1 /*
2 * WPA/RSN - Shared functions for supplicant and authenticator
3 * Copyright (c) 2002-2018, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "crypto/md5.h"
13 #include "crypto/sha1.h"
14 #include "crypto/sha256.h"
15 #include "crypto/sha384.h"
16 #include "crypto/sha512.h"
17 #include "crypto/aes_wrap.h"
18 #include "crypto/crypto.h"
19 #include "ieee802_11_defs.h"
20 #include "ieee802_11_common.h"
21 #include "defs.h"
22 #include "wpa_common.h"
23
24
wpa_kck_len(int akmp,size_t pmk_len)25 static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
26 {
27 switch (akmp) {
28 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
29 case WPA_KEY_MGMT_IEEE8021X_SHA384:
30 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
31 return 24;
32 case WPA_KEY_MGMT_FILS_SHA256:
33 case WPA_KEY_MGMT_FT_FILS_SHA256:
34 case WPA_KEY_MGMT_FILS_SHA384:
35 case WPA_KEY_MGMT_FT_FILS_SHA384:
36 return 0;
37 case WPA_KEY_MGMT_DPP:
38 return pmk_len / 2;
39 case WPA_KEY_MGMT_OWE:
40 return pmk_len / 2;
41 case WPA_KEY_MGMT_SAE_EXT_KEY:
42 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
43 return pmk_len / 2;
44 default:
45 return 16;
46 }
47 }
48
49
50 #ifdef CONFIG_IEEE80211R
wpa_kck2_len(int akmp)51 static unsigned int wpa_kck2_len(int akmp)
52 {
53 switch (akmp) {
54 case WPA_KEY_MGMT_FT_FILS_SHA256:
55 return 16;
56 case WPA_KEY_MGMT_FT_FILS_SHA384:
57 return 24;
58 default:
59 return 0;
60 }
61 }
62 #endif /* CONFIG_IEEE80211R */
63
64
wpa_kek_len(int akmp,size_t pmk_len)65 static unsigned int wpa_kek_len(int akmp, size_t pmk_len)
66 {
67 switch (akmp) {
68 case WPA_KEY_MGMT_FILS_SHA384:
69 case WPA_KEY_MGMT_FT_FILS_SHA384:
70 return 64;
71 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
72 case WPA_KEY_MGMT_FILS_SHA256:
73 case WPA_KEY_MGMT_FT_FILS_SHA256:
74 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
75 case WPA_KEY_MGMT_IEEE8021X_SHA384:
76 return 32;
77 case WPA_KEY_MGMT_DPP:
78 return pmk_len <= 32 ? 16 : 32;
79 case WPA_KEY_MGMT_OWE:
80 return pmk_len <= 32 ? 16 : 32;
81 case WPA_KEY_MGMT_SAE_EXT_KEY:
82 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
83 return pmk_len <= 32 ? 16 : 32;
84 default:
85 return 16;
86 }
87 }
88
89
90 #ifdef CONFIG_IEEE80211R
wpa_kek2_len(int akmp)91 static unsigned int wpa_kek2_len(int akmp)
92 {
93 switch (akmp) {
94 case WPA_KEY_MGMT_FT_FILS_SHA256:
95 return 16;
96 case WPA_KEY_MGMT_FT_FILS_SHA384:
97 return 32;
98 default:
99 return 0;
100 }
101 }
102 #endif /* CONFIG_IEEE80211R */
103
104
wpa_mic_len(int akmp,size_t pmk_len)105 unsigned int wpa_mic_len(int akmp, size_t pmk_len)
106 {
107 switch (akmp) {
108 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
109 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
110 case WPA_KEY_MGMT_IEEE8021X_SHA384:
111 return 24;
112 case WPA_KEY_MGMT_FILS_SHA256:
113 case WPA_KEY_MGMT_FILS_SHA384:
114 case WPA_KEY_MGMT_FT_FILS_SHA256:
115 case WPA_KEY_MGMT_FT_FILS_SHA384:
116 return 0;
117 case WPA_KEY_MGMT_DPP:
118 return pmk_len / 2;
119 case WPA_KEY_MGMT_OWE:
120 return pmk_len / 2;
121 case WPA_KEY_MGMT_SAE_EXT_KEY:
122 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
123 return pmk_len / 2;
124 default:
125 return 16;
126 }
127 }
128
129
130 /**
131 * wpa_use_akm_defined - Is AKM-defined Key Descriptor Version used
132 * @akmp: WPA_KEY_MGMT_* used in key derivation
133 * Returns: 1 if AKM-defined Key Descriptor Version is used; 0 otherwise
134 */
wpa_use_akm_defined(int akmp)135 int wpa_use_akm_defined(int akmp)
136 {
137 return akmp == WPA_KEY_MGMT_OSEN ||
138 akmp == WPA_KEY_MGMT_OWE ||
139 akmp == WPA_KEY_MGMT_DPP ||
140 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
141 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
142 wpa_key_mgmt_sae(akmp) ||
143 wpa_key_mgmt_suite_b(akmp) ||
144 wpa_key_mgmt_fils(akmp);
145 }
146
147
148 /**
149 * wpa_use_cmac - Is CMAC integrity algorithm used for EAPOL-Key MIC
150 * @akmp: WPA_KEY_MGMT_* used in key derivation
151 * Returns: 1 if CMAC is used; 0 otherwise
152 */
wpa_use_cmac(int akmp)153 int wpa_use_cmac(int akmp)
154 {
155 return akmp == WPA_KEY_MGMT_OSEN ||
156 akmp == WPA_KEY_MGMT_OWE ||
157 akmp == WPA_KEY_MGMT_DPP ||
158 wpa_key_mgmt_ft(akmp) ||
159 wpa_key_mgmt_sha256(akmp) ||
160 (wpa_key_mgmt_sae(akmp) &&
161 !wpa_key_mgmt_sae_ext_key(akmp)) ||
162 wpa_key_mgmt_suite_b(akmp);
163 }
164
165
166 /**
167 * wpa_use_aes_key_wrap - Is AES Keywrap algorithm used for EAPOL-Key Key Data
168 * @akmp: WPA_KEY_MGMT_* used in key derivation
169 * Returns: 1 if AES Keywrap is used; 0 otherwise
170 *
171 * Note: AKM 00-0F-AC:1 and 00-0F-AC:2 have special rules for selecting whether
172 * to use AES Keywrap based on the negotiated pairwise cipher. This function
173 * does not cover those special cases.
174 */
wpa_use_aes_key_wrap(int akmp)175 int wpa_use_aes_key_wrap(int akmp)
176 {
177 return akmp == WPA_KEY_MGMT_OSEN ||
178 akmp == WPA_KEY_MGMT_OWE ||
179 akmp == WPA_KEY_MGMT_DPP ||
180 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
181 wpa_key_mgmt_ft(akmp) ||
182 wpa_key_mgmt_sha256(akmp) ||
183 wpa_key_mgmt_sae(akmp) ||
184 wpa_key_mgmt_suite_b(akmp);
185 }
186
187
188 /**
189 * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
190 * @key: EAPOL-Key Key Confirmation Key (KCK)
191 * @key_len: KCK length in octets
192 * @akmp: WPA_KEY_MGMT_* used in key derivation
193 * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
194 * @buf: Pointer to the beginning of the EAPOL header (version field)
195 * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
196 * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
197 * Returns: 0 on success, -1 on failure
198 *
199 * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
200 * to be cleared (all zeroes) when calling this function.
201 *
202 * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
203 * description of the Key MIC calculation. It includes packet data from the
204 * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
205 * happened during final editing of the standard and the correct behavior is
206 * defined in the last draft (IEEE 802.11i/D10).
207 */
wpa_eapol_key_mic(const u8 * key,size_t key_len,int akmp,int ver,const u8 * buf,size_t len,u8 * mic)208 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
209 const u8 *buf, size_t len, u8 *mic)
210 {
211 u8 hash[SHA512_MAC_LEN];
212
213 if (key_len == 0) {
214 wpa_printf(MSG_DEBUG,
215 "WPA: KCK not set - cannot calculate MIC");
216 return -1;
217 }
218
219 switch (ver) {
220 #ifndef CONFIG_FIPS
221 case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
222 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-MD5");
223 return hmac_md5(key, key_len, buf, len, mic);
224 #endif /* CONFIG_FIPS */
225 case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
226 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-SHA1");
227 if (hmac_sha1(key, key_len, buf, len, hash))
228 return -1;
229 os_memcpy(mic, hash, MD5_MAC_LEN);
230 break;
231 case WPA_KEY_INFO_TYPE_AES_128_CMAC:
232 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using AES-CMAC");
233 return omac1_aes_128(key, buf, len, mic);
234 case WPA_KEY_INFO_TYPE_AKM_DEFINED:
235 switch (akmp) {
236 #ifdef CONFIG_SAE
237 case WPA_KEY_MGMT_SAE:
238 case WPA_KEY_MGMT_FT_SAE:
239 wpa_printf(MSG_DEBUG,
240 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - SAE)");
241 return omac1_aes_128(key, buf, len, mic);
242 case WPA_KEY_MGMT_SAE_EXT_KEY:
243 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
244 wpa_printf(MSG_DEBUG,
245 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - SAE-EXT-KEY)",
246 (unsigned int) key_len * 8 * 2);
247 if (key_len == 128 / 8) {
248 if (hmac_sha256(key, key_len, buf, len, hash))
249 return -1;
250 #ifdef CONFIG_SHA384
251 } else if (key_len == 192 / 8) {
252 if (hmac_sha384(key, key_len, buf, len, hash))
253 return -1;
254 #endif /* CONFIG_SHA384 */
255 #ifdef CONFIG_SHA512
256 } else if (key_len == 256 / 8) {
257 if (hmac_sha512(key, key_len, buf, len, hash))
258 return -1;
259 #endif /* CONFIG_SHA512 */
260 } else {
261 wpa_printf(MSG_INFO,
262 "SAE: Unsupported KCK length: %u",
263 (unsigned int) key_len);
264 return -1;
265 }
266 os_memcpy(mic, hash, key_len);
267 break;
268 #endif /* CONFIG_SAE */
269 #ifdef CONFIG_HS20
270 case WPA_KEY_MGMT_OSEN:
271 wpa_printf(MSG_DEBUG,
272 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - OSEN)");
273 return omac1_aes_128(key, buf, len, mic);
274 #endif /* CONFIG_HS20 */
275 #ifdef CONFIG_SUITEB
276 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
277 wpa_printf(MSG_DEBUG,
278 "WPA: EAPOL-Key MIC using HMAC-SHA256 (AKM-defined - Suite B)");
279 if (hmac_sha256(key, key_len, buf, len, hash))
280 return -1;
281 os_memcpy(mic, hash, MD5_MAC_LEN);
282 break;
283 #endif /* CONFIG_SUITEB */
284 #ifdef CONFIG_SUITEB192
285 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
286 wpa_printf(MSG_DEBUG,
287 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - Suite B 192-bit)");
288 if (hmac_sha384(key, key_len, buf, len, hash))
289 return -1;
290 os_memcpy(mic, hash, 24);
291 break;
292 #endif /* CONFIG_SUITEB192 */
293 #ifdef CONFIG_OWE
294 case WPA_KEY_MGMT_OWE:
295 wpa_printf(MSG_DEBUG,
296 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - OWE)",
297 (unsigned int) key_len * 8 * 2);
298 if (key_len == 128 / 8) {
299 if (hmac_sha256(key, key_len, buf, len, hash))
300 return -1;
301 } else if (key_len == 192 / 8) {
302 if (hmac_sha384(key, key_len, buf, len, hash))
303 return -1;
304 } else if (key_len == 256 / 8) {
305 if (hmac_sha512(key, key_len, buf, len, hash))
306 return -1;
307 } else {
308 wpa_printf(MSG_INFO,
309 "OWE: Unsupported KCK length: %u",
310 (unsigned int) key_len);
311 return -1;
312 }
313 os_memcpy(mic, hash, key_len);
314 break;
315 #endif /* CONFIG_OWE */
316 #ifdef CONFIG_DPP
317 case WPA_KEY_MGMT_DPP:
318 wpa_printf(MSG_DEBUG,
319 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - DPP)",
320 (unsigned int) key_len * 8 * 2);
321 if (key_len == 128 / 8) {
322 if (hmac_sha256(key, key_len, buf, len, hash))
323 return -1;
324 } else if (key_len == 192 / 8) {
325 if (hmac_sha384(key, key_len, buf, len, hash))
326 return -1;
327 } else if (key_len == 256 / 8) {
328 if (hmac_sha512(key, key_len, buf, len, hash))
329 return -1;
330 } else {
331 wpa_printf(MSG_INFO,
332 "DPP: Unsupported KCK length: %u",
333 (unsigned int) key_len);
334 return -1;
335 }
336 os_memcpy(mic, hash, key_len);
337 break;
338 #endif /* CONFIG_DPP */
339 #ifdef CONFIG_SHA384
340 case WPA_KEY_MGMT_IEEE8021X_SHA384:
341 #ifdef CONFIG_IEEE80211R
342 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
343 #endif /* CONFIG_IEEE80211R */
344 wpa_printf(MSG_DEBUG,
345 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - 802.1X SHA384)");
346 if (hmac_sha384(key, key_len, buf, len, hash))
347 return -1;
348 os_memcpy(mic, hash, 24);
349 break;
350 #endif /* CONFIG_SHA384 */
351 default:
352 wpa_printf(MSG_DEBUG,
353 "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
354 akmp);
355 return -1;
356 }
357 break;
358 default:
359 wpa_printf(MSG_DEBUG,
360 "WPA: EAPOL-Key MIC algorithm not known (ver=%d)",
361 ver);
362 return -1;
363 }
364
365 return 0;
366 }
367
368
369 /**
370 * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
371 * @pmk: Pairwise master key
372 * @pmk_len: Length of PMK
373 * @label: Label to use in derivation
374 * @addr1: AA or SA
375 * @addr2: SA or AA
376 * @nonce1: ANonce or SNonce
377 * @nonce2: SNonce or ANonce
378 * @ptk: Buffer for pairwise transient key
379 * @akmp: Negotiated AKM
380 * @cipher: Negotiated pairwise cipher
381 * @kdk_len: The length in octets that should be derived for KDK
382 * Returns: 0 on success, -1 on failure
383 *
384 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
385 * PTK = PRF-X(PMK, "Pairwise key expansion",
386 * Min(AA, SA) || Max(AA, SA) ||
387 * Min(ANonce, SNonce) || Max(ANonce, SNonce)
388 * [ || Z.x ])
389 *
390 * The optional Z.x component is used only with DPP and that part is not defined
391 * in IEEE 802.11.
392 */
wpa_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const char * label,const u8 * addr1,const u8 * addr2,const u8 * nonce1,const u8 * nonce2,struct wpa_ptk * ptk,int akmp,int cipher,const u8 * z,size_t z_len,size_t kdk_len)393 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
394 const u8 *addr1, const u8 *addr2,
395 const u8 *nonce1, const u8 *nonce2,
396 struct wpa_ptk *ptk, int akmp, int cipher,
397 const u8 *z, size_t z_len, size_t kdk_len)
398 {
399 #define MAX_Z_LEN 66 /* with NIST P-521 */
400 u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN + MAX_Z_LEN];
401 size_t data_len = 2 * ETH_ALEN + 2 * WPA_NONCE_LEN;
402 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
403 WPA_KDK_MAX_LEN];
404 size_t ptk_len;
405 #ifdef CONFIG_OWE
406 int owe_ptk_workaround = 0;
407
408 if (akmp == (WPA_KEY_MGMT_OWE | WPA_KEY_MGMT_PSK_SHA256)) {
409 owe_ptk_workaround = 1;
410 akmp = WPA_KEY_MGMT_OWE;
411 }
412 #endif /* CONFIG_OWE */
413
414 if (pmk_len == 0) {
415 wpa_printf(MSG_ERROR, "WPA: No PMK set for PTK derivation");
416 return -1;
417 }
418
419 if (z_len > MAX_Z_LEN)
420 return -1;
421
422 if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
423 os_memcpy(data, addr1, ETH_ALEN);
424 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
425 } else {
426 os_memcpy(data, addr2, ETH_ALEN);
427 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
428 }
429
430 if (os_memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
431 os_memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
432 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
433 WPA_NONCE_LEN);
434 } else {
435 os_memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
436 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
437 WPA_NONCE_LEN);
438 }
439
440 if (z && z_len) {
441 os_memcpy(data + 2 * ETH_ALEN + 2 * WPA_NONCE_LEN, z, z_len);
442 data_len += z_len;
443 }
444
445 if (kdk_len > WPA_KDK_MAX_LEN) {
446 wpa_printf(MSG_ERROR,
447 "WPA: KDK len=%zu exceeds max supported len",
448 kdk_len);
449 return -1;
450 }
451
452 ptk->kck_len = wpa_kck_len(akmp, pmk_len);
453 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
454 ptk->tk_len = wpa_cipher_key_len(cipher);
455 ptk->kdk_len = kdk_len;
456 if (ptk->tk_len == 0) {
457 wpa_printf(MSG_ERROR,
458 "WPA: Unsupported cipher (0x%x) used in PTK derivation",
459 cipher);
460 return -1;
461 }
462 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len + ptk->kdk_len;
463
464 if (wpa_key_mgmt_sha384(akmp)) {
465 #ifdef CONFIG_SHA384
466 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
467 if (sha384_prf(pmk, pmk_len, label, data, data_len,
468 tmp, ptk_len) < 0)
469 return -1;
470 #else /* CONFIG_SHA384 */
471 return -1;
472 #endif /* CONFIG_SHA384 */
473 } else if (wpa_key_mgmt_sha256(akmp)) {
474 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
475 if (sha256_prf(pmk, pmk_len, label, data, data_len,
476 tmp, ptk_len) < 0)
477 return -1;
478 #ifdef CONFIG_OWE
479 } else if (akmp == WPA_KEY_MGMT_OWE && (pmk_len == 32 ||
480 owe_ptk_workaround)) {
481 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
482 if (sha256_prf(pmk, pmk_len, label, data, data_len,
483 tmp, ptk_len) < 0)
484 return -1;
485 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 48) {
486 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
487 if (sha384_prf(pmk, pmk_len, label, data, data_len,
488 tmp, ptk_len) < 0)
489 return -1;
490 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 64) {
491 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
492 if (sha512_prf(pmk, pmk_len, label, data, data_len,
493 tmp, ptk_len) < 0)
494 return -1;
495 } else if (akmp == WPA_KEY_MGMT_OWE) {
496 wpa_printf(MSG_INFO, "OWE: Unknown PMK length %u",
497 (unsigned int) pmk_len);
498 return -1;
499 #endif /* CONFIG_OWE */
500 #ifdef CONFIG_DPP
501 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 32) {
502 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
503 if (sha256_prf(pmk, pmk_len, label, data, data_len,
504 tmp, ptk_len) < 0)
505 return -1;
506 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 48) {
507 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
508 if (sha384_prf(pmk, pmk_len, label, data, data_len,
509 tmp, ptk_len) < 0)
510 return -1;
511 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 64) {
512 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
513 if (sha512_prf(pmk, pmk_len, label, data, data_len,
514 tmp, ptk_len) < 0)
515 return -1;
516 } else if (akmp == WPA_KEY_MGMT_DPP) {
517 wpa_printf(MSG_INFO, "DPP: Unknown PMK length %u",
518 (unsigned int) pmk_len);
519 return -1;
520 #endif /* CONFIG_DPP */
521 #ifdef CONFIG_SAE
522 } else if (wpa_key_mgmt_sae_ext_key(akmp)) {
523 if (pmk_len == 32) {
524 wpa_printf(MSG_DEBUG,
525 "SAE: PTK derivation using PRF(SHA256)");
526 if (sha256_prf(pmk, pmk_len, label, data, data_len,
527 tmp, ptk_len) < 0)
528 return -1;
529 #ifdef CONFIG_SHA384
530 } else if (pmk_len == 48) {
531 wpa_printf(MSG_DEBUG,
532 "SAE: PTK derivation using PRF(SHA384)");
533 if (sha384_prf(pmk, pmk_len, label, data, data_len,
534 tmp, ptk_len) < 0)
535 return -1;
536 #endif /* CONFIG_SHA384 */
537 #ifdef CONFIG_SHA512
538 } else if (pmk_len == 64) {
539 wpa_printf(MSG_DEBUG,
540 "SAE: PTK derivation using PRF(SHA512)");
541 if (sha512_prf(pmk, pmk_len, label, data, data_len,
542 tmp, ptk_len) < 0)
543 return -1;
544 #endif /* CONFIG_SHA512 */
545 } else {
546 wpa_printf(MSG_INFO, "SAE: Unknown PMK length %u",
547 (unsigned int) pmk_len);
548 return -1;
549 }
550 #endif /* CONFIG_SAE */
551 } else {
552 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA1)");
553 if (sha1_prf(pmk, pmk_len, label, data, data_len, tmp,
554 ptk_len) < 0)
555 return -1;
556 }
557
558 wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR,
559 MAC2STR(addr1), MAC2STR(addr2));
560 wpa_hexdump(MSG_DEBUG, "WPA: Nonce1", nonce1, WPA_NONCE_LEN);
561 wpa_hexdump(MSG_DEBUG, "WPA: Nonce2", nonce2, WPA_NONCE_LEN);
562 if (z && z_len)
563 wpa_hexdump_key(MSG_DEBUG, "WPA: Z.x", z, z_len);
564 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
565 wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
566
567 os_memcpy(ptk->kck, tmp, ptk->kck_len);
568 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
569
570 os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
571 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
572
573 os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
574 wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
575
576 if (kdk_len) {
577 os_memcpy(ptk->kdk, tmp + ptk->kck_len + ptk->kek_len +
578 ptk->tk_len, ptk->kdk_len);
579 wpa_hexdump_key(MSG_DEBUG, "WPA: KDK", ptk->kdk, ptk->kdk_len);
580 }
581
582 ptk->kek2_len = 0;
583 ptk->kck2_len = 0;
584
585 os_memset(tmp, 0, sizeof(tmp));
586 os_memset(data, 0, data_len);
587 return 0;
588 }
589
590 #ifdef CONFIG_FILS
591
fils_rmsk_to_pmk(int akmp,const u8 * rmsk,size_t rmsk_len,const u8 * snonce,const u8 * anonce,const u8 * dh_ss,size_t dh_ss_len,u8 * pmk,size_t * pmk_len)592 int fils_rmsk_to_pmk(int akmp, const u8 *rmsk, size_t rmsk_len,
593 const u8 *snonce, const u8 *anonce, const u8 *dh_ss,
594 size_t dh_ss_len, u8 *pmk, size_t *pmk_len)
595 {
596 u8 nonces[2 * FILS_NONCE_LEN];
597 const u8 *addr[2];
598 size_t len[2];
599 size_t num_elem;
600 int res;
601
602 /* PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ]) */
603 wpa_printf(MSG_DEBUG, "FILS: rMSK to PMK derivation");
604
605 if (wpa_key_mgmt_sha384(akmp))
606 *pmk_len = SHA384_MAC_LEN;
607 else if (wpa_key_mgmt_sha256(akmp))
608 *pmk_len = SHA256_MAC_LEN;
609 else
610 return -1;
611
612 wpa_hexdump_key(MSG_DEBUG, "FILS: rMSK", rmsk, rmsk_len);
613 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
614 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
