1 /*
2 * WPA Supplicant - WPA state machine and EAPOL-Key processing
3 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
4 * Copyright(c) 2015 Intel Deutschland GmbH
5 *
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
8 */
9
10 #include "includes.h"
11
12 #include "common.h"
13 #include "crypto/aes.h"
14 #include "crypto/aes_wrap.h"
15 #include "crypto/crypto.h"
16 #include "crypto/random.h"
17 #include "crypto/aes_siv.h"
18 #include "crypto/sha256.h"
19 #include "crypto/sha384.h"
20 #include "crypto/sha512.h"
21 #include "common/ieee802_11_defs.h"
22 #include "common/ieee802_11_common.h"
23 #include "common/ocv.h"
24 #include "common/dpp.h"
25 #include "common/wpa_ctrl.h"
26 #include "eap_common/eap_defs.h"
27 #include "eapol_supp/eapol_supp_sm.h"
28 #include "drivers/driver.h"
29 #include "wpa.h"
30 #include "eloop.h"
31 #include "preauth.h"
32 #include "pmksa_cache.h"
33 #include "wpa_i.h"
34 #include "wpa_ie.h"
35
36
37 static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
38
39 static const u8 * wpa_sm_get_ap_rsnxe(struct wpa_sm *sm, size_t *len);
40
41
_wpa_hexdump_link(int level,u8 link_id,const char * title,const void * buf,size_t len,bool key)42 static void _wpa_hexdump_link(int level, u8 link_id, const char *title,
43 const void *buf, size_t len, bool key)
44 {
45 char *link_title = NULL;
46
47 if (link_id >= MAX_NUM_MLD_LINKS)
48 goto out;
49
50 link_title = os_malloc(os_strlen(title) + 20);
51 if (!link_title)
52 goto out;
53
54 os_snprintf(link_title, os_strlen(title) + 20, "MLO link[%u]: %s",
55 link_id, title);
56
57 out:
58 if (key)
59 wpa_hexdump_key(level, link_title ? link_title : title, buf,
60 len);
61 else
62 wpa_hexdump(level, link_title ? link_title : title, buf, len);
63 os_free(link_title);
64 }
65
66
wpa_hexdump_link(int level,u8 link_id,const char * title,const void * buf,size_t len)67 static void wpa_hexdump_link(int level, u8 link_id, const char *title,
68 const void *buf, size_t len)
69 {
70 _wpa_hexdump_link(level, link_id, title, buf, len, false);
71 }
72
73
wpa_hexdump_link_key(int level,u8 link_id,const char * title,const void * buf,size_t len)74 static void wpa_hexdump_link_key(int level, u8 link_id, const char *title,
75 const void *buf, size_t len)
76 {
77 _wpa_hexdump_link(level, link_id, title, buf, len, true);
78 }
79
80
81 /**
82 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
83 * @sm: Pointer to WPA state machine data from wpa_sm_init()
84 * @ptk: PTK for Key Confirmation/Encryption Key
85 * @ver: Version field from Key Info
86 * @dest: Destination address for the frame
87 * @proto: Ethertype (usually ETH_P_EAPOL)
88 * @msg: EAPOL-Key message
89 * @msg_len: Length of message
90 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
91 * Returns: >= 0 on success, < 0 on failure
92 */
wpa_eapol_key_send(struct wpa_sm * sm,struct wpa_ptk * ptk,int ver,const u8 * dest,u16 proto,u8 * msg,size_t msg_len,u8 * key_mic)93 int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
94 int ver, const u8 *dest, u16 proto,
95 u8 *msg, size_t msg_len, u8 *key_mic)
96 {
97 int ret = -1;
98 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
99
100 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
101 " ver=%d mic_len=%d key_mgmt=0x%x",
102 MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
103 if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
104 /*
105 * Association event was not yet received; try to fetch
106 * BSSID from the driver.
107 */
108 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
109 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
110 "WPA: Failed to read BSSID for "
111 "EAPOL-Key destination address");
112 } else {
113 dest = sm->bssid;
114 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
115 "WPA: Use BSSID (" MACSTR
116 ") as the destination for EAPOL-Key",
117 MAC2STR(dest));
118 }
119 }
120
121 if (mic_len) {
122 if (key_mic && (!ptk || !ptk->kck_len))
123 goto out;
124
125 if (key_mic &&
126 wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt,
127 sm->hash_alg, ver, msg, msg_len,
128 key_mic)) {
129 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
130 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
131 ver, sm->key_mgmt);
132 goto out;
133 }
134 if (ptk)
135 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
136 ptk->kck, ptk->kck_len);
137 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
138 key_mic, mic_len);
139 } else {
140 #ifdef CONFIG_FILS
141 /* AEAD cipher - Key MIC field not used */
142 struct ieee802_1x_hdr *s_hdr, *hdr;
143 struct wpa_eapol_key *s_key, *key;
144 u8 *buf, *s_key_data, *key_data;
145 size_t buf_len = msg_len + AES_BLOCK_SIZE;
146 size_t key_data_len;
147 u16 eapol_len;
148 const u8 *aad[1];
149 size_t aad_len[1];
150
151 if (!ptk || !ptk->kek_len)
152 goto out;
153
154 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
155 sizeof(struct wpa_eapol_key) - 2;
156
157 buf = os_malloc(buf_len);
158 if (!buf)
159 goto out;
160
161 os_memcpy(buf, msg, msg_len);
162 hdr = (struct ieee802_1x_hdr *) buf;
163 key = (struct wpa_eapol_key *) (hdr + 1);
164 key_data = ((u8 *) (key + 1)) + 2;
165
166 /* Update EAPOL header to include AES-SIV overhead */
167 eapol_len = be_to_host16(hdr->length);
168 eapol_len += AES_BLOCK_SIZE;
169 hdr->length = host_to_be16(eapol_len);
170
171 /* Update Key Data Length field to include AES-SIV overhead */
172 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
173
174 s_hdr = (struct ieee802_1x_hdr *) msg;
175 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
176 s_key_data = ((u8 *) (s_key + 1)) + 2;
177
178 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
179 s_key_data, key_data_len);
180
181 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
182 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
183 * to Key Data (exclusive). */
184 aad[0] = buf;
185 aad_len[0] = key_data - buf;
186 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
187 s_key_data, key_data_len,
188 1, aad, aad_len, key_data) < 0) {
189 os_free(buf);
190 goto out;
191 }
192
193 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
194 key_data, AES_BLOCK_SIZE + key_data_len);
195
196 os_free(msg);
197 msg = buf;
198 msg_len = buf_len;
199 #else /* CONFIG_FILS */
200 goto out;
201 #endif /* CONFIG_FILS */
202 }
203
204 wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
205 ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
206 eapol_sm_notify_tx_eapol_key(sm->eapol);
207 out:
208 os_free(msg);
209 return ret;
210 }
211
212
213 /**
214 * wpa_sm_key_request - Send EAPOL-Key Request
215 * @sm: Pointer to WPA state machine data from wpa_sm_init()
216 * @error: Indicate whether this is an Michael MIC error report
217 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
218 *
219 * Send an EAPOL-Key Request to the current authenticator. This function is
220 * used to request rekeying and it is usually called when a local Michael MIC
221 * failure is detected.
222 */
wpa_sm_key_request(struct wpa_sm * sm,int error,int pairwise)223 void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
224 {
225 size_t mic_len, hdrlen, rlen;
226 struct wpa_eapol_key *reply;
227 int key_info, ver;
228 u8 *rbuf, *key_mic, *mic;
229
230 if (pairwise && sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
231 wpa_sm_get_state(sm) == WPA_COMPLETED && !error) {
232 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
233 "WPA: PTK0 rekey not allowed, reconnecting");
234 wpa_sm_reconnect(sm);
235 return;
236 }
237
238 if (!sm->ptk_set) {
239 wpa_printf(MSG_INFO,
240 "WPA: No PTK derived yet - cannot send EAPOL-Key Request");
241 return;
242 }
243
244 if (wpa_use_akm_defined(sm->key_mgmt))
245 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
246 else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
247 wpa_key_mgmt_sha256(sm->key_mgmt))
248 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
249 else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
250 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
251 else
252 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
253
254 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
255 hdrlen = sizeof(*reply) + mic_len + 2;
256 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
257 hdrlen, &rlen, (void *) &reply);
258 if (rbuf == NULL)
259 return;
260
261 reply->type = (sm->proto == WPA_PROTO_RSN) ?
262 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
263 key_info = WPA_KEY_INFO_REQUEST | ver;
264 key_info |= WPA_KEY_INFO_SECURE;
265 if (mic_len)
266 key_info |= WPA_KEY_INFO_MIC;
267 else
268 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
269 if (error)
270 key_info |= WPA_KEY_INFO_ERROR;
271 if (pairwise)
272 key_info |= WPA_KEY_INFO_KEY_TYPE;
273 WPA_PUT_BE16(reply->key_info, key_info);
274 WPA_PUT_BE16(reply->key_length, 0);
275 os_memcpy(reply->replay_counter, sm->request_counter,
276 WPA_REPLAY_COUNTER_LEN);
277 inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
278
279 mic = (u8 *) (reply + 1);
280 WPA_PUT_BE16(mic + mic_len, 0);
281 if (!(key_info & WPA_KEY_INFO_MIC))
282 key_mic = NULL;
283 else
284 key_mic = mic;
285
286 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
287 "WPA: Sending EAPOL-Key Request (error=%d "
288 "pairwise=%d ptk_set=%d len=%lu)",
289 error, pairwise, sm->ptk_set, (unsigned long) rlen);
290 wpa_eapol_key_send(sm, &sm->ptk, ver, wpa_sm_get_auth_addr(sm),
291 ETH_P_EAPOL, rbuf, rlen, key_mic);
292 }
293
294
wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm * sm)295 static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
296 {
297 #ifdef CONFIG_IEEE80211R
298 if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
299 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
300 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
301 "RSN: Cannot set low order 256 bits of MSK for key management offload");
302 } else {
303 #endif /* CONFIG_IEEE80211R */
304 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
305 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
306 "RSN: Cannot set PMK for key management offload");
307 #ifdef CONFIG_IEEE80211R
308 }
309 #endif /* CONFIG_IEEE80211R */
310 }
311
312
wpa_supplicant_get_pmk(struct wpa_sm * sm,const unsigned char * src_addr,const u8 * pmkid)313 static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
314 const unsigned char *src_addr,
315 const u8 *pmkid)
316 {
317 int abort_cached = 0;
318
319 if (pmkid && !sm->cur_pmksa) {
320 /* When using drivers that generate RSN IE, wpa_supplicant may
321 * not have enough time to get the association information
322 * event before receiving this 1/4 message, so try to find a
323 * matching PMKSA cache entry here. */
324 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr,
325 sm->own_addr, pmkid,
326 sm->network_ctx, sm->key_mgmt);
327 if (sm->cur_pmksa) {
328 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
329 "RSN: found matching PMKID from PMKSA cache");
330 } else {
331 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
332 "RSN: no matching PMKID found");
333 abort_cached = 1;
334 }
335 }
336
337 if (pmkid && sm->cur_pmksa &&
338 os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
339 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
340 wpa_sm_set_pmk_from_pmksa(sm);
341 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
342 sm->pmk, sm->pmk_len);
343 eapol_sm_notify_cached(sm->eapol);
344 #ifdef CONFIG_IEEE80211R
345 sm->xxkey_len = 0;
346 #ifdef CONFIG_SAE
347 if ((sm->key_mgmt == WPA_KEY_MGMT_FT_SAE ||
348 sm->key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) &&
349 sm->pmk_len == PMK_LEN) {
350 /* Need to allow FT key derivation to proceed with
351 * PMK from SAE being used as the XXKey in cases where
352 * the PMKID in msg 1/4 matches the PMKSA entry that was
353 * just added based on SAE authentication for the
354 * initial mobility domain association. */
355 os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
356 sm->xxkey_len = sm->pmk_len;
357 }
358 #endif /* CONFIG_SAE */
359 #endif /* CONFIG_IEEE80211R */
360 } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
361 int res, pmk_len;
362 #ifdef CONFIG_IEEE80211R
363 u8 buf[2 * PMK_LEN];
364 #endif /* CONFIG_IEEE80211R */
365
366 if (wpa_key_mgmt_sha384(sm->key_mgmt))
367 pmk_len = PMK_LEN_SUITE_B_192;
368 else
369 pmk_len = PMK_LEN;
370 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
371 if (res) {
372 if (pmk_len == PMK_LEN) {
373 /*
374 * EAP-LEAP is an exception from other EAP
375 * methods: it uses only 16-byte PMK.
376 */
377 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
378 pmk_len = 16;
379 }
380 }
381 #ifdef CONFIG_IEEE80211R
382 if (res == 0 &&
383 eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {
384 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
385 os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);
386 sm->xxkey_len = SHA384_MAC_LEN;
387 } else {
388 os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);
389 sm->xxkey_len = PMK_LEN;
390 }
391 forced_memzero(buf, sizeof(buf));
392 if (sm->proto == WPA_PROTO_RSN &&
393 wpa_key_mgmt_ft(sm->key_mgmt)) {
394 struct rsn_pmksa_cache_entry *sa = NULL;
395 const u8 *fils_cache_id = NULL;
396
397 #ifdef CONFIG_FILS
398 if (sm->fils_cache_id_set)
399 fils_cache_id = sm->fils_cache_id;
400 #endif /* CONFIG_FILS */
401 wpa_hexdump_key(MSG_DEBUG,
402 "FT: Cache XXKey/MPMK",
403 sm->xxkey, sm->xxkey_len);
404 sa = pmksa_cache_add(sm->pmksa,
405 sm->xxkey, sm->xxkey_len,
406 NULL, NULL, 0,
407 src_addr, sm->own_addr,
408 sm->network_ctx,
409 sm->key_mgmt,
410 fils_cache_id, 0);
411 if (!sm->cur_pmksa)
412 sm->cur_pmksa = sa;
413 }
414 }
415 #endif /* CONFIG_IEEE80211R */
416 if (res == 0) {
417 struct rsn_pmksa_cache_entry *sa = NULL;
418 const u8 *fils_cache_id = NULL;
419
420 #ifdef CONFIG_FILS
421 if (sm->fils_cache_id_set)
422 fils_cache_id = sm->fils_cache_id;
423 #endif /* CONFIG_FILS */
424
425 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
426 "machines", sm->pmk, pmk_len);
427 sm->pmk_len = pmk_len;
428 wpa_supplicant_key_mgmt_set_pmk(sm);
429 if (sm->proto == WPA_PROTO_RSN &&
430 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
431 !wpa_key_mgmt_ft(sm->key_mgmt)) {
432 u16 auth_alg = 0;
433
434 #ifdef CONFIG_IEEE8021X_AUTH
435 if (eapol_sm_get_eap_over_auth_frame(sm->eapol))
436 auth_alg = WLAN_AUTH_802_1X;
437 #endif /* CONFIG_IEEE8021X_AUTH */
438
439 sa = pmksa_cache_add(sm->pmksa,
440 sm->pmk, pmk_len, NULL,
441 NULL, 0,
442 src_addr, sm->own_addr,
443 sm->network_ctx,
444 sm->key_mgmt,
445 fils_cache_id, auth_alg);
446 }
447 if (!sm->cur_pmksa && pmkid &&
448 pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr,
449 pmkid, NULL, 0)) {
450 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
451 "RSN: the new PMK matches with the "
452 "PMKID");
453 abort_cached = 0;
454 } else if (sa && !sm->cur_pmksa && pmkid) {
455 /*
456 * It looks like the authentication server
457 * derived mismatching MSK. This should not
458 * really happen, but bugs happen.. There is not
459 * much we can do here without knowing what
460 * exactly caused the server to misbehave.
461 */
462 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
463 "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
464 return -1;
465 }
466
467 if (!sm->cur_pmksa)
468 sm->cur_pmksa = sa;
469 #ifdef CONFIG_IEEE80211R
470 } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {
471 wpa_printf(MSG_DEBUG,
472 "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");
473 #endif /* CONFIG_IEEE80211R */
474 } else {
475 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
476 "WPA: Failed to get master session key from "
477 "EAPOL state machines - key handshake "
478 "aborted");
479 if (sm->cur_pmksa) {
480 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
481 "RSN: Cancelled PMKSA caching "
482 "attempt");
483 sm->cur_pmksa = NULL;
484 abort_cached = 1;
485 } else if (!abort_cached) {
486 return -1;
487 }
488 }
489 }
490
491 if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
492 !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
493 !wpa_key_mgmt_ft(sm->key_mgmt)) {
494 #ifdef CONFIG_IEEE8021X_AUTH
495 if (eapol_sm_get_eap_over_auth_frame(sm->eapol)) {
496 wpa_printf(MSG_DEBUG,
497 "RSN: EAP over auth frame - skip EAPOL-Start");
498 return 0;
499 }
500 #endif /* CONFIG_IEEE8021X_AUTH */
501
502 /* Send EAPOL-Start to trigger full EAP authentication. */
503 u8 *buf;
504 size_t buflen;
505
506 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
507 "RSN: no PMKSA entry found - trigger "
508 "full EAP authentication");
509 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
510 NULL, 0, &buflen, NULL);
511 if (buf) {
512 /* Set and reset eapFail to allow EAP state machine to
513 * proceed with new authentication. */
514 eapol_sm_notify_eap_fail(sm->eapol, true);
515 eapol_sm_notify_eap_fail(sm->eapol, false);
516 wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
517 buf, buflen);
518 os_free(buf);
519 return -2;
520 }
521
522 return -1;
523 }
524
525 return 0;
526 }
527
528
529 /**
530 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
531 * @sm: Pointer to WPA state machine data from wpa_sm_init()
532 * @dst: Destination address for the frame
533 * @key: Pointer to the EAPOL-Key frame header
534 * @ver: Version bits from EAPOL-Key Key Info
535 * @nonce: Nonce value for the EAPOL-Key frame
536 * @wpa_ie: WPA/RSN IE
537 * @wpa_ie_len: Length of the WPA/RSN IE
538 * @ptk: PTK to use for keyed hash and encryption
539 * Returns: >= 0 on success, < 0 on failure
540 */
wpa_supplicant_send_2_of_4(struct wpa_sm * sm,const unsigned char * dst,const struct wpa_eapol_key * key,int ver,const u8 * nonce,const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ptk * ptk)541 int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
542 const struct wpa_eapol_key *key,
543 int ver, const u8 *nonce,
544 const u8 *wpa_ie, size_t wpa_ie_len,
545 struct wpa_ptk *ptk)
546 {
547 size_t mic_len, hdrlen, rlen, extra_len = 0;
548 struct wpa_eapol_key *reply;
549 u8 *rbuf, *key_mic;
550 u8 *rsn_ie_buf = NULL, *buf2 = NULL;
551 u16 key_info;
552 #ifdef CONFIG_TESTING_OPTIONS
553 size_t pad_len = 0;
554 #endif /* CONFIG_TESTING_OPTIONS */
555
556 if (wpa_ie == NULL) {
557 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
558 "cannot generate msg 2/4");
559 return -1;
560 }
561
562 #ifdef CONFIG_IEEE80211R
563 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
564 int res;
565
566 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE before FT processing",
567 wpa_ie, wpa_ie_len);
568 /*
569 * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
570 * FTIE from (Re)Association Response.
571 */
572 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
573 sm->assoc_resp_ies_len);
574 if (rsn_ie_buf == NULL)
575 return -1;
576 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
577 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
578 sm->pmk_r1_name, !sm->ft_prepend_pmkid);
579 if (res < 0) {
580 os_free(rsn_ie_buf);
581 return -1;
582 }
583 wpa_hexdump(MSG_DEBUG,
584 "WPA: WPA IE after PMKID[PMKR1Name] addition into RSNE",
585 rsn_ie_buf, wpa_ie_len);
586
587 if (sm->assoc_resp_ies) {
588 wpa_hexdump(MSG_DEBUG, "WPA: Add assoc_resp_ies",
589 sm->assoc_resp_ies,
590 sm->assoc_resp_ies_len);
591 os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
592 sm->assoc_resp_ies_len);
593 wpa_ie_len += sm->assoc_resp_ies_len;
594 }
595
596 wpa_ie = rsn_ie_buf;
597 }
598 #endif /* CONFIG_IEEE80211R */
599
600 if (sm->rsn_override != RSN_OVERRIDE_NOT_USED) {
601 u8 *pos;
602
603 buf2 = os_malloc(wpa_ie_len + 2 + 4 + 1);
604 if (!buf2) {
605 os_free(rsn_ie_buf);
606 return -1;
607 }
608 os_memcpy(buf2, wpa_ie, wpa_ie_len);
609 pos = buf2 + wpa_ie_len;
610 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
611 *pos++ = 4 + 1;
612 WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);
613 pos += 4;
614 if (sm->rsn_override == RSN_OVERRIDE_RSNE) {
615 *pos++ = RSN_SELECTION_RSNE;
616 } else if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE) {
617 *pos++ = RSN_SELECTION_RSNE_OVERRIDE;
618 } else if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE_2) {
619 *pos++ = RSN_SELECTION_RSNE_OVERRIDE_2;
620 } else {
621 os_free(rsn_ie_buf);
622 os_free(buf2);
623 return -1;
624 }
625
626 wpa_ie = buf2;
627 wpa_ie_len += 2 + 4 + 1;
628
629 }
630
631 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
632
633 #ifdef CONFIG_TESTING_OPTIONS
634 if (sm->test_eapol_m2_elems)
635 extra_len = wpabuf_len(sm->test_eapol_m2_elems);
636 if (sm->encrypt_eapol_m2) {
637 pad_len = (wpa_ie_len + extra_len) % 8;
638 if (pad_len)
639 pad_len = 8 - pad_len;
640 extra_len += pad_len + 8;
641 }
642 #endif /* CONFIG_TESTING_OPTIONS */
643
644 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
645 hdrlen = sizeof(*reply) + mic_len + 2;
646 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
647 NULL, hdrlen + wpa_ie_len + extra_len,
648 &rlen, (void *) &reply);
649 if (rbuf == NULL) {
650 os_free(rsn_ie_buf);
651 os_free(buf2);
652 return -1;
653 }
654
655 reply->type = (sm->proto == WPA_PROTO_RSN) ?
656 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
657 key_info = ver | WPA_KEY_INFO_KEY_TYPE;
658 if (sm->ptk_set && sm->proto != WPA_PROTO_WPA)
659 key_info |= WPA_KEY_INFO_SECURE;
660 if (mic_len)
661 key_info |= WPA_KEY_INFO_MIC;
662 else
663 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
664 #ifdef CONFIG_TESTING_OPTIONS
665 if (sm->encrypt_eapol_m2)
666 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
667 if (sm->eapol_2_key_info_set_mask)
668 key_info |= sm->eapol_2_key_info_set_mask;
669 #endif /* CONFIG_TESTING_OPTIONS */
670 WPA_PUT_BE16(reply->key_info, key_info);
671 if (sm->proto == WPA_PROTO_RSN)
672 WPA_PUT_BE16(reply->key_length, 0);
673 else
674 os_memcpy(reply->key_length, key->key_length, 2);
675 os_memcpy(reply->replay_counter, key->replay_counter,
676 WPA_REPLAY_COUNTER_LEN);
677 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
678 WPA_REPLAY_COUNTER_LEN);
679
680 key_mic = (u8 *) (reply + 1);
681 /* Key Data Length */
682 WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len + extra_len);
683 os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
684 os_free(rsn_ie_buf);
685 os_free(buf2);
686 #ifdef CONFIG_TESTING_OPTIONS
687 if (sm->test_eapol_m2_elems) {
688 os_memcpy(key_mic + mic_len + 2 + wpa_ie_len,
689 wpabuf_head(sm->test_eapol_m2_elems),
690 wpabuf_len(sm->test_eapol_m2_elems));
691 }
692
693 if (sm->encrypt_eapol_m2) {
694 u8 *plain;
695 size_t plain_len;
696
697 if (sm->test_eapol_m2_elems)
698 extra_len = wpabuf_len(sm->test_eapol_m2_elems);
699 else
700 extra_len = 0;
701 plain_len = wpa_ie_len + extra_len + pad_len;
702 plain = os_memdup(key_mic + mic_len + 2, plain_len);
703 if (!plain) {
704 os_free(rbuf);
705 return -1;
706 }
707 if (pad_len)
708 plain[plain_len - pad_len] = 0xdd;
709
710 wpa_hexdump_key(MSG_DEBUG, "RSN: AES-WRAP using KEK",
711 ptk->kek, ptk->kek_len);
712 if (aes_wrap(ptk->kek, ptk->kek_len, plain_len / 8, plain,
713 key_mic + mic_len + 2)) {
714 os_free(plain);
715 os_free(rbuf);
716 return -1;
717 }
718 wpa_hexdump(MSG_DEBUG,
719 "RSN: Encrypted Key Data from AES-WRAP",
720 key_mic + mic_len + 2, plain_len + 8);
721 os_free(plain);
722 }
723 #endif /* CONFIG_TESTING_OPTIONS */
724
725 os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
726
727 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
728 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
729 key_mic);
730 }
731
732
wpa_derive_ptk(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,struct wpa_ptk * ptk)733 static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
734 const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
735 {
736 int ret;
737 const u8 *z = NULL, *ap_rsnxe;
738 size_t z_len = 0, kdk_len, ap_rsnxe_len;
739 int akmp;
740
741 ap_rsnxe = wpa_sm_get_ap_rsnxe(sm, &ap_rsnxe_len);
742
743 #ifdef CONFIG_IEEE80211R
744 if (wpa_key_mgmt_ft(sm->key_mgmt))
745 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
746 #endif /* CONFIG_IEEE80211R */
747
748 #ifdef CONFIG_DPP2
749 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
750 z = wpabuf_head(sm->dpp_z);
751 z_len = wpabuf_len(sm->dpp_z);
752 }
753 #endif /* CONFIG_DPP2 */
754
755 akmp = sm->key_mgmt;
756 #ifdef CONFIG_OWE
757 if (sm->owe_ptk_workaround && akmp == WPA_KEY_MGMT_OWE &&
758 sm->pmk_len > 32) {
759 wpa_printf(MSG_DEBUG,
760 "OWE: Force SHA256 for PTK derivation");
761 akmp |= WPA_KEY_MGMT_PSK_SHA256;
762 }
763 #endif /* CONFIG_OWE */
764
765 if (sm->force_kdk_derivation ||
766 (sm->secure_ltf &&
767 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF)))
768 kdk_len = WPA_KDK_MAX_LEN;
769 else
770 kdk_len = 0;
771
772 ret = wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
773 sm->own_addr, wpa_sm_get_auth_addr(sm), sm->snonce,
774 key->key_nonce, ptk, akmp,
775 sm->pairwise_cipher, z, z_len,
776 kdk_len);
777 if (ret) {
778 wpa_printf(MSG_ERROR, "WPA: PTK derivation failed");
779 return ret;
780 }
781
782 #ifdef CONFIG_PASN
783 if (sm->secure_ltf &&
784 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF))
785 ret = wpa_ltf_keyseed(ptk, akmp, sm->pairwise_cipher);
786 #endif /* CONFIG_PASN */
787
788 return ret;
789 }
790
791
wpa_handle_ext_key_id(struct wpa_sm * sm,struct wpa_eapol_ie_parse * kde)792 static int wpa_handle_ext_key_id(struct wpa_sm *sm,
793 struct wpa_eapol_ie_parse *kde)
794 {
795 if (sm->ext_key_id) {
796 u16 key_id;
797
798 if (!kde->key_id) {
799 wpa_msg(sm->ctx->msg_ctx,
800 sm->use_ext_key_id ? MSG_INFO : MSG_DEBUG,
801 "RSN: No Key ID in Extended Key ID handshake");
802 sm->keyidx_active = 0;
803 return sm->use_ext_key_id ? -1 : 0;
804 }
805
806 key_id = kde->key_id[0] & 0x03;
807 if (key_id > 1) {
808 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
809 "RSN: Invalid Extended Key ID: %d", key_id);
810 return -1;
811 }
812 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
813 "RSN: Using Extended Key ID %d", key_id);
814 sm->keyidx_active = key_id;
815 sm->use_ext_key_id = 1;
816 } else {
817 if (kde->key_id && (kde->key_id[0] & 0x03)) {
818 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
819 "RSN: Non-zero Extended Key ID Key ID in PTK0 handshake");
820 return -1;
821 }
822
823 if (kde->key_id) {
824 /* This is not supposed to be included here, but ignore
825 * the case of matching Key ID 0 just in case. */
826 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
827 "RSN: Extended Key ID Key ID 0 in PTK0 handshake");
828 }
829 sm->keyidx_active = 0;
830 sm->use_ext_key_id = 0;
831 }
832
833 return 0;
834 }
835
836
rsn_add_kde(u8 * pos,u32 kde,const u8 * data,size_t data_len)837 static u8 * rsn_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len)
838 {
839 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
840 *pos++ = RSN_SELECTOR_LEN + data_len;
841 RSN_SELECTOR_PUT(pos, kde);
842 pos += RSN_SELECTOR_LEN;
843 os_memcpy(pos, data, data_len);
844 pos += data_len;
845
846 return pos;
847 }
848
849
wpa_mlo_link_kde_len(struct wpa_sm * sm)850 static size_t wpa_mlo_link_kde_len(struct wpa_sm *sm)
851 {
852 int i;
853 unsigned int num_links = 0;
854
855 for_each_link(sm->mlo.req_links, i) {
856 if (sm->mlo.assoc_link_id != i)
857 num_links++;
858 }
859
860 return num_links * (RSN_SELECTOR_LEN + 1 + ETH_ALEN + 2);
861 }
862
863
wpa_mlo_link_kde(struct wpa_sm * sm,u8 * pos)864 static u8 * wpa_mlo_link_kde(struct wpa_sm *sm, u8 *pos)
865 {
866 int i;
867 u8 hdr[1 + ETH_ALEN];
868
869 for_each_link(sm->mlo.req_links, i) {
870 if (sm->mlo.assoc_link_id == i)
871 continue;
872
873 wpa_printf(MSG_DEBUG,
874 "MLO: Add MLO Link %d KDE in EAPOL-Key 2/4", i);
875 hdr[0] = i & 0xF; /* LinkID; no RSNE or RSNXE */
876 os_memcpy(&hdr[1], sm->mlo.links[i].addr, ETH_ALEN);
877 pos = rsn_add_kde(pos, RSN_KEY_DATA_MLO_LINK, hdr, sizeof(hdr));
878 }
879
880 return pos;
881 }
882
883
is_valid_ap_mld_mac_kde(struct wpa_sm * sm,const u8 * mac_kde)884 static bool is_valid_ap_mld_mac_kde(struct wpa_sm *sm, const u8 *mac_kde)
885 {
886 return mac_kde &&
887 ether_addr_equal(mac_kde, sm->mlo.ap_mld_addr);
888 }
889
890
wpas_swap_tkip_mic_keys(struct wpa_ptk * ptk)891 static void wpas_swap_tkip_mic_keys(struct wpa_ptk *ptk)
892 {
893 u8 buf[8];
894
895 /* Supplicant: swap tx/rx Mic keys */
896 os_memcpy(buf, &ptk->tk[16], 8);
897 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
898 os_memcpy(&ptk->tk[24], buf, 8);
899 forced_memzero(buf, sizeof(buf));
900 }
901
902
wpa_supplicant_process_1_of_4_wpa(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len,enum frame_encryption encrypted)903 static void wpa_supplicant_process_1_of_4_wpa(struct wpa_sm *sm,
904 const unsigned char *src_addr,
905 const struct wpa_eapol_key *key,
906 u16 ver, const u8 *key_data,
907 size_t key_data_len,
908 enum frame_encryption encrypted)
909 {
910 struct wpa_eapol_ie_parse ie;
911 struct wpa_ptk *ptk;
912 int res;
913
914 if (wpa_sm_get_network_ctx(sm) == NULL) {
915 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
916 "WPA: No SSID info found (msg 1 of 4)");
917 return;
918 }
919
920 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
921 "WPA: RX message 1 of 4-Way Handshake from " MACSTR
922 " (ver=%d)", MAC2STR(src_addr), ver);
923
924 os_memset(&ie, 0, sizeof(ie));
925
926 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
927 if (res == -2) {
928 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
929 "WPA: Do not reply to msg 1/4 - requesting full EAP authentication");
930 return;
931 }
932 if (res)
933 goto failed;
934
935 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
936
937 if (sm->renew_snonce) {
938 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
939 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
940 "WPA: Failed to get random data for SNonce");
941 goto failed;
942 }
943 sm->renew_snonce = 0;
944 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
945 sm->snonce, WPA_NONCE_LEN);
946 }
947
948 /* Calculate PTK which will be stored as a temporary PTK until it has
949 * been verified when processing message 3/4. */
950 ptk = &sm->tptk;
951 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
952 goto failed;
953 if (sm->pairwise_cipher == WPA_CIPHER_TKIP)
954 wpas_swap_tkip_mic_keys(ptk);
955 sm->tptk_set = 1;
956 sm->hash_alg = ptk->hash_alg;
957
958 if (wpa_supplicant_send_2_of_4(sm, wpa_sm_get_auth_addr(sm), key, ver,
959 sm->snonce, sm->assoc_wpa_ie,
960 sm->assoc_wpa_ie_len, ptk) < 0)
961 goto failed;
962
963 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
964 return;
965
966 failed:
967 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
968 }
969
970
wpa_supplicant_process_1_of_4(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len,enum frame_encryption encrypted)971 static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
972 const unsigned char *src_addr,
973 const struct wpa_eapol_key *key,
974 u16 ver, const u8 *key_data,
975 size_t key_data_len,
976 enum frame_encryption encrypted)
977 {
978 struct wpa_eapol_ie_parse ie;
979 struct wpa_ptk *ptk;
980 int res;
981 u8 *kde, *kde_buf = NULL;
982 size_t kde_len;
983 size_t mlo_kde_len = 0;
984
985 if (encrypted == FRAME_NOT_ENCRYPTED && sm->tk_set &&
986 wpa_sm_pmf_enabled(sm)) {
987 wpa_printf(MSG_DEBUG,
988 "RSN: Discard unencrypted EAPOL-Key msg 1/4 when TK is set and PMF is enabled");
989 return;
990 }
991
992 if (wpa_sm_get_network_ctx(sm) == NULL) {
993 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
994 "found (msg 1 of 4)");
995 return;
996 }
997
998 if (sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&
999 wpa_sm_get_state(sm) == WPA_COMPLETED) {
1000 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1001 "WPA: PTK0 rekey not allowed, reconnecting");
1002 wpa_sm_reconnect(sm);
1003 return;
1004 }
1005
1006 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of 4-Way "
1007 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1008
1009 os_memset(&ie, 0, sizeof(ie));
1010
1011 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
1012 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data", key_data, key_data_len);
1013 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0) {
1014 wpa_printf(MSG_DEBUG,
1015 "RSN: Discard EAPOL-Key msg 1/4 with invalid IEs/KDEs");
1016 return;
1017 }
1018 if (ie.pmkid) {
1019 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from Authenticator",
1020 ie.pmkid, PMKID_LEN);
1021 }
1022
1023 if (sm->mlo.valid_links && !is_valid_ap_mld_mac_kde(sm, ie.mac_addr)) {
1024 wpa_printf(MSG_INFO,
1025 "RSN: Discard EAPOL-Key msg 1/4 with invalid AP MLD MAC address KDE");
1026 return;
1027 }
1028
1029 res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
1030 if (res == -2) {
1031 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
1032 "msg 1/4 - requesting full EAP authentication");
1033 return;
1034 }
1035 if (res)
1036 goto failed;
1037
1038 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
1039
1040 if (sm->renew_snonce) {
1041 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
1042 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1043 "WPA: Failed to get random data for SNonce");
1044 goto failed;
1045 }
1046 if (wpa_sm_rsn_overriding_supported(sm))
1047 rsn_set_snonce_cookie(sm->snonce);
1048 sm->renew_snonce = 0;
1049 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
1050 sm->snonce, WPA_NONCE_LEN);
1051 }
1052
1053 /* Calculate PTK which will be stored as a temporary PTK until it has
1054 * been verified when processing message 3/4. */
1055 ptk = &sm->tptk;
1056 if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
1057 goto failed;
1058 if (sm->pairwise_cipher == WPA_CIPHER_TKIP)
1059 wpas_swap_tkip_mic_keys(ptk);
1060 sm->tptk_set = 1;
1061 sm->hash_alg = ptk->hash_alg;
1062
1063 /* Add MLO Link KDE and MAC KDE in M2 for ML connection */
1064 if (sm->mlo.valid_links)
1065 mlo_kde_len = wpa_mlo_link_kde_len(sm) +
1066 RSN_SELECTOR_LEN + ETH_ALEN + 2;
1067
1068 kde = sm->assoc_wpa_ie;
1069 kde_len = sm->assoc_wpa_ie_len;
1070 kde_buf = os_malloc(kde_len +
1071 2 + RSN_SELECTOR_LEN + 3 +
1072 sm->assoc_rsnxe_len +
1073 2 + RSN_SELECTOR_LEN + 1 +
1074 2 + RSN_SELECTOR_LEN + 2 + mlo_kde_len);
1075
1076 if (!kde_buf)
1077 goto failed;
1078 os_memcpy(kde_buf, kde, kde_len);
1079 kde = kde_buf;
1080
1081 #ifdef CONFIG_OCV
1082 if (wpa_sm_ocv_enabled(sm)) {
1083 struct wpa_channel_info ci;
1084 u8 *pos;
1085
1086 pos = kde + kde_len;
1087 if (wpa_sm_channel_info(sm, &ci) != 0) {
1088 wpa_printf(MSG_WARNING,
1089 "Failed to get channel info for OCI element in EAPOL-Key 2/4");
1090 goto failed;
1091 }
1092 #ifdef CONFIG_TESTING_OPTIONS
1093 if (sm->oci_freq_override_eapol) {
1094 wpa_printf(MSG_INFO,
1095 "TEST: Override OCI KDE frequency %d -> %d MHz",
1096 ci.frequency, sm->oci_freq_override_eapol);
1097 ci.frequency = sm->oci_freq_override_eapol;
1098 }
1099 #endif /* CONFIG_TESTING_OPTIONS */
1100
1101 if (ocv_insert_oci_kde(&ci, &pos) < 0)
1102 goto failed;
1103 kde_len = pos - kde;
1104 }
1105 #endif /* CONFIG_OCV */
1106
1107 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len) {
1108 os_memcpy(kde + kde_len, sm->assoc_rsnxe, sm->assoc_rsnxe_len);
1109 kde_len += sm->assoc_rsnxe_len;
1110 }
1111
1112 #ifdef CONFIG_P2P
1113 if (sm->p2p) {
1114 u8 *pos;
1115
1116 wpa_printf(MSG_DEBUG,
1117 "P2P: Add IP Address Request KDE into EAPOL-Key 2/4");
1118 pos = kde + kde_len;
1119 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
1120 *pos++ = RSN_SELECTOR_LEN + 1;
1121 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
1122 pos += RSN_SELECTOR_LEN;
1123 *pos++ = 0x01;
1124 kde_len = pos - kde;
1125 }
1126 #endif /* CONFIG_P2P */
1127
1128 #ifdef CONFIG_DPP2
1129 if (DPP_VERSION > 1 && sm->key_mgmt == WPA_KEY_MGMT_DPP) {
1130 u8 *pos;
1131
1132 wpa_printf(MSG_DEBUG, "DPP: Add DPP KDE into EAPOL-Key 2/4");
1133 pos = kde + kde_len;
1134 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
1135 *pos++ = RSN_SELECTOR_LEN + 2;
1136 RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_DPP);
1137 pos += RSN_SELECTOR_LEN;
1138 *pos++ = DPP_VERSION; /* Protocol Version */
1139 *pos = 0; /* Flags */
1140 if (sm->dpp_pfs == 0)
1141 *pos |= DPP_KDE_PFS_ALLOWED;
1142 else if (sm->dpp_pfs == 1)
1143 *pos |= DPP_KDE_PFS_ALLOWED | DPP_KDE_PFS_REQUIRED;
1144 pos++;
1145 kde_len = pos - kde;
1146 }
1147 #endif /* CONFIG_DPP2 */
1148
1149 if (sm->mlo.valid_links) {
1150 u8 *pos;
1151
1152 /* Add MAC KDE */
1153 wpa_printf(MSG_DEBUG, "MLO: Add MAC KDE into EAPOL-Key 2/4");
1154 pos = kde + kde_len;
1155 pos = rsn_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, sm->own_addr,
1156 ETH_ALEN);
1157
1158 /* Add MLO Link KDE */
1159 wpa_printf(MSG_DEBUG, "Add MLO Link KDE(s) into EAPOL-Key 2/4");
1160 pos = wpa_mlo_link_kde(sm, pos);
1161 kde_len = pos - kde;
1162 }
1163
1164 if (wpa_supplicant_send_2_of_4(sm, wpa_sm_get_auth_addr(sm), key, ver,
1165 sm->snonce, kde, kde_len, ptk) < 0)
1166 goto failed;
1167
1168 os_free(kde_buf);
1169 os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
1170 return;
1171
1172 failed:
1173 os_free(kde_buf);
1174 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
1175 }
1176
1177
wpa_sm_start_preauth(void * eloop_ctx,void * timeout_ctx)1178 static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
1179 {
1180 struct wpa_sm *sm = eloop_ctx;
1181 rsn_preauth_candidate_process(sm);
1182 }
1183
1184
wpa_supplicant_key_neg_complete(struct wpa_sm * sm,const u8 * addr,int secure)1185 static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
1186 const u8 *addr, int secure)
1187 {
1188 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1189 "WPA: Key negotiation completed with "
1190 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
1191 wpa_cipher_txt(sm->pairwise_cipher),
1192 wpa_cipher_txt(sm->group_cipher));
1193 wpa_sm_cancel_auth_timeout(sm);
1194 wpa_sm_set_state(sm, WPA_COMPLETED);
1195
1196 if (secure) {
1197 wpa_sm_mlme_setprotection(
1198 sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
1199 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1200 eapol_sm_notify_portValid(sm->eapol, true);
1201 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
1202 sm->key_mgmt == WPA_KEY_MGMT_DPP ||
1203 sm->key_mgmt == WPA_KEY_MGMT_OWE)
1204 eapol_sm_notify_eap_success(sm->eapol, true);
1205 /*
1206 * Start preauthentication after a short wait to avoid a
1207 * possible race condition between the data receive and key
1208 * configuration after the 4-Way Handshake. This increases the
1209 * likelihood of the first preauth EAPOL-Start frame getting to
1210 * the target AP.
