wpa.c

   1 /*
   2  * WPA Supplicant - WPA state machine and EAPOL-Key processing
   3  * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "md5.h"
  19 #include "sha1.h"
  20 #include "rc4.h"
  21 #include "aes_wrap.h"
  22 #include "wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "l2_packet.h"
  26 #include "eapol_sm.h"
  27 #include "preauth.h"
  28 #include "pmksa_cache.h"
  29 #include "wpa_i.h"
  30
  31
  32 static const int WPA_SELECTOR_LEN = 4;
  33 static const u8 WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
  34 static const u16 WPA_VERSION = 1;
  35 static const u8 WPA_AUTH_KEY_MGMT_NONE[] = { 0x00, 0x50, 0xf2, 0 };
  36 static const u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x50, 0xf2, 1 };
  37 static const u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x50, 0xf2, 2 };
  38 static const u8 WPA_CIPHER_SUITE_NONE[] = { 0x00, 0x50, 0xf2, 0 };
  39 static const u8 WPA_CIPHER_SUITE_WEP40[] = { 0x00, 0x50, 0xf2, 1 };
  40 static const u8 WPA_CIPHER_SUITE_TKIP[] = { 0x00, 0x50, 0xf2, 2 };
  41 #if 0
  42 static const u8 WPA_CIPHER_SUITE_WRAP[] = { 0x00, 0x50, 0xf2, 3 };
  43 #endif
  44 static const u8 WPA_CIPHER_SUITE_CCMP[] = { 0x00, 0x50, 0xf2, 4 };
  45 static const u8 WPA_CIPHER_SUITE_WEP104[] = { 0x00, 0x50, 0xf2, 5 };
  46
  47 /* WPA IE version 1
  48  * 00-50-f2:1 (OUI:OUI type)
  49  * 0x01 0x00 (version; little endian)
  50  * (all following fields are optional:)
  51  * Group Suite Selector (4 octets) (default: TKIP)
  52  * Pairwise Suite Count (2 octets, little endian) (default: 1)
  53  * Pairwise Suite List (4 * n octets) (default: TKIP)
  54  * Authenticated Key Management Suite Count (2 octets, little endian)
  55  *    (default: 1)
  56  * Authenticated Key Management Suite List (4 * n octets)
  57  *    (default: unspec 802.1X)
  58  * WPA Capabilities (2 octets, little endian) (default: 0)
  59  */
  60
  61 #ifdef _MSC_VER
  62 #pragma pack(push, 1)
  63 #endif /* _MSC_VER */
  64
  65 struct wpa_ie_hdr {
  66         u8 elem_id;
  67         u8 len;
  68         u8 oui[4]; /* 24-bit OUI followed by 8-bit OUI type */
  69         u8 version[2];
  70 } STRUCT_PACKED;
  71
  72 #ifdef _MSC_VER
  73 #pragma pack(pop)
  74 #endif /* _MSC_VER */
  75
  76
  77 static const int RSN_SELECTOR_LEN = 4;
  78 static const u16 RSN_VERSION = 1;
  79 static const u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x0f, 0xac, 1 };
  80 static const u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x0f, 0xac, 2 };
  81 static const u8 RSN_CIPHER_SUITE_NONE[] = { 0x00, 0x0f, 0xac, 0 };
  82 static const u8 RSN_CIPHER_SUITE_WEP40[] = { 0x00, 0x0f, 0xac, 1 };
  83 static const u8 RSN_CIPHER_SUITE_TKIP[] = { 0x00, 0x0f, 0xac, 2 };
  84 #if 0
  85 static const u8 RSN_CIPHER_SUITE_WRAP[] = { 0x00, 0x0f, 0xac, 3 };
  86 #endif
  87 static const u8 RSN_CIPHER_SUITE_CCMP[] = { 0x00, 0x0f, 0xac, 4 };
  88 static const u8 RSN_CIPHER_SUITE_WEP104[] = { 0x00, 0x0f, 0xac, 5 };
  89 #ifdef CONFIG_IEEE80211W
  90 static const u8 RSN_CIPHER_SUITE_AES_128_CMAC[] = { 0x00, 0x0f, 0xac, 6 };
  91 #endif /* CONFIG_IEEE80211W */
  92
  93 /* EAPOL-Key Key Data Encapsulation
  94  * GroupKey and PeerKey require encryption, otherwise, encryption is optional.
  95  */
  96 static const u8 RSN_KEY_DATA_GROUPKEY[] = { 0x00, 0x0f, 0xac, 1 };
  97 #if 0
  98 static const u8 RSN_KEY_DATA_STAKEY[] = { 0x00, 0x0f, 0xac, 2 };
  99 #endif
 100 static const u8 RSN_KEY_DATA_MAC_ADDR[] = { 0x00, 0x0f, 0xac, 3 };
 101 static const u8 RSN_KEY_DATA_PMKID[] = { 0x00, 0x0f, 0xac, 4 };
 102 #ifdef CONFIG_PEERKEY
 103 static const u8 RSN_KEY_DATA_SMK[] = { 0x00, 0x0f, 0xac, 5 };
 104 static const u8 RSN_KEY_DATA_NONCE[] = { 0x00, 0x0f, 0xac, 6 };
 105 static const u8 RSN_KEY_DATA_LIFETIME[] = { 0x00, 0x0f, 0xac, 7 };
 106 static const u8 RSN_KEY_DATA_ERROR[] = { 0x00, 0x0f, 0xac, 8 };
 107 #endif /* CONFIG_PEERKEY */
 108 #ifdef CONFIG_IEEE80211W
 109 /* FIX: IEEE 802.11w/D1.0 is using subtypes 5 and 6 for these, but they were
 110  * already taken by 802.11ma (PeerKey). Need to update the values here once
 111  * IEEE 802.11w fixes these. */
 112 static const u8 RSN_KEY_DATA_DHV[] = { 0x00, 0x0f, 0xac, 9 };
 113 static const u8 RSN_KEY_DATA_IGTK[] = { 0x00, 0x0f, 0xac, 10 };
 114 #endif /* CONFIG_IEEE80211W */
 115
 116 #ifdef CONFIG_PEERKEY
 117 enum {
 118         STK_MUI_4WAY_STA_AP = 1,
 119         STK_MUI_4WAY_STAT_STA = 2,
 120         STK_MUI_GTK = 3,
 121         STK_MUI_SMK = 4
 122 };
 123
 124 enum {
 125         STK_ERR_STA_NR = 1,
 126         STK_ERR_STA_NRSN = 2,
 127         STK_ERR_CPHR_NS = 3,
 128         STK_ERR_NO_STSL = 4
 129 };
 130 #endif /* CONFIG_PEERKEY */
 131
 132 /* 1/4: PMKID
 133  * 2/4: RSN IE
 134  * 3/4: one or two RSN IEs + GTK IE (encrypted)
 135  * 4/4: empty
 136  * 1/2: GTK IE (encrypted)
 137  * 2/2: empty
 138  */
 139
 140 /* RSN IE version 1
 141  * 0x01 0x00 (version; little endian)
 142  * (all following fields are optional:)
 143  * Group Suite Selector (4 octets) (default: CCMP)
 144  * Pairwise Suite Count (2 octets, little endian) (default: 1)
 145  * Pairwise Suite List (4 * n octets) (default: CCMP)
 146  * Authenticated Key Management Suite Count (2 octets, little endian)
 147  *    (default: 1)
 148  * Authenticated Key Management Suite List (4 * n octets)
 149  *    (default: unspec 802.1X)
 150  * RSN Capabilities (2 octets, little endian) (default: 0)
 151  * PMKID Count (2 octets) (default: 0)
 152  * PMKID List (16 * n octets)
 153  * Management Group Cipher Suite (4 octets) (default: AES-128-CMAC)
 154  */
 155
 156 #ifdef _MSC_VER
 157 #pragma pack(push, 1)
 158 #endif /* _MSC_VER */
 159
 160 struct rsn_ie_hdr {
 161         u8 elem_id; /* WLAN_EID_RSN */
 162         u8 len;
 163         u8 version[2];
 164 } STRUCT_PACKED;
 165
 166
 167 struct wpa_eapol_key {
 168         u8 type;
 169         /* Note: key_info, key_length, and key_data_length are unaligned */
 170         u8 key_info[2];
 171         u8 key_length[2];
 172         u8 replay_counter[WPA_REPLAY_COUNTER_LEN];
 173         u8 key_nonce[WPA_NONCE_LEN];
 174         u8 key_iv[16];
 175         u8 key_rsc[8];
 176         u8 key_id[8]; /* Reserved in IEEE 802.11i/RSN */
 177         u8 key_mic[16];
 178         u8 key_data_length[2];
 179         /* followed by key_data_length bytes of key_data */
 180 } STRUCT_PACKED;
 181
 182
 183 struct rsn_error_kde {
 184         u16 mui;
 185         u16 error_type;
 186 } STRUCT_PACKED;
 187
 188 #ifdef CONFIG_IEEE80211W
 189 struct wpa_dhv_kde {
 190         u8 dhv[WPA_DHV_LEN];
 191 } STRUCT_PACKED;
 192
 193 struct wpa_igtk_kde {
 194         u8 keyid[2];
 195         u8 pn[6];
 196         u8 igtk[WPA_IGTK_LEN];
 197 } STRUCT_PACKED;
 198 #endif /* CONFIG_IEEE80211W */
 199
 200 #ifdef _MSC_VER
 201 #pragma pack(pop)
 202 #endif /* _MSC_VER */
 203
 204 #define WPA_KEY_INFO_TYPE_MASK ((u16) (BIT(0) | BIT(1) | BIT(2)))
 205 #define WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 BIT(0)
 206 #define WPA_KEY_INFO_TYPE_HMAC_SHA1_AES BIT(1)
 207 #define WPA_KEY_INFO_KEY_TYPE BIT(3) /* 1 = Pairwise, 0 = Group key */
 208 /* bit4..5 is used in WPA, but is reserved in IEEE 802.11i/RSN */
 209 #define WPA_KEY_INFO_KEY_INDEX_MASK (BIT(4) | BIT(5))
 210 #define WPA_KEY_INFO_KEY_INDEX_SHIFT 4
 211 #define WPA_KEY_INFO_INSTALL BIT(6) /* pairwise */
 212 #define WPA_KEY_INFO_TXRX BIT(6) /* group */
 213 #define WPA_KEY_INFO_ACK BIT(7)
 214 #define WPA_KEY_INFO_MIC BIT(8)
 215 #define WPA_KEY_INFO_SECURE BIT(9)
 216 #define WPA_KEY_INFO_ERROR BIT(10)
 217 #define WPA_KEY_INFO_REQUEST BIT(11)
 218 #define WPA_KEY_INFO_ENCR_KEY_DATA BIT(12) /* IEEE 802.11i/RSN only */
 219 #define WPA_KEY_INFO_SMK_MESSAGE BIT(13)
 220
 221
 222 #ifdef CONFIG_PEERKEY
 223 static void wpa_supplicant_peerkey_free(struct wpa_sm *sm,
 224                                         struct wpa_peerkey *peerkey);
 225 #endif /* CONFIG_PEERKEY */
 226
 227
 228 /**
 229  * wpa_cipher_txt - Convert cipher suite to a text string
 230  * @cipher: Cipher suite (WPA_CIPHER_* enum)
 231  * Returns: Pointer to a text string of the cipher suite name
 232  */
 233 static const char * wpa_cipher_txt(int cipher)
 234 {
 235         switch (cipher) {
 236         case WPA_CIPHER_NONE:
 237                 return "NONE";
 238         case WPA_CIPHER_WEP40:
 239                 return "WEP-40";
 240         case WPA_CIPHER_WEP104:
 241                 return "WEP-104";
 242         case WPA_CIPHER_TKIP:
 243                 return "TKIP";
 244         case WPA_CIPHER_CCMP:
 245                 return "CCMP";
 246         default:
 247                 return "UNKNOWN";
 248         }
 249 }
 250
 251
 252 /**
 253  * wpa_key_mgmt_txt - Convert key management suite to a text string
 254  * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
 255  * @proto: WPA/WPA2 version (WPA_PROTO_*)
 256  * Returns: Pointer to a text string of the key management suite name
 257  */
 258 static const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
 259 {
 260         switch (key_mgmt) {
 261         case WPA_KEY_MGMT_IEEE8021X:
 262                 return proto == WPA_PROTO_RSN ?
 263                         "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
 264         case WPA_KEY_MGMT_PSK:
 265                 return proto == WPA_PROTO_RSN ?
 266                         "WPA2-PSK" : "WPA-PSK";
 267         case WPA_KEY_MGMT_NONE:
 268                 return "NONE";
 269         case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
 270                 return "IEEE 802.1X (no WPA)";
 271         default:
 272                 return "UNKNOWN";
 273         }
 274 }
 275
 276
 277 static int wpa_selector_to_bitfield(const u8 *s)
 278 {
 279         if (os_memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == 0)
 280                 return WPA_CIPHER_NONE;
 281         if (os_memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == 0)
 282                 return WPA_CIPHER_WEP40;
 283         if (os_memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == 0)
 284                 return WPA_CIPHER_TKIP;
 285         if (os_memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == 0)
 286                 return WPA_CIPHER_CCMP;
 287         if (os_memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == 0)
 288                 return WPA_CIPHER_WEP104;
 289         return 0;
 290 }
 291
 292
 293 static int wpa_key_mgmt_to_bitfield(const u8 *s)
 294 {
 295         if (os_memcmp(s, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X, WPA_SELECTOR_LEN) ==
 296             0)
 297                 return WPA_KEY_MGMT_IEEE8021X;
 298         if (os_memcmp(s, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X, WPA_SELECTOR_LEN)
 299             == 0)
 300                 return WPA_KEY_MGMT_PSK;
 301         if (os_memcmp(s, WPA_AUTH_KEY_MGMT_NONE, WPA_SELECTOR_LEN) == 0)
 302                 return WPA_KEY_MGMT_WPA_NONE;
 303         return 0;
 304 }
 305
 306
 307 #ifndef CONFIG_NO_WPA2
 308 static int rsn_selector_to_bitfield(const u8 *s)
 309 {
 310         if (os_memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == 0)
 311                 return WPA_CIPHER_NONE;
 312         if (os_memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == 0)
 313                 return WPA_CIPHER_WEP40;
 314         if (os_memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == 0)
 315                 return WPA_CIPHER_TKIP;
 316         if (os_memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == 0)
 317                 return WPA_CIPHER_CCMP;
 318         if (os_memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == 0)
 319                 return WPA_CIPHER_WEP104;
 320 #ifdef CONFIG_IEEE80211W
 321         if (os_memcmp(s, RSN_CIPHER_SUITE_AES_128_CMAC, RSN_SELECTOR_LEN) == 0)
 322                 return WPA_CIPHER_AES_128_CMAC;
 323 #endif /* CONFIG_IEEE80211W */
 324         return 0;
 325 }
 326
 327
 328 static int rsn_key_mgmt_to_bitfield(const u8 *s)
 329 {
 330         if (os_memcmp(s, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X, RSN_SELECTOR_LEN) ==
 331             0)
 332                 return WPA_KEY_MGMT_IEEE8021X;
 333         if (os_memcmp(s, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X, RSN_SELECTOR_LEN)
 334             == 0)
 335                 return WPA_KEY_MGMT_PSK;
 336         return 0;
 337 }
 338 #endif /* CONFIG_NO_WPA2 */
 339
 340
 341 #ifdef CONFIG_PEERKEY
 342 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
 343 {
 344         os_memcpy(pos, ie, ie_len);
 345         return pos + ie_len;
 346 }
 347
 348
 349 static u8 * wpa_add_kde(u8 *pos, const u8 *kde, const u8 *data,
 350                         size_t data_len)
 351 {
 352         *pos++ = GENERIC_INFO_ELEM;
 353         *pos++ = RSN_SELECTOR_LEN + data_len;
 354         os_memcpy(pos, kde, RSN_SELECTOR_LEN);
 355         pos += RSN_SELECTOR_LEN;
 356         os_memcpy(pos, data, data_len);
 357         pos += data_len;
 358         return pos;
 359 }
 360 #endif /* CONFIG_PEERKEY */
 361
 362
 363 static int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
 364                                 struct wpa_ie_data *data)
 365 {
 366         const struct wpa_ie_hdr *hdr;
 367         const u8 *pos;
 368         int left;
 369         int i, count;
 370
 371         data->proto = WPA_PROTO_WPA;
 372         data->pairwise_cipher = WPA_CIPHER_TKIP;
 373         data->group_cipher = WPA_CIPHER_TKIP;
 374         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 375         data->capabilities = 0;
 376         data->pmkid = NULL;
 377         data->num_pmkid = 0;
 378         data->mgmt_group_cipher = 0;
 379
 380         if (wpa_ie_len == 0) {
 381                 /* No WPA IE - fail silently */
 382                 return -1;
 383         }
 384
 385         if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
 386                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
 387                            __func__, (unsigned long) wpa_ie_len);
 388                 return -1;
 389         }
 390
 391         hdr = (const struct wpa_ie_hdr *) wpa_ie;
 392
 393         if (hdr->elem_id != GENERIC_INFO_ELEM ||
 394             hdr->len != wpa_ie_len - 2 ||
 395             os_memcmp(hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN) != 0 ||
 396             WPA_GET_LE16(hdr->version) != WPA_VERSION) {
 397                 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
 398                            __func__);
 399                 return -1;
 400         }
 401
 402         pos = (const u8 *) (hdr + 1);
 403         left = wpa_ie_len - sizeof(*hdr);
 404
 405         if (left >= WPA_SELECTOR_LEN) {
 406                 data->group_cipher = wpa_selector_to_bitfield(pos);
 407                 pos += WPA_SELECTOR_LEN;
 408                 left -= WPA_SELECTOR_LEN;
 409         } else if (left > 0) {
 410                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
 411                            __func__, left);
 412                 return -1;
 413         }
 414
 415         if (left >= 2) {
 416                 data->pairwise_cipher = 0;
 417                 count = WPA_GET_LE16(pos);
 418                 pos += 2;
 419                 left -= 2;
 420                 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
 421                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
 422                                    "count %u left %u", __func__, count, left);
 423                         return -1;
 424                 }
 425                 for (i = 0; i < count; i++) {
 426                         data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
 427                         pos += WPA_SELECTOR_LEN;
 428                         left -= WPA_SELECTOR_LEN;
 429                 }
 430         } else if (left == 1) {
 431                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
 432                            __func__);
 433                 return -1;
 434         }
 435
 436         if (left >= 2) {
 437                 data->key_mgmt = 0;
 438                 count = WPA_GET_LE16(pos);
 439                 pos += 2;
 440                 left -= 2;
 441                 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
 442                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
 443                                    "count %u left %u", __func__, count, left);
 444                         return -1;
 445                 }
 446                 for (i = 0; i < count; i++) {
 447                         data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
 448                         pos += WPA_SELECTOR_LEN;
 449                         left -= WPA_SELECTOR_LEN;
 450                 }
 451         } else if (left == 1) {
 452                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
 453                            __func__);
 454                 return -1;
 455         }
 456
 457         if (left >= 2) {
 458                 data->capabilities = WPA_GET_LE16(pos);
 459                 pos += 2;
 460                 left -= 2;
 461         }
 462
 463         if (left > 0) {
 464                 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
 465                            __func__, left);
 466         }
 467
 468         return 0;
 469 }
 470
 471
 472 static int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
 473                                 struct wpa_ie_data *data)
 474 {
 475 #ifndef CONFIG_NO_WPA2
 476         const struct rsn_ie_hdr *hdr;
 477         const u8 *pos;
 478         int left;
 479         int i, count;
 480
 481         data->proto = WPA_PROTO_RSN;
 482         data->pairwise_cipher = WPA_CIPHER_CCMP;
 483         data->group_cipher = WPA_CIPHER_CCMP;
 484         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 485         data->capabilities = 0;
 486         data->pmkid = NULL;
 487         data->num_pmkid = 0;
 488 #ifdef CONFIG_IEEE80211W
 489         data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
 490 #else /* CONFIG_IEEE80211W */
 491         data->mgmt_group_cipher = 0;
 492 #endif /* CONFIG_IEEE80211W */
 493
 494
 495         if (rsn_ie_len == 0) {
 496                 /* No RSN IE - fail silently */
 497                 return -1;
 498         }
 499
 500         if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
 501                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
 502                            __func__, (unsigned long) rsn_ie_len);
 503                 return -1;
 504         }
 505
 506         hdr = (const struct rsn_ie_hdr *) rsn_ie;
 507
 508         if (hdr->elem_id != RSN_INFO_ELEM ||
 509             hdr->len != rsn_ie_len - 2 ||
 510             WPA_GET_LE16(hdr->version) != RSN_VERSION) {
 511                 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
 512                            __func__);
 513                 return -1;
 514         }
 515
 516         pos = (const u8 *) (hdr + 1);
 517         left = rsn_ie_len - sizeof(*hdr);
 518
 519         if (left >= RSN_SELECTOR_LEN) {
 520                 data->group_cipher = rsn_selector_to_bitfield(pos);
 521 #ifdef CONFIG_IEEE80211W
 522                 if (data->group_cipher == WPA_CIPHER_AES_128_CMAC) {
 523                         wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as group "
 524                                    "cipher", __func__);
 525                         return -1;
 526                 }
 527 #endif /* CONFIG_IEEE80211W */
 528                 pos += RSN_SELECTOR_LEN;
 529                 left -= RSN_SELECTOR_LEN;
 530         } else if (left > 0) {
 531                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
 532                            __func__, left);
 533                 return -1;
 534         }
 535
 536         if (left >= 2) {
 537                 data->pairwise_cipher = 0;
 538                 count = WPA_GET_LE16(pos);
 539                 pos += 2;
 540                 left -= 2;
 541                 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
 542                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
 543                                    "count %u left %u", __func__, count, left);
 544                         return -1;
 545                 }
 546                 for (i = 0; i < count; i++) {
 547                         data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
 548                         pos += RSN_SELECTOR_LEN;
 549                         left -= RSN_SELECTOR_LEN;
 550                 }
 551 #ifdef CONFIG_IEEE80211W
 552                 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
 553                         wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
 554                                    "pairwise cipher", __func__);
 555                         return -1;
 556                 }
 557 #endif /* CONFIG_IEEE80211W */
 558         } else if (left == 1) {
 559                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
 560                            __func__);
 561                 return -1;
 562         }
 563
 564         if (left >= 2) {
 565                 data->key_mgmt = 0;
 566                 count = WPA_GET_LE16(pos);
 567                 pos += 2;
 568                 left -= 2;
 569                 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
 570                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
 571                                    "count %u left %u", __func__, count, left);
 572                         return -1;
 573                 }
 574                 for (i = 0; i < count; i++) {
 575                         data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
 576                         pos += RSN_SELECTOR_LEN;
 577                         left -= RSN_SELECTOR_LEN;
 578                 }
 579         } else if (left == 1) {
 580                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
 581                            __func__);
 582                 return -1;
 583         }
 584
 585         if (left >= 2) {
 586                 data->capabilities = WPA_GET_LE16(pos);
 587                 pos += 2;
 588                 left -= 2;
 589         }
 590
 591         if (left >= 2) {
 592                 data->num_pmkid = WPA_GET_LE16(pos);
 593                 pos += 2;
 594                 left -= 2;
 595                 if (left < data->num_pmkid * PMKID_LEN) {
 596                         wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
 597                                    "(num_pmkid=%d left=%d)",
 598                                    __func__, data->num_pmkid, left);
 599                         data->num_pmkid = 0;
 600                 } else {
 601                         data->pmkid = pos;
 602                         pos += data->num_pmkid * PMKID_LEN;
 603                         left -= data->num_pmkid * PMKID_LEN;
 604                 }
 605         }
 606
 607 #ifdef CONFIG_IEEE80211W
 608         if (left >= 4) {
 609                 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
 610                 if (data->mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC) {
 611                         wpa_printf(MSG_DEBUG, "%s: Unsupported management "
 612                                    "group cipher 0x%x", __func__,
 613                                    data->mgmt_group_cipher);
 614                         return -1;
 615                 }
 616                 pos += RSN_SELECTOR_LEN;
 617                 left -= RSN_SELECTOR_LEN;
 618         }
 619 #endif /* CONFIG_IEEE80211W */
 620
 621         if (left > 0) {
 622                 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
 623                            __func__, left);
 624         }
 625
 626         return 0;
 627 #else /* CONFIG_NO_WPA2 */
 628         return -1;
 629 #endif /* CONFIG_NO_WPA2 */
 630 }
 631
 632
 633 /**
 634  * wpa_parse_wpa_ie - Parse WPA/RSN IE
 635  * @wpa_ie: Pointer to WPA or RSN IE
 636  * @wpa_ie_len: Length of the WPA/RSN IE
 637  * @data: Pointer to data area for parsing results
 638  * Returns: 0 on success, -1 on failure
 639  *
 640  * Parse the contents of WPA or RSN IE and write the parsed data into data.
