1 /*
2 * wpa_supplicant - SME
3 * Copyright (c) 2009-2024, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/eloop.h"
13 #include "utils/ext_password.h"
14 #include "common/dragonfly.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/ieee802_11_common.h"
17 #include "common/ocv.h"
18 #include "common/ptksa_cache.h"
19 #include "crypto/crypto.h"
20 #include "eapol_supp/eapol_supp_sm.h"
21 #include "common/wpa_common.h"
22 #include "common/sae.h"
23 #include "common/dpp.h"
24 #include "crypto/random.h"
25 #include "crypto/sha256.h"
26 #include "crypto/sha384.h"
27 #include "rsn_supp/wpa.h"
28 #include "rsn_supp/pmksa_cache.h"
29 #include "rsn_supp/wpa_ie.h"
30 #include "config.h"
31 #include "wpa_supplicant_i.h"
32 #include "driver_i.h"
33 #include "wpas_glue.h"
34 #include "wps_supplicant.h"
35 #include "p2p_supplicant.h"
36 #include "notify.h"
37 #include "bss.h"
38 #include "bssid_ignore.h"
39 #include "scan.h"
40 #include "sme.h"
41 #include "hs20_supplicant.h"
42
43 #define SME_AUTH_TIMEOUT 5
44 #define SME_ASSOC_TIMEOUT 5
45 #ifdef CONFIG_ENC_ASSOC
46 static const int dot11RSNAConfigPMKLifetime = 43200;
47 #endif /* CONFIG_ENC_ASSOC */
48
49 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
50 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
51 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
52 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
53 static int sme_validate_basic_mle(const struct ieee802_11_elems *elems,
54 const u8 *addr);
55 #ifdef CONFIG_IEEE8021X_AUTH
56 static void sme_process_802_1x_auth_response(struct wpa_supplicant *wpa_s,
57 struct auth_info *auth,
58 bool external);
59 #endif /* CONFIG_IEEE8021X_AUTH */
60
61 #if defined(CONFIG_IEEE8021X_AUTH) || defined(CONFIG_ENC_ASSOC)
62
sme_get_peer_addr(struct wpa_supplicant * wpa_s,bool external)63 static const u8 * sme_get_peer_addr(struct wpa_supplicant *wpa_s, bool external)
64 {
65 if (external)
66 return wpa_s->sme.ext_ml_auth ?
67 wpa_s->sme.ext_auth_ap_mld_addr :
68 wpa_s->sme.ext_auth_bssid;
69 return wpa_s->valid_links ? wpa_s->ap_mld_addr : wpa_s->pending_bssid;
70 }
71
72
sme_get_ext_auth_pmkid(struct wpa_supplicant * wpa_s)73 const u8 * sme_get_ext_auth_pmkid(struct wpa_supplicant *wpa_s)
74 {
75 struct rsn_pmksa_cache *cache;
76 struct rsn_pmksa_cache_entry *entry;
77 const u8 *peer;
78
79 peer = sme_get_peer_addr(wpa_s, true);
80 if (!peer)
81 return NULL;
82
83 cache = wpa_sm_get_pmksa_cache(wpa_s->wpa);
84 if (!cache)
85 return NULL;
86
87 entry = pmksa_cache_get(cache, peer, wpa_s->own_addr, NULL,
88 wpa_s->sme.ext_auth_wpa_ssid,
89 wpa_s->sme.ext_auth_key_mgmt);
90 return entry ? entry->pmkid : NULL;
91 }
92
93 #endif /* CONFIG_IEEE8021X_AUTH || CONFIG_ENC_ASSOC */
94
95
96 #ifdef CONFIG_IEEE8021X_AUTH
97
sme_get_key_mgmt(struct wpa_supplicant * wpa_s,bool external)98 static int sme_get_key_mgmt(struct wpa_supplicant *wpa_s, bool external)
99 {
100 return external ? wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
101 }
102
103
sme_get_pairwise_cipher(struct wpa_supplicant * wpa_s,bool external)104 static int sme_get_pairwise_cipher(struct wpa_supplicant *wpa_s, bool external)
105 {
106 return external ? wpa_s->sme.ext_pairwise_cipher :
107 wpa_s->pairwise_cipher;
108 }
109
110
sme_is_ml_auth(struct wpa_supplicant * wpa_s,bool external)111 static bool sme_is_ml_auth(struct wpa_supplicant *wpa_s, bool external)
112 {
113 return external ? wpa_s->sme.ext_ml_auth : wpa_s->valid_links;
114 }
115
116 #endif /* CONFIG_IEEE8021X_AUTH */
117
118
119 #ifdef CONFIG_SAE
120
index_within_array(const int * array,int idx)121 static int index_within_array(const int *array, int idx)
122 {
123 int i;
124 for (i = 0; i < idx; i++) {
125 if (array[i] <= 0)
126 return 0;
127 }
128 return 1;
129 }
130
131
sme_set_sae_group(struct wpa_supplicant * wpa_s,bool external)132 static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
133 {
134 int *groups = wpa_s->conf->sae_groups;
135 int default_groups[] = { 19, 20, 21, 0 };
136
137 if (!groups || groups[0] <= 0)
138 groups = default_groups;
139
140 /* Configuration may have changed, so validate current index */
141 if (!index_within_array(groups, wpa_s->sme.sae_group_index))
142 return -1;
143
144 for (;;) {
145 int group = groups[wpa_s->sme.sae_group_index];
146 if (group <= 0)
147 break;
148 if (!int_array_includes(wpa_s->sme.sae_rejected_groups,
149 group) &&
150 sae_set_group(&wpa_s->sme.sae, group) == 0) {
151 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
152 wpa_s->sme.sae.group);
153 wpa_s->sme.sae.akmp = external ?
154 wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
155 return 0;
156 }
157 wpa_s->sme.sae_group_index++;
158 }
159
160 return -1;
161 }
162
163
sme_auth_build_sae_commit(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,const u8 * bssid,const u8 * mld_addr,int external,int reuse,int * ret_use_pt,bool * ret_use_pk)164 static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
165 struct wpa_ssid *ssid,
166 const u8 *bssid,
167 const u8 *mld_addr,
168 int external,
169 int reuse, int *ret_use_pt,
170 bool *ret_use_pk)
171 {
172 struct wpabuf *buf;
173 size_t len;
174 char *password = NULL;
175 struct wpa_bss *bss;
176 int use_pt = 0;
177 bool use_pk = false;
178 u8 rsnxe_capa = 0;
179 int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
180 wpa_s->key_mgmt;
181 const u8 *addr = mld_addr ? mld_addr : bssid;
182 enum sae_pwe sae_pwe;
183 const u8 *password_id = (const u8 *) ssid->sae_password_id;
184 size_t password_id_len = ssid->sae_password_id ?
185 os_strlen(ssid->sae_password_id) : 0;
186
187 if (ret_use_pt)
188 *ret_use_pt = 0;
189 if (ret_use_pk)
190 *ret_use_pk = false;
191
192 #ifdef CONFIG_TESTING_OPTIONS
193 if (wpa_s->sae_commit_override) {
194 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
195 buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
196 if (!buf)
197 goto fail;
198 if (!external) {
199 wpabuf_put_le16(buf, 1); /* Transaction seq# */
200 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
201 }
202 wpabuf_put_buf(buf, wpa_s->sae_commit_override);
203 return buf;
204 }
205 #endif /* CONFIG_TESTING_OPTIONS */
206
207 if (ssid->sae_password) {
208 password = os_strdup(ssid->sae_password);
209 if (!password) {
210 wpa_dbg(wpa_s, MSG_INFO,
211 "SAE: Failed to allocate password");
212 goto fail;
213 }
214 }
215 if (!password && ssid->passphrase) {
216 password = os_strdup(ssid->passphrase);
217 if (!password) {
218 wpa_dbg(wpa_s, MSG_INFO,
219 "SAE: Failed to allocate password");
220 goto fail;
221 }
222 }
223 if (!password && ssid->ext_psk) {
224 struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
225 ssid->ext_psk);
226
227 if (!pw) {
228 wpa_msg(wpa_s, MSG_INFO,
229 "SAE: No password found from external storage");
230 goto fail;
231 }
232
233 password = os_malloc(wpabuf_len(pw) + 1);
234 if (!password) {
235 wpa_dbg(wpa_s, MSG_INFO,
236 "SAE: Failed to allocate password");
237 goto fail;
238 }
239 os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
240 password[wpabuf_len(pw)] = '\0';
241 ext_password_free(pw);
242 }
243 if (!password) {
244 wpa_printf(MSG_DEBUG, "SAE: No password available");
245 goto fail;
246 }
247
248 if (reuse && wpa_s->sme.sae.tmp &&
249 ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
250 wpa_printf(MSG_DEBUG,
251 "SAE: Reuse previously generated PWE on a retry with the same AP");
252 use_pt = wpa_s->sme.sae.h2e;
253 use_pk = wpa_s->sme.sae.pk;
254 goto reuse_data;
255 }
256 if (sme_set_sae_group(wpa_s, external) < 0) {
257 wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
258 goto fail;
259 }
260
261 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
262 if (!bss) {
263 wpa_printf(MSG_DEBUG,
264 "SAE: BSS not available, update scan result to get BSS");
265 wpa_supplicant_update_scan_results(wpa_s, bssid);
266 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
267 }
268 if (bss) {
269 const u8 *rsnxe;
270
271 rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, ssid, false);
272 if (rsnxe && rsnxe[0] == WLAN_EID_VENDOR_SPECIFIC &&
273 rsnxe[1] >= 1 + 4)
274 rsnxe_capa = rsnxe[2 + 4];
275 else if (rsnxe && rsnxe[1] >= 1)
276 rsnxe_capa = rsnxe[2];
277 }
278
279 sae_pwe = wpas_get_ssid_sae_pwe(wpa_s, ssid);
280
281 if (ssid->sae_password_id &&
282 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
283 use_pt = 1;
284 if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
285 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
286 use_pt = 1;
287 if (bss && is_6ghz_freq(bss->freq) &&
288 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
289 use_pt = 1;
290 #ifdef CONFIG_SAE_PK
291 if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
292 ssid->sae_pk != SAE_PK_MODE_DISABLED &&
293 ((ssid->sae_password &&
294 sae_pk_valid_password(ssid->sae_password)) ||
295 (!ssid->sae_password && ssid->passphrase &&
296 sae_pk_valid_password(ssid->passphrase)))) {
297 use_pt = 1;
298 use_pk = true;
299 }
300
301 if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
302 wpa_printf(MSG_DEBUG,
303 "SAE: Cannot use PK with the selected AP");
304 goto fail;
305 }
306 #endif /* CONFIG_SAE_PK */
307
308 if (use_pt || sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
309 sae_pwe == SAE_PWE_BOTH) {
310 use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
311
312 if ((sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
313 ssid->sae_password_id ||
314 wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
315 sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
316 !use_pt) {
317 wpa_printf(MSG_DEBUG,
318 "SAE: Cannot use H2E with the selected AP");
319 goto fail;
320 }
321 }
322
323 if (use_pt && !ssid->pt)
324 wpa_s_setup_sae_pt(wpa_s, ssid, true);
325 if (use_pt &&
326 sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
327 wpa_s->own_addr, addr,
328 wpa_s->sme.sae_rejected_groups, NULL) < 0)
329 goto fail;
330 if (!use_pt &&
331 sae_prepare_commit(wpa_s->own_addr, addr,
332 (u8 *) password, os_strlen(password),
333 &wpa_s->sme.sae) < 0) {
334 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
335 goto fail;
336 }
337 if (wpa_s->sme.sae.tmp) {
338 os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
339 if (use_pt && use_pk)
340 wpa_s->sme.sae.pk = 1;
341 #ifdef CONFIG_SAE_PK
342 os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
343 ETH_ALEN);
344 os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
345 sae_pk_set_password(&wpa_s->sme.sae, password);
346 #endif /* CONFIG_SAE_PK */
347 }
348
349 reuse_data:
350 len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
351 if (ssid->sae_password_id)
352 len += 4 + os_strlen(ssid->sae_password_id);
353 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
354 if (buf == NULL)
355 goto fail;
356 if (!external) {
357 wpabuf_put_le16(buf, 1); /* Transaction seq# */
358 if (use_pk)
359 wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
360 else if (use_pt)
361 wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
362 else
363 wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
364 }
365
366 if (use_pt && ssid->pt && ssid->pt->password_id) {
367 password_id = wpabuf_head(ssid->pt->password_id);
368 password_id_len = wpabuf_len(ssid->pt->password_id);
369 }
370 if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
371 password_id, password_id_len) < 0) {
372 wpabuf_free(buf);
373 goto fail;
374 }
375 if (ret_use_pt)
376 *ret_use_pt = use_pt;
377 if (ret_use_pk)
378 *ret_use_pk = use_pk;
379
380 str_clear_free(password);
381 return buf;
382
383 fail:
384 str_clear_free(password);
385 return NULL;
386 }
387
388
sme_auth_build_sae_confirm(struct wpa_supplicant * wpa_s,int external)389 static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
390 int external)
391 {
392 struct wpabuf *buf;
393
394 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
395 if (buf == NULL)
396 return NULL;
397
398 if (!external) {
399 wpabuf_put_le16(buf, 2); /* Transaction seq# */
400 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
401 }
402 sae_write_confirm(&wpa_s->sme.sae, buf);
403
404 return buf;
405 }
406
407 #endif /* CONFIG_SAE */
408
409
410 #ifdef CONFIG_IEEE8021X_AUTH
411
sme_802_1x_auth_data_free(struct wpa_supplicant * wpa_s)412 static void sme_802_1x_auth_data_free(struct wpa_supplicant *wpa_s)
413 {
414 if (!wpa_s || !wpa_s->auth_1x)
415 return;
416
417 if (wpa_s->auth_1x->ecdh) {
418 crypto_ecdh_deinit(wpa_s->auth_1x->ecdh);
419 wpa_s->auth_1x->ecdh = NULL;
420 }
421
422 wpabuf_clear_free(wpa_s->auth_1x->dhss);
423 wpa_s->auth_1x->dhss = NULL;
424
425 os_free(wpa_s->auth_1x);
426 wpa_s->auth_1x = NULL;
427
428 if (wpa_s->eapol)
429 eapol_sm_set_eap_over_auth_frame(wpa_s->eapol, false);
430 }
431
432
433 static struct wpabuf *
sme_build_802_1x_for_ptk(struct wpa_supplicant * wpa_s,bool external)434 sme_build_802_1x_for_ptk(struct wpa_supplicant *wpa_s, bool external)
435 {
436 struct wpabuf *pubkey_buf = NULL;
437 struct wpabuf *buf = NULL;
438 int rsne_len, rsnxe_len;
439 size_t total_len = 0;
440
441 /* Generate SNonce */
442 if (random_get_bytes(wpa_s->auth_1x->snonce, WPA_NONCE_LEN) < 0) {
443 wpa_dbg(wpa_s, MSG_INFO, "Failed to generate SNonce");
444 goto fail;
445 }
446
447 /* Initialize ECDH for Diffie-Hellman Parameter element */
448 /* TODO: Add support for other groups */
449 wpa_s->auth_1x->dh_group = 19;
450 wpa_s->auth_1x->ecdh = crypto_ecdh_init(wpa_s->auth_1x->dh_group);
451 if (!wpa_s->auth_1x->ecdh) {
452 wpa_dbg(wpa_s, MSG_INFO, "Failed to init ECDH group %d",
453 wpa_s->auth_1x->dh_group);
454 goto fail;
455 }
456
457 pubkey_buf = crypto_ecdh_get_pubkey(wpa_s->auth_1x->ecdh, 0);
458 if (!pubkey_buf) {
459 wpa_dbg(wpa_s, MSG_INFO, "Failed to get ECDH pubkey");
460 goto fail;
461 }
462
463 /* Generate RSNE */
464 if (external)
465 rsne_len = wpa_external_auth_add_rsne(
466 wpa_s->auth_1x->rsne, sizeof(wpa_s->auth_1x->rsne),
467 wpa_s->sme.ext_auth_key_mgmt,
468 wpa_s->sme.ext_pairwise_cipher,
469 wpa_s->sme.ext_group_cipher,
470 wpa_s->sme.ext_mgmt_group_cipher,
471 wpa_s->sme.ext_rsn_capab,
472 sme_get_ext_auth_pmkid(wpa_s));
473 else
474 rsne_len = wpa_gen_wpa_ie_rsn(
475 wpa_s->auth_1x->rsne, sizeof(wpa_s->auth_1x->rsne),
476 wpa_s->pairwise_cipher, wpa_s->group_cipher,
477 wpa_s->key_mgmt, wpa_s->mgmt_group_cipher, wpa_s->wpa);
478 if (rsne_len < 0) {
479 wpa_dbg(wpa_s, MSG_INFO, "Failed to generate RSNE");
480 goto fail;
481 }
482 wpa_s->auth_1x->rsne_len = rsne_len;
483
484 /* Generate RSNXE */
485 if (external) {
486 /* Store driver-provided RSNXE directly */
487 os_memcpy(wpa_s->auth_1x->rsnxe, wpa_s->sme.ext_rsnxe,
488 wpa_s->sme.ext_rsnxe_len);
489 rsnxe_len = wpa_s->sme.ext_rsnxe_len;
490 } else {
491 rsnxe_len = wpa_gen_rsnxe(wpa_s->wpa, wpa_s->auth_1x->rsnxe,
492 sizeof(wpa_s->auth_1x->rsnxe));
493 }
494 if (rsnxe_len < 0) {
495 wpa_dbg(wpa_s, MSG_INFO, "Failed to generate RSNXE");
496 goto fail;
497 }
498 wpa_s->auth_1x->rsnxe_len = rsnxe_len;
499
500 total_len = 3 + WPA_NONCE_LEN + rsne_len + rsnxe_len +
501 3 + 2 + wpabuf_len(pubkey_buf);
502
503 buf = wpabuf_alloc(total_len);
504 if (!buf) {
505 wpa_dbg(wpa_s, MSG_INFO, "Failed to allocate buf");
506 goto fail;
507 }
508
509 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
510 wpabuf_put_u8(buf, 1 + WPA_NONCE_LEN);
511 wpabuf_put_u8(buf, WLAN_EID_EXT_NONCE);
512 wpabuf_put_data(buf, wpa_s->auth_1x->snonce, WPA_NONCE_LEN);
513
514 wpabuf_put_data(buf, wpa_s->auth_1x->rsne, rsne_len);
515 wpabuf_put_data(buf, wpa_s->auth_1x->rsnxe, rsnxe_len);
516
517 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
518 wpabuf_put_u8(buf, 1 + 2 + wpabuf_len(pubkey_buf));
519 wpabuf_put_u8(buf, WLAN_EID_EXT_OWE_DH_PARAM);
520 wpabuf_put_le16(buf, wpa_s->auth_1x->dh_group);
521 wpabuf_put_buf(buf, pubkey_buf);
522
523 wpabuf_free(pubkey_buf);
524
525 return buf;
526
527 fail:
528 wpabuf_free(pubkey_buf);
529 sme_802_1x_auth_data_free(wpa_s);
530 return NULL;
531 }
532
533
sme_build_802_1x_auth_start(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,bool external)534 static struct wpabuf * sme_build_802_1x_auth_start(struct wpa_supplicant *wpa_s,
535 struct wpa_ssid *ssid,
536 bool external)
537 {
538 struct wpabuf *buf, *eapol_pdu;
539 size_t buf_len;
540 u32 suite = 0;
541 struct wpabuf *buf_for_ptk = NULL;
542 int key_mgmt = sme_get_key_mgmt(wpa_s, external);
543
544 if (wpa_key_mgmt_wpa_ieee8021x(key_mgmt & ~WPA_KEY_MGMT_IEEE8021X))
545 suite = wpa_akm_to_suite(key_mgmt);
546
547 if (suite == 0) {
548 wpa_dbg(wpa_s, MSG_DEBUG, "No matching IEEE 802.1X AKM found");
549 return NULL;
550 }
551
552 eapol_pdu = eapol_sm_get_eapol_pdu(wpa_s->eapol,
553 IEEE802_1X_TYPE_EAPOL_START);
554 if (!eapol_pdu)
555 return NULL;
556
557 buf_len = 2 + 2 + 2 + wpabuf_len(eapol_pdu);
558
559 if (wpa_s->auth_1x->derive_ptk) {
560 buf_for_ptk = sme_build_802_1x_for_ptk(wpa_s, external);
561 if (!buf_for_ptk) {
562 wpabuf_free(eapol_pdu);
563 return NULL;
564 }
565 buf_len += wpabuf_len(buf_for_ptk);
566 } else {
567 buf_len += 7; /* AKM Suite Selector element */
568 }
569
570 buf = wpabuf_alloc(buf_len);
571 if (!buf) {
572 wpabuf_free(eapol_pdu);
573 wpabuf_free(buf_for_ptk);
574 return NULL;
575 }
576
577 wpabuf_put_le16(buf, wpa_s->auth_1x->auth_trans);
578 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
579 wpabuf_put_le16(buf, wpabuf_len(eapol_pdu));
580 wpabuf_put_buf(buf, eapol_pdu);
581
582 if (wpa_s->auth_1x->derive_ptk) {
583 wpabuf_put_buf(buf, buf_for_ptk);
584 wpabuf_free(buf_for_ptk);
585 } else {
586 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
587 wpabuf_put_u8(buf, 1 + 4);
588 wpabuf_put_u8(buf, WLAN_EID_EXT_AKM_SUITE_SELECTOR);
589 wpabuf_put_be32(buf, suite);
590 }
591
592 wpabuf_free(eapol_pdu);
593 return buf;
594 }
595
596
597 static struct wpabuf *
sme_build_802_1x_auth_continue(struct wpa_supplicant * wpa_s)598 sme_build_802_1x_auth_continue(struct wpa_supplicant *wpa_s)
599 {
600 struct wpabuf *buf, *eapol_pdu;
601
602 if (wpa_s->auth_1x->status != WLAN_STATUS_SUCCESS) {
603 buf = wpabuf_alloc(2 + 2 + 2);
604 if (!buf)
605 return NULL;
606
607 wpabuf_put_le16(buf, wpa_s->auth_1x->auth_trans);
608 wpabuf_put_le16(buf, wpa_s->auth_1x->status);
609 wpabuf_put_le16(buf, 0);
610 return buf;
611 }
612
613 eapol_pdu = eapol_sm_get_eapol_pdu(wpa_s->eapol,
614 IEEE802_1X_TYPE_EAP_PACKET);
615 if (!eapol_pdu)
616 return NULL;
617
618 buf = wpabuf_alloc(2 + 2 + 2 + wpabuf_len(eapol_pdu));
619 if (!buf) {
620 wpabuf_free(eapol_pdu);
621 return NULL;
622 }
623
624 wpa_s->auth_1x->auth_trans++;
625 wpabuf_put_le16(buf, wpa_s->auth_1x->auth_trans);
626 wpabuf_put_le16(buf, wpa_s->auth_1x->status);
627 wpabuf_put_le16(buf, wpabuf_len(eapol_pdu));
628 wpabuf_put_buf(buf, eapol_pdu);
629 wpabuf_free(eapol_pdu);
630
631 return buf;
632 }
633
634
sme_check_802_1x_pmksa_caching(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,bool external)635 static void sme_check_802_1x_pmksa_caching(struct wpa_supplicant *wpa_s,
636 struct wpa_bss *bss,
637 struct wpa_ssid *ssid,
638 bool external)
639 {
640 struct rsn_pmksa_cache_entry *pmksa;
641 const u8 *rsnxe, *peer_addr;
642 int key_mgmt;
643
644 peer_addr = sme_get_peer_addr(wpa_s, external);
645 key_mgmt = sme_get_key_mgmt(wpa_s, external);
646
647 rsnxe = bss ? wpa_bss_get_ie(bss, WLAN_EID_RSNX) : NULL;
648 if (ssid->eap_over_auth_frame &&
649 ieee802_11_rsnx_capab(rsnxe,
650 WLAN_RSNX_CAPAB_ASSOC_FRAME_ENCRYPTION) &&
651 (wpa_s->drv_flags2 &
652 WPA_DRIVER_FLAGS2_ASSOCIATION_FRAME_ENCRYPTION))
653 wpa_s->auth_1x->derive_ptk = true;
654
655 if (wpa_s->auth_1x->derive_ptk &&
656 pmksa_cache_set_current(wpa_s->wpa, NULL, peer_addr, ssid, 0, NULL,
657 key_mgmt, false) == 0) {
658 wpa_dbg(wpa_s, MSG_DEBUG,
659 "IEEE 802.1X: PMKSA cache entry found, using PMKSA caching");
660 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
661 wpa_s->auth_1x->pmksa_caching = true;
662
663 pmksa = pmksa_cache_get_current(wpa_s->wpa);
664 if (pmksa)
665 os_memcpy(wpa_s->auth_1x->pmkid, pmksa->pmkid,
666 PMKID_LEN);
667 }
668 }
669
670
671 static struct wpabuf *
sme_build_802_1x_auth_request(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,bool start,bool external)672 sme_build_802_1x_auth_request(struct wpa_supplicant *wpa_s,
673 struct wpa_bss *bss,
674 struct wpa_ssid *ssid, bool start,
675 bool external)
676 {
677 if (start) {
678 sme_802_1x_auth_data_free(wpa_s);
679 wpa_s->auth_1x = os_zalloc(sizeof(struct auth_802_1x_data));
680 if (!wpa_s->auth_1x)
681 return NULL;
682
683 sme_check_802_1x_pmksa_caching(wpa_s, bss, ssid, external);
684
685 if (!wpa_s->auth_1x->pmksa_caching) {
686 eapol_sm_set_eap_over_auth_frame(wpa_s->eapol, true);
687 eapol_sm_notify_portEnabled(wpa_s->eapol, true);
688 }
689
690 wpa_s->auth_1x->auth_trans = 1;
691 return sme_build_802_1x_auth_start(wpa_s, ssid, external);
692 }
693
694 return sme_build_802_1x_auth_continue(wpa_s);
695 }
696
697 #endif /* CONFIG_IEEE8021X_AUTH */
698
699
700 /**
701 * sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
702 * @wpa_s: Pointer to wpa_supplicant data
703 * @bss: Pointer to the bss which is the target of authentication attempt
704 */
sme_auth_handle_rrm(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)705 static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
706 struct wpa_bss *bss)
707 {
708 const u8 rrm_ie_len = 5;
709 u8 *pos;
710 const u8 *rrm_ie;
711
712 wpa_s->rrm.rrm_used = 0;
713
714 wpa_printf(MSG_DEBUG,
715 "RRM: Determining whether RRM can be used - device support: 0x%x",
716 wpa_s->drv_rrm_flags);
717
718 rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
719 if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
720 wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
721 return;
722 }
723
724 if (!((wpa_s->drv_rrm_flags &
725 WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
726 (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
727 !(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
728 wpa_printf(MSG_DEBUG,
729 "RRM: Insufficient RRM support in driver - do not use RRM");
730 return;
731 }
732
733 if (sizeof(wpa_s->sme.assoc_req_ie) <
734 wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
735 wpa_printf(MSG_INFO,
736 "RRM: Unable to use RRM, no room for RRM IE");
737 return;
738 }
739
740 wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
741 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
742 os_memset(pos, 0, 2 + rrm_ie_len);
743 *pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
744 *pos++ = rrm_ie_len;
745
746 /* Set supported capabilities flags */
747 if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
748 *pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
749
750 *pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
751 WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
752 WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
753
754 if (wpa_s->lci)
755 pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
756
757 wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
758 wpa_s->rrm.rrm_used = 1;
759 }
760
761
wpas_ml_handle_removed_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss)762 static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
763 struct wpa_bss *bss)
764 {
765 u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
766
767 wpa_s->valid_links &= ~removed_links;
768 }
769
770
771 #ifdef CONFIG_TESTING_OPTIONS
wpas_ml_connect_pref(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)772 static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
773 struct wpa_bss *bss,
774 struct wpa_ssid *ssid)
775 {
776 unsigned int low, high, i;
777
778 wpa_printf(MSG_DEBUG,
779 "MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
780 wpa_s->valid_links,
781 wpa_s->conf->mld_connect_band_pref,
782 MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
783
784 /* Check if there are more than one link */
785 if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
786 return bss;
787
788 if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
789 for_each_link(wpa_s->valid_links, i) {
790 if (wpa_s->mlo_assoc_link_id == i)
791 continue;
792
793 if (ether_addr_equal(
794 wpa_s->links[i].bssid,
795 wpa_s->conf->mld_connect_bssid_pref))
796 goto found;
797 }
798 }
799
800 if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
801 return bss;
802
803 switch (wpa_s->conf->mld_connect_band_pref) {
804 case MLD_CONNECT_BAND_PREF_2GHZ:
805 low = 2412;
806 high = 2472;
807 break;
808 case MLD_CONNECT_BAND_PREF_5GHZ:
809 low = 5180;
810 high = 5985;
811 break;
812 case MLD_CONNECT_BAND_PREF_6GHZ:
813 low = 5955;
814 high = 7125;
815 break;
816 default:
817 return bss;
818 }
819
820 for_each_link(wpa_s->valid_links, i) {
821 if (wpa_s->mlo_assoc_link_id == i)
822 continue;
823
824 if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
825 goto found;
826 }
827
828 found:
829 if (i == MAX_NUM_MLD_LINKS) {
830 wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
831 return bss;
832 }
833
834 wpa_printf(MSG_DEBUG,
835 "MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
836 MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
837 MAC2STR(wpa_s->links[i].bssid));
838
839 /* Get the BSS entry and do the switch */
840 if (ssid && ssid->ssid_len)
841 bss = wpa_bss_get(wpa_s, wpa_s->links[i].bssid, ssid->ssid,
842 ssid->ssid_len);
843 else
844 bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
845 wpa_s->mlo_assoc_link_id = i;
846
847 return bss;
848 }
849 #endif /* CONFIG_TESTING_OPTIONS */
850
851
wpas_sme_ml_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data,int ie_offset)852 static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
853 union wpa_event_data *data,
854 int ie_offset)
855 {
856 struct ieee802_11_elems elems;
857 u16 status_code = data->auth.status_code;
858
859 if (!wpa_s->valid_links)
860 return 0;
861
862 if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
863 data->auth.ies_len - ie_offset,
864 &elems, 0) == ParseFailed) {
865 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
866 return -1;
867 }
868
869 if (!elems.basic_mle || !elems.basic_mle_len) {
870 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
871 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
872 status_code == WLAN_STATUS_SUCCESS ||
873 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
874 status_code == WLAN_STATUS_SAE_PK)
875 return -1;
876 /* Accept missing Multi-Link element in failed authentication
877 * cases. */
878 return 0;
879 }
880
881 return sme_validate_basic_mle(&elems, wpa_s->ap_mld_addr);
882 }
883
884
wpas_sme_set_mlo_links(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)885 static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
886 struct wpa_bss *bss, struct wpa_ssid *ssid)
887 {
888 u16 usable_links;
889 u8 i;
890
891 wpas_reset_mlo_info(wpa_s);
892
893 if (!(wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO))
894 return;
895
896 usable_links = wpa_bss_get_usable_links(wpa_s, bss, ssid, NULL);
897 if (!usable_links)
898 return;
899
900 os_memcpy(wpa_s->ap_mld_addr, bss->mld_addr, ETH_ALEN);
901 wpa_s->valid_links = 0;
902 wpa_s->mlo_assoc_link_id = bss->mld_link_id;
903
904 for_each_link(usable_links, i) {
905 const u8 *bssid = bss->mld_links[i].bssid;
906
907 wpa_s->valid_links |= BIT(i);
908 os_memcpy(wpa_s->links[i].bssid, bssid, ETH_ALEN);
909 wpa_s->links[i].freq = bss->mld_links[i].freq;
910 wpa_s->links[i].disabled = bss->mld_links[i].disabled;
911 wpabuf_free(wpa_s->links[i].ies);
912 wpa_s->links[i].ies = NULL;
913 #ifdef CONFIG_TESTING_OPTIONS
914 if (wpa_s->link_ies[i])
915 wpa_s->links[i].ies = wpabuf_dup(wpa_s->link_ies[i]);
916 #endif /* CONFIG_TESTING_OPTIONS */
917
918 if (bss->mld_link_id == i)
919 wpa_s->links[i].bss = bss;
920 else if (ssid && ssid->ssid_len)
921 wpa_s->links[i].bss = wpa_bss_get(wpa_s, bssid,
922 ssid->ssid,
923 ssid->ssid_len);
924 else
925 wpa_s->links[i].bss = wpa_bss_get_bssid(wpa_s, bssid);
926 }
927 }
928
929
sme_add_assoc_req_ie(struct wpa_supplicant * wpa_s,const struct wpabuf * buf)930 static void sme_add_assoc_req_ie(struct wpa_supplicant *wpa_s,
931 const struct wpabuf *buf)
932 {
933 size_t len;
934 u8 *pos, *end;
935
936 if (!buf)
937 return;
938
939 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
940 end = wpa_s->sme.assoc_req_ie + sizeof(wpa_s->sme.assoc_req_ie);
941 if (pos >= end)
942 return;
943
944 len = wpabuf_len(buf);
945 if (len < (size_t) (end - pos)) {
946 os_memcpy(pos, wpabuf_head(buf), len);
947 wpa_s->sme.assoc_req_ie_len += len;
948 }
949 }
950
951
952 #ifdef CONFIG_ENC_ASSOC
953
wpas_eppke_initialize(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)954 static int wpas_eppke_initialize(struct wpa_supplicant *wpa_s,
955 struct wpa_bss *bss,
956 struct wpa_ssid *ssid)
957 {
958 struct pasn_data *pasn;
959 const u8 *ap_rsne, *ap_rsnxe;
960 u8 ap_rsne_len, ap_rsnxe_len;
961 u64 capab = 0;
962 int group;
963 bool derive_kdk;
964 u8 rsne[80];
965 size_t rsne_len = sizeof(rsne);
966 int len;
967
968 pasn = &wpa_s->pasn;
969
970 group = wpas_pasn_get_group(wpa_s, ssid, pasn);
971 if (!group) {
972 wpa_printf(MSG_DEBUG, "EPPKE: No suitable group available");
973 return -1;
974 }
975
976 /* Reset PASN data before initialization to clear state from any
977 * previous attempt, e.g., on group rejection retries.