1211 */
1212 if (!dl_list_empty(&sm->pmksa_candidates))
1213 eloop_register_timeout(1, 0, wpa_sm_start_preauth,
1214 sm, NULL);
1215 }
1216
1217 if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
1218 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1219 "RSN: Authenticator accepted "
1220 "opportunistic PMKSA entry - marking it valid");
1221 sm->cur_pmksa->opportunistic = 0;
1222 }
1223
1224 #ifdef CONFIG_IEEE80211R
1225 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
1226 /* Prepare for the next transition */
1227 wpa_ft_prepare_auth_request(sm, NULL);
1228 }
1229 #endif /* CONFIG_IEEE80211R */
1230 }
1231
1232
wpa_sm_rekey_ptk(void * eloop_ctx,void * timeout_ctx)1233 static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
1234 {
1235 struct wpa_sm *sm = eloop_ctx;
1236 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
1237 wpa_sm_key_request(sm, 0, 1);
1238 }
1239
1240
wpa_supplicant_install_ptk(struct wpa_sm * sm,const struct wpa_eapol_key * key,enum key_flag key_flag)1241 static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
1242 const struct wpa_eapol_key *key,
1243 enum key_flag key_flag)
1244 {
1245 int keylen, rsclen;
1246 enum wpa_alg alg;
1247 const u8 *key_rsc;
1248 #ifdef CONFIG_PASN
1249 const u8 *ap_rsnxe;
1250 size_t ap_rsnxe_len;
1251 #endif /* CONFIG_PASN */
1252
1253 if (sm->ptk.installed ||
1254 (sm->ptk.installed_rx && (key_flag & KEY_FLAG_NEXT))) {
1255 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1256 "WPA: Do not re-install same PTK to the driver");
1257 return 0;
1258 }
1259
1260 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1261 "WPA: Installing %sTK to the driver",
1262 (key_flag & KEY_FLAG_NEXT) ? "next " : "");
1263
1264 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
1265 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
1266 "Suite: NONE - do not use pairwise keys");
1267 return 0;
1268 }
1269
1270 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
1271 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1272 "WPA: Unsupported pairwise cipher %d",
1273 sm->pairwise_cipher);
1274 return -1;
1275 }
1276
1277 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
1278 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
1279 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
1280 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
1281 keylen, (long unsigned int) sm->ptk.tk_len);
1282 return -1;
1283 }
1284 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
1285
1286 if (sm->proto == WPA_PROTO_RSN) {
1287 key_rsc = null_rsc;
1288 } else {
1289 key_rsc = key->key_rsc;
1290 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
1291 }
1292
1293 if (wpa_sm_set_key(sm, -1, alg, wpa_sm_get_auth_addr(sm),
1294 sm->keyidx_active, 1, key_rsc, rsclen, sm->ptk.tk,
1295 keylen, KEY_FLAG_PAIRWISE | key_flag) < 0) {
1296 if (key_flag & KEY_FLAG_NEXT)
1297 return 0; /* Not all drivers support this, so do not
1298 * report failures on the RX-only set_key */
1299 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1300 "WPA: Failed to set PTK to the driver (alg=%d keylen=%d auth_addr="
1301 MACSTR " idx=%d key_flag=0x%x)",
1302 alg, keylen, MAC2STR(wpa_sm_get_auth_addr(sm)),
1303 sm->keyidx_active, key_flag);
1304 return -1;
1305 }
1306
1307 #ifdef CONFIG_PASN
1308 ap_rsnxe = wpa_sm_get_ap_rsnxe(sm, &ap_rsnxe_len);
1309 if (sm->secure_ltf &&
1310 ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF) &&
1311 wpa_sm_set_ltf_keyseed(sm, sm->own_addr, sm->bssid,
1312 sm->ptk.ltf_keyseed_len,
1313 sm->ptk.ltf_keyseed) < 0) {
1314 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1315 "WPA: Failed to set LTF keyseed to the driver (keylen=%zu bssid="
1316 MACSTR ")", sm->ptk.ltf_keyseed_len,
1317 MAC2STR(sm->bssid));
1318 return -1;
1319 }
1320 #endif /* CONFIG_PASN */
1321
1322 wpa_sm_store_ptk(sm, wpa_sm_get_auth_addr(sm), sm->pairwise_cipher,
1323 sm->dot11RSNAConfigPMKLifetime, &sm->ptk);
1324
1325 if (key_flag & KEY_FLAG_NEXT) {
1326 sm->ptk.installed_rx = true;
1327 } else {
1328 #ifndef CONFIG_TESTING_OPTIONS
1329 /* TK is not needed anymore in supplicant */
1330 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
1331 sm->ptk.tk_len = 0;
1332 #endif /* CONFIG_TESTING_OPTIONS */
1333 sm->ptk.installed = 1;
1334 sm->tk_set = true;
1335 }
1336
1337 if (sm->wpa_ptk_rekey) {
1338 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
1339 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
1340 sm, NULL);
1341 }
1342 return 0;
1343 }
1344
1345
wpa_supplicant_activate_ptk(struct wpa_sm * sm)1346 static int wpa_supplicant_activate_ptk(struct wpa_sm *sm)
1347 {
1348 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1349 "WPA: Activate PTK (idx=%d auth_addr=" MACSTR ")",
1350 sm->keyidx_active, MAC2STR(wpa_sm_get_auth_addr(sm)));
1351
1352 if (wpa_sm_set_key(sm, -1, 0, wpa_sm_get_auth_addr(sm),
1353 sm->keyidx_active, 0, NULL, 0, NULL, 0,
1354 KEY_FLAG_PAIRWISE_RX_TX_MODIFY) < 0) {
1355 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1356 "WPA: Failed to activate PTK for TX (idx=%d auth_addr="
1357 MACSTR ")", sm->keyidx_active,
1358 MAC2STR(wpa_sm_get_auth_addr(sm)));
1359 return -1;
1360 }
1361 return 0;
1362 }
1363
1364
wpa_supplicant_check_group_cipher(struct wpa_sm * sm,int group_cipher,int keylen,int maxkeylen,int * key_rsc_len,enum wpa_alg * alg)1365 static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
1366 int group_cipher,
1367 int keylen, int maxkeylen,
1368 int *key_rsc_len,
1369 enum wpa_alg *alg)
1370 {
1371 int klen;
1372
1373 *alg = wpa_cipher_to_alg(group_cipher);
1374 if (*alg == WPA_ALG_NONE) {
1375 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1376 "WPA: Unsupported Group Cipher %d",
1377 group_cipher);
1378 return -1;
1379 }
1380 *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
1381
1382 klen = wpa_cipher_key_len(group_cipher);
1383 if (keylen != klen || maxkeylen < klen) {
1384 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1385 "WPA: Unsupported %s Group Cipher key length %d (%d)",
1386 wpa_cipher_txt(group_cipher), keylen, maxkeylen);
1387 return -1;
1388 }
1389 return 0;
1390 }
1391
1392
1393 struct wpa_gtk_data {
1394 enum wpa_alg alg;
1395 int tx, key_rsc_len, keyidx;
1396 u8 gtk[WPA_GTK_MAX_LEN];
1397 int gtk_len;
1398 };
1399
1400
wpa_supplicant_validate_gtk_kde_len(size_t gtk_len)1401 static int wpa_supplicant_validate_gtk_kde_len(size_t gtk_len)
1402 {
1403 if (gtk_len < 2 || gtk_len - 2 > WPA_GTK_MAX_LEN)
1404 return -1;
1405
1406 return 0;
1407 }
1408
1409
wpa_supplicant_validate_mlo_gtk_kde_len(size_t gtk_len)1410 static int wpa_supplicant_validate_mlo_gtk_kde_len(size_t gtk_len)
1411 {
1412 if (gtk_len < RSN_MLO_GTK_KDE_PREFIX_LENGTH ||
1413 gtk_len - RSN_MLO_GTK_KDE_PREFIX_LENGTH > WPA_GTK_MAX_LEN)
1414 return -1;
1415
1416 return 0;
1417 }
1418
1419
wpa_supplicant_install_gtk(struct wpa_sm * sm,const struct wpa_gtk_data * gd,const u8 * key_rsc,int wnm_sleep)1420 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
1421 const struct wpa_gtk_data *gd,
1422 const u8 *key_rsc, int wnm_sleep)
1423 {
1424 const u8 *_gtk = gd->gtk;
1425 u8 gtk_buf[32];
1426
1427 /* Detect possible key reinstallation */
1428 if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
1429 os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
1430 (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
1431 os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
1432 sm->gtk_wnm_sleep.gtk_len) == 0)) {
1433 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1434 "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
1435 gd->keyidx, gd->tx, gd->gtk_len);
1436 return 0;
1437 }
1438
1439 wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
1440 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1441 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
1442 gd->keyidx, gd->tx, gd->gtk_len);
1443 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
1444 if (sm->group_cipher == WPA_CIPHER_TKIP) {
1445 /* Swap Tx/Rx keys for Michael MIC */
1446 os_memcpy(gtk_buf, gd->gtk, 16);
1447 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
1448 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
1449 _gtk = gtk_buf;
1450 }
1451 if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
1452 if (wpa_sm_set_key(sm, -1, gd->alg, NULL,
1453 gd->keyidx, 1, key_rsc, gd->key_rsc_len,
1454 _gtk, gd->gtk_len,
1455 KEY_FLAG_GROUP_RX_TX_DEFAULT) < 0) {
1456 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1457 "WPA: Failed to set GTK to the driver "
1458 "(Group only)");
1459 forced_memzero(gtk_buf, sizeof(gtk_buf));
1460 return -1;
1461 }
1462 } else if (wpa_sm_set_key(sm, -1, gd->alg, broadcast_ether_addr,
1463 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
1464 _gtk, gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
1465 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1466 "WPA: Failed to set GTK to "
1467 "the driver (alg=%d keylen=%d keyidx=%d)",
1468 gd->alg, gd->gtk_len, gd->keyidx);
1469 forced_memzero(gtk_buf, sizeof(gtk_buf));
1470 return -1;
1471 }
1472 forced_memzero(gtk_buf, sizeof(gtk_buf));
1473
1474 if (wnm_sleep) {
1475 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
1476 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
1477 sm->gtk_wnm_sleep.gtk_len);
1478 } else {
1479 sm->gtk.gtk_len = gd->gtk_len;
1480 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
1481 }
1482
1483 return 0;
1484 }
1485
1486
wpa_supplicant_install_mlo_gtk(struct wpa_sm * sm,u8 link_id,const struct wpa_gtk_data * gd,const u8 * key_rsc,int wnm_sleep)1487 static int wpa_supplicant_install_mlo_gtk(struct wpa_sm *sm, u8 link_id,
1488 const struct wpa_gtk_data *gd,
1489 const u8 *key_rsc, int wnm_sleep)
1490 {
1491 const u8 *gtk = gd->gtk;
1492 u8 gtk_buf[32];
1493
1494 /* Detect possible key reinstallation */
1495 if ((sm->mlo.links[link_id].gtk.gtk_len == (size_t) gd->gtk_len &&
1496 os_memcmp(sm->mlo.links[link_id].gtk.gtk, gd->gtk,
1497 sm->mlo.links[link_id].gtk.gtk_len) == 0) ||
1498 (sm->mlo.links[link_id].gtk_wnm_sleep.gtk_len ==
1499 (size_t) gd->gtk_len &&
1500 os_memcmp(sm->mlo.links[link_id].gtk_wnm_sleep.gtk, gd->gtk,
1501 sm->mlo.links[link_id].gtk_wnm_sleep.gtk_len) == 0)) {
1502 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1503 "RSN: Not reinstalling already in-use GTK to the driver (link_id=%d keyidx=%d tx=%d len=%d)",
1504 link_id, gd->keyidx, gd->tx, gd->gtk_len);
1505 return 0;
1506 }
1507
1508 wpa_hexdump_link_key(MSG_DEBUG, link_id, "RSN: Group Key", gd->gtk,
1509 gd->gtk_len);
1510 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1511 "RSN: Installing GTK to the driver (link_id=%d keyidx=%d tx=%d len=%d)",
1512 link_id, gd->keyidx, gd->tx, gd->gtk_len);
1513 wpa_hexdump_link(MSG_DEBUG, link_id, "RSN: RSC",
1514 key_rsc, gd->key_rsc_len);
1515 if (sm->group_cipher == WPA_CIPHER_TKIP) {
1516 /* Swap Tx/Rx keys for Michael MIC */
1517 os_memcpy(gtk_buf, gd->gtk, 16);
1518 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
1519 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
1520 gtk = gtk_buf;
1521 }
1522 if (wpa_sm_set_key(sm, link_id, gd->alg, broadcast_ether_addr,
1523 gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len, gtk,
1524 gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
1525 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1526 "RSN: Failed to set GTK to the driver (link_id=%d alg=%d keylen=%d keyidx=%d)",
1527 link_id, gd->alg, gd->gtk_len, gd->keyidx);
1528 forced_memzero(gtk_buf, sizeof(gtk_buf));
1529 return -1;
1530 }
1531 forced_memzero(gtk_buf, sizeof(gtk_buf));
1532
1533 if (wnm_sleep) {
1534 sm->mlo.links[link_id].gtk_wnm_sleep.gtk_len = gd->gtk_len;
1535 os_memcpy(sm->mlo.links[link_id].gtk_wnm_sleep.gtk, gd->gtk,
1536 sm->mlo.links[link_id].gtk_wnm_sleep.gtk_len);
1537 } else {
1538 sm->mlo.links[link_id].gtk.gtk_len = gd->gtk_len;
1539 os_memcpy(sm->mlo.links[link_id].gtk.gtk, gd->gtk,
1540 sm->mlo.links[link_id].gtk.gtk_len);
1541 }
1542
1543 return 0;
1544 }
1545
1546
wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm * sm,int tx)1547 static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
1548 int tx)
1549 {
1550 if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
1551 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
1552 * seemed to set this bit (incorrectly, since Tx is only when
1553 * doing Group Key only APs) and without this workaround, the
1554 * data connection does not work because wpa_supplicant
1555 * configured non-zero keyidx to be used for unicast. */
1556 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1557 "WPA: Tx bit set for GTK, but pairwise "
1558 "keys are used - ignore Tx bit");
1559 return 0;
1560 }
1561 return tx;
1562 }
1563
1564
wpa_supplicant_rsc_relaxation(const struct wpa_sm * sm,const u8 * rsc)1565 static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
1566 const u8 *rsc)
1567 {
1568 int rsclen;
1569
1570 if (!sm->wpa_rsc_relaxation)
1571 return 0;
1572
1573 rsclen = wpa_cipher_rsc_len(sm->group_cipher);
1574
1575 /*
1576 * Try to detect RSC (endian) corruption issue where the AP sends
1577 * the RSC bytes in EAPOL-Key message in the wrong order, both if
1578 * it's actually a 6-byte field (as it should be) and if it treats
1579 * it as an 8-byte field.
1580 * An AP model known to have this bug is the Sapido RB-1632.
1581 */
1582 if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
1583 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1584 "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
1585 rsc[0], rsc[1], rsc[2], rsc[3],
1586 rsc[4], rsc[5], rsc[6], rsc[7]);
1587
1588 return 1;
1589 }
1590
1591 return 0;
1592 }
1593
1594
wpa_supplicant_mlo_gtk(struct wpa_sm * sm,u8 link_id,const u8 * gtk,size_t gtk_len,int key_info)1595 static int wpa_supplicant_mlo_gtk(struct wpa_sm *sm, u8 link_id, const u8 *gtk,
1596 size_t gtk_len, int key_info)
1597 {
1598 struct wpa_gtk_data gd;
1599 const u8 *key_rsc;
1600 int ret;
1601
1602 /*
1603 * MLO GTK KDE format:
1604 * KeyID[bits 0-1], Tx [bit 2], Reserved [bit 3], link id [4-7]
1605 * PN
1606 * GTK
1607 */
1608 os_memset(&gd, 0, sizeof(gd));
1609 wpa_hexdump_link_key(MSG_DEBUG, link_id,
1610 "RSN: received GTK in pairwise handshake",
1611 gtk, gtk_len);
1612
1613 if (wpa_supplicant_validate_mlo_gtk_kde_len(gtk_len) < 0)
1614 return -1;
1615
1616 gd.keyidx = gtk[0] & 0x3;
1617 gtk += 1;
1618 gtk_len -= 1;
1619
1620 key_rsc = gtk;
1621
1622 gtk += 6;
1623 gtk_len -= 6;
1624
1625 os_memcpy(gd.gtk, gtk, gtk_len);
1626 gd.gtk_len = gtk_len;
1627
1628 ret = 0;
1629 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, gtk_len,
1630 gtk_len, &gd.key_rsc_len,
1631 &gd.alg) ||
1632 wpa_supplicant_install_mlo_gtk(sm, link_id, &gd, key_rsc, 0)) {
1633 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1634 "RSN: Failed to install GTK for MLO Link ID %u",
1635 link_id);
1636 ret = -1;
1637 goto out;
1638 }
1639
1640 out:
1641 forced_memzero(&gd, sizeof(gd));
1642 return ret;
1643 }
1644
1645
wpa_supplicant_pairwise_mlo_gtk(struct wpa_sm * sm,const struct wpa_eapol_key * key,struct wpa_eapol_ie_parse * ie,int key_info)1646 static int wpa_supplicant_pairwise_mlo_gtk(struct wpa_sm *sm,
1647 const struct wpa_eapol_key *key,
1648 struct wpa_eapol_ie_parse *ie,
1649 int key_info)
1650 {
1651 u8 i;
1652
1653 for_each_link(sm->mlo.valid_links, i) {
1654 if (!ie->mlo_gtk[i]) {
1655 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1656 "MLO RSN: GTK not found for link ID %u", i);
1657 return -1;
1658 }
1659
1660 if (wpa_supplicant_mlo_gtk(sm, i, ie->mlo_gtk[i],
1661 ie->mlo_gtk_len[i], key_info))
1662 return -1;
1663 }
1664
1665 return 0;
1666 }
1667
1668
wpa_supplicant_pairwise_gtk(struct wpa_sm * sm,const struct wpa_eapol_key * key,const u8 * gtk,size_t gtk_len,int key_info)1669 static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1670 const struct wpa_eapol_key *key,
1671 const u8 *gtk, size_t gtk_len,
1672 int key_info)
1673 {
1674 struct wpa_gtk_data gd;
1675 const u8 *key_rsc;
1676
1677 /*
1678 * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1679 * GTK KDE format:
1680 * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1681 * Reserved [bits 0-7]
1682 * GTK
1683 */
1684
1685 os_memset(&gd, 0, sizeof(gd));
1686 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1687 gtk, gtk_len);
1688
1689 if (wpa_supplicant_validate_gtk_kde_len(gtk_len) < 0)
1690 return -1;
1691
1692 gd.keyidx = gtk[0] & 0x3;
1693 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1694 !!(gtk[0] & BIT(2)));
1695 gtk += 2;
1696 gtk_len -= 2;
1697
1698 os_memcpy(gd.gtk, gtk, gtk_len);
1699 gd.gtk_len = gtk_len;
1700
1701 key_rsc = key->key_rsc;
1702 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1703 key_rsc = null_rsc;
1704
1705 if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
1706 (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1707 gtk_len, gtk_len,
1708 &gd.key_rsc_len, &gd.alg) ||
1709 wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
1710 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1711 "RSN: Failed to install GTK");
1712 forced_memzero(&gd, sizeof(gd));
1713 return -1;
1714 }
1715 forced_memzero(&gd, sizeof(gd));
1716
1717 return 0;
1718 }
1719
1720
wpa_supplicant_install_igtk(struct wpa_sm * sm,const struct wpa_igtk_kde * igtk,int wnm_sleep)1721 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
1722 const struct wpa_igtk_kde *igtk,
1723 int wnm_sleep)
1724 {
1725 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1726 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1727
1728 /* Detect possible key reinstallation */
1729 if ((sm->igtk.igtk_len == len &&
1730 os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1731 (sm->igtk_wnm_sleep.igtk_len == len &&
1732 os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1733 sm->igtk_wnm_sleep.igtk_len) == 0)) {
1734 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1735 "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1736 keyidx);
1737 return 0;
1738 }
1739
1740 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1741 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
1742 keyidx, MAC2STR(igtk->pn));
1743 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1744 if (keyidx > 4095) {
1745 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1746 "WPA: Invalid IGTK KeyID %d", keyidx);
1747 return -1;
1748 }
1749 if (wpa_sm_set_key(sm, -1, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1750 broadcast_ether_addr,
1751 keyidx, 0, igtk->pn, sizeof(igtk->pn),
1752 igtk->igtk, len, KEY_FLAG_GROUP_RX) < 0) {
1753 if (keyidx == 0x0400 || keyidx == 0x0500) {
1754 /* Assume the AP has broken PMF implementation since it
1755 * seems to have swapped the KeyID bytes. The AP cannot
1756 * be trusted to implement BIP correctly or provide a
1757 * valid IGTK, so do not try to configure this key with
1758 * swapped KeyID bytes. Instead, continue without
1759 * configuring the IGTK so that the driver can drop any
1760 * received group-addressed robust management frames due
1761 * to missing keys.
1762 *
1763 * Normally, this error behavior would result in us
1764 * disconnecting, but there are number of deployed APs
1765 * with this broken behavior, so as an interoperability
1766 * workaround, allow the connection to proceed. */
1767 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1768 "WPA: Ignore IGTK configuration error due to invalid IGTK KeyID byte order");
1769 } else {
1770 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1771 "WPA: Failed to configure IGTK to the driver");
1772 return -1;
1773 }
1774 }
1775
1776 if (wnm_sleep) {
1777 sm->igtk_wnm_sleep.igtk_len = len;
1778 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1779 sm->igtk_wnm_sleep.igtk_len);
1780 } else {
1781 sm->igtk.igtk_len = len;
1782 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1783 }
1784
1785 return 0;
1786 }
1787
1788
wpa_supplicant_install_bigtk(struct wpa_sm * sm,const struct wpa_bigtk_kde * bigtk,int wnm_sleep)1789 static int wpa_supplicant_install_bigtk(struct wpa_sm *sm,
1790 const struct wpa_bigtk_kde *bigtk,
1791 int wnm_sleep)
1792 {
1793 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1794 u16 keyidx = WPA_GET_LE16(bigtk->keyid);
1795
1796 /* Detect possible key reinstallation */
1797 if ((sm->bigtk.bigtk_len == len &&
1798 os_memcmp(sm->bigtk.bigtk, bigtk->bigtk,
1799 sm->bigtk.bigtk_len) == 0) ||
1800 (sm->bigtk_wnm_sleep.bigtk_len == len &&
1801 os_memcmp(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1802 sm->bigtk_wnm_sleep.bigtk_len) == 0)) {
1803 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1804 "WPA: Not reinstalling already in-use BIGTK to the driver (keyidx=%d)",
1805 keyidx);
1806 return 0;
1807 }
1808
1809 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1810 "WPA: BIGTK keyid %d pn " COMPACT_MACSTR,
1811 keyidx, MAC2STR(bigtk->pn));
1812 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK", bigtk->bigtk, len);
1813 if (keyidx < 6 || keyidx > 7) {
1814 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1815 "WPA: Invalid BIGTK KeyID %d", keyidx);
1816 return -1;
1817 }
1818 if (wpa_sm_set_key(sm, -1, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1819 broadcast_ether_addr,
1820 keyidx, 0, bigtk->pn, sizeof(bigtk->pn),
1821 bigtk->bigtk, len, KEY_FLAG_GROUP_RX) < 0) {
1822 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1823 "WPA: Failed to configure BIGTK to the driver");
1824 return -1;
1825 }
1826
1827 if (wnm_sleep) {
1828 sm->bigtk_wnm_sleep.bigtk_len = len;
1829 os_memcpy(sm->bigtk_wnm_sleep.bigtk, bigtk->bigtk,
1830 sm->bigtk_wnm_sleep.bigtk_len);
1831 } else {
1832 sm->bigtk.bigtk_len = len;
1833 os_memcpy(sm->bigtk.bigtk, bigtk->bigtk, sm->bigtk.bigtk_len);
1834 }
1835
1836 return 0;
1837 }
1838
1839
wpa_supplicant_install_mlo_igtk(struct wpa_sm * sm,u8 link_id,const struct rsn_mlo_igtk_kde * igtk,int wnm_sleep)1840 static int wpa_supplicant_install_mlo_igtk(struct wpa_sm *sm, u8 link_id,
1841 const struct rsn_mlo_igtk_kde *igtk,
1842 int wnm_sleep)
1843 {
1844 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1845 u16 keyidx = WPA_GET_LE16(igtk->keyid);
1846
1847 /* Detect possible key reinstallation */
1848 if ((sm->mlo.links[link_id].igtk.igtk_len == len &&
1849 os_memcmp(sm->mlo.links[link_id].igtk.igtk, igtk->igtk,
1850 sm->mlo.links[link_id].igtk.igtk_len) == 0) ||
1851 (sm->mlo.links[link_id].igtk_wnm_sleep.igtk_len == len &&
1852 os_memcmp(sm->mlo.links[link_id].igtk_wnm_sleep.igtk, igtk->igtk,
1853 sm->mlo.links[link_id].igtk_wnm_sleep.igtk_len) == 0)) {
1854 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1855 "RSN: Not reinstalling already in-use IGTK to the driver (link_id=%d keyidx=%d)",
1856 link_id, keyidx);
1857 return 0;
1858 }
1859
1860 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1861 "RSN: MLO Link %u IGTK keyid %d pn " COMPACT_MACSTR,
1862 link_id, keyidx, MAC2STR(igtk->pn));
1863 wpa_hexdump_link_key(MSG_DEBUG, link_id, "RSN: IGTK", igtk->igtk, len);
1864 if (keyidx > 4095) {
1865 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1866 "RSN: Invalid MLO Link %d IGTK KeyID %d", link_id,
1867 keyidx);
1868 return -1;
1869 }
1870 if (wpa_sm_set_key(sm, link_id,
1871 wpa_cipher_to_alg(sm->mgmt_group_cipher),
1872 broadcast_ether_addr, keyidx, 0, igtk->pn,
1873 sizeof(igtk->pn), igtk->igtk, len,
1874 KEY_FLAG_GROUP_RX) < 0) {
1875 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1876 "RSN: Failed to configure MLO Link %d IGTK to the driver",
1877 link_id);
1878 return -1;
1879 }
1880
1881 if (wnm_sleep) {
1882 sm->mlo.links[link_id].igtk_wnm_sleep.igtk_len = len;
1883 os_memcpy(sm->mlo.links[link_id].igtk_wnm_sleep.igtk,
1884 igtk->igtk,
1885 sm->mlo.links[link_id].igtk_wnm_sleep.igtk_len);
1886 } else {
1887 sm->mlo.links[link_id].igtk.igtk_len = len;
1888 os_memcpy(sm->mlo.links[link_id].igtk.igtk, igtk->igtk,
1889 sm->mlo.links[link_id].igtk.igtk_len);
1890 }
1891
1892 return 0;
1893 }
1894
1895
1896 static int
wpa_supplicant_install_mlo_bigtk(struct wpa_sm * sm,u8 link_id,const struct rsn_mlo_bigtk_kde * bigtk,int wnm_sleep)1897 wpa_supplicant_install_mlo_bigtk(struct wpa_sm *sm, u8 link_id,
1898 const struct rsn_mlo_bigtk_kde *bigtk,
1899 int wnm_sleep)
1900 {
1901 size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1902 u16 keyidx = WPA_GET_LE16(bigtk->keyid);
1903
1904 /* Detect possible key reinstallation */
1905 if ((sm->mlo.links[link_id].bigtk.bigtk_len == len &&
1906 os_memcmp(sm->mlo.links[link_id].bigtk.bigtk, bigtk->bigtk,
1907 sm->mlo.links[link_id].bigtk.bigtk_len) == 0) ||
1908 (sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk_len == len &&
1909 os_memcmp(sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk,
1910 bigtk->bigtk,
1911 sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk_len) ==
1912 0)) {
1913 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1914 "RSN: Not reinstalling already in-use BIGTK to the driver (link_id=%d keyidx=%d)",
1915 link_id, keyidx);
1916 return 0;
1917 }
1918
1919 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1920 "RSN: MLO Link %u BIGTK keyid %d pn " COMPACT_MACSTR,
1921 link_id, keyidx, MAC2STR(bigtk->pn));
1922 wpa_hexdump_link_key(MSG_DEBUG, link_id, "RSN: BIGTK", bigtk->bigtk,
1923 len);
1924 if (keyidx < 6 || keyidx > 7) {
1925 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1926 "RSN: Invalid MLO Link %d BIGTK KeyID %d", link_id,
1927 keyidx);
1928 return -1;
1929 }
1930 if (wpa_sm_set_key(sm, link_id,
1931 wpa_cipher_to_alg(sm->mgmt_group_cipher),
1932 broadcast_ether_addr, keyidx, 0, bigtk->pn,
1933 sizeof(bigtk->pn), bigtk->bigtk, len,
1934 KEY_FLAG_GROUP_RX) < 0) {
1935 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1936 "RSN: Failed to configure MLO Link %d BIGTK to the driver",
1937 link_id);
1938 return -1;
1939 }
1940
1941 if (wnm_sleep) {
1942 sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk_len = len;
1943 os_memcpy(sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk,
1944 bigtk->bigtk,
1945 sm->mlo.links[link_id].bigtk_wnm_sleep.bigtk_len);
1946 } else {
1947 sm->mlo.links[link_id].bigtk.bigtk_len = len;
1948 os_memcpy(sm->mlo.links[link_id].bigtk.bigtk, bigtk->bigtk,
1949 sm->mlo.links[link_id].bigtk.bigtk_len);
1950 }
1951
1952 return 0;
1953 }
1954
1955
_mlo_ieee80211w_set_keys(struct wpa_sm * sm,u8 link_id,struct wpa_eapol_ie_parse * ie)1956 static int _mlo_ieee80211w_set_keys(struct wpa_sm *sm, u8 link_id,
1957 struct wpa_eapol_ie_parse *ie)
1958 {
1959 size_t len;
1960
1961 if (ie->mlo_igtk[link_id]) {
1962 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1963 if (ie->mlo_igtk_len[link_id] !=
1964 RSN_MLO_IGTK_KDE_PREFIX_LENGTH + len)
1965 return -1;
1966
1967 if (wpa_supplicant_install_mlo_igtk(
1968 sm, link_id,
1969 (const struct rsn_mlo_igtk_kde *)
1970 ie->mlo_igtk[link_id],
1971 0) < 0)
1972 return -1;
1973 }
1974
1975 if (ie->mlo_bigtk[link_id] && sm->beacon_prot) {
1976 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1977 if (ie->mlo_bigtk_len[link_id] !=
1978 RSN_MLO_BIGTK_KDE_PREFIX_LENGTH + len)
1979 return -1;
1980
1981 if (wpa_supplicant_install_mlo_bigtk(
1982 sm, link_id,
1983 (const struct rsn_mlo_bigtk_kde *)
1984 ie->mlo_bigtk[link_id],
1985 0) < 0)
1986 return -1;
1987 }
1988
1989 return 0;
1990 }
1991
1992
mlo_ieee80211w_set_keys(struct wpa_sm * sm,struct wpa_eapol_ie_parse * ie)1993 static int mlo_ieee80211w_set_keys(struct wpa_sm *sm,
1994 struct wpa_eapol_ie_parse *ie)
1995 {
1996 u8 i;
1997
1998 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) ||
1999 sm->mgmt_group_cipher == WPA_CIPHER_GTK_NOT_USED)
2000 return 0;
2001
2002 for_each_link(sm->mlo.valid_links, i) {
2003 if (_mlo_ieee80211w_set_keys(sm, i, ie))
2004 return -1;
2005 }
2006
2007 return 0;
2008 }
2009
2010
ieee80211w_set_keys(struct wpa_sm * sm,struct wpa_eapol_ie_parse * ie)2011 static int ieee80211w_set_keys(struct wpa_sm *sm,
2012 struct wpa_eapol_ie_parse *ie)
2013 {
2014 size_t len;
2015
2016 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) ||
2017 sm->mgmt_group_cipher == WPA_CIPHER_GTK_NOT_USED)
2018 return 0;
2019
2020 if (ie->igtk) {
2021 const struct wpa_igtk_kde *igtk;
2022
2023 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
2024 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
2025 return -1;
2026
2027 igtk = (const struct wpa_igtk_kde *) ie->igtk;
2028 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
2029 return -1;
2030 }
2031
2032 if (ie->bigtk && sm->beacon_prot) {
2033 const struct wpa_bigtk_kde *bigtk;
2034
2035 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
2036 if (ie->bigtk_len != WPA_BIGTK_KDE_PREFIX_LEN + len)
2037 return -1;
2038
2039 bigtk = (const struct wpa_bigtk_kde *) ie->bigtk;
2040 if (wpa_supplicant_install_bigtk(sm, bigtk, 0) < 0)
2041 return -1;
2042 }
2043
2044 return 0;
2045 }
2046
2047
wpa_report_ie_mismatch(struct wpa_sm * sm,const char * reason,const u8 * src_addr,const u8 * wpa_ie,size_t wpa_ie_len,const u8 * rsn_ie,size_t rsn_ie_len)2048 static void wpa_report_ie_mismatch(struct wpa_sm *sm,
2049 const char *reason, const u8 *src_addr,
2050 const u8 *wpa_ie, size_t wpa_ie_len,
2051 const u8 *rsn_ie, size_t rsn_ie_len)
2052 {
2053 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
2054 reason, MAC2STR(src_addr));
2055
2056 if (sm->ap_wpa_ie) {
2057 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
2058 sm->ap_wpa_ie, sm->ap_wpa_ie_len);
2059 }
2060 if (wpa_ie) {
2061 if (!sm->ap_wpa_ie) {
2062 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2063 "WPA: No WPA IE in Beacon/ProbeResp");
2064 }
2065 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
2066 wpa_ie, wpa_ie_len);
2067 }
2068
2069 if (sm->ap_rsn_ie) {
2070 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
2071 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
2072 }
2073 if (rsn_ie) {
2074 if (!sm->ap_rsn_ie) {
2075 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2076 "WPA: No RSN IE in Beacon/ProbeResp");
2077 }
2078 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
2079 rsn_ie, rsn_ie_len);
2080 }
2081
2082 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
2083 }
2084
2085
2086 #ifdef CONFIG_IEEE80211R
2087
ft_validate_mdie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie,const u8 * assoc_resp_mdie)2088 static int ft_validate_mdie(struct wpa_sm *sm,
2089 const unsigned char *src_addr,
2090 struct wpa_eapol_ie_parse *ie,
2091 const u8 *assoc_resp_mdie)
2092 {
2093 struct rsn_mdie *mdie;
2094
2095 mdie = (struct rsn_mdie *) (ie->mdie + 2);
2096 if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
2097 os_memcmp(mdie->mobility_domain, sm->mobility_domain,
2098 MOBILITY_DOMAIN_ID_LEN) != 0) {
2099 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
2100 "not match with the current mobility domain");
2101 return -1;
2102 }
2103
2104 if (assoc_resp_mdie &&
2105 (assoc_resp_mdie[1] != ie->mdie[1] ||
2106 os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
2107 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
2108 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
2109 ie->mdie, 2 + ie->mdie[1]);
2110 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
2111 assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
2112 return -1;
2113 }
2114
2115 return 0;
2116 }
2117
2118
ft_validate_ftie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie,const u8 * assoc_resp_ftie)2119 static int ft_validate_ftie(struct wpa_sm *sm,
2120 const unsigned char *src_addr,
2121 struct wpa_eapol_ie_parse *ie,
2122 const u8 *assoc_resp_ftie)
2123 {
2124 if (ie->ftie == NULL) {
2125 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2126 "FT: No FTIE in EAPOL-Key msg 3/4");
2127 return -1;
2128 }
2129
2130 if (assoc_resp_ftie == NULL)
2131 return 0;
2132
2133 if (assoc_resp_ftie[1] != ie->ftie[1] ||
2134 os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
2135 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
2136 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
2137 ie->ftie, 2 + ie->ftie[1]);
2138 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
2139 assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
2140 return -1;
2141 }
2142
2143 return 0;
2144 }
2145
2146
ft_validate_rsnie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)2147 static int ft_validate_rsnie(struct wpa_sm *sm,
2148 const unsigned char *src_addr,
2149 struct wpa_eapol_ie_parse *ie)
2150 {
2151 struct wpa_ie_data rsn;
2152
2153 if (!ie->rsn_ie)
2154 return 0;
2155
2156 /*
2157 * Verify that PMKR1Name from EAPOL-Key message 3/4
2158 * matches with the value we derived.
