1 /*
2  * BIP
3  * Copyright (c) 2010-2012, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "crypto/aes_wrap.h"
14 #include "wlantest.h"
15 
16 
bip_protect(const u8 * igtk,size_t igtk_len,u8 * frame,size_t len,u8 * ipn,int keyid,size_t * prot_len)17 u8 * bip_protect(const u8 *igtk, size_t igtk_len, u8 *frame, size_t len,
18 		 u8 *ipn, int keyid, size_t *prot_len)
19 {
20 	u8 *prot, *pos, *buf;
21 	u8 mic[16];
22 	u16 fc;
23 	struct ieee80211_hdr *hdr;
24 	size_t plen;
25 
26 	plen = len + (igtk_len == 32 ? 26 : 18);
27 	prot = os_malloc(plen);
28 	if (prot == NULL)
29 		return NULL;
30 	os_memcpy(prot, frame, len);
31 	pos = prot + len;
32 	*pos++ = WLAN_EID_MMIE;
33 	*pos++ = igtk_len == 32 ? 24 : 16;
34 	WPA_PUT_LE16(pos, keyid);
35 	pos += 2;
36 	os_memcpy(pos, ipn, 6);
37 	pos += 6;
38 	os_memset(pos, 0, igtk_len == 32 ? 16 : 8); /* MIC */
39 
40 	buf = os_malloc(plen + 20 - 24);
41 	if (buf == NULL) {
42 		os_free(prot);
43 		return NULL;
44 	}
45 
46 	/* BIP AAD: FC(masked) A1 A2 A3 */
47 	hdr = (struct ieee80211_hdr *) frame;
48 	fc = le_to_host16(hdr->frame_control);
49 	fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
50 	WPA_PUT_LE16(buf, fc);
51 	os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
52 	os_memcpy(buf + 20, prot + 24, plen - 24);
53 	wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, plen + 20 - 24);
54 	/* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
55 	if (omac1_aes_128(igtk, buf, plen + 20 - 24, mic) < 0) {
56 		os_free(prot);
57 		os_free(buf);
58 		return NULL;
59 	}
60 	os_free(buf);
61 
62 	os_memcpy(pos, mic, igtk_len == 32 ? 16 : 8);
63 	wpa_hexdump(MSG_DEBUG, "BIP MMIE MIC", pos, igtk_len == 32 ? 16 : 8);
64 
65 	*prot_len = plen;
66 	return prot;
67 }
68 
69 
70 #define MME_LEN_LESS_MIC	10
71 #define MIC_ELEM_LEN_LESS_MIC	2
72 
bip_protect_s1g_beacon(const u8 * igtk,size_t igtk_len,const u8 * frame,size_t len,const u8 * ipn,int keyid,bool bce,size_t * prot_len)73 u8 * bip_protect_s1g_beacon(const u8 *igtk, size_t igtk_len, const u8 *frame,
74 			    size_t len, const u8 *ipn, int keyid, bool bce,
75 			    size_t *prot_len)
76 {
77 	u8 *prot, *pos, *buf;
78 	u8 mic[16];
79 	u16 fc;
80 	struct ieee80211_hdr_s1g_beacon *hdr;
81 	struct ieee80211_s1g_beacon_compat *bc;
82 	size_t plen, mic_len, element_len, buf_len;
83 	size_t hdr_add_len = 0, bce_add_len = 0;
84 
85 	mic_len = igtk_len == 32 ? 16 : 8;
86 	if (bce)
87 		element_len = MIC_ELEM_LEN_LESS_MIC + mic_len;
88 	else
89 		element_len = MME_LEN_LESS_MIC + mic_len;
90 
91 	plen = len + element_len; /* add element length */
92 	prot = os_malloc(plen);
93 	if (!prot)
94 		return NULL;
95 	os_memcpy(prot, frame, len);
96 	pos = prot + len;
97 
98 	/* Add MME/MIC element to the end of the frame */
99 	if (bce) {
100 		bce_add_len = 6; /* AAD increases by 6 bytes for BCE */
101 		*pos++ = WLAN_EID_MIC; /* Element ID */
102 		*pos++ = element_len - 2; /* Length field */
103 	} else {
104 		*pos++ = WLAN_EID_MMIE; /* Element ID */
105 		*pos++ = element_len - 2; /* Length field */