978 */
979 wpa_pasn_reset(pasn);
980
981 /* As per IEEE P802.11-REVmf/D2.1, 12.13.5, when SAE is wrapped within
982 * PASN authentication, both shall use the same finite cyclic group.
983 * SAE-level group rejection validation is not required.
984 */
985 if (sae_set_group(&wpa_s->sme.sae, group) < 0) {
986 wpa_printf(MSG_INFO, "EPPKE: Failed to set SAE group %u",
987 group);
988 return -1;
989 }
990
991 /* EPPKE has not been defined to be modified for RSN overriding, so use
992 * the RSNE and RSNXE from the AP for PASN MIC calculation instead of
993 * the RSNO elements, if any. */
994 ap_rsne = wpa_bss_get_ie(bss, WLAN_EID_RSN);
995 if (!ap_rsne) {
996 wpa_printf(MSG_DEBUG, "EPPKE: Can't connect without AP RSNE");
997 return -1;
998 }
999
1000 ap_rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
1001
1002 ap_rsne_len = *(ap_rsne + 1) + 2;
1003 ap_rsnxe_len = ap_rsnxe ? *(ap_rsnxe + 1) + 2 : 0;
1004 if (ap_rsne && ap_rsne_len) {
1005 wpabuf_free(pasn->beacon_rsne_rsnxe);
1006 pasn->beacon_rsne_rsnxe = wpabuf_alloc(ap_rsne_len +
1007 ap_rsnxe_len);
1008 if (!pasn->beacon_rsne_rsnxe) {
1009 wpa_printf(MSG_INFO,
1010 "EPPKE: Failed storing AP's RSNE/RSNXE");
1011 return -1;
1012 }
1013
1014 wpabuf_put_data(pasn->beacon_rsne_rsnxe, ap_rsne, ap_rsne_len);
1015 if (ap_rsnxe && ap_rsnxe_len)
1016 wpabuf_put_data(pasn->beacon_rsne_rsnxe,
1017 ap_rsnxe, ap_rsnxe_len);
1018 }
1019
1020 /* Use the RSNXOE, if it was included, for actual AP capability check */
1021 ap_rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, NULL, false);
1022 if (!ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_KEK_IN_PASN)) {
1023 wpa_printf(MSG_DEBUG, "EPPKE: AP does not support KEK_IN_PASN");
1024 goto fail;
1025 }
1026
1027 if (!ieee802_11_rsnx_capab(ap_rsnxe,
1028 WLAN_RSNX_CAPAB_ASSOC_FRAME_ENCRYPTION)) {
1029 wpa_printf(MSG_DEBUG,
1030 "EPPKE: AP does not support association frame encryption");
1031 goto fail;
1032 }
1033
1034 if (!(wpa_s->drv_flags2 &
1035 WPA_DRIVER_FLAGS2_ASSOCIATION_FRAME_ENCRYPTION)) {
1036 wpa_printf(MSG_INFO,
1037 "EPPKE: Cannot use EPPKE without support for association frame encryption");
1038 goto fail;
1039 }
1040
1041 capab |= BIT(WLAN_RSNX_CAPAB_ASSOC_FRAME_ENCRYPTION);
1042 capab |= BIT(WLAN_RSNX_CAPAB_KEK_IN_PASN);
1043 #ifdef CONFIG_PMKSA_PRIVACY
1044 if (ssid->pmksa_privacy)
1045 capab |= BIT(WLAN_RSNX_CAPAB_PMKSA_CACHING_PRIVACY);
1046 #endif /* CONFIG_PMKSA_PRIVACY */
1047 pasn->derive_kek = true;
1048
1049 if (0) {
1050 #ifdef CONFIG_SAE
1051 } else if (wpa_key_mgmt_sae_ext_key(ssid->key_mgmt)) {
1052 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1053 if (!ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SAE_H2E)) {
1054 wpa_printf(MSG_DEBUG,
1055 "EPPKE: AP does not support SAE H2E");
1056 goto fail;
1057 }
1058 if (pasn->pt)
1059 sae_deinit_pt(pasn->pt);
1060 pasn_set_pt(pasn, wpas_pasn_sae_derive_pt_for_eppke(ssid,
1061 group));
1062 if (!pasn->pt) {
1063 wpa_printf(MSG_DEBUG, "EPPKE: Failed to derive PT");
1064 goto fail;
1065 }
1066 pasn->sae.state = SAE_NOTHING;
1067 pasn->sae.send_confirm = 0;
1068
1069 /*
1070 * Advertise support for changing password identifiers if
1071 * configured.
1072 */
1073 if (ssid->sae_password_id && ssid->sae_password_id_change) {
1074 capab |= BIT_ULL(WLAN_RSNX_CAPAB_SAE_PW_ID_CHANGE);
1075 wpa_sm_set_param(wpa_s->wpa,
1076 WPA_PARAM_SAE_PW_ID_CHANGE, 1);
1077 }
1078 #endif /* CONFIG_SAE */
1079 } else if (wpa_key_mgmt_eppke(ssid->key_mgmt) &&
1080 wpa_key_mgmt_only_enhanced_open(ssid->key_mgmt)) {
1081 /* EPPKE without base AKM: verify AP supports unauthenticated
1082 * EPPKE per IEEE P802.11bi/D4.0, 12.16.9.1 */
1083 if (!ieee802_11_rsnx_capab(ap_rsnxe,
1084 WLAN_RSNX_CAPAB_UNAUTH_EPPKE)) {
1085 wpa_printf(MSG_DEBUG,
1086 "EPPKE: AP does not support unauthenticated EPPKE");
1087 goto fail;
1088 }
1089 } else {
1090 wpa_msg(wpa_s, MSG_INFO,
1091 "EPPKE: Suitable base AKM not enabled in local configuration");
1092 goto fail;
1093 }
1094
1095 derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) &&
1096 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF);
1097 #ifdef CONFIG_TESTING_OPTIONS
1098 if (!derive_kdk)
1099 derive_kdk = wpa_s->conf->force_kdk_derivation;
1100 #endif /* CONFIG_TESTING_OPTIONS */
1101 if (derive_kdk)
1102 pasn_enable_kdk_derivation(pasn);
1103 else
1104 pasn_disable_kdk_derivation(pasn);
1105
1106 wpa_printf(MSG_DEBUG, "PASN: kdk_len=%zu", pasn->kdk_len);
1107
1108 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) &&
1109 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF))
1110 pasn->secure_ltf = true;
1111 else
1112 pasn->secure_ltf = false;
1113
1114 #ifdef CONFIG_TESTING_OPTIONS
1115 pasn->corrupt_mic = wpa_s->conf->pasn_corrupt_mic;
1116 #endif /* CONFIG_TESTING_OPTIONS */
1117
1118 if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA)
1119 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1120 if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_STA)
1121 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
1122 if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA) {
1123 /*
1124 * URNM_MFPR_X20 is a subset of URNM_MFPR which excludes 20 MHz
1125 * bandwidth from mandating protected Management frames. Set
1126 * URNM_MFPR only when URNM_MFPR_X20 is not set.
1127 */
1128 if (wpa_s->disable_urnm_mfpr) {
1129 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_URNM_MFPR, 0);
1130 } else {
1131 capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR);
1132 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_URNM_MFPR, 1);
1133 }
1134 if (wpa_s->urnm_mfpr_x20) {
1135 capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR_X20);
1136 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_URNM_MFPR_X20,
1137 1);
1138 } else {
1139 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_URNM_MFPR_X20,
1140 0);
1141 }
1142 }
1143 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SPP_AMSDU) &&
1144 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SPP_A_MSDU))
1145 capab |= BIT(WLAN_RSNX_CAPAB_SPP_A_MSDU);
1146
1147 pasn_set_rsnxe_caps(pasn, capab);
1148 pasn_set_initiator_pmksa(pasn, wpa_sm_get_pmksa_cache(wpa_s->wpa));
1149
1150 if (pasn->ecdh)
1151 crypto_ecdh_deinit(pasn->ecdh);
1152 pasn->ecdh = crypto_ecdh_init(group);
1153 if (!pasn->ecdh) {
1154 wpa_printf(MSG_INFO, "EPPKE: Failed to init ECDH");
1155 goto fail;
1156 }
1157
1158 len = wpa_gen_wpa_ie(wpa_s->wpa, rsne, rsne_len);
1159 if (len < 0) {
1160 wpa_printf(MSG_INFO, "EPPKE: Failed to generate RSNE");
1161 goto fail;
1162 }
1163 pasn_set_rsne(pasn, rsne);
1164 wpa_hexdump(MSG_DEBUG, "EPPKE: Set own RSNE default",
1165 pasn->rsn_ie, pasn->rsn_ie_len);
1166 pasn->akmp = wpa_s->key_mgmt;
1167 pasn->cipher = wpa_s->pairwise_cipher;
1168 pasn->group = group;
1169 pasn->freq = bss->freq;
1170 pasn->auth_alg = WLAN_AUTH_EPPKE;
1171
1172 os_memcpy(pasn->own_addr, wpa_s->own_addr, ETH_ALEN);
1173 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
1174 wpa_s->valid_links) {
1175 pasn->is_ml_peer = true;
1176 os_memcpy(pasn->peer_addr, wpa_s->ap_mld_addr, ETH_ALEN);
1177 } else {
1178 os_memcpy(pasn->peer_addr, bss->bssid, ETH_ALEN);
1179 }
1180 os_memcpy(pasn->bssid, bss->bssid, ETH_ALEN);
1181
1182 wpa_printf(MSG_DEBUG,
1183 "PASN: Init: " MACSTR " akmp=0x%x, cipher=0x%x, group=%u",
1184 MAC2STR(pasn->peer_addr), pasn->akmp,
1185 pasn->cipher, pasn->group);
1186
1187 return 0;
1188
1189 fail:
1190 wpa_pasn_reset(pasn);
1191 return -1;
1192 }
1193
1194 #endif /* CONFIG_ENC_ASSOC */
1195
1196
sme_send_authentication(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid,int start)1197 static void sme_send_authentication(struct wpa_supplicant *wpa_s,
1198 struct wpa_bss *bss, struct wpa_ssid *ssid,
1199 int start)
1200 {
1201 struct wpa_driver_auth_params params;
1202 struct wpa_ssid *old_ssid;
1203 #ifdef CONFIG_IEEE80211R
1204 const u8 *ie;
1205 #endif /* CONFIG_IEEE80211R */
1206 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
1207 const u8 *md = NULL;
1208 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
1209 int bssid_changed;
1210 struct wpabuf *resp = NULL;
1211 u8 ext_capab[18];
1212 int ext_capab_len;
1213 int skip_auth;
1214 u8 *wpa_ie;
1215 size_t wpa_ie_len;
1216 #ifdef CONFIG_MBO
1217 const u8 *mbo_ie;
1218 #endif /* CONFIG_MBO */
1219 int omit_rsnxe = 0;
1220 unsigned int keys_to_clear = 0;
1221
1222 if (bss == NULL) {
1223 wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
1224 "the network");
1225 wpas_connect_work_done(wpa_s);
1226 return;
1227 }
1228
1229 os_memset(¶ms, 0, sizeof(params));
1230
1231 wpas_sme_set_mlo_links(wpa_s, bss, ssid);
1232
1233 if (wpa_s->valid_links) {
1234 wpa_printf(MSG_DEBUG, "MLD: In authentication");
1235
1236 #ifdef CONFIG_TESTING_OPTIONS
1237 bss = wpas_ml_connect_pref(wpa_s, bss, ssid);
1238 #endif /* CONFIG_TESTING_OPTIONS */
1239
1240 if (wpa_s->conf->mld_force_single_link) {
1241 wpa_printf(MSG_DEBUG, "MLD: Force single link");
1242 wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
1243 }
1244 params.mld = true;
1245 params.mld_link_id = wpa_s->mlo_assoc_link_id;
1246 params.ap_mld_addr = wpa_s->ap_mld_addr;
1247 wpas_ml_handle_removed_links(wpa_s, bss);
1248 }
1249
1250 skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
1251 wpa_s->reassoc_same_bss;
1252 wpa_s->current_bss = bss;
1253
1254 wpa_s->reassociate = 0;
1255
1256 params.freq = bss->freq;
1257 params.bssid = bss->bssid;
1258 params.ssid = bss->ssid;
1259 params.ssid_len = bss->ssid_len;
1260 params.p2p = ssid->p2p_group;
1261
1262 if (wpa_s->sme.ssid_len != params.ssid_len ||
1263 os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
1264 wpa_s->sme.prev_bssid_set = 0;
1265
1266 wpa_s->sme.freq = params.freq;
1267 os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
1268 wpa_s->sme.ssid_len = params.ssid_len;
1269
1270 params.auth_alg = WPA_AUTH_ALG_OPEN;
1271 #ifdef IEEE8021X_EAPOL
1272 if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1273 if (ssid->leap) {
1274 if (ssid->non_leap == 0)
1275 params.auth_alg = WPA_AUTH_ALG_LEAP;
1276 else
1277 params.auth_alg |= WPA_AUTH_ALG_LEAP;
1278 }
1279 }
1280 #endif /* IEEE8021X_EAPOL */
1281 wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
1282 params.auth_alg);
1283 if (ssid->auth_alg) {
1284 params.auth_alg = ssid->auth_alg;
1285 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1286 "0x%x", params.auth_alg);
1287 }
1288 #ifdef CONFIG_SAE
1289 wpa_s->sme.sae_pmksa_caching = 0;
1290 if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
1291 const u8 *rsn;
1292 struct wpa_ie_data ied;
1293
1294 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
1295 if (!rsn) {
1296 wpa_dbg(wpa_s, MSG_DEBUG,
1297 "SAE enabled, but target BSS does not advertise RSN");
1298 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied)) {
1299 wpa_printf(MSG_DEBUG, "SME: Failed parsing RSNE data");
1300 return;
1301 #ifdef CONFIG_DPP
1302 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
1303 (ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
1304 wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
1305 #endif /* CONFIG_DPP */
1306 #ifdef CONFIG_ENC_ASSOC
1307 } else if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_EPPKE) &&
1308 (ssid->key_mgmt & WPA_KEY_MGMT_EPPKE) &&
1309 (ied.key_mgmt & WPA_KEY_MGMT_EPPKE) &&
1310 wpa_key_mgmt_sae_ext_key(ssid->key_mgmt) &&
1311 wpa_key_mgmt_sae_ext_key(ied.key_mgmt) &&
1312 !wpas_is_sae_avoided(wpa_s, ssid, &ied) &&
1313 wpas_eppke_ap_capable(wpa_s, bss, false)) {
1314 wpa_dbg(wpa_s, MSG_DEBUG,
1315 "Prefer EPPKE over SAE when both are enabled");
1316 params.auth_alg = WPA_AUTH_ALG_EPPKE;
1317 #endif /* CONFIG_ENC_ASSOC */
1318 } else if (wpa_key_mgmt_sae(ied.key_mgmt)) {
1319 if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
1320 wpa_dbg(wpa_s, MSG_DEBUG,
1321 "SAE enabled, but disallowing SAE auth_alg without PMF");
1322 } else {
1323 wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
1324 params.auth_alg = WPA_AUTH_ALG_SAE;
1325 }
1326 } else {
1327 wpa_dbg(wpa_s, MSG_DEBUG,
1328 "SAE enabled, but target BSS does not advertise SAE AKM for RSN");
1329 }
1330 }
1331 #endif /* CONFIG_SAE */
1332
1333 #ifdef CONFIG_ENC_ASSOC
1334 if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_EPPKE) &&
1335 wpa_key_mgmt_only_enhanced_open(ssid->key_mgmt) &&
1336 wpa_key_mgmt_eppke(ssid->key_mgmt)) {
1337 const u8 *rsn;
1338 struct wpa_ie_data ied;
1339
1340 rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
1341 if (!rsn) {
1342 wpa_dbg(wpa_s, MSG_DEBUG,
1343 "EPPKE: Target BSS does not advertise RSN");
1344 } else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied)) {
1345 wpa_printf(MSG_DEBUG, "SME: Failed parsing RSNE data");
1346 return;
1347 } else if (ied.key_mgmt & WPA_KEY_MGMT_EPPKE &&
1348 wpas_eppke_ap_capable(wpa_s, bss, true)) {
1349 wpa_dbg(wpa_s, MSG_DEBUG, "Using EPPKE auth_alg");
1350 params.auth_alg = WPA_AUTH_ALG_EPPKE;
1351 } else {
1352 wpa_dbg(wpa_s, MSG_DEBUG,
1353 "EPPKE: Target BSS does not advertise EPPKE AKM");
1354 }
1355 }
1356 #endif /* CONFIG_ENC_ASSOC */
1357
1358 #ifdef CONFIG_WEP
1359 {
1360 int i;
1361
1362 for (i = 0; i < NUM_WEP_KEYS; i++) {
1363 if (ssid->wep_key_len[i]) {
1364 params.wep_key[i] = ssid->wep_key[i];
1365 keys_to_clear |= BIT(i);
1366 }
1367 params.wep_key_len[i] = ssid->wep_key_len[i];
1368 }
1369 params.wep_tx_keyidx = ssid->wep_tx_keyidx;
1370 }
1371 #endif /* CONFIG_WEP */
1372
1373 #ifdef CONFIG_IEEE8021X_AUTH
1374 if (ssid->eap_over_auth_frame &&
1375 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt &
1376 ~WPA_KEY_MGMT_IEEE8021X)) {
1377 const u8 *rsne, *rsnxe;
1378 struct wpa_ie_data ied;
1379
1380 rsne = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
1381 if (!rsne) {
1382 wpa_dbg(wpa_s, MSG_DEBUG,
1383 "IEEE 802.1X enabled, but target BSS does not advertise RSNE");
1384 } else if (rsne[1] &&
1385 wpa_parse_wpa_ie(rsne, 2 + rsne[1], &ied) == 0 &&
1386 wpa_key_mgmt_wpa_ieee8021x(
1387 ied.key_mgmt & ~WPA_KEY_MGMT_IEEE8021X)) {
1388 rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
1389 if (ieee802_11_rsnx_capab(
1390 rsnxe,
1391 WLAN_RSNX_CAPAB_802_1X_IN_AUTH_FRAMES) &&
1392 (wpa_s->drv_flags2 &
1393 WPA_DRIVER_FLAGS2_802_1X_AUTH)) {
1394 wpa_dbg(wpa_s, MSG_DEBUG,
1395 "Using IEEE 802.1X authentication using Authentication frames");
1396 params.auth_alg = WPA_AUTH_ALG_802_1X;
1397 } else {
1398 wpa_dbg(wpa_s, MSG_DEBUG,
1399 "IEEE 802.1X in Authentication frames enabled, but AP doesn't support it");
1400 }
1401 } else {
1402 wpa_dbg(wpa_s, MSG_DEBUG,
1403 "IEEE 802.1X in Authentication frames enabled, but the target BSS does not advertise a suitable AKMP for it");
1404 }
1405 }
1406 #endif /* CONFIG_IEEE8021X_AUTH */
1407
1408 if (!start)
1409 goto skip_setup;
1410 if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1411 wpa_bss_get_rsne(wpa_s, bss, ssid, false)) &&
1412 wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1413 int try_opportunistic;
1414 const u8 *cache_id = NULL;
1415
1416 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1417 wpa_s->conf->okc :
1418 ssid->proactive_key_caching) &&
1419 (ssid->proto & WPA_PROTO_RSN);
1420 #ifdef CONFIG_FILS
1421 if (wpa_key_mgmt_fils(ssid->key_mgmt))
1422 cache_id = wpa_bss_get_fils_cache_id(bss);
1423 #endif /* CONFIG_FILS */
1424 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1425 params.mld ? params.ap_mld_addr :
1426 bss->bssid,
1427 wpa_s->current_ssid,
1428 try_opportunistic, cache_id,
1429 0, false) == 0)
1430 eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
1431 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
1432 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1433 wpa_s->sme.assoc_req_ie,
1434 &wpa_s->sme.assoc_req_ie_len,
1435 false)) {
1436 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
1437 "key management and encryption suites");
1438 wpas_connect_work_done(wpa_s);
1439 return;
1440 }
1441 } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
1442 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1443 /*
1444 * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1445 * use non-WPA since the scan results did not indicate that the
1446 * AP is using WPA or WPA2.