2159 */
2160 if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
2161 rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
2162 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
2163 "FT 4-way handshake message 3/4");
2164 return -1;
2165 }
2166
2167 if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
2168 {
2169 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2170 "FT: PMKR1Name mismatch in "
2171 "FT 4-way handshake message 3/4");
2172 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
2173 rsn.pmkid, WPA_PMK_NAME_LEN);
2174 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
2175 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
2176 return -1;
2177 }
2178
2179 return 0;
2180 }
2181
2182
wpa_supplicant_validate_ie_ft(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)2183 static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
2184 const unsigned char *src_addr,
2185 struct wpa_eapol_ie_parse *ie)
2186 {
2187 const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
2188
2189 if (sm->assoc_resp_ies) {
2190 pos = sm->assoc_resp_ies;
2191 end = pos + sm->assoc_resp_ies_len;
2192 while (end - pos > 2) {
2193 if (2 + pos[1] > end - pos)
2194 break;
2195 switch (*pos) {
2196 case WLAN_EID_MOBILITY_DOMAIN:
2197 mdie = pos;
2198 break;
2199 case WLAN_EID_FAST_BSS_TRANSITION:
2200 ftie = pos;
2201 break;
2202 }
2203 pos += 2 + pos[1];
2204 }
2205 }
2206
2207 if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
2208 ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
2209 ft_validate_rsnie(sm, src_addr, ie) < 0)
2210 return -1;
2211
2212 return 0;
2213 }
2214
2215 #endif /* CONFIG_IEEE80211R */
2216
2217
wpa_supplicant_validate_ie(struct wpa_sm * sm,const unsigned char * src_addr,struct wpa_eapol_ie_parse * ie)2218 static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
2219 const unsigned char *src_addr,
2220 struct wpa_eapol_ie_parse *ie)
2221 {
2222 if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
2223 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2224 "WPA: No WPA/RSN IE for this AP known. "
2225 "Trying to get from scan results");
2226 if (wpa_sm_get_beacon_ie(sm) < 0) {
2227 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2228 "WPA: Could not find AP from "
2229 "the scan results");
2230 return -1;
2231 }
2232 wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
2233 "WPA: Found the current AP from updated scan results");
2234 }
2235
2236 if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
2237 (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
2238 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
2239 "with IE in Beacon/ProbeResp (no IE?)",
2240 src_addr, ie->wpa_ie, ie->wpa_ie_len,
2241 ie->rsn_ie, ie->rsn_ie_len);
2242 return -1;
2243 }
2244
2245 if ((ie->wpa_ie && sm->ap_wpa_ie &&
2246 (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
2247 os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
2248 (ie->rsn_ie && sm->ap_rsn_ie &&
2249 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
2250 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
2251 ie->rsn_ie, ie->rsn_ie_len))) {
2252 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
2253 "with IE in Beacon/ProbeResp",
2254 src_addr, ie->wpa_ie, ie->wpa_ie_len,
2255 ie->rsn_ie, ie->rsn_ie_len);
2256 return -1;
2257 }
2258
2259 if (sm->proto == WPA_PROTO_WPA &&
2260 ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
2261 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
2262 "detected - RSN was enabled and RSN IE "
2263 "was in msg 3/4, but not in "
2264 "Beacon/ProbeResp",
2265 src_addr, ie->wpa_ie, ie->wpa_ie_len,
2266 ie->rsn_ie, ie->rsn_ie_len);
2267 return -1;
2268 }
2269
2270 if (sm->proto == WPA_PROTO_RSN &&
2271 ((sm->ap_rsnxe && !ie->rsnxe) ||
2272 (!sm->ap_rsnxe && ie->rsnxe) ||
2273 (sm->ap_rsnxe && ie->rsnxe &&
2274 (sm->ap_rsnxe_len != ie->rsnxe_len ||
2275 os_memcmp(sm->ap_rsnxe, ie->rsnxe, sm->ap_rsnxe_len) != 0)))) {
2276 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2277 "WPA: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
2278 wpa_hexdump(MSG_INFO, "RSNXE in Beacon/ProbeResp",
2279 sm->ap_rsnxe, sm->ap_rsnxe_len);
2280 wpa_hexdump(MSG_INFO, "RSNXE in EAPOL-Key msg 3/4",
2281 ie->rsnxe, ie->rsnxe_len);
2282 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
2283 return -1;
2284 }
2285
2286 if (sm->proto == WPA_PROTO_RSN && wpa_sm_rsn_overriding_supported(sm)) {
2287 if ((sm->ap_rsne_override && !ie->rsne_override) ||
2288 (!sm->ap_rsne_override && ie->rsne_override) ||
2289 (sm->ap_rsne_override && ie->rsne_override &&
2290 (sm->ap_rsne_override_len != ie->rsne_override_len ||
2291 os_memcmp(sm->ap_rsne_override, ie->rsne_override,
2292 sm->ap_rsne_override_len) != 0))) {
2293 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2294 "RSN: RSNE Override element mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
2295 wpa_hexdump(MSG_INFO,
2296 "RSNE Override element in Beacon/ProbeResp",
2297 sm->ap_rsne_override,
2298 sm->ap_rsne_override_len);
2299 wpa_hexdump(MSG_INFO,
2300 "RSNE Override element in EAPOL-Key msg 3/4",
2301 ie->rsne_override, ie->rsne_override_len);
2302 wpa_sm_deauthenticate(sm,
2303 WLAN_REASON_IE_IN_4WAY_DIFFERS);
2304 return -1;
2305 }
2306
2307 if ((sm->ap_rsne_override_2 && !ie->rsne_override_2) ||
2308 (!sm->ap_rsne_override_2 && ie->rsne_override_2) ||
2309 (sm->ap_rsne_override_2 && ie->rsne_override_2 &&
2310 (sm->ap_rsne_override_2_len != ie->rsne_override_2_len ||
2311 os_memcmp(sm->ap_rsne_override_2, ie->rsne_override_2,
2312 sm->ap_rsne_override_2_len) != 0))) {
2313 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2314 "RSN: RSNE Override 2 element mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
2315 wpa_hexdump(MSG_INFO,
2316 "RSNE Override 2 element in Beacon/ProbeResp",
2317 sm->ap_rsne_override_2,
2318 sm->ap_rsne_override_2_len);
2319 wpa_hexdump(MSG_INFO,
2320 "RSNE Override 2 element in EAPOL-Key msg 3/4",
2321 ie->rsne_override_2, ie->rsne_override_2_len);
2322 wpa_sm_deauthenticate(sm,
2323 WLAN_REASON_IE_IN_4WAY_DIFFERS);
2324 return -1;
2325 }
2326
2327 if ((sm->ap_rsnxe_override && !ie->rsnxe_override) ||
2328 (!sm->ap_rsnxe_override && ie->rsnxe_override) ||
2329 (sm->ap_rsnxe_override && ie->rsnxe_override &&
2330 (sm->ap_rsnxe_override_len != ie->rsnxe_override_len ||
2331 os_memcmp(sm->ap_rsnxe_override, ie->rsnxe_override,
2332 sm->ap_rsnxe_override_len) != 0))) {
2333 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2334 "RSN: RSNXE Override element mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4");
2335 wpa_hexdump(MSG_INFO,
2336 "RSNXE Override element in Beacon/ProbeResp",
2337 sm->ap_rsnxe_override,
2338 sm->ap_rsnxe_override_len);
2339 wpa_hexdump(MSG_INFO,
2340 "RSNXE Override element in EAPOL-Key msg 3/4",
2341 ie->rsnxe_override, ie->rsnxe_override_len);
2342 wpa_sm_deauthenticate(sm,
2343 WLAN_REASON_IE_IN_4WAY_DIFFERS);
2344 return -1;
2345 }
2346 }
2347
2348 #ifdef CONFIG_IEEE80211R
2349 if (wpa_key_mgmt_ft(sm->key_mgmt) &&
2350 wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
2351 return -1;
2352 #endif /* CONFIG_IEEE80211R */
2353
2354 return 0;
2355 }
2356
2357
2358 /**
2359 * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
2360 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2361 * @dst: Destination address for the frame
2362 * @key: Pointer to the EAPOL-Key frame header
2363 * @ver: Version bits from EAPOL-Key Key Info
2364 * @key_info: Key Info
2365 * @ptk: PTK to use for keyed hash and encryption
2366 * Returns: >= 0 on success, < 0 on failure
2367 */
wpa_supplicant_send_4_of_4(struct wpa_sm * sm,const unsigned char * dst,const struct wpa_eapol_key * key,u16 ver,u16 key_info,struct wpa_ptk * ptk)2368 int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
2369 const struct wpa_eapol_key *key,
2370 u16 ver, u16 key_info,
2371 struct wpa_ptk *ptk)
2372 {
2373 size_t mic_len, hdrlen, rlen;
2374 struct wpa_eapol_key *reply;
2375 u8 *rbuf, *key_mic;
2376 u8 *kde = NULL;
2377 size_t kde_len = 0, extra_len = 0;
2378 #ifdef CONFIG_TESTING_OPTIONS
2379 size_t pad_len = 0;
2380 #endif /* CONFIG_TESTING_OPTIONS */
2381
2382 if (sm->mlo.valid_links) {
2383 u8 *pos;
2384
2385 kde = os_malloc(RSN_SELECTOR_LEN + ETH_ALEN + 2);
2386 if (!kde)
2387 return -1;
2388
2389 /* Add MAC KDE */
2390 wpa_printf(MSG_DEBUG, "MLO: Add MAC KDE into EAPOL-Key 4/4");
2391 pos = kde;
2392 pos = rsn_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, sm->own_addr,
2393 ETH_ALEN);
2394 kde_len = pos - kde;
2395 }
2396
2397 #ifdef CONFIG_TESTING_OPTIONS
2398 if (sm->test_eapol_m4_elems)
2399 extra_len = wpabuf_len(sm->test_eapol_m4_elems);
2400 if (sm->encrypt_eapol_m4) {
2401 pad_len = (kde_len + extra_len) % 8;
2402 if (pad_len)
2403 pad_len = 8 - pad_len;
2404 extra_len += pad_len + 8;
2405 }
2406 #endif /* CONFIG_TESTING_OPTIONS */
2407
2408 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
2409 hdrlen = sizeof(*reply) + mic_len + 2;
2410 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
2411 hdrlen + kde_len + extra_len, &rlen,
2412 (void *) &reply);
2413 if (!rbuf) {
2414 os_free(kde);
2415 return -1;
2416 }
2417
2418 reply->type = (sm->proto == WPA_PROTO_RSN) ?
2419 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
2420 key_info &= WPA_KEY_INFO_SECURE;
2421 key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
2422 if (mic_len)
2423 key_info |= WPA_KEY_INFO_MIC;
2424 else
2425 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
2426 #ifdef CONFIG_TESTING_OPTIONS
2427 if (sm->encrypt_eapol_m4)
2428 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
2429 #endif /* CONFIG_TESTING_OPTIONS */
2430 WPA_PUT_BE16(reply->key_info, key_info);
2431 if (sm->proto == WPA_PROTO_RSN)
2432 WPA_PUT_BE16(reply->key_length, 0);
2433 else
2434 os_memcpy(reply->key_length, key->key_length, 2);
2435 os_memcpy(reply->replay_counter, key->replay_counter,
2436 WPA_REPLAY_COUNTER_LEN);
2437
2438 key_mic = (u8 *) (reply + 1);
2439 /* Key Data length */
2440 WPA_PUT_BE16(key_mic + mic_len, kde_len + extra_len);
2441 if (kde) {
2442 os_memcpy(key_mic + mic_len + 2, kde, kde_len); /* Key Data */
2443 os_free(kde);
2444 }
2445
2446 #ifdef CONFIG_TESTING_OPTIONS
2447 if (sm->test_eapol_m4_elems) {
2448 os_memcpy(key_mic + mic_len + 2 + kde_len,
2449 wpabuf_head(sm->test_eapol_m4_elems),
2450 wpabuf_len(sm->test_eapol_m4_elems));
2451 }
2452
2453 if (sm->encrypt_eapol_m4) {
2454 u8 *plain;
2455 size_t plain_len;
2456
2457 if (sm->test_eapol_m4_elems)
2458 extra_len = wpabuf_len(sm->test_eapol_m4_elems);
2459 else
2460 extra_len = 0;
2461 plain_len = kde_len + extra_len + pad_len;
2462 plain = os_memdup(key_mic + mic_len + 2, plain_len);
2463 if (!plain) {
2464 os_free(rbuf);
2465 return -1;
2466 }
2467 if (pad_len)
2468 plain[plain_len - pad_len] = 0xdd;
2469
2470 wpa_hexdump_key(MSG_DEBUG, "RSN: AES-WRAP using KEK",
2471 ptk->kek, ptk->kek_len);
2472 if (aes_wrap(ptk->kek, ptk->kek_len, plain_len / 8, plain,
2473 key_mic + mic_len + 2)) {
2474 os_free(plain);
2475 os_free(rbuf);
2476 return -1;
2477 }
2478 wpa_hexdump(MSG_DEBUG,
2479 "RSN: Encrypted Key Data from AES-WRAP",
2480 key_mic + mic_len + 2, plain_len + 8);
2481 os_free(plain);
2482 }
2483 #endif /* CONFIG_TESTING_OPTIONS */
2484
2485 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
2486 return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
2487 key_mic);
2488 }
2489
2490
wpa_supplicant_validate_link_kde(struct wpa_sm * sm,u8 link_id,const u8 * link_kde,size_t link_kde_len,const u8 * rsn_override_link_kde,size_t rsn_override_link_kde_len)2491 static int wpa_supplicant_validate_link_kde(struct wpa_sm *sm, u8 link_id,
2492 const u8 *link_kde,
2493 size_t link_kde_len,
2494 const u8 *rsn_override_link_kde,
2495 size_t rsn_override_link_kde_len)
2496 {
2497 size_t rsne_len = 0, rsnxe_len = 0, rsnoe_len = 0, rsno2e_len = 0,
2498 rsnxoe_len = 0;
2499 const u8 *rsne = NULL, *rsnxe = NULL, *rsnoe = NULL, *rsno2e = NULL,
2500 *rsnxoe = NULL;
2501
2502 if (!link_kde ||
2503 link_kde_len < RSN_MLO_LINK_KDE_LINK_MAC_INDEX + ETH_ALEN) {
2504 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2505 "RSN: MLO Link KDE is not found for link ID %d",
2506 link_id);
2507 return -1;
2508 }
2509
2510 if (!ether_addr_equal(sm->mlo.links[link_id].bssid,
2511 &link_kde[RSN_MLO_LINK_KDE_LINK_MAC_INDEX])) {
2512 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2513 "RSN: MLO Link %u MAC address (" MACSTR
2514 ") not matching association response (" MACSTR ")",
2515 link_id,
2516 MAC2STR(&link_kde[RSN_MLO_LINK_KDE_LINK_MAC_INDEX]),
2517 MAC2STR(sm->mlo.links[link_id].bssid));
2518 return -1;
2519 }
2520
2521 if (link_kde[0] & RSN_MLO_LINK_KDE_LI_RSNE_INFO) {
2522 rsne = link_kde + RSN_MLO_LINK_KDE_FIXED_LENGTH;
2523 if (link_kde_len < RSN_MLO_LINK_KDE_FIXED_LENGTH + 2 ||
2524 link_kde_len <
2525 (size_t) (RSN_MLO_LINK_KDE_FIXED_LENGTH + 2 + rsne[1])) {
2526 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2527 "RSN: No room for link %u RSNE in MLO Link KDE",
2528 link_id);
2529 return -1;
2530 }
2531
2532 rsne_len = rsne[1] + 2;
2533 }
2534
2535 if (!rsne) {
2536 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2537 "RSN: RSNE not present in MLO Link %u KDE", link_id);
2538 return -1;
2539 }
2540
2541 if (link_kde[0] & RSN_MLO_LINK_KDE_LI_RSNXE_INFO) {
2542 rsnxe = link_kde + RSN_MLO_LINK_KDE_FIXED_LENGTH + rsne_len;
2543 if (link_kde_len <
2544 (RSN_MLO_LINK_KDE_FIXED_LENGTH + rsne_len + 2) ||
2545 link_kde_len <
2546 (RSN_MLO_LINK_KDE_FIXED_LENGTH + rsne_len + 2 + rsnxe[1])) {
2547 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2548 "RSN: No room for link %u RSNXE in MLO Link KDE",
2549 link_id);
2550 return -1;
2551 }
2552
2553 rsnxe_len = rsnxe[1] + 2;
2554 }
2555
2556 if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
2557 sm->mlo.links[link_id].ap_rsne,
2558 sm->mlo.links[link_id].ap_rsne_len,
2559 rsne, rsne_len)) {
2560 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2561 "RSN MLO: RSNE in 3/4 msg does not match with IE in Beacon/ProbeResp for link ID %u",
2562 link_id);
2563 wpa_hexdump(MSG_INFO, "RSNE in Beacon/ProbeResp",
2564 sm->mlo.links[link_id].ap_rsne,
2565 sm->mlo.links[link_id].ap_rsne_len);
2566 wpa_hexdump(MSG_INFO, "RSNE in EAPOL-Key msg 3/4",
2567 rsne, rsne_len);
2568 goto fail;
2569 }
2570
2571 if ((sm->mlo.links[link_id].ap_rsnxe && !rsnxe) ||
2572 (!sm->mlo.links[link_id].ap_rsnxe && rsnxe) ||
2573 (sm->mlo.links[link_id].ap_rsnxe && rsnxe &&
2574 (sm->mlo.links[link_id].ap_rsnxe_len != rsnxe_len ||
2575 os_memcmp(sm->mlo.links[link_id].ap_rsnxe, rsnxe,
2576 sm->mlo.links[link_id].ap_rsnxe_len) != 0))) {
2577 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2578 "RSN MLO: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4 for link ID %u",
2579 link_id);
2580 wpa_hexdump(MSG_INFO, "RSNXE in Beacon/ProbeResp",
2581 sm->mlo.links[link_id].ap_rsnxe,
2582 sm->mlo.links[link_id].ap_rsnxe_len);
2583 wpa_hexdump(MSG_INFO, "RSNXE in EAPOL-Key msg 3/4",
2584 rsnxe, rsnxe_len);
2585 goto fail;
2586 }
2587
2588 if (!wpa_sm_rsn_overriding_supported(sm))
2589 return 0;
2590
2591 if (rsn_override_link_kde) {
2592 rsnoe = get_vendor_ie(rsn_override_link_kde + 1,
2593 rsn_override_link_kde_len - 1,
2594 RSNE_OVERRIDE_IE_VENDOR_TYPE);
2595 if (rsnoe)
2596 rsnoe_len = 2 + rsnoe[1];
2597
2598 rsno2e = get_vendor_ie(rsn_override_link_kde + 1,
2599 rsn_override_link_kde_len - 1,
2600 RSNE_OVERRIDE_2_IE_VENDOR_TYPE);
2601 if (rsno2e)
2602 rsno2e_len = 2 + rsno2e[1];
2603
2604 rsnxoe = get_vendor_ie(rsn_override_link_kde + 1,
2605 rsn_override_link_kde_len - 1,
2606 RSNXE_OVERRIDE_IE_VENDOR_TYPE);
2607 if (rsnxoe)
2608 rsnxoe_len = 2 + rsnxoe[1];
2609 }
2610
2611 if ((sm->mlo.links[link_id].ap_rsnoe && !rsnoe) ||
2612 (!sm->mlo.links[link_id].ap_rsnoe && rsnoe) ||
2613 (sm->mlo.links[link_id].ap_rsnoe && rsnoe &&
2614 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
2615 sm->mlo.links[link_id].ap_rsnoe,
2616 sm->mlo.links[link_id].ap_rsnoe_len,
2617 rsnoe, rsnoe_len))) {
2618 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2619 "RSN MLO: RSNOE in 3/4 msg does not match with IE in Beacon/ProbeResp for link ID %u",
2620 link_id);
2621 wpa_hexdump(MSG_INFO, "RSNOE in Beacon/ProbeResp",
2622 sm->mlo.links[link_id].ap_rsnoe,
2623 sm->mlo.links[link_id].ap_rsnoe_len);
2624 wpa_hexdump(MSG_INFO, "RSNOE in EAPOL-Key msg 3/4",
2625 rsnoe, rsnoe_len);
2626 goto fail;
2627 }
2628
2629 if ((sm->mlo.links[link_id].ap_rsno2e && !rsno2e) ||
2630 (!sm->mlo.links[link_id].ap_rsno2e && rsno2e) ||
2631 (sm->mlo.links[link_id].ap_rsno2e && rsno2e &&
2632 wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
2633 sm->mlo.links[link_id].ap_rsno2e,
2634 sm->mlo.links[link_id].ap_rsno2e_len,
2635 rsno2e, rsno2e_len))) {
2636 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2637 "RSN MLO: RSNO2E in 3/4 msg does not match with IE in Beacon/ProbeResp for link ID %u",
2638 link_id);
2639 wpa_hexdump(MSG_INFO, "RSNO2E in Beacon/ProbeResp",
2640 sm->mlo.links[link_id].ap_rsno2e,
2641 sm->mlo.links[link_id].ap_rsno2e_len);
2642 wpa_hexdump(MSG_INFO, "RSNOE in EAPOL-Key msg 3/4",
2643 rsno2e, rsno2e_len);
2644 goto fail;
2645 }
2646
2647 if ((sm->mlo.links[link_id].ap_rsnxoe && !rsnxoe) ||
2648 (!sm->mlo.links[link_id].ap_rsnxoe && rsnxoe) ||
2649 (sm->mlo.links[link_id].ap_rsnxoe && rsnxoe &&
2650 (sm->mlo.links[link_id].ap_rsnxoe_len != rsnxoe_len ||
2651 os_memcmp(sm->mlo.links[link_id].ap_rsnxoe, rsnxoe,
2652 sm->mlo.links[link_id].ap_rsnxoe_len) != 0))) {
2653 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2654 "RSN MLO: RSNXOE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4 for link ID %u",
2655 link_id);
2656 wpa_hexdump(MSG_INFO, "RSNXOE in Beacon/ProbeResp",
2657 sm->mlo.links[link_id].ap_rsnxoe,
2658 sm->mlo.links[link_id].ap_rsnxoe_len);
2659 wpa_hexdump(MSG_INFO, "RSNXOE in EAPOL-Key msg 3/4",
2660 rsnxoe, rsnxoe_len);
2661 goto fail;
2662 }
2663
2664 return 0;
2665 fail:
2666 wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
2667 return -1;
2668 }
2669
2670
wpa_validate_mlo_ieee80211w_kdes(struct wpa_sm * sm,u8 link_id,struct wpa_eapol_ie_parse * ie)2671 static int wpa_validate_mlo_ieee80211w_kdes(struct wpa_sm *sm,
2672 u8 link_id,
2673 struct wpa_eapol_ie_parse *ie)
2674 {
2675 if (ie->mlo_igtk[link_id] &&
2676 ie->mlo_igtk_len[link_id] != RSN_MLO_IGTK_KDE_PREFIX_LENGTH +
2677 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
2678 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2679 "RSN MLO: Invalid IGTK KDE length %lu for link ID %u",
2680 (unsigned long) ie->mlo_igtk_len[link_id], link_id);
2681 return -1;
2682 }
2683
2684 if (!sm->beacon_prot)
2685 return 0;
2686
2687 if (ie->mlo_bigtk[link_id] &&
2688 ie->mlo_bigtk_len[link_id] != RSN_MLO_BIGTK_KDE_PREFIX_LENGTH +
2689 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
2690 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2691 "RSN MLO: Invalid BIGTK KDE length %lu for link ID %u",
2692 (unsigned long) ie->mlo_bigtk_len[link_id], link_id);
2693 return -1;
2694 }
2695
2696 return 0;
2697 }
2698
2699
wpa_supplicant_process_3_of_4_wpa(struct wpa_sm * sm,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len)2700 static void wpa_supplicant_process_3_of_4_wpa(struct wpa_sm *sm,
2701 const struct wpa_eapol_key *key,
2702 u16 ver, const u8 *key_data,
2703 size_t key_data_len)
2704 {
2705 u16 key_info, keylen;
2706 struct wpa_eapol_ie_parse ie;
2707
2708 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
2709 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2710 "WPA: RX message 3 of 4-Way Handshake from " MACSTR
2711 " (ver=%d)", MAC2STR(sm->bssid), ver);
2712
2713 key_info = WPA_GET_BE16(key->key_info);
2714
2715 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
2716 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
2717 goto failed;
2718
2719 if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
2720 goto failed;
2721
2722 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
2723 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2724 "WPA: ANonce from message 1 of 4-Way Handshake differs from 3 of 4-Way Handshake - drop packet (src="
2725 MACSTR ")", MAC2STR(sm->bssid));
2726 goto failed;
2727 }
2728
2729 keylen = WPA_GET_BE16(key->key_length);
2730 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
2731 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2732 "WPA: Invalid %s key length %d (src=" MACSTR ")",
2733 wpa_cipher_txt(sm->pairwise_cipher), keylen,
2734 MAC2STR(sm->bssid));
2735 goto failed;
2736 }
2737
2738 if (wpa_supplicant_send_4_of_4(sm, wpa_sm_get_auth_addr(sm), key, ver,
2739 key_info, &sm->ptk) < 0)
2740 goto failed;
2741
2742 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
2743 * for the next 4-Way Handshake. If msg 3 is received again, the old
2744 * SNonce will still be used to avoid changing PTK. */
2745 sm->renew_snonce = 1;
2746
2747 if ((key_info & WPA_KEY_INFO_INSTALL) &&
2748 wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX_TX))
2749 goto failed;
2750
2751 if (key_info & WPA_KEY_INFO_SECURE) {
2752 wpa_sm_mlme_setprotection(
2753 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
2754 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
2755 eapol_sm_notify_portValid(sm->eapol, true);
2756 }
2757 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
2758
2759 sm->msg_3_of_4_ok = 1;
2760 return;
2761
2762 failed:
2763 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2764 }
2765
2766
wpa_sm_sae_pw_id_change(struct wpa_sm * sm,const u8 * kde,size_t kde_len)2767 static void wpa_sm_sae_pw_id_change(struct wpa_sm *sm, const u8 *kde,
2768 size_t kde_len)
2769 {
2770 const u8 *pos = kde, *end = kde + kde_len;
2771 u8 flags;
2772 struct wpabuf_array *wa;
2773
2774 wpa_hexdump(MSG_DEBUG, "RSN: Received SAE Password Identifiers KDE",
2775 kde, kde_len);
2776
2777 if (end - pos < 1)
2778 return;
2779 flags = *pos++;
2780 wpa_printf(MSG_DEBUG, "RSN: SAE Password Identifiers Flags: 0x%x",
2781 flags);
2782
2783 if (!sm->ctx->sae_pw_id_change)
2784 return;
2785
2786 wa = wpabuf_array_alloc();
2787 if (!wa)
2788 return;
2789
2790 while (end > pos) {
2791 u8 len;
2792
2793 len = *pos++;
2794 if (end - pos < len) {
2795 wpa_printf(MSG_INFO,
2796 "RSN: Truncated SAE Password Identifier Tuple");
2797 wpabuf_array_free(wa);
2798 return;
2799 }
2800 wpa_hexdump(MSG_DEBUG, "RSN: SAE Password Identifier",
2801 pos, len);
2802 if (wpabuf_array_add(wa, wpabuf_alloc_copy(pos, len))) {
2803 wpabuf_array_free(wa);
2804 return;
2805 }
2806 pos += len;
2807 }
2808
2809 sm->ctx->sae_pw_id_change(sm->ctx->ctx, wa);
2810 }
2811
2812
wpa_supplicant_process_3_of_4(struct wpa_sm * sm,const struct wpa_eapol_key * key,u16 ver,const u8 * key_data,size_t key_data_len)2813 static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
2814 const struct wpa_eapol_key *key,
2815 u16 ver, const u8 *key_data,
2816 size_t key_data_len)
2817 {
2818 u16 key_info, keylen;
2819 struct wpa_eapol_ie_parse ie;
2820 bool mlo = sm->mlo.valid_links;
2821 int i;
2822
2823 wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
2824 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2825 "RSN: RX message 3 of 4-Way Handshake from " MACSTR
2826 " (ver=%d)%s", MAC2STR(sm->bssid), ver, mlo ? " (MLO)" : "");
2827
2828 key_info = WPA_GET_BE16(key->key_info);
2829
2830 wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
2831 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
2832 goto failed;
2833
2834 if (sm->ssid_protection) {
2835 if (!ie.ssid) {
2836 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2837 "RSN: No SSID included in EAPOL-Key msg 3/4");
2838 goto failed;
2839 }
2840
2841 if (ie.ssid_len != sm->ssid_len ||
2842 os_memcmp(ie.ssid, sm->ssid, sm->ssid_len) != 0) {
2843 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2844 "RSN: SSID mismatch in EAPOL-Key msg 3/4");
2845 wpa_hexdump_ascii(MSG_DEBUG, "RSN: Received SSID",
2846 ie.ssid, ie.ssid_len);
2847 wpa_hexdump_ascii(MSG_DEBUG, "RSN: Expected SSID",
2848 sm->ssid, sm->ssid_len);
2849 goto failed;
2850 }
2851
2852 wpa_sm_ssid_verified(sm);
2853 }
2854
2855 if (mlo && !ie.valid_mlo_gtks) {
2856 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2857 "MLO RSN: No GTK KDE included in EAPOL-Key msg 3/4");
2858 goto failed;
2859 }
2860 if (mlo &&
2861 (key_info &
2862 (WPA_KEY_INFO_ENCR_KEY_DATA | WPA_KEY_INFO_INSTALL |
2863 WPA_KEY_INFO_SECURE)) !=
2864 (WPA_KEY_INFO_ENCR_KEY_DATA | WPA_KEY_INFO_INSTALL |
2865 WPA_KEY_INFO_SECURE)) {
2866 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2867 "RSN MLO: Invalid key info (0x%x) in EAPOL-Key msg 3/4",
2868 key_info);
2869 goto failed;
2870 }
2871
2872 if (mlo && !is_valid_ap_mld_mac_kde(sm, ie.mac_addr)) {
2873 wpa_printf(MSG_DEBUG, "RSN: Invalid AP MLD MAC address KDE");
2874 goto failed;
2875 }
2876
2877 for (i = 0; mlo && i < MAX_NUM_MLD_LINKS; i++) {
2878 if (!(sm->mlo.req_links & BIT(i)))
2879 continue;
2880
2881 if (wpa_supplicant_validate_link_kde(
2882 sm, i, ie.mlo_link[i], ie.mlo_link_len[i],
2883 ie.rsn_override_link[i],
2884 ie.rsn_override_link_len[i]) < 0)
2885 goto failed;
2886
2887 if (!(sm->mlo.valid_links & BIT(i)))
2888 continue;
2889
2890 if (!ie.mlo_gtk[i]) {
2891 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2892 "RSN: GTK not found for link ID %u", i);
2893 goto failed;
2894 }
2895
2896 if (wpa_supplicant_validate_mlo_gtk_kde_len(
2897 ie.mlo_gtk_len[i]) < 0) {
2898 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2899 "RSN: Invalid MLO GTK KDE length %zu for link ID %u",
2900 ie.mlo_gtk_len[i], i);
2901 goto failed;
2902 }
2903
2904 if (sm->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED &&
2905 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
2906 wpa_validate_mlo_ieee80211w_kdes(sm, i, &ie) < 0)
2907 goto failed;
2908 }
2909
2910 #ifdef CONFIG_IEEE80211R
2911 if (mlo && wpa_key_mgmt_ft(sm->key_mgmt) &&
2912 wpa_supplicant_validate_ie_ft(sm, sm->bssid, &ie) < 0)
2913 goto failed;
2914 #endif /* CONFIG_IEEE80211R */
2915
2916 if (!mlo && ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2917 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2918 "WPA: GTK IE in unencrypted key data");
2919 goto failed;
2920 }
2921
2922 if (!mlo && ie.gtk &&
2923 wpa_supplicant_validate_gtk_kde_len(ie.gtk_len) < 0) {
2924 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2925 "WPA: Invalid GTK KDE length %zu", ie.gtk_len);
2926 goto failed;
2927 }
2928
2929 if (!mlo && ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2930 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2931 "WPA: IGTK KDE in unencrypted key data");
2932 goto failed;
2933 }
2934
2935 if (!mlo && ie.igtk &&
2936 sm->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED &&
2937 wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
2938 ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
2939 (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
2940 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2941 "WPA: Invalid IGTK KDE length %lu",
2942 (unsigned long) ie.igtk_len);
2943 goto failed;
2944 }
2945
2946 if (!mlo && wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
2947 goto failed;
2948
2949 if (wpa_handle_ext_key_id(sm, &ie))
2950 goto failed;
2951
2952 if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
2953 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2954 "WPA: ANonce from message 1 of 4-Way Handshake "
2955 "differs from 3 of 4-Way Handshake - drop packet (src="
2956 MACSTR ")", MAC2STR(sm->bssid));
2957 goto failed;
2958 }
2959
2960 keylen = WPA_GET_BE16(key->key_length);
2961 if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
2962 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2963 "WPA: Invalid %s key length %d (src=" MACSTR
2964 ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
2965 MAC2STR(sm->bssid));
2966 goto failed;
2967 }
2968
2969 #ifdef CONFIG_P2P
2970 if (ie.ip_addr_alloc) {
2971 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
2972 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
2973 sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
2974 }
2975 #endif /* CONFIG_P2P */
2976
2977 #ifdef CONFIG_OCV
2978 if (wpa_sm_ocv_enabled(sm)) {
2979 struct wpa_channel_info ci;
2980
2981 if (wpa_sm_channel_info(sm, &ci) != 0) {
2982 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2983 "Failed to get channel info to validate received OCI in EAPOL-Key 3/4");
2984 return;
2985 }
2986
2987 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
2988 channel_width_to_int(ci.chanwidth),
2989 ci.seg1_idx) != OCI_SUCCESS) {
2990 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, OCV_FAILURE
2991 "addr=" MACSTR " frame=eapol-key-m3 error=%s",
2992 MAC2STR(sm->bssid), ocv_errorstr);
2993 return;
2994 }
2995 }
2996 #endif /* CONFIG_OCV */
2997
2998 #ifdef CONFIG_DPP2
2999 if (DPP_VERSION > 1 && ie.dpp_kde) {
3000 wpa_printf(MSG_DEBUG,
3001 "DPP: peer Protocol Version %u Flags 0x%x",
3002 ie.dpp_kde[0], ie.dpp_kde[1]);
3003 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_pfs != 2 &&
3004 (ie.dpp_kde[1] & DPP_KDE_PFS_ALLOWED) && !sm->dpp_z) {
3005 wpa_printf(MSG_INFO,
3006 "DPP: Peer indicated it supports PFS and local configuration allows this, but PFS was not negotiated for the association");
3007 goto failed;
3008 }
3009 }
3010 #endif /* CONFIG_DPP2 */
3011
3012 if (sm->use_ext_key_id &&
3013 wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX))
3014 goto failed;
3015
3016 if (!sm->use_ext_key_id &&
3017 wpa_supplicant_install_ptk(sm, key, KEY_FLAG_RX | KEY_FLAG_NEXT)) {
3018 /* Continue anyway since the many drivers do not support
3019 * configuration of the TK for RX-only purposes for cases where
3020 * multiple keys might be in use in parallel and this being an
3021 * optional optimization to avoid race condition during TK
3022 * changes that could result in some protected frames getting
3023 * discarded. */
3024 }
3025
3026 if (wpa_supplicant_send_4_of_4(sm, wpa_sm_get_auth_addr(sm), key, ver,
3027 key_info, &sm->ptk) < 0)
3028 goto failed;
3029
3030 /* SNonce was successfully used in msg 3/4, so mark it to be renewed
3031 * for the next 4-Way Handshake. If msg 3 is received again, the old
3032 * SNonce will still be used to avoid changing PTK. */
3033 sm->renew_snonce = 1;
3034
3035 if (key_info & WPA_KEY_INFO_INSTALL) {
3036 int res;
3037
3038 if (sm->use_ext_key_id)
3039 res = wpa_supplicant_activate_ptk(sm);
3040 else
3041 res = wpa_supplicant_install_ptk(sm, key,
3042 KEY_FLAG_RX_TX);
3043 if (res)
3044 goto failed;
3045 }
3046
3047 if (key_info & WPA_KEY_INFO_SECURE) {
3048 wpa_sm_mlme_setprotection(
3049 sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
3050 MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
3051 eapol_sm_notify_portValid(sm->eapol, true);
3052 }
3053 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
3054
3055 if (mlo) {
3056 if (wpa_supplicant_pairwise_mlo_gtk(sm, key, &ie,
3057 key_info) < 0) {
3058 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3059 "MLO RSN: Failed to configure MLO GTKs");
3060 goto failed;
3061 }
3062 } else if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
3063 /* No GTK to be set to the driver */
3064 } else if (!ie.gtk && sm->proto == WPA_PROTO_RSN) {
3065 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3066 "RSN: No GTK KDE included in EAPOL-Key msg 3/4");
3067 goto failed;
3068 } else if (ie.gtk &&
3069 wpa_supplicant_pairwise_gtk(sm, key,
3070 ie.gtk, ie.gtk_len, key_info) < 0) {
3071 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3072 "RSN: Failed to configure GTK");
3073 goto failed;
3074 }
3075
3076 if ((mlo && mlo_ieee80211w_set_keys(sm, &ie) < 0) ||
3077 (!mlo && ieee80211w_set_keys(sm, &ie) < 0)) {
3078 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3079 "RSN: Failed to configure IGTK");
3080 goto failed;
3081 }
3082
3083 if (mlo || sm->group_cipher == WPA_CIPHER_GTK_NOT_USED || ie.gtk)
3084 wpa_supplicant_key_neg_complete(sm, sm->bssid,
3085 key_info & WPA_KEY_INFO_SECURE);
3086
3087 if (mlo || ie.gtk)
3088 wpa_sm_set_rekey_offload(sm);
3089
3090 /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
3091 * calculated only after KCK has been derived. Though, do not replace an
3092 * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
3093 * to avoid unnecessary changes of PMKID while continuing to use the
3094 * same PMK. */
3095 if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
3096 !sm->cur_pmksa) {
3097 struct rsn_pmksa_cache_entry *sa;
3098
3099 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
3100 sm->ptk.kck, sm->ptk.kck_len,
3101 wpa_sm_get_auth_addr(sm), sm->own_addr,
3102 sm->network_ctx, sm->key_mgmt, NULL, 0);
3103 if (!sm->cur_pmksa)
3104 sm->cur_pmksa = sa;
3105 }
3106
3107 if (ie.transition_disable)
3108 wpa_sm_transition_disable(sm, ie.transition_disable[0]);
3109 if (ie.sae_pw_ids && wpa_key_mgmt_sae(sm->key_mgmt) &&
3110 sm->sae_pw_id_change)
3111 wpa_sm_sae_pw_id_change(sm, ie.sae_pw_ids, ie.sae_pw_ids_len);
3112 sm->msg_3_of_4_ok = 1;
3113 return;
3114
3115 failed:
3116 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
3117 }
3118
3119
wpa_supplicant_send_2_of_2(struct wpa_sm * sm,const struct wpa_eapol_key * key,int ver,u16 key_info)3120 static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
3121 const struct wpa_eapol_key *key,
3122 int ver, u16 key_info)
3123 {
3124 size_t mic_len, hdrlen, rlen;
3125 struct wpa_eapol_key *reply;
3126 u8 *rbuf, *key_mic;
3127 size_t kde_len = 0;
3128
3129 #ifdef CONFIG_TESTING_OPTIONS
3130 if (sm->disable_eapol_g2_tx) {
3131 wpa_printf(MSG_INFO, "TEST: Disable sending EAPOL-Key 2/2");
3132 return 0;
3133 }
3134 #endif /* CONFIG_TESTING_OPTIONS */
3135
3136 #ifdef CONFIG_OCV
3137 if (wpa_sm_ocv_enabled(sm))
3138 kde_len = OCV_OCI_KDE_LEN;
3139 #endif /* CONFIG_OCV */
3140
3141 mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
3142 hdrlen = sizeof(*reply) + mic_len + 2;
3143 rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
3144 hdrlen + kde_len, &rlen, (void *) &reply);
3145 if (rbuf == NULL)
3146 return -1;
3147
3148 reply->type = (sm->proto == WPA_PROTO_RSN) ?
