1 /*
2 * WPA/RSN - Shared functions for supplicant and authenticator
3 * Copyright (c) 2002-2018, Jouni Malinen <[email protected]>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "crypto/md5.h"
13 #include "crypto/sha1.h"
14 #include "crypto/sha256.h"
15 #include "crypto/sha384.h"
16 #include "crypto/sha512.h"
17 #include "crypto/aes_wrap.h"
18 #include "crypto/crypto.h"
19 #include "ieee802_11_defs.h"
20 #include "ieee802_11_common.h"
21 #include "defs.h"
22 #include "wpa_common.h"
23
24
wpa_kck_len(int akmp,size_t pmk_len)25 static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
26 {
27 switch (akmp) {
28 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
29 case WPA_KEY_MGMT_IEEE8021X_SHA384:
30 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
31 return 24;
32 case WPA_KEY_MGMT_FILS_SHA256:
33 case WPA_KEY_MGMT_FT_FILS_SHA256:
34 case WPA_KEY_MGMT_FILS_SHA384:
35 case WPA_KEY_MGMT_FT_FILS_SHA384:
36 return 0;
37 case WPA_KEY_MGMT_DPP:
38 return pmk_len / 2;
39 case WPA_KEY_MGMT_OWE:
40 return pmk_len / 2;
41 case WPA_KEY_MGMT_SAE_EXT_KEY:
42 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
43 return pmk_len / 2;
44 default:
45 return 16;
46 }
47 }
48
49
50 #ifdef CONFIG_IEEE80211R
wpa_kck2_len(int akmp)51 static unsigned int wpa_kck2_len(int akmp)
52 {
53 switch (akmp) {
54 case WPA_KEY_MGMT_FT_FILS_SHA256:
55 return 16;
56 case WPA_KEY_MGMT_FT_FILS_SHA384:
57 return 24;
58 default:
59 return 0;
60 }
61 }
62 #endif /* CONFIG_IEEE80211R */
63
64
wpa_kek_len(int akmp,size_t pmk_len)65 static unsigned int wpa_kek_len(int akmp, size_t pmk_len)
66 {
67 switch (akmp) {
68 case WPA_KEY_MGMT_FILS_SHA384:
69 case WPA_KEY_MGMT_FT_FILS_SHA384:
70 return 64;
71 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
72 case WPA_KEY_MGMT_FILS_SHA256:
73 case WPA_KEY_MGMT_FT_FILS_SHA256:
74 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
75 case WPA_KEY_MGMT_IEEE8021X_SHA384:
76 return 32;
77 case WPA_KEY_MGMT_DPP:
78 return pmk_len <= 32 ? 16 : 32;
79 case WPA_KEY_MGMT_OWE:
80 return pmk_len <= 32 ? 16 : 32;
81 case WPA_KEY_MGMT_SAE_EXT_KEY:
82 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
83 return pmk_len <= 32 ? 16 : 32;
84 default:
85 return 16;
86 }
87 }
88
89
90 #ifdef CONFIG_IEEE80211R
wpa_kek2_len(int akmp)91 static unsigned int wpa_kek2_len(int akmp)
92 {
93 switch (akmp) {
94 case WPA_KEY_MGMT_FT_FILS_SHA256:
95 return 16;
96 case WPA_KEY_MGMT_FT_FILS_SHA384:
97 return 32;
98 default:
99 return 0;
100 }
101 }
102 #endif /* CONFIG_IEEE80211R */
103
104
wpa_mic_len(int akmp,size_t pmk_len)105 unsigned int wpa_mic_len(int akmp, size_t pmk_len)
106 {
107 switch (akmp) {
108 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
109 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
110 case WPA_KEY_MGMT_IEEE8021X_SHA384:
111 return 24;
112 case WPA_KEY_MGMT_FILS_SHA256:
113 case WPA_KEY_MGMT_FILS_SHA384:
114 case WPA_KEY_MGMT_FT_FILS_SHA256:
115 case WPA_KEY_MGMT_FT_FILS_SHA384:
116 return 0;
117 case WPA_KEY_MGMT_DPP:
118 return pmk_len / 2;
119 case WPA_KEY_MGMT_OWE:
120 return pmk_len / 2;
121 case WPA_KEY_MGMT_SAE_EXT_KEY:
122 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
123 return pmk_len / 2;
124 default:
125 return 16;
126 }
127 }
128
129
130 /**
131 * wpa_use_akm_defined - Is AKM-defined Key Descriptor Version used
132 * @akmp: WPA_KEY_MGMT_* used in key derivation
133 * Returns: 1 if AKM-defined Key Descriptor Version is used; 0 otherwise
134 */
wpa_use_akm_defined(int akmp)135 int wpa_use_akm_defined(int akmp)
136 {
137 return akmp == WPA_KEY_MGMT_OSEN ||
138 akmp == WPA_KEY_MGMT_OWE ||
139 akmp == WPA_KEY_MGMT_DPP ||
140 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
141 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
142 wpa_key_mgmt_sae(akmp) ||
143 wpa_key_mgmt_suite_b(akmp) ||
144 wpa_key_mgmt_fils(akmp);
145 }
146
147
148 /**
149 * wpa_use_cmac - Is CMAC integrity algorithm used for EAPOL-Key MIC
150 * @akmp: WPA_KEY_MGMT_* used in key derivation
151 * Returns: 1 if CMAC is used; 0 otherwise
152 */
wpa_use_cmac(int akmp)153 int wpa_use_cmac(int akmp)
154 {
155 return akmp == WPA_KEY_MGMT_OSEN ||
156 akmp == WPA_KEY_MGMT_OWE ||
157 akmp == WPA_KEY_MGMT_DPP ||
158 wpa_key_mgmt_ft(akmp) ||
159 wpa_key_mgmt_sha256(akmp) ||
160 (wpa_key_mgmt_sae(akmp) &&
161 !wpa_key_mgmt_sae_ext_key(akmp)) ||
162 wpa_key_mgmt_suite_b(akmp);
163 }
164
165
166 /**
167 * wpa_use_aes_key_wrap - Is AES Keywrap algorithm used for EAPOL-Key Key Data
168 * @akmp: WPA_KEY_MGMT_* used in key derivation
169 * Returns: 1 if AES Keywrap is used; 0 otherwise
170 *
171 * Note: AKM 00-0F-AC:1 and 00-0F-AC:2 have special rules for selecting whether
172 * to use AES Keywrap based on the negotiated pairwise cipher. This function
173 * does not cover those special cases.
174 */
wpa_use_aes_key_wrap(int akmp)175 int wpa_use_aes_key_wrap(int akmp)
176 {
177 return akmp == WPA_KEY_MGMT_OSEN ||
178 akmp == WPA_KEY_MGMT_OWE ||
179 akmp == WPA_KEY_MGMT_DPP ||
180 akmp == WPA_KEY_MGMT_IEEE8021X_SHA384 ||
181 wpa_key_mgmt_ft(akmp) ||
182 wpa_key_mgmt_sha256(akmp) ||
183 wpa_key_mgmt_sae(akmp) ||
184 wpa_key_mgmt_suite_b(akmp);
185 }
186
187
188 /**
189 * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
190 * @key: EAPOL-Key Key Confirmation Key (KCK)
191 * @key_len: KCK length in octets
192 * @akmp: WPA_KEY_MGMT_* used in key derivation
193 * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
194 * @buf: Pointer to the beginning of the EAPOL header (version field)
195 * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
196 * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
197 * Returns: 0 on success, -1 on failure
198 *
199 * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
200 * to be cleared (all zeroes) when calling this function.
201 *
202 * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
203 * description of the Key MIC calculation. It includes packet data from the
204 * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
205 * happened during final editing of the standard and the correct behavior is
206 * defined in the last draft (IEEE 802.11i/D10).
207 */
wpa_eapol_key_mic(const u8 * key,size_t key_len,int akmp,int ver,const u8 * buf,size_t len,u8 * mic)208 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
209 const u8 *buf, size_t len, u8 *mic)
210 {
211 u8 hash[SHA512_MAC_LEN];
212
213 if (key_len == 0) {
214 wpa_printf(MSG_DEBUG,
215 "WPA: KCK not set - cannot calculate MIC");
216 return -1;
217 }
218
219 switch (ver) {
220 #ifndef CONFIG_FIPS
221 case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
222 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-MD5");
223 return hmac_md5(key, key_len, buf, len, mic);
224 #endif /* CONFIG_FIPS */
225 case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
226 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-SHA1");
227 if (hmac_sha1(key, key_len, buf, len, hash))
228 return -1;
229 os_memcpy(mic, hash, MD5_MAC_LEN);
230 break;
231 case WPA_KEY_INFO_TYPE_AES_128_CMAC:
232 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using AES-CMAC");
233 return omac1_aes_128(key, buf, len, mic);
234 case WPA_KEY_INFO_TYPE_AKM_DEFINED:
235 switch (akmp) {
236 #ifdef CONFIG_SAE
237 case WPA_KEY_MGMT_SAE:
238 case WPA_KEY_MGMT_FT_SAE:
239 wpa_printf(MSG_DEBUG,
240 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - SAE)");
241 return omac1_aes_128(key, buf, len, mic);
242 case WPA_KEY_MGMT_SAE_EXT_KEY:
243 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
244 wpa_printf(MSG_DEBUG,
245 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - SAE-EXT-KEY)",
246 (unsigned int) key_len * 8 * 2);
247 if (key_len == 128 / 8) {
248 if (hmac_sha256(key, key_len, buf, len, hash))
249 return -1;
250 #ifdef CONFIG_SHA384
251 } else if (key_len == 192 / 8) {
252 if (hmac_sha384(key, key_len, buf, len, hash))
253 return -1;
254 #endif /* CONFIG_SHA384 */
255 #ifdef CONFIG_SHA512
256 } else if (key_len == 256 / 8) {
257 if (hmac_sha512(key, key_len, buf, len, hash))
258 return -1;
259 #endif /* CONFIG_SHA512 */
260 } else {
261 wpa_printf(MSG_INFO,
262 "SAE: Unsupported KCK length: %u",
263 (unsigned int) key_len);
264 return -1;
265 }
266 os_memcpy(mic, hash, key_len);
267 break;
268 #endif /* CONFIG_SAE */
269 #ifdef CONFIG_HS20
270 case WPA_KEY_MGMT_OSEN:
271 wpa_printf(MSG_DEBUG,
272 "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - OSEN)");
273 return omac1_aes_128(key, buf, len, mic);
274 #endif /* CONFIG_HS20 */
275 #ifdef CONFIG_SUITEB
276 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
277 wpa_printf(MSG_DEBUG,
278 "WPA: EAPOL-Key MIC using HMAC-SHA256 (AKM-defined - Suite B)");
279 if (hmac_sha256(key, key_len, buf, len, hash))
280 return -1;
281 os_memcpy(mic, hash, MD5_MAC_LEN);
282 break;
283 #endif /* CONFIG_SUITEB */
284 #ifdef CONFIG_SUITEB192
285 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
286 wpa_printf(MSG_DEBUG,
287 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - Suite B 192-bit)");
288 if (hmac_sha384(key, key_len, buf, len, hash))
289 return -1;
290 os_memcpy(mic, hash, 24);
291 break;
292 #endif /* CONFIG_SUITEB192 */
293 #ifdef CONFIG_OWE
294 case WPA_KEY_MGMT_OWE:
295 wpa_printf(MSG_DEBUG,
296 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - OWE)",
297 (unsigned int) key_len * 8 * 2);
298 if (key_len == 128 / 8) {
299 if (hmac_sha256(key, key_len, buf, len, hash))
300 return -1;
301 } else if (key_len == 192 / 8) {
302 if (hmac_sha384(key, key_len, buf, len, hash))
303 return -1;
304 } else if (key_len == 256 / 8) {
305 if (hmac_sha512(key, key_len, buf, len, hash))
306 return -1;
307 } else {
308 wpa_printf(MSG_INFO,
309 "OWE: Unsupported KCK length: %u",
310 (unsigned int) key_len);
311 return -1;
312 }
313 os_memcpy(mic, hash, key_len);
314 break;
315 #endif /* CONFIG_OWE */
316 #ifdef CONFIG_DPP
317 case WPA_KEY_MGMT_DPP:
318 wpa_printf(MSG_DEBUG,
319 "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - DPP)",
320 (unsigned int) key_len * 8 * 2);
321 if (key_len == 128 / 8) {
322 if (hmac_sha256(key, key_len, buf, len, hash))
323 return -1;
324 } else if (key_len == 192 / 8) {
325 if (hmac_sha384(key, key_len, buf, len, hash))
326 return -1;
327 } else if (key_len == 256 / 8) {
328 if (hmac_sha512(key, key_len, buf, len, hash))
329 return -1;
330 } else {
331 wpa_printf(MSG_INFO,
332 "DPP: Unsupported KCK length: %u",
333 (unsigned int) key_len);
334 return -1;
335 }
336 os_memcpy(mic, hash, key_len);
337 break;
338 #endif /* CONFIG_DPP */
339 #ifdef CONFIG_SHA384
340 case WPA_KEY_MGMT_IEEE8021X_SHA384:
341 #ifdef CONFIG_IEEE80211R
342 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
343 #endif /* CONFIG_IEEE80211R */
344 wpa_printf(MSG_DEBUG,
345 "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - 802.1X SHA384)");
346 if (hmac_sha384(key, key_len, buf, len, hash))
347 return -1;
348 os_memcpy(mic, hash, 24);
349 break;
350 #endif /* CONFIG_SHA384 */
351 default:
352 wpa_printf(MSG_DEBUG,
353 "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
354 akmp);
355 return -1;
356 }
357 break;
358 default:
359 wpa_printf(MSG_DEBUG,
360 "WPA: EAPOL-Key MIC algorithm not known (ver=%d)",
361 ver);
362 return -1;
363 }
364
365 return 0;
366 }
367
368
369 /**
370 * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
371 * @pmk: Pairwise master key
372 * @pmk_len: Length of PMK
373 * @label: Label to use in derivation
374 * @addr1: AA or SA
375 * @addr2: SA or AA
376 * @nonce1: ANonce or SNonce
377 * @nonce2: SNonce or ANonce
378 * @ptk: Buffer for pairwise transient key
379 * @akmp: Negotiated AKM
380 * @cipher: Negotiated pairwise cipher
381 * @kdk_len: The length in octets that should be derived for KDK
382 * Returns: 0 on success, -1 on failure
383 *
384 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
385 * PTK = PRF-X(PMK, "Pairwise key expansion",
386 * Min(AA, SA) || Max(AA, SA) ||
387 * Min(ANonce, SNonce) || Max(ANonce, SNonce)
388 * [ || Z.x ])
389 *
390 * The optional Z.x component is used only with DPP and that part is not defined
391 * in IEEE 802.11.
392 */
wpa_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const char * label,const u8 * addr1,const u8 * addr2,const u8 * nonce1,const u8 * nonce2,struct wpa_ptk * ptk,int akmp,int cipher,const u8 * z,size_t z_len,size_t kdk_len)393 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
394 const u8 *addr1, const u8 *addr2,
395 const u8 *nonce1, const u8 *nonce2,
396 struct wpa_ptk *ptk, int akmp, int cipher,
397 const u8 *z, size_t z_len, size_t kdk_len)
398 {
399 #define MAX_Z_LEN 66 /* with NIST P-521 */
400 u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN + MAX_Z_LEN];
401 size_t data_len = 2 * ETH_ALEN + 2 * WPA_NONCE_LEN;
402 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
403 WPA_KDK_MAX_LEN];
404 size_t ptk_len;
405 #ifdef CONFIG_OWE
406 int owe_ptk_workaround = 0;
407
408 if (akmp == (WPA_KEY_MGMT_OWE | WPA_KEY_MGMT_PSK_SHA256)) {
409 owe_ptk_workaround = 1;
410 akmp = WPA_KEY_MGMT_OWE;
411 }
412 #endif /* CONFIG_OWE */
413
414 if (pmk_len == 0) {
415 wpa_printf(MSG_ERROR, "WPA: No PMK set for PTK derivation");
416 return -1;
417 }
418
419 if (z_len > MAX_Z_LEN)
420 return -1;
421
422 if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
423 os_memcpy(data, addr1, ETH_ALEN);
424 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
425 } else {
426 os_memcpy(data, addr2, ETH_ALEN);
427 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
428 }
429
430 if (os_memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
431 os_memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
432 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
433 WPA_NONCE_LEN);
434 } else {
435 os_memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
436 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
437 WPA_NONCE_LEN);
438 }
439
440 if (z && z_len) {
441 os_memcpy(data + 2 * ETH_ALEN + 2 * WPA_NONCE_LEN, z, z_len);
442 data_len += z_len;
443 }
444
445 if (kdk_len > WPA_KDK_MAX_LEN) {
446 wpa_printf(MSG_ERROR,
447 "WPA: KDK len=%zu exceeds max supported len",
448 kdk_len);
449 return -1;
450 }
451
452 ptk->kck_len = wpa_kck_len(akmp, pmk_len);
453 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
454 ptk->tk_len = wpa_cipher_key_len(cipher);
455 ptk->kdk_len = kdk_len;
456 if (ptk->tk_len == 0) {
457 wpa_printf(MSG_ERROR,
458 "WPA: Unsupported cipher (0x%x) used in PTK derivation",
459 cipher);
460 return -1;
461 }
462 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len + ptk->kdk_len;
463
464 if (wpa_key_mgmt_sha384(akmp)) {
465 #ifdef CONFIG_SHA384
466 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
467 if (sha384_prf(pmk, pmk_len, label, data, data_len,
468 tmp, ptk_len) < 0)
469 return -1;
470 #else /* CONFIG_SHA384 */
471 return -1;
472 #endif /* CONFIG_SHA384 */
473 } else if (wpa_key_mgmt_sha256(akmp)) {
474 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
475 if (sha256_prf(pmk, pmk_len, label, data, data_len,
476 tmp, ptk_len) < 0)
477 return -1;
478 #ifdef CONFIG_OWE
479 } else if (akmp == WPA_KEY_MGMT_OWE && (pmk_len == 32 ||
480 owe_ptk_workaround)) {
481 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
482 if (sha256_prf(pmk, pmk_len, label, data, data_len,
483 tmp, ptk_len) < 0)
484 return -1;
485 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 48) {
486 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
487 if (sha384_prf(pmk, pmk_len, label, data, data_len,
488 tmp, ptk_len) < 0)
489 return -1;
490 } else if (akmp == WPA_KEY_MGMT_OWE && pmk_len == 64) {
491 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
492 if (sha512_prf(pmk, pmk_len, label, data, data_len,
493 tmp, ptk_len) < 0)
494 return -1;
495 } else if (akmp == WPA_KEY_MGMT_OWE) {
496 wpa_printf(MSG_INFO, "OWE: Unknown PMK length %u",
497 (unsigned int) pmk_len);
498 return -1;
499 #endif /* CONFIG_OWE */
500 #ifdef CONFIG_DPP
501 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 32) {
502 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
503 if (sha256_prf(pmk, pmk_len, label, data, data_len,
504 tmp, ptk_len) < 0)
505 return -1;
506 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 48) {
507 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
508 if (sha384_prf(pmk, pmk_len, label, data, data_len,
509 tmp, ptk_len) < 0)
510 return -1;
511 } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 64) {
512 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
513 if (sha512_prf(pmk, pmk_len, label, data, data_len,
514 tmp, ptk_len) < 0)
515 return -1;
516 } else if (akmp == WPA_KEY_MGMT_DPP) {
517 wpa_printf(MSG_INFO, "DPP: Unknown PMK length %u",
518 (unsigned int) pmk_len);
519 return -1;
520 #endif /* CONFIG_DPP */
521 #ifdef CONFIG_SAE
522 } else if (wpa_key_mgmt_sae_ext_key(akmp)) {
523 if (pmk_len == 32) {
524 wpa_printf(MSG_DEBUG,
525 "SAE: PTK derivation using PRF(SHA256)");
526 if (sha256_prf(pmk, pmk_len, label, data, data_len,
527 tmp, ptk_len) < 0)
528 return -1;
529 #ifdef CONFIG_SHA384
530 } else if (pmk_len == 48) {
531 wpa_printf(MSG_DEBUG,
532 "SAE: PTK derivation using PRF(SHA384)");
533 if (sha384_prf(pmk, pmk_len, label, data, data_len,
534 tmp, ptk_len) < 0)
535 return -1;
536 #endif /* CONFIG_SHA384 */
537 #ifdef CONFIG_SHA512
538 } else if (pmk_len == 64) {
539 wpa_printf(MSG_DEBUG,
540 "SAE: PTK derivation using PRF(SHA512)");
541 if (sha512_prf(pmk, pmk_len, label, data, data_len,
542 tmp, ptk_len) < 0)
543 return -1;
544 #endif /* CONFIG_SHA512 */
545 } else {
546 wpa_printf(MSG_INFO, "SAE: Unknown PMK length %u",
547 (unsigned int) pmk_len);
548 return -1;
549 }
550 #endif /* CONFIG_SAE */
551 } else {
552 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA1)");
553 if (sha1_prf(pmk, pmk_len, label, data, data_len, tmp,
554 ptk_len) < 0)
555 return -1;
556 }
557
558 wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR,
559 MAC2STR(addr1), MAC2STR(addr2));
560 wpa_hexdump(MSG_DEBUG, "WPA: Nonce1", nonce1, WPA_NONCE_LEN);
561 wpa_hexdump(MSG_DEBUG, "WPA: Nonce2", nonce2, WPA_NONCE_LEN);
562 if (z && z_len)
563 wpa_hexdump_key(MSG_DEBUG, "WPA: Z.x", z, z_len);
564 wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
565 wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
566
567 os_memcpy(ptk->kck, tmp, ptk->kck_len);
568 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
569
570 os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
571 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
572
573 os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
574 wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
575
576 if (kdk_len) {
577 os_memcpy(ptk->kdk, tmp + ptk->kck_len + ptk->kek_len +
578 ptk->tk_len, ptk->kdk_len);
579 wpa_hexdump_key(MSG_DEBUG, "WPA: KDK", ptk->kdk, ptk->kdk_len);
580 }
581
582 ptk->kek2_len = 0;
583 ptk->kck2_len = 0;
584
585 os_memset(tmp, 0, sizeof(tmp));
586 os_memset(data, 0, data_len);
587 return 0;
588 }
589
590 #ifdef CONFIG_FILS
591
fils_rmsk_to_pmk(int akmp,const u8 * rmsk,size_t rmsk_len,const u8 * snonce,const u8 * anonce,const u8 * dh_ss,size_t dh_ss_len,u8 * pmk,size_t * pmk_len)592 int fils_rmsk_to_pmk(int akmp, const u8 *rmsk, size_t rmsk_len,
593 const u8 *snonce, const u8 *anonce, const u8 *dh_ss,
594 size_t dh_ss_len, u8 *pmk, size_t *pmk_len)
595 {
596 u8 nonces[2 * FILS_NONCE_LEN];
597 const u8 *addr[2];
598 size_t len[2];
599 size_t num_elem;
600 int res;
601
602 /* PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ]) */
603 wpa_printf(MSG_DEBUG, "FILS: rMSK to PMK derivation");
604
605 if (wpa_key_mgmt_sha384(akmp))
606 *pmk_len = SHA384_MAC_LEN;
607 else if (wpa_key_mgmt_sha256(akmp))
608 *pmk_len = SHA256_MAC_LEN;
609 else
610 return -1;
611
612 wpa_hexdump_key(MSG_DEBUG, "FILS: rMSK", rmsk, rmsk_len);
613 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
614 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