1447 */
1448 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1449 wpa_s->sme.assoc_req_ie_len = 0;
1450 } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1451 wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
1452 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1453 wpa_s->sme.assoc_req_ie,
1454 &wpa_s->sme.assoc_req_ie_len,
1455 false)) {
1456 wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
1457 "key management and encryption suites (no "
1458 "scan results)");
1459 wpas_connect_work_done(wpa_s);
1460 return;
1461 }
1462 #ifdef CONFIG_WPS
1463 } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1464 struct wpabuf *wps_ie;
1465
1466 wpa_s->sme.assoc_req_ie_len = 0;
1467 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1468 sme_add_assoc_req_ie(wpa_s, wps_ie);
1469 wpabuf_free(wps_ie);
1470 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1471 #endif /* CONFIG_WPS */
1472 } else {
1473 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1474 wpa_s->sme.assoc_req_ie_len = 0;
1475 }
1476
1477 /* In case the WPA vendor IE is used, it should be placed after all the
1478 * non-vendor IEs, as the lower layer expects the IEs to be ordered as
1479 * defined in the standard. Store the WPA IE so it can later be
1480 * inserted at the correct location.
1481 */
1482 wpa_ie = NULL;
1483 wpa_ie_len = 0;
1484 if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
1485 wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
1486 wpa_s->sme.assoc_req_ie_len);
1487 omit_rsnxe = 1;
1488 if (wpa_ie) {
1489 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
1490
1491 wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
1492 wpa_s->sme.assoc_req_ie_len = 0;
1493 } else {
1494 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
1495 wpas_connect_work_done(wpa_s);
1496 return;
1497 }
1498 } else if (wpa_s->wpa_proto == WPA_PROTO_RSN &&
1499 wpa_key_mgmt_wpa_psk_no_sae(wpa_s->key_mgmt) &&
1500 !wpa_bss_get_rsnxe(wpa_s, bss, ssid, false)) {
1501 /* Omit RSNXE for WPA2-Personal connections to avoid AP
1502 * compatibility issues. */
1503 omit_rsnxe = 1;
1504 }
1505
1506 #ifdef CONFIG_IEEE80211R
1507 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1508 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1509 md = ie + 2;
1510 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1511 if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
1512 !wpa_key_mgmt_ft(wpa_s->key_mgmt)))
1513 md = NULL;
1514 if (md) {
1515 /* Prepare for the next transition */
1516 wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1517 }
1518
1519 if (md) {
1520 wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
1521 md[0], md[1]);
1522
1523 if (wpa_s->sme.assoc_req_ie_len + 5 <
1524 sizeof(wpa_s->sme.assoc_req_ie)) {
1525 struct rsn_mdie *mdie;
1526 u8 *pos = wpa_s->sme.assoc_req_ie +
1527 wpa_s->sme.assoc_req_ie_len;
1528 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
1529 *pos++ = sizeof(*mdie);
1530 mdie = (struct rsn_mdie *) pos;
1531 os_memcpy(mdie->mobility_domain, md,
1532 MOBILITY_DOMAIN_ID_LEN);
1533 mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
1534 wpa_s->sme.assoc_req_ie_len += 5;
1535 }
1536
1537 if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
1538 os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
1539 wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
1540 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
1541 "over-the-air");
1542 omit_rsnxe |= !wpa_bss_get_rsnxe(wpa_s, bss, ssid,
1543 false);
1544 params.auth_alg = WPA_AUTH_ALG_FT;
1545 params.ie = wpa_s->sme.ft_ies;
1546 params.ie_len = wpa_s->sme.ft_ies_len;
1547 }
1548 }
1549 #endif /* CONFIG_IEEE80211R */
1550
1551 wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
1552 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
1553 const u8 *rsn = wpa_bss_get_rsne(wpa_s, bss, ssid, false);
1554 struct wpa_ie_data _ie;
1555 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
1556 _ie.capabilities &
1557 (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
1558 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
1559 "MFP: require MFP");
1560 wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
1561 }
1562 }
1563
1564 wpa_s->sme.spp_amsdu = wpa_sm_uses_spp_amsdu(wpa_s->wpa);
1565
1566 #ifdef CONFIG_P2P
1567 if (wpa_s->global->p2p) {
1568 u8 *pos;
1569 size_t len;
1570 int res;
1571 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
1572 len = sizeof(wpa_s->sme.assoc_req_ie) -
1573 wpa_s->sme.assoc_req_ie_len;
1574 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1575 ssid->p2p_group);
1576 if (res >= 0)
1577 wpa_s->sme.assoc_req_ie_len += res;
1578 }
1579 #endif /* CONFIG_P2P */
1580
1581 #ifdef CONFIG_FST
1582 sme_add_assoc_req_ie(wpa_s, wpa_s->fst_ies);
1583 #endif /* CONFIG_FST */
1584
1585 sme_auth_handle_rrm(wpa_s, bss);
1586
1587 #ifndef CONFIG_NO_RRM
1588 wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
1589 wpa_s, ssid, bss,
1590 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1591 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
1592 #endif /* CONFIG_NO_RRM */
1593
1594 if (params.p2p)
1595 wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
1596 else
1597 wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
1598
1599 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
1600 sizeof(ext_capab), bss);
1601 if (ext_capab_len > 0) {
1602 u8 *pos = wpa_s->sme.assoc_req_ie;
1603 if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
1604 pos += 2 + pos[1];
1605 os_memmove(pos + ext_capab_len, pos,
1606 wpa_s->sme.assoc_req_ie_len -
1607 (pos - wpa_s->sme.assoc_req_ie));
1608 wpa_s->sme.assoc_req_ie_len += ext_capab_len;
1609 os_memcpy(pos, ext_capab, ext_capab_len);
1610 }
1611
1612 if (ssid->max_idle && wpa_s->sme.assoc_req_ie_len + 5 <=
1613 sizeof(wpa_s->sme.assoc_req_ie)) {
1614 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
1615
1616 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
1617 *pos++ = 3;
1618 WPA_PUT_LE16(pos, ssid->max_idle);
1619 pos += 2;
1620 *pos = 0; /* Idle Options */
1621 wpa_s->sme.assoc_req_ie_len += 5;
1622 }
1623
1624 #ifdef CONFIG_TESTING_OPTIONS
1625 if (wpa_s->rsnxe_override_assoc) {
1626 wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
1627 sme_add_assoc_req_ie(wpa_s, wpa_s->rsnxe_override_assoc);
1628 } else
1629 #endif /* CONFIG_TESTING_OPTIONS */
1630 if (wpa_s->rsnxe_len > 0 &&
1631 wpa_s->rsnxe_len <=
1632 sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
1633 !omit_rsnxe) {
1634 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
1635 wpa_s->rsnxe, wpa_s->rsnxe_len);
1636 wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
1637 }
1638
1639 if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION &&
1640 wpa_bss_ext_capab(bss, WLAN_EXT_CAPAB_KNOWN_STA_IDENTIFICATION)) {
1641 struct wpabuf *e;
1642
1643 e = wpa_sm_known_sta_identification(
1644 wpa_s->wpa,
1645 params.mld ? params.ap_mld_addr : bss->bssid,
1646 bss->tsf);
1647 if (e) {
1648 wpa_printf(MSG_DEBUG,
1649 "SME: Add Known STA Identification element");
1650 sme_add_assoc_req_ie(wpa_s, e);
1651 wpabuf_free(e);
1652 }
1653 }
1654
1655 #ifdef CONFIG_HS20
1656 if (is_hs20_network(wpa_s, ssid, bss)) {
1657 struct wpabuf *hs20;
1658
1659 hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
1660 if (hs20) {
1661 int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
1662
1663 wpas_hs20_add_indication(hs20, pps_mo_id,
1664 get_hs20_version(bss));
1665 wpas_hs20_add_roam_cons_sel(hs20, ssid);
1666 sme_add_assoc_req_ie(wpa_s, hs20);
1667 wpabuf_free(hs20);
1668 }
1669 }
1670 #endif /* CONFIG_HS20 */
1671
1672 if (wpa_ie) {
1673 size_t len;
1674
1675 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
1676
1677 len = sizeof(wpa_s->sme.assoc_req_ie) -
1678 wpa_s->sme.assoc_req_ie_len;
1679
1680 if (len > wpa_ie_len) {
1681 os_memcpy(wpa_s->sme.assoc_req_ie +
1682 wpa_s->sme.assoc_req_ie_len,
1683 wpa_ie, wpa_ie_len);
1684 wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
1685 } else {
1686 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
1687 }
1688
1689 os_free(wpa_ie);
1690 }
1691
1692 sme_add_assoc_req_ie(wpa_s, wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]);
1693
1694 #ifdef CONFIG_MBO
1695 mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
1696 if (!wpa_s->disable_mbo_oce && mbo_ie) {
1697 int len;
1698
1699 len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
1700 wpa_s->sme.assoc_req_ie_len,
1701 sizeof(wpa_s->sme.assoc_req_ie) -
1702 wpa_s->sme.assoc_req_ie_len,
1703 !!mbo_attr_from_mbo_ie(mbo_ie,
1704 OCE_ATTR_ID_CAPA_IND));
1705 if (len >= 0)
1706 wpa_s->sme.assoc_req_ie_len += len;
1707 }
1708 #endif /* CONFIG_MBO */
1709
1710 skip_setup:
1711 #ifdef CONFIG_ENC_ASSOC
1712 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_EPPKE) {
1713 if (start) {
1714 /* Initialize EPPKE just for the first Authentication
1715 * frame */
1716 if (wpas_eppke_initialize(wpa_s, bss, ssid) < 0) {
1717 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1718 return;
1719 }
1720
1721 resp = wpas_pasn_build_auth_1(&wpa_s->pasn, NULL,
1722 false, 0);
1723 } else {
1724 resp = wpas_pasn_build_auth_3(&wpa_s->pasn, 0);
1725 }
1726 if (!resp) {
1727 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1728 return;
1729 }
1730 params.auth_data = wpabuf_head(resp);
1731 params.auth_data_len = wpabuf_len(resp);
1732 }
1733 #endif /* CONFIG_ENC_ASSOC */
1734
1735 #ifdef CONFIG_SAE
1736 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
1737 pmksa_cache_set_current(wpa_s->wpa, NULL,
1738 params.mld ? params.ap_mld_addr :
1739 bss->bssid,
1740 ssid, 0,
1741 NULL,
1742 wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
1743 wpa_s->key_mgmt :
1744 (int) WPA_KEY_MGMT_SAE, false) == 0) {
1745 wpa_dbg(wpa_s, MSG_DEBUG,
1746 "PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
1747 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1748 params.auth_alg = WPA_AUTH_ALG_OPEN;
1749 wpa_s->sme.sae_pmksa_caching = 1;
1750 }
1751
1752 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
1753 if (start)
1754 resp = sme_auth_build_sae_commit(wpa_s, ssid,
1755 bss->bssid,
1756 params.mld ?
1757 params.ap_mld_addr :
1758 NULL, 0,
1759 start == 2, NULL,
1760 NULL);
1761 else
1762 resp = sme_auth_build_sae_confirm(wpa_s, 0);
1763 if (resp == NULL) {
1764 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1765 return;
1766 }
1767 params.auth_data = wpabuf_head(resp);
1768 params.auth_data_len = wpabuf_len(resp);
1769 wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
1770 }
1771 #endif /* CONFIG_SAE */
1772
1773 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1774 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1775 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1776 if (bssid_changed)
1777 wpas_notify_bssid_changed(wpa_s);
1778
1779 old_ssid = wpa_s->current_ssid;
1780 wpa_s->current_ssid = ssid;
1781 wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
1782 wpa_sm_set_ssid(wpa_s->wpa, bss->ssid, bss->ssid_len);
1783
1784 /*
1785 * Skip EAPOL SM re-init for IEEE 802.1X Authentication algorithm on
1786 * subsequent Authentication frames since it was already configured
1787 * for the first Authentication frame (start=1).
1788 */
1789 if (params.auth_alg != WPA_AUTH_ALG_802_1X || start)
1790 wpa_supplicant_initiate_eapol(wpa_s);
1791
1792 #ifdef CONFIG_IEEE8021X_AUTH
1793 if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_802_1X) {
1794 resp = sme_build_802_1x_auth_request(wpa_s, bss, ssid, start,
1795 false);
1796 if (!resp) {
1797 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1798 return;
1799 }
1800 params.auth_data = wpabuf_head(resp);
1801 params.auth_data_len = wpabuf_len(resp);
1802 }
1803 #endif /* CONFIG_IEEE8021X_AUTH */
1804
1805 #ifdef CONFIG_FILS
1806 /* TODO: FILS operations can in some cases be done between different
1807 * network_ctx (i.e., same credentials can be used with multiple
1808 * networks). */
1809 if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
1810 wpa_key_mgmt_fils(ssid->key_mgmt)) {
1811 const u8 *indic;
1812 u16 fils_info;
1813 const u8 *realm, *username, *rrk;
1814 size_t realm_len, username_len, rrk_len;
1815 u16 next_seq_num;
1816
1817 /*
1818 * Check FILS Indication element (FILS Information field) bits
1819 * indicating supported authentication algorithms against local
1820 * configuration (ssid->fils_dh_group). Try to use FILS
1821 * authentication only if the AP supports the combination in the
1822 * network profile. */
1823 indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
1824 if (!indic || indic[1] < 2) {
1825 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1826 " does not include FILS Indication element - cannot use FILS authentication with it",
1827 MAC2STR(bss->bssid));
1828 goto no_fils;
1829 }
1830
1831 fils_info = WPA_GET_LE16(indic + 2);
1832 if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
1833 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1834 " does not support FILS SK without PFS - cannot use FILS authentication with it",
1835 MAC2STR(bss->bssid));
1836 goto no_fils;
1837 }
1838 if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
1839 wpa_printf(MSG_DEBUG, "SME: " MACSTR
1840 " does not support FILS SK with PFS - cannot use FILS authentication with it",
1841 MAC2STR(bss->bssid));
1842 goto no_fils;
1843 }
1844
1845 if (wpa_s->last_con_fail_realm &&
1846 eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
1847 &username, &username_len,
1848 &realm, &realm_len, &next_seq_num,
1849 &rrk, &rrk_len) == 0 &&
1850 realm && realm_len == wpa_s->last_con_fail_realm_len &&
1851 os_memcmp(realm, wpa_s->last_con_fail_realm,
1852 realm_len) == 0) {
1853 wpa_printf(MSG_DEBUG,
1854 "SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
1855 goto no_fils;
1856 }
1857
1858 if (pmksa_cache_set_current(wpa_s->wpa, NULL,
1859 params.mld ? params.ap_mld_addr :
1860 bss->bssid,
1861 ssid, 0,
1862 wpa_bss_get_fils_cache_id(bss),
1863 0, false) == 0)
1864 wpa_printf(MSG_DEBUG,
1865 "SME: Try to use FILS with PMKSA caching");
1866 resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
1867 if (resp) {
1868 int auth_alg;
1869
1870 if (ssid->fils_dh_group)
1871 wpa_printf(MSG_DEBUG,
1872 "SME: Try to use FILS SK authentication with PFS (DH Group %u)",
1873 ssid->fils_dh_group);
1874 else
1875 wpa_printf(MSG_DEBUG,
1876 "SME: Try to use FILS SK authentication without PFS");
1877 auth_alg = ssid->fils_dh_group ?
1878 WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
1879 params.auth_alg = auth_alg;
1880 params.auth_data = wpabuf_head(resp);
1881 params.auth_data_len = wpabuf_len(resp);
1882 wpa_s->sme.auth_alg = auth_alg;
1883 }
1884 }
1885 no_fils:
1886 #endif /* CONFIG_FILS */
1887
1888 wpa_supplicant_cancel_sched_scan(wpa_s);
1889 wpa_supplicant_cancel_scan(wpa_s);
1890
1891 wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
1892 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
1893 wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
1894
1895 eapol_sm_notify_portValid(wpa_s->eapol, false);
1896 wpa_clear_keys(wpa_s, bss->bssid);
1897 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1898 if (old_ssid != wpa_s->current_ssid)
1899 wpas_notify_network_changed(wpa_s);
1900
1901 wpas_configure_frame_filters(wpa_s);
1902
1903 #ifdef CONFIG_P2P
1904 /*
1905 * If multi-channel concurrency is not supported, check for any
1906 * frequency conflict. In case of any frequency conflict, remove the
1907 * least prioritized connection.
1908 */
1909 if (wpa_s->num_multichan_concurrent < 2) {
1910 int freq, num;
1911 num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
1912 if (num > 0 && freq > 0 && freq != params.freq) {
1913 wpa_printf(MSG_DEBUG,
1914 "Conflicting frequency found (%d != %d)",
1915 freq, params.freq);
1916 if (wpas_p2p_handle_frequency_conflicts(wpa_s,
1917 params.freq,
1918 ssid) < 0) {
1919 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1920 wpa_supplicant_mark_disassoc(wpa_s);
1921 wpabuf_free(resp);
1922 wpas_connect_work_done(wpa_s);
1923 return;
1924 }
1925 }
1926 }
1927 #endif /* CONFIG_P2P */
1928
1929 if (skip_auth) {
1930 wpa_msg(wpa_s, MSG_DEBUG,
1931 "SME: Skip authentication step on reassoc-to-same-BSS");
1932 wpabuf_free(resp);
1933 sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
1934 return;
1935 }
1936
1937
1938 wpa_s->sme.auth_alg = params.auth_alg;
1939 wpa_s->keys_cleared &= ~keys_to_clear;
1940 if (wpa_drv_authenticate(wpa_s, ¶ms) < 0) {
1941 wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
1942 "driver failed");
1943 wpas_connection_failed(wpa_s, bss->bssid, NULL);
1944 wpa_supplicant_mark_disassoc(wpa_s);
1945 wpabuf_free(resp);
1946 wpas_connect_work_done(wpa_s);
1947 return;
1948 }
1949
1950 eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
1951 NULL);
1952
1953 /*
1954 * Association will be started based on the authentication event from
1955 * the driver.
1956 */
1957
1958 wpabuf_free(resp);
1959 }
1960
1961
sme_auth_start_cb(struct wpa_radio_work * work,int deinit)1962 static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
1963 {
1964 struct wpa_connect_work *cwork = work->ctx;
1965 struct wpa_supplicant *wpa_s = work->wpa_s;
1966
1967 wpa_s->roam_in_progress = false;
1968 #ifdef CONFIG_WNM
1969 wpa_s->bss_trans_mgmt_in_progress = false;
1970 #endif /* CONFIG_WNM */
1971
1972 if (deinit) {
1973 if (work->started)
1974 wpa_s->connect_work = NULL;
1975
1976 wpas_connect_work_free(cwork);
1977 return;
1978 }
1979
1980 wpa_s->connect_work = work;
1981
1982 if (cwork->bss_removed ||
1983 !wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
1984 wpas_network_disabled(wpa_s, cwork->ssid)) {
1985 wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
1986 wpas_connect_work_done(wpa_s);
1987 return;
1988 }
1989
1990 /* Starting new connection, so clear the possibly used WPA IE from the
1991 * previous association. */
1992 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1993 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
1994 wpa_s->rsnxe_len = 0;
1995
1996 sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
1997 wpas_notify_auth_changed(wpa_s);
1998 }
1999
2000
sme_authenticate(struct wpa_supplicant * wpa_s,struct wpa_bss * bss,struct wpa_ssid * ssid)2001 void sme_authenticate(struct wpa_supplicant *wpa_s,
2002 struct wpa_bss *bss, struct wpa_ssid *ssid)
2003 {
2004 struct wpa_connect_work *cwork;
2005
2006 if (bss == NULL || ssid == NULL)
2007 return;
2008 if (wpa_s->connect_work) {
2009 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
2010 return;
2011 }
2012
2013 if (wpa_s->roam_in_progress) {
2014 wpa_dbg(wpa_s, MSG_DEBUG,
2015 "SME: Reject sme_authenticate() in favor of explicit roam request");
2016 return;
2017 }
2018 #ifdef CONFIG_WNM
2019 if (wpa_s->bss_trans_mgmt_in_progress) {
2020 wpa_dbg(wpa_s, MSG_DEBUG,
2021 "SME: Reject sme_authenticate() in favor of BSS transition management request");
2022 return;
2023 }
2024 #endif /* CONFIG_WNM */
2025 if (radio_work_pending(wpa_s, "sme-connect")) {
2026 /*
2027 * The previous sme-connect work might no longer be valid due to
2028 * the fact that the BSS list was updated. In addition, it makes
2029 * sense to adhere to the 'newer' decision.
2030 */
2031 wpa_dbg(wpa_s, MSG_DEBUG,
2032 "SME: Remove previous pending sme-connect");
2033 radio_remove_works(wpa_s, "sme-connect", 0);
2034 }
2035
2036 wpas_abort_ongoing_scan(wpa_s);
2037
2038 cwork = os_zalloc(sizeof(*cwork));
2039 if (cwork == NULL)
2040 return;
2041 cwork->bss = bss;
2042 cwork->ssid = ssid;
2043 cwork->sme = 1;
2044
2045 #ifdef CONFIG_SAE
2046 wpa_s->sme.sae.state = SAE_NOTHING;
2047 wpa_s->sme.sae.send_confirm = 0;
2048 wpa_s->sme.sae_group_index = 0;
2049 #endif /* CONFIG_SAE */
2050
2051 if (!radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
2052 sme_auth_start_cb, cwork))
2053 wpas_connect_work_free(cwork);
2054 }
2055
2056
2057 #if defined(CONFIG_SAE) || defined(CONFIG_IEEE8021X_AUTH)
2058
2059 #define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
2060
wpa_auth_ml_ie(struct wpabuf * buf,const u8 * mld_addr)2061 static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
2062 {
2063
2064 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
2065 wpabuf_put_u8(buf, 4 + ETH_ALEN);
2066 wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
2067
2068 /* Basic Multi-Link element Control field */
2069 wpabuf_put_u8(buf, 0x0);
2070 wpabuf_put_u8(buf, 0x0);
2071
2072 /* Common Info */
2073 wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
2074 wpabuf_put_data(buf, mld_addr, ETH_ALEN);
2075 }
2076
2077 #endif /* CONFIG_SAE || CONFIG_IEEE8021X_AUTH */
2078
2079
2080 #ifdef CONFIG_SAE
2081
sme_external_auth_build_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,u16 auth_transaction,u16 seq_num,u16 status_code,const u8 * mld_addr)2082 static int sme_external_auth_build_buf(struct wpabuf *buf,
2083 struct wpabuf *params,
2084 const u8 *sa, const u8 *da,
2085 u16 auth_transaction, u16 seq_num,
2086 u16 status_code, const u8 *mld_addr)
2087 {
2088 struct ieee80211_mgmt *resp;
2089
2090 resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
2091 u.auth.variable));
2092
2093 resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
2094 (WLAN_FC_STYPE_AUTH << 4));
2095 os_memcpy(resp->da, da, ETH_ALEN);
2096 os_memcpy(resp->sa, sa, ETH_ALEN);
2097 os_memcpy(resp->bssid, da, ETH_ALEN);
2098 resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
2099 resp->seq_ctrl = host_to_le16(seq_num << 4);
2100 resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
2101 resp->u.auth.status_code = host_to_le16(status_code);
2102 if (params)
2103 wpabuf_put_buf(buf, params);
2104
2105 if (mld_addr)
2106 wpa_auth_ml_ie(buf, mld_addr);
2107
2108 return 0;
2109 }
2110
2111
sme_external_auth_send_sae_commit(struct wpa_supplicant * wpa_s,const u8 * bssid,struct wpa_ssid * ssid)2112 static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
2113 const u8 *bssid,
2114 struct wpa_ssid *ssid)
2115 {
2116 struct wpabuf *resp, *buf;
2117 int use_pt;
2118 bool use_pk;
2119 u16 status;
2120
2121 resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
2122 wpa_s->sme.ext_ml_auth ?
2123 wpa_s->sme.ext_auth_ap_mld_addr : NULL,
2124 1, 0, &use_pt, &use_pk);
2125 if (!resp) {
2126 wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
2127 return -1;
2128 }
2129
2130 wpa_s->sme.sae.state = SAE_COMMITTED;
2131 buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
2132 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
2133 0));
2134 if (!buf) {
2135 wpabuf_free(resp);
2136 return -1;
2137 }
2138
2139 wpa_s->sme.seq_num++;
2140 if (use_pk)
2141 status = WLAN_STATUS_SAE_PK;
2142 else if (use_pt)
2143 status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
2144 else
2145 status = WLAN_STATUS_SUCCESS;
2146 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
2147 wpa_s->sme.ext_ml_auth ?
2148 wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
2149 wpa_s->sme.seq_num, status,
2150 wpa_s->sme.ext_ml_auth ?
2151 wpa_s->own_addr : NULL);
2152 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1,
2153 wpa_s->sme.ext_auth_freq, 0);
2154 wpabuf_free(resp);
2155 wpabuf_free(buf);
2156
2157 return 0;
2158 }
2159
2160 #endif /* CONFIG_SAE */
2161
2162
sme_send_external_auth_status(struct wpa_supplicant * wpa_s,u16 status)2163 void sme_send_external_auth_status(struct wpa_supplicant *wpa_s, u16 status)
2164 {
2165 struct external_auth params;
2166
2167 wpa_s->sme.ext_auth_wpa_ssid = NULL;
2168 os_memset(¶ms, 0, sizeof(params));
2169 params.status = status;
2170 params.ssid = wpa_s->sme.ext_auth_ssid;
2171 params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
2172 params.bssid = wpa_s->sme.ext_auth_bssid;
2173 #ifdef CONFIG_SAE
2174 if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
2175 params.pmkid = wpa_s->sme.sae.pmkid;
2176 #endif /* CONFIG_SAE */
2177 #ifdef CONFIG_ENC_ASSOC
2178 if (status == WLAN_STATUS_SUCCESS &&
2179 wpa_s->sme.ext_auth_alg == WLAN_AUTH_EPPKE &&
2180 wpa_s->pasn.using_pmksa) {
2181 struct rsn_pmksa_cache_entry *pmksa;
2182
2183 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2184 if (pmksa)
2185 params.pmkid = pmksa->pmkid;
2186 }
2187 #endif /* CONFIG_ENC_ASSOC */
2188 #ifdef CONFIG_IEEE8021X_AUTH
2189 if (status == WLAN_STATUS_SUCCESS &&
2190 wpa_s->sme.ext_auth_alg == WLAN_AUTH_802_1X) {
2191 struct ptksa_cache_entry *entry;
2192 struct rsn_pmksa_cache_entry *pmksa;
2193
2194 entry = ptksa_cache_get(wpa_s->ptksa,
2195 sme_get_peer_addr(wpa_s, true),
2196 sme_get_pairwise_cipher(wpa_s, true));
2197 if (entry && entry->ptk.kck_len) {
2198 params.kck = entry->ptk.kck;
2199 params.kck_len = entry->ptk.kck_len;
2200 }
2201 if (wpa_s->auth_1x && wpa_s->auth_1x->pmkid_found) {
2202 pmksa = pmksa_cache_get_current(wpa_s->wpa);
2203 if (pmksa)
2204 params.pmkid = pmksa->pmkid;
2205 }
2206 }
2207 #endif /* CONFIG_IEEE8021X_AUTH */
2208
2209 wpa_drv_send_external_auth_status(wpa_s, ¶ms);
2210 }
2211
2212
2213 #ifdef CONFIG_SAE
2214
sme_handle_external_auth_start(struct wpa_supplicant * wpa_s,struct external_auth * ext_auth)2215 static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
2216 struct external_auth *ext_auth)
2217 {
2218 struct wpa_ssid *ssid;
2219 size_t ssid_str_len = ext_auth->ssid_len;
2220 const u8 *ssid_str = ext_auth->ssid;
2221
2222 wpa_s->sme.ext_auth_wpa_ssid = NULL;
2223 /* Get the SSID conf from the ssid string obtained */
2224 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2225 if (!wpas_network_disabled(wpa_s, ssid) &&
2226 ssid_str_len == ssid->ssid_len &&
2227 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
2228 wpa_key_mgmt_sae(ssid->key_mgmt)) {
2229 /* Make sure PT is derived */
2230 wpa_s_setup_sae_pt(wpa_s, ssid, false);
2231 wpa_s->sme.ext_auth_wpa_ssid = ssid;
2232 break;
2233 }
2234 }
2235 if (!ssid ||
2236 sme_external_auth_send_sae_commit(wpa_s, ext_auth->bssid,
2237 ssid) < 0)
2238 return -1;
2239
2240 return 0;
2241 }
2242
2243
sme_external_auth_send_sae_confirm(struct wpa_supplicant * wpa_s,const u8 * da)2244 static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
2245 const u8 *da)
2246 {
2247 struct wpabuf *resp, *buf;
2248
2249 resp = sme_auth_build_sae_confirm(wpa_s, 1);
2250 if (!resp) {
2251 wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
2252 return;
2253 }
2254
2255 wpa_s->sme.sae.state = SAE_CONFIRMED;
2256 buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
2257 (wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
2258 0));
2259 if (!buf) {
2260 wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
2261 wpabuf_free(resp);
2262 return;
2263 }
2264 wpa_s->sme.seq_num++;
2265 sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
2266 da, 2, wpa_s->sme.seq_num,
2267 WLAN_STATUS_SUCCESS,
2268 wpa_s->sme.ext_ml_auth ?