3149 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
3150 key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
3151 key_info |= ver | WPA_KEY_INFO_SECURE;
3152 if (mic_len)
3153 key_info |= WPA_KEY_INFO_MIC;
3154 else
3155 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
3156 WPA_PUT_BE16(reply->key_info, key_info);
3157 if (sm->proto == WPA_PROTO_RSN)
3158 WPA_PUT_BE16(reply->key_length, 0);
3159 else
3160 os_memcpy(reply->key_length, key->key_length, 2);
3161 os_memcpy(reply->replay_counter, key->replay_counter,
3162 WPA_REPLAY_COUNTER_LEN);
3163
3164 key_mic = (u8 *) (reply + 1);
3165 WPA_PUT_BE16(key_mic + mic_len, kde_len); /* Key Data Length */
3166
3167 #ifdef CONFIG_OCV
3168 if (wpa_sm_ocv_enabled(sm)) {
3169 struct wpa_channel_info ci;
3170 u8 *pos;
3171
3172 if (wpa_sm_channel_info(sm, &ci) != 0) {
3173 wpa_printf(MSG_WARNING,
3174 "Failed to get channel info for OCI element in EAPOL-Key 2/2");
3175 os_free(rbuf);
3176 return -1;
3177 }
3178 #ifdef CONFIG_TESTING_OPTIONS
3179 if (sm->oci_freq_override_eapol_g2) {
3180 wpa_printf(MSG_INFO,
3181 "TEST: Override OCI KDE frequency %d -> %d MHz",
3182 ci.frequency,
3183 sm->oci_freq_override_eapol_g2);
3184 ci.frequency = sm->oci_freq_override_eapol_g2;
3185 }
3186 #endif /* CONFIG_TESTING_OPTIONS */
3187
3188 pos = key_mic + mic_len + 2; /* Key Data */
3189 if (ocv_insert_oci_kde(&ci, &pos) < 0) {
3190 os_free(rbuf);
3191 return -1;
3192 }
3193 }
3194 #endif /* CONFIG_OCV */
3195
3196 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
3197 return wpa_eapol_key_send(sm, &sm->ptk, ver, wpa_sm_get_auth_addr(sm),
3198 ETH_P_EAPOL, rbuf, rlen, key_mic);
3199 }
3200
3201
wpa_supplicant_process_mlo_1_of_2(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,const u8 * key_data,size_t key_data_len,u16 ver)3202 static void wpa_supplicant_process_mlo_1_of_2(struct wpa_sm *sm,
3203 const unsigned char *src_addr,
3204 const struct wpa_eapol_key *key,
3205 const u8 *key_data,
3206 size_t key_data_len, u16 ver)
3207 {
3208 u16 key_info;
3209 u8 i;
3210 struct wpa_eapol_ie_parse ie;
3211
3212 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm) &&
3213 !wpa_eppke_is_completed(sm) &&
3214 !wpa_eap_over_auth_frame_is_completed(sm)) {
3215 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3216 "MLO RSN: Group Key Handshake started prior to completion of 4-way handshake");
3217 goto failed;
3218 }
3219
3220 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "MLO RSN: RX message 1 of Group "
3221 "Key Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr),
3222 ver);
3223
3224 key_info = WPA_GET_BE16(key->key_info);
3225
3226 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
3227
3228 wpa_hexdump_key(MSG_DEBUG, "MLO RSN: msg 1/2 key data", key_data,
3229 key_data_len);
3230 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
3231 goto failed;
3232
3233 if (!ie.valid_mlo_gtks) {
3234 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3235 "MLO RSN: No MLO GTK KDE in Group Key msg 1/2");
3236 goto failed;
3237 }
3238
3239 if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
3240 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3241 "MLO RSN: MLO GTK KDE in unencrypted key data");
3242 goto failed;
3243 }
3244
3245 #ifdef CONFIG_OCV
3246 if (wpa_sm_ocv_enabled(sm)) {
3247 struct wpa_channel_info ci;
3248
3249 if (wpa_sm_channel_info(sm, &ci) != 0) {
3250 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3251 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
3252 goto failed;
3253 }
3254
3255 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
3256 channel_width_to_int(ci.chanwidth),
3257 ci.seg1_idx) != OCI_SUCCESS) {
3258 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, OCV_FAILURE
3259 "addr=" MACSTR " frame=eapol-key-g1 error=%s",
3260 MAC2STR(sm->bssid), ocv_errorstr);
3261 goto failed;
3262 }
3263 }
3264 #endif /* CONFIG_OCV */
3265
3266 if (mlo_ieee80211w_set_keys(sm, &ie) < 0)
3267 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3268 "MLO RSN: Failed to configure MLO IGTK");
3269
3270 for_each_link(sm->mlo.valid_links, i) {
3271 /*
3272 * AP may send group keys for subset of the all links during
3273 * rekey
3274 */
3275 if (!ie.mlo_gtk[i])
3276 continue;
3277
3278 if (wpa_supplicant_mlo_gtk(sm, i, ie.mlo_gtk[i],
3279 ie.mlo_gtk_len[i], key_info))
3280 goto failed;
3281 }
3282
3283 if (wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
3284 goto failed;
3285
3286 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "MLO RSN: Group rekeying completed "
3287 "with " MACSTR " [GTK=%s]", MAC2STR(sm->mlo.ap_mld_addr),
3288 wpa_cipher_txt(sm->group_cipher));
3289 wpa_sm_cancel_auth_timeout(sm);
3290 wpa_sm_set_state(sm, WPA_COMPLETED);
3291
3292 wpa_sm_set_rekey_offload(sm);
3293
3294 return;
3295
3296 failed:
3297 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
3298 }
3299
3300
wpa_supplicant_process_1_of_2_wpa(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,const u8 * key_data,size_t key_data_len,u16 ver)3301 static void wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
3302 const unsigned char *src_addr,
3303 const struct wpa_eapol_key *key,
3304 const u8 *key_data,
3305 size_t key_data_len, u16 ver)
3306 {
3307 u16 key_info;
3308 int rekey;
3309 struct wpa_gtk_data gd;
3310 const u8 *key_rsc;
3311 size_t maxkeylen;
3312 u16 gtk_len;
3313
3314 if (!sm->msg_3_of_4_ok) {
3315 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3316 "WPA: Group Key Handshake started prior to completion of 4-way handshake");
3317 goto failed;
3318 }
3319
3320 os_memset(&gd, 0, sizeof(gd));
3321
3322 rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
3323 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3324 "WPA: RX message 1 of Group Key Handshake from " MACSTR
3325 " (ver=%d)", MAC2STR(src_addr), ver);
3326
3327 key_info = WPA_GET_BE16(key->key_info);
3328
3329 gtk_len = WPA_GET_BE16(key->key_length);
3330 maxkeylen = key_data_len;
3331 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3332 if (maxkeylen < 8) {
3333 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3334 "WPA: Too short maxkeylen (%lu)",
3335 (unsigned long) maxkeylen);
3336 goto failed;
3337 }
3338 maxkeylen -= 8;
3339 }
3340
3341 if (gtk_len > maxkeylen ||
3342 wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
3343 gtk_len, maxkeylen,
3344 &gd.key_rsc_len, &gd.alg))
3345 goto failed;
3346
3347 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
3348
3349 gd.gtk_len = gtk_len;
3350 gd.keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
3351 WPA_KEY_INFO_KEY_INDEX_SHIFT;
3352 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
3353 #if defined(CONFIG_NO_RC4) || defined(CONFIG_FIPS)
3354 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3355 "WPA: RC4 not supported in the build");
3356 goto failed;
3357 #else /* CONFIG_NO_RC4 || CONFIG_FIPS */
3358 u8 ek[32];
3359 if (key_data_len > sizeof(gd.gtk)) {
3360 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3361 "WPA: RC4 key data too long (%lu)",
3362 (unsigned long) key_data_len);
3363 goto failed;
3364 }
3365 os_memcpy(ek, key->key_iv, 16);
3366 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
3367 os_memcpy(gd.gtk, key_data, key_data_len);
3368 if (rc4_skip(ek, 32, 256, gd.gtk, key_data_len)) {
3369 forced_memzero(ek, sizeof(ek));
3370 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
3371 "WPA: RC4 failed");
3372 goto failed;
3373 }
3374 forced_memzero(ek, sizeof(ek));
3375 #endif /* CONFIG_NO_RC4 || CONFIG_FIPS */
3376 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3377 if (maxkeylen % 8) {
3378 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3379 "WPA: Unsupported AES-WRAP len %lu",
3380 (unsigned long) maxkeylen);
3381 goto failed;
3382 }
3383 if (maxkeylen > sizeof(gd.gtk)) {
3384 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3385 "WPA: AES-WRAP key data "
3386 "too long (keydatalen=%lu maxkeylen=%lu)",
3387 (unsigned long) key_data_len,
3388 (unsigned long) maxkeylen);
3389 goto failed;
3390 }
3391 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
3392 key_data, gd.gtk)) {
3393 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3394 "WPA: AES unwrap failed - could not decrypt "
3395 "GTK");
3396 goto failed;
3397 }
3398 } else {
3399 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3400 "WPA: Unsupported key_info type %d", ver);
3401 goto failed;
3402 }
3403 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3404 sm, !!(key_info & WPA_KEY_INFO_TXRX));
3405
3406 key_rsc = key->key_rsc;
3407 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
3408 key_rsc = null_rsc;
3409
3410 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
3411 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
3412 goto failed;
3413 forced_memzero(&gd, sizeof(gd));
3414
3415 if (rekey) {
3416 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3417 "WPA: Group rekeying completed with " MACSTR
3418 " [GTK=%s]",
3419 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
3420 wpa_sm_cancel_auth_timeout(sm);
3421 wpa_sm_set_state(sm, WPA_COMPLETED);
3422 } else {
3423 wpa_supplicant_key_neg_complete(sm, sm->bssid,
3424 key_info & WPA_KEY_INFO_SECURE);
3425 }
3426
3427 wpa_sm_set_rekey_offload(sm);
3428
3429 return;
3430
3431 failed:
3432 forced_memzero(&gd, sizeof(gd));
3433 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
3434 }
3435
3436
wpa_supplicant_process_1_of_2(struct wpa_sm * sm,const unsigned char * src_addr,const struct wpa_eapol_key * key,const u8 * key_data,size_t key_data_len,u16 ver)3437 static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
3438 const unsigned char *src_addr,
3439 const struct wpa_eapol_key *key,
3440 const u8 *key_data,
3441 size_t key_data_len, u16 ver)
3442 {
3443 u16 key_info;
3444 struct wpa_gtk_data gd;
3445 const u8 *key_rsc;
3446 int maxkeylen;
3447 struct wpa_eapol_ie_parse ie;
3448 u16 gtk_len;
3449
3450 if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm) &&
3451 !wpa_eppke_is_completed(sm) &&
3452 !wpa_eap_over_auth_frame_is_completed(sm)) {
3453 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3454 "RSN: Group Key Handshake started prior to completion of 4-way handshake");
3455 goto failed;
3456 }
3457
3458 os_memset(&gd, 0, sizeof(gd));
3459
3460 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3461 "RSN: RX message 1 of Group Key Handshake from " MACSTR
3462 " (ver=%d)", MAC2STR(src_addr), ver);
3463
3464 key_info = WPA_GET_BE16(key->key_info);
3465
3466 wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
3467 key_data, key_data_len);
3468 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
3469 goto failed;
3470
3471 wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
3472
3473 if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
3474 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3475 "RSN: GTK KDE in unencrypted key data");
3476 goto failed;
3477 }
3478 if (!ie.gtk) {
3479 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3480 "RSN: No GTK KDE in Group Key msg 1/2");
3481 goto failed;
3482 }
3483 gtk_len = ie.gtk_len;
3484 if (wpa_supplicant_validate_gtk_kde_len(gtk_len) < 0) {
3485 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3486 "RSN: Invalid GTK KDE length (%u) in Group Key msg 1/2",
3487 gtk_len);
3488 goto failed;
3489 }
3490 gtk_len -= 2;
3491 maxkeylen = gd.gtk_len = gtk_len;
3492
3493 #ifdef CONFIG_OCV
3494 if (wpa_sm_ocv_enabled(sm)) {
3495 struct wpa_channel_info ci;
3496
3497 if (wpa_sm_channel_info(sm, &ci) != 0) {
3498 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3499 "Failed to get channel info to validate received OCI in EAPOL-Key group msg 1/2");
3500 goto failed;
3501 }
3502
3503 if (ocv_verify_tx_params(ie.oci, ie.oci_len, &ci,
3504 channel_width_to_int(ci.chanwidth),
3505 ci.seg1_idx) != OCI_SUCCESS) {
3506 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, OCV_FAILURE
3507 "addr=" MACSTR " frame=eapol-key-g1 error=%s",
3508 MAC2STR(sm->bssid), ocv_errorstr);
3509 goto failed;
3510 }
3511 }
3512 #endif /* CONFIG_OCV */
3513
3514 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
3515 gtk_len, maxkeylen,
3516 &gd.key_rsc_len, &gd.alg))
3517 goto failed;
3518
3519 wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
3520 ie.gtk, 2 + gtk_len);
3521 gd.keyidx = ie.gtk[0] & 0x3;
3522 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
3523 !!(ie.gtk[0] & BIT(2)));
3524 os_memcpy(gd.gtk, ie.gtk + 2, gtk_len);
3525
3526 if (ieee80211w_set_keys(sm, &ie) < 0)
3527 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3528 "RSN: Failed to configure IGTK");
3529
3530 key_rsc = key->key_rsc;
3531 if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
3532 key_rsc = null_rsc;
3533
3534 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
3535 wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
3536 goto failed;
3537 forced_memzero(&gd, sizeof(gd));
3538
3539 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3540 "RSN: Group rekeying completed with " MACSTR " [GTK=%s]",
3541 MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
3542 wpa_sm_cancel_auth_timeout(sm);
3543 wpa_sm_set_state(sm, WPA_COMPLETED);
3544
3545 wpa_sm_set_rekey_offload(sm);
3546
3547 return;
3548
3549 failed:
3550 forced_memzero(&gd, sizeof(gd));
3551 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
3552 }
3553
3554
wpa_sm_tptk_to_ptk(struct wpa_sm * sm)3555 static void wpa_sm_tptk_to_ptk(struct wpa_sm *sm)
3556 {
3557 sm->tptk_set = 0;
3558 sm->ptk_set = 1;
3559 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
3560 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
3561 sm->hash_alg = sm->ptk.hash_alg;
3562
3563 if (wpa_sm_pmf_enabled(sm)) {
3564 os_memcpy(sm->last_kck, sm->ptk.kck, sm->ptk.kck_len);
3565 sm->last_kck_len = sm->ptk.kck_len;
3566 sm->last_kck_pmk_len = sm->pmk_len;
3567 sm->last_kck_key_mgmt = sm->key_mgmt;
3568 sm->last_kck_eapol_key_ver = sm->last_eapol_key_ver;
3569 os_memcpy(sm->last_kck_aa, wpa_sm_get_auth_addr(sm), ETH_ALEN);
3570 } else {
3571 os_memset(sm->last_kck, 0, sizeof(sm->last_kck));
3572 sm->last_kck_len = 0;
3573 os_memset(sm->last_kck_aa, 0, ETH_ALEN);
3574 }
3575 }
3576
3577
wpa_supplicant_verify_eapol_key_mic(struct wpa_sm * sm,struct wpa_eapol_key * key,u16 ver,const u8 * buf,size_t len)3578 static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
3579 struct wpa_eapol_key *key,
3580 u16 ver,
3581 const u8 *buf, size_t len)
3582 {
3583 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
3584 int ok = 0;
3585 size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg);
3586
3587 os_memcpy(mic, key + 1, mic_len);
3588 if (sm->tptk_set) {
3589 os_memset(key + 1, 0, mic_len);
3590 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
3591 sm->key_mgmt, sm->hash_alg,
3592 ver, buf, len, (u8 *) (key + 1)) < 0 ||
3593 os_memcmp_const(mic, key + 1, mic_len) != 0) {
3594 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3595 "WPA: Invalid EAPOL-Key MIC "
3596 "when using TPTK - ignoring TPTK");
3597 #ifdef TEST_FUZZ
3598 wpa_printf(MSG_INFO,
3599 "TEST: Ignore Key MIC failure for fuzz testing");
3600 goto continue_fuzz;
3601 #endif /* TEST_FUZZ */
3602 } else {
3603 #ifdef TEST_FUZZ
3604 continue_fuzz:
3605 #endif /* TEST_FUZZ */
3606 ok = 1;
3607 wpa_sm_tptk_to_ptk(sm);
3608 /*
3609 * This assures the same TPTK in sm->tptk can never be
3610 * copied twice to sm->ptk as the new PTK. In
3611 * combination with the installed flag in the wpa_ptk
3612 * struct, this assures the same PTK is only installed
3613 * once.
3614 */
3615 sm->renew_snonce = 1;
3616 }
3617 }
3618
3619 if (!ok && sm->ptk_set) {
3620 os_memset(key + 1, 0, mic_len);
3621 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
3622 sm->key_mgmt, sm->hash_alg,
3623 ver, buf, len, (u8 *) (key + 1)) < 0 ||
3624 os_memcmp_const(mic, key + 1, mic_len) != 0) {
3625 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3626 "WPA: Invalid EAPOL-Key MIC - "
3627 "dropping packet");
3628 #ifdef TEST_FUZZ
3629 wpa_printf(MSG_INFO,
3630 "TEST: Ignore Key MIC failure for fuzz testing");
3631 goto continue_fuzz2;
3632 #endif /* TEST_FUZZ */
3633 return -1;
3634 }
3635 #ifdef TEST_FUZZ
3636 continue_fuzz2:
3637 #endif /* TEST_FUZZ */
3638 ok = 1;
3639 }
3640
3641 if (!ok) {
3642 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3643 "WPA: Could not verify EAPOL-Key MIC - "
3644 "dropping packet");
3645 return -1;
3646 }
3647
3648 os_memcpy(sm->rx_replay_counter, key->replay_counter,
3649 WPA_REPLAY_COUNTER_LEN);
3650 sm->rx_replay_counter_set = 1;
3651 return 0;
3652 }
3653
3654
3655 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
wpa_supplicant_decrypt_key_data(struct wpa_sm * sm,struct wpa_eapol_key * key,size_t mic_len,u16 ver,u8 * key_data,size_t * key_data_len)3656 static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
3657 struct wpa_eapol_key *key,
3658 size_t mic_len, u16 ver,
3659 u8 *key_data, size_t *key_data_len)
3660 {
3661 wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
3662 key_data, *key_data_len);
3663 if (!sm->ptk_set) {
3664 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3665 "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
3666 "Data");
3667 return -1;
3668 }
3669
3670 /* Decrypt key data here so that this operation does not need
3671 * to be implemented separately for each message type. */
3672 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
3673 #if defined(CONFIG_NO_RC4) || defined(CONFIG_FIPS)
3674 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3675 "WPA: RC4 not supported in the build");
3676 return -1;
3677 #else /* CONFIG_NO_RC4 || CONFIG_FIPS */
3678 u8 ek[32];
3679
3680 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
3681 os_memcpy(ek, key->key_iv, 16);
3682 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
3683 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
3684 forced_memzero(ek, sizeof(ek));
3685 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
3686 "WPA: RC4 failed");
3687 return -1;
3688 }
3689 forced_memzero(ek, sizeof(ek));
3690 #endif /* CONFIG_NO_RC4 || CONFIG_FIPS */
3691 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
3692 ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
3693 wpa_use_aes_key_wrap(sm->key_mgmt)) {
3694 u8 *buf;
3695
3696 wpa_printf(MSG_DEBUG,
3697 "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
3698 (unsigned int) sm->ptk.kek_len);
3699 if (*key_data_len < 8 || *key_data_len % 8) {
3700 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3701 "WPA: Unsupported AES-WRAP len %u",
3702 (unsigned int) *key_data_len);
3703 return -1;
3704 }
3705 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
3706 buf = os_malloc(*key_data_len);
3707 if (buf == NULL) {
3708 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3709 "WPA: No memory for AES-UNWRAP buffer");
3710 return -1;
3711 }
3712 #ifdef TEST_FUZZ
3713 os_memset(buf, 0x11, *key_data_len);
3714 #endif /* TEST_FUZZ */
3715 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
3716 key_data, buf)) {
3717 #ifdef TEST_FUZZ
3718 wpa_printf(MSG_INFO,
3719 "TEST: Ignore AES unwrap failure for fuzz testing");
3720 goto continue_fuzz;
3721 #endif /* TEST_FUZZ */
3722 bin_clear_free(buf, *key_data_len);
3723 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3724 "WPA: AES unwrap failed - "
3725 "could not decrypt EAPOL-Key key data");
3726 return -1;
3727 }
3728 #ifdef TEST_FUZZ
3729 continue_fuzz:
3730 #endif /* TEST_FUZZ */
3731 os_memcpy(key_data, buf, *key_data_len);
3732 bin_clear_free(buf, *key_data_len);
3733 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
3734 } else {
3735 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3736 "WPA: Unsupported key_info type %d", ver);
3737 return -1;
3738 }
3739 wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
3740 key_data, *key_data_len);
3741 return 0;
3742 }
3743
3744
3745 /**
3746 * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
3747 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3748 */
wpa_sm_aborted_cached(struct wpa_sm * sm)3749 void wpa_sm_aborted_cached(struct wpa_sm *sm)
3750 {
3751 if (sm && sm->cur_pmksa) {
3752 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3753 "RSN: Cancelling PMKSA caching attempt");
3754 sm->cur_pmksa = NULL;
3755 }
3756 }
3757
3758
wpa_sm_aborted_external_cached(struct wpa_sm * sm)3759 void wpa_sm_aborted_external_cached(struct wpa_sm *sm)
3760 {
3761 if (sm && sm->cur_pmksa && sm->cur_pmksa->external) {
3762 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3763 "RSN: Cancelling external PMKSA caching attempt");
3764 sm->cur_pmksa = NULL;
3765 }
3766 }
3767
3768
wpa_eapol_key_dump(struct wpa_sm * sm,const struct wpa_eapol_key * key,unsigned int key_data_len,const u8 * mic,unsigned int mic_len)3769 static void wpa_eapol_key_dump(struct wpa_sm *sm,
3770 const struct wpa_eapol_key *key,
3771 unsigned int key_data_len,
3772 const u8 *mic, unsigned int mic_len)
3773 {
3774 #ifndef CONFIG_NO_STDOUT_DEBUG
3775 u16 key_info = WPA_GET_BE16(key->key_info);
3776
3777 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, " EAPOL-Key type=%d", key->type);
3778 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3779 " key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
3780 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
3781 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
3782 WPA_KEY_INFO_KEY_INDEX_SHIFT,
3783 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
3784 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
3785 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
3786 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
3787 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
3788 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
3789 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
3790 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
3791 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
3792 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3793 " key_length=%u key_data_length=%u",
3794 WPA_GET_BE16(key->key_length), key_data_len);
3795 wpa_hexdump(MSG_DEBUG, " replay_counter",
3796 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
3797 wpa_hexdump(MSG_DEBUG, " key_nonce", key->key_nonce, WPA_NONCE_LEN);
3798 wpa_hexdump(MSG_DEBUG, " key_iv", key->key_iv, 16);
3799 wpa_hexdump(MSG_DEBUG, " key_rsc", key->key_rsc, 8);
3800 wpa_hexdump(MSG_DEBUG, " key_id (reserved)", key->key_id, 8);
3801 wpa_hexdump(MSG_DEBUG, " key_mic", mic, mic_len);
3802 #endif /* CONFIG_NO_STDOUT_DEBUG */
3803 }
3804
3805
3806 #ifdef CONFIG_FILS
wpa_supp_aead_decrypt(struct wpa_sm * sm,u8 * buf,size_t buf_len,size_t * key_data_len)3807 static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
3808 size_t *key_data_len)
3809 {
3810 struct wpa_ptk *ptk;
3811 struct ieee802_1x_hdr *hdr;
3812 struct wpa_eapol_key *key;
3813 u8 *pos, *tmp;
3814 const u8 *aad[1];
3815 size_t aad_len[1];
3816
3817 if (*key_data_len < AES_BLOCK_SIZE) {
3818 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
3819 return -1;
3820 }
3821
3822 if (sm->tptk_set)
3823 ptk = &sm->tptk;
3824 else if (sm->ptk_set)
3825 ptk = &sm->ptk;
3826 else
3827 return -1;
3828
3829 hdr = (struct ieee802_1x_hdr *) buf;
3830 key = (struct wpa_eapol_key *) (hdr + 1);
3831 pos = (u8 *) (key + 1);
3832 pos += 2; /* Pointing at the Encrypted Key Data field */
3833
3834 tmp = os_malloc(*key_data_len);
3835 if (!tmp)
3836 return -1;
3837
3838 /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
3839 * to Key Data (exclusive). */
3840 aad[0] = buf;
3841 aad_len[0] = pos - buf;
3842 if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
3843 1, aad, aad_len, tmp) < 0) {
3844 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
3845 bin_clear_free(tmp, *key_data_len);
3846 return -1;
3847 }
3848
3849 /* AEAD decryption and validation completed successfully */
3850 (*key_data_len) -= AES_BLOCK_SIZE;
3851 wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
3852 tmp, *key_data_len);
3853
3854 /* Replace Key Data field with the decrypted version */
3855 os_memcpy(pos, tmp, *key_data_len);
3856 pos -= 2; /* Key Data Length field */
3857 WPA_PUT_BE16(pos, *key_data_len);
3858 bin_clear_free(tmp, *key_data_len);
3859
3860 if (sm->tptk_set)
3861 wpa_sm_tptk_to_ptk(sm);
3862
3863 os_memcpy(sm->rx_replay_counter, key->replay_counter,
3864 WPA_REPLAY_COUNTER_LEN);
3865 sm->rx_replay_counter_set = 1;
3866
3867 return 0;
3868 }
3869 #endif /* CONFIG_FILS */
3870
3871
wpa_sm_rx_eapol_wpa(struct wpa_sm * sm,const u8 * src_addr,struct wpa_eapol_key * key,enum frame_encryption encrypted,const u8 * tmp,size_t data_len,u8 * key_data,size_t key_data_len)3872 static int wpa_sm_rx_eapol_wpa(struct wpa_sm *sm, const u8 *src_addr,
3873 struct wpa_eapol_key *key,
3874 enum frame_encryption encrypted,
3875 const u8 *tmp, size_t data_len,
3876 u8 *key_data, size_t key_data_len)
3877 {
3878 u16 key_info, ver;
3879
3880 key_info = WPA_GET_BE16(key->key_info);
3881
3882 if (key->type != EAPOL_KEY_TYPE_WPA) {
3883 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3884 "WPA: Unsupported EAPOL-Key type %d", key->type);
3885 return -1;
3886 }
3887
3888 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
3889 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
3890 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3891 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3892 "WPA: Unsupported EAPOL-Key descriptor version %d",
3893 ver);
3894 return -1;
3895 }
3896
3897 if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
3898 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3899 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3900 "WPA: CCMP is used, but EAPOL-Key descriptor version (%d) is not 2",
3901 ver);
3902 if (sm->group_cipher != WPA_CIPHER_CCMP &&
3903 !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
3904 /* Earlier versions of IEEE 802.11i did not explicitly
3905 * require version 2 descriptor for all EAPOL-Key
3906 * packets, so allow group keys to use version 1 if
3907 * CCMP is not used for them. */
3908 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
3909 "WPA: Backwards compatibility: allow invalid version for non-CCMP group keys");
3910 } else
3911 return -1;
3912 }
3913
3914 if ((key_info & WPA_KEY_INFO_MIC) &&
3915 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
3916 return -1;
3917
3918 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
3919 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
3920 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3921 "WPA: Ignored EAPOL-Key (Pairwise) with non-zero key index");
3922 return -1;
3923 }
3924 if (key_info & (WPA_KEY_INFO_MIC |
3925 WPA_KEY_INFO_ENCR_KEY_DATA)) {
3926 /* 3/4 4-Way Handshake */
3927 wpa_supplicant_process_3_of_4_wpa(sm, key, ver,
3928 key_data,
3929 key_data_len);
3930 } else {
3931 /* 1/4 4-Way Handshake */
3932 wpa_supplicant_process_1_of_4_wpa(sm, src_addr, key,
3933 ver, key_data,
3934 key_data_len,
3935 encrypted);
3936 }
3937 } else {
3938 if (key_info & WPA_KEY_INFO_MIC) {
3939 /* 1/2 Group Key Handshake */
3940 wpa_supplicant_process_1_of_2_wpa(sm, src_addr, key,
3941 key_data,
3942 key_data_len,
3943 ver);
3944 } else {
3945 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
3946 "WPA: EAPOL-Key (Group) without Mic/Encr bit - dropped");
3947 }
3948 }
3949
3950 return 1;
3951 }
3952
3953
3954 /**
3955 * wpa_sm_rx_eapol - Process received WPA EAPOL frames
3956 * @sm: Pointer to WPA state machine data from wpa_sm_init()
3957 * @src_addr: Source MAC address of the EAPOL packet
3958 * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
3959 * @len: Length of the EAPOL frame
3960 * @encrypted: Whether the frame was encrypted
3961 * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure,
3962 * -2 = reply counter did not increase.
