2 * IEEE 802.11 RSN / WPA Authenticator
3 * Copyright (c) 2004-2011, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "utils/eloop.h"
19 #include "utils/state_machine.h"
20 #include "common/ieee802_11_defs.h"
21 #include "crypto/aes_wrap.h"
22 #include "crypto/crypto.h"
23 #include "crypto/sha1.h"
24 #include "crypto/sha256.h"
25 #include "crypto/random.h"
26 #include "eapol_auth/eapol_auth_sm.h"
27 #include "ap_config.h"
28 #include "ieee802_11.h"
30 #include "pmksa_cache_auth.h"
31 #include "wpa_auth_i.h"
32 #include "wpa_auth_ie.h"
34 #define STATE_MACHINE_DATA struct wpa_state_machine
35 #define STATE_MACHINE_DEBUG_PREFIX "WPA"
36 #define STATE_MACHINE_ADDR sm->addr
39 static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx);
40 static int wpa_sm_step(struct wpa_state_machine *sm);
41 static int wpa_verify_key_mic(struct wpa_ptk *PTK, u8 *data, size_t data_len);
42 static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx);
43 static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth,
44 struct wpa_group *group);
45 static void wpa_request_new_ptk(struct wpa_state_machine *sm);
46 static int wpa_gtk_update(struct wpa_authenticator *wpa_auth,
47 struct wpa_group *group);
48 static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth,
49 struct wpa_group *group);
51 static const u32 dot11RSNAConfigGroupUpdateCount = 4;
52 static const u32 dot11RSNAConfigPairwiseUpdateCount = 4;
53 static const u32 eapol_key_timeout_first = 100; /* ms */
54 static const u32 eapol_key_timeout_subseq = 1000; /* ms */
55 static const u32 eapol_key_timeout_first_group = 500; /* ms */
57 /* TODO: make these configurable */
58 static const int dot11RSNAConfigPMKLifetime = 43200;
59 static const int dot11RSNAConfigPMKReauthThreshold = 70;
60 static const int dot11RSNAConfigSATimeout = 60;
63 static inline void wpa_auth_mic_failure_report(
64 struct wpa_authenticator *wpa_auth, const u8 *addr)
66 if (wpa_auth->cb.mic_failure_report)
67 wpa_auth->cb.mic_failure_report(wpa_auth->cb.ctx, addr);
71 static inline void wpa_auth_set_eapol(struct wpa_authenticator *wpa_auth,
72 const u8 *addr, wpa_eapol_variable var,
75 if (wpa_auth->cb.set_eapol)
76 wpa_auth->cb.set_eapol(wpa_auth->cb.ctx, addr, var, value);
80 static inline int wpa_auth_get_eapol(struct wpa_authenticator *wpa_auth,
81 const u8 *addr, wpa_eapol_variable var)
83 if (wpa_auth->cb.get_eapol == NULL)
85 return wpa_auth->cb.get_eapol(wpa_auth->cb.ctx, addr, var);
89 static inline const u8 * wpa_auth_get_psk(struct wpa_authenticator *wpa_auth,
90 const u8 *addr, const u8 *prev_psk)
92 if (wpa_auth->cb.get_psk == NULL)
94 return wpa_auth->cb.get_psk(wpa_auth->cb.ctx, addr, prev_psk);
98 static inline int wpa_auth_get_msk(struct wpa_authenticator *wpa_auth,
99 const u8 *addr, u8 *msk, size_t *len)
101 if (wpa_auth->cb.get_msk == NULL)
103 return wpa_auth->cb.get_msk(wpa_auth->cb.ctx, addr, msk, len);
107 static inline int wpa_auth_set_key(struct wpa_authenticator *wpa_auth,
109 enum wpa_alg alg, const u8 *addr, int idx,
110 u8 *key, size_t key_len)
112 if (wpa_auth->cb.set_key == NULL)
114 return wpa_auth->cb.set_key(wpa_auth->cb.ctx, vlan_id, alg, addr, idx,
119 static inline int wpa_auth_get_seqnum(struct wpa_authenticator *wpa_auth,
120 const u8 *addr, int idx, u8 *seq)
122 if (wpa_auth->cb.get_seqnum == NULL)
124 return wpa_auth->cb.get_seqnum(wpa_auth->cb.ctx, addr, idx, seq);
129 wpa_auth_send_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr,
130 const u8 *data, size_t data_len, int encrypt)
132 if (wpa_auth->cb.send_eapol == NULL)
134 return wpa_auth->cb.send_eapol(wpa_auth->cb.ctx, addr, data, data_len,
139 int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth,
140 int (*cb)(struct wpa_state_machine *sm, void *ctx),
143 if (wpa_auth->cb.for_each_sta == NULL)
145 return wpa_auth->cb.for_each_sta(wpa_auth->cb.ctx, cb, cb_ctx);
149 int wpa_auth_for_each_auth(struct wpa_authenticator *wpa_auth,
150 int (*cb)(struct wpa_authenticator *a, void *ctx),
153 if (wpa_auth->cb.for_each_auth == NULL)
155 return wpa_auth->cb.for_each_auth(wpa_auth->cb.ctx, cb, cb_ctx);
159 void wpa_auth_logger(struct wpa_authenticator *wpa_auth, const u8 *addr,
160 logger_level level, const char *txt)
162 if (wpa_auth->cb.logger == NULL)
164 wpa_auth->cb.logger(wpa_auth->cb.ctx, addr, level, txt);
168 void wpa_auth_vlogger(struct wpa_authenticator *wpa_auth, const u8 *addr,
169 logger_level level, const char *fmt, ...)
175 if (wpa_auth->cb.logger == NULL)
178 maxlen = os_strlen(fmt) + 100;
179 format = os_malloc(maxlen);
184 vsnprintf(format, maxlen, fmt, ap);
187 wpa_auth_logger(wpa_auth, addr, level, format);
193 static void wpa_sta_disconnect(struct wpa_authenticator *wpa_auth,
196 if (wpa_auth->cb.disconnect == NULL)
198 wpa_printf(MSG_DEBUG, "wpa_sta_disconnect STA " MACSTR, MAC2STR(addr));
199 wpa_auth->cb.disconnect(wpa_auth->cb.ctx, addr,
200 WLAN_REASON_PREV_AUTH_NOT_VALID);
204 static int wpa_use_aes_cmac(struct wpa_state_machine *sm)
207 #ifdef CONFIG_IEEE80211R
208 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt))
210 #endif /* CONFIG_IEEE80211R */
211 #ifdef CONFIG_IEEE80211W
212 if (wpa_key_mgmt_sha256(sm->wpa_key_mgmt))
214 #endif /* CONFIG_IEEE80211W */
219 static void wpa_rekey_gmk(void *eloop_ctx, void *timeout_ctx)
221 struct wpa_authenticator *wpa_auth = eloop_ctx;
223 if (random_get_bytes(wpa_auth->group->GMK, WPA_GMK_LEN)) {
224 wpa_printf(MSG_ERROR, "Failed to get random data for WPA "
227 wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "GMK rekeyd");
228 wpa_hexdump_key(MSG_DEBUG, "GMK",
229 wpa_auth->group->GMK, WPA_GMK_LEN);
232 if (wpa_auth->conf.wpa_gmk_rekey) {
233 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0,
234 wpa_rekey_gmk, wpa_auth, NULL);
239 static void wpa_rekey_gtk(void *eloop_ctx, void *timeout_ctx)
241 struct wpa_authenticator *wpa_auth = eloop_ctx;
242 struct wpa_group *group;
244 wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "rekeying GTK");
245 for (group = wpa_auth->group; group; group = group->next) {
246 group->GTKReKey = TRUE;
248 group->changed = FALSE;
249 wpa_group_sm_step(wpa_auth, group);
250 } while (group->changed);
253 if (wpa_auth->conf.wpa_group_rekey) {
254 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey,
255 0, wpa_rekey_gtk, wpa_auth, NULL);
260 static void wpa_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
262 struct wpa_authenticator *wpa_auth = eloop_ctx;
263 struct wpa_state_machine *sm = timeout_ctx;
265 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "rekeying PTK");
266 wpa_request_new_ptk(sm);
271 static int wpa_auth_pmksa_clear_cb(struct wpa_state_machine *sm, void *ctx)
273 if (sm->pmksa == ctx)
279 static void wpa_auth_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
282 struct wpa_authenticator *wpa_auth = ctx;
283 wpa_auth_for_each_sta(wpa_auth, wpa_auth_pmksa_clear_cb, entry);
287 static void wpa_group_set_key_len(struct wpa_group *group, int cipher)
290 case WPA_CIPHER_CCMP:
293 case WPA_CIPHER_TKIP:
296 case WPA_CIPHER_WEP104:
299 case WPA_CIPHER_WEP40:
306 static int wpa_group_init_gmk_and_counter(struct wpa_authenticator *wpa_auth,
307 struct wpa_group *group)
309 u8 buf[ETH_ALEN + 8 + sizeof(group)];
312 if (random_get_bytes(group->GMK, WPA_GMK_LEN) < 0)
314 wpa_hexdump_key(MSG_DEBUG, "GMK", group->GMK, WPA_GMK_LEN);
317 * Counter = PRF-256(Random number, "Init Counter",
318 * Local MAC Address || Time)
320 os_memcpy(buf, wpa_auth->addr, ETH_ALEN);
321 wpa_get_ntp_timestamp(buf + ETH_ALEN);
322 os_memcpy(buf + ETH_ALEN + 8, &group, sizeof(group));
323 if (random_get_bytes(rkey, sizeof(rkey)) < 0)
326 if (sha1_prf(rkey, sizeof(rkey), "Init Counter", buf, sizeof(buf),
327 group->Counter, WPA_NONCE_LEN) < 0)
329 wpa_hexdump_key(MSG_DEBUG, "Key Counter",
330 group->Counter, WPA_NONCE_LEN);
336 static struct wpa_group * wpa_group_init(struct wpa_authenticator *wpa_auth,
337 int vlan_id, int delay_init)
339 struct wpa_group *group;
341 group = os_zalloc(sizeof(struct wpa_group));
345 group->GTKAuthenticator = TRUE;
346 group->vlan_id = vlan_id;
348 wpa_group_set_key_len(group, wpa_auth->conf.wpa_group);
350 if (random_pool_ready() != 1) {
351 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool "
352 "for secure operations - update keys later when "
353 "the first station connects");
357 * Set initial GMK/Counter value here. The actual values that will be
358 * used in negotiations will be set once the first station tries to
359 * connect. This allows more time for collecting additional randomness
360 * on embedded devices.
