2  * WPA Supplicant - Mesh RSN routines
3  * Copyright (c) 2013-2014, cozybit, Inc.  All rights reserved.
37 	if (sta->sae->state != SAE_ACCEPTED) {  in mesh_auth_timer()
38 		wpa_printf(MSG_DEBUG, "AUTH: Re-authenticate with " MACSTR  in mesh_auth_timer()
40 			   MAC2STR(sta->addr), sta->sae_auth_retry);  in mesh_auth_timer()
42 			MAC2STR(sta->addr));  in mesh_auth_timer()
43 		if (sta->sae_auth_retry < MESH_AUTH_RETRY) {  in mesh_auth_timer()
46 			hapd = wpa_s->ifmsh->bss[0];  in mesh_auth_timer()
48 			if (sta->sae_auth_retry > MESH_AUTH_RETRY) {  in mesh_auth_timer()
55 			sta->sae->state = SAE_NOTHING;  in mesh_auth_timer()
58 				MAC2STR(sta->addr),  in mesh_auth_timer()
59 				hapd->conf->ap_max_inactivity);  in mesh_auth_timer()
61 		sta->sae_auth_retry++;  in mesh_auth_timer()
70 		wpa_printf(MSG_DEBUG, "AUTH: " MACSTR " - %s",  in auth_logger()
82 	struct hostapd_data *hapd = mesh_rsn->wpa_s->ifmsh->bss[0];  in auth_get_psk()
92 	if (sta && sta->auth_alg == WLAN_AUTH_SAE) {  in auth_get_psk()
93 		if (!sta->sae || prev_psk)  in auth_get_psk()
95 		return sta->sae->pmk;  in auth_get_psk()
119 	wpa_hexdump_key(MSG_DEBUG, "AUTH: set_key - key", key, key_len);  in auth_set_key()
121 	return wpa_drv_set_key(mesh_rsn->wpa_s, -1, alg, addr, idx,  in auth_set_key()
132 	if (mesh_rsn->wpa_s->current_ssid->mode != WPAS_MODE_MESH)  in auth_start_ampe()
133 		return -1;  in auth_start_ampe()
135 	hapd = mesh_rsn->wpa_s->ifmsh->bss[0];  in auth_start_ampe()
138 		eloop_cancel_timeout(mesh_auth_timer, mesh_rsn->wpa_s, sta);  in auth_start_ampe()
140 	mesh_mpm_auth_peer(mesh_rsn->wpa_s, addr);  in auth_start_ampe()
153 	hapd = rsn->wpa_s->ifmsh->bss[0];  in auth_for_each_sta()
154 	for (sta = hapd->sta_list; sta; sta = sta->next) {  in auth_for_each_sta()
155 		if (sta->wpa_sm && cb(sta->wpa_sm, cb_ctx))  in auth_for_each_sta()
180 	conf.wpa_pairwise = rsn->pairwise_cipher;  in __mesh_rsn_auth_init()
181 	conf.rsn_pairwise = rsn->pairwise_cipher;  in __mesh_rsn_auth_init()
182 	conf.wpa_group = rsn->group_cipher;  in __mesh_rsn_auth_init()
184 	conf.wpa_group_rekey = -1;  in __mesh_rsn_auth_init()
189 		conf.group_mgmt_cipher = rsn->mgmt_group_cipher;  in __mesh_rsn_auth_init()
194 	rsn->auth = wpa_init(addr, &conf, &cb, rsn);  in __mesh_rsn_auth_init()
195 	if (rsn->auth == NULL) {  in __mesh_rsn_auth_init()
197 		return -1;  in __mesh_rsn_auth_init()
201 	rsn->mgtk_len = wpa_cipher_key_len(conf.wpa_group);  in __mesh_rsn_auth_init()
202 	if (random_get_bytes(rsn->mgtk, rsn->mgtk_len) < 0)  in __mesh_rsn_auth_init()
203 		return -1;  in __mesh_rsn_auth_init()
204 	rsn->mgtk_key_id = 1;  in __mesh_rsn_auth_init()