3963 *
3964 * This function is called for each received EAPOL frame. Other than EAPOL-Key
3965 * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
3966 * only processing WPA and WPA2 EAPOL-Key frames.
3967 *
3968 * The received EAPOL-Key packets are validated and valid packets are replied
3969 * to. In addition, key material (PTK, GTK) is configured at the end of a
3970 * successful key handshake.
3971 */
wpa_sm_rx_eapol(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len,enum frame_encryption encrypted)3972 int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
3973 const u8 *buf, size_t len, enum frame_encryption encrypted)
3974 {
3975 size_t plen, data_len, key_data_len;
3976 const struct ieee802_1x_hdr *hdr;
3977 struct wpa_eapol_key *key;
3978 u16 key_info, ver;
3979 u8 *tmp = NULL;
3980 int ret = -1;
3981 u8 *mic, *key_data;
3982 size_t mic_len, keyhdrlen, pmk_len;
3983
3984 #ifdef CONFIG_IEEE80211R
3985 sm->ft_completed = 0;
3986 #endif /* CONFIG_IEEE80211R */
3987
3988 pmk_len = sm->pmk_len;
3989 if (!pmk_len && sm->cur_pmksa)
3990 pmk_len = sm->cur_pmksa->pmk_len;
3991 mic_len = wpa_mic_len(sm->key_mgmt, pmk_len, sm->hash_alg);
3992 keyhdrlen = sizeof(*key) + mic_len + 2;
3993
3994 if (len < sizeof(*hdr) + keyhdrlen) {
3995 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3996 "WPA: EAPOL frame too short to be a WPA "
3997 "EAPOL-Key (len %lu, expecting at least %lu)",
3998 (unsigned long) len,
3999 (unsigned long) sizeof(*hdr) + keyhdrlen);
4000 return 0;
4001 }
4002
4003 hdr = (const struct ieee802_1x_hdr *) buf;
4004 plen = be_to_host16(hdr->length);
4005 data_len = plen + sizeof(*hdr);
4006 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4007 "IEEE 802.1X RX: version=%d type=%d length=%lu",
4008 hdr->version, hdr->type, (unsigned long) plen);
4009
4010 if (hdr->version < EAPOL_VERSION) {
4011 /* TODO: backwards compatibility */
4012 }
4013 if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
4014 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4015 "WPA: EAPOL frame (type %u) discarded, "
4016 "not a Key frame", hdr->type);
4017 ret = 0;
4018 goto out;
4019 }
4020 wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
4021 if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
4022 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4023 "WPA: EAPOL frame payload size %lu "
4024 "invalid (frame size %lu)",
4025 (unsigned long) plen, (unsigned long) len);
4026 ret = 0;
4027 goto out;
4028 }
4029 if (data_len < len) {
4030 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4031 "WPA: ignoring %lu bytes after the IEEE 802.1X data",
4032 (unsigned long) len - data_len);
4033 }
4034
4035 /*
4036 * Make a copy of the frame since we need to modify the buffer during
4037 * MAC validation and Key Data decryption.
4038 */
4039 tmp = os_memdup(buf, data_len);
4040 if (tmp == NULL)
4041 goto out;
4042 key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
4043 mic = (u8 *) (key + 1);
4044 key_data = mic + mic_len + 2;
4045
4046 if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
4047 {
4048 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4049 "WPA: EAPOL-Key type (%d) unknown, discarded",
4050 key->type);
4051 ret = 0;
4052 goto out;
4053 }
4054
4055 key_data_len = WPA_GET_BE16(mic + mic_len);
4056 wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
4057
4058 if (key_data_len > plen - keyhdrlen) {
4059 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
4060 "frame - key_data overflow (%u > %u)",
4061 (unsigned int) key_data_len,
4062 (unsigned int) (plen - keyhdrlen));
4063 goto out;
4064 }
4065
4066 if (sm->rx_replay_counter_set &&
4067 os_memcmp(key->replay_counter, sm->rx_replay_counter,
4068 WPA_REPLAY_COUNTER_LEN) <= 0) {
4069 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4070 "WPA: EAPOL-Key Replay Counter did not increase - dropping packet");
4071 ret = -2;
4072 goto out;
4073 }
4074
4075 eapol_sm_notify_lower_layer_success(sm->eapol, 0);
4076
4077 key_info = WPA_GET_BE16(key->key_info);
4078
4079 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
4080 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4081 "WPA: Unsupported SMK bit in key_info");
4082 goto out;
4083 }
4084
4085 if (!(key_info & WPA_KEY_INFO_ACK)) {
4086 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4087 "WPA: No Ack bit in key_info");
4088 goto out;
4089 }
4090
4091 if (key_info & WPA_KEY_INFO_REQUEST) {
4092 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4093 "WPA: EAPOL-Key with Request bit - dropped");
4094 goto out;
4095 }
4096
4097 if (sm->proto == WPA_PROTO_WPA) {
4098 ret = wpa_sm_rx_eapol_wpa(sm, src_addr, key, encrypted,
4099 tmp, data_len,
4100 key_data, key_data_len);
4101 goto out;
4102 }
4103
4104 if (key->type != EAPOL_KEY_TYPE_RSN) {
4105 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4106 "RSN: Unsupported EAPOL-Key type %d", key->type);
4107 goto out;
4108 }
4109
4110 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
4111 if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
4112 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
4113 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
4114 !wpa_use_akm_defined(sm->key_mgmt)) {
4115 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4116 "RSN: Unsupported EAPOL-Key descriptor version %d",
4117 ver);
4118 goto out;
4119 }
4120
4121 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
4122 sm->pairwise_cipher != WPA_CIPHER_TKIP) {
4123 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4124 "RSN: EAPOL-Key descriptor version %d not allowed without TKIP as the pairwise cipher",
4125 ver);
4126 goto out;
4127 }
4128
4129 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
4130 (sm->key_mgmt != WPA_KEY_MGMT_IEEE8021X &&
4131 sm->key_mgmt != WPA_KEY_MGMT_PSK)) {
4132 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4133 "RSN: EAPOL-Key descriptor version %d not allowed due to negotiated AKM (0x%x)",
4134 ver, sm->key_mgmt);
4135 goto out;
4136 }
4137
4138 if (wpa_use_akm_defined(sm->key_mgmt) &&
4139 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
4140 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4141 "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
4142 ver);
4143 goto out;
4144 }
4145
4146 #ifdef CONFIG_IEEE80211R
4147 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
4148 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
4149 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
4150 !wpa_use_akm_defined(sm->key_mgmt)) {
4151 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4152 "FT: AP did not use AES-128-CMAC");
4153 goto out;
4154 }
4155 } else
4156 #endif /* CONFIG_IEEE80211R */
4157 if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
4158 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
4159 !wpa_use_akm_defined(sm->key_mgmt)) {
4160 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4161 "RSN: AP did not use the negotiated AES-128-CMAC");
4162 goto out;
4163 }
4164 } else if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
4165 !wpa_use_akm_defined(sm->key_mgmt) &&
4166 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
4167 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4168 "RSN: CCMP is used, but EAPOL-Key descriptor version (%d) is not 2", ver);
4169 if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
4170 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4171 "RSN: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
4172 } else {
4173 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4174 "RSN: Unexpected descriptor version %u", ver);
4175 goto out;
4176 }
4177 } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
4178 !wpa_use_akm_defined(sm->key_mgmt) &&
4179 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
4180 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
4181 "RSN: GCMP is used, but EAPOL-Key descriptor version (%d) is not 2",
4182 ver);
4183 goto out;
4184 }
4185
4186 sm->last_eapol_key_ver = ver;
4187
4188 if ((key_info & WPA_KEY_INFO_MIC) &&
4189 wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
4190 goto out;
4191
4192 #ifdef CONFIG_FILS
4193 if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
4194 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
4195 goto out;
4196 }
4197 #endif /* CONFIG_FILS */
4198
4199 if (sm->proto == WPA_PROTO_RSN &&
4200 (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
4201 /*
4202 * Only decrypt the Key Data field if the frame's authenticity
4203 * was verified. When using AES-SIV (FILS), the MIC flag is not
4204 * set, so this check should only be performed if mic_len != 0
4205 * which is the case in this code branch.
4206 */
4207 if (!(key_info & WPA_KEY_INFO_MIC)) {
4208 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4209 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
4210 goto out;
4211 }
4212 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
4213 ver, key_data,
4214 &key_data_len))
4215 goto out;
4216 }
4217
4218 if (key_info & WPA_KEY_INFO_KEY_TYPE) {
4219 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
4220 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4221 "RSN: Ignored EAPOL-Key (Pairwise) with non-zero key index");
4222 goto out;
4223 }
4224 if (key_info & (WPA_KEY_INFO_MIC |
4225 WPA_KEY_INFO_ENCR_KEY_DATA)) {
4226 /* 3/4 4-Way Handshake */
4227 wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
4228 key_data_len);
4229 } else {
4230 /* 1/4 4-Way Handshake */
4231 wpa_supplicant_process_1_of_4(sm, src_addr, key,
4232 ver, key_data,
4233 key_data_len,
4234 encrypted);
4235 }
4236 } else {
4237 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
4238 (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
4239 /* 1/2 Group Key Handshake */
4240 if (sm->mlo.valid_links)
4241 wpa_supplicant_process_mlo_1_of_2(sm, src_addr,
4242 key, key_data,
4243 key_data_len,
4244 ver);
4245 else
4246 wpa_supplicant_process_1_of_2(sm, src_addr, key,
4247 key_data,
4248 key_data_len,
4249 ver);
4250 } else {
4251 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4252 "RSN: EAPOL-Key (Group) without Mic/Encr bit - dropped");
4253 }
4254 }
4255
4256 ret = 1;
4257
4258 out:
4259 bin_clear_free(tmp, data_len);
4260 return ret;
4261 }
4262
4263
4264 #ifdef CONFIG_CTRL_IFACE
wpa_key_mgmt_suite(struct wpa_sm * sm)4265 static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
4266 {
4267 switch (sm->key_mgmt) {
4268 case WPA_KEY_MGMT_IEEE8021X:
4269 return ((sm->proto == WPA_PROTO_RSN) ?
4270 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
4271 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
4272 case WPA_KEY_MGMT_PSK:
4273 return (sm->proto == WPA_PROTO_RSN ?
4274 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
4275 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
4276 #ifdef CONFIG_IEEE80211R
4277 case WPA_KEY_MGMT_FT_IEEE8021X:
4278 return RSN_AUTH_KEY_MGMT_FT_802_1X;
4279 case WPA_KEY_MGMT_FT_PSK:
4280 return RSN_AUTH_KEY_MGMT_FT_PSK;
4281 #endif /* CONFIG_IEEE80211R */
4282 case WPA_KEY_MGMT_IEEE8021X_SHA256:
4283 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
4284 case WPA_KEY_MGMT_PSK_SHA256:
4285 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
4286 case WPA_KEY_MGMT_CCKM:
4287 return (sm->proto == WPA_PROTO_RSN ?
4288 RSN_AUTH_KEY_MGMT_CCKM:
4289 WPA_AUTH_KEY_MGMT_CCKM);
4290 case WPA_KEY_MGMT_WPA_NONE:
4291 return WPA_AUTH_KEY_MGMT_NONE;
4292 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
4293 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
4294 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
4295 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
4296 case WPA_KEY_MGMT_IEEE8021X_SHA384:
4297 return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
4298 default:
4299 return 0;
4300 }
4301 }
4302
4303
4304 #define RSN_SUITE "%02x-%02x-%02x-%d"
4305 #define RSN_SUITE_ARG(s) \
4306 ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
4307
4308 /**
4309 * wpa_sm_get_mib - Dump text list of MIB entries
4310 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4311 * @buf: Buffer for the list
4312 * @buflen: Length of the buffer
4313 * Returns: Number of bytes written to buffer
4314 *
4315 * This function is used fetch dot11 MIB variables.
4316 */
wpa_sm_get_mib(struct wpa_sm * sm,char * buf,size_t buflen)4317 int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
4318 {
4319 char pmkid_txt[PMKID_LEN * 2 + 1];
4320 bool rsna;
4321 int ret;
4322 size_t len;
4323
4324 if (sm->cur_pmksa) {
4325 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
4326 sm->cur_pmksa->pmkid, PMKID_LEN);
4327 } else
4328 pmkid_txt[0] = '\0';
4329
4330 rsna = (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
4331 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
4332 sm->proto == WPA_PROTO_RSN;
4333
4334 ret = os_snprintf(buf, buflen,
4335 "dot11RSNAOptionImplemented=TRUE\n"
4336 "dot11RSNAPreauthenticationImplemented=TRUE\n"
4337 "dot11RSNAEnabled=%s\n"
4338 "dot11RSNAPreauthenticationEnabled=%s\n"
4339 "dot11RSNAConfigVersion=%d\n"
4340 "dot11RSNAConfigPairwiseKeysSupported=5\n"
4341 "dot11RSNAConfigGroupCipherSize=%d\n"
4342 "dot11RSNAConfigPMKLifetime=%d\n"
4343 "dot11RSNAConfigPMKReauthThreshold=%d\n"
4344 "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
4345 "dot11RSNAConfigSATimeout=%d\n",
4346 rsna ? "TRUE" : "FALSE",
4347 rsna ? "TRUE" : "FALSE",
4348 RSN_VERSION,
4349 wpa_cipher_key_len(sm->group_cipher) * 8,
4350 sm->dot11RSNAConfigPMKLifetime,
4351 sm->dot11RSNAConfigPMKReauthThreshold,
4352 sm->dot11RSNAConfigSATimeout);
4353 if (os_snprintf_error(buflen, ret))
4354 return 0;
4355 len = ret;
4356
4357 ret = os_snprintf(
4358 buf + len, buflen - len,
4359 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
4360 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
4361 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
4362 "dot11RSNAPMKIDUsed=%s\n"
4363 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
4364 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
4365 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
4366 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
4367 "dot11RSNA4WayHandshakeFailures=%u\n",
4368 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
4369 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
4370 sm->pairwise_cipher)),
4371 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
4372 sm->group_cipher)),
4373 pmkid_txt,
4374 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
4375 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
4376 sm->pairwise_cipher)),
4377 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
4378 sm->group_cipher)),
4379 sm->dot11RSNA4WayHandshakeFailures);
4380 if (!os_snprintf_error(buflen - len, ret))
4381 len += ret;
4382
4383 return (int) len;
4384 }
4385 #endif /* CONFIG_CTRL_IFACE */
4386
4387
wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry * entry,void * ctx,enum pmksa_free_reason reason)4388 static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
4389 void *ctx, enum pmksa_free_reason reason)
4390 {
4391 struct wpa_sm *sm = ctx;
4392 int deauth = 0;
4393
4394 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
4395 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
4396
4397 if (sm->cur_pmksa == entry) {
4398 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4399 "RSN: %s current PMKSA entry",
4400 reason == PMKSA_REPLACE ? "replaced" : "removed");
4401 pmksa_cache_clear_current(sm);
4402
4403 /*
4404 * If an entry is simply being replaced, there's no need to
4405 * deauthenticate because it will be immediately re-added.
4406 * This happens when EAP authentication is completed again
4407 * (reauth or failed PMKSA caching attempt).
4408 */
4409 if (reason != PMKSA_REPLACE)
4410 deauth = 1;
4411 }
4412
4413 if (reason == PMKSA_EXPIRE &&
4414 (sm->pmk_len == entry->pmk_len &&
4415 os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
4416 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4417 "RSN: deauthenticating due to expired PMK");
4418 pmksa_cache_clear_current(sm);
4419 deauth = 1;
4420 }
4421
4422 if (deauth) {
4423 sm->pmk_len = 0;
4424 os_memset(sm->pmk, 0, sizeof(sm->pmk));
4425 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
4426 }
4427 }
4428
4429
wpa_sm_pmksa_is_current_cb(struct rsn_pmksa_cache_entry * entry,void * ctx)4430 static bool wpa_sm_pmksa_is_current_cb(struct rsn_pmksa_cache_entry *entry,
4431 void *ctx)
4432 {
4433 struct wpa_sm *sm = ctx;
4434
4435 return sm->cur_pmksa == entry;
4436 }
4437
4438
wpa_sm_pmksa_notify_cb(struct rsn_pmksa_cache_entry * entry,void * ctx)4439 static void wpa_sm_pmksa_notify_cb(struct rsn_pmksa_cache_entry *entry,
4440 void *ctx)
4441 {
4442 struct wpa_sm *sm = ctx;
4443
4444 wpa_sm_notify_pmksa_cache_entry(sm, entry);
4445 }
4446
4447
4448 /**
4449 * wpa_sm_init - Initialize WPA state machine
4450 * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
4451 * Returns: Pointer to the allocated WPA state machine data
4452 *
4453 * This function is used to allocate a new WPA state machine and the returned
4454 * value is passed to all WPA state machine calls.
4455 */
wpa_sm_init(struct wpa_sm_ctx * ctx)4456 struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
4457 {
4458 struct wpa_sm *sm;
4459
4460 sm = os_zalloc(sizeof(*sm));
4461 if (sm == NULL)
4462 return NULL;
4463 dl_list_init(&sm->pmksa_candidates);
4464 sm->renew_snonce = 1;
4465 sm->ctx = ctx;
4466
4467 sm->dot11RSNAConfigPMKLifetime = 43200;
4468 sm->dot11RSNAConfigPMKReauthThreshold = 70;
4469 sm->dot11RSNAConfigSATimeout = 60;
4470
4471 sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb,
4472 wpa_sm_pmksa_is_current_cb,
4473 wpa_sm_pmksa_notify_cb, sm, sm);
4474 if (sm->pmksa == NULL) {
4475 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
4476 "RSN: PMKSA cache initialization failed");
4477 os_free(sm);
4478 return NULL;
4479 }
4480
4481 return sm;
4482 }
4483
4484
4485 /**
4486 * wpa_sm_deinit - Deinitialize WPA state machine
4487 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4488 */
wpa_sm_deinit(struct wpa_sm * sm)4489 void wpa_sm_deinit(struct wpa_sm *sm)
4490 {
4491 int i;
4492
4493 if (sm == NULL)
4494 return;
4495 pmksa_cache_deinit(sm->pmksa);
4496 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
4497 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
4498 os_free(sm->assoc_wpa_ie);
4499 os_free(sm->assoc_rsnxe);
4500 os_free(sm->ap_wpa_ie);
4501 os_free(sm->ap_rsn_ie);
4502 os_free(sm->ap_rsnxe);
4503 os_free(sm->ap_rsne_override);
4504 os_free(sm->ap_rsne_override_2);
4505 os_free(sm->ap_rsnxe_override);
4506 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
4507 os_free(sm->mlo.links[i].ap_rsne);
4508 os_free(sm->mlo.links[i].ap_rsnxe);
4509 os_free(sm->mlo.links[i].ap_rsnoe);
4510 os_free(sm->mlo.links[i].ap_rsno2e);
4511 os_free(sm->mlo.links[i].ap_rsnxoe);
4512 }
4513 wpa_sm_drop_sa(sm);
4514 os_free(sm->ctx);
4515 #ifdef CONFIG_IEEE80211R
4516 os_free(sm->assoc_resp_ies);
4517 #endif /* CONFIG_IEEE80211R */
4518 #ifdef CONFIG_TESTING_OPTIONS
4519 wpabuf_free(sm->test_assoc_ie);
4520 wpabuf_free(sm->test_eapol_m2_elems);
4521 wpabuf_free(sm->test_eapol_m4_elems);
4522 wpabuf_free(sm->test_rsnxe_data);
4523 wpabuf_free(sm->test_rsnxe_mask);
4524 #endif /* CONFIG_TESTING_OPTIONS */
4525 #ifdef CONFIG_FILS_SK_PFS
4526 crypto_ecdh_deinit(sm->fils_ecdh);
4527 #endif /* CONFIG_FILS_SK_PFS */
4528 #ifdef CONFIG_FILS
4529 wpabuf_free(sm->fils_ft_ies);
4530 #endif /* CONFIG_FILS */
4531 #ifdef CONFIG_OWE
4532 crypto_ecdh_deinit(sm->owe_ecdh);
4533 #endif /* CONFIG_OWE */
4534 #ifdef CONFIG_DPP2
4535 wpabuf_clear_free(sm->dpp_z);
4536 #endif /* CONFIG_DPP2 */
4537 os_memset(sm->last_kck, 0, sizeof(sm->last_kck));
4538 os_free(sm);
4539 }
4540
4541
wpa_sm_clear_ptk(struct wpa_sm * sm)4542 static void wpa_sm_clear_ptk(struct wpa_sm *sm)
4543 {
4544 int i;
4545
4546 sm->ptk_set = 0;
4547 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
4548 sm->tptk_set = 0;
4549 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
4550 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
4551 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
4552 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
4553 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
4554 os_memset(&sm->bigtk, 0, sizeof(sm->bigtk));
4555 os_memset(&sm->bigtk_wnm_sleep, 0, sizeof(sm->bigtk_wnm_sleep));
4556 sm->tk_set = false;
4557 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
4558 os_memset(&sm->mlo.links[i].gtk, 0,
4559 sizeof(sm->mlo.links[i].gtk));
4560 os_memset(&sm->mlo.links[i].gtk_wnm_sleep, 0,
4561 sizeof(sm->mlo.links[i].gtk_wnm_sleep));
4562 os_memset(&sm->mlo.links[i].igtk, 0,
4563 sizeof(sm->mlo.links[i].igtk));
4564 os_memset(&sm->mlo.links[i].igtk_wnm_sleep, 0,
4565 sizeof(sm->mlo.links[i].igtk_wnm_sleep));
4566 os_memset(&sm->mlo.links[i].bigtk, 0,
4567 sizeof(sm->mlo.links[i].bigtk));
4568 os_memset(&sm->mlo.links[i].bigtk_wnm_sleep, 0,
4569 sizeof(sm->mlo.links[i].bigtk_wnm_sleep));
4570 }
4571 }
4572
4573
4574 /**
4575 * wpa_sm_notify_assoc - Notify WPA state machine about association
4576 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4577 * @bssid: The BSSID of the new association
4578 *
4579 * This function is called to let WPA state machine know that the connection
4580 * was established.
4581 */
wpa_sm_notify_assoc(struct wpa_sm * sm,const u8 * bssid)4582 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
4583 {
4584 int clear_keys = 1;
4585
4586 if (sm == NULL)
4587 return;
4588
4589 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4590 "WPA: Association event - clear replay counter");
4591 os_memcpy(sm->bssid, bssid, ETH_ALEN);
4592 os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
4593 sm->rx_replay_counter_set = 0;
4594 sm->renew_snonce = 1;
4595 if (ether_addr_equal(sm->preauth_bssid, bssid))
4596 rsn_preauth_deinit(sm);
4597
4598 #ifdef CONFIG_IEEE80211R
4599 if (wpa_ft_is_completed(sm)) {
4600 /*
4601 * Clear portValid to kick EAPOL state machine to re-enter
4602 * AUTHENTICATED state to get the EAPOL port Authorized.
4603 */
4604 eapol_sm_notify_portValid(sm->eapol, false);
4605 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
4606
4607 /* Prepare for the next transition */
4608 wpa_ft_prepare_auth_request(sm, NULL);
4609
4610 clear_keys = 0;
4611 sm->ft_protocol = 1;
4612 } else {
4613 sm->ft_protocol = 0;
4614 }
4615 #endif /* CONFIG_IEEE80211R */
4616 #ifdef CONFIG_FILS
4617 if (sm->fils_completed) {
4618 /*
4619 * Clear portValid to kick EAPOL state machine to re-enter
4620 * AUTHENTICATED state to get the EAPOL port Authorized.
4621 */
4622 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
4623 clear_keys = 0;
4624 }
4625 #endif /* CONFIG_FILS */
4626 #ifdef CONFIG_ENC_ASSOC
4627 if (sm->eppke_completed || sm->eap_over_auth_frame_completed) {
4628 /*
4629 * Clear portValid to kick EAPOL state machine to re-enter
4630 * AUTHENTICATED state to get the EAPOL port Authorized.
4631 */
4632 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
4633 clear_keys = 0;
4634 }
4635 #endif /* CONFIG_ENC_ASSOC */
4636
4637 if (clear_keys) {
4638 /*
4639 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
4640 * this is not part of a Fast BSS Transition.
4641 */
4642 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
4643 wpa_sm_clear_ptk(sm);
4644 sm->hash_alg = RSN_HASH_NOT_SPECIFIED;
4645 }
4646
4647 #ifdef CONFIG_TDLS
4648 wpa_tdls_assoc(sm);
4649 #endif /* CONFIG_TDLS */
4650
4651 #ifdef CONFIG_P2P
4652 os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
4653 #endif /* CONFIG_P2P */
4654
4655 sm->keyidx_active = 0;
4656 }
4657
4658
4659 /**
4660 * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
4661 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4662 *
4663 * This function is called to let WPA state machine know that the connection
4664 * was lost. This will abort any existing pre-authentication session.
4665 */
wpa_sm_notify_disassoc(struct wpa_sm * sm)4666 void wpa_sm_notify_disassoc(struct wpa_sm *sm)
4667 {
4668 eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
4669 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
4670 rsn_preauth_deinit(sm);
4671 pmksa_cache_clear_current(sm);
4672 if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
4673 sm->dot11RSNA4WayHandshakeFailures++;
4674 #ifdef CONFIG_TDLS
4675 wpa_tdls_disassoc(sm);
4676 #endif /* CONFIG_TDLS */
4677 #ifdef CONFIG_FILS
4678 sm->fils_completed = 0;
4679 #endif /* CONFIG_FILS */
4680 #ifdef CONFIG_IEEE80211R
4681 sm->ft_reassoc_completed = 0;
4682 sm->ft_protocol = 0;
4683 #endif /* CONFIG_IEEE80211R */
4684 #ifdef CONFIG_ENC_ASSOC
4685 sm->eppke_completed = 0;
4686 sm->eap_over_auth_frame_completed = 0;
4687 #endif /* CONFIG_ENC_ASSOC */
4688
4689 /* Keys are not needed in the WPA state machine anymore */
4690 wpa_sm_drop_sa(sm);
4691 sm->keyidx_active = 0;
4692
4693 sm->msg_3_of_4_ok = 0;
4694 os_memset(sm->bssid, 0, ETH_ALEN);
4695 sm->hash_alg = RSN_HASH_NOT_SPECIFIED;
4696 }
4697
4698
4699 /**
4700 * wpa_sm_set_pmk - Set PMK
4701 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4702 * @pmk: The new PMK
4703 * @pmk_len: The length of the new PMK in bytes
4704 * @pmkid: Calculated PMKID
4705 * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
4706 *
4707 * Configure the PMK for WPA state machine.
4708 */
wpa_sm_set_pmk(struct wpa_sm * sm,const u8 * pmk,size_t pmk_len,const u8 * pmkid,const u8 * bssid)4709 void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
4710 const u8 *pmkid, const u8 *bssid)
4711 {
4712 if (sm == NULL)
4713 return;
4714
4715 wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
4716 pmk, pmk_len);
4717 sm->pmk_len = pmk_len;
4718 os_memcpy(sm->pmk, pmk, pmk_len);
4719
4720 #ifdef CONFIG_SAE
4721 if (wpa_key_mgmt_sae_ext_key(sm->key_mgmt)) {
4722 if (pmk_len == 32)
4723 sm->hash_alg = RSN_HASH_SHA256;
4724 else if (pmk_len == 48)
4725 sm->hash_alg = RSN_HASH_SHA384;
4726 else if (pmk_len == 64)
4727 sm->hash_alg = RSN_HASH_SHA512;
4728 }
4729 #endif /* CONFIG_SAE */
4730
4731 #ifdef CONFIG_IEEE80211R
4732 /* Set XXKey to be PSK for FT key derivation */
4733 sm->xxkey_len = pmk_len;
4734 os_memcpy(sm->xxkey, pmk, pmk_len);
4735 #endif /* CONFIG_IEEE80211R */
4736
4737 if (bssid) {
4738 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len,
4739 pmkid, NULL, 0, bssid,
4740 sm->own_addr,
4741 sm->network_ctx, sm->key_mgmt,
4742 NULL, 0);
4743 }
4744 }
4745
4746
4747 /**
4748 * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
4749 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4750 *
4751 * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
4752 * will be cleared.
4753 */
wpa_sm_set_pmk_from_pmksa(struct wpa_sm * sm)4754 void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
4755 {
4756 if (sm == NULL)
4757 return;
4758
4759 if (sm->cur_pmksa) {
4760 wpa_hexdump_key(MSG_DEBUG,
4761 "WPA: Set PMK based on current PMKSA",
4762 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
4763 sm->pmk_len = sm->cur_pmksa->pmk_len;
4764 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
4765 } else {
4766 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
4767 sm->pmk_len = 0;
4768 os_memset(sm->pmk, 0, PMK_LEN_MAX);
4769 }
4770 }
4771
4772
4773 /**
4774 * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
4775 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4776 * @fast_reauth: Whether fast reauthentication (EAP) is allowed
4777 */
wpa_sm_set_fast_reauth(struct wpa_sm * sm,int fast_reauth)4778 void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
4779 {
4780 if (sm)
4781 sm->fast_reauth = fast_reauth;
4782 }
4783
4784
4785 /**
4786 * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
4787 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4788 * @scard_ctx: Context pointer for smartcard related callback functions
4789 */
wpa_sm_set_scard_ctx(struct wpa_sm * sm,void * scard_ctx)4790 void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
4791 {
4792 if (sm == NULL)
4793 return;
4794 sm->scard_ctx = scard_ctx;
4795 if (sm->preauth_eapol)
4796 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
4797 }
4798
4799
4800 /**
4801 * wpa_sm_set_config - Notification of current configuration change
4802 * @sm: Pointer to WPA state machine data from wpa_sm_init()
4803 * @config: Pointer to current network configuration
4804 *
4805 * Notify WPA state machine that configuration has changed. config will be
4806 * stored as a backpointer to network configuration. This can be %NULL to clear
4807 * the stored pointed.