615 wpa_hexdump(MSG_DEBUG, "FILS: DHss", dh_ss, dh_ss_len);
616
617 os_memcpy(nonces, snonce, FILS_NONCE_LEN);
618 os_memcpy(&nonces[FILS_NONCE_LEN], anonce, FILS_NONCE_LEN);
619 addr[0] = rmsk;
620 len[0] = rmsk_len;
621 num_elem = 1;
622 if (dh_ss) {
623 addr[1] = dh_ss;
624 len[1] = dh_ss_len;
625 num_elem++;
626 }
627 if (wpa_key_mgmt_sha384(akmp))
628 res = hmac_sha384_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
629 addr, len, pmk);
630 else
631 res = hmac_sha256_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
632 addr, len, pmk);
633 if (res == 0)
634 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, *pmk_len);
635 else
636 *pmk_len = 0;
637 return res;
638 }
639
640
fils_pmkid_erp(int akmp,const u8 * reauth,size_t reauth_len,u8 * pmkid)641 int fils_pmkid_erp(int akmp, const u8 *reauth, size_t reauth_len,
642 u8 *pmkid)
643 {
644 const u8 *addr[1];
645 size_t len[1];
646 u8 hash[SHA384_MAC_LEN];
647 int res;
648
649 /* PMKID = Truncate-128(Hash(EAP-Initiate/Reauth)) */
650 addr[0] = reauth;
651 len[0] = reauth_len;
652 if (wpa_key_mgmt_sha384(akmp))
653 res = sha384_vector(1, addr, len, hash);
654 else if (wpa_key_mgmt_sha256(akmp))
655 res = sha256_vector(1, addr, len, hash);
656 else
657 return -1;
658 if (res)
659 return res;
660 os_memcpy(pmkid, hash, PMKID_LEN);
661 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
662 return 0;
663 }
664
665
fils_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * aa,const u8 * snonce,const u8 * anonce,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,u8 * ick,size_t * ick_len,int akmp,int cipher,u8 * fils_ft,size_t * fils_ft_len,size_t kdk_len)666 int fils_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa, const u8 *aa,
667 const u8 *snonce, const u8 *anonce, const u8 *dhss,
668 size_t dhss_len, struct wpa_ptk *ptk,
669 u8 *ick, size_t *ick_len, int akmp, int cipher,
670 u8 *fils_ft, size_t *fils_ft_len, size_t kdk_len)
671 {
672 u8 *data, *pos;
673 size_t data_len;
674 u8 tmp[FILS_ICK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
675 FILS_FT_MAX_LEN + WPA_KDK_MAX_LEN];
676 size_t key_data_len;
677 const char *label = "FILS PTK Derivation";
678 int ret = -1;
679 size_t offset;
680
681 /*
682 * FILS-Key-Data = PRF-X(PMK, "FILS PTK Derivation",
683 * SPA || AA || SNonce || ANonce [ || DHss ])
684 * ICK = L(FILS-Key-Data, 0, ICK_bits)
685 * KEK = L(FILS-Key-Data, ICK_bits, KEK_bits)
686 * TK = L(FILS-Key-Data, ICK_bits + KEK_bits, TK_bits)
687 * If doing FT initial mobility domain association:
688 * FILS-FT = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits,
689 * FILS-FT_bits)
690 * When a KDK is derived:
691 * KDK = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits + FILS-FT_bits,
692 * KDK_bits)
693 */
694 data_len = 2 * ETH_ALEN + 2 * FILS_NONCE_LEN + dhss_len;
695 data = os_malloc(data_len);
696 if (!data)
697 goto err;
698 pos = data;
699 os_memcpy(pos, spa, ETH_ALEN);
700 pos += ETH_ALEN;
701 os_memcpy(pos, aa, ETH_ALEN);
702 pos += ETH_ALEN;
703 os_memcpy(pos, snonce, FILS_NONCE_LEN);
704 pos += FILS_NONCE_LEN;
705 os_memcpy(pos, anonce, FILS_NONCE_LEN);
706 pos += FILS_NONCE_LEN;
707 if (dhss)
708 os_memcpy(pos, dhss, dhss_len);
709
710 ptk->kck_len = 0;
711 ptk->kek_len = wpa_kek_len(akmp, pmk_len);
712 ptk->tk_len = wpa_cipher_key_len(cipher);
713 if (wpa_key_mgmt_sha384(akmp))
714 *ick_len = 48;
715 else if (wpa_key_mgmt_sha256(akmp))
716 *ick_len = 32;
717 else
718 goto err;
719 key_data_len = *ick_len + ptk->kek_len + ptk->tk_len;
720
721 if (kdk_len) {
722 if (kdk_len > WPA_KDK_MAX_LEN) {
723 wpa_printf(MSG_ERROR, "FILS: KDK len=%zu too big",
724 kdk_len);
725 goto err;
726 }
727
728 ptk->kdk_len = kdk_len;
729 key_data_len += kdk_len;
730 } else {
731 ptk->kdk_len = 0;
732 }
733
734 if (fils_ft && fils_ft_len) {
735 if (akmp == WPA_KEY_MGMT_FT_FILS_SHA256) {
736 *fils_ft_len = 32;
737 } else if (akmp == WPA_KEY_MGMT_FT_FILS_SHA384) {
738 *fils_ft_len = 48;
739 } else {
740 *fils_ft_len = 0;
741 fils_ft = NULL;
742 }
743 key_data_len += *fils_ft_len;
744 }
745
746 if (wpa_key_mgmt_sha384(akmp)) {
747 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA384)");
748 if (sha384_prf(pmk, pmk_len, label, data, data_len,
749 tmp, key_data_len) < 0)
750 goto err;
751 } else {
752 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA256)");
753 if (sha256_prf(pmk, pmk_len, label, data, data_len,
754 tmp, key_data_len) < 0)
755 goto err;
756 }
757
758 wpa_printf(MSG_DEBUG, "FILS: PTK derivation - SPA=" MACSTR
759 " AA=" MACSTR, MAC2STR(spa), MAC2STR(aa));
760 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
761 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
762 if (dhss)
763 wpa_hexdump_key(MSG_DEBUG, "FILS: DHss", dhss, dhss_len);
764 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, pmk_len);
765 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-Key-Data", tmp, key_data_len);
766
767 os_memcpy(ick, tmp, *ick_len);
768 offset = *ick_len;
769 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, *ick_len);
770
771 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
772 wpa_hexdump_key(MSG_DEBUG, "FILS: KEK", ptk->kek, ptk->kek_len);
773 offset += ptk->kek_len;
774
775 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
776 wpa_hexdump_key(MSG_DEBUG, "FILS: TK", ptk->tk, ptk->tk_len);
777 offset += ptk->tk_len;
778
779 if (fils_ft && fils_ft_len) {
780 os_memcpy(fils_ft, tmp + offset, *fils_ft_len);
781 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-FT",
782 fils_ft, *fils_ft_len);
783 offset += *fils_ft_len;
784 }
785
786 if (ptk->kdk_len) {
787 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
788 wpa_hexdump_key(MSG_DEBUG, "FILS: KDK", ptk->kdk, ptk->kdk_len);
789 }
790
791 ptk->kek2_len = 0;
792 ptk->kck2_len = 0;
793
794 os_memset(tmp, 0, sizeof(tmp));
795 ret = 0;
796 err:
797 bin_clear_free(data, data_len);
798 return ret;
799 }
800
801
fils_key_auth_sk(const u8 * ick,size_t ick_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * g_sta,size_t g_sta_len,const u8 * g_ap,size_t g_ap_len,int akmp,u8 * key_auth_sta,u8 * key_auth_ap,size_t * key_auth_len)802 int fils_key_auth_sk(const u8 *ick, size_t ick_len, const u8 *snonce,
803 const u8 *anonce, const u8 *sta_addr, const u8 *bssid,
804 const u8 *g_sta, size_t g_sta_len,
805 const u8 *g_ap, size_t g_ap_len,
806 int akmp, u8 *key_auth_sta, u8 *key_auth_ap,
807 size_t *key_auth_len)
808 {
809 const u8 *addr[6];
810 size_t len[6];
811 size_t num_elem = 4;
812 int res;
813
814 wpa_printf(MSG_DEBUG, "FILS: Key-Auth derivation: STA-MAC=" MACSTR
815 " AP-BSSID=" MACSTR, MAC2STR(sta_addr), MAC2STR(bssid));
816 wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, ick_len);
817 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
818 wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
819 wpa_hexdump(MSG_DEBUG, "FILS: gSTA", g_sta, g_sta_len);
820 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
821
822 /*
823 * For (Re)Association Request frame (STA->AP):
824 * Key-Auth = HMAC-Hash(ICK, SNonce || ANonce || STA-MAC || AP-BSSID
825 * [ || gSTA || gAP ])
826 */
827 addr[0] = snonce;
828 len[0] = FILS_NONCE_LEN;
829 addr[1] = anonce;
830 len[1] = FILS_NONCE_LEN;
831 addr[2] = sta_addr;
832 len[2] = ETH_ALEN;
833 addr[3] = bssid;
834 len[3] = ETH_ALEN;
835 if (g_sta && g_sta_len && g_ap && g_ap_len) {
836 addr[4] = g_sta;
837 len[4] = g_sta_len;
838 addr[5] = g_ap;
839 len[5] = g_ap_len;
840 num_elem = 6;
841 }
842
843 if (wpa_key_mgmt_sha384(akmp)) {
844 *key_auth_len = 48;
845 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
846 key_auth_sta);
847 } else if (wpa_key_mgmt_sha256(akmp)) {
848 *key_auth_len = 32;
849 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
850 key_auth_sta);
851 } else {
852 return -1;
853 }
854 if (res < 0)
855 return res;
856
857 /*
858 * For (Re)Association Response frame (AP->STA):
859 * Key-Auth = HMAC-Hash(ICK, ANonce || SNonce || AP-BSSID || STA-MAC
860 * [ || gAP || gSTA ])
861 */
862 addr[0] = anonce;
863 addr[1] = snonce;
864 addr[2] = bssid;
865 addr[3] = sta_addr;
866 if (g_sta && g_sta_len && g_ap && g_ap_len) {
867 addr[4] = g_ap;
868 len[4] = g_ap_len;
869 addr[5] = g_sta;
870 len[5] = g_sta_len;
871 }
872
873 if (wpa_key_mgmt_sha384(akmp))
874 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
875 key_auth_ap);
876 else if (wpa_key_mgmt_sha256(akmp))
877 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
878 key_auth_ap);
879 if (res < 0)
880 return res;
881
882 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (STA)",
883 key_auth_sta, *key_auth_len);
884 wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (AP)",
885 key_auth_ap, *key_auth_len);
886
887 return 0;
888 }
889
890 #endif /* CONFIG_FILS */
891
892
893 #ifdef CONFIG_IEEE80211R
wpa_ft_mic(int key_mgmt,const u8 * kck,size_t kck_len,const u8 * sta_addr,const u8 * ap_addr,u8 transaction_seqnum,const u8 * mdie,size_t mdie_len,const u8 * ftie,size_t ftie_len,const u8 * rsnie,size_t rsnie_len,const u8 * ric,size_t ric_len,const u8 * rsnxe,size_t rsnxe_len,const struct wpabuf * extra,u8 * mic)894 int wpa_ft_mic(int key_mgmt, const u8 *kck, size_t kck_len, const u8 *sta_addr,
895 const u8 *ap_addr, u8 transaction_seqnum,
896 const u8 *mdie, size_t mdie_len,
897 const u8 *ftie, size_t ftie_len,
898 const u8 *rsnie, size_t rsnie_len,
899 const u8 *ric, size_t ric_len,
900 const u8 *rsnxe, size_t rsnxe_len,
901 const struct wpabuf *extra,
902 u8 *mic)
903 {
904 const u8 *addr[11];
905 size_t len[11];
906 size_t i, num_elem = 0;
907 u8 zero_mic[32];
908 size_t mic_len, fte_fixed_len;
909 int res;
910
911 if (kck_len == 16) {
912 mic_len = 16;
913 #ifdef CONFIG_SHA384
914 } else if (kck_len == 24) {
915 mic_len = 24;
916 #endif /* CONFIG_SHA384 */
917 #ifdef CONFIG_SHA512
918 } else if (kck_len == 32) {
919 mic_len = 32;
920 #endif /* CONFIG_SHA512 */
921 } else {
922 wpa_printf(MSG_WARNING, "FT: Unsupported KCK length %u",
923 (unsigned int) kck_len);
924 return -1;
925 }
926
927 fte_fixed_len = sizeof(struct rsn_ftie) - 16 + mic_len;
928
929 addr[num_elem] = sta_addr;
930 len[num_elem] = ETH_ALEN;
931 num_elem++;
932
933 addr[num_elem] = ap_addr;
934 len[num_elem] = ETH_ALEN;
935 num_elem++;
936
937 addr[num_elem] = &transaction_seqnum;
938 len[num_elem] = 1;
939 num_elem++;
940
941 if (rsnie) {
942 addr[num_elem] = rsnie;
943 len[num_elem] = rsnie_len;
944 num_elem++;
945 }
946 if (mdie) {
947 addr[num_elem] = mdie;
948 len[num_elem] = mdie_len;
949 num_elem++;
950 }
951 if (ftie) {
952 if (ftie_len < 2 + fte_fixed_len)
953 return -1;
954
955 /* IE hdr and mic_control */
956 addr[num_elem] = ftie;
957 len[num_elem] = 2 + 2;
958 num_elem++;
959
960 /* MIC field with all zeros */
961 os_memset(zero_mic, 0, mic_len);
962 addr[num_elem] = zero_mic;
963 len[num_elem] = mic_len;
964 num_elem++;
965
966 /* Rest of FTIE */
967 addr[num_elem] = ftie + 2 + 2 + mic_len;
968 len[num_elem] = ftie_len - (2 + 2 + mic_len);
969 num_elem++;
970 }
971 if (ric) {
972 addr[num_elem] = ric;
973 len[num_elem] = ric_len;
974 num_elem++;
975 }
976
977 if (rsnxe) {
978 addr[num_elem] = rsnxe;
979 len[num_elem] = rsnxe_len;
980 num_elem++;
981 }
982
983 if (extra) {
984 addr[num_elem] = wpabuf_head(extra);
985 len[num_elem] = wpabuf_len(extra);
986 num_elem++;
987 }
988
989 for (i = 0; i < num_elem; i++)
990 wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", addr[i], len[i]);
991 res = -1;
992 #ifdef CONFIG_SHA512
993 if (kck_len == 32) {
994 u8 hash[SHA512_MAC_LEN];
995
996 if (hmac_sha512_vector(kck, kck_len, num_elem, addr, len, hash))
997 return -1;
998 os_memcpy(mic, hash, 32);
999 res = 0;
1000 }
1001 #endif /* CONFIG_SHA384 */
1002 #ifdef CONFIG_SHA384
1003 if (kck_len == 24) {
1004 u8 hash[SHA384_MAC_LEN];
1005
1006 if (hmac_sha384_vector(kck, kck_len, num_elem, addr, len, hash))
1007 return -1;
1008 os_memcpy(mic, hash, 24);
1009 res = 0;
1010 }
1011 #endif /* CONFIG_SHA384 */
1012 if (kck_len == 16 && key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1013 u8 hash[SHA256_MAC_LEN];
1014
1015 if (hmac_sha256_vector(kck, kck_len, num_elem, addr, len, hash))
1016 return -1;
1017 os_memcpy(mic, hash, 16);
1018 res = 0;
1019 }
1020 if (kck_len == 16 && key_mgmt != WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
1021 omac1_aes_128_vector(kck, num_elem, addr, len, mic) == 0)
1022 res = 0;
1023
1024 return res;
1025 }
1026
1027
wpa_ft_parse_ftie(const u8 * ie,size_t ie_len,struct wpa_ft_ies * parse,const u8 * opt)1028 static int wpa_ft_parse_ftie(const u8 *ie, size_t ie_len,
1029 struct wpa_ft_ies *parse, const u8 *opt)
1030 {
1031 const u8 *end, *pos;
1032 u8 link_id;
1033
1034 pos = opt;
1035 end = ie + ie_len;
1036 wpa_hexdump(MSG_DEBUG, "FT: Parse FTE subelements", pos, end - pos);
1037
1038 while (end - pos >= 2) {
1039 u8 id, len;
1040
1041 id = *pos++;
1042 len = *pos++;
1043 if (len > end - pos) {
1044 wpa_printf(MSG_DEBUG, "FT: Truncated subelement");
1045 return -1;
1046 }
1047
1048 switch (id) {
1049 case FTIE_SUBELEM_R1KH_ID:
1050 if (len != FT_R1KH_ID_LEN) {
1051 wpa_printf(MSG_DEBUG,
1052 "FT: Invalid R1KH-ID length in FTIE: %d",
1053 len);
1054 return -1;
1055 }
1056 parse->r1kh_id = pos;
1057 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID",
1058 parse->r1kh_id, FT_R1KH_ID_LEN);
1059 break;
1060 case FTIE_SUBELEM_GTK:
1061 wpa_printf(MSG_DEBUG, "FT: GTK");
1062 parse->gtk = pos;
1063 parse->gtk_len = len;
1064 break;
1065 case FTIE_SUBELEM_R0KH_ID:
1066 if (len < 1 || len > FT_R0KH_ID_MAX_LEN) {
1067 wpa_printf(MSG_DEBUG,
1068 "FT: Invalid R0KH-ID length in FTIE: %d",
1069 len);
1070 return -1;
1071 }
1072 parse->r0kh_id = pos;
1073 parse->r0kh_id_len = len;
1074 wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID",
1075 parse->r0kh_id, parse->r0kh_id_len);
1076 break;
1077 case FTIE_SUBELEM_IGTK:
1078 wpa_printf(MSG_DEBUG, "FT: IGTK");
1079 parse->igtk = pos;
1080 parse->igtk_len = len;
1081 break;
1082 #ifdef CONFIG_OCV
1083 case FTIE_SUBELEM_OCI:
1084 parse->oci = pos;
1085 parse->oci_len = len;
1086 wpa_hexdump(MSG_DEBUG, "FT: OCI",
1087 parse->oci, parse->oci_len);
1088 break;
1089 #endif /* CONFIG_OCV */
1090 case FTIE_SUBELEM_BIGTK:
1091 wpa_printf(MSG_DEBUG, "FT: BIGTK");
1092 parse->bigtk = pos;
1093 parse->bigtk_len = len;
1094 break;
1095 case FTIE_SUBELEM_MLO_GTK:
1096 if (len < 2 + 1 + 1 + 8) {
1097 wpa_printf(MSG_DEBUG,
1098 "FT: Too short MLO GTK in FTE");
1099 return -1;
1100 }
1101 link_id = pos[2] & 0x0f;
1102 wpa_printf(MSG_DEBUG, "FT: MLO GTK (Link ID %u)",
1103 link_id);
1104 if (link_id >= MAX_NUM_MLD_LINKS)
1105 break;
1106 parse->valid_mlo_gtks |= BIT(link_id);
1107 parse->mlo_gtk[link_id] = pos;
1108 parse->mlo_gtk_len[link_id] = len;
1109 break;
1110 case FTIE_SUBELEM_MLO_IGTK:
1111 if (len < 2 + 6 + 1 + 1) {
1112 wpa_printf(MSG_DEBUG,
1113 "FT: Too short MLO IGTK in FTE");
1114 return -1;
1115 }
1116 link_id = pos[2 + 6] & 0x0f;
1117 wpa_printf(MSG_DEBUG, "FT: MLO IGTK (Link ID %u)",
1118 link_id);
1119 if (link_id >= MAX_NUM_MLD_LINKS)
1120 break;
1121 parse->valid_mlo_igtks |= BIT(link_id);
1122 parse->mlo_igtk[link_id] = pos;
1123 parse->mlo_igtk_len[link_id] = len;
1124 break;
1125 case FTIE_SUBELEM_MLO_BIGTK:
1126 if (len < 2 + 6 + 1 + 1) {
1127 wpa_printf(MSG_DEBUG,
1128 "FT: Too short MLO BIGTK in FTE");
1129 return -1;
1130 }
1131 link_id = pos[2 + 6] & 0x0f;
1132 wpa_printf(MSG_DEBUG, "FT: MLO BIGTK (Link ID %u)",
1133 link_id);
1134 if (link_id >= MAX_NUM_MLD_LINKS)
1135 break;
1136 parse->valid_mlo_bigtks |= BIT(link_id);
1137 parse->mlo_bigtk[link_id] = pos;
1138 parse->mlo_bigtk_len[link_id] = len;
1139 break;
1140 default:
1141 wpa_printf(MSG_DEBUG, "FT: Unknown subelem id %u", id);
1142 break;
1143 }
1144
1145 pos += len;
1146 }
1147
1148 return 0;
1149 }
1150
1151
wpa_ft_parse_fte(int key_mgmt,const u8 * ie,size_t len,struct wpa_ft_ies * parse)1152 static int wpa_ft_parse_fte(int key_mgmt, const u8 *ie, size_t len,
1153 struct wpa_ft_ies *parse)
1154 {
1155 size_t mic_len;
1156 u8 mic_len_info;
1157 const u8 *pos = ie;
1158 const u8 *end = pos + len;
1159
1160 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control", pos, 2);
1161 parse->fte_rsnxe_used = pos[0] & FTE_MIC_CTRL_RSNXE_USED;
1162 mic_len_info = (pos[0] & FTE_MIC_CTRL_MIC_LEN_MASK) >>
1163 FTE_MIC_CTRL_MIC_LEN_SHIFT;
1164 parse->fte_elem_count = pos[1];
1165 pos += 2;
1166
1167 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) {
1168 switch (mic_len_info) {
1169 case FTE_MIC_LEN_16:
1170 mic_len = 16;
1171 break;
1172 case FTE_MIC_LEN_24:
1173 mic_len = 24;
1174 break;
1175 case FTE_MIC_LEN_32:
1176 mic_len = 32;
1177 break;
1178 default:
1179 wpa_printf(MSG_DEBUG,
1180 "FT: Unknown MIC Length subfield value %u",
1181 mic_len_info);
1182 return -1;
1183 }
1184 } else {
1185 mic_len = wpa_key_mgmt_sha384(key_mgmt) ? 24 : 16;
1186 }
1187 if (mic_len > (size_t) (end - pos)) {
1188 wpa_printf(MSG_DEBUG, "FT: No room for %zu octet MIC in FTE",
1189 mic_len);
1190 return -1;
1191 }
1192 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC", pos, mic_len);
1193 parse->fte_mic = pos;
1194 parse->fte_mic_len = mic_len;
1195 pos += mic_len;
1196
1197 if (2 * WPA_NONCE_LEN > end - pos)
1198 return -1;
1199 parse->fte_anonce = pos;
1200 wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
1201 parse->fte_anonce, WPA_NONCE_LEN);
1202 pos += WPA_NONCE_LEN;
1203 parse->fte_snonce = pos;
1204 wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
1205 parse->fte_snonce, WPA_NONCE_LEN);
1206 pos += WPA_NONCE_LEN;
1207
1208 return wpa_ft_parse_ftie(ie, len, parse, pos);
1209 }
1210
1211
wpa_ft_parse_ies(const u8 * ies,size_t ies_len,struct wpa_ft_ies * parse,int key_mgmt,bool reassoc_resp)1212 int wpa_ft_parse_ies(const u8 *ies, size_t ies_len, struct wpa_ft_ies *parse,
1213 int key_mgmt, bool reassoc_resp)
1214 {
1215 const u8 *end, *pos;
1216 struct wpa_ie_data data;
1217 int ret;
1218 int prot_ie_count = 0;
1219 const u8 *fte = NULL;
1220 size_t fte_len = 0;
1221 bool is_fte = false;
1222 struct ieee802_11_elems elems;
1223
1224 os_memset(parse, 0, sizeof(*parse));
1225 if (ies == NULL)
1226 return 0;
1227
1228 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) == ParseFailed) {
1229 wpa_printf(MSG_DEBUG, "FT: Failed to parse elements");
1230 goto fail;
1231 }
1232
1233 pos = ies;
1234 end = ies + ies_len;
1235 while (end - pos >= 2) {
1236 u8 id, len;
1237
1238 id = *pos++;
1239 len = *pos++;
1240 if (len > end - pos)
1241 break;
1242
1243 if (id != WLAN_EID_FAST_BSS_TRANSITION &&
1244 id != WLAN_EID_FRAGMENT)
1245 is_fte = false;
1246
1247 switch (id) {
1248 case WLAN_EID_RSN:
1249 wpa_hexdump(MSG_DEBUG, "FT: RSNE", pos, len);
1250 parse->rsn = pos;
1251 parse->rsn_len = len;
1252 ret = wpa_parse_wpa_ie_rsn(parse->rsn - 2,
1253 parse->rsn_len + 2,
1254 &data);
1255 if (ret < 0) {
1256 wpa_printf(MSG_DEBUG, "FT: Failed to parse "
1257 "RSN IE: %d", ret);
1258 goto fail;
1259 }
1260 parse->rsn_capab = data.capabilities;
1261 if (data.num_pmkid == 1 && data.pmkid)
1262 parse->rsn_pmkid = data.pmkid;
1263 parse->key_mgmt = data.key_mgmt;
1264 parse->pairwise_cipher = data.pairwise_cipher;
1265 if (!key_mgmt)
1266 key_mgmt = parse->key_mgmt;
1267 break;
1268 case WLAN_EID_RSNX:
1269 wpa_hexdump(MSG_DEBUG, "FT: RSNXE", pos, len);
1270 if (len < 1)
1271 break;
1272 parse->rsnxe = pos;
1273 parse->rsnxe_len = len;
1274 break;
1275 case WLAN_EID_MOBILITY_DOMAIN:
1276 wpa_hexdump(MSG_DEBUG, "FT: MDE", pos, len);
1277 if (len < sizeof(struct rsn_mdie))
1278 goto fail;
1279 parse->mdie = pos;
1280 parse->mdie_len = len;
1281 break;
1282 case WLAN_EID_FAST_BSS_TRANSITION:
1283 wpa_hexdump(MSG_DEBUG, "FT: FTE", pos, len);
1284 /* The first two octets (MIC Control field) is in the
1285 * same offset for all cases, but the second field (MIC)
1286 * has variable length with three different values.