615 wpa_hexdump(MSG_DEBUG, "FILS: DHss", dh_ss, dh_ss_len);
616
617 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
618 os_memcpy(&nonces[FILS_NONCE_LEN], anonce, FILS_NONCE_LEN);
619 addr[0] = rmsk;
620 len[0] = rmsk_len;
621 num_elem = 1;
622 if (dh_ss) {
623 addr[1] = dh_ss;
624 len[1] = dh_ss_len;
625 num_elem++;
626 }
627 if (wpa_key_mgmt_sha384(akmp))
628 res = hmac_sha384_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
629 addr, len, pmk);
630 else
631 res = hmac_sha256_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
632 addr, len, pmk);
633 if (res == 0)
634 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, *pmk_len);
635 else
636 *pmk_len = 0;
637 return res;
638 }
639
640
fils_pmkid_erp(int akmp,const u8 * reauth,size_t reauth_len,u8 * pmkid)641 int fils_pmkid_erp(int akmp, const u8 *reauth, size_t reauth_len,
642 u8 *pmkid)
643 {
644 const u8 *addr[1];
645 size_t len[1];
646 u8 hash[SHA384_MAC_LEN];
647 int res;
648
649 /* PMKID = Truncate-128(Hash(EAP-Initiate/Reauth)) */
650 addr[0] = reauth;
651 len[0] = reauth_len;
652 if (wpa_key_mgmt_sha384(akmp))
653 res = sha384_vector(1, addr, len, hash);
654 else if (wpa_key_mgmt_sha256(akmp))
655 res = sha256_vector(1, addr, len, hash);
656 else
657 return -1;
658 if (res)
659 return res;
660 os_memcpy(pmkid, hash, PMKID_LEN);
661 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
662 return 0;
663 }
664
665
fils_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * aa,const u8 * snonce,const u8 * anonce,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,u8 * ick,size_t * ick_len,int akmp,int cipher,u8 * fils_ft,size_t * fils_ft_len,size_t kdk_len)666 int fils_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa, const u8 *aa,
667 const u8 *snonce, const u8 *anonce, const u8 *dhss,
668 size_t dhss_len, struct wpa_ptk *ptk,
669 u8 *ick, size_t *ick_len, int akmp, int cipher,
670 u8 *fils_ft, size_t *fils_ft_len, size_t kdk_len)
671 {
672 u8 *data, *pos;
673 size_t data_len;
674 u8 tmp[FILS_ICK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
675 FILS_FT_MAX_LEN + WPA_KDK_MAX_LEN];
676 size_t key_data_len;
677 const char *label = "FILS PTK Derivation";
678 int ret = -1;
679 size_t offset;
680
681 /*
682 * FILS-Key-Data = PRF-X(PMK, "FILS PTK Derivation",
683 * SPA || AA || SNonce || ANonce [ || DHss ])
684 * ICK = L(FILS-Key-Data, 0, ICK_bits)
685 * KEK = L(FILS-Key-Data, ICK_bits, KEK_bits)
686 * TK = L(FILS-Key-Data, ICK_bits + KEK_bits, TK_bits)
687 * If doing FT initial mobility domain association:
688 * FILS-FT = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits,
689 * FILS-FT_bits)
690 * When a KDK is derived:
691 * KDK = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits + FILS-FT_bits,
692 * KDK_bits)
693 */
694 data_len = 2 * ETH_ALEN + 2 * FILS_NONCE_LEN + dhss_len;
695 data = os_malloc(data_len);
696 if (!data)
697 goto err;
698 pos = data;
699 os_memcpy(pos, spa, ETH_ALEN);
700 pos += ETH_ALEN;
701 os_memcpy(pos, aa, ETH_ALEN);
702 pos += ETH_ALEN;
703 os_memcpy(pos, snonce, FILS_NONCE_LEN);
704 pos += FILS_NONCE_LEN;
705 os_memcpy(pos, anonce, FILS_NONCE_LEN);
706 pos += FILS_NONCE_LEN;
707 if (dhss)
708 os_memcpy(pos, dhss, dhss_len);
709
710 ptk->kck_len = 0;
711 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
712 ptk->tk_len = wpa_cipher_key_len(cipher);
713 if (wpa_key_mgmt_sha384(akmp))
714 *ick_len = 48;
715 else if (wpa_key_mgmt_sha256(akmp))
716 *ick_len = 32;
717 else
718 goto err;
719 key_data_len = *ick_len + ptk->kek_len + ptk->tk_len;
720
721 if (kdk_len) {
722 if (kdk_len > WPA_KDK_MAX_LEN) {
723 wpa_printf(MSG_ERROR, "FILS: KDK len=%zu too big",
724 kdk_len);
725 goto err;
726 }
727
728 ptk->kdk_len = kdk_len;
729 key_data_len += kdk_len;
730 } else {
731 ptk->kdk_len = 0;
732 }
733
734 if (fils_ft && fils_ft_len) {
735 if (akmp == WPA_KEY_MGMT_FT_FILS_SHA256) {
736 *fils_ft_len = 32;
737 } else if (akmp == WPA_KEY_MGMT_FT_FILS_SHA384) {
738 *fils_ft_len = 48;
739 } else {
740 *fils_ft_len = 0;
741 fils_ft = NULL;
742 }
743 key_data_len += *fils_ft_len;
744 }
745
746 if (wpa_key_mgmt_sha384(akmp)) {
747 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA384)");
748 if (sha384_prf(pmk, pmk_len, label, data, data_len,
749 tmp, key_data_len) < 0)
750 goto err;
751 } else {
752 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA256)");
753 if (sha256_prf(pmk, pmk_len, label, data, data_len,
754 tmp, key_data_len) < 0)
755 goto err;
756 }
757
758 wpa_printf(MSG_DEBUG, "FILS: PTK derivation - SPA=" MACSTR
759 " AA=" MACSTR, MAC2STR(spa), MAC2STR(aa));
760 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
761 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
762 if (dhss)
763 wpa_hexdump_key(MSG_DEBUG, "FILS: DHss", dhss, dhss_len);
764 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, pmk_len);
765 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-Key-Data", tmp, key_data_len);
766
767 os_memcpy(ick, tmp, *ick_len);
768 offset = *ick_len;
769 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, *ick_len);
770
771 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
772 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK", ptk->kek, ptk->kek_len);
773 offset += ptk->kek_len;
774
775 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
776 wpa_hexdump_key(MSG_DEBUG, "FILS: TK", ptk->tk, ptk->tk_len);
777 offset += ptk->tk_len;
778
779 if (fils_ft && fils_ft_len) {
780 os_memcpy(fils_ft, tmp + offset, *fils_ft_len);
781 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-FT",
782 fils_ft, *fils_ft_len);
783 offset += *fils_ft_len;
784 }
785
786 if (ptk->kdk_len) {
787 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
788 wpa_hexdump_key(MSG_DEBUG, "FILS: KDK", ptk->kdk, ptk->kdk_len);
789 }
790
791 ptk->kek2_len = 0;
792 ptk->kck2_len = 0;
793
794 os_memset(tmp, 0, sizeof(tmp));
795 ret = 0;
796 err:
797 bin_clear_free(data, data_len);
798 return ret;
799 }
800
801
fils_key_auth_sk(const u8 * ick,size_t ick_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * g_sta,size_t g_sta_len,const u8 * g_ap,size_t g_ap_len,int akmp,u8 * key_auth_sta,u8 * key_auth_ap,size_t * key_auth_len)802 int fils_key_auth_sk(const u8 *ick, size_t ick_len, const u8 *snonce,
803 const u8 *anonce, const u8 *sta_addr, const u8 *bssid,
804 const u8 *g_sta, size_t g_sta_len,
805 const u8 *g_ap, size_t g_ap_len,
806 int akmp, u8 *key_auth_sta, u8 *key_auth_ap,
807 size_t *key_auth_len)
808 {
809 const u8 *addr[6];
810 size_t len[6];
811 size_t num_elem = 4;
812 int res;
813
814 wpa_printf(MSG_DEBUG, "FILS: Key-Auth derivation: STA-MAC=" MACSTR
815 " AP-BSSID=" MACSTR, MAC2STR(sta_addr), MAC2STR(bssid));
816 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, ick_len);
817 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
818 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
819 wpa_hexdump(MSG_DEBUG, "FILS: gSTA", g_sta, g_sta_len);
820 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
821
822 /*
823 * For (Re)Association Request frame (STA->AP):
824 * Key-Auth = HMAC-Hash(ICK, SNonce || ANonce || STA-MAC || AP-BSSID
825 * [ || gSTA || gAP ])
826 */
827 addr[0] = snonce;
828 len[0] = FILS_NONCE_LEN;
829 addr[1] = anonce;
830 len[1] = FILS_NONCE_LEN;
831 addr[2] = sta_addr;
832 len[2] = ETH_ALEN;
833 addr[3] = bssid;
834 len[3] = ETH_ALEN;
835 if (g_sta && g_sta_len && g_ap && g_ap_len) {
836 addr[4] = g_sta;
837 len[4] = g_sta_len;
838 addr[5] = g_ap;
839 len[5] = g_ap_len;
840 num_elem = 6;
841 }
842
843 if (wpa_key_mgmt_sha384(akmp)) {
844 *key_auth_len = 48;
845 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
846 key_auth_sta);
847 } else if (wpa_key_mgmt_sha256(akmp)) {
848 *key_auth_len = 32;
849 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
850 key_auth_sta);
851 } else {
852 return -1;
853 }
854 if (res < 0)
855 return res;
856
857 /*
858 * For (Re)Association Response frame (AP->STA):
859 * Key-Auth = HMAC-Hash(ICK, ANonce || SNonce || AP-BSSID || STA-MAC
860 * [ || gAP || gSTA ])
861 */
862 addr[0] = anonce;
863 addr[1] = snonce;
864 addr[2] = bssid;
865 addr[3] = sta_addr;
866 if (g_sta && g_sta_len && g_ap && g_ap_len) {
867 addr[4] = g_ap;
868 len[4] = g_ap_len;
869 addr[5] = g_sta;
870 len[5] = g_sta_len;
871 }
872
873 if (wpa_key_mgmt_sha384(akmp))
874 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
875 key_auth_ap);
876 else if (wpa_key_mgmt_sha256(akmp))
877 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
878 key_auth_ap);
879 if (res < 0)
880 return res;
881
882 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (STA)",
883 key_auth_sta, *key_auth_len);
884 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (AP)",
885 key_auth_ap, *key_auth_len);
886
887 return 0;
888 }
889
890 #endif /* CONFIG_FILS */
891
892
893 #ifdef CONFIG_IEEE80211R
wpa_ft_mic(int key_mgmt,const u8 * kck,size_t kck_len,const u8 * sta_addr,const u8 * ap_addr,u8 transaction_seqnum,const u8 * mdie,size_t mdie_len,const u8 * ftie,size_t ftie_len,const u8 * rsnie,size_t rsnie_len,const u8 * ric,size_t ric_len,const u8 * rsnxe,size_t rsnxe_len,const struct wpabuf * extra,u8 * mic)894 int wpa_ft_mic(int key_mgmt, const u8 *kck, size_t kck_len, const u8 *sta_addr,
895 const u8 *ap_addr, u8 transaction_seqnum,
896 const u8 *mdie, size_t mdie_len,
897 const u8 *ftie, size_t ftie_len,
898 const u8 *rsnie, size_t rsnie_len,
899 const u8 *ric, size_t ric_len,
900 const u8 *rsnxe, size_t rsnxe_len,
901 const struct wpabuf *extra,
902 u8 *mic)
903 {
904 const u8 *addr[11];
905 size_t len[11];
906 size_t i, num_elem = 0;
907 u8 zero_mic[32];
908 size_t mic_len, fte_fixed_len;
909 int res;
910
911 if (kck_len == 16) {
912 mic_len = 16;
913 #ifdef CONFIG_SHA384
914 } else if (kck_len == 24) {
915 mic_len = 24;
916 #endif /* CONFIG_SHA384 */
917 #ifdef CONFIG_SHA512
918 } else if (kck_len == 32) {
919 mic_len = 32;
920 #endif /* CONFIG_SHA512 */
921 } else {
922 wpa_printf(MSG_WARNING, "FT: Unsupported KCK length %u",
923 (unsigned int) kck_len);
924 return -1;
925 }
926
927 fte_fixed_len = sizeof(struct rsn_ftie) - 16 + mic_len;
928
929 addr[num_elem] = sta_addr;
930 len[num_elem] = ETH_ALEN;
931 num_elem++;
932
933 addr[num_elem] = ap_addr;
934 len[num_elem] = ETH_ALEN;
935 num_elem++;
936
937 addr[num_elem] = &transaction_seqnum;
938 len[num_elem] = 1;
939 num_elem++;
940
941 if (rsnie) {
942 addr[num_elem] = rsnie;
943 len[num_elem] = rsnie_len;
944 num_elem++;
945 }
946 if (mdie) {
947 addr[num_elem] = mdie;
948 len[num_elem] = mdie_len;
949 num_elem++;
950 }
951 if (ftie) {
952 if (ftie_len < 2 + fte_fixed_len)
953 return -1;
954
955 /* IE hdr and mic_control */
956 addr[num_elem] = ftie;
957 len[num_elem] = 2 + 2;
958 num_elem++;
959
960 /* MIC field with all zeros */
961 os_memset(zero_mic, 0, mic_len);
962 addr[num_elem] = zero_mic;
963 len[num_elem] = mic_len;
964 num_elem++;
965
966 /* Rest of FTIE */
967 addr[num_elem] = ftie + 2 + 2 + mic_len;
968 len[num_elem] = ftie_len - (2 + 2 + mic_len);
969 num_elem++;
970 }
971 if (ric) {
972 addr[num_elem] = ric;
973 len[num_elem] = ric_len;
974 num_elem++;
975 }
976
977 if (rsnxe) {
978 addr[num_elem] = rsnxe;
979 len[num_elem] = rsnxe_len;
980 num_elem++;
981 }
982
983 if (extra) {
984 addr[num_elem] = wpabuf_head(extra);
985 len[num_elem] = wpabuf_len(extra);
986 num_elem++;
987 }
988
989 for (i = 0; i < num_elem; i++)
990 wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", addr[i], len[i]);
991 res = -1;
992 #ifdef CONFIG_SHA512
993 if (kck_len == 32) {
994 u8 hash[SHA512_MAC_LEN];
995
996 if (hmac_sha512_vector(kck, kck_len, num_elem, addr, len, hash))
997 return -1;
998 os_memcpy(mic, hash, 32);
999 res = 0;
1000 }
1001 #endif /* CONFIG_SHA384 */
1002 #ifdef CONFIG_SHA384
1003 if (kck_len == 24) {
1004 u8 hash[SHA384_MAC_LEN];
1005
1006 if (hmac_sha384_vector(kck, kck_len, num_elem, addr, len, hash))
1007 return -1;
1008 os_memcpy(mic, hash, 24);
1009 res = 0;
1010 }
1011 #endif /* CONFIG_SHA384 */
1012 if (kck_len == 16 && key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1013 u8 hash[SHA256_MAC_LEN];
1014
1015 if (hmac_sha256_vector(kck, kck_len, num_elem, addr, len, hash))
1016 return -1;
1017 os_memcpy(mic, hash, 16);
1018 res = 0;
1019 }
1020 if (kck_len == 16 && key_mgmt != WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
1021 omac1_aes_128_vector(kck, num_elem, addr, len, mic) == 0)
1022 res = 0;
1023
1024 return res;
1025 }
1026
1027
wpa_ft_parse_ftie(const u8 * ie,size_t ie_len,struct wpa_ft_ies * parse,const u8 * opt)1028 static int wpa_ft_parse_ftie(const u8 *ie, size_t ie_len,
1029 struct wpa_ft_ies *parse, const u8 *opt)
1030 {
1031 const u8 *end, *pos;
1032 u8 link_id;
1033
1034 pos = opt;
1035 end = ie + ie_len;
1036 wpa_hexdump(MSG_DEBUG, "FT: Parse FTE subelements", pos, end - pos);
1037
1038 while (end - pos >= 2) {
1039 u8 id, len;
1040
1041 id = *pos++;
1042 len = *pos++;
1043 if (len > end - pos) {
1044 wpa_printf(MSG_DEBUG, "FT: Truncated subelement");
1045 return -1;
1046 }
1047
1048 switch (id) {
1049 case FTIE_SUBELEM_R1KH_ID:
1050 if (len != FT_R1KH_ID_LEN) {
1051 wpa_printf(MSG_DEBUG,
1052 "FT: Invalid R1KH-ID length in FTIE: %d",
1053 len);
1054 return -1;
1055 }
1056 parse->r1kh_id = pos;
1057 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID",
1058 parse->r1kh_id, FT_R1KH_ID_LEN);
1059 break;
1060 case FTIE_SUBELEM_GTK:
1061 wpa_printf(MSG_DEBUG, "FT: GTK");
1062 parse->gtk = pos;
1063 parse->gtk_len = len;
1064 break;
1065 case FTIE_SUBELEM_R0KH_ID:
1066 if (len < 1 || len > FT_R0KH_ID_MAX_LEN) {
1067 wpa_printf(MSG_DEBUG,
1068 "FT: Invalid R0KH-ID length in FTIE: %d",
1069 len);
1070 return -1;
1071 }
1072 parse->r0kh_id = pos;
1073 parse->r0kh_id_len = len;
1074 wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID",
1075 parse->r0kh_id, parse->r0kh_id_len);
1076 break;
1077 case FTIE_SUBELEM_IGTK:
1078 wpa_printf(MSG_DEBUG, "FT: IGTK");
1079 parse->igtk = pos;
1080 parse->igtk_len = len;
1081 break;
1082 #ifdef CONFIG_OCV
1083 case FTIE_SUBELEM_OCI:
1084 parse->oci = pos;
1085 parse->oci_len = len;
1086 wpa_hexdump(MSG_DEBUG, "FT: OCI",
1087 parse->oci, parse->oci_len);
1088 break;
1089 #endif /* CONFIG_OCV */
1090 case FTIE_SUBELEM_BIGTK:
1091 wpa_printf(MSG_DEBUG, "FT: BIGTK");
1092 parse->bigtk = pos;
1093 parse->bigtk_len = len;
1094 break;
1095 case FTIE_SUBELEM_MLO_GTK:
1096 if (len < 2 + 1 + 1 + 8) {
1097 wpa_printf(MSG_DEBUG,
1098 "FT: Too short MLO GTK in FTE");
1099 return -1;
1100 }
1101 link_id = pos[2] & 0x0f;
1102 wpa_printf(MSG_DEBUG, "FT: MLO GTK (Link ID %u)",
1103 link_id);
1104 if (link_id >= MAX_NUM_MLD_LINKS)
1105 break;
1106 parse->valid_mlo_gtks |= BIT(link_id);
1107 parse->mlo_gtk[link_id] = pos;
1108 parse->mlo_gtk_len[link_id] = len;
1109 break;
1110 case FTIE_SUBELEM_MLO_IGTK:
1111 if (len < 2 + 6 + 1 + 1) {
1112 wpa_printf(MSG_DEBUG,
1113 "FT: Too short MLO IGTK in FTE");
1114 return -1;
1115 }
1116 link_id = pos[2 + 6] & 0x0f;
1117 wpa_printf(MSG_DEBUG, "FT: MLO IGTK (Link ID %u)",
1118 link_id);
1119 if (link_id >= MAX_NUM_MLD_LINKS)
1120 break;
1121 parse->valid_mlo_igtks |= BIT(link_id);
1122 parse->mlo_igtk[link_id] = pos;
1123 parse->mlo_igtk_len[link_id] = len;
1124 break;
1125 case FTIE_SUBELEM_MLO_BIGTK:
1126 if (len < 2 + 6 + 1 + 1) {
1127 wpa_printf(MSG_DEBUG,
1128 "FT: Too short MLO BIGTK in FTE");
1129 return -1;
1130 }
1131 link_id = pos[2 + 6] & 0x0f;
1132 wpa_printf(MSG_DEBUG, "FT: MLO BIGTK (Link ID %u)",
1133 link_id);
1134 if (link_id >= MAX_NUM_MLD_LINKS)
1135 break;
1136 parse->valid_mlo_bigtks |= BIT(link_id);
1137 parse->mlo_bigtk[link_id] = pos;
1138 parse->mlo_bigtk_len[link_id] = len;
1139 break;
1140 default:
1141 wpa_printf(MSG_DEBUG, "FT: Unknown subelem id %u", id);
1142 break;
1143 }
1144
1145 pos += len;
1146 }
1147
1148 return 0;
1149 }
1150
1151
wpa_ft_parse_fte(int key_mgmt,const u8 * ie,size_t len,struct wpa_ft_ies * parse)1152 static int wpa_ft_parse_fte(int key_mgmt, const u8 *ie, size_t len,
1153 struct wpa_ft_ies *parse)
1154 {
1155 size_t mic_len;
1156 u8 mic_len_info;
1157 const u8 *pos = ie;
1158 const u8 *end = pos + len;
1159
1160 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control", pos, 2);
1161 parse->fte_rsnxe_used = pos[0] & FTE_MIC_CTRL_RSNXE_USED;
1162 mic_len_info = (pos[0] & FTE_MIC_CTRL_MIC_LEN_MASK) >>
1163 FTE_MIC_CTRL_MIC_LEN_SHIFT;
1164 parse->fte_elem_count = pos[1];
1165 pos += 2;
1166
1167 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1168 switch (mic_len_info) {
1169 case FTE_MIC_LEN_16:
1170 mic_len = 16;
1171 break;
1172 case FTE_MIC_LEN_24:
1173 mic_len = 24;
1174 break;
1175 case FTE_MIC_LEN_32:
1176 mic_len = 32;
1177 break;
1178 default:
1179 wpa_printf(MSG_DEBUG,
1180 "FT: Unknown MIC Length subfield value %u",
1181 mic_len_info);
1182 return -1;
1183 }
1184 } else {
1185 mic_len = wpa_key_mgmt_sha384(key_mgmt) ? 24 : 16;
1186 }
1187 if (mic_len > (size_t) (end - pos)) {
1188 wpa_printf(MSG_DEBUG, "FT: No room for %zu octet MIC in FTE",
1189 mic_len);
1190 return -1;
1191 }
1192 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC", pos, mic_len);
1193 parse->fte_mic = pos;
1194 parse->fte_mic_len = mic_len;
1195 pos += mic_len;
1196
1197 if (2 * WPA_NONCE_LEN > end - pos)
1198 return -1;
1199 parse->fte_anonce = pos;
1200 wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
1201 parse->fte_anonce, WPA_NONCE_LEN);
1202 pos += WPA_NONCE_LEN;
1203 parse->fte_snonce = pos;
1204 wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
1205 parse->fte_snonce, WPA_NONCE_LEN);
1206 pos += WPA_NONCE_LEN;
1207
1208 return wpa_ft_parse_ftie(ie, len, parse, pos);
1209 }
1210
1211
wpa_ft_parse_ies(const u8 * ies,size_t ies_len,struct wpa_ft_ies * parse,int key_mgmt,bool reassoc_resp)1212 int wpa_ft_parse_ies(const u8 *ies, size_t ies_len, struct wpa_ft_ies *parse,
1213 int key_mgmt, bool reassoc_resp)
1214 {
1215 const u8 *end, *pos;
1216 struct wpa_ie_data data;
1217 int ret;
1218 int prot_ie_count = 0;
1219 const u8 *fte = NULL;
1220 size_t fte_len = 0;
1221 bool is_fte = false;
1222 struct ieee802_11_elems elems;
1223
1224 os_memset(parse, 0, sizeof(*parse));
1225 if (ies == NULL)
1226 return 0;
1227
1228 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) == ParseFailed) {
1229 wpa_printf(MSG_DEBUG, "FT: Failed to parse elements");
1230 goto fail;
1231 }
1232
1233 pos = ies;
1234 end = ies + ies_len;
1235 while (end - pos >= 2) {
1236 u8 id, len;
1237
1238 id = *pos++;
1239 len = *pos++;
1240 if (len > end - pos)
1241 break;
1242
1243 if (id != WLAN_EID_FAST_BSS_TRANSITION &&
1244 id != WLAN_EID_FRAGMENT)
1245 is_fte = false;
1246
1247 switch (id) {
1248 case WLAN_EID_RSN:
1249 wpa_hexdump(MSG_DEBUG, "FT: RSNE", pos, len);
1250 parse->rsn = pos;
1251 parse->rsn_len = len;
1252 ret = wpa_parse_wpa_ie_rsn(parse->rsn - 2,
1253 parse->rsn_len + 2,
1254 &data);
1255 if (ret < 0) {
1256 wpa_printf(MSG_DEBUG, "FT: Failed to parse "
1257 "RSN IE: %d", ret);
1258 goto fail;
1259 }
1260 parse->rsn_capab = data.capabilities;
1261 if (data.num_pmkid == 1 && data.pmkid)
1262 parse->rsn_pmkid = data.pmkid;
1263 parse->key_mgmt = data.key_mgmt;
1264 parse->pairwise_cipher = data.pairwise_cipher;
1265 if (!key_mgmt)
1266 key_mgmt = parse->key_mgmt;
1267 break;
1268 case WLAN_EID_RSNX:
1269 wpa_hexdump(MSG_DEBUG, "FT: RSNXE", pos, len);
1270 if (len < 1)
1271 break;
1272 parse->rsnxe = pos;
1273 parse->rsnxe_len = len;
1274 break;
1275 case WLAN_EID_MOBILITY_DOMAIN:
1276 wpa_hexdump(MSG_DEBUG, "FT: MDE", pos, len);
1277 if (len < sizeof(struct rsn_mdie))
1278 goto fail;
1279 parse->mdie = pos;
1280 parse->mdie_len = len;
1281 break;
1282 case WLAN_EID_FAST_BSS_TRANSITION:
1283 wpa_hexdump(MSG_DEBUG, "FT: FTE", pos, len);
1284 /* The first two octets (MIC Control field) is in the
1285 * same offset for all cases, but the second field (MIC)
1286 * has variable length with three different values.