 641  */
 642 int wpa_parse_wpa_ie(const u8 *wpa_ie, size_t wpa_ie_len,
 643                      struct wpa_ie_data *data)
 644 {
 645         if (wpa_ie_len >= 1 && wpa_ie[0] == RSN_INFO_ELEM)
 646                 return wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, data);
 647         else
 648                 return wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, data);
 649 }
 650
 651
 652 static int wpa_gen_wpa_ie_wpa(u8 *wpa_ie, size_t wpa_ie_len,
 653                               int pairwise_cipher, int group_cipher,
 654                               int key_mgmt)
 655 {
 656         u8 *pos;
 657         struct wpa_ie_hdr *hdr;
 658
 659         if (wpa_ie_len < sizeof(*hdr) + WPA_SELECTOR_LEN +
 660             2 + WPA_SELECTOR_LEN + 2 + WPA_SELECTOR_LEN)
 661                 return -1;
 662
 663         hdr = (struct wpa_ie_hdr *) wpa_ie;
 664         hdr->elem_id = GENERIC_INFO_ELEM;
 665         os_memcpy(hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN);
 666         WPA_PUT_LE16(hdr->version, WPA_VERSION);
 667         pos = (u8 *) (hdr + 1);
 668
 669         if (group_cipher == WPA_CIPHER_CCMP) {
 670                 os_memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
 671         } else if (group_cipher == WPA_CIPHER_TKIP) {
 672                 os_memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
 673         } else if (group_cipher == WPA_CIPHER_WEP104) {
 674                 os_memcpy(pos, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN);
 675         } else if (group_cipher == WPA_CIPHER_WEP40) {
 676                 os_memcpy(pos, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN);
 677         } else {
 678                 wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
 679                            group_cipher);
 680                 return -1;
 681         }
 682         pos += WPA_SELECTOR_LEN;
 683
 684         *pos++ = 1;
 685         *pos++ = 0;
 686         if (pairwise_cipher == WPA_CIPHER_CCMP) {
 687                 os_memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
 688         } else if (pairwise_cipher == WPA_CIPHER_TKIP) {
 689                 os_memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
 690         } else if (pairwise_cipher == WPA_CIPHER_NONE) {
 691                 os_memcpy(pos, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN);
 692         } else {
 693                 wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
 694                            pairwise_cipher);
 695                 return -1;
 696         }
 697         pos += WPA_SELECTOR_LEN;
 698
 699         *pos++ = 1;
 700         *pos++ = 0;
 701         if (key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
 702                 os_memcpy(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X,
 703                           WPA_SELECTOR_LEN);
 704         } else if (key_mgmt == WPA_KEY_MGMT_PSK) {
 705                 os_memcpy(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X,
 706                           WPA_SELECTOR_LEN);
 707         } else if (key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
 708                 os_memcpy(pos, WPA_AUTH_KEY_MGMT_NONE, WPA_SELECTOR_LEN);
 709         } else {
 710                 wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
 711                            key_mgmt);
 712                 return -1;
 713         }
 714         pos += WPA_SELECTOR_LEN;
 715
 716         /* WPA Capabilities; use defaults, so no need to include it */
 717
 718         hdr->len = (pos - wpa_ie) - 2;
 719
 720         WPA_ASSERT((size_t) (pos - wpa_ie) <= wpa_ie_len);
 721
 722         return pos - wpa_ie;
 723 }
 724
 725
 726 static int wpa_gen_wpa_ie_rsn(u8 *rsn_ie, size_t rsn_ie_len,
 727                               int pairwise_cipher, int group_cipher,
 728                               int key_mgmt, int mgmt_group_cipher,
 729                               struct wpa_sm *sm)
 730 {
 731 #ifndef CONFIG_NO_WPA2
 732         u8 *pos;
 733         struct rsn_ie_hdr *hdr;
 734         u16 capab;
 735
 736         if (rsn_ie_len < sizeof(*hdr) + RSN_SELECTOR_LEN +
 737             2 + RSN_SELECTOR_LEN + 2 + RSN_SELECTOR_LEN + 2 +
 738             (sm->cur_pmksa ? 2 + PMKID_LEN : 0))
 739                 return -1;
 740
 741         hdr = (struct rsn_ie_hdr *) rsn_ie;
 742         hdr->elem_id = RSN_INFO_ELEM;
 743         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 744         pos = (u8 *) (hdr + 1);
 745
 746         if (group_cipher == WPA_CIPHER_CCMP) {
 747                 os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
 748         } else if (group_cipher == WPA_CIPHER_TKIP) {
 749                 os_memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
 750         } else if (group_cipher == WPA_CIPHER_WEP104) {
 751                 os_memcpy(pos, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN);
 752         } else if (group_cipher == WPA_CIPHER_WEP40) {
 753                 os_memcpy(pos, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN);
 754         } else {
 755                 wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
 756                            group_cipher);
 757                 return -1;
 758         }
 759         pos += RSN_SELECTOR_LEN;
 760
 761         *pos++ = 1;
 762         *pos++ = 0;
 763         if (pairwise_cipher == WPA_CIPHER_CCMP) {
 764                 os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
 765         } else if (pairwise_cipher == WPA_CIPHER_TKIP) {
 766                 os_memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
 767         } else if (pairwise_cipher == WPA_CIPHER_NONE) {
 768                 os_memcpy(pos, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN);
 769         } else {
 770                 wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
 771                            pairwise_cipher);
 772                 return -1;
 773         }
 774         pos += RSN_SELECTOR_LEN;
 775
 776         *pos++ = 1;
 777         *pos++ = 0;
 778         if (key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
 779                 os_memcpy(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X,
 780                           RSN_SELECTOR_LEN);
 781         } else if (key_mgmt == WPA_KEY_MGMT_PSK) {
 782                 os_memcpy(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X,
 783                           RSN_SELECTOR_LEN);
 784         } else {
 785                 wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
 786                            key_mgmt);
 787                 return -1;
 788         }
 789         pos += RSN_SELECTOR_LEN;
 790
 791         /* RSN Capabilities */
 792         capab = 0;
 793 #ifdef CONFIG_IEEE80211W
 794         if (mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC)
 795                 capab |= WPA_CAPABILITY_MGMT_FRAME_PROTECTION;
 796 #endif /* CONFIG_IEEE80211W */
 797         WPA_PUT_LE16(pos, capab);
 798         pos += 2;
 799
 800         if (sm->cur_pmksa) {
 801                 /* PMKID Count (2 octets, little endian) */
 802                 *pos++ = 1;
 803                 *pos++ = 0;
 804                 /* PMKID */
 805                 os_memcpy(pos, sm->cur_pmksa->pmkid, PMKID_LEN);
 806                 pos += PMKID_LEN;
 807         }
 808
 809 #ifdef CONFIG_IEEE80211W
 810         if (mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
 811                 if (!sm->cur_pmksa) {
 812                         /* PMKID Count */
 813                         WPA_PUT_LE16(pos, 0);
 814                         pos += 2;
 815
 816                         /* Management Group Cipher Suite */
 817                         memcpy(pos, RSN_CIPHER_SUITE_AES_128_CMAC,
 818                                RSN_SELECTOR_LEN);
 819                         pos += RSN_SELECTOR_LEN;
 820                 }
 821         }
 822 #endif /* CONFIG_IEEE80211W */
 823
 824         hdr->len = (pos - rsn_ie) - 2;
 825
 826         WPA_ASSERT((size_t) (pos - rsn_ie) <= rsn_ie_len);
 827
 828         return pos - rsn_ie;
 829 #else /* CONFIG_NO_WPA2 */
 830         return -1;
 831 #endif /* CONFIG_NO_WPA2 */
 832 }
 833
 834
 835 /**
 836  * wpa_gen_wpa_ie - Generate WPA/RSN IE based on current security policy
 837  * @sm: Pointer to WPA state machine data from wpa_sm_init()
 838  * @wpa_ie: Pointer to memory area for the generated WPA/RSN IE
 839  * @wpa_ie_len: Maximum length of the generated WPA/RSN IE
 840  * Returns: Length of the generated WPA/RSN IE or -1 on failure
 841  */
 842 static int wpa_gen_wpa_ie(struct wpa_sm *sm, u8 *wpa_ie, size_t wpa_ie_len)
 843 {
 844         if (sm->proto == WPA_PROTO_RSN)
 845                 return wpa_gen_wpa_ie_rsn(wpa_ie, wpa_ie_len,
 846                                           sm->pairwise_cipher,
 847                                           sm->group_cipher,
 848                                           sm->key_mgmt, sm->mgmt_group_cipher,
 849                                           sm);
 850         else
 851                 return wpa_gen_wpa_ie_wpa(wpa_ie, wpa_ie_len,
 852                                           sm->pairwise_cipher,
 853                                           sm->group_cipher,
 854                                           sm->key_mgmt);
 855 }
 856
 857
 858 /**
 859  * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
 860  * @pmk: Pairwise master key
 861  * @pmk_len: Length of PMK
 862  * @label: Label to use in derivation
 863  * @addr1: AA or SA
 864  * @addr2: SA or AA
 865  * @nonce1: ANonce or SNonce
 866  * @nonce2: SNonce or ANonce
 867  * @ptk: Buffer for pairwise transient key
 868  * @ptk_len: Length of PTK
 869  *
 870  * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
 871  * PTK = PRF-X(PMK, "Pairwise key expansion",
 872  *             Min(AA, SA) || Max(AA, SA) ||
 873  *             Min(ANonce, SNonce) || Max(ANonce, SNonce))
 874  *
 875  * STK = PRF-X(SMK, "Peer key expansion",
 876  *             Min(MAC_I, MAC_P) || Max(MAC_I, MAC_P) ||
 877  *             Min(INonce, PNonce) || Max(INonce, PNonce))
 878  */
 879 static void wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len,
 880                            const char *label,
 881                            const u8 *addr1, const u8 *addr2,
 882                            const u8 *nonce1, const u8 *nonce2,
 883                            u8 *ptk, size_t ptk_len)
 884 {
 885         u8 data[2 * ETH_ALEN + 2 * 32];
 886
 887         if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
 888                 os_memcpy(data, addr1, ETH_ALEN);
 889                 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
 890         } else {
 891                 os_memcpy(data, addr2, ETH_ALEN);
 892                 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
 893         }
 894
 895         if (os_memcmp(nonce1, nonce2, 32) < 0) {
 896                 os_memcpy(data + 2 * ETH_ALEN, nonce1, 32);
 897                 os_memcpy(data + 2 * ETH_ALEN + 32, nonce2, 32);
 898         } else {
 899                 os_memcpy(data + 2 * ETH_ALEN, nonce2, 32);
 900                 os_memcpy(data + 2 * ETH_ALEN + 32, nonce1, 32);
 901         }
 902
 903         sha1_prf(pmk, pmk_len, label, data, sizeof(data), ptk, ptk_len);
 904
 905         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
 906         wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", ptk, ptk_len);
 907 }
 908
 909
 910 /**
 911  * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
 912  * @key: EAPOL-Key Key Confirmation Key (KCK)
 913  * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
 914  * @buf: Pointer to the beginning of the EAPOL header (version field)
 915  * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
 916  * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
 917  *
 918  * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
 919  * to be cleared (all zeroes) when calling this function.
 920  *
 921  * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
 922  * description of the Key MIC calculation. It includes packet data from the
 923  * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
 924  * happened during final editing of the standard and the correct behavior is
 925  * defined in the last draft (IEEE 802.11i/D10).
 926  */
 927 static void wpa_eapol_key_mic(const u8 *key, int ver,
 928                               const u8 *buf, size_t len, u8 *mic)
 929 {
 930         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
 931                 hmac_md5(key, 16, buf, len, mic);
 932         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
 933                 u8 hash[SHA1_MAC_LEN];
 934                 hmac_sha1(key, 16, buf, len, hash);
 935                 os_memcpy(mic, hash, MD5_MAC_LEN);
 936         }
 937 }
 938
 939
 940 static void wpa_eapol_key_send(struct wpa_sm *sm, const u8 *kck,
 941                                int ver, const u8 *dest, u16 proto,
 942                                u8 *msg, size_t msg_len, u8 *key_mic)
 943 {
 944         if (os_memcmp(dest, "\x00\x00\x00\x00\x00\x00", ETH_ALEN) == 0 &&
 945             os_memcmp(sm->bssid, "\x00\x00\x00\x00\x00\x00", ETH_ALEN) == 0) {
 946                 /*
 947                  * Association event was not yet received; try to fetch
 948                  * BSSID from the driver.
 949                  */
 950                 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
 951                         wpa_printf(MSG_DEBUG, "WPA: Failed to read BSSID for "
 952                                    "EAPOL-Key destination address");
 953                 } else {
 954                         dest = sm->bssid;
 955                         wpa_printf(MSG_DEBUG, "WPA: Use BSSID (" MACSTR
 956                                    ") as the destination for EAPOL-Key",
 957                                    MAC2STR(dest));
 958                 }
 959         }
 960         if (key_mic) {
 961                 wpa_eapol_key_mic(kck, ver, msg, msg_len, key_mic);
 962         }
 963         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
 964         wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
 965         eapol_sm_notify_tx_eapol_key(sm->eapol);
 966         os_free(msg);
 967 }
 968
 969
 970 /**
 971  * wpa_sm_key_request - Send EAPOL-Key Request
 972  * @sm: Pointer to WPA state machine data from wpa_sm_init()
 973  * @error: Indicate whether this is an Michael MIC error report
 974  * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
 975  * Returns: Pointer to the current network structure or %NULL on failure
 976  *
 977  * Send an EAPOL-Key Request to the current authenticator. This function is
 978  * used to request rekeying and it is usually called when a local Michael MIC
 979  * failure is detected.
 980  */
 981 void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
 982 {
 983         size_t rlen;
 984         struct wpa_eapol_key *reply;
 985         int key_info, ver;
 986         u8 bssid[ETH_ALEN], *rbuf;
 987
 988         if (sm->pairwise_cipher == WPA_CIPHER_CCMP)
 989                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
 990         else
 991                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
 992
 993         if (wpa_sm_get_bssid(sm, bssid) < 0) {
 994                 wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
 995                            "request");
 996                 return;
 997         }
 998
 999         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1000                                   sizeof(*reply), &rlen, (void *) &reply);
1001         if (rbuf == NULL)
1002                 return;
1003
1004         reply->type = sm->proto == WPA_PROTO_RSN ?
1005                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1006         key_info = WPA_KEY_INFO_REQUEST | ver;
1007         if (sm->ptk_set)
1008                 key_info |= WPA_KEY_INFO_MIC;
1009         if (error)
1010                 key_info |= WPA_KEY_INFO_ERROR;
1011         if (pairwise)
1012                 key_info |= WPA_KEY_INFO_KEY_TYPE;
1013         WPA_PUT_BE16(reply->key_info, key_info);
1014         WPA_PUT_BE16(reply->key_length, 0);
1015         os_memcpy(reply->replay_counter, sm->request_counter,
1016                   WPA_REPLAY_COUNTER_LEN);
1017         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
1018
1019         WPA_PUT_BE16(reply->key_data_length, 0);
1020
1021         wpa_printf(MSG_INFO, "WPA: Sending EAPOL-Key Request (error=%d "
1022                    "pairwise=%d ptk_set=%d len=%lu)",
1023                    error, pairwise, sm->ptk_set, (unsigned long) rlen);
1024         wpa_eapol_key_send(sm, sm->ptk.kck, ver, bssid, ETH_P_EAPOL,
1025                            rbuf, rlen, key_info & WPA_KEY_INFO_MIC ?
1026                            reply->key_mic : NULL);
1027 }
1028
1029
1030 /**
1031  * wpa_sm_stkstart - Send EAPOL-Key Request for STK handshake (STK M1)
1032  * @sm: Pointer to WPA state machine data from wpa_sm_init()
1033  * @peer: MAC address of the peer STA
1034  * Returns: 0 on success, or -1 on failure
1035  *
1036  * Send an EAPOL-Key Request to the current authenticator to start STK
1037  * handshake with the peer.