2269 wpa_s->own_addr : NULL);
2270
2271 wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1,
2272 wpa_s->sme.ext_auth_freq, 0);
2273 wpabuf_free(resp);
2274 wpabuf_free(buf);
2275 }
2276
2277
is_sae_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)2278 static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
2279 {
2280 /* suite is supposed to be the selector value in host byte order with
2281 * the OUI in three most significant octets. However, the initial
2282 * implementation swapped that byte order and did not work with drivers
2283 * that followed the expected byte order. Keep a workaround here to
2284 * match that initial implementation so that already deployed use cases
2285 * remain functional. */
2286 if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
2287 /* This will be true in following cases
2288 * 1. Old drivers which follow the initial implementation send
2289 * RSN_AUTH_KEY_MGMT_SAE with swapped byte order for both SAE
2290 * and FT-SAE connections.
2291 * 2. The driver sending RSN_AUTH_KEY_MGMT_SAE in host byte
2292 * order but kernel swapped that byte order to follow initial
2293 * implementation.
2294 * In these cases, update the AKM as WPA_KEY_MGMT_SAE. */
2295 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
2296 return true;
2297 }
2298
2299 if (suite == RSN_AUTH_KEY_MGMT_SAE)
2300 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
2301 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
2302 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
2303 else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
2304 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
2305 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
2306 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
2307 else
2308 return false;
2309
2310 return true;
2311 }
2312
2313 #endif /* CONFIG_SAE */
2314
2315
2316 #ifdef CONFIG_ENC_ASSOC
2317
is_eppke_auth_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)2318 static bool is_eppke_auth_key_mgmt_suite(struct wpa_supplicant *wpa_s,
2319 u32 suite)
2320 {
2321 /* Supported AKM suites for EPPKE */
2322 if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
2323 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
2324 else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
2325 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
2326 else if (suite == RSN_AUTH_KEY_MGMT_EPPKE)
2327 wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_EPPKE;
2328 else
2329 return false;
2330
2331 return true;
2332 }
2333
2334
sme_handle_eppke_external_auth_start(struct wpa_supplicant * wpa_s,struct external_auth * ext_auth)2335 static int sme_handle_eppke_external_auth_start(struct wpa_supplicant *wpa_s,
2336 struct external_auth *ext_auth)
2337 {
2338 struct wpa_ssid *ssid;
2339 size_t ssid_str_len = ext_auth->ssid_len;
2340 const u8 *ssid_str = ext_auth->ssid;
2341 u8 peer_addr[ETH_ALEN];
2342 bool is_ml_peer;
2343 int group;
2344
2345 wpa_s->sme.ext_auth_wpa_ssid = NULL;
2346 /* Find the network profil based on the selected SSID */
2347 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2348 if (!wpas_network_disabled(wpa_s, ssid) &&
2349 wpa_key_mgmt_eppke(ssid->key_mgmt) &&
2350 ssid_str_len == ssid->ssid_len &&
2351 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0) {
2352 wpa_s->sme.ext_auth_wpa_ssid = ssid;
2353 break;
2354 }
2355 }
2356 if (!ssid) {
2357 wpa_printf(MSG_DEBUG,
2358 "EPPKE: No matching network block found");
2359 return -1;
2360 }
2361
2362 wpa_s->sme.ext_auth_alg = ext_auth->auth_alg;
2363
2364 if (ext_auth->mld_addr) {
2365 is_ml_peer = true;
2366 os_memcpy(peer_addr, ext_auth->mld_addr, ETH_ALEN);
2367 } else {
2368 is_ml_peer = false;
2369 os_memcpy(peer_addr, ext_auth->bssid, ETH_ALEN);
2370 }
2371
2372 group = wpas_pasn_get_group(wpa_s, ssid, NULL);
2373 if (!group) {
2374 wpa_printf(MSG_DEBUG, "EPPKE: Failed to select PASN group");
2375 return -1;
2376 }
2377
2378 /* As per IEEE P802.11-REVmf/D2.1, 12.13.5, when SAE is wrapped within
2379 * PASN authentication, both shall use the same finite cyclic group.
2380 */
2381 if (sae_set_group(&wpa_s->sme.sae, group) < 0) {
2382 wpa_printf(MSG_INFO, "EPPKE: Failed to set SAE group %u",
2383 group);
2384 return -1;
2385 }
2386
2387 return wpas_pasn_auth_start(wpa_s, wpa_s->own_addr, peer_addr,
2388 rsn_key_mgmt_to_wpa_akm(
2389 ext_auth->key_mgmt_suite),
2390 ext_auth->pairwise_cipher,
2391 group, ssid->id, NULL, 0,
2392 ext_auth->auth_alg,
2393 ext_auth->group_cipher,
2394 ext_auth->group_mgmt_cipher,
2395 ext_auth->rsn_capab,
2396 ext_auth->rsnxe_data,
2397 is_ml_peer);
2398 }
2399
2400 #endif /* CONFIG_ENC_ASSOC */
2401
2402
sme_ext_auth_get_freq(struct wpa_supplicant * wpa_s,const u8 * bssid)2403 static void sme_ext_auth_get_freq(struct wpa_supplicant *wpa_s,
2404 const u8 *bssid)
2405 {
2406 struct wpa_bss *bss;
2407
2408 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
2409 if (!bss) {
2410 wpa_printf(MSG_DEBUG,
2411 "SAE: BSS not available, update scan result to get BSS");
2412 wpa_supplicant_update_scan_results(wpa_s, bssid);
2413 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
2414 }
2415 wpa_s->sme.ext_auth_freq = bss ? bss->freq : 0;
2416 }
2417
2418
2419 #ifdef CONFIG_IEEE8021X_AUTH
2420
sme_external_auth_build_802_1x_buf(struct wpabuf * buf,struct wpabuf * params,const u8 * sa,const u8 * da,const u8 * mld_addr)2421 static void sme_external_auth_build_802_1x_buf(struct wpabuf *buf,
2422 struct wpabuf *params,
2423 const u8 *sa, const u8 *da,
2424 const u8 *mld_addr)
2425 {
2426 struct ieee80211_hdr *hdr;
2427
2428 hdr = wpabuf_put(buf, sizeof(*hdr));
2429 hdr->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
2430 (WLAN_FC_STYPE_AUTH << 4));
2431 os_memcpy(hdr->addr1, da, ETH_ALEN);
2432 os_memcpy(hdr->addr2, sa, ETH_ALEN);
2433 os_memcpy(hdr->addr3, da, ETH_ALEN);
2434
2435 wpabuf_put_le16(buf, WLAN_AUTH_802_1X);
2436
2437 if (params)
2438 wpabuf_put_buf(buf, params);
2439
2440 if (mld_addr)
2441 wpa_auth_ml_ie(buf, mld_addr);
2442 }
2443
2444
sme_external_auth_send_802_1x(struct wpa_supplicant * wpa_s,struct wpa_ssid * ssid,bool start)2445 static int sme_external_auth_send_802_1x(struct wpa_supplicant *wpa_s,
2446 struct wpa_ssid *ssid, bool start)
2447 {
2448 struct wpabuf *resp, *buf;
2449 struct wpa_bss *bss = NULL;
2450 size_t buf_len;
2451 int ret = -1;
2452
2453 if (start)
2454 bss = wpa_bss_get_bssid_latest(wpa_s,
2455 wpa_s->sme.ext_auth_bssid);
2456
2457 resp = sme_build_802_1x_auth_request(wpa_s, bss, ssid, start, true);
2458 if (!resp)
2459 return -1;
2460
2461 buf_len = offsetof(struct ieee80211_mgmt, u.auth.variable) +
2462 wpabuf_len(resp);
2463 if (wpa_s->sme.ext_ml_auth)
2464 buf_len += WPA_AUTH_FRAME_ML_IE_LEN;
2465
2466 buf = wpabuf_alloc(buf_len);
2467 if (!buf)
2468 goto fail;
2469
2470 sme_external_auth_build_802_1x_buf(buf, resp, wpa_s->own_addr,
2471 wpa_s->sme.ext_auth_bssid,
2472 wpa_s->sme.ext_ml_auth ?
2473 wpa_s->own_addr : NULL);
2474
2475 if (wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf),
2476 0, 0, 0) < 0) {
2477 wpa_printf(MSG_INFO,
2478 "IEEE 802.1X: Failed to send Authentication frame");
2479 goto fail;
2480 }
2481
2482 ret = 0;
2483 fail:
2484 wpabuf_free(resp);
2485 wpabuf_free(buf);
2486 return ret;
2487 }
2488
2489
sme_external_auth_start_802_1x(struct wpa_supplicant * wpa_s,struct external_auth * ext_auth)2490 static int sme_external_auth_start_802_1x(struct wpa_supplicant *wpa_s,
2491 struct external_auth *ext_auth)
2492 {
2493 struct wpa_ssid *ssid;
2494 const u8 *ssid_str = ext_auth->ssid;
2495 size_t ssid_str_len = ext_auth->ssid_len;
2496
2497 wpa_s->sme.ext_auth_wpa_ssid = NULL;
2498 /* Match the driver-provided SSID against configured network blocks */
2499 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
2500 if (!wpas_network_disabled(wpa_s, ssid) &&
2501 ssid_str_len == ssid->ssid_len &&
2502 os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
2503 wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2504 wpa_s->sme.ext_auth_wpa_ssid = ssid;
2505 break;
2506 }
2507 }
2508 if (!ssid)
2509 return -1;
2510
2511 wpa_s->sme.ext_auth_alg = ext_auth->auth_alg;
2512 wpa_s->sme.ext_pairwise_cipher = ext_auth->pairwise_cipher;
2513 wpa_s->sme.ext_group_cipher = ext_auth->group_cipher;
2514 wpa_s->sme.ext_mgmt_group_cipher = ext_auth->group_mgmt_cipher;
2515 wpa_s->sme.ext_rsn_capab = ext_auth->rsn_capab;
2516 if (ext_auth->rsnxe_data &&
2517 ext_auth->rsnxe_data_len <= sizeof(wpa_s->sme.ext_rsnxe)) {
2518 os_memcpy(wpa_s->sme.ext_rsnxe, ext_auth->rsnxe_data,
2519 ext_auth->rsnxe_data_len);
2520 wpa_s->sme.ext_rsnxe_len = ext_auth->rsnxe_data_len;
2521 }
2522
2523 if (sme_external_auth_send_802_1x(wpa_s, ssid, 1) < 0)
2524 return -1;
2525
2526 return 0;
2527 }
2528
2529
is_ieee8021x_key_mgmt_suite(struct wpa_supplicant * wpa_s,u32 suite)2530 static bool is_ieee8021x_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
2531 {
2532 /*
2533 * If an originator chooses to initiate IEEE 802.1X authentication
2534 * utilizing Authentication frames, it shall select an IEEE 802.1X AKM,
2535 * other than IEEE 802.1X AKM 00-0F-AC:1.
2536 */
2537 static const struct {
2538 u32 selector;
2539 int key_mgmt;
2540 } suite_map[] = {
2541 { RSN_AUTH_KEY_MGMT_FT_802_1X, WPA_KEY_MGMT_FT_IEEE8021X },
2542 { RSN_AUTH_KEY_MGMT_802_1X_SHA256,
2543 WPA_KEY_MGMT_IEEE8021X_SHA256 },
2544 { RSN_AUTH_KEY_MGMT_802_1X_SUITE_B,
2545 WPA_KEY_MGMT_IEEE8021X_SUITE_B },
2546 { RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192,
2547 WPA_KEY_MGMT_IEEE8021X_SUITE_B_192 },
2548 { RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384,
2549 WPA_KEY_MGMT_FT_IEEE8021X_SHA384 },
2550 { RSN_AUTH_KEY_MGMT_FILS_SHA256,
2551 WPA_KEY_MGMT_FILS_SHA256 },
2552 { RSN_AUTH_KEY_MGMT_FILS_SHA384,
2553 WPA_KEY_MGMT_FILS_SHA384 },
2554 { RSN_AUTH_KEY_MGMT_FT_FILS_SHA256,
2555 WPA_KEY_MGMT_FT_FILS_SHA256 },
2556 { RSN_AUTH_KEY_MGMT_FT_FILS_SHA384,
2557 WPA_KEY_MGMT_FT_FILS_SHA384 },
2558 { RSN_AUTH_KEY_MGMT_802_1X_SHA384,
2559 WPA_KEY_MGMT_IEEE8021X_SHA384 },
2560 };
2561 unsigned int i;
2562
2563 for (i = 0; i < ARRAY_SIZE(suite_map); i++) {
2564 if (suite == suite_map[i].selector) {
2565 wpa_s->sme.ext_auth_key_mgmt = suite_map[i].key_mgmt;
2566 return true;
2567 }
2568 }
2569
2570 return false;
2571 }
2572
2573 #endif /* CONFIG_IEEE8021X_AUTH */
2574
2575
sme_external_auth_trigger(struct wpa_supplicant * wpa_s,struct external_auth * ext_auth)2576 void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
2577 struct external_auth *ext_auth)
2578 {
2579 switch (ext_auth->auth_alg) {
2580 #ifdef CONFIG_ENC_ASSOC
2581 case WLAN_AUTH_EPPKE:
2582 if (!is_eppke_auth_key_mgmt_suite(wpa_s,
2583 ext_auth->key_mgmt_suite))
2584 return;
2585 break;
2586 #endif /* CONFIG_ENC_ASSOC */
2587 #ifdef CONFIG_IEEE8021X_AUTH
2588 case WLAN_AUTH_802_1X:
2589 if (!is_ieee8021x_key_mgmt_suite(wpa_s,
2590 ext_auth->key_mgmt_suite))
2591 return;
2592 break;
2593 #endif /* CONFIG_IEEE8021X_AUTH */
2594 default:
2595 #ifdef CONFIG_SAE
2596 if (!is_sae_key_mgmt_suite(wpa_s, ext_auth->key_mgmt_suite))
2597 return;
2598 break;
2599 #else /* CONFIG_SAE */
2600 return;
2601 #endif /* CONFIG_SAE */
2602 }
2603
2604 if (ext_auth->action == EXT_AUTH_START) {
2605 if (!ext_auth->bssid || !ext_auth->ssid)
2606 return;
2607 os_memcpy(wpa_s->sme.ext_auth_bssid, ext_auth->bssid,
2608 ETH_ALEN);
2609 sme_ext_auth_get_freq(wpa_s, ext_auth->bssid);
2610 os_memcpy(wpa_s->sme.ext_auth_ssid, ext_auth->ssid,
2611 ext_auth->ssid_len);
2612 wpa_s->sme.ext_auth_ssid_len = ext_auth->ssid_len;
2613 if (ext_auth->mld_addr) {
2614 wpa_s->sme.ext_ml_auth = true;
2615 os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
2616 ext_auth->mld_addr, ETH_ALEN);
2617 } else {
2618 wpa_s->sme.ext_ml_auth = false;
2619 }
2620 #ifdef CONFIG_ENC_ASSOC
2621 if (ext_auth->auth_alg == WLAN_AUTH_EPPKE) {
2622 if (sme_handle_eppke_external_auth_start(wpa_s,
2623 ext_auth) < 0)
2624 sme_send_external_auth_status(
2625 wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
2626 return;
2627 }
2628 #endif /* CONFIG_ENC_ASSOC */
2629 #ifdef CONFIG_IEEE8021X_AUTH
2630 if (ext_auth->auth_alg == WLAN_AUTH_802_1X) {
2631 if (sme_external_auth_start_802_1x(wpa_s, ext_auth) < 0)
2632 sme_send_external_auth_status(
2633 wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
2634 return;
2635 }
2636 #endif /* CONFIG_IEEE8021X_AUTH */
2637 #ifdef CONFIG_SAE
2638 wpa_s->sme.seq_num = 0;
2639 wpa_s->sme.sae.state = SAE_NOTHING;
2640 wpa_s->sme.sae.send_confirm = 0;
2641 wpa_s->sme.sae_group_index = 0;
2642 if (sme_handle_external_auth_start(wpa_s, ext_auth) < 0)
2643 sme_send_external_auth_status(wpa_s,
2644 WLAN_STATUS_UNSPECIFIED_FAILURE);
2645 #endif /* CONFIG_SAE */
2646 } else if (ext_auth->action == EXT_AUTH_ABORT) {
2647 /* Report failure to driver for the wrong trigger */
2648 sme_send_external_auth_status(wpa_s,
2649 WLAN_STATUS_UNSPECIFIED_FAILURE);
2650 }
2651 }
2652
2653
2654 #ifdef CONFIG_SAE
2655
sme_sae_is_group_enabled(struct wpa_supplicant * wpa_s,int group)2656 static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
2657 {
2658 int *groups = wpa_s->conf->sae_groups;
2659 int default_groups[] = { 19, 20, 21, 0 };
2660 int i;
2661
2662 if (!groups)
2663 groups = default_groups;
2664
2665 for (i = 0; groups[i] > 0; i++) {
2666 if (groups[i] == group)
2667 return 1;
2668 }
2669
2670 return 0;
2671 }
2672
2673
sme_check_sae_rejected_groups(struct wpa_supplicant * wpa_s,const struct wpabuf * groups)2674 static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
2675 const struct wpabuf *groups)
2676 {
2677 size_t i, count, len;
2678 const u8 *pos;
2679
2680 if (!groups)
2681 return 0;
2682
2683 pos = wpabuf_head(groups);
2684 len = wpabuf_len(groups);
2685 if (len & 1) {
2686 wpa_printf(MSG_DEBUG,
2687 "SAE: Invalid length of the Rejected Groups element payload: %zu",
2688 len);
2689 return 1;
2690 }
2691 count = len / 2;
2692 for (i = 0; i < count; i++) {
2693 int enabled;
2694 u16 group;
2695
2696 group = WPA_GET_LE16(pos);
2697 pos += 2;
2698 enabled = sme_sae_is_group_enabled(wpa_s, group);
2699 wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
2700 group, enabled ? "enabled" : "disabled");
2701 if (enabled)
2702 return 1;
2703 }
2704
2705 return 0;
2706 }
2707
2708
sme_external_ml_auth(struct wpa_supplicant * wpa_s,const u8 * data,size_t len,int ie_offset,u16 status_code)2709 static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
2710 const u8 *data, size_t len, int ie_offset,
2711 u16 status_code)
2712 {
2713 struct ieee802_11_elems elems;
2714
2715 if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
2716 &elems, 0) == ParseFailed) {
2717 wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
2718 return -1;
2719 }
2720
2721 if (!elems.basic_mle || !elems.basic_mle_len) {
2722 wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
2723 if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
2724 status_code == WLAN_STATUS_SUCCESS ||
2725 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
2726 status_code == WLAN_STATUS_SAE_PK)
2727 return -1;
2728 /* Accept missing Multi-Link element in failed authentication
2729 * cases. */
2730 return 0;
2731 }
2732
2733 return sme_validate_basic_mle(&elems, wpa_s->sme.ext_auth_ap_mld_addr);
2734 }
2735
2736
sme_sae_auth(struct wpa_supplicant * wpa_s,u16 auth_transaction,u16 status_code,const u8 * data,size_t len,int external,const u8 * sa,int * ie_offset)2737 static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
2738 u16 status_code, const u8 *data, size_t len,
2739 int external, const u8 *sa, int *ie_offset)
2740 {
2741 int *groups;
2742
2743 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
2744 "status code %u", auth_transaction, status_code);
2745
2746 if (auth_transaction == WLAN_AUTH_TR_SEQ_SAE_COMMIT &&
2747 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
2748 wpa_s->sme.sae.state == SAE_COMMITTED &&
2749 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
2750 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
2751 int default_groups[] = { 19, 20, 21, 0 };
2752 u16 group;
2753 const u8 *token_pos;
2754 size_t token_len;
2755 int h2e = 0;
2756
2757 groups = wpa_s->conf->sae_groups;
2758 if (!groups || groups[0] <= 0)
2759 groups = default_groups;
2760
2761 wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
2762 data, len);
2763 if (len < sizeof(le16)) {
2764 wpa_dbg(wpa_s, MSG_DEBUG,
2765 "SME: Too short SAE anti-clogging token request");
2766 return -1;
2767 }
2768 group = WPA_GET_LE16(data);
2769 wpa_dbg(wpa_s, MSG_DEBUG,
2770 "SME: SAE anti-clogging token requested (group %u)",
2771 group);
2772 if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
2773 WLAN_STATUS_SUCCESS) {
2774 wpa_dbg(wpa_s, MSG_ERROR,
2775 "SME: SAE group %u of anti-clogging request is invalid",
2776 group);
2777 return -1;
2778 }
2779 wpabuf_free(wpa_s->sme.sae_token);
2780 token_pos = data + sizeof(le16);
2781 token_len = len - sizeof(le16);
2782 h2e = wpa_s->sme.sae.h2e;
2783 if (h2e) {
2784 u8 id, elen, extid;
2785
2786 if (token_len < 3) {
2787 wpa_dbg(wpa_s, MSG_DEBUG,
2788 "SME: Too short SAE anti-clogging token container");
2789 return -1;
2790 }
2791 id = *token_pos++;
2792 elen = *token_pos++;
2793 extid = *token_pos++;
2794 if (id != WLAN_EID_EXTENSION ||
2795 elen == 0 || elen > token_len - 2 ||
2796 extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
2797 wpa_dbg(wpa_s, MSG_DEBUG,
2798 "SME: Invalid SAE anti-clogging token container header");
2799 return -1;
2800 }
2801 token_len = elen - 1;
2802 #ifdef CONFIG_IEEE80211BE
2803 } else if ((wpa_s->valid_links ||
2804 (external && wpa_s->sme.ext_ml_auth)) &&
2805 token_len > 12 &&
2806 token_pos[token_len - 12] == WLAN_EID_EXTENSION &&
2807 token_pos[token_len - 11] == 10 &&
2808 token_pos[token_len - 10] ==
2809 WLAN_EID_EXT_MULTI_LINK) {
2810 /* IEEE P802.11be requires H2E to be used whenever SAE
2811 * is used for ML association. However, some early
2812 * Wi-Fi 7 APs enable MLO without H2E. Recognize this
2813 * special case based on the fixed length Basic
2814 * Multi-Link element being at the end of the data that
2815 * would contain the unknown variable length
2816 * Anti-Clogging Token field. The Basic Multi-Link
2817 * element in Authentication frames include the MLD MAC
2818 * addreess in the Common Info field and all subfields
2819 * of the Presence Bitmap subfield of the Multi-Link
2820 * Control field of the element zero and consequently,
2821 * has a fixed length of 12 octets. */
2822 wpa_printf(MSG_DEBUG,
2823 "SME: Detected Basic Multi-Link element at the end of Anti-Clogging Token field");
2824 token_len -= 12;
2825 #endif /* CONFIG_IEEE80211BE */
2826 }
2827
2828 *ie_offset = token_pos + token_len - data;
2829
2830 wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
2831 if (!wpa_s->sme.sae_token) {
2832 wpa_dbg(wpa_s, MSG_ERROR,
2833 "SME: Failed to allocate SAE token");
2834 return -1;
2835 }
2836
2837 wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
2838 wpa_s->sme.sae_token);
2839 if (!external) {
2840 sme_send_authentication(wpa_s, wpa_s->current_bss,
2841 wpa_s->current_ssid, 2);
2842 } else {
2843 if (wpa_s->sme.ext_ml_auth &&
2844 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
2845 status_code))
2846 return -1;
2847
2848 sme_external_auth_send_sae_commit(
2849 wpa_s, wpa_s->sme.ext_auth_bssid,
2850 wpa_s->sme.ext_auth_wpa_ssid);
2851 }
2852 return 0;
2853 }
2854
2855 if (auth_transaction == WLAN_AUTH_TR_SEQ_SAE_COMMIT &&
2856 status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
2857 wpa_s->sme.sae.state == SAE_COMMITTED &&
2858 ((external && wpa_s->sme.ext_auth_wpa_ssid) ||
2859 (!external && wpa_s->current_bss && wpa_s->current_ssid))) {
2860 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
2861 int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
2862 wpa_s->sme.sae.group);
2863 wpa_s->sme.sae_group_index++;
2864 if (sme_set_sae_group(wpa_s, external) < 0)
2865 return -1; /* no other groups enabled */
2866 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
2867 if (!external) {
2868 sme_send_authentication(wpa_s, wpa_s->current_bss,
2869 wpa_s->current_ssid, 1);
2870 } else {
2871 if (wpa_s->sme.ext_ml_auth &&
2872 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
2873 status_code))
2874 return -1;
2875
2876 sme_external_auth_send_sae_commit(
2877 wpa_s, wpa_s->sme.ext_auth_bssid,
2878 wpa_s->sme.ext_auth_wpa_ssid);
2879 }
2880 return 0;
2881 }
2882
2883 if (auth_transaction == WLAN_AUTH_TR_SEQ_SAE_COMMIT &&
2884 status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
2885 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
2886 struct wpa_ssid *ssid = wpa_s->current_ssid;
2887
2888 if (ssid && ssid->alt_sae_password_ids &&
2889 ssid->alt_sae_passwords_ids_used) {
2890 wpa_printf(MSG_DEBUG,
2891 "SAE: Remove alternative password identifier (idx=%u) due to rejection",
2892 ssid->alt_sae_passwords_ids_idx);
2893 wpabuf_array_remove(ssid->alt_sae_password_ids,
2894 ssid->alt_sae_passwords_ids_idx);
2895
2896 #ifndef CONFIG_NO_CONFIG_WRITE
2897 if (wpa_s->conf->update_config &&
2898 wpa_config_write(wpa_s->confname, wpa_s->conf))
2899 wpa_printf(MSG_DEBUG,
2900 "SAE: Failed to update configuration");
2901 #endif /* CONFIG_NO_CONFIG_WRITE */
2902 }
2903
2904 wpa_msg(wpa_s, MSG_INFO,
2905 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
2906 MAC2STR(bssid));
2907 return -1;
2908 }
2909
2910 if (status_code != WLAN_STATUS_SUCCESS &&
2911 status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
2912 status_code != WLAN_STATUS_SAE_PK) {
2913 const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
2914
2915 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
2916 " auth_type=%u auth_transaction=%u status_code=%u",
2917 MAC2STR(bssid), WLAN_AUTH_SAE,
2918 auth_transaction, status_code);
2919 return -2;
2920 }
2921
2922 if (auth_transaction == WLAN_AUTH_TR_SEQ_SAE_COMMIT) {
2923 u16 res;
2924
2925 groups = wpa_s->conf->sae_groups;
2926
2927 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
2928 if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
2929 (!external &&
2930 (!wpa_s->current_bss || !wpa_s->current_ssid)))
2931 return -1;
2932 if (wpa_s->sme.sae.state != SAE_COMMITTED) {
2933 wpa_printf(MSG_DEBUG,
2934 "SAE: Ignore commit message while waiting for confirm");
2935 return 0;
2936 }
2937 if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
2938 wpa_printf(MSG_DEBUG,
2939 "SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
2940 return -1;
2941 }
2942 if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
2943 status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
2944 wpa_printf(MSG_DEBUG,
2945 "SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
2946 return -1;
2947 }
2948 if (!wpa_s->sme.sae.pk &&
2949 status_code == WLAN_STATUS_SAE_PK) {
2950 wpa_printf(MSG_DEBUG,
2951 "SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
2952 return -1;
2953 }
2954
2955 if (groups && groups[0] <= 0)
2956 groups = NULL;
2957 res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
2958 groups, status_code ==
2959 WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
2960 status_code == WLAN_STATUS_SAE_PK,
2961 ie_offset);
2962 if (res == SAE_SILENTLY_DISCARD) {
2963 wpa_printf(MSG_DEBUG,
2964 "SAE: Drop commit message due to reflection attack");
2965 return 0;
2966 }
2967 if (res != WLAN_STATUS_SUCCESS)
2968 return -1;
2969
2970 if (wpa_s->sme.sae.tmp &&
2971 sme_check_sae_rejected_groups(
2972 wpa_s,
2973 wpa_s->sme.sae.tmp->peer_rejected_groups))
2974 return -1;
2975
2976 if (sae_process_commit(&wpa_s->sme.sae) < 0) {
2977 wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
2978 "commit");
2979 return -1;
2980 }
2981
2982 wpabuf_free(wpa_s->sme.sae_token);
2983 wpa_s->sme.sae_token = NULL;
2984 if (!external) {
2985 sme_send_authentication(wpa_s, wpa_s->current_bss,
2986 wpa_s->current_ssid, 0);
2987 } else {
2988 if (wpa_s->sme.ext_ml_auth &&
2989 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
2990 status_code))
2991 return -1;
2992
2993 sme_external_auth_send_sae_confirm(wpa_s, sa);
2994 }
2995 return 0;
2996 } else if (auth_transaction == WLAN_AUTH_TR_SEQ_SAE_CONFIRM) {
2997 if (status_code != WLAN_STATUS_SUCCESS)
2998 return -1;
2999 wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
3000 if (wpa_s->sme.sae.state != SAE_CONFIRMED)
3001 return -1;
3002 if (sae_check_confirm(&wpa_s->sme.sae, data, len,
3003 ie_offset) < 0)
3004 return -1;
3005 if (external && wpa_s->sme.ext_ml_auth &&
3006 sme_external_ml_auth(wpa_s, data, len, *ie_offset,
3007 status_code))
3008 return -1;
3009
3010 wpa_s->sme.sae.state = SAE_ACCEPTED;
3011 sae_clear_temp_data(&wpa_s->sme.sae);
3012 wpa_s_clear_sae_rejected(wpa_s);
3013
3014 if (external) {
3015 const u8 *connected_addr = wpa_s->valid_links ?
