33 	u8 *buf, *pos;  in wpa_ft_mic()  local
47 	pos = buf;  in wpa_ft_mic()
48 	os_memcpy(pos, sta_addr, ETH_ALEN);  in wpa_ft_mic()
49 	pos += ETH_ALEN;  in wpa_ft_mic()
50 	os_memcpy(pos, ap_addr, ETH_ALEN);  in wpa_ft_mic()
51 	pos += ETH_ALEN;  in wpa_ft_mic()
52 	*pos++ = transaction_seqnum;  in wpa_ft_mic()
54 		os_memcpy(pos, rsnie, rsnie_len);  in wpa_ft_mic()
55 		pos += rsnie_len;  in wpa_ft_mic()
58 		os_memcpy(pos, mdie, mdie_len);  in wpa_ft_mic()
59 		pos += mdie_len;  in wpa_ft_mic()
63 		os_memcpy(pos, ftie, ftie_len);  in wpa_ft_mic()
68 		_ftie = (struct rsn_ftie *) (pos + 2);  in wpa_ft_mic()
70 		pos += ftie_len;  in wpa_ft_mic()
73 		os_memcpy(pos, ric, ric_len);  in wpa_ft_mic()
74 		pos += ric_len;  in wpa_ft_mic()
77 	wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", buf, pos - buf);  in wpa_ft_mic()
78 	if (omac1_aes_128(kck, buf, pos - buf, mic)) {  in wpa_ft_mic()
92 	const u8 *end, *pos;  in wpa_ft_parse_ftie()  local
97 	pos = ie + sizeof(struct rsn_ftie);  in wpa_ft_parse_ftie()
100 	while (pos + 2 <= end && pos + 2 + pos[1] <= end) {  in wpa_ft_parse_ftie()
101 		switch (pos[0]) {  in wpa_ft_parse_ftie()
103 			if (pos[1] != FT_R1KH_ID_LEN) {  in wpa_ft_parse_ftie()
105 					   "length in FTIE: %d", pos[1]);  in wpa_ft_parse_ftie()
108 			parse->r1kh_id = pos + 2;  in wpa_ft_parse_ftie()
111 			parse->gtk = pos + 2;  in wpa_ft_parse_ftie()
112 			parse->gtk_len = pos[1];  in wpa_ft_parse_ftie()
115 			if (pos[1] < 1 || pos[1] > FT_R0KH_ID_MAX_LEN) {  in wpa_ft_parse_ftie()
117 					   "length in FTIE: %d", pos[1]);  in wpa_ft_parse_ftie()
120 			parse->r0kh_id = pos + 2;  in wpa_ft_parse_ftie()
121 			parse->r0kh_id_len = pos[1];  in wpa_ft_parse_ftie()
125 			parse->igtk = pos + 2;  in wpa_ft_parse_ftie()
126 			parse->igtk_len = pos[1];  in wpa_ft_parse_ftie()
131 		pos += 2 + pos[1];  in wpa_ft_parse_ftie()
141 	const u8 *end, *pos;  in wpa_ft_parse_ies()  local
151 	pos = ies;  in wpa_ft_parse_ies()
153 	while (pos + 2 <= end && pos + 2 + pos[1] <= end) {  in wpa_ft_parse_ies()
154 		switch (pos[0]) {  in wpa_ft_parse_ies()
156 			parse->rsn = pos + 2;  in wpa_ft_parse_ies()
157 			parse->rsn_len = pos[1];  in wpa_ft_parse_ies()
170 			parse->mdie = pos + 2;  in wpa_ft_parse_ies()
171 			parse->mdie_len = pos[1];  in wpa_ft_parse_ies()
174 			if (pos[1] < sizeof(*ftie))  in wpa_ft_parse_ies()
176 			ftie = (const struct rsn_ftie *) (pos + 2);  in wpa_ft_parse_ies()
178 			if (wpa_ft_parse_ftie(pos + 2, pos[1], parse) < 0)  in wpa_ft_parse_ies()
182 			parse->tie = pos + 2;  in wpa_ft_parse_ies()
183 			parse->tie_len = pos[1];  in wpa_ft_parse_ies()
187 				parse->ric = pos;  in wpa_ft_parse_ies()
191 		pos += 2 + pos[1];  in wpa_ft_parse_ies()
220 	pos = parse->ric;  in wpa_ft_parse_ies()
221 	while (pos && pos + 2 <= end && pos + 2 + pos[1] <= end &&  in wpa_ft_parse_ies()
