blob: 741ac6ccf12d6cc9a0857af776acac8d5b5269c6 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * WPA Supplicant - Glue code to setup EAPOL and RSN modules
Dmitry Shmidt807291d2015-01-27 13:40:23 -08003 * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07004 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "includes.h"
10
11#include "common.h"
12#include "eapol_supp/eapol_supp_sm.h"
Dmitry Shmidt29333592017-01-09 12:27:11 -080013#include "eap_peer/eap.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070014#include "rsn_supp/wpa.h"
15#include "eloop.h"
16#include "config.h"
17#include "l2_packet/l2_packet.h"
18#include "common/wpa_common.h"
Hai Shalom60840252021-02-19 19:02:11 -080019#include "common/ptksa_cache.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070020#include "wpa_supplicant_i.h"
21#include "driver_i.h"
22#include "rsn_supp/pmksa_cache.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070023#include "sme.h"
24#include "common/ieee802_11_defs.h"
25#include "common/wpa_ctrl.h"
26#include "wpas_glue.h"
27#include "wps_supplicant.h"
28#include "bss.h"
29#include "scan.h"
Dmitry Shmidtc55524a2011-07-07 11:18:38 -070030#include "notify.h"
Dmitry Shmidt5a1480c2014-05-12 09:46:02 -070031#include "wpas_kay.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070032
33
34#ifndef CONFIG_NO_CONFIG_BLOBS
35#if defined(IEEE8021X_EAPOL) || !defined(CONFIG_NO_WPA)
36static void wpa_supplicant_set_config_blob(void *ctx,
37 struct wpa_config_blob *blob)
38{
39 struct wpa_supplicant *wpa_s = ctx;
40 wpa_config_set_blob(wpa_s->conf, blob);
41 if (wpa_s->conf->update_config) {
42 int ret = wpa_config_write(wpa_s->confname, wpa_s->conf);
43 if (ret) {
44 wpa_printf(MSG_DEBUG, "Failed to update config after "
45 "blob set");
46 }
47 }
48}
49
50
51static const struct wpa_config_blob *
52wpa_supplicant_get_config_blob(void *ctx, const char *name)
53{
54 struct wpa_supplicant *wpa_s = ctx;
55 return wpa_config_get_blob(wpa_s->conf, name);
56}
57#endif /* defined(IEEE8021X_EAPOL) || !defined(CONFIG_NO_WPA) */
58#endif /* CONFIG_NO_CONFIG_BLOBS */
59
60
61#if defined(IEEE8021X_EAPOL) || !defined(CONFIG_NO_WPA)
62static u8 * wpa_alloc_eapol(const struct wpa_supplicant *wpa_s, u8 type,
63 const void *data, u16 data_len,
64 size_t *msg_len, void **data_pos)
65{
66 struct ieee802_1x_hdr *hdr;
67
68 *msg_len = sizeof(*hdr) + data_len;
69 hdr = os_malloc(*msg_len);
70 if (hdr == NULL)
71 return NULL;
72
73 hdr->version = wpa_s->conf->eapol_version;
74 hdr->type = type;
75 hdr->length = host_to_be16(data_len);
76
77 if (data)
78 os_memcpy(hdr + 1, data, data_len);
79 else
80 os_memset(hdr + 1, 0, data_len);
81
82 if (data_pos)
83 *data_pos = hdr + 1;
84
85 return (u8 *) hdr;
86}
87
88
89/**
90 * wpa_ether_send - Send Ethernet frame
91 * @wpa_s: Pointer to wpa_supplicant data
92 * @dest: Destination MAC address
93 * @proto: Ethertype in host byte order
94 * @buf: Frame payload starting from IEEE 802.1X header
95 * @len: Frame payload length
96 * Returns: >=0 on success, <0 on failure
97 */
Hai Shalomc1a21442022-02-04 13:43:00 -080098int wpa_ether_send(struct wpa_supplicant *wpa_s, const u8 *dest,
99 u16 proto, const u8 *buf, size_t len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700100{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800101#ifdef CONFIG_TESTING_OPTIONS
102 if (wpa_s->ext_eapol_frame_io && proto == ETH_P_EAPOL) {
103 size_t hex_len = 2 * len + 1;
104 char *hex = os_malloc(hex_len);
105
106 if (hex == NULL)
107 return -1;
108 wpa_snprintf_hex(hex, hex_len, buf, len);
109 wpa_msg(wpa_s, MSG_INFO, "EAPOL-TX " MACSTR " %s",
110 MAC2STR(dest), hex);
111 os_free(hex);
112 return 0;
113 }
114#endif /* CONFIG_TESTING_OPTIONS */
115
Hai Shalomfdcde762020-04-02 11:19:20 -0700116 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_CONTROL_PORT) {
117 int encrypt = wpa_s->wpa &&
118 wpa_sm_has_ptk_installed(wpa_s->wpa);
119
120 return wpa_drv_tx_control_port(wpa_s, dest, proto, buf, len,
121 !encrypt);
122 }
123
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700124 if (wpa_s->l2) {
125 return l2_packet_send(wpa_s->l2, dest, proto, buf, len);
126 }
127
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800128 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700129}
130#endif /* IEEE8021X_EAPOL || !CONFIG_NO_WPA */
131
132
133#ifdef IEEE8021X_EAPOL
134
135/**
136 * wpa_supplicant_eapol_send - Send IEEE 802.1X EAPOL packet to Authenticator
137 * @ctx: Pointer to wpa_supplicant data (wpa_s)
138 * @type: IEEE 802.1X packet type (IEEE802_1X_TYPE_*)
139 * @buf: EAPOL payload (after IEEE 802.1X header)
140 * @len: EAPOL payload length
141 * Returns: >=0 on success, <0 on failure
142 *
143 * This function adds Ethernet and IEEE 802.1X header and sends the EAPOL frame
144 * to the current Authenticator.
145 */
146static int wpa_supplicant_eapol_send(void *ctx, int type, const u8 *buf,
147 size_t len)
148{
149 struct wpa_supplicant *wpa_s = ctx;
150 u8 *msg, *dst, bssid[ETH_ALEN];
Sunil Ravic0f5d412024-09-11 22:12:49 +0000151 struct driver_sta_mlo_info drv_mlo;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700152 size_t msglen;
153 int res;
154
155 /* TODO: could add l2_packet_sendmsg that allows fragments to avoid
156 * extra copy here */
157
158 if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700159 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE ||
160 wpa_s->key_mgmt == WPA_KEY_MGMT_DPP ||
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700161 wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
162 /* Current SSID is not using IEEE 802.1X/EAP, so drop possible
163 * EAPOL frames (mainly, EAPOL-Start) from EAPOL state
164 * machines. */
165 wpa_printf(MSG_DEBUG, "WPA: drop TX EAPOL in non-IEEE 802.1X "
166 "mode (type=%d len=%lu)", type,
167 (unsigned long) len);
168 return -1;
169 }
170
171 if (pmksa_cache_get_current(wpa_s->wpa) &&
172 type == IEEE802_1X_TYPE_EAPOL_START) {
Dmitry Shmidt661b4f72014-09-29 14:58:27 -0700173 /*
174 * We were trying to use PMKSA caching and sending EAPOL-Start
175 * would abort that and trigger full EAPOL authentication.
176 * However, we've already waited for the AP/Authenticator to
177 * start 4-way handshake or EAP authentication, and apparently
178 * it has not done so since the startWhen timer has reached zero
179 * to get the state machine sending EAPOL-Start. This is not
180 * really supposed to happen, but an interoperability issue with
181 * a deployed AP has been identified where the connection fails
182 * due to that AP failing to operate correctly if PMKID is
183 * included in the Association Request frame. To work around
184 * this, assume PMKSA caching failed and try to initiate full
185 * EAP authentication.
186 */
187 if (!wpa_s->current_ssid ||
188 wpa_s->current_ssid->eap_workaround) {
189 wpa_printf(MSG_DEBUG,
190 "RSN: Timeout on waiting for the AP to initiate 4-way handshake for PMKSA caching or EAP authentication - try to force it to start EAP authentication");
191 } else {
192 wpa_printf(MSG_DEBUG,
193 "RSN: PMKSA caching - do not send EAPOL-Start");
194 return -1;
195 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700196 }
197
198 if (is_zero_ether_addr(wpa_s->bssid)) {
199 wpa_printf(MSG_DEBUG, "BSSID not set when trying to send an "
200 "EAPOL frame");
Sunil Ravic0f5d412024-09-11 22:12:49 +0000201 os_memset(&drv_mlo, 0, sizeof(drv_mlo));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700202 if (wpa_drv_get_bssid(wpa_s, bssid) == 0 &&
Sunil Ravic0f5d412024-09-11 22:12:49 +0000203 (!wpa_s->valid_links ||
204 wpas_drv_get_sta_mlo_info(wpa_s, &drv_mlo) == 0) &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700205 !is_zero_ether_addr(bssid)) {
Sunil Ravic0f5d412024-09-11 22:12:49 +0000206 dst = drv_mlo.valid_links ? drv_mlo.ap_mld_addr : bssid;
207 wpa_printf(MSG_DEBUG, "Using current %s " MACSTR
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700208 " from the driver as the EAPOL destination",
Sunil Ravic0f5d412024-09-11 22:12:49 +0000209 drv_mlo.valid_links ? "AP MLD MAC address" :
210 "BSSID",
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700211 MAC2STR(dst));
212 } else {
213 dst = wpa_s->last_eapol_src;
214 wpa_printf(MSG_DEBUG, "Using the source address of the"
215 " last received EAPOL frame " MACSTR " as "
216 "the EAPOL destination",
217 MAC2STR(dst));
218 }
219 } else {
Sunil Ravic0f5d412024-09-11 22:12:49 +0000220 /* BSSID was already set (from (Re)Assoc event, so use BSSID or
221 * AP MLD MAC address (in the case of MLO connection) as the
222 * EAPOL destination. */
223 dst = wpa_s->valid_links ? wpa_s->ap_mld_addr : wpa_s->bssid;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700224 }
225
226 msg = wpa_alloc_eapol(wpa_s, type, buf, len, &msglen, NULL);
227 if (msg == NULL)
228 return -1;
229
230 wpa_printf(MSG_DEBUG, "TX EAPOL: dst=" MACSTR, MAC2STR(dst));
231 wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", msg, msglen);
232 res = wpa_ether_send(wpa_s, dst, ETH_P_EAPOL, msg, msglen);
233 os_free(msg);
234 return res;
235}
236
237
Hai Shalomfdcde762020-04-02 11:19:20 -0700238#ifdef CONFIG_WEP
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700239/**
240 * wpa_eapol_set_wep_key - set WEP key for the driver
241 * @ctx: Pointer to wpa_supplicant data (wpa_s)
242 * @unicast: 1 = individual unicast key, 0 = broadcast key
243 * @keyidx: WEP key index (0..3)
244 * @key: Pointer to key data
245 * @keylen: Key length in bytes
246 * Returns: 0 on success or < 0 on error.