362 if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0) {
363 wpa_printf(MSG_ERROR, "Failed to get random data for WPA "
371 wpa_printf(MSG_DEBUG, "WPA: Delay group state machine start "
372 "until Beacon frames have been configured");
373 /* Initialization is completed in wpa_init_keys(). */
375 wpa_group_sm_step(wpa_auth, group);
376 group->GInit = FALSE;
377 wpa_group_sm_step(wpa_auth, group);
385 * wpa_init - Initialize WPA authenticator
386 * @addr: Authenticator address
387 * @conf: Configuration for WPA authenticator
388 * @cb: Callback functions for WPA authenticator
389 * Returns: Pointer to WPA authenticator data or %NULL on failure
391 struct wpa_authenticator * wpa_init(const u8 *addr,
392 struct wpa_auth_config *conf,
393 struct wpa_auth_callbacks *cb)
395 struct wpa_authenticator *wpa_auth;
397 wpa_auth = os_zalloc(sizeof(struct wpa_authenticator));
398 if (wpa_auth == NULL)
400 os_memcpy(wpa_auth->addr, addr, ETH_ALEN);
401 os_memcpy(&wpa_auth->conf, conf, sizeof(*conf));
402 os_memcpy(&wpa_auth->cb, cb, sizeof(*cb));
404 if (wpa_auth_gen_wpa_ie(wpa_auth)) {
405 wpa_printf(MSG_ERROR, "Could not generate WPA IE.");
410 wpa_auth->group = wpa_group_init(wpa_auth, 0, 1);
411 if (wpa_auth->group == NULL) {
412 os_free(wpa_auth->wpa_ie);
417 wpa_auth->pmksa = pmksa_cache_auth_init(wpa_auth_pmksa_free_cb,
419 if (wpa_auth->pmksa == NULL) {
420 wpa_printf(MSG_ERROR, "PMKSA cache initialization failed.");
421 os_free(wpa_auth->wpa_ie);
426 #ifdef CONFIG_IEEE80211R
427 wpa_auth->ft_pmk_cache = wpa_ft_pmk_cache_init();
428 if (wpa_auth->ft_pmk_cache == NULL) {
429 wpa_printf(MSG_ERROR, "FT PMK cache initialization failed.");
430 os_free(wpa_auth->wpa_ie);
431 pmksa_cache_auth_deinit(wpa_auth->pmksa);
435 #endif /* CONFIG_IEEE80211R */
437 if (wpa_auth->conf.wpa_gmk_rekey) {
438 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0,
439 wpa_rekey_gmk, wpa_auth, NULL);
442 if (wpa_auth->conf.wpa_group_rekey) {
443 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 0,
444 wpa_rekey_gtk, wpa_auth, NULL);
451 int wpa_init_keys(struct wpa_authenticator *wpa_auth)
453 struct wpa_group *group = wpa_auth->group;
455 wpa_printf(MSG_DEBUG, "WPA: Start group state machine to set initial "
457 wpa_group_sm_step(wpa_auth, group);
458 group->GInit = FALSE;
459 wpa_group_sm_step(wpa_auth, group);
465 * wpa_deinit - Deinitialize WPA authenticator
466 * @wpa_auth: Pointer to WPA authenticator data from wpa_init()
468 void wpa_deinit(struct wpa_authenticator *wpa_auth)
470 struct wpa_group *group, *prev;
472 eloop_cancel_timeout(wpa_rekey_gmk, wpa_auth, NULL);
473 eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL);
475 #ifdef CONFIG_PEERKEY
476 while (wpa_auth->stsl_negotiations)
477 wpa_stsl_remove(wpa_auth, wpa_auth->stsl_negotiations);
478 #endif /* CONFIG_PEERKEY */
480 pmksa_cache_auth_deinit(wpa_auth->pmksa);
482 #ifdef CONFIG_IEEE80211R
483 wpa_ft_pmk_cache_deinit(wpa_auth->ft_pmk_cache);
484 wpa_auth->ft_pmk_cache = NULL;
485 #endif /* CONFIG_IEEE80211R */
487 os_free(wpa_auth->wpa_ie);
489 group = wpa_auth->group;
501 * wpa_reconfig - Update WPA authenticator configuration
502 * @wpa_auth: Pointer to WPA authenticator data from wpa_init()
503 * @conf: Configuration for WPA authenticator
505 int wpa_reconfig(struct wpa_authenticator *wpa_auth,
506 struct wpa_auth_config *conf)
508 struct wpa_group *group;
509 if (wpa_auth == NULL)
512 os_memcpy(&wpa_auth->conf, conf, sizeof(*conf));
513 if (wpa_auth_gen_wpa_ie(wpa_auth)) {
514 wpa_printf(MSG_ERROR, "Could not generate WPA IE.");
519 * Reinitialize GTK to make sure it is suitable for the new
522 group = wpa_auth->group;
523 wpa_group_set_key_len(group, wpa_auth->conf.wpa_group);
525 wpa_group_sm_step(wpa_auth, group);
526 group->GInit = FALSE;
527 wpa_group_sm_step(wpa_auth, group);
533 struct wpa_state_machine *
534 wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr)
536 struct wpa_state_machine *sm;
538 sm = os_zalloc(sizeof(struct wpa_state_machine));
541 os_memcpy(sm->addr, addr, ETH_ALEN);
543 sm->wpa_auth = wpa_auth;
544 sm->group = wpa_auth->group;
550 int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth,
551 struct wpa_state_machine *sm)
553 if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL)
556 #ifdef CONFIG_IEEE80211R
557 if (sm->ft_completed) {
558 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
559 "FT authentication already completed - do not "
560 "start 4-way handshake");
563 #endif /* CONFIG_IEEE80211R */
566 os_memset(&sm->key_replay, 0, sizeof(sm->key_replay));
567 sm->ReAuthenticationRequest = TRUE;
568 return wpa_sm_step(sm);
571 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
572 "start authentication");
576 if (wpa_sm_step(sm) == 1)
577 return 1; /* should not really happen */
579 sm->AuthenticationRequest = TRUE;
580 return wpa_sm_step(sm);
584 void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm)
586 /* WPA/RSN was not used - clear WPA state. This is needed if the STA
587 * reassociates back to the same AP while the previous entry for the
588 * STA has not yet been removed. */
592 sm->wpa_key_mgmt = 0;
596 static void wpa_free_sta_sm(struct wpa_state_machine *sm)
598 if (sm->GUpdateStationKeys) {
599 sm->group->GKeyDoneStations--;
600 sm->GUpdateStationKeys = FALSE;
602 #ifdef CONFIG_IEEE80211R
603 os_free(sm->assoc_resp_ftie);
604 #endif /* CONFIG_IEEE80211R */
605 os_free(sm->last_rx_eapol_key);
611 void wpa_auth_sta_deinit(struct wpa_state_machine *sm)
616 if (sm->wpa_auth->conf.wpa_strict_rekey && sm->has_GTK) {
617 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
618 "strict rekeying - force GTK rekey since STA "
620 eloop_cancel_timeout(wpa_rekey_gtk, sm->wpa_auth, NULL);
621 eloop_register_timeout(0, 500000, wpa_rekey_gtk, sm->wpa_auth,
625 eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm);
626 sm->pending_1_of_4_timeout = 0;
627 eloop_cancel_timeout(wpa_sm_call_step, sm, NULL);
628 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
629 if (sm->in_step_loop) {
630 /* Must not free state machine while wpa_sm_step() is running.
631 * Freeing will be completed in the end of wpa_sm_step(). */
632 wpa_printf(MSG_DEBUG, "WPA: Registering pending STA state "
633 "machine deinit for " MACSTR, MAC2STR(sm->addr));
634 sm->pending_deinit = 1;
640 static void wpa_request_new_ptk(struct wpa_state_machine *sm)
645 sm->PTKRequest = TRUE;
650 static int wpa_replay_counter_valid(struct wpa_state_machine *sm,
651 const u8 *replay_counter)
654 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) {
655 if (!sm->key_replay[i].valid)
657 if (os_memcmp(replay_counter, sm->key_replay[i].counter,
658 WPA_REPLAY_COUNTER_LEN) == 0)
665 #ifdef CONFIG_IEEE80211R
666 static int ft_check_msg_2_of_4(struct wpa_authenticator *wpa_auth,
667 struct wpa_state_machine *sm,
668 struct wpa_eapol_ie_parse *kde)
670 struct wpa_ie_data ie;
671 struct rsn_mdie *mdie;
673 if (wpa_parse_wpa_ie_rsn(kde->rsn_ie, kde->rsn_ie_len, &ie) < 0 ||
674 ie.num_pmkid != 1 || ie.pmkid == NULL) {
675 wpa_printf(MSG_DEBUG, "FT: No PMKR1Name in "
676 "FT 4-way handshake message 2/4");
680 os_memcpy(sm->sup_pmk_r1_name, ie.pmkid, PMKID_LEN);
681 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Supplicant",
682 sm->sup_pmk_r1_name, PMKID_LEN);
684 if (!kde->mdie || !kde->ftie) {
685 wpa_printf(MSG_DEBUG, "FT: No %s in FT 4-way handshake "
686 "message 2/4", kde->mdie ? "FTIE" : "MDIE");
690 mdie = (struct rsn_mdie *) (kde->mdie + 2);
691 if (kde->mdie[1] < sizeof(struct rsn_mdie) ||
692 os_memcmp(wpa_auth->conf.mobility_domain, mdie->mobility_domain,
693 MOBILITY_DOMAIN_ID_LEN) != 0) {
694 wpa_printf(MSG_DEBUG, "FT: MDIE mismatch");
698 if (sm->assoc_resp_ftie &&
699 (kde->ftie[1] != sm->assoc_resp_ftie[1] ||
700 os_memcmp(kde->ftie, sm->assoc_resp_ftie,
701 2 + sm->assoc_resp_ftie[1]) != 0)) {
702 wpa_printf(MSG_DEBUG, "FT: FTIE mismatch");
703 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 2/4",
704 kde->ftie, kde->ftie_len);
705 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)AssocResp",
706 sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]);
712 #endif /* CONFIG_IEEE80211R */
715 static void wpa_receive_error_report(struct wpa_authenticator *wpa_auth,
716 struct wpa_state_machine *sm, int group)
718 /* Supplicant reported a Michael MIC error */
719 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
720 "received EAPOL-Key Error Request "
721 "(STA detected Michael MIC failure (group=%d))",
724 if (group && wpa_auth->conf.wpa_group != WPA_CIPHER_TKIP) {
725 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
726 "ignore Michael MIC failure report since "
727 "group cipher is not TKIP");
728 } else if (!group && sm->pairwise != WPA_CIPHER_TKIP) {
729 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
730 "ignore Michael MIC failure report since "
731 "pairwise cipher is not TKIP");
733 wpa_auth_mic_failure_report(wpa_auth, sm->addr);
734 sm->dot11RSNAStatsTKIPRemoteMICFailures++;
735 wpa_auth->dot11RSNAStatsTKIPRemoteMICFailures++;
739 * Error report is not a request for a new key handshake, but since
740 * Authenticator may do it, let's change the keys now anyway.
