blob: 33e7f41580eb4425303d17df55b0aeb1637b5630 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * WPA Supplicant - WPA state machine and EAPOL-Key processing
Roshan Pius3a1667e2018-07-03 15:17:14 -07003 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08004 * Copyright(c) 2015 Intel Deutschland GmbH
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07005 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08006 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07008 */
9
10#include "includes.h"
11
12#include "common.h"
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080013#include "crypto/aes.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070014#include "crypto/aes_wrap.h"
15#include "crypto/crypto.h"
16#include "crypto/random.h"
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080017#include "crypto/aes_siv.h"
Dmitry Shmidtd2986c22017-10-23 14:22:09 -070018#include "crypto/sha256.h"
19#include "crypto/sha384.h"
20#include "crypto/sha512.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070021#include "common/ieee802_11_defs.h"
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080022#include "common/ieee802_11_common.h"
Hai Shalom74f70d42019-02-11 14:42:39 -080023#include "common/ocv.h"
Paul Stewart092955c2017-02-06 09:13:09 -080024#include "eap_common/eap_defs.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070025#include "eapol_supp/eapol_supp_sm.h"
Hai Shalom74f70d42019-02-11 14:42:39 -080026#include "drivers/driver.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070027#include "wpa.h"
28#include "eloop.h"
29#include "preauth.h"
30#include "pmksa_cache.h"
31#include "wpa_i.h"
32#include "wpa_ie.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070033
34
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080035static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
36
37
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070038/**
39 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
40 * @sm: Pointer to WPA state machine data from wpa_sm_init()
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080041 * @ptk: PTK for Key Confirmation/Encryption Key
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070042 * @ver: Version field from Key Info
43 * @dest: Destination address for the frame
44 * @proto: Ethertype (usually ETH_P_EAPOL)
45 * @msg: EAPOL-Key message
46 * @msg_len: Length of message
47 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080048 * Returns: >= 0 on success, < 0 on failure
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070049 */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080050int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080051 int ver, const u8 *dest, u16 proto,
52 u8 *msg, size_t msg_len, u8 *key_mic)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070053{
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080054 int ret = -1;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -070055 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt807291d2015-01-27 13:40:23 -080056
Dmitry Shmidtd2986c22017-10-23 14:22:09 -070057 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
58 " ver=%d mic_len=%d key_mgmt=0x%x",
59 MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070060 if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
61 /*
62 * Association event was not yet received; try to fetch
63 * BSSID from the driver.
64 */
65 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
66 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
67 "WPA: Failed to read BSSID for "
68 "EAPOL-Key destination address");
69 } else {
70 dest = sm->bssid;
71 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
72 "WPA: Use BSSID (" MACSTR
73 ") as the destination for EAPOL-Key",
74 MAC2STR(dest));
75 }
76 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080077
78 if (mic_len) {
79 if (key_mic && (!ptk || !ptk->kck_len))
80 goto out;
81
82 if (key_mic &&
83 wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt, ver,
84 msg, msg_len, key_mic)) {
85 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
86 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
87 ver, sm->key_mgmt);
88 goto out;
89 }
Dmitry Shmidt29333592017-01-09 12:27:11 -080090 if (ptk)
91 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
92 ptk->kck, ptk->kck_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -080093 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
94 key_mic, mic_len);
95 } else {
96#ifdef CONFIG_FILS
97 /* AEAD cipher - Key MIC field not used */
98 struct ieee802_1x_hdr *s_hdr, *hdr;
99 struct wpa_eapol_key *s_key, *key;
100 u8 *buf, *s_key_data, *key_data;
101 size_t buf_len = msg_len + AES_BLOCK_SIZE;
102 size_t key_data_len;
103 u16 eapol_len;
104 const u8 *aad[1];
105 size_t aad_len[1];
106
107 if (!ptk || !ptk->kek_len)
108 goto out;
109
110 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
111 sizeof(struct wpa_eapol_key) - 2;
112
113 buf = os_malloc(buf_len);
114 if (!buf)
115 goto out;
116
117 os_memcpy(buf, msg, msg_len);
118 hdr = (struct ieee802_1x_hdr *) buf;
119 key = (struct wpa_eapol_key *) (hdr + 1);
120 key_data = ((u8 *) (key + 1)) + 2;
121
122 /* Update EAPOL header to include AES-SIV overhead */
123 eapol_len = be_to_host16(hdr->length);
124 eapol_len += AES_BLOCK_SIZE;
125 hdr->length = host_to_be16(eapol_len);
126
127 /* Update Key Data Length field to include AES-SIV overhead */
128 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
129
130 s_hdr = (struct ieee802_1x_hdr *) msg;
131 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
132 s_key_data = ((u8 *) (s_key + 1)) + 2;
133
134 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
135 s_key_data, key_data_len);
136
137 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
138 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
139 * to Key Data (exclusive). */
140 aad[0] = buf;
141 aad_len[0] = key_data - buf;
142 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
143 s_key_data, key_data_len,
144 1, aad, aad_len, key_data) < 0) {
145 os_free(buf);
146 goto out;
147 }
148
149 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
150 key_data, AES_BLOCK_SIZE + key_data_len);
151
152 os_free(msg);
153 msg = buf;
154 msg_len = buf_len;
155#else /* CONFIG_FILS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700156 goto out;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800157#endif /* CONFIG_FILS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700158 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800159
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700160 wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800161 ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700162 eapol_sm_notify_tx_eapol_key(sm->eapol);
163out:
164 os_free(msg);
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800165 return ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700166}
167
168
169/**
170 * wpa_sm_key_request - Send EAPOL-Key Request
171 * @sm: Pointer to WPA state machine data from wpa_sm_init()
172 * @error: Indicate whether this is an Michael MIC error report
173 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
174 *
175 * Send an EAPOL-Key Request to the current authenticator. This function is
176 * used to request rekeying and it is usually called when a local Michael MIC
177 * failure is detected.
178 */
179void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
180{
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800181 size_t mic_len, hdrlen, rlen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700182 struct wpa_eapol_key *reply;
183 int key_info, ver;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800184 u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700185
Hai Shalomfdcde762020-04-02 11:19:20 -0700186 if (pairwise && sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
187 wpa_sm_get_state(sm) == WPA_COMPLETED) {
188 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
189 "WPA: PTK0 rekey not allowed, reconnecting");
190 wpa_sm_reconnect(sm);
191 return;
192 }
193
Roshan Pius3a1667e2018-07-03 15:17:14 -0700194 if (wpa_use_akm_defined(sm->key_mgmt))
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800195 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
196 else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
197 wpa_key_mgmt_sha256(sm->key_mgmt))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700198 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700199 else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700200 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
201 else
202 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
203
204 if (wpa_sm_get_bssid(sm, bssid) < 0) {
205 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
206 "Failed to read BSSID for EAPOL-Key request");
207 return;
208 }
209
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700210 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800211 hdrlen = sizeof(*reply) + mic_len + 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700212 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800213 hdrlen, &rlen, (void *) &reply);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700214 if (rbuf == NULL)
215 return;
216
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800217 reply->type = (sm->proto == WPA_PROTO_RSN ||
218 sm->proto == WPA_PROTO_OSEN) ?
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700219 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
220 key_info = WPA_KEY_INFO_REQUEST | ver;
221 if (sm->ptk_set)
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800222 key_info |= WPA_KEY_INFO_SECURE;
223 if (sm->ptk_set && mic_len)
224 key_info |= WPA_KEY_INFO_MIC;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700225 if (error)
226 key_info |= WPA_KEY_INFO_ERROR;
227 if (pairwise)
228 key_info |= WPA_KEY_INFO_KEY_TYPE;
229 WPA_PUT_BE16(reply->key_info, key_info);
230 WPA_PUT_BE16(reply->key_length, 0);
231 os_memcpy(reply->replay_counter, sm->request_counter,
232 WPA_REPLAY_COUNTER_LEN);
233 inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
234
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800235 mic = (u8 *) (reply + 1);
236 WPA_PUT_BE16(mic + mic_len, 0);
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800237 if (!(key_info & WPA_KEY_INFO_MIC))
238 key_mic = NULL;
239 else
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800240 key_mic = mic;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700241
242 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
243 "WPA: Sending EAPOL-Key Request (error=%d "
244 "pairwise=%d ptk_set=%d len=%lu)",
245 error, pairwise, sm->ptk_set, (unsigned long) rlen);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800246 wpa_eapol_key_send(sm, &sm->ptk, ver, bssid, ETH_P_EAPOL, rbuf, rlen,
247 key_mic);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700248}
249
250
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800251static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
252{
253#ifdef CONFIG_IEEE80211R
254 if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
255 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
256 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
257 "RSN: Cannot set low order 256 bits of MSK for key management offload");
258 } else {
259#endif /* CONFIG_IEEE80211R */
260 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
261 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
262 "RSN: Cannot set PMK for key management offload");
263#ifdef CONFIG_IEEE80211R
264 }
265#endif /* CONFIG_IEEE80211R */
266}
267
268
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700269static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
270 const unsigned char *src_addr,
271 const u8 *pmkid)
272{
273 int abort_cached = 0;
274
275 if (pmkid && !sm->cur_pmksa) {
276 /* When using drivers that generate RSN IE, wpa_supplicant may
277 * not have enough time to get the association information
278 * event before receiving this 1/4 message, so try to find a
279 * matching PMKSA cache entry here. */
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -0800280 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
Roshan Pius3a1667e2018-07-03 15:17:14 -0700281 NULL, 0);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700282 if (sm->cur_pmksa) {
283 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
284 "RSN: found matching PMKID from PMKSA cache");
285 } else {
286 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
287 "RSN: no matching PMKID found");
288 abort_cached = 1;
289 }
290 }
291
292 if (pmkid && sm->cur_pmksa &&
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700293 os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700294 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
295 wpa_sm_set_pmk_from_pmksa(sm);
296 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
297 sm->pmk, sm->pmk_len);
298 eapol_sm_notify_cached(sm->eapol);
299#ifdef CONFIG_IEEE80211R
300 sm->xxkey_len = 0;
Roshan Pius3a1667e2018-07-03 15:17:14 -0700301#ifdef CONFIG_SAE
302 if (sm->key_mgmt == WPA_KEY_MGMT_FT_SAE &&
303 sm->pmk_len == PMK_LEN) {
304 /* Need to allow FT key derivation to proceed with
305 * PMK from SAE being used as the XXKey in cases where
306 * the PMKID in msg 1/4 matches the PMKSA entry that was
307 * just added based on SAE authentication for the
308 * initial mobility domain association. */
309 os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
310 sm->xxkey_len = sm->pmk_len;
311 }
312#endif /* CONFIG_SAE */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700313#endif /* CONFIG_IEEE80211R */
314 } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
315 int res, pmk_len;
Hai Shalom81f62d82019-07-22 12:10:00 -0700316#ifdef CONFIG_IEEE80211R
317 u8 buf[2 * PMK_LEN];
318#endif /* CONFIG_IEEE80211R */
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800319
Dmitry Shmidtebd93af2017-02-21 13:40:44 -0800320 if (wpa_key_mgmt_sha384(sm->key_mgmt))
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800321 pmk_len = PMK_LEN_SUITE_B_192;
322 else
323 pmk_len = PMK_LEN;
324 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700325 if (res) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800326 if (pmk_len == PMK_LEN) {
327 /*
328 * EAP-LEAP is an exception from other EAP
329 * methods: it uses only 16-byte PMK.
330 */
331 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
332 pmk_len = 16;
333 }
Hai Shalomf1c97642019-07-19 23:42:07 +0000334 }
Hai Shalom81f62d82019-07-22 12:10:00 -0700335#ifdef CONFIG_IEEE80211R
336 if (res == 0 &&
337 eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {
338 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
339 os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);
340 sm->xxkey_len = SHA384_MAC_LEN;
341 } else {
342 os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);
343 sm->xxkey_len = PMK_LEN;
344 }
345 forced_memzero(buf, sizeof(buf));
346 if (sm->proto == WPA_PROTO_RSN &&
347 wpa_key_mgmt_ft(sm->key_mgmt)) {
348 struct rsn_pmksa_cache_entry *sa = NULL;
349 const u8 *fils_cache_id = NULL;
350
351#ifdef CONFIG_FILS
352 if (sm->fils_cache_id_set)
353 fils_cache_id = sm->fils_cache_id;
354#endif /* CONFIG_FILS */
355 wpa_hexdump_key(MSG_DEBUG,
356 "FT: Cache XXKey/MPMK",
357 sm->xxkey, sm->xxkey_len);
358 sa = pmksa_cache_add(sm->pmksa,
359 sm->xxkey, sm->xxkey_len,
360 NULL, NULL, 0,
361 src_addr, sm->own_addr,
362 sm->network_ctx,
363 sm->key_mgmt,
364 fils_cache_id);
365 if (!sm->cur_pmksa)
366 sm->cur_pmksa = sa;
367 }
368 }
369#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700370 if (res == 0) {
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700371 struct rsn_pmksa_cache_entry *sa = NULL;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700372 const u8 *fils_cache_id = NULL;
373
374#ifdef CONFIG_FILS
375 if (sm->fils_cache_id_set)
376 fils_cache_id = sm->fils_cache_id;
377#endif /* CONFIG_FILS */
378
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700379 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
380 "machines", sm->pmk, pmk_len);
381 sm->pmk_len = pmk_len;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800382 wpa_supplicant_key_mgmt_set_pmk(sm);
Dmitry Shmidtc55524a2011-07-07 11:18:38 -0700383 if (sm->proto == WPA_PROTO_RSN &&
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800384 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
Dmitry Shmidtc55524a2011-07-07 11:18:38 -0700385 !wpa_key_mgmt_ft(sm->key_mgmt)) {
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700386 sa = pmksa_cache_add(sm->pmksa,
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800387 sm->pmk, pmk_len, NULL,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800388 NULL, 0,
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700389 src_addr, sm->own_addr,
390 sm->network_ctx,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700391 sm->key_mgmt,
392 fils_cache_id);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700393 }
394 if (!sm->cur_pmksa && pmkid &&
Roshan Pius3a1667e2018-07-03 15:17:14 -0700395 pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL,
396 0)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700397 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
398 "RSN: the new PMK matches with the "
399 "PMKID");
400 abort_cached = 0;
Jouni Malinen6ec30382015-07-08 20:48:18 +0300401 } else if (sa && !sm->cur_pmksa && pmkid) {
402 /*
403 * It looks like the authentication server
404 * derived mismatching MSK. This should not
405 * really happen, but bugs happen.. There is not
406 * much we can do here without knowing what
407 * exactly caused the server to misbehave.
408 */
Dmitry Shmidt014a3ff2015-12-28 13:27:49 -0800409 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
Jouni Malinen6ec30382015-07-08 20:48:18 +0300410 "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
411 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700412 }
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700413
414 if (!sm->cur_pmksa)
415 sm->cur_pmksa = sa;
Hai Shalom81f62d82019-07-22 12:10:00 -0700416#ifdef CONFIG_IEEE80211R
417 } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {
418 wpa_printf(MSG_DEBUG,
419 "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");
420#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700421 } else {
422 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
423 "WPA: Failed to get master session key from "
424 "EAPOL state machines - key handshake "
425 "aborted");
426 if (sm->cur_pmksa) {
427 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
428 "RSN: Cancelled PMKSA caching "
429 "attempt");
430 sm->cur_pmksa = NULL;
431 abort_cached = 1;
432 } else if (!abort_cached) {
433 return -1;
434 }
435 }
436 }
437
Dmitry Shmidtc55524a2011-07-07 11:18:38 -0700438 if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800439 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800440 !wpa_key_mgmt_ft(sm->key_mgmt) && sm->key_mgmt != WPA_KEY_MGMT_OSEN)
441 {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700442 /* Send EAPOL-Start to trigger full EAP authentication. */
443 u8 *buf;
444 size_t buflen;
445
446 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
447 "RSN: no PMKSA entry found - trigger "
448 "full EAP authentication");
449 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
450 NULL, 0, &buflen, NULL);
451 if (buf) {
452 wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
453 buf, buflen);
454 os_free(buf);
455 return -2;
456 }
457
458 return -1;
459 }
460
461 return 0;
462}
463
464
465/**
466 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
467 * @sm: Pointer to WPA state machine data from wpa_sm_init()
468 * @dst: Destination address for the frame
469 * @key: Pointer to the EAPOL-Key frame header
470 * @ver: Version bits from EAPOL-Key Key Info
471 * @nonce: Nonce value for the EAPOL-Key frame
472 * @wpa_ie: WPA/RSN IE
473 * @wpa_ie_len: Length of the WPA/RSN IE
474 * @ptk: PTK to use for keyed hash and encryption
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800475 * Returns: >= 0 on success, < 0 on failure
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700476 */
477int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
478 const struct wpa_eapol_key *key,
479 int ver, const u8 *nonce,
480 const u8 *wpa_ie, size_t wpa_ie_len,
481 struct wpa_ptk *ptk)
482{
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800483 size_t mic_len, hdrlen, rlen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700484 struct wpa_eapol_key *reply;
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800485 u8 *rbuf, *key_mic;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700486 u8 *rsn_ie_buf = NULL;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800487 u16 key_info;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700488
489 if (wpa_ie == NULL) {
490 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
491 "cannot generate msg 2/4");
492 return -1;
493 }
494
495#ifdef CONFIG_IEEE80211R
496 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
497 int res;
498
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -0800499 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE before FT processing",
500 wpa_ie, wpa_ie_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700501 /*
502 * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
503 * FTIE from (Re)Association Response.
504 */
505 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
506 sm->assoc_resp_ies_len);
507 if (rsn_ie_buf == NULL)
508 return -1;
509 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
Dmitry Shmidt55840ad2015-12-14 12:45:46 -0800510 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700511 sm->pmk_r1_name);
512 if (res < 0) {
513 os_free(rsn_ie_buf);
514 return -1;
515 }
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -0800516 wpa_hexdump(MSG_DEBUG,
517 "WPA: WPA IE after PMKID[PMKR1Name] addition into RSNE",
518 rsn_ie_buf, wpa_ie_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700519
520 if (sm->assoc_resp_ies) {
Ahmed ElArabawy0ff61c52019-12-26 12:38:39 -0800521 wpa_hexdump(MSG_DEBUG, "WPA: Add assoc_resp_ies",
522 sm->assoc_resp_ies,
523 sm->assoc_resp_ies_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700524 os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
525 sm->assoc_resp_ies_len);
526 wpa_ie_len += sm->assoc_resp_ies_len;
527 }
528
529 wpa_ie = rsn_ie_buf;
530 }
531#endif /* CONFIG_IEEE80211R */
532
533 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
534
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700535 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800536 hdrlen = sizeof(*reply) + mic_len + 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700537 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800538 NULL, hdrlen + wpa_ie_len,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700539 &rlen, (void *) &reply);
540 if (rbuf == NULL) {
541 os_free(rsn_ie_buf);
542 return -1;
543 }
544
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800545 reply->type = (sm->proto == WPA_PROTO_RSN ||
546 sm->proto == WPA_PROTO_OSEN) ?