247 */
248static int wpa_eapol_set_wep_key(void *ctx, int unicast, int keyidx,
249 const u8 *key, size_t keylen)
250{
251 struct wpa_supplicant *wpa_s = ctx;
252 if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
253 int cipher = (keylen == 5) ? WPA_CIPHER_WEP40 :
254 WPA_CIPHER_WEP104;
255 if (unicast)
256 wpa_s->pairwise_cipher = cipher;
257 else
258 wpa_s->group_cipher = cipher;
259 }
Sunil Ravi77d572f2023-01-17 23:58:31 +0000260 return wpa_drv_set_key(wpa_s, -1, WPA_ALG_WEP,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700261 unicast ? wpa_s->bssid : NULL,
Hai Shalomfdcde762020-04-02 11:19:20 -0700262 keyidx, unicast, NULL, 0, key, keylen,
263 unicast ? KEY_FLAG_PAIRWISE_RX_TX :
264 KEY_FLAG_GROUP_RX_TX_DEFAULT);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700265}
Hai Shalomfdcde762020-04-02 11:19:20 -0700266#endif /* CONFIG_WEP */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700267
268
269static void wpa_supplicant_aborted_cached(void *ctx)
270{
271 struct wpa_supplicant *wpa_s = ctx;
272 wpa_sm_aborted_cached(wpa_s->wpa);
273}
274
275
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800276static const char * result_str(enum eapol_supp_result result)
277{
278 switch (result) {
279 case EAPOL_SUPP_RESULT_FAILURE:
280 return "FAILURE";
281 case EAPOL_SUPP_RESULT_SUCCESS:
282 return "SUCCESS";
283 case EAPOL_SUPP_RESULT_EXPECTED_FAILURE:
284 return "EXPECTED_FAILURE";
285 }
286 return "?";
287}
288
289
290static void wpa_supplicant_eapol_cb(struct eapol_sm *eapol,
291 enum eapol_supp_result result,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700292 void *ctx)
293{
294 struct wpa_supplicant *wpa_s = ctx;
295 int res, pmk_len;
Vinayak Yadawadf49b1692022-06-16 16:39:46 +0530296 u8 pmk[PMK_LEN_MAX];
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700297
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800298 wpa_printf(MSG_DEBUG, "EAPOL authentication completed - result=%s",
299 result_str(result));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700300
301 if (wpas_wps_eapol_cb(wpa_s) > 0)
302 return;
303
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800304 wpa_s->eap_expected_failure = result ==
305 EAPOL_SUPP_RESULT_EXPECTED_FAILURE;
306
307 if (result != EAPOL_SUPP_RESULT_SUCCESS) {
Sunil Ravia04bd252022-05-02 22:54:18 -0700308 int timeout = 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700309 /*
310 * Make sure we do not get stuck here waiting for long EAPOL
311 * timeout if the AP does not disconnect in case of
312 * authentication failure.
313 */
Sunil Ravia04bd252022-05-02 22:54:18 -0700314 if (wpa_s->eapol_failed) {
315 wpa_printf(MSG_DEBUG,
316 "EAPOL authentication failed again and AP did not disconnect us");
317 timeout = 0;
318 }
319 wpa_s->eapol_failed = 1;
320 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
Dmitry Shmidt5a1480c2014-05-12 09:46:02 -0700321 } else {
Sunil Ravia04bd252022-05-02 22:54:18 -0700322 wpa_s->eapol_failed = 0;
Dmitry Shmidt5a1480c2014-05-12 09:46:02 -0700323 ieee802_1x_notify_create_actor(wpa_s, wpa_s->last_eapol_src);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700324 }
325
Andy Kuoaba17c12022-04-14 16:05:31 +0800326#if defined(CONFIG_DRIVER_NL80211_BRCM) || defined(CONFIG_DRIVER_NL80211_SYNA)
Mir Alieaaf04e2021-06-07 12:17:29 +0530327 if (result != EAPOL_SUPP_RESULT_SUCCESS)
328#else
329 if (result != EAPOL_SUPP_RESULT_SUCCESS ||
330 !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X))
Andy Kuoaba17c12022-04-14 16:05:31 +0800331#endif /* CONFIG_DRIVER_NL80211_BRCM || CONFIG_DRIVER_NL80211_SYNA */
Mir Alieaaf04e2021-06-07 12:17:29 +0530332 return;
333
Andy Kuoaba17c12022-04-14 16:05:31 +0800334#if defined(CONFIG_DRIVER_NL80211_BRCM) || defined(CONFIG_DRIVER_NL80211_SYNA)
Mir Alieaaf04e2021-06-07 12:17:29 +0530335 if (wpa_ft_is_ft_protocol(wpa_s->wpa)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700336 return;
Mir Alieaaf04e2021-06-07 12:17:29 +0530337 }
Andy Kuoaba17c12022-04-14 16:05:31 +0800338#endif /* CONFIG_DRIVER_NL80211_BRCM || CONFIG_DRIVER_NL80211_SYNA */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700339
340 if (!wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt))
341 return;
342
343 wpa_printf(MSG_DEBUG, "Configure PMK for driver-based RSN 4-way "
344 "handshake");
345
Vinayak Yadawadf49b1692022-06-16 16:39:46 +0530346 if (wpa_key_mgmt_sha384(wpa_s->key_mgmt))
347 pmk_len = PMK_LEN_SUITE_B_192;
348 else
349 pmk_len = PMK_LEN;
350
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700351 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
352#ifdef CONFIG_IEEE80211R
353 u8 buf[2 * PMK_LEN];
354 wpa_printf(MSG_DEBUG, "RSN: Use FT XXKey as PMK for "
355 "driver-based 4-way hs and FT");
356 res = eapol_sm_get_key(eapol, buf, 2 * PMK_LEN);
357 if (res == 0) {
358 os_memcpy(pmk, buf + PMK_LEN, PMK_LEN);
359 os_memset(buf, 0, sizeof(buf));
360 }
361#else /* CONFIG_IEEE80211R */
362 res = -1;
363#endif /* CONFIG_IEEE80211R */
364 } else {
Vinayak Yadawadf49b1692022-06-16 16:39:46 +0530365 res = eapol_sm_get_key(eapol, pmk, pmk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700366 if (res) {
367 /*
368 * EAP-LEAP is an exception from other EAP methods: it
369 * uses only 16-byte PMK.