207 		rsn->igtk_len = wpa_cipher_key_len(conf.group_mgmt_cipher);  in __mesh_rsn_auth_init()
208 		if (random_get_bytes(rsn->igtk, rsn->igtk_len) < 0)  in __mesh_rsn_auth_init()
209 			return -1;  in __mesh_rsn_auth_init()
210 		rsn->igtk_key_id = 4;  in __mesh_rsn_auth_init()
214 				rsn->igtk, rsn->igtk_len);  in __mesh_rsn_auth_init()
215 		wpa_drv_set_key(rsn->wpa_s, -1,  in __mesh_rsn_auth_init()
216 				wpa_cipher_to_alg(rsn->mgmt_group_cipher),  in __mesh_rsn_auth_init()
218 				rsn->igtk_key_id, 1,  in __mesh_rsn_auth_init()
219 				seq, sizeof(seq), rsn->igtk, rsn->igtk_len,  in __mesh_rsn_auth_init()
225 			rsn->mgtk, rsn->mgtk_len);  in __mesh_rsn_auth_init()
226 	wpa_drv_set_key(rsn->wpa_s, -1, wpa_cipher_to_alg(rsn->group_cipher),  in __mesh_rsn_auth_init()
228 			rsn->mgtk_key_id, 1, seq, sizeof(seq),  in __mesh_rsn_auth_init()
229 			rsn->mgtk, rsn->mgtk_len, KEY_FLAG_GROUP_TX_DEFAULT);  in __mesh_rsn_auth_init()
237 	os_memset(rsn->mgtk, 0, sizeof(rsn->mgtk));  in mesh_rsn_deinit()
238 	rsn->mgtk_len = 0;  in mesh_rsn_deinit()
239 	os_memset(rsn->igtk, 0, sizeof(rsn->igtk));  in mesh_rsn_deinit()
240 	rsn->igtk_len = 0;  in mesh_rsn_deinit()
241 	if (rsn->auth)  in mesh_rsn_deinit()
242 		wpa_deinit(rsn->auth);  in mesh_rsn_deinit()
250 	struct hostapd_data *bss = wpa_s->ifmsh->bss[0];  in mesh_rsn_auth_init()
260 	mesh_rsn->wpa_s = wpa_s;  in mesh_rsn_auth_init()
261 	mesh_rsn->pairwise_cipher = conf->pairwise_cipher;  in mesh_rsn_auth_init()
262 	mesh_rsn->group_cipher = conf->group_cipher;  in mesh_rsn_auth_init()
263 	mesh_rsn->mgmt_group_cipher = conf->mgmt_group_cipher;  in mesh_rsn_auth_init()
265 	if (__mesh_rsn_auth_init(mesh_rsn, wpa_s->own_addr,  in mesh_rsn_auth_init()
266 				 conf->ieee80211w, conf->ocv) < 0) {  in mesh_rsn_auth_init()
272 	bss->wpa_auth = mesh_rsn->auth;  in mesh_rsn_auth_init()
275 	while ((entry = dl_list_last(&wpa_s->mesh_external_pmksa_cache,  in mesh_rsn_auth_init()
280 		ret = wpa_auth_pmksa_add_entry(bss->wpa_auth,  in mesh_rsn_auth_init()
281 					       entry->pmksa_cache);  in mesh_rsn_auth_init()
282 		dl_list_del(&entry->list);  in mesh_rsn_auth_init()
290 	ie = wpa_auth_get_wpa_ie(mesh_rsn->auth, &ie_len);  in mesh_rsn_auth_init()
291 	conf->rsn_ie = (u8 *) ie;  in mesh_rsn_auth_init()
292 	conf->rsn_ie_len = ie_len;  in mesh_rsn_auth_init()
294 	wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);  in mesh_rsn_auth_init()
305 		if (array[i] == -1)  in index_within_array()
316 	int *groups = wpa_s->ifmsh->bss[0]->conf->sae_groups;  in mesh_rsn_sae_group()
319 	if (!index_within_array(groups, wpa_s->mesh_rsn->sae_group_index))  in mesh_rsn_sae_group()
320 		return -1;  in mesh_rsn_sae_group()