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700547 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800548 key_info = ver | WPA_KEY_INFO_KEY_TYPE;
549 if (mic_len)
550 key_info |= WPA_KEY_INFO_MIC;
551 else
552 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
553 WPA_PUT_BE16(reply->key_info, key_info);
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800554 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700555 WPA_PUT_BE16(reply->key_length, 0);
556 else
557 os_memcpy(reply->key_length, key->key_length, 2);
558 os_memcpy(reply->replay_counter, key->replay_counter,
559 WPA_REPLAY_COUNTER_LEN);
560 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
561 WPA_REPLAY_COUNTER_LEN);
562
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800563 key_mic = (u8 *) (reply + 1);
564 WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len); /* Key Data Length */
565 os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700566 os_free(rsn_ie_buf);
567
568 os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
569
Roshan Pius5e7db942018-04-12 12:27:41 -0700570 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Sending EAPOL-Key 2/4");
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800571 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
572 key_mic);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700573}
574
575
576static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800577 const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700578{
Hai Shalom021b0b52019-04-10 11:17:58 -0700579 const u8 *z = NULL;
580 size_t z_len = 0;
Hai Shalomfdcde762020-04-02 11:19:20 -0700581 int akmp;
Hai Shalom021b0b52019-04-10 11:17:58 -0700582
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700583#ifdef CONFIG_IEEE80211R
584 if (wpa_key_mgmt_ft(sm->key_mgmt))
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800585 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700586#endif /* CONFIG_IEEE80211R */
587
Hai Shalom021b0b52019-04-10 11:17:58 -0700588#ifdef CONFIG_DPP2
589 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
590 z = wpabuf_head(sm->dpp_z);
591 z_len = wpabuf_len(sm->dpp_z);
592 }
593#endif /* CONFIG_DPP2 */
594
Hai Shalomfdcde762020-04-02 11:19:20 -0700595 akmp = sm->key_mgmt;
596#ifdef CONFIG_OWE
597 if (sm->owe_ptk_workaround && akmp == WPA_KEY_MGMT_OWE &&
598 sm->pmk_len > 32) {
599 wpa_printf(MSG_DEBUG,
600 "OWE: Force SHA256 for PTK derivation");
601 akmp |= WPA_KEY_MGMT_PSK_SHA256;
602 }
603#endif /* CONFIG_OWE */
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800604 return wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
605 sm->own_addr, sm->bssid, sm->snonce,
Hai Shalomfdcde762020-04-02 11:19:20 -0700606 key->key_nonce, ptk, akmp,
Hai Shalom021b0b52019-04-10 11:17:58 -0700607 sm->pairwise_cipher, z, z_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700608}
609
610
Hai Shalomfdcde762020-04-02 11:19:20 -0700611static int wpa_handle_ext_key_id(struct wpa_sm *sm,
612 struct wpa_eapol_ie_parse *kde)
613{
614 if (sm->ext_key_id) {
615 u16 key_id;
616
617 if (!kde->key_id) {
618 wpa_msg(sm->ctx->msg_ctx,
619 sm->use_ext_key_id ? MSG_INFO : MSG_DEBUG,
620 "RSN: No Key ID in Extended Key ID handshake");
621 sm->keyidx_active = 0;
622 return sm->use_ext_key_id ? -1 : 0;
623 }
624
625 key_id = kde->key_id[0] & 0x03;
626 if (key_id > 1) {
627 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
628 "RSN: Invalid Extended Key ID: %d", key_id);
629 return -1;
630 }
631 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
632 "RSN: Using Extended Key ID %d", key_id);
633 sm->keyidx_active = key_id;
634 sm->use_ext_key_id = 1;
635 } else {
636 if (kde->key_id && (kde->key_id[0] & 0x03)) {
637 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
638 "RSN: Non-zero Extended Key ID Key ID in PTK0 handshake");
639 return -1;
640 }
641
642 if (kde->key_id) {
643 /* This is not supposed to be included here, but ignore
644 * the case of matching Key ID 0 just in case. */
645 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
646 "RSN: Extended Key ID Key ID 0 in PTK0 handshake");
647 }
648 sm->keyidx_active = 0;
649 sm->use_ext_key_id = 0;
650 }
651
652 return 0;
653}
654
655
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700656static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
657 const unsigned char *src_addr,
658 const struct wpa_eapol_key *key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700659 u16 ver, const u8 *key_data,
660 size_t key_data_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700661{
662 struct wpa_eapol_ie_parse ie;
663 struct wpa_ptk *ptk;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700664 int res;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800665 u8 *kde, *kde_buf = NULL;
666 size_t kde_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700667
668 if (wpa_sm_get_network_ctx(sm) == NULL) {
669 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
670 "found (msg 1 of 4)");
671 return;
672 }
673
Hai Shalomfdcde762020-04-02 11:19:20 -0700674 if (sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
675 wpa_sm_get_state(sm) == WPA_COMPLETED) {
676 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
677 "WPA: PTK0 rekey not allowed, reconnecting");
678 wpa_sm_reconnect(sm);
679 return;
680 }
681
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700682 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
Roshan Pius5e7db942018-04-12 12:27:41 -0700683 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: RX message 1 of 4-Way "
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700684 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
685
686 os_memset(&ie, 0, sizeof(ie));
687
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800688 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700689 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700690 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
691 key_data, key_data_len);
692 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800693 goto failed;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700694 if (ie.pmkid) {
695 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
696 "Authenticator", ie.pmkid, PMKID_LEN);
697 }
698 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700699
700 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
701 if (res == -2) {
702 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
703 "msg 1/4 - requesting full EAP authentication");
704 return;
705 }
706 if (res)
707 goto failed;
708
709 if (sm->renew_snonce) {
710 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
711 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
712 "WPA: Failed to get random data for SNonce");
713 goto failed;
714 }
715 sm->renew_snonce = 0;
716 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
717 sm->snonce, WPA_NONCE_LEN);
718 }
719
720 /* Calculate PTK which will be stored as a temporary PTK until it has
721 * been verified when processing message 3/4. */
722 ptk = &sm->tptk;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700723 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
724 goto failed;
Dmitry Shmidt98660862014-03-11 17:26:21 -0700725 if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
Dmitry Shmidt61593f02014-04-21 16:27:35 -0700726 u8 buf[8];
Dmitry Shmidt98660862014-03-11 17:26:21 -0700727 /* Supplicant: swap tx/rx Mic keys */
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800728 os_memcpy(buf, &ptk->tk[16], 8);
729 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
730 os_memcpy(&ptk->tk[24], buf, 8);
Hai Shalom81f62d82019-07-22 12:10:00 -0700731 forced_memzero(buf, sizeof(buf));
Dmitry Shmidt98660862014-03-11 17:26:21 -0700732 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700733 sm->tptk_set = 1;
734
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800735 kde = sm->assoc_wpa_ie;
736 kde_len = sm->assoc_wpa_ie_len;
Hai Shalomc3565922019-10-28 11:58:20 -0700737 kde_buf = os_malloc(kde_len +
738 2 + RSN_SELECTOR_LEN + 3 +
739 sm->assoc_rsnxe_len +
740 2 + RSN_SELECTOR_LEN + 1);
741 if (!kde_buf)
742 goto failed;
743 os_memcpy(kde_buf, kde, kde_len);
744 kde = kde_buf;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800745
Hai Shalom74f70d42019-02-11 14:42:39 -0800746#ifdef CONFIG_OCV
747 if (wpa_sm_ocv_enabled(sm)) {
748 struct wpa_channel_info ci;
749 u8 *pos;
750
Hai Shalomc3565922019-10-28 11:58:20 -0700751 pos = kde + kde_len;
Hai Shalom74f70d42019-02-11 14:42:39 -0800752 if (wpa_sm_channel_info(sm, &ci) != 0) {
753 wpa_printf(MSG_WARNING,
754 "Failed to get channel info for OCI element in EAPOL-Key 2/4");
755 goto failed;
756 }
757
Hai Shalom74f70d42019-02-11 14:42:39 -0800758 if (ocv_insert_oci_kde(&ci, &pos) < 0)
759 goto failed;
760 kde_len = pos - kde;
761 }
762#endif /* CONFIG_OCV */
763
Hai Shalomc3565922019-10-28 11:58:20 -0700764 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len) {
765 os_memcpy(kde + kde_len, sm->assoc_rsnxe, sm->assoc_rsnxe_len);
766 kde_len += sm->assoc_rsnxe_len;
767 }
768
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800769#ifdef CONFIG_P2P
770 if (sm->p2p) {
Hai Shalomc3565922019-10-28 11:58:20 -0700771 u8 *pos;
772
773 wpa_printf(MSG_DEBUG,
774 "P2P: Add IP Address Request KDE into EAPOL-Key 2/4");
775 pos = kde + kde_len;
776 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
777 *pos++ = RSN_SELECTOR_LEN + 1;
778 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
779 pos += RSN_SELECTOR_LEN;
780 *pos++ = 0x01;
781 kde_len = pos - kde;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800782 }
783#endif /* CONFIG_P2P */
784
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700785 if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800786 kde, kde_len, ptk) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700787 goto failed;
788
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800789 os_free(kde_buf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700790 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
791 return;
792
793failed:
Dmitry Shmidtcf32e602014-01-28 10:57:39 -0800794 os_free(kde_buf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700795 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
796}
797
798
799static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
800{
801 struct wpa_sm *sm = eloop_ctx;
802 rsn_preauth_candidate_process(sm);
803}
804
805
806static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
807 const u8 *addr, int secure)
808{
809 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
810 "WPA: Key negotiation completed with "
811 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
812 wpa_cipher_txt(sm->pairwise_cipher),
813 wpa_cipher_txt(sm->group_cipher));
814 wpa_sm_cancel_auth_timeout(sm);
815 wpa_sm_set_state(sm, WPA_COMPLETED);
816
817 if (secure) {
818 wpa_sm_mlme_setprotection(
819 sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
820 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
Hai Shalome21d4e82020-04-29 16:34:06 -0700821 eapol_sm_notify_portValid(sm->eapol, true);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700822 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
823 sm->key_mgmt == WPA_KEY_MGMT_DPP ||
824 sm->key_mgmt == WPA_KEY_MGMT_OWE)
Hai Shalome21d4e82020-04-29 16:34:06 -0700825 eapol_sm_notify_eap_success(sm->eapol, true);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700826 /*
827 * Start preauthentication after a short wait to avoid a
828 * possible race condition between the data receive and key
829 * configuration after the 4-Way Handshake. This increases the
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800830 * likelihood of the first preauth EAPOL-Start frame getting to
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700831 * the target AP.
832 */
Hai Shalom74f70d42019-02-11 14:42:39 -0800833 if (!dl_list_empty(&sm->pmksa_candidates))
834 eloop_register_timeout(1, 0, wpa_sm_start_preauth,
835 sm, NULL);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700836 }
837
838 if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
839 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
840 "RSN: Authenticator accepted "
841 "opportunistic PMKSA entry - marking it valid");
842 sm->cur_pmksa->opportunistic = 0;
843 }
844
845#ifdef CONFIG_IEEE80211R
846 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
847 /* Prepare for the next transition */
848 wpa_ft_prepare_auth_request(sm, NULL);
849 }
850#endif /* CONFIG_IEEE80211R */
851}
852
853
854static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
855{
856 struct wpa_sm *sm = eloop_ctx;
857 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
858 wpa_sm_key_request(sm, 0, 1);
859}
860
861
862static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
Hai Shalomfdcde762020-04-02 11:19:20 -0700863 const struct wpa_eapol_key *key,
864 enum key_flag key_flag)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700865{
866 int keylen, rsclen;
867 enum wpa_alg alg;
868 const u8 *key_rsc;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800869
Mathy Vanhoefc66556c2017-09-29 04:22:51 +0200870 if (sm->ptk.installed) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800871 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
872 "WPA: Do not re-install same PTK to the driver");
873 return 0;
874 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700875
876 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
877 "WPA: Installing PTK to the driver");
878
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700879 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700880 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
881 "Suite: NONE - do not use pairwise keys");
882 return 0;
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700883 }
884
885 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700886 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
887 "WPA: Unsupported pairwise cipher %d",
888 sm->pairwise_cipher);
889 return -1;
890 }
891
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700892 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
893 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700894 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
895 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
896 keylen, (long unsigned int) sm->ptk.tk_len);
897 return -1;
898 }
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700899 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
900
Dmitry Shmidtf21452a2014-02-26 10:55:25 -0800901 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700902 key_rsc = null_rsc;
903 } else {
904 key_rsc = key->key_rsc;
905 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
906 }
907
Hai Shalomfdcde762020-04-02 11:19:20 -0700908 if (wpa_sm_set_key(sm, alg, sm->bssid, sm->keyidx_active, 1, key_rsc,
909 rsclen, sm->ptk.tk, keylen,
910 KEY_FLAG_PAIRWISE | key_flag) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700911 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
Hai Shalomfdcde762020-04-02 11:19:20 -0700912 "WPA: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
913 MACSTR " idx=%d key_flag=0x%x)",
914 alg, keylen, MAC2STR(sm->bssid),
915 sm->keyidx_active, key_flag);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700916 return -1;
917 }
918
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800919 /* TK is not needed anymore in supplicant */
Dmitry Shmidt807291d2015-01-27 13:40:23 -0800920 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700921 sm->ptk.tk_len = 0;
Mathy Vanhoefc66556c2017-09-29 04:22:51 +0200922 sm->ptk.installed = 1;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800923
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700924 if (sm->wpa_ptk_rekey) {
925 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
926 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
927 sm, NULL);
928 }
Hai Shalomfdcde762020-04-02 11:19:20 -0700929 return 0;
930}
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700931
Hai Shalomfdcde762020-04-02 11:19:20 -0700932
933static int wpa_supplicant_activate_ptk(struct wpa_sm *sm)
934{
935 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
936 "WPA: Activate PTK (idx=%d bssid=" MACSTR ")",
937 sm->keyidx_active, MAC2STR(sm->bssid));
938
939 if (wpa_sm_set_key(sm, 0, sm->bssid, sm->keyidx_active, 0, NULL, 0,
940 NULL, 0, KEY_FLAG_PAIRWISE_RX_TX_MODIFY) < 0) {
941 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
942 "WPA: Failed to activate PTK for TX (idx=%d bssid="
943 MACSTR ")", sm->keyidx_active, MAC2STR(sm->bssid));
944 return -1;
945 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700946 return 0;
947}
948
949
950static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
951 int group_cipher,
952 int keylen, int maxkeylen,
953 int *key_rsc_len,
954 enum wpa_alg *alg)
955{
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700956 int klen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700957
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700958 *alg = wpa_cipher_to_alg(group_cipher);
959 if (*alg == WPA_ALG_NONE) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700960 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
961 "WPA: Unsupported Group Cipher %d",
962 group_cipher);
963 return -1;
964 }
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700965 *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700966
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700967 klen = wpa_cipher_key_len(group_cipher);
968 if (keylen != klen || maxkeylen < klen) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700969 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
970 "WPA: Unsupported %s Group Cipher key length %d (%d)",
971 wpa_cipher_txt(group_cipher), keylen, maxkeylen);
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700972 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700973 }
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -0700974 return 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700975}
976
977
978struct wpa_gtk_data {
979 enum wpa_alg alg;
980 int tx, key_rsc_len, keyidx;
981 u8 gtk[32];
982 int gtk_len;
983};
984
985
986static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
987 const struct wpa_gtk_data *gd,
Jouni Malinen58c0e962017-10-01 12:12:24 +0300988 const u8 *key_rsc, int wnm_sleep)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700989{
990 const u8 *_gtk = gd->gtk;
991 u8 gtk_buf[32];
992
Mathy Vanhoef10bfd642017-07-12 16:03:24 +0200993 /* Detect possible key reinstallation */
Jouni Malinen58c0e962017-10-01 12:12:24 +0300994 if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
995 os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
996 (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
997 os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
998 sm->gtk_wnm_sleep.gtk_len) == 0)) {
Mathy Vanhoef10bfd642017-07-12 16:03:24 +0200999 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1000 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
1001 gd->keyidx, gd->tx, gd->gtk_len);
1002 return 0;
1003 }
1004
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001005 wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
1006 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1007 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
1008 gd->keyidx, gd->tx, gd->gtk_len);
1009 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
1010 if (sm->group_cipher == WPA_CIPHER_TKIP) {
1011 /* Swap Tx/Rx keys for Michael MIC */
1012 os_memcpy(gtk_buf, gd->gtk, 16);
1013 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
1014 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
1015 _gtk = gtk_buf;
1016 }
1017 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
1018 if (wpa_sm_set_key(sm, gd->alg, NULL,
1019 gd->keyidx, 1, key_rsc, gd->key_rsc_len,
Hai Shalomfdcde762020-04-02 11:19:20 -07001020 _gtk, gd->gtk_len,
1021 KEY_FLAG_GROUP_RX_TX_DEFAULT) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001022 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1023 "WPA: Failed to set GTK to the driver "
1024 "(Group only)");
Hai Shalom81f62d82019-07-22 12:10:00 -07001025 forced_memzero(gtk_buf, sizeof(gtk_buf));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001026 return -1;
1027 }
1028 } else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
1029 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
Hai Shalomfdcde762020-04-02 11:19:20 -07001030 _gtk, gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001031 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1032 "WPA: Failed to set GTK to "
1033 "the driver (alg=%d keylen=%d keyidx=%d)",
1034 gd->alg, gd->gtk_len, gd->keyidx);
Hai Shalom81f62d82019-07-22 12:10:00 -07001035 forced_memzero(gtk_buf, sizeof(gtk_buf));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001036 return -1;
1037 }
Hai Shalom81f62d82019-07-22 12:10:00 -07001038 forced_memzero(gtk_buf, sizeof(gtk_buf));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001039
Jouni Malinen58c0e962017-10-01 12:12:24 +03001040 if (wnm_sleep) {
1041 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
1042 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
1043 sm->gtk_wnm_sleep.gtk_len);
1044 } else {
1045 sm->gtk.gtk_len = gd->gtk_len;
1046 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
1047 }
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001048
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001049 return 0;
1050}
1051
1052
1053static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
1054 int tx)
1055{
1056 if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
1057 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
1058 * seemed to set this bit (incorrectly, since Tx is only when
1059 * doing Group Key only APs) and without this workaround, the
1060 * data connection does not work because wpa_supplicant
1061 * configured non-zero keyidx to be used for unicast. */
1062 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1063 "WPA: Tx bit set for GTK, but pairwise "
1064 "keys are used - ignore Tx bit");
1065 return 0;
1066 }
1067 return tx;
1068}
1069
1070
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001071static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
1072 const u8 *rsc)
1073{
1074 int rsclen;
1075
1076 if (!sm->wpa_rsc_relaxation)
1077 return 0;
1078
1079 rsclen = wpa_cipher_rsc_len(sm->group_cipher);
1080
1081 /*
1082 * Try to detect RSC (endian) corruption issue where the AP sends
1083 * the RSC bytes in EAPOL-Key message in the wrong order, both if
1084 * it's actually a 6-byte field (as it should be) and if it treats
1085 * it as an 8-byte field.
1086 * An AP model known to have this bug is the Sapido RB-1632.
1087 */
1088 if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
1089 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1090 "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
1091 rsc[0], rsc[1], rsc[2], rsc[3],
1092 rsc[4], rsc[5], rsc[6], rsc[7]);
1093
1094 return 1;
1095 }
1096
1097 return 0;
1098}
1099
1100
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001101static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1102 const struct wpa_eapol_key *key,
1103 const u8 *gtk, size_t gtk_len,
1104 int key_info)
1105{
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001106 struct wpa_gtk_data gd;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001107 const u8 *key_rsc;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001108
1109 /*
1110 * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1111 * GTK KDE format:
1112 * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1113 * Reserved [bits 0-7]
1114 * GTK
1115 */
1116
1117 os_memset(&gd, 0, sizeof(gd));
1118 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1119 gtk, gtk_len);
1120
1121 if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
1122 return -1;
1123
1124 gd.keyidx = gtk[0] & 0x3;
1125 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1126 !!(gtk[0] & BIT(2)));
1127 gtk += 2;
1128 gtk_len -= 2;
1129
1130 os_memcpy(gd.gtk, gtk, gtk_len);
1131 gd.gtk_len = gtk_len;
1132
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001133 key_rsc = key->key_rsc;
1134 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1135 key_rsc = null_rsc;
1136
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001137 if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
1138 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1139 gtk_len, gtk_len,
1140 &gd.key_rsc_len, &gd.alg) ||
Jouni Malinen58c0e962017-10-01 12:12:24 +03001141 wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001142 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1143 "RSN: Failed to install GTK");
Hai Shalom81f62d82019-07-22 12:10:00 -07001144 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001145 return -1;
1146 }
Hai Shalom81f62d82019-07-22 12:10:00 -07001147 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001148
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001149 return 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001150}
1151
1152
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001153static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
Jouni Malinen58c0e962017-10-01 12:12:24 +03001154 const struct wpa_igtk_kde *igtk,
1155 int wnm_sleep)
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001156{
1157 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1158 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1159
1160 /* Detect possible key reinstallation */
Jouni Malinen58c0e962017-10-01 12:12:24 +03001161 if ((sm->igtk.igtk_len == len &&
1162 os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1163 (sm->igtk_wnm_sleep.igtk_len == len &&
1164 os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1165 sm->igtk_wnm_sleep.igtk_len) == 0)) {
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001166 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1167 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1168 keyidx);
1169 return 0;
1170 }
1171
1172 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
Hai Shalom39ba6fc2019-01-22 12:40:38 -08001173 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001174 keyidx, MAC2STR(igtk->pn));
1175 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1176 if (keyidx > 4095) {
1177 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1178 "WPA: Invalid IGTK KeyID %d", keyidx);
1179 return -1;
1180 }
1181 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1182 broadcast_ether_addr,
1183 keyidx, 0, igtk->pn, sizeof(igtk->pn),
Hai Shalomfdcde762020-04-02 11:19:20 -07001184 igtk->igtk, len, KEY_FLAG_GROUP_RX) < 0) {
Hai Shalom5f92bc92019-04-18 11:54:11 -07001185 if (keyidx == 0x0400 || keyidx == 0x0500) {
1186 /* Assume the AP has broken PMF implementation since it
1187 * seems to have swapped the KeyID bytes. The AP cannot
1188 * be trusted to implement BIP correctly or provide a
1189 * valid IGTK, so do not try to configure this key with
1190 * swapped KeyID bytes. Instead, continue without
1191 * configuring the IGTK so that the driver can drop any
1192 * received group-addressed robust management frames due
1193 * to missing keys.