370 */
371 res = eapol_sm_get_key(eapol, pmk, 16);
372 pmk_len = 16;
373 }
374 }
375
376 if (res) {
377 wpa_printf(MSG_DEBUG, "Failed to get PMK from EAPOL state "
378 "machines");
379 return;
380 }
381
382 wpa_hexdump_key(MSG_DEBUG, "RSN: Configure PMK for driver-based 4-way "
383 "handshake", pmk, pmk_len);
384
Sunil Ravi77d572f2023-01-17 23:58:31 +0000385 if (wpa_drv_set_key(wpa_s, -1, 0, NULL, 0, 0, NULL, 0, pmk,
Hai Shalomfdcde762020-04-02 11:19:20 -0700386 pmk_len, KEY_FLAG_PMK)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700387 wpa_printf(MSG_DEBUG, "Failed to set PMK to the driver");
388 }
389
Dennis Jeon67e32ea2023-11-21 08:49:36 -0500390 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) {
391 /* Add PMKSA cache entry */
392 wpa_printf(MSG_INFO, "add pmksa entry for the PMK");
393 wpa_sm_set_pmk(wpa_s->wpa, pmk, pmk_len, NULL, wpa_sm_get_auth_addr(wpa_s->wpa));
394 }
395
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700396 wpa_supplicant_cancel_scan(wpa_s);
397 wpa_supplicant_cancel_auth_timeout(wpa_s);
398 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
399
400}
401
402
403static void wpa_supplicant_notify_eapol_done(void *ctx)
404{
405 struct wpa_supplicant *wpa_s = ctx;
406 wpa_msg(wpa_s, MSG_DEBUG, "WPA: EAPOL processing complete");
407 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
408 wpa_supplicant_set_state(wpa_s, WPA_4WAY_HANDSHAKE);
409 } else {
410 wpa_supplicant_cancel_auth_timeout(wpa_s);
411 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
412 }
413}
414
415#endif /* IEEE8021X_EAPOL */
416
417
418#ifndef CONFIG_NO_WPA
419
420static int wpa_get_beacon_ie(struct wpa_supplicant *wpa_s)
421{
422 int ret = 0;
423 struct wpa_bss *curr = NULL, *bss;
424 struct wpa_ssid *ssid = wpa_s->current_ssid;
425 const u8 *ie;
426
427 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000428 if (!ether_addr_equal(bss->bssid, wpa_s->bssid))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700429 continue;
430 if (ssid == NULL ||
431 ((bss->ssid_len == ssid->ssid_len &&
432 os_memcmp(bss->ssid, ssid->ssid, ssid->ssid_len) == 0) ||
433 ssid->ssid_len == 0)) {
434 curr = bss;
435 break;
436 }
Hai Shalomfdcde762020-04-02 11:19:20 -0700437#ifdef CONFIG_OWE
438 if (ssid && (ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
439 (bss->flags & WPA_BSS_OWE_TRANSITION)) {
440 curr = bss;
441 break;
442 }
443#endif /* CONFIG_OWE */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700444 }
445
446 if (curr) {
447 ie = wpa_bss_get_vendor_ie(curr, WPA_IE_VENDOR_TYPE);
448 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0))
449 ret = -1;
450
Sunil Ravic0f5d412024-09-11 22:12:49 +0000451 ie = wpa_bss_get_ie(curr, WLAN_EID_RSN);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700452 if (wpa_sm_set_ap_rsn_ie(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0))
453 ret = -1;
Hai Shalomc3565922019-10-28 11:58:20 -0700454
Sunil Ravic0f5d412024-09-11 22:12:49 +0000455 ie = wpa_bss_get_ie(curr, WLAN_EID_RSNX);
Hai Shalomc3565922019-10-28 11:58:20 -0700456 if (wpa_sm_set_ap_rsnxe(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0))
457 ret = -1;
Sunil Ravic0f5d412024-09-11 22:12:49 +0000458
459 ie = wpa_bss_get_vendor_ie(curr, RSNE_OVERRIDE_IE_VENDOR_TYPE);
460 if (wpa_sm_set_ap_rsne_override(wpa_s->wpa, ie,
461 ie ? 2 + ie[1] : 0))
462 ret = -1;
463
464 ie = wpa_bss_get_vendor_ie(curr,
465 RSNE_OVERRIDE_2_IE_VENDOR_TYPE);
466 if (wpa_sm_set_ap_rsne_override_2(wpa_s->wpa, ie,
467 ie ? 2 + ie[1] : 0))
468 ret = -1;
469
470 ie = wpa_bss_get_vendor_ie(curr, RSNXE_OVERRIDE_IE_VENDOR_TYPE);
471 if (wpa_sm_set_ap_rsnxe_override(wpa_s->wpa, ie,
472 ie ? 2 + ie[1] : 0))
473 ret = -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700474 } else {
475 ret = -1;
476 }
477
478 return ret;
479}
480
481
482static int wpa_supplicant_get_beacon_ie(void *ctx)
483{
484 struct wpa_supplicant *wpa_s = ctx;
485 if (wpa_get_beacon_ie(wpa_s) == 0) {
486 return 0;
487 }
488
489 /* No WPA/RSN IE found in the cached scan results. Try to get updated
490 * scan results from the driver. */
Sunil Ravi99c035e2024-07-12 01:42:03 +0000491 if (wpa_supplicant_update_scan_results(wpa_s, wpa_s->bssid) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700492 return -1;
493
494 return wpa_get_beacon_ie(wpa_s);
495}
496
497
498static u8 * _wpa_alloc_eapol(void *wpa_s, u8 type,
499 const void *data, u16 data_len,
500 size_t *msg_len, void **data_pos)
501{
502 return wpa_alloc_eapol(wpa_s, type, data, data_len, msg_len, data_pos);
503}
504
505
506static int _wpa_ether_send(void *wpa_s, const u8 *dest, u16 proto,
507 const u8 *buf, size_t len)
508{
509 return wpa_ether_send(wpa_s, dest, proto, buf, len);
510}
511
512
513static void _wpa_supplicant_cancel_auth_timeout(void *wpa_s)
514{
515 wpa_supplicant_cancel_auth_timeout(wpa_s);
516}
517
518
519static void _wpa_supplicant_set_state(void *wpa_s, enum wpa_states state)
520{
521 wpa_supplicant_set_state(wpa_s, state);
522}
523
524
525/**
526 * wpa_supplicant_get_state - Get the connection state
527 * @wpa_s: Pointer to wpa_supplicant data
528 * Returns: The current connection state (WPA_*)
529 */
530static enum wpa_states wpa_supplicant_get_state(struct wpa_supplicant *wpa_s)
531{
532 return wpa_s->wpa_state;
533}
534
535
536static enum wpa_states _wpa_supplicant_get_state(void *wpa_s)
537{
538 return wpa_supplicant_get_state(wpa_s);
539}
540
541
Hai Shalom81f62d82019-07-22 12:10:00 -0700542static void _wpa_supplicant_deauthenticate(void *wpa_s, u16 reason_code)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700543{
544 wpa_supplicant_deauthenticate(wpa_s, reason_code);
545 /* Schedule a scan to make sure we continue looking for networks */
546 wpa_supplicant_req_scan(wpa_s, 5, 0);
547}
548
549
Hai Shalomfdcde762020-04-02 11:19:20 -0700550static void _wpa_supplicant_reconnect(void *wpa_s)
551{
552 wpa_supplicant_reconnect(wpa_s);
553}
554
555
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700556static void * wpa_supplicant_get_network_ctx(void *wpa_s)
557{
558 return wpa_supplicant_get_ssid(wpa_s);
559}
560
561
562static int wpa_supplicant_get_bssid(void *ctx, u8 *bssid)
563{
564 struct wpa_supplicant *wpa_s = ctx;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700565 return wpa_drv_get_bssid(wpa_s, bssid);
566}
567
568
Sunil Ravi77d572f2023-01-17 23:58:31 +0000569static int wpa_supplicant_set_key(void *_wpa_s, int link_id, enum wpa_alg alg,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700570 const u8 *addr, int key_idx, int set_tx,
571 const u8 *seq, size_t seq_len,
Hai Shalomfdcde762020-04-02 11:19:20 -0700572 const u8 *key, size_t key_len,
573 enum key_flag key_flag)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700574{
575 struct wpa_supplicant *wpa_s = _wpa_s;
Sunil Ravi7f769292024-07-23 22:21:32 +0000576 int ret;
577
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700578 if (alg == WPA_ALG_TKIP && key_idx == 0 && key_len == 32) {
579 /* Clear the MIC error counter when setting a new PTK. */
580 wpa_s->mic_errors_seen = 0;
581 }
Dmitry Shmidtb6e9aaf2013-05-20 14:49:44 -0700582#ifdef CONFIG_TESTING_GET_GTK
583 if (key_idx > 0 && addr && is_broadcast_ether_addr(addr) &&
584 alg != WPA_ALG_NONE && key_len <= sizeof(wpa_s->last_gtk)) {
585 os_memcpy(wpa_s->last_gtk, key, key_len);
586 wpa_s->last_gtk_len = key_len;
587 }
588#endif /* CONFIG_TESTING_GET_GTK */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700589#ifdef CONFIG_TESTING_OPTIONS
Hai Shalomfdcde762020-04-02 11:19:20 -0700590 if (addr && !is_broadcast_ether_addr(addr) &&
591 !(key_flag & KEY_FLAG_MODIFY)) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700592 wpa_s->last_tk_alg = alg;
593 os_memcpy(wpa_s->last_tk_addr, addr, ETH_ALEN);
594 wpa_s->last_tk_key_idx = key_idx;
595 if (key)
596 os_memcpy(wpa_s->last_tk, key, key_len);
597 wpa_s->last_tk_len = key_len;
598 }
599#endif /* CONFIG_TESTING_OPTIONS */
Sunil Ravi7f769292024-07-23 22:21:32 +0000600
601 ret = wpa_drv_set_key(wpa_s, link_id, alg, addr, key_idx, set_tx, seq,
602 seq_len, key, key_len, key_flag);
603 if (ret == 0 && (key_idx == 6 || key_idx == 7) &&
604 alg != WPA_ALG_NONE && key_len > 0)
605 wpa_s->bigtk_set = true;
606
607 return ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700608}
609
610
611static int wpa_supplicant_mlme_setprotection(void *wpa_s, const u8 *addr,
612 int protection_type,
613 int key_type)
614{
615 return wpa_drv_mlme_setprotection(wpa_s, addr, protection_type,
616 key_type);
617}
618
619
Dmitry Shmidt29333592017-01-09 12:27:11 -0800620static struct wpa_ssid * wpas_get_network_ctx(struct wpa_supplicant *wpa_s,
621 void *network_ctx)
622{
623 struct wpa_ssid *ssid;
624
625 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
626 if (network_ctx == ssid)
627 return ssid;
628 }
629
630 return NULL;
631}
632
633
634static int wpa_supplicant_add_pmkid(void *_wpa_s, void *network_ctx,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700635 const u8 *bssid, const u8 *pmkid,
636 const u8 *fils_cache_id,
Hai Shalomfdcde762020-04-02 11:19:20 -0700637 const u8 *pmk, size_t pmk_len,
Hai Shalom899fcc72020-10-19 14:38:18 -0700638 u32 pmk_lifetime, u8 pmk_reauth_threshold,
639 int akmp)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700640{
Dmitry Shmidt29333592017-01-09 12:27:11 -0800641 struct wpa_supplicant *wpa_s = _wpa_s;
