1 /*
2 * WPA/RSN - Shared functions for supplicant and authenticator
3 * Copyright (c) 2002-2018, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "crypto/md5.h"
13 #include "crypto/sha1.h"
14 #include "crypto/sha256.h"
15 #include "crypto/sha384.h"
16 #include "crypto/sha512.h"
17 #include "crypto/aes_wrap.h"
18 #include "crypto/crypto.h"
19 #include "ieee802_11_defs.h"
20 #include "ieee802_11_common.h"
21 #include "defs.h"
22 #include "common/nan_defs.h"
23 #include "wpa_common.h"
24
25
wpa_kck_len(int akmp,size_t pmk_len)26 static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
27 {
28 switch (akmp) {
29 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
30 case WPA_KEY_MGMT_IEEE8021X_SHA384:
31 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
32 return 24;
33 case WPA_KEY_MGMT_FILS_SHA256:
34 case WPA_KEY_MGMT_FT_FILS_SHA256:
35 case WPA_KEY_MGMT_FILS_SHA384:
36 case WPA_KEY_MGMT_FT_FILS_SHA384:
37 return 0;
38 case WPA_KEY_MGMT_DPP:
39 return pmk_len / 2;
40 case WPA_KEY_MGMT_OWE:
41 return pmk_len / 2;
42 case WPA_KEY_MGMT_SAE_EXT_KEY:
43 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
44 return pmk_len / 2;
45 default:
46 return 16;
47 }
48 }
49
50
51 #ifdef CONFIG_IEEE80211R
wpa_kck2_len(int akmp)52 static unsigned int wpa_kck2_len(int akmp)
53 {
54 switch (akmp) {
55 case WPA_KEY_MGMT_FT_FILS_SHA256:
56 return 16;
57 case WPA_KEY_MGMT_FT_FILS_SHA384:
58 return 24;
59 default:
60 return 0;
61 }
62 }
63 #endif /* CONFIG_IEEE80211R */
64
65
wpa_kek_len(int akmp,size_t pmk_len)66 unsigned int wpa_kek_len(int akmp, size_t pmk_len)
67 {
68 switch (akmp) {
69 case WPA_KEY_MGMT_FILS_SHA384:
70 case WPA_KEY_MGMT_FT_FILS_SHA384:
71 return 64;
72 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
73 case WPA_KEY_MGMT_FILS_SHA256:
74 case WPA_KEY_MGMT_FT_FILS_SHA256:
75 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
76 case WPA_KEY_MGMT_IEEE8021X_SHA384:
77 return 32;
78 case WPA_KEY_MGMT_DPP:
79 return pmk_len <= 32 ? 16 : 32;
80 case WPA_KEY_MGMT_OWE:
81 return pmk_len <= 32 ? 16 : 32;
82 case WPA_KEY_MGMT_SAE_EXT_KEY:
83 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
84 return pmk_len <= 32 ? 16 : 32;
85 default:
86 return 16;
87 }
88 }
89
90
91 #ifdef CONFIG_IEEE80211R
wpa_kek2_len(int akmp)92 static unsigned int wpa_kek2_len(int akmp)
93 {
94 switch (akmp) {
95 case WPA_KEY_MGMT_FT_FILS_SHA256:
96 return 16;
97 case WPA_KEY_MGMT_FT_FILS_SHA384:
98 return 32;
99 default:
100 return 0;
101 }
102 }
103 #endif /* CONFIG_IEEE80211R */
104
105
rsn_mic_len_hash(size_t pmk_len,enum rsn_hash_alg hash)106 static int rsn_mic_len_hash(size_t pmk_len, enum rsn_hash_alg hash)
107 {
108 switch (hash) {
109 case RSN_HASH_SHA256:
110 return 16;
111 case RSN_HASH_SHA384:
112 return 24;
113 case RSN_HASH_SHA512:
114 return 32;
115 default:
116 return pmk_len / 2;
117 }
118 }
119
wpa_mic_len(int akmp,size_t pmk_len,enum rsn_hash_alg hash)120 unsigned int wpa_mic_len(int akmp, size_t pmk_len, enum rsn_hash_alg hash)
121 {
122 switch (akmp) {
123 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
124 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
125 case WPA_KEY_MGMT_IEEE8021X_SHA384:
126 return 24;
127 case WPA_KEY_MGMT_FILS_SHA256:
128 case WPA_KEY_MGMT_FILS_SHA384:
129 case WPA_KEY_MGMT_FT_FILS_SHA256:
130 case WPA_KEY_MGMT_FT_FILS_SHA384:
131 return 0;
132 case WPA_KEY_MGMT_DPP:
133 return rsn_mic_len_hash(pmk_len, hash);
134 case WPA_KEY_MGMT_OWE:
135 return rsn_mic_len_hash(pmk_len, hash);
136 case WPA_KEY_MGMT_SAE_EXT_KEY:
137 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
138 return rsn_mic_len_hash(pmk_len, hash);
139 default:
140 return 16;
141 }
142 }
143
144
rsn_cipher_suite_to_wpa_cipher(u32 cipher)145 int rsn_cipher_suite_to_wpa_cipher(u32 cipher)
146 {
147 switch (cipher) {
148 case RSN_CIPHER_SUITE_NONE:
149 return WPA_CIPHER_NONE;
150 case RSN_CIPHER_SUITE_TKIP:
151 return WPA_CIPHER_TKIP;
152 case RSN_CIPHER_SUITE_CCMP:
153 return WPA_CIPHER_CCMP;
154 case RSN_CIPHER_SUITE_AES_128_CMAC:
155 return WPA_CIPHER_AES_128_CMAC;
156 case RSN_CIPHER_SUITE_GCMP:
157 return WPA_CIPHER_GCMP;
158 case RSN_CIPHER_SUITE_CCMP_256:
159 return WPA_CIPHER_CCMP_256;
160 case RSN_CIPHER_SUITE_GCMP_256:
161 return WPA_CIPHER_GCMP_256;
162 case RSN_CIPHER_SUITE_BIP_GMAC_128:
163 return WPA_CIPHER_BIP_GMAC_128;
164 case RSN_CIPHER_SUITE_BIP_GMAC_256:
165 return WPA_CIPHER_BIP_GMAC_256;
166 case RSN_CIPHER_SUITE_BIP_CMAC_256:
167 return WPA_CIPHER_BIP_CMAC_256;
168 case RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED:
169 return WPA_CIPHER_GTK_NOT_USED;
170 default:
171 return 0;
172 }
173 }
174
175
rsn_key_mgmt_to_wpa_akm(u32 akm_suite)176 int rsn_key_mgmt_to_wpa_akm(u32 akm_suite)
177 {
178 switch (akm_suite) {
179 case RSN_AUTH_KEY_MGMT_UNSPEC_802_1X:
180 return WPA_KEY_MGMT_IEEE8021X;
181 case RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X:
182 return WPA_KEY_MGMT_PSK;
183 #ifdef CONFIG_IEEE80211R
184 case RSN_AUTH_KEY_MGMT_FT_802_1X:
185 return WPA_KEY_MGMT_FT_IEEE8021X;
186 case RSN_AUTH_KEY_MGMT_FT_PSK:
187 return WPA_KEY_MGMT_FT_PSK;
188 #ifdef CONFIG_SHA384
189 case RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384:
190 return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
191 #endif /* CONFIG_SHA384 */
192 #endif /* CONFIG_IEEE80211R */
193 #ifdef CONFIG_SHA384
194 case RSN_AUTH_KEY_MGMT_802_1X_SHA384:
195 return WPA_KEY_MGMT_IEEE8021X_SHA384;
196 #endif /* CONFIG_SHA384 */
197 case RSN_AUTH_KEY_MGMT_802_1X_SHA256:
198 return WPA_KEY_MGMT_IEEE8021X_SHA256;
199 case RSN_AUTH_KEY_MGMT_PSK_SHA256:
200 return WPA_KEY_MGMT_PSK_SHA256;
201 #ifdef CONFIG_SAE
202 case RSN_AUTH_KEY_MGMT_SAE:
203 return WPA_KEY_MGMT_SAE;
204 case RSN_AUTH_KEY_MGMT_SAE_EXT_KEY:
205 return WPA_KEY_MGMT_SAE_EXT_KEY;
206 case RSN_AUTH_KEY_MGMT_FT_SAE:
207 return WPA_KEY_MGMT_FT_SAE;
208 case RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY:
209 return WPA_KEY_MGMT_FT_SAE_EXT_KEY;
210 #endif /* CONFIG_SAE */
211 case RSN_AUTH_KEY_MGMT_802_1X_SUITE_B:
212 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
213 case RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192:
214 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
215 case RSN_AUTH_KEY_MGMT_FILS_SHA256:
216 return WPA_KEY_MGMT_FILS_SHA256;
217 case RSN_AUTH_KEY_MGMT_FILS_SHA384:
218 return WPA_KEY_MGMT_FILS_SHA384;
219 case RSN_AUTH_KEY_MGMT_FT_FILS_SHA256:
220 return WPA_KEY_MGMT_FT_FILS_SHA256;
221 case RSN_AUTH_KEY_MGMT_FT_FILS_SHA384:
222 return WPA_KEY_MGMT_FT_FILS_SHA384;
223 #ifdef CONFIG_OWE
224 case RSN_AUTH_KEY_MGMT_OWE:
225 return WPA_KEY_MGMT_OWE;
226 #endif /* CONFIG_OWE */
227 #ifdef CONFIG_DPP
228 case RSN_AUTH_KEY_MGMT_DPP:
229 return WPA_KEY_MGMT_DPP;
230 #endif /* CONFIG_DPP */
231 #ifdef CONFIG_PASN
232 case RSN_AUTH_KEY_MGMT_PASN:
233 return WPA_KEY_MGMT_PASN;
234 #endif /* CONFIG_PASN */
235 case RSN_AUTH_KEY_MGMT_EPPKE:
236 return WPA_KEY_MGMT_EPPKE;
237 default:
238 return 0;
239 }
240 }
241
242
243 /**
244 * wpa_use_akm_defined - Is AKM-defined Key Descriptor Version used
245 * @akmp: WPA_KEY_MGMT_* used in key derivation
246 * Returns: 1 if AKM-defined Key Descriptor Version is used; 0 otherwise
247 */
wpa_use_akm_defined(int akmp)248 int wpa_use_akm_defined(int akmp)
249 {
250 return akmp == WPA_KEY_MGMT_OWE ||
251 akmp == WPA_KEY_MGMT_DPP ||
252 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
253 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
254 wpa_key_mgmt_sae(akmp) ||
255 wpa_key_mgmt_suite_b(akmp) ||
256 wpa_key_mgmt_fils(akmp);
257 }
258
259
260 /**
261 * wpa_use_cmac - Is CMAC integrity algorithm used for EAPOL-Key MIC
262 * @akmp: WPA_KEY_MGMT_* used in key derivation
263 * Returns: 1 if CMAC is used; 0 otherwise
264 */
wpa_use_cmac(int akmp)265 int wpa_use_cmac(int akmp)
266 {
267 return akmp == WPA_KEY_MGMT_OWE ||
268 akmp == WPA_KEY_MGMT_DPP ||
269 wpa_key_mgmt_ft(akmp) ||
270 wpa_key_mgmt_sha256(akmp) ||
271 (wpa_key_mgmt_sae(akmp) &&
272 !wpa_key_mgmt_sae_ext_key(akmp)) ||
273 wpa_key_mgmt_suite_b(akmp);
274 }
275
276
277 /**
278 * wpa_use_aes_key_wrap - Is AES Keywrap algorithm used for EAPOL-Key Key Data
279 * @akmp: WPA_KEY_MGMT_* used in key derivation
280 * Returns: 1 if AES Keywrap is used; 0 otherwise
281 *
282 * Note: AKM 00-0F-AC:1 and 00-0F-AC:2 have special rules for selecting whether
283 * to use AES Keywrap based on the negotiated pairwise cipher. This function
284 * does not cover those special cases.
285 */
wpa_use_aes_key_wrap(int akmp)286 int wpa_use_aes_key_wrap(int akmp)
287 {
288 return akmp == WPA_KEY_MGMT_OWE ||
289 akmp == WPA_KEY_MGMT_DPP ||
290 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
291 wpa_key_mgmt_ft(akmp) ||
292 wpa_key_mgmt_sha256(akmp) ||
293 wpa_key_mgmt_sae(akmp) ||
294 wpa_key_mgmt_suite_b(akmp);
295 }
296
297
298 #if defined(CONFIG_SAE) || defined(CONFIG_OWE) || defined(CONFIG_DPP)
rsn_eapol_key_mic_hash(const u8 * key,size_t key_len,int akmp,enum rsn_hash_alg hash_alg,int ver,const u8 * buf,size_t len,u8 * mic)299 static int rsn_eapol_key_mic_hash(const u8 *key, size_t key_len, int akmp,
300 enum rsn_hash_alg hash_alg, int ver,
301 const u8 *buf, size_t len, u8 *mic)
302 {
303 u8 hash[SHA512_MAC_LEN];
304 size_t mic_len;
305
306 if (hash_alg == RSN_HASH_NOT_SPECIFIED) {
307 if (key_len == 128 / 8)
308 hash_alg = RSN_HASH_SHA256;
309 else if (key_len == 192 / 8)
310 hash_alg = RSN_HASH_SHA384;
311 else if (key_len == 256 / 8)
312 hash_alg = RSN_HASH_SHA512;
313 else
314 return -1;
315 }
316
317 wpa_printf(MSG_DEBUG,
318 "RSN: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - %s)",
319 hash_alg == RSN_HASH_SHA512 ? 512 :
320 hash_alg == RSN_HASH_SHA384 ? 384 : 256,
321 wpa_key_mgmt_txt(akmp, WPA_PROTO_RSN));
322 wpa_hexdump(MSG_DEBUG, "RSN: KCK", key, key_len);
323
324 if (hash_alg == RSN_HASH_SHA256) {
325 if (hmac_sha256(key, key_len, buf, len, hash))
326 return -1;
327 mic_len = 16;
328 #ifdef CONFIG_SHA384
329 } else if (hash_alg == RSN_HASH_SHA384) {
330 if (hmac_sha384(key, key_len, buf, len, hash))
331 return -1;
332 mic_len = 24;
333 #endif /* CONFIG_SHA384 */
334 #ifdef CONFIG_SHA512
335 } else if (hash_alg == RSN_HASH_SHA512) {
336 if (hmac_sha512(key, key_len, buf, len, hash))
337 return -1;
338 mic_len = 32;
339 #endif /* CONFIG_SHA512 */
340 } else {
341 wpa_printf(MSG_INFO,
342 "RSN: Unsupported KCK length: %u (hash_alg=%d)",
343 (unsigned int) key_len, hash_alg);
344 return -1;
345 }
346
347 os_memcpy(mic, hash, mic_len);
348 wpa_hexdump(MSG_DEBUG, "RSN: EAPOL-Key MIC", mic, mic_len);
349 return 0;
350 }
351 #endif /* CONFIG_SAE || CONFIG_OWE || CONFIG_DPP */
352
353
354 /**
355 * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
356 * @key: EAPOL-Key Key Confirmation Key (KCK)
357 * @key_len: KCK length in octets
358 * @akmp: WPA_KEY_MGMT_* used in key derivation
359 * @hash_alg: Hash algorithm
360 * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
361 * @buf: Pointer to the beginning of the EAPOL header (version field)
362 * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
363 * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
364 * Returns: 0 on success, -1 on failure
365 *
366 * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
367 * to be cleared (all zeroes) when calling this function.
368 *
369 * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
370 * description of the Key MIC calculation. It includes packet data from the
371 * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
372 * happened during final editing of the standard and the correct behavior is
373 * defined in the last draft (IEEE 802.11i/D10).
374 */
wpa_eapol_key_mic(const u8 * key,size_t key_len,int akmp,enum rsn_hash_alg hash_alg,int ver,const u8 * buf,size_t len,u8 * mic)375 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp,
376 enum rsn_hash_alg hash_alg, int ver,
377 const u8 *buf, size_t len, u8 *mic)
378 {
379 u8 hash[SHA512_MAC_LEN];
380
381 if (key_len == 0) {
382 wpa_printf(MSG_DEBUG,
383 "WPA: KCK not set - cannot calculate MIC");
384 return -1;
385 }
386
387 switch (ver) {
388 #ifndef CONFIG_FIPS
389 case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
390 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-MD5");
391 return hmac_md5(key, key_len, buf, len, mic);
392 #endif /* CONFIG_FIPS */
393 case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
394 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-SHA1");
395 if (hmac_sha1(key, key_len, buf, len, hash))
396 return -1;
397 os_memcpy(mic, hash, MD5_MAC_LEN);
398 break;
399 case WPA_KEY_INFO_TYPE_AES_128_CMAC:
400 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using AES-CMAC");
401 return omac1_aes_128(key, buf, len, mic);
402 case WPA_KEY_INFO_TYPE_AKM_DEFINED:
403 switch (akmp) {
404 #ifdef CONFIG_SAE
405 case WPA_KEY_MGMT_SAE:
406 case WPA_KEY_MGMT_FT_SAE:
407 wpa_printf(MSG_DEBUG,
408 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - SAE)");
409 return omac1_aes_128(key, buf, len, mic);
410 case WPA_KEY_MGMT_SAE_EXT_KEY:
411 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
412 if (rsn_eapol_key_mic_hash(key, key_len, akmp, hash_alg,
413 ver, buf, len, mic) < 0)
414 return -1;
415 break;
416 #endif /* CONFIG_SAE */
417 #ifdef CONFIG_SUITEB
418 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
419 wpa_printf(MSG_DEBUG,
420 "WPA: EAPOL-Key MIC using HMAC-SHA256 (AKM-defined - Suite B)");
421 if (hmac_sha256(key, key_len, buf, len, hash))
422 return -1;
423 os_memcpy(mic, hash, MD5_MAC_LEN);
424 break;
425 #endif /* CONFIG_SUITEB */
426 #ifdef CONFIG_SUITEB192
427 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
428 wpa_printf(MSG_DEBUG,
429 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - Suite B 192-bit)");
430 if (hmac_sha384(key, key_len, buf, len, hash))
431 return -1;
432 os_memcpy(mic, hash, 24);
433 break;
434 #endif /* CONFIG_SUITEB192 */
435 #ifdef CONFIG_OWE
436 case WPA_KEY_MGMT_OWE:
437 if (rsn_eapol_key_mic_hash(key, key_len, akmp, hash_alg,
438 ver, buf, len, mic) < 0)
439 return -1;
440 break;
441 #endif /* CONFIG_OWE */
442 #ifdef CONFIG_DPP
443 case WPA_KEY_MGMT_DPP:
444 if (rsn_eapol_key_mic_hash(key, key_len, akmp, hash_alg,
445 ver, buf, len, mic) < 0)
446 return -1;
447 break;
448 #endif /* CONFIG_DPP */
449 #ifdef CONFIG_SHA384
450 case WPA_KEY_MGMT_IEEE8021X_SHA384:
451 #ifdef CONFIG_IEEE80211R
452 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
453 #endif /* CONFIG_IEEE80211R */
454 wpa_printf(MSG_DEBUG,
455 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - 802.1X SHA384)");
456 if (hmac_sha384(key, key_len, buf, len, hash))
457 return -1;
458 os_memcpy(mic, hash, 24);
459 break;
460 #endif /* CONFIG_SHA384 */
461 default:
462 wpa_printf(MSG_DEBUG,
463 "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
464 akmp);
465 return -1;
466 }
467 break;
468 default:
469 wpa_printf(MSG_DEBUG,
470 "WPA: EAPOL-Key MIC algorithm not known (ver=%d)",
471 ver);
472 return -1;
473 }
474
475 return 0;
476 }
477
478
479 /**
480 * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
481 * @pmk: Pairwise master key
482 * @pmk_len: Length of PMK
483 * @label: Label to use in derivation
484 * @addr1: AA or SA
485 * @addr2: SA or AA
486 * @nonce1: ANonce or SNonce
487 * @nonce2: SNonce or ANonce
488 * @ptk: Buffer for pairwise transient key
489 * @akmp: Negotiated AKM
490 * @cipher: Negotiated pairwise cipher
491 * @z: Additional context data
492 * @z_len: Length of additional context data
493 * @kdk_len: The length in octets that should be derived for KDK
494 * Returns: 0 on success, -1 on failure
495 *
496 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
497 * PTK = PRF-X(PMK, "Pairwise key expansion",
498 * Min(AA, SA) || Max(AA, SA) ||
499 * Min(ANonce, SNonce) || Max(ANonce, SNonce)
500 * [ || Z.x ])
501 *
502 * The optional Z.x component is used only with DPP and that part is not defined
503 * in IEEE 802.11. The additional context data is also used to carry the DHss
504 * (Diffie-Hellman shared secret) when IEEE 802.1X authentication in
505 * Authentication frames is used.