1194 *
1195 * Normally, this error behavior would result in us
1196 * disconnecting, but there are number of deployed APs
1197 * with this broken behavior, so as an interoperability
1198 * workaround, allow the connection to proceed. */
1199 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1200 "WPA: Ignore IGTK configuration error due to invalid IGTK KeyID byte order");
1201 } else {
1202 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1203 "WPA: Failed to configure IGTK to the driver");
1204 return -1;
1205 }
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001206 }
1207
Jouni Malinen58c0e962017-10-01 12:12:24 +03001208 if (wnm_sleep) {
1209 sm->igtk_wnm_sleep.igtk_len = len;
1210 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1211 sm->igtk_wnm_sleep.igtk_len);
1212 } else {
1213 sm->igtk.igtk_len = len;
1214 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1215 }
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001216
1217 return 0;
1218}
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001219
1220
Hai Shalomfdcde762020-04-02 11:19:20 -07001221static int wpa_supplicant_install_bigtk(struct wpa_sm *sm,
1222 const struct wpa_bigtk_kde *bigtk,
1223 int wnm_sleep)
1224{
1225 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1226 u16 keyidx = WPA_GET_LE16(bigtk->keyid);
1227
1228 /* Detect possible key reinstallation */
1229 if ((sm->bigtk.bigtk_len == len &&
1230 os_memcmp(sm->bigtk.bigtk, bigtk->bigtk,
1231 sm->bigtk.bigtk_len) == 0) ||
1232 (sm->bigtk_wnm_sleep.bigtk_len == len &&
1233 os_memcmp(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1234 sm->bigtk_wnm_sleep.bigtk_len) == 0)) {
1235 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1236 "WPA: Not reinstalling already in-use BIGTK to the driver (keyidx=%d)",
1237 keyidx);
1238 return 0;
1239 }
1240
1241 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1242 "WPA: BIGTK keyid %d pn " COMPACT_MACSTR,
1243 keyidx, MAC2STR(bigtk->pn));
1244 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK", bigtk->bigtk, len);
1245 if (keyidx < 6 || keyidx > 7) {
1246 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1247 "WPA: Invalid BIGTK KeyID %d", keyidx);
1248 return -1;
1249 }
1250 if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1251 broadcast_ether_addr,
1252 keyidx, 0, bigtk->pn, sizeof(bigtk->pn),
1253 bigtk->bigtk, len, KEY_FLAG_GROUP_RX) < 0) {
1254 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1255 "WPA: Failed to configure BIGTK to the driver");
1256 return -1;
1257 }
1258
1259 if (wnm_sleep) {
1260 sm->bigtk_wnm_sleep.bigtk_len = len;
1261 os_memcpy(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1262 sm->bigtk_wnm_sleep.bigtk_len);
1263 } else {
1264 sm->bigtk.bigtk_len = len;
1265 os_memcpy(sm->bigtk.bigtk, bigtk->bigtk, sm->bigtk.bigtk_len);
1266 }
1267
1268 return 0;
1269}
1270
1271
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001272static int ieee80211w_set_keys(struct wpa_sm *sm,
1273 struct wpa_eapol_ie_parse *ie)
1274{
Hai Shalomfdcde762020-04-02 11:19:20 -07001275 size_t len;
1276
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001277 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001278 return 0;
1279
1280 if (ie->igtk) {
1281 const struct wpa_igtk_kde *igtk;
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001282
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001283 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1284 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001285 return -1;
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02001286
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001287 igtk = (const struct wpa_igtk_kde *) ie->igtk;
Jouni Malinen58c0e962017-10-01 12:12:24 +03001288 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001289 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001290 }
1291
Hai Shalomfdcde762020-04-02 11:19:20 -07001292 if (ie->bigtk && sm->beacon_prot) {
1293 const struct wpa_bigtk_kde *bigtk;
1294
1295 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1296 if (ie->bigtk_len != WPA_BIGTK_KDE_PREFIX_LEN + len)
1297 return -1;
1298
1299 bigtk = (const struct wpa_bigtk_kde *) ie->bigtk;
1300 if (wpa_supplicant_install_bigtk(sm, bigtk, 0) < 0)
1301 return -1;
1302 }
1303
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001304 return 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001305}
1306
1307
1308static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1309 const char *reason, const u8 *src_addr,
1310 const u8 *wpa_ie, size_t wpa_ie_len,
1311 const u8 *rsn_ie, size_t rsn_ie_len)
1312{
1313 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
1314 reason, MAC2STR(src_addr));
1315
1316 if (sm->ap_wpa_ie) {
1317 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1318 sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1319 }
1320 if (wpa_ie) {
1321 if (!sm->ap_wpa_ie) {
1322 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1323 "WPA: No WPA IE in Beacon/ProbeResp");
1324 }
1325 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1326 wpa_ie, wpa_ie_len);
1327 }
1328
1329 if (sm->ap_rsn_ie) {
1330 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1331 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1332 }
1333 if (rsn_ie) {
1334 if (!sm->ap_rsn_ie) {
1335 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1336 "WPA: No RSN IE in Beacon/ProbeResp");
1337 }
1338 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1339 rsn_ie, rsn_ie_len);
1340 }
1341
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08001342 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001343}
1344
1345
1346#ifdef CONFIG_IEEE80211R
1347
1348static int ft_validate_mdie(struct wpa_sm *sm,
1349 const unsigned char *src_addr,
1350 struct wpa_eapol_ie_parse *ie,
1351 const u8 *assoc_resp_mdie)
1352{
1353 struct rsn_mdie *mdie;
1354
1355 mdie = (struct rsn_mdie *) (ie->mdie + 2);
1356 if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
1357 os_memcmp(mdie->mobility_domain, sm->mobility_domain,
1358 MOBILITY_DOMAIN_ID_LEN) != 0) {
1359 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
1360 "not match with the current mobility domain");
1361 return -1;
1362 }
1363
1364 if (assoc_resp_mdie &&
1365 (assoc_resp_mdie[1] != ie->mdie[1] ||
1366 os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
1367 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
1368 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
1369 ie->mdie, 2 + ie->mdie[1]);
1370 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
1371 assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
1372 return -1;
1373 }
1374
1375 return 0;
1376}
1377
1378
1379static int ft_validate_ftie(struct wpa_sm *sm,
1380 const unsigned char *src_addr,
1381 struct wpa_eapol_ie_parse *ie,
1382 const u8 *assoc_resp_ftie)
1383{
1384 if (ie->ftie == NULL) {
1385 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1386 "FT: No FTIE in EAPOL-Key msg 3/4");
1387 return -1;
1388 }
1389
1390 if (assoc_resp_ftie == NULL)
1391 return 0;
1392
1393 if (assoc_resp_ftie[1] != ie->ftie[1] ||
1394 os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
1395 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
1396 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
1397 ie->ftie, 2 + ie->ftie[1]);
1398 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
1399 assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
1400 return -1;
1401 }
1402
1403 return 0;
1404}
1405
1406
1407static int ft_validate_rsnie(struct wpa_sm *sm,
1408 const unsigned char *src_addr,
1409 struct wpa_eapol_ie_parse *ie)
1410{
1411 struct wpa_ie_data rsn;
1412
1413 if (!ie->rsn_ie)
1414 return 0;
1415
1416 /*
1417 * Verify that PMKR1Name from EAPOL-Key message 3/4
1418 * matches with the value we derived.
1419 */
1420 if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
1421 rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
1422 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
1423 "FT 4-way handshake message 3/4");
1424 return -1;
1425 }
1426
Dmitry Shmidtc2817022014-07-02 10:32:10 -07001427 if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
1428 {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001429 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1430 "FT: PMKR1Name mismatch in "
1431 "FT 4-way handshake message 3/4");
1432 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
1433 rsn.pmkid, WPA_PMK_NAME_LEN);
1434 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1435 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1436 return -1;
1437 }
1438
1439 return 0;
1440}
1441
1442
1443static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
1444 const unsigned char *src_addr,
1445 struct wpa_eapol_ie_parse *ie)
1446{
1447 const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
1448
1449 if (sm->assoc_resp_ies) {
1450 pos = sm->assoc_resp_ies;
1451 end = pos + sm->assoc_resp_ies_len;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001452 while (end - pos > 2) {
1453 if (2 + pos[1] > end - pos)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001454 break;
1455 switch (*pos) {
1456 case WLAN_EID_MOBILITY_DOMAIN:
1457 mdie = pos;
1458 break;
1459 case WLAN_EID_FAST_BSS_TRANSITION:
1460 ftie = pos;
1461 break;
1462 }
1463 pos += 2 + pos[1];
1464 }
1465 }
1466
1467 if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
1468 ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
1469 ft_validate_rsnie(sm, src_addr, ie) < 0)
1470 return -1;
1471
1472 return 0;
1473}
1474
1475#endif /* CONFIG_IEEE80211R */
1476
1477
1478static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1479 const unsigned char *src_addr,
1480 struct wpa_eapol_ie_parse *ie)
1481{
1482 if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
1483 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1484 "WPA: No WPA/RSN IE for this AP known. "
1485 "Trying to get from scan results");
1486 if (wpa_sm_get_beacon_ie(sm) < 0) {
1487 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1488 "WPA: Could not find AP from "
1489 "the scan results");
Hai Shalomfdcde762020-04-02 11:19:20 -07001490 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001491 }
Hai Shalomfdcde762020-04-02 11:19:20 -07001492 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
1493 "WPA: Found the current AP from updated scan results");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001494 }
1495
1496 if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1497 (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1498 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1499 "with IE in Beacon/ProbeResp (no IE?)",
1500 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1501 ie->rsn_ie, ie->rsn_ie_len);
1502 return -1;
1503 }
1504
1505 if ((ie->wpa_ie && sm->ap_wpa_ie &&
1506 (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1507 os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1508 (ie->rsn_ie && sm->ap_rsn_ie &&
1509 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
1510 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
1511 ie->rsn_ie, ie->rsn_ie_len))) {
1512 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1513 "with IE in Beacon/ProbeResp",
1514 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1515 ie->rsn_ie, ie->rsn_ie_len);
1516 return -1;
1517 }
1518
1519 if (sm->proto == WPA_PROTO_WPA &&
1520 ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
1521 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1522 "detected - RSN was enabled and RSN IE "
1523 "was in msg 3/4, but not in "
1524 "Beacon/ProbeResp",
1525 src_addr, ie->wpa_ie, ie->wpa_ie_len,
1526 ie->rsn_ie, ie->rsn_ie_len);
1527 return -1;
1528 }
1529
Hai Shalomc3565922019-10-28 11:58:20 -07001530 if ((sm->ap_rsnxe && !ie->rsnxe) ||
1531 (!sm->ap_rsnxe && ie->rsnxe) ||
1532 (sm->ap_rsnxe && ie->rsnxe &&
1533 (sm->ap_rsnxe_len != ie->rsnxe_len ||
1534 os_memcmp(sm->ap_rsnxe, ie->rsnxe, sm->ap_rsnxe_len) != 0))) {
1535 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1536 "WPA: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
Hai Shalomfdcde762020-04-02 11:19:20 -07001537 wpa_hexdump(MSG_INFO, "RSNXE in Beacon/ProbeResp",
1538 sm->ap_rsnxe, sm->ap_rsnxe_len);
1539 wpa_hexdump(MSG_INFO, "RSNXE in EAPOL-Key msg 3/4",
1540 ie->rsnxe, ie->rsnxe_len);
1541 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
Hai Shalomc3565922019-10-28 11:58:20 -07001542 return -1;
1543 }
1544
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001545#ifdef CONFIG_IEEE80211R
1546 if (wpa_key_mgmt_ft(sm->key_mgmt) &&
1547 wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
1548 return -1;
1549#endif /* CONFIG_IEEE80211R */
1550
1551 return 0;
1552}
1553
1554
1555/**
1556 * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
1557 * @sm: Pointer to WPA state machine data from wpa_sm_init()
1558 * @dst: Destination address for the frame
1559 * @key: Pointer to the EAPOL-Key frame header
1560 * @ver: Version bits from EAPOL-Key Key Info
1561 * @key_info: Key Info
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001562 * @ptk: PTK to use for keyed hash and encryption
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001563 * Returns: >= 0 on success, < 0 on failure
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001564 */
1565int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
1566 const struct wpa_eapol_key *key,
1567 u16 ver, u16 key_info,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001568 struct wpa_ptk *ptk)
1569{
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001570 size_t mic_len, hdrlen, rlen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001571 struct wpa_eapol_key *reply;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001572 u8 *rbuf, *key_mic;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001573
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001574 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001575 hdrlen = sizeof(*reply) + mic_len + 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001576 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001577 hdrlen, &rlen, (void *) &reply);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001578 if (rbuf == NULL)
1579 return -1;
1580
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001581 reply->type = (sm->proto == WPA_PROTO_RSN ||
1582 sm->proto == WPA_PROTO_OSEN) ?
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001583 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1584 key_info &= WPA_KEY_INFO_SECURE;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001585 key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
1586 if (mic_len)
1587 key_info |= WPA_KEY_INFO_MIC;
1588 else
1589 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001590 WPA_PUT_BE16(reply->key_info, key_info);
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001591 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001592 WPA_PUT_BE16(reply->key_length, 0);
1593 else
1594 os_memcpy(reply->key_length, key->key_length, 2);
1595 os_memcpy(reply->replay_counter, key->replay_counter,
1596 WPA_REPLAY_COUNTER_LEN);
1597
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001598 key_mic = (u8 *) (reply + 1);
1599 WPA_PUT_BE16(key_mic + mic_len, 0);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001600
Roshan Pius5e7db942018-04-12 12:27:41 -07001601 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Sending EAPOL-Key 4/4");
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001602 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
1603 key_mic);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001604}
1605
1606
1607static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
1608 const struct wpa_eapol_key *key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001609 u16 ver, const u8 *key_data,
1610 size_t key_data_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001611{
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001612 u16 key_info, keylen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001613 struct wpa_eapol_ie_parse ie;
1614
1615 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
Roshan Pius5e7db942018-04-12 12:27:41 -07001616 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO, "WPA: RX message 3 of 4-Way "
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001617 "Handshake from " MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
1618
1619 key_info = WPA_GET_BE16(key->key_info);
1620
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001621 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
1622 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001623 goto failed;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001624 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1625 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1626 "WPA: GTK IE in unencrypted key data");
1627 goto failed;
1628 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001629 if (ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1630 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1631 "WPA: IGTK KDE in unencrypted key data");
1632 goto failed;
1633 }
1634
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001635 if (ie.igtk &&
1636 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
1637 ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
1638 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001639 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1640 "WPA: Invalid IGTK KDE length %lu",
1641 (unsigned long) ie.igtk_len);
1642 goto failed;
1643 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001644
1645 if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
1646 goto failed;
1647
Hai Shalomfdcde762020-04-02 11:19:20 -07001648 if (wpa_handle_ext_key_id(sm, &ie))
1649 goto failed;
1650
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001651 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
1652 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1653 "WPA: ANonce from message 1 of 4-Way Handshake "
1654 "differs from 3 of 4-Way Handshake - drop packet (src="
1655 MACSTR ")", MAC2STR(sm->bssid));
1656 goto failed;
1657 }
1658
1659 keylen = WPA_GET_BE16(key->key_length);
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07001660 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
1661 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1662 "WPA: Invalid %s key length %d (src=" MACSTR
1663 ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
1664 MAC2STR(sm->bssid));
1665 goto failed;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001666 }
1667
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08001668#ifdef CONFIG_P2P
1669 if (ie.ip_addr_alloc) {
1670 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
1671 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
1672 sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
1673 }
1674#endif /* CONFIG_P2P */
1675
Hai Shalom74f70d42019-02-11 14:42:39 -08001676#ifdef CONFIG_OCV
1677 if (wpa_sm_ocv_enabled(sm)) {
1678 struct wpa_channel_info ci;
1679
1680 if (wpa_sm_channel_info(sm, &ci) != 0) {
1681 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1682 "Failed to get channel info to validate received OCI in EAPOL-Key 3/4");
1683 return;
1684 }
1685
1686 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1687 channel_width_to_int(ci.chanwidth),
1688 ci.seg1_idx) != 0) {
1689 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1690 ocv_errorstr);
1691 return;
1692 }
1693 }
1694#endif /* CONFIG_OCV */
1695
Hai Shalomfdcde762020-04-02 11:19:20 -07001696 if (sm->use_ext_key_id &&
1697 wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX))
1698 goto failed;
1699
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001700 if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001701 &sm->ptk) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001702 goto failed;
1703 }
1704
1705 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1706 * for the next 4-Way Handshake. If msg 3 is received again, the old
1707 * SNonce will still be used to avoid changing PTK. */
1708 sm->renew_snonce = 1;
1709
1710 if (key_info & WPA_KEY_INFO_INSTALL) {
Hai Shalomfdcde762020-04-02 11:19:20 -07001711 int res;
1712
1713 if (sm->use_ext_key_id)
1714 res = wpa_supplicant_activate_ptk(sm);
1715 else
1716 res = wpa_supplicant_install_ptk(sm, key,
1717 KEY_FLAG_RX_TX);
1718 if (res)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001719 goto failed;
1720 }
1721
1722 if (key_info & WPA_KEY_INFO_SECURE) {
1723 wpa_sm_mlme_setprotection(
1724 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
1725 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
Hai Shalome21d4e82020-04-29 16:34:06 -07001726 eapol_sm_notify_portValid(sm->eapol, true);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001727 }
1728 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1729
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001730 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
Hai Shalom5f92bc92019-04-18 11:54:11 -07001731 /* No GTK to be set to the driver */
1732 } else if (!ie.gtk && sm->proto == WPA_PROTO_RSN) {
1733 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1734 "RSN: No GTK KDE included in EAPOL-Key msg 3/4");
1735 goto failed;
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08001736 } else if (ie.gtk &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001737 wpa_supplicant_pairwise_gtk(sm, key,
1738 ie.gtk, ie.gtk_len, key_info) < 0) {
1739 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1740 "RSN: Failed to configure GTK");
1741 goto failed;
1742 }
1743
1744 if (ieee80211w_set_keys(sm, &ie) < 0) {
1745 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1746 "RSN: Failed to configure IGTK");
1747 goto failed;
1748 }
1749
Hai Shalom5f92bc92019-04-18 11:54:11 -07001750 if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED || ie.gtk)
1751 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1752 key_info & WPA_KEY_INFO_SECURE);
1753
Dmitry Shmidtcce06662013-11-04 18:44:24 -08001754 if (ie.gtk)
1755 wpa_sm_set_rekey_offload(sm);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001756
Hai Shalom39ba6fc2019-01-22 12:40:38 -08001757 /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
1758 * calculated only after KCK has been derived. Though, do not replace an
1759 * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
1760 * to avoid unnecessary changes of PMKID while continuing to use the
1761 * same PMK. */
1762 if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
1763 !sm->cur_pmksa) {
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001764 struct rsn_pmksa_cache_entry *sa;
1765
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08001766 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001767 sm->ptk.kck, sm->ptk.kck_len,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001768 sm->bssid, sm->own_addr,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001769 sm->network_ctx, sm->key_mgmt, NULL);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001770 if (!sm->cur_pmksa)
1771 sm->cur_pmksa = sa;
1772 }
1773
Hai Shalomfdcde762020-04-02 11:19:20 -07001774 if (ie.transition_disable)
1775 wpa_sm_transition_disable(sm, ie.transition_disable[0]);
Dmitry Shmidt4dd28dc2015-03-10 11:21:43 -07001776 sm->msg_3_of_4_ok = 1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001777 return;
1778
1779failed:
1780 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
1781}
1782
1783
1784static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
1785 const u8 *keydata,
1786 size_t keydatalen,
1787 u16 key_info,
1788 struct wpa_gtk_data *gd)
1789{
1790 int maxkeylen;
1791 struct wpa_eapol_ie_parse ie;
1792
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08001793 wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
1794 keydata, keydatalen);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001795 if (wpa_supplicant_parse_ies(keydata, keydatalen, &ie) < 0)
1796 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001797 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1798 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1799 "WPA: GTK IE in unencrypted key data");
1800 return -1;
1801 }
1802 if (ie.gtk == NULL) {
1803 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1804 "WPA: No GTK IE in Group Key msg 1/2");
1805 return -1;
1806 }
1807 maxkeylen = gd->gtk_len = ie.gtk_len - 2;
1808
Hai Shalom74f70d42019-02-11 14:42:39 -08001809#ifdef CONFIG_OCV
1810 if (wpa_sm_ocv_enabled(sm)) {
1811 struct wpa_channel_info ci;
1812
1813 if (wpa_sm_channel_info(sm, &ci) != 0) {
1814 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1815 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
1816 return -1;
1817 }
1818
1819 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
1820 channel_width_to_int(ci.chanwidth),
1821 ci.seg1_idx) != 0) {
1822 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "%s",
1823 ocv_errorstr);
1824 return -1;
1825 }
1826 }
1827#endif /* CONFIG_OCV */
1828
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001829 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1830 gd->gtk_len, maxkeylen,
1831 &gd->key_rsc_len, &gd->alg))
1832 return -1;
1833
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001834 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
1835 ie.gtk, ie.gtk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001836 gd->keyidx = ie.gtk[0] & 0x3;
1837 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1838 !!(ie.gtk[0] & BIT(2)));
1839 if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
1840 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1841 "RSN: Too long GTK in GTK IE (len=%lu)",
1842 (unsigned long) ie.gtk_len - 2);
1843 return -1;
1844 }
1845 os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
1846
1847 if (ieee80211w_set_keys(sm, &ie) < 0)
1848 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1849 "RSN: Failed to configure IGTK");
1850
1851 return 0;
1852}
1853
1854
1855static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
1856 const struct wpa_eapol_key *key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001857 const u8 *key_data,
1858 size_t key_data_len, u16 key_info,
1859 u16 ver, struct wpa_gtk_data *gd)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001860{
1861 size_t maxkeylen;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001862 u16 gtk_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001863
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001864 gtk_len = WPA_GET_BE16(key->key_length);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001865 maxkeylen = key_data_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001866 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1867 if (maxkeylen < 8) {
1868 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1869 "WPA: Too short maxkeylen (%lu)",
1870 (unsigned long) maxkeylen);
1871 return -1;
1872 }
1873 maxkeylen -= 8;
1874 }
1875
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001876 if (gtk_len > maxkeylen ||
1877 wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1878 gtk_len, maxkeylen,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001879 &gd->key_rsc_len, &gd->alg))
1880 return -1;
1881
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08001882 gd->gtk_len = gtk_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001883 gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1884 WPA_KEY_INFO_KEY_INDEX_SHIFT;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001885 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001886#ifdef CONFIG_NO_RC4
1887 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1888 "WPA: RC4 not supported in the build");
1889 return -1;
1890#else /* CONFIG_NO_RC4 */
Dmitry Shmidt61593f02014-04-21 16:27:35 -07001891 u8 ek[32];
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001892 if (key_data_len > sizeof(gd->gtk)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001893 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1894 "WPA: RC4 key data too long (%lu)",
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001895 (unsigned long) key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001896 return -1;
1897 }
Dmitry Shmidt61593f02014-04-21 16:27:35 -07001898 os_memcpy(ek, key->key_iv, 16);
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001899 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001900 os_memcpy(gd->gtk, key_data, key_data_len);
1901 if (rc4_skip(ek, 32, 256, gd->gtk, key_data_len)) {
Hai Shalom81f62d82019-07-22 12:10:00 -07001902 forced_memzero(ek, sizeof(ek));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001903 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1904 "WPA: RC4 failed");
1905 return -1;
1906 }
Hai Shalom81f62d82019-07-22 12:10:00 -07001907 forced_memzero(ek, sizeof(ek));
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08001908#endif /* CONFIG_NO_RC4 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001909 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001910 if (maxkeylen % 8) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001911 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1912 "WPA: Unsupported AES-WRAP len %lu",
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001913 (unsigned long) maxkeylen);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001914 return -1;
1915 }
1916 if (maxkeylen > sizeof(gd->gtk)) {
1917 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1918 "WPA: AES-WRAP key data "
1919 "too long (keydatalen=%lu maxkeylen=%lu)",
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07001920 (unsigned long) key_data_len,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001921 (unsigned long) maxkeylen);
1922 return -1;
1923 }
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001924 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
1925 key_data, gd->gtk)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001926 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1927 "WPA: AES unwrap failed - could not decrypt "
1928 "GTK");
1929 return -1;
1930 }
1931 } else {
1932 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1933 "WPA: Unsupported key_info type %d", ver);
1934 return -1;
1935 }
1936 gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
1937 sm, !!(key_info & WPA_KEY_INFO_TXRX));
1938 return 0;
1939}
1940
1941
1942static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
1943 const struct wpa_eapol_key *key,
1944 int ver, u16 key_info)
1945{
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001946 size_t mic_len, hdrlen, rlen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001947 struct wpa_eapol_key *reply;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08001948 u8 *rbuf, *key_mic;
Hai Shalom74f70d42019-02-11 14:42:39 -08001949 size_t kde_len = 0;
1950
1951#ifdef CONFIG_OCV
1952 if (wpa_sm_ocv_enabled(sm))
1953 kde_len = OCV_OCI_KDE_LEN;
1954#endif /* CONFIG_OCV */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001955
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001956 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001957 hdrlen = sizeof(*reply) + mic_len + 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001958 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
Hai Shalom74f70d42019-02-11 14:42:39 -08001959 hdrlen + kde_len, &rlen, (void *) &reply);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001960 if (rbuf == NULL)
1961 return -1;
1962
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001963 reply->type = (sm->proto == WPA_PROTO_RSN ||
1964 sm->proto == WPA_PROTO_OSEN) ?