642 struct wpa_ssid *ssid;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700643 struct wpa_pmkid_params params;
Dmitry Shmidt29333592017-01-09 12:27:11 -0800644
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700645 os_memset(&params, 0, sizeof(params));
Dmitry Shmidt29333592017-01-09 12:27:11 -0800646 ssid = wpas_get_network_ctx(wpa_s, network_ctx);
Hai Shalom899fcc72020-10-19 14:38:18 -0700647 if (ssid) {
Dmitry Shmidt29333592017-01-09 12:27:11 -0800648 wpa_msg(wpa_s, MSG_INFO, PMKSA_CACHE_ADDED MACSTR " %d",
649 MAC2STR(bssid), ssid->id);
Hai Shalom899fcc72020-10-19 14:38:18 -0700650 if ((akmp == WPA_KEY_MGMT_FT_IEEE8021X ||
651 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384) &&
652 !ssid->ft_eap_pmksa_caching) {
653 /* Since we will not be using PMKSA caching for FT-EAP
654 * within wpa_supplicant to avoid known interop issues
655 * with APs, do not add this PMKID to the driver either
656 * so that we won't be hitting those interop issues
657 * with driver-based RSNE generation. */
658 wpa_printf(MSG_DEBUG,
659 "FT: Do not add PMKID entry to the driver since FT-EAP PMKSA caching is not enabled in configuration");
660 return 0;
661 }
662 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700663 if (ssid && fils_cache_id) {
664 params.ssid = ssid->ssid;
665 params.ssid_len = ssid->ssid_len;
666 params.fils_cache_id = fils_cache_id;
667 } else {
668 params.bssid = bssid;
669 }
670
671 params.pmkid = pmkid;
672 params.pmk = pmk;
673 params.pmk_len = pmk_len;
Hai Shalomfdcde762020-04-02 11:19:20 -0700674 params.pmk_lifetime = pmk_lifetime;
675 params.pmk_reauth_threshold = pmk_reauth_threshold;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700676
677 return wpa_drv_add_pmkid(wpa_s, &params);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700678}
679
680
Dmitry Shmidt29333592017-01-09 12:27:11 -0800681static int wpa_supplicant_remove_pmkid(void *_wpa_s, void *network_ctx,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700682 const u8 *bssid, const u8 *pmkid,
683 const u8 *fils_cache_id)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700684{
Dmitry Shmidt29333592017-01-09 12:27:11 -0800685 struct wpa_supplicant *wpa_s = _wpa_s;
686 struct wpa_ssid *ssid;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700687 struct wpa_pmkid_params params;
Dmitry Shmidt29333592017-01-09 12:27:11 -0800688
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700689 os_memset(&params, 0, sizeof(params));
Dmitry Shmidt29333592017-01-09 12:27:11 -0800690 ssid = wpas_get_network_ctx(wpa_s, network_ctx);
691 if (ssid)
692 wpa_msg(wpa_s, MSG_INFO, PMKSA_CACHE_REMOVED MACSTR " %d",
693 MAC2STR(bssid), ssid->id);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700694 if (ssid && fils_cache_id) {
695 params.ssid = ssid->ssid;
696 params.ssid_len = ssid->ssid_len;
697 params.fils_cache_id = fils_cache_id;
698 } else {
699 params.bssid = bssid;
700 }
701
702 params.pmkid = pmkid;
703
704 return wpa_drv_remove_pmkid(wpa_s, &params);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700705}
706
707
708#ifdef CONFIG_IEEE80211R
709static int wpa_supplicant_update_ft_ies(void *ctx, const u8 *md,
710 const u8 *ies, size_t ies_len)
711{
712 struct wpa_supplicant *wpa_s = ctx;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700713 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
714 return sme_update_ft_ies(wpa_s, md, ies, ies_len);
715 return wpa_drv_update_ft_ies(wpa_s, md, ies, ies_len);
716}
717
718
719static int wpa_supplicant_send_ft_action(void *ctx, u8 action,
720 const u8 *target_ap,
721 const u8 *ies, size_t ies_len)
722{
723 struct wpa_supplicant *wpa_s = ctx;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800724 int ret;
725 u8 *data, *pos;
726 size_t data_len;
727
728 if (action != 1) {
729 wpa_printf(MSG_ERROR, "Unsupported send_ft_action action %d",
730 action);
731 return -1;
732 }
733
734 /*
735 * Action frame payload:
736 * Category[1] = 6 (Fast BSS Transition)
737 * Action[1] = 1 (Fast BSS Transition Request)
738 * STA Address
739 * Target AP Address
740 * FT IEs
741 */
742
743 data_len = 2 + 2 * ETH_ALEN + ies_len;
744 data = os_malloc(data_len);
745 if (data == NULL)
746 return -1;
747 pos = data;
748 *pos++ = 0x06; /* FT Action category */
749 *pos++ = action;
750 os_memcpy(pos, wpa_s->own_addr, ETH_ALEN);
751 pos += ETH_ALEN;
752 os_memcpy(pos, target_ap, ETH_ALEN);
753 pos += ETH_ALEN;
754 os_memcpy(pos, ies, ies_len);
755
756 ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0,
757 wpa_s->bssid, wpa_s->own_addr, wpa_s->bssid,
758 data, data_len, 0);
759 os_free(data);
760
761 return ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700762}
763
764
765static int wpa_supplicant_mark_authenticated(void *ctx, const u8 *target_ap)
766{
767 struct wpa_supplicant *wpa_s = ctx;
768 struct wpa_driver_auth_params params;
769 struct wpa_bss *bss;
770
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700771 bss = wpa_bss_get_bssid(wpa_s, target_ap);
772 if (bss == NULL)
773 return -1;
774
775 os_memset(&params, 0, sizeof(params));
776 params.bssid = target_ap;
777 params.freq = bss->freq;
778 params.ssid = bss->ssid;
779 params.ssid_len = bss->ssid_len;
780 params.auth_alg = WPA_AUTH_ALG_FT;
781 params.local_state_change = 1;
782 return wpa_drv_authenticate(wpa_s, &params);
783}
784#endif /* CONFIG_IEEE80211R */
785
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700786
787#ifdef CONFIG_TDLS
788
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800789static int wpa_supplicant_tdls_get_capa(void *ctx, int *tdls_supported,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800790 int *tdls_ext_setup,
791 int *tdls_chan_switch)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800792{
793 struct wpa_supplicant *wpa_s = ctx;
794
795 *tdls_supported = 0;
796 *tdls_ext_setup = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800797 *tdls_chan_switch = 0;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800798
799 if (!wpa_s->drv_capa_known)
800 return -1;
801
802 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)
803 *tdls_supported = 1;
804
805 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP)
806 *tdls_ext_setup = 1;
807
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800808 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH)
809 *tdls_chan_switch = 1;
810
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800811 return 0;
812}
813
814
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700815static int wpa_supplicant_send_tdls_mgmt(void *ctx, const u8 *dst,
816 u8 action_code, u8 dialog_token,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700817 u16 status_code, u32 peer_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700818 int initiator, const u8 *buf,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000819 size_t len, int link_id)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700820{
821 struct wpa_supplicant *wpa_s = ctx;
822 return wpa_drv_send_tdls_mgmt(wpa_s, dst, action_code, dialog_token,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700823 status_code, peer_capab, initiator, buf,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000824 len, link_id);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700825}
826
827
828static int wpa_supplicant_tdls_oper(void *ctx, int oper, const u8 *peer)
829{
830 struct wpa_supplicant *wpa_s = ctx;
831 return wpa_drv_tdls_oper(wpa_s, oper, peer);
832}
833
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800834
835static int wpa_supplicant_tdls_peer_addset(
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700836 void *ctx, const u8 *peer, int add, u16 aid, u16 capability,
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800837 const u8 *supp_rates, size_t supp_rates_len,
838 const struct ieee80211_ht_capabilities *ht_capab,
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800839 const struct ieee80211_vht_capabilities *vht_capab,
Hai Shalomc1a21442022-02-04 13:43:00 -0800840 const struct ieee80211_he_capabilities *he_capab,
841 size_t he_capab_len,
842 const struct ieee80211_he_6ghz_band_cap *he_6ghz_he_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700843 u8 qosinfo, int wmm, const u8 *ext_capab, size_t ext_capab_len,
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800844 const u8 *supp_channels, size_t supp_channels_len,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000845 const u8 *supp_oper_classes, size_t supp_oper_classes_len,
846 const struct ieee80211_eht_capabilities *eht_capab,
847 size_t eht_capab_len, int mld_link_id)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800848{
849 struct wpa_supplicant *wpa_s = ctx;
850 struct hostapd_sta_add_params params;
851
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800852 os_memset(&params, 0, sizeof(params));
853
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800854 params.addr = peer;
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700855 params.aid = aid;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800856 params.capability = capability;
857 params.flags = WPA_STA_TDLS_PEER | WPA_STA_AUTHORIZED;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800858
859 /*
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700860 * Don't rely only on qosinfo for WMM capability. It may be 0 even when
861 * present. Allow the WMM IE to also indicate QoS support.