106 		WPA_PUT_LE16(pos, keyid); /* KeyID */
107 		pos += 2;
108 		os_memcpy(pos, ipn, 6); /* BIPN */
109 		pos += 6;
110 	}
111 	os_memset(pos, 0, mic_len); /* MIC */
112 
113 	/* Duration (2) and Timestamp (4) are omitted from AAD, BIPN (6) is
114 	 * added if BCE is used */
115 	buf_len = plen - 6 + bce_add_len;
116 	buf = os_malloc(buf_len);
117 	if (!buf) {
118 		os_free(prot);
119 		return NULL;
120 	}
121 
122 	/* BIP AAD: FC SA ChangeSeq NextTBTT(if present)
123 	 * CompressedSSID(if present) ANO(if present), BIPN(if using BCE) */
124 	hdr = (struct ieee80211_hdr_s1g_beacon *) frame;
125 	fc = le_to_host16(hdr->frame_control);
126 	if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_EXT ||
127 	    WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_S1G_BEACON) {
128 		wpa_printf(MSG_ERROR, "Frame is not an S1G Beacon");
129 		os_free(prot);
130 		os_free(buf);
131 		return NULL;
132 	}
133 
134 	WPA_PUT_LE16(buf, fc);
135 	os_memcpy(buf + 2, hdr->sa, ETH_ALEN);
136 	os_memcpy(buf + 8, hdr->change_seq, 1);
137 	if (fc & WLAN_FC_S1G_BEACON_NEXT_TBTT)
138 		hdr_add_len += 3;
139 	if (fc & WLAN_FC_S1G_BEACON_COMP_SSID)
140 		hdr_add_len += 4;
141 	if (fc & WLAN_FC_S1G_BEACON_ANO)
142 		hdr_add_len++;
143 	os_memcpy(buf + 9, prot + IEEE80211_HDRLEN_S1G_BEACON, hdr_add_len);
144 	if (bce)
145 		os_memcpy(buf + 9 + hdr_add_len, ipn, bce_add_len);
146 	os_memcpy(buf + 9 + hdr_add_len + bce_add_len,
147 		  prot + IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len,
148 		  plen - (IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len));
149 	/* The S1G Beacon Compatibility element, when present, is the first
150 	 * element in the S1G Beacon frame body */
151 	if (len >= IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len +
152 	    sizeof(struct ieee80211_s1g_beacon_compat)) {
153 		bc = (struct ieee80211_s1g_beacon_compat *)
154 			(buf + 9 + hdr_add_len + bce_add_len);
155 		if (bc->element_id == WLAN_EID_S1G_BCN_COMPAT) {
156 			wpa_printf(MSG_DEBUG,
157 				   "S1G Beacon Compatibility element found, masking TSF Completion field");
158 			os_memset(&bc->tsf_completion, 0,
159 				  sizeof(bc->tsf_completion));
160 			if (bce && keyid - 6 != (bc->compat_info & 0x80) >> 7) {
161 				wpa_printf(MSG_ERROR,
162 					   "Key ID does not match BIGTK Key ID Index in S1G Beacon Compatibility element");
163 				os_free(prot);
164 				os_free(buf);
165 				return NULL;
166 			}
167 		}
168 	}
169 
170 	wpa_hexdump(MSG_MSGDUMP, "S1G BIP-CMAC AAD|Body(masked)", buf, buf_len);
171 
172 	/* MIC = L(AES-128-CMAC(AAD || Frame Body), 0, 64) */
173 	if (omac1_aes_128(igtk, buf, buf_len, mic) < 0) {
174 		os_free(prot);
175 		os_free(buf);
176 		return NULL;
177 	}
178 	os_free(buf);
179 
180 	os_memcpy(pos, mic, mic_len);
181 	wpa_hexdump(MSG_DEBUG, "S1G BIP-CMAC MIC", pos, mic_len);
182 
183 	*prot_len = plen;
184 	return prot;
185 }
186 
187 
bip_gmac_protect(const u8 * igtk,size_t igtk_len,u8 * frame,size_t len,u8 * ipn,int keyid,size_t * prot_len)188 u8 * bip_gmac_protect(const u8 *igtk, size_t igtk_len, u8 *frame, size_t len,