224 		pos += 2 + pos[1];  in wpa_ft_parse_ies()
226 	parse->ric_len = pos - parse->ric;  in wpa_ft_parse_ies()
410 	const u8 *pos;  in wpa_parse_wpa_ie_rsn()  local
446 	pos = (const u8 *) (hdr + 1);  in wpa_parse_wpa_ie_rsn()
450 		data->group_cipher = rsn_selector_to_bitfield(pos);  in wpa_parse_wpa_ie_rsn()
451 		pos += RSN_SELECTOR_LEN;  in wpa_parse_wpa_ie_rsn()
461 		count = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_rsn()
462 		pos += 2;  in wpa_parse_wpa_ie_rsn()
470 			data->pairwise_cipher |= rsn_selector_to_bitfield(pos);  in wpa_parse_wpa_ie_rsn()
471 			pos += RSN_SELECTOR_LEN;  in wpa_parse_wpa_ie_rsn()
482 		count = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_rsn()
483 		pos += 2;  in wpa_parse_wpa_ie_rsn()
491 			data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);  in wpa_parse_wpa_ie_rsn()
492 			pos += RSN_SELECTOR_LEN;  in wpa_parse_wpa_ie_rsn()
502 		data->capabilities = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_rsn()
503 		pos += 2;  in wpa_parse_wpa_ie_rsn()
508 		u16 num_pmkid = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_rsn()
509 		pos += 2;  in wpa_parse_wpa_ie_rsn()
519 			data->pmkid = pos;  in wpa_parse_wpa_ie_rsn()
520 			pos += data->num_pmkid * PMKID_LEN;  in wpa_parse_wpa_ie_rsn()
526 		data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);  in wpa_parse_wpa_ie_rsn()
531 				   WPA_GET_BE32(pos));  in wpa_parse_wpa_ie_rsn()
534 		pos += RSN_SELECTOR_LEN;  in wpa_parse_wpa_ie_rsn()
550 	const u8 *pos;  in wpa_parse_wpa_ie_wpa()  local
586 	pos = (const u8 *) (hdr + 1);  in wpa_parse_wpa_ie_wpa()
590 		data->group_cipher = wpa_selector_to_bitfield(pos);  in wpa_parse_wpa_ie_wpa()
591 		pos += WPA_SELECTOR_LEN;  in wpa_parse_wpa_ie_wpa()
601 		count = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_wpa()
602 		pos += 2;  in wpa_parse_wpa_ie_wpa()
610 			data->pairwise_cipher |= wpa_selector_to_bitfield(pos);  in wpa_parse_wpa_ie_wpa()
611 			pos += WPA_SELECTOR_LEN;  in wpa_parse_wpa_ie_wpa()
622 		count = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_wpa()
623 		pos += 2;  in wpa_parse_wpa_ie_wpa()
631 			data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);  in wpa_parse_wpa_ie_wpa()
632 			pos += WPA_SELECTOR_LEN;  in wpa_parse_wpa_ie_wpa()
642 		data->capabilities = WPA_GET_LE16(pos);  in wpa_parse_wpa_ie_wpa()
643 		pos += 2;  in wpa_parse_wpa_ie_wpa()
669 	u8 *pos, r0_key_data[48], hash[32];  in wpa_derive_pmk_r0()  local
683 	pos = buf;  in wpa_derive_pmk_r0()
684 	*pos++ = ssid_len;  in wpa_derive_pmk_r0()
685 	os_memcpy(pos, ssid, ssid_len);  in wpa_derive_pmk_r0()
686 	pos += ssid_len;  in wpa_derive_pmk_r0()
687 	os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);  in wpa_derive_pmk_r0()
688 	pos += MOBILITY_DOMAIN_ID_LEN;  in wpa_derive_pmk_r0()