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800862 */
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700863 if (wmm || qosinfo)
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800864 params.flags |= WPA_STA_WMM;
865
866 params.ht_capabilities = ht_capab;
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800867 params.vht_capabilities = vht_capab;
Hai Shalomc1a21442022-02-04 13:43:00 -0800868 params.he_capab = he_capab;
869 params.he_capab_len = he_capab_len;
870 params.he_6ghz_capab = he_6ghz_he_capab;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800871 params.qosinfo = qosinfo;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800872 params.listen_interval = 0;
873 params.supp_rates = supp_rates;
874 params.supp_rates_len = supp_rates_len;
875 params.set = !add;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800876 params.ext_capab = ext_capab;
877 params.ext_capab_len = ext_capab_len;
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800878 params.supp_channels = supp_channels;
879 params.supp_channels_len = supp_channels_len;
880 params.supp_oper_classes = supp_oper_classes;
881 params.supp_oper_classes_len = supp_oper_classes_len;
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000882 params.eht_capab = eht_capab;
883 params.eht_capab_len = eht_capab_len;
884 params.mld_link_id = mld_link_id;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800885
886 return wpa_drv_sta_add(wpa_s, &params);
887}
888
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800889
890static int wpa_supplicant_tdls_enable_channel_switch(
891 void *ctx, const u8 *addr, u8 oper_class,
892 const struct hostapd_freq_params *params)
893{
894 struct wpa_supplicant *wpa_s = ctx;
895
896 return wpa_drv_tdls_enable_channel_switch(wpa_s, addr, oper_class,
897 params);
898}
899
900
901static int wpa_supplicant_tdls_disable_channel_switch(void *ctx, const u8 *addr)
902{
903 struct wpa_supplicant *wpa_s = ctx;
904
905 return wpa_drv_tdls_disable_channel_switch(wpa_s, addr);
906}
907
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700908#endif /* CONFIG_TDLS */
909
Dmitry Shmidt34af3062013-07-11 10:46:32 -0700910#endif /* CONFIG_NO_WPA */
911
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700912
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800913enum wpa_ctrl_req_type wpa_supplicant_ctrl_req_from_string(const char *field)
914{
915 if (os_strcmp(field, "IDENTITY") == 0)
916 return WPA_CTRL_REQ_EAP_IDENTITY;
917 else if (os_strcmp(field, "PASSWORD") == 0)
918 return WPA_CTRL_REQ_EAP_PASSWORD;
919 else if (os_strcmp(field, "NEW_PASSWORD") == 0)
920 return WPA_CTRL_REQ_EAP_NEW_PASSWORD;
921 else if (os_strcmp(field, "PIN") == 0)
922 return WPA_CTRL_REQ_EAP_PIN;
923 else if (os_strcmp(field, "OTP") == 0)
924 return WPA_CTRL_REQ_EAP_OTP;
925 else if (os_strcmp(field, "PASSPHRASE") == 0)
926 return WPA_CTRL_REQ_EAP_PASSPHRASE;
Dmitry Shmidt051af732013-10-22 13:52:46 -0700927 else if (os_strcmp(field, "SIM") == 0)
928 return WPA_CTRL_REQ_SIM;
Dmitry Shmidt912c6ec2015-03-30 13:16:51 -0700929 else if (os_strcmp(field, "PSK_PASSPHRASE") == 0)
930 return WPA_CTRL_REQ_PSK_PASSPHRASE;
Dmitry Shmidt1b467752015-12-14 12:45:46 -0800931 else if (os_strcmp(field, "EXT_CERT_CHECK") == 0)
932 return WPA_CTRL_REQ_EXT_CERT_CHECK;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800933 return WPA_CTRL_REQ_UNKNOWN;
934}
935
936
937const char * wpa_supplicant_ctrl_req_to_string(enum wpa_ctrl_req_type field,
938 const char *default_txt,
939 const char **txt)
940{
941 const char *ret = NULL;
942
943 *txt = default_txt;
944
945 switch (field) {
946 case WPA_CTRL_REQ_EAP_IDENTITY:
947 *txt = "Identity";
948 ret = "IDENTITY";
949 break;
950 case WPA_CTRL_REQ_EAP_PASSWORD:
951 *txt = "Password";
952 ret = "PASSWORD";
953 break;
954 case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
955 *txt = "New Password";
956 ret = "NEW_PASSWORD";
957 break;
958 case WPA_CTRL_REQ_EAP_PIN:
959 *txt = "PIN";
960 ret = "PIN";
961 break;
962 case WPA_CTRL_REQ_EAP_OTP:
963 ret = "OTP";
964 break;
965 case WPA_CTRL_REQ_EAP_PASSPHRASE:
966 *txt = "Private key passphrase";
967 ret = "PASSPHRASE";
968 break;
Dmitry Shmidt051af732013-10-22 13:52:46 -0700969 case WPA_CTRL_REQ_SIM:
970 ret = "SIM";
971 break;
Dmitry Shmidt912c6ec2015-03-30 13:16:51 -0700972 case WPA_CTRL_REQ_PSK_PASSPHRASE:
973 *txt = "PSK or passphrase";
974 ret = "PSK_PASSPHRASE";
975 break;
Dmitry Shmidt1b467752015-12-14 12:45:46 -0800976 case WPA_CTRL_REQ_EXT_CERT_CHECK:
977 *txt = "External server certificate validation";
978 ret = "EXT_CERT_CHECK";
979 break;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800980 default:
981 break;
982 }
983
984 /* txt needs to be something */
985 if (*txt == NULL) {
986 wpa_printf(MSG_WARNING, "No message for request %d", field);
987 ret = NULL;
988 }
989
990 return ret;
991}
992
Dmitry Shmidt912c6ec2015-03-30 13:16:51 -0700993
994void wpas_send_ctrl_req(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
995 const char *field_name, const char *txt)
996{
Sunil Ravi77d572f2023-01-17 23:58:31 +0000997 wpa_msg(wpa_s, MSG_INFO, WPA_CTRL_REQ "%s-%d:%s needed for SSID %s",
998 field_name, ssid->id, txt,
999 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
Dmitry Shmidt912c6ec2015-03-30 13:16:51 -07001000}
1001
1002
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001003#ifdef IEEE8021X_EAPOL
1004#if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001005static void wpa_supplicant_eap_param_needed(void *ctx,
1006 enum wpa_ctrl_req_type field,
1007 const char *default_txt)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001008{
1009 struct wpa_supplicant *wpa_s = ctx;
1010 struct wpa_ssid *ssid = wpa_s->current_ssid;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001011 const char *field_name, *txt = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001012
1013 if (ssid == NULL)
1014 return;
1015
Dmitry Shmidt1b467752015-12-14 12:45:46 -08001016 if (field == WPA_CTRL_REQ_EXT_CERT_CHECK)
1017 ssid->eap.pending_ext_cert_check = PENDING_CHECK;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001018 wpas_notify_network_request(wpa_s, ssid, field, default_txt);
1019
1020 field_name = wpa_supplicant_ctrl_req_to_string(field, default_txt,
1021 &txt);
1022 if (field_name == NULL) {
1023 wpa_printf(MSG_WARNING, "Unhandled EAP param %d needed",
1024 field);
1025 return;
1026 }
1027
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001028 wpas_notify_eap_status(wpa_s, "eap parameter needed", field_name);
1029
Dmitry Shmidt912c6ec2015-03-30 13:16:51 -07001030 wpas_send_ctrl_req(wpa_s, ssid, field_name, txt);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001031}
1032#else /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1033#define wpa_supplicant_eap_param_needed NULL
1034#endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
1035
1036
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001037#ifdef CONFIG_EAP_PROXY
Dmitry Shmidt29333592017-01-09 12:27:11 -08001038
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001039static void wpa_supplicant_eap_proxy_cb(void *ctx)
1040{
1041 struct wpa_supplicant *wpa_s = ctx;
1042 size_t len;
1043
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001044 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, -1,
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001045 wpa_s->imsi, &len);
1046 if (wpa_s->mnc_len > 0) {
1047 wpa_s->imsi[len] = '\0';
1048 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
1049 wpa_s->imsi, wpa_s->mnc_len);
1050 } else {
1051 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
1052 }
1053}
Dmitry Shmidt29333592017-01-09 12:27:11 -08001054
1055
1056static void wpa_sm_sim_state_error_handler(struct wpa_supplicant *wpa_s)
1057{
1058 int i;
1059 struct wpa_ssid *ssid;
1060 const struct eap_method_type *eap_methods;
1061
1062 if (!wpa_s->conf)
1063 return;
1064
1065 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1066 eap_methods = ssid->eap.eap_methods;
1067 if (!eap_methods)
1068 continue;
1069
1070 for (i = 0; eap_methods[i].method != EAP_TYPE_NONE; i++) {
1071 if (eap_methods[i].vendor == EAP_VENDOR_IETF &&
1072 (eap_methods[i].method == EAP_TYPE_SIM ||