3016 wpa_s->ap_mld_addr : wpa_s->bssid;
3017 const u8 *src = wpa_s->sme.ext_ml_auth ?
3018 wpa_s->sme.ext_auth_ap_mld_addr :
3019 wpa_s->sme.ext_auth_bssid;
3020
3021 wpa_s->ext_auth_to_same_bss =
3022 wpa_s->wpa_state > WPA_ASSOCIATED &&
3023 ether_addr_equal(src, connected_addr);
3024
3025 /* Report success to driver */
3026 sme_send_external_auth_status(wpa_s,
3027 WLAN_STATUS_SUCCESS);
3028 }
3029
3030 return 1;
3031 }
3032
3033 return -1;
3034 }
3035
3036
sme_sae_set_pmk(struct wpa_supplicant * wpa_s,const u8 * bssid)3037 static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
3038 {
3039 wpa_printf(MSG_DEBUG,
3040 "SME: SAE completed - setting PMK for 4-way handshake");
3041 wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
3042 wpa_s->sme.sae.pmkid, bssid);
3043 if (wpa_s->conf->sae_pmkid_in_assoc) {
3044 /* Update the own RSNE contents now that we have set the PMK
3045 * and added a PMKSA cache entry based on the successfully
3046 * completed SAE exchange. In practice, this will add the PMKID
3047 * into RSNE. */
3048 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
3049 sizeof(wpa_s->sme.assoc_req_ie)) {
3050 wpa_msg(wpa_s, MSG_WARNING,
3051 "RSN: Not enough room for inserting own PMKID into RSNE");
3052 return -1;
3053 }
3054 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
3055 &wpa_s->sme.assoc_req_ie_len,
3056 wpa_s->sme.sae.pmkid, true) < 0)
3057 return -1;
3058 wpa_hexdump(MSG_DEBUG,
3059 "SME: Updated Association Request IEs",
3060 wpa_s->sme.assoc_req_ie,
3061 wpa_s->sme.assoc_req_ie_len);
3062 }
3063
3064 return 0;
3065 }
3066
3067 #endif /* CONFIG_SAE */
3068
3069
3070 #ifdef CONFIG_ENC_ASSOC
sme_handle_eppke_unknown_password_id(struct wpa_supplicant * wpa_s,bool external)3071 static void sme_handle_eppke_unknown_password_id(struct wpa_supplicant *wpa_s,
3072 bool external)
3073 {
3074 struct wpa_ssid *ssid;
3075 const u8 *bssid;
3076
3077 ssid = external ? wpa_s->sme.ext_auth_wpa_ssid : wpa_s->current_ssid;
3078 bssid = external ? wpa_s->sme.ext_auth_bssid : wpa_s->pending_bssid;
3079
3080 if (ssid && ssid->alt_sae_password_ids &&
3081 ssid->alt_sae_passwords_ids_used) {
3082 wpa_printf(MSG_DEBUG,
3083 "EPPKE: Remove alternative password identifier (idx=%u) due to rejection",
3084 ssid->alt_sae_passwords_ids_idx);
3085 wpabuf_array_remove(ssid->alt_sae_password_ids,
3086 ssid->alt_sae_passwords_ids_idx);
3087
3088 #ifndef CONFIG_NO_CONFIG_WRITE
3089 if (wpa_s->conf->update_config &&
3090 wpa_config_write(wpa_s->confname, wpa_s->conf))
3091 wpa_printf(MSG_DEBUG,
3092 "EPPKE: Failed to update configuration");
3093 #endif /* CONFIG_NO_CONFIG_WRITE */
3094 }
3095
3096 wpa_msg(wpa_s, MSG_INFO,
3097 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
3098 MAC2STR(bssid));
3099
3100 if (external) {
3101 sme_send_external_auth_status(wpa_s,
3102 WLAN_STATUS_UNSPECIFIED_FAILURE);
3103 } else {
3104 wpas_connection_failed(wpa_s, bssid, NULL);
3105 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3106 }
3107 }
3108 #endif /* CONFIG_ENC_ASSOC */
3109
3110
sme_external_auth_mgmt_rx(struct wpa_supplicant * wpa_s,const u8 * auth_frame,size_t len)3111 void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
3112 const u8 *auth_frame, size_t len)
3113 {
3114 const struct ieee80211_mgmt *header;
3115 size_t auth_length;
3116
3117 header = (const struct ieee80211_mgmt *) auth_frame;
3118 auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
3119
3120 if (len < auth_length) {
3121 /* Notify failure to the driver */
3122 sme_send_external_auth_status(wpa_s,
3123 WLAN_STATUS_UNSPECIFIED_FAILURE);
3124 return;
3125 }
3126
3127 #ifdef CONFIG_SAE
3128 if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
3129 int res;
3130 int ie_offset = 0;
3131
3132 res = sme_sae_auth(
3133 wpa_s, le_to_host16(header->u.auth.auth_transaction),
3134 le_to_host16(header->u.auth.status_code),
3135 header->u.auth.variable,
3136 len - auth_length, 1, header->sa, &ie_offset);
3137 if (res < 0) {
3138 /* Notify failure to the driver */
3139 sme_send_external_auth_status(
3140 wpa_s,
3141 res == -2 ?
3142 le_to_host16(header->u.auth.status_code) :
3143 WLAN_STATUS_UNSPECIFIED_FAILURE);
3144 return;
3145 }
3146 if (res != 1)
3147 return;
3148
3149 if (sme_sae_set_pmk(wpa_s,
3150 wpa_s->sme.ext_ml_auth ?
3151 wpa_s->sme.ext_auth_ap_mld_addr :
3152 wpa_s->sme.ext_auth_bssid) < 0)
3153 return;
3154 #ifdef CONFIG_ENC_ASSOC
3155 } else if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_EPPKE) {
3156 int res;
3157 u16 status_code = le_to_host16(header->u.auth.status_code);
3158
3159 /*
3160 * Handle unknown password identifier rejection for EPPKE:
3161 * remove the rejected alternative password identifier and
3162 * report the event.
3163 */
3164 if (status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
3165 sme_handle_eppke_unknown_password_id(wpa_s, true);
3166 return;
3167 }
3168
3169 res = wpas_pasn_auth_rx(wpa_s, header, len);
3170 if (res < 0) {
3171 /* Notify failure to the driver */
3172 sme_send_external_auth_status(
3173 wpa_s,
3174 res == -2 ?
3175 status_code :
3176 WLAN_STATUS_UNSPECIFIED_FAILURE);
3177 return;
3178 }
3179 #endif /* CONFIG_ENC_ASSOC */
3180 #ifdef CONFIG_IEEE8021X_AUTH
3181 } else if (le_to_host16(header->u.auth.auth_alg) ==
3182 WLAN_AUTH_802_1X) {
3183 struct auth_info auth;
3184
3185 os_memset(&auth, 0, sizeof(auth));
3186 os_memcpy(auth.peer, header->sa, ETH_ALEN);
3187 auth.auth_type = le_to_host16(header->u.auth.auth_alg);
3188 auth.auth_transaction =
3189 le_to_host16(header->u.auth.auth_transaction);
3190 auth.status_code = le_to_host16(header->u.auth.status_code);
3191 auth.ies = header->u.auth.variable;
3192 auth.ies_len = len - auth_length;
3193 auth.frame_body = (const u8 *) &header->u.auth;
3194 auth.frame_body_len = len - IEEE80211_HDRLEN;
3195
3196 sme_process_802_1x_auth_response(wpa_s, &auth, true);
3197 return;
3198 #endif /* CONFIG_IEEE8021X_AUTH */
3199 }
3200 #endif /* CONFIG_SAE */
3201 }
3202
3203
sme_validate_basic_mle(const struct ieee802_11_elems * elems,const u8 * addr)3204 static int sme_validate_basic_mle(const struct ieee802_11_elems *elems,
3205 const u8 *addr)
3206 {
3207 const u8 *mld_addr;
3208
3209 if (!addr) {
3210 wpa_printf(MSG_DEBUG, "MLD: No peer address to check against");
3211 return -1;
3212 }
3213
3214 if (!elems->basic_mle || !elems->basic_mle_len) {
3215 wpa_printf(MSG_DEBUG, "MLD: No MLE in authentication");
3216 return -1;
3217 }
3218
3219 mld_addr = get_basic_mle_mld_addr(elems->basic_mle,
3220 elems->basic_mle_len);
3221 if (!mld_addr) {
3222 wpa_printf(MSG_DEBUG, "MLD: No MLD address in MLE");
3223 return -1;
3224 }
3225
3226 wpa_printf(MSG_DEBUG, "MLD: MLD MAC address=" MACSTR,
3227 MAC2STR(mld_addr));
3228
3229 if (!ether_addr_equal(addr, mld_addr)) {
3230 wpa_printf(MSG_DEBUG,
3231 "MLD: Unexpected MLD MAC address (expected " MACSTR
3232 ")", MAC2STR(addr));
3233 return -1;
3234 }
3235
3236 return 0;
3237 }
3238
3239
3240 #ifdef CONFIG_IEEE8021X_AUTH
3241
sme_validate_802_1x_auth_mic(struct wpa_supplicant * wpa_s,const u8 * frame_data,size_t frame_data_len,const struct wpa_ptk * ptk,bool external)3242 static int sme_validate_802_1x_auth_mic(struct wpa_supplicant *wpa_s,
3243 const u8 *frame_data,
3244 size_t frame_data_len,
3245 const struct wpa_ptk *ptk,
3246 bool external)
3247 {
3248 const u8 *aa = sme_get_peer_addr(wpa_s, external);
3249 const u8 *spa = wpa_s->own_addr;
3250 const u8 *ap_rsne, *ap_rsnxe, *mic_elem;
3251 size_t ap_rsne_len, ap_rsnxe_len, mic_len, data_len;
3252 int key_mgmt = sme_get_key_mgmt(wpa_s, external);
3253 u8 calc_mic[SHA384_MAC_LEN];
3254 u8 *data;
3255 u8 *pos;
3256 struct wpa_bss *bss;
3257 int ret = -1;
3258 size_t mic_field_off;
3259
3260 if (!ptk || !ptk->kck_len || !frame_data || !frame_data_len)
3261 return -1;
3262
3263 /* Get AP RSNE and RSNXE from Beacon/Probe Response frame */
3264 if (external)
3265 bss = wpa_bss_get_bssid(wpa_s, wpa_s->sme.ext_auth_bssid);
3266 else
3267 bss = wpa_bss_get_bssid(wpa_s, wpa_s->pending_bssid);
3268 if (!bss)
3269 return -1;
3270
3271 ap_rsne = wpa_bss_get_rsne(wpa_s, bss, wpa_s->current_ssid, false);
3272 ap_rsnxe = wpa_bss_get_rsnxe(wpa_s, bss, wpa_s->current_ssid, false);
3273 if (!ap_rsne || !ap_rsnxe)
3274 return -1;
3275
3276 ap_rsne_len = 2 + ap_rsne[1];
3277 ap_rsnxe_len = 2 + ap_rsnxe[1];
3278
3279 mic_elem = get_ie(frame_data, frame_data_len, WLAN_EID_MIC);
3280 if (!mic_elem) {
3281 wpa_msg(wpa_s, MSG_INFO,
3282 "IEEE 802.1X: No MIC element in Authentication frame");
3283 return -1;
3284 }
3285
3286 /* Determine MIC length based on key management */
3287 mic_len = wpa_key_mgmt_sha384(key_mgmt) ? 24 : 16;
3288 if (mic_elem[1] != mic_len) {
3289 wpa_msg(wpa_s, MSG_INFO,
3290 "IEEE 802.1X: MIC length mismatch (%u != %zu)",
3291 mic_elem[1], mic_len);
3292 return -1;
3293 }
3294
3295 /* Build data for MIC calculation:
3296 AA || SPA || AP RSNE || AP RSNXE || Frame Data */
3297 data_len = ETH_ALEN + ETH_ALEN + ap_rsne_len + ap_rsnxe_len +
3298 frame_data_len;
3299 data = os_malloc(data_len);
3300 if (!data)
3301 return -1;
3302
3303 pos = data;
3304 os_memcpy(pos, aa, ETH_ALEN);
3305 pos += ETH_ALEN;
3306 os_memcpy(pos, spa, ETH_ALEN);
3307 pos += ETH_ALEN;
3308 os_memcpy(pos, ap_rsne, ap_rsne_len);
3309 pos += ap_rsne_len;
3310 os_memcpy(pos, ap_rsnxe, ap_rsnxe_len);
3311 pos += ap_rsnxe_len;
3312 os_memcpy(pos, frame_data, frame_data_len);
3313
3314 /* Clear the MIC field */
3315 mic_field_off = (size_t) (mic_elem - frame_data) + 2;
3316 if (mic_field_off + mic_len > frame_data_len)
3317 goto out;
3318 os_memset(pos + mic_field_off, 0, mic_len);
3319
3320 /* Calculate MIC */
3321 if (wpa_key_mgmt_sha384(key_mgmt)) {
3322 if (hmac_sha384(ptk->kck, ptk->kck_len, data, data_len,
3323 calc_mic) < 0)
3324 goto out;
3325 } else {
3326 if (hmac_sha256(ptk->kck, ptk->kck_len, data, data_len,
3327 calc_mic) < 0)
3328 goto out;
3329 }
3330
3331 /* Verify MIC */
3332 if (os_memcmp_const(calc_mic, mic_elem + 2, mic_len) != 0) {
3333 wpa_msg(wpa_s, MSG_INFO,
3334 "IEEE 802.1X: Invalid MIC in Authentication frame");
3335 goto out;
3336 }
3337
3338 wpa_printf(MSG_DEBUG, "IEEE 802.1X: MIC verified successfully");
3339 ret = 0;
3340
3341 out:
3342 bin_clear_free(data, data_len);
3343 return ret;
3344 }
3345
3346
sme_validate_8021x_auth_elems(struct wpa_supplicant * wpa_s,const struct ieee802_11_elems * elems,struct wpabuf * pdu)3347 static int sme_validate_8021x_auth_elems(struct wpa_supplicant *wpa_s,
3348 const struct ieee802_11_elems *elems,
3349 struct wpabuf *pdu)
3350 {
3351 struct wpa_ie_data ie;
3352 u16 group;
3353
3354 if (!elems->rsn_ie || !elems->owe_dh || !elems->nonce ||
3355 elems->nonce_len != WPA_NONCE_LEN) {
3356 wpa_msg(wpa_s, MSG_INFO,
3357 "IEEE 802.1X: Missing required encryption elements (RSNE=%p, DH=%p, Nonce=%p)",
3358 elems->rsn_ie, elems->owe_dh, elems->nonce);
3359 return -1;
3360 }
3361
3362 if (wpa_parse_wpa_ie(elems->rsn_ie - 2, elems->rsn_ie_len + 2, &ie) < 0)
3363 {
3364 wpa_msg(wpa_s, MSG_INFO,
3365 "IEEE 802.1X: Failed to parse received RSNE");
3366 return -1;
3367 }
3368
3369 if (wpa_compare_rsne_params(wpa_s->auth_1x->rsne,
3370 wpa_s->auth_1x->rsne_len,
3371 elems->rsn_ie - 2,
3372 elems->rsn_ie_len + 2) != 0) {
3373 wpa_msg(wpa_s, MSG_INFO, "IEEE 802.1X: RSNE mismatch");
3374 return -1;
3375 }
3376
3377 if (wpa_s->auth_1x->pmksa_caching) {
3378 if (ie.num_pmkid) {
3379 if (pdu) {
3380 wpa_msg(wpa_s, MSG_INFO,
3381 "IEEE 802.1X: Unexpected EAPOL PDU with PMKID indicating PMKSA caching");
3382 return -1;
3383 }
3384
3385 if (ie.num_pmkid != 1) {
3386 wpa_msg(wpa_s, MSG_INFO,
3387 "IEEE 802.1X: Expected only one PMKID, got %u",
3388 (unsigned int) ie.num_pmkid);
3389 return -1;
3390 }
3391
3392 if (os_memcmp(ie.pmkid, wpa_s->auth_1x->pmkid,
3393 PMKID_LEN) != 0) {
3394 wpa_msg(wpa_s, MSG_INFO,
3395 "IEEE 802.1X: PMKID mismatch");
3396 return -1;
3397 }
3398 wpa_s->auth_1x->pmkid_found = true;
3399 } else if (!pdu) {
3400 wpa_msg(wpa_s, MSG_INFO,
3401 "IEEE 802.1X: Missing EAPOL PDU for fallback (no PMKID)");
3402 return -1;
3403 }
3404 }
3405
3406 if (elems->owe_dh_len < 2) {
3407 wpa_msg(wpa_s, MSG_INFO,
3408 "IEEE 802.1X: DH parameter too short (%u)",
3409 (unsigned int) elems->owe_dh_len);
3410 return -1;
3411 }
3412
3413 group = WPA_GET_LE16(elems->owe_dh);
3414 if (group != wpa_s->auth_1x->dh_group) {
3415 wpa_msg(wpa_s, MSG_INFO,
3416 "IEEE 802.1X: DH group mismatch (AP=%u, local=%u)",
3417 group, wpa_s->auth_1x->dh_group);
3418 return -1;
3419 }
3420
3421 wpa_s->auth_1x->dhss =
3422 crypto_ecdh_set_peerkey(wpa_s->auth_1x->ecdh, 1,
3423 elems->owe_dh + 2,
3424 elems->owe_dh_len - 2);
3425 if (!wpa_s->auth_1x->dhss) {
3426 wpa_msg(wpa_s, MSG_INFO,
3427 "IEEE 802.1X: Failed to compute DH shared secret");
3428 return -1;
3429 }
3430
3431 os_memcpy(wpa_s->auth_1x->anonce, elems->nonce, WPA_NONCE_LEN);
3432
3433 return 0;
3434 }
3435
3436
sme_add_802_1x_mic_in_assoc(struct wpa_supplicant * wpa_s,const u8 * aa)3437 static int sme_add_802_1x_mic_in_assoc(struct wpa_supplicant *wpa_s,
3438 const u8 *aa)
3439 {
3440 struct ptksa_cache_entry *ptk_entry;
3441 const u8 *rsne, *rsnxe;
3442 size_t rsne_len = 0, rsnxe_len = 0;
3443 u8 mic[SHA384_MAC_LEN];
3444 size_t mic_len = 0;
3445 const u8 *spa = wpa_s->own_addr;
3446 struct wpabuf *buf = NULL;
3447 int ret = -1;
3448 u8 *pos;
3449
3450 ptk_entry = ptksa_cache_get(wpa_s->ptksa, aa, wpa_s->pairwise_cipher);
3451 if (!ptk_entry || !ptk_entry->ptk.kck_len)
3452 return -1;
3453
3454 rsne = get_ie(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
3455 WLAN_EID_RSN);
3456 rsnxe = get_ie(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
3457 WLAN_EID_RSNX);
3458 if (!rsne || !rsnxe || rsne[1] == 0 || rsnxe[1] == 0)
3459 return -1;
3460
3461 rsne_len = 2 + rsne[1];
3462 rsnxe_len = 2 + rsnxe[1];
3463
3464 buf = wpabuf_alloc(2 * ETH_ALEN + rsne_len + rsnxe_len);
3465 if (!buf)
3466 return -1;
3467
3468 /* Data to MAC: AA || SPA || RSNE || RSNXE */
3469 wpabuf_put_data(buf, aa, ETH_ALEN);
3470 wpabuf_put_data(buf, spa, ETH_ALEN);
3471 wpabuf_put_data(buf, rsne, rsne_len);
3472 wpabuf_put_data(buf, rsnxe, rsnxe_len);
3473
3474 if (wpa_key_mgmt_sha384(wpa_s->key_mgmt)) {
3475 mic_len = SHA384_MAC_LEN / 2;
3476 if (hmac_sha384(ptk_entry->ptk.kck, ptk_entry->ptk.kck_len,
3477 wpabuf_head(buf), wpabuf_len(buf), mic) < 0)
3478 goto out;
3479 } else {
3480 mic_len = SHA256_MAC_LEN / 2;
3481 if (hmac_sha256(ptk_entry->ptk.kck, ptk_entry->ptk.kck_len,
3482 wpabuf_head(buf), wpabuf_len(buf), mic) < 0)
3483 goto out;
3484 }
3485
3486 /* Append MIC element to assoc_req_ie */
3487 if (wpa_s->sme.assoc_req_ie_len + 2 + mic_len >
3488 sizeof(wpa_s->sme.assoc_req_ie))
3489 goto out;
3490
3491 pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
3492 *pos++ = WLAN_EID_MIC;
3493 *pos++ = mic_len;
3494 os_memcpy(pos, mic, mic_len);
3495 wpa_s->sme.assoc_req_ie_len += 2 + mic_len;
3496 ret = 0;
3497
3498 out:
3499 wpabuf_free(buf);
3500 return ret;
3501 }
3502
3503
sme_parse_802_1x_auth_frame(struct wpa_supplicant * wpa_s,const u8 * ies,size_t ies_len,struct ieee802_11_elems * elems,struct wpabuf ** pdu)3504 static int sme_parse_802_1x_auth_frame(struct wpa_supplicant *wpa_s,
3505 const u8 *ies, size_t ies_len,
3506 struct ieee802_11_elems *elems,
3507 struct wpabuf **pdu)
3508 {
3509 const u8 *pos = ies, *end = ies + ies_len;
3510 u16 encap_len;
3511
3512 *pdu = NULL;
3513
3514 if (end - pos < 2) {
3515 wpa_msg(wpa_s, MSG_INFO,
3516 "IEEE 802.1X: Authentication frame too short for the Encapsulation Length field");
3517 return -1;
3518 }
3519
3520 encap_len = WPA_GET_LE16(pos);
3521 pos += 2;
3522
3523 if (encap_len) {
3524 if (end - pos < encap_len) {
3525 wpa_msg(wpa_s, MSG_INFO,
3526 "IEEE 802.1X: Encapsulated data exceeds frame length");
3527 return -1;
3528 }
3529
3530 *pdu = wpabuf_alloc_copy(pos, encap_len);
3531 if (!*pdu) {
3532 wpa_msg(wpa_s, MSG_INFO,
3533 "IEEE 802.1X: Failed to allocate EAPOL PDU buffer");
3534 return -1;
3535 }
3536
3537 pos += encap_len;
3538 }
3539
3540 if (ieee802_11_parse_elems(pos, end - pos, elems, 0) < 0) {
3541 wpa_msg(wpa_s, MSG_INFO,
3542 "IEEE 802.1X: Failed to parse Authentication frame elements");
3543 wpabuf_free(*pdu);
3544 *pdu = NULL;
3545 return -1;
3546 }
3547
3548 return 0;
3549 }
3550
3551
wpas_get_kdk_len(struct wpa_supplicant * wpa_s)3552 static size_t wpas_get_kdk_len(struct wpa_supplicant *wpa_s)
3553 {
3554 const u8 *rsnxe;
3555
3556 if (!(wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) ||
3557 !wpa_s->current_bss)
3558 return 0;
3559
3560 rsnxe = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_RSNX);
3561
3562 if (rsnxe && ieee802_11_rsnx_capab(rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF))
3563 return WPA_KDK_MAX_LEN;
3564
3565 return 0;
3566 }
3567
3568
sme_process_802_1x_auth_response(struct wpa_supplicant * wpa_s,struct auth_info * auth,bool external)3569 static void sme_process_802_1x_auth_response(struct wpa_supplicant *wpa_s,
3570 struct auth_info *auth,
3571 bool external)
3572 {
3573 struct ieee802_11_elems elems;
3574 struct wpabuf *pdu = NULL;
3575 bool validation_failed = false;
3576 const u8 *peer_addr = sme_get_peer_addr(wpa_s, external);
3577 int key_mgmt = sme_get_key_mgmt(wpa_s, external);
3578
3579 if (!wpa_s->auth_1x) {
3580 wpa_msg(wpa_s, MSG_INFO,
3581 "IEEE 802.1X: No authentication data, cannot process response");
3582 return;
3583 }
3584
3585 if (auth->status_code != WLAN_STATUS_SUCCESS &&
3586 auth->status_code != WLAN_STATUS_802_1_X_AUTH_SUCCESS) {
3587 wpa_msg(wpa_s, MSG_INFO,
3588 "IEEE 802.1X: Authentication failed (status=%u)",
3589 auth->status_code);
3590 goto fail;
3591 }
3592
3593 if (auth->auth_transaction != wpa_s->auth_1x->auth_trans + 1) {
3594 wpa_msg(wpa_s, MSG_INFO,
3595 "IEEE 802.1X: Unexpected transaction number (received=%u, expected=%u) - discard",
3596 auth->auth_transaction,
3597 wpa_s->auth_1x->auth_trans + 1);
3598 return;
3599 }
3600
3601 wpa_s->auth_1x->auth_trans = auth->auth_transaction;
3602
3603 if (sme_parse_802_1x_auth_frame(wpa_s, auth->ies, auth->ies_len, &elems,
3604 &pdu) < 0) {
3605 wpa_msg(wpa_s, MSG_INFO,
3606 "IEEE 802.1X: Failed to parse Authentication frame");
3607 return;
3608 }
3609
3610 if (sme_is_ml_auth(wpa_s, external) &&
3611 sme_validate_basic_mle(&elems, peer_addr) < 0) {
3612 validation_failed = true;
3613 goto cleanup;
3614 }
3615
3616 if (auth->auth_transaction == 2) {
3617 if (wpa_s->auth_1x->derive_ptk) {
3618 if (sme_validate_8021x_auth_elems(wpa_s, &elems, pdu) <
3619 0) {
3620 validation_failed = true;
3621 goto cleanup;
3622 }
3623
3624 /* Fall back to EAP handshake if PMKSA entry for caching
3625 * was not identified */
3626 if (wpa_s->auth_1x->pmksa_caching &&
3627 !wpa_s->auth_1x->pmkid_found) {
3628 eapol_sm_set_eap_over_auth_frame(wpa_s->eapol,
3629 true);
3630 eapol_sm_notify_portEnabled(wpa_s->eapol, true);
3631 wpa_s->auth_1x->pmksa_caching = false;
3632 }
3633 } else if (!elems.akm_suite_selector ||
3634 elems.akm_suite_selector_len != 4 ||
3635 WPA_GET_BE32(elems.akm_suite_selector) !=
3636 wpa_akm_to_suite(key_mgmt)) {
3637 wpa_msg(wpa_s, MSG_INFO,
3638 "IEEE 802.1X: Invalid/missing AKM Suite Selector");
3639 wpa_s->auth_1x->status = WLAN_STATUS_INVALID_AKMP;
3640 if (external) {
3641 sme_external_auth_send_802_1x(
3642 wpa_s, wpa_s->sme.ext_auth_wpa_ssid, 0);
3643 goto cleanup;
3644 }
3645 sme_send_authentication(wpa_s, wpa_s->current_bss,
3646 wpa_s->current_ssid, 0);
3647 goto cleanup;
3648 }
3649 }
3650
3651 if (wpa_s->auth_1x->pmksa_caching &&
3652 auth->status_code != WLAN_STATUS_SUCCESS) {
3653 wpa_msg(wpa_s, MSG_INFO,
3654 "IEEE 802.1X: PMKSA caching failed (status=%u)",
3655 auth->status_code);
3656 goto fail;
3657 }
3658
3659 if (!wpa_s->auth_1x->pmkid_found) {
3660 if (!pdu) {
3661 wpa_msg(wpa_s, MSG_INFO,
3662 "IEEE 802.1X: Missing EAPOL PDU");
3663 goto fail;
3664 }
3665
3666 eapol_sm_rx_eapol(wpa_s->eapol, peer_addr,
3667 wpabuf_head(pdu), wpabuf_len(pdu),
3668 FRAME_ENCRYPTION_UNKNOWN);
3669
3670 if (eapol_sm_get_failure(wpa_s->eapol)) {
3671 wpa_msg(wpa_s, MSG_INFO,
3672 "IEEE 802.1X: EAP authentication failed");
3673 goto fail;
3674 }
3675
3676 if (eapol_sm_get_success(wpa_s->eapol) &&
3677 auth->status_code != WLAN_STATUS_802_1_X_AUTH_SUCCESS) {
3678 wpa_msg(wpa_s, MSG_INFO,
3679 "IEEE 802.1X: Invalid status code in EAP-Success authentication frame");
3680 goto fail;
3681 }
3682 }
3683
3684 if (auth->status_code == WLAN_STATUS_802_1_X_AUTH_SUCCESS ||
3685 wpa_s->auth_1x->pmkid_found) {
3686 if (wpa_s->auth_1x->derive_ptk) {
3687 struct wpa_ptk ptk;
3688 const u8 *pmk;
3689 size_t pmk_len;
3690 size_t kdk_len;
3691 static const u8 zero[6] = { 0 };
3692 enum wpa_alg alg;
3693 int pairwise_cipher;
3694
3695 pairwise_cipher = sme_get_pairwise_cipher(wpa_s,
3696 external);
3697 pmk = wpa_sm_get_pmk(wpa_s->wpa, peer_addr,
3698 wpa_s->auth_1x->pmkid_found ?