1287 * In particular the FT-SAE-EXT-KEY is inconvinient to
1288 * parse, so try to handle this in pieces instead of
1289 * using the struct rsn_ftie* definitions. */
1290
1291 if (len < 2)
1292 goto fail;
1293 prot_ie_count = pos[1]; /* Element Count field in
1294 * MIC Control */
1295 is_fte = true;
1296 fte = pos;
1297 fte_len = len;
1298 break;
1299 case WLAN_EID_FRAGMENT:
1300 if (is_fte) {
1301 wpa_hexdump(MSG_DEBUG, "FT: FTE fragment",
1302 pos, len);
1303 fte_len += 2 + len;
1304 }
1305 break;
1306 case WLAN_EID_TIMEOUT_INTERVAL:
1307 wpa_hexdump(MSG_DEBUG, "FT: Timeout Interval",
1308 pos, len);
1309 if (len != 5)
1310 break;
1311 parse->tie = pos;
1312 parse->tie_len = len;
1313 break;
1314 case WLAN_EID_RIC_DATA:
1315 if (parse->ric == NULL)
1316 parse->ric = pos - 2;
1317 break;
1318 }
1319
1320 pos += len;
1321 }
1322
1323 if (fte) {
1324 int res;
1325
1326 if (fte_len < 255) {
1327 res = wpa_ft_parse_fte(key_mgmt, fte, fte_len, parse);
1328 } else {
1329 parse->fte_buf = ieee802_11_defrag(fte, fte_len, false);
1330 if (!parse->fte_buf)
1331 goto fail;
1332 res = wpa_ft_parse_fte(key_mgmt,
1333 wpabuf_head(parse->fte_buf),
1334 wpabuf_len(parse->fte_buf),
1335 parse);
1336 }
1337 if (res < 0)
1338 goto fail;
1339
1340 /* FTE might be fragmented. If it is, the separate Fragment
1341 * elements are included in MIC calculation as full elements. */
1342 parse->ftie = fte;
1343 parse->ftie_len = fte_len;
1344 }
1345
1346 if (prot_ie_count == 0)
1347 return 0; /* no MIC */
1348
1349 /*
1350 * Check that the protected IE count matches with IEs included in the
1351 * frame.
1352 */
1353 if (reassoc_resp && elems.basic_mle) {
1354 unsigned int link_id;
1355
1356 /* TODO: This count should be done based on all _requested_,
1357 * not _accepted_ links. */
1358 for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
1359 if (parse->mlo_gtk[link_id]) {
1360 if (parse->rsn)
1361 prot_ie_count--;
1362 if (parse->rsnxe)
1363 prot_ie_count--;
1364 }
1365 }
1366 } else {
1367 if (parse->rsn)
1368 prot_ie_count--;
1369 if (parse->rsnxe)
1370 prot_ie_count--;
1371 }
1372 if (parse->mdie)
1373 prot_ie_count--;
1374 if (parse->ftie)
1375 prot_ie_count--;
1376 if (prot_ie_count < 0) {
1377 wpa_printf(MSG_DEBUG, "FT: Some required IEs not included in "
1378 "the protected IE count");
1379 goto fail;
1380 }
1381
1382 if (prot_ie_count == 0 && parse->ric) {
1383 wpa_printf(MSG_DEBUG, "FT: RIC IE(s) in the frame, but not "
1384 "included in protected IE count");
1385 goto fail;
1386 }
1387
1388 /* Determine the end of the RIC IE(s) */
1389 if (parse->ric) {
1390 pos = parse->ric;
1391 while (end - pos >= 2 && 2 + pos[1] <= end - pos &&
1392 prot_ie_count) {
1393 prot_ie_count--;
1394 pos += 2 + pos[1];
1395 }
1396 parse->ric_len = pos - parse->ric;
1397 }
1398 if (prot_ie_count) {
1399 wpa_printf(MSG_DEBUG, "FT: %d protected IEs missing from "
1400 "frame", (int) prot_ie_count);
1401 goto fail;
1402 }
1403
1404 return 0;
1405
1406 fail:
1407 wpa_ft_parse_ies_free(parse);
1408 return -1;
1409 }
1410
1411
wpa_ft_parse_ies_free(struct wpa_ft_ies * parse)1412 void wpa_ft_parse_ies_free(struct wpa_ft_ies *parse)
1413 {
1414 if (!parse)
1415 return;
1416 wpabuf_free(parse->fte_buf);
1417 parse->fte_buf = NULL;
1418 }
1419
1420 #endif /* CONFIG_IEEE80211R */
1421
1422
1423 #ifdef CONFIG_PASN
1424
1425 /*
1426 * pasn_use_sha384 - Should SHA384 be used or SHA256
1427 *
1428 * @akmp: Authentication and key management protocol
1429 * @cipher: The cipher suite
1430 *
1431 * According to IEEE P802.11az/D2.7, 12.12.7, the hash algorithm to use is the
1432 * hash algorithm defined for the Base AKM (see Table 9-151 (AKM suite
1433 * selectors)). When there is no Base AKM, the hash algorithm is selected based
1434 * on the pairwise cipher suite provided in the RSNE by the AP in the second
1435 * PASN frame. SHA-256 is used as the hash algorithm, except for the ciphers
1436 * 00-0F-AC:9 and 00-0F-AC:10 for which SHA-384 is used.
1437 */
pasn_use_sha384(int akmp,int cipher)1438 bool pasn_use_sha384(int akmp, int cipher)
1439 {
1440 return (akmp == WPA_KEY_MGMT_PASN && (cipher == WPA_CIPHER_CCMP_256 ||
1441 cipher == WPA_CIPHER_GCMP_256)) ||
1442 wpa_key_mgmt_sha384(akmp);
1443 }
1444
1445
1446 /**
1447 * pasn_pmk_to_ptk - Calculate PASN PTK from PMK, addresses, etc.
1448 * @pmk: Pairwise master key
1449 * @pmk_len: Length of PMK
1450 * @spa: Suppplicant address
1451 * @bssid: AP BSSID
1452 * @dhss: Is the shared secret (DHss) derived from the PASN ephemeral key
1453 * exchange encoded as an octet string
1454 * @dhss_len: The length of dhss in octets
1455 * @ptk: Buffer for pairwise transient key
1456 * @akmp: Negotiated AKM
1457 * @cipher: Negotiated pairwise cipher
1458 * @kdk_len: the length in octets that should be derived for HTLK. Can be zero.
1459 * @kek_len: The length in octets that should be derived for KEK. Can be zero.
1460 * Returns: 0 on success, -1 on failure
1461 */
pasn_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const u8 * spa,const u8 * bssid,const u8 * dhss,size_t dhss_len,struct wpa_ptk * ptk,int akmp,int cipher,size_t kdk_len,size_t kek_len)1462 int pasn_pmk_to_ptk(const u8 *pmk, size_t pmk_len,
1463 const u8 *spa, const u8 *bssid,
1464 const u8 *dhss, size_t dhss_len,
1465 struct wpa_ptk *ptk, int akmp, int cipher,
1466 size_t kdk_len, size_t kek_len)
1467 {
1468 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
1469 WPA_KDK_MAX_LEN];
1470 const u8 *pos;
1471 u8 *data;
1472 size_t data_len, ptk_len;
1473 int ret = -1;
1474 const char *label = "PASN PTK Derivation";
1475
1476 if (!pmk || !pmk_len) {
1477 wpa_printf(MSG_ERROR, "PASN: No PMK set for PTK derivation");
1478 return -1;
1479 }
1480
1481 if (!dhss || !dhss_len) {
1482 wpa_printf(MSG_ERROR, "PASN: No DHss set for PTK derivation");
1483 return -1;
1484 }
1485
1486 /*
1487 * PASN-PTK = KDF(PMK, “PASN PTK Derivation”, SPA || BSSID || DHss)
1488 *
1489 * KCK = L(PASN-PTK, 0, 256)
1490 * TK = L(PASN-PTK, 256, TK_bits)
1491 * KDK = L(PASN-PTK, 256 + TK_bits, kdk_len * 8)
1492 */
1493 data_len = 2 * ETH_ALEN + dhss_len;
1494 data = os_zalloc(data_len);
1495 if (!data)
1496 return -1;
1497
1498 os_memcpy(data, spa, ETH_ALEN);
1499 os_memcpy(data + ETH_ALEN, bssid, ETH_ALEN);
1500 os_memcpy(data + 2 * ETH_ALEN, dhss, dhss_len);
1501
1502 ptk->kck_len = WPA_PASN_KCK_LEN;
1503 ptk->tk_len = wpa_cipher_key_len(cipher);
1504 ptk->kdk_len = kdk_len;
1505 ptk->kek_len = kek_len;
1506 ptk->kek2_len = 0;
1507 ptk->kck2_len = 0;
1508
1509 if (ptk->tk_len == 0) {
1510 wpa_printf(MSG_ERROR,
1511 "PASN: Unsupported cipher (0x%x) used in PTK derivation",
1512 cipher);
1513 goto err;
1514 }
1515
1516 ptk_len = ptk->kck_len + ptk->tk_len + ptk->kdk_len + ptk->kek_len;
1517 if (ptk_len > sizeof(tmp))
1518 goto err;
1519
1520 if (pasn_use_sha384(akmp, cipher)) {
1521 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA384");
1522
1523 if (sha384_prf(pmk, pmk_len, label, data, data_len, tmp,
1524 ptk_len) < 0)
1525 goto err;
1526 } else {
1527 wpa_printf(MSG_DEBUG, "PASN: PTK derivation using SHA256");
1528
1529 if (sha256_prf(pmk, pmk_len, label, data, data_len, tmp,
1530 ptk_len) < 0)
1531 goto err;
1532 }
1533
1534 wpa_printf(MSG_DEBUG,
1535 "PASN: PTK derivation: SPA=" MACSTR " BSSID=" MACSTR,
1536 MAC2STR(spa), MAC2STR(bssid));
1537
1538 wpa_hexdump_key(MSG_DEBUG, "PASN: DHss", dhss, dhss_len);
1539 wpa_hexdump_key(MSG_DEBUG, "PASN: PMK", pmk, pmk_len);
1540 wpa_hexdump_key(MSG_DEBUG, "PASN: PASN-PTK", tmp, ptk_len);
1541
1542 os_memcpy(ptk->kck, tmp, WPA_PASN_KCK_LEN);
1543 wpa_hexdump_key(MSG_DEBUG, "PASN: KCK:", ptk->kck, WPA_PASN_KCK_LEN);
1544 pos = &tmp[WPA_PASN_KCK_LEN];
1545
1546 if (kek_len) {
1547 os_memcpy(ptk->kek, pos, kek_len);
1548 wpa_hexdump_key(MSG_DEBUG, "PASN: KEK:",
1549 ptk->kek, ptk->kek_len);
1550 pos += kek_len;
1551 }
1552
1553 os_memcpy(ptk->tk, pos, ptk->tk_len);
1554 wpa_hexdump_key(MSG_DEBUG, "PASN: TK:", ptk->tk, ptk->tk_len);
1555 pos += ptk->tk_len;
1556
1557 if (kdk_len) {
1558 os_memcpy(ptk->kdk, pos, ptk->kdk_len);
1559 wpa_hexdump_key(MSG_DEBUG, "PASN: KDK:",
1560 ptk->kdk, ptk->kdk_len);
1561 }
1562
1563 forced_memzero(tmp, sizeof(tmp));
1564 ret = 0;
1565 err:
1566 bin_clear_free(data, data_len);
1567 return ret;
1568 }
1569
1570
1571 /*
1572 * pasn_mic_len - Returns the MIC length for PASN authentication
1573 */
pasn_mic_len(int akmp,int cipher)1574 u8 pasn_mic_len(int akmp, int cipher)
1575 {
1576 if (pasn_use_sha384(akmp, cipher))
1577 return 24;
1578
1579 return 16;
1580 }
1581
1582
1583 /**
1584 * wpa_ltf_keyseed - Compute LTF keyseed from KDK
1585 * @ptk: Buffer that holds pairwise transient key
1586 * @akmp: Negotiated AKM
1587 * @cipher: Negotiated pairwise cipher
1588 * Returns: 0 on success, -1 on failure
1589 */
wpa_ltf_keyseed(struct wpa_ptk * ptk,int akmp,int cipher)1590 int wpa_ltf_keyseed(struct wpa_ptk *ptk, int akmp, int cipher)
1591 {
1592 u8 *buf;
1593 size_t buf_len;
1594 u8 hash[SHA384_MAC_LEN];
1595 const u8 *kdk = ptk->kdk;
1596 size_t kdk_len = ptk->kdk_len;
1597 const char *label = "Secure LTF key seed";
1598
1599 if (!kdk || !kdk_len) {
1600 wpa_printf(MSG_ERROR, "WPA: No KDK for LTF keyseed generation");
1601 return -1;
1602 }
1603
1604 buf = (u8 *)label;
1605 buf_len = os_strlen(label);
1606
1607 if (pasn_use_sha384(akmp, cipher)) {
1608 wpa_printf(MSG_DEBUG,
1609 "WPA: Secure LTF keyseed using HMAC-SHA384");
1610
1611 if (hmac_sha384(kdk, kdk_len, buf, buf_len, hash)) {
1612 wpa_printf(MSG_ERROR,
1613 "WPA: HMAC-SHA384 compute failed");
1614 return -1;
1615 }
1616 os_memcpy(ptk->ltf_keyseed, hash, SHA384_MAC_LEN);
1617 ptk->ltf_keyseed_len = SHA384_MAC_LEN;
1618 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1619 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1620
1621 } else {
1622 wpa_printf(MSG_DEBUG, "WPA: LTF keyseed using HMAC-SHA256");
1623
1624 if (hmac_sha256(kdk, kdk_len, buf, buf_len, hash)) {
1625 wpa_printf(MSG_ERROR,
1626 "WPA: HMAC-SHA256 compute failed");
1627 return -1;
1628 }
1629 os_memcpy(ptk->ltf_keyseed, hash, SHA256_MAC_LEN);
1630 ptk->ltf_keyseed_len = SHA256_MAC_LEN;
1631 wpa_hexdump_key(MSG_DEBUG, "WPA: Secure LTF keyseed: ",
1632 ptk->ltf_keyseed, ptk->ltf_keyseed_len);
1633 }
1634
1635 return 0;
1636 }
1637
1638
1639 /**
1640 * pasn_mic - Calculate PASN MIC
1641 * @kck: The key confirmation key for the PASN PTKSA
1642 * @akmp: Negotiated AKM
1643 * @cipher: Negotiated pairwise cipher
1644 * @addr1: For the 2nd PASN frame supplicant address; for the 3rd frame the
1645 * BSSID
1646 * @addr2: For the 2nd PASN frame the BSSID; for the 3rd frame the supplicant
1647 * address
1648 * @data: For calculating the MIC for the 2nd PASN frame, this should hold the
1649 * Beacon frame RSNE + RSNXE. For calculating the MIC for the 3rd PASN
1650 * frame, this should hold the hash of the body of the PASN 1st frame.
1651 * @data_len: The length of data
1652 * @frame: The body of the PASN frame including the MIC element with the octets
1653 * in the MIC field of the MIC element set to 0.