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001965 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1966 key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001967 key_info |= ver | WPA_KEY_INFO_SECURE;
1968 if (mic_len)
1969 key_info |= WPA_KEY_INFO_MIC;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07001970 else
1971 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001972 WPA_PUT_BE16(reply->key_info, key_info);
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08001973 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001974 WPA_PUT_BE16(reply->key_length, 0);
1975 else
1976 os_memcpy(reply->key_length, key->key_length, 2);
1977 os_memcpy(reply->replay_counter, key->replay_counter,
1978 WPA_REPLAY_COUNTER_LEN);
1979
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08001980 key_mic = (u8 *) (reply + 1);
Hai Shalom74f70d42019-02-11 14:42:39 -08001981 WPA_PUT_BE16(key_mic + mic_len, kde_len); /* Key Data Length */
1982
1983#ifdef CONFIG_OCV
1984 if (wpa_sm_ocv_enabled(sm)) {
1985 struct wpa_channel_info ci;
1986 u8 *pos;
1987
1988 if (wpa_sm_channel_info(sm, &ci) != 0) {
1989 wpa_printf(MSG_WARNING,
1990 "Failed to get channel info for OCI element in EAPOL-Key 2/2");
1991 os_free(rbuf);
1992 return -1;
1993 }
1994
1995 pos = key_mic + mic_len + 2; /* Key Data */
1996 if (ocv_insert_oci_kde(&ci, &pos) < 0) {
1997 os_free(rbuf);
1998 return -1;
1999 }
2000 }
2001#endif /* CONFIG_OCV */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002002
2003 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002004 return wpa_eapol_key_send(sm, &sm->ptk, ver, sm->bssid, ETH_P_EAPOL,
2005 rbuf, rlen, key_mic);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002006}
2007
2008
2009static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
2010 const unsigned char *src_addr,
2011 const struct wpa_eapol_key *key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002012 const u8 *key_data,
2013 size_t key_data_len, u16 ver)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002014{
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002015 u16 key_info;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002016 int rekey, ret;
2017 struct wpa_gtk_data gd;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002018 const u8 *key_rsc;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002019
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002020 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm)) {
Dmitry Shmidt4dd28dc2015-03-10 11:21:43 -07002021 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2022 "WPA: Group Key Handshake started prior to completion of 4-way handshake");
2023 goto failed;
2024 }
2025
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002026 os_memset(&gd, 0, sizeof(gd));
2027
2028 rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
2029 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of Group Key "
2030 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
2031
2032 key_info = WPA_GET_BE16(key->key_info);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002033
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002034 if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002035 ret = wpa_supplicant_process_1_of_2_rsn(sm, key_data,
2036 key_data_len, key_info,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002037 &gd);
2038 } else {
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002039 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, key_data,
2040 key_data_len,
2041 key_info, ver, &gd);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002042 }
2043
2044 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
2045
2046 if (ret)
2047 goto failed;
2048
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002049 key_rsc = key->key_rsc;
2050 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
2051 key_rsc = null_rsc;
2052
Jouni Malinen58c0e962017-10-01 12:12:24 +03002053 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002054 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002055 goto failed;
Hai Shalom81f62d82019-07-22 12:10:00 -07002056 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002057
2058 if (rekey) {
2059 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
2060 "completed with " MACSTR " [GTK=%s]",
2061 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
2062 wpa_sm_cancel_auth_timeout(sm);
2063 wpa_sm_set_state(sm, WPA_COMPLETED);
2064 } else {
2065 wpa_supplicant_key_neg_complete(sm, sm->bssid,
2066 key_info &
2067 WPA_KEY_INFO_SECURE);
2068 }
Dmitry Shmidtcce06662013-11-04 18:44:24 -08002069
2070 wpa_sm_set_rekey_offload(sm);
2071
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002072 return;
2073
2074failed:
Hai Shalom81f62d82019-07-22 12:10:00 -07002075 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002076 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2077}
2078
2079
2080static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002081 struct wpa_eapol_key *key,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002082 u16 ver,
2083 const u8 *buf, size_t len)
2084{
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002085 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002086 int ok = 0;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002087 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002088
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002089 os_memcpy(mic, key + 1, mic_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002090 if (sm->tptk_set) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002091 os_memset(key + 1, 0, mic_len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002092 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
2093 sm->key_mgmt,
2094 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2095 os_memcmp_const(mic, key + 1, mic_len) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002096 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2097 "WPA: Invalid EAPOL-Key MIC "
2098 "when using TPTK - ignoring TPTK");
Hai Shalom74f70d42019-02-11 14:42:39 -08002099#ifdef TEST_FUZZ
2100 wpa_printf(MSG_INFO,
2101 "TEST: Ignore Key MIC failure for fuzz testing");
2102 goto continue_fuzz;
2103#endif /* TEST_FUZZ */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002104 } else {
Hai Shalom74f70d42019-02-11 14:42:39 -08002105#ifdef TEST_FUZZ
2106 continue_fuzz:
2107#endif /* TEST_FUZZ */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002108 ok = 1;
2109 sm->tptk_set = 0;
2110 sm->ptk_set = 1;
2111 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
Dmitry Shmidt61593f02014-04-21 16:27:35 -07002112 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002113 /*
2114 * This assures the same TPTK in sm->tptk can never be
Roshan Pius3a1667e2018-07-03 15:17:14 -07002115 * copied twice to sm->ptk as the new PTK. In
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002116 * combination with the installed flag in the wpa_ptk
2117 * struct, this assures the same PTK is only installed
2118 * once.
2119 */
2120 sm->renew_snonce = 1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002121 }
2122 }
2123
2124 if (!ok && sm->ptk_set) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002125 os_memset(key + 1, 0, mic_len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002126 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
2127 sm->key_mgmt,
2128 ver, buf, len, (u8 *) (key + 1)) < 0 ||
2129 os_memcmp_const(mic, key + 1, mic_len) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002130 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2131 "WPA: Invalid EAPOL-Key MIC - "
2132 "dropping packet");
Hai Shalom74f70d42019-02-11 14:42:39 -08002133#ifdef TEST_FUZZ
2134 wpa_printf(MSG_INFO,
2135 "TEST: Ignore Key MIC failure for fuzz testing");
2136 goto continue_fuzz2;
2137#endif /* TEST_FUZZ */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002138 return -1;
2139 }
Hai Shalom74f70d42019-02-11 14:42:39 -08002140#ifdef TEST_FUZZ
2141 continue_fuzz2:
2142#endif /* TEST_FUZZ */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002143 ok = 1;
2144 }
2145
2146 if (!ok) {
2147 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2148 "WPA: Could not verify EAPOL-Key MIC - "
2149 "dropping packet");
2150 return -1;
2151 }
2152
2153 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2154 WPA_REPLAY_COUNTER_LEN);
2155 sm->rx_replay_counter_set = 1;
2156 return 0;
2157}
2158
2159
2160/* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
2161static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002162 struct wpa_eapol_key *key,
2163 size_t mic_len, u16 ver,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002164 u8 *key_data, size_t *key_data_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002165{
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002166 wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002167 key_data, *key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002168 if (!sm->ptk_set) {
2169 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2170 "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
2171 "Data");
2172 return -1;
2173 }
2174
2175 /* Decrypt key data here so that this operation does not need
2176 * to be implemented separately for each message type. */
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002177 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002178#ifdef CONFIG_NO_RC4
2179 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2180 "WPA: RC4 not supported in the build");
2181 return -1;
2182#else /* CONFIG_NO_RC4 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002183 u8 ek[32];
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002184
2185 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002186 os_memcpy(ek, key->key_iv, 16);
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002187 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002188 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
Hai Shalom81f62d82019-07-22 12:10:00 -07002189 forced_memzero(ek, sizeof(ek));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002190 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2191 "WPA: RC4 failed");
2192 return -1;
2193 }
Hai Shalom81f62d82019-07-22 12:10:00 -07002194 forced_memzero(ek, sizeof(ek));
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002195#endif /* CONFIG_NO_RC4 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002196 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002197 ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
Roshan Pius3a1667e2018-07-03 15:17:14 -07002198 wpa_use_aes_key_wrap(sm->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002199 u8 *buf;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002200
2201 wpa_printf(MSG_DEBUG,
2202 "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
2203 (unsigned int) sm->ptk.kek_len);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002204 if (*key_data_len < 8 || *key_data_len % 8) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002205 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002206 "WPA: Unsupported AES-WRAP len %u",
2207 (unsigned int) *key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002208 return -1;
2209 }
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002210 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
2211 buf = os_malloc(*key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002212 if (buf == NULL) {
2213 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2214 "WPA: No memory for AES-UNWRAP buffer");
2215 return -1;
2216 }
Hai Shalom74f70d42019-02-11 14:42:39 -08002217#ifdef TEST_FUZZ
2218 os_memset(buf, 0x11, *key_data_len);
2219#endif /* TEST_FUZZ */
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002220 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002221 key_data, buf)) {
Hai Shalom74f70d42019-02-11 14:42:39 -08002222#ifdef TEST_FUZZ
2223 wpa_printf(MSG_INFO,
2224 "TEST: Ignore AES unwrap failure for fuzz testing");
2225 goto continue_fuzz;
2226#endif /* TEST_FUZZ */
Dmitry Shmidt7d56b752015-12-22 10:59:44 -08002227 bin_clear_free(buf, *key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002228 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2229 "WPA: AES unwrap failed - "
2230 "could not decrypt EAPOL-Key key data");
2231 return -1;
2232 }
Hai Shalom74f70d42019-02-11 14:42:39 -08002233#ifdef TEST_FUZZ
2234 continue_fuzz:
2235#endif /* TEST_FUZZ */
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002236 os_memcpy(key_data, buf, *key_data_len);
Dmitry Shmidt7d56b752015-12-22 10:59:44 -08002237 bin_clear_free(buf, *key_data_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002238 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002239 } else {
2240 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2241 "WPA: Unsupported key_info type %d", ver);
2242 return -1;
2243 }
2244 wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002245 key_data, *key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002246 return 0;
2247}
2248
2249
2250/**
2251 * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
2252 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2253 */
2254void wpa_sm_aborted_cached(struct wpa_sm *sm)
2255{
2256 if (sm && sm->cur_pmksa) {
2257 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2258 "RSN: Cancelling PMKSA caching attempt");
2259 sm->cur_pmksa = NULL;
2260 }
2261}
2262
2263
2264static void wpa_eapol_key_dump(struct wpa_sm *sm,
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002265 const struct wpa_eapol_key *key,
2266 unsigned int key_data_len,
2267 const u8 *mic, unsigned int mic_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002268{
2269#ifndef CONFIG_NO_STDOUT_DEBUG
2270 u16 key_info = WPA_GET_BE16(key->key_info);
2271
2272 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, " EAPOL-Key type=%d", key->type);
2273 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2274 " key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
2275 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
2276 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
2277 WPA_KEY_INFO_KEY_INDEX_SHIFT,
2278 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
2279 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
2280 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
2281 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
2282 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
2283 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
2284 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
2285 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
2286 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
2287 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2288 " key_length=%u key_data_length=%u",
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002289 WPA_GET_BE16(key->key_length), key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002290 wpa_hexdump(MSG_DEBUG, " replay_counter",
2291 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
2292 wpa_hexdump(MSG_DEBUG, " key_nonce", key->key_nonce, WPA_NONCE_LEN);
2293 wpa_hexdump(MSG_DEBUG, " key_iv", key->key_iv, 16);
2294 wpa_hexdump(MSG_DEBUG, " key_rsc", key->key_rsc, 8);
2295 wpa_hexdump(MSG_DEBUG, " key_id (reserved)", key->key_id, 8);
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002296 wpa_hexdump(MSG_DEBUG, " key_mic", mic, mic_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002297#endif /* CONFIG_NO_STDOUT_DEBUG */
2298}
2299
2300
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002301#ifdef CONFIG_FILS
2302static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
2303 size_t *key_data_len)
2304{
2305 struct wpa_ptk *ptk;
2306 struct ieee802_1x_hdr *hdr;
2307 struct wpa_eapol_key *key;
2308 u8 *pos, *tmp;
2309 const u8 *aad[1];
2310 size_t aad_len[1];
2311
2312 if (*key_data_len < AES_BLOCK_SIZE) {
2313 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
2314 return -1;
2315 }
2316
2317 if (sm->tptk_set)
2318 ptk = &sm->tptk;
2319 else if (sm->ptk_set)
2320 ptk = &sm->ptk;
2321 else
2322 return -1;
2323
2324 hdr = (struct ieee802_1x_hdr *) buf;
2325 key = (struct wpa_eapol_key *) (hdr + 1);
2326 pos = (u8 *) (key + 1);
2327 pos += 2; /* Pointing at the Encrypted Key Data field */
2328
2329 tmp = os_malloc(*key_data_len);
2330 if (!tmp)
2331 return -1;
2332
2333 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
2334 * to Key Data (exclusive). */
2335 aad[0] = buf;
2336 aad_len[0] = pos - buf;
2337 if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
2338 1, aad, aad_len, tmp) < 0) {
2339 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
2340 bin_clear_free(tmp, *key_data_len);
2341 return -1;
2342 }
2343
2344 /* AEAD decryption and validation completed successfully */
2345 (*key_data_len) -= AES_BLOCK_SIZE;
2346 wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
2347 tmp, *key_data_len);
2348
2349 /* Replace Key Data field with the decrypted version */
2350 os_memcpy(pos, tmp, *key_data_len);
2351 pos -= 2; /* Key Data Length field */
2352 WPA_PUT_BE16(pos, *key_data_len);
2353 bin_clear_free(tmp, *key_data_len);
2354
2355 if (sm->tptk_set) {
2356 sm->tptk_set = 0;
2357 sm->ptk_set = 1;
2358 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
2359 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2360 }
2361
2362 os_memcpy(sm->rx_replay_counter, key->replay_counter,
2363 WPA_REPLAY_COUNTER_LEN);
2364 sm->rx_replay_counter_set = 1;
2365
2366 return 0;
2367}
2368#endif /* CONFIG_FILS */
2369
2370
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002371/**
2372 * wpa_sm_rx_eapol - Process received WPA EAPOL frames
2373 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2374 * @src_addr: Source MAC address of the EAPOL packet
2375 * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
2376 * @len: Length of the EAPOL frame
2377 * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
2378 *
2379 * This function is called for each received EAPOL frame. Other than EAPOL-Key
2380 * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
2381 * only processing WPA and WPA2 EAPOL-Key frames.
2382 *
2383 * The received EAPOL-Key packets are validated and valid packets are replied
2384 * to. In addition, key material (PTK, GTK) is configured at the end of a
2385 * successful key handshake.
2386 */
2387int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
2388 const u8 *buf, size_t len)
2389{
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002390 size_t plen, data_len, key_data_len;
2391 const struct ieee802_1x_hdr *hdr;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002392 struct wpa_eapol_key *key;
2393 u16 key_info, ver;
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002394 u8 *tmp = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002395 int ret = -1;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002396 u8 *mic, *key_data;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002397 size_t mic_len, keyhdrlen;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002398
2399#ifdef CONFIG_IEEE80211R
2400 sm->ft_completed = 0;
2401#endif /* CONFIG_IEEE80211R */
2402
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002403 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002404 keyhdrlen = sizeof(*key) + mic_len + 2;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002405
2406 if (len < sizeof(*hdr) + keyhdrlen) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002407 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2408 "WPA: EAPOL frame too short to be a WPA "
2409 "EAPOL-Key (len %lu, expecting at least %lu)",
2410 (unsigned long) len,
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002411 (unsigned long) sizeof(*hdr) + keyhdrlen);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002412 return 0;
2413 }
2414
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002415 hdr = (const struct ieee802_1x_hdr *) buf;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002416 plen = be_to_host16(hdr->length);
2417 data_len = plen + sizeof(*hdr);
2418 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2419 "IEEE 802.1X RX: version=%d type=%d length=%lu",
2420 hdr->version, hdr->type, (unsigned long) plen);
2421
2422 if (hdr->version < EAPOL_VERSION) {
2423 /* TODO: backwards compatibility */
2424 }
2425 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
2426 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2427 "WPA: EAPOL frame (type %u) discarded, "
2428 "not a Key frame", hdr->type);
2429 ret = 0;
2430 goto out;
2431 }
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002432 wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002433 if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002434 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2435 "WPA: EAPOL frame payload size %lu "
2436 "invalid (frame size %lu)",
2437 (unsigned long) plen, (unsigned long) len);
2438 ret = 0;
2439 goto out;
2440 }
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002441 if (data_len < len) {
2442 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2443 "WPA: ignoring %lu bytes after the IEEE 802.1X data",
2444 (unsigned long) len - data_len);
2445 }
2446
2447 /*
2448 * Make a copy of the frame since we need to modify the buffer during
2449 * MAC validation and Key Data decryption.