1287 * In particular the FT-SAE-EXT-KEY is inconvinient to
1288 * parse, so try to handle this in pieces instead of
1289 * using the struct rsn_ftie* definitions. */
1290
1291 if (len < 2)
1292 goto fail;
1293 prot_ie_count = pos[1]; /* Element Count field in
1294 * MIC Control */
1295 is_fte = true;
1296 fte = pos;
1297 fte_len = len;
1298 break;
1299 case WLAN_EID_FRAGMENT:
1300 if (is_fte) {
1301 wpa_hexdump(MSG_DEBUG, "FT: FTE fragment",
1302 pos, len);
1303 fte_len += 2 + len;
1304 }
1305 break;
1306 case WLAN_EID_TIMEOUT_INTERVAL:
1307 wpa_hexdump(MSG_DEBUG, "FT: Timeout Interval",
1308 pos, len);
1309 if (len != 5)
1310 break;
1311 parse->tie = pos;
1312 parse->tie_len = len;
1313 break;
1314 case WLAN_EID_RIC_DATA:
1315 if (parse->ric == NULL)
1316 parse->ric = pos - 2;
1317 break;
1318 }
1319
1320 pos += len;
1321 }
1322
1323 if (fte) {
1324 int res;
1325
1326 if (fte_len < 255) {
1327 res = wpa_ft_parse_fte(key_mgmt, fte, fte_len, parse);
1328 } else {
1329 parse->fte_buf = ieee802_11_defrag(fte, fte_len, false);
1330 if (!parse->fte_buf)
1331 goto fail;
1332 res = wpa_ft_parse_fte(key_mgmt,
1333 wpabuf_head(parse->fte_buf),
1334 wpabuf_len(parse->fte_buf),
1335 parse);
1336 }
1337 if (res < 0)
1338 goto fail;
1339
1340 /* FTE might be fragmented. If it is, the separate Fragment
1341 * elements are included in MIC calculation as full elements. */
1342 parse->ftie = fte;
1343 parse->ftie_len = fte_len;
1344 }
1345
1346 if (prot_ie_count == 0)
1347 return 0; /* no MIC */
1348
1349 /*
1350 * Check that the protected IE count matches with IEs included in the
1351 * frame.
1352 */
1353 if (reassoc_resp && elems.basic_mle) {
1354 unsigned int link_id;
1355
1356 /* TODO: This count should be done based on all _requested_,
1357 * not _accepted_ links. */
1358 for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
1359 if (parse->mlo_gtk[link_id]) {
1360 if (parse->rsn)
1361 prot_ie_count--;
1362 if (parse->rsnxe)
1363 prot_ie_count--;
1364 }
1365 }
1366 } else {
1367 if (parse->rsn)
1368 prot_ie_count--;
1369 if (parse->rsnxe)
1370 prot_ie_count--;
1371 }
1372 if (parse->mdie)
1373 prot_ie_count--;
1374 if (parse->ftie)
1375 prot_ie_count--;
1376 if (prot_ie_count < 0) {
1377 wpa_printf(MSG_DEBUG, "FT: Some required IEs not included in "
1378 "the protected IE count");
1379 goto fail;
1380 }
1381
1382 if (prot_ie_count == 0 && parse->ric) {
1383 wpa_printf(MSG_DEBUG, "FT: RIC IE(s) in the frame, but not "
1384 "included in protected IE count");
1385 goto fail;
1386 }
1387
1388 /* Determine the end of the RIC IE(s) */
1389 if (parse->ric) {
1390 pos = parse->ric;
1391 while (end - pos >= 2 && 2 + pos[1] <= end - pos &&
1392 prot_ie_count) {
1393 prot_ie_count--;
1394 pos += 2 + pos[1];
1395 }
1396 parse->ric_len = pos - parse->ric;
1397 }
1398 if (prot_ie_count) {
1399 wpa_printf(MSG_DEBUG, "FT: %d protected IEs missing from "
1400 "frame", (int) prot_ie_count);
1401 goto fail;
1402 }
1403
1404 return 0;
1405
1406 fail:
1407 wpa_ft_parse_ies_free(parse);
1408 return -1;
1409 }
1410
1411
wpa_ft_parse_ies_free(struct wpa_ft_ies * parse)1412 void wpa_ft_parse_ies_free(struct wpa_ft_ies *parse)
1413 {
1414 if (!parse)
1415 return;
1416 wpabuf_free(parse->fte_buf);
1417 parse->fte_buf = NULL;
1418 }
1419
1420 #endif /* CONFIG_IEEE80211R */
1421
1422
1423 #ifdef CONFIG_PASN
1424
1425 /*
1426 * pasn_use_sha384 - Should SHA384 be used or SHA256
1427 *
1428 * @akmp: Authentication and key management protocol
1429 * @cipher: The cipher suite
1430 *
1431 * According to IEEE P802.11az/D2.7, 12.12.7, the hash algorithm to use is the
1432 * hash algorithm defined for the Base AKM (see Table 9-151 (AKM suite
1433 * selectors)). When there is no Base AKM, the hash algorithm is selected based
1434 * on the pairwise cipher suite provided in the RSNE by the AP in the second
1435 * PASN frame. SHA-256 is used as the hash algorithm, except for the ciphers
1436 * 00-0F-AC:9 and 00-0F-AC:10 for which SHA-384 is used.
1437 */
pasn_use_sha384(int akmp,int cipher)1438 bool pasn_use_sha384(int akmp, int cipher)
1439 {
1440 return (akmp == WPA_KEY_MGMT_PASN && (cipher == WPA_CIPHER_CCMP_256 ||
1441 cipher == WPA_CIPHER_GCMP_256)) ||
1442 wpa_key_mgmt_sha384(akmp);
1443 }
1444
1445
1446 /**
1447 * pasn_pmk_to_ptk - Calculate PASN PTK from PMK, addresses, etc.
1448 * @pmk: Pairwise master key
1449 * @pmk_len: Length of PMK
1450 * @spa: Suppplicant address
1451 * @bssid: AP BSSID
1452 * @dhss: Is the shared secret (DHss) derived from the PASN ephemeral key
1453 * exchange encoded as an octet string
1454 * @dhss_len: The length of dhss in octets
1455 * @ptk: Buffer for pairwise transient key
1456 * @akmp: Negotiated AKM
1457 * @cipher: Negotiated pairwise cipher
1458 * @kdk_len: the length in octets that should be derived for HTLK. Can be zero.
1459 * Returns: 0 on success, -1 on failure
1460 */
pasn_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * bssid,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,int akmp,int cipher,size_t kdk_len)1461 int pasn_pmk_to_ptk(const u8 *pmk, size_t pmk_len,
1462 const u8 *spa, const u8 *bssid,
1463 const u8 *dhss, size_t dhss_len,
1464 struct wpa_ptk *ptk, int akmp, int cipher,
1465 size_t kdk_len)
1466 {
1467 u8 tmp[WPA_KCK_MAX_LEN + WPA_TK_MAX_LEN + WPA_KDK_MAX_LEN];
1468 u8 *data;
1469 size_t data_len, ptk_len;
1470 int ret = -1;
1471 const char *label = "PASN PTK Derivation";
1472
1473 if (!pmk || !pmk_len) {
1474 wpa_printf(MSG_ERROR, "PASN: No PMK set for PTK derivation");
1475 return -1;
1476 }
1477
1478 if (!dhss || !dhss_len) {
1479 wpa_printf(MSG_ERROR, "PASN: No DHss set for PTK derivation");
1480 return -1;
1481 }
1482
1483 /*
1484 * PASN-PTK = KDF(PMK, “PASN PTK Derivation”, SPA || BSSID || DHss)
1485 *
1486 * KCK = L(PASN-PTK, 0, 256)
1487 * TK = L(PASN-PTK, 256, TK_bits)
1488 * KDK = L(PASN-PTK, 256 + TK_bits, kdk_len * 8)
1489 */
1490 data_len = 2 * ETH_ALEN + dhss_len;
1491 data = os_zalloc(data_len);
1492 if (!data)
1493 return -1;
1494
1495 os_memcpy(data, spa, ETH_ALEN);
1496 os_memcpy(data + ETH_ALEN, bssid, ETH_ALEN);
1497 os_memcpy(data + 2 * ETH_ALEN, dhss, dhss_len);
1498
1499 ptk->kck_len = WPA_PASN_KCK_LEN;
1500 ptk->tk_len = wpa_cipher_key_len(cipher);
1501 ptk->kdk_len = kdk_len;
1502 ptk->kek_len = 0;
1503 ptk->kek2_len = 0;
1504 ptk->kck2_len = 0;
1505
1506 if (ptk->tk_len == 0) {
1507 wpa_printf(MSG_ERROR,
1508 "PASN: Unsupported cipher (0x%x) used in PTK derivation",
1509 cipher);
1510 goto err;
1511 }
1512
1513 ptk_len = ptk->kck_len + ptk->tk_len + ptk->kdk_len;
1514 if (ptk_len > sizeof(tmp))
1515 goto err;
1516
1517 if (pasn_use_sha384(akmp, cipher)) {
1518 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA384");
1519
1520 if (sha384_prf(pmk, pmk_len, label, data, data_len, tmp,
1521 ptk_len) < 0)
1522 goto err;
1523 } else {
1524 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA256");
1525
1526 if (sha256_prf(pmk, pmk_len, label, data, data_len, tmp,
1527 ptk_len) < 0)
1528 goto err;
1529 }
1530
1531 wpa_printf(MSG_DEBUG,
1532 "PASN: PTK derivation: SPA=" MACSTR " BSSID=" MACSTR,
1533 MAC2STR(spa), MAC2STR(bssid));
1534
1535 wpa_hexdump_key(MSG_DEBUG, "PASN: DHss", dhss, dhss_len);
1536 wpa_hexdump_key(MSG_DEBUG, "PASN: PMK", pmk, pmk_len);
1537 wpa_hexdump_key(MSG_DEBUG, "PASN: PASN-PTK", tmp, ptk_len);
1538
1539 os_memcpy(ptk->kck, tmp, WPA_PASN_KCK_LEN);
1540 wpa_hexdump_key(MSG_DEBUG, "PASN: KCK:", ptk->kck, WPA_PASN_KCK_LEN);
1541
1542 os_memcpy(ptk->tk, tmp + WPA_PASN_KCK_LEN, ptk->tk_len);
1543 wpa_hexdump_key(MSG_DEBUG, "PASN: TK:", ptk->tk, ptk->tk_len);
1544
1545 if (kdk_len) {
1546 os_memcpy(ptk->kdk, tmp + WPA_PASN_KCK_LEN + ptk->tk_len,
1547 ptk->kdk_len);
1548 wpa_hexdump_key(MSG_DEBUG, "PASN: KDK:",
1549 ptk->kdk, ptk->kdk_len);
1550 }
1551
1552 forced_memzero(tmp, sizeof(tmp));
1553 ret = 0;
1554 err:
1555 bin_clear_free(data, data_len);
1556 return ret;
1557 }
1558
1559
1560 /*
1561 * pasn_mic_len - Returns the MIC length for PASN authentication
1562 */
pasn_mic_len(int akmp,int cipher)1563 u8 pasn_mic_len(int akmp, int cipher)
1564 {
1565 if (pasn_use_sha384(akmp, cipher))
1566 return 24;
1567
1568 return 16;
1569 }
1570
1571
1572 /**
1573 * wpa_ltf_keyseed - Compute LTF keyseed from KDK
1574 * @ptk: Buffer that holds pairwise transient key
1575 * @akmp: Negotiated AKM
1576 * @cipher: Negotiated pairwise cipher
1577 * Returns: 0 on success, -1 on failure
1578 */
wpa_ltf_keyseed(struct wpa_ptk * ptk,int akmp,int cipher)1579 int wpa_ltf_keyseed(struct wpa_ptk *ptk, int akmp, int cipher)
1580 {
1581 u8 *buf;
1582 size_t buf_len;
1583 u8 hash[SHA384_MAC_LEN];
1584 const u8 *kdk = ptk->kdk;
1585 size_t kdk_len = ptk->kdk_len;
1586 const char *label = "Secure LTF key seed";
1587
1588 if (!kdk || !kdk_len) {
1589 wpa_printf(MSG_ERROR, "WPA: No KDK for LTF keyseed generation");
1590 return -1;
1591 }
1592
1593 buf = (u8 *)label;
1594 buf_len = os_strlen(label);
1595
1596 if (pasn_use_sha384(akmp, cipher)) {
1597 wpa_printf(MSG_DEBUG,
1598 "WPA: Secure LTF keyseed using HMAC-SHA384");
1599
1600 if (hmac_sha384(kdk, kdk_len, buf, buf_len, hash)) {
1601 wpa_printf(MSG_ERROR,
1602 "WPA: HMAC-SHA384 compute failed");
1603 return -1;
1604 }
1605 os_memcpy(ptk->ltf_keyseed, hash, SHA384_MAC_LEN);
1606 ptk->ltf_keyseed_len = SHA384_MAC_LEN;
1607 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1608 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1609
1610 } else {
1611 wpa_printf(MSG_DEBUG, "WPA: LTF keyseed using HMAC-SHA256");
1612
1613 if (hmac_sha256(kdk, kdk_len, buf, buf_len, hash)) {
1614 wpa_printf(MSG_ERROR,
1615 "WPA: HMAC-SHA256 compute failed");
1616 return -1;
1617 }
1618 os_memcpy(ptk->ltf_keyseed, hash, SHA256_MAC_LEN);
1619 ptk->ltf_keyseed_len = SHA256_MAC_LEN;
1620 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1621 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1622 }
1623
1624 return 0;
1625 }
1626
1627
1628 /**
1629 * pasn_mic - Calculate PASN MIC
1630 * @kck: The key confirmation key for the PASN PTKSA
1631 * @akmp: Negotiated AKM
1632 * @cipher: Negotiated pairwise cipher
1633 * @addr1: For the 2nd PASN frame supplicant address; for the 3rd frame the
1634 * BSSID
1635 * @addr2: For the 2nd PASN frame the BSSID; for the 3rd frame the supplicant
1636 * address
1637 * @data: For calculating the MIC for the 2nd PASN frame, this should hold the
1638 * Beacon frame RSNE + RSNXE. For calculating the MIC for the 3rd PASN
1639 * frame, this should hold the hash of the body of the PASN 1st frame.
1640 * @data_len: The length of data
1641 * @frame: The body of the PASN frame including the MIC element with the octets
1642 * in the MIC field of the MIC element set to 0.