506 */
wpa_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const char * label,const u8 * addr1,const u8 * addr2,const u8 * nonce1,const u8 * nonce2,struct wpa_ptk * ptk,int akmp,int cipher,const u8 * z,size_t z_len,size_t kdk_len)507 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
508 const u8 *addr1, const u8 *addr2,
509 const u8 *nonce1, const u8 *nonce2,
510 struct wpa_ptk *ptk, int akmp, int cipher,
511 const u8 *z, size_t z_len, size_t kdk_len)
512 {
513 #define MAX_Z_LEN 66 /* with NIST P-521 */
514 u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN + MAX_Z_LEN];
515 size_t data_len = 2 * ETH_ALEN + 2 * WPA_NONCE_LEN;
516 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
517 WPA_KDK_MAX_LEN];
518 size_t ptk_len;
519 #ifdef CONFIG_OWE
520 int owe_ptk_workaround = 0;
521
522 if (akmp == (WPA_KEY_MGMT_OWE | WPA_KEY_MGMT_PSK_SHA256)) {
523 owe_ptk_workaround = 1;
524 akmp = WPA_KEY_MGMT_OWE;
525 }
526 #endif /* CONFIG_OWE */
527
528 if (pmk_len == 0) {
529 wpa_printf(MSG_ERROR, "WPA: No PMK set for PTK derivation");
530 return -1;
531 }
532
533 if (z_len > MAX_Z_LEN)
534 return -1;
535
536 if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
537 os_memcpy(data, addr1, ETH_ALEN);
538 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
539 } else {
540 os_memcpy(data, addr2, ETH_ALEN);
541 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
542 }
543
544 if (os_memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
545 os_memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
546 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
547 WPA_NONCE_LEN);
548 } else {
549 os_memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
550 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
551 WPA_NONCE_LEN);
552 }
553
554 if (z && z_len) {
555 os_memcpy(data + 2 * ETH_ALEN + 2 * WPA_NONCE_LEN, z, z_len);
556 data_len += z_len;
557 }
558
559 if (kdk_len > WPA_KDK_MAX_LEN) {
560 wpa_printf(MSG_ERROR,
561 "WPA: KDK len=%zu exceeds max supported len",
562 kdk_len);
563 return -1;
564 }
565
566 ptk->kck_len = wpa_kck_len(akmp, pmk_len);
567 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
568 ptk->tk_len = wpa_cipher_key_len(cipher);
569 ptk->kdk_len = kdk_len;
570 if (ptk->tk_len == 0) {
571 wpa_printf(MSG_ERROR,
572 "WPA: Unsupported cipher (0x%x) used in PTK derivation",
573 cipher);
574 return -1;
575 }
576 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len + ptk->kdk_len;
577
578 if (wpa_key_mgmt_sha384(akmp)) {
579 #ifdef CONFIG_SHA384
580 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
581 if (sha384_prf(pmk, pmk_len, label, data, data_len,
582 tmp, ptk_len) < 0)
583 return -1;
584 ptk->hash_alg = RSN_HASH_SHA384;
585 #else /* CONFIG_SHA384 */
586 return -1;
587 #endif /* CONFIG_SHA384 */
588 } else if (wpa_key_mgmt_sha256(akmp)) {
589 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
590 if (sha256_prf(pmk, pmk_len, label, data, data_len,
591 tmp, ptk_len) < 0)
592 return -1;
593 ptk->hash_alg = RSN_HASH_SHA256;
594 #ifdef CONFIG_OWE
595 } else if (akmp == WPA_KEY_MGMT_OWE && (pmk_len == 32 ||
596 owe_ptk_workaround)) {
597 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
598 if (sha256_prf(pmk, pmk_len, label, data, data_len,
599 tmp, ptk_len) < 0)
600 return -1;
601 if (owe_ptk_workaround && pmk_len == 64)
602 ptk->hash_alg = RSN_HASH_SHA512;
603 else if (owe_ptk_workaround && pmk_len == 48)
604 ptk->hash_alg = RSN_HASH_SHA384;
605 else
606 ptk->hash_alg = RSN_HASH_SHA256;
607 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 48) {
608 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
609 if (sha384_prf(pmk, pmk_len, label, data, data_len,
610 tmp, ptk_len) < 0)
611 return -1;
612 ptk->hash_alg = RSN_HASH_SHA384;
613 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 64) {
614 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
615 if (sha512_prf(pmk, pmk_len, label, data, data_len,
616 tmp, ptk_len) < 0)
617 return -1;
618 ptk->hash_alg = RSN_HASH_SHA512;
619 } else if (akmp == WPA_KEY_MGMT_OWE) {
620 wpa_printf(MSG_INFO, "OWE: Unknown PMK length %u",
621 (unsigned int) pmk_len);
622 return -1;
623 #endif /* CONFIG_OWE */
624 #ifdef CONFIG_DPP
625 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 32) {
626 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
627 if (sha256_prf(pmk, pmk_len, label, data, data_len,
628 tmp, ptk_len) < 0)
629 return -1;
630 ptk->hash_alg = RSN_HASH_SHA256;
631 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 48) {
632 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
633 if (sha384_prf(pmk, pmk_len, label, data, data_len,
634 tmp, ptk_len) < 0)
635 return -1;
636 ptk->hash_alg = RSN_HASH_SHA384;
637 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 64) {
638 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
639 if (sha512_prf(pmk, pmk_len, label, data, data_len,
640 tmp, ptk_len) < 0)
641 return -1;
642 ptk->hash_alg = RSN_HASH_SHA512;
643 } else if (akmp == WPA_KEY_MGMT_DPP) {
644 wpa_printf(MSG_INFO, "DPP: Unknown PMK length %u",
645 (unsigned int) pmk_len);
646 return -1;
647 #endif /* CONFIG_DPP */
648 #ifdef CONFIG_SAE
649 } else if (wpa_key_mgmt_sae_ext_key(akmp)) {
650 if (pmk_len == 32) {
651 wpa_printf(MSG_DEBUG,
652 "SAE: PTK derivation using PRF(SHA256)");
653 if (sha256_prf(pmk, pmk_len, label, data, data_len,
654 tmp, ptk_len) < 0)
655 return -1;
656 ptk->hash_alg = RSN_HASH_SHA256;
657 #ifdef CONFIG_SHA384
658 } else if (pmk_len == 48) {
659 wpa_printf(MSG_DEBUG,
660 "SAE: PTK derivation using PRF(SHA384)");
661 if (sha384_prf(pmk, pmk_len, label, data, data_len,
662 tmp, ptk_len) < 0)
663 return -1;
664 ptk->hash_alg = RSN_HASH_SHA384;
665 #endif /* CONFIG_SHA384 */
666 #ifdef CONFIG_SHA512
667 } else if (pmk_len == 64) {
668 wpa_printf(MSG_DEBUG,
669 "SAE: PTK derivation using PRF(SHA512)");
670 if (sha512_prf(pmk, pmk_len, label, data, data_len,
671 tmp, ptk_len) < 0)
672 return -1;
673 ptk->hash_alg = RSN_HASH_SHA512;
674 #endif /* CONFIG_SHA512 */
675 } else {
676 wpa_printf(MSG_INFO, "SAE: Unknown PMK length %u",
677 (unsigned int) pmk_len);
678 return -1;
679 }
680 #endif /* CONFIG_SAE */
681 } else {
682 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA1)");
683 if (sha1_prf(pmk, pmk_len, label, data, data_len, tmp,
684 ptk_len) < 0)
685 return -1;
686 ptk->hash_alg = RSN_HASH_SHA1;
687 }
688
689 wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR,
690 MAC2STR(addr1), MAC2STR(addr2));
691 wpa_hexdump(MSG_DEBUG, "WPA: Nonce1", nonce1, WPA_NONCE_LEN);
692 wpa_hexdump(MSG_DEBUG, "WPA: Nonce2", nonce2, WPA_NONCE_LEN);
693 if (z && z_len)
694 wpa_hexdump_key(MSG_DEBUG, "WPA: Z.x", z, z_len);
695 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
696 wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
697
698 os_memcpy(ptk->kck, tmp, ptk->kck_len);
699 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
700
701 os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
702 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
703
704 os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
705 wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
706
707 if (kdk_len) {
708 os_memcpy(ptk->kdk, tmp + ptk->kck_len + ptk->kek_len +
709 ptk->tk_len, ptk->kdk_len);
710 wpa_hexdump_key(MSG_DEBUG, "WPA: KDK", ptk->kdk, ptk->kdk_len);
711 }
712
713 ptk->kek2_len = 0;
714 ptk->kck2_len = 0;
715
716 ptk->ptk_len = ptk_len;
717 os_memset(tmp, 0, sizeof(tmp));
718 os_memset(data, 0, data_len);
719 return 0;
720 }
721
722 #ifdef CONFIG_FILS
723
fils_rmsk_to_pmk(int akmp,const u8 * rmsk,size_t rmsk_len,const u8 * snonce,const u8 * anonce,const u8 * dh_ss,size_t dh_ss_len,u8 * pmk,size_t * pmk_len)724 int fils_rmsk_to_pmk(int akmp, const u8 *rmsk, size_t rmsk_len,
725 const u8 *snonce, const u8 *anonce, const u8 *dh_ss,
726 size_t dh_ss_len, u8 *pmk, size_t *pmk_len)
727 {
728 u8 nonces[2 * NONCE_LEN];
729 const u8 *addr[2];
730 size_t len[2];
731 size_t num_elem;
732 int res;
733
734 /* PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ]) */
735 wpa_printf(MSG_DEBUG, "FILS: rMSK to PMK derivation");
736
737 if (wpa_key_mgmt_sha384(akmp))
738 *pmk_len = SHA384_MAC_LEN;
739 else if (wpa_key_mgmt_sha256(akmp))
740 *pmk_len = SHA256_MAC_LEN;
741 else
742 return -1;
743
744 wpa_hexdump_key(MSG_DEBUG, "FILS: rMSK", rmsk, rmsk_len);
745 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, NONCE_LEN);
746 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, NONCE_LEN);
747 wpa_hexdump(MSG_DEBUG, "FILS: DHss", dh_ss, dh_ss_len);
748
749 os_memcpy(nonces, snonce, NONCE_LEN);
750 os_memcpy(&nonces[NONCE_LEN], anonce, NONCE_LEN);
751 addr[0] = rmsk;
752 len[0] = rmsk_len;
753 num_elem = 1;
754 if (dh_ss) {
755 addr[1] = dh_ss;
756 len[1] = dh_ss_len;
757 num_elem++;
758 }
759 if (wpa_key_mgmt_sha384(akmp))
760 res = hmac_sha384_vector(nonces, 2 * NONCE_LEN, num_elem,
761 addr, len, pmk);
762 else
763 res = hmac_sha256_vector(nonces, 2 * NONCE_LEN, num_elem,
764 addr, len, pmk);
765 if (res == 0)
766 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, *pmk_len);
767 else
768 *pmk_len = 0;
769 return res;
770 }
771
772
fils_pmkid_erp(int akmp,const u8 * reauth,size_t reauth_len,u8 * pmkid)773 int fils_pmkid_erp(int akmp, const u8 *reauth, size_t reauth_len,
774 u8 *pmkid)
775 {
776 const u8 *addr[1];
777 size_t len[1];
778 u8 hash[SHA384_MAC_LEN];
779 int res;
780
781 /* PMKID = Truncate-128(Hash(EAP-Initiate/Reauth)) */
782 addr[0] = reauth;
783 len[0] = reauth_len;
784 if (wpa_key_mgmt_sha384(akmp))
785 res = sha384_vector(1, addr, len, hash);
786 else if (wpa_key_mgmt_sha256(akmp))
787 res = sha256_vector(1, addr, len, hash);
788 else
789 return -1;
790 if (res)
791 return res;
792 os_memcpy(pmkid, hash, PMKID_LEN);
793 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
794 return 0;
795 }
796
797
fils_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * aa,const u8 * snonce,const u8 * anonce,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,u8 * ick,size_t * ick_len,int akmp,int cipher,u8 * fils_ft,size_t * fils_ft_len,size_t kdk_len)798 int fils_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa, const u8 *aa,
799 const u8 *snonce, const u8 *anonce, const u8 *dhss,
800 size_t dhss_len, struct wpa_ptk *ptk,
801 u8 *ick, size_t *ick_len, int akmp, int cipher,
802 u8 *fils_ft, size_t *fils_ft_len, size_t kdk_len)
803 {
804 u8 *data, *pos;
805 size_t data_len;
806 u8 tmp[FILS_ICK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
807 FILS_FT_MAX_LEN + WPA_KDK_MAX_LEN];
808 size_t key_data_len;
809 const char *label = "FILS PTK Derivation";
810 int ret = -1;
811 size_t offset;
812
813 /*
814 * FILS-Key-Data = PRF-X(PMK, "FILS PTK Derivation",
815 * SPA || AA || SNonce || ANonce [ || DHss ])
816 * ICK = L(FILS-Key-Data, 0, ICK_bits)
817 * KEK = L(FILS-Key-Data, ICK_bits, KEK_bits)
818 * TK = L(FILS-Key-Data, ICK_bits + KEK_bits, TK_bits)
819 * If doing FT initial mobility domain association:
820 * FILS-FT = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits,
821 * FILS-FT_bits)
822 * When a KDK is derived:
823 * KDK = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits + FILS-FT_bits,
824 * KDK_bits)
825 */
826 data_len = 2 * ETH_ALEN + 2 * NONCE_LEN + dhss_len;
827 data = os_malloc(data_len);
828 if (!data)
829 goto err;
830 pos = data;
831 os_memcpy(pos, spa, ETH_ALEN);
832 pos += ETH_ALEN;
833 os_memcpy(pos, aa, ETH_ALEN);
834 pos += ETH_ALEN;
835 os_memcpy(pos, snonce, NONCE_LEN);
836 pos += NONCE_LEN;
837 os_memcpy(pos, anonce, NONCE_LEN);
838 pos += NONCE_LEN;
839 if (dhss)
840 os_memcpy(pos, dhss, dhss_len);
841
842 ptk->kck_len = 0;
843 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
844 ptk->tk_len = wpa_cipher_key_len(cipher);
845 if (wpa_key_mgmt_sha384(akmp))
846 *ick_len = 48;
847 else if (wpa_key_mgmt_sha256(akmp))
848 *ick_len = 32;
849 else
850 goto err;
851 key_data_len = *ick_len + ptk->kek_len + ptk->tk_len;
852
853 if (kdk_len) {
854 if (kdk_len > WPA_KDK_MAX_LEN) {
855 wpa_printf(MSG_ERROR, "FILS: KDK len=%zu too big",
856 kdk_len);
857 goto err;
858 }
859
860 ptk->kdk_len = kdk_len;
861 key_data_len += kdk_len;
862 } else {
863 ptk->kdk_len = 0;
864 }
865
866 if (fils_ft && fils_ft_len) {
867 if (akmp == WPA_KEY_MGMT_FT_FILS_SHA256) {
868 *fils_ft_len = 32;
869 } else if (akmp == WPA_KEY_MGMT_FT_FILS_SHA384) {
870 *fils_ft_len = 48;
871 } else {
872 *fils_ft_len = 0;
873 fils_ft = NULL;
874 }
875 key_data_len += *fils_ft_len;
876 }
877
878 if (wpa_key_mgmt_sha384(akmp)) {
879 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA384)");
880 if (sha384_prf(pmk, pmk_len, label, data, data_len,
881 tmp, key_data_len) < 0)
882 goto err;
883 } else {
884 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA256)");
885 if (sha256_prf(pmk, pmk_len, label, data, data_len,
886 tmp, key_data_len) < 0)
887 goto err;
888 }
889
890 wpa_printf(MSG_DEBUG, "FILS: PTK derivation - SPA=" MACSTR
891 " AA=" MACSTR, MAC2STR(spa), MAC2STR(aa));
892 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, NONCE_LEN);
893 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, NONCE_LEN);
894 if (dhss)
895 wpa_hexdump_key(MSG_DEBUG, "FILS: DHss", dhss, dhss_len);
896 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, pmk_len);
897 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-Key-Data", tmp, key_data_len);
898
899 os_memcpy(ick, tmp, *ick_len);
900 offset = *ick_len;
901 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, *ick_len);
902
903 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
904 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK", ptk->kek, ptk->kek_len);
905 offset += ptk->kek_len;
906
907 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
908 wpa_hexdump_key(MSG_DEBUG, "FILS: TK", ptk->tk, ptk->tk_len);
909 offset += ptk->tk_len;
910
911 if (fils_ft && fils_ft_len) {
912 os_memcpy(fils_ft, tmp + offset, *fils_ft_len);
913 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-FT",
914 fils_ft, *fils_ft_len);
915 offset += *fils_ft_len;
916 }
917
918 if (ptk->kdk_len) {
919 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
920 wpa_hexdump_key(MSG_DEBUG, "FILS: KDK", ptk->kdk, ptk->kdk_len);
921 }
922
923 ptk->kek2_len = 0;
924 ptk->kck2_len = 0;
925
926 os_memset(tmp, 0, sizeof(tmp));
927 ret = 0;
928 err:
929 bin_clear_free(data, data_len);
930 return ret;
931 }
932
933
fils_key_auth_sk(const u8 * ick,size_t ick_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * g_sta,size_t g_sta_len,const u8 * g_ap,size_t g_ap_len,int akmp,u8 * key_auth_sta,u8 * key_auth_ap,size_t * key_auth_len)934 int fils_key_auth_sk(const u8 *ick, size_t ick_len, const u8 *snonce,
935 const u8 *anonce, const u8 *sta_addr, const u8 *bssid,
936 const u8 *g_sta, size_t g_sta_len,
937 const u8 *g_ap, size_t g_ap_len,
938 int akmp, u8 *key_auth_sta, u8 *key_auth_ap,
939 size_t *key_auth_len)
940 {
941 const u8 *addr[6];
942 size_t len[6];
943 size_t num_elem = 4;
944 int res;
945
946 wpa_printf(MSG_DEBUG, "FILS: Key-Auth derivation: STA-MAC=" MACSTR
947 " AP-BSSID=" MACSTR, MAC2STR(sta_addr), MAC2STR(bssid));
948 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, ick_len);
949 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, NONCE_LEN);
950 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, NONCE_LEN);
951 wpa_hexdump(MSG_DEBUG, "FILS: gSTA", g_sta, g_sta_len);
952 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
953
954 /*
955 * For (Re)Association Request frame (STA->AP):
956 * Key-Auth = HMAC-Hash(ICK, SNonce || ANonce || STA-MAC || AP-BSSID
957 * [ || gSTA || gAP ])
958 */
959 addr[0] = snonce;
960 len[0] = NONCE_LEN;
961 addr[1] = anonce;
962 len[1] = NONCE_LEN;
963 addr[2] = sta_addr;
964 len[2] = ETH_ALEN;
965 addr[3] = bssid;
966 len[3] = ETH_ALEN;
967 if (g_sta && g_sta_len && g_ap && g_ap_len) {
968 addr[4] = g_sta;
969 len[4] = g_sta_len;
970 addr[5] = g_ap;
971 len[5] = g_ap_len;
972 num_elem = 6;
973 }
974
975 if (wpa_key_mgmt_sha384(akmp)) {
976 *key_auth_len = 48;
977 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
978 key_auth_sta);
979 } else if (wpa_key_mgmt_sha256(akmp)) {
980 *key_auth_len = 32;
981 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
982 key_auth_sta);
983 } else {
984 return -1;
985 }
986 if (res < 0)
987 return res;
988
989 /*
990 * For (Re)Association Response frame (AP->STA):
991 * Key-Auth = HMAC-Hash(ICK, ANonce || SNonce || AP-BSSID || STA-MAC
992 * [ || gAP || gSTA ])
993 */
994 addr[0] = anonce;
995 addr[1] = snonce;
996 addr[2] = bssid;
997 addr[3] = sta_addr;
998 if (g_sta && g_sta_len && g_ap && g_ap_len) {
999 addr[4] = g_ap;
1000 len[4] = g_ap_len;
1001 addr[5] = g_sta;
1002 len[5] = g_sta_len;
1003 }
1004
1005 if (wpa_key_mgmt_sha384(akmp))
1006 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
1007 key_auth_ap);
1008 else if (wpa_key_mgmt_sha256(akmp))
1009 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
1010 key_auth_ap);
1011 if (res < 0)
1012 return res;
1013
1014 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (STA)",
1015 key_auth_sta, *key_auth_len);
1016 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (AP)",
1017 key_auth_ap, *key_auth_len);
1018
1019 return 0;
1020 }
1021
1022 #endif /* CONFIG_FILS */
1023
1024
1025 #ifdef CONFIG_IEEE80211R
wpa_ft_mic(int key_mgmt,const u8 * kck,size_t kck_len,const u8 * sta_addr,const u8 * ap_addr,u8 transaction_seqnum,const u8 * mdie,size_t mdie_len,const u8 * ftie,size_t ftie_len,const u8 * rsnie,size_t rsnie_len,const u8 * ric,size_t ric_len,const u8 * rsnxe,size_t rsnxe_len,const struct wpabuf * extra,u8 * mic)1026 int wpa_ft_mic(int key_mgmt, const u8 *kck, size_t kck_len, const u8 *sta_addr,
1027 const u8 *ap_addr, u8 transaction_seqnum,
1028 const u8 *mdie, size_t mdie_len,
1029 const u8 *ftie, size_t ftie_len,
1030 const u8 *rsnie, size_t rsnie_len,
1031 const u8 *ric, size_t ric_len,
1032 const u8 *rsnxe, size_t rsnxe_len,
1033 const struct wpabuf *extra,
1034 u8 *mic)
1035 {
1036 const u8 *addr[11];
1037 size_t len[11];
1038 size_t i, num_elem = 0;
1039 u8 zero_mic[32];
1040 size_t mic_len, fte_fixed_len;
1041 int res;
1042
1043 if (kck_len == 16) {
1044 mic_len = 16;
1045 #ifdef CONFIG_SHA384
1046 } else if (kck_len == 24) {
1047 mic_len = 24;
1048 #endif /* CONFIG_SHA384 */
1049 #ifdef CONFIG_SHA512
1050 } else if (kck_len == 32) {
1051 mic_len = 32;
1052 #endif /* CONFIG_SHA512 */
1053 } else {
1054 wpa_printf(MSG_WARNING, "FT: Unsupported KCK length %u",
1055 (unsigned int) kck_len);
1056 return -1;
1057 }
1058
1059 fte_fixed_len = sizeof(struct rsn_ftie) - 16 + mic_len;
1060
1061 addr[num_elem] = sta_addr;
1062 len[num_elem] = ETH_ALEN;
1063 num_elem++;
1064
1065 addr[num_elem] = ap_addr;
1066 len[num_elem] = ETH_ALEN;
1067 num_elem++;
1068
1069 addr[num_elem] = &transaction_seqnum;
1070 len[num_elem] = 1;
1071 num_elem++;
1072
1073 if (rsnie) {
1074 addr[num_elem] = rsnie;
1075 len[num_elem] = rsnie_len;
1076 num_elem++;
1077 }
1078 if (mdie) {
1079 addr[num_elem] = mdie;
1080 len[num_elem] = mdie_len;
1081 num_elem++;
1082 }
1083 if (ftie) {
1084 if (ftie_len < 2 + fte_fixed_len)
1085 return -1;
1086
1087 /* IE hdr and mic_control */
1088 addr[num_elem] = ftie;
1089 len[num_elem] = 2 + 2;
1090 num_elem++;
1091
1092 /* MIC field with all zeros */
1093 os_memset(zero_mic, 0, mic_len);
1094 addr[num_elem] = zero_mic;
1095 len[num_elem] = mic_len;
1096 num_elem++;
1097
1098 /* Rest of FTIE */
1099 addr[num_elem] = ftie + 2 + 2 + mic_len;
1100 len[num_elem] = ftie_len - (2 + 2 + mic_len);
1101 num_elem++;
1102 }
1103 if (ric) {
1104 addr[num_elem] = ric;
1105 len[num_elem] = ric_len;
1106 num_elem++;
1107 }
1108
1109 if (rsnxe) {
1110 addr[num_elem] = rsnxe;
1111 len[num_elem] = rsnxe_len;
1112 num_elem++;
1113 }
1114
1115 if (extra) {
1116 addr[num_elem] = wpabuf_head(extra);
1117 len[num_elem] = wpabuf_len(extra);
1118 num_elem++;
1119 }
1120
1121 for (i = 0; i < num_elem; i++)
1122 wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", addr[i], len[i]);
1123 res = -1;
1124 #ifdef CONFIG_SHA512
1125 if (kck_len == 32) {
1126 u8 hash[SHA512_MAC_LEN];
1127
1128 if (hmac_sha512_vector(kck, kck_len, num_elem, addr, len, hash))
1129 return -1;
1130 os_memcpy(mic, hash, 32);
1131 res = 0;
1132 }
1133 #endif /* CONFIG_SHA384 */
1134 #ifdef CONFIG_SHA384
1135 if (kck_len == 24) {
1136 u8 hash[SHA384_MAC_LEN];
1137
1138 if (hmac_sha384_vector(kck, kck_len, num_elem, addr, len, hash))
1139 return -1;
1140 os_memcpy(mic, hash, 24);
1141 res = 0;
1142 }
1143 #endif /* CONFIG_SHA384 */
1144 if (kck_len == 16 && key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1145 u8 hash[SHA256_MAC_LEN];
1146
1147 if (hmac_sha256_vector(kck, kck_len, num_elem, addr, len, hash))
1148 return -1;
1149 os_memcpy(mic, hash, 16);
1150 res = 0;
1151 }
1152 if (kck_len == 16 && key_mgmt != WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
1153 omac1_aes_128_vector(kck, num_elem, addr, len, mic) == 0)
1154 res = 0;
1155
1156 return res;
1157 }
1158
1159
wpa_ft_parse_ftie(const u8 * ie,size_t ie_len,struct wpa_ft_ies * parse,const u8 * opt)1160 static int wpa_ft_parse_ftie(const u8 *ie, size_t ie_len,
1161 struct wpa_ft_ies *parse, const u8 *opt)
1162 {
1163 const u8 *end, *pos;
1164 u8 link_id;
1165
1166 pos = opt;
1167 end = ie + ie_len;