4808 */
wpa_sm_set_config(struct wpa_sm * sm,struct rsn_supp_config * config)4809 void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
4810 {
4811 if (!sm)
4812 return;
4813
4814 if (config) {
4815 sm->network_ctx = config->network_ctx;
4816 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
4817 sm->proactive_key_caching = config->proactive_key_caching;
4818 sm->eap_workaround = config->eap_workaround;
4819 sm->eap_conf_ctx = config->eap_conf_ctx;
4820 if (config->ssid) {
4821 os_memcpy(sm->ssid, config->ssid, config->ssid_len);
4822 sm->ssid_len = config->ssid_len;
4823 } else
4824 sm->ssid_len = 0;
4825 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
4826 sm->p2p = config->p2p;
4827 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
4828 sm->owe_ptk_workaround = config->owe_ptk_workaround;
4829 sm->force_kdk_derivation = config->force_kdk_derivation;
4830 #ifdef CONFIG_FILS
4831 if (config->fils_cache_id) {
4832 sm->fils_cache_id_set = 1;
4833 os_memcpy(sm->fils_cache_id, config->fils_cache_id,
4834 FILS_CACHE_ID_LEN);
4835 } else {
4836 sm->fils_cache_id_set = 0;
4837 }
4838 #endif /* CONFIG_FILS */
4839 sm->beacon_prot = config->beacon_prot;
4840 } else {
4841 sm->network_ctx = NULL;
4842 sm->allowed_pairwise_cipher = 0;
4843 sm->proactive_key_caching = 0;
4844 sm->eap_workaround = 0;
4845 sm->eap_conf_ctx = NULL;
4846 sm->ssid_len = 0;
4847 sm->wpa_ptk_rekey = 0;
4848 sm->p2p = 0;
4849 sm->wpa_rsc_relaxation = 0;
4850 sm->owe_ptk_workaround = 0;
4851 sm->beacon_prot = 0;
4852 sm->force_kdk_derivation = false;
4853 }
4854 }
4855
4856
wpa_sm_set_ssid(struct wpa_sm * sm,const u8 * ssid,size_t ssid_len)4857 void wpa_sm_set_ssid(struct wpa_sm *sm, const u8 *ssid, size_t ssid_len)
4858 {
4859 if (!sm)
4860 return;
4861
4862 if (ssid) {
4863 os_memcpy(sm->ssid, ssid, ssid_len);
4864 sm->ssid_len = ssid_len;
4865 } else {
4866 sm->ssid_len = 0;
4867 }
4868 }
4869
4870
wpa_sm_clear_mlo_group_keys(struct wpa_sm * sm,int link_id)4871 static void wpa_sm_clear_mlo_group_keys(struct wpa_sm *sm, int link_id)
4872 {
4873 if (!sm)
4874 return;
4875
4876 os_memset(&sm->mlo.links[link_id].gtk, 0,
4877 sizeof(sm->mlo.links[link_id].gtk));
4878 os_memset(&sm->mlo.links[link_id].gtk_wnm_sleep, 0,
4879 sizeof(sm->mlo.links[link_id].gtk_wnm_sleep));
4880 os_memset(&sm->mlo.links[link_id].igtk, 0,
4881 sizeof(sm->mlo.links[link_id].igtk));
4882 os_memset(&sm->mlo.links[link_id].igtk_wnm_sleep, 0,
4883 sizeof(sm->mlo.links[link_id].igtk_wnm_sleep));
4884 os_memset(&sm->mlo.links[link_id].bigtk, 0,
4885 sizeof(sm->mlo.links[link_id].bigtk));
4886 os_memset(&sm->mlo.links[link_id].bigtk_wnm_sleep, 0,
4887 sizeof(sm->mlo.links[link_id].bigtk_wnm_sleep));
4888 }
4889
4890
wpa_sm_set_mlo_params(struct wpa_sm * sm,const struct wpa_sm_mlo * mlo)4891 int wpa_sm_set_mlo_params(struct wpa_sm *sm, const struct wpa_sm_mlo *mlo)
4892 {
4893 int i;
4894 u16 removed_links;
4895
4896 if (!sm)
4897 return -1;
4898
4899 os_memcpy(sm->mlo.ap_mld_addr, mlo->ap_mld_addr, ETH_ALEN);
4900 removed_links = ~mlo->valid_links & sm->mlo.valid_links;
4901 sm->mlo.assoc_link_id = mlo->assoc_link_id;
4902 sm->mlo.valid_links = mlo->valid_links;
4903 sm->mlo.req_links = mlo->req_links;
4904
4905 for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
4906 const u8 *ie;
4907 size_t len;
4908
4909 if (sm->mlo.req_links & BIT(i)) {
4910 if (!mlo->links[i].ap_rsne ||
4911 mlo->links[i].ap_rsne_len == 0) {
4912 wpa_dbg(sm->ctx->msg_ctx, MSG_INFO,
4913 "RSN: No RSNE for AP MLO link %d with BSSID "
4914 MACSTR,
4915 i, MAC2STR(mlo->links[i].bssid));
4916 return -1;
4917
4918 }
4919 os_memcpy(sm->mlo.links[i].addr, mlo->links[i].addr,
4920 ETH_ALEN);
4921 os_memcpy(sm->mlo.links[i].bssid, mlo->links[i].bssid,
4922 ETH_ALEN);
4923 }
4924
4925 ie = mlo->links[i].ap_rsne;
4926 len = mlo->links[i].ap_rsne_len;
4927 os_free(sm->mlo.links[i].ap_rsne);
4928 if (!ie || len == 0) {
4929 if (sm->mlo.links[i].ap_rsne)
4930 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4931 "RSN: Clearing MLO link[%u] AP RSNE",
4932 i);
4933 sm->mlo.links[i].ap_rsne = NULL;
4934 sm->mlo.links[i].ap_rsne_len = 0;
4935 } else {
4936 wpa_hexdump_link(MSG_DEBUG, i, "RSN: Set AP RSNE",
4937 ie, len);
4938 sm->mlo.links[i].ap_rsne = os_memdup(ie, len);
4939 if (!sm->mlo.links[i].ap_rsne) {
4940 sm->mlo.links[i].ap_rsne_len = 0;
4941 return -1;
4942 }
4943 sm->mlo.links[i].ap_rsne_len = len;
4944 }
4945
4946 ie = mlo->links[i].ap_rsnxe;
4947 len = mlo->links[i].ap_rsnxe_len;
4948 os_free(sm->mlo.links[i].ap_rsnxe);
4949 if (!ie || len == 0) {
4950 if (sm->mlo.links[i].ap_rsnxe)
4951 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4952 "RSN: Clearing MLO link[%u] AP RSNXE",
4953 i);
4954 sm->mlo.links[i].ap_rsnxe = NULL;
4955 sm->mlo.links[i].ap_rsnxe_len = 0;
4956 } else {
4957 wpa_hexdump_link(MSG_DEBUG, i, "RSN: Set AP RSNXE", ie,
4958 len);
4959 sm->mlo.links[i].ap_rsnxe = os_memdup(ie, len);
4960 if (!sm->mlo.links[i].ap_rsnxe) {
4961 sm->mlo.links[i].ap_rsnxe_len = 0;
4962 return -1;
4963 }
4964 sm->mlo.links[i].ap_rsnxe_len = len;
4965 }
4966
4967 ie = mlo->links[i].ap_rsnoe;
4968 len = mlo->links[i].ap_rsnoe_len;
4969 os_free(sm->mlo.links[i].ap_rsnoe);
4970 if (!ie || len == 0) {
4971 if (sm->mlo.links[i].ap_rsnoe)
4972 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4973 "RSN: Clearing MLO link[%u] AP RSNOE",
4974 i);
4975 sm->mlo.links[i].ap_rsnoe = NULL;
4976 sm->mlo.links[i].ap_rsnoe_len = 0;
4977 } else {
4978 wpa_hexdump_link(MSG_DEBUG, i, "RSN: Set AP RSNOE",
4979 ie, len);
4980 sm->mlo.links[i].ap_rsnoe = os_memdup(ie, len);
4981 if (!sm->mlo.links[i].ap_rsnoe) {
4982 sm->mlo.links[i].ap_rsnoe_len = 0;
4983 return -1;
4984 }
4985 sm->mlo.links[i].ap_rsnoe_len = len;
4986 }
4987
4988 ie = mlo->links[i].ap_rsno2e;
4989 len = mlo->links[i].ap_rsno2e_len;
4990 os_free(sm->mlo.links[i].ap_rsno2e);
4991 if (!ie || len == 0) {
4992 if (sm->mlo.links[i].ap_rsno2e)
4993 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
4994 "RSN: Clearing MLO link[%u] AP RSNO2E",
4995 i);
4996 sm->mlo.links[i].ap_rsno2e = NULL;
4997 sm->mlo.links[i].ap_rsno2e_len = 0;
4998 } else {
4999 wpa_hexdump_link(MSG_DEBUG, i, "RSN: Set AP RSNO2E",
5000 ie, len);
5001 sm->mlo.links[i].ap_rsno2e = os_memdup(ie, len);
5002 if (!sm->mlo.links[i].ap_rsno2e) {
5003 sm->mlo.links[i].ap_rsno2e_len = 0;
5004 return -1;
5005 }
5006 sm->mlo.links[i].ap_rsno2e_len = len;
5007 }
5008
5009 ie = mlo->links[i].ap_rsnxoe;
5010 len = mlo->links[i].ap_rsnxoe_len;
5011 os_free(sm->mlo.links[i].ap_rsnxoe);
5012 if (!ie || len == 0) {
5013 if (sm->mlo.links[i].ap_rsnxoe)
5014 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5015 "RSN: Clearing MLO link[%u] AP RSNXOE",
5016 i);
5017 sm->mlo.links[i].ap_rsnxoe = NULL;
5018 sm->mlo.links[i].ap_rsnxoe_len = 0;
5019 } else {
5020 wpa_hexdump_link(MSG_DEBUG, i, "RSN: Set AP RSNXOE",
5021 ie, len);
5022 sm->mlo.links[i].ap_rsnxoe = os_memdup(ie, len);
5023 if (!sm->mlo.links[i].ap_rsnxoe) {
5024 sm->mlo.links[i].ap_rsnxoe_len = 0;
5025 return -1;
5026 }
5027 sm->mlo.links[i].ap_rsnxoe_len = len;
5028 }
5029
5030 if (removed_links & BIT(i)) {
5031 wpa_printf(MSG_DEBUG,
5032 "RSN: Clearing MLO group keys for link[%u]",
5033 i);
5034 wpa_sm_clear_mlo_group_keys(sm, i);
5035 }
5036 }
5037
5038 return 0;
5039 }
5040
5041
5042 /**
5043 * wpa_sm_set_own_addr - Set own MAC address
5044 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5045 * @addr: Own MAC address
5046 */
wpa_sm_set_own_addr(struct wpa_sm * sm,const u8 * addr)5047 void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
5048 {
5049 if (sm)
5050 os_memcpy(sm->own_addr, addr, ETH_ALEN);
5051 }
5052
5053
5054 /**
5055 * wpa_sm_set_ifname - Set network interface name
5056 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5057 * @ifname: Interface name
5058 * @bridge_ifname: Optional bridge interface name (for pre-auth)
5059 */
wpa_sm_set_ifname(struct wpa_sm * sm,const char * ifname,const char * bridge_ifname)5060 void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
5061 const char *bridge_ifname)
5062 {
5063 if (sm) {
5064 sm->ifname = ifname;
5065 sm->bridge_ifname = bridge_ifname;
5066 }
5067 }
5068
5069
5070 /**
5071 * wpa_sm_set_eapol - Set EAPOL state machine pointer
5072 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5073 * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
5074 */
wpa_sm_set_eapol(struct wpa_sm * sm,struct eapol_sm * eapol)5075 void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
5076 {
5077 if (sm)
5078 sm->eapol = eapol;
5079 }
5080
5081
5082 /**
5083 * wpa_sm_set_param - Set WPA state machine parameters
5084 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5085 * @param: Parameter field
5086 * @value: Parameter value
5087 * Returns: 0 on success, -1 on failure
5088 */
wpa_sm_set_param(struct wpa_sm * sm,enum wpa_sm_conf_params param,unsigned int value)5089 int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
5090 unsigned int value)
5091 {
5092 int ret = 0;
5093
5094 if (sm == NULL)
5095 return -1;
5096
5097 switch (param) {
5098 case RSNA_PMK_LIFETIME:
5099 if (value > 0)
5100 sm->dot11RSNAConfigPMKLifetime = value;
5101 else
5102 ret = -1;
5103 break;
5104 case RSNA_PMK_REAUTH_THRESHOLD:
5105 if (value > 0 && value <= 100)
5106 sm->dot11RSNAConfigPMKReauthThreshold = value;
5107 else
5108 ret = -1;
5109 break;
5110 case RSNA_SA_TIMEOUT:
5111 if (value > 0)
5112 sm->dot11RSNAConfigSATimeout = value;
5113 else
5114 ret = -1;
5115 break;
5116 case WPA_PARAM_PROTO:
5117 sm->proto = value;
5118 break;
5119 case WPA_PARAM_PAIRWISE:
5120 sm->pairwise_cipher = value;
5121 break;
5122 case WPA_PARAM_GROUP:
5123 sm->group_cipher = value;
5124 break;
5125 case WPA_PARAM_KEY_MGMT:
5126 sm->key_mgmt = value;
5127 break;
5128 case WPA_PARAM_MGMT_GROUP:
5129 sm->mgmt_group_cipher = value;
5130 break;
5131 case WPA_PARAM_RSN_ENABLED:
5132 sm->rsn_enabled = value;
5133 break;
5134 case WPA_PARAM_MFP:
5135 sm->mfp = value;
5136 break;
5137 case WPA_PARAM_OCV:
5138 sm->ocv = value;
5139 break;
5140 case WPA_PARAM_SAE_PWE:
5141 sm->sae_pwe = value;
5142 break;
5143 case WPA_PARAM_SAE_PK:
5144 sm->sae_pk = value;
5145 break;
5146 case WPA_PARAM_DENY_PTK0_REKEY:
5147 sm->wpa_deny_ptk0_rekey = value;
5148 break;
5149 case WPA_PARAM_EXT_KEY_ID:
5150 sm->ext_key_id = value;
5151 break;
5152 case WPA_PARAM_USE_EXT_KEY_ID:
5153 sm->use_ext_key_id = value;
5154 break;
5155 case WPA_PARAM_SPP_AMSDU:
5156 sm->spp_amsdu = !!value;
5157 break;
5158 #ifdef CONFIG_TESTING_OPTIONS
5159 case WPA_PARAM_FT_RSNXE_USED:
5160 sm->ft_rsnxe_used = value;
5161 break;
5162 case WPA_PARAM_OCI_FREQ_EAPOL:
5163 sm->oci_freq_override_eapol = value;
5164 break;
5165 case WPA_PARAM_OCI_FREQ_EAPOL_G2:
5166 sm->oci_freq_override_eapol_g2 = value;
5167 break;
5168 case WPA_PARAM_OCI_FREQ_FT_ASSOC:
5169 sm->oci_freq_override_ft_assoc = value;
5170 break;
5171 case WPA_PARAM_OCI_FREQ_FILS_ASSOC:
5172 sm->oci_freq_override_fils_assoc = value;
5173 break;
5174 case WPA_PARAM_DISABLE_EAPOL_G2_TX:
5175 sm->disable_eapol_g2_tx = value;
5176 break;
5177 case WPA_PARAM_ENCRYPT_EAPOL_M2:
5178 sm->encrypt_eapol_m2 = value;
5179 break;
5180 case WPA_PARAM_ENCRYPT_EAPOL_M4:
5181 sm->encrypt_eapol_m4 = value;
5182 break;
5183 case WPA_PARAM_EAPOL_2_KEY_INFO_SET_MASK:
5184 sm->eapol_2_key_info_set_mask = value;
5185 break;
5186 #endif /* CONFIG_TESTING_OPTIONS */
5187 case WPA_PARAM_URNM_MFPR:
5188 sm->prot_range_neg = value;
5189 break;
5190 case WPA_PARAM_URNM_MFPR_X20:
5191 sm->prot_range_neg_x20 = value;
5192 break;
5193 #ifdef CONFIG_DPP2
5194 case WPA_PARAM_DPP_PFS:
5195 sm->dpp_pfs = value;
5196 break;
5197 #endif /* CONFIG_DPP2 */
5198 case WPA_PARAM_WMM_ENABLED:
5199 sm->wmm_enabled = value;
5200 break;
5201 case WPA_PARAM_FT_PREPEND_PMKID:
5202 sm->ft_prepend_pmkid = value;
5203 break;
5204 case WPA_PARAM_SSID_PROTECTION:
5205 sm->ssid_protection = value;
5206 break;
5207 case WPA_PARAM_RSN_OVERRIDE:
5208 sm->rsn_override = value;
5209 break;
5210 case WPA_PARAM_RSN_OVERRIDE_SUPPORT:
5211 sm->rsn_override_support = value;
5212 break;
5213 case WPA_PARAM_SAE_PW_ID_CHANGE:
5214 sm->sae_pw_id_change = !!value;
5215 break;
5216 case WPA_PARAM_ASSOC_ENC:
5217 sm->assoc_encryption = !!value;
5218 break;
5219 case WPA_PARAM_PMKSA_CACHING_PRIVACY:
5220 sm->pmksa_privacy = !!value;
5221 break;
5222 default:
5223 break;
5224 }
5225
5226 return ret;
5227 }
5228
5229
wpa_sm_get_ap_rsne(struct wpa_sm * sm,size_t * len)5230 static const u8 * wpa_sm_get_ap_rsne(struct wpa_sm *sm, size_t *len)
5231 {
5232 if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE) {
5233 *len = sm->ap_rsne_override_len;
5234 return sm->ap_rsne_override;
5235 }
5236
5237 if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE_2) {
5238 *len = sm->ap_rsne_override_2_len;
5239 return sm->ap_rsne_override_2;
5240 }
5241
5242 *len = sm->ap_rsn_ie_len;
5243 return sm->ap_rsn_ie;
5244 }
5245
5246
wpa_sm_get_ap_rsnxe(struct wpa_sm * sm,size_t * len)5247 static const u8 * wpa_sm_get_ap_rsnxe(struct wpa_sm *sm, size_t *len)
5248 {
5249 if (sm->rsn_override != RSN_OVERRIDE_NOT_USED &&
5250 sm->rsn_override != RSN_OVERRIDE_RSNE &&
5251 sm->ap_rsnxe_override && sm->ap_rsnxe_override_len) {
5252 *len = sm->ap_rsnxe_override_len;
5253 return sm->ap_rsnxe_override;
5254 }
5255
5256 *len = sm->ap_rsnxe_len;
5257 return sm->ap_rsnxe;
5258 }
5259
5260
5261 /**
5262 * wpa_sm_get_status - Get WPA state machine
5263 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5264 * @buf: Buffer for status information
5265 * @buflen: Maximum buffer length
5266 * @verbose: Whether to include verbose status information
5267 * Returns: Number of bytes written to buf.
5268 *
5269 * Query WPA state machine for status information. This function fills in
5270 * a text area with current status information. If the buffer (buf) is not
5271 * large enough, status information will be truncated to fit the buffer.
5272 */
wpa_sm_get_status(struct wpa_sm * sm,char * buf,size_t buflen,int verbose)5273 int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
5274 int verbose)
5275 {
5276 char *pos = buf, *end = buf + buflen;
5277 int ret;
5278 const u8 *rsne;
5279 size_t rsne_len;
5280
5281 rsne = wpa_sm_get_ap_rsne(sm, &rsne_len);
5282
5283 ret = os_snprintf(pos, end - pos,
5284 "pairwise_cipher=%s\n"
5285 "group_cipher=%s\n"
5286 "key_mgmt=%s\n",
5287 wpa_cipher_txt(sm->pairwise_cipher),
5288 wpa_cipher_txt(sm->group_cipher),
5289 wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
5290 if (os_snprintf_error(end - pos, ret))
5291 return pos - buf;
5292 pos += ret;
5293
5294 #ifdef CONFIG_DPP2
5295 if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {
5296 ret = os_snprintf(pos, end - pos, "dpp_pfs=1\n");
5297 if (os_snprintf_error(end - pos, ret))
5298 return pos - buf;
5299 pos += ret;
5300 }
5301 #endif /* CONFIG_DPP2 */
5302
5303 if (sm->mfp != NO_MGMT_FRAME_PROTECTION && rsne) {
5304 struct wpa_ie_data rsn;
5305
5306 if (wpa_parse_wpa_ie_rsn(rsne, rsne_len, &rsn) >= 0 &&
5307 rsn.capabilities & (WPA_CAPABILITY_MFPR |
5308 WPA_CAPABILITY_MFPC)) {
5309 ret = os_snprintf(pos, end - pos, "pmf=%d\n"
5310 "mgmt_group_cipher=%s\n",
5311 (rsn.capabilities &
5312 WPA_CAPABILITY_MFPR) ? 2 : 1,
5313 wpa_cipher_txt(
5314 sm->mgmt_group_cipher));
5315 if (os_snprintf_error(end - pos, ret))
5316 return pos - buf;
5317 pos += ret;
5318 }
5319 }
5320
5321 return pos - buf;
5322 }
5323
5324
wpa_sm_pmf_enabled(struct wpa_sm * sm)5325 int wpa_sm_pmf_enabled(struct wpa_sm *sm)
5326 {
5327 struct wpa_ie_data rsn;
5328 const u8 *rsne;
5329 size_t rsne_len;
5330
5331 rsne = wpa_sm_get_ap_rsne(sm, &rsne_len);
5332
5333 if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !rsne)
5334 return 0;
5335
5336 if (wpa_parse_wpa_ie_rsn(rsne, rsne_len, &rsn) >= 0 &&
5337 rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
5338 return 1;
5339
5340 return 0;
5341 }
5342
5343
wpa_sm_rsn_overriding_supported(struct wpa_sm * sm)5344 bool wpa_sm_rsn_overriding_supported(struct wpa_sm *sm)
5345 {
5346 const u8 *rsne;
5347 size_t rsne_len;
5348
5349 rsne = wpa_sm_get_ap_rsne(sm, &rsne_len);
5350
5351 return sm->rsn_override_support && rsne;
5352 }
5353
5354
wpa_sm_ext_key_id(struct wpa_sm * sm)5355 int wpa_sm_ext_key_id(struct wpa_sm *sm)
5356 {
5357 return sm ? sm->ext_key_id : 0;
5358 }
5359
5360
wpa_sm_ext_key_id_active(struct wpa_sm * sm)5361 int wpa_sm_ext_key_id_active(struct wpa_sm *sm)
5362 {
5363 return sm ? sm->use_ext_key_id : 0;
5364 }
5365
5366
wpa_sm_ocv_enabled(struct wpa_sm * sm)5367 int wpa_sm_ocv_enabled(struct wpa_sm *sm)
5368 {
5369 struct wpa_ie_data rsn;
5370 const u8 *rsne;
5371 size_t rsne_len;
5372
5373 rsne = wpa_sm_get_ap_rsne(sm, &rsne_len);
5374 if (!sm->ocv || !rsne)
5375 return 0;
5376
5377 return wpa_parse_wpa_ie_rsn(rsne, rsne_len, &rsn) >= 0 &&
5378 (rsn.capabilities & WPA_CAPABILITY_OCVC);
5379 }
5380
5381
5382 /**
5383 * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
5384 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5385 * @wpa_ie: Pointer to buffer for WPA/RSN IE
5386 * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
5387 * Returns: 0 on success, -1 on failure
5388 */
wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm * sm,u8 * wpa_ie,size_t * wpa_ie_len)5389 int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
5390 size_t *wpa_ie_len)
5391 {
5392 int res;
5393
5394 if (sm == NULL)
5395 return -1;
5396
5397 #ifdef CONFIG_TESTING_OPTIONS
5398 if (sm->test_assoc_ie) {
5399 wpa_printf(MSG_DEBUG,
5400 "TESTING: Replace association WPA/RSN IE");
5401 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
5402 return -1;
5403 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
5404 wpabuf_len(sm->test_assoc_ie));
5405 res = wpabuf_len(sm->test_assoc_ie);
5406 } else
5407 #endif /* CONFIG_TESTING_OPTIONS */
5408 res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
5409 if (res < 0)
5410 return -1;
5411 *wpa_ie_len = res;
5412
5413 wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
5414 wpa_ie, *wpa_ie_len);
5415
5416 if (sm->assoc_wpa_ie == NULL) {
5417 /*
5418 * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
5419 * the correct version of the IE even if PMKSA caching is
5420 * aborted (which would remove PMKID from IE generation).
5421 */
5422 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
5423 if (sm->assoc_wpa_ie == NULL)
5424 return -1;
5425
5426 sm->assoc_wpa_ie_len = *wpa_ie_len;
5427 } else {
5428 wpa_hexdump(MSG_DEBUG,
5429 "WPA: Leave previously set WPA IE default",
5430 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
5431 }
5432
5433 return 0;
5434 }
5435
5436
5437 /**
5438 * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
5439 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5440 * @ie: Pointer to IE data (starting from id)
5441 * @len: IE length
5442 * Returns: 0 on success, -1 on failure
5443 *
5444 * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
5445 * Request frame. The IE will be used to override the default value generated
5446 * with wpa_sm_set_assoc_wpa_ie_default().
5447 */
wpa_sm_set_assoc_wpa_ie(struct wpa_sm * sm,const u8 * ie,size_t len)5448 int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
5449 {
5450 if (sm == NULL)
5451 return -1;
5452
5453 os_free(sm->assoc_wpa_ie);
5454 if (ie == NULL || len == 0) {
5455 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5456 "WPA: clearing own WPA/RSN IE");
5457 sm->assoc_wpa_ie = NULL;
5458 sm->assoc_wpa_ie_len = 0;
5459 } else {
5460 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
5461 sm->assoc_wpa_ie = os_memdup(ie, len);
5462 if (sm->assoc_wpa_ie == NULL)
5463 return -1;
5464
5465 sm->assoc_wpa_ie_len = len;
5466 }
5467
5468 return 0;
5469 }
5470
5471
5472 #ifdef CONFIG_TESTING_OPTIONS
5473
wpa_sm_set_test_rsnxe_data(struct wpa_sm * sm,struct wpabuf * data,struct wpabuf * mask)5474 int wpa_sm_set_test_rsnxe_data(struct wpa_sm *sm, struct wpabuf *data,
5475 struct wpabuf *mask)
5476 {
5477 size_t data_len = 0, mask_len = 0;
5478
5479 wpabuf_free(sm->test_rsnxe_data);
5480 sm->test_rsnxe_data = NULL;
5481 wpabuf_free(sm->test_rsnxe_mask);
5482 sm->test_rsnxe_mask = NULL;
5483
5484 if (!data && !mask)
5485 return 0;
5486
5487 if (data)
5488 data_len = wpabuf_len(data);
5489 if (mask)
5490 mask_len = wpabuf_len(mask);
5491
5492 if (data_len != mask_len || data_len > 255)
5493 return -1;
5494
5495 sm->test_rsnxe_data = data;
5496 sm->test_rsnxe_mask = mask;
5497
5498 return 0;
5499 }
5500
5501
wpa_set_test_rsnxe_data(struct wpa_sm * sm,u8 * rsnxe,size_t orig_len,size_t max_len)5502 static int wpa_set_test_rsnxe_data(struct wpa_sm *sm, u8 *rsnxe,
5503 size_t orig_len, size_t max_len)
5504 {
5505 const u8 *data, *mask;
5506 size_t i, data_len;
5507
5508 if (!sm->test_rsnxe_data || !sm->test_rsnxe_mask)
5509 return orig_len;
5510
5511 mask = wpabuf_head(sm->test_rsnxe_mask);
5512 data = wpabuf_head(sm->test_rsnxe_data);
5513 data_len = wpabuf_len(sm->test_rsnxe_data);
5514 if (max_len < data_len + 2) {
5515 wpa_printf(MSG_ERROR, "Couldn't fit RSNXE test data");
5516 return -1;
5517 }
5518
5519 /* Set data after original RSNXE to zero */
5520 if (orig_len < data_len + 2)
5521 os_memset(&rsnxe[orig_len], 0, data_len + 2 - orig_len);
5522
5523 /* Set EID and length fields */
5524 *rsnxe++ = WLAN_EID_RSNX;
5525 *rsnxe++ = data_len;
5526
5527 /* Preserve original RSNXE bit value when mask bit is zero */
5528 for (i = 0; i < data_len; i++) {
5529 if (!mask[i])
5530 continue;
5531
5532 rsnxe[i] &= ~mask[i];
5533 rsnxe[i] |= data[i] & mask[i];
5534 }
5535
5536 return data_len + 2;
5537 }
5538
5539 #endif /* CONFIG_TESTING_OPTIONS */
5540
5541
5542 /**
5543 * wpa_sm_set_assoc_rsnxe_default - Generate own RSNXE from configuration
5544 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5545 * @rsnxe: Pointer to buffer for RSNXE
5546 * @rsnxe_len: Pointer to the length of the rsne buffer
5547 * Returns: 0 on success, -1 on failure
5548 */
wpa_sm_set_assoc_rsnxe_default(struct wpa_sm * sm,u8 * rsnxe,size_t * rsnxe_len)5549 int wpa_sm_set_assoc_rsnxe_default(struct wpa_sm *sm, u8 *rsnxe,
5550 size_t *rsnxe_len)
5551 {
5552 int res;
5553
5554 if (!sm)
5555 return -1;
5556
5557 res = wpa_gen_rsnxe(sm, rsnxe, *rsnxe_len);
5558 if (res < 0)
5559 return -1;
5560 #ifdef CONFIG_TESTING_OPTIONS
5561 res = wpa_set_test_rsnxe_data(sm, rsnxe, res, *rsnxe_len);
5562 if (res < 0)
5563 return -1;
5564 #endif /* CONFIG_TESTING_OPTIONS */
5565 *rsnxe_len = res;
5566
5567 wpa_hexdump(MSG_DEBUG, "RSN: Set own RSNXE default", rsnxe, *rsnxe_len);
5568
5569 if (sm->assoc_rsnxe) {
5570 wpa_hexdump(MSG_DEBUG,
5571 "RSN: Leave previously set RSNXE default",
5572 sm->assoc_rsnxe, sm->assoc_rsnxe_len);
5573 } else if (*rsnxe_len > 0) {
5574 /*
5575 * Make a copy of the RSNXE so that 4-Way Handshake gets the
5576 * correct version of the IE even if it gets changed.
5577 */
5578 sm->assoc_rsnxe = os_memdup(rsnxe, *rsnxe_len);
5579 if (!sm->assoc_rsnxe)
5580 return -1;
5581
5582 sm->assoc_rsnxe_len = *rsnxe_len;
5583 }
5584
5585 return 0;
5586 }
5587
5588
5589 /**
5590 * wpa_sm_set_assoc_rsnxe - Set own RSNXE from (Re)AssocReq
5591 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5592 * @ie: Pointer to IE data (starting from id)
5593 * @len: IE length
5594 * Returns: 0 on success, -1 on failure
5595 *
5596 * Inform WPA state machine about the RSNXE used in (Re)Association Request
5597 * frame. The IE will be used to override the default value generated
5598 * with wpa_sm_set_assoc_rsnxe_default().
5599 */
wpa_sm_set_assoc_rsnxe(struct wpa_sm * sm,const u8 * ie,size_t len)5600 int wpa_sm_set_assoc_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
5601 {
5602 if (!sm)
5603 return -1;
5604
5605 os_free(sm->assoc_rsnxe);
5606 if (!ie || len == 0) {
5607 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5608 "RSN: clearing own RSNXE");
5609 sm->assoc_rsnxe = NULL;
5610 sm->assoc_rsnxe_len = 0;
5611 } else {
5612 wpa_hexdump(MSG_DEBUG, "RSN: set own RSNXE", ie, len);
5613 sm->assoc_rsnxe = os_memdup(ie, len);
5614 if (!sm->assoc_rsnxe)
5615 return -1;
5616
5617 sm->assoc_rsnxe_len = len;
5618 }
5619
5620 if (sm->ssid_protection &&
5621 !ieee802_11_rsnx_capab(sm->assoc_rsnxe,
5622 WLAN_RSNX_CAPAB_SSID_PROTECTION)) {
5623 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5624 "RSN: Disabling SSID protection based on own RSNXE update");
5625 sm->ssid_protection = 0;
5626 }
5627
5628 return 0;
5629 }
5630
5631
5632 /**
5633 * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
5634 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5635 * @ie: Pointer to IE data (starting from id)
5636 * @len: IE length
5637 * Returns: 0 on success, -1 on failure
5638 *
5639 * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
5640 * frame.
5641 */
wpa_sm_set_ap_wpa_ie(struct wpa_sm * sm,const u8 * ie,size_t len)5642 int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
5643 {
5644 if (sm == NULL)
5645 return -1;
5646
5647 os_free(sm->ap_wpa_ie);
5648 if (ie == NULL || len == 0) {
5649 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5650 "WPA: clearing AP WPA IE");
5651 sm->ap_wpa_ie = NULL;
5652 sm->ap_wpa_ie_len = 0;
5653 } else {
5654 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
5655 sm->ap_wpa_ie = os_memdup(ie, len);
5656 if (sm->ap_wpa_ie == NULL)
5657 return -1;
5658
5659 sm->ap_wpa_ie_len = len;
5660 }
5661
5662 return 0;
5663 }
5664
5665
5666 /**
5667 * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
5668 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5669 * @ie: Pointer to IE data (starting from id)
5670 * @len: IE length
5671 * Returns: 0 on success, -1 on failure
5672 *
5673 * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
5674 * frame.
5675 */
wpa_sm_set_ap_rsn_ie(struct wpa_sm * sm,const u8 * ie,size_t len)5676 int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
5677 {
5678 if (sm == NULL)
5679 return -1;
5680
5681 os_free(sm->ap_rsn_ie);
5682 if (ie == NULL || len == 0) {
5683 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5684 "WPA: clearing AP RSN IE");
5685 sm->ap_rsn_ie = NULL;
5686 sm->ap_rsn_ie_len = 0;
5687 } else {
5688 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
5689 sm->ap_rsn_ie = os_memdup(ie, len);
5690 if (sm->ap_rsn_ie == NULL)
5691 return -1;
5692
5693 sm->ap_rsn_ie_len = len;
5694 }
5695
5696 return 0;
5697 }
5698
5699
5700 /**
5701 * wpa_sm_set_ap_rsnxe - Set AP RSNXE from Beacon/ProbeResp
5702 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5703 * @ie: Pointer to IE data (starting from id)
5704 * @len: IE length
5705 * Returns: 0 on success, -1 on failure
5706 *
5707 * Inform WPA state machine about the RSNXE used in Beacon / Probe Response
5708 * frame.
5709 */
wpa_sm_set_ap_rsnxe(struct wpa_sm * sm,const u8 * ie,size_t len)5710 int wpa_sm_set_ap_rsnxe(struct wpa_sm *sm, const u8 *ie, size_t len)
5711 {
5712 if (!sm)
5713 return -1;
5714
5715 os_free(sm->ap_rsnxe);
5716 if (!ie || len == 0) {
5717 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: clearing AP RSNXE");
5718 sm->ap_rsnxe = NULL;
5719 sm->ap_rsnxe_len = 0;
5720 } else {
5721 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSNXE", ie, len);
5722 sm->ap_rsnxe = os_memdup(ie, len);
5723 if (!sm->ap_rsnxe)
5724 return -1;
5725
5726 sm->ap_rsnxe_len = len;
5727 }
5728
5729 return 0;
5730 }
5731
5732
wpa_sm_set_ap_rsne_override(struct wpa_sm * sm,const u8 * ie,size_t len)5733 int wpa_sm_set_ap_rsne_override(struct wpa_sm *sm, const u8 *ie, size_t len)
5734 {
5735 if (!sm)
5736 return -1;
5737
5738 os_free(sm->ap_rsne_override);
5739 if (!ie || len == 0) {
5740 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5741 "RSN: Clearing AP RSNE Override element");
5742 sm->ap_rsne_override = NULL;
5743 sm->ap_rsne_override_len = 0;
5744 } else {
5745 wpa_hexdump(MSG_DEBUG, "RSN: Set AP RSNE Override element",
5746 ie, len);
5747 sm->ap_rsne_override = os_memdup(ie, len);
5748 if (!sm->ap_rsne_override)
5749 return -1;
5750
5751 sm->ap_rsne_override_len = len;
5752 }
5753
5754 return 0;
5755 }
5756
5757
wpa_sm_set_ap_rsne_override_2(struct wpa_sm * sm,const u8 * ie,size_t len)5758 int wpa_sm_set_ap_rsne_override_2(struct wpa_sm *sm, const u8 *ie, size_t len)
5759 {
5760 if (!sm)
5761 return -1;
5762
5763 os_free(sm->ap_rsne_override_2);
5764 if (!ie || len == 0) {
5765 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5766 "RSN: Clearing AP RSNE Override 2 element");
5767 sm->ap_rsne_override_2 = NULL;
5768 sm->ap_rsne_override_2_len = 0;
5769 } else {
5770 wpa_hexdump(MSG_DEBUG, "RSN: Set AP RSNE Override 2 element",
5771 ie, len);
5772 sm->ap_rsne_override_2 = os_memdup(ie, len);
5773 if (!sm->ap_rsne_override_2)
5774 return -1;
5775
5776 sm->ap_rsne_override_2_len = len;
5777 }
5778
5779 return 0;
5780 }
5781
5782
wpa_sm_set_ap_rsnxe_override(struct wpa_sm * sm,const u8 * ie,size_t len)5783 int wpa_sm_set_ap_rsnxe_override(struct wpa_sm *sm, const u8 *ie, size_t len)
5784 {
5785 if (!sm)
5786 return -1;
5787
5788 os_free(sm->ap_rsnxe_override);
5789 if (!ie || len == 0) {
5790 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5791 "RSN: Clearing AP RSNXE Override element");
5792 sm->ap_rsnxe_override = NULL;
5793 sm->ap_rsnxe_override_len = 0;
5794 } else {
5795 wpa_hexdump(MSG_DEBUG, "RSN: Set AP RSNXE Override element",
5796 ie, len);
5797 sm->ap_rsnxe_override = os_memdup(ie, len);
5798 if (!sm->ap_rsnxe_override)
5799 return -1;
5800
5801 sm->ap_rsnxe_override_len = len;
5802 }
5803
5804 return 0;
5805 }
5806
5807
5808 /**
5809 * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
5810 * @sm: Pointer to WPA state machine data from wpa_sm_init()
5811 * @data: Pointer to data area for parsing results
5812 * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
5813 *
5814 * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
5815 * parsed data into data.