323 		int group = groups[wpa_s->mesh_rsn->sae_group_index];  in mesh_rsn_sae_group()
329 				sae->group);  in mesh_rsn_sae_group()
332 		wpa_s->mesh_rsn->sae_group_index++;  in mesh_rsn_sae_group()
335 	return -1;  in mesh_rsn_sae_group()
345 	password = ssid->sae_password;  in mesh_rsn_build_sae_commit()
347 		password = ssid->passphrase;  in mesh_rsn_build_sae_commit()
350 		return -1;  in mesh_rsn_build_sae_commit()
353 	if (mesh_rsn_sae_group(wpa_s, sta->sae) < 0) {  in mesh_rsn_build_sae_commit()
355 		return -1;  in mesh_rsn_build_sae_commit()
358 	if (sta->sae->tmp && !sta->sae->tmp->pw_id && ssid->sae_password_id) {  in mesh_rsn_build_sae_commit()
359 		sta->sae->tmp->pw_id = os_strdup(ssid->sae_password_id);  in mesh_rsn_build_sae_commit()
360 		if (!sta->sae->tmp->pw_id)  in mesh_rsn_build_sae_commit()
361 			return -1;  in mesh_rsn_build_sae_commit()
363 	return sae_prepare_commit(wpa_s->own_addr, sta->addr,  in mesh_rsn_build_sae_commit()
365 				  sta->sae);  in mesh_rsn_build_sae_commit()
373 	struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];  in mesh_rsn_auth_sae_sta()
374 	struct wpa_ssid *ssid = wpa_s->current_ssid;  in mesh_rsn_auth_sae_sta()
382 		return -1;  in mesh_rsn_auth_sae_sta()
385 	if (!sta->sae) {  in mesh_rsn_auth_sae_sta()
386 		sta->sae = os_zalloc(sizeof(*sta->sae));  in mesh_rsn_auth_sae_sta()
387 		if (sta->sae == NULL)  in mesh_rsn_auth_sae_sta()
388 			return -1;  in mesh_rsn_auth_sae_sta()
391 	pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr, NULL);  in mesh_rsn_auth_sae_sta()
393 		if (!sta->wpa_sm)  in mesh_rsn_auth_sae_sta()
394 			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,  in mesh_rsn_auth_sae_sta()
395 							sta->addr, NULL);  in mesh_rsn_auth_sae_sta()
396 		if (!sta->wpa_sm) {  in mesh_rsn_auth_sae_sta()
399 			return -1;  in mesh_rsn_auth_sae_sta()
404 			   " - try to use PMKSA caching instead of new SAE authentication",  in mesh_rsn_auth_sae_sta()
405 			   MAC2STR(sta->addr));  in mesh_rsn_auth_sae_sta()
406 		wpa_auth_pmksa_set_to_sm(pmksa, sta->wpa_sm, hapd->wpa_auth,  in mesh_rsn_auth_sae_sta()
407 					 sta->sae->pmkid, sta->sae->pmk,  in mesh_rsn_auth_sae_sta()
408 					 &sta->sae->pmk_len);  in mesh_rsn_auth_sae_sta()
410 		sta->mesh_sae_pmksa_caching = 1;  in mesh_rsn_auth_sae_sta()
413 	sta->mesh_sae_pmksa_caching = 0;  in mesh_rsn_auth_sae_sta()
416 		return -1;  in mesh_rsn_auth_sae_sta()
420 		MAC2STR(sta->addr));  in mesh_rsn_auth_sae_sta()
436 	os_memcpy(pmkid, sta->sae->pmkid, SAE_PMKID_LEN);  in mesh_rsn_get_pmkid()
443 	u8 *myaddr = rsn->wpa_s->own_addr;  in mesh_rsn_derive_aek()
444 	u8 *peer = sta->addr;  in mesh_rsn_derive_aek()