2450 */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002451 tmp = os_memdup(buf, data_len);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002452 if (tmp == NULL)
2453 goto out;
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002454 key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002455 mic = (u8 *) (key + 1);
2456 key_data = mic + mic_len + 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002457
2458 if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
2459 {
2460 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2461 "WPA: EAPOL-Key type (%d) unknown, discarded",
2462 key->type);
2463 ret = 0;
2464 goto out;
2465 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002466
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002467 key_data_len = WPA_GET_BE16(mic + mic_len);
2468 wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002469
2470 if (key_data_len > plen - keyhdrlen) {
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002471 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
2472 "frame - key_data overflow (%u > %u)",
2473 (unsigned int) key_data_len,
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002474 (unsigned int) (plen - keyhdrlen));
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002475 goto out;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002476 }
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002477
2478 eapol_sm_notify_lower_layer_success(sm->eapol, 0);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002479 key_info = WPA_GET_BE16(key->key_info);
2480 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
2481 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002482 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002483 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
Roshan Pius3a1667e2018-07-03 15:17:14 -07002484 !wpa_use_akm_defined(sm->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002485 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2486 "WPA: Unsupported EAPOL-Key descriptor version %d",
2487 ver);
2488 goto out;
2489 }
2490
Roshan Pius3a1667e2018-07-03 15:17:14 -07002491 if (wpa_use_akm_defined(sm->key_mgmt) &&
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002492 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
2493 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2494 "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
2495 ver);
2496 goto out;
2497 }
2498
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002499#ifdef CONFIG_IEEE80211R
2500 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
2501 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
Roshan Pius3a1667e2018-07-03 15:17:14 -07002502 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2503 !wpa_use_akm_defined(sm->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002504 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2505 "FT: AP did not use AES-128-CMAC");
2506 goto out;
2507 }
2508 } else
2509#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002510 if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002511 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
Roshan Pius3a1667e2018-07-03 15:17:14 -07002512 !wpa_use_akm_defined(sm->key_mgmt)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002513 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2514 "WPA: AP did not use the "
2515 "negotiated AES-128-CMAC");
2516 goto out;
2517 }
Hai Shalomc3565922019-10-28 11:58:20 -07002518 } else if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
2519 !wpa_use_akm_defined(sm->key_mgmt) &&
2520 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002521 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2522 "WPA: CCMP is used, but EAPOL-Key "
2523 "descriptor version (%d) is not 2", ver);
2524 if (sm->group_cipher != WPA_CIPHER_CCMP &&
2525 !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
2526 /* Earlier versions of IEEE 802.11i did not explicitly
2527 * require version 2 descriptor for all EAPOL-Key
2528 * packets, so allow group keys to use version 1 if
2529 * CCMP is not used for them. */
2530 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2531 "WPA: Backwards compatibility: allow invalid "
2532 "version for non-CCMP group keys");
Jouni Malinen658fb4a2014-11-14 20:57:05 +02002533 } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
2534 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2535 "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002536 } else
2537 goto out;
Dmitry Shmidt71757432014-06-02 13:50:35 -07002538 } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
Roshan Pius3a1667e2018-07-03 15:17:14 -07002539 !wpa_use_akm_defined(sm->key_mgmt) &&
Dmitry Shmidt71757432014-06-02 13:50:35 -07002540 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07002541 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2542 "WPA: GCMP is used, but EAPOL-Key "
2543 "descriptor version (%d) is not 2", ver);
2544 goto out;
2545 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002546
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002547 if (sm->rx_replay_counter_set &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002548 os_memcmp(key->replay_counter, sm->rx_replay_counter,
2549 WPA_REPLAY_COUNTER_LEN) <= 0) {
2550 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2551 "WPA: EAPOL-Key Replay Counter did not increase - "
2552 "dropping packet");
2553 goto out;
2554 }
2555
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002556 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
2557 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2558 "WPA: Unsupported SMK bit in key_info");
2559 goto out;
2560 }
2561
2562 if (!(key_info & WPA_KEY_INFO_ACK)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002563 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2564 "WPA: No Ack bit in key_info");
2565 goto out;
2566 }
2567
2568 if (key_info & WPA_KEY_INFO_REQUEST) {
2569 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2570 "WPA: EAPOL-Key with Request bit - dropped");
2571 goto out;
2572 }
2573
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002574 if ((key_info & WPA_KEY_INFO_MIC) &&
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002575 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002576 goto out;
2577
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002578#ifdef CONFIG_FILS
2579 if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2580 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
2581 goto out;
2582 }
2583#endif /* CONFIG_FILS */
2584
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002585 if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002586 (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
Hai Shalomce48b4a2018-09-05 11:41:35 -07002587 /*
2588 * Only decrypt the Key Data field if the frame's authenticity
2589 * was verified. When using AES-SIV (FILS), the MIC flag is not
2590 * set, so this check should only be performed if mic_len != 0
2591 * which is the case in this code branch.
2592 */
2593 if (!(key_info & WPA_KEY_INFO_MIC)) {
2594 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2595 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
2596 goto out;
2597 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002598 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
2599 ver, key_data,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002600 &key_data_len))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002601 goto out;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002602 }
2603
2604 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
2605 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
2606 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2607 "WPA: Ignored EAPOL-Key (Pairwise) with "
2608 "non-zero key index");
2609 goto out;
2610 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002611 if (key_info & (WPA_KEY_INFO_MIC |
2612 WPA_KEY_INFO_ENCR_KEY_DATA)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002613 /* 3/4 4-Way Handshake */
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002614 wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
2615 key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002616 } else {
2617 /* 1/4 4-Way Handshake */
2618 wpa_supplicant_process_1_of_4(sm, src_addr, key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002619 ver, key_data,
2620 key_data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002621 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002622 } else {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002623 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
2624 (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002625 /* 1/2 Group Key Handshake */
2626 wpa_supplicant_process_1_of_2(sm, src_addr, key,
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002627 key_data, key_data_len,
2628 ver);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002629 } else {
2630 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002631 "WPA: EAPOL-Key (Group) without Mic/Encr bit - "
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002632 "dropped");
2633 }
2634 }
2635
2636 ret = 1;
2637
2638out:
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002639 bin_clear_free(tmp, data_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002640 return ret;
2641}
2642
2643
2644#ifdef CONFIG_CTRL_IFACE
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002645static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
2646{
2647 switch (sm->key_mgmt) {
2648 case WPA_KEY_MGMT_IEEE8021X:
Dmitry Shmidtf21452a2014-02-26 10:55:25 -08002649 return ((sm->proto == WPA_PROTO_RSN ||
2650 sm->proto == WPA_PROTO_OSEN) ?
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002651 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2652 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2653 case WPA_KEY_MGMT_PSK:
2654 return (sm->proto == WPA_PROTO_RSN ?
2655 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2656 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2657#ifdef CONFIG_IEEE80211R
2658 case WPA_KEY_MGMT_FT_IEEE8021X:
2659 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2660 case WPA_KEY_MGMT_FT_PSK:
2661 return RSN_AUTH_KEY_MGMT_FT_PSK;
2662#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002663 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2664 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2665 case WPA_KEY_MGMT_PSK_SHA256:
2666 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002667 case WPA_KEY_MGMT_CCKM:
2668 return (sm->proto == WPA_PROTO_RSN ?
2669 RSN_AUTH_KEY_MGMT_CCKM:
2670 WPA_AUTH_KEY_MGMT_CCKM);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002671 case WPA_KEY_MGMT_WPA_NONE:
2672 return WPA_AUTH_KEY_MGMT_NONE;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002673 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2674 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
Dmitry Shmidt807291d2015-01-27 13:40:23 -08002675 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2676 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002677 default:
2678 return 0;
2679 }
2680}
2681
2682
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002683#define RSN_SUITE "%02x-%02x-%02x-%d"
2684#define RSN_SUITE_ARG(s) \
2685((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2686
2687/**
2688 * wpa_sm_get_mib - Dump text list of MIB entries
2689 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2690 * @buf: Buffer for the list
2691 * @buflen: Length of the buffer
2692 * Returns: Number of bytes written to buffer
2693 *
2694 * This function is used fetch dot11 MIB variables.
2695 */
2696int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
2697{
2698 char pmkid_txt[PMKID_LEN * 2 + 1];
Hai Shalome21d4e82020-04-29 16:34:06 -07002699 bool rsna;
2700 int ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002701 size_t len;
2702
2703 if (sm->cur_pmksa) {
2704 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2705 sm->cur_pmksa->pmkid, PMKID_LEN);
2706 } else
2707 pmkid_txt[0] = '\0';
2708
Hai Shalome21d4e82020-04-29 16:34:06 -07002709 rsna = (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
2710 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
2711 sm->proto == WPA_PROTO_RSN;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002712
2713 ret = os_snprintf(buf, buflen,
2714 "dot11RSNAOptionImplemented=TRUE\n"
2715 "dot11RSNAPreauthenticationImplemented=TRUE\n"
2716 "dot11RSNAEnabled=%s\n"
2717 "dot11RSNAPreauthenticationEnabled=%s\n"
2718 "dot11RSNAConfigVersion=%d\n"
2719 "dot11RSNAConfigPairwiseKeysSupported=5\n"
2720 "dot11RSNAConfigGroupCipherSize=%d\n"
2721 "dot11RSNAConfigPMKLifetime=%d\n"
2722 "dot11RSNAConfigPMKReauthThreshold=%d\n"
2723 "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2724 "dot11RSNAConfigSATimeout=%d\n",
2725 rsna ? "TRUE" : "FALSE",
2726 rsna ? "TRUE" : "FALSE",
2727 RSN_VERSION,
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07002728 wpa_cipher_key_len(sm->group_cipher) * 8,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002729 sm->dot11RSNAConfigPMKLifetime,
2730 sm->dot11RSNAConfigPMKReauthThreshold,
2731 sm->dot11RSNAConfigSATimeout);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002732 if (os_snprintf_error(buflen, ret))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002733 return 0;
2734 len = ret;
2735
2736 ret = os_snprintf(
2737 buf + len, buflen - len,
2738 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2739 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2740 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2741 "dot11RSNAPMKIDUsed=%s\n"
2742 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2743 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2744 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2745 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
2746 "dot11RSNA4WayHandshakeFailures=%u\n",
2747 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07002748 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2749 sm->pairwise_cipher)),
2750 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2751 sm->group_cipher)),
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002752 pmkid_txt,
2753 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
Dmitry Shmidt4530cfd2012-09-09 15:20:40 -07002754 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2755 sm->pairwise_cipher)),
2756 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2757 sm->group_cipher)),
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002758 sm->dot11RSNA4WayHandshakeFailures);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002759 if (!os_snprintf_error(buflen - len, ret))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002760 len += ret;
2761
2762 return (int) len;
2763}
2764#endif /* CONFIG_CTRL_IFACE */
2765
2766
2767static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002768 void *ctx, enum pmksa_free_reason reason)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002769{
2770 struct wpa_sm *sm = ctx;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002771 int deauth = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002772
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002773 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
2774 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
2775
2776 if (sm->cur_pmksa == entry) {
2777 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2778 "RSN: %s current PMKSA entry",
2779 reason == PMKSA_REPLACE ? "replaced" : "removed");
2780 pmksa_cache_clear_current(sm);
2781
2782 /*
2783 * If an entry is simply being replaced, there's no need to
2784 * deauthenticate because it will be immediately re-added.
2785 * This happens when EAP authentication is completed again
2786 * (reauth or failed PMKSA caching attempt).
2787 */
2788 if (reason != PMKSA_REPLACE)
2789 deauth = 1;
2790 }
2791
2792 if (reason == PMKSA_EXPIRE &&
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002793 (sm->pmk_len == entry->pmk_len &&
2794 os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
2795 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002796 "RSN: deauthenticating due to expired PMK");
2797 pmksa_cache_clear_current(sm);
2798 deauth = 1;
2799 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002800
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002801 if (deauth) {
Roshan Pius3a1667e2018-07-03 15:17:14 -07002802 sm->pmk_len = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002803 os_memset(sm->pmk, 0, sizeof(sm->pmk));
2804 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2805 }
2806}
2807
2808
2809/**
2810 * wpa_sm_init - Initialize WPA state machine
2811 * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
2812 * Returns: Pointer to the allocated WPA state machine data
2813 *
2814 * This function is used to allocate a new WPA state machine and the returned
2815 * value is passed to all WPA state machine calls.
2816 */
2817struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
2818{
2819 struct wpa_sm *sm;
2820
2821 sm = os_zalloc(sizeof(*sm));
2822 if (sm == NULL)
2823 return NULL;
2824 dl_list_init(&sm->pmksa_candidates);
2825 sm->renew_snonce = 1;
2826 sm->ctx = ctx;
2827
2828 sm->dot11RSNAConfigPMKLifetime = 43200;
2829 sm->dot11RSNAConfigPMKReauthThreshold = 70;
2830 sm->dot11RSNAConfigSATimeout = 60;
2831
2832 sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
2833 if (sm->pmksa == NULL) {
2834 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2835 "RSN: PMKSA cache initialization failed");
2836 os_free(sm);
2837 return NULL;
2838 }
2839
2840 return sm;
2841}
2842
2843
2844/**
2845 * wpa_sm_deinit - Deinitialize WPA state machine
2846 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2847 */
2848void wpa_sm_deinit(struct wpa_sm *sm)
2849{
2850 if (sm == NULL)
2851 return;
2852 pmksa_cache_deinit(sm->pmksa);
2853 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2854 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
2855 os_free(sm->assoc_wpa_ie);
Hai Shalomc3565922019-10-28 11:58:20 -07002856 os_free(sm->assoc_rsnxe);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002857 os_free(sm->ap_wpa_ie);
2858 os_free(sm->ap_rsn_ie);
Hai Shalomc3565922019-10-28 11:58:20 -07002859 os_free(sm->ap_rsnxe);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002860 wpa_sm_drop_sa(sm);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002861 os_free(sm->ctx);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002862#ifdef CONFIG_IEEE80211R
2863 os_free(sm->assoc_resp_ies);
2864#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt55840ad2015-12-14 12:45:46 -08002865#ifdef CONFIG_TESTING_OPTIONS
2866 wpabuf_free(sm->test_assoc_ie);
2867#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002868#ifdef CONFIG_FILS_SK_PFS
2869 crypto_ecdh_deinit(sm->fils_ecdh);
2870#endif /* CONFIG_FILS_SK_PFS */
2871#ifdef CONFIG_FILS
2872 wpabuf_free(sm->fils_ft_ies);
2873#endif /* CONFIG_FILS */
2874#ifdef CONFIG_OWE
2875 crypto_ecdh_deinit(sm->owe_ecdh);
2876#endif /* CONFIG_OWE */
Hai Shalom021b0b52019-04-10 11:17:58 -07002877#ifdef CONFIG_DPP2
2878 wpabuf_clear_free(sm->dpp_z);
2879#endif /* CONFIG_DPP2 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002880 os_free(sm);
2881}
2882
2883
2884/**
2885 * wpa_sm_notify_assoc - Notify WPA state machine about association
2886 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2887 * @bssid: The BSSID of the new association
2888 *
2889 * This function is called to let WPA state machine know that the connection
2890 * was established.
2891 */
2892void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
2893{
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002894 int clear_keys = 1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002895
2896 if (sm == NULL)
2897 return;
2898
2899 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2900 "WPA: Association event - clear replay counter");
2901 os_memcpy(sm->bssid, bssid, ETH_ALEN);
2902 os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
2903 sm->rx_replay_counter_set = 0;
2904 sm->renew_snonce = 1;
2905 if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
2906 rsn_preauth_deinit(sm);
2907
2908#ifdef CONFIG_IEEE80211R
2909 if (wpa_ft_is_completed(sm)) {
2910 /*
2911 * Clear portValid to kick EAPOL state machine to re-enter
2912 * AUTHENTICATED state to get the EAPOL port Authorized.
2913 */
Hai Shalome21d4e82020-04-29 16:34:06 -07002914 eapol_sm_notify_portValid(sm->eapol, false);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002915 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2916
2917 /* Prepare for the next transition */
2918 wpa_ft_prepare_auth_request(sm, NULL);
2919
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002920 clear_keys = 0;
Hai Shalom81f62d82019-07-22 12:10:00 -07002921 sm->ft_protocol = 1;
2922 } else {
2923 sm->ft_protocol = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002924 }
2925#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002926#ifdef CONFIG_FILS
2927 if (sm->fils_completed) {
2928 /*
2929 * Clear portValid to kick EAPOL state machine to re-enter
2930 * AUTHENTICATED state to get the EAPOL port Authorized.
2931 */
2932 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002933 clear_keys = 0;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002934 }
2935#endif /* CONFIG_FILS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002936
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002937 if (clear_keys) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002938 /*
2939 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
2940 * this is not part of a Fast BSS Transition.
2941 */
2942 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
2943 sm->ptk_set = 0;
Dmitry Shmidt61593f02014-04-21 16:27:35 -07002944 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002945 sm->tptk_set = 0;
Dmitry Shmidt61593f02014-04-21 16:27:35 -07002946 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002947 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
Jouni Malinen58c0e962017-10-01 12:12:24 +03002948 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02002949 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
Jouni Malinen58c0e962017-10-01 12:12:24 +03002950 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002951 }
2952
2953#ifdef CONFIG_TDLS
2954 wpa_tdls_assoc(sm);
2955#endif /* CONFIG_TDLS */
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08002956
2957#ifdef CONFIG_P2P
2958 os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
2959#endif /* CONFIG_P2P */
Hai Shalomfdcde762020-04-02 11:19:20 -07002960
2961 sm->keyidx_active = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002962}
2963
2964
2965/**
2966 * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
2967 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2968 *
2969 * This function is called to let WPA state machine know that the connection
2970 * was lost. This will abort any existing pre-authentication session.
2971 */
2972void wpa_sm_notify_disassoc(struct wpa_sm *sm)
2973{
Dmitry Shmidt4dd28dc2015-03-10 11:21:43 -07002974 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2975 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002976 rsn_preauth_deinit(sm);
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08002977 pmksa_cache_clear_current(sm);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002978 if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
2979 sm->dot11RSNA4WayHandshakeFailures++;
2980#ifdef CONFIG_TDLS
2981 wpa_tdls_disassoc(sm);
2982#endif /* CONFIG_TDLS */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002983#ifdef CONFIG_FILS
2984 sm->fils_completed = 0;
2985#endif /* CONFIG_FILS */
Jouni Malinen4283f9e2017-09-22 12:06:37 +03002986#ifdef CONFIG_IEEE80211R
2987 sm->ft_reassoc_completed = 0;
Hai Shalom81f62d82019-07-22 12:10:00 -07002988 sm->ft_protocol = 0;
Jouni Malinen4283f9e2017-09-22 12:06:37 +03002989#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002990
2991 /* Keys are not needed in the WPA state machine anymore */
2992 wpa_sm_drop_sa(sm);
Hai Shalomfdcde762020-04-02 11:19:20 -07002993 sm->keyidx_active = 0;
Dmitry Shmidt4dd28dc2015-03-10 11:21:43 -07002994
2995 sm->msg_3_of_4_ok = 0;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07002996 os_memset(sm->bssid, 0, ETH_ALEN);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002997}
2998
2999
3000/**
3001 * wpa_sm_set_pmk - Set PMK
3002 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3003 * @pmk: The new PMK
3004 * @pmk_len: The length of the new PMK in bytes
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08003005 * @pmkid: Calculated PMKID
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003006 * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003007 *
3008 * Configure the PMK for WPA state machine.
3009 */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003010void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08003011 const u8 *pmkid, const u8 *bssid)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003012{
3013 if (sm == NULL)
3014 return;
3015
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003016 wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
3017 pmk, pmk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003018 sm->pmk_len = pmk_len;
3019 os_memcpy(sm->pmk, pmk, pmk_len);
3020
3021#ifdef CONFIG_IEEE80211R
3022 /* Set XXKey to be PSK for FT key derivation */
3023 sm->xxkey_len = pmk_len;
3024 os_memcpy(sm->xxkey, pmk, pmk_len);
3025#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003026
3027 if (bssid) {
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08003028 pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003029 bssid, sm->own_addr,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003030 sm->network_ctx, sm->key_mgmt, NULL);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003031 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003032}
3033
3034
3035/**
3036 * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
3037 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3038 *
3039 * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
3040 * will be cleared.
3041 */
3042void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
3043{
3044 if (sm == NULL)
3045 return;
3046
3047 if (sm->cur_pmksa) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003048 wpa_hexdump_key(MSG_DEBUG,
3049 "WPA: Set PMK based on current PMKSA",
3050 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003051 sm->pmk_len = sm->cur_pmksa->pmk_len;
3052 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
3053 } else {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003054 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
3055 sm->pmk_len = 0;
3056 os_memset(sm->pmk, 0, PMK_LEN_MAX);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003057 }
3058}
3059
3060
3061/**
3062 * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
3063 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3064 * @fast_reauth: Whether fast reauthentication (EAP) is allowed
3065 */
3066void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
3067{
3068 if (sm)
3069 sm->fast_reauth = fast_reauth;
3070}
3071
3072
3073/**
3074 * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
3075 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3076 * @scard_ctx: Context pointer for smartcard related callback functions
3077 */
3078void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
3079{
3080 if (sm == NULL)
3081 return;
3082 sm->scard_ctx = scard_ctx;
3083 if (sm->preauth_eapol)
3084 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
3085}
3086
3087
3088/**
Hai Shalomfdcde762020-04-02 11:19:20 -07003089 * wpa_sm_set_config - Notification of current configuration change
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003090 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3091 * @config: Pointer to current network configuration
3092 *
3093 * Notify WPA state machine that configuration has changed. config will be
3094 * stored as a backpointer to network configuration. This can be %NULL to clear
3095 * the stored pointed.