742 wpa_request_new_ptk(sm);
746 void wpa_receive(struct wpa_authenticator *wpa_auth,
747 struct wpa_state_machine *sm,
748 u8 *data, size_t data_len)
750 struct ieee802_1x_hdr *hdr;
751 struct wpa_eapol_key *key;
752 u16 key_info, key_data_length;
753 enum { PAIRWISE_2, PAIRWISE_4, GROUP_2, REQUEST,
754 SMK_M1, SMK_M3, SMK_ERROR } msg;
756 struct wpa_eapol_ie_parse kde;
758 const u8 *eapol_key_ie;
759 size_t eapol_key_ie_len;
761 if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL)
764 if (data_len < sizeof(*hdr) + sizeof(*key))
767 hdr = (struct ieee802_1x_hdr *) data;
768 key = (struct wpa_eapol_key *) (hdr + 1);
769 key_info = WPA_GET_BE16(key->key_info);
770 key_data_length = WPA_GET_BE16(key->key_data_length);
771 wpa_printf(MSG_DEBUG, "WPA: Received EAPOL-Key from " MACSTR
772 " key_info=0x%x type=%u key_data_length=%u",
773 MAC2STR(sm->addr), key_info, key->type, key_data_length);
774 if (key_data_length > data_len - sizeof(*hdr) - sizeof(*key)) {
775 wpa_printf(MSG_INFO, "WPA: Invalid EAPOL-Key frame - "
776 "key_data overflow (%d > %lu)",
778 (unsigned long) (data_len - sizeof(*hdr) -
783 if (sm->wpa == WPA_VERSION_WPA2) {
784 if (key->type != EAPOL_KEY_TYPE_RSN) {
785 wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with "
786 "unexpected type %d in RSN mode",
791 if (key->type != EAPOL_KEY_TYPE_WPA) {
792 wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with "
793 "unexpected type %d in WPA mode",
799 wpa_hexdump(MSG_DEBUG, "WPA: Received Key Nonce", key->key_nonce,
801 wpa_hexdump(MSG_DEBUG, "WPA: Received Replay Counter",
802 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
804 /* FIX: verify that the EAPOL-Key frame was encrypted if pairwise keys
807 if ((key_info & (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) ==
808 (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) {
809 if (key_info & WPA_KEY_INFO_ERROR) {
811 msgtxt = "SMK Error";
816 } else if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
819 } else if (key_info & WPA_KEY_INFO_REQUEST) {
822 } else if (!(key_info & WPA_KEY_INFO_KEY_TYPE)) {
824 msgtxt = "2/2 Group";
825 } else if (key_data_length == 0) {
827 msgtxt = "4/4 Pairwise";
830 msgtxt = "2/4 Pairwise";
833 /* TODO: key_info type validation for PeerKey */
834 if (msg == REQUEST || msg == PAIRWISE_2 || msg == PAIRWISE_4 ||
836 u16 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
837 if (sm->pairwise == WPA_CIPHER_CCMP) {
838 if (wpa_use_aes_cmac(sm) &&
839 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC) {
840 wpa_auth_logger(wpa_auth, sm->addr,
842 "advertised support for "
843 "AES-128-CMAC, but did not "
848 if (!wpa_use_aes_cmac(sm) &&
849 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
850 wpa_auth_logger(wpa_auth, sm->addr,
852 "did not use HMAC-SHA1-AES "
859 if (key_info & WPA_KEY_INFO_REQUEST) {
860 if (sm->req_replay_counter_used &&
861 os_memcmp(key->replay_counter, sm->req_replay_counter,
862 WPA_REPLAY_COUNTER_LEN) <= 0) {
863 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING,
864 "received EAPOL-Key request with "
870 if (!(key_info & WPA_KEY_INFO_REQUEST) &&
871 !wpa_replay_counter_valid(sm, key->replay_counter)) {
873 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
874 "received EAPOL-Key %s with unexpected "
875 "replay counter", msgtxt);
876 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) {
877 if (!sm->key_replay[i].valid)
879 wpa_hexdump(MSG_DEBUG, "pending replay counter",
880 sm->key_replay[i].counter,
881 WPA_REPLAY_COUNTER_LEN);
883 wpa_hexdump(MSG_DEBUG, "received replay counter",
884 key->replay_counter, WPA_REPLAY_COUNTER_LEN);
890 if (sm->wpa_ptk_state != WPA_PTK_PTKSTART &&
891 sm->wpa_ptk_state != WPA_PTK_PTKCALCNEGOTIATING) {
892 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
893 "received EAPOL-Key msg 2/4 in "
894 "invalid state (%d) - dropped",
898 random_add_randomness(key->key_nonce, WPA_NONCE_LEN);
899 if (sm->group->reject_4way_hs_for_entropy) {
901 * The system did not have enough entropy to generate
902 * strong random numbers. Reject the first 4-way
903 * handshake(s) and collect some entropy based on the
904 * information from it. Once enough entropy is
905 * available, the next atempt will trigger GMK/Key
906 * Counter update and the station will be allowed to
909 wpa_printf(MSG_DEBUG, "WPA: Reject 4-way handshake to "
910 "collect more entropy for random number "
912 sm->group->reject_4way_hs_for_entropy = FALSE;
913 random_mark_pool_ready();
914 sm->group->first_sta_seen = FALSE;
915 wpa_sta_disconnect(wpa_auth, sm->addr);
918 if (wpa_parse_kde_ies((u8 *) (key + 1), key_data_length,
920 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
921 "received EAPOL-Key msg 2/4 with "
922 "invalid Key Data contents");
926 eapol_key_ie = kde.rsn_ie;
927 eapol_key_ie_len = kde.rsn_ie_len;
929 eapol_key_ie = kde.wpa_ie;
930 eapol_key_ie_len = kde.wpa_ie_len;
932 ft = sm->wpa == WPA_VERSION_WPA2 &&
933 wpa_key_mgmt_ft(sm->wpa_key_mgmt);
934 if (sm->wpa_ie == NULL ||
935 wpa_compare_rsn_ie(ft,
936 sm->wpa_ie, sm->wpa_ie_len,
937 eapol_key_ie, eapol_key_ie_len)) {
938 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
939 "WPA IE from (Re)AssocReq did not "
940 "match with msg 2/4");
942 wpa_hexdump(MSG_DEBUG, "WPA IE in AssocReq",
943 sm->wpa_ie, sm->wpa_ie_len);
945 wpa_hexdump(MSG_DEBUG, "WPA IE in msg 2/4",
946 eapol_key_ie, eapol_key_ie_len);
947 /* MLME-DEAUTHENTICATE.request */
948 wpa_sta_disconnect(wpa_auth, sm->addr);
951 #ifdef CONFIG_IEEE80211R
952 if (ft && ft_check_msg_2_of_4(wpa_auth, sm, &kde) < 0) {
953 wpa_sta_disconnect(wpa_auth, sm->addr);
956 #endif /* CONFIG_IEEE80211R */
959 if (sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING ||
961 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
962 "received EAPOL-Key msg 4/4 in "
963 "invalid state (%d) - dropped",
969 if (sm->wpa_ptk_group_state != WPA_PTK_GROUP_REKEYNEGOTIATING
971 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
972 "received EAPOL-Key msg 2/2 in "
973 "invalid state (%d) - dropped",
974 sm->wpa_ptk_group_state);
978 #ifdef CONFIG_PEERKEY
982 if (!wpa_auth->conf.peerkey) {
983 wpa_printf(MSG_DEBUG, "RSN: SMK M1/M3/Error, but "
984 "PeerKey use disabled - ignoring message");
987 if (!sm->PTK_valid) {
988 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
989 "received EAPOL-Key msg SMK in "
990 "invalid state - dropped");
994 #else /* CONFIG_PEERKEY */
998 return; /* STSL disabled - ignore SMK messages */
999 #endif /* CONFIG_PEERKEY */
1004 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1005 "received EAPOL-Key frame (%s)", msgtxt);
1007 if (key_info & WPA_KEY_INFO_ACK) {
1008 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1009 "received invalid EAPOL-Key: Key Ack set");
1013 if (!(key_info & WPA_KEY_INFO_MIC)) {
1014 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1015 "received invalid EAPOL-Key: Key MIC not set");
1019 sm->MICVerified = FALSE;
1020 if (sm->PTK_valid) {
1021 if (wpa_verify_key_mic(&sm->PTK, data, data_len)) {
1022 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1023 "received EAPOL-Key with invalid MIC");
1026 sm->MICVerified = TRUE;
1027 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm);
1028 sm->pending_1_of_4_timeout = 0;
1031 if (key_info & WPA_KEY_INFO_REQUEST) {
1032 if (sm->MICVerified) {
1033 sm->req_replay_counter_used = 1;
1034 os_memcpy(sm->req_replay_counter, key->replay_counter,
1035 WPA_REPLAY_COUNTER_LEN);
1037 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1038 "received EAPOL-Key request with "
1044 * TODO: should decrypt key data field if encryption was used;
1045 * even though MAC address KDE is not normally encrypted,
1046 * supplicant is allowed to encrypt it.
1048 if (msg == SMK_ERROR) {
1049 #ifdef CONFIG_PEERKEY
1050 wpa_smk_error(wpa_auth, sm, key);
1051 #endif /* CONFIG_PEERKEY */
1053 } else if (key_info & WPA_KEY_INFO_ERROR) {
1054 wpa_receive_error_report(
1056 !(key_info & WPA_KEY_INFO_KEY_TYPE));
1057 } else if (key_info & WPA_KEY_INFO_KEY_TYPE) {
1058 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1059 "received EAPOL-Key Request for new "
1061 wpa_request_new_ptk(sm);
1062 #ifdef CONFIG_PEERKEY
1063 } else if (msg == SMK_M1) {
1064 wpa_smk_m1(wpa_auth, sm, key);
1065 #endif /* CONFIG_PEERKEY */
1066 } else if (key_data_length > 0 &&
1067 wpa_parse_kde_ies((const u8 *) (key + 1),
1068 key_data_length, &kde) == 0 &&
1071 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1072 "received EAPOL-Key Request for GTK "
1074 eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL);
1075 wpa_rekey_gtk(wpa_auth, NULL);
1078 /* Do not allow the same key replay counter to be reused. This
1079 * does also invalidate all other pending replay counters if
1080 * retransmissions were used, i.e., we will only process one of
1081 * the pending replies and ignore rest if more than one is
1083 sm->key_replay[0].valid = FALSE;
1086 #ifdef CONFIG_PEERKEY
1087 if (msg == SMK_M3) {
1088 wpa_smk_m3(wpa_auth, sm, key);
1091 #endif /* CONFIG_PEERKEY */
1093 os_free(sm->last_rx_eapol_key);
1094 sm->last_rx_eapol_key = os_malloc(data_len);
1095 if (sm->last_rx_eapol_key == NULL)
1097 os_memcpy(sm->last_rx_eapol_key, data, data_len);
1098 sm->last_rx_eapol_key_len = data_len;
1100 sm->rx_eapol_key_secure = !!(key_info & WPA_KEY_INFO_SECURE);
1101 sm->EAPOLKeyReceived = TRUE;
1102 sm->EAPOLKeyPairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE);
1103 sm->EAPOLKeyRequest = !!(key_info & WPA_KEY_INFO_REQUEST);
1104 os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN);
1109 static int wpa_gmk_to_gtk(const u8 *gmk, const char *label, const u8 *addr,
1110 const u8 *gnonce, u8 *gtk, size_t gtk_len)
1112 u8 data[ETH_ALEN + WPA_NONCE_LEN + 8 + 16];
1116 /* GTK = PRF-X(GMK, "Group key expansion",
1117 * AA || GNonce || Time || random data)
1118 * The example described in the IEEE 802.11 standard uses only AA and
1119 * GNonce as inputs here. Add some more entropy since this derivation
1120 * is done only at the Authenticator and as such, does not need to be
1123 os_memcpy(data, addr, ETH_ALEN);
1124 os_memcpy(data + ETH_ALEN, gnonce, WPA_NONCE_LEN);
1125 pos = data + ETH_ALEN + WPA_NONCE_LEN;
1126 wpa_get_ntp_timestamp(pos);
1128 if (random_get_bytes(pos, 16) < 0)
1131 #ifdef CONFIG_IEEE80211W
1132 sha256_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len);
1133 #else /* CONFIG_IEEE80211W */
1134 if (sha1_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len)
1137 #endif /* CONFIG_IEEE80211W */
1143 static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx)
1145 struct wpa_authenticator *wpa_auth = eloop_ctx;
1146 struct wpa_state_machine *sm = timeout_ctx;
1148 sm->pending_1_of_4_timeout = 0;
1149 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "EAPOL-Key timeout");
1150 sm->TimeoutEvt = TRUE;
1155 void __wpa_send_eapol(struct wpa_authenticator *wpa_auth,
1156 struct wpa_state_machine *sm, int key_info,
1157 const u8 *key_rsc, const u8 *nonce,
1158 const u8 *kde, size_t kde_len,
1159 int keyidx, int encr, int force_version)
1161 struct ieee802_1x_hdr *hdr;
1162 struct wpa_eapol_key *key;
1165 int key_data_len, pad_len = 0;
1167 int version, pairwise;
1170 len = sizeof(struct ieee802_1x_hdr) + sizeof(struct wpa_eapol_key);
1173 version = force_version;
1174 else if (wpa_use_aes_cmac(sm))
1175 version = WPA_KEY_INFO_TYPE_AES_128_CMAC;
1176 else if (sm->pairwise == WPA_CIPHER_CCMP)
1177 version = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
1179 version = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
1181 pairwise = key_info & WPA_KEY_INFO_KEY_TYPE;
1183 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL(version=%d secure=%d mic=%d "
1184 "ack=%d install=%d pairwise=%d kde_len=%lu keyidx=%d "
1187 (key_info & WPA_KEY_INFO_SECURE) ? 1 : 0,
1188 (key_info & WPA_KEY_INFO_MIC) ? 1 : 0,
1189 (key_info & WPA_KEY_INFO_ACK) ? 1 : 0,
1190 (key_info & WPA_KEY_INFO_INSTALL) ? 1 : 0,
1191 pairwise, (unsigned long) kde_len, keyidx, encr);
1193 key_data_len = kde_len;
1195 if ((version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
1196 version == WPA_KEY_INFO_TYPE_AES_128_CMAC) && encr) {
1197 pad_len = key_data_len % 8;
1199 pad_len = 8 - pad_len;
1200 key_data_len += pad_len + 8;
1203 len += key_data_len;
1205 hdr = os_zalloc(len);
1208 hdr->version = wpa_auth->conf.eapol_version;
1209 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1210 hdr->length = host_to_be16(len - sizeof(*hdr));
1211 key = (struct wpa_eapol_key *) (hdr + 1);
1213 key->type = sm->wpa == WPA_VERSION_WPA2 ?