1643 * @frame_len: The length of frame
1644 * @mic: Buffer to hold the MIC on success. Should be big enough to handle the
1645 * maximal MIC length
1646 * Returns: 0 on success, -1 on failure
1647 */
pasn_mic(const u8 * kck,int akmp,int cipher,const u8 * addr1,const u8 * addr2,const u8 * data,size_t data_len,const u8 * frame,size_t frame_len,u8 * mic)1648 int pasn_mic(const u8 *kck, int akmp, int cipher,
1649 const u8 *addr1, const u8 *addr2,
1650 const u8 *data, size_t data_len,
1651 const u8 *frame, size_t frame_len, u8 *mic)
1652 {
1653 u8 *buf;
1654 u8 hash[SHA384_MAC_LEN];
1655 size_t buf_len = 2 * ETH_ALEN + data_len + frame_len;
1656 int ret = -1;
1657
1658 if (!kck) {
1659 wpa_printf(MSG_ERROR, "PASN: No KCK for MIC calculation");
1660 return -1;
1661 }
1662
1663 if (!data || !data_len) {
1664 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1665 return -1;
1666 }
1667
1668 if (!frame || !frame_len) {
1669 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1670 return -1;
1671 }
1672
1673 buf = os_zalloc(buf_len);
1674 if (!buf)
1675 return -1;
1676
1677 os_memcpy(buf, addr1, ETH_ALEN);
1678 os_memcpy(buf + ETH_ALEN, addr2, ETH_ALEN);
1679
1680 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: data", data, data_len);
1681 os_memcpy(buf + 2 * ETH_ALEN, data, data_len);
1682
1683 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: frame", frame, frame_len);
1684 os_memcpy(buf + 2 * ETH_ALEN + data_len, frame, frame_len);
1685
1686 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: KCK", kck, WPA_PASN_KCK_LEN);
1687 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: buf", buf, buf_len);
1688
1689 if (pasn_use_sha384(akmp, cipher)) {
1690 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA384");
1691
1692 if (hmac_sha384(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1693 goto err;
1694
1695 os_memcpy(mic, hash, 24);
1696 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 24);
1697 } else {
1698 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA256");
1699
1700 if (hmac_sha256(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1701 goto err;
1702
1703 os_memcpy(mic, hash, 16);
1704 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 16);
1705 }
1706
1707 ret = 0;
1708 err:
1709 bin_clear_free(buf, buf_len);
1710 return ret;
1711 }
1712
1713
1714 /**
1715 * pasn_auth_frame_hash - Computes a hash of an Authentication frame body
1716 * @akmp: Negotiated AKM
1717 * @cipher: Negotiated pairwise cipher
1718 * @data: Pointer to the Authentication frame body
1719 * @len: Length of the Authentication frame body
1720 * @hash: On return would hold the computed hash. Should be big enough to handle
1721 * SHA384.
1722 * Returns: 0 on success, -1 on failure
1723 */
pasn_auth_frame_hash(int akmp,int cipher,const u8 * data,size_t len,u8 * hash)1724 int pasn_auth_frame_hash(int akmp, int cipher, const u8 *data, size_t len,
1725 u8 *hash)
1726 {
1727 if (pasn_use_sha384(akmp, cipher)) {
1728 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-384");
1729 return sha384_vector(1, &data, &len, hash);
1730 } else {
1731 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-256");
1732 return sha256_vector(1, &data, &len, hash);
1733 }
1734 }
1735
1736 #endif /* CONFIG_PASN */
1737
1738
rsn_selector_to_bitfield(const u8 * s)1739 static int rsn_selector_to_bitfield(const u8 *s)
1740 {
1741 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NONE)
1742 return WPA_CIPHER_NONE;
1743 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_TKIP)
1744 return WPA_CIPHER_TKIP;
1745 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP)
1746 return WPA_CIPHER_CCMP;
1747 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_AES_128_CMAC)
1748 return WPA_CIPHER_AES_128_CMAC;
1749 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP)
1750 return WPA_CIPHER_GCMP;
1751 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP_256)
1752 return WPA_CIPHER_CCMP_256;
1753 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP_256)
1754 return WPA_CIPHER_GCMP_256;
1755 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_128)
1756 return WPA_CIPHER_BIP_GMAC_128;
1757 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_256)
1758 return WPA_CIPHER_BIP_GMAC_256;
1759 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_CMAC_256)
1760 return WPA_CIPHER_BIP_CMAC_256;
1761 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED)
1762 return WPA_CIPHER_GTK_NOT_USED;
1763 return 0;
1764 }
1765
1766
rsn_key_mgmt_to_bitfield(const u8 * s)1767 static int rsn_key_mgmt_to_bitfield(const u8 *s)
1768 {
1769 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_UNSPEC_802_1X)
1770 return WPA_KEY_MGMT_IEEE8021X;
1771 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1772 return WPA_KEY_MGMT_PSK;
1773 #ifdef CONFIG_IEEE80211R
1774 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X)
1775 return WPA_KEY_MGMT_FT_IEEE8021X;
1776 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_PSK)
1777 return WPA_KEY_MGMT_FT_PSK;
1778 #ifdef CONFIG_SHA384
1779 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384)
1780 return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
1781 #endif /* CONFIG_SHA384 */
1782 #endif /* CONFIG_IEEE80211R */
1783 #ifdef CONFIG_SHA384
1784 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA384)
1785 return WPA_KEY_MGMT_IEEE8021X_SHA384;
1786 #endif /* CONFIG_SHA384 */
1787 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
1788 return WPA_KEY_MGMT_IEEE8021X_SHA256;
1789 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
1790 return WPA_KEY_MGMT_PSK_SHA256;
1791 #ifdef CONFIG_SAE
1792 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE)
1793 return WPA_KEY_MGMT_SAE;
1794 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1795 return WPA_KEY_MGMT_SAE_EXT_KEY;
1796 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE)
1797 return WPA_KEY_MGMT_FT_SAE;
1798 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1799 return WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1800 #endif /* CONFIG_SAE */
1801 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B)
1802 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1803 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192)
1804 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1805 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA256)
1806 return WPA_KEY_MGMT_FILS_SHA256;
1807 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA384)
1808 return WPA_KEY_MGMT_FILS_SHA384;
1809 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA256)
1810 return WPA_KEY_MGMT_FT_FILS_SHA256;
1811 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA384)
1812 return WPA_KEY_MGMT_FT_FILS_SHA384;
1813 #ifdef CONFIG_OWE
1814 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OWE)
1815 return WPA_KEY_MGMT_OWE;
1816 #endif /* CONFIG_OWE */
1817 #ifdef CONFIG_DPP
1818 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_DPP)
1819 return WPA_KEY_MGMT_DPP;
1820 #endif /* CONFIG_DPP */
1821 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OSEN)
1822 return WPA_KEY_MGMT_OSEN;
1823 #ifdef CONFIG_PASN
1824 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PASN)
1825 return WPA_KEY_MGMT_PASN;
1826 #endif /* CONFIG_PASN */
1827 return 0;
1828 }
1829
1830
wpa_cipher_valid_group(int cipher)1831 int wpa_cipher_valid_group(int cipher)
1832 {
1833 return wpa_cipher_valid_pairwise(cipher) ||
1834 cipher == WPA_CIPHER_GTK_NOT_USED;
1835 }
1836
1837
wpa_cipher_valid_mgmt_group(int cipher)1838 int wpa_cipher_valid_mgmt_group(int cipher)
1839 {
1840 return cipher == WPA_CIPHER_GTK_NOT_USED ||
1841 cipher == WPA_CIPHER_AES_128_CMAC ||
1842 cipher == WPA_CIPHER_BIP_GMAC_128 ||
1843 cipher == WPA_CIPHER_BIP_GMAC_256 ||
1844 cipher == WPA_CIPHER_BIP_CMAC_256;
1845 }
1846
1847
1848 /**
1849 * wpa_parse_wpa_ie_rsn - Parse RSN IE
1850 * @rsn_ie: Buffer containing RSN IE
1851 * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
1852 * @data: Pointer to structure that will be filled in with parsed data
1853 * Returns: 0 on success, <0 on failure
1854 */
wpa_parse_wpa_ie_rsn(const u8 * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)1855 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
1856 struct wpa_ie_data *data)
1857 {
1858 const u8 *pos;
1859 int left;
1860 int i, count;
1861
1862 os_memset(data, 0, sizeof(*data));
1863 data->proto = WPA_PROTO_RSN;
1864 data->pairwise_cipher = WPA_CIPHER_CCMP;
1865 data->group_cipher = WPA_CIPHER_CCMP;
1866 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1867 data->capabilities = 0;
1868 data->pmkid = NULL;
1869 data->num_pmkid = 0;
1870 data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1871
1872 if (rsn_ie_len == 0) {
1873 /* No RSN IE - fail silently */
1874 return -1;
1875 }
1876
1877 if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
1878 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1879 __func__, (unsigned long) rsn_ie_len);
1880 return -1;
1881 }
1882
1883 if (rsn_ie_len >= 6 && rsn_ie[1] >= 4 &&
1884 rsn_ie[1] == rsn_ie_len - 2 &&
1885 WPA_GET_BE32(&rsn_ie[2]) == OSEN_IE_VENDOR_TYPE) {
1886 pos = rsn_ie + 6;
1887 left = rsn_ie_len - 6;
1888
1889 data->group_cipher = WPA_CIPHER_GTK_NOT_USED;
1890 data->has_group = 1;
1891 data->key_mgmt = WPA_KEY_MGMT_OSEN;
1892 data->proto = WPA_PROTO_OSEN;
1893 } else if (rsn_ie_len >= 2 + 4 + 2 && rsn_ie[1] >= 4 + 2 &&
1894 rsn_ie[1] == rsn_ie_len - 2 &&
1895 (WPA_GET_BE32(&rsn_ie[2]) == RSNE_OVERRIDE_IE_VENDOR_TYPE ||
1896 WPA_GET_BE32(&rsn_ie[2]) ==
1897 RSNE_OVERRIDE_2_IE_VENDOR_TYPE) &&
1898 WPA_GET_LE16(&rsn_ie[2 + 4]) == RSN_VERSION) {
1899 pos = rsn_ie + 2 + 4 + 2;
1900 left = rsn_ie_len - 2 - 4 - 2;
1901 } else {
1902 const struct rsn_ie_hdr *hdr;
1903
1904 hdr = (const struct rsn_ie_hdr *) rsn_ie;
1905
1906 if (hdr->elem_id != WLAN_EID_RSN ||
1907 hdr->len != rsn_ie_len - 2 ||
1908 WPA_GET_LE16(hdr->version) != RSN_VERSION) {
1909 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1910 __func__);
1911 return -2;
1912 }
1913
1914 pos = (const u8 *) (hdr + 1);
1915 left = rsn_ie_len - sizeof(*hdr);
1916 }
1917
1918 if (left >= RSN_SELECTOR_LEN) {
1919 data->group_cipher = rsn_selector_to_bitfield(pos);
1920 data->has_group = 1;
1921 if (!wpa_cipher_valid_group(data->group_cipher)) {
1922 wpa_printf(MSG_DEBUG,
1923 "%s: invalid group cipher 0x%x (%08x)",
1924 __func__, data->group_cipher,
1925 WPA_GET_BE32(pos));
1926 #ifdef CONFIG_NO_TKIP
1927 if (RSN_SELECTOR_GET(pos) == RSN_CIPHER_SUITE_TKIP) {
1928 wpa_printf(MSG_DEBUG,
1929 "%s: TKIP as group cipher not supported in CONFIG_NO_TKIP=y build",
1930 __func__);
1931 }
1932 #endif /* CONFIG_NO_TKIP */
1933 return -1;
1934 }
1935 pos += RSN_SELECTOR_LEN;
1936 left -= RSN_SELECTOR_LEN;
1937 } else if (left > 0) {
1938 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1939 __func__, left);
1940 return -3;
1941 }
1942
1943 if (left >= 2) {
1944 data->pairwise_cipher = 0;
1945 count = WPA_GET_LE16(pos);
1946 pos += 2;
1947 left -= 2;
1948 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1949 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1950 "count %u left %u", __func__, count, left);
1951 return -4;
1952 }
1953 if (count)
1954 data->has_pairwise = 1;
1955 for (i = 0; i < count; i++) {
1956 data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
1957 pos += RSN_SELECTOR_LEN;
1958 left -= RSN_SELECTOR_LEN;
1959 }
1960 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
1961 wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
1962 "pairwise cipher", __func__);
1963 return -1;
1964 }
1965 } else if (left == 1) {
1966 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1967 __func__);
1968 return -5;
1969 }
1970
1971 if (left >= 2) {
1972 data->key_mgmt = 0;
1973 count = WPA_GET_LE16(pos);
1974 pos += 2;
1975 left -= 2;
1976 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1977 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1978 "count %u left %u", __func__, count, left);
1979 return -6;
1980 }
1981 for (i = 0; i < count; i++) {
1982 data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
1983 pos += RSN_SELECTOR_LEN;
1984 left -= RSN_SELECTOR_LEN;
1985 }
1986 } else if (left == 1) {
1987 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
1988 __func__);
1989 return -7;
1990 }
1991
1992 if (left >= 2) {
1993 data->capabilities = WPA_GET_LE16(pos);
1994 pos += 2;
1995 left -= 2;
1996 }
1997
1998 if (left >= 2) {
1999 u16 num_pmkid = WPA_GET_LE16(pos);
2000 pos += 2;
2001 left -= 2;
2002 if (num_pmkid > (unsigned int) left / PMKID_LEN) {
2003 wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
2004 "(num_pmkid=%u left=%d)",
2005 __func__, num_pmkid, left);
2006 data->num_pmkid = 0;
2007 return -9;
2008 } else {
2009 data->num_pmkid = num_pmkid;
2010 data->pmkid = pos;
2011 pos += data->num_pmkid * PMKID_LEN;
2012 left -= data->num_pmkid * PMKID_LEN;
2013 }
2014 }
2015
2016 if (left >= 4) {
2017 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
2018 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
2019 wpa_printf(MSG_DEBUG,
2020 "%s: Unsupported management group cipher 0x%x (%08x)",
2021 __func__, data->mgmt_group_cipher,
2022 WPA_GET_BE32(pos));
2023 return -10;
2024 }
2025 pos += RSN_SELECTOR_LEN;
2026 left -= RSN_SELECTOR_LEN;
2027 }
2028
2029 if (left > 0) {
2030 wpa_hexdump(MSG_DEBUG,
2031 "wpa_parse_wpa_ie_rsn: ignore trailing bytes",
2032 pos, left);
2033 }
2034
2035 return 0;
2036 }
2037
2038
wpa_selector_to_bitfield(const u8 * s)2039 static int wpa_selector_to_bitfield(const u8 *s)
2040 {
2041 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
2042 return WPA_CIPHER_NONE;
2043 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
2044 return WPA_CIPHER_TKIP;
2045 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
2046 return WPA_CIPHER_CCMP;
2047 return 0;
2048 }
2049
2050
wpa_key_mgmt_to_bitfield(const u8 * s)2051 static int wpa_key_mgmt_to_bitfield(const u8 *s)
2052 {
2053 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
2054 return WPA_KEY_MGMT_IEEE8021X;
2055 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
2056 return WPA_KEY_MGMT_PSK;
2057 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
2058 return WPA_KEY_MGMT_WPA_NONE;
2059 return 0;
2060 }
2061
2062
wpa_parse_wpa_ie_wpa(const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)2063 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
2064 struct wpa_ie_data *data)
2065 {
2066 const struct wpa_ie_hdr *hdr;
2067 const u8 *pos;
2068 int left;
2069 int i, count;
2070
2071 os_memset(data, 0, sizeof(*data));
2072 data->proto = WPA_PROTO_WPA;
2073 data->pairwise_cipher = WPA_CIPHER_TKIP;
2074 data->group_cipher = WPA_CIPHER_TKIP;
2075 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
2076 data->capabilities = 0;
2077 data->pmkid = NULL;
2078 data->num_pmkid = 0;
2079 data->mgmt_group_cipher = 0;
2080
2081 if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
2082 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
2083 __func__, (unsigned long) wpa_ie_len);
2084 return -1;
2085 }
2086
2087 hdr = (const struct wpa_ie_hdr *) wpa_ie;
2088
2089 if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
2090 hdr->len != wpa_ie_len - 2 ||
2091 RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
2092 WPA_GET_LE16(hdr->version) != WPA_VERSION) {
2093 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
2094 __func__);
2095 return -2;
2096 }
2097
2098 pos = (const u8 *) (hdr + 1);
2099 left = wpa_ie_len - sizeof(*hdr);
2100
2101 if (left >= WPA_SELECTOR_LEN) {
2102 data->group_cipher = wpa_selector_to_bitfield(pos);
2103 pos += WPA_SELECTOR_LEN;
2104 left -= WPA_SELECTOR_LEN;
2105 } else if (left > 0) {
2106 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
2107 __func__, left);
2108 return -3;
2109 }
2110
2111 if (left >= 2) {
2112 data->pairwise_cipher = 0;
2113 count = WPA_GET_LE16(pos);
2114 pos += 2;
2115 left -= 2;
2116 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2117 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
2118 "count %u left %u", __func__, count, left);
2119 return -4;
2120 }
2121 for (i = 0; i < count; i++) {
2122 data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
2123 pos += WPA_SELECTOR_LEN;
2124 left -= WPA_SELECTOR_LEN;
2125 }
2126 } else if (left == 1) {
2127 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
2128 __func__);
2129 return -5;
2130 }
2131
2132 if (left >= 2) {
2133 data->key_mgmt = 0;
2134 count = WPA_GET_LE16(pos);
2135 pos += 2;
2136 left -= 2;
2137 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2138 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
2139 "count %u left %u", __func__, count, left);
2140 return -6;
2141 }
2142 for (i = 0; i < count; i++) {
2143 data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
2144 pos += WPA_SELECTOR_LEN;
2145 left -= WPA_SELECTOR_LEN;
2146 }
2147 } else if (left == 1) {
2148 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
2149 __func__);
2150 return -7;
2151 }
2152
2153 if (left >= 2) {
2154 data->capabilities = WPA_GET_LE16(pos);
2155 pos += 2;
2156 left -= 2;
2157 }
2158
2159 if (left > 0) {
2160 wpa_hexdump(MSG_DEBUG,
2161 "wpa_parse_wpa_ie_wpa: ignore trailing bytes",
2162 pos, left);
2163 }
2164
2165 return 0;
2166 }
2167
2168
wpa_default_rsn_cipher(int freq)2169 int wpa_default_rsn_cipher(int freq)
2170 {
2171 if (freq > 56160)
2172 return WPA_CIPHER_GCMP; /* DMG */
2173
2174 return WPA_CIPHER_CCMP;
2175 }
2176
2177
2178 #ifdef CONFIG_IEEE80211R
2179
2180 /**
2181 * wpa_derive_pmk_r0 - Derive PMK-R0 and PMKR0Name
2182 *
2183 * IEEE Std 802.11r-2008 - 8.5.1.5.3
2184 */
wpa_derive_pmk_r0(const u8 * xxkey,size_t xxkey_len,const u8 * ssid,size_t ssid_len,const u8 * mdid,const u8 * r0kh_id,size_t r0kh_id_len,const u8 * s0kh_id,u8 * pmk_r0,u8 * pmk_r0_name,int key_mgmt)2185 int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
2186 const u8 *ssid, size_t ssid_len,
2187 const u8 *mdid, const u8 *r0kh_id, size_t r0kh_id_len,
2188 const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
2189 int key_mgmt)
2190 {
2191 u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
2192 FT_R0KH_ID_MAX_LEN + ETH_ALEN];
2193 u8 *pos, r0_key_data[64 + 16], hash[64];
2194 const u8 *addr[2];
2195 size_t len[2];
2196 size_t q, r0_key_data_len;
2197 int res;
2198
2199 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2200 (xxkey_len == SHA256_MAC_LEN || xxkey_len == SHA384_MAC_LEN ||
2201 xxkey_len == SHA512_MAC_LEN))
2202 q = xxkey_len;
2203 else if (wpa_key_mgmt_sha384(key_mgmt))
2204 q = SHA384_MAC_LEN;
2205 else
2206 q = SHA256_MAC_LEN;
2207 r0_key_data_len = q + 16;
2208
2209 /*
2210 * R0-Key-Data = KDF-Hash-Length(XXKey, "FT-R0",
2211 * SSIDlength || SSID || MDID || R0KHlength ||
2212 * R0KH-ID || S0KH-ID)
2213 * XXKey is either the second 256 bits of MSK or PSK; or the first
2214 * 384 bits of MSK for FT-EAP-SHA384; or PMK from SAE.