1073 eap_methods[i].method == EAP_TYPE_AKA ||
1074 eap_methods[i].method == EAP_TYPE_AKA_PRIME)) {
1075 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1076 break;
1077 }
1078 }
1079 }
1080}
1081
1082
1083static void
1084wpa_supplicant_eap_proxy_notify_sim_status(void *ctx,
1085 enum eap_proxy_sim_state sim_state)
1086{
1087 struct wpa_supplicant *wpa_s = ctx;
1088
1089 wpa_printf(MSG_DEBUG, "eap_proxy: SIM card status %u", sim_state);
1090 switch (sim_state) {
1091 case SIM_STATE_ERROR:
1092 wpa_sm_sim_state_error_handler(wpa_s);
1093 break;
1094 default:
1095 wpa_printf(MSG_DEBUG, "eap_proxy: SIM card status unknown");
1096 break;
1097 }
1098}
1099
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001100#endif /* CONFIG_EAP_PROXY */
1101
1102
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001103static void wpa_supplicant_port_cb(void *ctx, int authorized)
1104{
1105 struct wpa_supplicant *wpa_s = ctx;
1106#ifdef CONFIG_AP
1107 if (wpa_s->ap_iface) {
1108 wpa_printf(MSG_DEBUG, "AP mode active - skip EAPOL Supplicant "
1109 "port status: %s",
1110 authorized ? "Authorized" : "Unauthorized");
1111 return;
1112 }
1113#endif /* CONFIG_AP */
1114 wpa_printf(MSG_DEBUG, "EAPOL: Supplicant port status: %s",
1115 authorized ? "Authorized" : "Unauthorized");
1116 wpa_drv_set_supp_port(wpa_s, authorized);
1117}
Dmitry Shmidtc55524a2011-07-07 11:18:38 -07001118
Steven Liu850c2e02022-11-28 17:26:39 +00001119static void wpa_supplicant_permanent_id_req_denied_cb(void *ctx)
1120{
1121 struct wpas_supplicant *wpa_s = ctx;
1122
1123 wpas_notify_permanent_id_req_denied(wpa_s);
1124}
Dmitry Shmidtc55524a2011-07-07 11:18:38 -07001125
Hai Shalom81f62d82019-07-22 12:10:00 -07001126static void wpa_supplicant_cert_cb(void *ctx, struct tls_cert_data *cert,
1127 const char *cert_hash)
Dmitry Shmidtc55524a2011-07-07 11:18:38 -07001128{
1129 struct wpa_supplicant *wpa_s = ctx;
1130
Hai Shalom81f62d82019-07-22 12:10:00 -07001131 wpas_notify_certification(wpa_s, cert, cert_hash);
Dmitry Shmidtc55524a2011-07-07 11:18:38 -07001132}
Dmitry Shmidt04949592012-07-19 12:16:46 -07001133
1134
1135static void wpa_supplicant_status_cb(void *ctx, const char *status,
1136 const char *parameter)
1137{
1138 struct wpa_supplicant *wpa_s = ctx;
1139
1140 wpas_notify_eap_status(wpa_s, status, parameter);
1141}
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07001142
Roshan Pius3a1667e2018-07-03 15:17:14 -07001143
Ahmed ElArabawy9c86a7f2018-03-15 09:00:10 -07001144static void wpa_supplicant_eap_error_cb(void *ctx, int error_code)
1145{
1146 struct wpa_supplicant *wpa_s = ctx;
1147
1148 wpas_notify_eap_error(wpa_s, error_code);
1149}
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07001150
Roshan Pius3a1667e2018-07-03 15:17:14 -07001151
Hai Shalomfdcde762020-04-02 11:19:20 -07001152static int wpa_supplicant_eap_auth_start_cb(void *ctx)
1153{
1154 struct wpa_supplicant *wpa_s = ctx;
1155
1156 if (!wpa_s->new_connection && wpa_s->deny_ptk0_rekey &&
1157 !wpa_sm_ext_key_id_active(wpa_s->wpa)) {
1158 wpa_msg(wpa_s, MSG_INFO,
1159 "WPA: PTK0 rekey not allowed, reconnecting");
1160 wpa_supplicant_reconnect(wpa_s);
1161 return -1;
1162 }
1163 return 0;
1164}
1165
1166
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07001167static void wpa_supplicant_set_anon_id(void *ctx, const u8 *id, size_t len)
1168{
1169 struct wpa_supplicant *wpa_s = ctx;
1170 char *str;
1171 int res;
1172
1173 wpa_hexdump_ascii(MSG_DEBUG, "EAP method updated anonymous_identity",
1174 id, len);
1175
1176 if (wpa_s->current_ssid == NULL)
1177 return;
1178
1179 if (id == NULL) {
1180 if (wpa_config_set(wpa_s->current_ssid, "anonymous_identity",
1181 "NULL", 0) < 0)
1182 return;
1183 } else {
1184 str = os_malloc(len * 2 + 1);
1185 if (str == NULL)
1186 return;
1187 wpa_snprintf_hex(str, len * 2 + 1, id, len);
1188 res = wpa_config_set(wpa_s->current_ssid, "anonymous_identity",
1189 str, 0);
1190 os_free(str);
1191 if (res < 0)
1192 return;
1193 }
1194
1195 if (wpa_s->conf->update_config) {
1196 res = wpa_config_write(wpa_s->confname, wpa_s->conf);
1197 if (res) {
1198 wpa_printf(MSG_DEBUG, "Failed to update config after "
1199 "anonymous_id update");
1200 }
1201 }
1202}
Gabriel Biren3a2ec2c2022-03-07 17:59:41 +00001203
1204static void wpa_supplicant_eap_method_selected_cb(void *ctx,
1205 const char* reason_string)
1206{
1207 struct wpa_supplicant *wpa_s = ctx;
1208
1209 wpas_notify_eap_method_selected(wpa_s, reason_string);
1210}
1211
1212static void wpa_supplicant_open_ssl_failure_cb(void *ctx,
1213 const char* reason_string)
1214{
1215 struct wpa_supplicant *wpa_s = ctx;
1216
1217 wpas_notify_open_ssl_failure(wpa_s, reason_string);
1218}
Sunil8cd6f4d2022-06-28 18:40:46 +00001219
1220static bool wpas_encryption_required(void *ctx)
1221{
1222 struct wpa_supplicant *wpa_s = ctx;
1223
1224 return wpa_s->wpa &&
1225 wpa_sm_has_ptk_installed(wpa_s->wpa) &&
1226 wpa_sm_pmf_enabled(wpa_s->wpa);
1227}
1228
Gabriel Biren93398232022-12-15 19:18:28 +00001229static ssize_t wpa_supplicant_get_certificate_cb(
1230 const char* alias, uint8_t** value)
1231{
Gabriel Biren980c48a2023-03-27 21:49:21 +00001232 wpa_printf(MSG_INFO, "wpa_supplicant_get_certificate_cb");
Gabriel Biren93398232022-12-15 19:18:28 +00001233 return wpas_get_certificate(alias, value);
1234}
1235
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001236#endif /* IEEE8021X_EAPOL */
1237
1238
1239int wpa_supplicant_init_eapol(struct wpa_supplicant *wpa_s)
1240{
1241#ifdef IEEE8021X_EAPOL
1242 struct eapol_ctx *ctx;
1243 ctx = os_zalloc(sizeof(*ctx));
1244 if (ctx == NULL) {
1245 wpa_printf(MSG_ERROR, "Failed to allocate EAPOL context.");
1246 return -1;
1247 }
1248
1249 ctx->ctx = wpa_s;
1250 ctx->msg_ctx = wpa_s;
1251 ctx->eapol_send_ctx = wpa_s;
1252 ctx->preauth = 0;
1253 ctx->eapol_done_cb = wpa_supplicant_notify_eapol_done;
1254 ctx->eapol_send = wpa_supplicant_eapol_send;
Hai Shalomfdcde762020-04-02 11:19:20 -07001255#ifdef CONFIG_WEP
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001256 ctx->set_wep_key = wpa_eapol_set_wep_key;
Hai Shalomfdcde762020-04-02 11:19:20 -07001257#endif /* CONFIG_WEP */
Dmitry Shmidt700a1372013-03-15 14:14:44 -07001258#ifndef CONFIG_NO_CONFIG_BLOBS
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001259 ctx->set_config_blob = wpa_supplicant_set_config_blob;
1260 ctx->get_config_blob = wpa_supplicant_get_config_blob;
Dmitry Shmidt700a1372013-03-15 14:14:44 -07001261#endif /* CONFIG_NO_CONFIG_BLOBS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001262 ctx->aborted_cached = wpa_supplicant_aborted_cached;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001263#ifndef CONFIG_OPENSC_ENGINE_PATH
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001264 ctx->opensc_engine_path = wpa_s->conf->opensc_engine_path;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001265#endif /* CONFIG_OPENSC_ENGINE_PATH */
1266#ifndef CONFIG_PKCS11_ENGINE_PATH
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001267 ctx->pkcs11_engine_path = wpa_s->conf->pkcs11_engine_path;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001268#endif /* CONFIG_PKCS11_ENGINE_PATH */
1269#ifndef CONFIG_PKCS11_MODULE_PATH
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001270 ctx->pkcs11_module_path = wpa_s->conf->pkcs11_module_path;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001271#endif /* CONFIG_PKCS11_MODULE_PATH */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001272 ctx->openssl_ciphers = wpa_s->conf->openssl_ciphers;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001273 ctx->wps = wpa_s->wps;
1274 ctx->eap_param_needed = wpa_supplicant_eap_param_needed;
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001275#ifdef CONFIG_EAP_PROXY
1276 ctx->eap_proxy_cb = wpa_supplicant_eap_proxy_cb;
Dmitry Shmidt29333592017-01-09 12:27:11 -08001277 ctx->eap_proxy_notify_sim_status =
1278 wpa_supplicant_eap_proxy_notify_sim_status;
Dmitry Shmidt203eadb2015-03-05 14:16:04 -08001279#endif /* CONFIG_EAP_PROXY */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001280 ctx->port_cb = wpa_supplicant_port_cb;
1281 ctx->cb = wpa_supplicant_eapol_cb;
Dmitry Shmidtc55524a2011-07-07 11:18:38 -07001282 ctx->cert_cb = wpa_supplicant_cert_cb;