3699 wpa_s->auth_1x->pmkid :
3700 NULL, &pmk_len);
3701 if (!pmk) {
3702 wpa_msg(wpa_s, MSG_INFO,
3703 "IEEE 802.1X: Failed to get PMK");
3704 goto fail;
3705 }
3706
3707 kdk_len = wpas_get_kdk_len(wpa_s);
3708
3709 if (!wpa_s->auth_1x->dhss ||
3710 wpa_auth_802_1x_pmk_to_ptk(
3711 pmk, pmk_len, wpa_s->own_addr, peer_addr,
3712 wpa_s->auth_1x->snonce,
3713 wpa_s->auth_1x->anonce,
3714 key_mgmt, pairwise_cipher,
3715 wpabuf_head(wpa_s->auth_1x->dhss),
3716 wpabuf_len(wpa_s->auth_1x->dhss),
3717 &ptk, kdk_len) < 0) {
3718 wpa_msg(wpa_s, MSG_INFO,
3719 "SME: PTK derivation failed");
3720 goto fail;
3721 }
3722
3723 /* Clear DHss after successful PTK derivation */
3724 wpabuf_clear_free(wpa_s->auth_1x->dhss);
3725 wpa_s->auth_1x->dhss = NULL;
3726
3727 if (sme_validate_802_1x_auth_mic(
3728 wpa_s, auth->frame_body,
3729 auth->frame_body_len, &ptk,
3730 external) < 0) {
3731 wpa_msg(wpa_s, MSG_INFO,
3732 "IEEE 802.1X: MIC validation failed");
3733 forced_memzero(&ptk, sizeof(ptk));
3734 goto fail;
3735 }
3736
3737 alg = wpa_cipher_to_alg(pairwise_cipher);
3738 if (wpa_drv_set_key(wpa_s, -1, alg, peer_addr, 0, 1,
3739 zero, sizeof(zero),
3740 ptk.tk, ptk.tk_len,
3741 KEY_FLAG_PAIRWISE_RX_TX) < 0) {
3742 wpa_msg(wpa_s, MSG_INFO,
3743 "IEEE 802.1X: TK configuration failed");
3744 forced_memzero(&ptk, sizeof(ptk));
3745 goto fail;
3746 }
3747
3748 ptksa_cache_add(wpa_s->ptksa, wpa_s->own_addr,
3749 peer_addr, pairwise_cipher,
3750 dot11RSNAConfigPMKLifetime, &ptk, NULL,
3751 NULL, key_mgmt,
3752 WLAN_AUTH_802_1X);
3753
3754 forced_memzero(&ptk, sizeof(ptk));
3755 }
3756
3757 wpa_msg(wpa_s, MSG_INFO,
3758 "IEEE 802.1X: Authentication successful");
3759
3760 eapol_sm_set_eap_over_auth_frame(wpa_s->eapol, false);
3761
3762 if (external) {
3763 sme_send_external_auth_status(wpa_s,
3764 WLAN_STATUS_SUCCESS);
3765 sme_802_1x_auth_data_free(wpa_s);
3766 goto cleanup;
3767 }
3768 sme_associate(wpa_s, wpa_s->current_ssid->mode,
3769 auth->peer, auth->auth_type);
3770 sme_802_1x_auth_data_free(wpa_s);
3771 goto cleanup;
3772 }
3773
3774 if (auth->status_code == WLAN_STATUS_SUCCESS) {
3775 wpa_printf(MSG_DEBUG,
3776 "IEEE 802.1X: Authentication in progress, sending next frame");
3777 if (external) {
3778 sme_external_auth_send_802_1x(
3779 wpa_s, wpa_s->sme.ext_auth_wpa_ssid, 0);
3780 goto cleanup;
3781 }
3782 sme_send_authentication(wpa_s, wpa_s->current_bss,
3783 wpa_s->current_ssid, 0);
3784 goto cleanup;
3785 }
3786
3787 fail:
3788 wpa_msg(wpa_s, MSG_INFO, "IEEE 802.1X: Authentication failed");
3789 validation_failed = true;
3790
3791 cleanup:
3792 wpabuf_free(pdu);
3793
3794 if (validation_failed) {
3795 sme_802_1x_auth_data_free(wpa_s);
3796 if (external)
3797 sme_send_external_auth_status(
3798 wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
3799 else {
3800 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
3801 NULL);
3802 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3803 }
3804 }
3805 }
3806
3807 #endif /* CONFIG_IEEE8021X_AUTH */
3808
3809
sme_event_auth(struct wpa_supplicant * wpa_s,union wpa_event_data * data)3810 void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
3811 {
3812 struct wpa_ssid *ssid = wpa_s->current_ssid;
3813 int ie_offset = 0;
3814
3815 if (ssid == NULL) {
3816 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
3817 "when network is not selected");
3818 return;
3819 }
3820
3821 if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
3822 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
3823 "when not in authenticating state");
3824 return;
3825 }
3826
3827 if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
3828 !(wpa_s->valid_links &&
3829 ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
3830 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
3831 "unexpected peer " MACSTR,
3832 MAC2STR(data->auth.peer));
3833 return;
3834 }
3835
3836 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
3837 " auth_type=%d auth_transaction=%d status_code=%d",
3838 MAC2STR(data->auth.peer), data->auth.auth_type,
3839 data->auth.auth_transaction, data->auth.status_code);
3840 wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
3841 data->auth.ies, data->auth.ies_len);
3842
3843 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
3844
3845 #ifdef CONFIG_IEEE8021X_AUTH
3846 if (data->auth.auth_type == WLAN_AUTH_802_1X) {
3847 sme_process_802_1x_auth_response(wpa_s, &data->auth, false);
3848 return;
3849 }
3850 #endif /* CONFIG_IEEE8021X_AUTH */
3851
3852 #ifdef CONFIG_ENC_ASSOC
3853 if (data->auth.auth_type == WLAN_AUTH_EPPKE) {
3854 struct pasn_data *pasn = &wpa_s->pasn;
3855 struct wpa_pasn_params_data pasn_params;
3856 int res;
3857 enum wpa_alg alg;
3858 struct ptksa_cache_entry *entry;
3859
3860 /*
3861 * Handle unknown password identifier rejection for EPPKE:
3862 * remove the rejected alternative password identifier and
3863 * report the event.
3864 */
3865 if (data->auth.status_code ==
3866 WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
3867 sme_handle_eppke_unknown_password_id(wpa_s, false);
3868 return;
3869 }
3870
3871 res = wpas_parse_pasn_frame(pasn, data->auth.auth_type,
3872 data->auth.auth_transaction,
3873 data->auth.status_code,
3874 data->auth.ies, data->auth.ies_len,
3875 &pasn_params);
3876 if (res < 0) {
3877 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
3878 NULL);
3879 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3880 return;
3881 }
3882
3883 /*
3884 * TODO: Add support for comeback if AP rejected group
3885 * negotiation temporarily.
3886 */
3887
3888 /*
3889 * AP rejected the proposed group; retry with the
3890 * next valid group.
3891 */
3892 if (res == 2) {
3893 struct wpa_bss *bss = wpa_s->current_bss;
3894
3895 if (!bss) {
3896 bss = wpa_bss_get_bssid_latest(
3897 wpa_s, wpa_s->pending_bssid);
3898 if (!bss) {
3899 wpas_connection_failed(
3900 wpa_s, wpa_s->pending_bssid,
3901 NULL);
3902 wpa_supplicant_mark_disassoc(wpa_s);
3903 return;
3904 }
3905 }
3906
3907 wpa_printf(MSG_DEBUG,
3908 "EPPKE: Group %u rejected by AP - retrying with next group",
3909 pasn->group);
3910 wpas_connect_work_done(wpa_s);
3911 wpa_supplicant_mark_disassoc(wpa_s);
3912 wpa_supplicant_connect(wpa_s, bss, ssid);
3913 return;
3914 }
3915
3916 ptksa_cache_add(wpa_s->ptksa, pasn->own_addr, pasn->peer_addr,
3917 pasn_get_cipher(pasn),
3918 dot11RSNAConfigPMKLifetime,
3919 pasn_get_ptk(pasn), NULL, NULL,
3920 pasn_get_akmp(pasn), pasn->auth_alg);
3921
3922 if (pasn->pmksa_entry)
3923 wpa_sm_set_cur_pmksa(wpa_s->wpa, pasn->pmksa_entry);
3924 wpa_sm_set_pmk(wpa_s->wpa, pasn->pmk, pasn->pmk_len,
3925 pasn->sae.pmkid, NULL);
3926
3927 sme_send_authentication(wpa_s, wpa_s->current_bss,
3928 wpa_s->current_ssid, 0);
3929
3930 if (wpa_s->conf->sae_pmkid_in_assoc) {
3931 if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
3932 sizeof(wpa_s->sme.assoc_req_ie)) {
3933 wpa_msg(wpa_s, MSG_WARNING,
3934 "RSN: Not enough room for inserting own PMKID into RSNE");
3935 return;
3936 }
3937 if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
3938 &wpa_s->sme.assoc_req_ie_len,
3939 pasn->sae.pmkid, true) < 0)
3940 return;
3941 }
3942
3943 alg = wpa_cipher_to_alg(pasn_get_cipher(pasn));
3944 entry = ptksa_cache_get(wpa_s->ptksa, pasn->peer_addr,
3945 pasn_get_cipher(pasn));
3946 if (!entry) {
3947 wpa_printf(MSG_INFO,
3948 "EPPKE: No PTKSA found to configure TK");
3949 return;
3950 }
3951
3952 wpa_drv_set_key(wpa_s, -1, alg, pasn->peer_addr, 0, 1,
3953 NULL, 0, entry->ptk.tk, entry->ptk.tk_len,
3954 KEY_FLAG_PAIRWISE_RX_TX);
3955 }
3956 #endif /* CONFIG_ENC_ASSOC */
3957
3958 #ifdef CONFIG_SAE
3959 if (data->auth.auth_type == WLAN_AUTH_SAE) {
3960 const u8 *addr = wpa_s->pending_bssid;
3961 int res;
3962
3963 res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
3964 data->auth.status_code, data->auth.ies,
3965 data->auth.ies_len, 0, data->auth.peer,
3966 &ie_offset);
3967 if (res < 0) {
3968 if (data->auth.auth_transaction ==
3969 WLAN_AUTH_TR_SEQ_SAE_CONFIRM &&
3970 data->auth.status_code ==
3971 WLAN_STATUS_CHALLENGE_FAIL)
3972 wpas_notify_sae_password_mismatch(wpa_s);
3973 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
3974 NULL);
3975 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3976
3977 if (wpa_s->sme.sae_rejected_groups &&
3978 ssid->disabled_until.sec) {
3979 wpa_printf(MSG_DEBUG,
3980 "SME: Clear SAE state with rejected groups due to continuous failures");
3981 wpa_s_clear_sae_rejected(wpa_s);
3982 }
3983 }
3984 if (res != 1)
3985 return;
3986
3987 if (wpa_s->valid_links)
3988 addr = wpa_s->ap_mld_addr;
3989
3990 if (sme_sae_set_pmk(wpa_s, addr) < 0)
3991 return;
3992 }
3993 #endif /* CONFIG_SAE */
3994
3995 if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
3996 char *ie_txt = NULL;
3997
3998 if (data->auth.ies && data->auth.ies_len) {
3999 size_t buflen = 2 * data->auth.ies_len + 1;
4000 ie_txt = os_malloc(buflen);
4001 if (ie_txt) {
4002 wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
4003 data->auth.ies_len);
4004 }
4005 }
4006 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
4007 " auth_type=%u auth_transaction=%u status_code=%u%s%s",
4008 MAC2STR(data->auth.peer), data->auth.auth_type,
4009 data->auth.auth_transaction, data->auth.status_code,
4010 ie_txt ? " ie=" : "",
4011 ie_txt ? ie_txt : "");
4012 os_free(ie_txt);
4013
4014 #ifdef CONFIG_FILS
4015 if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
4016 wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
4017 fils_connection_failure(wpa_s);
4018 #endif /* CONFIG_FILS */
4019
4020 if (data->auth.status_code !=
4021 WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
4022 wpa_s->sme.auth_alg == data->auth.auth_type ||
4023 wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
4024 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
4025 NULL);
4026 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4027 return;
4028 }
4029
4030 wpas_connect_work_done(wpa_s);
4031
4032 switch (data->auth.auth_type) {
4033 case WLAN_AUTH_OPEN:
4034 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
4035
4036 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
4037 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
4038 wpa_s->current_ssid);
4039 return;
4040
4041 case WLAN_AUTH_SHARED_KEY:
4042 wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
4043
4044 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
4045 wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
4046 wpa_s->current_ssid);
4047 return;
4048
4049 default:
4050 return;
4051 }
4052 }
4053
4054 #ifdef CONFIG_IEEE80211R
4055 if (data->auth.auth_type == WLAN_AUTH_FT) {
4056 const u8 *ric_ies = NULL;
4057 size_t ric_ies_len = 0;
4058
4059 if (wpa_s->ric_ies) {
4060 ric_ies = wpabuf_head(wpa_s->ric_ies);
4061 ric_ies_len = wpabuf_len(wpa_s->ric_ies);
4062 }
4063 if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
4064 data->auth.ies_len, 0,
4065 data->auth.peer,
4066 ric_ies, ric_ies_len) < 0) {
4067 wpa_dbg(wpa_s, MSG_DEBUG,
4068 "SME: FT Authentication response processing failed");
4069 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
4070 MACSTR
4071 " reason=%d locally_generated=1",
4072 MAC2STR(wpa_s->pending_bssid),
4073 WLAN_REASON_DEAUTH_LEAVING);
4074 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
4075 NULL);
4076 wpa_supplicant_mark_disassoc(wpa_s);
4077 return;
4078 }
4079 }
4080 #endif /* CONFIG_IEEE80211R */
4081
4082 #ifdef CONFIG_FILS
4083 if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
4084 data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
4085 u16 expect_auth_type;
4086
4087 expect_auth_type = wpa_s->sme.auth_alg ==
4088 WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
4089 WLAN_AUTH_FILS_SK;
4090 if (data->auth.auth_type != expect_auth_type) {
4091 wpa_dbg(wpa_s, MSG_DEBUG,
4092 "SME: FILS Authentication response used different auth alg (%u; expected %u)",
4093 data->auth.auth_type, expect_auth_type);
4094 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
4095 MACSTR
4096 " reason=%d locally_generated=1",
4097 MAC2STR(wpa_s->pending_bssid),
4098 WLAN_REASON_DEAUTH_LEAVING);
4099 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
4100 NULL);
4101 wpa_supplicant_mark_disassoc(wpa_s);
4102 return;
4103 }
4104
4105 if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
4106 data->auth.ies, data->auth.ies_len) < 0) {
4107 wpa_dbg(wpa_s, MSG_DEBUG,
4108 "SME: FILS Authentication response processing failed");
4109 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
4110 MACSTR
4111 " reason=%d locally_generated=1",
4112 MAC2STR(wpa_s->pending_bssid),
4113 WLAN_REASON_DEAUTH_LEAVING);
4114 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
4115 NULL);
4116 wpa_supplicant_mark_disassoc(wpa_s);
4117 return;
4118 }
4119 }
4120 #endif /* CONFIG_FILS */
4121
4122 /* TODO: Support additional auth_type values as well */
4123 if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
4124 data->auth.auth_type == WLAN_AUTH_SAE) &&
4125 wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
4126 wpa_dbg(wpa_s, MSG_DEBUG,
4127 "MLD: Failed to parse ML Authentication frame");
4128 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
4129 " reason=%d locally_generated=1",
4130 MAC2STR(wpa_s->pending_bssid),
4131 WLAN_REASON_DEAUTH_LEAVING);
4132 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
4133 wpa_supplicant_deauthenticate(wpa_s,
4134 WLAN_REASON_DEAUTH_LEAVING);
4135 wpa_printf(MSG_DEBUG,
4136 "MLD: Authentication - clearing MLD state");
4137 wpas_reset_mlo_info(wpa_s);
4138 return;
4139 }
4140
4141 sme_associate(wpa_s, ssid->mode, data->auth.peer,
4142 data->auth.auth_type);
4143 }
4144
4145
4146 #ifdef CONFIG_IEEE80211R
remove_ie(u8 * buf,size_t * len,u8 eid)4147 static void remove_ie(u8 *buf, size_t *len, u8 eid)
4148 {
4149 u8 *pos, *next, *end;
4150
4151 pos = (u8 *) get_ie(buf, *len, eid);
4152 if (pos) {
4153 next = pos + 2 + pos[1];
4154 end = buf + *len;
4155 *len -= 2 + pos[1];
4156 os_memmove(pos, next, end - next);
4157 }
4158 }
4159 #endif /* CONFIG_IEEE80211R */
4160
4161
sme_associate(struct wpa_supplicant * wpa_s,enum wpas_mode mode,const u8 * bssid,u16 auth_type)4162 void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
4163 const u8 *bssid, u16 auth_type)
4164 {
4165 struct wpa_driver_associate_params params;
4166 struct ieee802_11_elems elems;
4167 struct wpa_ssid *ssid = wpa_s->current_ssid;
4168 #ifdef CONFIG_FILS
4169 u8 nonces[2 * NONCE_LEN];
4170 #endif /* CONFIG_FILS */
4171 #ifdef CONFIG_HT_OVERRIDES
4172 struct ieee80211_ht_capabilities htcaps;
4173 struct ieee80211_ht_capabilities htcaps_mask;
4174 #endif /* CONFIG_HT_OVERRIDES */
4175 #ifdef CONFIG_VHT_OVERRIDES
4176 struct ieee80211_vht_capabilities vhtcaps;
4177 struct ieee80211_vht_capabilities vhtcaps_mask;
4178 #endif /* CONFIG_VHT_OVERRIDES */
4179 #ifdef CONFIG_PMKSA_PRIVACY
4180 const u8 *ap_rsnxe;
4181 #endif /* CONFIG_PMKSA_PRIVACY */
4182
4183 os_memset(¶ms, 0, sizeof(params));
4184
4185 /* Save auth type, in case we need to retry after comeback timer. */
4186 wpa_s->sme.assoc_auth_type = auth_type;
4187
4188 #ifdef CONFIG_FILS
4189 if (auth_type == WLAN_AUTH_FILS_SK ||
4190 auth_type == WLAN_AUTH_FILS_SK_PFS) {
4191 struct wpabuf *buf;
4192 const u8 *snonce, *anonce;
4193 const unsigned int max_hlp = 20;
4194 struct wpabuf *hlp[max_hlp];
4195 unsigned int i, num_hlp = 0;
4196 struct fils_hlp_req *req;
4197
4198 dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
4199 list) {
4200 hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
4201 wpabuf_len(req->pkt));
4202 if (!hlp[num_hlp])
4203 break;
4204 wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
4205 wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
4206 ETH_ALEN);
4207 wpabuf_put_data(hlp[num_hlp],
4208 "\xaa\xaa\x03\x00\x00\x00", 6);
4209 wpabuf_put_buf(hlp[num_hlp], req->pkt);
4210 num_hlp++;
4211 if (num_hlp >= max_hlp)
4212 break;
4213 }
4214
4215 buf = fils_build_assoc_req(wpa_s->wpa, ¶ms.fils_kek,
4216 ¶ms.fils_kek_len, &snonce,
4217 &anonce,
4218 (const struct wpabuf **) hlp,
4219 num_hlp);
4220 for (i = 0; i < num_hlp; i++)
4221 wpabuf_free(hlp[i]);
4222 if (!buf)
4223 return;
4224 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
4225 wpa_s->sme.assoc_req_ie,
4226 wpa_s->sme.assoc_req_ie_len);
4227 #ifdef CONFIG_IEEE80211R
4228 if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
4229 /* Remove RSNE and MDE to allow them to be overridden
4230 * with FILS+FT specific values from
4231 * fils_build_assoc_req(). */
4232 remove_ie(wpa_s->sme.assoc_req_ie,
4233 &wpa_s->sme.assoc_req_ie_len,
4234 WLAN_EID_RSN);
4235 wpa_hexdump(MSG_DEBUG,
4236 "FILS: assoc_req after RSNE removal",
4237 wpa_s->sme.assoc_req_ie,
4238 wpa_s->sme.assoc_req_ie_len);
4239 remove_ie(wpa_s->sme.assoc_req_ie,
4240 &wpa_s->sme.assoc_req_ie_len,
4241 WLAN_EID_MOBILITY_DOMAIN);
4242 wpa_hexdump(MSG_DEBUG,
4243 "FILS: assoc_req after MDE removal",
4244 wpa_s->sme.assoc_req_ie,
4245 wpa_s->sme.assoc_req_ie_len);
4246 }
4247 #endif /* CONFIG_IEEE80211R */
4248 /* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
4249 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
4250 sizeof(wpa_s->sme.assoc_req_ie)) {
4251 wpa_printf(MSG_ERROR,
4252 "FILS: Not enough buffer room for own AssocReq elements");
4253 wpabuf_free(buf);
4254 return;
4255 }
4256 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
4257 wpabuf_head(buf), wpabuf_len(buf));
4258 wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
4259 wpabuf_free(buf);
4260 wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
4261 wpa_s->sme.assoc_req_ie,
4262 wpa_s->sme.assoc_req_ie_len);
4263
4264 os_memcpy(nonces, snonce, NONCE_LEN);
4265 os_memcpy(nonces + NONCE_LEN, anonce, NONCE_LEN);
4266 params.fils_nonces = nonces;
4267 params.fils_nonces_len = sizeof(nonces);
4268 }
4269 #endif /* CONFIG_FILS */
4270
4271 #ifdef CONFIG_OWE
4272 #ifdef CONFIG_TESTING_OPTIONS
4273 if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
4274 WLAN_EID_EXT_OWE_DH_PARAM)) {
4275 wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
4276 } else
4277 #endif /* CONFIG_TESTING_OPTIONS */
4278 if (auth_type == WLAN_AUTH_OPEN &&
4279 wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
4280 struct wpabuf *owe_ie;
4281 u16 group;
4282
4283 if (ssid && ssid->owe_group) {
4284 group = ssid->owe_group;
4285 } else if (wpa_s->assoc_status_code ==
4286 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
4287 if (wpa_s->last_owe_group == 19)
4288 group = 20;
4289 else if (wpa_s->last_owe_group == 20)
4290 group = 21;
4291 else
4292 group = OWE_DH_GROUP;
4293 } else {
4294 group = OWE_DH_GROUP;
4295 }
4296
4297 wpa_s->last_owe_group = group;
4298 wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
4299 owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
4300 if (!owe_ie) {
4301 wpa_printf(MSG_ERROR,
4302 "OWE: Failed to build IE for Association Request frame");
4303 return;
4304 }
4305 if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
4306 sizeof(wpa_s->sme.assoc_req_ie)) {
4307 wpa_printf(MSG_ERROR,
4308 "OWE: Not enough buffer room for own Association Request frame elements");
4309 wpabuf_free(owe_ie);
4310 return;
4311 }
4312 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
4313 wpabuf_head(owe_ie), wpabuf_len(owe_ie));
4314 wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
4315 wpabuf_free(owe_ie);
4316 }
4317 #endif /* CONFIG_OWE */
4318
4319 #ifdef CONFIG_DPP2
4320 if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
4321 ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
4322 !ssid->dpp_pfs_fallback) {
4323 struct rsn_pmksa_cache_entry *pmksa;
4324
4325 pmksa = pmksa_cache_get_current(wpa_s->wpa);
4326 if (!pmksa || !pmksa->dpp_pfs)
4327 goto pfs_fail;
4328
4329 dpp_pfs_free(wpa_s->dpp_pfs);
4330 wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
4331 ssid->dpp_netaccesskey_len);
4332 if (!wpa_s->dpp_pfs) {
4333 wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
4334 /* Try to continue without PFS */
4335 goto pfs_fail;
4336 }
4337 if (wpa_s->sme.assoc_req_ie_len +
4338 wpabuf_len(wpa_s->dpp_pfs->ie) >
4339 sizeof(wpa_s->sme.assoc_req_ie)) {
4340 wpa_printf(MSG_ERROR,
4341 "DPP: Not enough buffer room for own Association Request frame elements");
4342 dpp_pfs_free(wpa_s->dpp_pfs);
4343 wpa_s->dpp_pfs = NULL;
4344 goto pfs_fail;
4345 }
4346 os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
4347 wpabuf_head(wpa_s->dpp_pfs->ie),
4348 wpabuf_len(wpa_s->dpp_pfs->ie));
4349 wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
4350 }
4351 pfs_fail:
4352 #endif /* CONFIG_DPP2 */
4353
4354 #ifndef CONFIG_NO_ROBUST_AV
4355 wpa_s->mscs_setup_done = false;
4356 if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
4357 wpa_s->robust_av.valid_config) {
4358 struct wpabuf *mscs_ie;
4359 size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
4360
4361 buf_len = 3 + /* MSCS descriptor IE header */
4362 1 + /* Request type */
4363 2 + /* User priority control */
4364 4 + /* Stream timeout */
4365 3 + /* TCLAS Mask IE header */
4366 wpa_s->robust_av.frame_classifier_len;
4367 mscs_ie = wpabuf_alloc(buf_len);
4368 if (!mscs_ie) {
4369 wpa_printf(MSG_INFO,
4370 "MSCS: Failed to allocate MSCS IE");
4371 goto mscs_fail;
4372 }
4373
4374 wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
4375 max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
4376 wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
4377 if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
4378 wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
4379 mscs_ie_len = wpabuf_len(mscs_ie);