449 	 * AEK = KDF-Hash-256(PMK, "AEK Derivation", Selected AKM Suite ||  in mesh_rsn_derive_aek()
467 	sha256_prf(sta->sae->pmk, sizeof(sta->sae->pmk), "AEK Derivation",  in mesh_rsn_derive_aek()
468 		   context, sizeof(context), sta->aek, sizeof(sta->aek));  in mesh_rsn_derive_aek()
477 	u8 *myaddr = wpa_s->own_addr;  in mesh_rsn_derive_mtk()
478 	u8 *peer = sta->addr;  in mesh_rsn_derive_mtk()
482 	 * MTK = KDF-Hash-Length(PMK, "Temporal Key Derivation", min(localNonce,  in mesh_rsn_derive_mtk()
488 	if (os_memcmp(sta->my_nonce, sta->peer_nonce, WPA_NONCE_LEN) < 0) {  in mesh_rsn_derive_mtk()
489 		min = sta->my_nonce;  in mesh_rsn_derive_mtk()
490 		max = sta->peer_nonce;  in mesh_rsn_derive_mtk()
492 		min = sta->peer_nonce;  in mesh_rsn_derive_mtk()
493 		max = sta->my_nonce;  in mesh_rsn_derive_mtk()
500 	if (sta->my_lid < sta->peer_lid) {  in mesh_rsn_derive_mtk()
501 		WPA_PUT_LE16(ptr, sta->my_lid);  in mesh_rsn_derive_mtk()
503 		WPA_PUT_LE16(ptr, sta->peer_lid);  in mesh_rsn_derive_mtk()
506 		WPA_PUT_LE16(ptr, sta->peer_lid);  in mesh_rsn_derive_mtk()
508 		WPA_PUT_LE16(ptr, sta->my_lid);  in mesh_rsn_derive_mtk()
527 	sta->mtk_len = wpa_cipher_key_len(wpa_s->mesh_rsn->pairwise_cipher);  in mesh_rsn_derive_mtk()
528 	sha256_prf(sta->sae->pmk, SAE_PMK_LEN,  in mesh_rsn_derive_mtk()
530 		   sta->mtk, sta->mtk_len);  in mesh_rsn_derive_mtk()
537 	if (random_get_bytes(sta->my_nonce, WPA_NONCE_LEN) < 0) {  in mesh_rsn_init_ampe_sta()
541 	os_memset(sta->peer_nonce, 0, WPA_NONCE_LEN);  in mesh_rsn_init_ampe_sta()
542 	mesh_rsn_derive_aek(wpa_s->mesh_rsn, sta);  in mesh_rsn_init_ampe_sta()
546 /* insert AMPE and encrypted MIC at @ie.
550  * @buf: wpabuf to add encrypted AMPE and MIC to.
557 	u8 *ampe_ie, *pos, *mic_payload;  in mesh_rsn_protect_frame()  local
558 	const u8 *aad[] = { rsn->wpa_s->own_addr, sta->addr, cat };  in mesh_rsn_protect_frame()
559 	const size_t aad_len[] = { ETH_ALEN, ETH_ALEN, ie - cat };  in mesh_rsn_protect_frame()
565 		len += rsn->mgtk_len + WPA_KEY_RSC_LEN + 4;  in mesh_rsn_protect_frame()
566 	if (cat[1] == PLINK_OPEN && rsn->igtk_len)  in mesh_rsn_protect_frame()
567 		len += 2 + 6 + rsn->igtk_len;  in mesh_rsn_protect_frame()
571 		return -EINVAL;  in mesh_rsn_protect_frame()
577 		return -ENOMEM;  in mesh_rsn_protect_frame()
585 	RSN_SELECTOR_PUT(ampe->selected_pairwise_suite,  in mesh_rsn_protect_frame()
587 	os_memcpy(ampe->local_nonce, sta->my_nonce, WPA_NONCE_LEN);  in mesh_rsn_protect_frame()
588 	os_memcpy(ampe->peer_nonce, sta->peer_nonce, WPA_NONCE_LEN);  in mesh_rsn_protect_frame()
590 	pos = (u8 *) (ampe + 1);  in mesh_rsn_protect_frame()
602 	os_memcpy(pos, rsn->mgtk, rsn->mgtk_len);  in mesh_rsn_protect_frame()