Steven Liu850c2e02022-11-28 17:26:39 +00001283 ctx->permanent_id_req_denied_cb = wpa_supplicant_permanent_id_req_denied_cb;
Dmitry Shmidt2f74e362015-01-21 13:19:05 -08001284 ctx->cert_in_cb = wpa_s->conf->cert_in_cb;
Dmitry Shmidt04949592012-07-19 12:16:46 -07001285 ctx->status_cb = wpa_supplicant_status_cb;
Ahmed ElArabawy9c86a7f2018-03-15 09:00:10 -07001286 ctx->eap_error_cb = wpa_supplicant_eap_error_cb;
Hai Shalomfdcde762020-04-02 11:19:20 -07001287 ctx->confirm_auth_cb = wpa_supplicant_eap_auth_start_cb;
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07001288 ctx->set_anon_id = wpa_supplicant_set_anon_id;
Gabriel Biren3a2ec2c2022-03-07 17:59:41 +00001289 ctx->eap_method_selected_cb = wpa_supplicant_eap_method_selected_cb;
1290 ctx->open_ssl_failure_cb = wpa_supplicant_open_ssl_failure_cb;
Gabriel Biren93398232022-12-15 19:18:28 +00001291 ctx->get_certificate_cb = wpa_supplicant_get_certificate_cb;
Sunil8cd6f4d2022-06-28 18:40:46 +00001292 ctx->encryption_required = wpas_encryption_required;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001293 ctx->cb_ctx = wpa_s;
1294 wpa_s->eapol = eapol_sm_init(ctx);
1295 if (wpa_s->eapol == NULL) {
1296 os_free(ctx);
1297 wpa_printf(MSG_ERROR, "Failed to initialize EAPOL state "
1298 "machines.");
1299 return -1;
1300 }
1301#endif /* IEEE8021X_EAPOL */
1302
1303 return 0;
1304}
1305
1306
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001307#ifndef CONFIG_NO_WPA
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001308
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001309static void wpa_supplicant_set_rekey_offload(void *ctx,
1310 const u8 *kek, size_t kek_len,
1311 const u8 *kck, size_t kck_len,
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001312 const u8 *replay_ctr)
1313{
1314 struct wpa_supplicant *wpa_s = ctx;
1315
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001316 wpa_drv_set_rekey_info(wpa_s, kek, kek_len, kck, kck_len, replay_ctr);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001317}
1318
1319
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001320static int wpa_supplicant_key_mgmt_set_pmk(void *ctx, const u8 *pmk,
1321 size_t pmk_len)
1322{
1323 struct wpa_supplicant *wpa_s = ctx;
1324
Dmitry Shmidt1d755d02015-04-28 10:34:29 -07001325 if (wpa_s->conf->key_mgmt_offload &&
1326 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD))
Sunil Ravi77d572f2023-01-17 23:58:31 +00001327 return wpa_drv_set_key(wpa_s, -1, 0, NULL, 0, 0,
Hai Shalomfdcde762020-04-02 11:19:20 -07001328 NULL, 0, pmk, pmk_len, KEY_FLAG_PMK);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001329 else
1330 return 0;
1331}
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001332
1333
1334static void wpa_supplicant_fils_hlp_rx(void *ctx, const u8 *dst, const u8 *src,
1335 const u8 *pkt, size_t pkt_len)
1336{
1337 struct wpa_supplicant *wpa_s = ctx;
1338 char *hex;
1339 size_t hexlen;
1340
1341 hexlen = pkt_len * 2 + 1;
1342 hex = os_malloc(hexlen);
1343 if (!hex)
1344 return;
1345 wpa_snprintf_hex(hex, hexlen, pkt, pkt_len);
1346 wpa_msg(wpa_s, MSG_INFO, FILS_HLP_RX "dst=" MACSTR " src=" MACSTR
1347 " frame=%s", MAC2STR(dst), MAC2STR(src), hex);
1348 os_free(hex);
1349}
1350
Hai Shalom74f70d42019-02-11 14:42:39 -08001351
1352static int wpa_supplicant_channel_info(void *_wpa_s,
1353 struct wpa_channel_info *ci)
1354{
1355 struct wpa_supplicant *wpa_s = _wpa_s;
1356
1357 return wpa_drv_channel_info(wpa_s, ci);
1358}
1359
Hai Shalomfdcde762020-04-02 11:19:20 -07001360
1361static void disable_wpa_wpa2(struct wpa_ssid *ssid)
1362{
1363 ssid->proto &= ~WPA_PROTO_WPA;
1364 ssid->proto |= WPA_PROTO_RSN;
1365 ssid->key_mgmt &= ~(WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_FT_PSK |
1366 WPA_KEY_MGMT_PSK_SHA256);
1367 ssid->group_cipher &= ~WPA_CIPHER_TKIP;
1368 if (!(ssid->group_cipher & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1369 WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256)))
1370 ssid->group_cipher |= WPA_CIPHER_CCMP;
1371 ssid->ieee80211w = MGMT_FRAME_PROTECTION_REQUIRED;
1372}
1373
1374
Sunil Ravi77d572f2023-01-17 23:58:31 +00001375void wpas_transition_disable(struct wpa_supplicant *wpa_s, u8 bitmap)
Hai Shalomfdcde762020-04-02 11:19:20 -07001376{
Hai Shalomfdcde762020-04-02 11:19:20 -07001377 struct wpa_ssid *ssid;
1378 int changed = 0;
1379
1380 wpa_msg(wpa_s, MSG_INFO, TRANSITION_DISABLE "%02x", bitmap);
1381
1382 ssid = wpa_s->current_ssid;
1383 if (!ssid)
1384 return;
1385
Hai Shalom899fcc72020-10-19 14:38:18 -07001386#ifdef CONFIG_SAE
Hai Shalomfdcde762020-04-02 11:19:20 -07001387 if ((bitmap & TRANSITION_DISABLE_WPA3_PERSONAL) &&
1388 wpa_key_mgmt_sae(wpa_s->key_mgmt) &&
Sunil Ravi89eba102022-09-13 21:04:37 -07001389 wpa_key_mgmt_sae(ssid->key_mgmt) &&
Hai Shalomfdcde762020-04-02 11:19:20 -07001390 (ssid->ieee80211w != MGMT_FRAME_PROTECTION_REQUIRED ||
1391 (ssid->group_cipher & WPA_CIPHER_TKIP))) {
1392 wpa_printf(MSG_DEBUG,
1393 "WPA3-Personal transition mode disabled based on AP notification");
1394 disable_wpa_wpa2(ssid);
1395 changed = 1;
1396 }
1397
Hai Shalom899fcc72020-10-19 14:38:18 -07001398 if ((bitmap & TRANSITION_DISABLE_SAE_PK) &&
1399 wpa_key_mgmt_sae(wpa_s->key_mgmt) &&
1400#ifdef CONFIG_SME
1401 wpa_s->sme.sae.state == SAE_ACCEPTED &&
1402 wpa_s->sme.sae.pk &&
1403#endif /* CONFIG_SME */
Sunil Ravi89eba102022-09-13 21:04:37 -07001404 wpa_key_mgmt_sae(ssid->key_mgmt) &&
Hai Shalom899fcc72020-10-19 14:38:18 -07001405 (ssid->sae_pk != SAE_PK_MODE_ONLY ||
1406 ssid->ieee80211w != MGMT_FRAME_PROTECTION_REQUIRED ||
1407 (ssid->group_cipher & WPA_CIPHER_TKIP))) {
1408 wpa_printf(MSG_DEBUG,
1409 "SAE-PK: SAE authentication without PK disabled based on AP notification");
1410 disable_wpa_wpa2(ssid);
1411 ssid->sae_pk = SAE_PK_MODE_ONLY;
1412 changed = 1;
1413 }
1414#endif /* CONFIG_SAE */
1415
Hai Shalomfdcde762020-04-02 11:19:20 -07001416 if ((bitmap & TRANSITION_DISABLE_WPA3_ENTERPRISE) &&
1417 wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
1418 (ssid->key_mgmt & (WPA_KEY_MGMT_IEEE8021X |
1419 WPA_KEY_MGMT_FT_IEEE8021X |
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001420 WPA_KEY_MGMT_IEEE8021X_SHA256 |
1421 WPA_KEY_MGMT_IEEE8021X_SHA384)) &&
Hai Shalomfdcde762020-04-02 11:19:20 -07001422 (ssid->ieee80211w != MGMT_FRAME_PROTECTION_REQUIRED ||
1423 (ssid->group_cipher & WPA_CIPHER_TKIP))) {
1424 disable_wpa_wpa2(ssid);
1425 changed = 1;
1426 }
1427
1428 if ((bitmap & TRANSITION_DISABLE_ENHANCED_OPEN) &&
1429 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE &&
1430 (ssid->key_mgmt & WPA_KEY_MGMT_OWE) &&
1431 !ssid->owe_only) {
1432 ssid->owe_only = 1;
1433 changed = 1;
1434 }
1435
Winnie Chen4138eec2022-11-10 16:32:53 +08001436#if defined(CONFIG_DRIVER_NL80211_BRCM) || defined(CONFIG_DRIVER_NL80211_SYNA)
Vinayak Yadawade62409f2022-01-20 12:32:07 +05301437 /* driver call for transition disable */
1438 {
1439 struct wpa_driver_associate_params params;
1440
1441 os_memset(&params, 0, sizeof(params));
1442 params.td_policy = bitmap;
1443 wpa_drv_update_connect_params(wpa_s, &params, WPA_DRV_UPDATE_TD_POLICY);
1444 }
Winnie Chen4138eec2022-11-10 16:32:53 +08001445#endif /* CONFIG_DRIVER_NL80211_BRCM || CONFIG_DRIVER_NL80211_SYNA */
Vinayak Yadawade62409f2022-01-20 12:32:07 +05301446
Jimmy Chen39deead2020-10-14 23:47:20 +08001447 wpas_notify_transition_disable(wpa_s, ssid, bitmap);
1448
Hai Shalomfdcde762020-04-02 11:19:20 -07001449 if (!changed)
1450 return;
1451
1452#ifndef CONFIG_NO_CONFIG_WRITE
1453 if (wpa_s->conf->update_config &&
1454 wpa_config_write(wpa_s->confname, wpa_s->conf))
1455 wpa_printf(MSG_DEBUG, "Failed to update configuration");
1456#endif /* CONFIG_NO_CONFIG_WRITE */
1457}
1458
Hai Shalom60840252021-02-19 19:02:11 -08001459
Sunil Ravi77d572f2023-01-17 23:58:31 +00001460static void wpa_supplicant_transition_disable(void *_wpa_s, u8 bitmap)
1461{
1462 struct wpa_supplicant *wpa_s = _wpa_s;
1463 wpas_transition_disable(wpa_s, bitmap);
1464}
1465
1466
Sunil Raviaf8751c2023-03-29 11:35:17 -07001467static void wpa_supplicant_store_ptk(void *ctx, const u8 *addr, int cipher,
Hai Shalom60840252021-02-19 19:02:11 -08001468 u32 life_time, const struct wpa_ptk *ptk)
1469{