2215 * PMK-R0 = L(R0-Key-Data, 0, Q)
2216 * PMK-R0Name-Salt = L(R0-Key-Data, Q, 128)
2217 * Q = 384 for FT-EAP-SHA384; the length of the digest generated by H()
2218 * for FT-SAE-EXT-KEY; or otherwise, 256
2219 */
2220 if (ssid_len > SSID_MAX_LEN || r0kh_id_len > FT_R0KH_ID_MAX_LEN)
2221 return -1;
2222 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R0 using KDF-SHA%zu", q * 8);
2223 wpa_hexdump_key(MSG_DEBUG, "FT: XXKey", xxkey, xxkey_len);
2224 wpa_hexdump_ascii(MSG_DEBUG, "FT: SSID", ssid, ssid_len);
2225 wpa_hexdump(MSG_DEBUG, "FT: MDID", mdid, MOBILITY_DOMAIN_ID_LEN);
2226 wpa_hexdump_ascii(MSG_DEBUG, "FT: R0KH-ID", r0kh_id, r0kh_id_len);
2227 wpa_printf(MSG_DEBUG, "FT: S0KH-ID: " MACSTR, MAC2STR(s0kh_id));
2228 pos = buf;
2229 *pos++ = ssid_len;
2230 os_memcpy(pos, ssid, ssid_len);
2231 pos += ssid_len;
2232 os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);
2233 pos += MOBILITY_DOMAIN_ID_LEN;
2234 *pos++ = r0kh_id_len;
2235 os_memcpy(pos, r0kh_id, r0kh_id_len);
2236 pos += r0kh_id_len;
2237 os_memcpy(pos, s0kh_id, ETH_ALEN);
2238 pos += ETH_ALEN;
2239
2240 res = -1;
2241 #ifdef CONFIG_SHA512
2242 if (q == SHA512_MAC_LEN) {
2243 if (xxkey_len != SHA512_MAC_LEN) {
2244 wpa_printf(MSG_ERROR,
2245 "FT: Unexpected XXKey length %d (expected %d)",
2246 (int) xxkey_len, SHA512_MAC_LEN);
2247 return -1;
2248 }
2249 res = sha512_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2250 r0_key_data, r0_key_data_len);
2251 }
2252 #endif /* CONFIG_SHA512 */
2253 #ifdef CONFIG_SHA384
2254 if (q == SHA384_MAC_LEN) {
2255 if (xxkey_len != SHA384_MAC_LEN) {
2256 wpa_printf(MSG_ERROR,
2257 "FT: Unexpected XXKey length %d (expected %d)",
2258 (int) xxkey_len, SHA384_MAC_LEN);
2259 return -1;
2260 }
2261 res = sha384_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2262 r0_key_data, r0_key_data_len);
2263 }
2264 #endif /* CONFIG_SHA384 */
2265 if (q == SHA256_MAC_LEN) {
2266 if (xxkey_len != PMK_LEN) {
2267 wpa_printf(MSG_ERROR,
2268 "FT: Unexpected XXKey length %d (expected %d)",
2269 (int) xxkey_len, PMK_LEN);
2270 return -1;
2271 }
2272 res = sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2273 r0_key_data, r0_key_data_len);
2274 }
2275 if (res < 0)
2276 return res;
2277 os_memcpy(pmk_r0, r0_key_data, q);
2278 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, q);
2279 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
2280
2281 /*
2282 * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
2283 */
2284 addr[0] = (const u8 *) "FT-R0N";
2285 len[0] = 6;
2286 addr[1] = &r0_key_data[q];
2287 len[1] = 16;
2288
2289 res = -1;
2290 #ifdef CONFIG_SHA512
2291 if (q == SHA512_MAC_LEN)
2292 res = sha512_vector(2, addr, len, hash);
2293 #endif /* CONFIG_SHA512 */
2294 #ifdef CONFIG_SHA384
2295 if (q == SHA384_MAC_LEN)
2296 res = sha384_vector(2, addr, len, hash);
2297 #endif /* CONFIG_SHA384 */
2298 if (q == SHA256_MAC_LEN)
2299 res = sha256_vector(2, addr, len, hash);
2300 if (res < 0) {
2301 wpa_printf(MSG_DEBUG,
2302 "FT: Failed to derive PMKR0Name (PMK-R0 len %zu)",
2303 q);
2304 return res;
2305 }
2306 os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
2307 wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN);
2308 forced_memzero(r0_key_data, sizeof(r0_key_data));
2309 return 0;
2310 }
2311
2312
2313 /**
2314 * wpa_derive_pmk_r1_name - Derive PMKR1Name
2315 *
2316 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2317 */
wpa_derive_pmk_r1_name(const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1_name,size_t pmk_r1_len)2318 int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
2319 const u8 *s1kh_id, u8 *pmk_r1_name,
2320 size_t pmk_r1_len)
2321 {
2322 u8 hash[64];
2323 const u8 *addr[4];
2324 size_t len[4];
2325 int res;
2326 const char *title;
2327
2328 /*
2329 * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
2330 * R1KH-ID || S1KH-ID))
2331 */
2332 addr[0] = (const u8 *) "FT-R1N";
2333 len[0] = 6;
2334 addr[1] = pmk_r0_name;
2335 len[1] = WPA_PMK_NAME_LEN;
2336 addr[2] = r1kh_id;
2337 len[2] = FT_R1KH_ID_LEN;
2338 addr[3] = s1kh_id;
2339 len[3] = ETH_ALEN;
2340
2341 res = -1;
2342 #ifdef CONFIG_SHA512
2343 if (pmk_r1_len == SHA512_MAC_LEN) {
2344 title = "FT: PMKR1Name (using SHA512)";
2345 res = sha512_vector(4, addr, len, hash);
2346 }
2347 #endif /* CONFIG_SHA512 */
2348 #ifdef CONFIG_SHA384
2349 if (pmk_r1_len == SHA384_MAC_LEN) {
2350 title = "FT: PMKR1Name (using SHA384)";
2351 res = sha384_vector(4, addr, len, hash);
2352 }
2353 #endif /* CONFIG_SHA384 */
2354 if (pmk_r1_len == SHA256_MAC_LEN) {
2355 title = "FT: PMKR1Name (using SHA256)";
2356 res = sha256_vector(4, addr, len, hash);
2357 }
2358 if (res < 0) {
2359 wpa_printf(MSG_DEBUG,
2360 "FT: Failed to derive PMKR1Name (PMK-R1 len %zu)",
2361 pmk_r1_len);
2362 return res;
2363 }
2364 os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
2365 wpa_hexdump(MSG_DEBUG, title, pmk_r1_name, WPA_PMK_NAME_LEN);
2366 return 0;
2367 }
2368
2369
2370 /**
2371 * wpa_derive_pmk_r1 - Derive PMK-R1 and PMKR1Name from PMK-R0
2372 *
2373 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2374 */
wpa_derive_pmk_r1(const u8 * pmk_r0,size_t pmk_r0_len,const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1,u8 * pmk_r1_name)2375 int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
2376 const u8 *pmk_r0_name,
2377 const u8 *r1kh_id, const u8 *s1kh_id,
2378 u8 *pmk_r1, u8 *pmk_r1_name)
2379 {
2380 u8 buf[FT_R1KH_ID_LEN + ETH_ALEN];
2381 u8 *pos;
2382 int res;
2383
2384 /* PMK-R1 = KDF-Hash(PMK-R0, "FT-R1", R1KH-ID || S1KH-ID) */
2385 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R1 using KDF-SHA%zu",
2386 pmk_r0_len * 8);
2387 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len);
2388 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", r1kh_id, FT_R1KH_ID_LEN);
2389 wpa_printf(MSG_DEBUG, "FT: S1KH-ID: " MACSTR, MAC2STR(s1kh_id));
2390 pos = buf;
2391 os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);
2392 pos += FT_R1KH_ID_LEN;
2393 os_memcpy(pos, s1kh_id, ETH_ALEN);
2394 pos += ETH_ALEN;
2395
2396 res = -1;
2397 #ifdef CONFIG_SHA512
2398 if (pmk_r0_len == SHA512_MAC_LEN)
2399 res = sha512_prf(pmk_r0, pmk_r0_len, "FT-R1",
2400 buf, pos - buf, pmk_r1, pmk_r0_len);
2401 #endif /* CONFIG_SHA512 */
2402 #ifdef CONFIG_SHA384
2403 if (pmk_r0_len == SHA384_MAC_LEN)
2404 res = sha384_prf(pmk_r0, pmk_r0_len, "FT-R1",
2405 buf, pos - buf, pmk_r1, pmk_r0_len);
2406 #endif /* CONFIG_SHA384 */
2407 if (pmk_r0_len == SHA256_MAC_LEN)
2408 res = sha256_prf(pmk_r0, pmk_r0_len, "FT-R1",
2409 buf, pos - buf, pmk_r1, pmk_r0_len);
2410 if (res < 0) {
2411 wpa_printf(MSG_ERROR, "FT: Failed to derive PMK-R1");
2412 return res;
2413 }
2414 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
2415
2416 return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
2417 pmk_r1_name, pmk_r0_len);
2418 }
2419
2420
2421 /**
2422 * wpa_pmk_r1_to_ptk - Derive PTK and PTKName from PMK-R1
2423 *
2424 * IEEE Std 802.11r-2008 - 8.5.1.5.5
2425 */
wpa_pmk_r1_to_ptk(const u8 * pmk_r1,size_t pmk_r1_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * pmk_r1_name,struct wpa_ptk * ptk,u8 * ptk_name,int akmp,int cipher,size_t kdk_len)2426 int wpa_pmk_r1_to_ptk(const u8 *pmk_r1, size_t pmk_r1_len,
2427 const u8 *snonce, const u8 *anonce,
2428 const u8 *sta_addr, const u8 *bssid,
2429 const u8 *pmk_r1_name,
2430 struct wpa_ptk *ptk, u8 *ptk_name, int akmp, int cipher,
2431 size_t kdk_len)
2432 {
2433 u8 buf[2 * WPA_NONCE_LEN + 2 * ETH_ALEN];
2434 u8 *pos, hash[32];
2435 const u8 *addr[6];
2436 size_t len[6];
2437 u8 tmp[2 * WPA_KCK_MAX_LEN + 2 * WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
2438 WPA_KDK_MAX_LEN];
2439 size_t ptk_len, offset;
2440 size_t key_len;
2441 int res;
2442
2443 if (kdk_len > WPA_KDK_MAX_LEN) {
2444 wpa_printf(MSG_ERROR,
2445 "FT: KDK len=%zu exceeds max supported len",
2446 kdk_len);
2447 return -1;
2448 }
2449
2450 if (akmp == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2451 (pmk_r1_len == SHA256_MAC_LEN || pmk_r1_len == SHA384_MAC_LEN ||
2452 pmk_r1_len == SHA512_MAC_LEN))
2453 key_len = pmk_r1_len;
2454 else if (wpa_key_mgmt_sha384(akmp))
2455 key_len = SHA384_MAC_LEN;
2456 else
2457 key_len = SHA256_MAC_LEN;
2458
2459 /*
2460 * PTK = KDF-PTKLen(PMK-R1, "FT-PTK", SNonce || ANonce ||
2461 * BSSID || STA-ADDR)
2462 */
2463 wpa_printf(MSG_DEBUG, "FT: Derive PTK using KDF-SHA%zu", key_len * 8);
2464 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len);
2465 wpa_hexdump(MSG_DEBUG, "FT: SNonce", snonce, WPA_NONCE_LEN);
2466 wpa_hexdump(MSG_DEBUG, "FT: ANonce", anonce, WPA_NONCE_LEN);
2467 wpa_printf(MSG_DEBUG, "FT: BSSID=" MACSTR " STA-ADDR=" MACSTR,
2468 MAC2STR(bssid), MAC2STR(sta_addr));
2469 pos = buf;
2470 os_memcpy(pos, snonce, WPA_NONCE_LEN);
2471 pos += WPA_NONCE_LEN;
2472 os_memcpy(pos, anonce, WPA_NONCE_LEN);
2473 pos += WPA_NONCE_LEN;
2474 os_memcpy(pos, bssid, ETH_ALEN);
2475 pos += ETH_ALEN;
2476 os_memcpy(pos, sta_addr, ETH_ALEN);
2477 pos += ETH_ALEN;
2478
2479 ptk->kck_len = wpa_kck_len(akmp, key_len);
2480 ptk->kck2_len = wpa_kck2_len(akmp);
2481 ptk->kek_len = wpa_kek_len(akmp, key_len);
2482 ptk->kek2_len = wpa_kek2_len(akmp);
2483 ptk->tk_len = wpa_cipher_key_len(cipher);
2484 ptk->kdk_len = kdk_len;
2485 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len +
2486 ptk->kck2_len + ptk->kek2_len + ptk->kdk_len;
2487
2488 res = -1;
2489 #ifdef CONFIG_SHA512
2490 if (key_len == SHA512_MAC_LEN) {
2491 if (pmk_r1_len != SHA512_MAC_LEN) {
2492 wpa_printf(MSG_ERROR,
2493 "FT: Unexpected PMK-R1 length %d (expected %d)",
2494 (int) pmk_r1_len, SHA512_MAC_LEN);
2495 return -1;
2496 }
2497 res = sha512_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2498 buf, pos - buf, tmp, ptk_len);
2499 }
2500 #endif /* CONFIG_SHA512 */
2501 #ifdef CONFIG_SHA384
2502 if (key_len == SHA384_MAC_LEN) {
2503 if (pmk_r1_len != SHA384_MAC_LEN) {
2504 wpa_printf(MSG_ERROR,
2505 "FT: Unexpected PMK-R1 length %d (expected %d)",
2506 (int) pmk_r1_len, SHA384_MAC_LEN);
2507 return -1;
2508 }
2509 res = sha384_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2510 buf, pos - buf, tmp, ptk_len);
2511 }
2512 #endif /* CONFIG_SHA384 */
2513 if (key_len == SHA256_MAC_LEN) {
2514 if (pmk_r1_len != PMK_LEN) {
2515 wpa_printf(MSG_ERROR,
2516 "FT: Unexpected PMK-R1 length %d (expected %d)",
2517 (int) pmk_r1_len, PMK_LEN);
2518 return -1;
2519 }
2520 res = sha256_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2521 buf, pos - buf, tmp, ptk_len);
2522 }
2523 if (res < 0)
2524 return -1;
2525 wpa_hexdump_key(MSG_DEBUG, "FT: PTK", tmp, ptk_len);
2526
2527 /*
2528 * PTKName = Truncate-128(SHA-256(PMKR1Name || "FT-PTKN" || SNonce ||
2529 * ANonce || BSSID || STA-ADDR))
2530 */
2531 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN);
2532 addr[0] = pmk_r1_name;
2533 len[0] = WPA_PMK_NAME_LEN;
2534 addr[1] = (const u8 *) "FT-PTKN";
2535 len[1] = 7;
2536 addr[2] = snonce;
2537 len[2] = WPA_NONCE_LEN;
2538 addr[3] = anonce;
2539 len[3] = WPA_NONCE_LEN;
2540 addr[4] = bssid;
2541 len[4] = ETH_ALEN;
2542 addr[5] = sta_addr;
2543 len[5] = ETH_ALEN;
2544
2545 if (sha256_vector(6, addr, len, hash) < 0)
2546 return -1;
2547 os_memcpy(ptk_name, hash, WPA_PMK_NAME_LEN);
2548
2549 os_memcpy(ptk->kck, tmp, ptk->kck_len);
2550 offset = ptk->kck_len;
2551 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
2552 offset += ptk->kek_len;
2553 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
2554 offset += ptk->tk_len;
2555 os_memcpy(ptk->kck2, tmp + offset, ptk->kck2_len);
2556 offset += ptk->kck2_len;
2557 os_memcpy(ptk->kek2, tmp + offset, ptk->kek2_len);
2558 offset += ptk->kek2_len;
2559 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
2560
2561 wpa_hexdump_key(MSG_DEBUG, "FT: KCK", ptk->kck, ptk->kck_len);
2562 wpa_hexdump_key(MSG_DEBUG, "FT: KEK", ptk->kek, ptk->kek_len);
2563 if (ptk->kck2_len)
2564 wpa_hexdump_key(MSG_DEBUG, "FT: KCK2",
2565 ptk->kck2, ptk->kck2_len);
2566 if (ptk->kek2_len)
2567 wpa_hexdump_key(MSG_DEBUG, "FT: KEK2",
2568 ptk->kek2, ptk->kek2_len);
2569 if (ptk->kdk_len)
2570 wpa_hexdump_key(MSG_DEBUG, "FT: KDK", ptk->kdk, ptk->kdk_len);
2571
2572 wpa_hexdump_key(MSG_DEBUG, "FT: TK", ptk->tk, ptk->tk_len);
2573 wpa_hexdump(MSG_DEBUG, "FT: PTKName", ptk_name, WPA_PMK_NAME_LEN);
2574
2575 forced_memzero(tmp, sizeof(tmp));
2576
2577 return 0;
2578 }
2579
2580 #endif /* CONFIG_IEEE80211R */
2581
2582
2583 /**
2584 * rsn_pmkid - Calculate PMK identifier
2585 * @pmk: Pairwise master key
2586 * @pmk_len: Length of pmk in bytes
2587 * @aa: Authenticator address
2588 * @spa: Supplicant address
2589 * @pmkid: Buffer for PMKID
2590 * @akmp: Negotiated key management protocol
2591 *
2592 * IEEE Std 802.11-2016 - 12.7.1.3 Pairwise key hierarchy
2593 * AKM: 00-0F-AC:3, 00-0F-AC:5, 00-0F-AC:6, 00-0F-AC:14, 00-0F-AC:16
2594 * PMKID = Truncate-128(HMAC-SHA-256(PMK, "PMK Name" || AA || SPA))
2595 * AKM: 00-0F-AC:11
2596 * See rsn_pmkid_suite_b()
2597 * AKM: 00-0F-AC:12
2598 * See rsn_pmkid_suite_b_192()
2599 * AKM: 00-0F-AC:13, 00-0F-AC:15, 00-0F-AC:17
2600 * PMKID = Truncate-128(HMAC-SHA-384(PMK, "PMK Name" || AA || SPA))
2601 * Otherwise:
2602 * PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name" || AA || SPA))
2603 */
rsn_pmkid(const u8 * pmk,size_t pmk_len,const u8 * aa,const u8 * spa,u8 * pmkid,int akmp)2604 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
2605 u8 *pmkid, int akmp)
2606 {
2607 char *title = "PMK Name";
2608 const u8 *addr[3];
2609 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2610 unsigned char hash[SHA384_MAC_LEN];
2611
2612 addr[0] = (u8 *) title;
2613 addr[1] = aa;
2614 addr[2] = spa;
2615
2616 if (0) {
2617 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
2618 } else if (wpa_key_mgmt_sha384(akmp)) {
2619 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-384");
2620 hmac_sha384_vector(pmk, pmk_len, 3, addr, len, hash);
2621 #endif /* CONFIG_FILS || CONFIG_SHA384 */
2622 } else if (wpa_key_mgmt_sha256(akmp)) {
2623 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-256");
2624 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
2625 } else {
2626 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-1");
2627 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
2628 }
2629 wpa_hexdump(MSG_DEBUG, "RSN: Derived PMKID", hash, PMKID_LEN);
2630 os_memcpy(pmkid, hash, PMKID_LEN);
2631 }
2632
2633
2634 #ifdef CONFIG_SUITEB
2635 /**
2636 * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
2637 * @kck: Key confirmation key
2638 * @kck_len: Length of kck in bytes
2639 * @aa: Authenticator address
2640 * @spa: Supplicant address
2641 * @pmkid: Buffer for PMKID
2642 * Returns: 0 on success, -1 on failure
2643 *
2644 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2645 * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
2646 */
rsn_pmkid_suite_b(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2647 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
2648 const u8 *spa, u8 *pmkid)
2649 {
2650 char *title = "PMK Name";
2651 const u8 *addr[3];
2652 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2653 unsigned char hash[SHA256_MAC_LEN];
2654
2655 addr[0] = (u8 *) title;
2656 addr[1] = aa;
2657 addr[2] = spa;
2658
2659 if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
2660 return -1;
2661 os_memcpy(pmkid, hash, PMKID_LEN);
2662 return 0;
2663 }
2664 #endif /* CONFIG_SUITEB */
2665
2666
2667 #ifdef CONFIG_SUITEB192
2668 /**
2669 * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
2670 * @kck: Key confirmation key
2671 * @kck_len: Length of kck in bytes
2672 * @aa: Authenticator address
2673 * @spa: Supplicant address
2674 * @pmkid: Buffer for PMKID
2675 * Returns: 0 on success, -1 on failure
2676 *
2677 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2678 * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
2679 */
rsn_pmkid_suite_b_192(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2680 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
2681 const u8 *spa, u8 *pmkid)
2682 {
2683 char *title = "PMK Name";
2684 const u8 *addr[3];
2685 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2686 unsigned char hash[SHA384_MAC_LEN];
2687
2688 addr[0] = (u8 *) title;
2689 addr[1] = aa;
2690 addr[2] = spa;
2691
2692 if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
2693 return -1;
2694 os_memcpy(pmkid, hash, PMKID_LEN);
2695 return 0;
2696 }
2697 #endif /* CONFIG_SUITEB192 */
2698
2699
2700 /**
2701 * wpa_cipher_txt - Convert cipher suite to a text string
2702 * @cipher: Cipher suite (WPA_CIPHER_* enum)
2703 * Returns: Pointer to a text string of the cipher suite name
2704 */
wpa_cipher_txt(int cipher)2705 const char * wpa_cipher_txt(int cipher)
2706 {
2707 switch (cipher) {
2708 case WPA_CIPHER_NONE:
2709 return "NONE";
2710 #ifdef CONFIG_WEP
2711 case WPA_CIPHER_WEP40:
2712 return "WEP-40";
2713 case WPA_CIPHER_WEP104:
2714 return "WEP-104";
2715 #endif /* CONFIG_WEP */
2716 case WPA_CIPHER_TKIP:
2717 return "TKIP";
2718 case WPA_CIPHER_CCMP:
2719 return "CCMP";
2720 case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
2721 return "CCMP+TKIP";
2722 case WPA_CIPHER_GCMP:
2723 return "GCMP";
2724 case WPA_CIPHER_GCMP_256:
2725 return "GCMP-256";
2726 case WPA_CIPHER_CCMP_256:
2727 return "CCMP-256";
2728 case WPA_CIPHER_AES_128_CMAC:
2729 return "BIP";
2730 case WPA_CIPHER_BIP_GMAC_128:
2731 return "BIP-GMAC-128";
2732 case WPA_CIPHER_BIP_GMAC_256:
2733 return "BIP-GMAC-256";
2734 case WPA_CIPHER_BIP_CMAC_256:
2735 return "BIP-CMAC-256";
2736 case WPA_CIPHER_GTK_NOT_USED:
2737 return "GTK_NOT_USED";
2738 default:
2739 return "UNKNOWN";
2740 }
2741 }
2742
2743
2744 /**
2745 * wpa_key_mgmt_txt - Convert key management suite to a text string
2746 * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
2747 * @proto: WPA/WPA2 version (WPA_PROTO_*)
2748 * Returns: Pointer to a text string of the key management suite name
2749 */
wpa_key_mgmt_txt(int key_mgmt,int proto)2750 const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
2751 {
2752 switch (key_mgmt) {
2753 case WPA_KEY_MGMT_IEEE8021X:
2754 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2755 return "WPA2+WPA/IEEE 802.1X/EAP";
2756 return proto == WPA_PROTO_RSN ?
2757 "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
2758 case WPA_KEY_MGMT_PSK:
2759 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2760 return "WPA2-PSK+WPA-PSK";
2761 return proto == WPA_PROTO_RSN ?