1214 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1215 key_info |= version;
1216 if (encr && sm->wpa == WPA_VERSION_WPA2)
1217 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
1218 if (sm->wpa != WPA_VERSION_WPA2)
1219 key_info |= keyidx << WPA_KEY_INFO_KEY_INDEX_SHIFT;
1220 WPA_PUT_BE16(key->key_info, key_info);
1222 alg = pairwise ? sm->pairwise : wpa_auth->conf.wpa_group;
1224 case WPA_CIPHER_CCMP:
1225 WPA_PUT_BE16(key->key_length, 16);
1227 case WPA_CIPHER_TKIP:
1228 WPA_PUT_BE16(key->key_length, 32);
1230 case WPA_CIPHER_WEP40:
1231 WPA_PUT_BE16(key->key_length, 5);
1233 case WPA_CIPHER_WEP104:
1234 WPA_PUT_BE16(key->key_length, 13);
1237 if (key_info & WPA_KEY_INFO_SMK_MESSAGE)
1238 WPA_PUT_BE16(key->key_length, 0);
1240 /* FIX: STSL: what to use as key_replay_counter? */
1241 for (i = RSNA_MAX_EAPOL_RETRIES - 1; i > 0; i--) {
1242 sm->key_replay[i].valid = sm->key_replay[i - 1].valid;
1243 os_memcpy(sm->key_replay[i].counter,
1244 sm->key_replay[i - 1].counter,
1245 WPA_REPLAY_COUNTER_LEN);
1247 inc_byte_array(sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN);
1248 os_memcpy(key->replay_counter, sm->key_replay[0].counter,
1249 WPA_REPLAY_COUNTER_LEN);
1250 sm->key_replay[0].valid = TRUE;
1253 os_memcpy(key->key_nonce, nonce, WPA_NONCE_LEN);
1256 os_memcpy(key->key_rsc, key_rsc, WPA_KEY_RSC_LEN);
1259 os_memcpy(key + 1, kde, kde_len);
1260 WPA_PUT_BE16(key->key_data_length, kde_len);
1261 } else if (encr && kde) {
1262 buf = os_zalloc(key_data_len);
1268 os_memcpy(pos, kde, kde_len);
1274 wpa_hexdump_key(MSG_DEBUG, "Plaintext EAPOL-Key Key Data",
1276 if (version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
1277 version == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
1278 if (aes_wrap(sm->PTK.kek, (key_data_len - 8) / 8, buf,
1279 (u8 *) (key + 1))) {
1284 WPA_PUT_BE16(key->key_data_length, key_data_len);
1287 os_memcpy(key->key_iv,
1288 sm->group->Counter + WPA_NONCE_LEN - 16, 16);
1289 inc_byte_array(sm->group->Counter, WPA_NONCE_LEN);
1290 os_memcpy(ek, key->key_iv, 16);
1291 os_memcpy(ek + 16, sm->PTK.kek, 16);
1292 os_memcpy(key + 1, buf, key_data_len);
1293 rc4_skip(ek, 32, 256, (u8 *) (key + 1), key_data_len);
1294 WPA_PUT_BE16(key->key_data_length, key_data_len);
1299 if (key_info & WPA_KEY_INFO_MIC) {
1300 if (!sm->PTK_valid) {
1301 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
1302 "PTK not valid when sending EAPOL-Key "
1307 wpa_eapol_key_mic(sm->PTK.kck, version, (u8 *) hdr, len,
1311 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_inc_EapolFramesTx,
1313 wpa_auth_send_eapol(wpa_auth, sm->addr, (u8 *) hdr, len,
1319 static void wpa_send_eapol(struct wpa_authenticator *wpa_auth,
1320 struct wpa_state_machine *sm, int key_info,
1321 const u8 *key_rsc, const u8 *nonce,
1322 const u8 *kde, size_t kde_len,
1323 int keyidx, int encr)
1326 int pairwise = key_info & WPA_KEY_INFO_KEY_TYPE;
1332 __wpa_send_eapol(wpa_auth, sm, key_info, key_rsc, nonce, kde, kde_len,
1335 ctr = pairwise ? sm->TimeoutCtr : sm->GTimeoutCtr;
1336 if (ctr == 1 && wpa_auth->conf.tx_status)
1337 timeout_ms = pairwise ? eapol_key_timeout_first :
1338 eapol_key_timeout_first_group;
1340 timeout_ms = eapol_key_timeout_subseq;
1341 if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC))
1342 sm->pending_1_of_4_timeout = 1;
1343 wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry "
1344 "counter %d)", timeout_ms, ctr);
1345 eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000,
1346 wpa_send_eapol_timeout, wpa_auth, sm);
1350 static int wpa_verify_key_mic(struct wpa_ptk *PTK, u8 *data, size_t data_len)
1352 struct ieee802_1x_hdr *hdr;
1353 struct wpa_eapol_key *key;
1358 if (data_len < sizeof(*hdr) + sizeof(*key))
1361 hdr = (struct ieee802_1x_hdr *) data;
1362 key = (struct wpa_eapol_key *) (hdr + 1);
1363 key_info = WPA_GET_BE16(key->key_info);
1364 os_memcpy(mic, key->key_mic, 16);
1365 os_memset(key->key_mic, 0, 16);
1366 if (wpa_eapol_key_mic(PTK->kck, key_info & WPA_KEY_INFO_TYPE_MASK,
1367 data, data_len, key->key_mic) ||
1368 os_memcmp(mic, key->key_mic, 16) != 0)
1370 os_memcpy(key->key_mic, mic, 16);
1375 void wpa_remove_ptk(struct wpa_state_machine *sm)
1377 sm->PTK_valid = FALSE;
1378 os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1379 wpa_auth_set_key(sm->wpa_auth, 0, WPA_ALG_NONE, sm->addr, 0, NULL, 0);
1380 sm->pairwise_set = FALSE;
1381 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
1385 int wpa_auth_sm_event(struct wpa_state_machine *sm, wpa_event event)
1392 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1393 "event %d notification", event);
1401 sm->DeauthenticationRequest = TRUE;
1404 case WPA_REAUTH_EAPOL:
1407 * When using WPS, we may end up here if the STA
1408 * manages to re-associate without the previous STA
1409 * entry getting removed. Consequently, we need to make
1410 * sure that the WPA state machines gets initialized
1411 * properly at this point.
1413 wpa_printf(MSG_DEBUG, "WPA state machine had not been "
1414 "started - initialize now");
1417 if (wpa_sm_step(sm) == 1)
1418 return 1; /* should not really happen */
1420 sm->AuthenticationRequest = TRUE;
1423 if (sm->GUpdateStationKeys) {
1425 * Reauthentication cancels the pending group key
1426 * update for this STA.
1428 sm->group->GKeyDoneStations--;
1429 sm->GUpdateStationKeys = FALSE;
1430 sm->PtkGroupInit = TRUE;
1432 sm->ReAuthenticationRequest = TRUE;
1435 #ifdef CONFIG_IEEE80211R
1436 wpa_printf(MSG_DEBUG, "FT: Retry PTK configuration "
1437 "after association");
1438 wpa_ft_install_ptk(sm);
1440 /* Using FT protocol, not WPA auth state machine */
1441 sm->ft_completed = 1;
1443 #else /* CONFIG_IEEE80211R */
1445 #endif /* CONFIG_IEEE80211R */
1448 #ifdef CONFIG_IEEE80211R
1449 sm->ft_completed = 0;
1450 #endif /* CONFIG_IEEE80211R */
1452 #ifdef CONFIG_IEEE80211W
1453 if (sm->mgmt_frame_prot && event == WPA_AUTH)
1455 #endif /* CONFIG_IEEE80211W */
1458 sm->PTK_valid = FALSE;
1459 os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1461 if (event != WPA_REAUTH_EAPOL)
1465 return wpa_sm_step(sm);
1469 static enum wpa_alg wpa_alg_enum(int alg)
1472 case WPA_CIPHER_CCMP:
1473 return WPA_ALG_CCMP;
1474 case WPA_CIPHER_TKIP:
1475 return WPA_ALG_TKIP;
1476 case WPA_CIPHER_WEP104:
1477 case WPA_CIPHER_WEP40:
1480 return WPA_ALG_NONE;
1485 SM_STATE(WPA_PTK, INITIALIZE)
1487 SM_ENTRY_MA(WPA_PTK, INITIALIZE, wpa_ptk);
1489 /* Init flag is not cleared here, so avoid busy
1490 * loop by claiming nothing changed. */
1491 sm->changed = FALSE;
1495 if (sm->GUpdateStationKeys)
1496 sm->group->GKeyDoneStations--;
1497 sm->GUpdateStationKeys = FALSE;
1498 if (sm->wpa == WPA_VERSION_WPA)
1499 sm->PInitAKeys = FALSE;
1500 if (1 /* Unicast cipher supported AND (ESS OR ((IBSS or WDS) and
1501 * Local AA > Remote AA)) */) {
1504 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 0);
1506 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 0);
1508 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
1509 wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
1510 WPA_EAPOL_authorized, 0);
1515 SM_STATE(WPA_PTK, DISCONNECT)
1517 SM_ENTRY_MA(WPA_PTK, DISCONNECT, wpa_ptk);
1518 sm->Disconnect = FALSE;
1519 wpa_sta_disconnect(sm->wpa_auth, sm->addr);
1523 SM_STATE(WPA_PTK, DISCONNECTED)
1525 SM_ENTRY_MA(WPA_PTK, DISCONNECTED, wpa_ptk);
1526 sm->DeauthenticationRequest = FALSE;
1530 SM_STATE(WPA_PTK, AUTHENTICATION)
1532 SM_ENTRY_MA(WPA_PTK, AUTHENTICATION, wpa_ptk);
1533 os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1534 sm->PTK_valid = FALSE;
1535 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portControl_Auto,
1537 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 1);
1538 sm->AuthenticationRequest = FALSE;
1542 static void wpa_group_first_station(struct wpa_authenticator *wpa_auth,
1543 struct wpa_group *group)
1546 * System has run bit further than at the time hostapd was started
1547 * potentially very early during boot up. This provides better chances
1548 * of collecting more randomness on embedded systems. Re-initialize the
1549 * GMK and Counter here to improve their strength if there was not
1550 * enough entropy available immediately after system startup.