189 		      u8 *ipn, int keyid, size_t *prot_len)
190 {
191 	u8 *prot, *pos, *buf;
192 	u16 fc;
193 	struct ieee80211_hdr *hdr;
194 	size_t plen;
195 	u8 nonce[12], *npos;
196 
197 	plen = len + 26;
198 	prot = os_malloc(plen);
199 	if (prot == NULL)
200 		return NULL;
201 	os_memcpy(prot, frame, len);
202 	pos = prot + len;
203 	*pos++ = WLAN_EID_MMIE;
204 	*pos++ = 24;
205 	WPA_PUT_LE16(pos, keyid);
206 	pos += 2;
207 	os_memcpy(pos, ipn, 6);
208 	pos += 6;
209 	os_memset(pos, 0, 16); /* MIC */
210 
211 	buf = os_malloc(plen + 20 - 24);
212 	if (buf == NULL) {
213 		os_free(prot);
214 		return NULL;
215 	}
216 
217 	/* BIP AAD: FC(masked) A1 A2 A3 */
218 	hdr = (struct ieee80211_hdr *) frame;
219 	fc = le_to_host16(hdr->frame_control);
220 	fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
221 	WPA_PUT_LE16(buf, fc);
222 	os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
223 	os_memcpy(buf + 20, prot + 24, plen - 24);
224 	wpa_hexdump(MSG_MSGDUMP, "BIP-GMAC: AAD|Body(masked)",
225 		    buf, plen + 20 - 24);
226 
227 	/* Nonce: A2 | IPN */
228 	os_memcpy(nonce, hdr->addr2, ETH_ALEN);
229 	npos = nonce + ETH_ALEN;
230 	*npos++ = ipn[5];
231 	*npos++ = ipn[4];
232 	*npos++ = ipn[3];
233 	*npos++ = ipn[2];
234 	*npos++ = ipn[1];
235 	*npos++ = ipn[0];
236 	wpa_hexdump(MSG_EXCESSIVE, "BIP-GMAC: Nonce", nonce, sizeof(nonce));
237 
238 	/* MIC = AES-GMAC(AAD || Frame Body(masked)) */
239 	if (aes_gmac(igtk, igtk_len, nonce, sizeof(nonce),
240 		     buf, plen + 20 - 24, pos) < 0) {
241 		os_free(prot);
242 		os_free(buf);
243 		return NULL;
244 	}
245 	os_free(buf);
246 
247 	wpa_hexdump(MSG_DEBUG, "BIP-GMAC MMIE MIC", pos, 16);
248 
249 	*prot_len = plen;
250 	return prot;
251 }
252 
253 
bip_gmac_protect_s1g_beacon(const u8 * igtk,size_t igtk_len,const u8 * frame,size_t len,const u8 * ipn,int keyid,bool bce,size_t * prot_len)254 u8 * bip_gmac_protect_s1g_beacon(const u8 *igtk, size_t igtk_len,
255 				 const u8 *frame, size_t len, const u8 *ipn,
256 				 int keyid, bool bce, size_t *prot_len)
257 {
258 	u8 *prot, *pos, *buf;
259 	u16 fc;
260 	struct ieee80211_hdr_s1g_beacon *hdr;
261 	struct ieee80211_s1g_beacon_compat *bc;
262 	size_t plen, mic_len, element_len, buf_len;
263 	size_t hdr_add_len = 0, bce_add_len = 0;
264 	u8 nonce[12], *npos;
265 
266 	mic_len = 16;
267 	if (bce)
268 		element_len = MIC_ELEM_LEN_LESS_MIC + mic_len;
269 	else
270 		element_len = MME_LEN_LESS_MIC + mic_len;
271 
272 	plen = len + element_len; /* add element length */
273 	prot = os_malloc(plen);
274 	if (!prot)
275 		return NULL;
276 	os_memcpy(prot, frame, len);
277 	pos = prot + len;
278 	/* Add MME/MIC element to the end of the frame */
279 	if (bce) {
280 		bce_add_len = 6;
281 		*pos++ = WLAN_EID_MIC; /* Element ID */
282 		*pos++ = element_len - 2; /* Length field */
283 	} else {
284 		*pos++ = WLAN_EID_MMIE; /* Element ID */
285 		*pos++ = element_len - 2; /* Length field */
286 		WPA_PUT_LE16(pos, keyid); /* KeyID */
287 		pos += 2;
288 		os_memcpy(pos, ipn, 6); /* BIPN */