1038  */
1039 int wpa_sm_stkstart(struct wpa_sm *sm, const u8 *peer)
1040 {
1041 #ifdef CONFIG_PEERKEY
1042         size_t rlen, kde_len;
1043         struct wpa_eapol_key *req;
1044         int key_info, ver;
1045         u8 bssid[ETH_ALEN], *rbuf, *pos, *count_pos;
1046         u16 count;
1047         struct wpa_ssid *ssid = sm->cur_ssid;
1048         struct rsn_ie_hdr *hdr;
1049         struct wpa_peerkey *peerkey;
1050         struct wpa_ie_data ie;
1051
1052         if (sm->proto != WPA_PROTO_RSN || !sm->ptk_set ||
1053             ssid == NULL || !ssid->peerkey)
1054                 return -1;
1055
1056         if (sm->ap_rsn_ie &&
1057             wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &ie) == 0 &&
1058             !(ie.capabilities & WPA_CAPABILITY_PEERKEY_ENABLED)) {
1059                 wpa_printf(MSG_DEBUG, "RSN: Current AP does not support STK");
1060                 return -1;
1061         }
1062
1063         if (sm->pairwise_cipher == WPA_CIPHER_CCMP)
1064                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
1065         else
1066                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
1067
1068         if (wpa_sm_get_bssid(sm, bssid) < 0) {
1069                 wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
1070                            "SMK M1");
1071                 return -1;
1072         }
1073
1074         /* TODO: find existing entry and if found, use that instead of adding
1075          * a new one */
1076         peerkey = os_malloc(sizeof(*peerkey));
1077         if (peerkey == NULL)
1078                 return -1;
1079         os_memset(peerkey, 0, sizeof(*peerkey));
1080         peerkey->initiator = 1;
1081         os_memcpy(peerkey->addr, peer, ETH_ALEN);
1082
1083         /* SMK M1:
1084          * EAPOL-Key(S=1, M=1, A=0, I=0, K=0, SM=1, KeyRSC=0, Nonce=INonce,
1085          *           MIC=MIC, DataKDs=(RSNIE_I, MAC_P KDE))
1086          */
1087
1088         hdr = (struct rsn_ie_hdr *) peerkey->rsnie_i;
1089         hdr->elem_id = RSN_INFO_ELEM;
1090         WPA_PUT_LE16(hdr->version, RSN_VERSION);
1091         pos = (u8 *) (hdr + 1);
1092         /* Group Suite can be anything for SMK RSN IE; receiver will just
1093          * ignore it. */
1094         os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
1095         pos += RSN_SELECTOR_LEN;
1096         count_pos = pos;
1097         pos += 2;
1098
1099         count = 0;
1100         if (ssid->pairwise_cipher & WPA_CIPHER_CCMP) {
1101                 os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
1102                 pos += RSN_SELECTOR_LEN;
1103                 count++;
1104         }
1105         if (ssid->pairwise_cipher & WPA_CIPHER_TKIP) {
1106                 os_memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
1107                 pos += RSN_SELECTOR_LEN;
1108                 count++;
1109         }
1110         WPA_PUT_LE16(count_pos, count);
1111
1112         hdr->len = (pos - peerkey->rsnie_i) - 2;
1113         peerkey->rsnie_i_len = pos - peerkey->rsnie_i;
1114         wpa_hexdump(MSG_DEBUG, "WPA: RSN IE for SMK handshake",
1115                     peerkey->rsnie_i, peerkey->rsnie_i_len);
1116
1117         kde_len = peerkey->rsnie_i_len + 2 + RSN_SELECTOR_LEN + ETH_ALEN;
1118
1119         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1120                                   sizeof(*req) + kde_len, &rlen,
1121                                   (void *) &req);
1122         if (rbuf == NULL) {
1123                 wpa_supplicant_peerkey_free(sm, peerkey);
1124                 return -1;
1125         }
1126
1127         req->type = EAPOL_KEY_TYPE_RSN;
1128         key_info = WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
1129                 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_REQUEST | ver;
1130         WPA_PUT_BE16(req->key_info, key_info);
1131         WPA_PUT_BE16(req->key_length, 0);
1132         os_memcpy(req->replay_counter, sm->request_counter,
1133                   WPA_REPLAY_COUNTER_LEN);
1134         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
1135
1136         if (hostapd_get_rand(peerkey->inonce, WPA_NONCE_LEN)) {
1137                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
1138                         "WPA: Failed to get random data for INonce");
1139                 os_free(rbuf);
1140                 wpa_supplicant_peerkey_free(sm, peerkey);
1141                 return -1;
1142         }
1143         os_memcpy(req->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
1144         wpa_hexdump(MSG_DEBUG, "WPA: INonce for SMK handshake",
1145                     req->key_nonce, WPA_NONCE_LEN);
1146
1147         WPA_PUT_BE16(req->key_data_length, (u16) kde_len);
1148         pos = (u8 *) (req + 1);
1149
1150         /* Initiator RSN IE */
1151         pos = wpa_add_ie(pos, peerkey->rsnie_i, peerkey->rsnie_i_len);
1152         /* Peer MAC address KDE */
1153         pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peer, ETH_ALEN);
1154
1155         wpa_printf(MSG_INFO, "RSN: Sending EAPOL-Key SMK M1 Request (peer "
1156                    MACSTR ")", MAC2STR(peer));
1157         wpa_eapol_key_send(sm, sm->ptk.kck, ver, bssid, ETH_P_EAPOL,
1158                            rbuf, rlen, req->key_mic);
1159
1160         peerkey->next = sm->peerkey;
1161         sm->peerkey = peerkey;
1162
1163         return 0;
1164
1165 #else /* CONFIG_PEERKEY */
1166
1167         return -1;
1168
1169 #endif /* CONFIG_PEERKEY */
1170 }
1171
1172
1173 struct wpa_eapol_ie_parse {
1174         const u8 *wpa_ie;
1175         size_t wpa_ie_len;
1176         const u8 *rsn_ie;
1177         size_t rsn_ie_len;
1178         const u8 *pmkid;
1179         const u8 *gtk;
1180         size_t gtk_len;
1181         const u8 *mac_addr;
1182         size_t mac_addr_len;
1183 #ifdef CONFIG_PEERKEY
1184         const u8 *smk;
1185         size_t smk_len;
1186         const u8 *nonce;
1187         size_t nonce_len;
1188         const u8 *lifetime;
1189         size_t lifetime_len;
1190         const u8 *error;
1191         size_t error_len;
1192 #endif /* CONFIG_PEERKEY */
1193 #ifdef CONFIG_IEEE80211W
1194         const u8 *dhv;
1195         size_t dhv_len;
1196         const u8 *igtk;
1197         size_t igtk_len;
1198 #endif /* CONFIG_IEEE80211W */
1199 };
1200
1201
1202 /**
1203  * wpa_supplicant_parse_generic - Parse EAPOL-Key Key Data Generic IEs
1204  * @pos: Pointer to the IE header
1205  * @end: Pointer to the end of the Key Data buffer
1206  * @ie: Pointer to parsed IE data
1207  * Returns: 0 on success, 1 if end mark is found, -1 on failure
1208  */
1209 static int wpa_supplicant_parse_generic(const u8 *pos, const u8 *end,
1210                                         struct wpa_eapol_ie_parse *ie)
1211 {
1212         if (pos[1] == 0)
1213                 return 1;
1214
1215         if (pos[1] >= 6 &&
1216             os_memcmp(pos + 2, WPA_OUI_TYPE, WPA_SELECTOR_LEN) == 0 &&
1217             pos[2 + WPA_SELECTOR_LEN] == 1 &&
1218             pos[2 + WPA_SELECTOR_LEN + 1] == 0) {
1219                 ie->wpa_ie = pos;
1220                 ie->wpa_ie_len = pos[1] + 2;
1221                 return 0;
1222         }
1223
1224         if (pos + 1 + RSN_SELECTOR_LEN < end &&
1225             pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
1226             os_memcmp(pos + 2, RSN_KEY_DATA_PMKID, RSN_SELECTOR_LEN) == 0) {
1227                 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN;
1228                 return 0;
1229         }
1230
1231         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1232             os_memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY, RSN_SELECTOR_LEN) == 0) {
1233                 ie->gtk = pos + 2 + RSN_SELECTOR_LEN;
1234                 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN;
1235                 return 0;
1236         }
1237
1238         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1239             os_memcmp(pos + 2, RSN_KEY_DATA_MAC_ADDR, RSN_SELECTOR_LEN) == 0) {
1240                 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN;
1241                 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN;
1242                 return 0;
1243         }
1244
1245 #ifdef CONFIG_PEERKEY
1246         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1247             os_memcmp(pos + 2, RSN_KEY_DATA_SMK, RSN_SELECTOR_LEN) == 0) {
1248                 ie->smk = pos + 2 + RSN_SELECTOR_LEN;
1249                 ie->smk_len = pos[1] - RSN_SELECTOR_LEN;
1250                 return 0;
1251         }
1252
1253         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1254             os_memcmp(pos + 2, RSN_KEY_DATA_NONCE, RSN_SELECTOR_LEN) == 0) {
1255                 ie->nonce = pos + 2 + RSN_SELECTOR_LEN;
1256                 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN;
1257                 return 0;
1258         }
1259
1260         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1261             os_memcmp(pos + 2, RSN_KEY_DATA_LIFETIME, RSN_SELECTOR_LEN) == 0) {
1262                 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN;
1263                 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN;
1264                 return 0;
1265         }
1266
1267         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1268             os_memcmp(pos + 2, RSN_KEY_DATA_ERROR, RSN_SELECTOR_LEN) == 0) {
1269                 ie->error = pos + 2 + RSN_SELECTOR_LEN;
1270                 ie->error_len = pos[1] - RSN_SELECTOR_LEN;
1271                 return 0;
1272         }
1273 #endif /* CONFIG_PEERKEY */
1274
1275 #ifdef CONFIG_IEEE80211W
1276         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1277             os_memcmp(pos + 2, RSN_KEY_DATA_DHV, RSN_SELECTOR_LEN) == 0) {
1278                 ie->dhv = pos + 2 + RSN_SELECTOR_LEN;
1279                 ie->dhv_len = pos[1] - RSN_SELECTOR_LEN;
1280                 return 0;
1281         }
1282
1283         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
1284             os_memcmp(pos + 2, RSN_KEY_DATA_IGTK, RSN_SELECTOR_LEN) == 0) {
1285                 ie->igtk = pos + 2 + RSN_SELECTOR_LEN;
1286                 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN;
1287                 return 0;
1288         }
1289 #endif /* CONFIG_IEEE80211W */
1290
1291         return 0;
1292 }
1293
1294
1295 /**
1296  * wpa_supplicant_parse_ies - Parse EAPOL-Key Key Data IEs
1297  * @buf: Pointer to the Key Data buffer
1298  * @len: Key Data Length
1299  * @ie: Pointer to parsed IE data
1300  * Returns: 0 on success, -1 on failure
1301  */
1302 static int wpa_supplicant_parse_ies(const u8 *buf, size_t len,
1303                                     struct wpa_eapol_ie_parse *ie)
1304 {
1305         const u8 *pos, *end;
1306         int ret = 0;
1307
1308         os_memset(ie, 0, sizeof(*ie));
1309         for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) {
1310                 if (pos[0] == 0xdd &&
1311                     ((pos == buf + len - 1) || pos[1] == 0)) {
1312                         /* Ignore padding */
1313                         break;
1314                 }
1315                 if (pos + 2 + pos[1] > end) {
1316                         wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data "
1317                                    "underflow (ie=%d len=%d pos=%d)",
1318                                    pos[0], pos[1], (int) (pos - buf));
1319                         wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data",
1320                                         buf, len);
1321                         ret = -1;
1322                         break;
1323                 }
1324                 if (*pos == RSN_INFO_ELEM) {
1325                         ie->rsn_ie = pos;
1326                         ie->rsn_ie_len = pos[1] + 2;
1327                 } else if (*pos == GENERIC_INFO_ELEM) {
1328                         ret = wpa_supplicant_parse_generic(pos, end, ie);
1329                         if (ret < 0)
1330                                 break;
1331                         if (ret > 0) {
1332                                 ret = 0;
1333                                 break;
1334                         }
1335                 } else {
1336                         wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key "
1337                                     "Key Data IE", pos, 2 + pos[1]);
1338                 }
1339         }
1340
1341         return ret;
1342 }
1343
1344
1345 static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
1346                                   const unsigned char *src_addr,
1347                                   const u8 *pmkid)
1348 {
1349         int abort_cached = 0;
1350
1351         if (pmkid && !sm->cur_pmksa) {
1352                 /* When using drivers that generate RSN IE, wpa_supplicant may
1353                  * not have enough time to get the association information
1354                  * event before receiving this 1/4 message, so try to find a
1355                  * matching PMKSA cache entry here. */
1356                 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid);
1357                 if (sm->cur_pmksa) {
1358                         wpa_printf(MSG_DEBUG, "RSN: found matching PMKID from "
1359                                    "PMKSA cache");
1360                 } else {
1361                         wpa_printf(MSG_DEBUG, "RSN: no matching PMKID found");
1362                         abort_cached = 1;
1363                 }
1364         }
1365
1366         if (pmkid && sm->cur_pmksa &&
1367             os_memcmp(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
1368                 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
1369                 wpa_sm_set_pmk_from_pmksa(sm);
1370                 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
1371                                 sm->pmk, sm->pmk_len);
1372                 eapol_sm_notify_cached(sm->eapol);
1373         } else if (sm->key_mgmt == WPA_KEY_MGMT_IEEE8021X && sm->eapol) {
1374                 int res, pmk_len;
1375                 pmk_len = PMK_LEN;
1376                 res = eapol_sm_get_key(sm->eapol, sm->pmk, PMK_LEN);
1377                 if (res) {
1378                         /*
1379                          * EAP-LEAP is an exception from other EAP methods: it
1380                          * uses only 16-byte PMK.
1381                          */
1382                         res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
1383                         pmk_len = 16;
1384                 }
1385                 if (res == 0) {
1386                         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
1387                                         "machines", sm->pmk, pmk_len);
1388                         sm->pmk_len = pmk_len;
1389                         pmksa_cache_add(sm->pmksa, sm->pmk, pmk_len, src_addr,
1390                                         sm->own_addr, sm->cur_ssid);
1391                         if (!sm->cur_pmksa && pmkid &&
1392                             pmksa_cache_get(sm->pmksa, src_addr, pmkid)) {
1393                                 wpa_printf(MSG_DEBUG, "RSN: the new PMK "
1394                                            "matches with the PMKID");
1395                                 abort_cached = 0;
1396                         }
1397                 } else {
1398                         wpa_msg(sm->ctx->ctx, MSG_WARNING,
1399                                 "WPA: Failed to get master session key from "
1400                                 "EAPOL state machines");
1401                         wpa_msg(sm->ctx->ctx, MSG_WARNING,
1402                                 "WPA: Key handshake aborted");
1403                         if (sm->cur_pmksa) {
1404                                 wpa_printf(MSG_DEBUG, "RSN: Cancelled PMKSA "
1405                                            "caching attempt");
1406                                 sm->cur_pmksa = NULL;
1407                                 abort_cached = 1;
1408                         } else if (!abort_cached) {
1409                                 return -1;
1410                         }
1411                 }
1412         }
1413
1414         if (abort_cached && sm->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
1415                 /* Send EAPOL-Start to trigger full EAP authentication. */
1416                 u8 *buf;
1417                 size_t buflen;
1418
1419                 wpa_printf(MSG_DEBUG, "RSN: no PMKSA entry found - trigger "
1420                            "full EAP authentication");
1421                 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
1422                                          NULL, 0, &buflen, NULL);
1423                 if (buf) {
1424                         wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
1425                                           buf, buflen);
1426                         os_free(buf);
1427                 }
1428
1429                 return -1;
1430         }
1431
1432         return 0;
1433 }
1434
1435
1436 static int wpa_supplicant_send_2_of_4(struct wpa_sm *sm,
1437                                       const unsigned char *dst,
1438                                       const struct wpa_eapol_key *key,
1439                                       int ver, const u8 *nonce,
1440                                       const u8 *wpa_ie, size_t wpa_ie_len,
1441                                       struct wpa_ptk *ptk)
1442 {
1443         size_t rlen;
1444         struct wpa_eapol_key *reply;
1445         u8 *rbuf;
1446
1447         if (wpa_ie == NULL) {
1448                 wpa_printf(MSG_WARNING, "WPA: No wpa_ie set - cannot "
1449                            "generate msg 2/4");
1450                 return -1;
1451         }
1452
1453         wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
1454
1455         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
1456                                   NULL, sizeof(*reply) + wpa_ie_len,
1457                                   &rlen, (void *) &reply);
1458         if (rbuf == NULL)
1459                 return -1;
1460
1461         reply->type = sm->proto == WPA_PROTO_RSN ?
1462                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1463         WPA_PUT_BE16(reply->key_info,
1464                      ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_MIC);
1465         if (sm->proto == WPA_PROTO_RSN)
1466                 WPA_PUT_BE16(reply->key_length, 0);
1467         else
1468                 os_memcpy(reply->key_length, key->key_length, 2);
1469         os_memcpy(reply->replay_counter, key->replay_counter,
1470                   WPA_REPLAY_COUNTER_LEN);
1471
1472         WPA_PUT_BE16(reply->key_data_length, wpa_ie_len);
1473         os_memcpy(reply + 1, wpa_ie, wpa_ie_len);
1474
1475         os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
1476
1477         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
1478         wpa_eapol_key_send(sm, ptk->kck, ver, dst, ETH_P_EAPOL,
1479                            rbuf, rlen, reply->key_mic);
1480
1481         return 0;
1482 }
1483
1484
1485 static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
1486                                           const unsigned char *src_addr,
1487                                           const struct wpa_eapol_key *key,
1488                                           u16 ver)
1489 {
1490         struct wpa_eapol_ie_parse ie;
1491         struct wpa_ptk *ptk;
1492         u8 buf[8];
1493
1494         if (wpa_sm_get_ssid(sm) == NULL) {
1495                 wpa_printf(MSG_WARNING, "WPA: No SSID info found (msg 1 of "
1496                            "4).");
1497                 return;
1498         }
1499
1500         wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
1501         wpa_printf(MSG_DEBUG, "WPA: RX message 1 of 4-Way Handshake from "
1502                    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1503
1504         os_memset(&ie, 0, sizeof(ie));
1505
1506 #ifndef CONFIG_NO_WPA2
1507         if (sm->proto == WPA_PROTO_RSN) {
1508                 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
1509                 const u8 *_buf = (const u8 *) (key + 1);
1510                 size_t len = WPA_GET_BE16(key->key_data_length);
1511                 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data", _buf, len);
1512                 wpa_supplicant_parse_ies(_buf, len, &ie);
1513                 if (ie.pmkid) {
1514                         wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
1515                                     "Authenticator", ie.pmkid, PMKID_LEN);
1516                 }
1517         }
1518 #endif /* CONFIG_NO_WPA2 */
1519
1520         if (wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid))
1521                 return;
1522
1523         if (sm->renew_snonce) {
1524                 if (hostapd_get_rand(sm->snonce, WPA_NONCE_LEN)) {
1525                         wpa_msg(sm->ctx->ctx, MSG_WARNING,
1526                                 "WPA: Failed to get random data for SNonce");
1527                         return;
1528                 }
1529                 sm->renew_snonce = 0;
1530                 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
1531                             sm->snonce, WPA_NONCE_LEN);
1532         }
1533
1534         /* Calculate PTK which will be stored as a temporary PTK until it has
1535          * been verified when processing message 3/4. */
1536         ptk = &sm->tptk;
1537         wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
1538                        sm->own_addr, sm->bssid, sm->snonce, key->key_nonce,
1539                        (u8 *) ptk, sizeof(*ptk));
1540         /* Supplicant: swap tx/rx Mic keys */
1541         os_memcpy(buf, ptk->u.auth.tx_mic_key, 8);
1542         os_memcpy(ptk->u.auth.tx_mic_key, ptk->u.auth.rx_mic_key, 8);
1543         os_memcpy(ptk->u.auth.rx_mic_key, buf, 8);
1544         sm->tptk_set = 1;
1545
1546         if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
1547                                        sm->assoc_wpa_ie, sm->assoc_wpa_ie_len,
1548                                        ptk))
1549                 return;
1550
1551         os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
1552 }
1553
1554
1555 static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
1556 {
1557         struct wpa_sm *sm = eloop_ctx;
1558         rsn_preauth_candidate_process(sm);
1559 }
1560
1561
1562 static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
1563                                             const u8 *addr, int secure)
1564 {
1565         wpa_msg(sm->ctx->ctx, MSG_INFO, "WPA: Key negotiation completed with "
1566                 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
1567                 wpa_cipher_txt(sm->pairwise_cipher),
1568                 wpa_cipher_txt(sm->group_cipher));
1569         wpa_sm_cancel_auth_timeout(sm);
1570         wpa_sm_set_state(sm, WPA_COMPLETED);
1571
1572         if (secure) {
1573                 wpa_sm_mlme_setprotection(
1574                         sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
1575                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1576                 eapol_sm_notify_portValid(sm->eapol, TRUE);
1577                 if (sm->key_mgmt == WPA_KEY_MGMT_PSK)
1578                         eapol_sm_notify_eap_success(sm->eapol, TRUE);
1579                 /*
1580                  * Start preauthentication after a short wait to avoid a
1581                  * possible race condition between the data receive and key
1582                  * configuration after the 4-Way Handshake. This increases the
1583                  * likelyhood of the first preauth EAPOL-Start frame getting to
1584                  * the target AP.