1552 wpa_printf(MSG_DEBUG, "WPA: Re-initialize GMK/Counter on first "
1554 if (random_pool_ready() != 1) {
1555 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool "
1556 "to proceed - reject first 4-way handshake");
1557 group->reject_4way_hs_for_entropy = TRUE;
1559 wpa_group_init_gmk_and_counter(wpa_auth, group);
1560 wpa_gtk_update(wpa_auth, group);
1561 wpa_group_config_group_keys(wpa_auth, group);
1565 SM_STATE(WPA_PTK, AUTHENTICATION2)
1567 SM_ENTRY_MA(WPA_PTK, AUTHENTICATION2, wpa_ptk);
1569 if (!sm->group->first_sta_seen) {
1570 wpa_group_first_station(sm->wpa_auth, sm->group);
1571 sm->group->first_sta_seen = TRUE;
1574 os_memcpy(sm->ANonce, sm->group->Counter, WPA_NONCE_LEN);
1575 wpa_hexdump(MSG_DEBUG, "WPA: Assign ANonce", sm->ANonce,
1577 inc_byte_array(sm->group->Counter, WPA_NONCE_LEN);
1578 sm->ReAuthenticationRequest = FALSE;
1579 /* IEEE 802.11i does not clear TimeoutCtr here, but this is more
1580 * logical place than INITIALIZE since AUTHENTICATION2 can be
1581 * re-entered on ReAuthenticationRequest without going through
1587 SM_STATE(WPA_PTK, INITPMK)
1589 u8 msk[2 * PMK_LEN];
1590 size_t len = 2 * PMK_LEN;
1592 SM_ENTRY_MA(WPA_PTK, INITPMK, wpa_ptk);
1593 #ifdef CONFIG_IEEE80211R
1595 #endif /* CONFIG_IEEE80211R */
1597 wpa_printf(MSG_DEBUG, "WPA: PMK from PMKSA cache");
1598 os_memcpy(sm->PMK, sm->pmksa->pmk, PMK_LEN);
1599 } else if (wpa_auth_get_msk(sm->wpa_auth, sm->addr, msk, &len) == 0) {
1600 wpa_printf(MSG_DEBUG, "WPA: PMK from EAPOL state machine "
1601 "(len=%lu)", (unsigned long) len);
1602 os_memcpy(sm->PMK, msk, PMK_LEN);
1603 #ifdef CONFIG_IEEE80211R
1604 if (len >= 2 * PMK_LEN) {
1605 os_memcpy(sm->xxkey, msk + PMK_LEN, PMK_LEN);
1606 sm->xxkey_len = PMK_LEN;
1608 #endif /* CONFIG_IEEE80211R */
1610 wpa_printf(MSG_DEBUG, "WPA: Could not get PMK");
1613 sm->req_replay_counter_used = 0;
1614 /* IEEE 802.11i does not set keyRun to FALSE, but not doing this
1615 * will break reauthentication since EAPOL state machines may not be
1616 * get into AUTHENTICATING state that clears keyRun before WPA state
1617 * machine enters AUTHENTICATION2 state and goes immediately to INITPMK
1618 * state and takes PMK from the previously used AAA Key. This will
1619 * eventually fail in 4-Way Handshake because Supplicant uses PMK
1620 * derived from the new AAA Key. Setting keyRun = FALSE here seems to
1621 * be good workaround for this issue. */
1622 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyRun, 0);
1626 SM_STATE(WPA_PTK, INITPSK)
1629 SM_ENTRY_MA(WPA_PTK, INITPSK, wpa_ptk);
1630 psk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, NULL);
1632 os_memcpy(sm->PMK, psk, PMK_LEN);
1633 #ifdef CONFIG_IEEE80211R
1634 os_memcpy(sm->xxkey, psk, PMK_LEN);
1635 sm->xxkey_len = PMK_LEN;
1636 #endif /* CONFIG_IEEE80211R */
1638 sm->req_replay_counter_used = 0;
1642 SM_STATE(WPA_PTK, PTKSTART)
1644 u8 buf[2 + RSN_SELECTOR_LEN + PMKID_LEN], *pmkid = NULL;
1645 size_t pmkid_len = 0;
1647 SM_ENTRY_MA(WPA_PTK, PTKSTART, wpa_ptk);
1648 sm->PTKRequest = FALSE;
1649 sm->TimeoutEvt = FALSE;
1652 if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
1653 /* No point in sending the EAPOL-Key - we will disconnect
1654 * immediately following this. */
1658 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1659 "sending 1/4 msg of 4-Way Handshake");
1661 * TODO: Could add PMKID even with WPA2-PSK, but only if there is only
1662 * one possible PSK for this STA.
1664 if (sm->wpa == WPA_VERSION_WPA2 &&
1665 wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt)) {
1667 pmkid_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN;
1668 pmkid[0] = WLAN_EID_VENDOR_SPECIFIC;
1669 pmkid[1] = RSN_SELECTOR_LEN + PMKID_LEN;
1670 RSN_SELECTOR_PUT(&pmkid[2], RSN_KEY_DATA_PMKID);
1672 os_memcpy(&pmkid[2 + RSN_SELECTOR_LEN],
1673 sm->pmksa->pmkid, PMKID_LEN);
1676 * Calculate PMKID since no PMKSA cache entry was
1677 * available with pre-calculated PMKID.
1679 rsn_pmkid(sm->PMK, PMK_LEN, sm->wpa_auth->addr,
1680 sm->addr, &pmkid[2 + RSN_SELECTOR_LEN],
1681 wpa_key_mgmt_sha256(sm->wpa_key_mgmt));
1684 wpa_send_eapol(sm->wpa_auth, sm,
1685 WPA_KEY_INFO_ACK | WPA_KEY_INFO_KEY_TYPE, NULL,
1686 sm->ANonce, pmkid, pmkid_len, 0, 0);
1690 static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *pmk,
1691 struct wpa_ptk *ptk)
1693 size_t ptk_len = sm->pairwise == WPA_CIPHER_CCMP ? 48 : 64;
1694 #ifdef CONFIG_IEEE80211R
1695 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt))
1696 return wpa_auth_derive_ptk_ft(sm, pmk, ptk, ptk_len);
1697 #endif /* CONFIG_IEEE80211R */
1699 wpa_pmk_to_ptk(pmk, PMK_LEN, "Pairwise key expansion",
1700 sm->wpa_auth->addr, sm->addr, sm->ANonce, sm->SNonce,
1701 (u8 *) ptk, ptk_len,
1702 wpa_key_mgmt_sha256(sm->wpa_key_mgmt));
1708 SM_STATE(WPA_PTK, PTKCALCNEGOTIATING)
1712 const u8 *pmk = NULL;
1714 SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING, wpa_ptk);
1715 sm->EAPOLKeyReceived = FALSE;
1717 /* WPA with IEEE 802.1X: use the derived PMK from EAP
1718 * WPA-PSK: iterate through possible PSKs and select the one matching
1721 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
1722 pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, pmk);
1728 wpa_derive_ptk(sm, pmk, &PTK);
1730 if (wpa_verify_key_mic(&PTK, sm->last_rx_eapol_key,
1731 sm->last_rx_eapol_key_len) == 0) {
1736 if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt))
1741 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1742 "invalid MIC in msg 2/4 of 4-Way Handshake");
1746 #ifdef CONFIG_IEEE80211R
1747 if (sm->wpa == WPA_VERSION_WPA2 && wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
1749 * Verify that PMKR1Name from EAPOL-Key message 2/4 matches
1750 * with the value we derived.
1752 if (os_memcmp(sm->sup_pmk_r1_name, sm->pmk_r1_name,
1753 WPA_PMK_NAME_LEN) != 0) {
1754 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1755 "PMKR1Name mismatch in FT 4-way "
1757 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from "
1759 sm->sup_pmk_r1_name, WPA_PMK_NAME_LEN);
1760 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1761 sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1765 #endif /* CONFIG_IEEE80211R */
1767 sm->pending_1_of_4_timeout = 0;
1768 eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm);
1770 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
1771 /* PSK may have changed from the previous choice, so update
1772 * state machine data based on whatever PSK was selected here.