1654 * @frame_len: The length of frame
1655 * @mic: Buffer to hold the MIC on success. Should be big enough to handle the
1656 * maximal MIC length
1657 * Returns: 0 on success, -1 on failure
1658 */
pasn_mic(const u8 * kck,int akmp,int cipher,const u8 * addr1,const u8 * addr2,const u8 * data,size_t data_len,const u8 * frame,size_t frame_len,u8 * mic)1659 int pasn_mic(const u8 *kck, int akmp, int cipher,
1660 const u8 *addr1, const u8 *addr2,
1661 const u8 *data, size_t data_len,
1662 const u8 *frame, size_t frame_len, u8 *mic)
1663 {
1664 u8 *buf;
1665 u8 hash[SHA384_MAC_LEN];
1666 size_t buf_len = 2 * ETH_ALEN + data_len + frame_len;
1667 int ret = -1;
1668
1669 if (!kck) {
1670 wpa_printf(MSG_ERROR, "PASN: No KCK for MIC calculation");
1671 return -1;
1672 }
1673
1674 if (!data || !data_len) {
1675 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1676 return -1;
1677 }
1678
1679 if (!frame || !frame_len) {
1680 wpa_printf(MSG_ERROR, "PASN: invalid data for MIC calculation");
1681 return -1;
1682 }
1683
1684 buf = os_zalloc(buf_len);
1685 if (!buf)
1686 return -1;
1687
1688 os_memcpy(buf, addr1, ETH_ALEN);
1689 os_memcpy(buf + ETH_ALEN, addr2, ETH_ALEN);
1690
1691 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: data", data, data_len);
1692 os_memcpy(buf + 2 * ETH_ALEN, data, data_len);
1693
1694 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: frame", frame, frame_len);
1695 os_memcpy(buf + 2 * ETH_ALEN + data_len, frame, frame_len);
1696
1697 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: KCK", kck, WPA_PASN_KCK_LEN);
1698 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: buf", buf, buf_len);
1699
1700 if (pasn_use_sha384(akmp, cipher)) {
1701 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA384");
1702
1703 if (hmac_sha384(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1704 goto err;
1705
1706 os_memcpy(mic, hash, 24);
1707 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 24);
1708 } else {
1709 wpa_printf(MSG_DEBUG, "PASN: MIC using HMAC-SHA256");
1710
1711 if (hmac_sha256(kck, WPA_PASN_KCK_LEN, buf, buf_len, hash))
1712 goto err;
1713
1714 os_memcpy(mic, hash, 16);
1715 wpa_hexdump_key(MSG_DEBUG, "PASN: MIC: mic: ", mic, 16);
1716 }
1717
1718 ret = 0;
1719 err:
1720 bin_clear_free(buf, buf_len);
1721 return ret;
1722 }
1723
1724
1725 /**
1726 * pasn_auth_frame_hash - Computes a hash of an Authentication frame body
1727 * @akmp: Negotiated AKM
1728 * @cipher: Negotiated pairwise cipher
1729 * @data: Pointer to the Authentication frame body
1730 * @len: Length of the Authentication frame body
1731 * @hash: On return would hold the computed hash. Should be big enough to handle
1732 * SHA384.
1733 * Returns: 0 on success, -1 on failure
1734 */
pasn_auth_frame_hash(int akmp,int cipher,const u8 * data,size_t len,u8 * hash)1735 int pasn_auth_frame_hash(int akmp, int cipher, const u8 *data, size_t len,
1736 u8 *hash)
1737 {
1738 if (pasn_use_sha384(akmp, cipher)) {
1739 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-384");
1740 return sha384_vector(1, &data, &len, hash);
1741 } else {
1742 wpa_printf(MSG_DEBUG, "PASN: Frame hash using SHA-256");
1743 return sha256_vector(1, &data, &len, hash);
1744 }
1745 }
1746
1747 #endif /* CONFIG_PASN */
1748
1749
rsn_selector_to_bitfield(const u8 * s)1750 static int rsn_selector_to_bitfield(const u8 *s)
1751 {
1752 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NONE)
1753 return WPA_CIPHER_NONE;
1754 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_TKIP)
1755 return WPA_CIPHER_TKIP;
1756 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP)
1757 return WPA_CIPHER_CCMP;
1758 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_AES_128_CMAC)
1759 return WPA_CIPHER_AES_128_CMAC;
1760 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP)
1761 return WPA_CIPHER_GCMP;
1762 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP_256)
1763 return WPA_CIPHER_CCMP_256;
1764 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP_256)
1765 return WPA_CIPHER_GCMP_256;
1766 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_128)
1767 return WPA_CIPHER_BIP_GMAC_128;
1768 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_256)
1769 return WPA_CIPHER_BIP_GMAC_256;
1770 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_CMAC_256)
1771 return WPA_CIPHER_BIP_CMAC_256;
1772 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED)
1773 return WPA_CIPHER_GTK_NOT_USED;
1774 return 0;
1775 }
1776
1777
rsn_key_mgmt_to_bitfield(const u8 * s)1778 static int rsn_key_mgmt_to_bitfield(const u8 *s)
1779 {
1780 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_UNSPEC_802_1X)
1781 return WPA_KEY_MGMT_IEEE8021X;
1782 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1783 return WPA_KEY_MGMT_PSK;
1784 #ifdef CONFIG_IEEE80211R
1785 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X)
1786 return WPA_KEY_MGMT_FT_IEEE8021X;
1787 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_PSK)
1788 return WPA_KEY_MGMT_FT_PSK;
1789 #ifdef CONFIG_SHA384
1790 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384)
1791 return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
1792 #endif /* CONFIG_SHA384 */
1793 #endif /* CONFIG_IEEE80211R */
1794 #ifdef CONFIG_SHA384
1795 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA384)
1796 return WPA_KEY_MGMT_IEEE8021X_SHA384;
1797 #endif /* CONFIG_SHA384 */
1798 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
1799 return WPA_KEY_MGMT_IEEE8021X_SHA256;
1800 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
1801 return WPA_KEY_MGMT_PSK_SHA256;
1802 #ifdef CONFIG_SAE
1803 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE)
1804 return WPA_KEY_MGMT_SAE;
1805 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
1806 return WPA_KEY_MGMT_SAE_EXT_KEY;
1807 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE)
1808 return WPA_KEY_MGMT_FT_SAE;
1809 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
1810 return WPA_KEY_MGMT_FT_SAE_EXT_KEY;
1811 #endif /* CONFIG_SAE */
1812 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B)
1813 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1814 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192)
1815 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1816 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA256)
1817 return WPA_KEY_MGMT_FILS_SHA256;
1818 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA384)
1819 return WPA_KEY_MGMT_FILS_SHA384;
1820 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA256)
1821 return WPA_KEY_MGMT_FT_FILS_SHA256;
1822 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA384)
1823 return WPA_KEY_MGMT_FT_FILS_SHA384;
1824 #ifdef CONFIG_OWE
1825 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OWE)
1826 return WPA_KEY_MGMT_OWE;
1827 #endif /* CONFIG_OWE */
1828 #ifdef CONFIG_DPP
1829 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_DPP)
1830 return WPA_KEY_MGMT_DPP;
1831 #endif /* CONFIG_DPP */
1832 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OSEN)
1833 return WPA_KEY_MGMT_OSEN;
1834 #ifdef CONFIG_PASN
1835 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PASN)
1836 return WPA_KEY_MGMT_PASN;
1837 #endif /* CONFIG_PASN */
1838 return 0;
1839 }
1840
1841
wpa_cipher_valid_group(int cipher)1842 int wpa_cipher_valid_group(int cipher)
1843 {
1844 return wpa_cipher_valid_pairwise(cipher) ||
1845 cipher == WPA_CIPHER_GTK_NOT_USED;
1846 }
1847
1848
wpa_cipher_valid_mgmt_group(int cipher)1849 int wpa_cipher_valid_mgmt_group(int cipher)
1850 {
1851 return cipher == WPA_CIPHER_GTK_NOT_USED ||
1852 cipher == WPA_CIPHER_AES_128_CMAC ||
1853 cipher == WPA_CIPHER_BIP_GMAC_128 ||
1854 cipher == WPA_CIPHER_BIP_GMAC_256 ||
1855 cipher == WPA_CIPHER_BIP_CMAC_256;
1856 }
1857
1858
1859 /**
1860 * wpa_parse_wpa_ie_rsn - Parse RSN IE
1861 * @rsn_ie: Buffer containing RSN IE
1862 * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
1863 * @data: Pointer to structure that will be filled in with parsed data
1864 * Returns: 0 on success, <0 on failure
1865 */
wpa_parse_wpa_ie_rsn(const u8 * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)1866 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
1867 struct wpa_ie_data *data)
1868 {
1869 const u8 *pos;
1870 int left;
1871 int i, count;
1872
1873 os_memset(data, 0, sizeof(*data));
1874 data->proto = WPA_PROTO_RSN;
1875 data->pairwise_cipher = WPA_CIPHER_CCMP;
1876 data->group_cipher = WPA_CIPHER_CCMP;
1877 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1878 data->capabilities = 0;
1879 data->pmkid = NULL;
1880 data->num_pmkid = 0;
1881 data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1882
1883 if (rsn_ie_len == 0) {
1884 /* No RSN IE - fail silently */
1885 return -1;
1886 }
1887
1888 if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
1889 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1890 __func__, (unsigned long) rsn_ie_len);
1891 return -1;
1892 }
1893
1894 if (rsn_ie_len >= 6 && rsn_ie[1] >= 4 &&
1895 rsn_ie[1] == rsn_ie_len - 2 &&
1896 WPA_GET_BE32(&rsn_ie[2]) == OSEN_IE_VENDOR_TYPE) {
1897 pos = rsn_ie + 6;
1898 left = rsn_ie_len - 6;
1899
1900 data->group_cipher = WPA_CIPHER_GTK_NOT_USED;
1901 data->has_group = 1;
1902 data->key_mgmt = WPA_KEY_MGMT_OSEN;
1903 data->proto = WPA_PROTO_OSEN;
1904 } else if (rsn_ie_len >= 2 + 4 + 2 && rsn_ie[1] >= 4 + 2 &&
1905 rsn_ie[1] == rsn_ie_len - 2 &&
1906 (WPA_GET_BE32(&rsn_ie[2]) == RSNE_OVERRIDE_IE_VENDOR_TYPE ||
1907 WPA_GET_BE32(&rsn_ie[2]) ==
1908 RSNE_OVERRIDE_2_IE_VENDOR_TYPE) &&
1909 WPA_GET_LE16(&rsn_ie[2 + 4]) == RSN_VERSION) {
1910 pos = rsn_ie + 2 + 4 + 2;
1911 left = rsn_ie_len - 2 - 4 - 2;
1912 } else {
1913 const struct rsn_ie_hdr *hdr;
1914
1915 hdr = (const struct rsn_ie_hdr *) rsn_ie;
1916
1917 if (hdr->elem_id != WLAN_EID_RSN ||
1918 hdr->len != rsn_ie_len - 2 ||
1919 WPA_GET_LE16(hdr->version) != RSN_VERSION) {
1920 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1921 __func__);
1922 return -2;
1923 }
1924
1925 pos = (const u8 *) (hdr + 1);
1926 left = rsn_ie_len - sizeof(*hdr);
1927 }
1928
1929 if (left >= RSN_SELECTOR_LEN) {
1930 data->group_cipher = rsn_selector_to_bitfield(pos);
1931 data->has_group = 1;
1932 if (!wpa_cipher_valid_group(data->group_cipher)) {
1933 wpa_printf(MSG_DEBUG,
1934 "%s: invalid group cipher 0x%x (%08x)",
1935 __func__, data->group_cipher,
1936 WPA_GET_BE32(pos));
1937 #ifdef CONFIG_NO_TKIP
1938 if (RSN_SELECTOR_GET(pos) == RSN_CIPHER_SUITE_TKIP) {
1939 wpa_printf(MSG_DEBUG,
1940 "%s: TKIP as group cipher not supported in CONFIG_NO_TKIP=y build",
1941 __func__);
1942 }
1943 #endif /* CONFIG_NO_TKIP */
1944 return -1;
1945 }
1946 pos += RSN_SELECTOR_LEN;
1947 left -= RSN_SELECTOR_LEN;
1948 } else if (left > 0) {
1949 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1950 __func__, left);
1951 return -3;
1952 }
1953
1954 if (left >= 2) {
1955 data->pairwise_cipher = 0;
1956 count = WPA_GET_LE16(pos);
1957 pos += 2;
1958 left -= 2;
1959 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1960 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1961 "count %u left %u", __func__, count, left);
1962 return -4;
1963 }
1964 if (count)
1965 data->has_pairwise = 1;
1966 for (i = 0; i < count; i++) {
1967 data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
1968 pos += RSN_SELECTOR_LEN;
1969 left -= RSN_SELECTOR_LEN;
1970 }
1971 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
1972 wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
1973 "pairwise cipher", __func__);
1974 return -1;
1975 }
1976 } else if (left == 1) {
1977 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1978 __func__);
1979 return -5;
1980 }
1981
1982 if (left >= 2) {
1983 data->key_mgmt = 0;
1984 count = WPA_GET_LE16(pos);
1985 pos += 2;
1986 left -= 2;
1987 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1988 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1989 "count %u left %u", __func__, count, left);
1990 return -6;
1991 }
1992 for (i = 0; i < count; i++) {
1993 data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
1994 pos += RSN_SELECTOR_LEN;
1995 left -= RSN_SELECTOR_LEN;
1996 }
1997 } else if (left == 1) {
1998 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
1999 __func__);
2000 return -7;
2001 }
2002
2003 if (left >= 2) {
2004 data->capabilities = WPA_GET_LE16(pos);
2005 pos += 2;
2006 left -= 2;
2007 }
2008
2009 if (left >= 2) {
2010 u16 num_pmkid = WPA_GET_LE16(pos);
2011 pos += 2;
2012 left -= 2;
2013 if (num_pmkid > (unsigned int) left / PMKID_LEN) {
2014 wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
2015 "(num_pmkid=%u left=%d)",
2016 __func__, num_pmkid, left);
2017 data->num_pmkid = 0;
2018 return -9;
2019 } else {
2020 data->num_pmkid = num_pmkid;
2021 data->pmkid = pos;
2022 pos += data->num_pmkid * PMKID_LEN;
2023 left -= data->num_pmkid * PMKID_LEN;
2024 }
2025 }
2026
2027 if (left >= 4) {
2028 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
2029 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
2030 wpa_printf(MSG_DEBUG,
2031 "%s: Unsupported management group cipher 0x%x (%08x)",
2032 __func__, data->mgmt_group_cipher,
2033 WPA_GET_BE32(pos));
2034 return -10;
2035 }
2036 pos += RSN_SELECTOR_LEN;
2037 left -= RSN_SELECTOR_LEN;
2038 }
2039
2040 if (left > 0) {
2041 wpa_hexdump(MSG_DEBUG,
2042 "wpa_parse_wpa_ie_rsn: ignore trailing bytes",
2043 pos, left);
2044 }
2045
2046 return 0;
2047 }
2048
2049
wpa_selector_to_bitfield(const u8 * s)2050 static int wpa_selector_to_bitfield(const u8 *s)
2051 {
2052 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
2053 return WPA_CIPHER_NONE;
2054 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
2055 return WPA_CIPHER_TKIP;
2056 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
2057 return WPA_CIPHER_CCMP;
2058 return 0;
2059 }
2060
2061
wpa_key_mgmt_to_bitfield(const u8 * s)2062 static int wpa_key_mgmt_to_bitfield(const u8 *s)
2063 {
2064 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
2065 return WPA_KEY_MGMT_IEEE8021X;
2066 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
2067 return WPA_KEY_MGMT_PSK;
2068 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
2069 return WPA_KEY_MGMT_WPA_NONE;
2070 return 0;
2071 }
2072
2073
wpa_parse_wpa_ie_wpa(const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)2074 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
2075 struct wpa_ie_data *data)
2076 {
2077 const struct wpa_ie_hdr *hdr;
2078 const u8 *pos;
2079 int left;
2080 int i, count;
2081
2082 os_memset(data, 0, sizeof(*data));
2083 data->proto = WPA_PROTO_WPA;
2084 data->pairwise_cipher = WPA_CIPHER_TKIP;
2085 data->group_cipher = WPA_CIPHER_TKIP;
2086 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
2087 data->capabilities = 0;
2088 data->pmkid = NULL;
2089 data->num_pmkid = 0;
2090 data->mgmt_group_cipher = 0;
2091
2092 if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
2093 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
2094 __func__, (unsigned long) wpa_ie_len);
2095 return -1;
2096 }
2097
2098 hdr = (const struct wpa_ie_hdr *) wpa_ie;
2099
2100 if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
2101 hdr->len != wpa_ie_len - 2 ||
2102 RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
2103 WPA_GET_LE16(hdr->version) != WPA_VERSION) {
2104 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
2105 __func__);
2106 return -2;
2107 }
2108
2109 pos = (const u8 *) (hdr + 1);
2110 left = wpa_ie_len - sizeof(*hdr);
2111
2112 if (left >= WPA_SELECTOR_LEN) {
2113 data->group_cipher = wpa_selector_to_bitfield(pos);
2114 pos += WPA_SELECTOR_LEN;
2115 left -= WPA_SELECTOR_LEN;
2116 } else if (left > 0) {
2117 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
2118 __func__, left);
2119 return -3;
2120 }
2121
2122 if (left >= 2) {
2123 data->pairwise_cipher = 0;
2124 count = WPA_GET_LE16(pos);
2125 pos += 2;
2126 left -= 2;
2127 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2128 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
2129 "count %u left %u", __func__, count, left);
2130 return -4;
2131 }
2132 for (i = 0; i < count; i++) {
2133 data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
2134 pos += WPA_SELECTOR_LEN;
2135 left -= WPA_SELECTOR_LEN;
2136 }
2137 } else if (left == 1) {
2138 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
2139 __func__);
2140 return -5;
2141 }
2142
2143 if (left >= 2) {
2144 data->key_mgmt = 0;
2145 count = WPA_GET_LE16(pos);
2146 pos += 2;
2147 left -= 2;
2148 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
2149 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
2150 "count %u left %u", __func__, count, left);
2151 return -6;
2152 }
2153 for (i = 0; i < count; i++) {
2154 data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
2155 pos += WPA_SELECTOR_LEN;
2156 left -= WPA_SELECTOR_LEN;
2157 }
2158 } else if (left == 1) {
2159 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
2160 __func__);
2161 return -7;
2162 }
2163
2164 if (left >= 2) {
2165 data->capabilities = WPA_GET_LE16(pos);
2166 pos += 2;
2167 left -= 2;
2168 }
2169
2170 if (left > 0) {
2171 wpa_hexdump(MSG_DEBUG,
2172 "wpa_parse_wpa_ie_wpa: ignore trailing bytes",
2173 pos, left);
2174 }
2175
2176 return 0;
2177 }
2178
2179
wpa_default_rsn_cipher(int freq)2180 int wpa_default_rsn_cipher(int freq)
2181 {
2182 if (freq > 56160)
2183 return WPA_CIPHER_GCMP; /* DMG */
2184
2185 return WPA_CIPHER_CCMP;
2186 }
2187
2188
2189 #ifdef CONFIG_IEEE80211R
2190
2191 /**
2192 * wpa_derive_pmk_r0 - Derive PMK-R0 and PMKR0Name
2193 *
2194 * IEEE Std 802.11r-2008 - 8.5.1.5.3
2195 */
wpa_derive_pmk_r0(const u8 * xxkey,size_t xxkey_len,const u8 * ssid,size_t ssid_len,const u8 * mdid,const u8 * r0kh_id,size_t r0kh_id_len,const u8 * s0kh_id,u8 * pmk_r0,u8 * pmk_r0_name,int key_mgmt)2196 int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
2197 const u8 *ssid, size_t ssid_len,
2198 const u8 *mdid, const u8 *r0kh_id, size_t r0kh_id_len,
2199 const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
2200 int key_mgmt)
2201 {
2202 u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
2203 FT_R0KH_ID_MAX_LEN + ETH_ALEN];
2204 u8 *pos, r0_key_data[64 + 16], hash[64];
2205 const u8 *addr[2];
2206 size_t len[2];
2207 size_t q, r0_key_data_len;
2208 int res;
2209
2210 if (key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2211 (xxkey_len == SHA256_MAC_LEN || xxkey_len == SHA384_MAC_LEN ||
2212 xxkey_len == SHA512_MAC_LEN))
2213 q = xxkey_len;
2214 else if (wpa_key_mgmt_sha384(key_mgmt))
2215 q = SHA384_MAC_LEN;
2216 else
2217 q = SHA256_MAC_LEN;
2218 r0_key_data_len = q + 16;
2219
2220 /*
2221 * R0-Key-Data = KDF-Hash-Length(XXKey, "FT-R0",
2222 * SSIDlength || SSID || MDID || R0KHlength ||
2223 * R0KH-ID || S0KH-ID)
2224 * XXKey is either the second 256 bits of MSK or PSK; or the first
2225 * 384 bits of MSK for FT-EAP-SHA384; or PMK from SAE.