1168 wpa_hexdump(MSG_DEBUG, "FT: Parse FTE subelements", pos, end - pos);
1169
1170 while (end - pos >= 2) {
1171 u8 id, len;
1172
1173 id = *pos++;
1174 len = *pos++;
1175 if (len > end - pos) {
1176 wpa_printf(MSG_DEBUG, "FT: Truncated subelement");
1177 return -1;
1178 }
1179
1180 switch (id) {
1181 case FTIE_SUBELEM_R1KH_ID:
1182 if (len != FT_R1KH_ID_LEN) {
1183 wpa_printf(MSG_DEBUG,
1184 "FT: Invalid R1KH-ID length in FTIE: %d",
1185 len);
1186 return -1;
1187 }
1188 parse->r1kh_id = pos;
1189 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID",
1190 parse->r1kh_id, FT_R1KH_ID_LEN);
1191 break;
1192 case FTIE_SUBELEM_GTK:
1193 wpa_printf(MSG_DEBUG, "FT: GTK");
1194 parse->gtk = pos;
1195 parse->gtk_len = len;
1196 break;
1197 case FTIE_SUBELEM_R0KH_ID:
1198 if (len < 1 || len > FT_R0KH_ID_MAX_LEN) {
1199 wpa_printf(MSG_DEBUG,
1200 "FT: Invalid R0KH-ID length in FTIE: %d",
1201 len);
1202 return -1;
1203 }
1204 parse->r0kh_id = pos;
1205 parse->r0kh_id_len = len;
1206 wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID",
1207 parse->r0kh_id, parse->r0kh_id_len);
1208 break;
1209 case FTIE_SUBELEM_IGTK:
1210 wpa_printf(MSG_DEBUG, "FT: IGTK");
1211 parse->igtk = pos;
1212 parse->igtk_len = len;
1213 break;
1214 #ifdef CONFIG_OCV
1215 case FTIE_SUBELEM_OCI:
1216 parse->oci = pos;
1217 parse->oci_len = len;
1218 wpa_hexdump(MSG_DEBUG, "FT: OCI",
1219 parse->oci, parse->oci_len);
1220 break;
1221 #endif /* CONFIG_OCV */
1222 case FTIE_SUBELEM_BIGTK:
1223 wpa_printf(MSG_DEBUG, "FT: BIGTK");
1224 parse->bigtk = pos;
1225 parse->bigtk_len = len;
1226 break;
1227 case FTIE_SUBELEM_MLO_GTK:
1228 if (len < 2 + 1 + 1 + 8) {
1229 wpa_printf(MSG_DEBUG,
1230 "FT: Too short MLO GTK in FTE");
1231 return -1;
1232 }
1233 link_id = pos[2] & 0x0f;
1234 wpa_printf(MSG_DEBUG, "FT: MLO GTK (Link ID %u)",
1235 link_id);
1236 if (link_id >= MAX_NUM_MLD_LINKS)
1237 break;
1238 parse->valid_mlo_gtks |= BIT(link_id);
1239 parse->mlo_gtk[link_id] = pos;
1240 parse->mlo_gtk_len[link_id] = len;
1241 break;
1242 case FTIE_SUBELEM_MLO_IGTK:
1243 if (len < 2 + 6 + 1 + 1) {
1244 wpa_printf(MSG_DEBUG,
1245 "FT: Too short MLO IGTK in FTE");
1246 return -1;
1247 }
1248 link_id = pos[2 + 6] & 0x0f;
1249 wpa_printf(MSG_DEBUG, "FT: MLO IGTK (Link ID %u)",
1250 link_id);
1251 if (link_id >= MAX_NUM_MLD_LINKS)
1252 break;
1253 parse->valid_mlo_igtks |= BIT(link_id);
1254 parse->mlo_igtk[link_id] = pos;
1255 parse->mlo_igtk_len[link_id] = len;
1256 break;
1257 case FTIE_SUBELEM_MLO_BIGTK:
1258 if (len < 2 + 6 + 1 + 1) {
1259 wpa_printf(MSG_DEBUG,
1260 "FT: Too short MLO BIGTK in FTE");
1261 return -1;
1262 }
1263 link_id = pos[2 + 6] & 0x0f;
1264 wpa_printf(MSG_DEBUG, "FT: MLO BIGTK (Link ID %u)",
1265 link_id);
1266 if (link_id >= MAX_NUM_MLD_LINKS)
1267 break;
1268 parse->valid_mlo_bigtks |= BIT(link_id);
1269 parse->mlo_bigtk[link_id] = pos;
1270 parse->mlo_bigtk_len[link_id] = len;
1271 break;
1272 default:
1273 wpa_printf(MSG_DEBUG, "FT: Unknown subelem id %u", id);
1274 break;
1275 }
1276
1277 pos += len;
1278 }
1279
1280 return 0;
1281 }
1282
1283
wpa_ft_parse_fte(int key_mgmt,const u8 * ie,size_t len,struct wpa_ft_ies * parse)1284 static int wpa_ft_parse_fte(int key_mgmt, const u8 *ie, size_t len,
1285 struct wpa_ft_ies *parse)
1286 {
1287 size_t mic_len;
1288 u8 mic_len_info;
1289 const u8 *pos = ie;
1290 const u8 *end = pos + len;
1291
1292 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control", pos, 2);
1293 parse->fte_rsnxe_used = pos[0] & FTE_MIC_CTRL_RSNXE_USED;
1294 mic_len_info = (pos[0] & FTE_MIC_CTRL_MIC_LEN_MASK) >>
1295 FTE_MIC_CTRL_MIC_LEN_SHIFT;
1296 parse->fte_elem_count = pos[1];
1297 pos += 2;
1298
1299 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1300 switch (mic_len_info) {
1301 case FTE_MIC_LEN_16:
1302 mic_len = 16;
1303 break;
1304 case FTE_MIC_LEN_24:
1305 mic_len = 24;
1306 break;
1307 case FTE_MIC_LEN_32:
1308 mic_len = 32;
1309 break;
1310 default:
1311 wpa_printf(MSG_DEBUG,
1312 "FT: Unknown MIC Length subfield value %u",
1313 mic_len_info);
1314 return -1;
1315 }
1316 } else {
1317 mic_len = wpa_key_mgmt_sha384(key_mgmt) ? 24 : 16;
1318 }
1319 if (mic_len > (size_t) (end - pos)) {
1320 wpa_printf(MSG_DEBUG, "FT: No room for %zu octet MIC in FTE",
1321 mic_len);
1322 return -1;
1323 }
1324 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC", pos, mic_len);
1325 parse->fte_mic = pos;
1326 parse->fte_mic_len = mic_len;
1327 pos += mic_len;
1328
1329 if (2 * WPA_NONCE_LEN > end - pos)
1330 return -1;
1331 parse->fte_anonce = pos;
1332 wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
1333 parse->fte_anonce, WPA_NONCE_LEN);
1334 pos += WPA_NONCE_LEN;
1335 parse->fte_snonce = pos;
1336 wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
1337 parse->fte_snonce, WPA_NONCE_LEN);
1338 pos += WPA_NONCE_LEN;
1339
1340 return wpa_ft_parse_ftie(ie, len, parse, pos);
1341 }
1342
1343
wpa_ft_parse_ies(const u8 * ies,size_t ies_len,struct wpa_ft_ies * parse,int key_mgmt,bool reassoc_resp)1344 int wpa_ft_parse_ies(const u8 *ies, size_t ies_len, struct wpa_ft_ies *parse,
1345 int key_mgmt, bool reassoc_resp)
1346 {
1347 const u8 *end, *pos;
1348 struct wpa_ie_data data;
1349 int ret;
1350 int prot_ie_count = 0;
1351 const u8 *fte = NULL;
1352 size_t fte_len = 0;
1353 bool is_fte = false;
1354 struct ieee802_11_elems elems;
1355
1356 os_memset(parse, 0, sizeof(*parse));
1357 if (ies == NULL)
1358 return 0;
1359
1360 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) == ParseFailed) {
1361 wpa_printf(MSG_DEBUG, "FT: Failed to parse elements");
1362 goto fail;
1363 }
1364
1365 pos = ies;
1366 end = ies + ies_len;
1367 while (end - pos >= 2) {
1368 u8 id, len;
1369
1370 id = *pos++;
1371 len = *pos++;
1372 if (len > end - pos)
1373 break;
1374
1375 if (id != WLAN_EID_FAST_BSS_TRANSITION &&
1376 id != WLAN_EID_FRAGMENT)
1377 is_fte = false;
1378
1379 switch (id) {
1380 case WLAN_EID_RSN:
1381 wpa_hexdump(MSG_DEBUG, "FT: RSNE", pos, len);
1382 parse->rsn = pos;
1383 parse->rsn_len = len;
1384 ret = wpa_parse_wpa_ie_rsn(parse->rsn - 2,
1385 parse->rsn_len + 2,
1386 &data);
1387 if (ret < 0) {
1388 wpa_printf(MSG_DEBUG, "FT: Failed to parse "
1389 "RSN IE: %d", ret);
1390 goto fail;
1391 }
1392 parse->rsn_capab = data.capabilities;
1393 if (data.num_pmkid == 1 && data.pmkid)
1394 parse->rsn_pmkid = data.pmkid;
1395 parse->key_mgmt = data.key_mgmt;
1396 parse->pairwise_cipher = data.pairwise_cipher;
1397 if (!key_mgmt)
1398 key_mgmt = parse->key_mgmt;
1399 break;
1400 case WLAN_EID_RSNX:
1401 wpa_hexdump(MSG_DEBUG, "FT: RSNXE", pos, len);
1402 if (len < 1)
1403 break;
1404 parse->rsnxe = pos;
1405 parse->rsnxe_len = len;
1406 break;
1407 case WLAN_EID_MOBILITY_DOMAIN:
1408 wpa_hexdump(MSG_DEBUG, "FT: MDE", pos, len);
1409 if (len < sizeof(struct rsn_mdie))
1410 goto fail;
1411 parse->mdie = pos;
1412 parse->mdie_len = len;
1413 break;
1414 case WLAN_EID_FAST_BSS_TRANSITION:
1415 wpa_hexdump(MSG_DEBUG, "FT: FTE", pos, len);
1416 /* The first two octets (MIC Control field) is in the
1417 * same offset for all cases, but the second field (MIC)
1418 * has variable length with three different values.
1419 * In particular the FT-SAE-EXT-KEY is inconvinient to
1420 * parse, so try to handle this in pieces instead of
1421 * using the struct rsn_ftie* definitions. */
1422
1423 if (len < 2)
1424 goto fail;
1425 prot_ie_count = pos[1]; /* Element Count field in
1426 * MIC Control */
1427 is_fte = true;
1428 fte = pos;
1429 fte_len = len;
1430 break;
1431 case WLAN_EID_FRAGMENT:
1432 if (is_fte) {
1433 wpa_hexdump(MSG_DEBUG, "FT: FTE fragment",
1434 pos, len);
1435 fte_len += 2 + len;
1436 }
1437 break;
1438 case WLAN_EID_TIMEOUT_INTERVAL:
1439 wpa_hexdump(MSG_DEBUG, "FT: Timeout Interval",
1440 pos, len);
1441 if (len != 5)
1442 break;
1443 parse->tie = pos;
1444 parse->tie_len = len;
1445 break;
1446 case WLAN_EID_RIC_DATA:
1447 if (parse->ric == NULL)
1448 parse->ric = pos - 2;
1449 break;
1450 }
1451
1452 pos += len;
1453 }
1454
1455 if (fte) {
1456 int res;
1457
1458 if (fte_len < 255) {
1459 res = wpa_ft_parse_fte(key_mgmt, fte, fte_len, parse);
1460 } else {
1461 parse->fte_buf = ieee802_11_defrag(fte, fte_len, false);
1462 if (!parse->fte_buf)
1463 goto fail;
1464 res = wpa_ft_parse_fte(key_mgmt,
1465 wpabuf_head(parse->fte_buf),
1466 wpabuf_len(parse->fte_buf),
1467 parse);
1468 }
1469 if (res < 0)
1470 goto fail;
1471
1472 /* FTE might be fragmented. If it is, the separate Fragment
1473 * elements are included in MIC calculation as full elements. */
1474 parse->ftie = fte;
1475 parse->ftie_len = fte_len;
1476 }
1477
1478 if (prot_ie_count == 0)
1479 return 0; /* no MIC */
1480
1481 /*
1482 * Check that the protected IE count matches with IEs included in the
1483 * frame.
1484 */
1485 if (reassoc_resp && elems.basic_mle) {
1486 unsigned int link_id;
1487
1488 /* TODO: This count should be done based on all _requested_,
1489 * not _accepted_ links. */
1490 for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
1491 if (parse->mlo_gtk[link_id]) {
1492 if (parse->rsn)
1493 prot_ie_count--;
1494 if (parse->rsnxe)
1495 prot_ie_count--;
1496 }
1497 }
1498 } else {
1499 if (parse->rsn)
1500 prot_ie_count--;
1501 if (parse->rsnxe)
1502 prot_ie_count--;
1503 }
1504 if (parse->mdie)
1505 prot_ie_count--;
1506 if (parse->ftie)
1507 prot_ie_count--;
1508 if (prot_ie_count < 0) {
1509 wpa_printf(MSG_DEBUG, "FT: Some required IEs not included in "
1510 "the protected IE count");
1511 goto fail;
1512 }
1513
1514 if (prot_ie_count == 0 && parse->ric) {
1515 wpa_printf(MSG_DEBUG, "FT: RIC IE(s) in the frame, but not "
1516 "included in protected IE count");
1517 goto fail;
1518 }
1519
1520 /* Determine the end of the RIC IE(s) */
1521 if (parse->ric) {
1522 pos = parse->ric;
1523 while (end - pos >= 2 && 2 + pos[1] <= end - pos &&
1524 prot_ie_count) {
1525 prot_ie_count--;
1526 pos += 2 + pos[1];
1527 }
1528 parse->ric_len = pos - parse->ric;
1529 }
1530 if (prot_ie_count) {
1531 wpa_printf(MSG_DEBUG, "FT: %d protected IEs missing from "
1532 "frame", (int) prot_ie_count);
1533 goto fail;
1534 }
1535
1536 return 0;
1537
1538 fail:
1539 wpa_ft_parse_ies_free(parse);
1540 return -1;
1541 }
1542
1543
wpa_ft_parse_ies_free(struct wpa_ft_ies * parse)1544 void wpa_ft_parse_ies_free(struct wpa_ft_ies *parse)
1545 {
1546 if (!parse)
1547 return;
1548 wpabuf_free(parse->fte_buf);
1549 parse->fte_buf = NULL;
1550 }
1551
1552 #endif /* CONFIG_IEEE80211R */
1553
1554
1555 #ifdef CONFIG_PASN
1556
1557 /*
1558 * pasn_use_sha384 - Should SHA384 be used or SHA256
1559 *
1560 * @akmp: Authentication and key management protocol
1561 * @cipher: The cipher suite
1562 *
1563 * According to IEEE Std 802.11-2024, 12.13.8 (PTKSA derivation with PASN
1564 * authentication), the hash algorithm to use is the
1565 * hash algorithm defined for the Base AKM (see Table 9-190 (AKM suite
1566 * selectors)). When there is no Base AKM, the hash algorithm is selected based
1567 * on the pairwise cipher suite provided in the RSNE by the AP in the second
1568 * PASN frame. SHA-256 is used as the hash algorithm, except for the ciphers
1569 * 00-0F-AC:9 and 00-0F-AC:10 for which SHA-384 is used.
1570 */
pasn_use_sha384(int akmp,int cipher)1571 static bool pasn_use_sha384(int akmp, int cipher)
1572 {
1573 return ((akmp == WPA_KEY_MGMT_PASN || akmp == WPA_KEY_MGMT_EPPKE) &&
1574 (cipher == WPA_CIPHER_CCMP_256 ||
1575 cipher == WPA_CIPHER_GCMP_256)) ||
1576 wpa_key_mgmt_sha384(akmp);
1577 }
1578
1579
1580 /**
1581 * pasn_select_hash_alg - Select hash algorithm for PTK derivation
1582 * @akmp: Authentication and key management protocol
1583 * @cipher: The cipher suite
1584 * @pmk_len: PMK length in octets
1585 *
1586 * According to IEEE Std 802.11-2024, Table 9-190 (AKM suite selectors), AKMs
1587 * 00-0F-AC:24 and 00-0F-AC:25 have the length of the PMK, the length
1588 * of the SAE key confirmation key, SAE-KCK, and PTK-KCK, and the length of
1589 * PTK-KEK depending on the hash algorithm specified in 12.4.2 (see 12.7.1.3
1590 * and 12.7.3), i.e, the hash algorithm depends on the prime length associated
1591 * with the selected group per Table 12-1 (Hash algorithm based on length of
1592 * prime).
1593 */
pasn_select_hash_alg(int akmp,int cipher,size_t pmk_len)1594 static enum rsn_hash_alg pasn_select_hash_alg(int akmp, int cipher,
1595 size_t pmk_len)
1596 {
1597 #ifdef CONFIG_SAE
1598 if (wpa_key_mgmt_sae_ext_key(akmp)) {
1599 if (pmk_len == 64)
1600 return RSN_HASH_SHA512;
1601 if (pmk_len == 48)
1602 return RSN_HASH_SHA384;
1603 }
1604 #endif /* CONFIG_SAE */
1605
1606 if (pasn_use_sha384(akmp, cipher))
1607 return RSN_HASH_SHA384;
1608
1609 return RSN_HASH_SHA256;
1610 }
1611
1612
1613 /**
1614 * pasn_pmk_to_ptk - Calculate PASN/EPPKE PTK from PMK, addresses, etc.
1615 * @pmk: Pairwise master key
1616 * @pmk_len: Length of PMK
1617 * @spa: For EPPKE authentication, non-AP MLD MAC address is used for MLO. For
1618 * PASN authentication or EPPKE authentication for non-MLO, non-AP STA link
1619 * MAC address is used.
1620 * @bssid: For EPPKE authentication, AP MLD MAC address is used for MLO. For
1621 * PASN authentication or EPPKE authentication for non-MLO, AP BSSID is
1622 * used.
1623 * @dhss: Is the shared secret (DHss) derived from the PASN ephemeral key
1624 * exchange encoded as an octet string
1625 * @dhss_len: The length of dhss in octets
1626 * @ptk: Buffer for pairwise transient key
1627 * @akmp: Negotiated AKM
1628 * @cipher: Negotiated pairwise cipher
1629 * @kdk_len: the length in octets that should be derived for HTLK. Can be zero.
1630 * @kek_len: The length in octets that should be derived for KEK. Can be zero.
1631 * @alg: Output variable for indicating the selected hash algorithm
1632 * @is_eppke: EPPKE authentication
1633 * Returns: 0 on success, -1 on failure
1634 */
pasn_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * bssid,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,int akmp,int cipher,size_t kdk_len,size_t kek_len,enum rsn_hash_alg * alg,bool is_eppke)1635 int pasn_pmk_to_ptk(const u8 *pmk, size_t pmk_len,
1636 const u8 *spa, const u8 *bssid,
1637 const u8 *dhss, size_t dhss_len,
1638 struct wpa_ptk *ptk, int akmp, int cipher,
1639 size_t kdk_len, size_t kek_len, enum rsn_hash_alg *alg,
1640 bool is_eppke)
1641 {
1642 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
1643 WPA_KDK_MAX_LEN];
1644 const u8 *pos;
1645 u8 *data;
1646 size_t data_len, ptk_len;
1647 int ret = -1;
1648 const char *label = is_eppke ? "EPPKE PTK Derivation" :
1649 "PASN PTK Derivation";
1650
1651 if (!pmk || !pmk_len) {
1652 wpa_printf(MSG_ERROR, "PASN: No PMK set for PTK derivation");
1653 return -1;
1654 }
1655
1656 if (!dhss || !dhss_len) {
1657 wpa_printf(MSG_ERROR, "PASN: No DHss set for PTK derivation");
1658 return -1;
1659 }
1660
1661 /*
1662 * Use "EPPKE PTK Derivation" instead of “PASN PTK Derivation” for
1663 * EPPKE Authentication per IEEE P802.11bi/D4.0, 12.16.9.3.4 (PTKSA
1664 * derivation and MIC computation with EPPKE authentication). For EPPKE
1665 * MLO, the non-AP MLD MAC address is used instead of the SPA and the
1666 * AP MLD MAC address instead of the BSSID.
1667 *
1668 * PASN-PTK = KDF(PMK, “PASN PTK Derivation”, SPA || BSSID || DHss)
1669 *
1670 * KCK = L(PASN-PTK, 0, 256)
1671 * TK = L(PASN-PTK, 256, TK_bits)
1672 * KDK = L(PASN-PTK, 256 + TK_bits, kdk_len * 8)
1673 */
1674 data_len = 2 * ETH_ALEN + dhss_len;
1675 data = os_zalloc(data_len);
1676 if (!data)
1677 return -1;
1678
1679 os_memcpy(data, spa, ETH_ALEN);
1680 os_memcpy(data + ETH_ALEN, bssid, ETH_ALEN);
1681 os_memcpy(data + 2 * ETH_ALEN, dhss, dhss_len);
1682
1683 ptk->kck_len = WPA_PASN_KCK_LEN;
1684 ptk->tk_len = wpa_cipher_key_len(cipher);
1685 ptk->kdk_len = kdk_len;
1686 ptk->kek_len = kek_len;
1687 ptk->kek2_len = 0;
1688 ptk->kck2_len = 0;
1689
1690 if (ptk->tk_len == 0) {
1691 wpa_printf(MSG_ERROR,
1692 "PASN: Unsupported cipher (0x%x) used in PTK derivation",
1693 cipher);
1694 goto err;
1695 }
1696
1697 ptk_len = ptk->kck_len + ptk->tk_len + ptk->kdk_len + ptk->kek_len;
1698 if (ptk_len > sizeof(tmp))
1699 goto err;
1700
1701 *alg = pasn_select_hash_alg(akmp, cipher, pmk_len);
1702
1703 switch (*alg) {
1704 case RSN_HASH_SHA512:
1705 #ifdef CONFIG_SHA512
1706 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA512");
1707
1708 if (sha512_prf(pmk, pmk_len, label, data, data_len, tmp,
1709 ptk_len) < 0)
1710 goto err;
1711 break;
1712 #endif
1713 case RSN_HASH_SHA384:
1714 #ifdef CONFIG_SHA384
1715 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA384");
1716
1717 if (sha384_prf(pmk, pmk_len, label, data, data_len, tmp,
1718 ptk_len) < 0)
1719 goto err;
1720 break;
1721 #endif
1722 case RSN_HASH_SHA256:
1723 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA256");
1724
1725 if (sha256_prf(pmk, pmk_len, label, data, data_len, tmp,
1726 ptk_len) < 0)
1727 goto err;
1728 break;
1729 default:
1730 wpa_printf(MSG_DEBUG, "PASN: Unsupported hash algorithm %d",
1731 *alg);
1732 goto err;
1733 }
1734
1735 wpa_printf(MSG_DEBUG,
1736 "PASN: PTK derivation: SPA=" MACSTR " BSSID=" MACSTR,
1737 MAC2STR(spa), MAC2STR(bssid));
1738
1739 wpa_hexdump_key(MSG_DEBUG, "PASN: DHss", dhss, dhss_len);
1740 wpa_hexdump_key(MSG_DEBUG, "PASN: PMK", pmk, pmk_len);
1741 wpa_hexdump_key(MSG_DEBUG, "PASN: PASN-PTK", tmp, ptk_len);
1742
1743 os_memcpy(ptk->kck, tmp, WPA_PASN_KCK_LEN);
1744 wpa_hexdump_key(MSG_DEBUG, "PASN: KCK:", ptk->kck, WPA_PASN_KCK_LEN);
1745 pos = &tmp[WPA_PASN_KCK_LEN];
1746
1747 if (kek_len) {
1748 os_memcpy(ptk->kek, pos, kek_len);
1749 wpa_hexdump_key(MSG_DEBUG, "PASN: KEK:",
1750 ptk->kek, ptk->kek_len);
1751 pos += kek_len;
1752 }
1753
1754 os_memcpy(ptk->tk, pos, ptk->tk_len);
1755 wpa_hexdump_key(MSG_DEBUG, "PASN: TK:", ptk->tk, ptk->tk_len);
1756 pos += ptk->tk_len;
1757
1758 if (kdk_len) {
1759 os_memcpy(ptk->kdk, pos, ptk->kdk_len);
1760 wpa_hexdump_key(MSG_DEBUG, "PASN: KDK:",
1761 ptk->kdk, ptk->kdk_len);
1762 }
1763
1764 ptk->ptk_len = ptk_len;
1765 ptk->hash_alg = *alg;
1766 forced_memzero(tmp, sizeof(tmp));
1767 ret = 0;
1768 err:
1769 bin_clear_free(data, data_len);
1770 return ret;
1771 }
1772
1773
1774 /*
1775 * pasn_mic_len - Returns the MIC length for PASN authentication
1776 * @alg: Selected hash algorithm from pasn_pmk_to_ptk()
1777 */
pasn_mic_len(enum rsn_hash_alg alg)1778 size_t pasn_mic_len(enum rsn_hash_alg alg)
1779 {
1780 switch (alg) {
1781 case RSN_HASH_SHA512:
1782 return 32;
1783 case RSN_HASH_SHA384:
1784 return 24;
1785 case RSN_HASH_SHA256:
1786 default:
1787 return 16;
1788 }
1789 }
1790
1791
1792 /**
1793 * wpa_ltf_keyseed - Compute LTF keyseed from KDK
1794 * @ptk: Buffer that holds pairwise transient key
1795 * @akmp: Negotiated AKM
1796 * @cipher: Negotiated pairwise cipher
1797 * Returns: 0 on success, -1 on failure
1798 */
wpa_ltf_keyseed(struct wpa_ptk * ptk,int akmp,int cipher)1799 int wpa_ltf_keyseed(struct wpa_ptk *ptk, int akmp, int cipher)
1800 {
1801 u8 *buf;
1802 size_t buf_len;
1803 u8 hash[SHA384_MAC_LEN];
1804 const u8 *kdk = ptk->kdk;
1805 size_t kdk_len = ptk->kdk_len;
1806 const char *label = "Secure LTF key seed";
1807
1808 if (!kdk || !kdk_len) {
1809 wpa_printf(MSG_ERROR, "WPA: No KDK for LTF keyseed generation");
1810 return -1;
1811 }
1812
1813 buf = (u8 *)label;
1814 buf_len = os_strlen(label);
1815
1816 if (pasn_use_sha384(akmp, cipher)) {
1817 wpa_printf(MSG_DEBUG,
1818 "WPA: Secure LTF keyseed using HMAC-SHA384");
1819
1820 if (hmac_sha384(kdk, kdk_len, buf, buf_len, hash)) {
1821 wpa_printf(MSG_ERROR,
1822 "WPA: HMAC-SHA384 compute failed");
1823 return -1;
1824 }
1825 os_memcpy(ptk->ltf_keyseed, hash, SHA384_MAC_LEN);
1826 ptk->ltf_keyseed_len = SHA384_MAC_LEN;
1827 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1828 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1829
1830 } else {
1831 wpa_printf(MSG_DEBUG, "WPA: LTF keyseed using HMAC-SHA256");
1832
1833 if (hmac_sha256(kdk, kdk_len, buf, buf_len, hash)) {
1834 wpa_printf(MSG_ERROR,
1835 "WPA: HMAC-SHA256 compute failed");
1836 return -1;
1837 }
1838 os_memcpy(ptk->ltf_keyseed, hash, SHA256_MAC_LEN);
1839 ptk->ltf_keyseed_len = SHA256_MAC_LEN;
1840 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1841 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1842 }
1843
1844 return 0;
1845 }
1846
1847
1848 #ifdef CONFIG_IEEE8021X_AUTH
1849
wpa_auth_802_1x_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * aa,const u8 * snonce,const u8 * anonce,int akmp,int cipher,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,size_t kdk_len)1850 int wpa_auth_802_1x_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa,
1851 const u8 *aa, const u8 *snonce, const u8 *anonce,
1852 int akmp, int cipher, const u8 *dhss,
1853 size_t dhss_len, struct wpa_ptk *ptk,
1854 size_t kdk_len)
1855 {
1856 return wpa_pmk_to_ptk(pmk, pmk_len, "Pairwise key expansion",
1857 spa, aa, snonce, anonce, ptk, akmp,
1858 cipher, dhss, dhss_len, kdk_len);
1859 }
1860
1861
1862 /**
1863 * wpa_auth_8021x_mic - Calculate IEEE 802.1X in Authentication frames MIC
1864 * @akmp: Negotiated key management protocol
1865 * @kck: The key confirmation key from 802.1X exchange
1866 * @kck_len: KCK length in octets
1867 * @addr1: Authenticator address
1868 * @addr2: Supplicant address
1869 * @data: This should hold the RSNE + RSNXE.