1774 os_memcpy(sm->PMK, pmk, PMK_LEN);
1777 sm->MICVerified = TRUE;
1779 os_memcpy(&sm->PTK, &PTK, sizeof(PTK));
1780 sm->PTK_valid = TRUE;
1784 SM_STATE(WPA_PTK, PTKCALCNEGOTIATING2)
1786 SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING2, wpa_ptk);
1791 #ifdef CONFIG_IEEE80211W
1793 static int ieee80211w_kde_len(struct wpa_state_machine *sm)
1795 if (sm->mgmt_frame_prot) {
1796 return 2 + RSN_SELECTOR_LEN + sizeof(struct wpa_igtk_kde);
1803 static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos)
1805 struct wpa_igtk_kde igtk;
1806 struct wpa_group *gsm = sm->group;
1808 if (!sm->mgmt_frame_prot)
1811 igtk.keyid[0] = gsm->GN_igtk;
1813 if (gsm->wpa_group_state != WPA_GROUP_SETKEYSDONE ||
1814 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, igtk.pn) < 0)
1815 os_memset(igtk.pn, 0, sizeof(igtk.pn));
1816 os_memcpy(igtk.igtk, gsm->IGTK[gsm->GN_igtk - 4], WPA_IGTK_LEN);
1817 pos = wpa_add_kde(pos, RSN_KEY_DATA_IGTK,
1818 (const u8 *) &igtk, sizeof(igtk), NULL, 0);
1823 #else /* CONFIG_IEEE80211W */
1825 static int ieee80211w_kde_len(struct wpa_state_machine *sm)
1831 static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos)
1836 #endif /* CONFIG_IEEE80211W */
1839 SM_STATE(WPA_PTK, PTKINITNEGOTIATING)
1841 u8 rsc[WPA_KEY_RSC_LEN], *_rsc, *gtk, *kde, *pos;
1842 size_t gtk_len, kde_len;
1843 struct wpa_group *gsm = sm->group;
1845 int wpa_ie_len, secure, keyidx, encr = 0;
1847 SM_ENTRY_MA(WPA_PTK, PTKINITNEGOTIATING, wpa_ptk);
1848 sm->TimeoutEvt = FALSE;
1851 if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
1852 /* No point in sending the EAPOL-Key - we will disconnect
1853 * immediately following this. */
1857 /* Send EAPOL(1, 1, 1, Pair, P, RSC, ANonce, MIC(PTK), RSNIE, [MDIE],
1858 GTK[GN], IGTK, [FTIE], [TIE * 2])
1860 os_memset(rsc, 0, WPA_KEY_RSC_LEN);
1861 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc);
1862 /* If FT is used, wpa_auth->wpa_ie includes both RSNIE and MDIE */
1863 wpa_ie = sm->wpa_auth->wpa_ie;
1864 wpa_ie_len = sm->wpa_auth->wpa_ie_len;
1865 if (sm->wpa == WPA_VERSION_WPA &&
1866 (sm->wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
1867 wpa_ie_len > wpa_ie[1] + 2 && wpa_ie[0] == WLAN_EID_RSN) {
1868 /* WPA-only STA, remove RSN IE */
1869 wpa_ie = wpa_ie + wpa_ie[1] + 2;
1870 wpa_ie_len = wpa_ie[1] + 2;
1872 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1873 "sending 3/4 msg of 4-Way Handshake");
1874 if (sm->wpa == WPA_VERSION_WPA2) {
1875 /* WPA2 send GTK in the 4-way handshake */
1877 gtk = gsm->GTK[gsm->GN - 1];
1878 gtk_len = gsm->GTK_len;
1883 /* WPA does not include GTK in msg 3/4 */
1889 if (sm->rx_eapol_key_secure) {
1891 * It looks like Windows 7 supplicant tries to use
1892 * Secure bit in msg 2/4 after having reported Michael
1893 * MIC failure and it then rejects the 4-way handshake
1894 * if msg 3/4 does not set Secure bit. Work around this
1895 * by setting the Secure bit here even in the case of
1896 * WPA if the supplicant used it first.
1898 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1899 "STA used Secure bit in WPA msg 2/4 - "
1900 "set Secure for 3/4 as workaround");
1905 kde_len = wpa_ie_len + ieee80211w_kde_len(sm);
1907 kde_len += 2 + RSN_SELECTOR_LEN + 2 + gtk_len;
1908 #ifdef CONFIG_IEEE80211R
1909 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
1910 kde_len += 2 + PMKID_LEN; /* PMKR1Name into RSN IE */
1911 kde_len += 300; /* FTIE + 2 * TIE */
1913 #endif /* CONFIG_IEEE80211R */
1914 kde = os_malloc(kde_len);
1919 os_memcpy(pos, wpa_ie, wpa_ie_len);
1921 #ifdef CONFIG_IEEE80211R
1922 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
1923 int res = wpa_insert_pmkid(kde, pos - kde, sm->pmk_r1_name);
1925 wpa_printf(MSG_ERROR, "FT: Failed to insert "
1926 "PMKR1Name into RSN IE in EAPOL-Key data");
1932 #endif /* CONFIG_IEEE80211R */
1935 hdr[0] = keyidx & 0x03;
1937 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2,
1940 pos = ieee80211w_kde_add(sm, pos);
1942 #ifdef CONFIG_IEEE80211R
1943 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
1945 struct wpa_auth_config *conf;
1947 conf = &sm->wpa_auth->conf;
1948 res = wpa_write_ftie(conf, conf->r0_key_holder,
1949 conf->r0_key_holder_len,
1950 NULL, NULL, pos, kde + kde_len - pos,
1953 wpa_printf(MSG_ERROR, "FT: Failed to insert FTIE "
1954 "into EAPOL-Key Key Data");
1960 /* TIE[ReassociationDeadline] (TU) */
1961 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
1963 *pos++ = WLAN_TIMEOUT_REASSOC_DEADLINE;
1964 WPA_PUT_LE32(pos, conf->reassociation_deadline);
1967 /* TIE[KeyLifetime] (seconds) */
1968 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
1970 *pos++ = WLAN_TIMEOUT_KEY_LIFETIME;
1971 WPA_PUT_LE32(pos, conf->r0_key_lifetime * 60);
1974 #endif /* CONFIG_IEEE80211R */
1976 wpa_send_eapol(sm->wpa_auth, sm,
1977 (secure ? WPA_KEY_INFO_SECURE : 0) | WPA_KEY_INFO_MIC |
1978 WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL |
1979 WPA_KEY_INFO_KEY_TYPE,
1980 _rsc, sm->ANonce, kde, pos - kde, keyidx, encr);
1985 SM_STATE(WPA_PTK, PTKINITDONE)
1987 SM_ENTRY_MA(WPA_PTK, PTKINITDONE, wpa_ptk);
1988 sm->EAPOLKeyReceived = FALSE;
1992 if (sm->pairwise == WPA_CIPHER_TKIP) {
1999 if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0,
2000 sm->PTK.tk1, klen)) {
2001 wpa_sta_disconnect(sm->wpa_auth, sm->addr);
2004 /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
2005 sm->pairwise_set = TRUE;
2007 if (sm->wpa_auth->conf.wpa_ptk_rekey) {
2008 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
2009 eloop_register_timeout(sm->wpa_auth->conf.
2010 wpa_ptk_rekey, 0, wpa_rekey_ptk,
2014 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
2015 wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
2016 WPA_EAPOL_authorized, 1);
2020 if (0 /* IBSS == TRUE */) {
2022 if (sm->keycount == 2) {
2023 wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
2024 WPA_EAPOL_portValid, 1);
2027 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid,
2030 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyAvailable, 0);
2031 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyDone, 1);
2032 if (sm->wpa == WPA_VERSION_WPA)
2033 sm->PInitAKeys = TRUE;
2036 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2037 "pairwise key handshake completed (%s)",
2038 sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN");
2040 #ifdef CONFIG_IEEE80211R
2041 wpa_ft_push_pmk_r1(sm->wpa_auth, sm->addr);
2042 #endif /* CONFIG_IEEE80211R */
2048 struct wpa_authenticator *wpa_auth = sm->wpa_auth;
2051 SM_ENTER(WPA_PTK, INITIALIZE);
2052 else if (sm->Disconnect
2053 /* || FIX: dot11RSNAConfigSALifetime timeout */) {
2054 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
2055 "WPA_PTK: sm->Disconnect");
2056 SM_ENTER(WPA_PTK, DISCONNECT);
2058 else if (sm->DeauthenticationRequest)
2059 SM_ENTER(WPA_PTK, DISCONNECTED);
2060 else if (sm->AuthenticationRequest)
2061 SM_ENTER(WPA_PTK, AUTHENTICATION);
2062 else if (sm->ReAuthenticationRequest)
2063 SM_ENTER(WPA_PTK, AUTHENTICATION2);
2064 else if (sm->PTKRequest)
2065 SM_ENTER(WPA_PTK, PTKSTART);
2066 else switch (sm->wpa_ptk_state) {
2067 case WPA_PTK_INITIALIZE:
2069 case WPA_PTK_DISCONNECT:
2070 SM_ENTER(WPA_PTK, DISCONNECTED);
2072 case WPA_PTK_DISCONNECTED:
2073 SM_ENTER(WPA_PTK, INITIALIZE);
2075 case WPA_PTK_AUTHENTICATION:
2076 SM_ENTER(WPA_PTK, AUTHENTICATION2);
2078 case WPA_PTK_AUTHENTICATION2:
2079 if (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) &&
2080 wpa_auth_get_eapol(sm->wpa_auth, sm->addr,
2081 WPA_EAPOL_keyRun) > 0)
2082 SM_ENTER(WPA_PTK, INITPMK);
2083 else if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)
2084 /* FIX: && 802.1X::keyRun */)
2085 SM_ENTER(WPA_PTK, INITPSK);
2087 case WPA_PTK_INITPMK:
2088 if (wpa_auth_get_eapol(sm->wpa_auth, sm->addr,
2089 WPA_EAPOL_keyAvailable) > 0)
2090 SM_ENTER(WPA_PTK, PTKSTART);
2092 wpa_auth->dot11RSNA4WayHandshakeFailures++;
2093 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2094 "INITPMK - keyAvailable = false");
2095 SM_ENTER(WPA_PTK, DISCONNECT);
2098 case WPA_PTK_INITPSK:
2099 if (wpa_auth_get_psk(sm->wpa_auth, sm->addr, NULL))
2100 SM_ENTER(WPA_PTK, PTKSTART);
2102 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2103 "no PSK configured for the STA");
2104 wpa_auth->dot11RSNA4WayHandshakeFailures++;
2105 SM_ENTER(WPA_PTK, DISCONNECT);
2108 case WPA_PTK_PTKSTART:
2109 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2110 sm->EAPOLKeyPairwise)
2111 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
2112 else if (sm->TimeoutCtr >
2113 (int) dot11RSNAConfigPairwiseUpdateCount) {
2114 wpa_auth->dot11RSNA4WayHandshakeFailures++;
2115 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2116 "PTKSTART: Retry limit %d reached",
2117 dot11RSNAConfigPairwiseUpdateCount);
2118 SM_ENTER(WPA_PTK, DISCONNECT);
2119 } else if (sm->TimeoutEvt)
2120 SM_ENTER(WPA_PTK, PTKSTART);
2122 case WPA_PTK_PTKCALCNEGOTIATING:
2123 if (sm->MICVerified)
2124 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING2);
2125 else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2126 sm->EAPOLKeyPairwise)
2127 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
2128 else if (sm->TimeoutEvt)
2129 SM_ENTER(WPA_PTK, PTKSTART);
2131 case WPA_PTK_PTKCALCNEGOTIATING2:
2132 SM_ENTER(WPA_PTK, PTKINITNEGOTIATING);
2134 case WPA_PTK_PTKINITNEGOTIATING:
2135 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2136 sm->EAPOLKeyPairwise && sm->MICVerified)
2137 SM_ENTER(WPA_PTK, PTKINITDONE);
2138 else if (sm->TimeoutCtr >
2139 (int) dot11RSNAConfigPairwiseUpdateCount) {
2140 wpa_auth->dot11RSNA4WayHandshakeFailures++;