603 	pos += rsn->mgtk_len;  in mesh_rsn_protect_frame()
604 	wpa_drv_get_seqnum(rsn->wpa_s, NULL, rsn->mgtk_key_id, pos);  in mesh_rsn_protect_frame()
605 	pos += WPA_KEY_RSC_LEN;  in mesh_rsn_protect_frame()
607 	WPA_PUT_LE32(pos, 0xffffffff);  in mesh_rsn_protect_frame()
608 	pos += 4;  in mesh_rsn_protect_frame()
614 	if (rsn->igtk_len) {  in mesh_rsn_protect_frame()
615 		WPA_PUT_LE16(pos, rsn->igtk_key_id);  in mesh_rsn_protect_frame()
616 		pos += 2;  in mesh_rsn_protect_frame()
617 		wpa_drv_get_seqnum(rsn->wpa_s, NULL, rsn->igtk_key_id, pos);  in mesh_rsn_protect_frame()
618 		pos += 6;  in mesh_rsn_protect_frame()
619 		os_memcpy(pos, rsn->igtk, rsn->igtk_len);  in mesh_rsn_protect_frame()
626 	/* IE: MIC */  in mesh_rsn_protect_frame()
629 	/* MIC field is output ciphertext */  in mesh_rsn_protect_frame()
631 	/* encrypt after MIC */  in mesh_rsn_protect_frame()
634 	if (aes_siv_encrypt(sta->aek, sizeof(sta->aek), ampe_ie, 2 + len, 3,  in mesh_rsn_protect_frame()
637 		ret = -ENOMEM;  in mesh_rsn_protect_frame()
656 	u8 *ampe_buf, *crypt = NULL, *pos, *end;  in mesh_rsn_process_ampe()  local
658 	const u8 *aad[] = { sta->addr, wpa_s->own_addr, cat };  in mesh_rsn_process_ampe()
660 				   elems->mic ? (elems->mic - 2) - cat : 0 };  in mesh_rsn_process_ampe()
663 	if (!sta->sae) {  in mesh_rsn_process_ampe()
664 		struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];  in mesh_rsn_process_ampe()
666 		if (!wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr, NULL)) {  in mesh_rsn_process_ampe()
669 			return -1;  in mesh_rsn_process_ampe()
675 	    (!sta->sae ||  in mesh_rsn_process_ampe()
676 	     os_memcmp(chosen_pmk, sta->sae->pmkid, PMKID_LEN) != 0)) {  in mesh_rsn_process_ampe()
679 		return -1;  in mesh_rsn_process_ampe()
682 	if (!elems->mic || elems->mic_len < AES_BLOCK_SIZE) {  in mesh_rsn_process_ampe()
683 		wpa_msg(wpa_s, MSG_DEBUG, "Mesh RSN: missing mic ie");  in mesh_rsn_process_ampe()
684 		return -1;  in mesh_rsn_process_ampe()
687 	ampe_buf = (u8 *) elems->mic + elems->mic_len;  in mesh_rsn_process_ampe()
688 	if ((int) elems_len < ampe_buf - start)  in mesh_rsn_process_ampe()
689 		return -1;  in mesh_rsn_process_ampe()
691 	crypt_len = elems_len - (elems->mic - start);  in mesh_rsn_process_ampe()
694 		return -1;  in mesh_rsn_process_ampe()
701 		ret = -ENOMEM;  in mesh_rsn_process_ampe()
705 	os_memcpy(crypt, elems->mic, crypt_len);  in mesh_rsn_process_ampe()
707 	if (aes_siv_decrypt(sta->aek, sizeof(sta->aek), crypt, crypt_len, 3,  in mesh_rsn_process_ampe()
710 		ret = -2;  in mesh_rsn_process_ampe()
714 	crypt_len -= AES_BLOCK_SIZE;  in mesh_rsn_process_ampe()
725 		ret = -1;  in mesh_rsn_process_ampe()