1870 * For a MIC included by the AP with EAP-Success and the second
1871 * Authentication frame if a PMKSA was identified via a PMKID included in
1872 * the first Authentication frame, this holds the Beacon frame RSNE+RSNXE.
1873 * For a MIC included by the non-AP STA in the (Re)Association Request
1874 * frame, this holds the RSNE and RSNXE sent by the non-AP STA.
1875 * @data_len: The length of data
1876 * @frame: For a MIC included by the AP in EAP-Success and the second
1877 * Authentication frame if a PMKSA was identified via a PMKID included in
1878 * the first Authentication frame, this holds the body of the
1879 * Authentication frame including the MIC element with the octets in the
1880 * MIC field of the MIC element set to 0, else NULL
1881 * @frame_len: The length of frame
1882 * @mic: Buffer to hold the MIC on success. Must be large enough to handle the
1883 * maximal MIC length.
1884 * Returns: 0 on success, -1 on failure
1885 *
1886 * HMAC-HASH (PTK-KCK, AA || SPA || RSNE || RSNXE || Frame Data)
1887 */
wpa_auth_8021x_mic(int akmp,const u8 * kck,size_t kck_len,const u8 * addr1,const u8 * addr2,const u8 * data,size_t data_len,const u8 * frame,size_t frame_len,u8 * mic)1888 int wpa_auth_8021x_mic(int akmp, const u8 *kck, size_t kck_len, const u8 *addr1,
1889 const u8 *addr2, const u8 *data, size_t data_len,
1890 const u8 *frame, size_t frame_len, u8 *mic)
1891 {
1892 size_t mic_len;
1893 u8 *buf;
1894 int ret = -1;
1895 size_t buf_len = 2 * ETH_ALEN + data_len + frame_len;
1896
1897 if (!kck) {
1898 wpa_printf(MSG_INFO, "802.1X: No KCK for MIC calculation");
1899 return -1;
1900 }
1901
1902 if (!data || !data_len) {
1903 wpa_printf(MSG_INFO,
1904 "802.1X: Invalid data for MIC calculation");
1905 return -1;
1906 }
1907
1908 buf = os_zalloc(buf_len);
1909 if (!buf)
1910 return -1;
1911
1912 wpa_printf(MSG_DEBUG, "802.1X MIC calculation");
1913 wpa_printf(MSG_DEBUG, "addr1: " MACSTR, MAC2STR(addr1));
1914 wpa_printf(MSG_DEBUG, "addr2: " MACSTR, MAC2STR(addr2));
1915
1916 os_memcpy(buf, addr1, ETH_ALEN);
1917 os_memcpy(buf + ETH_ALEN, addr2, ETH_ALEN);
1918
1919 wpa_hexdump_key(MSG_DEBUG, "MIC: data", data, data_len);
1920 os_memcpy(buf + 2 * ETH_ALEN, data, data_len);
1921
1922 wpa_hexdump_key(MSG_DEBUG, "MIC: KCK", kck, kck_len);
1923
1924 if (frame) {
1925 wpa_hexdump_key(MSG_MSGDUMP, "802.1X: MIC: frame",
1926 frame, frame_len);
1927 os_memcpy(buf + 2 * ETH_ALEN + data_len, frame, frame_len);
1928 }
1929
1930 wpa_hexdump_key(MSG_DEBUG, "MIC: buf", buf, buf_len);
1931 if (wpa_key_mgmt_sha384(akmp)) {
1932 wpa_printf(MSG_DEBUG, "MIC: HMAC-SHA384");
1933 mic_len = 24;
1934
1935 if (hmac_sha384(kck, kck_len, buf, buf_len, mic) < 0)
1936 goto out;
1937 } else {
1938 wpa_printf(MSG_DEBUG, "MIC: HMAC-SHA256");
1939 mic_len = 16;
1940
1941 if (hmac_sha256(kck, kck_len, buf, buf_len, mic) < 0)
1942 goto out;
1943 }
1944
1945 wpa_hexdump_key(MSG_DEBUG, "802.1X: Calculated MIC", mic, mic_len);
1946 ret = 0;
1947 out:
1948 bin_clear_free(buf, buf_len);
1949 return ret;
1950 }
1951
1952 #endif /* CONFIG_IEEE8021X_AUTH */
1953
1954
1955 /**
1956 * pasn_mic - Calculate PASN MIC
1957 * @alg: Selected hash algorithm from pasn_pmk_to_ptk()
1958 * @kck: The key confirmation key for the PASN PTKSA
1959 * @kck_len: KCK length in octets
1960 * @addr1: For the 2nd PASN/EPPKE frame supplicant address is used for non-MLO;
1961 * for MLO, 2nd EPPKE authentication to use non-AP MLD MAC address.
1962 * For the 3rd PASN/EPPKE frame BSSID is used for non-MLO; for MLO, 3rd
1963 * EPPKE authentication to use AP MLD MAC address as per
1964 * @addr2: For the 2nd PASN/EPPKE frame BSSID is used for non-MLO; for MLO, 2nd
1965 * EPPKE authentication to use AP MLD MAC address. For the 3rd PASN/EPPKE
1966 * frame supplicant address is used for non-MLO; for MLO, 3rd EPPKE
1967 * Authentication frame to use non-AP MLD MAC address.
1968 * @data: For calculating the MIC for the 2nd PASN frame, this should hold the
1969 * Beacon frame RSNE + RSNXE. For calculating the MIC for the 3rd PASN
1970 * frame, this should hold the hash of the body of the PASN 1st frame.
1971 * @data_len: The length of data
1972 * @frame: The body of the PASN frame including the MIC element with the octets
1973 * in the MIC field of the MIC element set to 0.
1974 * @frame_len: The length of frame
1975 * @mic: Buffer to hold the MIC on success. Should be big enough to handle the
1976 * maximal MIC length
1977 * Returns: 0 on success, -1 on failure
1978 */
pasn_mic(enum rsn_hash_alg alg,const u8 * kck,size_t kck_len,const u8 * addr1,const u8 * addr2,const u8 * data,size_t data_len,const u8 * frame,size_t frame_len,u8 * mic)1979 int pasn_mic(enum rsn_hash_alg alg, const u8 *kck, size_t kck_len,
1980 const u8 *addr1, const u8 *addr2,
1981 const u8 *data, size_t data_len,
1982 const u8 *frame, size_t frame_len, u8 *mic)
1983 {
1984 u8 *buf;
1985 u8 hash[SHA512_MAC_LEN];
1986 size_t buf_len = 2 * ETH_ALEN + data_len + frame_len;
1987 int ret = -1;
1988 size_t mic_len;
1989
1990 if (!kck) {
1991 wpa_printf(MSG_ERROR, "PASN: No KCK for MIC calculation");
1992 return -1;
1993 }
1994
1995 if (kck_len != WPA_PASN_KCK_LEN) {
1996 wpa_printf(MSG_ERROR,
1997 "PASN: Unexpected KCK length %zu for MIC calculation",
1998 kck_len);
1999 return -1;
2000 }
2001
2002 if (!data || !data_len) {
2003 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
2004 return -1;
2005 }
2006
2007 if (!frame || !frame_len) {
2008 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
2009 return -1;
2010 }
2011
2012 buf = os_zalloc(buf_len);
2013 if (!buf)
2014 return -1;
2015
2016 os_memcpy(buf, addr1, ETH_ALEN);
2017 os_memcpy(buf + ETH_ALEN, addr2, ETH_ALEN);
2018
2019 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: data", data, data_len);
2020 os_memcpy(buf + 2 * ETH_ALEN, data, data_len);
2021
2022 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: frame", frame, frame_len);
2023 os_memcpy(buf + 2 * ETH_ALEN + data_len, frame, frame_len);
2024
2025 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: KCK", kck, kck_len);
2026 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: buf", buf, buf_len);
2027
2028 mic_len = pasn_mic_len(alg);
2029
2030 switch (alg) {
2031 #ifdef CONFIG_SHA512
2032 case RSN_HASH_SHA512:
2033 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA512");
2034 if (hmac_sha512(kck, kck_len, buf, buf_len, hash))
2035 goto err;
2036 break;
2037 #endif /* CONFIG_SHA512 */
2038 #ifdef CONFIG_SHA384
2039 case RSN_HASH_SHA384:
2040 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA384");
2041 if (hmac_sha384(kck, kck_len, buf, buf_len, hash))
2042 goto err;
2043 break;
2044 #endif /* CONFIG_SHA384 */
2045 case RSN_HASH_SHA256:
2046 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA256");
2047 if (hmac_sha256(kck, kck_len, buf, buf_len, hash))
2048 goto err;
2049 break;
2050 default:
2051 wpa_printf(MSG_ERROR,
2052 "PASN: Unsupported alg=%d for MIC calculation", alg);
2053 goto err;
2054 }
2055
2056 os_memcpy(mic, hash, mic_len);
2057 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC", mic, mic_len);
2058
2059 ret = 0;
2060 err:
2061 bin_clear_free(buf, buf_len);
2062 return ret;
2063 }
2064
2065
2066 /**
2067 * pasn_auth_frame_hash - Computes a hash of an Authentication frame body
2068 * @alg: Selected hash algorithm from pasn_pmk_to_ptk()
2069 * @data: Pointer to the Authentication frame body
2070 * @len: Length of the Authentication frame body
2071 * @hash: On return would hold the computed hash. Should be big enough to handle
2072 * SHA512.
2073 * Returns: 0 on success, -1 on failure
2074 */
pasn_auth_frame_hash(enum rsn_hash_alg alg,const u8 * data,size_t len,u8 * hash)2075 int pasn_auth_frame_hash(enum rsn_hash_alg alg, const u8 *data, size_t len,
2076 u8 *hash)
2077 {
2078 switch (alg) {
2079 #ifdef CONFIG_SHA512
2080 case RSN_HASH_SHA512:
2081 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-512");
2082 return sha512_vector(1, &data, &len, hash);
2083 #endif /* CONFIG_SHA512 */
2084 #ifdef CONFIG_SHA384
2085 case RSN_HASH_SHA384:
2086 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-384");
2087 return sha384_vector(1, &data, &len, hash);
2088 #endif /* CONFIG_SHA384 */
2089 case RSN_HASH_SHA256:
2090 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-256");
2091 return sha256_vector(1, &data, &len, hash);
2092 default:
2093 wpa_printf(MSG_ERROR, "PASN: Unsupported alg=%d", alg);
2094 return -1;
2095 }
2096 }
2097
2098 #endif /* CONFIG_PASN */
2099
2100
rsn_selector_to_bitfield(const u8 * s)2101 static int rsn_selector_to_bitfield(const u8 *s)
2102 {
2103 return rsn_cipher_suite_to_wpa_cipher(RSN_SELECTOR_GET(s));
2104 }
2105
2106
rsn_key_mgmt_to_bitfield(const u8 * s)2107 static int rsn_key_mgmt_to_bitfield(const u8 *s)
2108 {
2109 return rsn_key_mgmt_to_wpa_akm(RSN_SELECTOR_GET(s));
2110 }
2111
2112
wpa_cipher_valid_group(int cipher)2113 int wpa_cipher_valid_group(int cipher)
2114 {
2115 return wpa_cipher_valid_pairwise(cipher) ||
2116 cipher == WPA_CIPHER_GTK_NOT_USED;
2117 }
2118
2119
wpa_cipher_valid_mgmt_group(int cipher)2120 int wpa_cipher_valid_mgmt_group(int cipher)
2121 {
2122 return cipher == WPA_CIPHER_GTK_NOT_USED ||
2123 cipher == WPA_CIPHER_AES_128_CMAC ||
2124 cipher == WPA_CIPHER_BIP_GMAC_128 ||
2125 cipher == WPA_CIPHER_BIP_GMAC_256 ||
2126 cipher == WPA_CIPHER_BIP_CMAC_256;
2127 }
2128
2129
2130 /**
2131 * wpa_parse_wpa_ie_rsn - Parse RSN IE
2132 * @rsn_ie: Buffer containing RSN IE
2133 * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
2134 * @data: Pointer to structure that will be filled in with parsed data
2135 * Returns: 0 on success, <0 on failure
2136 */
wpa_parse_wpa_ie_rsn(const u8 * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)2137 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
2138 struct wpa_ie_data *data)
2139 {
2140 const u8 *pos;
2141 int left;
2142 int i, count;
2143
2144 os_memset(data, 0, sizeof(*data));
2145 data->proto = WPA_PROTO_RSN;
2146 data->pairwise_cipher = WPA_CIPHER_CCMP;
2147 data->group_cipher = WPA_CIPHER_CCMP;
2148 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
2149 data->capabilities = 0;
2150 data->pmkid = NULL;
2151 data->num_pmkid = 0;
2152 data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
2153
2154 if (rsn_ie_len == 0) {
2155 /* No RSN IE - fail silently */
2156 return -1;
2157 }
2158
2159 if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
2160 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
2161 __func__, (unsigned long) rsn_ie_len);
2162 return -1;
2163 }
2164
2165 if (rsn_ie_len >= 2 + 4 + 2 && rsn_ie[1] >= 4 + 2 &&
2166 rsn_ie[1] == rsn_ie_len - 2 &&
2167 (WPA_GET_BE32(&rsn_ie[2]) == RSNE_OVERRIDE_IE_VENDOR_TYPE ||
2168 WPA_GET_BE32(&rsn_ie[2]) ==
2169 RSNE_OVERRIDE_2_IE_VENDOR_TYPE) &&
2170 WPA_GET_LE16(&rsn_ie[2 + 4]) == RSN_VERSION) {
2171 pos = rsn_ie + 2 + 4 + 2;
2172 left = rsn_ie_len - 2 - 4 - 2;
2173 } else {
2174 const struct rsn_ie_hdr *hdr;
2175
2176 hdr = (const struct rsn_ie_hdr *) rsn_ie;
2177
2178 if (hdr->elem_id != WLAN_EID_RSN ||
2179 hdr->len != rsn_ie_len - 2 ||
2180 WPA_GET_LE16(hdr->version) != RSN_VERSION) {
2181 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
2182 __func__);
2183 return -2;
2184 }
2185
2186 pos = (const u8 *) (hdr + 1);
2187 left = rsn_ie_len - sizeof(*hdr);
2188 }
2189
2190 if (left >= RSN_SELECTOR_LEN) {
2191 data->group_cipher = rsn_selector_to_bitfield(pos);
2192 data->has_group = 1;
2193 if (!wpa_cipher_valid_group(data->group_cipher)) {
2194 wpa_printf(MSG_DEBUG,
2195 "%s: invalid group cipher 0x%x (%08x)",
2196 __func__, data->group_cipher,
2197 WPA_GET_BE32(pos));
2198 #ifdef CONFIG_NO_TKIP
2199 if (RSN_SELECTOR_GET(pos) == RSN_CIPHER_SUITE_TKIP) {
2200 wpa_printf(MSG_DEBUG,
2201 "%s: TKIP as group cipher not supported in CONFIG_NO_TKIP=y build",
2202 __func__);
2203 }
2204 #endif /* CONFIG_NO_TKIP */
2205 return -1;
2206 }
2207 pos += RSN_SELECTOR_LEN;
2208 left -= RSN_SELECTOR_LEN;
2209 } else if (left > 0) {
2210 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
2211 __func__, left);
2212 return -3;
2213 }
2214
2215 if (left >= 2) {
2216 data->pairwise_cipher = 0;
2217 count = WPA_GET_LE16(pos);
2218 pos += 2;
2219 left -= 2;
2220 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
2221 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
2222 "count %u left %u", __func__, count, left);
2223 return -4;
2224 }
2225 if (count)
2226 data->has_pairwise = 1;
2227 for (i = 0; i < count; i++) {
2228 data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
2229 pos += RSN_SELECTOR_LEN;
2230 left -= RSN_SELECTOR_LEN;
2231 }
2232 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
2233 wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
2234 "pairwise cipher", __func__);
2235 return -1;
2236 }
2237 } else if (left == 1) {
2238 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
2239 __func__);
2240 return -5;
2241 }
2242
2243 if (left >= 2) {
2244 data->key_mgmt = 0;
2245 count = WPA_GET_LE16(pos);
2246 pos += 2;
2247 left -= 2;
2248 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
2249 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
2250 "count %u left %u", __func__, count, left);
2251 return -6;
2252 }
2253 for (i = 0; i < count; i++) {
2254 data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
2255 pos += RSN_SELECTOR_LEN;
2256 left -= RSN_SELECTOR_LEN;
2257 }
2258 } else if (left == 1) {
2259 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
2260 __func__);
2261 return -7;
2262 }
2263
2264 if (left >= 2) {
2265 data->capabilities = WPA_GET_LE16(pos);
2266 pos += 2;
2267 left -= 2;
2268 }
2269
2270 if (left >= 2) {
2271 u16 num_pmkid = WPA_GET_LE16(pos);
2272 pos += 2;
2273 left -= 2;
2274 if (num_pmkid > (unsigned int) left / PMKID_LEN) {
2275 wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
2276 "(num_pmkid=%u left=%d)",
2277 __func__, num_pmkid, left);
2278 data->num_pmkid = 0;
2279 return -9;
2280 } else {
2281 data->num_pmkid = num_pmkid;
2282 data->pmkid = pos;
2283 pos += data->num_pmkid * PMKID_LEN;
2284 left -= data->num_pmkid * PMKID_LEN;
2285 }
2286 }
2287
2288 if (left >= 4) {
2289 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
2290 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
2291 wpa_printf(MSG_DEBUG,
2292 "%s: Unsupported management group cipher 0x%x (%08x)",
2293 __func__, data->mgmt_group_cipher,
2294 WPA_GET_BE32(pos));
2295 return -10;
2296 }
2297 pos += RSN_SELECTOR_LEN;
2298 left -= RSN_SELECTOR_LEN;
2299 }
2300
2301 if (left > 0) {
2302 wpa_hexdump(MSG_DEBUG,
2303 "wpa_parse_wpa_ie_rsn: ignore trailing bytes",
2304 pos, left);
2305 }
2306
2307 return 0;
2308 }
2309
2310
wpa_selector_to_bitfield(const u8 * s)2311 static int wpa_selector_to_bitfield(const u8 *s)
2312 {
2313 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
2314 return WPA_CIPHER_NONE;
2315 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
2316 return WPA_CIPHER_TKIP;
2317 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
2318 return WPA_CIPHER_CCMP;
2319 return 0;
2320 }
2321
2322
wpa_key_mgmt_to_bitfield(const u8 * s)2323 static int wpa_key_mgmt_to_bitfield(const u8 *s)
2324 {
2325 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
2326 return WPA_KEY_MGMT_IEEE8021X;
2327 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
2328 return WPA_KEY_MGMT_PSK;
2329 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
2330 return WPA_KEY_MGMT_WPA_NONE;
2331 return 0;
2332 }
2333
2334
wpa_parse_wpa_ie_wpa(const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)2335 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
2336 struct wpa_ie_data *data)
2337 {
2338 const struct wpa_ie_hdr *hdr;
2339 const u8 *pos;
2340 int left;
2341 int i, count;
2342
2343 os_memset(data, 0, sizeof(*data));
2344 data->proto = WPA_PROTO_WPA;
2345 data->pairwise_cipher = WPA_CIPHER_TKIP;
2346 data->group_cipher = WPA_CIPHER_TKIP;
2347 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
2348 data->capabilities = 0;
2349 data->pmkid = NULL;
2350 data->num_pmkid = 0;
2351 data->mgmt_group_cipher = 0;
2352
2353 if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
2354 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
2355 __func__, (unsigned long) wpa_ie_len);
2356 return -1;
2357 }
2358
2359 hdr = (const struct wpa_ie_hdr *) wpa_ie;
2360
2361 if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
2362 hdr->len != wpa_ie_len - 2 ||
2363 RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
2364 WPA_GET_LE16(hdr->version) != WPA_VERSION) {
2365 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
2366 __func__);
2367 return -2;
2368 }
2369
2370 pos = (const u8 *) (hdr + 1);
2371 left = wpa_ie_len - sizeof(*hdr);
2372
2373 if (left >= WPA_SELECTOR_LEN) {
2374 data->group_cipher = wpa_selector_to_bitfield(pos);
2375 pos += WPA_SELECTOR_LEN;
2376 left -= WPA_SELECTOR_LEN;
2377 } else if (left > 0) {
2378 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
2379 __func__, left);
2380 return -3;
2381 }
2382
2383 if (left >= 2) {
2384 data->pairwise_cipher = 0;
2385 count = WPA_GET_LE16(pos);
2386 pos += 2;
2387 left -= 2;
2388 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2389 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
2390 "count %u left %u", __func__, count, left);
2391 return -4;
2392 }
2393 for (i = 0; i < count; i++) {
2394 data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
2395 pos += WPA_SELECTOR_LEN;
2396 left -= WPA_SELECTOR_LEN;
2397 }
2398 } else if (left == 1) {
2399 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
2400 __func__);
2401 return -5;
2402 }
2403
2404 if (left >= 2) {
2405 data->key_mgmt = 0;
2406 count = WPA_GET_LE16(pos);
2407 pos += 2;
2408 left -= 2;
2409 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2410 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
2411 "count %u left %u", __func__, count, left);
2412 return -6;
2413 }
2414 for (i = 0; i < count; i++) {
2415 data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
2416 pos += WPA_SELECTOR_LEN;
2417 left -= WPA_SELECTOR_LEN;
2418 }
2419 } else if (left == 1) {
2420 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
2421 __func__);
2422 return -7;
2423 }
2424
2425 if (left >= 2) {
2426 data->capabilities = WPA_GET_LE16(pos);
2427 pos += 2;
2428 left -= 2;
2429 }
2430
2431 if (left > 0) {
2432 wpa_hexdump(MSG_DEBUG,
2433 "wpa_parse_wpa_ie_wpa: ignore trailing bytes",
2434 pos, left);
2435 }
2436
2437 return 0;
2438 }
2439
2440
wpa_default_rsn_cipher(int freq)2441 int wpa_default_rsn_cipher(int freq)
2442 {
2443 if (freq > 56160)
2444 return WPA_CIPHER_GCMP; /* DMG */
2445
2446 return WPA_CIPHER_CCMP;
2447 }
2448
2449
2450 #ifdef CONFIG_IEEE80211R
2451
2452 /**
2453 * wpa_derive_pmk_r0 - Derive PMK-R0 and PMKR0Name
2454 *
2455 * IEEE Std 802.11r-2008 - 8.5.1.5.3
2456 */
wpa_derive_pmk_r0(const u8 * xxkey,size_t xxkey_len,const u8 * ssid,size_t ssid_len,const u8 * mdid,const u8 * r0kh_id,size_t r0kh_id_len,const u8 * s0kh_id,u8 * pmk_r0,u8 * pmk_r0_name,int key_mgmt)2457 int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
2458 const u8 *ssid, size_t ssid_len,
2459 const u8 *mdid, const u8 *r0kh_id, size_t r0kh_id_len,
2460 const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
2461 int key_mgmt)
2462 {
2463 u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
2464 FT_R0KH_ID_MAX_LEN + ETH_ALEN];
2465 u8 *pos, r0_key_data[64 + 16], hash[64];
2466 const u8 *addr[2];
2467 size_t len[2];
2468 size_t q, r0_key_data_len;
2469 int res;
2470
2471 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2472 (xxkey_len == SHA256_MAC_LEN || xxkey_len == SHA384_MAC_LEN ||
2473 xxkey_len == SHA512_MAC_LEN))
2474 q = xxkey_len;
2475 else if (wpa_key_mgmt_sha384(key_mgmt))
2476 q = SHA384_MAC_LEN;
2477 else
2478 q = SHA256_MAC_LEN;
2479 r0_key_data_len = q + 16;
2480
2481 /*
2482 * R0-Key-Data = KDF-Hash-Length(XXKey, "FT-R0",
2483 * SSIDlength || SSID || MDID || R0KHlength ||
2484 * R0KH-ID || S0KH-ID)
2485 * XXKey is either the second 256 bits of MSK or PSK; or the first
2486 * 384 bits of MSK for FT-EAP-SHA384; or PMK from SAE.