1470 struct wpa_supplicant *wpa_s = ctx;
1471
Sunil Ravi89eba102022-09-13 21:04:37 -07001472 ptksa_cache_add(wpa_s->ptksa, wpa_s->own_addr, addr, cipher, life_time,
Sunil Ravi77d572f2023-01-17 23:58:31 +00001473 ptk, NULL, NULL, 0);
Hai Shalom60840252021-02-19 19:02:11 -08001474}
1475
Dmitry Shmidtd7ff03d2015-12-04 14:49:35 -08001476#endif /* CONFIG_NO_WPA */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001477
1478
Sunil Ravi89eba102022-09-13 21:04:37 -07001479#ifdef CONFIG_PASN
1480static int wpa_supplicant_set_ltf_keyseed(void *_wpa_s, const u8 *own_addr,
1481 const u8 *peer_addr,
1482 size_t ltf_keyseed_len,
1483 const u8 *ltf_keyseed)
1484{
1485 struct wpa_supplicant *wpa_s = _wpa_s;
1486
1487 return wpa_drv_set_secure_ranging_ctx(wpa_s, own_addr, peer_addr, 0, 0,
1488 NULL, ltf_keyseed_len,
1489 ltf_keyseed, 0);
1490}
1491#endif /* CONFIG_PASN */
1492
1493
Sunil Ravi77d572f2023-01-17 23:58:31 +00001494static void
1495wpa_supplicant_notify_pmksa_cache_entry(void *_wpa_s,
1496 struct rsn_pmksa_cache_entry *entry)
1497{
1498 struct wpa_supplicant *wpa_s = _wpa_s;
1499
1500 wpas_notify_pmk_cache_added(wpa_s, entry);
1501}
1502
1503
Sunil Ravi7f769292024-07-23 22:21:32 +00001504static void wpa_supplicant_ssid_verified(void *_wpa_s)
1505{
1506 struct wpa_supplicant *wpa_s = _wpa_s;
1507
1508 wpa_s->ssid_verified = true;
1509 wpa_msg(wpa_s, MSG_INFO, "RSN: SSID matched expected value");
1510}
1511
1512
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001513int wpa_supplicant_init_wpa(struct wpa_supplicant *wpa_s)
1514{
1515#ifndef CONFIG_NO_WPA
1516 struct wpa_sm_ctx *ctx;
Hai Shalom60840252021-02-19 19:02:11 -08001517
1518 wpa_s->ptksa = ptksa_cache_init();
1519 if (!wpa_s->ptksa) {
1520 wpa_printf(MSG_ERROR, "Failed to allocate PTKSA");
1521 return -1;
1522 }
1523
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001524 ctx = os_zalloc(sizeof(*ctx));
1525 if (ctx == NULL) {
1526 wpa_printf(MSG_ERROR, "Failed to allocate WPA context.");
Hai Shalom60840252021-02-19 19:02:11 -08001527
1528 ptksa_cache_deinit(wpa_s->ptksa);
1529 wpa_s->ptksa = NULL;
1530
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001531 return -1;
1532 }
1533
1534 ctx->ctx = wpa_s;
1535 ctx->msg_ctx = wpa_s;
1536 ctx->set_state = _wpa_supplicant_set_state;
1537 ctx->get_state = _wpa_supplicant_get_state;
1538 ctx->deauthenticate = _wpa_supplicant_deauthenticate;
Hai Shalomfdcde762020-04-02 11:19:20 -07001539 ctx->reconnect = _wpa_supplicant_reconnect;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001540 ctx->set_key = wpa_supplicant_set_key;
1541 ctx->get_network_ctx = wpa_supplicant_get_network_ctx;
1542 ctx->get_bssid = wpa_supplicant_get_bssid;
1543 ctx->ether_send = _wpa_ether_send;
1544 ctx->get_beacon_ie = wpa_supplicant_get_beacon_ie;
1545 ctx->alloc_eapol = _wpa_alloc_eapol;
1546 ctx->cancel_auth_timeout = _wpa_supplicant_cancel_auth_timeout;
1547 ctx->add_pmkid = wpa_supplicant_add_pmkid;
1548 ctx->remove_pmkid = wpa_supplicant_remove_pmkid;
1549#ifndef CONFIG_NO_CONFIG_BLOBS
1550 ctx->set_config_blob = wpa_supplicant_set_config_blob;
1551 ctx->get_config_blob = wpa_supplicant_get_config_blob;
1552#endif /* CONFIG_NO_CONFIG_BLOBS */
1553 ctx->mlme_setprotection = wpa_supplicant_mlme_setprotection;
1554#ifdef CONFIG_IEEE80211R
1555 ctx->update_ft_ies = wpa_supplicant_update_ft_ies;
1556 ctx->send_ft_action = wpa_supplicant_send_ft_action;
1557 ctx->mark_authenticated = wpa_supplicant_mark_authenticated;
1558#endif /* CONFIG_IEEE80211R */
1559#ifdef CONFIG_TDLS
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001560 ctx->tdls_get_capa = wpa_supplicant_tdls_get_capa;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001561 ctx->send_tdls_mgmt = wpa_supplicant_send_tdls_mgmt;
1562 ctx->tdls_oper = wpa_supplicant_tdls_oper;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001563 ctx->tdls_peer_addset = wpa_supplicant_tdls_peer_addset;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001564 ctx->tdls_enable_channel_switch =
1565 wpa_supplicant_tdls_enable_channel_switch;
1566 ctx->tdls_disable_channel_switch =
1567 wpa_supplicant_tdls_disable_channel_switch;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001568#endif /* CONFIG_TDLS */
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001569 ctx->set_rekey_offload = wpa_supplicant_set_rekey_offload;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001570 ctx->key_mgmt_set_pmk = wpa_supplicant_key_mgmt_set_pmk;
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001571 ctx->fils_hlp_rx = wpa_supplicant_fils_hlp_rx;
Hai Shalom74f70d42019-02-11 14:42:39 -08001572 ctx->channel_info = wpa_supplicant_channel_info;
Hai Shalomfdcde762020-04-02 11:19:20 -07001573 ctx->transition_disable = wpa_supplicant_transition_disable;
Hai Shalom60840252021-02-19 19:02:11 -08001574 ctx->store_ptk = wpa_supplicant_store_ptk;
Sunil Ravi89eba102022-09-13 21:04:37 -07001575#ifdef CONFIG_PASN
1576 ctx->set_ltf_keyseed = wpa_supplicant_set_ltf_keyseed;
1577#endif /* CONFIG_PASN */
Sunil Ravi77d572f2023-01-17 23:58:31 +00001578 ctx->notify_pmksa_cache_entry = wpa_supplicant_notify_pmksa_cache_entry;
Sunil Ravi7f769292024-07-23 22:21:32 +00001579 ctx->ssid_verified = wpa_supplicant_ssid_verified;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001580
1581 wpa_s->wpa = wpa_sm_init(ctx);
1582 if (wpa_s->wpa == NULL) {
Hai Shalom60840252021-02-19 19:02:11 -08001583 wpa_printf(MSG_ERROR,
1584 "Failed to initialize WPA state machine");
Dmitry Shmidtff787d52015-01-12 13:01:47 -08001585 os_free(ctx);
Hai Shalom60840252021-02-19 19:02:11 -08001586 ptksa_cache_deinit(wpa_s->ptksa);
1587 wpa_s->ptksa = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001588 return -1;
1589 }
1590#endif /* CONFIG_NO_WPA */
1591
1592 return 0;
1593}
1594
1595
1596void wpa_supplicant_rsn_supp_set_config(struct wpa_supplicant *wpa_s,
1597 struct wpa_ssid *ssid)
1598{
1599 struct rsn_supp_config conf;
1600 if (ssid) {
1601 os_memset(&conf, 0, sizeof(conf));
1602 conf.network_ctx = ssid;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001603 conf.allowed_pairwise_cipher = ssid->pairwise_cipher;
1604#ifdef IEEE8021X_EAPOL
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001605 conf.proactive_key_caching = ssid->proactive_key_caching < 0 ?
1606 wpa_s->conf->okc : ssid->proactive_key_caching;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001607 conf.eap_workaround = ssid->eap_workaround;
1608 conf.eap_conf_ctx = &ssid->eap;
1609#endif /* IEEE8021X_EAPOL */
1610 conf.ssid = ssid->ssid;
1611 conf.ssid_len = ssid->ssid_len;
1612 conf.wpa_ptk_rekey = ssid->wpa_ptk_rekey;
Hai Shalomfdcde762020-04-02 11:19:20 -07001613 conf.wpa_deny_ptk0_rekey = ssid->wpa_deny_ptk0_rekey;
1614 conf.owe_ptk_workaround = ssid->owe_ptk_workaround;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08001615#ifdef CONFIG_P2P
1616 if (ssid->p2p_group && wpa_s->current_bss &&
1617 !wpa_s->p2p_disable_ip_addr_req) {
1618 struct wpabuf *p2p;
1619 p2p = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
1620 P2P_IE_VENDOR_TYPE);
1621 if (p2p) {
1622 u8 group_capab;
1623 group_capab = p2p_get_group_capab(p2p);
1624 if (group_capab &
1625 P2P_GROUP_CAPAB_IP_ADDR_ALLOCATION)
1626 conf.p2p = 1;
1627 wpabuf_free(p2p);
1628 }
1629 }
1630#endif /* CONFIG_P2P */
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001631 conf.wpa_rsc_relaxation = wpa_s->conf->wpa_rsc_relaxation;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001632#ifdef CONFIG_FILS
1633 if (wpa_key_mgmt_fils(wpa_s->key_mgmt))
1634 conf.fils_cache_id =
1635 wpa_bss_get_fils_cache_id(wpa_s->current_bss);
1636#endif /* CONFIG_FILS */
Hai Shalom60840252021-02-19 19:02:11 -08001637 if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_BEACON_PROTECTION) ||
1638 (wpa_s->drv_flags2 &
1639 WPA_DRIVER_FLAGS2_BEACON_PROTECTION_CLIENT))
1640 conf.beacon_prot = ssid->beacon_prot;
1641
1642#ifdef CONFIG_PASN
1643#ifdef CONFIG_TESTING_OPTIONS
1644 conf.force_kdk_derivation = wpa_s->conf->force_kdk_derivation;
1645#endif /* CONFIG_TESTING_OPTIONS */
1646#endif /* CONFIG_PASN */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001647 }
1648 wpa_sm_set_config(wpa_s->wpa, ssid ? &conf : NULL);
1649}