3096 */
3097void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
3098{
3099 if (!sm)
3100 return;
3101
3102 if (config) {
3103 sm->network_ctx = config->network_ctx;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003104 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
3105 sm->proactive_key_caching = config->proactive_key_caching;
3106 sm->eap_workaround = config->eap_workaround;
3107 sm->eap_conf_ctx = config->eap_conf_ctx;
3108 if (config->ssid) {
3109 os_memcpy(sm->ssid, config->ssid, config->ssid_len);
3110 sm->ssid_len = config->ssid_len;
3111 } else
3112 sm->ssid_len = 0;
3113 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08003114 sm->p2p = config->p2p;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003115 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
Hai Shalomfdcde762020-04-02 11:19:20 -07003116 sm->owe_ptk_workaround = config->owe_ptk_workaround;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003117#ifdef CONFIG_FILS
3118 if (config->fils_cache_id) {
3119 sm->fils_cache_id_set = 1;
3120 os_memcpy(sm->fils_cache_id, config->fils_cache_id,
3121 FILS_CACHE_ID_LEN);
3122 } else {
3123 sm->fils_cache_id_set = 0;
3124 }
3125#endif /* CONFIG_FILS */
Hai Shalomfdcde762020-04-02 11:19:20 -07003126 sm->beacon_prot = config->beacon_prot;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003127 } else {
3128 sm->network_ctx = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003129 sm->allowed_pairwise_cipher = 0;
3130 sm->proactive_key_caching = 0;
3131 sm->eap_workaround = 0;
3132 sm->eap_conf_ctx = NULL;
3133 sm->ssid_len = 0;
3134 sm->wpa_ptk_rekey = 0;
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08003135 sm->p2p = 0;
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003136 sm->wpa_rsc_relaxation = 0;
Hai Shalomfdcde762020-04-02 11:19:20 -07003137 sm->owe_ptk_workaround = 0;
3138 sm->beacon_prot = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003139 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003140}
3141
3142
3143/**
3144 * wpa_sm_set_own_addr - Set own MAC address
3145 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3146 * @addr: Own MAC address
3147 */
3148void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
3149{
3150 if (sm)
3151 os_memcpy(sm->own_addr, addr, ETH_ALEN);
3152}
3153
3154
3155/**
3156 * wpa_sm_set_ifname - Set network interface name
3157 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3158 * @ifname: Interface name
3159 * @bridge_ifname: Optional bridge interface name (for pre-auth)
3160 */
3161void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
3162 const char *bridge_ifname)
3163{
3164 if (sm) {
3165 sm->ifname = ifname;
3166 sm->bridge_ifname = bridge_ifname;
3167 }
3168}
3169
3170
3171/**
3172 * wpa_sm_set_eapol - Set EAPOL state machine pointer
3173 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3174 * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
3175 */
3176void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
3177{
3178 if (sm)
3179 sm->eapol = eapol;
3180}
3181
3182
3183/**
3184 * wpa_sm_set_param - Set WPA state machine parameters
3185 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3186 * @param: Parameter field
3187 * @value: Parameter value
3188 * Returns: 0 on success, -1 on failure
3189 */
3190int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
3191 unsigned int value)
3192{
3193 int ret = 0;
3194
3195 if (sm == NULL)
3196 return -1;
3197
3198 switch (param) {
3199 case RSNA_PMK_LIFETIME:
3200 if (value > 0)
3201 sm->dot11RSNAConfigPMKLifetime = value;
3202 else
3203 ret = -1;
3204 break;
3205 case RSNA_PMK_REAUTH_THRESHOLD:
3206 if (value > 0 && value <= 100)
3207 sm->dot11RSNAConfigPMKReauthThreshold = value;
3208 else
3209 ret = -1;
3210 break;
3211 case RSNA_SA_TIMEOUT:
3212 if (value > 0)
3213 sm->dot11RSNAConfigSATimeout = value;
3214 else
3215 ret = -1;
3216 break;
3217 case WPA_PARAM_PROTO:
3218 sm->proto = value;
3219 break;
3220 case WPA_PARAM_PAIRWISE:
3221 sm->pairwise_cipher = value;
3222 break;
3223 case WPA_PARAM_GROUP:
3224 sm->group_cipher = value;
3225 break;
3226 case WPA_PARAM_KEY_MGMT:
3227 sm->key_mgmt = value;
3228 break;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003229 case WPA_PARAM_MGMT_GROUP:
3230 sm->mgmt_group_cipher = value;
3231 break;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003232 case WPA_PARAM_RSN_ENABLED:
3233 sm->rsn_enabled = value;
3234 break;
3235 case WPA_PARAM_MFP:
3236 sm->mfp = value;
3237 break;
Hai Shalom74f70d42019-02-11 14:42:39 -08003238 case WPA_PARAM_OCV:
3239 sm->ocv = value;
3240 break;
Hai Shalomc3565922019-10-28 11:58:20 -07003241 case WPA_PARAM_SAE_PWE:
3242 sm->sae_pwe = value;
3243 break;
Hai Shalomfdcde762020-04-02 11:19:20 -07003244 case WPA_PARAM_DENY_PTK0_REKEY:
3245 sm->wpa_deny_ptk0_rekey = value;
3246 break;
3247 case WPA_PARAM_EXT_KEY_ID:
3248 sm->ext_key_id = value;
3249 break;
3250 case WPA_PARAM_USE_EXT_KEY_ID:
3251 sm->use_ext_key_id = value;
3252 break;
Hai Shalomb755a2a2020-04-23 21:49:02 -07003253#ifdef CONFIG_TESTING_OPTIONS
3254 case WPA_PARAM_FT_RSNXE_USED:
3255 sm->ft_rsnxe_used = value;
3256 break;
3257#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003258 default:
3259 break;
3260 }
3261
3262 return ret;
3263}
3264
3265
3266/**
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003267 * wpa_sm_get_status - Get WPA state machine
3268 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3269 * @buf: Buffer for status information
3270 * @buflen: Maximum buffer length
3271 * @verbose: Whether to include verbose status information
3272 * Returns: Number of bytes written to buf.
3273 *
3274 * Query WPA state machine for status information. This function fills in
3275 * a text area with current status information. If the buffer (buf) is not
3276 * large enough, status information will be truncated to fit the buffer.
3277 */
3278int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
3279 int verbose)
3280{
3281 char *pos = buf, *end = buf + buflen;
3282 int ret;
3283
3284 ret = os_snprintf(pos, end - pos,
3285 "pairwise_cipher=%s\n"
3286 "group_cipher=%s\n"
3287 "key_mgmt=%s\n",
3288 wpa_cipher_txt(sm->pairwise_cipher),
3289 wpa_cipher_txt(sm->group_cipher),
3290 wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003291 if (os_snprintf_error(end - pos, ret))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003292 return pos - buf;
3293 pos += ret;
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08003294
3295 if (sm->mfp != NO_MGMT_FRAME_PROTECTION && sm->ap_rsn_ie) {
3296 struct wpa_ie_data rsn;
3297 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn)
3298 >= 0 &&
3299 rsn.capabilities & (WPA_CAPABILITY_MFPR |
3300 WPA_CAPABILITY_MFPC)) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003301 ret = os_snprintf(pos, end - pos, "pmf=%d\n"
3302 "mgmt_group_cipher=%s\n",
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08003303 (rsn.capabilities &
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003304 WPA_CAPABILITY_MFPR) ? 2 : 1,
3305 wpa_cipher_txt(
3306 sm->mgmt_group_cipher));
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003307 if (os_snprintf_error(end - pos, ret))
Dmitry Shmidtd5e49232012-12-03 15:08:10 -08003308 return pos - buf;
3309 pos += ret;
3310 }
3311 }
3312
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003313 return pos - buf;
3314}
3315
3316
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -07003317int wpa_sm_pmf_enabled(struct wpa_sm *sm)
3318{
3319 struct wpa_ie_data rsn;
3320
3321 if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !sm->ap_rsn_ie)
3322 return 0;
3323
3324 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) >= 0 &&
3325 rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
3326 return 1;
3327
3328 return 0;
3329}
3330
3331
Hai Shalomfdcde762020-04-02 11:19:20 -07003332int wpa_sm_ext_key_id(struct wpa_sm *sm)
3333{
3334 return sm ? sm->ext_key_id : 0;
3335}
3336
3337
3338int wpa_sm_ext_key_id_active(struct wpa_sm *sm)
3339{
3340 return sm ? sm->use_ext_key_id : 0;
3341}
3342
3343
Hai Shalom74f70d42019-02-11 14:42:39 -08003344int wpa_sm_ocv_enabled(struct wpa_sm *sm)
3345{
3346 struct wpa_ie_data rsn;
3347
3348 if (!sm->ocv || !sm->ap_rsn_ie)
3349 return 0;
3350
3351 return wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len,
3352 &rsn) >= 0 &&
3353 (rsn.capabilities & WPA_CAPABILITY_OCVC);
3354}
3355
3356
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003357/**
3358 * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
3359 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3360 * @wpa_ie: Pointer to buffer for WPA/RSN IE
3361 * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
3362 * Returns: 0 on success, -1 on failure
3363 */
3364int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
3365 size_t *wpa_ie_len)
3366{
3367 int res;
3368
3369 if (sm == NULL)
3370 return -1;
3371
Dmitry Shmidt55840ad2015-12-14 12:45:46 -08003372#ifdef CONFIG_TESTING_OPTIONS
3373 if (sm->test_assoc_ie) {
3374 wpa_printf(MSG_DEBUG,
3375 "TESTING: Replace association WPA/RSN IE");
3376 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
3377 return -1;
3378 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
3379 wpabuf_len(sm->test_assoc_ie));
3380 res = wpabuf_len(sm->test_assoc_ie);
3381 } else
3382#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003383 res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
3384 if (res < 0)
3385 return -1;
3386 *wpa_ie_len = res;
3387
3388 wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
3389 wpa_ie, *wpa_ie_len);
3390
3391 if (sm->assoc_wpa_ie == NULL) {
3392 /*
3393 * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
3394 * the correct version of the IE even if PMKSA caching is
3395 * aborted (which would remove PMKID from IE generation).
3396 */
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003397 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003398 if (sm->assoc_wpa_ie == NULL)
3399 return -1;
3400
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003401 sm->assoc_wpa_ie_len = *wpa_ie_len;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003402 } else {
3403 wpa_hexdump(MSG_DEBUG,
3404 "WPA: Leave previously set WPA IE default",
3405 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003406 }
3407
3408 return 0;
3409}
3410
3411
3412/**
3413 * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
3414 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3415 * @ie: Pointer to IE data (starting from id)
3416 * @len: IE length
3417 * Returns: 0 on success, -1 on failure
3418 *
3419 * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
3420 * Request frame. The IE will be used to override the default value generated
3421 * with wpa_sm_set_assoc_wpa_ie_default().
3422 */
3423int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3424{
3425 if (sm == NULL)
3426 return -1;
3427
3428 os_free(sm->assoc_wpa_ie);
3429 if (ie == NULL || len == 0) {
3430 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3431 "WPA: clearing own WPA/RSN IE");
3432 sm->assoc_wpa_ie = NULL;
3433 sm->assoc_wpa_ie_len = 0;
3434 } else {
3435 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003436 sm->assoc_wpa_ie = os_memdup(ie, len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003437 if (sm->assoc_wpa_ie == NULL)
3438 return -1;
3439
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003440 sm->assoc_wpa_ie_len = len;
3441 }
3442
3443 return 0;
3444}
3445
3446
3447/**
Hai Shalomc3565922019-10-28 11:58:20 -07003448 * wpa_sm_set_assoc_rsnxe_default - Generate own RSNXE from configuration
3449 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3450 * @rsnxe: Pointer to buffer for RSNXE
3451 * @rsnxe_len: Pointer to the length of the rsne buffer
3452 * Returns: 0 on success, -1 on failure
3453 */
3454int wpa_sm_set_assoc_rsnxe_default(struct wpa_sm *sm, u8 *rsnxe,
3455 size_t *rsnxe_len)
3456{
3457 int res;
3458
3459 if (!sm)
3460 return -1;
3461
3462 res = wpa_gen_rsnxe(sm, rsnxe, *rsnxe_len);
3463 if (res < 0)
3464 return -1;
3465 *rsnxe_len = res;
3466
3467 wpa_hexdump(MSG_DEBUG, "RSN: Set own RSNXE default", rsnxe, *rsnxe_len);
3468
3469 if (sm->assoc_rsnxe) {
3470 wpa_hexdump(MSG_DEBUG,
3471 "RSN: Leave previously set RSNXE default",
3472 sm->assoc_rsnxe, sm->assoc_rsnxe_len);
3473 } else if (*rsnxe_len > 0) {
3474 /*
3475 * Make a copy of the RSNXE so that 4-Way Handshake gets the
3476 * correct version of the IE even if it gets changed.
3477 */
3478 sm->assoc_rsnxe = os_memdup(rsnxe, *rsnxe_len);
3479 if (!sm->assoc_rsnxe)
3480 return -1;
3481
3482 sm->assoc_rsnxe_len = *rsnxe_len;
3483 }
3484
3485 return 0;
3486}
3487
3488
3489/**
3490 * wpa_sm_set_assoc_rsnxe - Set own RSNXE from (Re)AssocReq
3491 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3492 * @ie: Pointer to IE data (starting from id)
3493 * @len: IE length
3494 * Returns: 0 on success, -1 on failure
3495 *
3496 * Inform WPA state machine about the RSNXE used in (Re)Association Request
3497 * frame. The IE will be used to override the default value generated
3498 * with wpa_sm_set_assoc_rsnxe_default().
3499 */
3500int wpa_sm_set_assoc_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3501{
3502 if (!sm)
3503 return -1;
3504
3505 os_free(sm->assoc_rsnxe);
3506 if (!ie || len == 0) {
3507 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3508 "RSN: clearing own RSNXE");
3509 sm->assoc_rsnxe = NULL;
3510 sm->assoc_rsnxe_len = 0;
3511 } else {
3512 wpa_hexdump(MSG_DEBUG, "RSN: set own RSNXE", ie, len);
3513 sm->assoc_rsnxe = os_memdup(ie, len);
3514 if (!sm->assoc_rsnxe)
3515 return -1;
3516
3517 sm->assoc_rsnxe_len = len;
3518 }
3519
3520 return 0;
3521}
3522
3523
3524/**
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003525 * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
3526 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3527 * @ie: Pointer to IE data (starting from id)
3528 * @len: IE length
3529 * Returns: 0 on success, -1 on failure
3530 *
3531 * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
3532 * frame.
3533 */
3534int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3535{
3536 if (sm == NULL)
3537 return -1;
3538
3539 os_free(sm->ap_wpa_ie);
3540 if (ie == NULL || len == 0) {
3541 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3542 "WPA: clearing AP WPA IE");
3543 sm->ap_wpa_ie = NULL;
3544 sm->ap_wpa_ie_len = 0;
3545 } else {
3546 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003547 sm->ap_wpa_ie = os_memdup(ie, len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003548 if (sm->ap_wpa_ie == NULL)
3549 return -1;
3550
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003551 sm->ap_wpa_ie_len = len;
3552 }
3553
3554 return 0;
3555}
3556
3557
3558/**
3559 * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
3560 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3561 * @ie: Pointer to IE data (starting from id)
3562 * @len: IE length
3563 * Returns: 0 on success, -1 on failure
3564 *
3565 * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
3566 * frame.
3567 */
3568int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3569{
3570 if (sm == NULL)
3571 return -1;
3572
3573 os_free(sm->ap_rsn_ie);
3574 if (ie == NULL || len == 0) {
3575 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3576 "WPA: clearing AP RSN IE");
3577 sm->ap_rsn_ie = NULL;
3578 sm->ap_rsn_ie_len = 0;
3579 } else {
3580 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003581 sm->ap_rsn_ie = os_memdup(ie, len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003582 if (sm->ap_rsn_ie == NULL)
3583 return -1;
3584
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003585 sm->ap_rsn_ie_len = len;
3586 }
3587
3588 return 0;
3589}
3590
3591
3592/**
Hai Shalomc3565922019-10-28 11:58:20 -07003593 * wpa_sm_set_ap_rsnxe - Set AP RSNXE from Beacon/ProbeResp
3594 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3595 * @ie: Pointer to IE data (starting from id)
3596 * @len: IE length
3597 * Returns: 0 on success, -1 on failure
3598 *
3599 * Inform WPA state machine about the RSNXE used in Beacon / Probe Response
3600 * frame.
3601 */
3602int wpa_sm_set_ap_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
3603{
3604 if (!sm)
3605 return -1;
3606
3607 os_free(sm->ap_rsnxe);
3608 if (!ie || len == 0) {
3609 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: clearing AP RSNXE");
3610 sm->ap_rsnxe = NULL;
3611 sm->ap_rsnxe_len = 0;
3612 } else {
3613 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSNXE", ie, len);
3614 sm->ap_rsnxe = os_memdup(ie, len);
3615 if (!sm->ap_rsnxe)
3616 return -1;
3617
3618 sm->ap_rsnxe_len = len;
3619 }
3620
3621 return 0;
3622}
3623
3624
3625/**
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003626 * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
3627 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3628 * @data: Pointer to data area for parsing results
3629 * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
3630 *
3631 * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
3632 * parsed data into data.