5816 */
wpa_sm_parse_own_wpa_ie(struct wpa_sm * sm,struct wpa_ie_data * data)5817 int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
5818 {
5819 if (sm == NULL)
5820 return -1;
5821
5822 if (sm->assoc_wpa_ie == NULL) {
5823 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
5824 "WPA: No WPA/RSN IE available from association info");
5825 return -1;
5826 }
5827 if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
5828 return -2;
5829 return 0;
5830 }
5831
5832
wpa_sm_pmksa_cache_list(struct wpa_sm * sm,char * buf,size_t len)5833 int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
5834 {
5835 return pmksa_cache_list(sm->pmksa, buf, len);
5836 }
5837
5838
wpa_sm_pmksa_cache_head(struct wpa_sm * sm)5839 struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
5840 {
5841 return pmksa_cache_head(sm->pmksa);
5842 }
5843
5844
5845 struct rsn_pmksa_cache_entry *
wpa_sm_pmksa_cache_add_entry(struct wpa_sm * sm,struct rsn_pmksa_cache_entry * entry)5846 wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
5847 struct rsn_pmksa_cache_entry * entry)
5848 {
5849 return pmksa_cache_add_entry(sm->pmksa, entry);
5850 }
5851
5852
wpa_sm_pmksa_cache_add(struct wpa_sm * sm,const u8 * pmk,size_t pmk_len,const u8 * pmkid,const u8 * bssid,const u8 * fils_cache_id)5853 void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
5854 const u8 *pmkid, const u8 *bssid,
5855 const u8 *fils_cache_id)
5856 {
5857 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
5858 bssid, sm->own_addr, sm->network_ctx,
5859 sm->key_mgmt, fils_cache_id, 0);
5860 }
5861
5862
wpa_sm_pmksa_exists(struct wpa_sm * sm,const u8 * bssid,const u8 * own_addr,const void * network_ctx)5863 int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid, const u8 *own_addr,
5864 const void *network_ctx)
5865 {
5866 return pmksa_cache_get(sm->pmksa, bssid, own_addr, NULL, network_ctx,
5867 0) != NULL;
5868 }
5869
5870
wpa_sm_pmksa_cache_get(struct wpa_sm * sm,const u8 * aa,const u8 * pmkid,const void * network_ctx,int akmp)5871 struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_get(struct wpa_sm *sm,
5872 const u8 *aa,
5873 const u8 *pmkid,
5874 const void *network_ctx,
5875 int akmp)
5876 {
5877 return pmksa_cache_get(sm->pmksa, aa, sm->own_addr, pmkid, network_ctx,
5878 akmp);
5879 }
5880
5881
wpa_sm_pmksa_get_pmk(struct wpa_sm * sm,const u8 * aa,const u8 ** pmk,size_t * pmk_len,const u8 ** pmkid)5882 int wpa_sm_pmksa_get_pmk(struct wpa_sm *sm, const u8 *aa, const u8 **pmk,
5883 size_t *pmk_len, const u8 **pmkid)
5884 {
5885 struct rsn_pmksa_cache_entry *pmksa;
5886
5887 pmksa = wpa_sm_pmksa_cache_get(sm, aa, NULL, NULL, 0);
5888 if (!pmksa) {
5889 wpa_printf(MSG_DEBUG, "RSN: Failed to get PMKSA for " MACSTR,
5890 MAC2STR(aa));
5891 return -1;
5892 }
5893
5894 *pmk = pmksa->pmk;
5895 *pmk_len = pmksa->pmk_len;
5896 *pmkid = pmksa->pmkid;
5897 return 0;
5898 }
5899
5900
wpa_sm_pmksa_cache_remove(struct wpa_sm * sm,struct rsn_pmksa_cache_entry * entry)5901 void wpa_sm_pmksa_cache_remove(struct wpa_sm *sm,
5902 struct rsn_pmksa_cache_entry *entry)
5903 {
5904 if (sm && sm->pmksa)
5905 pmksa_cache_remove(sm->pmksa, entry);
5906 }
5907
5908
wpa_sm_drop_sa(struct wpa_sm * sm)5909 void wpa_sm_drop_sa(struct wpa_sm *sm)
5910 {
5911 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
5912 wpa_sm_clear_ptk(sm);
5913 sm->pmk_len = 0;
5914 os_memset(sm->pmk, 0, sizeof(sm->pmk));
5915 #ifdef CONFIG_IEEE80211R
5916 os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
5917 sm->xxkey_len = 0;
5918 os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
5919 sm->pmk_r0_len = 0;
5920 os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
5921 sm->pmk_r1_len = 0;
5922 #ifdef CONFIG_PASN
5923 os_free(sm->pasn_r1kh);
5924 sm->pasn_r1kh = NULL;
5925 sm->n_pasn_r1kh = 0;
5926 #endif /* CONFIG_PASN */
5927 #endif /* CONFIG_IEEE80211R */
5928 }
5929
5930
5931 #ifdef CONFIG_IEEE80211R
wpa_sm_has_ft_keys(struct wpa_sm * sm,const u8 * md)5932 bool wpa_sm_has_ft_keys(struct wpa_sm *sm, const u8 *md)
5933 {
5934 if (!sm)
5935 return false;
5936 if (!wpa_key_mgmt_ft(sm->key_mgmt) ||
5937 os_memcmp(md, sm->key_mobility_domain,
5938 MOBILITY_DOMAIN_ID_LEN) != 0) {
5939 /* Do not allow FT protocol to be used even if we were to have
5940 * an PTK since the mobility domain has changed. */
5941 return false;
5942 }
5943 return sm->ptk_set;
5944 }
5945 #endif /* CONFIG_IEEE80211R */
5946
5947
wpa_sm_has_ptk_installed(struct wpa_sm * sm)5948 int wpa_sm_has_ptk_installed(struct wpa_sm *sm)
5949 {
5950 if (!sm)
5951 return 0;
5952 return sm->tk_set || sm->ptk.installed;
5953 }
5954
5955
wpa_sm_update_replay_ctr(struct wpa_sm * sm,const u8 * replay_ctr)5956 void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
5957 {
5958 os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
5959 }
5960
5961
wpa_sm_pmksa_cache_flush(struct wpa_sm * sm,void * network_ctx)5962 void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
5963 {
5964 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0, false, NULL);
5965 }
5966
5967
wpa_sm_pmksa_cache_flush_addr(struct wpa_sm * sm,void * network_ctx,const u8 * addr)5968 void wpa_sm_pmksa_cache_flush_addr(struct wpa_sm *sm, void *network_ctx,
5969 const u8 *addr)
5970 {
5971 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0, false, addr);
5972 }
5973
5974
wpa_sm_external_pmksa_cache_flush(struct wpa_sm * sm,void * network_ctx)5975 void wpa_sm_external_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
5976 {
5977 pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0, true, NULL);
5978 }
5979
5980
5981 #ifdef CONFIG_WNM
wpa_wnmsleep_install_key(struct wpa_sm * sm,u8 subelem_id,u8 * buf)5982 int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
5983 {
5984 u16 keyinfo;
5985 u8 keylen; /* plaintext key len */
5986 u8 *key_rsc;
5987
5988 if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
5989 struct wpa_gtk_data gd;
5990
5991 os_memset(&gd, 0, sizeof(gd));
5992 keylen = wpa_cipher_key_len(sm->group_cipher);
5993 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
5994 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
5995 if (gd.alg == WPA_ALG_NONE) {
5996 wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
5997 return -1;
5998 }
5999
6000 key_rsc = buf + 5;
6001 keyinfo = WPA_GET_LE16(buf + 2);
6002 gd.gtk_len = keylen;
6003 if (gd.gtk_len != buf[4]) {
6004 wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
6005 gd.gtk_len, buf[4]);
6006 return -1;
6007 }
6008 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
6009 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
6010 sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
6011
6012 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
6013
6014 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
6015 gd.gtk, gd.gtk_len);
6016 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
6017 forced_memzero(&gd, sizeof(gd));
6018 wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
6019 "WNM mode");
6020 return -1;
6021 }
6022 forced_memzero(&gd, sizeof(gd));
6023 } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
6024 const struct wpa_igtk_kde *igtk;
6025
6026 igtk = (const struct wpa_igtk_kde *) (buf + 2);
6027 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
6028 return -1;
6029 } else if (subelem_id == WNM_SLEEP_SUBELEM_BIGTK) {
6030 const struct wpa_bigtk_kde *bigtk;
6031
6032 bigtk = (const struct wpa_bigtk_kde *) (buf + 2);
6033 if (sm->beacon_prot &&
6034 wpa_supplicant_install_bigtk(sm, bigtk, 1) < 0)
6035 return -1;
6036 } else {
6037 wpa_printf(MSG_DEBUG, "Unknown element id");
6038 return -1;
6039 }
6040
6041 return 0;
6042 }
6043 #endif /* CONFIG_WNM */
6044
6045
6046 #ifdef CONFIG_P2P
6047
wpa_sm_get_p2p_ip_addr(struct wpa_sm * sm,u8 * buf)6048 int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
6049 {
6050 if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
6051 return -1;
6052 os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
6053 return 0;
6054 }
6055
6056 #endif /* CONFIG_P2P */
6057
6058
wpa_sm_set_rx_replay_ctr(struct wpa_sm * sm,const u8 * rx_replay_counter)6059 void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
6060 {
6061 if (rx_replay_counter == NULL)
6062 return;
6063
6064 os_memcpy(sm->rx_replay_counter, rx_replay_counter,
6065 WPA_REPLAY_COUNTER_LEN);
6066 sm->rx_replay_counter_set = 1;
6067 wpa_printf(MSG_DEBUG, "Updated key replay counter");
6068 }
6069
6070
wpa_sm_set_ptk_kck_kek(struct wpa_sm * sm,enum rsn_hash_alg hash,const u8 * ptk_kck,size_t ptk_kck_len,const u8 * ptk_kek,size_t ptk_kek_len)6071 void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm, enum rsn_hash_alg hash,
6072 const u8 *ptk_kck, size_t ptk_kck_len,
6073 const u8 *ptk_kek, size_t ptk_kek_len)
6074 {
6075 if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
6076 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
6077 sm->ptk.kck_len = ptk_kck_len;
6078 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
6079 }
6080 if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
6081 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
6082 sm->ptk.kek_len = ptk_kek_len;
6083 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
6084 }
6085 sm->ptk.hash_alg = hash;
6086 if (sm->hash_alg != hash) {
6087 wpa_printf(MSG_DEBUG,
6088 "Updated hash algorithm for PTKSA: %d -> %d",
6089 sm->hash_alg, hash);
6090 sm->hash_alg = hash;
6091 }
6092 sm->ptk_set = 1;
6093 }
6094
6095
6096 #ifdef CONFIG_TESTING_OPTIONS
6097
wpa_sm_set_ptk_tk(struct wpa_sm * sm,const u8 * ptk_tk,size_t ptk_tk_len)6098 void wpa_sm_set_ptk_tk(struct wpa_sm *sm, const u8 *ptk_tk, size_t ptk_tk_len)
6099 {
6100 if (ptk_tk && ptk_tk_len <= WPA_TK_MAX_LEN) {
6101 os_memcpy(sm->ptk.tk, ptk_tk, ptk_tk_len);
6102 sm->ptk.tk_len = ptk_tk_len;
6103 wpa_printf(MSG_DEBUG, "Updated PTK TK");
6104 }
6105 }
6106
6107
wpa_sm_set_test_assoc_ie(struct wpa_sm * sm,struct wpabuf * buf)6108 void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
6109 {
6110 wpabuf_free(sm->test_assoc_ie);
6111 sm->test_assoc_ie = buf;
6112 }
6113
6114
wpa_sm_set_test_eapol_m2_elems(struct wpa_sm * sm,struct wpabuf * buf)6115 void wpa_sm_set_test_eapol_m2_elems(struct wpa_sm *sm, struct wpabuf *buf)
6116 {
6117 wpabuf_free(sm->test_eapol_m2_elems);
6118 sm->test_eapol_m2_elems = buf;
6119 }
6120
6121
wpa_sm_set_test_eapol_m4_elems(struct wpa_sm * sm,struct wpabuf * buf)6122 void wpa_sm_set_test_eapol_m4_elems(struct wpa_sm *sm, struct wpabuf *buf)
6123 {
6124 wpabuf_free(sm->test_eapol_m4_elems);
6125 sm->test_eapol_m4_elems = buf;
6126 }
6127
6128
wpa_sm_get_anonce(struct wpa_sm * sm)6129 const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
6130 {
6131 return sm->anonce;
6132 }
6133
6134 #endif /* CONFIG_TESTING_OPTIONS */
6135
6136
wpa_sm_get_key_mgmt(struct wpa_sm * sm)6137 unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
6138 {
6139 return sm->key_mgmt;
6140 }
6141
6142
wpa_sm_get_auth_addr(struct wpa_sm * sm)6143 const u8 * wpa_sm_get_auth_addr(struct wpa_sm *sm)
6144 {
6145 return sm->mlo.valid_links ? sm->mlo.ap_mld_addr : sm->bssid;
6146 }
6147
6148
6149 #ifdef CONFIG_FILS
6150
fils_build_auth(struct wpa_sm * sm,int dh_group,const u8 * md)6151 struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
6152 {
6153 struct wpabuf *buf = NULL;
6154 struct wpabuf *erp_msg;
6155 struct wpabuf *pub = NULL;
6156
6157 erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
6158 if (!erp_msg && !sm->cur_pmksa) {
6159 wpa_printf(MSG_DEBUG,
6160 "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
6161 goto fail;
6162 }
6163
6164 wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
6165 erp_msg != NULL, sm->cur_pmksa != NULL);
6166
6167 sm->fils_completed = 0;
6168
6169 if (!sm->assoc_wpa_ie) {
6170 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
6171 goto fail;
6172 }
6173
6174 if (random_get_bytes(sm->fils_nonce, NONCE_LEN) < 0 ||
6175 random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
6176 goto fail;
6177
6178 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
6179 sm->fils_nonce, NONCE_LEN);
6180 wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
6181 sm->fils_session, FILS_SESSION_LEN);
6182
6183 #ifdef CONFIG_FILS_SK_PFS
6184 sm->fils_dh_group = dh_group;
6185 if (dh_group) {
6186 crypto_ecdh_deinit(sm->fils_ecdh);
6187 sm->fils_ecdh = crypto_ecdh_init(dh_group);
6188 if (!sm->fils_ecdh) {
6189 wpa_printf(MSG_INFO,
6190 "FILS: Could not initialize ECDH with group %d",
6191 dh_group);
6192 goto fail;
6193 }
6194 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
6195 if (!pub)
6196 goto fail;
6197 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
6198 pub);
6199 sm->fils_dh_elem_len = wpabuf_len(pub);
6200 }
6201 #endif /* CONFIG_FILS_SK_PFS */
6202
6203 buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
6204 (pub ? wpabuf_len(pub) : 0));
6205 if (!buf)
6206 goto fail;
6207
6208 /* Fields following the Authentication algorithm number field */
6209
6210 /* Authentication Transaction seq# */
6211 wpabuf_put_le16(buf, 1);
6212
6213 /* Status Code */
6214 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
6215
6216 /* TODO: FILS PK */
6217 #ifdef CONFIG_FILS_SK_PFS
6218 if (dh_group) {
6219 /* Finite Cyclic Group */
6220 wpabuf_put_le16(buf, dh_group);
6221 /* Element */
6222 wpabuf_put_buf(buf, pub);
6223 }
6224 #endif /* CONFIG_FILS_SK_PFS */
6225
6226 /* RSNE */
6227 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
6228 sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
6229 wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
6230
6231 if (md) {
6232 /* MDE when using FILS for FT initial association */
6233 struct rsn_mdie *mdie;
6234
6235 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
6236 wpabuf_put_u8(buf, sizeof(*mdie));
6237 mdie = wpabuf_put(buf, sizeof(*mdie));
6238 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
6239 mdie->ft_capab = 0;
6240 }
6241
6242 /* FILS Nonce */
6243 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6244 wpabuf_put_u8(buf, 1 + NONCE_LEN); /* Length */
6245 /* Element ID Extension */
6246 wpabuf_put_u8(buf, WLAN_EID_EXT_NONCE);
6247 wpabuf_put_data(buf, sm->fils_nonce, NONCE_LEN);
6248
6249 /* FILS Session */
6250 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6251 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
6252 /* Element ID Extension */
6253 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
6254 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
6255
6256 /* Wrapped Data */
6257 sm->fils_erp_pmkid_set = 0;
6258 if (erp_msg) {
6259 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6260 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
6261 /* Element ID Extension */
6262 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
6263 wpabuf_put_buf(buf, erp_msg);
6264 /* Calculate pending PMKID here so that we do not need to
6265 * maintain a copy of the EAP-Initiate/Reauth message. */
6266 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
6267 wpabuf_len(erp_msg),
6268 sm->fils_erp_pmkid) == 0)
6269 sm->fils_erp_pmkid_set = 1;
6270 }
6271
6272 wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
6273 buf);
6274
6275 fail:
6276 wpabuf_free(erp_msg);
6277 wpabuf_free(pub);
6278 return buf;
6279 }
6280
6281
fils_process_auth(struct wpa_sm * sm,const u8 * bssid,const u8 * data,size_t len)6282 int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
6283 size_t len)
6284 {
6285 const u8 *pos, *end;
6286 struct ieee802_11_elems elems;
6287 struct wpa_ie_data rsn;
6288 int pmkid_match = 0;
6289 u8 ick[FILS_ICK_MAX_LEN];
6290 size_t ick_len;
6291 int res;
6292 struct wpabuf *dh_ss = NULL;
6293 const u8 *g_sta = NULL;
6294 size_t g_sta_len = 0;
6295 const u8 *g_ap = NULL;
6296 size_t g_ap_len = 0, kdk_len;
6297 struct wpabuf *pub = NULL;
6298 #ifdef CONFIG_IEEE80211R
6299 struct wpa_ft_ies parse;
6300
6301 os_memset(&parse, 0, sizeof(parse));
6302 #endif /* CONFIG_IEEE80211R */
6303
6304 os_memcpy(sm->bssid, bssid, ETH_ALEN);
6305
6306 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
6307 data, len);
6308 pos = data;
6309 end = data + len;
6310
6311 /* TODO: FILS PK */
6312 #ifdef CONFIG_FILS_SK_PFS
6313 if (sm->fils_dh_group) {
6314 u16 group;
6315
6316 /* Using FILS PFS */
6317
6318 /* Finite Cyclic Group */
6319 if (end - pos < 2) {
6320 wpa_printf(MSG_DEBUG,
6321 "FILS: No room for Finite Cyclic Group");
6322 goto fail;
6323 }
6324 group = WPA_GET_LE16(pos);
6325 pos += 2;
6326 if (group != sm->fils_dh_group) {
6327 wpa_printf(MSG_DEBUG,
6328 "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
6329 group, sm->fils_dh_group);
6330 goto fail;
6331 }
6332
6333 /* Element */
6334 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
6335 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
6336 goto fail;
6337 }
6338
6339 if (!sm->fils_ecdh) {
6340 wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
6341 goto fail;
6342 }
6343 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
6344 sm->fils_dh_elem_len);
6345 if (!dh_ss) {
6346 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
6347 goto fail;
6348 }
6349 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
6350 g_ap = pos;
6351 g_ap_len = sm->fils_dh_elem_len;
6352 pos += sm->fils_dh_elem_len;
6353 }
6354 #endif /* CONFIG_FILS_SK_PFS */
6355
6356 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
6357 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
6358 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
6359 goto fail;
6360 }
6361
6362 /* RSNE */
6363 wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
6364 elems.rsn_ie_len);
6365 if (!elems.rsn_ie ||
6366 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
6367 &rsn) < 0) {
6368 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
6369 goto fail;
6370 }
6371
6372 if (!elems.nonce) {
6373 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
6374 goto fail;
6375 }
6376 os_memcpy(sm->fils_anonce, elems.nonce, NONCE_LEN);
6377 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, NONCE_LEN);
6378
6379 #ifdef CONFIG_IEEE80211R
6380 if (wpa_key_mgmt_ft(sm->key_mgmt)) {
6381 if (!elems.mdie || !elems.ftie) {
6382 wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
6383 goto fail;
6384 }
6385
6386 if (wpa_ft_parse_ies(pos, end - pos, &parse,
6387 sm->key_mgmt, false) < 0) {
6388 wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
6389 goto fail;
6390 }
6391
6392 if (!parse.r0kh_id) {
6393 wpa_printf(MSG_DEBUG,
6394 "FILS+FT: No R0KH-ID subelem in FTE");
6395 goto fail;
6396 }
6397 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
6398 sm->r0kh_id_len = parse.r0kh_id_len;
6399 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
6400 sm->r0kh_id, sm->r0kh_id_len);
6401
6402 if (!parse.r1kh_id) {
6403 wpa_printf(MSG_DEBUG,
6404 "FILS+FT: No R1KH-ID subelem in FTE");
6405 goto fail;
6406 }
6407 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
6408 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
6409 sm->r1kh_id, FT_R1KH_ID_LEN);
6410
6411 /* TODO: Check MDE and FTE payload */
6412
6413 wpabuf_free(sm->fils_ft_ies);
6414 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
6415 2 + elems.ftie_len);
6416 if (!sm->fils_ft_ies)
6417 goto fail;
6418 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
6419 2 + elems.mdie_len);
6420 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
6421 2 + elems.ftie_len);
6422 } else {
6423 wpabuf_free(sm->fils_ft_ies);
6424 sm->fils_ft_ies = NULL;
6425 }
6426 #endif /* CONFIG_IEEE80211R */
6427
6428 /* PMKID List */
6429 if (rsn.pmkid && rsn.num_pmkid > 0) {
6430 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
6431 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
6432
6433 if (rsn.num_pmkid != 1) {
6434 wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
6435 goto fail;
6436 }
6437 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
6438 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
6439 {
6440 wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
6441 wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
6442 sm->cur_pmksa->pmkid, PMKID_LEN);
6443 goto fail;
6444 }
6445 wpa_printf(MSG_DEBUG,
6446 "FILS: Matching PMKID - continue using PMKSA caching");
6447 pmkid_match = 1;
6448 }
6449 if (!pmkid_match && sm->cur_pmksa) {
6450 wpa_printf(MSG_DEBUG,
6451 "FILS: No PMKID match - cannot use cached PMKSA entry");
6452 sm->cur_pmksa = NULL;
6453 }
6454
6455 /* FILS Session */
6456 if (!elems.fils_session) {
6457 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
6458 goto fail;
6459 }
6460 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
6461 FILS_SESSION_LEN);
6462 if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
6463 != 0) {
6464 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
6465 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
6466 sm->fils_session, FILS_SESSION_LEN);
6467 goto fail;
6468 }
6469
6470 /* Wrapped Data */
6471 if (!sm->cur_pmksa && elems.wrapped_data) {
6472 u8 rmsk[ERP_MAX_KEY_LEN];
6473 size_t rmsk_len;
6474
6475 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
6476 elems.wrapped_data,
6477 elems.wrapped_data_len);
6478 eapol_sm_process_erp_finish(sm->eapol, elems.wrapped_data,
6479 elems.wrapped_data_len);
6480 if (eapol_sm_failed(sm->eapol))
6481 goto fail;
6482
6483 rmsk_len = ERP_MAX_KEY_LEN;
6484 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
6485 if (res == PMK_LEN) {
6486 rmsk_len = PMK_LEN;
6487 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
6488 }
6489 if (res)
6490 goto fail;
6491
6492 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
6493 sm->fils_nonce, sm->fils_anonce,
6494 dh_ss ? wpabuf_head(dh_ss) : NULL,
6495 dh_ss ? wpabuf_len(dh_ss) : 0,
6496 sm->pmk, &sm->pmk_len);
6497 forced_memzero(rmsk, sizeof(rmsk));
6498
6499 /* Don't use DHss in PTK derivation if PMKSA caching is not
6500 * used. */
6501 wpabuf_clear_free(dh_ss);
6502 dh_ss = NULL;
6503
6504 if (res)
6505 goto fail;
6506
6507 if (!sm->fils_erp_pmkid_set) {
6508 wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
6509 goto fail;
6510 }
6511 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
6512 PMKID_LEN);
6513 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
6514 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
6515 sm->fils_erp_pmkid, NULL, 0,
6516 sm->bssid, sm->own_addr,
6517 sm->network_ctx, sm->key_mgmt,
6518 NULL, 0);
6519 }
6520
6521 if (!sm->cur_pmksa) {
6522 wpa_printf(MSG_DEBUG,
6523 "FILS: No remaining options to continue FILS authentication");
6524 goto fail;
6525 }
6526
6527 if (sm->force_kdk_derivation ||
6528 (sm->secure_ltf &&
6529 ieee802_11_rsnx_capab(sm->ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF)))
6530 kdk_len = WPA_KDK_MAX_LEN;
6531 else
6532 kdk_len = 0;
6533
6534 if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr,
6535 wpa_sm_get_auth_addr(sm),
6536 sm->fils_nonce, sm->fils_anonce,
6537 dh_ss ? wpabuf_head(dh_ss) : NULL,
6538 dh_ss ? wpabuf_len(dh_ss) : 0,
6539 &sm->ptk, ick, &ick_len,
6540 sm->key_mgmt, sm->pairwise_cipher,
6541 sm->fils_ft, &sm->fils_ft_len,
6542 kdk_len) < 0) {
6543 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
6544 goto fail;
6545 }
6546
6547 #ifdef CONFIG_PASN
6548 if (sm->secure_ltf &&
6549 ieee802_11_rsnx_capab(sm->ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF) &&
6550 wpa_ltf_keyseed(&sm->ptk, sm->key_mgmt, sm->pairwise_cipher)) {
6551 wpa_printf(MSG_DEBUG, "FILS: Failed to derive LTF keyseed");
6552 goto fail;
6553 }
6554 #endif /* CONFIG_PASN */
6555
6556 wpabuf_clear_free(dh_ss);
6557 dh_ss = NULL;
6558
6559 sm->ptk_set = 1;
6560 sm->tptk_set = 0;
6561 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
6562
6563 #ifdef CONFIG_FILS_SK_PFS
6564 if (sm->fils_dh_group) {
6565 if (!sm->fils_ecdh) {
6566 wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
6567 goto fail;
6568 }
6569 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
6570 if (!pub)
6571 goto fail;
6572 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
6573 g_sta = wpabuf_head(pub);
6574 g_sta_len = wpabuf_len(pub);
6575 if (!g_ap) {
6576 wpa_printf(MSG_INFO, "FILS: gAP not available");
6577 goto fail;
6578 }
6579 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
6580 }
6581 #endif /* CONFIG_FILS_SK_PFS */
6582
6583 res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
6584 sm->fils_anonce, sm->own_addr, sm->bssid,
6585 g_sta, g_sta_len, g_ap, g_ap_len,
6586 sm->key_mgmt, sm->fils_key_auth_sta,
6587 sm->fils_key_auth_ap,
6588 &sm->fils_key_auth_len);
6589 wpabuf_free(pub);
6590 forced_memzero(ick, sizeof(ick));
6591 #ifdef CONFIG_IEEE80211R
6592 wpa_ft_parse_ies_free(&parse);
6593 #endif /* CONFIG_IEEE80211R */
6594 return res;
6595 fail:
6596 wpabuf_free(pub);
6597 wpabuf_clear_free(dh_ss);
6598 #ifdef CONFIG_IEEE80211R
6599 wpa_ft_parse_ies_free(&parse);
6600 #endif /* CONFIG_IEEE80211R */
6601 return -1;
6602 }
6603
6604
6605 #ifdef CONFIG_IEEE80211R
fils_ft_build_assoc_req_rsne(struct wpa_sm * sm,struct wpabuf * buf)6606 static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
6607 {
6608 struct rsn_ie_hdr *rsnie;
6609 u16 capab;
6610 u8 *pos;
6611 int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
6612
6613 /* RSNIE[PMKR0Name/PMKR1Name] */
6614 rsnie = wpabuf_put(buf, sizeof(*rsnie));
6615 rsnie->elem_id = WLAN_EID_RSN;
6616 WPA_PUT_LE16(rsnie->version, RSN_VERSION);
6617
6618 /* Group Suite Selector */
6619 if (!wpa_cipher_valid_group(sm->group_cipher)) {
6620 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
6621 sm->group_cipher);
6622 return -1;
6623 }
6624 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
6625 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
6626 sm->group_cipher));
6627
6628 /* Pairwise Suite Count */
6629 wpabuf_put_le16(buf, 1);
6630
6631 /* Pairwise Suite List */
6632 if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
6633 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
6634 sm->pairwise_cipher);
6635 return -1;
6636 }
6637 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
6638 RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
6639 sm->pairwise_cipher));
6640
6641 /* Authenticated Key Management Suite Count */
6642 wpabuf_put_le16(buf, 1);
6643
6644 /* Authenticated Key Management Suite List */
6645 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
6646 if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
6647 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
6648 else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
6649 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
6650 else {
6651 wpa_printf(MSG_WARNING,
6652 "FILS+FT: Invalid key management type (%d)",
6653 sm->key_mgmt);
6654 return -1;
6655 }
6656
6657 /* RSN Capabilities */
6658 capab = 0;
6659 if (sm->mfp)
6660 capab |= WPA_CAPABILITY_MFPC;
6661 if (sm->mfp == 2)
6662 capab |= WPA_CAPABILITY_MFPR;
6663 if (sm->ocv)
6664 capab |= WPA_CAPABILITY_OCVC;
6665 if (sm->ext_key_id)
6666 capab |= WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST;
6667 wpabuf_put_le16(buf, capab);
6668
6669 /* PMKID Count */
6670 wpabuf_put_le16(buf, 1);
6671
6672 /* PMKID List [PMKR1Name] */
6673 wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
6674 sm->fils_ft, sm->fils_ft_len);
6675 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
6676 wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
6677 sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
6678 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
6679 sm->r0kh_id, sm->r0kh_id_len);
6680 if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
6681 sm->ssid_len, sm->mobility_domain,
6682 sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
6683 sm->pmk_r0, sm->pmk_r0_name, sm->key_mgmt) < 0) {
6684 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
6685 return -1;
6686 }
6687 if (wpa_key_mgmt_sae_ext_key(sm->key_mgmt))
6688 sm->pmk_r0_len = sm->fils_ft_len;
6689 else
6690 sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
6691 wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
6692 MAC2STR(sm->r1kh_id));
6693 pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
6694 if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
6695 sm->pmk_r1_name, sm->fils_ft_len) < 0) {
6696 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
6697 return -1;
6698 }
6699 os_memcpy(pos, sm->pmk_r1_name, WPA_PMK_NAME_LEN);
6700
6701 os_memcpy(sm->key_mobility_domain, sm->mobility_domain,
6702 MOBILITY_DOMAIN_ID_LEN);
6703
6704 if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
6705 /* Management Group Cipher Suite */
6706 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
6707 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
6708 }
6709
6710 rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
6711 return 0;
6712 }
6713 #endif /* CONFIG_IEEE80211R */
6714
6715
fils_build_assoc_req(struct wpa_sm * sm,const u8 ** kek,size_t * kek_len,const u8 ** snonce,const u8 ** anonce,const struct wpabuf ** hlp,unsigned int num_hlp)6716 struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
6717 size_t *kek_len, const u8 **snonce,
6718 const u8 **anonce,
6719 const struct wpabuf **hlp,
6720 unsigned int num_hlp)
6721 {
6722 struct wpabuf *buf;
6723 size_t len;
6724 unsigned int i;
6725
6726 len = 1000;
6727 #ifdef CONFIG_IEEE80211R
6728 if (sm->fils_ft_ies)
6729 len += wpabuf_len(sm->fils_ft_ies);
6730 if (wpa_key_mgmt_ft(sm->key_mgmt))
6731 len += 256;
6732 #endif /* CONFIG_IEEE80211R */
6733 for (i = 0; hlp && i < num_hlp; i++)
6734 len += 10 + wpabuf_len(hlp[i]);
6735 buf = wpabuf_alloc(len);
6736 if (!buf)
6737 return NULL;
6738
6739 #ifdef CONFIG_IEEE80211R
6740 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
6741 /* MDE and FTE when using FILS+FT */
6742 wpabuf_put_buf(buf, sm->fils_ft_ies);
6743 /* RSNE with PMKR1Name in PMKID field */
6744 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
6745 wpabuf_free(buf);
6746 return NULL;
6747 }
6748 }
6749 #endif /* CONFIG_IEEE80211R */
6750
6751 /* FILS Session */
6752 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6753 wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
6754 /* Element ID Extension */
6755 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
6756 wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
6757
6758 /* Everything after FILS Session element gets encrypted in the driver
6759 * with KEK. The buffer returned from here is the plaintext version. */
6760
6761 /* TODO: FILS Public Key */
6762
6763 /* FILS Key Confirm */
6764 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6765 wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
6766 /* Element ID Extension */
6767 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
6768 wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
6769
6770 /* FILS HLP Container */
6771 for (i = 0; hlp && i < num_hlp; i++) {
6772 const u8 *pos = wpabuf_head(hlp[i]);
6773 size_t left = wpabuf_len(hlp[i]);
6774
6775 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
6776 if (left <= 254)
6777 len = 1 + left;
6778 else
6779 len = 255;
6780 wpabuf_put_u8(buf, len); /* Length */
6781 /* Element ID Extension */
6782 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
6783 /* Destination MAC Address, Source MAC Address, HLP Packet.