2226 * PMK-R0 = L(R0-Key-Data, 0, Q)
2227 * PMK-R0Name-Salt = L(R0-Key-Data, Q, 128)
2228 * Q = 384 for FT-EAP-SHA384; the length of the digest generated by H()
2229 * for FT-SAE-EXT-KEY; or otherwise, 256
2230 */
2231 if (ssid_len > SSID_MAX_LEN || r0kh_id_len > FT_R0KH_ID_MAX_LEN)
2232 return -1;
2233 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R0 using KDF-SHA%zu", q * 8);
2234 wpa_hexdump_key(MSG_DEBUG, "FT: XXKey", xxkey, xxkey_len);
2235 wpa_hexdump_ascii(MSG_DEBUG, "FT: SSID", ssid, ssid_len);
2236 wpa_hexdump(MSG_DEBUG, "FT: MDID", mdid, MOBILITY_DOMAIN_ID_LEN);
2237 wpa_hexdump_ascii(MSG_DEBUG, "FT: R0KH-ID", r0kh_id, r0kh_id_len);
2238 wpa_printf(MSG_DEBUG, "FT: S0KH-ID: " MACSTR, MAC2STR(s0kh_id));
2239 pos = buf;
2240 *pos++ = ssid_len;
2241 os_memcpy(pos, ssid, ssid_len);
2242 pos += ssid_len;
2243 os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);
2244 pos += MOBILITY_DOMAIN_ID_LEN;
2245 *pos++ = r0kh_id_len;
2246 os_memcpy(pos, r0kh_id, r0kh_id_len);
2247 pos += r0kh_id_len;
2248 os_memcpy(pos, s0kh_id, ETH_ALEN);
2249 pos += ETH_ALEN;
2250
2251 res = -1;
2252 #ifdef CONFIG_SHA512
2253 if (q == SHA512_MAC_LEN) {
2254 if (xxkey_len != SHA512_MAC_LEN) {
2255 wpa_printf(MSG_ERROR,
2256 "FT: Unexpected XXKey length %d (expected %d)",
2257 (int) xxkey_len, SHA512_MAC_LEN);
2258 return -1;
2259 }
2260 res = sha512_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2261 r0_key_data, r0_key_data_len);
2262 }
2263 #endif /* CONFIG_SHA512 */
2264 #ifdef CONFIG_SHA384
2265 if (q == SHA384_MAC_LEN) {
2266 if (xxkey_len != SHA384_MAC_LEN) {
2267 wpa_printf(MSG_ERROR,
2268 "FT: Unexpected XXKey length %d (expected %d)",
2269 (int) xxkey_len, SHA384_MAC_LEN);
2270 return -1;
2271 }
2272 res = sha384_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2273 r0_key_data, r0_key_data_len);
2274 }
2275 #endif /* CONFIG_SHA384 */
2276 if (q == SHA256_MAC_LEN) {
2277 if (xxkey_len != PMK_LEN) {
2278 wpa_printf(MSG_ERROR,
2279 "FT: Unexpected XXKey length %d (expected %d)",
2280 (int) xxkey_len, PMK_LEN);
2281 return -1;
2282 }
2283 res = sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
2284 r0_key_data, r0_key_data_len);
2285 }
2286 if (res < 0)
2287 return res;
2288 os_memcpy(pmk_r0, r0_key_data, q);
2289 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, q);
2290 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
2291
2292 /*
2293 * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
2294 */
2295 addr[0] = (const u8 *) "FT-R0N";
2296 len[0] = 6;
2297 addr[1] = &r0_key_data[q];
2298 len[1] = 16;
2299
2300 res = -1;
2301 #ifdef CONFIG_SHA512
2302 if (q == SHA512_MAC_LEN)
2303 res = sha512_vector(2, addr, len, hash);
2304 #endif /* CONFIG_SHA512 */
2305 #ifdef CONFIG_SHA384
2306 if (q == SHA384_MAC_LEN)
2307 res = sha384_vector(2, addr, len, hash);
2308 #endif /* CONFIG_SHA384 */
2309 if (q == SHA256_MAC_LEN)
2310 res = sha256_vector(2, addr, len, hash);
2311 if (res < 0) {
2312 wpa_printf(MSG_DEBUG,
2313 "FT: Failed to derive PMKR0Name (PMK-R0 len %zu)",
2314 q);
2315 return res;
2316 }
2317 os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
2318 wpa_hexdump(MSG_DEBUG, "FT: PMKR0Name", pmk_r0_name, WPA_PMK_NAME_LEN);
2319 forced_memzero(r0_key_data, sizeof(r0_key_data));
2320 return 0;
2321 }
2322
2323
2324 /**
2325 * wpa_derive_pmk_r1_name - Derive PMKR1Name
2326 *
2327 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2328 */
wpa_derive_pmk_r1_name(const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1_name,size_t pmk_r1_len)2329 int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
2330 const u8 *s1kh_id, u8 *pmk_r1_name,
2331 size_t pmk_r1_len)
2332 {
2333 u8 hash[64];
2334 const u8 *addr[4];
2335 size_t len[4];
2336 int res;
2337 const char *title;
2338
2339 /*
2340 * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
2341 * R1KH-ID || S1KH-ID))
2342 */
2343 addr[0] = (const u8 *) "FT-R1N";
2344 len[0] = 6;
2345 addr[1] = pmk_r0_name;
2346 len[1] = WPA_PMK_NAME_LEN;
2347 addr[2] = r1kh_id;
2348 len[2] = FT_R1KH_ID_LEN;
2349 addr[3] = s1kh_id;
2350 len[3] = ETH_ALEN;
2351
2352 res = -1;
2353 #ifdef CONFIG_SHA512
2354 if (pmk_r1_len == SHA512_MAC_LEN) {
2355 title = "FT: PMKR1Name (using SHA512)";
2356 res = sha512_vector(4, addr, len, hash);
2357 }
2358 #endif /* CONFIG_SHA512 */
2359 #ifdef CONFIG_SHA384
2360 if (pmk_r1_len == SHA384_MAC_LEN) {
2361 title = "FT: PMKR1Name (using SHA384)";
2362 res = sha384_vector(4, addr, len, hash);
2363 }
2364 #endif /* CONFIG_SHA384 */
2365 if (pmk_r1_len == SHA256_MAC_LEN) {
2366 title = "FT: PMKR1Name (using SHA256)";
2367 res = sha256_vector(4, addr, len, hash);
2368 }
2369 if (res < 0) {
2370 wpa_printf(MSG_DEBUG,
2371 "FT: Failed to derive PMKR1Name (PMK-R1 len %zu)",
2372 pmk_r1_len);
2373 return res;
2374 }
2375 os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
2376 wpa_hexdump(MSG_DEBUG, title, pmk_r1_name, WPA_PMK_NAME_LEN);
2377 return 0;
2378 }
2379
2380
2381 /**
2382 * wpa_derive_pmk_r1 - Derive PMK-R1 and PMKR1Name from PMK-R0
2383 *
2384 * IEEE Std 802.11r-2008 - 8.5.1.5.4
2385 */
wpa_derive_pmk_r1(const u8 * pmk_r0,size_t pmk_r0_len,const u8 * pmk_r0_name,const u8 * r1kh_id,const u8 * s1kh_id,u8 * pmk_r1,u8 * pmk_r1_name)2386 int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
2387 const u8 *pmk_r0_name,
2388 const u8 *r1kh_id, const u8 *s1kh_id,
2389 u8 *pmk_r1, u8 *pmk_r1_name)
2390 {
2391 u8 buf[FT_R1KH_ID_LEN + ETH_ALEN];
2392 u8 *pos;
2393 int res;
2394
2395 /* PMK-R1 = KDF-Hash(PMK-R0, "FT-R1", R1KH-ID || S1KH-ID) */
2396 wpa_printf(MSG_DEBUG, "FT: Derive PMK-R1 using KDF-SHA%zu",
2397 pmk_r0_len * 8);
2398 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len);
2399 wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", r1kh_id, FT_R1KH_ID_LEN);
2400 wpa_printf(MSG_DEBUG, "FT: S1KH-ID: " MACSTR, MAC2STR(s1kh_id));
2401 pos = buf;
2402 os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);
2403 pos += FT_R1KH_ID_LEN;
2404 os_memcpy(pos, s1kh_id, ETH_ALEN);
2405 pos += ETH_ALEN;
2406
2407 res = -1;
2408 #ifdef CONFIG_SHA512
2409 if (pmk_r0_len == SHA512_MAC_LEN)
2410 res = sha512_prf(pmk_r0, pmk_r0_len, "FT-R1",
2411 buf, pos - buf, pmk_r1, pmk_r0_len);
2412 #endif /* CONFIG_SHA512 */
2413 #ifdef CONFIG_SHA384
2414 if (pmk_r0_len == SHA384_MAC_LEN)
2415 res = sha384_prf(pmk_r0, pmk_r0_len, "FT-R1",
2416 buf, pos - buf, pmk_r1, pmk_r0_len);
2417 #endif /* CONFIG_SHA384 */
2418 if (pmk_r0_len == SHA256_MAC_LEN)
2419 res = sha256_prf(pmk_r0, pmk_r0_len, "FT-R1",
2420 buf, pos - buf, pmk_r1, pmk_r0_len);
2421 if (res < 0) {
2422 wpa_printf(MSG_ERROR, "FT: Failed to derive PMK-R1");
2423 return res;
2424 }
2425 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
2426
2427 return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
2428 pmk_r1_name, pmk_r0_len);
2429 }
2430
2431
2432 /**
2433 * wpa_pmk_r1_to_ptk - Derive PTK and PTKName from PMK-R1
2434 *
2435 * IEEE Std 802.11r-2008 - 8.5.1.5.5
2436 */
wpa_pmk_r1_to_ptk(const u8 * pmk_r1,size_t pmk_r1_len,const u8 * snonce,const u8 * anonce,const u8 * sta_addr,const u8 * bssid,const u8 * pmk_r1_name,struct wpa_ptk * ptk,u8 * ptk_name,int akmp,int cipher,size_t kdk_len)2437 int wpa_pmk_r1_to_ptk(const u8 *pmk_r1, size_t pmk_r1_len,
2438 const u8 *snonce, const u8 *anonce,
2439 const u8 *sta_addr, const u8 *bssid,
2440 const u8 *pmk_r1_name,
2441 struct wpa_ptk *ptk, u8 *ptk_name, int akmp, int cipher,
2442 size_t kdk_len)
2443 {
2444 u8 buf[2 * WPA_NONCE_LEN + 2 * ETH_ALEN];
2445 u8 *pos, hash[32];
2446 const u8 *addr[6];
2447 size_t len[6];
2448 u8 tmp[2 * WPA_KCK_MAX_LEN + 2 * WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
2449 WPA_KDK_MAX_LEN];
2450 size_t ptk_len, offset;
2451 size_t key_len;
2452 int res;
2453
2454 if (kdk_len > WPA_KDK_MAX_LEN) {
2455 wpa_printf(MSG_ERROR,
2456 "FT: KDK len=%zu exceeds max supported len",
2457 kdk_len);
2458 return -1;
2459 }
2460
2461 if (akmp == WPA_KEY_MGMT_FT_SAE_EXT_KEY &&
2462 (pmk_r1_len == SHA256_MAC_LEN || pmk_r1_len == SHA384_MAC_LEN ||
2463 pmk_r1_len == SHA512_MAC_LEN))
2464 key_len = pmk_r1_len;
2465 else if (wpa_key_mgmt_sha384(akmp))
2466 key_len = SHA384_MAC_LEN;
2467 else
2468 key_len = SHA256_MAC_LEN;
2469
2470 /*
2471 * PTK = KDF-PTKLen(PMK-R1, "FT-PTK", SNonce || ANonce ||
2472 * BSSID || STA-ADDR)
2473 */
2474 wpa_printf(MSG_DEBUG, "FT: Derive PTK using KDF-SHA%zu", key_len * 8);
2475 wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len);
2476 wpa_hexdump(MSG_DEBUG, "FT: SNonce", snonce, WPA_NONCE_LEN);
2477 wpa_hexdump(MSG_DEBUG, "FT: ANonce", anonce, WPA_NONCE_LEN);
2478 wpa_printf(MSG_DEBUG, "FT: BSSID=" MACSTR " STA-ADDR=" MACSTR,
2479 MAC2STR(bssid), MAC2STR(sta_addr));
2480 pos = buf;
2481 os_memcpy(pos, snonce, WPA_NONCE_LEN);
2482 pos += WPA_NONCE_LEN;
2483 os_memcpy(pos, anonce, WPA_NONCE_LEN);
2484 pos += WPA_NONCE_LEN;
2485 os_memcpy(pos, bssid, ETH_ALEN);
2486 pos += ETH_ALEN;
2487 os_memcpy(pos, sta_addr, ETH_ALEN);
2488 pos += ETH_ALEN;
2489
2490 ptk->kck_len = wpa_kck_len(akmp, key_len);
2491 ptk->kck2_len = wpa_kck2_len(akmp);
2492 ptk->kek_len = wpa_kek_len(akmp, key_len);
2493 ptk->kek2_len = wpa_kek2_len(akmp);
2494 ptk->tk_len = wpa_cipher_key_len(cipher);
2495 ptk->kdk_len = kdk_len;
2496 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len +
2497 ptk->kck2_len + ptk->kek2_len + ptk->kdk_len;
2498
2499 res = -1;
2500 #ifdef CONFIG_SHA512
2501 if (key_len == SHA512_MAC_LEN) {
2502 if (pmk_r1_len != SHA512_MAC_LEN) {
2503 wpa_printf(MSG_ERROR,
2504 "FT: Unexpected PMK-R1 length %d (expected %d)",
2505 (int) pmk_r1_len, SHA512_MAC_LEN);
2506 return -1;
2507 }
2508 res = sha512_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2509 buf, pos - buf, tmp, ptk_len);
2510 }
2511 #endif /* CONFIG_SHA512 */
2512 #ifdef CONFIG_SHA384
2513 if (key_len == SHA384_MAC_LEN) {
2514 if (pmk_r1_len != SHA384_MAC_LEN) {
2515 wpa_printf(MSG_ERROR,
2516 "FT: Unexpected PMK-R1 length %d (expected %d)",
2517 (int) pmk_r1_len, SHA384_MAC_LEN);
2518 return -1;
2519 }
2520 res = sha384_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2521 buf, pos - buf, tmp, ptk_len);
2522 }
2523 #endif /* CONFIG_SHA384 */
2524 if (key_len == SHA256_MAC_LEN) {
2525 if (pmk_r1_len != PMK_LEN) {
2526 wpa_printf(MSG_ERROR,
2527 "FT: Unexpected PMK-R1 length %d (expected %d)",
2528 (int) pmk_r1_len, PMK_LEN);
2529 return -1;
2530 }
2531 res = sha256_prf(pmk_r1, pmk_r1_len, "FT-PTK",
2532 buf, pos - buf, tmp, ptk_len);
2533 }
2534 if (res < 0)
2535 return -1;
2536 wpa_hexdump_key(MSG_DEBUG, "FT: PTK", tmp, ptk_len);
2537
2538 /*
2539 * PTKName = Truncate-128(SHA-256(PMKR1Name || "FT-PTKN" || SNonce ||
2540 * ANonce || BSSID || STA-ADDR))
2541 */
2542 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN);
2543 addr[0] = pmk_r1_name;
2544 len[0] = WPA_PMK_NAME_LEN;
2545 addr[1] = (const u8 *) "FT-PTKN";
2546 len[1] = 7;
2547 addr[2] = snonce;
2548 len[2] = WPA_NONCE_LEN;
2549 addr[3] = anonce;
2550 len[3] = WPA_NONCE_LEN;
2551 addr[4] = bssid;
2552 len[4] = ETH_ALEN;
2553 addr[5] = sta_addr;
2554 len[5] = ETH_ALEN;
2555
2556 if (sha256_vector(6, addr, len, hash) < 0)
2557 return -1;
2558 os_memcpy(ptk_name, hash, WPA_PMK_NAME_LEN);
2559
2560 os_memcpy(ptk->kck, tmp, ptk->kck_len);
2561 offset = ptk->kck_len;
2562 os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
2563 offset += ptk->kek_len;
2564 os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
2565 offset += ptk->tk_len;
2566 os_memcpy(ptk->kck2, tmp + offset, ptk->kck2_len);
2567 offset += ptk->kck2_len;
2568 os_memcpy(ptk->kek2, tmp + offset, ptk->kek2_len);
2569 offset += ptk->kek2_len;
2570 os_memcpy(ptk->kdk, tmp + offset, ptk->kdk_len);
2571
2572 wpa_hexdump_key(MSG_DEBUG, "FT: KCK", ptk->kck, ptk->kck_len);
2573 wpa_hexdump_key(MSG_DEBUG, "FT: KEK", ptk->kek, ptk->kek_len);
2574 if (ptk->kck2_len)
2575 wpa_hexdump_key(MSG_DEBUG, "FT: KCK2",
2576 ptk->kck2, ptk->kck2_len);
2577 if (ptk->kek2_len)
2578 wpa_hexdump_key(MSG_DEBUG, "FT: KEK2",
2579 ptk->kek2, ptk->kek2_len);
2580 if (ptk->kdk_len)
2581 wpa_hexdump_key(MSG_DEBUG, "FT: KDK", ptk->kdk, ptk->kdk_len);
2582
2583 wpa_hexdump_key(MSG_DEBUG, "FT: TK", ptk->tk, ptk->tk_len);
2584 wpa_hexdump(MSG_DEBUG, "FT: PTKName", ptk_name, WPA_PMK_NAME_LEN);
2585
2586 forced_memzero(tmp, sizeof(tmp));
2587
2588 return 0;
2589 }
2590
2591 #endif /* CONFIG_IEEE80211R */
2592
2593
2594 /**
2595 * rsn_pmkid - Calculate PMK identifier
2596 * @pmk: Pairwise master key
2597 * @pmk_len: Length of pmk in bytes
2598 * @aa: Authenticator address
2599 * @spa: Supplicant address
2600 * @pmkid: Buffer for PMKID
2601 * @akmp: Negotiated key management protocol
2602 *
2603 * IEEE Std 802.11-2016 - 12.7.1.3 Pairwise key hierarchy
2604 * AKM: 00-0F-AC:3, 00-0F-AC:5, 00-0F-AC:6, 00-0F-AC:14, 00-0F-AC:16
2605 * PMKID = Truncate-128(HMAC-SHA-256(PMK, "PMK Name" || AA || SPA))
2606 * AKM: 00-0F-AC:11
2607 * See rsn_pmkid_suite_b()
2608 * AKM: 00-0F-AC:12
2609 * See rsn_pmkid_suite_b_192()
2610 * AKM: 00-0F-AC:13, 00-0F-AC:15, 00-0F-AC:17
2611 * PMKID = Truncate-128(HMAC-SHA-384(PMK, "PMK Name" || AA || SPA))
2612 * Otherwise:
2613 * PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name" || AA || SPA))
2614 */
rsn_pmkid(const u8 * pmk,size_t pmk_len,const u8 * aa,const u8 * spa,u8 * pmkid,int akmp)2615 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
2616 u8 *pmkid, int akmp)
2617 {
2618 char *title = "PMK Name";
2619 const u8 *addr[3];
2620 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2621 unsigned char hash[SHA384_MAC_LEN];
2622
2623 addr[0] = (u8 *) title;
2624 addr[1] = aa;
2625 addr[2] = spa;
2626
2627 if (0) {
2628 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
2629 } else if (wpa_key_mgmt_sha384(akmp)) {
2630 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-384");
2631 hmac_sha384_vector(pmk, pmk_len, 3, addr, len, hash);
2632 #endif /* CONFIG_FILS || CONFIG_SHA384 */
2633 } else if (wpa_key_mgmt_sha256(akmp)) {
2634 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-256");
2635 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
2636 } else {
2637 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-1");
2638 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
2639 }
2640 wpa_hexdump(MSG_DEBUG, "RSN: Derived PMKID", hash, PMKID_LEN);
2641 os_memcpy(pmkid, hash, PMKID_LEN);
2642 }
2643
2644
2645 #ifdef CONFIG_SUITEB
2646 /**
2647 * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
2648 * @kck: Key confirmation key
2649 * @kck_len: Length of kck in bytes
2650 * @aa: Authenticator address
2651 * @spa: Supplicant address
2652 * @pmkid: Buffer for PMKID
2653 * Returns: 0 on success, -1 on failure
2654 *
2655 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2656 * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
2657 */
rsn_pmkid_suite_b(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2658 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
2659 const u8 *spa, u8 *pmkid)
2660 {
2661 char *title = "PMK Name";
2662 const u8 *addr[3];
2663 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2664 unsigned char hash[SHA256_MAC_LEN];
2665
2666 addr[0] = (u8 *) title;
2667 addr[1] = aa;
2668 addr[2] = spa;
2669
2670 if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
2671 return -1;
2672 os_memcpy(pmkid, hash, PMKID_LEN);
2673 return 0;
2674 }
2675 #endif /* CONFIG_SUITEB */
2676
2677
2678 #ifdef CONFIG_SUITEB192
2679 /**
2680 * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
2681 * @kck: Key confirmation key
2682 * @kck_len: Length of kck in bytes
2683 * @aa: Authenticator address
2684 * @spa: Supplicant address
2685 * @pmkid: Buffer for PMKID
2686 * Returns: 0 on success, -1 on failure
2687 *
2688 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
2689 * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
2690 */
rsn_pmkid_suite_b_192(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)2691 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
2692 const u8 *spa, u8 *pmkid)
2693 {
2694 char *title = "PMK Name";
2695 const u8 *addr[3];
2696 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
2697 unsigned char hash[SHA384_MAC_LEN];
2698
2699 addr[0] = (u8 *) title;
2700 addr[1] = aa;
2701 addr[2] = spa;
2702
2703 if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
2704 return -1;
2705 os_memcpy(pmkid, hash, PMKID_LEN);
2706 return 0;
2707 }
2708 #endif /* CONFIG_SUITEB192 */
2709
2710
2711 /**
2712 * wpa_cipher_txt - Convert cipher suite to a text string
2713 * @cipher: Cipher suite (WPA_CIPHER_* enum)
2714 * Returns: Pointer to a text string of the cipher suite name
2715 */
wpa_cipher_txt(int cipher)2716 const char * wpa_cipher_txt(int cipher)
2717 {
2718 switch (cipher) {
2719 case WPA_CIPHER_NONE:
2720 return "NONE";
2721 #ifdef CONFIG_WEP
2722 case WPA_CIPHER_WEP40:
2723 return "WEP-40";
2724 case WPA_CIPHER_WEP104:
2725 return "WEP-104";
2726 #endif /* CONFIG_WEP */
2727 case WPA_CIPHER_TKIP:
2728 return "TKIP";
2729 case WPA_CIPHER_CCMP:
2730 return "CCMP";
2731 case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
2732 return "CCMP+TKIP";
2733 case WPA_CIPHER_GCMP:
2734 return "GCMP";
2735 case WPA_CIPHER_GCMP_256:
2736 return "GCMP-256";
2737 case WPA_CIPHER_CCMP_256:
2738 return "CCMP-256";
2739 case WPA_CIPHER_AES_128_CMAC:
2740 return "BIP";
2741 case WPA_CIPHER_BIP_GMAC_128:
2742 return "BIP-GMAC-128";
2743 case WPA_CIPHER_BIP_GMAC_256:
2744 return "BIP-GMAC-256";
2745 case WPA_CIPHER_BIP_CMAC_256:
2746 return "BIP-CMAC-256";
2747 case WPA_CIPHER_GTK_NOT_USED:
2748 return "GTK_NOT_USED";
2749 default:
2750 return "UNKNOWN";
2751 }
2752 }
2753
2754
2755 /**
2756 * wpa_key_mgmt_txt - Convert key management suite to a text string
2757 * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
2758 * @proto: WPA/WPA2 version (WPA_PROTO_*)
2759 * Returns: Pointer to a text string of the key management suite name
2760 */
wpa_key_mgmt_txt(int key_mgmt,int proto)2761 const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
2762 {
2763 switch (key_mgmt) {
2764 case WPA_KEY_MGMT_IEEE8021X:
2765 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2766 return "WPA2+WPA/IEEE 802.1X/EAP";
2767 return proto == WPA_PROTO_RSN ?
2768 "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
2769 case WPA_KEY_MGMT_PSK:
2770 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
2771 return "WPA2-PSK+WPA-PSK";
2772 return proto == WPA_PROTO_RSN ?