1585                  */
1586                 eloop_register_timeout(1, 0, wpa_sm_start_preauth, sm, NULL);
1587         }
1588
1589         if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
1590                 wpa_printf(MSG_DEBUG, "RSN: Authenticator accepted "
1591                            "opportunistic PMKSA entry - marking it valid");
1592                 sm->cur_pmksa->opportunistic = 0;
1593         }
1594 }
1595
1596
1597 static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
1598                                       const struct wpa_eapol_key *key)
1599 {
1600         int keylen, rsclen;
1601         wpa_alg alg;
1602         const u8 *key_rsc;
1603         u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
1604
1605         wpa_printf(MSG_DEBUG, "WPA: Installing PTK to the driver.");
1606
1607         switch (sm->pairwise_cipher) {
1608         case WPA_CIPHER_CCMP:
1609                 alg = WPA_ALG_CCMP;
1610                 keylen = 16;
1611                 rsclen = 6;
1612                 break;
1613         case WPA_CIPHER_TKIP:
1614                 alg = WPA_ALG_TKIP;
1615                 keylen = 32;
1616                 rsclen = 6;
1617                 break;
1618         case WPA_CIPHER_NONE:
1619                 wpa_printf(MSG_DEBUG, "WPA: Pairwise Cipher Suite: "
1620                            "NONE - do not use pairwise keys");
1621                 return 0;
1622         default:
1623                 wpa_printf(MSG_WARNING, "WPA: Unsupported pairwise cipher %d",
1624                            sm->pairwise_cipher);
1625                 return -1;
1626         }
1627
1628         if (sm->proto == WPA_PROTO_RSN) {
1629                 key_rsc = null_rsc;
1630         } else {
1631                 key_rsc = key->key_rsc;
1632                 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
1633         }
1634
1635         if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
1636                            (u8 *) sm->ptk.tk1, keylen) < 0) {
1637                 wpa_printf(MSG_WARNING, "WPA: Failed to set PTK to the "
1638                            "driver.");
1639                 return -1;
1640         }
1641         return 0;
1642 }
1643
1644
1645 static int wpa_supplicant_check_group_cipher(int group_cipher,
1646                                              int keylen, int maxkeylen,
1647                                              int *key_rsc_len, wpa_alg *alg)
1648 {
1649         int ret = 0;
1650
1651         switch (group_cipher) {
1652         case WPA_CIPHER_CCMP:
1653                 if (keylen != 16 || maxkeylen < 16) {
1654                         ret = -1;
1655                         break;
1656                 }
1657                 *key_rsc_len = 6;
1658                 *alg = WPA_ALG_CCMP;
1659                 break;
1660         case WPA_CIPHER_TKIP:
1661                 if (keylen != 32 || maxkeylen < 32) {
1662                         ret = -1;
1663                         break;
1664                 }
1665                 *key_rsc_len = 6;
1666                 *alg = WPA_ALG_TKIP;
1667                 break;
1668         case WPA_CIPHER_WEP104:
1669                 if (keylen != 13 || maxkeylen < 13) {
1670                         ret = -1;
1671                         break;
1672                 }
1673                 *key_rsc_len = 0;
1674                 *alg = WPA_ALG_WEP;
1675                 break;
1676         case WPA_CIPHER_WEP40:
1677                 if (keylen != 5 || maxkeylen < 5) {
1678                         ret = -1;
1679                         break;
1680                 }
1681                 *key_rsc_len = 0;
1682                 *alg = WPA_ALG_WEP;
1683                 break;
1684         default:
1685                 wpa_printf(MSG_WARNING, "WPA: Unsupported Group Cipher %d",
1686                            group_cipher);
1687                 return -1;
1688         }
1689
1690         if (ret < 0 ) {
1691                 wpa_printf(MSG_WARNING, "WPA: Unsupported %s Group Cipher key "
1692                            "length %d (%d).",
1693                            wpa_cipher_txt(group_cipher), keylen, maxkeylen);
1694         }
1695
1696         return ret;
1697 }
1698
1699
1700 struct wpa_gtk_data {
1701         wpa_alg alg;
1702         int tx, key_rsc_len, keyidx;
1703         u8 gtk[32];
1704         int gtk_len;
1705 };
1706
1707
1708 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
1709                                       const struct wpa_gtk_data *gd,
1710                                       const u8 *key_rsc)
1711 {
1712         const u8 *_gtk = gd->gtk;
1713         u8 gtk_buf[32];
1714
1715         wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
1716         wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver "
1717                    "(keyidx=%d tx=%d).", gd->keyidx, gd->tx);
1718         wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
1719         if (sm->group_cipher == WPA_CIPHER_TKIP) {
1720                 /* Swap Tx/Rx keys for Michael MIC */
1721                 os_memcpy(gtk_buf, gd->gtk, 16);
1722                 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
1723                 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
1724                 _gtk = gtk_buf;
1725         }
1726         if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
1727                 if (wpa_sm_set_key(sm, gd->alg,
1728                                    (u8 *) "\xff\xff\xff\xff\xff\xff",
1729                                    gd->keyidx, 1, key_rsc, gd->key_rsc_len,
1730                                    _gtk, gd->gtk_len) < 0) {
1731                         wpa_printf(MSG_WARNING, "WPA: Failed to set "
1732                                    "GTK to the driver (Group only).");
1733                         return -1;
1734                 }
1735         } else if (wpa_sm_set_key(sm, gd->alg,
1736                                   (u8 *) "\xff\xff\xff\xff\xff\xff",
1737                                   gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
1738                                   _gtk, gd->gtk_len) < 0) {
1739                 wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to "
1740                            "the driver.");
1741                 return -1;
1742         }
1743
1744         return 0;
1745 }
1746
1747
1748 static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
1749                                                 int tx)
1750 {
1751         if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
1752                 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
1753                  * seemed to set this bit (incorrectly, since Tx is only when
1754                  * doing Group Key only APs) and without this workaround, the
1755                  * data connection does not work because wpa_supplicant
1756                  * configured non-zero keyidx to be used for unicast. */
1757                 wpa_printf(MSG_INFO, "WPA: Tx bit set for GTK, but pairwise "
1758                            "keys are used - ignore Tx bit");
1759                 return 0;
1760         }
1761         return tx;
1762 }
1763
1764
1765 static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
1766                                        const struct wpa_eapol_key *key,
1767                                        const u8 *gtk, size_t gtk_len,
1768                                        int key_info)
1769 {
1770 #ifndef CONFIG_NO_WPA2
1771         struct wpa_gtk_data gd;
1772
1773         /*
1774          * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
1775          * GTK KDE format:
1776          * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
1777          * Reserved [bits 0-7]
1778          * GTK
1779          */
1780
1781         os_memset(&gd, 0, sizeof(gd));
1782         wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1783                         gtk, gtk_len);
1784
1785         if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
1786                 return -1;
1787
1788         gd.keyidx = gtk[0] & 0x3;
1789         gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1790                                                      !!(gtk[0] & BIT(2)));
1791         gtk += 2;
1792         gtk_len -= 2;
1793
1794         os_memcpy(gd.gtk, gtk, gtk_len);
1795         gd.gtk_len = gtk_len;
1796
1797         if (wpa_supplicant_check_group_cipher(sm->group_cipher,
1798                                               gtk_len, gtk_len,
1799                                               &gd.key_rsc_len, &gd.alg) ||
1800             wpa_supplicant_install_gtk(sm, &gd, key->key_rsc)) {
1801                 wpa_printf(MSG_DEBUG, "RSN: Failed to install GTK");
1802                 return -1;
1803         }
1804
1805         wpa_supplicant_key_neg_complete(sm, sm->bssid,
1806                                         key_info & WPA_KEY_INFO_SECURE);
1807         return 0;
1808 #else /* CONFIG_NO_WPA2 */
1809         return -1;
1810 #endif /* CONFIG_NO_WPA2 */
1811 }
1812
1813
1814 static int ieee80211w_set_keys(struct wpa_sm *sm,
1815                                struct wpa_eapol_ie_parse *ie)
1816 {
1817 #ifdef CONFIG_IEEE80211W
1818         if (sm->mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC)
1819                 return 0;
1820
1821         if (ie->igtk) {
1822                 const struct wpa_igtk_kde *igtk;
1823                 u16 keyidx;
1824                 if (ie->igtk_len != sizeof(*igtk))
1825                         return -1;
1826                 igtk = (const struct wpa_igtk_kde *) ie->igtk;
1827                 keyidx = WPA_GET_LE16(igtk->keyid);
1828                 wpa_printf(MSG_DEBUG, "WPA: IGTK keyid %d "
1829                            "pn %02x%02x%02x%02x%02x%02x",
1830                            keyidx, MAC2STR(igtk->pn));
1831                 wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
1832                                 igtk->igtk, WPA_IGTK_LEN);
1833                 if (keyidx > 4095) {
1834                         wpa_printf(MSG_WARNING, "WPA: Invalid IGTK KeyID %d",
1835                                    keyidx);
1836                         return -1;
1837                 }
1838                 if (wpa_sm_set_key(sm, WPA_ALG_IGTK,
1839                                    (u8 *) "\xff\xff\xff\xff\xff\xff",
1840                                    keyidx, 0, igtk->pn, sizeof(igtk->pn),
1841                                    igtk->igtk, WPA_IGTK_LEN) < 0) {
1842                         wpa_printf(MSG_WARNING, "WPA: Failed to configure IGTK"
1843                                    " to the driver");
1844                         return -1;
1845                 }
1846         }
1847
1848         if (ie->dhv) {
1849                 const struct wpa_dhv_kde *dhv;
1850                 if (ie->dhv_len != sizeof(*dhv))
1851                         return -1;
1852                 dhv = (const struct wpa_dhv_kde *) ie->dhv;
1853                 wpa_hexdump_key(MSG_DEBUG, "WPA: DHV", dhv->dhv, WPA_DHV_LEN);
1854                 if (wpa_sm_set_key(sm, WPA_ALG_DHV,
1855                                    (u8 *) "\xff\xff\xff\xff\xff\xff", 0, 0,
1856                                    NULL, 0, dhv->dhv, WPA_DHV_LEN) < 0) {
1857                         wpa_printf(MSG_WARNING, "WPA: Failed to configure DHV "
1858                                    "to the driver");
1859                         return -1;
1860                 }
1861         }
1862
1863         return 0;
1864 #else /* CONFIG_IEEE80211W */
1865         return 0;
1866 #endif /* CONFIG_IEEE80211W */
1867 }
1868
1869
1870 static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1871                                    const char *reason, const u8 *src_addr,
1872                                    const u8 *wpa_ie, size_t wpa_ie_len,
1873                                    const u8 *rsn_ie, size_t rsn_ie_len)
1874 {
1875         wpa_msg(sm->ctx->ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
1876                 reason, MAC2STR(src_addr));
1877
1878         if (sm->ap_wpa_ie) {
1879                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1880                             sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1881         }
1882         if (wpa_ie) {
1883                 if (!sm->ap_wpa_ie) {
1884                         wpa_printf(MSG_INFO, "WPA: No WPA IE in "
1885                                    "Beacon/ProbeResp");
1886                 }
1887                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1888                             wpa_ie, wpa_ie_len);
1889         }
1890
1891         if (sm->ap_rsn_ie) {
1892                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1893                             sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1894         }
1895         if (rsn_ie) {
1896                 if (!sm->ap_rsn_ie) {
1897                         wpa_printf(MSG_INFO, "WPA: No RSN IE in "
1898                                    "Beacon/ProbeResp");
1899                 }
1900                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1901                             rsn_ie, rsn_ie_len);
1902         }
1903
1904         wpa_sm_disassociate(sm, REASON_IE_IN_4WAY_DIFFERS);
1905 }
1906
1907
1908 static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1909                                       const unsigned char *src_addr,
1910                                       struct wpa_eapol_ie_parse *ie)
1911 {
1912         struct wpa_ssid *ssid = sm->cur_ssid;
1913
1914         if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
1915                 wpa_printf(MSG_DEBUG, "WPA: No WPA/RSN IE for this AP known. "
1916                            "Trying to get from scan results");
1917                 if (wpa_sm_get_beacon_ie(sm) < 0) {
1918                         wpa_printf(MSG_WARNING, "WPA: Could not find AP from "
1919                                    "the scan results");
1920                 } else {
1921                         wpa_printf(MSG_DEBUG, "WPA: Found the current AP from "
1922                                    "updated scan results");
1923                 }
1924         }
1925
1926         if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1927             (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1928                 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1929                                        "with IE in Beacon/ProbeResp (no IE?)",
1930                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1931                                        ie->rsn_ie, ie->rsn_ie_len);
1932                 return -1;
1933         }
1934
1935         if ((ie->wpa_ie && sm->ap_wpa_ie &&
1936              (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1937               os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1938             (ie->rsn_ie && sm->ap_rsn_ie &&
1939              (ie->rsn_ie_len != sm->ap_rsn_ie_len ||
1940               os_memcmp(ie->rsn_ie, sm->ap_rsn_ie, ie->rsn_ie_len) != 0))) {
1941                 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1942                                        "with IE in Beacon/ProbeResp",
1943                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1944                                        ie->rsn_ie, ie->rsn_ie_len);
1945                 return -1;
1946         }
1947
1948         if (sm->proto == WPA_PROTO_WPA &&
1949             ie->rsn_ie && sm->ap_rsn_ie == NULL &&
1950             ssid && (ssid->proto & WPA_PROTO_RSN)) {
1951                 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1952                                        "detected - RSN was enabled and RSN IE "
1953                                        "was in msg 3/4, but not in "
1954                                        "Beacon/ProbeResp",
1955                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1956                                        ie->rsn_ie, ie->rsn_ie_len);
1957                 return -1;
1958         }
1959
1960         return 0;
1961 }
1962
1963
1964 static int wpa_supplicant_send_4_of_4(struct wpa_sm *sm,
1965                                       const unsigned char *dst,
1966                                       const struct wpa_eapol_key *key,
1967                                       u16 ver, u16 key_info,
1968                                       const u8 *kde, size_t kde_len,
1969                                       struct wpa_ptk *ptk)
1970 {
1971         size_t rlen;
1972         struct wpa_eapol_key *reply;
1973         u8 *rbuf;
1974
1975         if (kde)
1976                 wpa_hexdump(MSG_DEBUG, "WPA: KDE for msg 4/4", kde, kde_len);
1977
1978         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1979                                   sizeof(*reply) + kde_len,
1980                                   &rlen, (void *) &reply);
1981         if (rbuf == NULL)
1982                 return -1;
1983
1984         reply->type = sm->proto == WPA_PROTO_RSN ?