289 		pos += 6;
290 	}
291 	os_memset(pos, 0, mic_len); /* MIC */
292 
293 	 /* Duration (2) and Timestamp (4) are omitted from AAD,
294 	  * BIPN (6) is added if BCE is used */
295 	buf_len = plen - 6 + bce_add_len;
296 	buf = os_malloc(buf_len);
297 	if (!buf) {
298 		os_free(prot);
299 		return NULL;
300 	}
301 
302 	/* BIP AAD: FC SA ChangeSeq NextTBTT(if present)
303 	 * CompressedSSID(if present) ANO(if present) */
304 	hdr = (struct ieee80211_hdr_s1g_beacon *) frame;
305 	fc = le_to_host16(hdr->frame_control);
306 	if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_EXT ||
307 	    WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_S1G_BEACON) {
308 		wpa_printf(MSG_ERROR, "Frame is not an S1G Beacon");
309 		os_free(prot);
310 		os_free(buf);
311 		return NULL;
312 	}
313 
314 	WPA_PUT_LE16(buf, fc);
315 	os_memcpy(buf + 2, hdr->sa, ETH_ALEN);
316 	os_memcpy(buf + 8, hdr->change_seq, 1);
317 	if (fc & WLAN_FC_S1G_BEACON_NEXT_TBTT)
318 		hdr_add_len += 3;
319 	if (fc & WLAN_FC_S1G_BEACON_COMP_SSID)
320 		hdr_add_len += 4;
321 	if (fc & WLAN_FC_S1G_BEACON_ANO)
322 		hdr_add_len++;
323 	os_memcpy(buf + 9, prot + IEEE80211_HDRLEN_S1G_BEACON, hdr_add_len);
324 	if (bce)
325 		os_memcpy(buf + 9 + hdr_add_len, ipn, bce_add_len);
326 	os_memcpy(buf + 9 + hdr_add_len + bce_add_len,
327 		  prot + IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len,
328 		  plen - (IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len));
329 	/* The S1G Beacon Compatibility element, when present, is the first
330 	 * element in the S1G Beacon frame body */
331 	if (len >= IEEE80211_HDRLEN_S1G_BEACON + hdr_add_len +
332 	    sizeof(struct ieee80211_s1g_beacon_compat)) {
333 		bc = (struct ieee80211_s1g_beacon_compat *)
334 			(buf + 9 + hdr_add_len + bce_add_len);
335 		if (bc->element_id == WLAN_EID_S1G_BCN_COMPAT) {
336 			wpa_printf(MSG_DEBUG,
337 				   "S1G Beacon Compatibility element found, masking TSF Completion field");
338 			os_memset(&bc->tsf_completion, 0,
339 				  sizeof(bc->tsf_completion));
340 			if (bce && keyid - 6 != (bc->compat_info & 0x80) >> 7) {
341 				wpa_printf(MSG_ERROR,
342 					   "Key ID does not match BIGTK Key ID Index in S1G Beacon Compatibility element");
343 				os_free(prot);
344 				os_free(buf);
345 				return NULL;
346 			}
347 		}
348 	}
349 	wpa_hexdump(MSG_MSGDUMP, "S1G BIP-GMAC AAD|Body(masked)", buf, buf_len);
350 
351 	/* Nonce: SA | IPN */
352 	os_memcpy(nonce, hdr->sa, ETH_ALEN);
353 	npos = nonce + ETH_ALEN;
354 	*npos++ = ipn[5];
355 	*npos++ = ipn[4];
356 	*npos++ = ipn[3];
357 	*npos++ = ipn[2];
358 	*npos++ = ipn[1];
359 	*npos++ = ipn[0];
360 	wpa_hexdump(MSG_EXCESSIVE, "S1G BIP-GMAC Nonce", nonce, sizeof(nonce));
361 
362 	/* MIC = AES-GMAC(AAD || Frame Body) */
363 	if (aes_gmac(igtk, igtk_len, nonce, sizeof(nonce), buf, buf_len, pos) <
364 	    0) {
365 		os_free(prot);
366 		os_free(buf);
367 		return NULL;
368 	}
369 	os_free(buf);
370 
371 	wpa_hexdump(MSG_DEBUG, "S1G BIP-GMAC MIC", pos, 16);
372 
373 	*prot_len = plen;
374 	return prot;
375 }
376