2773 "WPA2-PSK" : "WPA-PSK";
2774 case WPA_KEY_MGMT_NONE:
2775 return "NONE";
2776 case WPA_KEY_MGMT_WPA_NONE:
2777 return "WPA-NONE";
2778 case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
2779 return "IEEE 802.1X (no WPA)";
2780 #ifdef CONFIG_IEEE80211R
2781 case WPA_KEY_MGMT_FT_IEEE8021X:
2782 return "FT-EAP";
2783 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
2784 return "FT-EAP-SHA384";
2785 case WPA_KEY_MGMT_FT_PSK:
2786 return "FT-PSK";
2787 #endif /* CONFIG_IEEE80211R */
2788 case WPA_KEY_MGMT_IEEE8021X_SHA256:
2789 return "WPA2-EAP-SHA256";
2790 case WPA_KEY_MGMT_PSK_SHA256:
2791 return "WPA2-PSK-SHA256";
2792 case WPA_KEY_MGMT_WPS:
2793 return "WPS";
2794 case WPA_KEY_MGMT_SAE:
2795 return "SAE";
2796 case WPA_KEY_MGMT_SAE_EXT_KEY:
2797 return "SAE-EXT-KEY";
2798 case WPA_KEY_MGMT_FT_SAE:
2799 return "FT-SAE";
2800 case WPA_KEY_MGMT_FT_SAE_EXT_KEY:
2801 return "FT-SAE-EXT-KEY";
2802 case WPA_KEY_MGMT_OSEN:
2803 return "OSEN";
2804 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2805 return "WPA2-EAP-SUITE-B";
2806 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2807 return "WPA2-EAP-SUITE-B-192";
2808 case WPA_KEY_MGMT_FILS_SHA256:
2809 return "FILS-SHA256";
2810 case WPA_KEY_MGMT_FILS_SHA384:
2811 return "FILS-SHA384";
2812 case WPA_KEY_MGMT_FT_FILS_SHA256:
2813 return "FT-FILS-SHA256";
2814 case WPA_KEY_MGMT_FT_FILS_SHA384:
2815 return "FT-FILS-SHA384";
2816 case WPA_KEY_MGMT_OWE:
2817 return "OWE";
2818 case WPA_KEY_MGMT_DPP:
2819 return "DPP";
2820 case WPA_KEY_MGMT_PASN:
2821 return "PASN";
2822 case WPA_KEY_MGMT_IEEE8021X_SHA384:
2823 return "WPA2-EAP-SHA384";
2824 default:
2825 return "UNKNOWN";
2826 }
2827 }
2828
2829
wpa_akm_to_suite(int akm)2830 u32 wpa_akm_to_suite(int akm)
2831 {
2832 if (akm & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
2833 return RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
2834 if (akm & WPA_KEY_MGMT_FT_IEEE8021X)
2835 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2836 if (akm & WPA_KEY_MGMT_FT_PSK)
2837 return RSN_AUTH_KEY_MGMT_FT_PSK;
2838 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA384)
2839 return RSN_AUTH_KEY_MGMT_802_1X_SHA384;
2840 if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
2841 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2842 if (akm & WPA_KEY_MGMT_IEEE8021X)
2843 return RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
2844 if (akm & WPA_KEY_MGMT_PSK_SHA256)
2845 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2846 if (akm & WPA_KEY_MGMT_PSK)
2847 return RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
2848 if (akm & WPA_KEY_MGMT_CCKM)
2849 return RSN_AUTH_KEY_MGMT_CCKM;
2850 if (akm & WPA_KEY_MGMT_OSEN)
2851 return RSN_AUTH_KEY_MGMT_OSEN;
2852 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
2853 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2854 if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2855 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2856 if (akm & WPA_KEY_MGMT_FILS_SHA256)
2857 return RSN_AUTH_KEY_MGMT_FILS_SHA256;
2858 if (akm & WPA_KEY_MGMT_FILS_SHA384)
2859 return RSN_AUTH_KEY_MGMT_FILS_SHA384;
2860 if (akm & WPA_KEY_MGMT_FT_FILS_SHA256)
2861 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
2862 if (akm & WPA_KEY_MGMT_FT_FILS_SHA384)
2863 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
2864 if (akm & WPA_KEY_MGMT_SAE)
2865 return RSN_AUTH_KEY_MGMT_SAE;
2866 if (akm & WPA_KEY_MGMT_SAE_EXT_KEY)
2867 return RSN_AUTH_KEY_MGMT_SAE_EXT_KEY;
2868 if (akm & WPA_KEY_MGMT_FT_SAE)
2869 return RSN_AUTH_KEY_MGMT_FT_SAE;
2870 if (akm & WPA_KEY_MGMT_FT_SAE_EXT_KEY)
2871 return RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY;
2872 if (akm & WPA_KEY_MGMT_OWE)
2873 return RSN_AUTH_KEY_MGMT_OWE;
2874 if (akm & WPA_KEY_MGMT_DPP)
2875 return RSN_AUTH_KEY_MGMT_DPP;
2876 return 0;
2877 }
2878
2879
wpa_compare_rsn_ie(int ft_initial_assoc,const u8 * ie1,size_t ie1len,const u8 * ie2,size_t ie2len)2880 int wpa_compare_rsn_ie(int ft_initial_assoc,
2881 const u8 *ie1, size_t ie1len,
2882 const u8 *ie2, size_t ie2len)
2883 {
2884 if (ie1 == NULL || ie2 == NULL)
2885 return -1;
2886
2887 if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
2888 return 0; /* identical IEs */
2889
2890 #ifdef CONFIG_IEEE80211R
2891 if (ft_initial_assoc) {
2892 struct wpa_ie_data ie1d, ie2d;
2893 /*
2894 * The PMKID-List in RSN IE is different between Beacon/Probe
2895 * Response/(Re)Association Request frames and EAPOL-Key
2896 * messages in FT initial mobility domain association. Allow
2897 * for this, but verify that other parts of the RSN IEs are
2898 * identical.
2899 */
2900 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
2901 wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
2902 return -1;
2903 if (ie1d.proto == ie2d.proto &&
2904 ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
2905 ie1d.group_cipher == ie2d.group_cipher &&
2906 ie1d.key_mgmt == ie2d.key_mgmt &&
2907 ie1d.capabilities == ie2d.capabilities &&
2908 ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
2909 return 0;
2910 }
2911 #endif /* CONFIG_IEEE80211R */
2912
2913 return -1;
2914 }
2915
2916
wpa_insert_pmkid(u8 * ies,size_t * ies_len,const u8 * pmkid,bool replace)2917 int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid, bool replace)
2918 {
2919 u8 *start, *end, *rpos, *rend;
2920 int added = 0;
2921
2922 start = ies;
2923 end = ies + *ies_len;
2924
2925 while (start < end) {
2926 if (*start == WLAN_EID_RSN)
2927 break;
2928 start += 2 + start[1];
2929 }
2930 if (start >= end) {
2931 wpa_printf(MSG_ERROR, "RSN: Could not find RSNE in IEs data");
2932 return -1;
2933 }
2934 wpa_hexdump(MSG_DEBUG, "RSN: RSNE before modification",
2935 start, 2 + start[1]);
2936
2937 /* Find start of PMKID-Count */
2938 rpos = start + 2;
2939 rend = rpos + start[1];
2940
2941 /* Skip Version and Group Data Cipher Suite */
2942 rpos += 2 + 4;
2943 /* Skip Pairwise Cipher Suite Count and List */
2944 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2945 /* Skip AKM Suite Count and List */
2946 rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2947
2948 if (rpos == rend) {
2949 /* Add RSN Capabilities */
2950 os_memmove(rpos + 2, rpos, end - rpos);
2951 *rpos++ = 0;
2952 *rpos++ = 0;
2953 added += 2;
2954 start[1] += 2;
2955 rend = rpos;
2956 } else {
2957 /* Skip RSN Capabilities */
2958 rpos += 2;
2959 if (rpos > rend) {
2960 wpa_printf(MSG_ERROR,
2961 "RSN: Could not parse RSNE in IEs data");
2962 return -1;
2963 }
2964 }
2965
2966 if (rpos == rend) {
2967 /* No PMKID-Count field included; add it */
2968 os_memmove(rpos + 2 + PMKID_LEN, rpos, end + added - rpos);
2969 WPA_PUT_LE16(rpos, 1);
2970 rpos += 2;
2971 os_memcpy(rpos, pmkid, PMKID_LEN);
2972 added += 2 + PMKID_LEN;
2973 start[1] += 2 + PMKID_LEN;
2974 } else {
2975 u16 num_pmkid;
2976
2977 if (rend - rpos < 2)
2978 return -1;
2979 num_pmkid = WPA_GET_LE16(rpos);
2980 if (num_pmkid * PMKID_LEN > rend - rpos - 2)
2981 return -1;
2982 /* PMKID-Count was included; use it */
2983 if (replace && num_pmkid != 0) {
2984 u8 *after;
2985
2986 /*
2987 * PMKID may have been included in RSN IE in
2988 * (Re)Association Request frame, so remove the old
2989 * PMKID(s) first before adding the new one.
2990 */
2991 wpa_printf(MSG_DEBUG,
2992 "RSN: Remove %u old PMKID(s) from RSNE",
2993 num_pmkid);
2994 after = rpos + 2 + num_pmkid * PMKID_LEN;
2995 os_memmove(rpos + 2, after, end - after);
2996 start[1] -= num_pmkid * PMKID_LEN;
2997 added -= num_pmkid * PMKID_LEN;
2998 num_pmkid = 0;
2999 }
3000 WPA_PUT_LE16(rpos, num_pmkid + 1);
3001 rpos += 2;
3002 os_memmove(rpos + PMKID_LEN, rpos, end + added - rpos);
3003 os_memcpy(rpos, pmkid, PMKID_LEN);
3004 added += PMKID_LEN;
3005 start[1] += PMKID_LEN;
3006 }
3007
3008 wpa_hexdump(MSG_DEBUG, "RSN: RSNE after modification (PMKID inserted)",
3009 start, 2 + start[1]);
3010
3011 *ies_len += added;
3012
3013 return 0;
3014 }
3015
3016
wpa_cipher_key_len(int cipher)3017 int wpa_cipher_key_len(int cipher)
3018 {
3019 switch (cipher) {
3020 case WPA_CIPHER_CCMP_256:
3021 case WPA_CIPHER_GCMP_256:
3022 case WPA_CIPHER_BIP_GMAC_256:
3023 case WPA_CIPHER_BIP_CMAC_256:
3024 return 32;
3025 case WPA_CIPHER_CCMP:
3026 case WPA_CIPHER_GCMP:
3027 case WPA_CIPHER_AES_128_CMAC:
3028 case WPA_CIPHER_BIP_GMAC_128:
3029 return 16;
3030 case WPA_CIPHER_TKIP:
3031 return 32;
3032 default:
3033 return 0;
3034 }
3035 }
3036
3037
wpa_cipher_rsc_len(int cipher)3038 int wpa_cipher_rsc_len(int cipher)
3039 {
3040 switch (cipher) {
3041 case WPA_CIPHER_CCMP_256:
3042 case WPA_CIPHER_GCMP_256:
3043 case WPA_CIPHER_CCMP:
3044 case WPA_CIPHER_GCMP:
3045 case WPA_CIPHER_TKIP:
3046 return 6;
3047 default:
3048 return 0;
3049 }
3050 }
3051
3052
wpa_cipher_to_alg(int cipher)3053 enum wpa_alg wpa_cipher_to_alg(int cipher)
3054 {
3055 switch (cipher) {
3056 case WPA_CIPHER_CCMP_256:
3057 return WPA_ALG_CCMP_256;
3058 case WPA_CIPHER_GCMP_256:
3059 return WPA_ALG_GCMP_256;
3060 case WPA_CIPHER_CCMP:
3061 return WPA_ALG_CCMP;
3062 case WPA_CIPHER_GCMP:
3063 return WPA_ALG_GCMP;
3064 case WPA_CIPHER_TKIP:
3065 return WPA_ALG_TKIP;
3066 case WPA_CIPHER_AES_128_CMAC:
3067 return WPA_ALG_BIP_CMAC_128;
3068 case WPA_CIPHER_BIP_GMAC_128:
3069 return WPA_ALG_BIP_GMAC_128;
3070 case WPA_CIPHER_BIP_GMAC_256:
3071 return WPA_ALG_BIP_GMAC_256;
3072 case WPA_CIPHER_BIP_CMAC_256:
3073 return WPA_ALG_BIP_CMAC_256;
3074 default:
3075 return WPA_ALG_NONE;
3076 }
3077 }
3078
3079
wpa_cipher_valid_pairwise(int cipher)3080 int wpa_cipher_valid_pairwise(int cipher)
3081 {
3082 #ifdef CONFIG_NO_TKIP
3083 return cipher == WPA_CIPHER_CCMP_256 ||
3084 cipher == WPA_CIPHER_GCMP_256 ||
3085 cipher == WPA_CIPHER_CCMP ||
3086 cipher == WPA_CIPHER_GCMP;
3087 #else /* CONFIG_NO_TKIP */
3088 return cipher == WPA_CIPHER_CCMP_256 ||
3089 cipher == WPA_CIPHER_GCMP_256 ||
3090 cipher == WPA_CIPHER_CCMP ||
3091 cipher == WPA_CIPHER_GCMP ||
3092 cipher == WPA_CIPHER_TKIP;
3093 #endif /* CONFIG_NO_TKIP */
3094 }
3095
3096
wpa_cipher_to_suite(int proto,int cipher)3097 u32 wpa_cipher_to_suite(int proto, int cipher)
3098 {
3099 if (cipher & WPA_CIPHER_CCMP_256)
3100 return RSN_CIPHER_SUITE_CCMP_256;
3101 if (cipher & WPA_CIPHER_GCMP_256)
3102 return RSN_CIPHER_SUITE_GCMP_256;
3103 if (cipher & WPA_CIPHER_CCMP)
3104 return (proto == WPA_PROTO_RSN ?
3105 RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
3106 if (cipher & WPA_CIPHER_GCMP)
3107 return RSN_CIPHER_SUITE_GCMP;
3108 if (cipher & WPA_CIPHER_TKIP)
3109 return (proto == WPA_PROTO_RSN ?
3110 RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
3111 if (cipher & WPA_CIPHER_NONE)
3112 return (proto == WPA_PROTO_RSN ?
3113 RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
3114 if (cipher & WPA_CIPHER_GTK_NOT_USED)
3115 return RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED;
3116 if (cipher & WPA_CIPHER_AES_128_CMAC)
3117 return RSN_CIPHER_SUITE_AES_128_CMAC;
3118 if (cipher & WPA_CIPHER_BIP_GMAC_128)
3119 return RSN_CIPHER_SUITE_BIP_GMAC_128;
3120 if (cipher & WPA_CIPHER_BIP_GMAC_256)
3121 return RSN_CIPHER_SUITE_BIP_GMAC_256;
3122 if (cipher & WPA_CIPHER_BIP_CMAC_256)
3123 return RSN_CIPHER_SUITE_BIP_CMAC_256;
3124 return 0;
3125 }
3126
3127
rsn_cipher_put_suites(u8 * start,int ciphers)3128 int rsn_cipher_put_suites(u8 *start, int ciphers)
3129 {
3130 u8 *pos = start;
3131
3132 if (ciphers & WPA_CIPHER_CCMP_256) {
3133 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP_256);
3134 pos += RSN_SELECTOR_LEN;
3135 }
3136 if (ciphers & WPA_CIPHER_GCMP_256) {
3137 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
3138 pos += RSN_SELECTOR_LEN;
3139 }
3140 if (ciphers & WPA_CIPHER_CCMP) {
3141 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
3142 pos += RSN_SELECTOR_LEN;
3143 }
3144 if (ciphers & WPA_CIPHER_GCMP) {
3145 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
3146 pos += RSN_SELECTOR_LEN;
3147 }
3148 if (ciphers & WPA_CIPHER_TKIP) {
3149 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
3150 pos += RSN_SELECTOR_LEN;
3151 }
3152 if (ciphers & WPA_CIPHER_NONE) {
3153 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
3154 pos += RSN_SELECTOR_LEN;
3155 }
3156
3157 return (pos - start) / RSN_SELECTOR_LEN;
3158 }
3159
3160
wpa_cipher_put_suites(u8 * start,int ciphers)3161 int wpa_cipher_put_suites(u8 *start, int ciphers)
3162 {
3163 u8 *pos = start;
3164
3165 if (ciphers & WPA_CIPHER_CCMP) {
3166 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
3167 pos += WPA_SELECTOR_LEN;
3168 }
3169 if (ciphers & WPA_CIPHER_TKIP) {
3170 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
3171 pos += WPA_SELECTOR_LEN;
3172 }
3173 if (ciphers & WPA_CIPHER_NONE) {
3174 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
3175 pos += WPA_SELECTOR_LEN;
3176 }
3177
3178 return (pos - start) / RSN_SELECTOR_LEN;
3179 }
3180
3181
wpa_pick_pairwise_cipher(int ciphers,int none_allowed)3182 int wpa_pick_pairwise_cipher(int ciphers, int none_allowed)
3183 {
3184 if (ciphers & WPA_CIPHER_CCMP_256)
3185 return WPA_CIPHER_CCMP_256;
3186 if (ciphers & WPA_CIPHER_GCMP_256)
3187 return WPA_CIPHER_GCMP_256;
3188 if (ciphers & WPA_CIPHER_CCMP)
3189 return WPA_CIPHER_CCMP;
3190 if (ciphers & WPA_CIPHER_GCMP)
3191 return WPA_CIPHER_GCMP;
3192 if (ciphers & WPA_CIPHER_TKIP)
3193 return WPA_CIPHER_TKIP;
3194 if (none_allowed && (ciphers & WPA_CIPHER_NONE))
3195 return WPA_CIPHER_NONE;
3196 return -1;
3197 }
3198
3199
wpa_pick_group_cipher(int ciphers)3200 int wpa_pick_group_cipher(int ciphers)
3201 {
3202 if (ciphers & WPA_CIPHER_CCMP_256)
3203 return WPA_CIPHER_CCMP_256;
3204 if (ciphers & WPA_CIPHER_GCMP_256)
3205 return WPA_CIPHER_GCMP_256;
3206 if (ciphers & WPA_CIPHER_CCMP)
3207 return WPA_CIPHER_CCMP;
3208 if (ciphers & WPA_CIPHER_GCMP)
3209 return WPA_CIPHER_GCMP;
3210 if (ciphers & WPA_CIPHER_GTK_NOT_USED)
3211 return WPA_CIPHER_GTK_NOT_USED;
3212 if (ciphers & WPA_CIPHER_TKIP)
3213 return WPA_CIPHER_TKIP;
3214 return -1;
3215 }
3216
3217
wpa_parse_cipher(const char * value)3218 int wpa_parse_cipher(const char *value)
3219 {
3220 int val = 0, last;
3221 char *start, *end, *buf;
3222
3223 buf = os_strdup(value);
3224 if (buf == NULL)
3225 return -1;
3226 start = buf;
3227
3228 while (*start != '\0') {
3229 while (*start == ' ' || *start == '\t')
3230 start++;
3231 if (*start == '\0')
3232 break;
3233 end = start;
3234 while (*end != ' ' && *end != '\t' && *end != '\0')
3235 end++;
3236 last = *end == '\0';
3237 *end = '\0';
3238 if (os_strcmp(start, "CCMP-256") == 0)
3239 val |= WPA_CIPHER_CCMP_256;
3240 else if (os_strcmp(start, "GCMP-256") == 0)
3241 val |= WPA_CIPHER_GCMP_256;
3242 else if (os_strcmp(start, "CCMP") == 0)
3243 val |= WPA_CIPHER_CCMP;
3244 else if (os_strcmp(start, "GCMP") == 0)
3245 val |= WPA_CIPHER_GCMP;
3246 #ifndef CONFIG_NO_TKIP
3247 else if (os_strcmp(start, "TKIP") == 0)
3248 val |= WPA_CIPHER_TKIP;
3249 #endif /* CONFIG_NO_TKIP */
3250 #ifdef CONFIG_WEP
3251 else if (os_strcmp(start, "WEP104") == 0)
3252 val |= WPA_CIPHER_WEP104;
3253 else if (os_strcmp(start, "WEP40") == 0)
3254 val |= WPA_CIPHER_WEP40;
3255 #endif /* CONFIG_WEP */
3256 else if (os_strcmp(start, "NONE") == 0)
3257 val |= WPA_CIPHER_NONE;
3258 else if (os_strcmp(start, "GTK_NOT_USED") == 0)
3259 val |= WPA_CIPHER_GTK_NOT_USED;
3260 else if (os_strcmp(start, "AES-128-CMAC") == 0)
3261 val |= WPA_CIPHER_AES_128_CMAC;
3262 else if (os_strcmp(start, "BIP-GMAC-128") == 0)
3263 val |= WPA_CIPHER_BIP_GMAC_128;
3264 else if (os_strcmp(start, "BIP-GMAC-256") == 0)
3265 val |= WPA_CIPHER_BIP_GMAC_256;
3266 else if (os_strcmp(start, "BIP-CMAC-256") == 0)
3267 val |= WPA_CIPHER_BIP_CMAC_256;
3268 else {
3269 os_free(buf);
3270 return -1;
3271 }
3272
3273 if (last)
3274 break;
3275 start = end + 1;
3276 }
3277 os_free(buf);
3278
3279 return val;
3280 }
3281
3282
wpa_write_ciphers(char * start,char * end,int ciphers,const char * delim)3283 int wpa_write_ciphers(char *start, char *end, int ciphers, const char *delim)
3284 {
3285 char *pos = start;
3286 int ret;
3287
3288 if (ciphers & WPA_CIPHER_CCMP_256) {
3289 ret = os_snprintf(pos, end - pos, "%sCCMP-256",
3290 pos == start ? "" : delim);
3291 if (os_snprintf_error(end - pos, ret))
3292 return -1;
3293 pos += ret;
3294 }
3295 if (ciphers & WPA_CIPHER_GCMP_256) {
3296 ret = os_snprintf(pos, end - pos, "%sGCMP-256",