1985                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1986         key_info &= WPA_KEY_INFO_SECURE;
1987         key_info |= ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_MIC;
1988         WPA_PUT_BE16(reply->key_info, key_info);
1989         if (sm->proto == WPA_PROTO_RSN)
1990                 WPA_PUT_BE16(reply->key_length, 0);
1991         else
1992                 os_memcpy(reply->key_length, key->key_length, 2);
1993         os_memcpy(reply->replay_counter, key->replay_counter,
1994                   WPA_REPLAY_COUNTER_LEN);
1995
1996         WPA_PUT_BE16(reply->key_data_length, kde_len);
1997         if (kde)
1998                 os_memcpy(reply + 1, kde, kde_len);
1999
2000         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
2001         wpa_eapol_key_send(sm, ptk->kck, ver, dst, ETH_P_EAPOL,
2002                            rbuf, rlen, reply->key_mic);
2003
2004         return 0;
2005 }
2006
2007
2008 static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
2009                                           const struct wpa_eapol_key *key,
2010                                           u16 ver)
2011 {
2012         u16 key_info, keylen, len;
2013         const u8 *pos;
2014         struct wpa_eapol_ie_parse ie;
2015
2016         wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
2017         wpa_printf(MSG_DEBUG, "WPA: RX message 3 of 4-Way Handshake from "
2018                    MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
2019
2020         key_info = WPA_GET_BE16(key->key_info);
2021
2022         pos = (const u8 *) (key + 1);
2023         len = WPA_GET_BE16(key->key_data_length);
2024         wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", pos, len);
2025         wpa_supplicant_parse_ies(pos, len, &ie);
2026         if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2027                 wpa_printf(MSG_WARNING, "WPA: GTK IE in unencrypted key data");
2028                 return;
2029         }
2030 #ifdef CONFIG_IEEE80211W
2031         if ((ie.dhv || ie.igtk) && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2032                 wpa_printf(MSG_WARNING, "WPA: DHV/IGTK KDE in unencrypted key "
2033                            "data");
2034                 return;
2035         }
2036
2037         if (ie.dhv && ie.dhv_len != sizeof(struct wpa_dhv_kde)) {
2038                 wpa_printf(MSG_WARNING, "WPA: Invalid DHV KDE length %lu",
2039                            (unsigned long) ie.dhv_len);
2040                 return;
2041         }
2042
2043         if (ie.igtk && ie.igtk_len != sizeof(struct wpa_igtk_kde)) {
2044                 wpa_printf(MSG_WARNING, "WPA: Invalid IGTK KDE length %lu",
2045                            (unsigned long) ie.igtk_len);
2046                 return;
2047         }
2048 #endif /* CONFIG_IEEE80211W */
2049
2050         if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
2051                 return;
2052
2053         if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
2054                 wpa_printf(MSG_WARNING, "WPA: ANonce from message 1 of 4-Way "
2055                            "Handshake differs from 3 of 4-Way Handshake - drop"
2056                            " packet (src=" MACSTR ")", MAC2STR(sm->bssid));
2057                 return;
2058         }
2059
2060         keylen = WPA_GET_BE16(key->key_length);
2061         switch (sm->pairwise_cipher) {
2062         case WPA_CIPHER_CCMP:
2063                 if (keylen != 16) {
2064                         wpa_printf(MSG_WARNING, "WPA: Invalid CCMP key length "
2065                                    "%d (src=" MACSTR ")",
2066                                    keylen, MAC2STR(sm->bssid));
2067                         return;
2068                 }
2069                 break;
2070         case WPA_CIPHER_TKIP:
2071                 if (keylen != 32) {
2072                         wpa_printf(MSG_WARNING, "WPA: Invalid TKIP key length "
2073                                    "%d (src=" MACSTR ")",
2074                                    keylen, MAC2STR(sm->bssid));
2075                         return;
2076                 }
2077                 break;
2078         }
2079
2080         if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
2081                                        NULL, 0, &sm->ptk))
2082                 return;
2083
2084         /* SNonce was successfully used in msg 3/4, so mark it to be renewed
2085          * for the next 4-Way Handshake. If msg 3 is received again, the old
2086          * SNonce will still be used to avoid changing PTK. */
2087         sm->renew_snonce = 1;
2088
2089         if (key_info & WPA_KEY_INFO_INSTALL) {
2090                 wpa_supplicant_install_ptk(sm, key);
2091         }
2092
2093         if (key_info & WPA_KEY_INFO_SECURE) {
2094                 wpa_sm_mlme_setprotection(
2095                         sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
2096                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
2097                 eapol_sm_notify_portValid(sm->eapol, TRUE);
2098         }
2099         wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
2100
2101         if (ie.gtk &&
2102             wpa_supplicant_pairwise_gtk(sm, key,
2103                                         ie.gtk, ie.gtk_len, key_info) < 0) {
2104                 wpa_printf(MSG_INFO, "RSN: Failed to configure GTK");
2105         }
2106
2107         if (ieee80211w_set_keys(sm, &ie) < 0)
2108                 wpa_printf(MSG_INFO, "RSN: Failed to configure DHV/IGTK");
2109 }
2110
2111
2112 #ifdef CONFIG_PEERKEY
2113 static void wpa_supplicant_smk_timeout(void *eloop_ctx, void *timeout_ctx)
2114 {
2115 #if 0
2116         struct wpa_sm *sm = eloop_ctx;
2117         struct wpa_peerkey *peerkey = timeout_ctx;
2118 #endif
2119         /* TODO: time out SMK and any STK that was generated using this SMK */
2120 }
2121
2122
2123 static void wpa_supplicant_peerkey_free(struct wpa_sm *sm,
2124                                         struct wpa_peerkey *peerkey)
2125 {
2126         eloop_cancel_timeout(wpa_supplicant_smk_timeout, sm, peerkey);
2127         os_free(peerkey);
2128 }
2129
2130
2131 static int wpa_supplicant_send_smk_error(struct wpa_sm *sm, const u8 *dst,
2132                                          const u8 *peer,
2133                                          u16 mui, u16 error_type, int ver)
2134 {
2135 #ifndef CONFIG_NO_WPA2
2136         size_t rlen;
2137         struct wpa_eapol_key *err;
2138         struct rsn_error_kde error;
2139         u8 *rbuf, *pos;
2140         size_t kde_len;
2141         u16 key_info;
2142
2143         kde_len = 2 + RSN_SELECTOR_LEN + sizeof(error);
2144         if (peer)
2145                 kde_len += 2 + RSN_SELECTOR_LEN + ETH_ALEN;
2146
2147         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
2148                                   NULL, sizeof(*err) + kde_len, &rlen,
2149                                   (void *) &err);
2150         if (rbuf == NULL)
2151                 return -1;
2152
2153         err->type = EAPOL_KEY_TYPE_RSN;
2154         key_info = ver | WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
2155                 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_ERROR |
2156                 WPA_KEY_INFO_REQUEST;
2157         WPA_PUT_BE16(err->key_info, key_info);
2158         WPA_PUT_BE16(err->key_length, 0);
2159         os_memcpy(err->replay_counter, sm->request_counter,
2160                   WPA_REPLAY_COUNTER_LEN);
2161         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
2162
2163         WPA_PUT_BE16(err->key_data_length, (u16) kde_len);
2164         pos = (u8 *) (err + 1);
2165
2166         if (peer) {
2167                 /* Peer MAC Address KDE */
2168                 pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peer, ETH_ALEN);
2169         }
2170
2171         /* Error KDE */
2172         error.mui = host_to_be16(mui);
2173         error.error_type = host_to_be16(error_type);
2174         pos = wpa_add_kde(pos, RSN_KEY_DATA_ERROR,
2175                           (u8 *) &error, sizeof(error));
2176
2177         if (peer) {
2178                 wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK Error (peer "
2179                            MACSTR " mui %d error_type %d)",
2180                            MAC2STR(peer), mui, error_type);
2181         } else {
2182                 wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK Error "
2183                            "(mui %d error_type %d)", mui, error_type);
2184         }
2185
2186         wpa_eapol_key_send(sm, sm->ptk.kck, ver, dst, ETH_P_EAPOL,
2187                            rbuf, rlen, err->key_mic);
2188
2189         return 0;
2190 #else /* CONFIG_NO_WPA2 */
2191         return -1;
2192 #endif /* CONFIG_NO_WPA2 */
2193 }
2194
2195
2196 static int wpa_supplicant_send_smk_m3(struct wpa_sm *sm,
2197                                       const unsigned char *src_addr,
2198                                       const struct wpa_eapol_key *key,
2199                                       int ver, struct wpa_peerkey *peerkey)
2200 {
2201         size_t rlen;
2202         struct wpa_eapol_key *reply;
2203         u8 *rbuf, *pos;
2204         size_t kde_len;
2205         u16 key_info;
2206
2207         /* KDEs: Peer RSN IE, Initiator MAC Address, Initiator Nonce */
2208         kde_len = peerkey->rsnie_p_len +
2209                 2 + RSN_SELECTOR_LEN + ETH_ALEN +
2210                 2 + RSN_SELECTOR_LEN + WPA_NONCE_LEN;
2211
2212         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
2213                                   NULL, sizeof(*reply) + kde_len, &rlen,
2214                                   (void *) &reply);
2215         if (rbuf == NULL)
2216                 return -1;
2217
2218         reply->type = EAPOL_KEY_TYPE_RSN;
2219         key_info = ver | WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
2220                 WPA_KEY_INFO_SECURE;
2221         WPA_PUT_BE16(reply->key_info, key_info);
2222         WPA_PUT_BE16(reply->key_length, 0);
2223         os_memcpy(reply->replay_counter, key->replay_counter,
2224                   WPA_REPLAY_COUNTER_LEN);
2225
2226         os_memcpy(reply->key_nonce, peerkey->pnonce, WPA_NONCE_LEN);
2227
2228         WPA_PUT_BE16(reply->key_data_length, (u16) kde_len);
2229         pos = (u8 *) (reply + 1);
2230
2231         /* Peer RSN IE */
2232         pos = wpa_add_ie(pos, peerkey->rsnie_p, peerkey->rsnie_p_len);
2233
2234         /* Initiator MAC Address KDE */
2235         pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peerkey->addr, ETH_ALEN);
2236
2237         /* Initiator Nonce */
2238         pos = wpa_add_kde(pos, RSN_KEY_DATA_NONCE,
2239                           peerkey->inonce, WPA_NONCE_LEN);
2240
2241         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK M3");
2242         wpa_eapol_key_send(sm, sm->ptk.kck, ver, src_addr, ETH_P_EAPOL,
2243                            rbuf, rlen, reply->key_mic);
2244
2245         return 0;
2246 }
2247
2248
2249 static int wpa_supplicant_process_smk_m2(
2250         struct wpa_sm *sm, const unsigned char *src_addr,
2251         const struct wpa_eapol_key *key, size_t extra_len, int ver)
2252 {
2253         struct wpa_ssid *ssid = sm->cur_ssid;
2254         struct wpa_peerkey *peerkey;
2255         struct wpa_eapol_ie_parse kde;
2256         struct wpa_ie_data ie;
2257         int cipher;
2258         struct rsn_ie_hdr *hdr;
2259         u8 *pos;
2260
2261         wpa_printf(MSG_DEBUG, "RSN: Received SMK M2");
2262
2263         if (ssid == NULL || !ssid->peerkey || sm->proto != WPA_PROTO_RSN) {
2264                 wpa_printf(MSG_INFO, "RSN: SMK handshake not allowed for "
2265                            "the current network");
2266                 return -1;
2267         }
2268
2269         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
2270             0) {
2271                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK M2");
2272                 return -1;
2273         }
2274
2275         if (kde.rsn_ie == NULL || kde.mac_addr == NULL ||
2276             kde.mac_addr_len < ETH_ALEN) {
2277                 wpa_printf(MSG_INFO, "RSN: No RSN IE or MAC address KDE in "
2278                            "SMK M2");
2279                 return -1;
2280         }
2281
2282         wpa_printf(MSG_DEBUG, "RSN: SMK M2 - SMK initiator " MACSTR,
2283                    MAC2STR(kde.mac_addr));
2284
2285         if (kde.rsn_ie_len > PEERKEY_MAX_IE_LEN) {
2286                 wpa_printf(MSG_INFO, "RSN: Too long Initiator RSN IE in SMK "
2287                            "M2");
2288                 return -1;
2289         }
2290
2291         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2292                 wpa_printf(MSG_INFO, "RSN: Failed to parse RSN IE in SMK M2");
2293                 return -1;
2294         }
2295
2296         cipher = ie.pairwise_cipher & ssid->pairwise_cipher;
2297         if (cipher & WPA_CIPHER_CCMP) {
2298                 wpa_printf(MSG_DEBUG, "RSN: Using CCMP for PeerKey");
2299                 cipher = WPA_CIPHER_CCMP;
2300         } else if (cipher & WPA_CIPHER_TKIP) {
2301                 wpa_printf(MSG_DEBUG, "RSN: Using TKIP for PeerKey");
2302                 cipher = WPA_CIPHER_TKIP;
2303         } else {
2304                 wpa_printf(MSG_INFO, "RSN: No acceptable cipher in SMK M2");
2305                 wpa_supplicant_send_smk_error(sm, src_addr, kde.mac_addr,
2306                                               STK_MUI_SMK, STK_ERR_CPHR_NS,
2307                                               ver);
2308                 return -1;
2309         }
2310
2311         /* TODO: find existing entry and if found, use that instead of adding
2312          * a new one; how to handle the case where both ends initiate at the
2313          * same time? */
2314         peerkey = os_malloc(sizeof(*peerkey));
2315         if (peerkey == NULL)
2316                 return -1;
2317         os_memset(peerkey, 0, sizeof(*peerkey));
2318         os_memcpy(peerkey->addr, kde.mac_addr, ETH_ALEN);
2319         os_memcpy(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN);
2320         os_memcpy(peerkey->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
2321         peerkey->rsnie_i_len = kde.rsn_ie_len;
2322         peerkey->cipher = cipher;
2323
2324         if (hostapd_get_rand(peerkey->pnonce, WPA_NONCE_LEN)) {
2325                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2326                         "WPA: Failed to get random data for PNonce");
2327                 wpa_supplicant_peerkey_free(sm, peerkey);
2328                 return -1;
2329         }
2330
2331         hdr = (struct rsn_ie_hdr *) peerkey->rsnie_p;
2332         hdr->elem_id = RSN_INFO_ELEM;
2333         WPA_PUT_LE16(hdr->version, RSN_VERSION);
2334         pos = (u8 *) (hdr + 1);
2335         /* Group Suite can be anything for SMK RSN IE; receiver will just
2336          * ignore it. */
2337         os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
2338         pos += RSN_SELECTOR_LEN;
2339         /* Include only the selected cipher in pairwise cipher suite */
2340         WPA_PUT_LE16(pos, 1);
2341         pos += 2;
2342         if (cipher == WPA_CIPHER_CCMP)
2343                 os_memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
2344         else if (cipher == WPA_CIPHER_TKIP)
2345                 os_memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
2346         pos += RSN_SELECTOR_LEN;
2347
2348         hdr->len = (pos - peerkey->rsnie_p) - 2;
2349         peerkey->rsnie_p_len = pos - peerkey->rsnie_p;
2350         wpa_hexdump(MSG_DEBUG, "WPA: RSN IE for SMK handshake",
2351                     peerkey->rsnie_p, peerkey->rsnie_p_len);
2352
2353         wpa_supplicant_send_smk_m3(sm, src_addr, key, ver, peerkey);
2354
2355         peerkey->next = sm->peerkey;
2356         sm->peerkey = peerkey;
2357
2358         return 0;
2359 }
2360
2361
2362 /**
2363  * rsn_smkid - Derive SMK identifier
2364  * @smk: Station master key (32 bytes)
2365  * @pnonce: Peer Nonce
2366  * @mac_p: Peer MAC address
2367  * @inonce: Initiator Nonce
2368  * @mac_i: Initiator MAC address
2369  *
2370  * 8.5.1.4 Station to station (STK) key hierarchy
2371  * SMKID = HMAC-SHA1-128(SMK, "SMK Name" || PNonce || MAC_P || INonce || MAC_I)
2372  */
2373 static void rsn_smkid(const u8 *smk, const u8 *pnonce, const u8 *mac_p,
2374                       const u8 *inonce, const u8 *mac_i, u8 *smkid)
2375 {
2376         char *title = "SMK Name";
2377         const u8 *addr[5];
2378         const size_t len[5] = { 8, WPA_NONCE_LEN, ETH_ALEN, WPA_NONCE_LEN,
2379                                 ETH_ALEN };
2380         unsigned char hash[SHA1_MAC_LEN];
2381
2382         addr[0] = (u8 *) title;
2383         addr[1] = pnonce;
2384         addr[2] = mac_p;
2385         addr[3] = inonce;
2386         addr[4] = mac_i;
2387
2388         hmac_sha1_vector(smk, PMK_LEN, 5, addr, len, hash);
2389         os_memcpy(smkid, hash, PMKID_LEN);
2390 }
2391
2392
2393 static void wpa_supplicant_send_stk_1_of_4(struct wpa_sm *sm,
2394                                            struct wpa_peerkey *peerkey)
2395 {
2396         size_t mlen;
2397         struct wpa_eapol_key *msg;
2398         u8 *mbuf;
2399         size_t kde_len;
2400         u16 key_info, ver;
2401
2402         kde_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN;
2403
2404         mbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
2405                                   sizeof(*msg) + kde_len, &mlen,
2406                                   (void *) &msg);
2407         if (mbuf == NULL)
2408                 return;
2409
2410         msg->type = EAPOL_KEY_TYPE_RSN;
2411
2412         if (peerkey->cipher == WPA_CIPHER_CCMP)
2413                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
2414         else
2415                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
2416
2417         key_info = ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_ACK;
2418         WPA_PUT_BE16(msg->key_info, key_info);
2419
2420         if (peerkey->cipher == WPA_CIPHER_CCMP)
2421                 WPA_PUT_BE16(msg->key_length, 16);
2422         else
2423                 WPA_PUT_BE16(msg->key_length, 32);
2424
2425         os_memcpy(msg->replay_counter, peerkey->replay_counter,
2426                   WPA_REPLAY_COUNTER_LEN);
2427         inc_byte_array(peerkey->replay_counter, WPA_REPLAY_COUNTER_LEN);
2428
2429         WPA_PUT_BE16(msg->key_data_length, kde_len);
2430         wpa_add_kde((u8 *) (msg + 1), RSN_KEY_DATA_PMKID,
2431                     peerkey->smkid, PMKID_LEN);
2432
2433         if (hostapd_get_rand(peerkey->inonce, WPA_NONCE_LEN)) {
2434                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2435                         "RSN: Failed to get random data for INonce (STK)");
2436                 os_free(mbuf);
2437                 return;
2438         }
2439         wpa_hexdump(MSG_DEBUG, "RSN: INonce for STK 4-Way Handshake",
2440                     peerkey->inonce, WPA_NONCE_LEN);
2441         os_memcpy(msg->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
2442
2443         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key STK 1/4 to " MACSTR,
2444                    MAC2STR(peerkey->addr));
2445         wpa_eapol_key_send(sm, NULL, ver, peerkey->addr, ETH_P_EAPOL,
2446                            mbuf, mlen, NULL);
2447 }
2448
2449
2450 static void wpa_supplicant_send_stk_3_of_4(struct wpa_sm *sm,
2451                                            struct wpa_peerkey *peerkey)
2452 {
2453         size_t mlen;
2454         struct wpa_eapol_key *msg;
2455         u8 *mbuf, *pos;
2456         size_t kde_len;
2457         u16 key_info, ver;
2458         u32 lifetime;
2459
2460         kde_len = peerkey->rsnie_i_len +
2461                 2 + RSN_SELECTOR_LEN + sizeof(lifetime);
2462
2463         mbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
2464                                   sizeof(*msg) + kde_len, &mlen,
2465                                   (void *) &msg);
2466         if (mbuf == NULL)
2467                 return;
2468
2469         msg->type = EAPOL_KEY_TYPE_RSN;
2470
2471         if (peerkey->cipher == WPA_CIPHER_CCMP)
2472                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
2473         else
2474                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
2475
2476         key_info = ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_ACK |
2477                 WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE;
2478         WPA_PUT_BE16(msg->key_info, key_info);
2479
2480         if (peerkey->cipher == WPA_CIPHER_CCMP)
2481                 WPA_PUT_BE16(msg->key_length, 16);
2482         else
2483                 WPA_PUT_BE16(msg->key_length, 32);
2484
2485         os_memcpy(msg->replay_counter, peerkey->replay_counter,
2486                   WPA_REPLAY_COUNTER_LEN);
2487         inc_byte_array(peerkey->replay_counter, WPA_REPLAY_COUNTER_LEN);
2488
2489         WPA_PUT_BE16(msg->key_data_length, kde_len);
2490         pos = (u8 *) (msg + 1);
2491         pos = wpa_add_ie(pos, peerkey->rsnie_i, peerkey->rsnie_i_len);
2492         lifetime = host_to_be32(peerkey->lifetime);
2493         pos = wpa_add_kde(pos, RSN_KEY_DATA_LIFETIME,
2494                           (u8 *) &lifetime, sizeof(lifetime));
2495
2496         os_memcpy(msg->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
2497
2498         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key STK 3/4 to " MACSTR,
2499                    MAC2STR(peerkey->addr));
2500         wpa_eapol_key_send(sm, peerkey->stk.kck, ver, peerkey->addr,
2501                            ETH_P_EAPOL, mbuf, mlen, msg->key_mic);
2502 }
2503
2504
2505 static int wpa_supplicant_process_smk_m45(
2506         struct wpa_sm *sm, const unsigned char *src_addr,
2507         const struct wpa_eapol_key *key, size_t extra_len, int ver)
2508 {
2509         struct wpa_ssid *ssid = sm->cur_ssid;
2510         struct wpa_peerkey *peerkey;
2511         struct wpa_eapol_ie_parse kde;
2512         u32 lifetime;
2513         struct os_time now;
2514         struct wpa_ie_data ie;
2515
2516         if (ssid == NULL || !ssid->peerkey || sm->proto != WPA_PROTO_RSN) {
2517                 wpa_printf(MSG_DEBUG, "RSN: SMK handshake not allowed for "
2518                            "the current network");
2519                 return -1;
2520         }
2521
2522         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
2523             0) {
2524                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK M4/M5");
2525                 return -1;
2526         }
2527
2528         if (kde.mac_addr == NULL || kde.mac_addr_len < ETH_ALEN ||
2529             kde.nonce == NULL || kde.nonce_len < WPA_NONCE_LEN ||
2530             kde.smk == NULL || kde.smk_len < PMK_LEN + WPA_NONCE_LEN ||
2531             kde.lifetime == NULL || kde.lifetime_len < 4) {
2532                 wpa_printf(MSG_INFO, "RSN: No MAC Address, Nonce, SMK, or "
2533                            "Lifetime KDE in SMK M4/M5");
2534                 return -1;
2535         }
2536
2537         for (peerkey = sm->peerkey; peerkey; peerkey = peerkey->next) {
2538                 if (os_memcmp(peerkey->addr, kde.mac_addr, ETH_ALEN) == 0 &&
2539                     os_memcmp(peerkey->initiator ? peerkey->inonce :
2540                            peerkey->pnonce,
2541                            key->key_nonce, WPA_NONCE_LEN) == 0)
2542                         break;
2543         }
2544         if (peerkey == NULL) {
2545                 wpa_printf(MSG_INFO, "RSN: No matching SMK handshake found "
2546                            "for SMK M4/M5: peer " MACSTR,
2547                            MAC2STR(kde.mac_addr));
2548                 return -1;
2549         }
2550
2551         if (peerkey->initiator) {
2552                 int cipher;
2553                 wpa_printf(MSG_DEBUG, "RSN: Received SMK M5 (Peer " MACSTR ")",
2554                            MAC2STR(kde.mac_addr));
2555                 if (kde.rsn_ie == NULL || kde.rsn_ie_len > PEERKEY_MAX_IE_LEN
2556                     || wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) <
2557                     0) {
2558                         wpa_printf(MSG_INFO, "RSN: No RSN IE in SMK M5");
2559                         /* TODO: abort negotiation */
2560                         return -1;
2561                 }
2562
2563                 if (os_memcmp(key->key_nonce, peerkey->inonce, WPA_NONCE_LEN)