3633 */
3634int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
3635{
3636 if (sm == NULL)
3637 return -1;
3638
3639 if (sm->assoc_wpa_ie == NULL) {
3640 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3641 "WPA: No WPA/RSN IE available from association info");
3642 return -1;
3643 }
3644 if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
3645 return -2;
3646 return 0;
3647}
3648
3649
3650int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
3651{
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003652 return pmksa_cache_list(sm->pmksa, buf, len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003653}
3654
3655
Dmitry Shmidt29333592017-01-09 12:27:11 -08003656struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
3657{
3658 return pmksa_cache_head(sm->pmksa);
3659}
3660
3661
3662struct rsn_pmksa_cache_entry *
3663wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
3664 struct rsn_pmksa_cache_entry * entry)
3665{
3666 return pmksa_cache_add_entry(sm->pmksa, entry);
3667}
3668
3669
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003670void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3671 const u8 *pmkid, const u8 *bssid,
3672 const u8 *fils_cache_id)
3673{
3674 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3675 bssid, sm->own_addr, sm->network_ctx,
3676 sm->key_mgmt, fils_cache_id);
3677}
3678
3679
3680int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid,
3681 const void *network_ctx)
3682{
Roshan Pius3a1667e2018-07-03 15:17:14 -07003683 return pmksa_cache_get(sm->pmksa, bssid, NULL, network_ctx, 0) != NULL;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003684}
3685
3686
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003687void wpa_sm_drop_sa(struct wpa_sm *sm)
3688{
3689 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
3690 sm->ptk_set = 0;
3691 sm->tptk_set = 0;
Roshan Pius3a1667e2018-07-03 15:17:14 -07003692 sm->pmk_len = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003693 os_memset(sm->pmk, 0, sizeof(sm->pmk));
3694 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
3695 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02003696 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
Jouni Malinen58c0e962017-10-01 12:12:24 +03003697 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02003698 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
Jouni Malinen58c0e962017-10-01 12:12:24 +03003699 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003700#ifdef CONFIG_IEEE80211R
3701 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
Roshan Pius3a1667e2018-07-03 15:17:14 -07003702 sm->xxkey_len = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003703 os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
Roshan Pius3a1667e2018-07-03 15:17:14 -07003704 sm->pmk_r0_len = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003705 os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
Roshan Pius3a1667e2018-07-03 15:17:14 -07003706 sm->pmk_r1_len = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003707#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003708}
3709
3710
3711int wpa_sm_has_ptk(struct wpa_sm *sm)
3712{
3713 if (sm == NULL)
3714 return 0;
3715 return sm->ptk_set;
3716}
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003717
3718
Hai Shalomfdcde762020-04-02 11:19:20 -07003719int wpa_sm_has_ptk_installed(struct wpa_sm *sm)
3720{
3721 if (!sm)
3722 return 0;
3723 return sm->ptk.installed;
3724}
3725
3726
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003727void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
3728{
3729 os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
3730}
3731
3732
3733void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
3734{
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -07003735 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003736}
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003737
3738
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08003739#ifdef CONFIG_WNM
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003740int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
3741{
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003742 u16 keyinfo;
3743 u8 keylen; /* plaintext key len */
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003744 u8 *key_rsc;
3745
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003746 if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
Dmitry Shmidt61593f02014-04-21 16:27:35 -07003747 struct wpa_gtk_data gd;
3748
3749 os_memset(&gd, 0, sizeof(gd));
3750 keylen = wpa_cipher_key_len(sm->group_cipher);
3751 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
3752 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
3753 if (gd.alg == WPA_ALG_NONE) {
3754 wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
3755 return -1;
3756 }
3757
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003758 key_rsc = buf + 5;
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08003759 keyinfo = WPA_GET_LE16(buf + 2);
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003760 gd.gtk_len = keylen;
3761 if (gd.gtk_len != buf[4]) {
3762 wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
3763 gd.gtk_len, buf[4]);
3764 return -1;
3765 }
3766 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
3767 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3768 sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
3769
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08003770 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003771
3772 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
3773 gd.gtk, gd.gtk_len);
Jouni Malinen58c0e962017-10-01 12:12:24 +03003774 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
Hai Shalom81f62d82019-07-22 12:10:00 -07003775 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003776 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
3777 "WNM mode");
3778 return -1;
3779 }
Hai Shalom81f62d82019-07-22 12:10:00 -07003780 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003781 } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02003782 const struct wpa_igtk_kde *igtk;
Dmitry Shmidt61593f02014-04-21 16:27:35 -07003783
Mathy Vanhoef10bfd642017-07-12 16:03:24 +02003784 igtk = (const struct wpa_igtk_kde *) (buf + 2);
Jouni Malinen58c0e962017-10-01 12:12:24 +03003785 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003786 return -1;
Hai Shalomfdcde762020-04-02 11:19:20 -07003787 } else if (subelem_id == WNM_SLEEP_SUBELEM_BIGTK) {
3788 const struct wpa_bigtk_kde *bigtk;
3789
3790 bigtk = (const struct wpa_bigtk_kde *) (buf + 2);
3791 if (sm->beacon_prot &&
3792 wpa_supplicant_install_bigtk(sm, bigtk, 1) < 0)
3793 return -1;
Dmitry Shmidt61d9df32012-08-29 16:22:06 -07003794 } else {
3795 wpa_printf(MSG_DEBUG, "Unknown element id");
3796 return -1;
3797 }
3798
3799 return 0;
3800}
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08003801#endif /* CONFIG_WNM */
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -08003802
3803
Dmitry Shmidtcf32e602014-01-28 10:57:39 -08003804#ifdef CONFIG_P2P
3805
3806int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
3807{
3808 if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
3809 return -1;
3810 os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
3811 return 0;
3812}
3813
3814#endif /* CONFIG_P2P */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003815
3816
3817void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
3818{
3819 if (rx_replay_counter == NULL)
3820 return;
3821
3822 os_memcpy(sm->rx_replay_counter, rx_replay_counter,
3823 WPA_REPLAY_COUNTER_LEN);
3824 sm->rx_replay_counter_set = 1;
3825 wpa_printf(MSG_DEBUG, "Updated key replay counter");
3826}
3827
3828
Dmitry Shmidt807291d2015-01-27 13:40:23 -08003829void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm,
3830 const u8 *ptk_kck, size_t ptk_kck_len,
3831 const u8 *ptk_kek, size_t ptk_kek_len)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003832{
Dmitry Shmidt807291d2015-01-27 13:40:23 -08003833 if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
3834 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
3835 sm->ptk.kck_len = ptk_kck_len;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003836 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
3837 }
Dmitry Shmidt807291d2015-01-27 13:40:23 -08003838 if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
3839 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
3840 sm->ptk.kek_len = ptk_kek_len;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003841 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
3842 }
3843 sm->ptk_set = 1;
3844}
Dmitry Shmidt55840ad2015-12-14 12:45:46 -08003845
3846
3847#ifdef CONFIG_TESTING_OPTIONS
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003848
Dmitry Shmidt55840ad2015-12-14 12:45:46 -08003849void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
3850{
3851 wpabuf_free(sm->test_assoc_ie);
3852 sm->test_assoc_ie = buf;
3853}
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003854
3855
3856const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
3857{
3858 return sm->anonce;
3859}
3860
Dmitry Shmidt55840ad2015-12-14 12:45:46 -08003861#endif /* CONFIG_TESTING_OPTIONS */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003862
3863
Roshan Pius3a1667e2018-07-03 15:17:14 -07003864unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
3865{
3866 return sm->key_mgmt;
3867}
3868
3869
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003870#ifdef CONFIG_FILS
3871
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003872struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003873{
3874 struct wpabuf *buf = NULL;
3875 struct wpabuf *erp_msg;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003876 struct wpabuf *pub = NULL;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003877
3878 erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
3879 if (!erp_msg && !sm->cur_pmksa) {
3880 wpa_printf(MSG_DEBUG,
3881 "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
3882 goto fail;
3883 }
3884
3885 wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
3886 erp_msg != NULL, sm->cur_pmksa != NULL);
3887
3888 sm->fils_completed = 0;
3889
3890 if (!sm->assoc_wpa_ie) {
3891 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
3892 goto fail;
3893 }
3894
3895 if (random_get_bytes(sm->fils_nonce, FILS_NONCE_LEN) < 0 ||
3896 random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
3897 goto fail;
3898
3899 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
3900 sm->fils_nonce, FILS_NONCE_LEN);
3901 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
3902 sm->fils_session, FILS_SESSION_LEN);
3903
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003904#ifdef CONFIG_FILS_SK_PFS
3905 sm->fils_dh_group = dh_group;
3906 if (dh_group) {
3907 crypto_ecdh_deinit(sm->fils_ecdh);
3908 sm->fils_ecdh = crypto_ecdh_init(dh_group);
3909 if (!sm->fils_ecdh) {
3910 wpa_printf(MSG_INFO,
3911 "FILS: Could not initialize ECDH with group %d",
3912 dh_group);
3913 goto fail;
3914 }
3915 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3916 if (!pub)
3917 goto fail;
3918 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
3919 pub);
3920 sm->fils_dh_elem_len = wpabuf_len(pub);
3921 }
3922#endif /* CONFIG_FILS_SK_PFS */
3923
3924 buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
3925 (pub ? wpabuf_len(pub) : 0));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003926 if (!buf)
3927 goto fail;
3928
3929 /* Fields following the Authentication algorithm number field */
3930
3931 /* Authentication Transaction seq# */
3932 wpabuf_put_le16(buf, 1);
3933
3934 /* Status Code */
3935 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
3936
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003937 /* TODO: FILS PK */
3938#ifdef CONFIG_FILS_SK_PFS
3939 if (dh_group) {
3940 /* Finite Cyclic Group */
3941 wpabuf_put_le16(buf, dh_group);
3942 /* Element */
3943 wpabuf_put_buf(buf, pub);
3944 }
3945#endif /* CONFIG_FILS_SK_PFS */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003946
3947 /* RSNE */
3948 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
3949 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3950 wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3951
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003952 if (md) {
3953 /* MDE when using FILS for FT initial association */
3954 struct rsn_mdie *mdie;
3955
3956 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
3957 wpabuf_put_u8(buf, sizeof(*mdie));
3958 mdie = wpabuf_put(buf, sizeof(*mdie));
3959 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
3960 mdie->ft_capab = 0;
3961 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003962
3963 /* FILS Nonce */
3964 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3965 wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN); /* Length */
3966 /* Element ID Extension */
3967 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
3968 wpabuf_put_data(buf, sm->fils_nonce, FILS_NONCE_LEN);
3969
3970 /* FILS Session */
3971 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3972 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
3973 /* Element ID Extension */
3974 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
3975 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
3976
Hai Shalomfdcde762020-04-02 11:19:20 -07003977 /* Wrapped Data */
Paul Stewart092955c2017-02-06 09:13:09 -08003978 sm->fils_erp_pmkid_set = 0;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003979 if (erp_msg) {
3980 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3981 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
3982 /* Element ID Extension */
Hai Shalomfdcde762020-04-02 11:19:20 -07003983 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003984 wpabuf_put_buf(buf, erp_msg);
Paul Stewart092955c2017-02-06 09:13:09 -08003985 /* Calculate pending PMKID here so that we do not need to
3986 * maintain a copy of the EAP-Initiate/Reauth message. */
3987 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
3988 wpabuf_len(erp_msg),
3989 sm->fils_erp_pmkid) == 0)
3990 sm->fils_erp_pmkid_set = 1;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003991 }
3992
3993 wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
3994 buf);
3995
3996fail:
3997 wpabuf_free(erp_msg);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07003998 wpabuf_free(pub);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003999 return buf;
4000}
4001
4002
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004003int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
4004 size_t len)
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004005{
4006 const u8 *pos, *end;
4007 struct ieee802_11_elems elems;
4008 struct wpa_ie_data rsn;
4009 int pmkid_match = 0;
4010 u8 ick[FILS_ICK_MAX_LEN];
4011 size_t ick_len;
4012 int res;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004013 struct wpabuf *dh_ss = NULL;
4014 const u8 *g_sta = NULL;
4015 size_t g_sta_len = 0;
4016 const u8 *g_ap = NULL;
4017 size_t g_ap_len = 0;
4018 struct wpabuf *pub = NULL;
4019
4020 os_memcpy(sm->bssid, bssid, ETH_ALEN);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004021
4022 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
4023 data, len);
4024 pos = data;
4025 end = data + len;
4026
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004027 /* TODO: FILS PK */
4028#ifdef CONFIG_FILS_SK_PFS
4029 if (sm->fils_dh_group) {
4030 u16 group;
4031
4032 /* Using FILS PFS */
4033
4034 /* Finite Cyclic Group */
4035 if (end - pos < 2) {
4036 wpa_printf(MSG_DEBUG,
4037 "FILS: No room for Finite Cyclic Group");
4038 goto fail;
4039 }
4040 group = WPA_GET_LE16(pos);
4041 pos += 2;
4042 if (group != sm->fils_dh_group) {
4043 wpa_printf(MSG_DEBUG,
4044 "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
4045 group, sm->fils_dh_group);
4046 goto fail;
4047 }
4048
4049 /* Element */
4050 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
4051 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
4052 goto fail;
4053 }
4054
4055 if (!sm->fils_ecdh) {
4056 wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
4057 goto fail;
4058 }
4059 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
4060 sm->fils_dh_elem_len);
4061 if (!dh_ss) {
4062 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
4063 goto fail;
4064 }
4065 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
4066 g_ap = pos;
4067 g_ap_len = sm->fils_dh_elem_len;
4068 pos += sm->fils_dh_elem_len;
4069 }
4070#endif /* CONFIG_FILS_SK_PFS */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004071
4072 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
4073 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
4074 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004075 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004076 }
4077
4078 /* RSNE */
4079 wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
4080 elems.rsn_ie_len);
4081 if (!elems.rsn_ie ||
4082 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4083 &rsn) < 0) {
4084 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004085 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004086 }
4087
4088 if (!elems.fils_nonce) {
4089 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004090 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004091 }
4092 os_memcpy(sm->fils_anonce, elems.fils_nonce, FILS_NONCE_LEN);
4093 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, FILS_NONCE_LEN);
4094
Roshan Pius3a1667e2018-07-03 15:17:14 -07004095#ifdef CONFIG_IEEE80211R
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004096 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
4097 struct wpa_ft_ies parse;
4098
4099 if (!elems.mdie || !elems.ftie) {
4100 wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
4101 goto fail;
4102 }
4103
Roshan Pius3a1667e2018-07-03 15:17:14 -07004104 if (wpa_ft_parse_ies(pos, end - pos, &parse,
4105 wpa_key_mgmt_sha384(sm->key_mgmt)) < 0) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004106 wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
4107 goto fail;
4108 }
4109
4110 if (!parse.r0kh_id) {
4111 wpa_printf(MSG_DEBUG,
4112 "FILS+FT: No R0KH-ID subelem in FTE");
4113 goto fail;
4114 }
4115 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
4116 sm->r0kh_id_len = parse.r0kh_id_len;
4117 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4118 sm->r0kh_id, sm->r0kh_id_len);
4119
4120 if (!parse.r1kh_id) {
4121 wpa_printf(MSG_DEBUG,
4122 "FILS+FT: No R1KH-ID subelem in FTE");
4123 goto fail;
4124 }
4125 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
4126 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
4127 sm->r1kh_id, FT_R1KH_ID_LEN);
4128
4129 /* TODO: Check MDE and FTE payload */
4130
4131 wpabuf_free(sm->fils_ft_ies);
4132 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
4133 2 + elems.ftie_len);
4134 if (!sm->fils_ft_ies)
4135 goto fail;
4136 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
4137 2 + elems.mdie_len);
4138 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
4139 2 + elems.ftie_len);
4140 } else {
4141 wpabuf_free(sm->fils_ft_ies);
4142 sm->fils_ft_ies = NULL;
4143 }
Roshan Pius3a1667e2018-07-03 15:17:14 -07004144#endif /* CONFIG_IEEE80211R */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004145
4146 /* PMKID List */
4147 if (rsn.pmkid && rsn.num_pmkid > 0) {
4148 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
4149 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
4150
4151 if (rsn.num_pmkid != 1) {
4152 wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004153 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004154 }
4155 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
4156 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
4157 {
4158 wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
4159 wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
4160 sm->cur_pmksa->pmkid, PMKID_LEN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004161 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004162 }
4163 wpa_printf(MSG_DEBUG,
4164 "FILS: Matching PMKID - continue using PMKSA caching");
4165 pmkid_match = 1;
4166 }
4167 if (!pmkid_match && sm->cur_pmksa) {
4168 wpa_printf(MSG_DEBUG,
4169 "FILS: No PMKID match - cannot use cached PMKSA entry");
4170 sm->cur_pmksa = NULL;
4171 }
4172
4173 /* FILS Session */
4174 if (!elems.fils_session) {
4175 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004176 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004177 }
4178 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
4179 FILS_SESSION_LEN);
4180 if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
4181 != 0) {
4182 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
4183 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4184 sm->fils_session, FILS_SESSION_LEN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004185 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004186 }
4187
Hai Shalomfdcde762020-04-02 11:19:20 -07004188 /* Wrapped Data */
4189 if (!sm->cur_pmksa && elems.wrapped_data) {
Paul Stewart092955c2017-02-06 09:13:09 -08004190 u8 rmsk[ERP_MAX_KEY_LEN];
4191 size_t rmsk_len;
4192
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004193 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
Hai Shalomfdcde762020-04-02 11:19:20 -07004194 elems.wrapped_data,
4195 elems.wrapped_data_len);
4196 eapol_sm_process_erp_finish(sm->eapol, elems.wrapped_data,
4197 elems.wrapped_data_len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004198 if (eapol_sm_failed(sm->eapol))
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004199 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004200
Paul Stewart092955c2017-02-06 09:13:09 -08004201 rmsk_len = ERP_MAX_KEY_LEN;
4202 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4203 if (res == PMK_LEN) {
4204 rmsk_len = PMK_LEN;
4205 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
4206 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004207 if (res)
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004208 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004209
Paul Stewart092955c2017-02-06 09:13:09 -08004210 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004211 sm->fils_nonce, sm->fils_anonce,
4212 dh_ss ? wpabuf_head(dh_ss) : NULL,
4213 dh_ss ? wpabuf_len(dh_ss) : 0,
Paul Stewart092955c2017-02-06 09:13:09 -08004214 sm->pmk, &sm->pmk_len);
Hai Shalom81f62d82019-07-22 12:10:00 -07004215 forced_memzero(rmsk, sizeof(rmsk));
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004216
4217 /* Don't use DHss in PTK derivation if PMKSA caching is not
4218 * used. */
4219 wpabuf_clear_free(dh_ss);
4220 dh_ss = NULL;
4221
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08004222 if (res)
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004223 goto fail;
Paul Stewart092955c2017-02-06 09:13:09 -08004224
4225 if (!sm->fils_erp_pmkid_set) {
4226 wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004227 goto fail;
Paul Stewart092955c2017-02-06 09:13:09 -08004228 }
4229 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
4230 PMKID_LEN);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004231 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
Paul Stewart092955c2017-02-06 09:13:09 -08004232 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
4233 sm->fils_erp_pmkid, NULL, 0,
4234 sm->bssid, sm->own_addr,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004235 sm->network_ctx, sm->key_mgmt,
4236 NULL);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004237 }
4238
4239 if (!sm->cur_pmksa) {
4240 wpa_printf(MSG_DEBUG,
4241 "FILS: No remaining options to continue FILS authentication");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004242 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004243 }
4244
4245 if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr, sm->bssid,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004246 sm->fils_nonce, sm->fils_anonce,
4247 dh_ss ? wpabuf_head(dh_ss) : NULL,
4248 dh_ss ? wpabuf_len(dh_ss) : 0,
4249 &sm->ptk, ick, &ick_len,
4250 sm->key_mgmt, sm->pairwise_cipher,
4251 sm->fils_ft, &sm->fils_ft_len) < 0) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004252 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004253 goto fail;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004254 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004255
4256 wpabuf_clear_free(dh_ss);
4257 dh_ss = NULL;
4258
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004259 sm->ptk_set = 1;
4260 sm->tptk_set = 0;
4261 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
4262
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004263#ifdef CONFIG_FILS_SK_PFS
4264 if (sm->fils_dh_group) {
4265 if (!sm->fils_ecdh) {
4266 wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
4267 goto fail;
4268 }
4269 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
4270 if (!pub)
4271 goto fail;
4272 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
4273 g_sta = wpabuf_head(pub);
4274 g_sta_len = wpabuf_len(pub);
4275 if (!g_ap) {
4276 wpa_printf(MSG_INFO, "FILS: gAP not available");
4277 goto fail;
4278 }
4279 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
4280 }
4281#endif /* CONFIG_FILS_SK_PFS */
4282
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004283 res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
4284 sm->fils_anonce, sm->own_addr, sm->bssid,
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004285 g_sta, g_sta_len, g_ap, g_ap_len,
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004286 sm->key_mgmt, sm->fils_key_auth_sta,
4287 sm->fils_key_auth_ap,
4288 &sm->fils_key_auth_len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004289 wpabuf_free(pub);
Hai Shalom81f62d82019-07-22 12:10:00 -07004290 forced_memzero(ick, sizeof(ick));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004291 return res;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004292fail:
4293 wpabuf_free(pub);
4294 wpabuf_clear_free(dh_ss);
4295 return -1;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004296}
4297
4298
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004299#ifdef CONFIG_IEEE80211R
4300static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
4301{
4302 struct rsn_ie_hdr *rsnie;
4303 u16 capab;
4304 u8 *pos;
Roshan Pius3a1667e2018-07-03 15:17:14 -07004305 int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004306
4307 /* RSNIE[PMKR0Name/PMKR1Name] */
4308 rsnie = wpabuf_put(buf, sizeof(*rsnie));
4309 rsnie->elem_id = WLAN_EID_RSN;
4310 WPA_PUT_LE16(rsnie->version, RSN_VERSION);
4311
4312 /* Group Suite Selector */
4313 if (!wpa_cipher_valid_group(sm->group_cipher)) {
4314 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
4315 sm->group_cipher);
4316 return -1;
4317 }
4318 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4319 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4320 sm->group_cipher));
4321
4322 /* Pairwise Suite Count */
4323 wpabuf_put_le16(buf, 1);
4324
4325 /* Pairwise Suite List */
4326 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
4327 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
4328 sm->pairwise_cipher);
4329 return -1;
4330 }
4331 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4332 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
4333 sm->pairwise_cipher));
4334
4335 /* Authenticated Key Management Suite Count */
4336 wpabuf_put_le16(buf, 1);
4337
4338 /* Authenticated Key Management Suite List */
4339 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4340 if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
4341 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
4342 else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
4343 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
4344 else {
4345 wpa_printf(MSG_WARNING,
4346 "FILS+FT: Invalid key management type (%d)",
4347 sm->key_mgmt);
4348 return -1;
4349 }
4350
4351 /* RSN Capabilities */
4352 capab = 0;
Hai Shalomc3565922019-10-28 11:58:20 -07004353 if (sm->mfp)
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004354 capab |= WPA_CAPABILITY_MFPC;
Hai Shalomc3565922019-10-28 11:58:20 -07004355 if (sm->mfp == 2)
4356 capab |= WPA_CAPABILITY_MFPR;
Hai Shalom74f70d42019-02-11 14:42:39 -08004357 if (sm->ocv)
4358 capab |= WPA_CAPABILITY_OCVC;
Hai Shalomfdcde762020-04-02 11:19:20 -07004359 if (sm->ext_key_id)
4360 capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004361 wpabuf_put_le16(buf, capab);
4362
4363 /* PMKID Count */
4364 wpabuf_put_le16(buf, 1);
4365
4366 /* PMKID List [PMKR1Name] */
4367 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
4368 sm->fils_ft, sm->fils_ft_len);
4369 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
4370 wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
4371 sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
4372 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
4373 sm->r0kh_id, sm->r0kh_id_len);
4374 if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
4375 sm->ssid_len, sm->mobility_domain,
4376 sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
Roshan Pius3a1667e2018-07-03 15:17:14 -07004377 sm->pmk_r0, sm->pmk_r0_name, use_sha384) < 0) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004378 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
4379 return -1;
4380 }
Roshan Pius3a1667e2018-07-03 15:17:14 -07004381 sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
4382 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0",
4383 sm->pmk_r0, sm->pmk_r0_len);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004384 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name",
4385 sm->pmk_r0_name, WPA_PMK_NAME_LEN);
4386 wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
4387 MAC2STR(sm->r1kh_id));
4388 pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
4389 if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
Hai Shalom021b0b52019-04-10 11:17:58 -07004390 sm->pmk_r1_name, use_sha384) < 0) {
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004391 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
4392 return -1;
4393 }
Hai Shalom021b0b52019-04-10 11:17:58 -07004394 wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR1Name", sm->pmk_r1_name,
4395 WPA_PMK_NAME_LEN);
4396 os_memcpy(pos, sm->pmk_r1_name, WPA_PMK_NAME_LEN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004397
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004398 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
4399 /* Management Group Cipher Suite */
4400 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
4401 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
4402 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004403
4404 rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
4405 return 0;
4406}
4407#endif /* CONFIG_IEEE80211R */
4408
4409
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004410struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
4411 size_t *kek_len, const u8 **snonce,
Paul Stewart092955c2017-02-06 09:13:09 -08004412 const u8 **anonce,
4413 const struct wpabuf **hlp,
4414 unsigned int num_hlp)
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004415{
4416 struct wpabuf *buf;
Paul Stewart092955c2017-02-06 09:13:09 -08004417 size_t len;
4418 unsigned int i;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004419
Paul Stewart092955c2017-02-06 09:13:09 -08004420 len = 1000;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004421#ifdef CONFIG_IEEE80211R
4422 if (sm->fils_ft_ies)
4423 len += wpabuf_len(sm->fils_ft_ies);
4424 if (wpa_key_mgmt_ft(sm->key_mgmt))
4425 len += 256;
4426#endif /* CONFIG_IEEE80211R */
Paul Stewart092955c2017-02-06 09:13:09 -08004427 for (i = 0; hlp && i < num_hlp; i++)
4428 len += 10 + wpabuf_len(hlp[i]);
4429 buf = wpabuf_alloc(len);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004430 if (!buf)
4431 return NULL;
4432
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004433#ifdef CONFIG_IEEE80211R
4434 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4435 /* MDE and FTE when using FILS+FT */
4436 wpabuf_put_buf(buf, sm->fils_ft_ies);
4437 /* RSNE with PMKR1Name in PMKID field */
4438 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
4439 wpabuf_free(buf);
4440 return NULL;
4441 }
4442 }
4443#endif /* CONFIG_IEEE80211R */
4444
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004445 /* FILS Session */
4446 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4447 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
4448 /* Element ID Extension */
4449 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
4450 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
4451
4452 /* Everything after FILS Session element gets encrypted in the driver
4453 * with KEK. The buffer returned from here is the plaintext version. */
4454
4455 /* TODO: FILS Public Key */
4456
4457 /* FILS Key Confirm */
4458 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4459 wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
4460 /* Element ID Extension */
4461 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
4462 wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
4463
Paul Stewart092955c2017-02-06 09:13:09 -08004464 /* FILS HLP Container */
4465 for (i = 0; hlp && i < num_hlp; i++) {
4466 const u8 *pos = wpabuf_head(hlp[i]);
4467 size_t left = wpabuf_len(hlp[i]);
4468
4469 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
4470 if (left <= 254)
4471 len = 1 + left;
4472 else
4473 len = 255;
4474 wpabuf_put_u8(buf, len); /* Length */
4475 /* Element ID Extension */
4476 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
4477 /* Destination MAC Address, Source MAC Address, HLP Packet.