4380 os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
4381 wpabuf_head(mscs_ie), mscs_ie_len);
4382 *wpa_ie_len += mscs_ie_len;
4383 }
4384
4385 wpabuf_free(mscs_ie);
4386 }
4387 mscs_fail:
4388 #endif /* CONFIG_NO_ROBUST_AV */
4389
4390 wpa_s->sme.assoc_req_ie_len =
4391 wpas_populate_wfa_capa(wpa_s, wpa_s->current_bss,
4392 wpa_s->sme.assoc_req_ie,
4393 wpa_s->sme.assoc_req_ie_len,
4394 sizeof(wpa_s->sme.assoc_req_ie));
4395
4396 if (ssid && ssid->multi_ap_backhaul_sta) {
4397 size_t multi_ap_ie_len;
4398 struct multi_ap_params multi_ap = { 0 };
4399
4400 multi_ap.capability = MULTI_AP_BACKHAUL_STA;
4401 multi_ap.profile = ssid->multi_ap_profile;
4402
4403 multi_ap_ie_len = add_multi_ap_ie(
4404 wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
4405 sizeof(wpa_s->sme.assoc_req_ie) -
4406 wpa_s->sme.assoc_req_ie_len,
4407 &multi_ap);
4408 if (multi_ap_ie_len == 0) {
4409 wpa_printf(MSG_ERROR,
4410 "Multi-AP: Failed to build Multi-AP IE");
4411 return;
4412 }
4413 wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
4414 }
4415
4416 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE_SUPPORT,
4417 wpas_rsn_overriding(wpa_s, ssid));
4418 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
4419 RSN_OVERRIDE_NOT_USED);
4420 if (wpas_rsn_overriding(wpa_s, ssid) &&
4421 wpas_ap_supports_rsn_overriding(wpa_s, wpa_s->current_bss) &&
4422 wpa_s->sme.assoc_req_ie_len + 2 + 4 <=
4423 sizeof(wpa_s->sme.assoc_req_ie)) {
4424 u8 *pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
4425 const u8 *ie;
4426 enum rsn_selection_variant variant = RSN_SELECTION_RSNE;
4427
4428 wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_OVERRIDE,
4429 RSN_OVERRIDE_RSNE);
4430 ie = wpa_bss_get_rsne(wpa_s, wpa_s->current_bss, ssid,
4431 wpa_s->valid_links);
4432 if (ie && ie[0] == WLAN_EID_VENDOR_SPECIFIC && ie[1] >= 4) {
4433 u32 type;
4434
4435 type = WPA_GET_BE32(&ie[2]);
4436 if (type == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
4437 variant = RSN_SELECTION_RSNE_OVERRIDE;
4438 wpa_sm_set_param(wpa_s->wpa,
4439 WPA_PARAM_RSN_OVERRIDE,
4440 RSN_OVERRIDE_RSNE_OVERRIDE);
4441 } else if (type == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
4442 variant = RSN_SELECTION_RSNE_OVERRIDE_2;
4443 wpa_sm_set_param(wpa_s->wpa,
4444 WPA_PARAM_RSN_OVERRIDE,
4445 RSN_OVERRIDE_RSNE_OVERRIDE_2);
4446 }
4447 }
4448
4449 /* Indicate which RSNE variant was used */
4450 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
4451 *pos++ = 4 + 1;
4452 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
4453 pos += 4;
4454 *pos = variant;
4455 wpa_s->sme.assoc_req_ie_len += 2 + 4 + 1;
4456 }
4457
4458 #ifdef CONFIG_PMKSA_PRIVACY
4459 ap_rsnxe = wpa_bss_get_rsnxe(wpa_s, wpa_s->current_bss,
4460 NULL, wpa_s->valid_links);
4461 if (ssid->pmksa_privacy &&
4462 (wpa_s->drv_flags2 &
4463 WPA_DRIVER_FLAGS2_ASSOCIATION_FRAME_ENCRYPTION) &&
4464 ieee802_11_rsnx_capab(ap_rsnxe,
4465 WLAN_RSNX_CAPAB_PMKSA_CACHING_PRIVACY)) {
4466 size_t len = 3 + NONCE_LEN;
4467 u8 *pos;
4468
4469 if (wpa_s->sme.assoc_req_ie_len + len >
4470 sizeof(wpa_s->sme.assoc_req_ie)) {
4471 wpa_printf(MSG_INFO,
4472 "PMKID privacy: AssocReq IE buffer too small for SNonce");
4473 return;
4474 }
4475
4476 if (os_get_random(wpa_s->pmkid_snonce, NONCE_LEN) < 0) {
4477 wpa_printf(MSG_INFO,
4478 "PMKID privacy: Failed to generate SNonce");
4479 return;
4480 }
4481
4482 pos = &wpa_s->sme.assoc_req_ie[wpa_s->sme.assoc_req_ie_len];
4483 *pos++ = WLAN_EID_EXTENSION; /* EID Extension */
4484 *pos++ = 1 + NONCE_LEN; /* Length */
4485 *pos++ = WLAN_EID_EXT_NONCE; /* Element ID */
4486 os_memcpy(pos, wpa_s->pmkid_snonce, NONCE_LEN);
4487 wpa_s->sme.assoc_req_ie_len += len;
4488 wpa_hexdump(MSG_DEBUG, "PMKID privacy: SNonce in Assoc Request",
4489 wpa_s->pmkid_snonce, NONCE_LEN);
4490 wpa_s->pmkid_snonce_set = true;
4491 }
4492 #endif /* CONFIG_PMKSA_PRIVACY */
4493
4494 #ifdef CONFIG_IEEE8021X_AUTH
4495 /*
4496 * Append MIC element to (Re)Association Request frame when using
4497 * IEEE 802.1X Authentication algorithm.
4498 */
4499 if (auth_type == WLAN_AUTH_802_1X && wpa_s->auth_1x &&
4500 wpa_s->auth_1x->derive_ptk)
4501 sme_add_802_1x_mic_in_assoc(wpa_s, wpa_s->valid_links ?
4502 wpa_s->ap_mld_addr : bssid);
4503 #endif /* CONFIG_IEEE8021X_AUTH */
4504
4505 params.bssid = bssid;
4506 params.ssid = wpa_s->sme.ssid;
4507 params.ssid_len = wpa_s->sme.ssid_len;
4508 params.freq.freq = wpa_s->sme.freq;
4509 params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
4510 params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
4511 wpa_s->sme.assoc_req_ie : NULL;
4512 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
4513 wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
4514 params.wpa_ie, params.wpa_ie_len);
4515 params.pairwise_suite = wpa_s->pairwise_cipher;
4516 params.group_suite = wpa_s->group_cipher;
4517 params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
4518 params.key_mgmt_suite = wpa_s->key_mgmt;
4519 params.wpa_proto = wpa_s->wpa_proto;
4520 #ifdef CONFIG_HT_OVERRIDES
4521 os_memset(&htcaps, 0, sizeof(htcaps));
4522 os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
4523 params.htcaps = (u8 *) &htcaps;
4524 params.htcaps_mask = (u8 *) &htcaps_mask;
4525 wpa_supplicant_apply_ht_overrides(wpa_s, ssid, ¶ms);
4526 #endif /* CONFIG_HT_OVERRIDES */
4527 #ifdef CONFIG_VHT_OVERRIDES
4528 os_memset(&vhtcaps, 0, sizeof(vhtcaps));
4529 os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
4530 params.vhtcaps = &vhtcaps;
4531 params.vhtcaps_mask = &vhtcaps_mask;
4532 wpa_supplicant_apply_vht_overrides(wpa_s, ssid, ¶ms);
4533 #endif /* CONFIG_VHT_OVERRIDES */
4534 #ifdef CONFIG_HE_OVERRIDES
4535 wpa_supplicant_apply_he_overrides(wpa_s, ssid, ¶ms);
4536 #endif /* CONFIG_HE_OVERRIDES */
4537 wpa_supplicant_apply_eht_overrides(wpa_s, ssid, ¶ms);
4538 #ifdef CONFIG_IEEE80211R
4539 if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
4540 get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
4541 WLAN_EID_RIC_DATA)) {
4542 /* There seems to be a pretty inconvenient bug in the Linux
4543 * kernel IE splitting functionality when RIC is used. For now,
4544 * skip correct behavior in IE construction here (i.e., drop the
4545 * additional non-FT-specific IEs) to avoid kernel issues. This
4546 * is fine since RIC is used only for testing purposes in the
4547 * current implementation. */
4548 wpa_printf(MSG_INFO,
4549 "SME: Linux kernel workaround - do not try to include additional IEs with RIC");
4550 params.wpa_ie = wpa_s->sme.ft_ies;
4551 params.wpa_ie_len = wpa_s->sme.ft_ies_len;
4552 } else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
4553 const u8 *rm_en, *pos, *end;
4554 size_t rm_en_len = 0;
4555 u8 *rm_en_dup = NULL, *wpos;
4556
4557 /* Remove RSNE, MDE, FTE to allow them to be overridden with
4558 * FT specific values */
4559 remove_ie(wpa_s->sme.assoc_req_ie,
4560 &wpa_s->sme.assoc_req_ie_len,
4561 WLAN_EID_RSN);
4562 remove_ie(wpa_s->sme.assoc_req_ie,
4563 &wpa_s->sme.assoc_req_ie_len,
4564 WLAN_EID_MOBILITY_DOMAIN);
4565 remove_ie(wpa_s->sme.assoc_req_ie,
4566 &wpa_s->sme.assoc_req_ie_len,
4567 WLAN_EID_FAST_BSS_TRANSITION);
4568 /* Remove own RSNXE if AP does not advertise RSNXE to match FT
4569 * specific backwards compatibility expectations. */
4570 if (!wpa_bss_get_rsnxe(wpa_s, wpa_s->current_bss, ssid,
4571 wpa_s->valid_links))
4572 remove_ie(wpa_s->sme.assoc_req_ie,
4573 &wpa_s->sme.assoc_req_ie_len,
4574 WLAN_EID_RSNX);
4575 rm_en = get_ie(wpa_s->sme.assoc_req_ie,
4576 wpa_s->sme.assoc_req_ie_len,
4577 WLAN_EID_RRM_ENABLED_CAPABILITIES);
4578 if (rm_en) {
4579 /* Need to remove RM Enabled Capabilities element as
4580 * well temporarily, so that it can be placed between
4581 * RSNE and MDE. */
4582 rm_en_len = 2 + rm_en[1];
4583 rm_en_dup = os_memdup(rm_en, rm_en_len);
4584 remove_ie(wpa_s->sme.assoc_req_ie,
4585 &wpa_s->sme.assoc_req_ie_len,
4586 WLAN_EID_RRM_ENABLED_CAPABILITIES);
4587 }
4588 wpa_hexdump(MSG_DEBUG,
4589 "SME: Association Request IEs after FT IE removal",
4590 wpa_s->sme.assoc_req_ie,
4591 wpa_s->sme.assoc_req_ie_len);
4592 if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
4593 rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
4594 wpa_printf(MSG_ERROR,
4595 "SME: Not enough buffer room for FT IEs in Association Request frame");
4596 os_free(rm_en_dup);
4597 return;
4598 }
4599
4600 os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
4601 rm_en_len,
4602 wpa_s->sme.assoc_req_ie,
4603 wpa_s->sme.assoc_req_ie_len);
4604 pos = wpa_s->sme.ft_ies;
4605 end = pos + wpa_s->sme.ft_ies_len;
4606 wpos = wpa_s->sme.assoc_req_ie;
4607 if (*pos == WLAN_EID_RSN) {
4608 os_memcpy(wpos, pos, 2 + pos[1]);
4609 wpos += 2 + pos[1];
4610 pos += 2 + pos[1];
4611 }
4612 if (rm_en_dup) {
4613 os_memcpy(wpos, rm_en_dup, rm_en_len);
4614 wpos += rm_en_len;
4615 os_free(rm_en_dup);
4616 }
4617 os_memcpy(wpos, pos, end - pos);
4618 wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
4619 rm_en_len;
4620 params.wpa_ie = wpa_s->sme.assoc_req_ie;
4621 params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
4622 wpa_hexdump(MSG_DEBUG,
4623 "SME: Association Request IEs after FT override",
4624 params.wpa_ie, params.wpa_ie_len);
4625 }
4626 #endif /* CONFIG_IEEE80211R */
4627 params.mode = mode;
4628 params.mgmt_frame_protection = wpa_s->sme.mfp;
4629 params.spp_amsdu = wpa_s->sme.spp_amsdu;
4630 params.rrm_used = wpa_s->rrm.rrm_used;
4631 if (wpa_s->sme.prev_bssid_set)
4632 params.prev_bssid = wpa_s->sme.prev_bssid;
4633
4634 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
4635 " (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
4636 params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
4637 params.freq.freq);
4638
4639 wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
4640
4641 if (params.wpa_ie == NULL ||
4642 ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
4643 < 0) {
4644 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
4645 os_memset(&elems, 0, sizeof(elems));
4646 }
4647 if (elems.rsn_ie) {
4648 params.wpa_proto = WPA_PROTO_RSN;
4649 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
4650 elems.rsn_ie_len + 2);
4651 } else if (elems.wpa_ie) {
4652 params.wpa_proto = WPA_PROTO_WPA;
4653 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
4654 elems.wpa_ie_len + 2);
4655 } else
4656 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
4657 if (elems.rsnxe)
4658 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
4659 elems.rsnxe_len + 2);
4660 else
4661 wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
4662 if (ssid && ssid->p2p_group)
4663 params.p2p = 1;
4664
4665 if (wpa_s->p2pdev->set_sta_uapsd)
4666 params.uapsd = wpa_s->p2pdev->sta_uapsd;
4667 else
4668 params.uapsd = -1;
4669
4670 if (wpa_s->valid_links) {
4671 unsigned int i;
4672
4673 wpa_printf(MSG_DEBUG,
4674 "MLD: In association. assoc_link_id=%u, valid_links=0x%x",
4675 wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
4676
4677 params.mld_params.mld_addr = wpa_s->ap_mld_addr;
4678 params.mld_params.valid_links = wpa_s->valid_links;
4679 params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
4680 for_each_link(wpa_s->valid_links, i) {
4681 params.mld_params.mld_links[i].bssid =
4682 wpa_s->links[i].bssid;
4683 params.mld_params.mld_links[i].freq =
4684 wpa_s->links[i].freq;
4685 params.mld_params.mld_links[i].disabled =
4686 wpa_s->links[i].disabled;
4687 if (wpa_s->links[i].ies) {
4688 params.mld_params.mld_links[i].ies =
4689 wpabuf_head(wpa_s->links[i].ies);
4690 params.mld_params.mld_links[i].ies_len =
4691 wpabuf_len(wpa_s->links[i].ies);
4692 }
4693
4694 wpa_printf(MSG_DEBUG,
4695 "MLD: id=%u, freq=%d, disabled=%u, ies_len=%zu, "
4696 MACSTR,
4697 i, wpa_s->links[i].freq,
4698 wpa_s->links[i].disabled,
4699 params.mld_params.mld_links[i].ies_len,
4700 MAC2STR(wpa_s->links[i].bssid));
4701 }
4702 }
4703
4704 if (wpa_drv_associate(wpa_s, ¶ms) < 0) {
4705 unsigned int n_failed_links = 0;
4706 int i;
4707
4708 wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
4709 "driver failed");
4710
4711 /* Prepare list of failed links for error report */
4712 for_each_link(wpa_s->valid_links, i) {
4713 if (wpa_s->mlo_assoc_link_id == i ||
4714 !params.mld_params.mld_links[i].error)
4715 continue;
4716
4717 wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
4718 n_failed_links++;
4719 }
4720
4721 if (n_failed_links) {
4722 /* Deauth and connect (possibly to the same AP MLD) */
4723 wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
4724 WLAN_REASON_DEAUTH_LEAVING);
4725 wpas_connect_work_done(wpa_s);
4726 wpa_supplicant_mark_disassoc(wpa_s);
4727 wpas_request_connection(wpa_s);
4728 } else {
4729 wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
4730 NULL);
4731 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4732
4733 #ifdef CONFIG_ENC_ASSOC
4734 /* Clear configured keys and PTKSA */
4735 if (wpa_s->ptksa &&
4736 ptksa_cache_get(wpa_s->ptksa, wpa_s->bssid,
4737 WPA_CIPHER_NONE)) {
4738 wpa_clear_keys(wpa_s, wpa_s->bssid);
4739 ptksa_cache_flush(wpa_s->ptksa, wpa_s->bssid,
4740 WPA_CIPHER_NONE);
4741 }
4742 #endif /* CONFIG_ENC_ASSOC */
4743
4744 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
4745 }
4746 return;
4747 }
4748
4749 eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
4750 NULL);
4751
4752 #ifdef CONFIG_TESTING_OPTIONS
4753 wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
4754 wpa_s->last_assoc_req_wpa_ie = NULL;
4755 if (params.wpa_ie)
4756 wpa_s->last_assoc_req_wpa_ie =
4757 wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
4758 #endif /* CONFIG_TESTING_OPTIONS */
4759 }
4760
4761
sme_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)4762 int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
4763 const u8 *ies, size_t ies_len)
4764 {
4765 if (md == NULL || ies == NULL) {
4766 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
4767 os_free(wpa_s->sme.ft_ies);
4768 wpa_s->sme.ft_ies = NULL;
4769 wpa_s->sme.ft_ies_len = 0;
4770 wpa_s->sme.ft_used = 0;
4771 return 0;
4772 }
4773
4774 os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
4775 wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
4776 os_free(wpa_s->sme.ft_ies);
4777 wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
4778 if (wpa_s->sme.ft_ies == NULL)
4779 return -1;
4780 wpa_s->sme.ft_ies_len = ies_len;
4781 return 0;
4782 }
4783
4784
sme_deauth(struct wpa_supplicant * wpa_s,const u8 ** link_bssids)4785 static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
4786 {
4787 int bssid_changed;
4788 const u8 *bssid;
4789
4790 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
4791
4792 if (wpa_s->valid_links)
4793 bssid = wpa_s->ap_mld_addr;
4794 else
4795 bssid = wpa_s->pending_bssid;
4796
4797 if (wpa_drv_deauthenticate(wpa_s, bssid,
4798 WLAN_REASON_DEAUTH_LEAVING) < 0) {
4799 wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
4800 "failed");
4801 }
4802 wpa_s->sme.prev_bssid_set = 0;
4803
4804 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
4805 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4806
4807 #ifdef CONFIG_ENC_ASSOC
4808 /* Clear configured keys and PTKSA */
4809 if (wpa_s->ptksa &&
4810 ptksa_cache_get(wpa_s->ptksa, wpa_s->bssid, WPA_CIPHER_NONE)) {
4811 wpa_clear_keys(wpa_s, wpa_s->bssid);
4812 ptksa_cache_flush(wpa_s->ptksa, wpa_s->bssid, WPA_CIPHER_NONE);
4813 }
4814 #endif /* CONFIG_ENC_ASSOC */
4815
4816 os_memset(wpa_s->bssid, 0, ETH_ALEN);
4817 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
4818 if (bssid_changed)
4819 wpas_notify_bssid_changed(wpa_s);
4820 }
4821
4822
sme_assoc_comeback_timer(void * eloop_ctx,void * timeout_ctx)4823 static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
4824 {
4825 struct wpa_supplicant *wpa_s = eloop_ctx;
4826
4827 if (!wpa_s->current_bss || !wpa_s->current_ssid) {
4828 wpa_msg(wpa_s, MSG_DEBUG,
4829 "SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
4830 return;
4831 }
4832
4833 wpa_msg(wpa_s, MSG_DEBUG,
4834 "SME: Comeback timeout expired; retry associating with "
4835 MACSTR "; mode=%d auth_type=%u",
4836 MAC2STR(wpa_s->current_bss->bssid),
4837 wpa_s->current_ssid->mode,
4838 wpa_s->sme.assoc_auth_type);
4839
4840 /* Authentication state was completed already; just try association
4841 * again. */
4842 sme_associate(wpa_s, wpa_s->current_ssid->mode,
4843 wpa_s->current_bss->bssid,
4844 wpa_s->sme.assoc_auth_type);
4845 }
4846
4847
sme_try_assoc_comeback(struct wpa_supplicant * wpa_s,union wpa_event_data * data)4848 static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
4849 union wpa_event_data *data)
4850 {
4851 struct ieee802_11_elems elems;
4852 u32 timeout_interval;
4853 unsigned long comeback_usec;
4854 u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
4855
4856 #ifdef CONFIG_TESTING_OPTIONS
4857 if (wpa_s->test_assoc_comeback_type != -1)
4858 type = wpa_s->test_assoc_comeback_type;
4859 #endif /* CONFIG_TESTING_OPTIONS */
4860
4861 if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
4862 data->assoc_reject.resp_ies_len,
4863 &elems, 0) == ParseFailed) {
4864 wpa_msg(wpa_s, MSG_INFO,
4865 "SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
4866 return false;
4867 }
4868
4869 if (!elems.timeout_int) {
4870 wpa_msg(wpa_s, MSG_INFO,
4871 "SME: Temporary assoc reject: missing timeout interval IE");
4872 return false;
4873 }
4874
4875 if (elems.timeout_int[0] != type) {
4876 wpa_msg(wpa_s, MSG_INFO,
4877 "SME: Temporary assoc reject: missing association comeback time");
4878 return false;
4879 }
4880
4881 timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
4882 if (timeout_interval > 60000) {
4883 /* This is unprotected information and there is no point in
4884 * getting stuck waiting for very long duration based on it */
4885 wpa_msg(wpa_s, MSG_DEBUG,
4886 "SME: Ignore overly long association comeback interval: %u TUs",
4887 timeout_interval);
4888 return false;
4889 }
4890 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
4891 timeout_interval);
4892
4893 comeback_usec = timeout_interval * 1024;
4894 eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
4895 sme_assoc_comeback_timer, wpa_s, NULL);
4896 return true;
4897 }
4898
4899
sme_event_assoc_reject(struct wpa_supplicant * wpa_s,union wpa_event_data * data,const u8 ** link_bssids)4900 void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
4901 union wpa_event_data *data,
4902 const u8 **link_bssids)
4903 {
4904 const u8 *bssid;
4905
4906 if (wpa_s->valid_links)
4907 bssid = wpa_s->ap_mld_addr;
4908 else
4909 bssid = wpa_s->pending_bssid;
4910
4911 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
4912 "status code %d", MAC2STR(wpa_s->pending_bssid),
4913 data->assoc_reject.status_code);
4914
4915 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
4916 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
4917
4918 /* Authentication phase has been completed at this point. Check whether
4919 * the AP rejected association temporarily due to still holding a
4920 * security associationis with us (MFP). If so, we must wait for the
4921 * AP's association comeback timeout period before associating again. */
4922 if (data->assoc_reject.status_code ==
4923 WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
4924 wpa_msg(wpa_s, MSG_DEBUG,
4925 "SME: Temporary association reject from BSS " MACSTR,
4926 MAC2STR(bssid));
4927 if (sme_try_assoc_comeback(wpa_s, data)) {
4928 /* Break out early; comeback error is not a failure. */
4929 return;
4930 }
4931 }
4932
4933 #ifdef CONFIG_SAE
4934 if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
4935 wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
4936 struct wpa_bss *bss = wpa_s->current_bss;
4937 const u8 *aa;
4938
4939 wpa_dbg(wpa_s, MSG_DEBUG,
4940 "PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
4941 wpa_sm_aborted_cached(wpa_s->wpa);
4942 if (wpa_s->valid_links)
4943 aa = wpa_s->ap_mld_addr;
4944 else if (bss)
4945 aa = bss->bssid;
4946 else
4947 aa = NULL;
4948
4949 if (aa)
4950 wpa_sm_pmksa_cache_flush_addr(wpa_s->wpa,
4951 wpa_s->current_ssid, aa);
4952 if (wpa_s->current_bss) {
4953 struct wpa_ssid *ssid = wpa_s->current_ssid;
4954
4955 wpa_drv_deauthenticate(wpa_s, bssid,
4956 WLAN_REASON_DEAUTH_LEAVING);
4957 wpas_connect_work_done(wpa_s);
4958 wpa_supplicant_mark_disassoc(wpa_s);
4959 wpa_supplicant_connect(wpa_s, bss, ssid);
4960 return;
4961 }
4962 }
4963 #endif /* CONFIG_SAE */
4964
4965 #ifdef CONFIG_DPP
4966 if (wpa_s->current_ssid &&
4967 wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
4968 !data->assoc_reject.timed_out &&
4969 data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
4970 struct rsn_pmksa_cache_entry *pmksa;
4971
4972 pmksa = pmksa_cache_get_current(wpa_s->wpa);
4973 if (pmksa) {
4974 wpa_dbg(wpa_s, MSG_DEBUG,
4975 "DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
4976 wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
4977 }
4978 wpa_sm_aborted_cached(wpa_s->wpa);
4979 if (wpa_s->current_bss) {
4980 struct wpa_bss *bss = wpa_s->current_bss;
4981 struct wpa_ssid *ssid = wpa_s->current_ssid;
4982
4983 wpa_dbg(wpa_s, MSG_DEBUG,
4984 "DPP: Try network introduction again");
4985 wpas_connect_work_done(wpa_s);
4986 wpa_supplicant_mark_disassoc(wpa_s);
4987 wpa_supplicant_connect(wpa_s, bss, ssid);
4988 return;
4989 }
4990 }
4991 #endif /* CONFIG_DPP */
4992
4993 /*
4994 * For now, unconditionally terminate the previous authentication. In
4995 * theory, this should not be needed, but mac80211 gets quite confused
4996 * if the authentication is left pending.. Some roaming cases might
4997 * benefit from using the previous authentication, so this could be
4998 * optimized in the future.