2762 "WPA2-PSK" : "WPA-PSK";
2763 case WPA_KEY_MGMT_NONE:
2764 return "NONE";
2765 case WPA_KEY_MGMT_WPA_NONE:
2766 return "WPA-NONE";
2767 case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
2768 return "IEEE 802.1X (no WPA)";
2769 #ifdef CONFIG_IEEE80211R
2770 case WPA_KEY_MGMT_FT_IEEE8021X:
2771 return "FT-EAP";
2772 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
2773 return "FT-EAP-SHA384";
2774 case WPA_KEY_MGMT_FT_PSK:
2775 return "FT-PSK";
2776 #endif /* CONFIG_IEEE80211R */
2777 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2778 return "WPA2-EAP-SHA256";
2779 case WPA_KEY_MGMT_PSK_SHA256:
2780 return "WPA2-PSK-SHA256";
2781 case WPA_KEY_MGMT_WPS:
2782 return "WPS";
2783 case WPA_KEY_MGMT_SAE:
2784 return "SAE";
2785 case WPA_KEY_MGMT_SAE_EXT_KEY:
2786 return "SAE-EXT-KEY";
2787 case WPA_KEY_MGMT_FT_SAE:
2788 return "FT-SAE";
2789 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
2790 return "FT-SAE-EXT-KEY";
2791 case WPA_KEY_MGMT_OSEN:
2792 return "OSEN";
2793 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2794 return "WPA2-EAP-SUITE-B";
2795 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2796 return "WPA2-EAP-SUITE-B-192";
2797 case WPA_KEY_MGMT_FILS_SHA256:
2798 return "FILS-SHA256";
2799 case WPA_KEY_MGMT_FILS_SHA384:
2800 return "FILS-SHA384";
2801 case WPA_KEY_MGMT_FT_FILS_SHA256:
2802 return "FT-FILS-SHA256";
2803 case WPA_KEY_MGMT_FT_FILS_SHA384:
2804 return "FT-FILS-SHA384";
2805 case WPA_KEY_MGMT_OWE:
2806 return "OWE";
2807 case WPA_KEY_MGMT_DPP:
2808 return "DPP";
2809 case WPA_KEY_MGMT_PASN:
2810 return "PASN";
2811 case WPA_KEY_MGMT_IEEE8021X_SHA384:
2812 return "WPA2-EAP-SHA384";
2813 default:
2814 return "UNKNOWN";
2815 }
2816 }
2817
2818
wpa_akm_to_suite(int akm)2819 u32 wpa_akm_to_suite(int akm)
2820 {
2821 if (akm & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
2822 return RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
2823 if (akm & WPA_KEY_MGMT_FT_IEEE8021X)
2824 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2825 if (akm & WPA_KEY_MGMT_FT_PSK)
2826 return RSN_AUTH_KEY_MGMT_FT_PSK;
2827 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA384)
2828 return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
2829 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
2830 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2831 if (akm & WPA_KEY_MGMT_IEEE8021X)
2832 return RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
2833 if (akm & WPA_KEY_MGMT_PSK_SHA256)
2834 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2835 if (akm & WPA_KEY_MGMT_PSK)
2836 return RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
2837 if (akm & WPA_KEY_MGMT_CCKM)
2838 return RSN_AUTH_KEY_MGMT_CCKM;
2839 if (akm & WPA_KEY_MGMT_OSEN)
2840 return RSN_AUTH_KEY_MGMT_OSEN;
2841 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
2842 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2843 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2844 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2845 if (akm & WPA_KEY_MGMT_FILS_SHA256)
2846 return RSN_AUTH_KEY_MGMT_FILS_SHA256;
2847 if (akm & WPA_KEY_MGMT_FILS_SHA384)
2848 return RSN_AUTH_KEY_MGMT_FILS_SHA384;
2849 if (akm & WPA_KEY_MGMT_FT_FILS_SHA256)
2850 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
2851 if (akm & WPA_KEY_MGMT_FT_FILS_SHA384)
2852 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
2853 if (akm & WPA_KEY_MGMT_SAE)
2854 return RSN_AUTH_KEY_MGMT_SAE;
2855 if (akm & WPA_KEY_MGMT_SAE_EXT_KEY)
2856 return RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
2857 if (akm & WPA_KEY_MGMT_FT_SAE)
2858 return RSN_AUTH_KEY_MGMT_FT_SAE;
2859 if (akm & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
2860 return RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY;
2861 if (akm & WPA_KEY_MGMT_OWE)
2862 return RSN_AUTH_KEY_MGMT_OWE;
2863 if (akm & WPA_KEY_MGMT_DPP)
2864 return RSN_AUTH_KEY_MGMT_DPP;
2865 return 0;
2866 }
2867
2868
wpa_compare_rsn_ie(int ft_initial_assoc,const u8 * ie1,size_t ie1len,const u8 * ie2,size_t ie2len)2869 int wpa_compare_rsn_ie(int ft_initial_assoc,
2870 const u8 *ie1, size_t ie1len,
2871 const u8 *ie2, size_t ie2len)
2872 {
2873 if (ie1 == NULL || ie2 == NULL)
2874 return -1;
2875
2876 if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
2877 return 0; /* identical IEs */
2878
2879 #ifdef CONFIG_IEEE80211R
2880 if (ft_initial_assoc) {
2881 struct wpa_ie_data ie1d, ie2d;
2882 /*
2883 * The PMKID-List in RSN IE is different between Beacon/Probe
2884 * Response/(Re)Association Request frames and EAPOL-Key
2885 * messages in FT initial mobility domain association. Allow
2886 * for this, but verify that other parts of the RSN IEs are
2887 * identical.
2888 */
2889 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
2890 wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
2891 return -1;
2892 if (ie1d.proto == ie2d.proto &&
2893 ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
2894 ie1d.group_cipher == ie2d.group_cipher &&
2895 ie1d.key_mgmt == ie2d.key_mgmt &&
2896 ie1d.capabilities == ie2d.capabilities &&
2897 ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
2898 return 0;
2899 }
2900 #endif /* CONFIG_IEEE80211R */
2901
2902 return -1;
2903 }
2904
2905
wpa_insert_pmkid(u8 * ies,size_t * ies_len,const u8 * pmkid,bool replace)2906 int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid, bool replace)
2907 {
2908 u8 *start, *end, *rpos, *rend;
2909 int added = 0;
2910
2911 start = ies;
2912 end = ies + *ies_len;
2913
2914 while (start < end) {
2915 if (*start == WLAN_EID_RSN)
2916 break;
2917 start += 2 + start[1];
2918 }
2919 if (start >= end) {
2920 wpa_printf(MSG_ERROR, "RSN: Could not find RSNE in IEs data");
2921 return -1;
2922 }
2923 wpa_hexdump(MSG_DEBUG, "RSN: RSNE before modification",
2924 start, 2 + start[1]);
2925
2926 /* Find start of PMKID-Count */
2927 rpos = start + 2;
2928 rend = rpos + start[1];
2929
2930 /* Skip Version and Group Data Cipher Suite */
2931 rpos += 2 + 4;
2932 /* Skip Pairwise Cipher Suite Count and List */
2933 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2934 /* Skip AKM Suite Count and List */
2935 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2936
2937 if (rpos == rend) {
2938 /* Add RSN Capabilities */
2939 os_memmove(rpos + 2, rpos, end - rpos);
2940 *rpos++ = 0;
2941 *rpos++ = 0;
2942 added += 2;
2943 start[1] += 2;
2944 rend = rpos;
2945 } else {
2946 /* Skip RSN Capabilities */
2947 rpos += 2;
2948 if (rpos > rend) {
2949 wpa_printf(MSG_ERROR,
2950 "RSN: Could not parse RSNE in IEs data");
2951 return -1;
2952 }
2953 }
2954
2955 if (rpos == rend) {
2956 /* No PMKID-Count field included; add it */
2957 os_memmove(rpos + 2 + PMKID_LEN, rpos, end + added - rpos);
2958 WPA_PUT_LE16(rpos, 1);
2959 rpos += 2;
2960 os_memcpy(rpos, pmkid, PMKID_LEN);
2961 added += 2 + PMKID_LEN;
2962 start[1] += 2 + PMKID_LEN;
2963 } else {
2964 u16 num_pmkid;
2965
2966 if (rend - rpos < 2)
2967 return -1;
2968 num_pmkid = WPA_GET_LE16(rpos);
2969 if (num_pmkid * PMKID_LEN > rend - rpos - 2)
2970 return -1;
2971 /* PMKID-Count was included; use it */
2972 if (replace && num_pmkid != 0) {
2973 u8 *after;
2974
2975 /*
2976 * PMKID may have been included in RSN IE in
2977 * (Re)Association Request frame, so remove the old
2978 * PMKID(s) first before adding the new one.
2979 */
2980 wpa_printf(MSG_DEBUG,
2981 "RSN: Remove %u old PMKID(s) from RSNE",
2982 num_pmkid);
2983 after = rpos + 2 + num_pmkid * PMKID_LEN;
2984 os_memmove(rpos + 2, after, end - after);
2985 start[1] -= num_pmkid * PMKID_LEN;
2986 added -= num_pmkid * PMKID_LEN;
2987 num_pmkid = 0;
2988 }
2989 WPA_PUT_LE16(rpos, num_pmkid + 1);
2990 rpos += 2;
2991 os_memmove(rpos + PMKID_LEN, rpos, end + added - rpos);
2992 os_memcpy(rpos, pmkid, PMKID_LEN);
2993 added += PMKID_LEN;
2994 start[1] += PMKID_LEN;
2995 }
2996
2997 wpa_hexdump(MSG_DEBUG, "RSN: RSNE after modification (PMKID inserted)",
2998 start, 2 + start[1]);
2999
3000 *ies_len += added;
3001
3002 return 0;
3003 }
3004
3005
wpa_cipher_key_len(int cipher)3006 int wpa_cipher_key_len(int cipher)
3007 {
3008 switch (cipher) {
3009 case WPA_CIPHER_CCMP_256:
3010 case WPA_CIPHER_GCMP_256:
3011 case WPA_CIPHER_BIP_GMAC_256:
3012 case WPA_CIPHER_BIP_CMAC_256:
3013 return 32;
3014 case WPA_CIPHER_CCMP:
3015 case WPA_CIPHER_GCMP:
3016 case WPA_CIPHER_AES_128_CMAC:
3017 case WPA_CIPHER_BIP_GMAC_128:
3018 return 16;
3019 case WPA_CIPHER_TKIP:
3020 return 32;
3021 default:
3022 return 0;
3023 }
3024 }
3025
3026
wpa_cipher_rsc_len(int cipher)3027 int wpa_cipher_rsc_len(int cipher)
3028 {
3029 switch (cipher) {
3030 case WPA_CIPHER_CCMP_256:
3031 case WPA_CIPHER_GCMP_256:
3032 case WPA_CIPHER_CCMP:
3033 case WPA_CIPHER_GCMP:
3034 case WPA_CIPHER_TKIP:
3035 return 6;
3036 default:
3037 return 0;
3038 }
3039 }
3040
3041
wpa_cipher_to_alg(int cipher)3042 enum wpa_alg wpa_cipher_to_alg(int cipher)
3043 {
3044 switch (cipher) {
3045 case WPA_CIPHER_CCMP_256:
3046 return WPA_ALG_CCMP_256;
3047 case WPA_CIPHER_GCMP_256:
3048 return WPA_ALG_GCMP_256;
3049 case WPA_CIPHER_CCMP:
3050 return WPA_ALG_CCMP;
3051 case WPA_CIPHER_GCMP:
3052 return WPA_ALG_GCMP;
3053 case WPA_CIPHER_TKIP:
3054 return WPA_ALG_TKIP;
3055 case WPA_CIPHER_AES_128_CMAC:
3056 return WPA_ALG_BIP_CMAC_128;
3057 case WPA_CIPHER_BIP_GMAC_128:
3058 return WPA_ALG_BIP_GMAC_128;
3059 case WPA_CIPHER_BIP_GMAC_256:
3060 return WPA_ALG_BIP_GMAC_256;
3061 case WPA_CIPHER_BIP_CMAC_256:
3062 return WPA_ALG_BIP_CMAC_256;
3063 default:
3064 return WPA_ALG_NONE;
3065 }
3066 }
3067
3068
wpa_cipher_valid_pairwise(int cipher)3069 int wpa_cipher_valid_pairwise(int cipher)
3070 {
3071 #ifdef CONFIG_NO_TKIP
3072 return cipher == WPA_CIPHER_CCMP_256 ||
3073 cipher == WPA_CIPHER_GCMP_256 ||
3074 cipher == WPA_CIPHER_CCMP ||
3075 cipher == WPA_CIPHER_GCMP;
3076 #else /* CONFIG_NO_TKIP */
3077 return cipher == WPA_CIPHER_CCMP_256 ||
3078 cipher == WPA_CIPHER_GCMP_256 ||
3079 cipher == WPA_CIPHER_CCMP ||
3080 cipher == WPA_CIPHER_GCMP ||
3081 cipher == WPA_CIPHER_TKIP;
3082 #endif /* CONFIG_NO_TKIP */
3083 }
3084
3085
wpa_cipher_to_suite(int proto,int cipher)3086 u32 wpa_cipher_to_suite(int proto, int cipher)
3087 {
3088 if (cipher & WPA_CIPHER_CCMP_256)
3089 return RSN_CIPHER_SUITE_CCMP_256;
3090 if (cipher & WPA_CIPHER_GCMP_256)
3091 return RSN_CIPHER_SUITE_GCMP_256;
3092 if (cipher & WPA_CIPHER_CCMP)
3093 return (proto == WPA_PROTO_RSN ?
3094 RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
3095 if (cipher & WPA_CIPHER_GCMP)
3096 return RSN_CIPHER_SUITE_GCMP;
3097 if (cipher & WPA_CIPHER_TKIP)
3098 return (proto == WPA_PROTO_RSN ?
3099 RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
3100 if (cipher & WPA_CIPHER_NONE)
3101 return (proto == WPA_PROTO_RSN ?
3102 RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
3103 if (cipher & WPA_CIPHER_GTK_NOT_USED)
3104 return RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED;
3105 if (cipher & WPA_CIPHER_AES_128_CMAC)
3106 return RSN_CIPHER_SUITE_AES_128_CMAC;
3107 if (cipher & WPA_CIPHER_BIP_GMAC_128)
3108 return RSN_CIPHER_SUITE_BIP_GMAC_128;
3109 if (cipher & WPA_CIPHER_BIP_GMAC_256)
3110 return RSN_CIPHER_SUITE_BIP_GMAC_256;
3111 if (cipher & WPA_CIPHER_BIP_CMAC_256)
3112 return RSN_CIPHER_SUITE_BIP_CMAC_256;
3113 return 0;
3114 }
3115
3116
rsn_cipher_put_suites(u8 * start,int ciphers)3117 int rsn_cipher_put_suites(u8 *start, int ciphers)
3118 {
3119 u8 *pos = start;
3120
3121 if (ciphers & WPA_CIPHER_CCMP_256) {
3122 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP_256);
3123 pos += RSN_SELECTOR_LEN;
3124 }
3125 if (ciphers & WPA_CIPHER_GCMP_256) {
3126 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
3127 pos += RSN_SELECTOR_LEN;
3128 }
3129 if (ciphers & WPA_CIPHER_CCMP) {
3130 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
3131 pos += RSN_SELECTOR_LEN;
3132 }
3133 if (ciphers & WPA_CIPHER_GCMP) {
3134 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
3135 pos += RSN_SELECTOR_LEN;
3136 }
3137 if (ciphers & WPA_CIPHER_TKIP) {
3138 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
3139 pos += RSN_SELECTOR_LEN;
3140 }
3141 if (ciphers & WPA_CIPHER_NONE) {
3142 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
3143 pos += RSN_SELECTOR_LEN;
3144 }
3145
3146 return (pos - start) / RSN_SELECTOR_LEN;
3147 }
3148
3149
wpa_cipher_put_suites(u8 * start,int ciphers)3150 int wpa_cipher_put_suites(u8 *start, int ciphers)
3151 {
3152 u8 *pos = start;
3153
3154 if (ciphers & WPA_CIPHER_CCMP) {
3155 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
3156 pos += WPA_SELECTOR_LEN;
3157 }
3158 if (ciphers & WPA_CIPHER_TKIP) {
3159 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
3160 pos += WPA_SELECTOR_LEN;
3161 }
3162 if (ciphers & WPA_CIPHER_NONE) {
3163 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
3164 pos += WPA_SELECTOR_LEN;
3165 }
3166
3167 return (pos - start) / RSN_SELECTOR_LEN;
3168 }
3169
3170
wpa_pick_pairwise_cipher(int ciphers,int none_allowed)3171 int wpa_pick_pairwise_cipher(int ciphers, int none_allowed)
3172 {
3173 if (ciphers & WPA_CIPHER_CCMP_256)
3174 return WPA_CIPHER_CCMP_256;
3175 if (ciphers & WPA_CIPHER_GCMP_256)
3176 return WPA_CIPHER_GCMP_256;
3177 if (ciphers & WPA_CIPHER_CCMP)
3178 return WPA_CIPHER_CCMP;
3179 if (ciphers & WPA_CIPHER_GCMP)
3180 return WPA_CIPHER_GCMP;
3181 if (ciphers & WPA_CIPHER_TKIP)
3182 return WPA_CIPHER_TKIP;
3183 if (none_allowed && (ciphers & WPA_CIPHER_NONE))
3184 return WPA_CIPHER_NONE;
3185 return -1;
3186 }
3187
3188
wpa_pick_group_cipher(int ciphers)3189 int wpa_pick_group_cipher(int ciphers)
3190 {
3191 if (ciphers & WPA_CIPHER_CCMP_256)
3192 return WPA_CIPHER_CCMP_256;
3193 if (ciphers & WPA_CIPHER_GCMP_256)
3194 return WPA_CIPHER_GCMP_256;
3195 if (ciphers & WPA_CIPHER_CCMP)
3196 return WPA_CIPHER_CCMP;
3197 if (ciphers & WPA_CIPHER_GCMP)
3198 return WPA_CIPHER_GCMP;
3199 if (ciphers & WPA_CIPHER_GTK_NOT_USED)
3200 return WPA_CIPHER_GTK_NOT_USED;
3201 if (ciphers & WPA_CIPHER_TKIP)
3202 return WPA_CIPHER_TKIP;
3203 return -1;
3204 }
3205
3206
wpa_parse_cipher(const char * value)3207 int wpa_parse_cipher(const char *value)
3208 {
3209 int val = 0, last;
3210 char *start, *end, *buf;
3211
3212 buf = os_strdup(value);
3213 if (buf == NULL)
3214 return -1;
3215 start = buf;
3216
3217 while (*start != '\0') {
3218 while (*start == ' ' || *start == '\t')
3219 start++;
3220 if (*start == '\0')
3221 break;
3222 end = start;
3223 while (*end != ' ' && *end != '\t' && *end != '\0')
3224 end++;
3225 last = *end == '\0';
3226 *end = '\0';
3227 if (os_strcmp(start, "CCMP-256") == 0)
3228 val |= WPA_CIPHER_CCMP_256;
3229 else if (os_strcmp(start, "GCMP-256") == 0)
3230 val |= WPA_CIPHER_GCMP_256;
3231 else if (os_strcmp(start, "CCMP") == 0)
3232 val |= WPA_CIPHER_CCMP;
3233 else if (os_strcmp(start, "GCMP") == 0)
3234 val |= WPA_CIPHER_GCMP;
3235 #ifndef CONFIG_NO_TKIP
3236 else if (os_strcmp(start, "TKIP") == 0)
3237 val |= WPA_CIPHER_TKIP;
3238 #endif /* CONFIG_NO_TKIP */
3239 #ifdef CONFIG_WEP
3240 else if (os_strcmp(start, "WEP104") == 0)
3241 val |= WPA_CIPHER_WEP104;
3242 else if (os_strcmp(start, "WEP40") == 0)
3243 val |= WPA_CIPHER_WEP40;
3244 #endif /* CONFIG_WEP */
3245 else if (os_strcmp(start, "NONE") == 0)
3246 val |= WPA_CIPHER_NONE;
3247 else if (os_strcmp(start, "GTK_NOT_USED") == 0)
3248 val |= WPA_CIPHER_GTK_NOT_USED;
3249 else if (os_strcmp(start, "AES-128-CMAC") == 0)
3250 val |= WPA_CIPHER_AES_128_CMAC;
3251 else if (os_strcmp(start, "BIP-GMAC-128") == 0)
3252 val |= WPA_CIPHER_BIP_GMAC_128;
3253 else if (os_strcmp(start, "BIP-GMAC-256") == 0)
3254 val |= WPA_CIPHER_BIP_GMAC_256;
3255 else if (os_strcmp(start, "BIP-CMAC-256") == 0)
3256 val |= WPA_CIPHER_BIP_CMAC_256;
3257 else {
3258 os_free(buf);
3259 return -1;
3260 }
3261
3262 if (last)
3263 break;
3264 start = end + 1;
3265 }
3266 os_free(buf);
3267
3268 return val;
3269 }
3270
3271
wpa_write_ciphers(char * start,char * end,int ciphers,const char * delim)3272 int wpa_write_ciphers(char *start, char *end, int ciphers, const char *delim)
3273 {
3274 char *pos = start;
3275 int ret;
3276
3277 if (ciphers & WPA_CIPHER_CCMP_256) {
3278 ret = os_snprintf(pos, end - pos, "%sCCMP-256",
3279 pos == start ? "" : delim);
3280 if (os_snprintf_error(end - pos, ret))
3281 return -1;
3282 pos += ret;
3283 }
3284 if (ciphers & WPA_CIPHER_GCMP_256) {
3285 ret = os_snprintf(pos, end - pos, "%sGCMP-256",