2564                     != 0) {
2565                         wpa_printf(MSG_INFO, "RSN: Key Nonce in SMK M5 does "
2566                                    "not match with INonce used in SMK M1");
2567                         return -1;
2568                 }
2569
2570                 if (os_memcmp(kde.smk + PMK_LEN, peerkey->inonce,
2571                               WPA_NONCE_LEN) != 0) {
2572                         wpa_printf(MSG_INFO, "RSN: INonce in SMK KDE does not "
2573                                    "match with the one used in SMK M1");
2574                         return -1;
2575                 }
2576
2577                 os_memcpy(peerkey->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
2578                 peerkey->rsnie_p_len = kde.rsn_ie_len;
2579                 os_memcpy(peerkey->pnonce, kde.nonce, WPA_NONCE_LEN);
2580
2581                 cipher = ie.pairwise_cipher & ssid->pairwise_cipher;
2582                 if (cipher & WPA_CIPHER_CCMP) {
2583                         wpa_printf(MSG_DEBUG, "RSN: Using CCMP for PeerKey");
2584                         peerkey->cipher = WPA_CIPHER_CCMP;
2585                 } else if (cipher & WPA_CIPHER_TKIP) {
2586                         wpa_printf(MSG_DEBUG, "RSN: Using TKIP for PeerKey");
2587                         peerkey->cipher = WPA_CIPHER_TKIP;
2588                 } else {
2589                         wpa_printf(MSG_INFO, "RSN: SMK Peer STA " MACSTR
2590                                    " selected unacceptable cipher",
2591                                    MAC2STR(kde.mac_addr));
2592                         wpa_supplicant_send_smk_error(
2593                                 sm, src_addr, kde.mac_addr,
2594                                 STK_MUI_SMK, STK_ERR_CPHR_NS, ver);
2595                         /* TODO: abort negotiation */
2596                         return -1;
2597                 }
2598         } else {
2599                 wpa_printf(MSG_DEBUG, "RSN: Received SMK M4 (Initiator "
2600                            MACSTR ")", MAC2STR(kde.mac_addr));
2601
2602                 if (os_memcmp(kde.smk + PMK_LEN, peerkey->pnonce,
2603                               WPA_NONCE_LEN) != 0) {
2604                         wpa_printf(MSG_INFO, "RSN: PNonce in SMK KDE does not "
2605                                    "match with the one used in SMK M3");
2606                         return -1;
2607                 }
2608
2609                 if (os_memcmp(kde.nonce, peerkey->inonce, WPA_NONCE_LEN) != 0)
2610                 {
2611                         wpa_printf(MSG_INFO, "RSN: INonce in SMK M5 did not "
2612                                    "match with the one received in SMK M2");
2613                         return -1;
2614                 }
2615         }
2616
2617         os_memcpy(peerkey->smk, kde.smk, PMK_LEN);
2618         peerkey->smk_complete = 1;
2619         wpa_hexdump_key(MSG_DEBUG, "RSN: SMK", peerkey->smk, PMK_LEN);
2620         lifetime = WPA_GET_BE32(kde.lifetime);
2621         wpa_printf(MSG_DEBUG, "RSN: SMK lifetime %u seconds", lifetime);
2622         if (lifetime > 1000000000)
2623                 lifetime = 1000000000; /* avoid overflowing expiration time */
2624         peerkey->lifetime = lifetime;
2625         os_get_time(&now);
2626         peerkey->expiration = now.sec + lifetime;
2627         eloop_register_timeout(lifetime, 0, wpa_supplicant_smk_timeout,
2628                                sm, peerkey);
2629
2630         if (peerkey->initiator) {
2631                 rsn_smkid(peerkey->smk, peerkey->pnonce, peerkey->addr,
2632                           peerkey->inonce, sm->own_addr, peerkey->smkid);
2633                 wpa_supplicant_send_stk_1_of_4(sm, peerkey);
2634         } else {
2635                 rsn_smkid(peerkey->smk, peerkey->pnonce, sm->own_addr,
2636                           peerkey->inonce, peerkey->addr, peerkey->smkid);
2637         }
2638         wpa_hexdump(MSG_DEBUG, "RSN: SMKID", peerkey->smkid, PMKID_LEN);
2639
2640         return 0;
2641 }
2642
2643
2644 static int wpa_supplicant_process_smk_error(
2645         struct wpa_sm *sm, const unsigned char *src_addr,
2646         const struct wpa_eapol_key *key, size_t extra_len)
2647 {
2648         struct wpa_ssid *ssid = sm->cur_ssid;
2649         struct wpa_eapol_ie_parse kde;
2650         struct rsn_error_kde error;
2651         u8 peer[ETH_ALEN];
2652         u16 error_type;
2653
2654         wpa_printf(MSG_DEBUG, "RSN: Received SMK Error");
2655
2656         if (ssid == NULL || !ssid->peerkey || sm->proto != WPA_PROTO_RSN) {
2657                 wpa_printf(MSG_DEBUG, "RSN: SMK handshake not allowed for "
2658                            "the current network");
2659                 return -1;
2660         }
2661
2662         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
2663             0) {
2664                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK Error");
2665                 return -1;
2666         }
2667
2668         if (kde.error == NULL || kde.error_len < sizeof(error)) {
2669                 wpa_printf(MSG_INFO, "RSN: No Error KDE in SMK Error");
2670                 return -1;
2671         }
2672
2673         if (kde.mac_addr && kde.mac_addr_len >= ETH_ALEN)
2674                 os_memcpy(peer, kde.mac_addr, ETH_ALEN);
2675         os_memcpy(&error, kde.error, sizeof(error));
2676         error_type = be_to_host16(error.error_type);
2677         wpa_msg(sm->ctx->ctx, MSG_INFO,
2678                 "RSN: SMK Error KDE received: MUI %d error_type %d peer "
2679                 MACSTR,
2680                 be_to_host16(error.mui), error_type,
2681                 MAC2STR(peer));
2682
2683         if (kde.mac_addr &&
2684             (error_type == STK_ERR_STA_NR || error_type == STK_ERR_STA_NRSN ||
2685              error_type == STK_ERR_CPHR_NS)) {
2686                 struct wpa_peerkey *peerkey;
2687
2688                 for (peerkey = sm->peerkey; peerkey; peerkey = peerkey->next) {
2689                         if (os_memcmp(peerkey->addr, kde.mac_addr, ETH_ALEN) ==
2690                             0)
2691                                 break;
2692                 }
2693                 if (peerkey == NULL) {
2694                         wpa_printf(MSG_DEBUG, "RSN: No matching SMK handshake "
2695                                    "found for SMK Error");
2696                         return -1;
2697                 }
2698                 /* TODO: abort SMK/STK handshake and remove all related keys */
2699         }
2700
2701         return 0;
2702 }
2703
2704
2705 static void wpa_supplicant_process_stk_1_of_4(struct wpa_sm *sm,
2706                                               struct wpa_peerkey *peerkey,
2707                                               const struct wpa_eapol_key *key,
2708                                               u16 ver)
2709 {
2710         struct wpa_eapol_ie_parse ie;
2711         const u8 *kde;
2712         size_t len, kde_buf_len;
2713         struct wpa_ptk *stk;
2714         u8 buf[8], *kde_buf, *pos;
2715         u32 lifetime;
2716
2717         wpa_printf(MSG_DEBUG, "RSN: RX message 1 of STK 4-Way Handshake from "
2718                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
2719
2720         os_memset(&ie, 0, sizeof(ie));
2721
2722         /* RSN: msg 1/4 should contain SMKID for the selected SMK */
2723         kde = (const u8 *) (key + 1);
2724         len = WPA_GET_BE16(key->key_data_length);
2725         wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data", kde, len);
2726         if (wpa_supplicant_parse_ies(kde, len, &ie) < 0 || ie.pmkid == NULL) {
2727                 wpa_printf(MSG_DEBUG, "RSN: No SMKID in STK 1/4");
2728                 return;
2729         }
2730         if (os_memcmp(ie.pmkid, peerkey->smkid, PMKID_LEN) != 0) {
2731                 wpa_hexdump(MSG_DEBUG, "RSN: Unknown SMKID in STK 1/4",
2732                             ie.pmkid, PMKID_LEN);
2733                 return;
2734         }
2735
2736         if (hostapd_get_rand(peerkey->pnonce, WPA_NONCE_LEN)) {
2737                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2738                         "RSN: Failed to get random data for PNonce");
2739                 return;
2740         }
2741         wpa_hexdump(MSG_DEBUG, "WPA: Renewed PNonce",
2742                     peerkey->pnonce, WPA_NONCE_LEN);
2743
2744         /* Calculate STK which will be stored as a temporary STK until it has
2745          * been verified when processing message 3/4. */
2746         stk = &peerkey->tstk;
2747         wpa_pmk_to_ptk(peerkey->smk, PMK_LEN, "Peer key expansion",
2748                        sm->own_addr, peerkey->addr,
2749                        peerkey->pnonce, key->key_nonce,
2750                        (u8 *) stk, sizeof(*stk));
2751         /* Supplicant: swap tx/rx Mic keys */
2752         os_memcpy(buf, stk->u.auth.tx_mic_key, 8);
2753         os_memcpy(stk->u.auth.tx_mic_key, stk->u.auth.rx_mic_key, 8);
2754         os_memcpy(stk->u.auth.rx_mic_key, buf, 8);
2755         peerkey->tstk_set = 1;
2756
2757         kde_buf_len = peerkey->rsnie_p_len +
2758                 2 + RSN_SELECTOR_LEN + sizeof(lifetime) +
2759                 2 + RSN_SELECTOR_LEN + PMKID_LEN;
2760         kde_buf = os_malloc(kde_buf_len);
2761         if (kde_buf == NULL)
2762                 return;
2763         pos = kde_buf;
2764         pos = wpa_add_ie(pos, peerkey->rsnie_p, peerkey->rsnie_p_len);
2765         lifetime = host_to_be32(peerkey->lifetime);
2766         pos = wpa_add_kde(pos, RSN_KEY_DATA_LIFETIME,
2767                           (u8 *) &lifetime, sizeof(lifetime));
2768         pos = wpa_add_kde(pos, RSN_KEY_DATA_PMKID, peerkey->smkid, PMKID_LEN);
2769
2770         if (wpa_supplicant_send_2_of_4(sm, peerkey->addr, key, ver,
2771                                        peerkey->pnonce, kde_buf, kde_buf_len,
2772                                        stk)) {
2773                 os_free(kde_buf);
2774                 return;
2775         }
2776         os_free(kde_buf);
2777
2778         os_memcpy(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN);
2779 }
2780
2781
2782 static void wpa_supplicant_update_smk_lifetime(struct wpa_sm *sm,
2783                                                struct wpa_peerkey *peerkey,
2784                                                struct wpa_eapol_ie_parse *kde)
2785 {
2786         u32 lifetime;
2787         struct os_time now;
2788
2789         if (kde->lifetime == NULL || kde->lifetime_len < sizeof(lifetime))
2790                 return;
2791
2792         lifetime = WPA_GET_BE32(kde->lifetime);
2793
2794         if (lifetime >= peerkey->lifetime) {
2795                 wpa_printf(MSG_DEBUG, "RSN: Peer used SMK lifetime %u seconds "
2796                            "which is larger than or equal to own value %u "
2797                            "seconds - ignored", lifetime, peerkey->lifetime);
2798                 return;
2799         }
2800
2801         wpa_printf(MSG_DEBUG, "RSN: Peer used shorter SMK lifetime %u seconds "
2802                    "(own was %u seconds) - updated",
2803                    lifetime, peerkey->lifetime);
2804         peerkey->lifetime = lifetime;
2805
2806         os_get_time(&now);
2807         peerkey->expiration = now.sec + lifetime;
2808         eloop_cancel_timeout(wpa_supplicant_smk_timeout, sm, peerkey);
2809         eloop_register_timeout(lifetime, 0, wpa_supplicant_smk_timeout,
2810                                sm, peerkey);
2811 }
2812
2813
2814 static void wpa_supplicant_process_stk_2_of_4(struct wpa_sm *sm,
2815                                               struct wpa_peerkey *peerkey,
2816                                               const struct wpa_eapol_key *key,
2817                                               u16 ver)
2818 {
2819         struct wpa_eapol_ie_parse kde;
2820         const u8 *keydata;
2821         size_t len;
2822
2823         wpa_printf(MSG_DEBUG, "RSN: RX message 2 of STK 4-Way Handshake from "
2824                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
2825
2826         os_memset(&kde, 0, sizeof(kde));
2827
2828         /* RSN: msg 2/4 should contain SMKID for the selected SMK and RSN IE
2829          * from the peer. It may also include Lifetime KDE. */
2830         keydata = (const u8 *) (key + 1);
2831         len = WPA_GET_BE16(key->key_data_length);
2832         wpa_hexdump(MSG_DEBUG, "RSN: msg 2/4 key data", keydata, len);
2833         if (wpa_supplicant_parse_ies(keydata, len, &kde) < 0 ||
2834             kde.pmkid == NULL || kde.rsn_ie == NULL) {
2835                 wpa_printf(MSG_DEBUG, "RSN: No SMKID or RSN IE in STK 2/4");
2836                 return;
2837         }
2838
2839         if (os_memcmp(kde.pmkid, peerkey->smkid, PMKID_LEN) != 0) {
2840                 wpa_hexdump(MSG_DEBUG, "RSN: Unknown SMKID in STK 2/4",
2841                             kde.pmkid, PMKID_LEN);
2842                 return;
2843         }
2844
2845         if (kde.rsn_ie_len != peerkey->rsnie_p_len ||
2846             os_memcmp(kde.rsn_ie, peerkey->rsnie_p, kde.rsn_ie_len) != 0) {
2847                 wpa_printf(MSG_INFO, "RSN: Peer RSN IE in SMK and STK "
2848                            "handshakes did not match");
2849                 wpa_hexdump(MSG_DEBUG, "RSN: Peer RSN IE in SMK handshake",
2850                             peerkey->rsnie_p, peerkey->rsnie_p_len);
2851                 wpa_hexdump(MSG_DEBUG, "RSN: Peer RSN IE in STK handshake",
2852                             kde.rsn_ie, kde.rsn_ie_len);
2853                 return;
2854         }
2855
2856         wpa_supplicant_update_smk_lifetime(sm, peerkey, &kde);
2857
2858         wpa_supplicant_send_stk_3_of_4(sm, peerkey);
2859         os_memcpy(peerkey->pnonce, key->key_nonce, WPA_NONCE_LEN);
2860 }
2861
2862
2863 static void wpa_supplicant_process_stk_3_of_4(struct wpa_sm *sm,
2864                                               struct wpa_peerkey *peerkey,
2865                                               const struct wpa_eapol_key *key,
2866                                               u16 ver)
2867 {
2868         struct wpa_eapol_ie_parse kde;
2869         const u8 *keydata;
2870         size_t len, key_len;
2871         const u8 *_key;
2872         u8 key_buf[32], rsc[6];
2873
2874         wpa_printf(MSG_DEBUG, "RSN: RX message 3 of STK 4-Way Handshake from "
2875                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
2876
2877         os_memset(&kde, 0, sizeof(kde));
2878
2879         /* RSN: msg 3/4 should contain Initiator RSN IE. It may also include
2880          * Lifetime KDE. */
2881         keydata = (const u8 *) (key + 1);
2882         len = WPA_GET_BE16(key->key_data_length);
2883         wpa_hexdump(MSG_DEBUG, "RSN: msg 3/4 key data", keydata, len);
2884         if (wpa_supplicant_parse_ies(keydata, len, &kde) < 0) {
2885                 wpa_printf(MSG_DEBUG, "RSN: Failed to parse key data in "
2886                            "STK 3/4");
2887                 return;
2888         }
2889
2890         if (kde.rsn_ie_len != peerkey->rsnie_i_len ||
2891             os_memcmp(kde.rsn_ie, peerkey->rsnie_i, kde.rsn_ie_len) != 0) {
2892                 wpa_printf(MSG_INFO, "RSN: Initiator RSN IE in SMK and STK "
2893                            "handshakes did not match");
2894                 wpa_hexdump(MSG_DEBUG, "RSN: Initiator RSN IE in SMK "
2895                             "handshake",
2896                             peerkey->rsnie_i, peerkey->rsnie_i_len);
2897                 wpa_hexdump(MSG_DEBUG, "RSN: Initiator RSN IE in STK "
2898                             "handshake",
2899                             kde.rsn_ie, kde.rsn_ie_len);
2900                 return;
2901         }
2902
2903         if (os_memcmp(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
2904                 wpa_printf(MSG_WARNING, "RSN: INonce from message 1 of STK "
2905                            "4-Way Handshake differs from 3 of STK 4-Way "
2906                            "Handshake - drop packet (src=" MACSTR ")",
2907                            MAC2STR(peerkey->addr));
2908                 return;
2909         }
2910
2911         wpa_supplicant_update_smk_lifetime(sm, peerkey, &kde);
2912
2913         if (wpa_supplicant_send_4_of_4(sm, peerkey->addr, key, ver,
2914                                        WPA_GET_BE16(key->key_info),
2915                                        NULL, 0, &peerkey->stk))
2916                 return;
2917
2918         _key = (u8 *) peerkey->stk.tk1;
2919         if (peerkey->cipher == WPA_CIPHER_TKIP) {
2920                 /* Swap Tx/Rx keys for Michael MIC */
2921                 os_memcpy(key_buf, _key, 16);
2922                 os_memcpy(key_buf + 16, _key + 24, 8);
2923                 os_memcpy(key_buf + 24, _key + 16, 8);
2924                 _key = key_buf;
2925                 key_len = 32;
2926         } else
2927                 key_len = 16;
2928
2929         os_memset(rsc, 0, 6);
2930         if (wpa_sm_set_key(sm, peerkey->cipher, peerkey->addr, 0, 1,
2931                            rsc, sizeof(rsc), _key, key_len) < 0) {
2932                 wpa_printf(MSG_WARNING, "RSN: Failed to set STK to the "
2933                            "driver.");
2934                 return;
2935         }
2936 }
2937
2938
2939 static void wpa_supplicant_process_stk_4_of_4(struct wpa_sm *sm,
2940                                               struct wpa_peerkey *peerkey,
2941                                               const struct wpa_eapol_key *key,
2942                                               u16 ver)
2943 {
2944         u8 rsc[6];
2945
2946         wpa_printf(MSG_DEBUG, "RSN: RX message 4 of STK 4-Way Handshake from "
2947                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
2948
2949         os_memset(rsc, 0, 6);
2950         if (wpa_sm_set_key(sm, peerkey->cipher, peerkey->addr, 0, 1,
2951                            rsc, sizeof(rsc), (u8 *) peerkey->stk.tk1,
2952                            peerkey->cipher == WPA_CIPHER_TKIP ? 32 : 16) < 0) {
2953                 wpa_printf(MSG_WARNING, "RSN: Failed to set STK to the "
2954                            "driver.");
2955                 return;
2956         }
2957 }
2958 #endif /* CONFIG_PEERKEY */
2959
2960
2961 static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
2962                                              const u8 *keydata,
2963                                              size_t keydatalen,
2964                                              u16 key_info,
2965                                              struct wpa_gtk_data *gd)
2966 {
2967         int maxkeylen;
2968         struct wpa_eapol_ie_parse ie;
2969
2970         wpa_hexdump(MSG_DEBUG, "RSN: msg 1/2 key data", keydata, keydatalen);
2971         wpa_supplicant_parse_ies(keydata, keydatalen, &ie);
2972         if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2973                 wpa_printf(MSG_WARNING, "WPA: GTK IE in unencrypted key data");
2974                 return -1;
2975         }
2976         if (ie.gtk == NULL) {
2977                 wpa_printf(MSG_INFO, "WPA: No GTK IE in Group Key msg 1/2");
2978                 return -1;
2979         }
2980         maxkeylen = gd->gtk_len = ie.gtk_len - 2;
2981
2982         if (wpa_supplicant_check_group_cipher(sm->group_cipher,
2983                                               gd->gtk_len, maxkeylen,
2984                                               &gd->key_rsc_len, &gd->alg))
2985                 return -1;
2986
2987         wpa_hexdump(MSG_DEBUG, "RSN: received GTK in group key handshake",
2988                     ie.gtk, ie.gtk_len);
2989         gd->keyidx = ie.gtk[0] & 0x3;
2990         gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
2991                                                       !!(ie.gtk[0] & BIT(2)));
2992         if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
2993                 wpa_printf(MSG_INFO, "RSN: Too long GTK in GTK IE "
2994                            "(len=%lu)", (unsigned long) ie.gtk_len - 2);
2995                 return -1;
2996         }
2997         os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
2998
2999         if (ieee80211w_set_keys(sm, &ie) < 0)
3000                 wpa_printf(MSG_INFO, "RSN: Failed to configure DHV/IGTK");
3001
3002         return 0;
3003 }
3004
3005
3006 static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
3007                                              const struct wpa_eapol_key *key,
3008                                              size_t keydatalen, int key_info,
3009                                              size_t extra_len, u16 ver,
3010                                              struct wpa_gtk_data *gd)
3011 {
3012         size_t maxkeylen;
3013         u8 ek[32];
3014
3015         gd->gtk_len = WPA_GET_BE16(key->key_length);
3016         maxkeylen = keydatalen;
3017         if (keydatalen > extra_len) {
3018                 wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
3019                            " key_data_length=%lu > extra_len=%lu",
3020                            (unsigned long) keydatalen,
3021                            (unsigned long) extra_len);
3022                 return -1;
3023         }
3024         if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3025                 if (maxkeylen < 8) {
3026                         wpa_printf(MSG_INFO, "WPA: Too short maxkeylen (%lu)",
3027                                    (unsigned long) maxkeylen);
3028                         return -1;
3029                 }
3030                 maxkeylen -= 8;
3031         }
3032
3033         if (wpa_supplicant_check_group_cipher(sm->group_cipher,
3034                                               gd->gtk_len, maxkeylen,
3035                                               &gd->key_rsc_len, &gd->alg))
3036                 return -1;
3037
3038         gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
3039                 WPA_KEY_INFO_KEY_INDEX_SHIFT;
3040         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
3041                 os_memcpy(ek, key->key_iv, 16);
3042                 os_memcpy(ek + 16, sm->ptk.kek, 16);
3043                 if (keydatalen > sizeof(gd->gtk)) {
3044                         wpa_printf(MSG_WARNING, "WPA: RC4 key data "
3045                                    "too long (%lu)",
3046                                    (unsigned long) keydatalen);
3047                         return -1;
3048                 }
3049                 os_memcpy(gd->gtk, key + 1, keydatalen);
3050                 rc4_skip(ek, 32, 256, gd->gtk, keydatalen);
3051         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3052                 if (keydatalen % 8) {
3053                         wpa_printf(MSG_WARNING, "WPA: Unsupported AES-WRAP "
3054                                    "len %lu", (unsigned long) keydatalen);
3055                         return -1;
3056                 }
3057                 if (maxkeylen > sizeof(gd->gtk)) {
3058                         wpa_printf(MSG_WARNING, "WPA: AES-WRAP key data "
3059                                    "too long (keydatalen=%lu maxkeylen=%lu)",
3060                                    (unsigned long) keydatalen,
3061                                    (unsigned long) maxkeylen);
3062                         return -1;
3063                 }
3064                 if (aes_unwrap(sm->ptk.kek, maxkeylen / 8,
3065                                (const u8 *) (key + 1), gd->gtk)) {
3066                         wpa_printf(MSG_WARNING, "WPA: AES unwrap "
3067                                    "failed - could not decrypt GTK");
3068                         return -1;
3069                 }
3070         }
3071         gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
3072                 sm, !!(key_info & WPA_KEY_INFO_TXRX));
3073         return 0;
3074 }
3075
3076
3077 static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
3078                                       const struct wpa_eapol_key *key,
3079                                       int ver, u16 key_info)
3080 {
3081         size_t rlen;
3082         struct wpa_eapol_key *reply;
3083         u8 *rbuf;
3084
3085         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
3086                                   sizeof(*reply), &rlen, (void *) &reply);
3087         if (rbuf == NULL)
3088                 return -1;
3089
3090         reply->type = sm->proto == WPA_PROTO_RSN ?