6784 * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
6785 * header when LPD is used). */
6786 wpabuf_put_data(buf, pos, len - 1);
6787 pos += len - 1;
6788 left -= len - 1;
6789 while (left) {
6790 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
6791 len = left > 255 ? 255 : left;
6792 wpabuf_put_u8(buf, len);
6793 wpabuf_put_data(buf, pos, len);
6794 pos += len;
6795 left -= len;
6796 }
6797 }
6798
6799 /* TODO: FILS IP Address Assignment */
6800
6801 #ifdef CONFIG_OCV
6802 if (wpa_sm_ocv_enabled(sm)) {
6803 struct wpa_channel_info ci;
6804 u8 *pos;
6805
6806 if (wpa_sm_channel_info(sm, &ci) != 0) {
6807 wpa_printf(MSG_WARNING,
6808 "FILS: Failed to get channel info for OCI element");
6809 wpabuf_free(buf);
6810 return NULL;
6811 }
6812 #ifdef CONFIG_TESTING_OPTIONS
6813 if (sm->oci_freq_override_fils_assoc) {
6814 wpa_printf(MSG_INFO,
6815 "TEST: Override OCI KDE frequency %d -> %d MHz",
6816 ci.frequency,
6817 sm->oci_freq_override_fils_assoc);
6818 ci.frequency = sm->oci_freq_override_fils_assoc;
6819 }
6820 #endif /* CONFIG_TESTING_OPTIONS */
6821
6822 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
6823 if (ocv_insert_extended_oci(&ci, pos) < 0) {
6824 wpabuf_free(buf);
6825 return NULL;
6826 }
6827 }
6828 #endif /* CONFIG_OCV */
6829
6830 wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
6831
6832 *kek = sm->ptk.kek;
6833 *kek_len = sm->ptk.kek_len;
6834 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
6835 *snonce = sm->fils_nonce;
6836 wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD", *snonce, NONCE_LEN);
6837 *anonce = sm->fils_anonce;
6838 wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD", *anonce, NONCE_LEN);
6839
6840 return buf;
6841 }
6842
6843
fils_process_hlp_resp(struct wpa_sm * sm,const u8 * resp,size_t len)6844 static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
6845 {
6846 const u8 *pos, *end;
6847
6848 wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
6849 if (len < 2 * ETH_ALEN)
6850 return;
6851 pos = resp + 2 * ETH_ALEN;
6852 end = resp + len;
6853 if (end - pos >= 6 &&
6854 os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
6855 pos += 6; /* Remove SNAP/LLC header */
6856 wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
6857 }
6858
6859
fils_process_hlp_container(struct wpa_sm * sm,const u8 * pos,size_t len)6860 static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
6861 size_t len)
6862 {
6863 const u8 *end = pos + len;
6864 u8 *tmp, *tmp_pos;
6865
6866 /* Check if there are any FILS HLP Container elements */
6867 while (end - pos >= 2) {
6868 if (2 + pos[1] > end - pos)
6869 return;
6870 if (pos[0] == WLAN_EID_EXTENSION &&
6871 pos[1] >= 1 + 2 * ETH_ALEN &&
6872 pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
6873 break;
6874 pos += 2 + pos[1];
6875 }
6876 if (end - pos < 2)
6877 return; /* No FILS HLP Container elements */
6878
6879 tmp = os_malloc(end - pos);
6880 if (!tmp)
6881 return;
6882
6883 while (end - pos >= 2) {
6884 if (2 + pos[1] > end - pos ||
6885 pos[0] != WLAN_EID_EXTENSION ||
6886 pos[1] < 1 + 2 * ETH_ALEN ||
6887 pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
6888 break;
6889 tmp_pos = tmp;
6890 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
6891 tmp_pos += pos[1] - 1;
6892 pos += 2 + pos[1];
6893
6894 /* Add possible fragments */
6895 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
6896 2 + pos[1] <= end - pos) {
6897 os_memcpy(tmp_pos, pos + 2, pos[1]);
6898 tmp_pos += pos[1];
6899 pos += 2 + pos[1];
6900 }
6901
6902 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
6903 }
6904
6905 os_free(tmp);
6906 }
6907
6908
fils_process_assoc_resp(struct wpa_sm * sm,const u8 * resp,size_t len)6909 int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
6910 {
6911 const struct ieee80211_mgmt *mgmt;
6912 const u8 *end, *ie_start;
6913 struct ieee802_11_elems elems;
6914 int keylen, rsclen;
6915 enum wpa_alg alg;
6916 struct wpa_gtk_data gd;
6917 int maxkeylen;
6918 struct wpa_eapol_ie_parse kde;
6919
6920 if (!sm || !sm->ptk_set) {
6921 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
6922 return -1;
6923 }
6924
6925 if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
6926 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
6927 return -1;
6928 }
6929
6930 if (sm->fils_completed) {
6931 wpa_printf(MSG_DEBUG,
6932 "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
6933 return -1;
6934 }
6935
6936 wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
6937 resp, len);
6938
6939 mgmt = (const struct ieee80211_mgmt *) resp;
6940 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
6941 return -1;
6942
6943 end = resp + len;
6944 /* Same offset for Association Response and Reassociation Response */
6945 ie_start = mgmt->u.assoc_resp.variable;
6946
6947 if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
6948 ParseFailed) {
6949 wpa_printf(MSG_DEBUG,
6950 "FILS: Failed to parse decrypted elements");
6951 goto fail;
6952 }
6953
6954 if (!elems.fils_session) {
6955 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
6956 return -1;
6957 }
6958 if (os_memcmp(elems.fils_session, sm->fils_session,
6959 FILS_SESSION_LEN) != 0) {
6960 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
6961 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
6962 elems.fils_session, FILS_SESSION_LEN);
6963 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
6964 sm->fils_session, FILS_SESSION_LEN);
6965 }
6966
6967 if (!elems.rsn_ie) {
6968 wpa_printf(MSG_DEBUG,
6969 "FILS: No RSNE in (Re)Association Response");
6970 /* As an interop workaround, allow this for now since IEEE Std
6971 * 802.11ai-2016 did not include all the needed changes to make
6972 * a FILS AP include RSNE in the frame. This workaround might
6973 * eventually be removed and replaced with rejection (goto fail)
6974 * to follow a strict interpretation of the standard. */
6975 } else if (wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
6976 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
6977 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
6978 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
6979 "FILS: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
6980 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in Beacon/Probe Response",
6981 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
6982 wpa_hexdump(MSG_DEBUG, "FILS: RSNE in (Re)Association Response",
6983 elems.rsn_ie, elems.rsn_ie_len);
6984 goto fail;
6985 }
6986
6987 if ((sm->ap_rsnxe && !elems.rsnxe) ||
6988 (!sm->ap_rsnxe && elems.rsnxe) ||
6989 (sm->ap_rsnxe && elems.rsnxe && sm->ap_rsnxe_len >= 2 &&
6990 (sm->ap_rsnxe_len != 2U + elems.rsnxe_len ||
6991 os_memcmp(sm->ap_rsnxe + 2, elems.rsnxe, sm->ap_rsnxe_len - 2) !=
6992 0))) {
6993 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
6994 "FILS: RSNXE mismatch between Beacon/Probe Response and (Re)Association Response");
6995 wpa_hexdump(MSG_INFO, "FILS: RSNXE in Beacon/Probe Response",
6996 sm->ap_rsnxe, sm->ap_rsnxe_len);
6997 wpa_hexdump(MSG_INFO, "RSNXE in (Re)Association Response",
6998 elems.rsnxe, elems.rsnxe_len);
6999 /* As an interop workaround, allow this for now if we did not
7000 * include the RSNXE in (Re)Association Request frame since
7001 * IEEE Std 802.11-2020 does not say anything about verifying
7002 * the RSNXE in FILS cases and there have been hostapd releases
7003 * that might omit the RSNXE in cases where the STA did not
7004 * include it in the Association Request frame. This workaround
7005 * might eventually be removed. */
7006 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len)
7007 goto fail;
7008 }
7009
7010 /* TODO: FILS Public Key */
7011
7012 if (!elems.fils_key_confirm) {
7013 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
7014 goto fail;
7015 }
7016 if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
7017 wpa_printf(MSG_DEBUG,
7018 "FILS: Unexpected Key-Auth length %d (expected %d)",
7019 elems.fils_key_confirm_len,
7020 (int) sm->fils_key_auth_len);
7021 goto fail;
7022 }
7023 if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
7024 sm->fils_key_auth_len) != 0) {
7025 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
7026 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
7027 elems.fils_key_confirm,
7028 elems.fils_key_confirm_len);
7029 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
7030 sm->fils_key_auth_ap, sm->fils_key_auth_len);
7031 goto fail;
7032 }
7033
7034 #ifdef CONFIG_OCV
7035 if (wpa_sm_ocv_enabled(sm)) {
7036 struct wpa_channel_info ci;
7037
7038 if (wpa_sm_channel_info(sm, &ci) != 0) {
7039 wpa_printf(MSG_WARNING,
7040 "Failed to get channel info to validate received OCI in FILS (Re)Association Response frame");
7041 goto fail;
7042 }
7043
7044 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
7045 channel_width_to_int(ci.chanwidth),
7046 ci.seg1_idx) != OCI_SUCCESS) {
7047 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, OCV_FAILURE
7048 "addr=" MACSTR " frame=fils-assoc error=%s",
7049 MAC2STR(sm->bssid), ocv_errorstr);
7050 goto fail;
7051 }
7052 }
7053 #endif /* CONFIG_OCV */
7054
7055 #ifdef CONFIG_IEEE80211R
7056 if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
7057 struct wpa_ie_data rsn;
7058
7059 /* Check that PMKR1Name derived by the AP matches */
7060 if (!elems.rsn_ie ||
7061 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
7062 &rsn) < 0 ||
7063 !rsn.pmkid || rsn.num_pmkid != 1 ||
7064 os_memcmp(rsn.pmkid, sm->pmk_r1_name,
7065 WPA_PMK_NAME_LEN) != 0) {
7066 wpa_printf(MSG_DEBUG,
7067 "FILS+FT: No RSNE[PMKR1Name] match in AssocResp");
7068 goto fail;
7069 }
7070 }
7071 #endif /* CONFIG_IEEE80211R */
7072
7073 /* Key Delivery */
7074 if (!elems.key_delivery) {
7075 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
7076 goto fail;
7077 }
7078
7079 /* Parse GTK and set the key to the driver */
7080 os_memset(&gd, 0, sizeof(gd));
7081 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
7082 elems.key_delivery_len - WPA_KEY_RSC_LEN,
7083 &kde) < 0) {
7084 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
7085 goto fail;
7086 }
7087 if (!kde.gtk) {
7088 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
7089 goto fail;
7090 }
7091 maxkeylen = gd.gtk_len = kde.gtk_len - 2;
7092 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
7093 gd.gtk_len, maxkeylen,
7094 &gd.key_rsc_len, &gd.alg))
7095 goto fail;
7096
7097 wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
7098 gd.keyidx = kde.gtk[0] & 0x3;
7099 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
7100 !!(kde.gtk[0] & BIT(2)));
7101 if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
7102 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
7103 (unsigned long) kde.gtk_len - 2);
7104 goto fail;
7105 }
7106 os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
7107
7108 wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
7109 if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
7110 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
7111 goto fail;
7112 }
7113
7114 if (ieee80211w_set_keys(sm, &kde) < 0) {
7115 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
7116 goto fail;
7117 }
7118
7119 alg = wpa_cipher_to_alg(sm->pairwise_cipher);
7120 keylen = wpa_cipher_key_len(sm->pairwise_cipher);
7121 if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
7122 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
7123 keylen, (long unsigned int) sm->ptk.tk_len);
7124 goto fail;
7125 }
7126
7127 rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
7128 wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
7129 sm->ptk.tk, keylen);
7130 if (wpa_sm_set_key(sm, -1, alg, wpa_sm_get_auth_addr(sm), 0, 1,
7131 null_rsc, rsclen,
7132 sm->ptk.tk, keylen, KEY_FLAG_PAIRWISE_RX_TX) < 0) {
7133 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
7134 "FILS: Failed to set PTK to the driver (alg=%d keylen=%d auth_addr="
7135 MACSTR ")",
7136 alg, keylen, MAC2STR(wpa_sm_get_auth_addr(sm)));
7137 goto fail;
7138 }
7139
7140 wpa_sm_store_ptk(sm, wpa_sm_get_auth_addr(sm), sm->pairwise_cipher,
7141 sm->dot11RSNAConfigPMKLifetime, &sm->ptk);
7142
7143 /* TODO: TK could be cleared after auth frame exchange now that driver
7144 * takes care of association frame encryption/decryption. */
7145 /* TK is not needed anymore in supplicant */
7146 os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
7147 sm->ptk.tk_len = 0;
7148 sm->ptk.installed = 1;
7149 sm->tk_set = true;
7150
7151 /* FILS HLP Container */
7152 fils_process_hlp_container(sm, ie_start, end - ie_start);
7153
7154 /* TODO: FILS IP Address Assignment */
7155
7156 wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
7157 sm->fils_completed = 1;
7158 forced_memzero(&gd, sizeof(gd));
7159
7160 if (kde.transition_disable)
7161 wpa_sm_transition_disable(sm, kde.transition_disable[0]);
7162
7163 return 0;
7164 fail:
7165 forced_memzero(&gd, sizeof(gd));
7166 return -1;
7167 }
7168
7169
wpa_sm_set_reset_fils_completed(struct wpa_sm * sm,int set)7170 void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
7171 {
7172 if (sm)
7173 sm->fils_completed = !!set;
7174 }
7175
7176 #endif /* CONFIG_FILS */
7177
7178
wpa_fils_is_completed(struct wpa_sm * sm)7179 int wpa_fils_is_completed(struct wpa_sm *sm)
7180 {
7181 #ifdef CONFIG_FILS
7182 return sm && sm->fils_completed;
7183 #else /* CONFIG_FILS */
7184 return 0;
7185 #endif /* CONFIG_FILS */
7186 }
7187
7188
7189 #ifdef CONFIG_OWE
7190
owe_build_assoc_req(struct wpa_sm * sm,u16 group)7191 struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
7192 {
7193 struct wpabuf *ie = NULL, *pub = NULL;
7194 size_t prime_len;
7195
7196 if (group == 19)
7197 prime_len = 32;
7198 else if (group == 20)
7199 prime_len = 48;
7200 else if (group == 21)
7201 prime_len = 66;
7202 else
7203 return NULL;
7204
7205 crypto_ecdh_deinit(sm->owe_ecdh);
7206 sm->owe_ecdh = crypto_ecdh_init(group);
7207 if (!sm->owe_ecdh)
7208 goto fail;
7209 sm->owe_group = group;
7210 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
7211 pub = wpabuf_zeropad(pub, prime_len);
7212 if (!pub)
7213 goto fail;
7214
7215 ie = wpabuf_alloc(5 + wpabuf_len(pub));
7216 if (!ie)
7217 goto fail;
7218 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
7219 wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
7220 wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
7221 wpabuf_put_le16(ie, group);
7222 wpabuf_put_buf(ie, pub);
7223 wpabuf_free(pub);
7224 wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
7225 ie);
7226
7227 return ie;
7228 fail:
7229 wpabuf_free(pub);
7230 crypto_ecdh_deinit(sm->owe_ecdh);
7231 sm->owe_ecdh = NULL;
7232 return NULL;
7233 }
7234
7235
owe_process_assoc_resp(struct wpa_sm * sm,const u8 * bssid,const u8 * resp_ies,size_t resp_ies_len)7236 int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
7237 const u8 *resp_ies, size_t resp_ies_len)
7238 {
7239 struct ieee802_11_elems elems;
7240 u16 group;
7241 struct wpabuf *secret, *pub, *hkey;
7242 int res;
7243 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
7244 const char *info = "OWE Key Generation";
7245 const u8 *addr[2];
7246 size_t len[2];
7247 size_t hash_len, prime_len;
7248 struct wpa_ie_data data;
7249
7250 if (!resp_ies ||
7251 ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
7252 ParseFailed) {
7253 wpa_printf(MSG_INFO,
7254 "OWE: Could not parse Association Response frame elements");
7255 return -1;
7256 }
7257
7258 if (sm->cur_pmksa && elems.rsn_ie &&
7259 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
7260 &data) == 0 &&
7261 data.num_pmkid == 1 && data.pmkid &&
7262 os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
7263 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
7264 wpa_sm_set_pmk_from_pmksa(sm);
7265 return 0;
7266 }
7267
7268 if (!elems.owe_dh) {
7269 wpa_printf(MSG_INFO,
7270 "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
7271 return -1;
7272 }
7273
7274 group = WPA_GET_LE16(elems.owe_dh);
7275 if (group != sm->owe_group) {
7276 wpa_printf(MSG_INFO,
7277 "OWE: Unexpected Diffie-Hellman group in response: %u",
7278 group);
7279 return -1;
7280 }
7281
7282 if (!sm->owe_ecdh) {
7283 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
7284 return -1;
7285 }
7286
7287 if (group == 19)
7288 prime_len = 32;
7289 else if (group == 20)
7290 prime_len = 48;
7291 else if (group == 21)
7292 prime_len = 66;
7293 else
7294 return -1;
7295
7296 secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
7297 elems.owe_dh + 2,
7298 elems.owe_dh_len - 2);
7299 secret = wpabuf_zeropad(secret, prime_len);
7300 if (!secret) {
7301 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
7302 return -1;
7303 }
7304 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
7305
7306 /* prk = HKDF-extract(C | A | group, z) */
7307
7308 pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
7309 if (!pub) {
7310 wpabuf_clear_free(secret);
7311 return -1;
7312 }
7313
7314 /* PMKID = Truncate-128(Hash(C | A)) */
7315 addr[0] = wpabuf_head(pub);
7316 len[0] = wpabuf_len(pub);
7317 addr[1] = elems.owe_dh + 2;
7318 len[1] = elems.owe_dh_len - 2;
7319 if (group == 19) {
7320 res = sha256_vector(2, addr, len, pmkid);
7321 hash_len = SHA256_MAC_LEN;
7322 } else if (group == 20) {
7323 res = sha384_vector(2, addr, len, pmkid);
7324 hash_len = SHA384_MAC_LEN;
7325 } else if (group == 21) {
7326 res = sha512_vector(2, addr, len, pmkid);
7327 hash_len = SHA512_MAC_LEN;
7328 } else {
7329 res = -1;
7330 hash_len = 0;
7331 }
7332 pub = wpabuf_zeropad(pub, prime_len);
7333 if (res < 0 || !pub) {
7334 wpabuf_free(pub);
7335 wpabuf_clear_free(secret);
7336 return -1;
7337 }
7338
7339 hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
7340 if (!hkey) {
7341 wpabuf_free(pub);
7342 wpabuf_clear_free(secret);
7343 return -1;
7344 }
7345
7346 wpabuf_put_buf(hkey, pub); /* C */
7347 wpabuf_free(pub);
7348 wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
7349 wpabuf_put_le16(hkey, sm->owe_group); /* group */
7350 if (group == 19)
7351 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
7352 wpabuf_head(secret), wpabuf_len(secret), prk);
7353 else if (group == 20)
7354 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
7355 wpabuf_head(secret), wpabuf_len(secret), prk);
7356 else if (group == 21)
7357 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
7358 wpabuf_head(secret), wpabuf_len(secret), prk);
7359 wpabuf_clear_free(hkey);
7360 wpabuf_clear_free(secret);
7361 if (res < 0)
7362 return -1;
7363
7364 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
7365
7366 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
7367
7368 if (group == 19)
7369 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
7370 os_strlen(info), sm->pmk, hash_len);
7371 else if (group == 20)
7372 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
7373 os_strlen(info), sm->pmk, hash_len);
7374 else if (group == 21)
7375 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
7376 os_strlen(info), sm->pmk, hash_len);
7377 forced_memzero(prk, SHA512_MAC_LEN);
7378 if (res < 0) {
7379 sm->pmk_len = 0;
7380 return -1;
7381 }
7382 sm->pmk_len = hash_len;
7383
7384 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
7385 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
7386 pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
7387 bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
7388 NULL, 0);
7389
7390 return 0;
7391 }
7392
7393 #endif /* CONFIG_OWE */
7394
7395
wpa_sm_set_fils_cache_id(struct wpa_sm * sm,const u8 * fils_cache_id)7396 void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
7397 {
7398 #ifdef CONFIG_FILS
7399 if (sm && fils_cache_id) {
7400 sm->fils_cache_id_set = 1;
7401 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
7402 }
7403 #endif /* CONFIG_FILS */
7404 }
7405
7406
7407 #ifdef CONFIG_DPP2
wpa_sm_set_dpp_z(struct wpa_sm * sm,const struct wpabuf * z)7408 void wpa_sm_set_dpp_z(struct wpa_sm *sm, const struct wpabuf *z)
7409 {
7410 if (sm) {
7411 wpabuf_clear_free(sm->dpp_z);
7412 sm->dpp_z = z ? wpabuf_dup(z) : NULL;
7413 }
7414 }
7415 #endif /* CONFIG_DPP2 */
7416
7417
7418 #ifdef CONFIG_PASN
7419
wpa_pasn_sm_set_caps(struct wpa_sm * sm,unsigned int flags2)7420 void wpa_pasn_sm_set_caps(struct wpa_sm *sm, unsigned int flags2)
7421 {
7422 if (flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA)
7423 sm->secure_ltf = 1;
7424 if (flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_STA)
7425 sm->secure_rtt = 1;
7426 if (flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA)
7427 sm->prot_range_neg = 1;
7428 }
7429
7430 #endif /* CONFIG_PASN */
7431
7432
wpa_sm_pmksa_cache_reconfig(struct wpa_sm * sm)7433 void wpa_sm_pmksa_cache_reconfig(struct wpa_sm *sm)
7434 {
7435 if (sm)
7436 pmksa_cache_reconfig(sm->pmksa);
7437 }
7438
7439
wpa_sm_uses_spp_amsdu(struct wpa_sm * sm)7440 bool wpa_sm_uses_spp_amsdu(struct wpa_sm *sm)
7441 {
7442 return sm ? sm->spp_amsdu : false;
7443 }
7444
7445
wpa_sm_get_pmksa_cache(struct wpa_sm * sm)7446 struct rsn_pmksa_cache * wpa_sm_get_pmksa_cache(struct wpa_sm *sm)
7447 {
7448 return sm ? sm->pmksa : NULL;
7449 }
7450
7451
wpa_sm_set_cur_pmksa(struct wpa_sm * sm,struct rsn_pmksa_cache_entry * entry)7452 void wpa_sm_set_cur_pmksa(struct wpa_sm *sm,
7453 struct rsn_pmksa_cache_entry *entry)
7454 {
7455 if (sm)
7456 sm->cur_pmksa = entry;
7457 }
7458
7459
wpa_sm_set_driver_bss_selection(struct wpa_sm * sm,bool driver_bss_selection)7460 void wpa_sm_set_driver_bss_selection(struct wpa_sm *sm,
7461 bool driver_bss_selection)
7462 {
7463 if (sm)
7464 sm->driver_bss_selection = driver_bss_selection;
7465 }
7466
7467
wpa_sm_known_sta_identification(struct wpa_sm * sm,const u8 * aa,u64 timestamp)7468 struct wpabuf * wpa_sm_known_sta_identification(struct wpa_sm *sm, const u8 *aa,
7469 u64 timestamp)
7470 {
7471 struct wpabuf *ie;
7472 unsigned int mic_len;
7473 const u8 *start;
7474 u8 *mic;
7475
7476 if (!sm || sm->last_kck_len == 0)
7477 return NULL;
7478
7479 if (!ether_addr_equal(aa, sm->last_kck_aa))
7480 return NULL;
7481
7482 mic_len = wpa_mic_len(sm->last_kck_key_mgmt, sm->last_kck_pmk_len,
7483 sm->hash_alg);
7484
7485 ie = wpabuf_alloc(3 + 8 + 1 + mic_len);
7486 if (!ie)
7487 return NULL;
7488
7489 wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
7490 wpabuf_put_u8(ie, 1 + 8 + 1 + mic_len);
7491 wpabuf_put_u8(ie, WLAN_EID_EXT_KNOWN_STA_IDENTIFICATION);
7492 start = wpabuf_put(ie, 0);
7493 wpabuf_put_le64(ie, timestamp);
7494 wpabuf_put_u8(ie, mic_len);
7495 mic = wpabuf_put(ie, mic_len);
7496 if (wpa_eapol_key_mic(sm->last_kck, sm->last_kck_len,
7497 sm->last_kck_key_mgmt, sm->hash_alg,
7498 sm->last_kck_eapol_key_ver,
7499 start, 8, mic) < 0) {
7500 wpabuf_free(ie);
7501 return NULL;
7502 }
7503
7504 return ie;
7505 }
7506
7507
mlo_ieee80211w_set_keys_for_new_links(struct wpa_sm * sm,struct wpa_eapol_ie_parse * ie,u16 added_links_bitmap)7508 static int mlo_ieee80211w_set_keys_for_new_links(struct wpa_sm *sm,
7509 struct wpa_eapol_ie_parse *ie,
7510 u16 added_links_bitmap)
7511 {
7512 int i;
7513
7514 if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) ||
7515 sm->mgmt_group_cipher == WPA_CIPHER_GTK_NOT_USED)
7516 return 0;
7517
7518 for_each_link(added_links_bitmap, i) {
7519 if (_mlo_ieee80211w_set_keys(sm, i, ie))
7520 return -1;
7521 }
7522
7523 return 0;
7524 }
7525
7526
wpa_supplicant_install_mlo_gtk_keys(struct wpa_sm * sm,struct wpa_eapol_ie_parse * ie,u16 added_links_bitmap)7527 static int wpa_supplicant_install_mlo_gtk_keys(struct wpa_sm *sm,
7528 struct wpa_eapol_ie_parse *ie,
7529 u16 added_links_bitmap)
7530 {
7531 int i;
7532
7533 for_each_link(added_links_bitmap, i) {
7534 if (!ie->mlo_gtk[i]) {
7535 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
7536 "MLO RSN: GTK not found for link ID %u", i);
7537 return -1;
7538 }
7539
7540 if (wpa_supplicant_mlo_gtk(sm, i, ie->mlo_gtk[i],
7541 ie->mlo_gtk_len[i], 0))
7542 return -1;
7543 }
7544
7545 return 0;
7546 }
7547
7548
wpa_sm_install_mlo_group_keys(struct wpa_sm * sm,const u8 * key_data,size_t key_data_len,u16 added_links_bitmap)7549 int wpa_sm_install_mlo_group_keys(struct wpa_sm *sm, const u8 *key_data,
7550 size_t key_data_len, u16 added_links_bitmap)
7551 {
7552 struct wpa_eapol_ie_parse ie;
7553
7554 if (!sm)
7555 return -1;
7556
7557 wpa_hexdump_key(MSG_DEBUG, "RSN: IE KeyData for MLO link reconfig",
7558 key_data, key_data_len);
7559
7560 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
7561 return -1;
7562
7563 if (wpa_supplicant_install_mlo_gtk_keys(
7564 sm, &ie, added_links_bitmap) < 0)
7565 return -1;
7566
7567 if (mlo_ieee80211w_set_keys_for_new_links(sm, &ie,
7568 added_links_bitmap) < 0)
7569 return -1;
7570
7571 return 0;
7572 }
7573
7574
7575 #ifdef CONFIG_ENC_ASSOC
7576
process_key_delivery_link(struct wpa_sm * sm,u8 i,struct wpa_eapol_ie_parse * kde)7577 static int process_key_delivery_link(struct wpa_sm *sm, u8 i,
7578 struct wpa_eapol_ie_parse *kde)
7579 {
7580 if (wpa_supplicant_mlo_gtk(sm, i, kde->mlo_gtk[i],
7581 kde->mlo_gtk_len[i], 0))
7582 return -1;
7583
7584 if (_mlo_ieee80211w_set_keys(sm, i, kde) < 0) {
7585 wpa_printf(MSG_DEBUG,
7586 "ENC_ASSOC: Failed to set MLO IGTK/BIGTK (link=%u)",
7587 i);
7588 return -1;
7589 }
7590
7591 return 0;
7592 }
7593
7594
process_key_delivery_ml(struct wpa_sm * sm,struct wpa_eapol_ie_parse * kde,int valid_links)7595 static int process_key_delivery_ml(struct wpa_sm *sm,
7596 struct wpa_eapol_ie_parse *kde,
7597 int valid_links)
7598 {
7599 u8 i;
7600
7601 for_each_link(valid_links, i) {
7602 if (process_key_delivery_link(sm, i, kde) < 0)
7603 return -1;
7604 }
7605
7606 return 0;
7607 }
7608
7609
process_key_delivery(struct wpa_sm * sm,struct wpa_eapol_ie_parse * kde,const u8 * rsc)7610 static int process_key_delivery(struct wpa_sm *sm,
7611 struct wpa_eapol_ie_parse *kde,
7612 const u8 *rsc)
7613 {
7614 struct wpa_gtk_data gd;
7615 int ret = -1;
7616 int maxkeylen;
7617
7618 os_memset(&gd, 0, sizeof(gd));
7619
7620 if (!kde->gtk) {
7621 wpa_printf(MSG_DEBUG, "ENC_ASSOC: No GTK KDE");
7622 goto fail;
7623 }
7624
7625 maxkeylen = gd.gtk_len = kde->gtk_len - 2;
7626 if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
7627 gd.gtk_len, maxkeylen,
7628 &gd.key_rsc_len, &gd.alg))
7629 goto fail;
7630
7631 wpa_hexdump_key(MSG_DEBUG, "ENC_ASSOC: Received GTK",
7632 kde->gtk, kde->gtk_len);
7633 gd.keyidx = kde->gtk[0] & 0x3;
7634 if (kde->gtk_len - 2 > sizeof(gd.gtk)) {
7635 wpa_printf(MSG_DEBUG,
7636 "ENC_ASSOC: Too long GTK in GTK KDE (len=%zu)",
7637 kde->gtk_len - 2);
7638 goto fail;
7639 }
7640 os_memcpy(gd.gtk, kde->gtk + 2, kde->gtk_len - 2);
7641
7642 wpa_printf(MSG_DEBUG, "ENC_ASSOC: Set GTK to driver");
7643 if (wpa_supplicant_install_gtk(sm, &gd, rsc, 0) < 0) {
7644 wpa_printf(MSG_DEBUG, "ENC_ASSOC: Failed to set GTK");
7645 goto fail;
7646 }
7647
7648 if (ieee80211w_set_keys(sm, kde) < 0) {
7649 wpa_printf(MSG_DEBUG, "ENC_ASSOC: Failed to set IGTK/BIGTK");
7650 goto fail;
7651 }
7652
7653 ret = 0;
7654 fail:
7655 forced_memzero(&gd, sizeof(gd));
7656 return ret;
7657 }
7658
7659
process_encrypted_assoc_resp(struct wpa_sm * sm,int valid_links,const u8 * ies,size_t ies_len)7660 int process_encrypted_assoc_resp(struct wpa_sm *sm, int valid_links,
7661 const u8 *ies, size_t ies_len)
7662 {
7663 struct ieee802_11_elems elems;
7664 struct wpa_eapol_ie_parse kde;
7665 const u8 *rsc;
7666 struct wpabuf *buf = NULL;
7667 int ret = -1;
7668
7669 if (!sm || !sm->ptk_set) {
7670 wpa_printf(MSG_DEBUG, "ENC_ASSOC: No KEK available");
7671 return -1;
7672 }
7673
7674 sm->eppke_completed = 0;
7675 sm->eap_over_auth_frame_completed = 0;
7676 wpa_hexdump_key(MSG_DEBUG, "ENC_ASSOC: (Re)Association Response frame",
7677 ies, ies_len);
7678
7679 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed)
7680 return -1;
7681
7682 if (!elems.rsn_ie) {
7683 wpa_printf(MSG_DEBUG,
7684 "ENC_ASSOC: No RSNE in (Re)Association Response");
7685 return -1;
7686 }
7687
7688 if (wpa_compare_rsn_ie(wpa_key_mgmt_sae(sm->key_mgmt) ||
7689 wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt),
7690 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
7691 elems.rsn_ie - 2, elems.rsn_ie_len + 2)) {
7692 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
7693 "ENC_ASSOC: RSNE mismatch between Beacon/Probe Response and (Re)Association Response");
7694 wpa_hexdump(MSG_DEBUG,
7695 "ENC_ASSOC: RSNE in Beacon/Probe Response",
7696 sm->ap_rsn_ie, sm->ap_rsn_ie_len);
7697 wpa_hexdump(MSG_DEBUG,
7698 "ENC_ASSOC: RSNE in (Re)Association Response",
7699 elems.rsn_ie, elems.rsn_ie_len);
7700 return -1;
7701 }
7702
7703 if ((sm->ap_rsnxe && !elems.rsnxe) ||
7704 (!sm->ap_rsnxe && elems.rsnxe) ||
7705 (sm->ap_rsnxe && elems.rsnxe && sm->ap_rsnxe_len >= 2 &&
7706 (sm->ap_rsnxe_len != 2U + elems.rsnxe_len ||
7707 os_memcmp(sm->ap_rsnxe + 2, elems.rsnxe, sm->ap_rsnxe_len - 2) !=
7708 0))) {
7709 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
7710 "ENC_ASSOC: RSNXE mismatch between Beacon/Probe Response and (Re)Association Response");
7711 wpa_hexdump(MSG_DEBUG,
7712 "ENC_ASSOC: RSNXE in Beacon/Probe Response",
7713 sm->ap_rsnxe, sm->ap_rsnxe_len);
7714 wpa_hexdump(MSG_DEBUG,
7715 "ENC_ASSOC: RSNXE in (Re)Association Response",
7716 elems.rsnxe, elems.rsnxe_len);
7717 if (sm->assoc_rsnxe && sm->assoc_rsnxe_len)
7718 return -1;
7719 }
7720
7721 /* TODO: Check for RSNE/RSNXE mismatch for per-STA profile for MLO */
7722
7723 /* Key Delivery element */
7724 buf = ieee802_11_defrag(elems.key_delivery, elems.key_delivery_len,
7725 true);
7726 if (!buf) {
7727 wpa_printf(MSG_DEBUG, "ENC_ASSOC: No Key Delivery element");
7728 return -1;
7729 }
7730 elems.key_delivery = wpabuf_head(buf);
7731 elems.key_delivery_len = wpabuf_len(buf);
7732
7733 /* Parse Key Delivery element: RSC followed by group key KDEs */
7734 rsc = elems.key_delivery;
7735 if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
7736 elems.key_delivery_len - WPA_KEY_RSC_LEN,
7737 &kde) < 0) {
7738 wpa_printf(MSG_DEBUG, "ENC_ASSOC: Failed to parse KDEs");
7739 goto fail;
7740 }
7741
7742 if ((valid_links == -1 &&
7743 process_key_delivery(sm, &kde, rsc) < 0) ||
7744 (valid_links != -1 &&
7745 process_key_delivery_ml(sm, &kde, valid_links) < 0))
7746 goto fail;
7747
7748 /* Process SAE Password Identifiers KDE if present in the encrypted
7749 * (Re)Association Response frame (EPPKE path). */
7750 if (kde.sae_pw_ids && wpa_key_mgmt_sae(sm->key_mgmt) &&
7751 sm->sae_pw_id_change)
7752 wpa_sm_sae_pw_id_change(sm, kde.sae_pw_ids,
7753 kde.sae_pw_ids_len);
7754
7755 wpa_sm_set_rekey_offload(sm);
7756
7757 wpa_printf(MSG_DEBUG, "ENC_ASSOC: Association completed successfully");
7758 sm->eppke_completed = 1;
7759 sm->eap_over_auth_frame_completed = 1;
7760
7761 ret = 0;
7762 fail:
7763 wpabuf_free(buf);
7764 return ret;
7765 }
7766
7767 #endif /* CONFIG_ENC_ASSOC */
7768
7769
wpa_eppke_is_completed(struct wpa_sm * sm)7770 bool wpa_eppke_is_completed(struct wpa_sm *sm)
7771 {
7772 #ifdef CONFIG_ENC_ASSOC
7773 return sm && sm->eppke_completed;
7774 #else /* CONFIG_ENC_ASSOC */
7775 return false;
7776 #endif /* CONFIG_ENC_ASSOC */
7777 }
7778
7779
wpa_eap_over_auth_frame_is_completed(struct wpa_sm * sm)7780 bool wpa_eap_over_auth_frame_is_completed(struct wpa_sm *sm)
7781 {
7782 #ifdef CONFIG_ENC_ASSOC
7783 return sm && sm->eap_over_auth_frame_completed;
7784 #else /* CONFIG_ENC_ASSOC */
7785 return false;
7786 #endif /* CONFIG_ENC_ASSOC */
7787 }
7788
7789
wpa_sm_pmksa_privacy_supported(struct wpa_sm * sm)7790 bool wpa_sm_pmksa_privacy_supported(struct wpa_sm *sm)
7791 {
7792 return sm && sm->pmksa_privacy;
7793 }
7794
7795
7796 #ifdef CONFIG_IEEE8021X_AUTH
7797
wpa_sm_set_802_1x_auth_caps(struct wpa_sm * sm,u64 flags2)7798 void wpa_sm_set_802_1x_auth_caps(struct wpa_sm *sm, u64 flags2)
7799 {
7800 sm->eap_over_auth_frame =
7801 !!(flags2 & WPA_DRIVER_FLAGS2_802_1X_AUTH);
7802 }
7803
7804
wpa_sm_get_pmk(struct wpa_sm * sm,const u8 * addr,const u8 * pmkid,size_t * pmk_len)7805 const u8 * wpa_sm_get_pmk(struct wpa_sm *sm, const u8 *addr, const u8 *pmkid,
7806 size_t *pmk_len)
7807 {
7808 if (wpa_supplicant_get_pmk(sm, addr, pmkid) < 0 ||
7809 sm->pmk_len == 0)
7810 return NULL;
7811
7812 *pmk_len = sm->pmk_len;
7813 return sm->pmk;
7814 }
7815
7816 #endif /* CONFIG_IEEE8021X_AUTH */
7817
7818
7819 #ifdef CONFIG_TESTING_OPTIONS
7820 /**
7821 * wpa_sm_get_cached_tk - Get cached TK for testing purposes
7822 * @sm: Pointer to WPA state machine data from wpa_sm_init()
7823 * @tk: Buffer to store the TK
7824 * @tk_len: Pointer to store the TK length
7825 * Returns: 0 on success, -1 if TK is not available
7826 *
7827 * This function retrieves the cached TK from wpa_sm. The TK is only available
7828 * if PTK is set and TK is not null.
7829 */
wpa_sm_get_cached_tk(struct wpa_sm * sm,u8 * tk,size_t * tk_len)7830 int wpa_sm_get_cached_tk(struct wpa_sm *sm, u8 *tk, size_t *tk_len)
7831 {
7832 if (!sm || !sm->ptk_set ||
7833 sm->ptk.tk_len == 0 || sm->ptk.tk_len > WPA_TK_MAX_LEN)
7834 return -1;
7835
7836 os_memcpy(tk, sm->ptk.tk, sm->ptk.tk_len);
7837 *tk_len = sm->ptk.tk_len;
7838
7839 return 0;
7840 }
7841 #endif /* CONFIG_TESTING_OPTIONS */
7842