4478 * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
4479 * header when LPD is used). */
4480 wpabuf_put_data(buf, pos, len - 1);
4481 pos += len - 1;
4482 left -= len - 1;
4483 while (left) {
4484 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4485 len = left > 255 ? 255 : left;
4486 wpabuf_put_u8(buf, len);
4487 wpabuf_put_data(buf, pos, len);
4488 pos += len;
4489 left -= len;
4490 }
4491 }
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004492
4493 /* TODO: FILS IP Address Assignment */
4494
Hai Shalom74f70d42019-02-11 14:42:39 -08004495#ifdef CONFIG_OCV
4496 if (wpa_sm_ocv_enabled(sm)) {
4497 struct wpa_channel_info ci;
4498 u8 *pos;
4499
4500 if (wpa_sm_channel_info(sm, &ci) != 0) {
4501 wpa_printf(MSG_WARNING,
4502 "FILS: Failed to get channel info for OCI element");
4503 wpabuf_free(buf);
4504 return NULL;
4505 }
4506
4507 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
4508 if (ocv_insert_extended_oci(&ci, pos) < 0) {
4509 wpabuf_free(buf);
4510 return NULL;
4511 }
4512 }
4513#endif /* CONFIG_OCV */
4514
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004515 wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
4516
4517 *kek = sm->ptk.kek;
4518 *kek_len = sm->ptk.kek_len;
4519 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
4520 *snonce = sm->fils_nonce;
4521 wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD",
4522 *snonce, FILS_NONCE_LEN);
4523 *anonce = sm->fils_anonce;
4524 wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD",
4525 *anonce, FILS_NONCE_LEN);
4526
4527 return buf;
4528}
4529
4530
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08004531static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4532{
4533 const u8 *pos, *end;
4534
4535 wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
4536 if (len < 2 * ETH_ALEN)
4537 return;
4538 pos = resp + 2 * ETH_ALEN;
4539 end = resp + len;
4540 if (end - pos >= 6 &&
4541 os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
4542 pos += 6; /* Remove SNAP/LLC header */
4543 wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
4544}
4545
4546
4547static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
4548 size_t len)
4549{
4550 const u8 *end = pos + len;
4551 u8 *tmp, *tmp_pos;
4552
4553 /* Check if there are any FILS HLP Container elements */
4554 while (end - pos >= 2) {
4555 if (2 + pos[1] > end - pos)
4556 return;
4557 if (pos[0] == WLAN_EID_EXTENSION &&
4558 pos[1] >= 1 + 2 * ETH_ALEN &&
4559 pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
4560 break;
4561 pos += 2 + pos[1];
4562 }
4563 if (end - pos < 2)
4564 return; /* No FILS HLP Container elements */
4565
4566 tmp = os_malloc(end - pos);
4567 if (!tmp)
4568 return;
4569
4570 while (end - pos >= 2) {
4571 if (2 + pos[1] > end - pos ||
4572 pos[0] != WLAN_EID_EXTENSION ||
4573 pos[1] < 1 + 2 * ETH_ALEN ||
4574 pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
4575 break;
4576 tmp_pos = tmp;
4577 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
4578 tmp_pos += pos[1] - 1;
4579 pos += 2 + pos[1];
4580
4581 /* Add possible fragments */
4582 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
4583 2 + pos[1] <= end - pos) {
4584 os_memcpy(tmp_pos, pos + 2, pos[1]);
4585 tmp_pos += pos[1];
4586 pos += 2 + pos[1];
4587 }
4588
4589 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
4590 }
4591
4592 os_free(tmp);
4593}
4594
4595
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004596int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4597{
4598 const struct ieee80211_mgmt *mgmt;
4599 const u8 *end, *ie_start;
4600 struct ieee802_11_elems elems;
4601 int keylen, rsclen;
4602 enum wpa_alg alg;
4603 struct wpa_gtk_data gd;
4604 int maxkeylen;
4605 struct wpa_eapol_ie_parse kde;
4606
4607 if (!sm || !sm->ptk_set) {
4608 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
4609 return -1;
4610 }
4611
4612 if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
4613 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
4614 return -1;
4615 }
4616
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004617 if (sm->fils_completed) {
4618 wpa_printf(MSG_DEBUG,
4619 "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
4620 return -1;
4621 }
4622
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004623 wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
4624 resp, len);
4625
4626 mgmt = (const struct ieee80211_mgmt *) resp;
4627 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
4628 return -1;
4629
4630 end = resp + len;
4631 /* Same offset for Association Response and Reassociation Response */
4632 ie_start = mgmt->u.assoc_resp.variable;
4633
4634 if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
4635 ParseFailed) {
4636 wpa_printf(MSG_DEBUG,
4637 "FILS: Failed to parse decrypted elements");
4638 goto fail;
4639 }
4640
4641 if (!elems.fils_session) {
4642 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4643 return -1;
4644 }
4645 if (os_memcmp(elems.fils_session, sm->fils_session,
4646 FILS_SESSION_LEN) != 0) {
4647 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
4648 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
4649 elems.fils_session, FILS_SESSION_LEN);
4650 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4651 sm->fils_session, FILS_SESSION_LEN);
4652 }
4653
Hai Shalom81f62d82019-07-22 12:10:00 -07004654 if (!elems.rsn_ie) {
4655 wpa_printf(MSG_DEBUG,
4656 "FILS: No RSNE in (Re)Association Response");
4657 /* As an interop workaround, allow this for now since IEEE Std
4658 * 802.11ai-2016 did not include all the needed changes to make
4659 * a FILS AP include RSNE in the frame. This workaround might
4660 * eventually be removed and replaced with rejection (goto fail)
4661 * to follow a strict interpretation of the standard. */
4662 } else if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
4663 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
4664 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
4665 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4666 "FILS: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
4667 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in Beacon/Probe Response",
4668 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
4669 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in (Re)Association Response",
4670 elems.rsn_ie, elems.rsn_ie_len);
4671 goto fail;
4672 }
4673
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004674 /* TODO: FILS Public Key */
4675
4676 if (!elems.fils_key_confirm) {
4677 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
4678 goto fail;
4679 }
4680 if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
4681 wpa_printf(MSG_DEBUG,
4682 "FILS: Unexpected Key-Auth length %d (expected %d)",
4683 elems.fils_key_confirm_len,
4684 (int) sm->fils_key_auth_len);
4685 goto fail;
4686 }
4687 if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
4688 sm->fils_key_auth_len) != 0) {
4689 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
4690 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
4691 elems.fils_key_confirm,
4692 elems.fils_key_confirm_len);
4693 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
4694 sm->fils_key_auth_ap, sm->fils_key_auth_len);
4695 goto fail;
4696 }
4697
Hai Shalom74f70d42019-02-11 14:42:39 -08004698#ifdef CONFIG_OCV
4699 if (wpa_sm_ocv_enabled(sm)) {
4700 struct wpa_channel_info ci;
4701
4702 if (wpa_sm_channel_info(sm, &ci) != 0) {
4703 wpa_printf(MSG_WARNING,
4704 "Failed to get channel info to validate received OCI in FILS (Re)Association Response frame");
4705 goto fail;
4706 }
4707
4708 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
4709 channel_width_to_int(ci.chanwidth),
4710 ci.seg1_idx) != 0) {
4711 wpa_printf(MSG_WARNING, "FILS: %s", ocv_errorstr);
4712 goto fail;
4713 }
4714 }
4715#endif /* CONFIG_OCV */
4716
Hai Shalom021b0b52019-04-10 11:17:58 -07004717#ifdef CONFIG_IEEE80211R
4718 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
4719 struct wpa_ie_data rsn;
4720
4721 /* Check that PMKR1Name derived by the AP matches */
4722 if (!elems.rsn_ie ||
4723 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
4724 &rsn) < 0 ||
4725 !rsn.pmkid || rsn.num_pmkid != 1 ||
4726 os_memcmp(rsn.pmkid, sm->pmk_r1_name,
4727 WPA_PMK_NAME_LEN) != 0) {
4728 wpa_printf(MSG_DEBUG,
4729 "FILS+FT: No RSNE[PMKR1Name] match in AssocResp");
4730 goto fail;
4731 }
4732 }
4733#endif /* CONFIG_IEEE80211R */
4734
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004735 /* Key Delivery */
4736 if (!elems.key_delivery) {
4737 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
4738 goto fail;
4739 }
4740
4741 /* Parse GTK and set the key to the driver */
4742 os_memset(&gd, 0, sizeof(gd));
4743 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
4744 elems.key_delivery_len - WPA_KEY_RSC_LEN,
4745 &kde) < 0) {
4746 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
4747 goto fail;
4748 }
4749 if (!kde.gtk) {
4750 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
4751 goto fail;
4752 }
4753 maxkeylen = gd.gtk_len = kde.gtk_len - 2;
4754 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
4755 gd.gtk_len, maxkeylen,
4756 &gd.key_rsc_len, &gd.alg))
4757 goto fail;
4758
4759 wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
4760 gd.keyidx = kde.gtk[0] & 0x3;
4761 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
4762 !!(kde.gtk[0] & BIT(2)));
4763 if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
4764 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
4765 (unsigned long) kde.gtk_len - 2);
4766 goto fail;
4767 }
4768 os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
4769
4770 wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004771 if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004772 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
4773 goto fail;
4774 }
4775
4776 if (ieee80211w_set_keys(sm, &kde) < 0) {
4777 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
4778 goto fail;
4779 }
4780
4781 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
4782 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004783 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
4784 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
4785 keylen, (long unsigned int) sm->ptk.tk_len);
4786 goto fail;
4787 }
Hai Shalomfdcde762020-04-02 11:19:20 -07004788
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004789 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
4790 wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
4791 sm->ptk.tk, keylen);
4792 if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, null_rsc, rsclen,
Hai Shalomfdcde762020-04-02 11:19:20 -07004793 sm->ptk.tk, keylen, KEY_FLAG_PAIRWISE_RX_TX) < 0) {
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004794 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4795 "FILS: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
4796 MACSTR ")",
4797 alg, keylen, MAC2STR(sm->bssid));
4798 goto fail;
4799 }
4800
4801 /* TODO: TK could be cleared after auth frame exchange now that driver
4802 * takes care of association frame encryption/decryption. */
4803 /* TK is not needed anymore in supplicant */
4804 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004805 sm->ptk.tk_len = 0;
Mathy Vanhoefc66556c2017-09-29 04:22:51 +02004806 sm->ptk.installed = 1;
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004807
Dmitry Shmidtebd93af2017-02-21 13:40:44 -08004808 /* FILS HLP Container */
4809 fils_process_hlp_container(sm, ie_start, end - ie_start);
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004810
4811 /* TODO: FILS IP Address Assignment */
4812
4813 wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
4814 sm->fils_completed = 1;
Hai Shalom81f62d82019-07-22 12:10:00 -07004815 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004816
Hai Shalomfdcde762020-04-02 11:19:20 -07004817 if (kde.transition_disable)
4818 wpa_sm_transition_disable(sm, kde.transition_disable[0]);
4819
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004820 return 0;
4821fail:
Hai Shalom81f62d82019-07-22 12:10:00 -07004822 forced_memzero(&gd, sizeof(gd));
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004823 return -1;
4824}
4825
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004826
4827void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
4828{
4829 if (sm)
4830 sm->fils_completed = !!set;
4831}
4832
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08004833#endif /* CONFIG_FILS */
4834
4835
4836int wpa_fils_is_completed(struct wpa_sm *sm)
4837{
4838#ifdef CONFIG_FILS
4839 return sm && sm->fils_completed;
4840#else /* CONFIG_FILS */
4841 return 0;
4842#endif /* CONFIG_FILS */
4843}
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07004844
4845
4846#ifdef CONFIG_OWE
4847
4848struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
4849{
4850 struct wpabuf *ie = NULL, *pub = NULL;
4851 size_t prime_len;
4852
4853 if (group == 19)
4854 prime_len = 32;
4855 else if (group == 20)
4856 prime_len = 48;
4857 else if (group == 21)
4858 prime_len = 66;
4859 else
4860 return NULL;
4861
4862 crypto_ecdh_deinit(sm->owe_ecdh);
4863 sm->owe_ecdh = crypto_ecdh_init(group);
4864 if (!sm->owe_ecdh)
4865 goto fail;
4866 sm->owe_group = group;
4867 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4868 pub = wpabuf_zeropad(pub, prime_len);
4869 if (!pub)
4870 goto fail;
4871
4872 ie = wpabuf_alloc(5 + wpabuf_len(pub));
4873 if (!ie)
4874 goto fail;
4875 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
4876 wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
4877 wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
4878 wpabuf_put_le16(ie, group);
4879 wpabuf_put_buf(ie, pub);
4880 wpabuf_free(pub);
4881 wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
4882 ie);
4883
4884 return ie;
4885fail:
4886 wpabuf_free(pub);
4887 crypto_ecdh_deinit(sm->owe_ecdh);
4888 sm->owe_ecdh = NULL;
4889 return NULL;
4890}
4891
4892
4893int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
4894 const u8 *resp_ies, size_t resp_ies_len)
4895{
4896 struct ieee802_11_elems elems;
4897 u16 group;
4898 struct wpabuf *secret, *pub, *hkey;
4899 int res;
4900 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
4901 const char *info = "OWE Key Generation";
4902 const u8 *addr[2];
4903 size_t len[2];
4904 size_t hash_len, prime_len;
4905 struct wpa_ie_data data;
4906
4907 if (!resp_ies ||
4908 ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
4909 ParseFailed) {
4910 wpa_printf(MSG_INFO,
4911 "OWE: Could not parse Association Response frame elements");
4912 return -1;
4913 }
4914
4915 if (sm->cur_pmksa && elems.rsn_ie &&
4916 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
4917 &data) == 0 &&
4918 data.num_pmkid == 1 && data.pmkid &&
4919 os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
4920 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
4921 wpa_sm_set_pmk_from_pmksa(sm);
4922 return 0;
4923 }
4924
4925 if (!elems.owe_dh) {
4926 wpa_printf(MSG_INFO,
4927 "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
4928 return -1;
4929 }
4930
4931 group = WPA_GET_LE16(elems.owe_dh);
4932 if (group != sm->owe_group) {
4933 wpa_printf(MSG_INFO,
4934 "OWE: Unexpected Diffie-Hellman group in response: %u",
4935 group);
4936 return -1;
4937 }
4938
4939 if (!sm->owe_ecdh) {
4940 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
4941 return -1;
4942 }
4943
4944 if (group == 19)
4945 prime_len = 32;
4946 else if (group == 20)
4947 prime_len = 48;
4948 else if (group == 21)
4949 prime_len = 66;
4950 else
4951 return -1;
4952
4953 secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
4954 elems.owe_dh + 2,
4955 elems.owe_dh_len - 2);
4956 secret = wpabuf_zeropad(secret, prime_len);
4957 if (!secret) {
4958 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
4959 return -1;
4960 }
4961 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
4962
4963 /* prk = HKDF-extract(C | A | group, z) */
4964
4965 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4966 if (!pub) {
4967 wpabuf_clear_free(secret);
4968 return -1;
4969 }
4970
4971 /* PMKID = Truncate-128(Hash(C | A)) */
4972 addr[0] = wpabuf_head(pub);
4973 len[0] = wpabuf_len(pub);
4974 addr[1] = elems.owe_dh + 2;
4975 len[1] = elems.owe_dh_len - 2;
4976 if (group == 19) {
4977 res = sha256_vector(2, addr, len, pmkid);
4978 hash_len = SHA256_MAC_LEN;
4979 } else if (group == 20) {
4980 res = sha384_vector(2, addr, len, pmkid);
4981 hash_len = SHA384_MAC_LEN;
4982 } else if (group == 21) {
4983 res = sha512_vector(2, addr, len, pmkid);
4984 hash_len = SHA512_MAC_LEN;
4985 } else {
4986 res = -1;
4987 hash_len = 0;
4988 }
4989 pub = wpabuf_zeropad(pub, prime_len);
4990 if (res < 0 || !pub) {
4991 wpabuf_free(pub);
4992 wpabuf_clear_free(secret);
4993 return -1;
4994 }
4995
4996 hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
4997 if (!hkey) {
4998 wpabuf_free(pub);
4999 wpabuf_clear_free(secret);
5000 return -1;
5001 }
5002
5003 wpabuf_put_buf(hkey, pub); /* C */
5004 wpabuf_free(pub);
5005 wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
5006 wpabuf_put_le16(hkey, sm->owe_group); /* group */
5007 if (group == 19)
5008 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
5009 wpabuf_head(secret), wpabuf_len(secret), prk);
5010 else if (group == 20)
5011 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
5012 wpabuf_head(secret), wpabuf_len(secret), prk);
5013 else if (group == 21)
5014 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
5015 wpabuf_head(secret), wpabuf_len(secret), prk);
5016 wpabuf_clear_free(hkey);
5017 wpabuf_clear_free(secret);
5018 if (res < 0)
5019 return -1;
5020
5021 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
5022
5023 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
5024
5025 if (group == 19)
5026 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
5027 os_strlen(info), sm->pmk, hash_len);
5028 else if (group == 20)
5029 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
5030 os_strlen(info), sm->pmk, hash_len);
5031 else if (group == 21)
5032 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
5033 os_strlen(info), sm->pmk, hash_len);
Hai Shalom81f62d82019-07-22 12:10:00 -07005034 forced_memzero(prk, SHA512_MAC_LEN);
Roshan Pius3a1667e2018-07-03 15:17:14 -07005035 if (res < 0) {
5036 sm->pmk_len = 0;
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07005037 return -1;
Roshan Pius3a1667e2018-07-03 15:17:14 -07005038 }
Dmitry Shmidtd2986c22017-10-23 14:22:09 -07005039 sm->pmk_len = hash_len;
5040
5041 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
5042 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
5043 pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
5044 bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
5045 NULL);
5046
5047 return 0;
5048}
5049
5050#endif /* CONFIG_OWE */
5051
5052
5053void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
5054{
5055#ifdef CONFIG_FILS
5056 if (sm && fils_cache_id) {
5057 sm->fils_cache_id_set = 1;
5058 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
5059 }
5060#endif /* CONFIG_FILS */
5061}
Hai Shalom021b0b52019-04-10 11:17:58 -07005062
5063
5064#ifdef CONFIG_DPP2
5065void wpa_sm_set_dpp_z(struct wpa_sm *sm, const struct wpabuf *z)
5066{
5067 if (sm) {
5068 wpabuf_clear_free(sm->dpp_z);
5069 sm->dpp_z = z ? wpabuf_dup(z) : NULL;
5070 }
5071}
5072#endif /* CONFIG_DPP2 */