2487 * PMK-R0 = L(R0-Key-Data, 0, Q)
2488 * PMK-R0Name-Salt = L(R0-Key-Data, Q, 128)
2489 * Q = 384 for FT-EAP-SHA384; the length of the digest generated by H()
2490 * for FT-SAE-EXT-KEY; or otherwise, 256
2491 */
2492 if (ssid_len > SSID_MAX_LEN || r0kh_id_len > FT_R0KH_ID_MAX_LEN)
2493 return -1;
2494 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R0 using KDF-SHA%zu", q * 8);
2495 wpa_hexdump_key(MSG_DEBUG, "FT: XXKey", xxkey, xxkey_len);
2496 wpa_hexdump_ascii(MSG_DEBUG, "FT: SSID", ssid, ssid_len);
2497 wpa_hexdump(MSG_DEBUG, "FT: MDID", mdid, MOBILITY_DOMAIN_ID_LEN);
2498 wpa_hexdump_ascii(MSG_DEBUG, "FT: R0KH-ID", r0kh_id, r0kh_id_len);
2499 wpa_printf(MSG_DEBUG, "FT: S0KH-ID: " MACSTR, MAC2STR(s0kh_id));
2500 pos = buf;
2501 *pos++ = ssid_len;
2502 os_memcpy(pos, ssid, ssid_len);
2503 pos += ssid_len;
2504 os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);
2505 pos += MOBILITY_DOMAIN_ID_LEN;
2506 *pos++ = r0kh_id_len;
2507 os_memcpy(pos, r0kh_id, r0kh_id_len);
2508 pos += r0kh_id_len;
2509 os_memcpy(pos, s0kh_id, ETH_ALEN);
2510 pos += ETH_ALEN;
2511
2512 res = -1;
2513 #ifdef CONFIG_SHA512
2514 if (q == SHA512_MAC_LEN) {
2515 if (xxkey_len != SHA512_MAC_LEN) {
2516 wpa_printf(MSG_ERROR,
2517 "FT: Unexpected XXKey length %d (expected %d)",
2518 (int) xxkey_len, SHA512_MAC_LEN);
2519 return -1;
2520 }
2521 res = sha512_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2522 r0_key_data, r0_key_data_len);
2523 }
2524 #endif /* CONFIG_SHA512 */
2525 #ifdef CONFIG_SHA384
2526 if (q == SHA384_MAC_LEN) {
2527 if (xxkey_len != SHA384_MAC_LEN) {
2528 wpa_printf(MSG_ERROR,
2529 "FT: Unexpected XXKey length %d (expected %d)",
2530 (int) xxkey_len, SHA384_MAC_LEN);
2531 return -1;
2532 }
2533 res = sha384_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2534 r0_key_data, r0_key_data_len);
2535 }
2536 #endif /* CONFIG_SHA384 */
2537 if (q == SHA256_MAC_LEN) {
2538 if (xxkey_len != PMK_LEN) {
2539 wpa_printf(MSG_ERROR,
2540 "FT: Unexpected XXKey length %d (expected %d)",
2541 (int) xxkey_len, PMK_LEN);
2542 return -1;
2543 }
2544 res = sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2545 r0_key_data, r0_key_data_len);
2546 }
2547 if (res < 0)
2548 return res;
2549 os_memcpy(pmk_r0, r0_key_data, q);
2550 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, q);
2551 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
2552
2553 /*
2554 * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
2555 */
2556 addr[0] = (const u8 *) "FT-R0N";
2557 len[0] = 6;
2558 addr[1] = &r0_key_data[q];
2559 len[1] = 16;
2560
2561 res = -1;
2562 #ifdef CONFIG_SHA512
2563 if (q == SHA512_MAC_LEN)
2564 res = sha512_vector(2, addr, len, hash);
2565 #endif /* CONFIG_SHA512 */
2566 #ifdef CONFIG_SHA384
2567 if (q == SHA384_MAC_LEN)
2568 res = sha384_vector(2, addr, len, hash);
2569 #endif /* CONFIG_SHA384 */
2570 if (q == SHA256_MAC_LEN)
2571 res = sha256_vector(2, addr, len, hash);
2572 if (res < 0) {
2573 wpa_printf(MSG_DEBUG,
2574 "FT: Failed to derive PMKR0Name (PMK-R0 len %zu)",
2575 q);
2576 return res;
2577 }
2578 os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
2579 wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN);
2580 forced_memzero(r0_key_data, sizeof(r0_key_data));
2581 return 0;
2582 }
2583
2584
2585 /**
2586 * wpa_derive_pmk_r1_name - Derive PMKR1Name
2587 *
2588 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2589 */
wpa_derive_pmk_r1_name(const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1_name,size_t pmk_r1_len)2590 int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
2591 const u8 *s1kh_id, u8 *pmk_r1_name,
2592 size_t pmk_r1_len)
2593 {
2594 u8 hash[64];
2595 const u8 *addr[4];
2596 size_t len[4];
2597 int res;
2598 const char *title;
2599
2600 /*
2601 * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
2602 * R1KH-ID || S1KH-ID))
2603 */
2604 addr[0] = (const u8 *) "FT-R1N";
2605 len[0] = 6;
2606 addr[1] = pmk_r0_name;
2607 len[1] = WPA_PMK_NAME_LEN;
2608 addr[2] = r1kh_id;
2609 len[2] = FT_R1KH_ID_LEN;
2610 addr[3] = s1kh_id;
2611 len[3] = ETH_ALEN;
2612
2613 res = -1;
2614 #ifdef CONFIG_SHA512
2615 if (pmk_r1_len == SHA512_MAC_LEN) {
2616 title = "FT: PMKR1Name (using SHA512)";
2617 res = sha512_vector(4, addr, len, hash);
2618 }
2619 #endif /* CONFIG_SHA512 */
2620 #ifdef CONFIG_SHA384
2621 if (pmk_r1_len == SHA384_MAC_LEN) {
2622 title = "FT: PMKR1Name (using SHA384)";
2623 res = sha384_vector(4, addr, len, hash);
2624 }
2625 #endif /* CONFIG_SHA384 */
2626 if (pmk_r1_len == SHA256_MAC_LEN) {
2627 title = "FT: PMKR1Name (using SHA256)";
2628 res = sha256_vector(4, addr, len, hash);
2629 }
2630 if (res < 0) {
2631 wpa_printf(MSG_DEBUG,
2632 "FT: Failed to derive PMKR1Name (PMK-R1 len %zu)",
2633 pmk_r1_len);
2634 return res;
2635 }
2636 os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
2637 wpa_hexdump(MSG_DEBUG, title, pmk_r1_name, WPA_PMK_NAME_LEN);
2638 return 0;
2639 }
2640
2641
2642 /**
2643 * wpa_derive_pmk_r1 - Derive PMK-R1 and PMKR1Name from PMK-R0
2644 *
2645 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2646 */
wpa_derive_pmk_r1(const u8 * pmk_r0,size_t pmk_r0_len,const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1,u8 * pmk_r1_name)2647 int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
2648 const u8 *pmk_r0_name,
2649 const u8 *r1kh_id, const u8 *s1kh_id,
2650 u8 *pmk_r1, u8 *pmk_r1_name)
2651 {
2652 u8 buf[FT_R1KH_ID_LEN + ETH_ALEN];
2653 u8 *pos;
2654 int res;
2655
2656 /* PMK-R1 = KDF-Hash(PMK-R0, "FT-R1", R1KH-ID || S1KH-ID) */
2657 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R1 using KDF-SHA%zu",
2658 pmk_r0_len * 8);
2659 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len);
2660 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", r1kh_id, FT_R1KH_ID_LEN);
2661 wpa_printf(MSG_DEBUG, "FT: S1KH-ID: " MACSTR, MAC2STR(s1kh_id));
2662 pos = buf;
2663 os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);
2664 pos += FT_R1KH_ID_LEN;
2665 os_memcpy(pos, s1kh_id, ETH_ALEN);
2666 pos += ETH_ALEN;
2667
2668 res = -1;
2669 #ifdef CONFIG_SHA512
2670 if (pmk_r0_len == SHA512_MAC_LEN)
2671 res = sha512_prf(pmk_r0, pmk_r0_len, "FT-R1",
2672 buf, pos - buf, pmk_r1, pmk_r0_len);
2673 #endif /* CONFIG_SHA512 */
2674 #ifdef CONFIG_SHA384
2675 if (pmk_r0_len == SHA384_MAC_LEN)
2676 res = sha384_prf(pmk_r0, pmk_r0_len, "FT-R1",
2677 buf, pos - buf, pmk_r1, pmk_r0_len);
2678 #endif /* CONFIG_SHA384 */
2679 if (pmk_r0_len == SHA256_MAC_LEN)
2680 res = sha256_prf(pmk_r0, pmk_r0_len, "FT-R1",
2681 buf, pos - buf, pmk_r1, pmk_r0_len);
2682 if (res < 0) {
2683 wpa_printf(MSG_ERROR, "FT: Failed to derive PMK-R1");
2684 return res;
2685 }
2686 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
2687
2688 return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
2689 pmk_r1_name, pmk_r0_len);
2690 }
2691
2692
2693 /**
2694 * wpa_pmk_r1_to_ptk - Derive PTK and PTKName from PMK-R1
2695 *
2696 * IEEE Std 802.11r-2008 - 8.5.1.5.5
2697 */
wpa_pmk_r1_to_ptk(const u8 * pmk_r1,size_t pmk_r1_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * pmk_r1_name,struct wpa_ptk * ptk,u8 * ptk_name,int akmp,int cipher,size_t kdk_len)2698 int wpa_pmk_r1_to_ptk(const u8 *pmk_r1, size_t pmk_r1_len,
2699 const u8 *snonce, const u8 *anonce,
2700 const u8 *sta_addr, const u8 *bssid,
2701 const u8 *pmk_r1_name,
2702 struct wpa_ptk *ptk, u8 *ptk_name, int akmp, int cipher,
2703 size_t kdk_len)
2704 {
2705 u8 buf[2 * WPA_NONCE_LEN + 2 * ETH_ALEN];
2706 u8 *pos, hash[32];
2707 const u8 *addr[6];
2708 size_t len[6];
2709 u8 tmp[2 * WPA_KCK_MAX_LEN + 2 * WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
2710 WPA_KDK_MAX_LEN];
2711 size_t ptk_len, offset;
2712 size_t key_len;
2713 int res;
2714
2715 if (kdk_len > WPA_KDK_MAX_LEN) {
2716 wpa_printf(MSG_ERROR,
2717 "FT: KDK len=%zu exceeds max supported len",
2718 kdk_len);
2719 return -1;
2720 }
2721
2722 if (akmp == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2723 (pmk_r1_len == SHA256_MAC_LEN || pmk_r1_len == SHA384_MAC_LEN ||
2724 pmk_r1_len == SHA512_MAC_LEN))
2725 key_len = pmk_r1_len;
2726 else if (wpa_key_mgmt_sha384(akmp))
2727 key_len = SHA384_MAC_LEN;
2728 else
2729 key_len = SHA256_MAC_LEN;
2730
2731 /*
2732 * PTK = KDF-PTKLen(PMK-R1, "FT-PTK", SNonce || ANonce ||
2733 * BSSID || STA-ADDR)
2734 */
2735 wpa_printf(MSG_DEBUG, "FT: Derive PTK using KDF-SHA%zu", key_len * 8);
2736 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len);
2737 wpa_hexdump(MSG_DEBUG, "FT: SNonce", snonce, WPA_NONCE_LEN);
2738 wpa_hexdump(MSG_DEBUG, "FT: ANonce", anonce, WPA_NONCE_LEN);
2739 wpa_printf(MSG_DEBUG, "FT: BSSID=" MACSTR " STA-ADDR=" MACSTR,
2740 MAC2STR(bssid), MAC2STR(sta_addr));
2741 pos = buf;
2742 os_memcpy(pos, snonce, WPA_NONCE_LEN);
2743 pos += WPA_NONCE_LEN;
2744 os_memcpy(pos, anonce, WPA_NONCE_LEN);
2745 pos += WPA_NONCE_LEN;
2746 os_memcpy(pos, bssid, ETH_ALEN);
2747 pos += ETH_ALEN;
2748 os_memcpy(pos, sta_addr, ETH_ALEN);
2749 pos += ETH_ALEN;
2750
2751 ptk->kck_len = wpa_kck_len(akmp, key_len);
2752 ptk->kck2_len = wpa_kck2_len(akmp);
2753 ptk->kek_len = wpa_kek_len(akmp, key_len);
2754 ptk->kek2_len = wpa_kek2_len(akmp);
2755 ptk->tk_len = wpa_cipher_key_len(cipher);
2756 ptk->kdk_len = kdk_len;
2757 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len +
2758 ptk->kck2_len + ptk->kek2_len + ptk->kdk_len;
2759
2760 res = -1;
2761 #ifdef CONFIG_SHA512
2762 if (key_len == SHA512_MAC_LEN) {
2763 if (pmk_r1_len != SHA512_MAC_LEN) {
2764 wpa_printf(MSG_ERROR,
2765 "FT: Unexpected PMK-R1 length %d (expected %d)",
2766 (int) pmk_r1_len, SHA512_MAC_LEN);
2767 return -1;
2768 }
2769 res = sha512_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2770 buf, pos - buf, tmp, ptk_len);
2771 }
2772 #endif /* CONFIG_SHA512 */
2773 #ifdef CONFIG_SHA384
2774 if (key_len == SHA384_MAC_LEN) {
2775 if (pmk_r1_len != SHA384_MAC_LEN) {
2776 wpa_printf(MSG_ERROR,
2777 "FT: Unexpected PMK-R1 length %d (expected %d)",
2778 (int) pmk_r1_len, SHA384_MAC_LEN);
2779 return -1;
2780 }
2781 res = sha384_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2782 buf, pos - buf, tmp, ptk_len);
2783 }
2784 #endif /* CONFIG_SHA384 */
2785 if (key_len == SHA256_MAC_LEN) {
2786 if (pmk_r1_len != PMK_LEN) {
2787 wpa_printf(MSG_ERROR,
2788 "FT: Unexpected PMK-R1 length %d (expected %d)",
2789 (int) pmk_r1_len, PMK_LEN);
2790 return -1;
2791 }
2792 res = sha256_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2793 buf, pos - buf, tmp, ptk_len);
2794 }
2795 if (res < 0)
2796 return -1;
2797 wpa_hexdump_key(MSG_DEBUG, "FT: PTK", tmp, ptk_len);
2798
2799 /*
2800 * PTKName = Truncate-128(SHA-256(PMKR1Name || "FT-PTKN" || SNonce ||
2801 * ANonce || BSSID || STA-ADDR))
2802 */
2803 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN);
2804 addr[0] = pmk_r1_name;
2805 len[0] = WPA_PMK_NAME_LEN;
2806 addr[1] = (const u8 *) "FT-PTKN";
2807 len[1] = 7;
2808 addr[2] = snonce;
2809 len[2] = WPA_NONCE_LEN;
2810 addr[3] = anonce;
2811 len[3] = WPA_NONCE_LEN;
2812 addr[4] = bssid;
2813 len[4] = ETH_ALEN;
2814 addr[5] = sta_addr;
2815 len[5] = ETH_ALEN;
2816
2817 if (sha256_vector(6, addr, len, hash) < 0)
2818 return -1;
2819 os_memcpy(ptk_name, hash, WPA_PMK_NAME_LEN);
2820
2821 os_memcpy(ptk->kck, tmp, ptk->kck_len);
2822 offset = ptk->kck_len;
2823 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
2824 offset += ptk->kek_len;
2825 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
2826 offset += ptk->tk_len;
2827 os_memcpy(ptk->kck2, tmp + offset, ptk->kck2_len);
2828 offset += ptk->kck2_len;
2829 os_memcpy(ptk->kek2, tmp + offset, ptk->kek2_len);
2830 offset += ptk->kek2_len;
2831 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
2832
2833 wpa_hexdump_key(MSG_DEBUG, "FT: KCK", ptk->kck, ptk->kck_len);
2834 wpa_hexdump_key(MSG_DEBUG, "FT: KEK", ptk->kek, ptk->kek_len);
2835 if (ptk->kck2_len)
2836 wpa_hexdump_key(MSG_DEBUG, "FT: KCK2",
2837 ptk->kck2, ptk->kck2_len);
2838 if (ptk->kek2_len)
2839 wpa_hexdump_key(MSG_DEBUG, "FT: KEK2",
2840 ptk->kek2, ptk->kek2_len);
2841 if (ptk->kdk_len)
2842 wpa_hexdump_key(MSG_DEBUG, "FT: KDK", ptk->kdk, ptk->kdk_len);
2843
2844 wpa_hexdump_key(MSG_DEBUG, "FT: TK", ptk->tk, ptk->tk_len);
2845 wpa_hexdump(MSG_DEBUG, "FT: PTKName", ptk_name, WPA_PMK_NAME_LEN);
2846
2847 forced_memzero(tmp, sizeof(tmp));
2848
2849 return 0;
2850 }
2851
2852 #endif /* CONFIG_IEEE80211R */
2853
2854
2855 /**
2856 * rsn_pmkid - Calculate PMK identifier
2857 * @pmk: Pairwise master key
2858 * @pmk_len: Length of pmk in bytes
2859 * @aa: Authenticator address
2860 * @spa: Supplicant address
2861 * @pmkid: Buffer for PMKID
2862 * @akmp: Negotiated key management protocol
2863 *
2864 * IEEE Std 802.11-2016 - 12.7.1.3 Pairwise key hierarchy
2865 * AKM: 00-0F-AC:3, 00-0F-AC:5, 00-0F-AC:6, 00-0F-AC:14, 00-0F-AC:16
2866 * PMKID = Truncate-128(HMAC-SHA-256(PMK, "PMK Name" || AA || SPA))
2867 * AKM: 00-0F-AC:11
2868 * See rsn_pmkid_suite_b()
2869 * AKM: 00-0F-AC:12
2870 * See rsn_pmkid_suite_b_192()
2871 * AKM: 00-0F-AC:13, 00-0F-AC:15, 00-0F-AC:17
2872 * PMKID = Truncate-128(HMAC-SHA-384(PMK, "PMK Name" || AA || SPA))
2873 * Otherwise:
2874 * PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name" || AA || SPA))
2875 */
rsn_pmkid(const u8 * pmk,size_t pmk_len,const u8 * aa,const u8 * spa,u8 * pmkid,int akmp)2876 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
2877 u8 *pmkid, int akmp)
2878 {
2879 char *title = "PMK Name";
2880 const u8 *addr[3];
2881 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2882 unsigned char hash[SHA384_MAC_LEN];
2883
2884 addr[0] = (u8 *) title;
2885 addr[1] = aa;
2886 addr[2] = spa;
2887
2888 if (0) {
2889 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
2890 } else if (wpa_key_mgmt_sha384(akmp)) {
2891 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-384");
2892 hmac_sha384_vector(pmk, pmk_len, 3, addr, len, hash);
2893 #endif /* CONFIG_FILS || CONFIG_SHA384 */
2894 } else if (wpa_key_mgmt_sha256(akmp)) {
2895 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-256");
2896 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
2897 } else {
2898 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-1");
2899 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
2900 }
2901 wpa_hexdump(MSG_DEBUG, "RSN: Derived PMKID", hash, PMKID_LEN);
2902 os_memcpy(pmkid, hash, PMKID_LEN);
2903 }
2904
2905
2906 #ifdef CONFIG_SUITEB
2907 /**
2908 * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
2909 * @kck: Key confirmation key
2910 * @kck_len: Length of kck in bytes
2911 * @aa: Authenticator address
2912 * @spa: Supplicant address
2913 * @pmkid: Buffer for PMKID
2914 * Returns: 0 on success, -1 on failure
2915 *
2916 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2917 * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
2918 */
rsn_pmkid_suite_b(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2919 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
2920 const u8 *spa, u8 *pmkid)
2921 {
2922 char *title = "PMK Name";
2923 const u8 *addr[3];
2924 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2925 unsigned char hash[SHA256_MAC_LEN];
2926
2927 addr[0] = (u8 *) title;
2928 addr[1] = aa;
2929 addr[2] = spa;
2930
2931 if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
2932 return -1;
2933 os_memcpy(pmkid, hash, PMKID_LEN);
2934 return 0;
2935 }
2936 #endif /* CONFIG_SUITEB */
2937
2938
2939 #ifdef CONFIG_SUITEB192
2940 /**
2941 * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
2942 * @kck: Key confirmation key
2943 * @kck_len: Length of kck in bytes
2944 * @aa: Authenticator address
2945 * @spa: Supplicant address
2946 * @pmkid: Buffer for PMKID
2947 * Returns: 0 on success, -1 on failure
2948 *
2949 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2950 * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
2951 */
rsn_pmkid_suite_b_192(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2952 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
2953 const u8 *spa, u8 *pmkid)
2954 {
2955 char *title = "PMK Name";
2956 const u8 *addr[3];
2957 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2958 unsigned char hash[SHA384_MAC_LEN];
2959
2960 addr[0] = (u8 *) title;
2961 addr[1] = aa;
2962 addr[2] = spa;
2963
2964 if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
2965 return -1;
2966 os_memcpy(pmkid, hash, PMKID_LEN);
2967 return 0;
2968 }
2969 #endif /* CONFIG_SUITEB192 */
2970
2971
2972 #ifdef CONFIG_PMKSA_PRIVACY
2973 /**
2974 * rsn_pmkid_privacy - Calculate a new PMKID for PMKSA caching privacy
2975 * @pmkid_anonce: Authenticator nonce (ANonce)
2976 * @pmkid_snonce: Supplicant nonce (SNonce)
2977 * @akmp: Negotiated key management protocol
2978 * @pmk_len: PMK length in bytes
2979 * @pmkid: Buffer for returning PMKID
2980 * Returns: 0 on success, -1 on failure
2981 *
2982 * IEEE P802.11bi/D4.0, 12.16.7.2 (PMKID privacy)
2983 * PMKID = Truncate-128(Hash("PMK Name" || PMKIDANonce || PMKIDSNonce))
2984 */
rsn_pmkid_privacy(const u8 * pmkid_anonce,const u8 * pmkid_snonce,int akmp,size_t pmk_len,u8 * pmkid)2985 int rsn_pmkid_privacy(const u8 *pmkid_anonce, const u8 *pmkid_snonce,
2986 int akmp, size_t pmk_len, u8 *pmkid)
2987 {
2988 const char *label = "PMK Name";
2989 const u8 *addr[3];
2990 const size_t len[3] = { 8, NONCE_LEN, NONCE_LEN };
2991 unsigned char hash[SHA512_MAC_LEN];
2992
2993 wpa_hexdump(MSG_DEBUG, "PMKID privacy: PMKIDANonce",
2994 pmkid_anonce, NONCE_LEN);
2995 wpa_hexdump(MSG_DEBUG, "PMKID privacy: PMKIDSNonce",
2996 pmkid_snonce, NONCE_LEN);
2997
2998 addr[0] = (const u8 *) label;
2999 addr[1] = pmkid_anonce;
3000 addr[2] = pmkid_snonce;
3001
3002 if (0) {
3003 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
3004 } else if (wpa_key_mgmt_sha384(akmp)) {
3005 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using SHA-384");
3006 if (sha384_vector(3, addr, len, hash) < 0)
3007 return -1;
3008 #endif /* CONFIG_FILS || CONFIG_SHA384 */
3009 #ifdef CONFIG_SAE
3010 } else if (wpa_key_mgmt_sae_ext_key(akmp)) {
3011 if (pmk_len == 64) {
3012 if (sha512_vector(3, addr, len, hash) < 0)
3013 return -1;
3014 } else if (pmk_len == 48) {
3015 if (sha384_vector(3, addr, len, hash) < 0)
3016 return -1;
3017 } else {
3018 if (sha256_vector(3, addr, len, hash) < 0)
3019 return -1;
3020 }
3021 #endif /* CONFIG_SAE */
3022 } else {
3023 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using SHA-256");
3024 if (sha256_vector(3, addr, len, hash) < 0)
3025 return -1;
3026 }
3027
3028 wpa_hexdump(MSG_DEBUG, "PMKID privacy: new PMKID", hash, PMKID_LEN);
3029 os_memcpy(pmkid, hash, PMKID_LEN);
3030
3031 return 0;
3032 }
3033 #endif /* CONFIG_PMKSA_PRIVACY */
3034
3035
3036 /**
3037 * wpa_cipher_txt - Convert cipher suite to a text string
3038 * @cipher: Cipher suite (WPA_CIPHER_* enum)
3039 * Returns: Pointer to a text string of the cipher suite name
3040 */
wpa_cipher_txt(int cipher)3041 const char * wpa_cipher_txt(int cipher)
3042 {
3043 switch (cipher) {
3044 case WPA_CIPHER_NONE:
3045 return "NONE";
3046 #ifdef CONFIG_WEP
3047 case WPA_CIPHER_WEP40:
3048 return "WEP-40";
3049 case WPA_CIPHER_WEP104:
3050 return "WEP-104";
3051 #endif /* CONFIG_WEP */
3052 case WPA_CIPHER_TKIP:
3053 return "TKIP";
3054 case WPA_CIPHER_CCMP:
3055 return "CCMP";
3056 case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
3057 return "CCMP+TKIP";
3058 case WPA_CIPHER_GCMP:
3059 return "GCMP";
3060 case WPA_CIPHER_GCMP_256:
3061 return "GCMP-256";
3062 case WPA_CIPHER_CCMP_256:
3063 return "CCMP-256";
3064 case WPA_CIPHER_AES_128_CMAC:
3065 return "BIP";
3066 case WPA_CIPHER_BIP_GMAC_128:
3067 return "BIP-GMAC-128";
3068 case WPA_CIPHER_BIP_GMAC_256:
3069 return "BIP-GMAC-256";
3070 case WPA_CIPHER_BIP_CMAC_256:
3071 return "BIP-CMAC-256";
3072 case WPA_CIPHER_GTK_NOT_USED:
3073 return "GTK_NOT_USED";
3074 default:
3075 return "UNKNOWN";
3076 }
3077 }
3078
3079
3080 /**
3081 * wpa_key_mgmt_txt - Convert key management suite to a text string
3082 * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
3083 * @proto: WPA/WPA2 version (WPA_PROTO_*)
3084 * Returns: Pointer to a text string of the key management suite name
3085 */
wpa_key_mgmt_txt(int key_mgmt,int proto)3086 const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
3087 {
3088 switch (key_mgmt) {
3089 case WPA_KEY_MGMT_IEEE8021X:
3090 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
3091 return "WPA2+WPA/IEEE 802.1X/EAP";
3092 return proto == WPA_PROTO_RSN ?