3297 pos == start ? "" : delim);
3298 if (os_snprintf_error(end - pos, ret))
3299 return -1;
3300 pos += ret;
3301 }
3302 if (ciphers & WPA_CIPHER_CCMP) {
3303 ret = os_snprintf(pos, end - pos, "%sCCMP",
3304 pos == start ? "" : delim);
3305 if (os_snprintf_error(end - pos, ret))
3306 return -1;
3307 pos += ret;
3308 }
3309 if (ciphers & WPA_CIPHER_GCMP) {
3310 ret = os_snprintf(pos, end - pos, "%sGCMP",
3311 pos == start ? "" : delim);
3312 if (os_snprintf_error(end - pos, ret))
3313 return -1;
3314 pos += ret;
3315 }
3316 if (ciphers & WPA_CIPHER_TKIP) {
3317 ret = os_snprintf(pos, end - pos, "%sTKIP",
3318 pos == start ? "" : delim);
3319 if (os_snprintf_error(end - pos, ret))
3320 return -1;
3321 pos += ret;
3322 }
3323 if (ciphers & WPA_CIPHER_AES_128_CMAC) {
3324 ret = os_snprintf(pos, end - pos, "%sAES-128-CMAC",
3325 pos == start ? "" : delim);
3326 if (os_snprintf_error(end - pos, ret))
3327 return -1;
3328 pos += ret;
3329 }
3330 if (ciphers & WPA_CIPHER_BIP_GMAC_128) {
3331 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-128",
3332 pos == start ? "" : delim);
3333 if (os_snprintf_error(end - pos, ret))
3334 return -1;
3335 pos += ret;
3336 }
3337 if (ciphers & WPA_CIPHER_BIP_GMAC_256) {
3338 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-256",
3339 pos == start ? "" : delim);
3340 if (os_snprintf_error(end - pos, ret))
3341 return -1;
3342 pos += ret;
3343 }
3344 if (ciphers & WPA_CIPHER_BIP_CMAC_256) {
3345 ret = os_snprintf(pos, end - pos, "%sBIP-CMAC-256",
3346 pos == start ? "" : delim);
3347 if (os_snprintf_error(end - pos, ret))
3348 return -1;
3349 pos += ret;
3350 }
3351 if (ciphers & WPA_CIPHER_NONE) {
3352 ret = os_snprintf(pos, end - pos, "%sNONE",
3353 pos == start ? "" : delim);
3354 if (os_snprintf_error(end - pos, ret))
3355 return -1;
3356 pos += ret;
3357 }
3358
3359 return pos - start;
3360 }
3361
3362
wpa_select_ap_group_cipher(int wpa,int wpa_pairwise,int rsn_pairwise)3363 int wpa_select_ap_group_cipher(int wpa, int wpa_pairwise, int rsn_pairwise)
3364 {
3365 int pairwise = 0;
3366
3367 /* Select group cipher based on the enabled pairwise cipher suites */
3368 if (wpa & 1)
3369 pairwise |= wpa_pairwise;
3370 if (wpa & 2)
3371 pairwise |= rsn_pairwise;
3372
3373 if (pairwise & WPA_CIPHER_TKIP)
3374 return WPA_CIPHER_TKIP;
3375 if ((pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP)
3376 return WPA_CIPHER_GCMP;
3377 if ((pairwise & (WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP |
3378 WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP_256)
3379 return WPA_CIPHER_GCMP_256;
3380 if ((pairwise & (WPA_CIPHER_CCMP_256 | WPA_CIPHER_CCMP |
3381 WPA_CIPHER_GCMP)) == WPA_CIPHER_CCMP_256)
3382 return WPA_CIPHER_CCMP_256;
3383 return WPA_CIPHER_CCMP;
3384 }
3385
3386
3387 #ifdef CONFIG_FILS
fils_domain_name_hash(const char * domain,u8 * hash)3388 int fils_domain_name_hash(const char *domain, u8 *hash)
3389 {
3390 char buf[255], *wpos = buf;
3391 const char *pos = domain;
3392 size_t len;
3393 const u8 *addr[1];
3394 u8 mac[SHA256_MAC_LEN];
3395
3396 for (len = 0; len < sizeof(buf) && *pos; len++) {
3397 if (isalpha(*pos) && isupper(*pos))
3398 *wpos++ = tolower(*pos);
3399 else
3400 *wpos++ = *pos;
3401 pos++;
3402 }
3403
3404 addr[0] = (const u8 *) buf;
3405 if (sha256_vector(1, addr, &len, mac) < 0)
3406 return -1;
3407 os_memcpy(hash, mac, 2);
3408 return 0;
3409 }
3410 #endif /* CONFIG_FILS */
3411
3412
3413 /**
3414 * wpa_parse_vendor_specific - Parse Vendor Specific IEs
3415 * @pos: Pointer to the IE header
3416 * @end: Pointer to the end of the Key Data buffer
3417 * @ie: Pointer to parsed IE data
3418 */
wpa_parse_vendor_specific(const u8 * pos,const u8 * end,struct wpa_eapol_ie_parse * ie)3419 static void wpa_parse_vendor_specific(const u8 *pos, const u8 *end,
3420 struct wpa_eapol_ie_parse *ie)
3421 {
3422 unsigned int oui;
3423
3424 if (pos[1] < 4) {
3425 wpa_printf(MSG_MSGDUMP,
3426 "Too short vendor specific IE ignored (len=%u)",
3427 pos[1]);
3428 return;
3429 }
3430
3431 oui = WPA_GET_BE24(&pos[2]);
3432 if (oui == OUI_MICROSOFT && pos[5] == WMM_OUI_TYPE && pos[1] > 4) {
3433 if (pos[6] == WMM_OUI_SUBTYPE_INFORMATION_ELEMENT) {
3434 ie->wmm = &pos[2];
3435 ie->wmm_len = pos[1];
3436 wpa_hexdump(MSG_DEBUG, "WPA: WMM IE",
3437 ie->wmm, ie->wmm_len);
3438 } else if (pos[6] == WMM_OUI_SUBTYPE_PARAMETER_ELEMENT) {
3439 ie->wmm = &pos[2];
3440 ie->wmm_len = pos[1];
3441 wpa_hexdump(MSG_DEBUG, "WPA: WMM Parameter Element",
3442 ie->wmm, ie->wmm_len);
3443 }
3444 }
3445 }
3446
3447
3448 /**
3449 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
3450 * @pos: Pointer to the IE header
3451 * @ie: Pointer to parsed IE data
3452 * Returns: 0 on success, 1 if end mark is found, 2 if KDE is not recognized
3453 */
wpa_parse_generic(const u8 * pos,struct wpa_eapol_ie_parse * ie)3454 static int wpa_parse_generic(const u8 *pos, struct wpa_eapol_ie_parse *ie)
3455 {
3456 u8 len = pos[1];
3457 size_t dlen = 2 + len;
3458 u32 selector;
3459 const u8 *p;
3460 size_t left;
3461 u8 link_id;
3462 char title[100];
3463 int ret;
3464
3465 if (len == 0)
3466 return 1;
3467
3468 if (len < RSN_SELECTOR_LEN)
3469 return 2;
3470
3471 p = pos + 2;
3472 selector = RSN_SELECTOR_GET(p);
3473 p += RSN_SELECTOR_LEN;
3474 left = len - RSN_SELECTOR_LEN;
3475
3476 if (left >= 2 && selector == WPA_OUI_TYPE && p[0] == 1 && p[1] == 0) {
3477 ie->wpa_ie = pos;
3478 ie->wpa_ie_len = dlen;
3479 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE in EAPOL-Key",
3480 ie->wpa_ie, ie->wpa_ie_len);
3481 return 0;
3482 }
3483
3484 if (selector == OSEN_IE_VENDOR_TYPE) {
3485 ie->osen = pos;
3486 ie->osen_len = dlen;
3487 return 0;
3488 }
3489
3490 if (left >= PMKID_LEN && selector == RSN_KEY_DATA_PMKID) {
3491 ie->pmkid = p;
3492 wpa_hexdump(MSG_DEBUG, "WPA: PMKID in EAPOL-Key", pos, dlen);
3493 return 0;
3494 }
3495
3496 if (left >= 2 && selector == RSN_KEY_DATA_KEYID) {
3497 ie->key_id = p;
3498 wpa_hexdump(MSG_DEBUG, "WPA: KeyID in EAPOL-Key", pos, dlen);
3499 return 0;
3500 }
3501
3502 if (left > 2 && selector == RSN_KEY_DATA_GROUPKEY) {
3503 ie->gtk = p;
3504 ie->gtk_len = left;
3505 wpa_hexdump_key(MSG_DEBUG, "WPA: GTK in EAPOL-Key", pos, dlen);
3506 return 0;
3507 }
3508
3509 if (left >= ETH_ALEN && selector == RSN_KEY_DATA_MAC_ADDR) {
3510 ie->mac_addr = p;
3511 wpa_printf(MSG_DEBUG, "WPA: MAC Address in EAPOL-Key: " MACSTR,
3512 MAC2STR(ie->mac_addr));
3513 return 0;
3514 }
3515
3516 if (left > 2 && selector == RSN_KEY_DATA_IGTK) {
3517 ie->igtk = p;
3518 ie->igtk_len = left;
3519 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK in EAPOL-Key",
3520 pos, dlen);
3521 return 0;
3522 }
3523
3524 if (left > 2 && selector == RSN_KEY_DATA_BIGTK) {
3525 ie->bigtk = p;
3526 ie->bigtk_len = left;
3527 wpa_hexdump_key(MSG_DEBUG, "WPA: BIGTK in EAPOL-Key",
3528 pos, dlen);
3529 return 0;
3530 }
3531
3532 if (left >= 1 && selector == WFA_KEY_DATA_IP_ADDR_REQ) {
3533 ie->ip_addr_req = p;
3534 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key",
3535 ie->ip_addr_req, left);
3536 return 0;
3537 }
3538
3539 if (left >= 3 * 4 && selector == WFA_KEY_DATA_IP_ADDR_ALLOC) {
3540 ie->ip_addr_alloc = p;
3541 wpa_hexdump(MSG_DEBUG,
3542 "WPA: IP Address Allocation in EAPOL-Key",
3543 ie->ip_addr_alloc, left);
3544 return 0;
3545 }
3546
3547 if (left > 2 && selector == RSN_KEY_DATA_OCI) {
3548 ie->oci = p;
3549 ie->oci_len = left;
3550 wpa_hexdump(MSG_DEBUG, "WPA: OCI KDE in EAPOL-Key",
3551 pos, dlen);
3552 return 0;
3553 }
3554
3555 if (left >= 1 && selector == WFA_KEY_DATA_TRANSITION_DISABLE) {
3556 ie->transition_disable = p;
3557 ie->transition_disable_len = left;
3558 wpa_hexdump(MSG_DEBUG,
3559 "WPA: Transition Disable KDE in EAPOL-Key",
3560 pos, dlen);
3561 return 0;
3562 }
3563
3564 if (left >= 2 && selector == WFA_KEY_DATA_DPP) {
3565 ie->dpp_kde = p;
3566 ie->dpp_kde_len = left;
3567 wpa_hexdump(MSG_DEBUG, "WPA: DPP KDE in EAPOL-Key", pos, dlen);
3568 return 0;
3569 }
3570
3571 if (left >= RSN_MLO_GTK_KDE_PREFIX_LENGTH &&
3572 selector == RSN_KEY_DATA_MLO_GTK) {
3573 link_id = (p[0] & RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_MASK) >>
3574 RSN_MLO_GTK_KDE_PREFIX0_LINK_ID_SHIFT;
3575 if (link_id >= MAX_NUM_MLD_LINKS)
3576 return 2;
3577
3578 ie->valid_mlo_gtks |= BIT(link_id);
3579 ie->mlo_gtk[link_id] = p;
3580 ie->mlo_gtk_len[link_id] = left;
3581 ret = os_snprintf(title, sizeof(title),
3582 "RSN: Link ID %u - MLO GTK KDE in EAPOL-Key",
3583 link_id);
3584 if (!os_snprintf_error(sizeof(title), ret))
3585 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3586 return 0;
3587 }
3588
3589 if (left >= RSN_MLO_IGTK_KDE_PREFIX_LENGTH &&
3590 selector == RSN_KEY_DATA_MLO_IGTK) {
3591 link_id = (p[8] & RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3592 RSN_MLO_IGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3593 if (link_id >= MAX_NUM_MLD_LINKS)
3594 return 2;
3595
3596 ie->valid_mlo_igtks |= BIT(link_id);
3597 ie->mlo_igtk[link_id] = p;
3598 ie->mlo_igtk_len[link_id] = left;
3599 ret = os_snprintf(title, sizeof(title),
3600 "RSN: Link ID %u - MLO IGTK KDE in EAPOL-Key",
3601 link_id);
3602 if (!os_snprintf_error(sizeof(title), ret))
3603 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3604 return 0;
3605 }
3606
3607 if (left >= RSN_MLO_BIGTK_KDE_PREFIX_LENGTH &&
3608 selector == RSN_KEY_DATA_MLO_BIGTK) {
3609 link_id = (p[8] & RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_MASK) >>
3610 RSN_MLO_BIGTK_KDE_PREFIX8_LINK_ID_SHIFT;
3611 if (link_id >= MAX_NUM_MLD_LINKS)
3612 return 2;
3613
3614 ie->valid_mlo_bigtks |= BIT(link_id);
3615 ie->mlo_bigtk[link_id] = p;
3616 ie->mlo_bigtk_len[link_id] = left;
3617 ret = os_snprintf(title, sizeof(title),
3618 "RSN: Link ID %u - MLO BIGTK KDE in EAPOL-Key",
3619 link_id);
3620 if (!os_snprintf_error(sizeof(title), ret))
3621 wpa_hexdump_key(MSG_DEBUG, title, pos, dlen);
3622 return 0;
3623 }
3624
3625 if (left >= RSN_MLO_LINK_KDE_FIXED_LENGTH &&
3626 selector == RSN_KEY_DATA_MLO_LINK) {
3627 link_id = (p[0] & RSN_MLO_LINK_KDE_LI_LINK_ID_MASK) >>
3628 RSN_MLO_LINK_KDE_LI_LINK_ID_SHIFT;
3629 if (link_id >= MAX_NUM_MLD_LINKS)
3630 return 2;
3631
3632 ie->valid_mlo_links |= BIT(link_id);
3633 ie->mlo_link[link_id] = p;
3634 ie->mlo_link_len[link_id] = left;
3635 ret = os_snprintf(title, sizeof(title),
3636 "RSN: Link ID %u - MLO Link KDE in EAPOL-Key",
3637 link_id);
3638 if (!os_snprintf_error(sizeof(title), ret))
3639 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
3640 return 0;
3641 }
3642
3643 if (left >= 1 && selector == WFA_KEY_DATA_RSN_OVERRIDE_LINK) {
3644 link_id = p[0];
3645 if (link_id >= MAX_NUM_MLD_LINKS)
3646 return 2;
3647
3648 ie->rsn_override_link[link_id] = p;
3649 ie->rsn_override_link_len[link_id] = left;
3650 ret = os_snprintf(title, sizeof(title),
3651 "RSN: Link ID %u - RSN Override Link KDE in EAPOL-Key",
3652 link_id);
3653 if (!os_snprintf_error(sizeof(title), ret))
3654 wpa_hexdump(MSG_DEBUG, title, pos, dlen);
3655 return 0;
3656 }
3657
3658 if (selector == RSNE_OVERRIDE_IE_VENDOR_TYPE) {
3659 ie->rsne_override = pos;
3660 ie->rsne_override_len = dlen;
3661 wpa_hexdump(MSG_DEBUG,
3662 "RSN: RSNE Override element in EAPOL-Key",
3663 ie->rsne_override, ie->rsne_override_len);
3664 return 0;
3665 }
3666
3667 if (selector == RSNE_OVERRIDE_2_IE_VENDOR_TYPE) {
3668 ie->rsne_override_2 = pos;
3669 ie->rsne_override_2_len = dlen;
3670 wpa_hexdump(MSG_DEBUG,
3671 "RSN: RSNE Override 2 element in EAPOL-Key",
3672 ie->rsne_override_2, ie->rsne_override_2_len);
3673 return 0;
3674 }
3675
3676 if (selector == RSNXE_OVERRIDE_IE_VENDOR_TYPE) {
3677 ie->rsnxe_override = pos;
3678 ie->rsnxe_override_len = dlen;
3679 wpa_hexdump(MSG_DEBUG,
3680 "RSN: RSNXE Override element in EAPOL-Key",
3681 ie->rsnxe_override, ie->rsnxe_override_len);
3682 return 0;
3683 }
3684
3685 if (selector == RSN_SELECTION_IE_VENDOR_TYPE) {
3686 ie->rsn_selection = p;
3687 ie->rsn_selection_len = left;
3688 wpa_hexdump(MSG_DEBUG,
3689 "RSN: RSN Selection element in EAPOL-Key",
3690 ie->rsn_selection, ie->rsn_selection_len);
3691 return 0;
3692 }
3693
3694 return 2;
3695 }
3696
3697
3698 /**
3699 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
3700 * @buf: Pointer to the Key Data buffer
3701 * @len: Key Data Length
3702 * @ie: Pointer to parsed IE data
3703 * Returns: 0 on success, -1 on failure
3704 */
wpa_parse_kde_ies(const u8 * buf,size_t len,struct wpa_eapol_ie_parse * ie)3705 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
3706 {
3707 const u8 *pos, *end;
3708 int ret = 0;
3709 size_t dlen = 0;
3710
3711 os_memset(ie, 0, sizeof(*ie));
3712 for (pos = buf, end = pos + len; end - pos > 1; pos += dlen) {
3713 if (pos[0] == 0xdd &&
3714 ((pos == buf + len - 1) || pos[1] == 0)) {
3715 /* Ignore padding */
3716 break;
3717 }
3718 dlen = 2 + pos[1];
3719 if ((int) dlen > end - pos) {
3720 wpa_printf(MSG_DEBUG,
3721 "WPA: EAPOL-Key Key Data underflow (ie=%d len=%d pos=%d)",
3722 pos[0], pos[1], (int) (pos - buf));
3723 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", buf, len);
3724 ret = -1;
3725 break;
3726 }
3727 if (*pos == WLAN_EID_RSN) {
3728 ie->rsn_ie = pos;
3729 ie->rsn_ie_len = dlen;
3730 wpa_hexdump(MSG_DEBUG, "WPA: RSN IE in EAPOL-Key",
3731 ie->rsn_ie, ie->rsn_ie_len);
3732 } else if (*pos == WLAN_EID_RSNX) {
3733 ie->rsnxe = pos;
3734 ie->rsnxe_len = dlen;
3735 wpa_hexdump(MSG_DEBUG, "WPA: RSNXE in EAPOL-Key",
3736 ie->rsnxe, ie->rsnxe_len);
3737 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
3738 ie->mdie = pos;
3739 ie->mdie_len = dlen;
3740 wpa_hexdump(MSG_DEBUG, "WPA: MDIE in EAPOL-Key",
3741 ie->mdie, ie->mdie_len);
3742 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) {
3743 ie->ftie = pos;
3744 ie->ftie_len = dlen;
3745 wpa_hexdump(MSG_DEBUG, "WPA: FTIE in EAPOL-Key",
3746 ie->ftie, ie->ftie_len);
3747 } else if (*pos == WLAN_EID_TIMEOUT_INTERVAL && pos[1] >= 5) {
3748 if (pos[2] == WLAN_TIMEOUT_REASSOC_DEADLINE) {
3749 ie->reassoc_deadline = pos;
3750 wpa_hexdump(MSG_DEBUG, "WPA: Reassoc Deadline "
3751 "in EAPOL-Key",
3752 ie->reassoc_deadline, dlen);
3753 } else if (pos[2] == WLAN_TIMEOUT_KEY_LIFETIME) {
3754 ie->key_lifetime = pos;
3755 wpa_hexdump(MSG_DEBUG, "WPA: KeyLifetime "
3756 "in EAPOL-Key",
3757 ie->key_lifetime, dlen);
3758 } else {
3759 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized "
3760 "EAPOL-Key Key Data IE",
3761 pos, dlen);
3762 }
3763 } else if (*pos == WLAN_EID_LINK_ID) {
3764 if (pos[1] >= 18) {
3765 ie->lnkid = pos;
3766 ie->lnkid_len = dlen;
3767 }
3768 } else if (*pos == WLAN_EID_EXT_CAPAB) {
3769 ie->ext_capab = pos;
3770 ie->ext_capab_len = dlen;
3771 } else if (*pos == WLAN_EID_SUPP_RATES) {
3772 ie->supp_rates = pos;
3773 ie->supp_rates_len = dlen;
3774 } else if (*pos == WLAN_EID_EXT_SUPP_RATES) {
3775 ie->ext_supp_rates = pos;
3776 ie->ext_supp_rates_len = dlen;
3777 } else if (*pos == WLAN_EID_HT_CAP &&
3778 pos[1] >= sizeof(struct ieee80211_ht_capabilities)) {
3779 ie->ht_capabilities = pos + 2;
3780 } else if (*pos == WLAN_EID_AID) {
3781 if (pos[1] >= 2)
3782 ie->aid = WPA_GET_LE16(pos + 2) & 0x3fff;
3783 } else if (*pos == WLAN_EID_VHT_CAP &&
3784 pos[1] >= sizeof(struct ieee80211_vht_capabilities))
3785 {
3786 ie->vht_capabilities = pos + 2;
3787 } else if (*pos == WLAN_EID_EXTENSION &&
3788 pos[1] >= 1 + IEEE80211_HE_CAPAB_MIN_LEN &&
3789 pos[2] == WLAN_EID_EXT_HE_CAPABILITIES) {
3790 ie->he_capabilities = pos + 3;
3791 ie->he_capab_len = pos[1] - 1;
3792 } else if (*pos == WLAN_EID_EXTENSION &&
3793 pos[1] >= 1 +
3794 sizeof(struct ieee80211_he_6ghz_band_cap) &&
3795 pos[2] == WLAN_EID_EXT_HE_6GHZ_BAND_CAP) {
3796 ie->he_6ghz_capabilities = pos + 3;
3797 } else if (*pos == WLAN_EID_EXTENSION &&
3798 pos[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN &&
3799 pos[2] == WLAN_EID_EXT_EHT_CAPABILITIES) {
3800 ie->eht_capabilities = pos + 3;
3801 ie->eht_capab_len = pos[1] - 1;
3802 } else if (*pos == WLAN_EID_QOS && pos[1] >= 1) {
3803 ie->qosinfo = pos[2];
3804 } else if (*pos == WLAN_EID_SUPPORTED_CHANNELS) {
3805 ie->supp_channels = pos + 2;
3806 ie->supp_channels_len = pos[1];
3807 } else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) {
3808 /*
3809 * The value of the Length field of the Supported
3810 * Operating Classes element is between 2 and 253.