3091                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
3092         key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
3093         key_info |= ver | WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE;
3094         WPA_PUT_BE16(reply->key_info, key_info);
3095         if (sm->proto == WPA_PROTO_RSN)
3096                 WPA_PUT_BE16(reply->key_length, 0);
3097         else
3098                 os_memcpy(reply->key_length, key->key_length, 2);
3099         os_memcpy(reply->replay_counter, key->replay_counter,
3100                   WPA_REPLAY_COUNTER_LEN);
3101
3102         WPA_PUT_BE16(reply->key_data_length, 0);
3103
3104         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
3105         wpa_eapol_key_send(sm, sm->ptk.kck, ver, sm->bssid, ETH_P_EAPOL,
3106                            rbuf, rlen, reply->key_mic);
3107
3108         return 0;
3109 }
3110
3111
3112 static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
3113                                           const unsigned char *src_addr,
3114                                           const struct wpa_eapol_key *key,
3115                                           int extra_len, u16 ver)
3116 {
3117         u16 key_info, keydatalen;
3118         int rekey, ret;
3119         struct wpa_gtk_data gd;
3120
3121         os_memset(&gd, 0, sizeof(gd));
3122
3123         rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
3124         wpa_printf(MSG_DEBUG, "WPA: RX message 1 of Group Key Handshake from "
3125                    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
3126
3127         key_info = WPA_GET_BE16(key->key_info);
3128         keydatalen = WPA_GET_BE16(key->key_data_length);
3129
3130         if (sm->proto == WPA_PROTO_RSN) {
3131                 ret = wpa_supplicant_process_1_of_2_rsn(sm,
3132                                                         (const u8 *) (key + 1),
3133                                                         keydatalen, key_info,
3134                                                         &gd);
3135         } else {
3136                 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, keydatalen,
3137                                                         key_info, extra_len,
3138                                                         ver, &gd);
3139         }
3140
3141         wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
3142
3143         if (ret)
3144                 return;
3145
3146         if (wpa_supplicant_install_gtk(sm, &gd, key->key_rsc) ||
3147             wpa_supplicant_send_2_of_2(sm, key, ver, key_info))
3148                 return;
3149
3150         if (rekey) {
3151                 wpa_msg(sm->ctx->ctx, MSG_INFO, "WPA: Group rekeying "
3152                         "completed with " MACSTR " [GTK=%s]",
3153                         MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
3154                 wpa_sm_set_state(sm, WPA_COMPLETED);
3155         } else {
3156                 wpa_supplicant_key_neg_complete(sm, sm->bssid,
3157                                                 key_info &
3158                                                 WPA_KEY_INFO_SECURE);
3159         }
3160 }
3161
3162
3163 static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
3164                                                struct wpa_eapol_key *key,
3165                                                u16 ver,
3166                                                const u8 *buf, size_t len)
3167 {
3168         u8 mic[16];
3169         int ok = 0;
3170
3171         os_memcpy(mic, key->key_mic, 16);
3172         if (sm->tptk_set) {
3173                 os_memset(key->key_mic, 0, 16);
3174                 wpa_eapol_key_mic(sm->tptk.kck, ver, buf, len,
3175                                   key->key_mic);
3176                 if (os_memcmp(mic, key->key_mic, 16) != 0) {
3177                         wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
3178                                    "when using TPTK - ignoring TPTK");
3179                 } else {
3180                         ok = 1;
3181                         sm->tptk_set = 0;
3182                         sm->ptk_set = 1;
3183                         os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
3184                 }
3185         }
3186
3187         if (!ok && sm->ptk_set) {
3188                 os_memset(key->key_mic, 0, 16);
3189                 wpa_eapol_key_mic(sm->ptk.kck, ver, buf, len,
3190                                   key->key_mic);
3191                 if (os_memcmp(mic, key->key_mic, 16) != 0) {
3192                         wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
3193                                    "- dropping packet");
3194                         return -1;
3195                 }
3196                 ok = 1;
3197         }
3198
3199         if (!ok) {
3200                 wpa_printf(MSG_WARNING, "WPA: Could not verify EAPOL-Key MIC "
3201                            "- dropping packet");
3202                 return -1;
3203         }
3204
3205         os_memcpy(sm->rx_replay_counter, key->replay_counter,
3206                   WPA_REPLAY_COUNTER_LEN);
3207         sm->rx_replay_counter_set = 1;
3208         return 0;
3209 }
3210
3211
3212 #ifdef CONFIG_PEERKEY
3213 static int wpa_supplicant_verify_eapol_key_mic_peerkey(
3214         struct wpa_sm *sm, struct wpa_peerkey *peerkey,
3215         struct wpa_eapol_key *key, u16 ver, const u8 *buf, size_t len)
3216 {
3217         u8 mic[16];
3218         int ok = 0;
3219
3220         if (peerkey->initiator && !peerkey->stk_set) {
3221                 wpa_pmk_to_ptk(peerkey->smk, PMK_LEN, "Peer key expansion",
3222                                sm->own_addr, peerkey->addr,
3223                                peerkey->inonce, key->key_nonce,
3224                                (u8 *) &peerkey->stk, sizeof(peerkey->stk));
3225                 peerkey->stk_set = 1;
3226         }
3227
3228         os_memcpy(mic, key->key_mic, 16);
3229         if (peerkey->tstk_set) {
3230                 os_memset(key->key_mic, 0, 16);
3231                 wpa_eapol_key_mic(peerkey->tstk.kck, ver, buf, len,
3232                                   key->key_mic);
3233                 if (os_memcmp(mic, key->key_mic, 16) != 0) {
3234                         wpa_printf(MSG_WARNING, "RSN: Invalid EAPOL-Key MIC "
3235                                    "when using TSTK - ignoring TSTK");
3236                 } else {
3237                         ok = 1;
3238                         peerkey->tstk_set = 0;
3239                         peerkey->stk_set = 1;
3240                         os_memcpy(&peerkey->stk, &peerkey->tstk,
3241                                   sizeof(peerkey->stk));
3242                 }
3243         }
3244
3245         if (!ok && peerkey->stk_set) {
3246                 os_memset(key->key_mic, 0, 16);
3247                 wpa_eapol_key_mic(peerkey->stk.kck, ver, buf, len,
3248                                   key->key_mic);
3249                 if (os_memcmp(mic, key->key_mic, 16) != 0) {
3250                         wpa_printf(MSG_WARNING, "RSN: Invalid EAPOL-Key MIC "
3251                                    "- dropping packet");
3252                         return -1;
3253                 }
3254                 ok = 1;
3255         }
3256
3257         if (!ok) {
3258                 wpa_printf(MSG_WARNING, "RSN: Could not verify EAPOL-Key MIC "
3259                            "- dropping packet");
3260                 return -1;
3261         }
3262
3263         os_memcpy(peerkey->replay_counter, key->replay_counter,
3264                   WPA_REPLAY_COUNTER_LEN);
3265         peerkey->replay_counter_set = 1;
3266         return 0;
3267 }
3268 #endif /* CONFIG_PEERKEY */
3269
3270
3271 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
3272 static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
3273                                            struct wpa_eapol_key *key, u16 ver)
3274 {
3275         u16 keydatalen = WPA_GET_BE16(key->key_data_length);
3276
3277         wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
3278                     (u8 *) (key + 1), keydatalen);
3279         if (!sm->ptk_set) {
3280                 wpa_printf(MSG_WARNING, "WPA: PTK not available, "
3281                            "cannot decrypt EAPOL-Key key data.");
3282                 return -1;
3283         }
3284
3285         /* Decrypt key data here so that this operation does not need
3286          * to be implemented separately for each message type. */
3287         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
3288                 u8 ek[32];
3289                 os_memcpy(ek, key->key_iv, 16);
3290                 os_memcpy(ek + 16, sm->ptk.kek, 16);
3291                 rc4_skip(ek, 32, 256, (u8 *) (key + 1), keydatalen);
3292         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3293                 u8 *buf;
3294                 if (keydatalen % 8) {
3295                         wpa_printf(MSG_WARNING, "WPA: Unsupported "
3296                                    "AES-WRAP len %d", keydatalen);
3297                         return -1;
3298                 }
3299                 keydatalen -= 8; /* AES-WRAP adds 8 bytes */
3300                 buf = os_malloc(keydatalen);
3301                 if (buf == NULL) {
3302                         wpa_printf(MSG_WARNING, "WPA: No memory for "
3303                                    "AES-UNWRAP buffer");
3304                         return -1;
3305                 }
3306                 if (aes_unwrap(sm->ptk.kek, keydatalen / 8,
3307                                (u8 *) (key + 1), buf)) {
3308                         os_free(buf);
3309                         wpa_printf(MSG_WARNING, "WPA: AES unwrap failed - "
3310                                    "could not decrypt EAPOL-Key key data");
3311                         return -1;
3312                 }
3313                 os_memcpy(key + 1, buf, keydatalen);
3314                 os_free(buf);
3315                 WPA_PUT_BE16(key->key_data_length, keydatalen);
3316         }
3317         wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
3318                         (u8 *) (key + 1), keydatalen);
3319         return 0;
3320 }
3321
3322
3323 /**
3324  * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
3325  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3326  */
3327 void wpa_sm_aborted_cached(struct wpa_sm *sm)
3328 {
3329         if (sm && sm->cur_pmksa) {
3330                 wpa_printf(MSG_DEBUG, "RSN: Cancelling PMKSA caching attempt");
3331                 sm->cur_pmksa = NULL;
3332         }
3333 }
3334
3335
3336 static void wpa_eapol_key_dump(const struct wpa_eapol_key *key)
3337 {
3338 #ifndef CONFIG_NO_STDOUT_DEBUG
3339         u16 key_info = WPA_GET_BE16(key->key_info);
3340
3341         wpa_printf(MSG_DEBUG, "  EAPOL-Key type=%d", key->type);
3342         wpa_printf(MSG_DEBUG, "  key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s"
3343                    "%s%s%s%s%s%s%s)",
3344                    key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
3345                    (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
3346                    WPA_KEY_INFO_KEY_INDEX_SHIFT,
3347                    (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
3348                    key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
3349                    key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
3350                    key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
3351                    key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
3352                    key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
3353                    key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
3354                    key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
3355                    key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
3356         wpa_printf(MSG_DEBUG, "  key_length=%u key_data_length=%u",
3357                    WPA_GET_BE16(key->key_length),
3358                    WPA_GET_BE16(key->key_data_length));
3359         wpa_hexdump(MSG_DEBUG, "  replay_counter",
3360                     key->replay_counter, WPA_REPLAY_COUNTER_LEN);
3361         wpa_hexdump(MSG_DEBUG, "  key_nonce", key->key_nonce, WPA_NONCE_LEN);
3362         wpa_hexdump(MSG_DEBUG, "  key_iv", key->key_iv, 16);
3363         wpa_hexdump(MSG_DEBUG, "  key_rsc", key->key_rsc, 8);
3364         wpa_hexdump(MSG_DEBUG, "  key_id (reserved)", key->key_id, 8);
3365         wpa_hexdump(MSG_DEBUG, "  key_mic", key->key_mic, 16);
3366 #endif /* CONFIG_NO_STDOUT_DEBUG */
3367 }
3368
3369
3370 /**
3371  * wpa_sm_rx_eapol - Process received WPA EAPOL frames
3372  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3373  * @src_addr: Source MAC address of the EAPOL packet
3374  * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
3375  * @len: Length of the EAPOL frame
3376  * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
3377  *
3378  * This function is called for each received EAPOL frame. Other than EAPOL-Key
3379  * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
3380  * only processing WPA and WPA2 EAPOL-Key frames.
3381  *
3382  * The received EAPOL-Key packets are validated and valid packets are replied
3383  * to. In addition, key material (PTK, GTK) is configured at the end of a
3384  * successful key handshake.
3385  */
3386 int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
3387                     const u8 *buf, size_t len)
3388 {
3389         size_t plen, data_len, extra_len;
3390         struct ieee802_1x_hdr *hdr;
3391         struct wpa_eapol_key *key;
3392         u16 key_info, ver;
3393         u8 *tmp;
3394         int ret = -1;
3395         struct wpa_peerkey *peerkey = NULL;
3396
3397         if (len < sizeof(*hdr) + sizeof(*key)) {
3398                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame too short to be a WPA "
3399                            "EAPOL-Key (len %lu, expecting at least %lu)",
3400                            (unsigned long) len,
3401                            (unsigned long) sizeof(*hdr) + sizeof(*key));
3402                 return 0;
3403         }
3404
3405         tmp = os_malloc(len);
3406         if (tmp == NULL)
3407                 return -1;
3408         os_memcpy(tmp, buf, len);
3409
3410         hdr = (struct ieee802_1x_hdr *) tmp;
3411         key = (struct wpa_eapol_key *) (hdr + 1);
3412         plen = be_to_host16(hdr->length);
3413         data_len = plen + sizeof(*hdr);
3414         wpa_printf(MSG_DEBUG, "IEEE 802.1X RX: version=%d type=%d length=%lu",
3415                    hdr->version, hdr->type, (unsigned long) plen);
3416
3417         if (hdr->version < EAPOL_VERSION) {
3418                 /* TODO: backwards compatibility */
3419         }
3420         if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
3421                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame (type %u) discarded, "
3422                         "not a Key frame", hdr->type);
3423                 ret = 0;
3424                 goto out;
3425         }
3426         if (plen > len - sizeof(*hdr) || plen < sizeof(*key)) {
3427                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame payload size %lu "
3428                            "invalid (frame size %lu)",
3429                            (unsigned long) plen, (unsigned long) len);
3430                 ret = 0;
3431                 goto out;
3432         }
3433
3434         if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
3435         {
3436                 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key type (%d) unknown, "
3437                            "discarded", key->type);
3438                 ret = 0;
3439                 goto out;
3440         }
3441         wpa_eapol_key_dump(key);
3442
3443         eapol_sm_notify_lower_layer_success(sm->eapol);
3444         wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", tmp, len);
3445         if (data_len < len) {
3446                 wpa_printf(MSG_DEBUG, "WPA: ignoring %lu bytes after the IEEE "
3447                            "802.1X data", (unsigned long) len - data_len);
3448         }
3449         key_info = WPA_GET_BE16(key->key_info);
3450         ver = key_info & WPA_KEY_INFO_TYPE_MASK;
3451         if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
3452             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3453                 wpa_printf(MSG_INFO, "WPA: Unsupported EAPOL-Key descriptor "
3454                            "version %d.", ver);
3455                 goto out;
3456         }
3457
3458         if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
3459             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
3460                 wpa_printf(MSG_INFO, "WPA: CCMP is used, but EAPOL-Key "
3461                            "descriptor version (%d) is not 2.", ver);
3462                 if (sm->group_cipher != WPA_CIPHER_CCMP &&
3463                     !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
3464                         /* Earlier versions of IEEE 802.11i did not explicitly
3465                          * require version 2 descriptor for all EAPOL-Key
3466                          * packets, so allow group keys to use version 1 if
3467                          * CCMP is not used for them. */
3468                         wpa_printf(MSG_INFO, "WPA: Backwards compatibility: "
3469                                    "allow invalid version for non-CCMP group "
3470                                    "keys");
3471                 } else
3472                         goto out;
3473         }
3474
3475 #ifdef CONFIG_PEERKEY
3476         for (peerkey = sm->peerkey; peerkey; peerkey = peerkey->next) {
3477                 if (os_memcmp(peerkey->addr, src_addr, ETH_ALEN) == 0)
3478                         break;
3479         }
3480
3481         if (!(key_info & WPA_KEY_INFO_SMK_MESSAGE) && peerkey) {
3482                 if (!peerkey->initiator && peerkey->replay_counter_set &&
3483                     os_memcmp(key->replay_counter, peerkey->replay_counter,
3484                               WPA_REPLAY_COUNTER_LEN) <= 0) {
3485                         wpa_printf(MSG_WARNING, "RSN: EAPOL-Key Replay "
3486                                    "Counter did not increase (STK) - dropping "
3487                                    "packet");
3488                         goto out;
3489                 } else if (peerkey->initiator) {
3490                         u8 _tmp[WPA_REPLAY_COUNTER_LEN];
3491                         os_memcpy(_tmp, key->replay_counter,
3492                                   WPA_REPLAY_COUNTER_LEN);
3493                         inc_byte_array(_tmp, WPA_REPLAY_COUNTER_LEN);
3494                         if (os_memcmp(_tmp, peerkey->replay_counter,
3495                                       WPA_REPLAY_COUNTER_LEN) != 0) {
3496                                 wpa_printf(MSG_DEBUG, "RSN: EAPOL-Key Replay "
3497                                            "Counter did not match (STK) - "
3498                                            "dropping packet");
3499                                 goto out;
3500                         }
3501                 }
3502         }
3503
3504         if (peerkey && peerkey->initiator && (key_info & WPA_KEY_INFO_ACK)) {
3505                 wpa_printf(MSG_INFO, "RSN: Ack bit in key_info from STK peer");
3506                 goto out;
3507         }
3508 #endif /* CONFIG_PEERKEY */
3509
3510         if (!peerkey && sm->rx_replay_counter_set &&
3511             os_memcmp(key->replay_counter, sm->rx_replay_counter,
3512                       WPA_REPLAY_COUNTER_LEN) <= 0) {
3513                 wpa_printf(MSG_WARNING, "WPA: EAPOL-Key Replay Counter did not"
3514                            " increase - dropping packet");
3515                 goto out;
3516         }
3517
3518         if (!(key_info & (WPA_KEY_INFO_ACK | WPA_KEY_INFO_SMK_MESSAGE))
3519 #ifdef CONFIG_PEERKEY
3520             && (peerkey == NULL || !peerkey->initiator)
3521 #endif /* CONFIG_PEERKEY */
3522                 ) {
3523                 wpa_printf(MSG_INFO, "WPA: No Ack bit in key_info");
3524                 goto out;
3525         }
3526
3527         if (key_info & WPA_KEY_INFO_REQUEST) {
3528                 wpa_printf(MSG_INFO, "WPA: EAPOL-Key with Request bit - "
3529                            "dropped");
3530                 goto out;
3531         }
3532
3533         if ((key_info & WPA_KEY_INFO_MIC) && !peerkey &&
3534             wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
3535                 goto out;
3536
3537 #ifdef CONFIG_PEERKEY
3538         if ((key_info & WPA_KEY_INFO_MIC) && peerkey &&
3539             wpa_supplicant_verify_eapol_key_mic_peerkey(
3540                     sm, peerkey, key, ver, tmp, data_len))
3541                 goto out;
3542 #endif /* CONFIG_PEERKEY */
3543
3544         extra_len = data_len - sizeof(*hdr) - sizeof(*key);
3545
3546         if (WPA_GET_BE16(key->key_data_length) > extra_len) {
3547                 wpa_msg(sm->ctx->ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
3548                         "frame - key_data overflow (%d > %lu)",
3549                         WPA_GET_BE16(key->key_data_length),
3550                         (unsigned long) extra_len);
3551                 goto out;
3552         }
3553         extra_len = WPA_GET_BE16(key->key_data_length);
3554
3555         if (sm->proto == WPA_PROTO_RSN &&
3556             (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
3557                 if (wpa_supplicant_decrypt_key_data(sm, key, ver))
3558                         goto out;
3559                 extra_len = WPA_GET_BE16(key->key_data_length);
3560         }
3561
3562         if (key_info & WPA_KEY_INFO_KEY_TYPE) {
3563                 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
3564                         wpa_printf(MSG_WARNING, "WPA: Ignored EAPOL-Key "
3565                                    "(Pairwise) with non-zero key index");
3566                         goto out;
3567                 }
3568 #ifdef CONFIG_PEERKEY
3569                 if (peerkey) {
3570                         if ((key_info & (WPA_KEY_INFO_MIC | WPA_KEY_INFO_ACK))
3571                             == (WPA_KEY_INFO_MIC | WPA_KEY_INFO_ACK)) {
3572                                 /* 3/4 STK 4-Way Handshake */
3573                                 wpa_supplicant_process_stk_3_of_4(sm, peerkey,
3574                                                                   key, ver);
3575                         } else if (key_info & WPA_KEY_INFO_ACK) {
3576                                 /* 1/4 STK 4-Way Handshake */
3577                                 wpa_supplicant_process_stk_1_of_4(sm, peerkey,
3578                                                                   key, ver);
3579                         } else if (key_info & WPA_KEY_INFO_SECURE) {
3580                                 /* 4/4 STK 4-Way Handshake */
3581                                 wpa_supplicant_process_stk_4_of_4(sm, peerkey,
3582                                                                   key, ver);
3583                         } else {
3584                                 /* 2/4 STK 4-Way Handshake */
3585                                 wpa_supplicant_process_stk_2_of_4(sm, peerkey,
3586                                                                   key, ver);
3587                         }
3588                 } else
3589 #endif /* CONFIG_PEERKEY */
3590                 if (key_info & WPA_KEY_INFO_MIC) {
3591                         /* 3/4 4-Way Handshake */
3592                         wpa_supplicant_process_3_of_4(sm, key, ver);
3593                 } else {
3594                         /* 1/4 4-Way Handshake */
3595                         wpa_supplicant_process_1_of_4(sm, src_addr, key,
3596                                                       ver);
3597                 }
3598         } else if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
3599 #ifdef CONFIG_PEERKEY
3600                 if (key_info & WPA_KEY_INFO_ERROR) {
3601                         /* SMK Error */
3602                         wpa_supplicant_process_smk_error(sm, src_addr, key,
3603                                                          extra_len);
3604                 } else if (key_info & WPA_KEY_INFO_ACK) {
3605                         /* SMK M2 */
3606                         wpa_supplicant_process_smk_m2(sm, src_addr, key,
3607                                                       extra_len, ver);
3608                 } else {
3609                         /* SMK M4 or M5 */
3610                         wpa_supplicant_process_smk_m45(sm, src_addr, key,
3611                                                        extra_len, ver);
3612                 }
3613 #endif /* CONFIG_PEERKEY */
3614         } else {
3615                 if (key_info & WPA_KEY_INFO_MIC) {
3616                         /* 1/2 Group Key Handshake */
3617                         wpa_supplicant_process_1_of_2(sm, src_addr, key,
3618                                                       extra_len, ver);
3619                 } else {
3620                         wpa_printf(MSG_WARNING, "WPA: EAPOL-Key (Group) "
3621                                    "without Mic bit - dropped");
3622                 }
3623         }
3624
3625         ret = 1;
3626
3627 out:
3628         os_free(tmp);
3629         return ret;
3630 }
3631
3632
3633 #ifdef CONFIG_CTRL_IFACE
3634 static int wpa_cipher_bits(int cipher)
3635 {
3636         switch (cipher) {
3637         case WPA_CIPHER_CCMP:
3638                 return 128;
3639         case WPA_CIPHER_TKIP:
3640                 return 256;
3641         case WPA_CIPHER_WEP104:
3642                 return 104;
3643         case WPA_CIPHER_WEP40:
3644                 return 40;
3645         default:
3646                 return 0;
3647         }
3648 }
3649
3650
3651 static const u8 * wpa_key_mgmt_suite(struct wpa_sm *sm)
3652 {
3653         static const u8 *dummy = (u8 *) "\x00\x00\x00\x00";
3654         switch (sm->key_mgmt) {
3655         case WPA_KEY_MGMT_IEEE8021X:
3656                 return (sm->proto == WPA_PROTO_RSN ?