689 	*pos++ = r0kh_id_len;  in wpa_derive_pmk_r0()
690 	os_memcpy(pos, r0kh_id, r0kh_id_len);  in wpa_derive_pmk_r0()
691 	pos += r0kh_id_len;  in wpa_derive_pmk_r0()
692 	os_memcpy(pos, s0kh_id, ETH_ALEN);  in wpa_derive_pmk_r0()
693 	pos += ETH_ALEN;  in wpa_derive_pmk_r0()
695 	sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,  in wpa_derive_pmk_r0()
752 	u8 *pos;  in wpa_derive_pmk_r1()  local
755 	pos = buf;  in wpa_derive_pmk_r1()
756 	os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);  in wpa_derive_pmk_r1()
757 	pos += FT_R1KH_ID_LEN;  in wpa_derive_pmk_r1()
758 	os_memcpy(pos, s1kh_id, ETH_ALEN);  in wpa_derive_pmk_r1()
759 	pos += ETH_ALEN;  in wpa_derive_pmk_r1()
761 	sha256_prf(pmk_r0, PMK_LEN, "FT-R1", buf, pos - buf, pmk_r1, PMK_LEN);  in wpa_derive_pmk_r1()
778 	u8 *pos, hash[32];  in wpa_pmk_r1_to_ptk()  local
788 	pos = buf;  in wpa_pmk_r1_to_ptk()
789 	os_memcpy(pos, snonce, WPA_NONCE_LEN);  in wpa_pmk_r1_to_ptk()
790 	pos += WPA_NONCE_LEN;  in wpa_pmk_r1_to_ptk()
791 	os_memcpy(pos, anonce, WPA_NONCE_LEN);  in wpa_pmk_r1_to_ptk()
792 	pos += WPA_NONCE_LEN;  in wpa_pmk_r1_to_ptk()
793 	os_memcpy(pos, bssid, ETH_ALEN);  in wpa_pmk_r1_to_ptk()
794 	pos += ETH_ALEN;  in wpa_pmk_r1_to_ptk()
795 	os_memcpy(pos, sta_addr, ETH_ALEN);  in wpa_pmk_r1_to_ptk()
796 	pos += ETH_ALEN;  in wpa_pmk_r1_to_ptk()
803 	sha256_prf(pmk_r1, PMK_LEN, "FT-PTK", buf, pos - buf, tmp, ptk_len);  in wpa_pmk_r1_to_ptk()
1459 int rsn_cipher_put_suites(u8 *pos, int ciphers)  in rsn_cipher_put_suites()  argument
1465 		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);  in rsn_cipher_put_suites()
1466 		pos += RSN_SELECTOR_LEN;  in rsn_cipher_put_suites()
1470 		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);  in rsn_cipher_put_suites()
1471 		pos += RSN_SELECTOR_LEN;  in rsn_cipher_put_suites()
1476 		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);  in rsn_cipher_put_suites()
1477 		pos += RSN_SELECTOR_LEN;  in rsn_cipher_put_suites()
1481 		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);  in rsn_cipher_put_suites()
1482 		pos += RSN_SELECTOR_LEN;  in rsn_cipher_put_suites()
1486 		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);  in rsn_cipher_put_suites()
1487 		pos += RSN_SELECTOR_LEN;  in rsn_cipher_put_suites()
1494 int wpa_cipher_put_suites(u8 *pos, int ciphers)  in wpa_cipher_put_suites()  argument
1499 		RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);  in wpa_cipher_put_suites()
1500 		pos += WPA_SELECTOR_LEN;  in wpa_cipher_put_suites()
1504 		RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);  in wpa_cipher_put_suites()
1505 		pos += WPA_SELECTOR_LEN;  in wpa_cipher_put_suites()
1509 		RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);  in wpa_cipher_put_suites()
1510 		pos += WPA_SELECTOR_LEN;  in wpa_cipher_put_suites()