3811 * Silently skip invalid elements to avoid interop
3812 * issues when trying to use the value.
3813 */
3814 if (pos[1] >= 2 && pos[1] <= 253) {
3815 ie->supp_oper_classes = pos + 2;
3816 ie->supp_oper_classes_len = pos[1];
3817 }
3818 } else if (*pos == WLAN_EID_SSID) {
3819 ie->ssid = pos + 2;
3820 ie->ssid_len = pos[1];
3821 wpa_hexdump_ascii(MSG_DEBUG, "RSN: SSID in EAPOL-Key",
3822 ie->ssid, ie->ssid_len);
3823 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
3824 ret = wpa_parse_generic(pos, ie);
3825 if (ret == 1) {
3826 /* end mark found */
3827 ret = 0;
3828 break;
3829 }
3830
3831 if (ret == 2) {
3832 /* not a known KDE */
3833 wpa_parse_vendor_specific(pos, end, ie);
3834 }
3835
3836 ret = 0;
3837 } else {
3838 wpa_hexdump(MSG_DEBUG,
3839 "WPA: Unrecognized EAPOL-Key Key Data IE",
3840 pos, dlen);
3841 }
3842 }
3843
3844 return ret;
3845 }
3846
3847
3848 #ifdef CONFIG_PASN
3849
3850 /*
3851 * wpa_pasn_build_auth_header - Add the MAC header and initialize Authentication
3852 * frame for PASN
3853 *
3854 * @buf: Buffer in which the header will be added
3855 * @bssid: The BSSID of the AP
3856 * @src: Source address
3857 * @dst: Destination address
3858 * @trans_seq: Authentication transaction sequence number
3859 * @status: Authentication status
3860 */
wpa_pasn_build_auth_header(struct wpabuf * buf,const u8 * bssid,const u8 * src,const u8 * dst,u8 trans_seq,u16 status)3861 void wpa_pasn_build_auth_header(struct wpabuf *buf, const u8 *bssid,
3862 const u8 *src, const u8 *dst,
3863 u8 trans_seq, u16 status)
3864 {
3865 struct ieee80211_mgmt *auth;
3866
3867 wpa_printf(MSG_DEBUG, "PASN: Add authentication header. trans_seq=%u",
3868 trans_seq);
3869
3870 auth = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
3871 u.auth.variable));
3872
3873 auth->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
3874 (WLAN_FC_STYPE_AUTH << 4));
3875
3876 os_memcpy(auth->da, dst, ETH_ALEN);
3877 os_memcpy(auth->sa, src, ETH_ALEN);
3878 os_memcpy(auth->bssid, bssid, ETH_ALEN);
3879 auth->seq_ctrl = 0;
3880
3881 auth->u.auth.auth_alg = host_to_le16(WLAN_AUTH_PASN);
3882 auth->u.auth.auth_transaction = host_to_le16(trans_seq);
3883 auth->u.auth.status_code = host_to_le16(status);
3884 }
3885
3886
3887 /*
3888 * wpa_pasn_add_rsne - Add an RSNE for PASN authentication
3889 * @buf: Buffer in which the IE will be added
3890 * @pmkid: Optional PMKID. Can be NULL.
3891 * @akmp: Authentication and key management protocol
3892 * @cipher: The cipher suite
3893 */
wpa_pasn_add_rsne(struct wpabuf * buf,const u8 * pmkid,int akmp,int cipher)3894 int wpa_pasn_add_rsne(struct wpabuf *buf, const u8 *pmkid, int akmp, int cipher)
3895 {
3896 struct rsn_ie_hdr *hdr;
3897 u32 suite;
3898 u16 capab;
3899 u8 *pos;
3900 u8 rsne_len;
3901
3902 wpa_printf(MSG_DEBUG, "PASN: Add RSNE");
3903
3904 rsne_len = sizeof(*hdr) + RSN_SELECTOR_LEN +
3905 2 + RSN_SELECTOR_LEN + 2 + RSN_SELECTOR_LEN +
3906 2 + RSN_SELECTOR_LEN + 2 + (pmkid ? PMKID_LEN : 0);
3907
3908 if (wpabuf_tailroom(buf) < rsne_len)
3909 return -1;
3910 hdr = wpabuf_put(buf, rsne_len);
3911 hdr->elem_id = WLAN_EID_RSN;
3912 hdr->len = rsne_len - 2;
3913 WPA_PUT_LE16(hdr->version, RSN_VERSION);
3914 pos = (u8 *) (hdr + 1);
3915
3916 /* Group addressed data is not allowed */
3917 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3918 pos += RSN_SELECTOR_LEN;
3919
3920 /* Add the pairwise cipher */
3921 WPA_PUT_LE16(pos, 1);
3922 pos += 2;
3923 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, cipher);
3924 RSN_SELECTOR_PUT(pos, suite);
3925 pos += RSN_SELECTOR_LEN;
3926
3927 /* Add the AKM suite */
3928 WPA_PUT_LE16(pos, 1);
3929 pos += 2;
3930
3931 switch (akmp) {
3932 case WPA_KEY_MGMT_PASN:
3933 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PASN);
3934 break;
3935 #ifdef CONFIG_SAE
3936 case WPA_KEY_MGMT_SAE:
3937 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE);
3938 break;
3939 case WPA_KEY_MGMT_SAE_EXT_KEY:
3940 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE_EXT_KEY);
3941 break;
3942 #endif /* CONFIG_SAE */
3943 #ifdef CONFIG_FILS
3944 case WPA_KEY_MGMT_FILS_SHA256:
3945 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA256);
3946 break;
3947 case WPA_KEY_MGMT_FILS_SHA384:
3948 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FILS_SHA384);
3949 break;
3950 #endif /* CONFIG_FILS */
3951 #ifdef CONFIG_IEEE80211R
3952 case WPA_KEY_MGMT_FT_PSK:
3953 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
3954 break;
3955 case WPA_KEY_MGMT_FT_IEEE8021X:
3956 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
3957 break;
3958 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
3959 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384);
3960 break;
3961 #endif /* CONFIG_IEEE80211R */
3962 default:
3963 wpa_printf(MSG_ERROR, "PASN: Invalid AKMP=0x%x", akmp);
3964 return -1;
3965 }
3966 pos += RSN_SELECTOR_LEN;
3967
3968 /* RSN Capabilities: PASN mandates both MFP capable and required */
3969 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
3970 WPA_PUT_LE16(pos, capab);
3971 pos += 2;
3972
3973 if (pmkid) {
3974 wpa_printf(MSG_DEBUG, "PASN: Adding PMKID");
3975
3976 WPA_PUT_LE16(pos, 1);
3977 pos += 2;
3978 os_memcpy(pos, pmkid, PMKID_LEN);
3979 pos += PMKID_LEN;
3980 } else {
3981 WPA_PUT_LE16(pos, 0);
3982 pos += 2;
3983 }
3984
3985 /* Group addressed management is not allowed */
3986 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
3987
3988 return 0;
3989 }
3990
3991
3992 /*
3993 * wpa_pasn_add_parameter_ie - Add PASN Parameters IE for PASN authentication
3994 * @buf: Buffer in which the IE will be added
3995 * @pasn_group: Finite Cyclic Group ID for PASN authentication
3996 * @wrapped_data_format: Format of the data in the Wrapped Data IE
3997 * @pubkey: A buffer holding the local public key. Can be NULL
3998 * @compressed: In case pubkey is included, indicates if the public key is
3999 * compressed (only x coordinate is included) or not (both x and y
4000 * coordinates are included)
4001 * @comeback: A buffer holding the comeback token. Can be NULL
4002 * @after: If comeback is set, defined the comeback time in seconds. -1 to not
4003 * include the Comeback After field (frames from non-AP STA).
4004 */
wpa_pasn_add_parameter_ie(struct wpabuf * buf,u16 pasn_group,u8 wrapped_data_format,const struct wpabuf * pubkey,bool compressed,const struct wpabuf * comeback,int after)4005 void wpa_pasn_add_parameter_ie(struct wpabuf *buf, u16 pasn_group,
4006 u8 wrapped_data_format,
4007 const struct wpabuf *pubkey, bool compressed,
4008 const struct wpabuf *comeback, int after)
4009 {
4010 struct pasn_parameter_ie *params;
4011
4012 wpa_printf(MSG_DEBUG, "PASN: Add PASN Parameters element");
4013
4014 params = wpabuf_put(buf, sizeof(*params));
4015
4016 params->id = WLAN_EID_EXTENSION;
4017 params->len = sizeof(*params) - 2;
4018 params->id_ext = WLAN_EID_EXT_PASN_PARAMS;
4019 params->control = 0;
4020 params->wrapped_data_format = wrapped_data_format;
4021
4022 if (comeback) {
4023 wpa_printf(MSG_DEBUG, "PASN: Adding comeback data");
4024
4025 /*
4026 * 2 octets for the 'after' field + 1 octet for the length +
4027 * actual cookie data
4028 */
4029 if (after >= 0)
4030 params->len += 2;
4031 params->len += 1 + wpabuf_len(comeback);
4032 params->control |= WPA_PASN_CTRL_COMEBACK_INFO_PRESENT;
4033
4034 if (after >= 0)
4035 wpabuf_put_le16(buf, after);
4036 wpabuf_put_u8(buf, wpabuf_len(comeback));
4037 wpabuf_put_buf(buf, comeback);
4038 }
4039
4040 if (pubkey) {
4041 wpa_printf(MSG_DEBUG,
4042 "PASN: Adding public key and group ID %u",
4043 pasn_group);
4044
4045 /*
4046 * 2 octets for the finite cyclic group + 2 octets public key
4047 * length + 1 octet for the compressed/uncompressed indication +
4048 * the actual key.
4049 */
4050 params->len += 2 + 1 + 1 + wpabuf_len(pubkey);
4051 params->control |= WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT;
4052
4053 wpabuf_put_le16(buf, pasn_group);
4054
4055 /*
4056 * The first octet indicates whether the public key is
4057 * compressed, as defined in RFC 5480 section 2.2.
4058 */
4059 wpabuf_put_u8(buf, wpabuf_len(pubkey) + 1);
4060 wpabuf_put_u8(buf, compressed ? WPA_PASN_PUBKEY_COMPRESSED_0 :
4061 WPA_PASN_PUBKEY_UNCOMPRESSED);
4062
4063 wpabuf_put_buf(buf, pubkey);
4064 }
4065 }
4066
4067 /*
4068 * wpa_pasn_add_wrapped_data - Add a Wrapped Data IE to PASN Authentication
4069 * frame. If needed, the Wrapped Data IE would be fragmented.
4070 *
4071 * @buf: Buffer in which the IE will be added
4072 * @wrapped_data_buf: Buffer holding the wrapped data
4073 */
wpa_pasn_add_wrapped_data(struct wpabuf * buf,struct wpabuf * wrapped_data_buf)4074 int wpa_pasn_add_wrapped_data(struct wpabuf *buf,
4075 struct wpabuf *wrapped_data_buf)
4076 {
4077 const u8 *data;
4078 size_t data_len;
4079 u8 len;
4080
4081 if (!wrapped_data_buf)
4082 return 0;
4083
4084 wpa_printf(MSG_DEBUG, "PASN: Add wrapped data");
4085
4086 data = wpabuf_head_u8(wrapped_data_buf);
4087 data_len = wpabuf_len(wrapped_data_buf);
4088
4089 /* nothing to add */
4090 if (!data_len)
4091 return 0;
4092
4093 if (data_len <= 254)
4094 len = 1 + data_len;
4095 else
4096 len = 255;
4097
4098 if (wpabuf_tailroom(buf) < 3 + data_len)
4099 return -1;
4100
4101 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
4102 wpabuf_put_u8(buf, len);
4103 wpabuf_put_u8(buf, WLAN_EID_EXT_WRAPPED_DATA);
4104 wpabuf_put_data(buf, data, len - 1);
4105
4106 data += len - 1;
4107 data_len -= len - 1;
4108
4109 while (data_len) {
4110 if (wpabuf_tailroom(buf) < 1 + data_len)
4111 return -1;
4112 wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
4113 len = data_len > 255 ? 255 : data_len;
4114 wpabuf_put_u8(buf, len);
4115 wpabuf_put_data(buf, data, len);
4116 data += len;
4117 data_len -= len;
4118 }
4119
4120 return 0;
4121 }
4122
4123
4124 /*
4125 * wpa_pasn_validate_rsne - Validate PSAN specific data of RSNE
4126 * @data: Parsed representation of an RSNE
4127 * Returns -1 for invalid data; otherwise 0
4128 */
wpa_pasn_validate_rsne(const struct wpa_ie_data * data)4129 int wpa_pasn_validate_rsne(const struct wpa_ie_data *data)
4130 {
4131 u16 capab = WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR;
4132
4133 if (data->proto != WPA_PROTO_RSN)
4134 return -1;
4135
4136 if ((data->capabilities & capab) != capab) {
4137 wpa_printf(MSG_DEBUG, "PASN: Invalid RSNE capabilities");
4138 return -1;
4139 }
4140
4141 if (!data->has_group || data->group_cipher != WPA_CIPHER_GTK_NOT_USED) {
4142 wpa_printf(MSG_DEBUG, "PASN: Invalid group data cipher");
4143 return -1;
4144 }
4145
4146 if (!data->has_pairwise || !data->pairwise_cipher ||
4147 (data->pairwise_cipher & (data->pairwise_cipher - 1))) {
4148 wpa_printf(MSG_DEBUG, "PASN: No valid pairwise suite");
4149 return -1;
4150 }
4151
4152 switch (data->key_mgmt) {
4153 #ifdef CONFIG_SAE
4154 case WPA_KEY_MGMT_SAE:
4155 case WPA_KEY_MGMT_SAE_EXT_KEY:
4156 /* fall through */
4157 #endif /* CONFIG_SAE */
4158 #ifdef CONFIG_FILS
4159 case WPA_KEY_MGMT_FILS_SHA256:
4160 case WPA_KEY_MGMT_FILS_SHA384:
4161 /* fall through */
4162 #endif /* CONFIG_FILS */
4163 #ifdef CONFIG_IEEE80211R
4164 case WPA_KEY_MGMT_FT_PSK:
4165 case WPA_KEY_MGMT_FT_IEEE8021X:
4166 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
4167 /* fall through */
4168 #endif /* CONFIG_IEEE80211R */
4169 case WPA_KEY_MGMT_PASN:
4170 break;
4171 default:
4172 wpa_printf(MSG_ERROR, "PASN: invalid key_mgmt: 0x%0x",
4173 data->key_mgmt);
4174 return -1;
4175 }
4176
4177 if (data->mgmt_group_cipher != WPA_CIPHER_GTK_NOT_USED) {
4178 wpa_printf(MSG_DEBUG, "PASN: Invalid group mgmt cipher");
4179 return -1;
4180 }
4181
4182 if (data->num_pmkid > 1) {
4183 wpa_printf(MSG_DEBUG, "PASN: Invalid number of PMKIDs");
4184 return -1;
4185 }
4186
4187 return 0;
4188 }
4189
4190
4191 /*
4192 * wpa_pasn_parse_parameter_ie - Validates PASN Parameters IE
4193 * @data: Pointer to the PASN Parameters IE (starting with the EID).
4194 * @len: Length of the data in the PASN Parameters IE
4195 * @from_ap: Whether this was received from an AP
4196 * @pasn_params: On successful return would hold the parsed PASN parameters.
4197 * Returns: -1 for invalid data; otherwise 0
4198 *
4199 * Note: On successful return, the pointers in &pasn_params point to the data in
4200 * the IE and are not locally allocated (so they should not be freed etc.).
4201 */
wpa_pasn_parse_parameter_ie(const u8 * data,u8 len,bool from_ap,struct wpa_pasn_params_data * pasn_params)4202 int wpa_pasn_parse_parameter_ie(const u8 *data, u8 len, bool from_ap,
4203 struct wpa_pasn_params_data *pasn_params)
4204 {
4205 struct pasn_parameter_ie *params = (struct pasn_parameter_ie *) data;
4206 const u8 *pos = (const u8 *) (params + 1);
4207
4208 if (!pasn_params) {
4209 wpa_printf(MSG_DEBUG, "PASN: Invalid params");
4210 return -1;
4211 }
4212
4213 if (!params || ((size_t) (params->len + 2) < sizeof(*params)) ||
4214 len < sizeof(*params) || params->len + 2 != len) {
4215 wpa_printf(MSG_DEBUG,
4216 "PASN: Invalid parameters IE. len=(%u, %u)",
4217 params ? params->len : 0, len);
4218 return -1;
4219 }
4220
4221 os_memset(pasn_params, 0, sizeof(*pasn_params));
4222
4223 switch (params->wrapped_data_format) {
4224 case WPA_PASN_WRAPPED_DATA_NO:
4225 case WPA_PASN_WRAPPED_DATA_SAE:
4226 case WPA_PASN_WRAPPED_DATA_FILS_SK:
4227 case WPA_PASN_WRAPPED_DATA_FT:
4228 break;
4229 default:
4230 wpa_printf(MSG_DEBUG, "PASN: Invalid wrapped data format");
4231 return -1;
4232 }
4233
4234 pasn_params->wrapped_data_format = params->wrapped_data_format;
4235
4236 len -= sizeof(*params);
4237
4238 if (params->control & WPA_PASN_CTRL_COMEBACK_INFO_PRESENT) {
4239 if (from_ap) {
4240 if (len < 2) {
4241 wpa_printf(MSG_DEBUG,
4242 "PASN: Invalid Parameters IE: Truncated Comeback After");
4243 return -1;
4244 }
4245 pasn_params->after = WPA_GET_LE16(pos);
4246 pos += 2;
4247 len -= 2;
4248 }
4249
4250 if (len < 1 || len < 1 + *pos) {
4251 wpa_printf(MSG_DEBUG,
4252 "PASN: Invalid Parameters IE: comeback len");
4253 return -1;
4254 }
4255
4256 pasn_params->comeback_len = *pos++;
4257 len--;
4258 pasn_params->comeback = pos;
4259 len -= pasn_params->comeback_len;
4260 pos += pasn_params->comeback_len;
4261 }
4262
4263 if (params->control & WPA_PASN_CTRL_GROUP_AND_KEY_PRESENT) {
4264 if (len < 3 || len < 3 + pos[2]) {
4265 wpa_printf(MSG_DEBUG,
4266 "PASN: Invalid Parameters IE: group and key");
4267 return -1;
4268 }
4269
4270 pasn_params->group = WPA_GET_LE16(pos);
4271 pos += 2;
4272 len -= 2;
4273 pasn_params->pubkey_len = *pos++;
4274 len--;
4275 pasn_params->pubkey = pos;
4276 len -= pasn_params->pubkey_len;
4277 pos += pasn_params->pubkey_len;
4278 }
4279
4280 if (len) {
4281 wpa_printf(MSG_DEBUG,
4282 "PASN: Invalid Parameters IE. Bytes left=%u", len);
4283 return -1;
4284 }
4285
4286 return 0;
4287 }
4288
4289
wpa_pasn_add_rsnxe(struct wpabuf * buf,u16 capab)4290 void wpa_pasn_add_rsnxe(struct wpabuf *buf, u16 capab)
4291 {
4292 size_t flen;
4293
4294 flen = (capab & 0xff00) ? 2 : 1;
4295 if (!capab)
4296 return; /* no supported extended RSN capabilities */
4297 if (wpabuf_tailroom(buf) < 2 + flen)
4298 return;
4299 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
4300
4301 wpabuf_put_u8(buf, WLAN_EID_RSNX);
4302 wpabuf_put_u8(buf, flen);
4303 wpabuf_put_u8(buf, capab & 0x00ff);
4304 capab >>= 8;
4305 if (capab)
4306 wpabuf_put_u8(buf, capab);
4307 }
4308
4309
4310 /*
4311 * wpa_pasn_add_extra_ies - Add protocol specific IEs in Authentication
4312 * frame for PASN.
4313 *
4314 * @buf: Buffer in which the elements will be added
4315 * @extra_ies: Protocol specific elements to add
4316 * @len: Length of the elements
4317 * Returns: 0 on success, -1 on failure
4318 */
4319
wpa_pasn_add_extra_ies(struct wpabuf * buf,const u8 * extra_ies,size_t len)4320 int wpa_pasn_add_extra_ies(struct wpabuf *buf, const u8 *extra_ies, size_t len)
4321 {
4322 if (!len || !extra_ies || !buf)
4323 return 0;
4324
4325 if (wpabuf_tailroom(buf) < sizeof(len))
4326 return -1;
4327
4328 wpabuf_put_data(buf, extra_ies, len);
4329 return 0;
4330 }
4331
4332 #endif /* CONFIG_PASN */
4333
4334
rsn_set_snonce_cookie(u8 * snonce)4335 void rsn_set_snonce_cookie(u8 *snonce)
4336 {
4337 u8 *pos;
4338
4339 pos = snonce + WPA_NONCE_LEN - 6;
4340 WPA_PUT_BE24(pos, OUI_WFA);
4341 pos += 3;
4342 WPA_PUT_BE24(pos, 0x000029);
4343 }
4344
4345
rsn_is_snonce_cookie(const u8 * snonce)4346 bool rsn_is_snonce_cookie(const u8 *snonce)
4347 {
4348 const u8 *pos;
4349
4350 pos = snonce + WPA_NONCE_LEN - 6;
4351 return WPA_GET_BE24(pos) == OUI_WFA &&
4352 WPA_GET_BE24(pos + 3) == 0x000029;
4353 }
4354