3093 "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
3094 case WPA_KEY_MGMT_PSK:
3095 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
3096 return "WPA2-PSK+WPA-PSK";
3097 return proto == WPA_PROTO_RSN ?
3098 "WPA2-PSK" : "WPA-PSK";
3099 case WPA_KEY_MGMT_NONE:
3100 return "NONE";
3101 case WPA_KEY_MGMT_WPA_NONE:
3102 return "WPA-NONE";
3103 case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
3104 return "IEEE 802.1X (no WPA)";
3105 #ifdef CONFIG_IEEE80211R
3106 case WPA_KEY_MGMT_FT_IEEE8021X:
3107 return "FT-EAP";
3108 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
3109 return "FT-EAP-SHA384";
3110 case WPA_KEY_MGMT_FT_PSK:
3111 return "FT-PSK";
3112 #endif /* CONFIG_IEEE80211R */
3113 case WPA_KEY_MGMT_IEEE8021X_SHA256:
3114 return "WPA2-EAP-SHA256";
3115 case WPA_KEY_MGMT_PSK_SHA256:
3116 return "WPA2-PSK-SHA256";
3117 case WPA_KEY_MGMT_WPS:
3118 return "WPS";
3119 case WPA_KEY_MGMT_SAE:
3120 return "SAE";
3121 case WPA_KEY_MGMT_SAE_EXT_KEY:
3122 return "SAE-EXT-KEY";
3123 case WPA_KEY_MGMT_FT_SAE:
3124 return "FT-SAE";
3125 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
3126 return "FT-SAE-EXT-KEY";
3127 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
3128 return "WPA2-EAP-SUITE-B";
3129 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
3130 return "WPA2-EAP-SUITE-B-192";
3131 case WPA_KEY_MGMT_FILS_SHA256:
3132 return "FILS-SHA256";
3133 case WPA_KEY_MGMT_FILS_SHA384:
3134 return "FILS-SHA384";
3135 case WPA_KEY_MGMT_FT_FILS_SHA256:
3136 return "FT-FILS-SHA256";
3137 case WPA_KEY_MGMT_FT_FILS_SHA384:
3138 return "FT-FILS-SHA384";
3139 case WPA_KEY_MGMT_OWE:
3140 return "OWE";
3141 case WPA_KEY_MGMT_DPP:
3142 return "DPP";
3143 case WPA_KEY_MGMT_PASN:
3144 return "PASN";
3145 case WPA_KEY_MGMT_IEEE8021X_SHA384:
3146 return "WPA2-EAP-SHA384";
3147 case WPA_KEY_MGMT_EPPKE:
3148 return "EPPKE";
3149 default:
3150 return "UNKNOWN";
3151 }
3152 }
3153
3154
wpa_akm_to_suite(int akm)3155 u32 wpa_akm_to_suite(int akm)
3156 {
3157 if (akm & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
3158 return RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
3159 if (akm & WPA_KEY_MGMT_FT_IEEE8021X)
3160 return RSN_AUTH_KEY_MGMT_FT_802_1X;
3161 if (akm & WPA_KEY_MGMT_FT_PSK)
3162 return RSN_AUTH_KEY_MGMT_FT_PSK;
3163 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA384)
3164 return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
3165 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
3166 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
3167 if (akm & WPA_KEY_MGMT_IEEE8021X)
3168 return RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
3169 if (akm & WPA_KEY_MGMT_PSK_SHA256)
3170 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
3171 if (akm & WPA_KEY_MGMT_PSK)
3172 return RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
3173 if (akm & WPA_KEY_MGMT_CCKM)
3174 return RSN_AUTH_KEY_MGMT_CCKM;
3175 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
3176 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
3177 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
3178 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
3179 if (akm & WPA_KEY_MGMT_FILS_SHA256)
3180 return RSN_AUTH_KEY_MGMT_FILS_SHA256;
3181 if (akm & WPA_KEY_MGMT_FILS_SHA384)
3182 return RSN_AUTH_KEY_MGMT_FILS_SHA384;
3183 if (akm & WPA_KEY_MGMT_FT_FILS_SHA256)
3184 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
3185 if (akm & WPA_KEY_MGMT_FT_FILS_SHA384)
3186 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
3187 if (akm & WPA_KEY_MGMT_SAE)
3188 return RSN_AUTH_KEY_MGMT_SAE;
3189 if (akm & WPA_KEY_MGMT_SAE_EXT_KEY)
3190 return RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
3191 if (akm & WPA_KEY_MGMT_FT_SAE)
3192 return RSN_AUTH_KEY_MGMT_FT_SAE;
3193 if (akm & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
3194 return RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY;
3195 if (akm & WPA_KEY_MGMT_OWE)
3196 return RSN_AUTH_KEY_MGMT_OWE;
3197 if (akm & WPA_KEY_MGMT_DPP)
3198 return RSN_AUTH_KEY_MGMT_DPP;
3199 #ifdef CONFIG_PASN
3200 if (akm & WPA_KEY_MGMT_PASN)
3201 return RSN_AUTH_KEY_MGMT_PASN;
3202 #endif /* CONFIG_PASN */
3203 if (akm & WPA_KEY_MGMT_EPPKE)
3204 return RSN_AUTH_KEY_MGMT_EPPKE;
3205 return 0;
3206 }
3207
3208
wpa_compare_rsn_ie(int ft_initial_assoc,const u8 * ie1,size_t ie1len,const u8 * ie2,size_t ie2len)3209 int wpa_compare_rsn_ie(int ft_initial_assoc,
3210 const u8 *ie1, size_t ie1len,
3211 const u8 *ie2, size_t ie2len)
3212 {
3213 if (ie1 == NULL || ie2 == NULL)
3214 return -1;
3215
3216 if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
3217 return 0; /* identical IEs */
3218
3219 #ifdef CONFIG_IEEE80211R
3220 if (ft_initial_assoc) {
3221 struct wpa_ie_data ie1d, ie2d;
3222 /*
3223 * The PMKID-List in RSN IE is different between Beacon/Probe
3224 * Response/(Re)Association Request frames and EAPOL-Key
3225 * messages in FT initial mobility domain association. Allow
3226 * for this, but verify that other parts of the RSN IEs are
3227 * identical.
3228 */
3229 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
3230 wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
3231 return -1;
3232 if (ie1d.proto == ie2d.proto &&
3233 ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
3234 ie1d.group_cipher == ie2d.group_cipher &&
3235 ie1d.key_mgmt == ie2d.key_mgmt &&
3236 ie1d.capabilities == ie2d.capabilities &&
3237 ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
3238 return 0;
3239 }
3240 #endif /* CONFIG_IEEE80211R */
3241
3242 return -1;
3243 }
3244
3245
3246 /**
3247 * wpa_compare_rsn_ie_params - Compare RSN IE parameters
3248 * @rsne1: Pointer to first RSNE (with element ID and length)
3249 * @rsne1_len: Length of the first RSNE
3250 * @rsnee2: Pointer to second RSNE (with element ID and length)
3251 * @rsne2_len: Length of the second RSNE
3252 * Returns: 0 if parameters match, -1 otherwise
3253 *
3254 * Compare the security parameters (proto, ciphers, key_mgmt)
3255 * of two RSN IEs.
3256 */
wpa_compare_rsne_params(const u8 * rsne1,size_t rsne1_len,const u8 * rsne2,size_t rsne2_len)3257 int wpa_compare_rsne_params(const u8 *rsne1, size_t rsne1_len,
3258 const u8 *rsne2, size_t rsne2_len)
3259 {
3260 struct wpa_ie_data rsn1, rsn2;
3261
3262 if (!rsne1 || !rsne2)
3263 return -1;
3264
3265 if (wpa_parse_wpa_ie_rsn(rsne1, rsne1_len, &rsn1) < 0 ||
3266 wpa_parse_wpa_ie_rsn(rsne2, rsne2_len, &rsn2) < 0)
3267 return -1;
3268
3269 if (rsn1.proto == rsn2.proto &&
3270 rsn1.pairwise_cipher == rsn2.pairwise_cipher &&
3271 rsn1.key_mgmt == rsn2.key_mgmt)
3272 return 0;
3273
3274 return -1;
3275 }
3276
3277
wpa_insert_pmkid(u8 * ies,size_t * ies_len,const u8 * pmkid,bool replace)3278 int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid, bool replace)
3279 {
3280 u8 *start, *end, *rpos, *rend;
3281 int added = 0;
3282
3283 start = ies;
3284 end = ies + *ies_len;
3285
3286 while (start < end) {
3287 if (*start == WLAN_EID_RSN)
3288 break;
3289 start += 2 + start[1];
3290 }
3291 if (start >= end) {
3292 wpa_printf(MSG_ERROR, "RSN: Could not find RSNE in IEs data");
3293 return -1;
3294 }
3295 wpa_hexdump(MSG_DEBUG, "RSN: RSNE before modification",
3296 start, 2 + start[1]);
3297
3298 /* Find start of PMKID-Count */
3299 rpos = start + 2;
3300 rend = rpos + start[1];
3301
3302 /* Skip Version and Group Data Cipher Suite */
3303 rpos += 2 + 4;
3304 /* Skip Pairwise Cipher Suite Count and List */
3305 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
3306 /* Skip AKM Suite Count and List */
3307 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
3308
3309 if (rpos == rend) {
3310 /* Add RSN Capabilities */
3311 os_memmove(rpos + 2, rpos, end - rpos);
3312 *rpos++ = 0;
3313 *rpos++ = 0;
3314 added += 2;
3315 start[1] += 2;
3316 rend = rpos;
3317 } else {
3318 /* Skip RSN Capabilities */
3319 rpos += 2;
3320 if (rpos > rend) {
3321 wpa_printf(MSG_ERROR,
3322 "RSN: Could not parse RSNE in IEs data");
3323 return -1;
3324 }
3325 }
3326
3327 if (rpos == rend) {
3328 /* No PMKID-Count field included; add it */
3329 os_memmove(rpos + 2 + PMKID_LEN, rpos, end + added - rpos);
3330 WPA_PUT_LE16(rpos, 1);
3331 rpos += 2;
3332 os_memcpy(rpos, pmkid, PMKID_LEN);
3333 added += 2 + PMKID_LEN;
3334 start[1] += 2 + PMKID_LEN;
3335 } else {
3336 u16 num_pmkid;
3337
3338 if (rend - rpos < 2)
3339 return -1;
3340 num_pmkid = WPA_GET_LE16(rpos);
3341 if (num_pmkid * PMKID_LEN > rend - rpos - 2)
3342 return -1;
3343 /* PMKID-Count was included; use it */
3344 if (replace && num_pmkid != 0) {
3345 u8 *after;
3346
3347 /*
3348 * PMKID may have been included in RSN IE in
3349 * (Re)Association Request frame, so remove the old
3350 * PMKID(s) first before adding the new one.
3351 */
3352 wpa_printf(MSG_DEBUG,
3353 "RSN: Remove %u old PMKID(s) from RSNE",
3354 num_pmkid);
3355 after = rpos + 2 + num_pmkid * PMKID_LEN;
3356 os_memmove(rpos + 2, after, end - after);
3357 start[1] -= num_pmkid * PMKID_LEN;
3358 added -= num_pmkid * PMKID_LEN;
3359 num_pmkid = 0;
3360 }
3361 WPA_PUT_LE16(rpos, num_pmkid + 1);
3362 rpos += 2;
3363 os_memmove(rpos + PMKID_LEN, rpos, end + added - rpos);
3364 os_memcpy(rpos, pmkid, PMKID_LEN);
3365 added += PMKID_LEN;
3366 start[1] += PMKID_LEN;
3367 }
3368
3369 wpa_hexdump(MSG_DEBUG, "RSN: RSNE after modification (PMKID inserted)",
3370 start, 2 + start[1]);
3371
3372 *ies_len += added;
3373
3374 return 0;
3375 }
3376
3377
wpa_cipher_key_len(int cipher)3378 int wpa_cipher_key_len(int cipher)
3379 {
3380 switch (cipher) {
3381 case WPA_CIPHER_CCMP_256:
3382 case WPA_CIPHER_GCMP_256:
3383 case WPA_CIPHER_BIP_GMAC_256:
3384 case WPA_CIPHER_BIP_CMAC_256:
3385 return 32;
3386 case WPA_CIPHER_CCMP:
3387 case WPA_CIPHER_GCMP:
3388 case WPA_CIPHER_AES_128_CMAC:
3389 case WPA_CIPHER_BIP_GMAC_128:
3390 return 16;
3391 case WPA_CIPHER_TKIP:
3392 return 32;
3393 default:
3394 return 0;
3395 }
3396 }
3397
3398
wpa_cipher_rsc_len(int cipher)3399 int wpa_cipher_rsc_len(int cipher)
3400 {
3401 switch (cipher) {
3402 case WPA_CIPHER_CCMP_256:
3403 case WPA_CIPHER_GCMP_256:
3404 case WPA_CIPHER_CCMP:
3405 case WPA_CIPHER_GCMP:
3406 case WPA_CIPHER_TKIP:
3407 return 6;
3408 default:
3409 return 0;
3410 }
3411 }
3412
3413
wpa_cipher_to_alg(int cipher)3414 enum wpa_alg wpa_cipher_to_alg(int cipher)
3415 {
3416 switch (cipher) {
3417 case WPA_CIPHER_CCMP_256:
3418 return WPA_ALG_CCMP_256;
3419 case WPA_CIPHER_GCMP_256:
3420 return WPA_ALG_GCMP_256;
3421 case WPA_CIPHER_CCMP:
3422 return WPA_ALG_CCMP;
3423 case WPA_CIPHER_GCMP:
3424 return WPA_ALG_GCMP;
3425 case WPA_CIPHER_TKIP:
3426 return WPA_ALG_TKIP;
3427 case WPA_CIPHER_AES_128_CMAC:
3428 return WPA_ALG_BIP_CMAC_128;
3429 case WPA_CIPHER_BIP_GMAC_128:
3430 return WPA_ALG_BIP_GMAC_128;
3431 case WPA_CIPHER_BIP_GMAC_256:
3432 return WPA_ALG_BIP_GMAC_256;
3433 case WPA_CIPHER_BIP_CMAC_256:
3434 return WPA_ALG_BIP_CMAC_256;
3435 default:
3436 return WPA_ALG_NONE;
3437 }
3438 }
3439
3440
wpa_cipher_valid_pairwise(int cipher)3441 int wpa_cipher_valid_pairwise(int cipher)
3442 {
3443 #ifdef CONFIG_NO_TKIP
3444 return cipher == WPA_CIPHER_CCMP_256 ||
3445 cipher == WPA_CIPHER_GCMP_256 ||
3446 cipher == WPA_CIPHER_CCMP ||
3447 cipher == WPA_CIPHER_GCMP;
3448 #else /* CONFIG_NO_TKIP */
3449 return cipher == WPA_CIPHER_CCMP_256 ||
3450 cipher == WPA_CIPHER_GCMP_256 ||
3451 cipher == WPA_CIPHER_CCMP ||
3452 cipher == WPA_CIPHER_GCMP ||
3453 cipher == WPA_CIPHER_TKIP;
3454 #endif /* CONFIG_NO_TKIP */
3455 }
3456
3457
wpa_cipher_to_suite(int proto,int cipher)3458 u32 wpa_cipher_to_suite(int proto, int cipher)
3459 {
3460 if (cipher & WPA_CIPHER_CCMP_256)
3461 return RSN_CIPHER_SUITE_CCMP_256;
3462 if (cipher & WPA_CIPHER_GCMP_256)
3463 return RSN_CIPHER_SUITE_GCMP_256;
3464 if (cipher & WPA_CIPHER_CCMP)
3465 return (proto == WPA_PROTO_RSN ?
3466 RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
3467 if (cipher & WPA_CIPHER_GCMP)
3468 return RSN_CIPHER_SUITE_GCMP;
3469 if (cipher & WPA_CIPHER_TKIP)
3470 return (proto == WPA_PROTO_RSN ?
3471 RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
3472 if (cipher & WPA_CIPHER_NONE)
3473 return (proto == WPA_PROTO_RSN ?