3286 pos == start ? "" : delim);
3287 if (os_snprintf_error(end - pos, ret))
3288 return -1;
3289 pos += ret;
3290 }
3291 if (ciphers & WPA_CIPHER_CCMP) {
3292 ret = os_snprintf(pos, end - pos, "%sCCMP",
3293 pos == start ? "" : delim);
3294 if (os_snprintf_error(end - pos, ret))
3295 return -1;
3296 pos += ret;
3297 }
3298 if (ciphers & WPA_CIPHER_GCMP) {
3299 ret = os_snprintf(pos, end - pos, "%sGCMP",
3300 pos == start ? "" : delim);
3301 if (os_snprintf_error(end - pos, ret))
3302 return -1;
3303 pos += ret;
3304 }
3305 if (ciphers & WPA_CIPHER_TKIP) {
3306 ret = os_snprintf(pos, end - pos, "%sTKIP",
3307 pos == start ? "" : delim);
3308 if (os_snprintf_error(end - pos, ret))
3309 return -1;
3310 pos += ret;
3311 }
3312 if (ciphers & WPA_CIPHER_AES_128_CMAC) {
3313 ret = os_snprintf(pos, end - pos, "%sAES-128-CMAC",
3314 pos == start ? "" : delim);
3315 if (os_snprintf_error(end - pos, ret))
3316 return -1;
3317 pos += ret;
3318 }
3319 if (ciphers & WPA_CIPHER_BIP_GMAC_128) {
3320 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-128",
3321 pos == start ? "" : delim);
3322 if (os_snprintf_error(end - pos, ret))
3323 return -1;
3324 pos += ret;
3325 }
3326 if (ciphers & WPA_CIPHER_BIP_GMAC_256) {
3327 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-256",
3328 pos == start ? "" : delim);
3329 if (os_snprintf_error(end - pos, ret))
3330 return -1;
3331 pos += ret;
3332 }
3333 if (ciphers & WPA_CIPHER_BIP_CMAC_256) {
3334 ret = os_snprintf(pos, end - pos, "%sBIP-CMAC-256",
3335 pos == start ? "" : delim);
3336 if (os_snprintf_error(end - pos, ret))
3337 return -1;
3338 pos += ret;
3339 }
3340 if (ciphers & WPA_CIPHER_NONE) {
3341 ret = os_snprintf(pos, end - pos, "%sNONE",
3342 pos == start ? "" : delim);
3343 if (os_snprintf_error(end - pos, ret))
3344 return -1;
3345 pos += ret;
3346 }
3347
3348 return pos - start;
3349 }
3350
3351
wpa_select_ap_group_cipher(int wpa,int wpa_pairwise,int rsn_pairwise)3352 int wpa_select_ap_group_cipher(int wpa, int wpa_pairwise, int rsn_pairwise)
3353 {
3354 int pairwise = 0;
3355
3356 /* Select group cipher based on the enabled pairwise cipher suites */
3357 if (wpa & 1)
3358 pairwise |= wpa_pairwise;
3359 if (wpa & 2)
3360 pairwise |= rsn_pairwise;
3361
3362 if (pairwise & WPA_CIPHER_TKIP)
3363 return WPA_CIPHER_TKIP;
3364 if ((pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP)
3365 return WPA_CIPHER_GCMP;
3366 if ((pairwise & (WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP |
3367 WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP_256)
3368 return WPA_CIPHER_GCMP_256;
3369 if ((pairwise & (WPA_CIPHER_CCMP_256 | WPA_CIPHER_CCMP |
3370 WPA_CIPHER_GCMP)) == WPA_CIPHER_CCMP_256)
3371 return WPA_CIPHER_CCMP_256;
3372 return WPA_CIPHER_CCMP;
3373 }
3374
3375
3376 #ifdef CONFIG_FILS
fils_domain_name_hash(const char * domain,u8 * hash)3377 int fils_domain_name_hash(const char *domain, u8 *hash)
3378 {
3379 char buf[255], *wpos = buf;
3380 const char *pos = domain;
3381 size_t len;
3382 const u8 *addr[1];
3383 u8 mac[SHA256_MAC_LEN];
3384
3385 for (len = 0; len < sizeof(buf) && *pos; len++) {
3386 if (isalpha(*pos) && isupper(*pos))
3387 *wpos++ = tolower(*pos);
3388 else
3389 *wpos++ = *pos;
3390 pos++;
3391 }
3392
3393 addr[0] = (const u8 *) buf;
3394 if (sha256_vector(1, addr, &len, mac) < 0)
3395 return -1;
3396 os_memcpy(hash, mac, 2);
3397 return 0;
3398 }
3399 #endif /* CONFIG_FILS */
3400
3401
3402 /**
3403 * wpa_parse_vendor_specific - Parse Vendor Specific IEs
3404 * @pos: Pointer to the IE header
3405 * @end: Pointer to the end of the Key Data buffer
3406 * @ie: Pointer to parsed IE data
3407 */
wpa_parse_vendor_specific(const u8 * pos,const u8 * end,struct wpa_eapol_ie_parse * ie)3408 static void wpa_parse_vendor_specific(const u8 *pos, const u8 *end,
3409 struct wpa_eapol_ie_parse *ie)
3410 {
3411 unsigned int oui;
3412
3413 if (pos[1] < 4) {
3414 wpa_printf(MSG_MSGDUMP,
3415 "Too short vendor specific IE ignored (len=%u)",
3416 pos[1]);
3417 return;
3418 }
3419
3420 oui = WPA_GET_BE24(&pos[2]);
3421 if (oui == OUI_MICROSOFT && pos[5] == WMM_OUI_TYPE && pos[1] > 4) {
3422 if (pos[6] == WMM_OUI_SUBTYPE_INFORMATION_ELEMENT) {
3423 ie->wmm = &pos[2];
3424 ie->wmm_len = pos[1];
3425 wpa_hexdump(MSG_DEBUG, "WPA: WMM IE",
3426 ie->wmm, ie->wmm_len);
3427 } else if (pos[6] == WMM_OUI_SUBTYPE_PARAMETER_ELEMENT) {
3428 ie->wmm = &pos[2];
3429 ie->wmm_len = pos[1];
3430 wpa_hexdump(MSG_DEBUG, "WPA: WMM Parameter Element",
3431 ie->wmm, ie->wmm_len);
3432 }
3433 }
3434 }
3435
3436
3437 /**
3438 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
3439 * @pos: Pointer to the IE header
3440 * @ie: Pointer to parsed IE data
3441 * Returns: 0 on success, 1 if end mark is found, 2 if KDE is not recognized
3442 */
wpa_parse_generic(const u8 * pos,struct wpa_eapol_ie_parse * ie)3443 static int wpa_parse_generic(const u8 *pos, struct wpa_eapol_ie_parse *ie)
3444 {
3445 u8 len = pos[1];
3446 size_t dlen = 2 + len;
3447 u32 selector;
3448 const u8 *p;
3449 size_t left;
3450 u8 link_id;
3451 char title[100];
3452 int ret;
3453
3454 if (len == 0)
3455 return 1;
3456
3457 if (len < RSN_SELECTOR_LEN)
3458 return 2;
3459
3460 p = pos + 2;
3461 selector = RSN_SELECTOR_GET(p);
3462 p += RSN_SELECTOR_LEN;
3463 left = len - RSN_SELECTOR_LEN;
3464
3465 if (left >= 2 && selector == WPA_OUI_TYPE && p[0] == 1 && p[1] == 0) {
3466 ie->wpa_ie = pos;
3467 ie->wpa_ie_len = dlen;
3468 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE in EAPOL-Key",
3469 ie->wpa_ie, ie->wpa_ie_len);
3470 return 0;
3471 }
3472
3473 if (selector == OSEN_IE_VENDOR_TYPE) {
3474 ie->osen = pos;
3475 ie->osen_len = dlen;
3476 return 0;
3477 }
3478
3479 if (left >= PMKID_LEN && selector == RSN_KEY_DATA_PMKID) {
3480 ie->pmkid = p;
3481 wpa_hexdump(MSG_DEBUG, "WPA: PMKID in EAPOL-Key", pos, dlen);
3482 return 0;
3483 }
3484
3485 if (left >= 2 && selector == RSN_KEY_DATA_KEYID) {
3486 ie->key_id = p;
3487 wpa_hexdump(MSG_DEBUG, "WPA: KeyID in EAPOL-Key", pos, dlen);
3488 return 0;
3489 }
3490
3491 if (left > 2 && selector == RSN_KEY_DATA_GROUPKEY) {
3492 ie->gtk = p;
3493 ie->gtk_len = left;
3494 wpa_hexdump_key(MSG_DEBUG, "WPA: GTK in EAPOL-Key", pos, dlen);
3495 return 0;
3496 }
3497
3498 if (left >= ETH_ALEN && selector == RSN_KEY_DATA_MAC_ADDR) {
3499 ie->mac_addr = p;
3500 wpa_printf(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key: " MACSTR,
3501 MAC2STR(ie->mac_addr));
3502 return 0;
3503 }
3504
3505 if (left > 2 && selector == RSN_KEY_DATA_IGTK) {
3506 ie->igtk = p;
3507 ie->igtk_len = left;
3508 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK in EAPOL-Key",
3509 pos, dlen);
3510 return 0;
3511 }
3512
3513 if (left > 2 && selector == RSN_KEY_DATA_BIGTK) {
3514 ie->bigtk = p;
3515 ie->bigtk_len = left;
3516 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK in EAPOL-Key",
3517 pos, dlen);
3518 return 0;
3519 }
3520
3521 if (left >= 1 && selector == WFA_KEY_DATA_IP_ADDR_REQ) {
3522 ie->ip_addr_req = p;
3523 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key",
3524 ie->ip_addr_req, left);
3525 return 0;
3526 }
3527
3528 if (left >= 3 * 4 && selector == WFA_KEY_DATA_IP_ADDR_ALLOC) {
3529 ie->ip_addr_alloc = p;
3530 wpa_hexdump(MSG_DEBUG,
3531 "WPA: IP Address Allocation in EAPOL-Key",
3532 ie->ip_addr_alloc, left);
3533 return 0;
3534 }
3535
3536 if (left > 2 && selector == RSN_KEY_DATA_OCI) {
3537 ie->oci = p;
3538 ie->oci_len = left;
3539 wpa_hexdump(MSG_DEBUG, "WPA: OCI KDE in EAPOL-Key",
3540 pos, dlen);
3541 return 0;
3542 }
3543
3544 if (left >= 1 && selector == WFA_KEY_DATA_TRANSITION_DISABLE) {
3545 ie->transition_disable = p;
3546 ie->transition_disable_len = left;
3547 wpa_hexdump(MSG_DEBUG,
3548 "WPA: Transition Disable KDE in EAPOL-Key",
3549 pos, dlen);
3550 return 0;
3551 }
3552
3553 if (left >= 2 && selector == WFA_KEY_DATA_DPP) {
3554 ie->dpp_kde = p;
3555 ie->dpp_kde_len = left;
3556 wpa_hexdump(MSG_DEBUG, "WPA: DPP KDE in EAPOL-Key", pos, dlen);
3557 return 0;
3558 }
3559
3560 if (left >= RSN_MLO_GTK_KDE_PREFIX_LENGTH &&
3561 selector == RSN_KEY_DATA_MLO_GTK) {
3562 link_id = (p[0] & RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_MASK) >>
3563 RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_SHIFT;
3564 if (link_id >= MAX_NUM_MLD_LINKS)
3565 return 2;
3566
3567 ie->valid_mlo_gtks |= BIT(link_id);
3568 ie->mlo_gtk[link_id] = p;
3569 ie->mlo_gtk_len[link_id] = left;
3570 ret = os_snprintf(title, sizeof(title),
3571 "RSN: Link ID %u - MLO GTK KDE in EAPOL-Key",
3572 link_id);
3573 if (!os_snprintf_error(sizeof(title), ret))
3574 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3575 return 0;
3576 }
3577
3578 if (left >= RSN_MLO_IGTK_KDE_PREFIX_LENGTH &&
3579 selector == RSN_KEY_DATA_MLO_IGTK) {
3580 link_id = (p[8] & RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3581 RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3582 if (link_id >= MAX_NUM_MLD_LINKS)
3583 return 2;
3584
3585 ie->valid_mlo_igtks |= BIT(link_id);
3586 ie->mlo_igtk[link_id] = p;
3587 ie->mlo_igtk_len[link_id] = left;
3588 ret = os_snprintf(title, sizeof(title),
3589 "RSN: Link ID %u - MLO IGTK KDE in EAPOL-Key",
3590 link_id);
3591 if (!os_snprintf_error(sizeof(title), ret))
3592 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3593 return 0;
3594 }
3595
3596 if (left >= RSN_MLO_BIGTK_KDE_PREFIX_LENGTH &&
3597 selector == RSN_KEY_DATA_MLO_BIGTK) {
3598 link_id = (p[8] & RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3599 RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3600 if (link_id >= MAX_NUM_MLD_LINKS)
3601 return 2;
3602
3603 ie->valid_mlo_bigtks |= BIT(link_id);
3604 ie->mlo_bigtk[link_id] = p;
3605 ie->mlo_bigtk_len[link_id] = left;
3606 ret = os_snprintf(title, sizeof(title),
3607 "RSN: Link ID %u - MLO BIGTK KDE in EAPOL-Key",
3608 link_id);
3609 if (!os_snprintf_error(sizeof(title), ret))
3610 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3611 return 0;
3612 }
3613
3614 if (left >= RSN_MLO_LINK_KDE_FIXED_LENGTH &&
3615 selector == RSN_KEY_DATA_MLO_LINK) {
3616 link_id = (p[0] & RSN_MLO_LINK_KDE_LI_LINK_ID_MASK) >>
3617 RSN_MLO_LINK_KDE_LI_LINK_ID_SHIFT;
3618 if (link_id >= MAX_NUM_MLD_LINKS)
3619 return 2;
3620
3621 ie->valid_mlo_links |= BIT(link_id);
3622 ie->mlo_link[link_id] = p;
3623 ie->mlo_link_len[link_id] = left;
3624 ret = os_snprintf(title, sizeof(title),
3625 "RSN: Link ID %u - MLO Link KDE in EAPOL-Key",
3626 link_id);
3627 if (!os_snprintf_error(sizeof(title), ret))
3628 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
3629 return 0;
3630 }
3631
3632 if (left >= 1 && selector == WFA_KEY_DATA_RSN_OVERRIDE_LINK) {
3633 link_id = p[0];
3634 if (link_id >= MAX_NUM_MLD_LINKS)
3635 return 2;
3636
3637 ie->rsn_override_link[link_id] = p;
3638 ie->rsn_override_link_len[link_id] = left;
3639 ret = os_snprintf(title, sizeof(title),
3640 "RSN: Link ID %u - RSN Override Link KDE in EAPOL-Key",
3641 link_id);
3642 if (!os_snprintf_error(sizeof(title), ret))
3643 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
3644 return 0;
3645 }
3646
3647 if (selector == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
3648 ie->rsne_override = pos;
3649 ie->rsne_override_len = dlen;
3650 wpa_hexdump(MSG_DEBUG,
3651 "RSN: RSNE Override element in EAPOL-Key",
3652 ie->rsne_override, ie->rsne_override_len);
3653 return 0;
3654 }
3655
3656 if (selector == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
3657 ie->rsne_override_2 = pos;
3658 ie->rsne_override_2_len = dlen;
3659 wpa_hexdump(MSG_DEBUG,
3660 "RSN: RSNE Override 2 element in EAPOL-Key",
3661 ie->rsne_override_2, ie->rsne_override_2_len);
3662 return 0;
3663 }
3664
3665 if (selector == RSNXE_OVERRIDE_IE_VENDOR_TYPE) {
3666 ie->rsnxe_override = pos;
3667 ie->rsnxe_override_len = dlen;
3668 wpa_hexdump(MSG_DEBUG,
3669 "RSN: RSNXE Override element in EAPOL-Key",
3670 ie->rsnxe_override, ie->rsnxe_override_len);
3671 return 0;
3672 }
3673
3674 if (selector == RSN_SELECTION_IE_VENDOR_TYPE) {
3675 ie->rsn_selection = p;
3676 ie->rsn_selection_len = left;
3677 wpa_hexdump(MSG_DEBUG,
3678 "RSN: RSN Selection element in EAPOL-Key",
3679 ie->rsn_selection, ie->rsn_selection_len);
3680 return 0;
3681 }
3682
3683 return 2;
3684 }
3685
3686
3687 /**
3688 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
3689 * @buf: Pointer to the Key Data buffer
3690 * @len: Key Data Length
3691 * @ie: Pointer to parsed IE data
3692 * Returns: 0 on success, -1 on failure
3693 */
wpa_parse_kde_ies(const u8 * buf,size_t len,struct wpa_eapol_ie_parse * ie)3694 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
3695 {
3696 const u8 *pos, *end;
3697 int ret = 0;
3698 size_t dlen = 0;
3699
3700 os_memset(ie, 0, sizeof(*ie));
3701 for (pos = buf, end = pos + len; end - pos > 1; pos += dlen) {
3702 if (pos[0] == 0xdd &&
3703 ((pos == buf + len - 1) || pos[1] == 0)) {
3704 /* Ignore padding */
3705 break;
3706 }
3707 dlen = 2 + pos[1];
3708 if ((int) dlen > end - pos) {
3709 wpa_printf(MSG_DEBUG,
3710 "WPA: EAPOL-Key Key Data underflow (ie=%d len=%d pos=%d)",
3711 pos[0], pos[1], (int) (pos - buf));
3712 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", buf, len);
3713 ret = -1;
3714 break;
3715 }
3716 if (*pos == WLAN_EID_RSN) {
3717 ie->rsn_ie = pos;
3718 ie->rsn_ie_len = dlen;
3719 wpa_hexdump(MSG_DEBUG, "WPA: RSN IE in EAPOL-Key",
3720 ie->rsn_ie, ie->rsn_ie_len);
3721 } else if (*pos == WLAN_EID_RSNX) {
3722 ie->rsnxe = pos;
3723 ie->rsnxe_len = dlen;
3724 wpa_hexdump(MSG_DEBUG, "WPA: RSNXE in EAPOL-Key",
3725 ie->rsnxe, ie->rsnxe_len);
3726 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
3727 ie->mdie = pos;
3728 ie->mdie_len = dlen;
3729 wpa_hexdump(MSG_DEBUG, "WPA: MDIE in EAPOL-Key",
3730 ie->mdie, ie->mdie_len);
3731 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) {
3732 ie->ftie = pos;
3733 ie->ftie_len = dlen;
3734 wpa_hexdump(MSG_DEBUG, "WPA: FTIE in EAPOL-Key",
3735 ie->ftie, ie->ftie_len);
3736 } else if (*pos == WLAN_EID_TIMEOUT_INTERVAL && pos[1] >= 5) {
3737 if (pos[2] == WLAN_TIMEOUT_REASSOC_DEADLINE) {
3738 ie->reassoc_deadline = pos;
3739 wpa_hexdump(MSG_DEBUG, "WPA: Reassoc Deadline "
3740 "in EAPOL-Key",
3741 ie->reassoc_deadline, dlen);
3742 } else if (pos[2] == WLAN_TIMEOUT_KEY_LIFETIME) {
3743 ie->key_lifetime = pos;
3744 wpa_hexdump(MSG_DEBUG, "WPA: KeyLifetime "
3745 "in EAPOL-Key",
3746 ie->key_lifetime, dlen);
3747 } else {
3748 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized "
3749 "EAPOL-Key Key Data IE",
3750 pos, dlen);
3751 }
3752 } else if (*pos == WLAN_EID_LINK_ID) {
3753 if (pos[1] >= 18) {
3754 ie->lnkid = pos;
3755 ie->lnkid_len = dlen;
3756 }
3757 } else if (*pos == WLAN_EID_EXT_CAPAB) {
3758 ie->ext_capab = pos;
3759 ie->ext_capab_len = dlen;
3760 } else if (*pos == WLAN_EID_SUPP_RATES) {
3761 ie->supp_rates = pos;
3762 ie->supp_rates_len = dlen;
3763 } else if (*pos == WLAN_EID_EXT_SUPP_RATES) {
3764 ie->ext_supp_rates = pos;
3765 ie->ext_supp_rates_len = dlen;
3766 } else if (*pos == WLAN_EID_HT_CAP &&
3767 pos[1] >= sizeof(struct ieee80211_ht_capabilities)) {
3768 ie->ht_capabilities = pos + 2;
3769 } else if (*pos == WLAN_EID_AID) {
3770 if (pos[1] >= 2)
3771 ie->aid = WPA_GET_LE16(pos + 2) & 0x3fff;
3772 } else if (*pos == WLAN_EID_VHT_CAP &&
3773 pos[1] >= sizeof(struct ieee80211_vht_capabilities))
3774 {
3775 ie->vht_capabilities = pos + 2;
3776 } else if (*pos == WLAN_EID_EXTENSION &&
3777 pos[1] >= 1 + IEEE80211_HE_CAPAB_MIN_LEN &&
3778 pos[2] == WLAN_EID_EXT_HE_CAPABILITIES) {
3779 ie->he_capabilities = pos + 3;
3780 ie->he_capab_len = pos[1] - 1;
3781 } else if (*pos == WLAN_EID_EXTENSION &&
3782 pos[1] >= 1 +
3783 sizeof(struct ieee80211_he_6ghz_band_cap) &&
3784 pos[2] == WLAN_EID_EXT_HE_6GHZ_BAND_CAP) {
3785 ie->he_6ghz_capabilities = pos + 3;
3786 } else if (*pos == WLAN_EID_EXTENSION &&
3787 pos[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN &&
3788 pos[2] == WLAN_EID_EXT_EHT_CAPABILITIES) {
3789 ie->eht_capabilities = pos + 3;
3790 ie->eht_capab_len = pos[1] - 1;
3791 } else if (*pos == WLAN_EID_QOS && pos[1] >= 1) {
3792 ie->qosinfo = pos[2];
3793 } else if (*pos == WLAN_EID_SUPPORTED_CHANNELS) {
3794 ie->supp_channels = pos + 2;
3795 ie->supp_channels_len = pos[1];
3796 } else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) {
3797 /*
3798 * The value of the Length field of the Supported
3799 * Operating Classes element is between 2 and 253.