2141 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2142 "PTKINITNEGOTIATING: Retry limit %d "
2144 dot11RSNAConfigPairwiseUpdateCount);
2145 SM_ENTER(WPA_PTK, DISCONNECT);
2146 } else if (sm->TimeoutEvt)
2147 SM_ENTER(WPA_PTK, PTKINITNEGOTIATING);
2149 case WPA_PTK_PTKINITDONE:
2155 SM_STATE(WPA_PTK_GROUP, IDLE)
2157 SM_ENTRY_MA(WPA_PTK_GROUP, IDLE, wpa_ptk_group);
2159 /* Init flag is not cleared here, so avoid busy
2160 * loop by claiming nothing changed. */
2161 sm->changed = FALSE;
2163 sm->GTimeoutCtr = 0;
2167 SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING)
2169 u8 rsc[WPA_KEY_RSC_LEN];
2170 struct wpa_group *gsm = sm->group;
2171 u8 *kde, *pos, hdr[2];
2174 SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group);
2177 if (sm->GTimeoutCtr > (int) dot11RSNAConfigGroupUpdateCount) {
2178 /* No point in sending the EAPOL-Key - we will disconnect
2179 * immediately following this. */
2183 if (sm->wpa == WPA_VERSION_WPA)
2184 sm->PInitAKeys = FALSE;
2185 sm->TimeoutEvt = FALSE;
2186 /* Send EAPOL(1, 1, 1, !Pair, G, RSC, GNonce, MIC(PTK), GTK[GN]) */
2187 os_memset(rsc, 0, WPA_KEY_RSC_LEN);
2188 if (gsm->wpa_group_state == WPA_GROUP_SETKEYSDONE)
2189 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc);
2190 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2191 "sending 1/2 msg of Group Key Handshake");
2193 if (sm->wpa == WPA_VERSION_WPA2) {
2194 kde_len = 2 + RSN_SELECTOR_LEN + 2 + gsm->GTK_len +
2195 ieee80211w_kde_len(sm);
2196 kde = os_malloc(kde_len);
2201 hdr[0] = gsm->GN & 0x03;
2203 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2,
2204 gsm->GTK[gsm->GN - 1], gsm->GTK_len);
2205 pos = ieee80211w_kde_add(sm, pos);
2207 kde = gsm->GTK[gsm->GN - 1];
2208 pos = kde + gsm->GTK_len;
2211 wpa_send_eapol(sm->wpa_auth, sm,
2212 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC |
2214 (!sm->Pair ? WPA_KEY_INFO_INSTALL : 0),
2215 rsc, gsm->GNonce, kde, pos - kde, gsm->GN, 1);
2216 if (sm->wpa == WPA_VERSION_WPA2)
2221 SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED)
2223 SM_ENTRY_MA(WPA_PTK_GROUP, REKEYESTABLISHED, wpa_ptk_group);
2224 sm->EAPOLKeyReceived = FALSE;
2225 if (sm->GUpdateStationKeys)
2226 sm->group->GKeyDoneStations--;
2227 sm->GUpdateStationKeys = FALSE;
2228 sm->GTimeoutCtr = 0;
2229 /* FIX: MLME.SetProtection.Request(TA, Tx_Rx) */
2230 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2231 "group key handshake completed (%s)",
2232 sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN");
2237 SM_STATE(WPA_PTK_GROUP, KEYERROR)
2239 SM_ENTRY_MA(WPA_PTK_GROUP, KEYERROR, wpa_ptk_group);
2240 if (sm->GUpdateStationKeys)
2241 sm->group->GKeyDoneStations--;
2242 sm->GUpdateStationKeys = FALSE;
2243 sm->Disconnect = TRUE;
2247 SM_STEP(WPA_PTK_GROUP)
2249 if (sm->Init || sm->PtkGroupInit) {
2250 SM_ENTER(WPA_PTK_GROUP, IDLE);
2251 sm->PtkGroupInit = FALSE;
2252 } else switch (sm->wpa_ptk_group_state) {
2253 case WPA_PTK_GROUP_IDLE:
2254 if (sm->GUpdateStationKeys ||
2255 (sm->wpa == WPA_VERSION_WPA && sm->PInitAKeys))
2256 SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
2258 case WPA_PTK_GROUP_REKEYNEGOTIATING:
2259 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2260 !sm->EAPOLKeyPairwise && sm->MICVerified)
2261 SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED);
2262 else if (sm->GTimeoutCtr >
2263 (int) dot11RSNAConfigGroupUpdateCount)
2264 SM_ENTER(WPA_PTK_GROUP, KEYERROR);
2265 else if (sm->TimeoutEvt)
2266 SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
2268 case WPA_PTK_GROUP_KEYERROR:
2269 SM_ENTER(WPA_PTK_GROUP, IDLE);
2271 case WPA_PTK_GROUP_REKEYESTABLISHED:
2272 SM_ENTER(WPA_PTK_GROUP, IDLE);
2278 static int wpa_gtk_update(struct wpa_authenticator *wpa_auth,
2279 struct wpa_group *group)
2283 os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN);
2284 inc_byte_array(group->Counter, WPA_NONCE_LEN);
2285 if (wpa_gmk_to_gtk(group->GMK, "Group key expansion",
2286 wpa_auth->addr, group->GNonce,
2287 group->GTK[group->GN - 1], group->GTK_len) < 0)
2289 wpa_hexdump_key(MSG_DEBUG, "GTK",
2290 group->GTK[group->GN - 1], group->GTK_len);
2292 #ifdef CONFIG_IEEE80211W
2293 if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) {
2294 os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN);
2295 inc_byte_array(group->Counter, WPA_NONCE_LEN);
2296 if (wpa_gmk_to_gtk(group->GMK, "IGTK key expansion",
2297 wpa_auth->addr, group->GNonce,
2298 group->IGTK[group->GN_igtk - 4],
2301 wpa_hexdump_key(MSG_DEBUG, "IGTK",
2302 group->IGTK[group->GN_igtk - 4], WPA_IGTK_LEN);
2304 #endif /* CONFIG_IEEE80211W */
2310 static void wpa_group_gtk_init(struct wpa_authenticator *wpa_auth,
2311 struct wpa_group *group)
2313 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2314 "GTK_INIT (VLAN-ID %d)", group->vlan_id);
2315 group->changed = FALSE; /* GInit is not cleared here; avoid loop */
2316 group->wpa_group_state = WPA_GROUP_GTK_INIT;
2319 os_memset(group->GTK, 0, sizeof(group->GTK));
2322 #ifdef CONFIG_IEEE80211W
2325 #endif /* CONFIG_IEEE80211W */
2326 /* GTK[GN] = CalcGTK() */
2327 wpa_gtk_update(wpa_auth, group);
2331 static int wpa_group_update_sta(struct wpa_state_machine *sm, void *ctx)
2333 if (sm->wpa_ptk_state != WPA_PTK_PTKINITDONE) {
2334 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2335 "Not in PTKINITDONE; skip Group Key update");
2336 sm->GUpdateStationKeys = FALSE;
2339 if (sm->GUpdateStationKeys) {
2341 * This should not really happen, so add a debug log entry.
2342 * Since we clear the GKeyDoneStations before the loop, the
2343 * station needs to be counted here anyway.
2345 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2346 "GUpdateStationKeys was already set when "
2347 "marking station for GTK rekeying");
2350 sm->group->GKeyDoneStations++;
2351 sm->GUpdateStationKeys = TRUE;
2358 static void wpa_group_setkeys(struct wpa_authenticator *wpa_auth,
2359 struct wpa_group *group)
2363 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2364 "SETKEYS (VLAN-ID %d)", group->vlan_id);
2365 group->changed = TRUE;
2366 group->wpa_group_state = WPA_GROUP_SETKEYS;
2367 group->GTKReKey = FALSE;
2369 group->GM = group->GN;
2371 #ifdef CONFIG_IEEE80211W
2372 tmp = group->GM_igtk;
2373 group->GM_igtk = group->GN_igtk;
2374 group->GN_igtk = tmp;
2375 #endif /* CONFIG_IEEE80211W */
2376 /* "GKeyDoneStations = GNoStations" is done in more robust way by
2377 * counting the STAs that are marked with GUpdateStationKeys instead of
2378 * including all STAs that could be in not-yet-completed state. */
2379 wpa_gtk_update(wpa_auth, group);
2381 if (group->GKeyDoneStations) {
2382 wpa_printf(MSG_DEBUG, "wpa_group_setkeys: Unexpected "
2383 "GKeyDoneStations=%d when starting new GTK rekey",
2384 group->GKeyDoneStations);
2385 group->GKeyDoneStations = 0;
2387 wpa_auth_for_each_sta(wpa_auth, wpa_group_update_sta, NULL);
2388 wpa_printf(MSG_DEBUG, "wpa_group_setkeys: GKeyDoneStations=%d",
2389 group->GKeyDoneStations);
2393 static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth,
2394 struct wpa_group *group)
2398 if (wpa_auth_set_key(wpa_auth, group->vlan_id,
2399 wpa_alg_enum(wpa_auth->conf.wpa_group),
2400 broadcast_ether_addr, group->GN,
2401 group->GTK[group->GN - 1], group->GTK_len) < 0)
2404 #ifdef CONFIG_IEEE80211W
2405 if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION &&
2406 wpa_auth_set_key(wpa_auth, group->vlan_id, WPA_ALG_IGTK,
2407 broadcast_ether_addr, group->GN_igtk,
2408 group->IGTK[group->GN_igtk - 4],
2411 #endif /* CONFIG_IEEE80211W */
2417 static int wpa_group_setkeysdone(struct wpa_authenticator *wpa_auth,
2418 struct wpa_group *group)
2420 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2421 "SETKEYSDONE (VLAN-ID %d)", group->vlan_id);
2422 group->changed = TRUE;
2423 group->wpa_group_state = WPA_GROUP_SETKEYSDONE;
2425 if (wpa_group_config_group_keys(wpa_auth, group) < 0)
2432 static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth,
2433 struct wpa_group *group)
2436 wpa_group_gtk_init(wpa_auth, group);
2437 } else if (group->wpa_group_state == WPA_GROUP_GTK_INIT &&
2438 group->GTKAuthenticator) {
2439 wpa_group_setkeysdone(wpa_auth, group);
2440 } else if (group->wpa_group_state == WPA_GROUP_SETKEYSDONE &&
2442 wpa_group_setkeys(wpa_auth, group);
2443 } else if (group->wpa_group_state == WPA_GROUP_SETKEYS) {
2444 if (group->GKeyDoneStations == 0)
2445 wpa_group_setkeysdone(wpa_auth, group);
2446 else if (group->GTKReKey)
2447 wpa_group_setkeys(wpa_auth, group);
2452 static int wpa_sm_step(struct wpa_state_machine *sm)
2457 if (sm->in_step_loop) {
2458 /* This should not happen, but if it does, make sure we do not
2459 * end up freeing the state machine too early by exiting the
2460 * recursive call. */
2461 wpa_printf(MSG_ERROR, "WPA: wpa_sm_step() called recursively");
2465 sm->in_step_loop = 1;
2467 if (sm->pending_deinit)
2470 sm->changed = FALSE;
2471 sm->wpa_auth->group->changed = FALSE;
2473 SM_STEP_RUN(WPA_PTK);
2474 if (sm->pending_deinit)
2476 SM_STEP_RUN(WPA_PTK_GROUP);
2477 if (sm->pending_deinit)
2479 wpa_group_sm_step(sm->wpa_auth, sm->group);
2480 } while (sm->changed || sm->wpa_auth->group->changed);
2481 sm->in_step_loop = 0;
2483 if (sm->pending_deinit) {
2484 wpa_printf(MSG_DEBUG, "WPA: Completing pending STA state "
2485 "machine deinit for " MACSTR, MAC2STR(sm->addr));
2486 wpa_free_sta_sm(sm);
2493 static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx)
2495 struct wpa_state_machine *sm = eloop_ctx;
2500 void wpa_auth_sm_notify(struct wpa_state_machine *sm)
2504 eloop_register_timeout(0, 0, wpa_sm_call_step, sm, NULL);
2508 void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth)
2511 struct wpa_group *group;