3474 RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
3475 if (cipher & WPA_CIPHER_GTK_NOT_USED)
3476 return RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED;
3477 if (cipher & WPA_CIPHER_AES_128_CMAC)
3478 return RSN_CIPHER_SUITE_AES_128_CMAC;
3479 if (cipher & WPA_CIPHER_BIP_GMAC_128)
3480 return RSN_CIPHER_SUITE_BIP_GMAC_128;
3481 if (cipher & WPA_CIPHER_BIP_GMAC_256)
3482 return RSN_CIPHER_SUITE_BIP_GMAC_256;
3483 if (cipher & WPA_CIPHER_BIP_CMAC_256)
3484 return RSN_CIPHER_SUITE_BIP_CMAC_256;
3485 return 0;
3486 }
3487
3488
rsn_cipher_put_suites(u8 * start,int ciphers)3489 int rsn_cipher_put_suites(u8 *start, int ciphers)
3490 {
3491 u8 *pos = start;
3492
3493 if (ciphers & WPA_CIPHER_CCMP_256) {
3494 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP_256);
3495 pos += RSN_SELECTOR_LEN;
3496 }
3497 if (ciphers & WPA_CIPHER_GCMP_256) {
3498 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
3499 pos += RSN_SELECTOR_LEN;
3500 }
3501 if (ciphers & WPA_CIPHER_CCMP) {
3502 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
3503 pos += RSN_SELECTOR_LEN;
3504 }
3505 if (ciphers & WPA_CIPHER_GCMP) {
3506 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
3507 pos += RSN_SELECTOR_LEN;
3508 }
3509 if (ciphers & WPA_CIPHER_TKIP) {
3510 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
3511 pos += RSN_SELECTOR_LEN;
3512 }
3513 if (ciphers & WPA_CIPHER_NONE) {
3514 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
3515 pos += RSN_SELECTOR_LEN;
3516 }
3517
3518 return (pos - start) / RSN_SELECTOR_LEN;
3519 }
3520
3521
wpa_cipher_put_suites(u8 * start,int ciphers)3522 int wpa_cipher_put_suites(u8 *start, int ciphers)
3523 {
3524 u8 *pos = start;
3525
3526 if (ciphers & WPA_CIPHER_CCMP) {
3527 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
3528 pos += WPA_SELECTOR_LEN;
3529 }
3530 if (ciphers & WPA_CIPHER_TKIP) {
3531 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
3532 pos += WPA_SELECTOR_LEN;
3533 }
3534 if (ciphers & WPA_CIPHER_NONE) {
3535 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
3536 pos += WPA_SELECTOR_LEN;
3537 }
3538
3539 return (pos - start) / RSN_SELECTOR_LEN;
3540 }
3541
3542
wpa_pick_pairwise_cipher(int ciphers,int none_allowed)3543 int wpa_pick_pairwise_cipher(int ciphers, int none_allowed)
3544 {
3545 if (ciphers & WPA_CIPHER_GCMP_256)
3546 return WPA_CIPHER_GCMP_256;
3547 if (ciphers & WPA_CIPHER_CCMP_256)
3548 return WPA_CIPHER_CCMP_256;
3549 if (ciphers & WPA_CIPHER_CCMP)
3550 return WPA_CIPHER_CCMP;
3551 if (ciphers & WPA_CIPHER_GCMP)
3552 return WPA_CIPHER_GCMP;
3553 if (ciphers & WPA_CIPHER_TKIP)
3554 return WPA_CIPHER_TKIP;
3555 if (none_allowed && (ciphers & WPA_CIPHER_NONE))
3556 return WPA_CIPHER_NONE;
3557 return -1;
3558 }
3559
3560
wpa_pick_group_cipher(int ciphers)3561 int wpa_pick_group_cipher(int ciphers)
3562 {
3563 if (ciphers & WPA_CIPHER_GCMP_256)
3564 return WPA_CIPHER_GCMP_256;
3565 if (ciphers & WPA_CIPHER_CCMP_256)
3566 return WPA_CIPHER_CCMP_256;
3567 if (ciphers & WPA_CIPHER_CCMP)
3568 return WPA_CIPHER_CCMP;
3569 if (ciphers & WPA_CIPHER_GCMP)
3570 return WPA_CIPHER_GCMP;
3571 if (ciphers & WPA_CIPHER_GTK_NOT_USED)
3572 return WPA_CIPHER_GTK_NOT_USED;
3573 if (ciphers & WPA_CIPHER_TKIP)
3574 return WPA_CIPHER_TKIP;
3575 return -1;
3576 }
3577
3578
wpa_parse_cipher(const char * value)3579 int wpa_parse_cipher(const char *value)
3580 {
3581 int val = 0, last;
3582 char *start, *end, *buf;
3583
3584 buf = os_strdup(value);
3585 if (buf == NULL)
3586 return -1;
3587 start = buf;
3588
3589 while (*start != '\0') {
3590 while (*start == ' ' || *start == '\t')
3591 start++;
3592 if (*start == '\0')
3593 break;
3594 end = start;
3595 while (*end != ' ' && *end != '\t' && *end != '\0')
3596 end++;
3597 last = *end == '\0';
3598 *end = '\0';
3599 if (os_strcmp(start, "CCMP-256") == 0)
3600 val |= WPA_CIPHER_CCMP_256;
3601 else if (os_strcmp(start, "GCMP-256") == 0)
3602 val |= WPA_CIPHER_GCMP_256;
3603 else if (os_strcmp(start, "CCMP") == 0)
3604 val |= WPA_CIPHER_CCMP;
3605 else if (os_strcmp(start, "GCMP") == 0)
3606 val |= WPA_CIPHER_GCMP;
3607 #ifndef CONFIG_NO_TKIP
3608 else if (os_strcmp(start, "TKIP") == 0)
3609 val |= WPA_CIPHER_TKIP;
3610 #endif /* CONFIG_NO_TKIP */
3611 #ifdef CONFIG_WEP
3612 else if (os_strcmp(start, "WEP104") == 0)
3613 val |= WPA_CIPHER_WEP104;
3614 else if (os_strcmp(start, "WEP40") == 0)
3615 val |= WPA_CIPHER_WEP40;
3616 #endif /* CONFIG_WEP */
3617 else if (os_strcmp(start, "NONE") == 0)
3618 val |= WPA_CIPHER_NONE;
3619 else if (os_strcmp(start, "GTK_NOT_USED") == 0)
3620 val |= WPA_CIPHER_GTK_NOT_USED;
3621 else if (os_strcmp(start, "AES-128-CMAC") == 0)
3622 val |= WPA_CIPHER_AES_128_CMAC;
3623 else if (os_strcmp(start, "BIP-GMAC-128") == 0)
3624 val |= WPA_CIPHER_BIP_GMAC_128;
3625 else if (os_strcmp(start, "BIP-GMAC-256") == 0)
3626 val |= WPA_CIPHER_BIP_GMAC_256;
3627 else if (os_strcmp(start, "BIP-CMAC-256") == 0)
3628 val |= WPA_CIPHER_BIP_CMAC_256;
3629 else {
3630 os_free(buf);
3631 return -1;
3632 }
3633
3634 if (last)
3635 break;
3636 start = end + 1;
3637 }
3638 os_free(buf);
3639
3640 return val;
3641 }
3642
3643
wpa_write_ciphers(char * start,char * end,int ciphers,const char * delim)3644 int wpa_write_ciphers(char *start, char *end, int ciphers, const char *delim)
3645 {
3646 char *pos = start;
3647 int ret;
3648
3649 if (ciphers & WPA_CIPHER_CCMP_256) {
3650 ret = os_snprintf(pos, end - pos, "%sCCMP-256",
3651 pos == start ? "" : delim);
3652 if (os_snprintf_error(end - pos, ret))
3653 return -1;
3654 pos += ret;
3655 }
3656 if (ciphers & WPA_CIPHER_GCMP_256) {
3657 ret = os_snprintf(pos, end - pos, "%sGCMP-256",
3658 pos == start ? "" : delim);
3659 if (os_snprintf_error(end - pos, ret))
3660 return -1;
3661 pos += ret;
3662 }
3663 if (ciphers & WPA_CIPHER_CCMP) {
3664 ret = os_snprintf(pos, end - pos, "%sCCMP",
3665 pos == start ? "" : delim);
3666 if (os_snprintf_error(end - pos, ret))
3667 return -1;
3668 pos += ret;
3669 }
3670 if (ciphers & WPA_CIPHER_GCMP) {
3671 ret = os_snprintf(pos, end - pos, "%sGCMP",
3672 pos == start ? "" : delim);
3673 if (os_snprintf_error(end - pos, ret))
3674 return -1;
3675 pos += ret;
3676 }
3677 if (ciphers & WPA_CIPHER_TKIP) {
3678 ret = os_snprintf(pos, end - pos, "%sTKIP",
3679 pos == start ? "" : delim);
3680 if (os_snprintf_error(end - pos, ret))
3681 return -1;
3682 pos += ret;
3683 }
3684 if (ciphers & WPA_CIPHER_AES_128_CMAC) {
3685 ret = os_snprintf(pos, end - pos, "%sAES-128-CMAC",
3686 pos == start ? "" : delim);
3687 if (os_snprintf_error(end - pos, ret))
3688 return -1;
3689 pos += ret;
3690 }
3691 if (ciphers & WPA_CIPHER_BIP_GMAC_128) {
3692 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-128",
3693 pos == start ? "" : delim);
3694 if (os_snprintf_error(end - pos, ret))
3695 return -1;
3696 pos += ret;
3697 }
3698 if (ciphers & WPA_CIPHER_BIP_GMAC_256) {
3699 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-256",
3700 pos == start ? "" : delim);
3701 if (os_snprintf_error(end - pos, ret))
3702 return -1;
3703 pos += ret;
3704 }
3705 if (ciphers & WPA_CIPHER_BIP_CMAC_256) {
3706 ret = os_snprintf(pos, end - pos, "%sBIP-CMAC-256",
3707 pos == start ? "" : delim);
3708 if (os_snprintf_error(end - pos, ret))
3709 return -1;
3710 pos += ret;
3711 }
3712 if (ciphers & WPA_CIPHER_NONE) {
3713 ret = os_snprintf(pos, end - pos, "%sNONE",
3714 pos == start ? "" : delim);
3715 if (os_snprintf_error(end - pos, ret))
3716 return -1;
3717 pos += ret;
3718 }
3719
3720 return pos - start;
3721 }
3722
3723
wpa_select_ap_group_cipher(int wpa,int wpa_pairwise,int rsn_pairwise)3724 int wpa_select_ap_group_cipher(int wpa, int wpa_pairwise, int rsn_pairwise)
3725 {
3726 int pairwise = 0;
3727
3728 /* Select group cipher based on the enabled pairwise cipher suites */
3729 if (wpa & 1)
3730 pairwise |= wpa_pairwise;
3731 if (wpa & 2)
3732 pairwise |= rsn_pairwise;
3733
3734 if (pairwise & WPA_CIPHER_TKIP)
3735 return WPA_CIPHER_TKIP;
3736 if ((pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP)
3737 return WPA_CIPHER_GCMP;
3738 if ((pairwise & (WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP |
3739 WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP_256)
3740 return WPA_CIPHER_GCMP_256;
3741 if ((pairwise & (WPA_CIPHER_CCMP_256 | WPA_CIPHER_CCMP |
3742 WPA_CIPHER_GCMP)) == WPA_CIPHER_CCMP_256)
3743 return WPA_CIPHER_CCMP_256;
3744 return WPA_CIPHER_CCMP;
3745 }
3746
3747
3748 #ifdef CONFIG_FILS
fils_domain_name_hash(const char * domain,u8 * hash)3749 int fils_domain_name_hash(const char *domain, u8 *hash)
3750 {
3751 char buf[255], *wpos = buf;
3752 const char *pos = domain;
3753 size_t len;
3754 const u8 *addr[1];
3755 u8 mac[SHA256_MAC_LEN];
3756
3757 for (len = 0; len < sizeof(buf) && *pos; len++) {
3758 if (isalpha(*pos) && isupper(*pos))
3759 *wpos++ = tolower(*pos);
3760 else
3761 *wpos++ = *pos;
3762 pos++;
3763 }
3764
3765 addr[0] = (const u8 *) buf;
3766 if (sha256_vector(1, addr, &len, mac) < 0)
3767 return -1;
3768 os_memcpy(hash, mac, 2);
3769 return 0;
3770 }
3771 #endif /* CONFIG_FILS */
3772
3773
3774 /**
3775 * wpa_parse_vendor_specific - Parse Vendor Specific IEs
3776 * @pos: Pointer to the IE header
3777 * @end: Pointer to the end of the Key Data buffer
3778 * @ie: Pointer to parsed IE data
3779 */
wpa_parse_vendor_specific(const u8 * pos,const u8 * end,struct wpa_eapol_ie_parse * ie)3780 static void wpa_parse_vendor_specific(const u8 *pos, const u8 *end,
3781 struct wpa_eapol_ie_parse *ie)
3782 {
3783 unsigned int oui;
3784
3785 if (pos[1] < 4) {
3786 wpa_printf(MSG_MSGDUMP,
3787 "Too short vendor specific IE ignored (len=%u)",
3788 pos[1]);
3789 return;
3790 }
3791
3792 oui = WPA_GET_BE24(&pos[2]);
3793 if (oui == OUI_MICROSOFT && pos[5] == WMM_OUI_TYPE && pos[1] > 4) {
3794 if (pos[6] == WMM_OUI_SUBTYPE_INFORMATION_ELEMENT) {
3795 ie->wmm = &pos[2];
3796 ie->wmm_len = pos[1];
3797 wpa_hexdump(MSG_DEBUG, "WPA: WMM IE",
3798 ie->wmm, ie->wmm_len);
3799 } else if (pos[6] == WMM_OUI_SUBTYPE_PARAMETER_ELEMENT) {
3800 ie->wmm = &pos[2];
3801 ie->wmm_len = pos[1];
3802 wpa_hexdump(MSG_DEBUG, "WPA: WMM Parameter Element",
3803 ie->wmm, ie->wmm_len);
3804 }
3805 }
3806 }
3807
3808
3809 /**
3810 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
3811 * @pos: Pointer to the IE header
3812 * @ie: Pointer to parsed IE data
3813 * Returns: 0 on success, 1 if end mark is found, 2 if KDE is not recognized
3814 */
wpa_parse_generic(const u8 * pos,struct wpa_eapol_ie_parse * ie)3815 static int wpa_parse_generic(const u8 *pos, struct wpa_eapol_ie_parse *ie)
3816 {
3817 u8 len = pos[1];
3818 size_t dlen = 2 + len;
3819 u32 selector;
3820 const u8 *p;
3821 size_t left;
3822 u8 link_id;
3823 char title[100];
3824 int ret;
3825
3826 if (len == 0)
3827 return 1;
3828
3829 if (len < RSN_SELECTOR_LEN)
3830 return 2;
3831
3832 p = pos + 2;
3833 selector = RSN_SELECTOR_GET(p);
3834 p += RSN_SELECTOR_LEN;
3835 left = len - RSN_SELECTOR_LEN;
3836
3837 if (left >= 2 && selector == WPA_OUI_TYPE && p[0] == 1 && p[1] == 0) {
3838 ie->wpa_ie = pos;
3839 ie->wpa_ie_len = dlen;
3840 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE in EAPOL-Key",
3841 ie->wpa_ie, ie->wpa_ie_len);
3842 return 0;
3843 }
3844
3845 if (left >= PMKID_LEN && selector == RSN_KEY_DATA_PMKID) {
3846 ie->pmkid = p;
3847 wpa_hexdump(MSG_DEBUG, "WPA: PMKID in EAPOL-Key", pos, dlen);
3848 return 0;
3849 }
3850
3851 if (left >= 2 && selector == RSN_KEY_DATA_KEYID) {
3852 ie->key_id = p;
3853 wpa_hexdump(MSG_DEBUG, "WPA: KeyID in EAPOL-Key", pos, dlen);
3854 return 0;
3855 }
3856
3857 if (left > 2 && selector == RSN_KEY_DATA_GROUPKEY) {
3858 ie->gtk = p;
3859 ie->gtk_len = left;
3860 wpa_hexdump_key(MSG_DEBUG, "WPA: GTK in EAPOL-Key", pos, dlen);
3861 return 0;
3862 }
3863
3864 if (left >= ETH_ALEN && selector == RSN_KEY_DATA_MAC_ADDR) {
3865 ie->mac_addr = p;
3866 wpa_printf(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key: " MACSTR,
3867 MAC2STR(ie->mac_addr));
3868 return 0;
3869 }
3870
3871 if (left > 2 && selector == RSN_KEY_DATA_IGTK) {
3872 ie->igtk = p;
3873 ie->igtk_len = left;
3874 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK in EAPOL-Key",
3875 pos, dlen);
3876 return 0;
3877 }
3878
3879 if (left > 2 && selector == RSN_KEY_DATA_BIGTK) {
3880 ie->bigtk = p;
3881 ie->bigtk_len = left;
3882 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK in EAPOL-Key",
3883 pos, dlen);
3884 return 0;
3885 }
3886
3887 if (left > 2 && selector == RSN_KEY_DATA_SAE_PW_IDS) {
3888 ie->sae_pw_ids = p;
3889 ie->sae_pw_ids_len = left;
3890 wpa_hexdump_key(MSG_DEBUG,
3891 "RSN: SAE Password Identifiers in EAPOL-Key",
3892 pos, dlen);
3893 return 0;
3894 }
3895
3896 if (left >= 1 && selector == WFA_KEY_DATA_IP_ADDR_REQ) {
3897 ie->ip_addr_req = p;
3898 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key",
3899 ie->ip_addr_req, left);
3900 return 0;
3901 }
3902
3903 if (left >= 3 * 4 && selector == WFA_KEY_DATA_IP_ADDR_ALLOC) {
3904 ie->ip_addr_alloc = p;
3905 wpa_hexdump(MSG_DEBUG,
3906 "WPA: IP Address Allocation in EAPOL-Key",
3907 ie->ip_addr_alloc, left);
3908 return 0;
3909 }
3910
3911 if (left > 2 && selector == RSN_KEY_DATA_OCI) {
3912 ie->oci = p;
3913 ie->oci_len = left;
3914 wpa_hexdump(MSG_DEBUG, "WPA: OCI KDE in EAPOL-Key",
3915 pos, dlen);
3916 return 0;
3917 }
3918
3919 if (left >= 1 && selector == WFA_KEY_DATA_TRANSITION_DISABLE) {
3920 ie->transition_disable = p;
3921 ie->transition_disable_len = left;
3922 wpa_hexdump(MSG_DEBUG,
3923 "WPA: Transition Disable KDE in EAPOL-Key",
3924 pos, dlen);
3925 return 0;
3926 }
3927
3928 if (left >= 2 && selector == WFA_KEY_DATA_DPP) {
3929 ie->dpp_kde = p;
3930 ie->dpp_kde_len = left;
3931 wpa_hexdump(MSG_DEBUG, "WPA: DPP KDE in EAPOL-Key", pos, dlen);
3932 return 0;
3933 }
3934
3935 if (left >= RSN_MLO_GTK_KDE_PREFIX_LENGTH &&
3936 selector == RSN_KEY_DATA_MLO_GTK) {
3937 link_id = (p[0] & RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_MASK) >>
3938 RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_SHIFT;
3939 if (link_id >= MAX_NUM_MLD_LINKS)
3940 return 2;
3941
3942 ie->valid_mlo_gtks |= BIT(link_id);
3943 ie->mlo_gtk[link_id] = p;
3944 ie->mlo_gtk_len[link_id] = left;
3945 ret = os_snprintf(title, sizeof(title),
3946 "RSN: Link ID %u - MLO GTK KDE in EAPOL-Key",
3947 link_id);
3948 if (!os_snprintf_error(sizeof(title), ret))
3949 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3950 return 0;
3951 }
3952
3953 if (left >= RSN_MLO_IGTK_KDE_PREFIX_LENGTH &&
3954 selector == RSN_KEY_DATA_MLO_IGTK) {
3955 link_id = (p[8] & RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3956 RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3957 if (link_id >= MAX_NUM_MLD_LINKS)
3958 return 2;
3959
3960 ie->valid_mlo_igtks |= BIT(link_id);
3961 ie->mlo_igtk[link_id] = p;
3962 ie->mlo_igtk_len[link_id] = left;
3963 ret = os_snprintf(title, sizeof(title),
3964 "RSN: Link ID %u - MLO IGTK KDE in EAPOL-Key",
3965 link_id);
3966 if (!os_snprintf_error(sizeof(title), ret))
3967 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3968 return 0;
3969 }
3970
3971 if (left >= RSN_MLO_BIGTK_KDE_PREFIX_LENGTH &&
3972 selector == RSN_KEY_DATA_MLO_BIGTK) {
3973 link_id = (p[8] & RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3974 RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3975 if (link_id >= MAX_NUM_MLD_LINKS)
3976 return 2;
3977
3978 ie->valid_mlo_bigtks |= BIT(link_id);
3979 ie->mlo_bigtk[link_id] = p;
3980 ie->mlo_bigtk_len[link_id] = left;
3981 ret = os_snprintf(title, sizeof(title),
3982 "RSN: Link ID %u - MLO BIGTK KDE in EAPOL-Key",
3983 link_id);
3984 if (!os_snprintf_error(sizeof(title), ret))
3985 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3986 return 0;
3987 }
3988
3989 if (left >= RSN_MLO_LINK_KDE_FIXED_LENGTH &&
3990 selector == RSN_KEY_DATA_MLO_LINK) {
3991 link_id = (p[0] & RSN_MLO_LINK_KDE_LI_LINK_ID_MASK) >>
3992 RSN_MLO_LINK_KDE_LI_LINK_ID_SHIFT;
3993 if (link_id >= MAX_NUM_MLD_LINKS)
3994 return 2;
3995
3996 ie->valid_mlo_links |= BIT(link_id);
3997 ie->mlo_link[link_id] = p;
3998 ie->mlo_link_len[link_id] = left;
3999 ret = os_snprintf(title, sizeof(title),
4000 "RSN: Link ID %u - MLO Link KDE in EAPOL-Key",
4001 link_id);
4002 if (!os_snprintf_error(sizeof(title), ret))
4003 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
4004 return 0;
4005 }
4006
4007 if (left >= 1 && selector == WFA_KEY_DATA_RSN_OVERRIDE_LINK) {
4008 link_id = p[0];
4009 if (link_id >= MAX_NUM_MLD_LINKS)
4010 return 2;
4011
4012 ie->rsn_override_link[link_id] = p;
4013 ie->rsn_override_link_len[link_id] = left;
4014 ret = os_snprintf(title, sizeof(title),
4015 "RSN: Link ID %u - RSN Override Link KDE in EAPOL-Key",
4016 link_id);
4017 if (!os_snprintf_error(sizeof(title), ret))
4018 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
4019 return 0;
4020 }
4021
4022 if (selector == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
4023 ie->rsne_override = pos;
4024 ie->rsne_override_len = dlen;
4025 wpa_hexdump(MSG_DEBUG,
4026 "RSN: RSNE Override element in EAPOL-Key",
4027 ie->rsne_override, ie->rsne_override_len);
4028 return 0;
4029 }
4030
4031 if (selector == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
4032 ie->rsne_override_2 = pos;
4033 ie->rsne_override_2_len = dlen;
4034 wpa_hexdump(MSG_DEBUG,
4035 "RSN: RSNE Override 2 element in EAPOL-Key",
4036 ie->rsne_override_2, ie->rsne_override_2_len);
4037 return 0;
4038 }
4039
4040 if (selector == RSNXE_OVERRIDE_IE_VENDOR_TYPE) {
4041 ie->rsnxe_override = pos;
4042 ie->rsnxe_override_len = dlen;
4043 wpa_hexdump(MSG_DEBUG,
4044 "RSN: RSNXE Override element in EAPOL-Key",
4045 ie->rsnxe_override, ie->rsnxe_override_len);
4046 return 0;
4047 }
4048
4049 if (selector == RSN_SELECTION_IE_VENDOR_TYPE) {
4050 ie->rsn_selection = p;
4051 ie->rsn_selection_len = left;
4052 wpa_hexdump(MSG_DEBUG,
4053 "RSN: RSN Selection element in EAPOL-Key",
4054 ie->rsn_selection, ie->rsn_selection_len);
4055 return 0;
4056 }
4057
4058 #if defined(CONFIG_NAN) || defined(CONFIG_PASN)
4059 if (left >= sizeof(struct nan_nik_kde) &&
4060 selector == NAN_KEY_DATA_NIK) {
4061 ie->nan_nik = p;
4062 ie->nan_nik_len = left;
4063 wpa_hexdump_key(MSG_DEBUG, "RSN: NAN NIK KDE in EAPOL-Key",
4064 ie->nan_nik, ie->nan_nik_len);
4065 return 0;
4066 }
4067
4068 if (left >= sizeof(struct nan_key_lifetime_kde) &&
4069 selector == NAN_KEY_DATA_LIFETIME) {
4070 ie->nan_key_lifetime = p;
4071 ie->nan_key_lifetime_len = left;
4072 wpa_hexdump(MSG_DEBUG,
4073 "RSN: NAN Key Lifetime KDE in EAPOL-Key",
4074 ie->nan_key_lifetime, ie->nan_key_lifetime_len);
4075 return 0;
4076 }
4077 #endif /* CONFIG_NAN || CONFIG_PASN */
4078
4079 return 2;
4080 }
4081
4082
4083 /**
4084 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
4085 * @buf: Pointer to the Key Data buffer
4086 * @len: Key Data Length
4087 * @ie: Pointer to parsed IE data
4088 * Returns: 0 on success, -1 on failure
4089 */
wpa_parse_kde_ies(const u8 * buf,size_t len,struct wpa_eapol_ie_parse * ie)4090 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
4091 {
4092 const u8 *pos, *end;
4093 int ret = 0;
4094 size_t dlen = 0;
4095
4096 os_memset(ie, 0, sizeof(*ie));
4097 for (pos = buf, end = pos + len; end - pos > 1; pos += dlen) {
4098 if (pos[0] == 0xdd &&
4099 ((pos == buf + len - 1) || pos[1] == 0)) {
4100 /* Ignore padding */
4101 break;
4102 }
4103 dlen = 2 + pos[1];
4104 if ((int) dlen > end - pos) {
4105 wpa_printf(MSG_DEBUG,
4106 "WPA: EAPOL-Key Key Data underflow (ie=%d len=%d pos=%d)",
4107 pos[0], pos[1], (int) (pos - buf));
4108 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", buf, len);
4109 ret = -1;
4110 break;
4111 }
4112 if (*pos == WLAN_EID_RSN) {
4113 ie->rsn_ie = pos;
4114 ie->rsn_ie_len = dlen;
4115 wpa_hexdump(MSG_DEBUG, "WPA: RSN IE in EAPOL-Key",
4116 ie->rsn_ie, ie->rsn_ie_len);
4117 } else if (*pos == WLAN_EID_RSNX) {
4118 ie->rsnxe = pos;
4119 ie->rsnxe_len = dlen;
4120 wpa_hexdump(MSG_DEBUG, "WPA: RSNXE in EAPOL-Key",
4121 ie->rsnxe, ie->rsnxe_len);
4122 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
4123 ie->mdie = pos;
4124 ie->mdie_len = dlen;
4125 wpa_hexdump(MSG_DEBUG, "WPA: MDIE in EAPOL-Key",
4126 ie->mdie, ie->mdie_len);
4127 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) {
4128 ie->ftie = pos;
4129 ie->ftie_len = dlen;
4130 wpa_hexdump(MSG_DEBUG, "WPA: FTIE in EAPOL-Key",
4131 ie->ftie, ie->ftie_len);
4132 } else if (*pos == WLAN_EID_TIMEOUT_INTERVAL && pos[1] >= 5) {
4133 if (pos[2] == WLAN_TIMEOUT_REASSOC_DEADLINE) {
4134 ie->reassoc_deadline = pos;
4135 wpa_hexdump(MSG_DEBUG, "WPA: Reassoc Deadline "
4136 "in EAPOL-Key",
4137 ie->reassoc_deadline, dlen);
4138 } else if (pos[2] == WLAN_TIMEOUT_KEY_LIFETIME) {
4139 ie->key_lifetime = pos;
4140 wpa_hexdump(MSG_DEBUG, "WPA: KeyLifetime "
4141 "in EAPOL-Key",
4142 ie->key_lifetime, dlen);
4143 } else {
4144 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized "
4145 "EAPOL-Key Key Data IE",
4146 pos, dlen);
4147 }
4148 } else if (*pos == WLAN_EID_LINK_ID) {
4149 if (pos[1] >= 18) {
4150 ie->lnkid = pos;
4151 ie->lnkid_len = dlen;
4152 }
4153 } else if (*pos == WLAN_EID_EXT_CAPAB) {
4154 ie->ext_capab = pos;
4155 ie->ext_capab_len = dlen;
4156 } else if (*pos == WLAN_EID_SUPP_RATES) {
4157 ie->supp_rates = pos;
4158 ie->supp_rates_len = dlen;
4159 } else if (*pos == WLAN_EID_EXT_SUPP_RATES) {
4160 ie->ext_supp_rates = pos;
4161 ie->ext_supp_rates_len = dlen;
4162 } else if (*pos == WLAN_EID_HT_CAP &&
4163 pos[1] >= sizeof(struct ieee80211_ht_capabilities)) {
4164 ie->ht_capabilities = pos + 2;
4165 } else if (*pos == WLAN_EID_AID) {
4166 if (pos[1] >= 2)
4167 ie->aid = WPA_GET_LE16(pos + 2) & 0x3fff;
4168 } else if (*pos == WLAN_EID_VHT_CAP &&
4169 pos[1] >= sizeof(struct ieee80211_vht_capabilities))
4170 {
4171 ie->vht_capabilities = pos + 2;
4172 } else if (*pos == WLAN_EID_EXTENSION &&
4173 pos[1] >= 1 + IEEE80211_HE_CAPAB_MIN_LEN &&
4174 pos[2] == WLAN_EID_EXT_HE_CAPABILITIES) {
4175 ie->he_capabilities = pos + 3;
4176 ie->he_capab_len = pos[1] - 1;
4177 } else if (*pos == WLAN_EID_EXTENSION &&
4178 pos[1] >= 1 +
4179 sizeof(struct ieee80211_he_6ghz_band_cap) &&
4180 pos[2] == WLAN_EID_EXT_HE_6GHZ_BAND_CAP) {
4181 ie->he_6ghz_capabilities = pos + 3;
4182 } else if (*pos == WLAN_EID_EXTENSION &&
4183 pos[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN &&
4184 pos[2] == WLAN_EID_EXT_EHT_CAPABILITIES) {
4185 ie->eht_capabilities = pos + 3;
4186 ie->eht_capab_len = pos[1] - 1;
4187 } else if (*pos == WLAN_EID_QOS && pos[1] >= 1) {
4188 ie->qosinfo = pos[2];
4189 } else if (*pos == WLAN_EID_SUPPORTED_CHANNELS) {
4190 ie->supp_channels = pos + 2;
4191 ie->supp_channels_len = pos[1];
4192 } else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) {
4193 /*
4194 * The value of the Length field of the Supported
4195 * Operating Classes element is between 2 and 253.