730 	pos = (u8 *) (ampe + 1);  in mesh_rsn_process_ampe()
732 	if (os_memcmp(ampe->peer_nonce, null_nonce, WPA_NONCE_LEN) != 0 &&  in mesh_rsn_process_ampe()
733 	    os_memcmp(ampe->peer_nonce, sta->my_nonce, WPA_NONCE_LEN) != 0) {  in mesh_rsn_process_ampe()
735 		ret = -1;  in mesh_rsn_process_ampe()
738 	os_memcpy(sta->peer_nonce, ampe->local_nonce,  in mesh_rsn_process_ampe()
739 		  sizeof(ampe->local_nonce));  in mesh_rsn_process_ampe()
758 		if (end > pos) {  in mesh_rsn_process_ampe()
761 					pos, end - pos);  in mesh_rsn_process_ampe()
770 	sta->mgtk_key_id = 1; /* FIX: Where to get Key ID? */  in mesh_rsn_process_ampe()
771 	key_len = wpa_cipher_key_len(wpa_s->mesh_rsn->group_cipher);  in mesh_rsn_process_ampe()
772 	if ((int) key_len + WPA_KEY_RSC_LEN + 4 > end - pos) {  in mesh_rsn_process_ampe()
774 		ret = -1;  in mesh_rsn_process_ampe()
777 	sta->mgtk_len = key_len;  in mesh_rsn_process_ampe()
778 	os_memcpy(sta->mgtk, pos, sta->mgtk_len);  in mesh_rsn_process_ampe()
779 	wpa_hexdump_key(MSG_DEBUG, "mesh: GTKdata - MGTK",  in mesh_rsn_process_ampe()
780 			sta->mgtk, sta->mgtk_len);  in mesh_rsn_process_ampe()
781 	pos += sta->mgtk_len;  in mesh_rsn_process_ampe()
782 	wpa_hexdump(MSG_DEBUG, "mesh: GTKdata - MGTK - Key RSC",  in mesh_rsn_process_ampe()
783 		    pos, WPA_KEY_RSC_LEN);  in mesh_rsn_process_ampe()
784 	os_memcpy(sta->mgtk_rsc, pos, sizeof(sta->mgtk_rsc));  in mesh_rsn_process_ampe()
785 	pos += WPA_KEY_RSC_LEN;  in mesh_rsn_process_ampe()
787 		   "mesh: GTKdata - MGTK - GTKExpirationTime: %u seconds",  in mesh_rsn_process_ampe()
788 		   WPA_GET_LE32(pos));  in mesh_rsn_process_ampe()
789 	pos += 4;  in mesh_rsn_process_ampe()
795 	key_len = wpa_cipher_key_len(wpa_s->mesh_rsn->mgmt_group_cipher);  in mesh_rsn_process_ampe()
796 	if (end - pos >= (int) (2 + 6 + key_len)) {  in mesh_rsn_process_ampe()
797 		sta->igtk_key_id = WPA_GET_LE16(pos);  in mesh_rsn_process_ampe()
798 		wpa_printf(MSG_DEBUG, "mesh: IGTKdata - Key ID %u",  in mesh_rsn_process_ampe()
799 			   sta->igtk_key_id);  in mesh_rsn_process_ampe()
800 		pos += 2;  in mesh_rsn_process_ampe()
801 		os_memcpy(sta->igtk_rsc, pos, sizeof(sta->igtk_rsc));  in mesh_rsn_process_ampe()
802 		wpa_hexdump(MSG_DEBUG, "mesh: IGTKdata - IPN",  in mesh_rsn_process_ampe()
803 			    sta->igtk_rsc, sizeof(sta->igtk_rsc));  in mesh_rsn_process_ampe()
804 		pos += 6;  in mesh_rsn_process_ampe()
805 		os_memcpy(sta->igtk, pos, key_len);  in mesh_rsn_process_ampe()
806 		sta->igtk_len = key_len;  in mesh_rsn_process_ampe()
807 		wpa_hexdump_key(MSG_DEBUG, "mesh: IGTKdata - IGTK",  in mesh_rsn_process_ampe()
808 				sta->igtk, sta->igtk_len);  in mesh_rsn_process_ampe()