3800 * Silently skip invalid elements to avoid interop
3801 * issues when trying to use the value.
3802 */
3803 if (pos[1] >= 2 && pos[1] <= 253) {
3804 ie->supp_oper_classes = pos + 2;
3805 ie->supp_oper_classes_len = pos[1];
3806 }
3807 } else if (*pos == WLAN_EID_SSID) {
3808 ie->ssid = pos + 2;
3809 ie->ssid_len = pos[1];
3810 wpa_hexdump_ascii(MSG_DEBUG, "RSN: SSID in EAPOL-Key",
3811 ie->ssid, ie->ssid_len);
3812 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
3813 ret = wpa_parse_generic(pos, ie);
3814 if (ret == 1) {
3815 /* end mark found */
3816 ret = 0;
3817 break;
3818 }
3819
3820 if (ret == 2) {
3821 /* not a known KDE */
3822 wpa_parse_vendor_specific(pos, end, ie);
3823 }
3824
3825 ret = 0;
3826 } else {
3827 wpa_hexdump(MSG_DEBUG,
3828 "WPA: Unrecognized EAPOL-Key Key Data IE",
3829 pos, dlen);
3830 }
3831 }
3832
3833 return ret;
3834 }
3835
3836
3837 #ifdef CONFIG_PASN
3838
3839 /*
3840 * wpa_pasn_build_auth_header - Add the MAC header and initialize Authentication
3841 * frame for PASN
3842 *
3843 * @buf: Buffer in which the header will be added
3844 * @bssid: The BSSID of the AP
3845 * @src: Source address
3846 * @dst: Destination address
3847 * @trans_seq: Authentication transaction sequence number
3848 * @status: Authentication status
3849 */
wpa_pasn_build_auth_header(struct wpabuf * buf,const u8 * bssid,const u8 * src,const u8 * dst,u8 trans_seq,u16 status)3850 void wpa_pasn_build_auth_header(struct wpabuf *buf, const u8 *bssid,
3851 const u8 *src, const u8 *dst,
3852 u8 trans_seq, u16 status)
3853 {
3854 struct ieee80211_mgmt *auth;
3855
3856 wpa_printf(MSG_DEBUG, "PASN: Add authentication header. trans_seq=%u",
3857 trans_seq);
3858
3859 auth = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
3860 u.auth.variable));
3861
3862 auth->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
3863 (WLAN_FC_STYPE_AUTH << 4));
3864
3865 os_memcpy(auth->da, dst, ETH_ALEN);
3866 os_memcpy(auth->sa, src, ETH_ALEN);
3867 os_memcpy(auth->bssid, bssid, ETH_ALEN);
3868 auth->seq_ctrl = 0;
3869
3870 auth->u.auth.auth_alg = host_to_le16(WLAN_AUTH_PASN);
3871 auth->u.auth.auth_transaction = host_to_le16(trans_seq);
3872 auth->u.auth.status_code = host_to_le16(status);
3873 }
3874
3875
3876 /*
3877 * wpa_pasn_add_rsne - Add an RSNE for PASN authentication
3878 * @buf: Buffer in which the IE will be added
3879 * @pmkid: Optional PMKID. Can be NULL.
3880 * @akmp: Authentication and key management protocol
3881 * @cipher: The cipher suite
3882 */
wpa_pasn_add_rsne(struct wpabuf * buf,const u8 * pmkid,int akmp,int cipher)3883 int wpa_pasn_add_rsne(struct wpabuf *buf, const u8 *pmkid, int akmp, int cipher)
3884 {
3885 struct rsn_ie_hdr *hdr;
3886 u32 suite;
3887 u16 capab;
3888 u8 *pos;
3889 u8 rsne_len;
3890
3891 wpa_printf(MSG_DEBUG, "PASN: Add RSNE");
3892
3893 rsne_len = sizeof(*hdr) + RSN_SELECTOR_LEN +
3894 2 + RSN_SELECTOR_LEN + 2 + RSN_SELECTOR_LEN +
3895 2 + RSN_SELECTOR_LEN + 2 + (pmkid ? PMKID_LEN : 0);
3896
3897 if (wpabuf_tailroom(buf) < rsne_len)
3898 return -1;
3899 hdr = wpabuf_put(buf, rsne_len);
3900 hdr->elem_id = WLAN_EID_RSN;
3901 hdr->len = rsne_len - 2;
3902 WPA_PUT_LE16(hdr->version, RSN_VERSION);
3903 pos = (u8 *) (hdr + 1);
3904
3905 /* Group addressed data is not allowed */
3906 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3907 pos += RSN_SELECTOR_LEN;
3908
3909 /* Add the pairwise cipher */
3910 WPA_PUT_LE16(pos, 1);
3911 pos += 2;
3912 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, cipher);
3913 RSN_SELECTOR_PUT(pos, suite);
3914 pos += RSN_SELECTOR_LEN;
3915
3916 /* Add the AKM suite */
3917 WPA_PUT_LE16(pos, 1);
3918 pos += 2;
3919
3920 switch (akmp) {
3921 case WPA_KEY_MGMT_PASN:
3922 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PASN);
3923 break;
3924 #ifdef CONFIG_SAE
3925 case WPA_KEY_MGMT_SAE:
3926 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
3927 break;
3928 case WPA_KEY_MGMT_SAE_EXT_KEY:
3929 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE_EXT_KEY);
3930 break;
3931 #endif /* CONFIG_SAE */
3932 #ifdef CONFIG_FILS
3933 case WPA_KEY_MGMT_FILS_SHA256:
3934 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
3935 break;
3936 case WPA_KEY_MGMT_FILS_SHA384:
3937 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
3938 break;
3939 #endif /* CONFIG_FILS */
3940 #ifdef CONFIG_IEEE80211R
3941 case WPA_KEY_MGMT_FT_PSK:
3942 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
3943 break;
3944 case WPA_KEY_MGMT_FT_IEEE8021X:
3945 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
3946 break;
3947 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
3948 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
3949 break;
3950 #endif /* CONFIG_IEEE80211R */
3951 default:
3952 wpa_printf(MSG_ERROR, "PASN: Invalid AKMP=0x%x", akmp);
3953 return -1;
3954 }
3955 pos += RSN_SELECTOR_LEN;
3956
3957 /* RSN Capabilities: PASN mandates both MFP capable and required */
3958 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
3959 WPA_PUT_LE16(pos, capab);
3960 pos += 2;
3961
3962 if (pmkid) {
3963 wpa_printf(MSG_DEBUG, "PASN: Adding PMKID");
3964
3965 WPA_PUT_LE16(pos, 1);
3966 pos += 2;
3967 os_memcpy(pos, pmkid, PMKID_LEN);
3968 pos += PMKID_LEN;
3969 } else {
3970 WPA_PUT_LE16(pos, 0);
3971 pos += 2;
3972 }
3973
3974 /* Group addressed management is not allowed */
3975 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3976
3977 return 0;
3978 }
3979
3980
3981 /*
3982 * wpa_pasn_add_parameter_ie - Add PASN Parameters IE for PASN authentication
3983 * @buf: Buffer in which the IE will be added
3984 * @pasn_group: Finite Cyclic Group ID for PASN authentication
3985 * @wrapped_data_format: Format of the data in the Wrapped Data IE
3986 * @pubkey: A buffer holding the local public key. Can be NULL
3987 * @compressed: In case pubkey is included, indicates if the public key is
3988 * compressed (only x coordinate is included) or not (both x and y
3989 * coordinates are included)
3990 * @comeback: A buffer holding the comeback token. Can be NULL
3991 * @after: If comeback is set, defined the comeback time in seconds. -1 to not
3992 * include the Comeback After field (frames from non-AP STA).
3993 */
wpa_pasn_add_parameter_ie(struct wpabuf * buf,u16 pasn_group,u8 wrapped_data_format,const struct wpabuf * pubkey,bool compressed,const struct wpabuf * comeback,int after)3994 void wpa_pasn_add_parameter_ie(struct wpabuf *buf, u16 pasn_group,
3995 u8 wrapped_data_format,
3996 const struct wpabuf *pubkey, bool compressed,
3997 const struct wpabuf *comeback, int after)
3998 {
3999 struct pasn_parameter_ie *params;
4000
4001 wpa_printf(MSG_DEBUG, "PASN: Add PASN Parameters element");
4002
4003 params = wpabuf_put(buf, sizeof(*params));
4004
4005 params->id = WLAN_EID_EXTENSION;
4006 params->len = sizeof(*params) - 2;
4007 params->id_ext = WLAN_EID_EXT_PASN_PARAMS;
4008 params->control = 0;
4009 params->wrapped_data_format = wrapped_data_format;
4010
4011 if (comeback) {
4012 wpa_printf(MSG_DEBUG, "PASN: Adding comeback data");
4013
4014 /*
4015 * 2 octets for the 'after' field + 1 octet for the length +
4016 * actual cookie data
4017 */
4018 if (after >= 0)
4019 params->len += 2;
4020 params->len += 1 + wpabuf_len(comeback);
4021 params->control |= WPA_PASN_CTRL_COMEBACK_INFO_PRESENT;
4022
4023 if (after >= 0)
4024 wpabuf_put_le16(buf, after);
4025 wpabuf_put_u8(buf, wpabuf_len(comeback));
4026 wpabuf_put_buf(buf, comeback);
4027 }
4028
4029 if (pubkey) {
4030 wpa_printf(MSG_DEBUG,
4031 "PASN: Adding public key and group ID %u",
4032 pasn_group);
4033
4034 /*
4035 * 2 octets for the finite cyclic group + 2 octets public key
4036 * length + 1 octet for the compressed/uncompressed indication +
4037 * the actual key.
4038 */
4039 params->len += 2 + 1 + 1 + wpabuf_len(pubkey);
4040 params->control |= WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT;
4041
4042 wpabuf_put_le16(buf, pasn_group);
4043
4044 /*
4045 * The first octet indicates whether the public key is
4046 * compressed, as defined in RFC 5480 section 2.2.
4047 */
4048 wpabuf_put_u8(buf, wpabuf_len(pubkey) + 1);
4049 wpabuf_put_u8(buf, compressed ? WPA_PASN_PUBKEY_COMPRESSED_0 :
4050 WPA_PASN_PUBKEY_UNCOMPRESSED);
4051
4052 wpabuf_put_buf(buf, pubkey);
4053 }
4054 }
4055
4056 /*
4057 * wpa_pasn_add_wrapped_data - Add a Wrapped Data IE to PASN Authentication
4058 * frame. If needed, the Wrapped Data IE would be fragmented.
4059 *
4060 * @buf: Buffer in which the IE will be added
4061 * @wrapped_data_buf: Buffer holding the wrapped data
4062 */
wpa_pasn_add_wrapped_data(struct wpabuf * buf,struct wpabuf * wrapped_data_buf)4063 int wpa_pasn_add_wrapped_data(struct wpabuf *buf,
4064 struct wpabuf *wrapped_data_buf)
4065 {
4066 const u8 *data;
4067 size_t data_len;
4068 u8 len;
4069
4070 if (!wrapped_data_buf)
4071 return 0;
4072
4073 wpa_printf(MSG_DEBUG, "PASN: Add wrapped data");
4074
4075 data = wpabuf_head_u8(wrapped_data_buf);
4076 data_len = wpabuf_len(wrapped_data_buf);
4077
4078 /* nothing to add */
4079 if (!data_len)
4080 return 0;
4081
4082 if (data_len <= 254)
4083 len = 1 + data_len;
4084 else
4085 len = 255;
4086
4087 if (wpabuf_tailroom(buf) < 3 + data_len)
4088 return -1;
4089
4090 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
4091 wpabuf_put_u8(buf, len);
4092 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
4093 wpabuf_put_data(buf, data, len - 1);
4094
4095 data += len - 1;
4096 data_len -= len - 1;
4097
4098 while (data_len) {
4099 if (wpabuf_tailroom(buf) < 1 + data_len)
4100 return -1;
4101 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4102 len = data_len > 255 ? 255 : data_len;
4103 wpabuf_put_u8(buf, len);
4104 wpabuf_put_data(buf, data, len);
4105 data += len;
4106 data_len -= len;
4107 }
4108
4109 return 0;
4110 }
4111
4112
4113 /*
4114 * wpa_pasn_validate_rsne - Validate PSAN specific data of RSNE
4115 * @data: Parsed representation of an RSNE
4116 * Returns -1 for invalid data; otherwise 0
4117 */
wpa_pasn_validate_rsne(const struct wpa_ie_data * data)4118 int wpa_pasn_validate_rsne(const struct wpa_ie_data *data)
4119 {
4120 u16 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
4121
4122 if (data->proto != WPA_PROTO_RSN)
4123 return -1;
4124
4125 if ((data->capabilities & capab) != capab) {
4126 wpa_printf(MSG_DEBUG, "PASN: Invalid RSNE capabilities");
4127 return -1;
4128 }
4129
4130 if (!data->has_group || data->group_cipher != WPA_CIPHER_GTK_NOT_USED) {
4131 wpa_printf(MSG_DEBUG, "PASN: Invalid group data cipher");
4132 return -1;
4133 }
4134
4135 if (!data->has_pairwise || !data->pairwise_cipher ||
4136 (data->pairwise_cipher & (data->pairwise_cipher - 1))) {
4137 wpa_printf(MSG_DEBUG, "PASN: No valid pairwise suite");
4138 return -1;
4139 }
4140
4141 switch (data->key_mgmt) {
4142 #ifdef CONFIG_SAE
4143 case WPA_KEY_MGMT_SAE:
4144 case WPA_KEY_MGMT_SAE_EXT_KEY:
4145 /* fall through */
4146 #endif /* CONFIG_SAE */
4147 #ifdef CONFIG_FILS
4148 case WPA_KEY_MGMT_FILS_SHA256:
4149 case WPA_KEY_MGMT_FILS_SHA384:
4150 /* fall through */
4151 #endif /* CONFIG_FILS */
4152 #ifdef CONFIG_IEEE80211R
4153 case WPA_KEY_MGMT_FT_PSK:
4154 case WPA_KEY_MGMT_FT_IEEE8021X:
4155 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
4156 /* fall through */
4157 #endif /* CONFIG_IEEE80211R */
4158 case WPA_KEY_MGMT_PASN:
4159 break;
4160 default:
4161 wpa_printf(MSG_ERROR, "PASN: invalid key_mgmt: 0x%0x",
4162 data->key_mgmt);
4163 return -1;
4164 }
4165
4166 if (data->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED) {
4167 wpa_printf(MSG_DEBUG, "PASN: Invalid group mgmt cipher");
4168 return -1;
4169 }
4170
4171 if (data->num_pmkid > 1) {
4172 wpa_printf(MSG_DEBUG, "PASN: Invalid number of PMKIDs");
4173 return -1;
4174 }
4175
4176 return 0;
4177 }
4178
4179
4180 /*
4181 * wpa_pasn_parse_parameter_ie - Validates PASN Parameters IE
4182 * @data: Pointer to the PASN Parameters IE (starting with the EID).
4183 * @len: Length of the data in the PASN Parameters IE
4184 * @from_ap: Whether this was received from an AP
4185 * @pasn_params: On successful return would hold the parsed PASN parameters.
4186 * Returns: -1 for invalid data; otherwise 0
4187 *
4188 * Note: On successful return, the pointers in &pasn_params point to the data in
4189 * the IE and are not locally allocated (so they should not be freed etc.).
4190 */
wpa_pasn_parse_parameter_ie(const u8 * data,u8 len,bool from_ap,struct wpa_pasn_params_data * pasn_params)4191 int wpa_pasn_parse_parameter_ie(const u8 *data, u8 len, bool from_ap,
4192 struct wpa_pasn_params_data *pasn_params)
4193 {
4194 struct pasn_parameter_ie *params = (struct pasn_parameter_ie *) data;
4195 const u8 *pos = (const u8 *) (params + 1);
4196
4197 if (!pasn_params) {
4198 wpa_printf(MSG_DEBUG, "PASN: Invalid params");
4199 return -1;
4200 }
4201
4202 if (!params || ((size_t) (params->len + 2) < sizeof(*params)) ||
4203 len < sizeof(*params) || params->len + 2 != len) {
4204 wpa_printf(MSG_DEBUG,
4205 "PASN: Invalid parameters IE. len=(%u, %u)",
4206 params ? params->len : 0, len);
4207 return -1;
4208 }
4209
4210 os_memset(pasn_params, 0, sizeof(*pasn_params));
4211
4212 switch (params->wrapped_data_format) {
4213 case WPA_PASN_WRAPPED_DATA_NO:
4214 case WPA_PASN_WRAPPED_DATA_SAE:
4215 case WPA_PASN_WRAPPED_DATA_FILS_SK:
4216 case WPA_PASN_WRAPPED_DATA_FT:
4217 break;
4218 default:
4219 wpa_printf(MSG_DEBUG, "PASN: Invalid wrapped data format");
4220 return -1;
4221 }
4222
4223 pasn_params->wrapped_data_format = params->wrapped_data_format;
4224
4225 len -= sizeof(*params);
4226
4227 if (params->control & WPA_PASN_CTRL_COMEBACK_INFO_PRESENT) {
4228 if (from_ap) {
4229 if (len < 2) {
4230 wpa_printf(MSG_DEBUG,
4231 "PASN: Invalid Parameters IE: Truncated Comeback After");
4232 return -1;
4233 }
4234 pasn_params->after = WPA_GET_LE16(pos);
4235 pos += 2;
4236 len -= 2;
4237 }
4238
4239 if (len < 1 || len < 1 + *pos) {
4240 wpa_printf(MSG_DEBUG,
4241 "PASN: Invalid Parameters IE: comeback len");
4242 return -1;
4243 }
4244
4245 pasn_params->comeback_len = *pos++;
4246 len--;
4247 pasn_params->comeback = pos;
4248 len -= pasn_params->comeback_len;
4249 pos += pasn_params->comeback_len;
4250 }
4251
4252 if (params->control & WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT) {
4253 if (len < 3 || len < 3 + pos[2]) {
4254 wpa_printf(MSG_DEBUG,
4255 "PASN: Invalid Parameters IE: group and key");
4256 return -1;
4257 }
4258
4259 pasn_params->group = WPA_GET_LE16(pos);
4260 pos += 2;
4261 len -= 2;
4262 pasn_params->pubkey_len = *pos++;
4263 len--;
4264 pasn_params->pubkey = pos;
4265 len -= pasn_params->pubkey_len;
4266 pos += pasn_params->pubkey_len;
4267 }
4268
4269 if (len) {
4270 wpa_printf(MSG_DEBUG,
4271 "PASN: Invalid Parameters IE. Bytes left=%u", len);
4272 return -1;
4273 }
4274
4275 return 0;
4276 }
4277
4278
wpa_pasn_add_rsnxe(struct wpabuf * buf,u16 capab)4279 void wpa_pasn_add_rsnxe(struct wpabuf *buf, u16 capab)
4280 {
4281 size_t flen;
4282
4283 flen = (capab & 0xff00) ? 2 : 1;
4284 if (!capab)
4285 return; /* no supported extended RSN capabilities */
4286 if (wpabuf_tailroom(buf) < 2 + flen)
4287 return;
4288 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
4289
4290 wpabuf_put_u8(buf, WLAN_EID_RSNX);
4291 wpabuf_put_u8(buf, flen);
4292 wpabuf_put_u8(buf, capab & 0x00ff);
4293 capab >>= 8;
4294 if (capab)
4295 wpabuf_put_u8(buf, capab);
4296 }
4297
4298
4299 /*
4300 * wpa_pasn_add_extra_ies - Add protocol specific IEs in Authentication
4301 * frame for PASN.
4302 *
4303 * @buf: Buffer in which the elements will be added
4304 * @extra_ies: Protocol specific elements to add
4305 * @len: Length of the elements
4306 * Returns: 0 on success, -1 on failure
4307 */
4308
wpa_pasn_add_extra_ies(struct wpabuf * buf,const u8 * extra_ies,size_t len)4309 int wpa_pasn_add_extra_ies(struct wpabuf *buf, const u8 *extra_ies, size_t len)
4310 {
4311 if (!len || !extra_ies || !buf)
4312 return 0;
4313
4314 if (wpabuf_tailroom(buf) < sizeof(len))
4315 return -1;
4316
4317 wpabuf_put_data(buf, extra_ies, len);
4318 return 0;
4319 }
4320
4321 #endif /* CONFIG_PASN */
4322
4323
rsn_set_snonce_cookie(u8 * snonce)4324 void rsn_set_snonce_cookie(u8 *snonce)
4325 {
4326 u8 *pos;
4327
4328 pos = snonce + WPA_NONCE_LEN - 6;
4329 WPA_PUT_BE24(pos, OUI_WFA);
4330 pos += 3;
4331 WPA_PUT_BE24(pos, 0x000029);
4332 }
4333
4334
rsn_is_snonce_cookie(const u8 * snonce)4335 bool rsn_is_snonce_cookie(const u8 *snonce)
4336 {
4337 const u8 *pos;
4338
4339 pos = snonce + WPA_NONCE_LEN - 6;
4340 return WPA_GET_BE24(pos) == OUI_WFA &&
4341 WPA_GET_BE24(pos + 3) == 0x000029;
4342 }
4343