4196 * Silently skip invalid elements to avoid interop
4197 * issues when trying to use the value.
4198 */
4199 if (pos[1] >= 2 && pos[1] <= 253) {
4200 ie->supp_oper_classes = pos + 2;
4201 ie->supp_oper_classes_len = pos[1];
4202 }
4203 } else if (*pos == WLAN_EID_SSID) {
4204 ie->ssid = pos + 2;
4205 ie->ssid_len = pos[1];
4206 wpa_hexdump_ascii(MSG_DEBUG, "RSN: SSID in EAPOL-Key",
4207 ie->ssid, ie->ssid_len);
4208 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
4209 ret = wpa_parse_generic(pos, ie);
4210 if (ret == 1) {
4211 /* end mark found */
4212 ret = 0;
4213 break;
4214 }
4215
4216 if (ret == 2) {
4217 /* not a known KDE */
4218 wpa_parse_vendor_specific(pos, end, ie);
4219 }
4220
4221 ret = 0;
4222 } else {
4223 wpa_hexdump(MSG_DEBUG,
4224 "WPA: Unrecognized EAPOL-Key Key Data IE",
4225 pos, dlen);
4226 }
4227 }
4228
4229 return ret;
4230 }
4231
4232
4233 #ifdef CONFIG_PASN
4234
4235 /*
4236 * wpa_pasn_build_auth_header - Add the MAC header and initialize Authentication
4237 * frame for PASN/EPPKE
4238 *
4239 * @buf: Buffer in which the header will be added
4240 * @bssid: The BSSID of the AP
4241 * @src: Source address
4242 * @dst: Destination address
4243 * @trans_seq: Authentication transaction sequence number
4244 * @status: Authentication status
4245 * @is_eppke: EPPKE authentication
4246 */
wpa_pasn_build_auth_header(struct wpabuf * buf,const u8 * bssid,const u8 * src,const u8 * dst,u8 trans_seq,u16 status,bool is_eppke)4247 void wpa_pasn_build_auth_header(struct wpabuf *buf, const u8 *bssid,
4248 const u8 *src, const u8 *dst,
4249 u8 trans_seq, u16 status, bool is_eppke)
4250 {
4251 struct ieee80211_mgmt *auth;
4252 u16 auth_alg = is_eppke ? WLAN_AUTH_EPPKE : WLAN_AUTH_PASN;
4253
4254 wpa_printf(MSG_DEBUG, "%s: Add authentication header trans_seq=%u",
4255 is_eppke ? "EPPKE" : "PASN", trans_seq);
4256
4257 auth = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
4258 u.auth.variable));
4259
4260 auth->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
4261 (WLAN_FC_STYPE_AUTH << 4));
4262
4263 os_memcpy(auth->da, dst, ETH_ALEN);
4264 os_memcpy(auth->sa, src, ETH_ALEN);
4265 os_memcpy(auth->bssid, bssid, ETH_ALEN);
4266 auth->seq_ctrl = 0;
4267
4268 auth->u.auth.auth_alg = host_to_le16(auth_alg);
4269 auth->u.auth.auth_transaction = host_to_le16(trans_seq);
4270 auth->u.auth.status_code = host_to_le16(status);
4271 }
4272
4273
4274 /*
4275 * wpa_pasn_add_rsne - Add an RSNE for PASN authentication
4276 * @buf: Buffer in which the IE will be added
4277 * @pmkid: Optional PMKID. Can be NULL.
4278 * @akmp: Authentication and key management protocol
4279 * @cipher: The cipher suite
4280 */
wpa_pasn_add_rsne(struct wpabuf * buf,const u8 * pmkid,int akmp,int cipher)4281 int wpa_pasn_add_rsne(struct wpabuf *buf, const u8 *pmkid, int akmp, int cipher)
4282 {
4283 struct rsn_ie_hdr *hdr;
4284 u32 suite;
4285 u16 capab;
4286 u8 *pos;
4287 u8 rsne_len;
4288
4289 wpa_printf(MSG_DEBUG, "PASN: Add RSNE");
4290
4291 rsne_len = sizeof(*hdr) + RSN_SELECTOR_LEN +
4292 2 + RSN_SELECTOR_LEN + 2 + RSN_SELECTOR_LEN +
4293 2 + RSN_SELECTOR_LEN + 2 + (pmkid ? PMKID_LEN : 0);
4294
4295 if (wpabuf_tailroom(buf) < rsne_len)
4296 return -1;
4297 hdr = wpabuf_put(buf, rsne_len);
4298 hdr->elem_id = WLAN_EID_RSN;
4299 hdr->len = rsne_len - 2;
4300 WPA_PUT_LE16(hdr->version, RSN_VERSION);
4301 pos = (u8 *) (hdr + 1);
4302
4303 /* Group addressed data is not allowed */
4304 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
4305 pos += RSN_SELECTOR_LEN;
4306
4307 /* Add the pairwise cipher */
4308 WPA_PUT_LE16(pos, 1);
4309 pos += 2;
4310 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, cipher);
4311 RSN_SELECTOR_PUT(pos, suite);
4312 pos += RSN_SELECTOR_LEN;
4313
4314 /* Add the AKM suite */
4315 WPA_PUT_LE16(pos, 1);
4316 pos += 2;
4317
4318 switch (akmp) {
4319 case WPA_KEY_MGMT_PASN:
4320 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PASN);
4321 break;
4322 #ifdef CONFIG_ENC_ASSOC
4323 case WPA_KEY_MGMT_EPPKE:
4324 /* EPPKE without base AKM: EPPKE AKMP is used as the selected
4325 * AKMP per IEEE P802.11bi/D4.0, 12.16.9.1. */
4326 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_EPPKE);
4327 break;
4328 #endif /* CONFIG_ENC_ASSOC */
4329 #ifdef CONFIG_SAE
4330 case WPA_KEY_MGMT_SAE:
4331 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
4332 break;
4333 case WPA_KEY_MGMT_SAE_EXT_KEY:
4334 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE_EXT_KEY);
4335 break;
4336 #endif /* CONFIG_SAE */
4337 #ifdef CONFIG_FILS
4338 case WPA_KEY_MGMT_FILS_SHA256:
4339 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
4340 break;
4341 case WPA_KEY_MGMT_FILS_SHA384:
4342 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
4343 break;
4344 #endif /* CONFIG_FILS */
4345 #ifdef CONFIG_IEEE80211R
4346 case WPA_KEY_MGMT_FT_PSK:
4347 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
4348 break;
4349 case WPA_KEY_MGMT_FT_IEEE8021X:
4350 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
4351 break;
4352 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
4353 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
4354 break;
4355 #endif /* CONFIG_IEEE80211R */
4356 default:
4357 wpa_printf(MSG_ERROR, "PASN: Invalid AKMP=0x%x", akmp);
4358 return -1;
4359 }
4360 pos += RSN_SELECTOR_LEN;
4361
4362 /* RSN Capabilities: PASN mandates both MFP capable and required */
4363 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
4364 WPA_PUT_LE16(pos, capab);
4365 pos += 2;
4366
4367 if (pmkid) {
4368 wpa_printf(MSG_DEBUG, "PASN: Adding PMKID");
4369
4370 WPA_PUT_LE16(pos, 1);
4371 pos += 2;
4372 os_memcpy(pos, pmkid, PMKID_LEN);
4373 pos += PMKID_LEN;
4374 } else {
4375 WPA_PUT_LE16(pos, 0);
4376 pos += 2;
4377 }
4378
4379 /* Group addressed management is not allowed */
4380 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
4381
4382 return 0;
4383 }
4384
4385
4386 /*
4387 * wpa_pasn_add_parameter_ie - Add PASN Parameters IE for PASN authentication
4388 * @buf: Buffer in which the IE will be added
4389 * @pasn_group: Finite Cyclic Group ID for PASN authentication
4390 * @wrapped_data_format: Format of the data in the Wrapped Data IE
4391 * @pubkey: A buffer holding the local public key. Can be NULL
4392 * @compressed: In case pubkey is included, indicates if the public key is
4393 * compressed (only x coordinate is included) or not (both x and y
4394 * coordinates are included)
4395 * @comeback: A buffer holding the comeback token. Can be NULL
4396 * @after: If comeback is set, defined the comeback time in seconds. -1 to not
4397 * include the Comeback After field (frames from non-AP STA).
4398 */
wpa_pasn_add_parameter_ie(struct wpabuf * buf,u16 pasn_group,u8 wrapped_data_format,const struct wpabuf * pubkey,bool compressed,const struct wpabuf * comeback,int after)4399 void wpa_pasn_add_parameter_ie(struct wpabuf *buf, u16 pasn_group,
4400 u8 wrapped_data_format,
4401 const struct wpabuf *pubkey, bool compressed,
4402 const struct wpabuf *comeback, int after)
4403 {
4404 struct pasn_parameter_ie *params;
4405
4406 wpa_printf(MSG_DEBUG, "PASN: Add PASN Parameters element");
4407
4408 params = wpabuf_put(buf, sizeof(*params));
4409
4410 params->id = WLAN_EID_EXTENSION;
4411 params->len = sizeof(*params) - 2;
4412 params->id_ext = WLAN_EID_EXT_PASN_PARAMS;
4413 params->control = 0;
4414 params->wrapped_data_format = wrapped_data_format;
4415
4416 if (comeback) {
4417 wpa_printf(MSG_DEBUG, "PASN: Adding comeback data");
4418
4419 /*
4420 * 2 octets for the 'after' field + 1 octet for the length +
4421 * actual cookie data
4422 */
4423 if (after >= 0)
4424 params->len += 2;
4425 params->len += 1 + wpabuf_len(comeback);
4426 params->control |= WPA_PASN_CTRL_COMEBACK_INFO_PRESENT;
4427
4428 if (after >= 0)
4429 wpabuf_put_le16(buf, after);
4430 wpabuf_put_u8(buf, wpabuf_len(comeback));
4431 wpabuf_put_buf(buf, comeback);
4432 }
4433
4434 if (pubkey) {
4435 wpa_printf(MSG_DEBUG,
4436 "PASN: Adding public key and group ID %u",
4437 pasn_group);
4438
4439 /*
4440 * 2 octets for the finite cyclic group + 2 octets public key
4441 * length + 1 octet for the compressed/uncompressed indication +
4442 * the actual key.
4443 */
4444 params->len += 2 + 1 + 1 + wpabuf_len(pubkey);
4445 params->control |= WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT;
4446
4447 wpabuf_put_le16(buf, pasn_group);
4448
4449 /*
4450 * The first octet indicates whether the public key is
4451 * compressed, as defined in RFC 5480 section 2.2.
4452 */
4453 wpabuf_put_u8(buf, wpabuf_len(pubkey) + 1);
4454 wpabuf_put_u8(buf, compressed ? WPA_PASN_PUBKEY_COMPRESSED_0 :
4455 WPA_PASN_PUBKEY_UNCOMPRESSED);
4456
4457 wpabuf_put_buf(buf, pubkey);
4458 }
4459 }
4460
4461 /*
4462 * wpa_pasn_add_wrapped_data - Add a Wrapped Data IE to PASN Authentication
4463 * frame. If needed, the Wrapped Data IE would be fragmented.
4464 *
4465 * @buf: Buffer in which the IE will be added
4466 * @wrapped_data_buf: Buffer holding the wrapped data
4467 */
wpa_pasn_add_wrapped_data(struct wpabuf * buf,struct wpabuf * wrapped_data_buf)4468 int wpa_pasn_add_wrapped_data(struct wpabuf *buf,
4469 struct wpabuf *wrapped_data_buf)
4470 {
4471 const u8 *data;
4472 size_t data_len;
4473 u8 len;
4474
4475 if (!wrapped_data_buf)
4476 return 0;
4477
4478 wpa_printf(MSG_DEBUG, "PASN: Add wrapped data");
4479
4480 data = wpabuf_head_u8(wrapped_data_buf);
4481 data_len = wpabuf_len(wrapped_data_buf);
4482
4483 /* nothing to add */
4484 if (!data_len)
4485 return 0;
4486
4487 if (data_len <= 254)
4488 len = 1 + data_len;
4489 else
4490 len = 255;
4491
4492 if (wpabuf_tailroom(buf) < 3 + data_len)
4493 return -1;
4494
4495 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
4496 wpabuf_put_u8(buf, len);
4497 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
4498 wpabuf_put_data(buf, data, len - 1);
4499
4500 data += len - 1;
4501 data_len -= len - 1;
4502
4503 while (data_len) {
4504 if (wpabuf_tailroom(buf) < 2 + data_len)
4505 return -1;
4506 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4507 len = data_len > 255 ? 255 : data_len;
4508 wpabuf_put_u8(buf, len);
4509 wpabuf_put_data(buf, data, len);
4510 data += len;
4511 data_len -= len;
4512 }
4513
4514 return 0;
4515 }
4516
4517
4518 /*
4519 * wpa_pasn_validate_rsne - Validate PASN/EPPKE specific data of RSNE
4520 * @data: Parsed representation of an RSNE
4521 * @is_eppke: EPPKE Authentication
4522 * Returns -1 for invalid data; otherwise 0
4523 */
wpa_pasn_validate_rsne(const struct wpa_ie_data * data,bool is_eppke)4524 int wpa_pasn_validate_rsne(const struct wpa_ie_data *data, bool is_eppke)
4525 {
4526 u16 capab = WPA_CAPABILITY_MFPC;
4527
4528 if (!is_eppke)
4529 capab |= WPA_CAPABILITY_MFPR;
4530
4531 if (data->proto != WPA_PROTO_RSN)
4532 return -1;
4533
4534 if ((data->capabilities & capab) != capab) {
4535 wpa_printf(MSG_DEBUG, "%s: Invalid RSNE capabilities",
4536 is_eppke ? "EPPKE" : "PASN");
4537 return -1;
4538 }
4539
4540 if (!data->has_group ||
4541 (!is_eppke && data->group_cipher != WPA_CIPHER_GTK_NOT_USED)) {
4542 wpa_printf(MSG_DEBUG, "PASN: Invalid group data cipher");
4543 return -1;
4544 }
4545
4546 if (!data->has_pairwise || !data->pairwise_cipher ||
4547 (data->pairwise_cipher & (data->pairwise_cipher - 1))) {
4548 wpa_printf(MSG_DEBUG, "PASN: No valid pairwise suite");
4549 return -1;
4550 }
4551
4552 switch (data->key_mgmt) {
4553 #ifdef CONFIG_SAE
4554 case WPA_KEY_MGMT_SAE:
4555 case WPA_KEY_MGMT_SAE_EXT_KEY:
4556 /* fall through */
4557 #endif /* CONFIG_SAE */
4558 #ifdef CONFIG_FILS
4559 case WPA_KEY_MGMT_FILS_SHA256:
4560 case WPA_KEY_MGMT_FILS_SHA384:
4561 /* fall through */
4562 #endif /* CONFIG_FILS */
4563 #ifdef CONFIG_IEEE80211R
4564 case WPA_KEY_MGMT_FT_PSK:
4565 case WPA_KEY_MGMT_FT_IEEE8021X:
4566 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
4567 /* fall through */
4568 #endif /* CONFIG_IEEE80211R */
4569 case WPA_KEY_MGMT_PASN:
4570 break;
4571 #ifdef CONFIG_ENC_ASSOC
4572 case WPA_KEY_MGMT_EPPKE:
4573 /* EPPKE AKMP is used when EPPKE is performed without a base
4574 * AKM (no mutual authentication). This is only valid for EPPKE
4575 * authentication per IEEE P802.11bi/D4.0, 12.16.9.1. */
4576 if (!is_eppke) {
4577 wpa_printf(MSG_INFO,
4578 "PASN: EPPKE AKM not allowed for PASN");
4579 return -1;
4580 }
4581 break;
4582 #endif /* CONFIG_ENC_ASSOC */
4583 default:
4584 wpa_printf(MSG_ERROR, "%s: invalid key_mgmt: 0x%0x",
4585 is_eppke ? "EPPKE" : "PASN", data->key_mgmt);
4586 return -1;
4587 }
4588
4589 if (!is_eppke && (data->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED)) {
4590 wpa_printf(MSG_DEBUG, "PASN: Invalid group mgmt cipher");
4591 return -1;
4592 }
4593
4594 if (data->num_pmkid > 1) {
4595 wpa_printf(MSG_DEBUG, "PASN: Invalid number of PMKIDs");
4596 return -1;
4597 }
4598
4599 return 0;
4600 }
4601
4602
4603 /*
4604 * wpa_pasn_parse_parameter_ie - Validates PASN Parameters IE
4605 * @data: Pointer to the PASN Parameters IE (starting with the EID).
4606 * @len: Length of the data in the PASN Parameters IE
4607 * @from_ap: Whether this was received from an AP
4608 * @pasn_params: On successful return would hold the parsed PASN parameters.
4609 * Returns: -1 for invalid data; otherwise 0
4610 *
4611 * Note: On successful return, the pointers in &pasn_params point to the data in
4612 * the IE and are not locally allocated (so they should not be freed etc.).
4613 */
wpa_pasn_parse_parameter_ie(const u8 * data,u8 len,bool from_ap,struct wpa_pasn_params_data * pasn_params)4614 int wpa_pasn_parse_parameter_ie(const u8 *data, u8 len, bool from_ap,
4615 struct wpa_pasn_params_data *pasn_params)
4616 {
4617 struct pasn_parameter_ie *params = (struct pasn_parameter_ie *) data;
4618 const u8 *pos = (const u8 *) (params + 1);
4619
4620 if (!pasn_params) {
4621 wpa_printf(MSG_DEBUG, "PASN: Invalid params");
4622 return -1;
4623 }
4624
4625 if (!params || ((size_t) (params->len + 2) < sizeof(*params)) ||
4626 len < sizeof(*params) || params->len + 2 != len) {
4627 wpa_printf(MSG_DEBUG,
4628 "PASN: Invalid parameters IE. len=(%u, %u)",
4629 params ? params->len : 0, len);
4630 return -1;
4631 }
4632
4633 os_memset(pasn_params, 0, sizeof(*pasn_params));
4634
4635 switch (params->wrapped_data_format) {
4636 case WPA_PASN_WRAPPED_DATA_NO:
4637 case WPA_PASN_WRAPPED_DATA_SAE:
4638 case WPA_PASN_WRAPPED_DATA_FILS_SK:
4639 case WPA_PASN_WRAPPED_DATA_FT:
4640 break;
4641 default:
4642 wpa_printf(MSG_DEBUG, "PASN: Invalid wrapped data format");
4643 return -1;
4644 }
4645
4646 pasn_params->wrapped_data_format = params->wrapped_data_format;
4647
4648 len -= sizeof(*params);
4649
4650 if (params->control & WPA_PASN_CTRL_COMEBACK_INFO_PRESENT) {
4651 if (from_ap) {
4652 if (len < 2) {
4653 wpa_printf(MSG_DEBUG,
4654 "PASN: Invalid Parameters IE: Truncated Comeback After");
4655 return -1;
4656 }
4657 pasn_params->after = WPA_GET_LE16(pos);
4658 pos += 2;
4659 len -= 2;
4660 }
4661
4662 if (len < 1 || len < 1 + *pos) {
4663 wpa_printf(MSG_DEBUG,
4664 "PASN: Invalid Parameters IE: comeback len");
4665 return -1;
4666 }
4667
4668 pasn_params->comeback_len = *pos++;
4669 len--;
4670 pasn_params->comeback = pos;
4671 len -= pasn_params->comeback_len;
4672 pos += pasn_params->comeback_len;
4673 }
4674
4675 if (params->control & WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT) {
4676 if (len < 3 || len < 3 + pos[2]) {
4677 wpa_printf(MSG_DEBUG,
4678 "PASN: Invalid Parameters IE: group and key");
4679 return -1;
4680 }
4681
4682 pasn_params->group = WPA_GET_LE16(pos);
4683 pos += 2;
4684 len -= 2;
4685 pasn_params->pubkey_len = *pos++;
4686 len--;
4687 pasn_params->pubkey = pos;
4688 len -= pasn_params->pubkey_len;
4689 pos += pasn_params->pubkey_len;
4690 }
4691
4692 if (len) {
4693 wpa_printf(MSG_DEBUG,
4694 "PASN: Invalid Parameters IE. Bytes left=%u", len);
4695 return -1;
4696 }
4697
4698 return 0;
4699 }
4700
4701
wpa_pasn_add_rsnxe(struct wpabuf * buf,u64 capab)4702 void wpa_pasn_add_rsnxe(struct wpabuf *buf, u64 capab)
4703 {
4704 size_t flen;
4705
4706 if (!capab)
4707 return; /* no supported extended RSN capabilities */
4708
4709 /* Determine how many octets are needed to represent capab */
4710 if (capab & 0xFF00000000000000ULL)
4711 flen = 8;
4712 else if (capab & 0x00FF000000000000ULL)
4713 flen = 7;
4714 else if (capab & 0x0000FF0000000000ULL)
4715 flen = 6;
4716 else if (capab & 0x000000FF00000000ULL)
4717 flen = 5;
4718 else if (capab & 0xFF000000)
4719 flen = 4;
4720 else if (capab & 0x00FF0000)
4721 flen = 3;
4722 else if (capab & 0x0000FF00)
4723 flen = 2;
4724 else
4725 flen = 1;
4726
4727 if (wpabuf_tailroom(buf) < 2 + flen)
4728 return;
4729 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
4730
4731 wpabuf_put_u8(buf, WLAN_EID_RSNX);
4732 wpabuf_put_u8(buf, flen);
4733
4734 /* Write the little endian capability field octet-by-octet */
4735 wpabuf_put_u8(buf, capab & 0x000000FF);
4736 if (flen > 1)
4737 wpabuf_put_u8(buf, (capab >> 8) & 0x000000FF);
4738 if (flen > 2)
4739 wpabuf_put_u8(buf, (capab >> 16) & 0x000000FF);
4740 if (flen > 3)
4741 wpabuf_put_u8(buf, (capab >> 24) & 0x000000FF);
4742 if (flen > 4)
4743 wpabuf_put_u8(buf, (capab >> 32) & 0x000000FF);
4744 if (flen > 5)
4745 wpabuf_put_u8(buf, (capab >> 40) & 0x000000FF);
4746 if (flen > 6)
4747 wpabuf_put_u8(buf, (capab >> 48) & 0x000000FF);
4748 if (flen > 7)
4749 wpabuf_put_u8(buf, (capab >> 56) & 0x000000FF);
4750 }
4751
4752
4753 /*
4754 * wpa_pasn_add_extra_ies - Add protocol specific IEs in Authentication
4755 * frame for PASN.
4756 *
4757 * @buf: Buffer in which the elements will be added
4758 * @extra_ies: Protocol specific elements to add
4759 * @len: Length of the elements
4760 * Returns: 0 on success, -1 on failure
4761 */
4762
wpa_pasn_add_extra_ies(struct wpabuf * buf,const u8 * extra_ies,size_t len)4763 int wpa_pasn_add_extra_ies(struct wpabuf *buf, const u8 *extra_ies, size_t len)
4764 {
4765 if (!len || !extra_ies || !buf)
4766 return 0;
4767
4768 if (wpabuf_tailroom(buf) < len)
4769 return -1;
4770
4771 wpabuf_put_data(buf, extra_ies, len);
4772 return 0;
4773 }
4774
4775 #endif /* CONFIG_PASN */
4776
4777
rsn_set_snonce_cookie(u8 * snonce)4778 void rsn_set_snonce_cookie(u8 *snonce)
4779 {
4780 u8 *pos;
4781
4782 pos = snonce + WPA_NONCE_LEN - 6;
4783 WPA_PUT_BE24(pos, OUI_WFA);
4784 pos += 3;
4785 WPA_PUT_BE24(pos, 0x000029);
4786 }
4787
4788
rsn_is_snonce_cookie(const u8 * snonce)4789 bool rsn_is_snonce_cookie(const u8 *snonce)
4790 {
4791 const u8 *pos;
4792
4793 pos = snonce + WPA_NONCE_LEN - 6;
4794 return WPA_GET_BE24(pos) == OUI_WFA &&
4795 WPA_GET_BE24(pos + 3) == 0x000029;
4796 }
4797
4798
wpa_add_supported_groups(struct wpabuf * buf,const int * groups)4799 void wpa_add_supported_groups(struct wpabuf *buf, const int *groups)
4800 {
4801 unsigned int count, i;
4802
4803 if (!buf || !groups)
4804 return;
4805
4806 count = int_array_len(groups);
4807 if (wpabuf_tailroom(buf) < 2 + 1 + count * 2)
4808 return;
4809
4810 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
4811 wpabuf_put_u8(buf, 1 + count * 2);
4812 wpabuf_put_u8(buf, WLAN_EID_EXT_SUPPORTED_GROUPS);
4813 for (i = 0; i < count; i++)
4814 wpabuf_put_le16(buf, groups[i]);
4815 }
4816