4999 */
5000 sme_deauth(wpa_s, link_bssids);
5001 }
5002
5003
sme_event_auth_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)5004 void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
5005 union wpa_event_data *data)
5006 {
5007 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
5008 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
5009 wpa_supplicant_mark_disassoc(wpa_s);
5010 }
5011
5012
sme_event_assoc_timed_out(struct wpa_supplicant * wpa_s,union wpa_event_data * data)5013 void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
5014 union wpa_event_data *data)
5015 {
5016 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
5017 wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
5018 wpa_supplicant_mark_disassoc(wpa_s);
5019 }
5020
5021
sme_event_deauth(struct wpa_supplicant * wpa_s,struct deauth_info * info)5022 void sme_event_deauth(struct wpa_supplicant *wpa_s, struct deauth_info *info)
5023 {
5024 #ifdef CONFIG_SAE
5025 const u8 *aa;
5026
5027 /* Some APs reject a (Re)Association Request frame that tries to use
5028 * PMKSA caching by deauthenticating the STA with reason code 9
5029 * (STA_REQ_ASSOC_WITHOUT_AUTH) instead of responding to it with an
5030 * error status code. Drop the PMKSA cache entry for that AP in that
5031 * case so that the next attempt uses a full SAE authentication
5032 * instead of finding the same PMKSA cache entry again and repeating
5033 * the same failure. */
5034 if (!wpa_s->sme.sae_pmksa_caching || !info || info->locally_generated ||
5035 info->reason_code != WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH ||
5036 wpa_s->wpa_state != WPA_ASSOCIATING || !wpa_s->current_ssid ||
5037 !wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt))
5038 return;
5039
5040 if (wpa_s->valid_links)
5041 aa = wpa_s->ap_mld_addr;
5042 else if (wpa_s->current_bss)
5043 aa = wpa_s->current_bss->bssid;
5044 else
5045 return; /* Do not flush the PMKSA cache entries of the full ESS
5046 * based on an unprotected frame from a single AP. */
5047
5048 wpa_dbg(wpa_s, MSG_DEBUG,
5049 "SME: PMKSA caching attempt rejected with deauthentication - drop PMKSA cache entry");
5050 wpa_sm_aborted_cached(wpa_s->wpa);
5051 wpa_sm_pmksa_cache_flush_addr(wpa_s->wpa, wpa_s->current_ssid, aa);
5052 #endif /* CONFIG_SAE */
5053 }
5054
5055
sme_event_disassoc(struct wpa_supplicant * wpa_s,struct disassoc_info * info)5056 void sme_event_disassoc(struct wpa_supplicant *wpa_s,
5057 struct disassoc_info *info)
5058 {
5059 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
5060 if (wpa_s->sme.prev_bssid_set) {
5061 /*
5062 * cfg80211/mac80211 can get into somewhat confused state if
5063 * the AP only disassociates us and leaves us in authenticated
5064 * state. For now, force the state to be cleared to avoid
5065 * confusing errors if we try to associate with the AP again.
5066 */
5067 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
5068 "driver state");
5069 wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
5070 WLAN_REASON_DEAUTH_LEAVING);
5071 }
5072 }
5073
5074
sme_auth_timer(void * eloop_ctx,void * timeout_ctx)5075 static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
5076 {
5077 struct wpa_supplicant *wpa_s = eloop_ctx;
5078 if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
5079 wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
5080 sme_deauth(wpa_s, NULL);
5081 }
5082 }
5083
5084
sme_assoc_timer(void * eloop_ctx,void * timeout_ctx)5085 static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
5086 {
5087 struct wpa_supplicant *wpa_s = eloop_ctx;
5088 if (wpa_s->wpa_state == WPA_ASSOCIATING) {
5089 wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
5090 sme_deauth(wpa_s, NULL);
5091 }
5092 }
5093
5094
sme_state_changed(struct wpa_supplicant * wpa_s)5095 void sme_state_changed(struct wpa_supplicant *wpa_s)
5096 {
5097 /* Make sure timers are cleaned up appropriately. */
5098 if (wpa_s->wpa_state != WPA_ASSOCIATING) {
5099 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
5100 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
5101 }
5102 if (wpa_s->wpa_state != WPA_AUTHENTICATING)
5103 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
5104 }
5105
5106
sme_clear_on_disassoc(struct wpa_supplicant * wpa_s)5107 void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
5108 {
5109 wpa_s->sme.prev_bssid_set = 0;
5110 #ifdef CONFIG_SAE
5111 wpabuf_free(wpa_s->sme.sae_token);
5112 wpa_s->sme.sae_token = NULL;
5113 sae_clear_data(&wpa_s->sme.sae);
5114 #endif /* CONFIG_SAE */
5115 #ifdef CONFIG_IEEE80211R
5116 if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
5117 sme_update_ft_ies(wpa_s, NULL, NULL, 0);
5118 #endif /* CONFIG_IEEE80211R */
5119 #ifdef CONFIG_IEEE8021X_AUTH
5120 sme_802_1x_auth_data_free(wpa_s);
5121 #endif /* CONFIG_IEEE8021X_AUTH */
5122 sme_stop_sa_query(wpa_s);
5123 }
5124
5125
sme_deinit(struct wpa_supplicant * wpa_s)5126 void sme_deinit(struct wpa_supplicant *wpa_s)
5127 {
5128 sme_clear_on_disassoc(wpa_s);
5129 #ifdef CONFIG_SAE
5130 os_free(wpa_s->sme.sae_rejected_groups);
5131 wpa_s->sme.sae_rejected_groups = NULL;
5132 #endif /* CONFIG_SAE */
5133
5134 eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
5135 eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
5136 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
5137 eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
5138 }
5139
5140
sme_send_2040_bss_coex(struct wpa_supplicant * wpa_s,const u8 * chan_list,u8 num_channels,u8 num_intol)5141 static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
5142 const u8 *chan_list, u8 num_channels,
5143 u8 num_intol)
5144 {
5145 struct ieee80211_2040_bss_coex_ie *bc_ie;
5146 struct ieee80211_2040_intol_chan_report *ic_report;
5147 struct wpabuf *buf;
5148
5149 wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
5150 " (num_channels=%u num_intol=%u)",
5151 MAC2STR(wpa_s->bssid), num_channels, num_intol);
5152 wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
5153 chan_list, num_channels);
5154
5155 buf = wpabuf_alloc(2 + /* action.category + action_code */
5156 sizeof(struct ieee80211_2040_bss_coex_ie) +
5157 sizeof(struct ieee80211_2040_intol_chan_report) +
5158 num_channels);
5159 if (buf == NULL)
5160 return;
5161
5162 wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
5163 wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
5164
5165 bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
5166 bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
5167 bc_ie->length = 1;
5168 if (num_intol)
5169 bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
5170
5171 if (num_channels > 0) {
5172 ic_report = wpabuf_put(buf, sizeof(*ic_report));
5173 ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
5174 ic_report->length = num_channels + 1;
5175 ic_report->op_class = 0;
5176 os_memcpy(wpabuf_put(buf, num_channels), chan_list,
5177 num_channels);
5178 }
5179
5180 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5181 wpa_s->own_addr, wpa_s->bssid,
5182 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5183 wpa_msg(wpa_s, MSG_INFO,
5184 "SME: Failed to send 20/40 BSS Coexistence frame");
5185 }
5186
5187 wpabuf_free(buf);
5188 }
5189
5190
sme_proc_obss_scan(struct wpa_supplicant * wpa_s)5191 int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
5192 {
5193 struct wpa_bss *bss;
5194 const u8 *ie;
5195 u16 ht_cap;
5196 u8 chan_list[P2P_MAX_CHANNELS], channel;
5197 u8 num_channels = 0, num_intol = 0, i;
5198
5199 if (!wpa_s->sme.sched_obss_scan)
5200 return 0;
5201
5202 wpa_s->sme.sched_obss_scan = 0;
5203 if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
5204 return 1;
5205
5206 /*
5207 * Check whether AP uses regulatory triplet or channel triplet in
5208 * country info. Right now the operating class of the BSS channel
5209 * width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
5210 * based on the assumption that operating class triplet is not used in
5211 * beacon frame. If the First Channel Number/Operating Extension
5212 * Identifier octet has a positive integer value of 201 or greater,
5213 * then its operating class triplet.
5214 *
5215 * TODO: If Supported Operating Classes element is present in beacon
5216 * frame, have to lookup operating class in Annex E and fill them in
5217 * 2040 coex frame.
5218 */
5219 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
5220 if (ie && (ie[1] >= 6) && (ie[5] >= 201))
5221 return 1;
5222
5223 os_memset(chan_list, 0, sizeof(chan_list));
5224
5225 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5226 /* Skip other band bss */
5227 enum hostapd_hw_mode mode;
5228 mode = ieee80211_freq_to_chan(bss->freq, &channel);
5229 if (mode != HOSTAPD_MODE_IEEE80211G &&
5230 mode != HOSTAPD_MODE_IEEE80211B)
5231 continue;
5232
5233 ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
5234 ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
5235 wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
5236 " freq=%u chan=%u ht_cap=0x%x",
5237 MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
5238
5239 if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
5240 if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
5241 num_intol++;
5242
5243 /* Check whether the channel is already considered */
5244 for (i = 0; i < num_channels; i++) {
5245 if (channel == chan_list[i])
5246 break;
5247 }
5248 if (i != num_channels)
5249 continue;
5250
5251 chan_list[num_channels++] = channel;
5252 }
5253 }
5254
5255 sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
5256 return 1;
5257 }
5258
5259
wpa_obss_scan_freqs_list(struct wpa_supplicant * wpa_s,struct wpa_driver_scan_params * params)5260 static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
5261 struct wpa_driver_scan_params *params)
5262 {
5263 /* Include only affected channels */
5264 struct hostapd_hw_modes *mode;
5265 int count, i;
5266 int start, end;
5267
5268 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
5269 HOSTAPD_MODE_IEEE80211G, false);
5270 if (mode == NULL) {
5271 /* No channels supported in this band - use empty list */
5272 params->freqs = os_zalloc(sizeof(int));
5273 return;
5274 }
5275
5276 if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
5277 wpa_s->current_bss) {
5278 const u8 *ie;
5279
5280 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
5281 if (ie && ie[1] >= 2) {
5282 u8 o;
5283
5284 o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
5285 if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
5286 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
5287 else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
5288 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
5289 }
5290 }
5291
5292 start = wpa_s->assoc_freq - 10;
5293 end = wpa_s->assoc_freq + 10;
5294 switch (wpa_s->sme.ht_sec_chan) {
5295 case HT_SEC_CHAN_UNKNOWN:
5296 /* HT40+ possible on channels 1..9 */
5297 if (wpa_s->assoc_freq <= 2452)
5298 start -= 20;
5299 /* HT40- possible on channels 5-13 */
5300 if (wpa_s->assoc_freq >= 2432)
5301 end += 20;
5302 break;
5303 case HT_SEC_CHAN_ABOVE:
5304 end += 20;
5305 break;
5306 case HT_SEC_CHAN_BELOW:
5307 start -= 20;
5308 break;
5309 }
5310 wpa_printf(MSG_DEBUG,
5311 "OBSS: assoc_freq %d possible affected range %d-%d",
5312 wpa_s->assoc_freq, start, end);
5313
5314 params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
5315 if (params->freqs == NULL)
5316 return;
5317 for (count = 0, i = 0; i < mode->num_channels; i++) {
5318 int freq;
5319
5320 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
5321 continue;
5322 freq = mode->channels[i].freq;
5323 if (freq - 10 >= end || freq + 10 <= start)
5324 continue; /* not affected */
5325 params->freqs[count++] = freq;
5326 }
5327 }
5328
5329
sme_obss_scan_timeout(void * eloop_ctx,void * timeout_ctx)5330 static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
5331 {
5332 struct wpa_supplicant *wpa_s = eloop_ctx;
5333 struct wpa_driver_scan_params params;
5334
5335 if (!wpa_s->current_bss) {
5336 wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
5337 return;
5338 }
5339
5340 os_memset(¶ms, 0, sizeof(params));
5341 wpa_obss_scan_freqs_list(wpa_s, ¶ms);
5342 params.low_priority = 1;
5343 wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
5344
5345 if (wpa_supplicant_trigger_scan(wpa_s, ¶ms, true, false))
5346 wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
5347 else
5348 wpa_s->sme.sched_obss_scan = 1;
5349 os_free(params.freqs);
5350
5351 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
5352 sme_obss_scan_timeout, wpa_s, NULL);
5353 }
5354
5355
sme_sched_obss_scan(struct wpa_supplicant * wpa_s,int enable)5356 void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
5357 {
5358 const u8 *ie;
5359 struct wpa_bss *bss = wpa_s->current_bss;
5360 struct wpa_ssid *ssid = wpa_s->current_ssid;
5361 struct hostapd_hw_modes *hw_mode = NULL;
5362 int i;
5363
5364 eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
5365 wpa_s->sme.sched_obss_scan = 0;
5366 wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
5367 if (!enable)
5368 return;
5369
5370 /*
5371 * Schedule OBSS scan if driver is using station SME in wpa_supplicant
5372 * or it expects OBSS scan to be performed by wpa_supplicant.
5373 */
5374 if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
5375 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
5376 ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
5377 return;
5378
5379 #ifdef CONFIG_HT_OVERRIDES
5380 /* No need for OBSS scan if HT40 is explicitly disabled */
5381 if (ssid->disable_ht40)
5382 return;
5383 #endif /* CONFIG_HT_OVERRIDES */
5384
5385 if (!wpa_s->hw.modes)
5386 return;
5387
5388 /* only HT caps in 11g mode are relevant */
5389 for (i = 0; i < wpa_s->hw.num_modes; i++) {
5390 hw_mode = &wpa_s->hw.modes[i];
5391 if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
5392 break;
5393 }
5394
5395 /* Driver does not support HT40 for 11g or doesn't have 11g. */
5396 if (i == wpa_s->hw.num_modes || !hw_mode ||
5397 !(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5398 return;
5399
5400 if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
5401 return; /* Not associated on 2.4 GHz band */
5402
5403 /* Check whether AP supports HT40 */
5404 ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
5405 if (!ie || ie[1] < 2 ||
5406 !(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5407 return; /* AP does not support HT40 */
5408
5409 ie = wpa_bss_get_ie(wpa_s->current_bss,
5410 WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
5411 if (!ie || ie[1] < 14)
5412 return; /* AP does not request OBSS scans */
5413
5414 wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
5415 if (wpa_s->sme.obss_scan_int < 10) {
5416 wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
5417 "replaced with the minimum 10 sec",
5418 wpa_s->sme.obss_scan_int);
5419 wpa_s->sme.obss_scan_int = 10;
5420 }
5421 wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
5422 wpa_s->sme.obss_scan_int);
5423 eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
5424 sme_obss_scan_timeout, wpa_s, NULL);
5425 }
5426
5427
5428 static const unsigned int sa_query_max_timeout = 1000;
5429 static const unsigned int sa_query_retry_timeout = 201;
5430 static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
5431
sme_check_sa_query_timeout(struct wpa_supplicant * wpa_s)5432 static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
5433 {
5434 u32 tu;
5435 struct os_reltime now, passed;
5436 os_get_reltime(&now);
5437 os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
5438 tu = (passed.sec * 1000000 + passed.usec) / 1024;
5439 if (sa_query_max_timeout < tu) {
5440 wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
5441 sme_stop_sa_query(wpa_s);
5442 wpa_supplicant_deauthenticate(
5443 wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
5444 return 1;
5445 }
5446
5447 return 0;
5448 }
5449
5450
sme_send_sa_query_req(struct wpa_supplicant * wpa_s,const u8 * trans_id)5451 static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
5452 const u8 *trans_id)
5453 {
5454 u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
5455 u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
5456
5457 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
5458 MACSTR, MAC2STR(wpa_s->bssid));
5459 wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
5460 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
5461 req[0] = WLAN_ACTION_SA_QUERY;
5462 req[1] = WLAN_SA_QUERY_REQUEST;
5463 os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
5464
5465 #ifdef CONFIG_OCV
5466 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
5467 struct wpa_channel_info ci;
5468
5469 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
5470 wpa_printf(MSG_WARNING,
5471 "Failed to get channel info for OCI element in SA Query Request frame");
5472 return;
5473 }
5474
5475 #ifdef CONFIG_TESTING_OPTIONS
5476 if (wpa_s->oci_freq_override_saquery_req) {
5477 wpa_printf(MSG_INFO,
5478 "TEST: Override SA Query Request OCI frequency %d -> %d MHz",
5479 ci.frequency,
5480 wpa_s->oci_freq_override_saquery_req);
5481 ci.frequency = wpa_s->oci_freq_override_saquery_req;
5482 }
5483 #endif /* CONFIG_TESTING_OPTIONS */
5484
5485 if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
5486 return;
5487
5488 req_len += OCV_OCI_EXTENDED_LEN;
5489 }
5490 #endif /* CONFIG_OCV */
5491
5492 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5493 wpa_s->own_addr, wpa_s->bssid,
5494 req, req_len, 0) < 0)
5495 wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
5496 "Request");
5497 }
5498
5499
sme_sa_query_timer(void * eloop_ctx,void * timeout_ctx)5500 static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
5501 {
5502 struct wpa_supplicant *wpa_s = eloop_ctx;
5503 unsigned int timeout, sec, usec;
5504 u8 *trans_id, *nbuf;
5505
5506 if (wpa_s->sme.sa_query_count > 0 &&
5507 sme_check_sa_query_timeout(wpa_s))
5508 return;
5509
5510 nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
5511 wpa_s->sme.sa_query_count + 1,
5512 WLAN_SA_QUERY_TR_ID_LEN);
5513 if (nbuf == NULL) {
5514 sme_stop_sa_query(wpa_s);
5515 return;
5516 }
5517 if (wpa_s->sme.sa_query_count == 0) {
5518 /* Starting a new SA Query procedure */
5519 os_get_reltime(&wpa_s->sme.sa_query_start);
5520 }
5521 trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
5522 wpa_s->sme.sa_query_trans_id = nbuf;
5523 wpa_s->sme.sa_query_count++;
5524
5525 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
5526 wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
5527 sme_stop_sa_query(wpa_s);
5528 return;
5529 }
5530
5531 timeout = sa_query_retry_timeout;
5532 sec = ((timeout / 1000) * 1024) / 1000;
5533 usec = (timeout % 1000) * 1024;
5534 eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
5535
5536 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
5537 wpa_s->sme.sa_query_count);
5538
5539 sme_send_sa_query_req(wpa_s, trans_id);
5540 }
5541
5542
sme_start_sa_query(struct wpa_supplicant * wpa_s)5543 static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
5544 {
5545 sme_sa_query_timer(wpa_s, NULL);
5546 }
5547
5548
sme_stop_sa_query(struct wpa_supplicant * wpa_s)5549 static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
5550 {
5551 if (wpa_s->sme.sa_query_trans_id)
5552 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
5553 eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
5554 os_free(wpa_s->sme.sa_query_trans_id);
5555 wpa_s->sme.sa_query_trans_id = NULL;
5556 wpa_s->sme.sa_query_count = 0;
5557 }
5558
5559
sme_event_unprot_disconnect(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * da,u16 reason_code)5560 void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
5561 const u8 *da, u16 reason_code)
5562 {
5563 struct wpa_ssid *ssid;
5564 struct os_reltime now;
5565
5566 if (wpa_s->wpa_state != WPA_COMPLETED)
5567 return;
5568 ssid = wpa_s->current_ssid;
5569 if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
5570 return;
5571 if (!ether_addr_equal(sa, wpa_s->bssid))
5572 return;
5573 if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
5574 reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
5575 return;
5576 if (wpa_s->sme.sa_query_count > 0)
5577 return;
5578 #ifdef CONFIG_TESTING_OPTIONS
5579 if (wpa_s->disable_sa_query)
5580 return;
5581 #endif /* CONFIG_TESTING_OPTIONS */
5582
5583 os_get_reltime(&now);
5584 if (wpa_s->sme.last_unprot_disconnect.sec &&
5585 !os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
5586 return; /* limit SA Query procedure frequency */
5587 wpa_s->sme.last_unprot_disconnect = now;
5588
5589 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
5590 "possible AP/STA state mismatch - trigger SA Query");
5591 sme_start_sa_query(wpa_s);
5592 }
5593
5594
sme_event_ch_switch(struct wpa_supplicant * wpa_s)5595 void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
5596 {
5597 unsigned int usec;
5598 u32 _rand;
5599
5600 if (wpa_s->wpa_state != WPA_COMPLETED ||
5601 !wpa_sm_ocv_enabled(wpa_s->wpa))
5602 return;
5603
5604 wpa_dbg(wpa_s, MSG_DEBUG,
5605 "SME: Channel switch completed - trigger new SA Query to verify new operating channel");
5606 sme_stop_sa_query(wpa_s);
5607
5608 if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
5609 _rand = os_random();
5610 usec = _rand % (sa_query_ch_switch_max_delay + 1);
5611 eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
5612 }
5613
5614
sme_process_sa_query_request(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)5615 static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
5616 const u8 *sa, const u8 *data,
5617 size_t len)
5618 {
5619 u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
5620 u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
5621
5622 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
5623 MACSTR, MAC2STR(wpa_s->bssid));
5624
5625 resp[0] = WLAN_ACTION_SA_QUERY;
5626 resp[1] = WLAN_SA_QUERY_RESPONSE;
5627 os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
5628
5629 #ifdef CONFIG_OCV
5630 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
5631 struct wpa_channel_info ci;
5632
5633 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
5634 wpa_printf(MSG_WARNING,
5635 "Failed to get channel info for OCI element in SA Query Response frame");
5636 return;
5637 }
5638
5639 #ifdef CONFIG_TESTING_OPTIONS
5640 if (wpa_s->oci_freq_override_saquery_resp) {
5641 wpa_printf(MSG_INFO,
5642 "TEST: Override SA Query Response OCI frequency %d -> %d MHz",
5643 ci.frequency,
5644 wpa_s->oci_freq_override_saquery_resp);
5645 ci.frequency = wpa_s->oci_freq_override_saquery_resp;
5646 }
5647 #endif /* CONFIG_TESTING_OPTIONS */
5648
5649 if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
5650 return;
5651
5652 resp_len += OCV_OCI_EXTENDED_LEN;
5653 }
5654 #endif /* CONFIG_OCV */
5655
5656 if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5657 wpa_s->own_addr, wpa_s->bssid,
5658 resp, resp_len, 0) < 0)
5659 wpa_msg(wpa_s, MSG_INFO,
5660 "SME: Failed to send SA Query Response");
5661 }
5662
5663
sme_process_sa_query_response(struct wpa_supplicant * wpa_s,const u8 * sa,const u8 * data,size_t len)5664 static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
5665 const u8 *sa, const u8 *data,
5666 size_t len)
5667 {
5668 int i;
5669
5670 if (!wpa_s->sme.sa_query_trans_id)
5671 return;
5672
5673 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
5674 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
5675
5676 if (!ether_addr_equal(sa, wpa_s->bssid))
5677 return;
5678
5679 for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
5680 if (os_memcmp(wpa_s->sme.sa_query_trans_id +
5681 i * WLAN_SA_QUERY_TR_ID_LEN,
5682 data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
5683 break;
5684 }
5685
5686 if (i >= wpa_s->sme.sa_query_count) {
5687 wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
5688 "transaction identifier found");
5689 return;
5690 }
5691
5692 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
5693 "from " MACSTR, MAC2STR(sa));
5694 sme_stop_sa_query(wpa_s);
5695 }
5696
5697
sme_sa_query_rx(struct wpa_supplicant * wpa_s,const u8 * da,const u8 * sa,const u8 * data,size_t len)5698 void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
5699 const u8 *data, size_t len)
5700 {
5701 if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
5702 return;
5703 if (is_multicast_ether_addr(da)) {
5704 wpa_printf(MSG_DEBUG,
5705 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
5706 MAC2STR(da), MAC2STR(sa));
5707 return;
5708 }
5709
5710 wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
5711 MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
5712
5713 #ifdef CONFIG_OCV
5714 if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
5715 struct ieee802_11_elems elems;
5716 struct wpa_channel_info ci;
5717
5718 if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
5719 len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
5720 &elems, 1) == ParseFailed) {
5721 wpa_printf(MSG_DEBUG,
5722 "SA Query: Failed to parse elements");
5723 return;
5724 }
5725
5726 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
5727 wpa_printf(MSG_WARNING,
5728 "Failed to get channel info to validate received OCI in SA Query Action frame");
5729 return;
5730 }
5731
5732 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
5733 channel_width_to_int(ci.chanwidth),
5734 ci.seg1_idx) != OCI_SUCCESS) {
5735 wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
5736 " frame=saquery%s error=%s",
5737 MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
5738 "req" : "resp", ocv_errorstr);
5739 return;
5740 }
5741 }
5742 #endif /* CONFIG_OCV */
5743
5744 if (data[0] == WLAN_SA_QUERY_REQUEST)
5745 sme_process_sa_query_request(wpa_s, sa, data, len);
5746 else if (data[0] == WLAN_SA_QUERY_RESPONSE)
5747 sme_process_sa_query_response(wpa_s, sa, data, len);
5748 }
5749