2513 if (wpa_auth == NULL)
2516 group = wpa_auth->group;
2518 for (i = 0; i < 2; i++) {
2520 group->GM = group->GN;
2522 #ifdef CONFIG_IEEE80211W
2523 tmp = group->GM_igtk;
2524 group->GM_igtk = group->GN_igtk;
2525 group->GN_igtk = tmp;
2526 #endif /* CONFIG_IEEE80211W */
2527 wpa_gtk_update(wpa_auth, group);
2528 wpa_group_config_group_keys(wpa_auth, group);
2533 static const char * wpa_bool_txt(int bool)
2535 return bool ? "TRUE" : "FALSE";
2539 static int wpa_cipher_bits(int cipher)
2542 case WPA_CIPHER_CCMP:
2544 case WPA_CIPHER_TKIP:
2546 case WPA_CIPHER_WEP104:
2548 case WPA_CIPHER_WEP40:
2556 #define RSN_SUITE "%02x-%02x-%02x-%d"
2557 #define RSN_SUITE_ARG(s) \
2558 ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2560 int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen)
2563 char pmkid_txt[PMKID_LEN * 2 + 1];
2564 #ifdef CONFIG_RSN_PREAUTH
2565 const int preauth = 1;
2566 #else /* CONFIG_RSN_PREAUTH */
2567 const int preauth = 0;
2568 #endif /* CONFIG_RSN_PREAUTH */
2570 if (wpa_auth == NULL)
2573 ret = os_snprintf(buf + len, buflen - len,
2574 "dot11RSNAOptionImplemented=TRUE\n"
2575 "dot11RSNAPreauthenticationImplemented=%s\n"
2576 "dot11RSNAEnabled=%s\n"
2577 "dot11RSNAPreauthenticationEnabled=%s\n",
2578 wpa_bool_txt(preauth),
2579 wpa_bool_txt(wpa_auth->conf.wpa & WPA_PROTO_RSN),
2580 wpa_bool_txt(wpa_auth->conf.rsn_preauth));
2581 if (ret < 0 || (size_t) ret >= buflen - len)
2585 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2586 wpa_auth->dot11RSNAPMKIDUsed, PMKID_LEN);
2589 buf + len, buflen - len,
2590 "dot11RSNAConfigVersion=%u\n"
2591 "dot11RSNAConfigPairwiseKeysSupported=9999\n"
2592 /* FIX: dot11RSNAConfigGroupCipher */
2593 /* FIX: dot11RSNAConfigGroupRekeyMethod */
2594 /* FIX: dot11RSNAConfigGroupRekeyTime */
2595 /* FIX: dot11RSNAConfigGroupRekeyPackets */
2596 "dot11RSNAConfigGroupRekeyStrict=%u\n"
2597 "dot11RSNAConfigGroupUpdateCount=%u\n"
2598 "dot11RSNAConfigPairwiseUpdateCount=%u\n"
2599 "dot11RSNAConfigGroupCipherSize=%u\n"
2600 "dot11RSNAConfigPMKLifetime=%u\n"
2601 "dot11RSNAConfigPMKReauthThreshold=%u\n"
2602 "dot11RSNAConfigNumberOfPTKSAReplayCounters=0\n"
2603 "dot11RSNAConfigSATimeout=%u\n"
2604 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2605 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2606 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2607 "dot11RSNAPMKIDUsed=%s\n"
2608 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2609 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2610 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2611 "dot11RSNATKIPCounterMeasuresInvoked=%u\n"
2612 "dot11RSNA4WayHandshakeFailures=%u\n"
2613 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n",
2615 !!wpa_auth->conf.wpa_strict_rekey,
2616 dot11RSNAConfigGroupUpdateCount,
2617 dot11RSNAConfigPairwiseUpdateCount,
2618 wpa_cipher_bits(wpa_auth->conf.wpa_group),
2619 dot11RSNAConfigPMKLifetime,
2620 dot11RSNAConfigPMKReauthThreshold,
2621 dot11RSNAConfigSATimeout,
2622 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteSelected),
2623 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherSelected),
2624 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherSelected),
2626 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteRequested),
2627 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherRequested),
2628 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherRequested),
2629 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked,
2630 wpa_auth->dot11RSNA4WayHandshakeFailures);
2631 if (ret < 0 || (size_t) ret >= buflen - len)
2635 /* TODO: dot11RSNAConfigPairwiseCiphersTable */
2636 /* TODO: dot11RSNAConfigAuthenticationSuitesTable */
2639 ret = os_snprintf(buf + len, buflen - len, "hostapdWPAGroupState=%d\n",
2640 wpa_auth->group->wpa_group_state);
2641 if (ret < 0 || (size_t) ret >= buflen - len)
2649 int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen)
2657 /* TODO: FF-FF-FF-FF-FF-FF entry for broadcast/multicast stats */
2659 /* dot11RSNAStatsEntry */
2661 if (sm->wpa == WPA_VERSION_WPA) {
2662 if (sm->pairwise == WPA_CIPHER_CCMP)
2663 pairwise = WPA_CIPHER_SUITE_CCMP;
2664 else if (sm->pairwise == WPA_CIPHER_TKIP)
2665 pairwise = WPA_CIPHER_SUITE_TKIP;
2666 else if (sm->pairwise == WPA_CIPHER_WEP104)
2667 pairwise = WPA_CIPHER_SUITE_WEP104;
2668 else if (sm->pairwise == WPA_CIPHER_WEP40)
2669 pairwise = WPA_CIPHER_SUITE_WEP40;
2670 else if (sm->pairwise == WPA_CIPHER_NONE)
2671 pairwise = WPA_CIPHER_SUITE_NONE;
2672 } else if (sm->wpa == WPA_VERSION_WPA2) {
2673 if (sm->pairwise == WPA_CIPHER_CCMP)
2674 pairwise = RSN_CIPHER_SUITE_CCMP;
2675 else if (sm->pairwise == WPA_CIPHER_TKIP)
2676 pairwise = RSN_CIPHER_SUITE_TKIP;
2677 else if (sm->pairwise == WPA_CIPHER_WEP104)
2678 pairwise = RSN_CIPHER_SUITE_WEP104;
2679 else if (sm->pairwise == WPA_CIPHER_WEP40)
2680 pairwise = RSN_CIPHER_SUITE_WEP40;
2681 else if (sm->pairwise == WPA_CIPHER_NONE)
2682 pairwise = RSN_CIPHER_SUITE_NONE;
2687 buf + len, buflen - len,
2688 /* TODO: dot11RSNAStatsIndex */
2689 "dot11RSNAStatsSTAAddress=" MACSTR "\n"
2690 "dot11RSNAStatsVersion=1\n"
2691 "dot11RSNAStatsSelectedPairwiseCipher=" RSN_SUITE "\n"
2692 /* TODO: dot11RSNAStatsTKIPICVErrors */
2693 "dot11RSNAStatsTKIPLocalMICFailures=%u\n"
2694 "dot11RSNAStatsTKIPRemoteMICFailures=%u\n"
2695 /* TODO: dot11RSNAStatsCCMPReplays */
2696 /* TODO: dot11RSNAStatsCCMPDecryptErrors */
2697 /* TODO: dot11RSNAStatsTKIPReplays */,
2699 RSN_SUITE_ARG(pairwise),
2700 sm->dot11RSNAStatsTKIPLocalMICFailures,
2701 sm->dot11RSNAStatsTKIPRemoteMICFailures);
2702 if (ret < 0 || (size_t) ret >= buflen - len)
2707 ret = os_snprintf(buf + len, buflen - len,
2708 "hostapdWPAPTKState=%d\n"
2709 "hostapdWPAPTKGroupState=%d\n",
2711 sm->wpa_ptk_group_state);
2712 if (ret < 0 || (size_t) ret >= buflen - len)
2720 void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth)
2723 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked++;
2727 int wpa_auth_pairwise_set(struct wpa_state_machine *sm)
2729 return sm && sm->pairwise_set;
2733 int wpa_auth_get_pairwise(struct wpa_state_machine *sm)
2735 return sm->pairwise;
2739 int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm)
2743 return sm->wpa_key_mgmt;
2747 int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
2755 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
2756 struct rsn_pmksa_cache_entry *entry)
2758 if (sm == NULL || sm->pmksa != entry)
2765 struct rsn_pmksa_cache_entry *
2766 wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm)
2768 return sm ? sm->pmksa : NULL;
2772 void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm)
2775 sm->dot11RSNAStatsTKIPLocalMICFailures++;
2779 const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth, size_t *len)
2781 if (wpa_auth == NULL)
2783 *len = wpa_auth->wpa_ie_len;
2784 return wpa_auth->wpa_ie;
2788 int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk,
2789 int session_timeout, struct eapol_state_machine *eapol)
2791 if (sm == NULL || sm->wpa != WPA_VERSION_WPA2 ||
2792 sm->wpa_auth->conf.disable_pmksa_caching)
2795 if (pmksa_cache_auth_add(sm->wpa_auth->pmksa, pmk, PMK_LEN,
2796 sm->wpa_auth->addr, sm->addr, session_timeout,
2797 eapol, sm->wpa_key_mgmt))
2804 int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth,
2805 const u8 *pmk, size_t len, const u8 *sta_addr,
2806 int session_timeout,
2807 struct eapol_state_machine *eapol)
2809 if (wpa_auth == NULL)
2812 if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, len, wpa_auth->addr,
2813 sta_addr, session_timeout, eapol,
2814 WPA_KEY_MGMT_IEEE8021X))
2821 static struct wpa_group *
2822 wpa_auth_add_group(struct wpa_authenticator *wpa_auth, int vlan_id)
2824 struct wpa_group *group;
2826 if (wpa_auth == NULL || wpa_auth->group == NULL)
2829 wpa_printf(MSG_DEBUG, "WPA: Add group state machine for VLAN-ID %d",
2831 group = wpa_group_init(wpa_auth, vlan_id, 0);
2835 group->next = wpa_auth->group->next;
2836 wpa_auth->group->next = group;
2842 int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id)
2844 struct wpa_group *group;
2846 if (sm == NULL || sm->wpa_auth == NULL)
2849 group = sm->wpa_auth->group;
2851 if (group->vlan_id == vlan_id)
2853 group = group->next;
2856 if (group == NULL) {
2857 group = wpa_auth_add_group(sm->wpa_auth, vlan_id);
2862 if (sm->group == group)
2865 wpa_printf(MSG_DEBUG, "WPA: Moving STA " MACSTR " to use group state "
2866 "machine for VLAN ID %d", MAC2STR(sm->addr), vlan_id);
2873 void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth,
2874 struct wpa_state_machine *sm, int ack)
2876 if (wpa_auth == NULL || sm == NULL)
2878 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key TX status for STA " MACSTR
2879 " ack=%d", MAC2STR(sm->addr), ack);
2880 if (sm->pending_1_of_4_timeout && ack) {
2882 * Some deployed supplicant implementations update their SNonce
2883 * for each EAPOL-Key 2/4 message even within the same 4-way
2884 * handshake and then fail to use the first SNonce when
2885 * deriving the PTK. This results in unsuccessful 4-way
2886 * handshake whenever the relatively short initial timeout is
2887 * reached and EAPOL-Key 1/4 is retransmitted. Try to work
2888 * around this by increasing the timeout now that we know that
2889 * the station has received the frame.
2891 int timeout_ms = eapol_key_timeout_subseq;
2892 wpa_printf(MSG_DEBUG, "WPA: Increase initial EAPOL-Key 1/4 "
2893 "timeout by %u ms because of acknowledged frame",
2895 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm);
2896 eloop_register_timeout(timeout_ms / 1000,
2897 (timeout_ms % 1000) * 1000,
2898 wpa_send_eapol_timeout, wpa_auth, sm);