3657                         RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
3658                         WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
3659         case WPA_KEY_MGMT_PSK:
3660                 return (sm->proto == WPA_PROTO_RSN ?
3661                         RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
3662                         WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
3663         case WPA_KEY_MGMT_WPA_NONE:
3664                 return WPA_AUTH_KEY_MGMT_NONE;
3665         default:
3666                 return dummy;
3667         }
3668 }
3669
3670
3671 static const u8 * wpa_cipher_suite(struct wpa_sm *sm, int cipher)
3672 {
3673         static const u8 *dummy = (u8 *) "\x00\x00\x00\x00";
3674         switch (cipher) {
3675         case WPA_CIPHER_CCMP:
3676                 return (sm->proto == WPA_PROTO_RSN ?
3677                         RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
3678         case WPA_CIPHER_TKIP:
3679                 return (sm->proto == WPA_PROTO_RSN ?
3680                         RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
3681         case WPA_CIPHER_WEP104:
3682                 return (sm->proto == WPA_PROTO_RSN ?
3683                         RSN_CIPHER_SUITE_WEP104 : WPA_CIPHER_SUITE_WEP104);
3684         case WPA_CIPHER_WEP40:
3685                 return (sm->proto == WPA_PROTO_RSN ?
3686                         RSN_CIPHER_SUITE_WEP40 : WPA_CIPHER_SUITE_WEP40);
3687         case WPA_CIPHER_NONE:
3688                 return (sm->proto == WPA_PROTO_RSN ?
3689                         RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
3690         default:
3691                 return dummy;
3692         }
3693 }
3694
3695
3696 #define RSN_SUITE "%02x-%02x-%02x-%d"
3697 #define RSN_SUITE_ARG(s) (s)[0], (s)[1], (s)[2], (s)[3]
3698
3699 /**
3700  * wpa_sm_get_mib - Dump text list of MIB entries
3701  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3702  * @buf: Buffer for the list
3703  * @buflen: Length of the buffer
3704  * Returns: Number of bytes written to buffer
3705  *
3706  * This function is used fetch dot11 MIB variables.
3707  */
3708 int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
3709 {
3710         char pmkid_txt[PMKID_LEN * 2 + 1];
3711         int rsna, ret;
3712         size_t len;
3713
3714         if (sm->cur_pmksa) {
3715                 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
3716                                  sm->cur_pmksa->pmkid, PMKID_LEN);
3717         } else
3718                 pmkid_txt[0] = '\0';
3719
3720         if ((sm->key_mgmt == WPA_KEY_MGMT_PSK ||
3721              sm->key_mgmt == WPA_KEY_MGMT_IEEE8021X) &&
3722             sm->proto == WPA_PROTO_RSN)
3723                 rsna = 1;
3724         else
3725                 rsna = 0;
3726
3727         ret = os_snprintf(buf, buflen,
3728                           "dot11RSNAOptionImplemented=TRUE\n"
3729                           "dot11RSNAPreauthenticationImplemented=TRUE\n"
3730                           "dot11RSNAEnabled=%s\n"
3731                           "dot11RSNAPreauthenticationEnabled=%s\n"
3732                           "dot11RSNAConfigVersion=%d\n"
3733                           "dot11RSNAConfigPairwiseKeysSupported=5\n"
3734                           "dot11RSNAConfigGroupCipherSize=%d\n"
3735                           "dot11RSNAConfigPMKLifetime=%d\n"
3736                           "dot11RSNAConfigPMKReauthThreshold=%d\n"
3737                           "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
3738                           "dot11RSNAConfigSATimeout=%d\n",
3739                           rsna ? "TRUE" : "FALSE",
3740                           rsna ? "TRUE" : "FALSE",
3741                           RSN_VERSION,
3742                           wpa_cipher_bits(sm->group_cipher),
3743                           sm->dot11RSNAConfigPMKLifetime,
3744                           sm->dot11RSNAConfigPMKReauthThreshold,
3745                           sm->dot11RSNAConfigSATimeout);
3746         if (ret < 0 || (size_t) ret >= buflen)
3747                 return 0;
3748         len = ret;
3749
3750         ret = os_snprintf(
3751                 buf + len, buflen - len,
3752                 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
3753                 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
3754                 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
3755                 "dot11RSNAPMKIDUsed=%s\n"
3756                 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
3757                 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
3758                 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
3759                 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
3760                 "dot11RSNA4WayHandshakeFailures=%u\n",
3761                 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
3762                 RSN_SUITE_ARG(wpa_cipher_suite(sm, sm->pairwise_cipher)),
3763                 RSN_SUITE_ARG(wpa_cipher_suite(sm, sm->group_cipher)),
3764                 pmkid_txt,
3765                 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
3766                 RSN_SUITE_ARG(wpa_cipher_suite(sm, sm->pairwise_cipher)),
3767                 RSN_SUITE_ARG(wpa_cipher_suite(sm, sm->group_cipher)),
3768                 sm->dot11RSNA4WayHandshakeFailures);
3769         if (ret >= 0 && (size_t) ret < buflen)
3770                 len += ret;
3771
3772         return (int) len;
3773 }
3774 #endif /* CONFIG_CTRL_IFACE */
3775
3776
3777 static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
3778                                  void *ctx, int replace)
3779 {
3780         struct wpa_sm *sm = ctx;
3781
3782         if (sm->cur_pmksa == entry ||
3783             (sm->pmk_len == entry->pmk_len &&
3784              os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
3785                 wpa_printf(MSG_DEBUG, "RSN: removed current PMKSA entry");
3786                 sm->cur_pmksa = NULL;
3787
3788                 if (replace) {
3789                         /* A new entry is being added, so no need to
3790                          * deauthenticate in this case. This happens when EAP
3791                          * authentication is completed again (reauth or failed
3792                          * PMKSA caching attempt). */
3793                         return;
3794                 }
3795
3796                 os_memset(sm->pmk, 0, sizeof(sm->pmk));
3797                 wpa_sm_deauthenticate(sm, REASON_UNSPECIFIED);
3798         }
3799 }
3800
3801
3802 /**
3803  * wpa_sm_init - Initialize WPA state machine
3804  * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
3805  * Returns: Pointer to the allocated WPA state machine data
3806  *
3807  * This function is used to allocate a new WPA state machine and the returned
3808  * value is passed to all WPA state machine calls.
3809  */
3810 struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
3811 {
3812         struct wpa_sm *sm;
3813
3814         sm = os_zalloc(sizeof(*sm));
3815         if (sm == NULL)
3816                 return NULL;
3817         sm->renew_snonce = 1;
3818         sm->ctx = ctx;
3819
3820         sm->dot11RSNAConfigPMKLifetime = 43200;
3821         sm->dot11RSNAConfigPMKReauthThreshold = 70;
3822         sm->dot11RSNAConfigSATimeout = 60;
3823
3824         sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
3825         if (sm->pmksa == NULL) {
3826                 wpa_printf(MSG_ERROR, "RSN: PMKSA cache initialization "
3827                            "failed");
3828                 os_free(sm);
3829                 return NULL;
3830         }
3831
3832         return sm;
3833 }
3834
3835
3836 /**
3837  * wpa_sm_deinit - Deinitialize WPA state machine
3838  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3839  */
3840 void wpa_sm_deinit(struct wpa_sm *sm)
3841 {
3842         if (sm == NULL)
3843                 return;
3844         pmksa_cache_deinit(sm->pmksa);
3845         eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
3846         os_free(sm->assoc_wpa_ie);
3847         os_free(sm->ap_wpa_ie);
3848         os_free(sm->ap_rsn_ie);
3849         os_free(sm->ctx);
3850 #ifdef CONFIG_PEERKEY
3851         {
3852                 struct wpa_peerkey *prev, *peerkey = sm->peerkey;
3853                 while (peerkey) {
3854                         prev = peerkey;
3855                         peerkey = peerkey->next;
3856                         os_free(prev);
3857                 }
3858         }
3859 #endif /* CONFIG_PEERKEY */
3860         os_free(sm);
3861 }
3862
3863
3864 /**
3865  * wpa_sm_notify_assoc - Notify WPA state machine about association
3866  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3867  * @bssid: The BSSID of the new association
3868  *
3869  * This function is called to let WPA state machine know that the connection
3870  * was established.
3871  */
3872 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
3873 {
3874         if (sm == NULL)
3875                 return;
3876
3877         wpa_printf(MSG_DEBUG, "WPA: Association event - clear replay counter");
3878         os_memcpy(sm->bssid, bssid, ETH_ALEN);
3879         os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
3880         sm->rx_replay_counter_set = 0;
3881         sm->renew_snonce = 1;
3882         if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
3883                 rsn_preauth_deinit(sm);
3884 }
3885
3886
3887 /**
3888  * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
3889  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3890  *
3891  * This function is called to let WPA state machine know that the connection
3892  * was lost. This will abort any existing pre-authentication session.
3893  */
3894 void wpa_sm_notify_disassoc(struct wpa_sm *sm)
3895 {
3896         rsn_preauth_deinit(sm);
3897         if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
3898                 sm->dot11RSNA4WayHandshakeFailures++;
3899 }
3900
3901
3902 /**
3903  * wpa_sm_set_pmk - Set PMK
3904  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3905  * @pmk: The new PMK
3906  * @pmk_len: The length of the new PMK in bytes
3907  *
3908  * Configure the PMK for WPA state machine.
3909  */
3910 void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len)
3911 {
3912         if (sm == NULL)
3913                 return;
3914
3915         sm->pmk_len = pmk_len;
3916         os_memcpy(sm->pmk, pmk, pmk_len);
3917 }
3918
3919
3920 /**
3921  * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
3922  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3923  *
3924  * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
3925  * will be cleared.
3926  */
3927 void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
3928 {
3929         if (sm == NULL)
3930                 return;
3931
3932         if (sm->cur_pmksa) {
3933                 sm->pmk_len = sm->cur_pmksa->pmk_len;
3934                 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
3935         } else {
3936                 sm->pmk_len = PMK_LEN;
3937                 os_memset(sm->pmk, 0, PMK_LEN);
3938         }
3939 }
3940
3941
3942 /**
3943  * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
3944  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3945  * @fast_reauth: Whether fast reauthentication (EAP) is allowed
3946  */
3947 void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
3948 {
3949         if (sm)
3950                 sm->fast_reauth = fast_reauth;
3951 }
3952
3953
3954 /**
3955  * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
3956  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3957  * @scard_ctx: Context pointer for smartcard related callback functions
3958  */
3959 void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
3960 {
3961         if (sm == NULL)
3962                 return;
3963         sm->scard_ctx = scard_ctx;
3964         if (sm->preauth_eapol)
3965                 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
3966 }
3967
3968
3969 /**
3970  * wpa_sm_set_config - Notification of current configration change
3971  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3972  * @config: Pointer to current network configuration
3973  *
3974  * Notify WPA state machine that configuration has changed. config will be
3975  * stored as a backpointer to network configuration. This can be %NULL to clear
3976  * the stored pointed.
3977  */
3978 void wpa_sm_set_config(struct wpa_sm *sm, struct wpa_ssid *config)
3979 {
3980         if (sm) {
3981                 sm->cur_ssid = config;
3982                 pmksa_cache_notify_reconfig(sm->pmksa);
3983         }
3984 }
3985
3986
3987 /**
3988  * wpa_sm_set_own_addr - Set own MAC address
3989  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3990  * @addr: Own MAC address
3991  */
3992 void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
3993 {
3994         if (sm)
3995                 os_memcpy(sm->own_addr, addr, ETH_ALEN);
3996 }
3997
3998
3999 /**
4000  * wpa_sm_set_ifname - Set network interface name
4001  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4002  * @ifname: Interface name
4003  * @bridge_ifname: Optional bridge interface name (for pre-auth)
4004  */
4005 void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
4006                        const char *bridge_ifname)
4007 {
4008         if (sm) {
4009                 sm->ifname = ifname;
4010                 sm->bridge_ifname = bridge_ifname;
4011         }
4012 }
4013
4014
4015 /**
4016  * wpa_sm_set_eapol - Set EAPOL state machine pointer
4017  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4018  * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
4019  */
4020 void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
4021 {
4022         if (sm)
4023                 sm->eapol = eapol;
4024 }
4025
4026
4027 /**
4028  * wpa_sm_set_param - Set WPA state machine parameters
4029  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4030  * @param: Parameter field
4031  * @value: Parameter value
4032  * Returns: 0 on success, -1 on failure
4033  */
4034 int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
4035                      unsigned int value)
4036 {
4037         int ret = 0;
4038
4039         if (sm == NULL)
4040                 return -1;
4041
4042         switch (param) {
4043         case RSNA_PMK_LIFETIME:
4044                 if (value > 0)
4045                         sm->dot11RSNAConfigPMKLifetime = value;
4046                 else
4047                         ret = -1;
4048                 break;
4049         case RSNA_PMK_REAUTH_THRESHOLD:
4050                 if (value > 0 && value <= 100)
4051                         sm->dot11RSNAConfigPMKReauthThreshold = value;
4052                 else
4053                         ret = -1;
4054                 break;
4055         case RSNA_SA_TIMEOUT:
4056                 if (value > 0)
4057                         sm->dot11RSNAConfigSATimeout = value;
4058                 else
4059                         ret = -1;
4060                 break;
4061         case WPA_PARAM_PROTO:
4062                 sm->proto = value;
4063                 break;
4064         case WPA_PARAM_PAIRWISE:
4065                 sm->pairwise_cipher = value;
4066                 break;
4067         case WPA_PARAM_GROUP:
4068                 sm->group_cipher = value;
4069                 break;
4070         case WPA_PARAM_KEY_MGMT:
4071                 sm->key_mgmt = value;
4072                 break;
4073 #ifdef CONFIG_IEEE80211W
4074         case WPA_PARAM_MGMT_GROUP:
4075                 sm->mgmt_group_cipher = value;
4076                 break;
4077 #endif /* CONFIG_IEEE80211W */
4078         default:
4079                 break;
4080         }
4081
4082         return ret;
4083 }
4084
4085
4086 /**
4087  * wpa_sm_get_param - Get WPA state machine parameters
4088  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4089  * @param: Parameter field
4090  * Returns: Parameter value
4091  */
4092 unsigned int wpa_sm_get_param(struct wpa_sm *sm, enum wpa_sm_conf_params param)
4093 {
4094         if (sm == NULL)
4095                 return 0;
4096
4097         switch (param) {
4098         case RSNA_PMK_LIFETIME:
4099                 return sm->dot11RSNAConfigPMKLifetime;
4100         case RSNA_PMK_REAUTH_THRESHOLD:
4101                 return sm->dot11RSNAConfigPMKReauthThreshold;
4102         case RSNA_SA_TIMEOUT:
4103                 return sm->dot11RSNAConfigSATimeout;
4104         case WPA_PARAM_PROTO:
4105                 return sm->proto;
4106         case WPA_PARAM_PAIRWISE:
4107                 return sm->pairwise_cipher;
4108         case WPA_PARAM_GROUP:
4109                 return sm->group_cipher;
4110         case WPA_PARAM_KEY_MGMT:
4111                 return sm->key_mgmt;
4112 #ifdef CONFIG_IEEE80211W
4113         case WPA_PARAM_MGMT_GROUP:
4114                 return sm->mgmt_group_cipher;
4115 #endif /* CONFIG_IEEE80211W */
4116         default:
4117                 return 0;
4118         }
4119 }
4120
4121
4122 /**
4123  * wpa_sm_get_status - Get WPA state machine
4124  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4125  * @buf: Buffer for status information
4126  * @buflen: Maximum buffer length
4127  * @verbose: Whether to include verbose status information
4128  * Returns: Number of bytes written to buf.
4129  *
4130  * Query WPA state machine for status information. This function fills in
4131  * a text area with current status information. If the buffer (buf) is not
4132  * large enough, status information will be truncated to fit the buffer.
4133  */
4134 int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
4135                       int verbose)
4136 {
4137         char *pos = buf, *end = buf + buflen;
4138         int ret;
4139
4140         ret = os_snprintf(pos, end - pos,
4141                           "pairwise_cipher=%s\n"
4142                           "group_cipher=%s\n"
4143                           "key_mgmt=%s\n",
4144                           wpa_cipher_txt(sm->pairwise_cipher),
4145                           wpa_cipher_txt(sm->group_cipher),
4146                           wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
4147         if (ret < 0 || ret >= end - pos)
4148                 return pos - buf;
4149         pos += ret;
4150         return pos - buf;
4151 }
4152
4153
4154 /**
4155  * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
4156  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4157  * @wpa_ie: Pointer to buffer for WPA/RSN IE
4158  * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
4159  * Returns: 0 on success, -1 on failure
4160  */
4161 int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
4162                                     size_t *wpa_ie_len)
4163 {
4164         int res;
4165
4166         if (sm == NULL)
4167                 return -1;
4168
4169         res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
4170         if (res < 0)
4171                 return -1;
4172         *wpa_ie_len = res;
4173
4174         wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
4175                     wpa_ie, *wpa_ie_len);
4176
4177         if (sm->assoc_wpa_ie == NULL) {
4178                 /*
4179                  * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
4180                  * the correct version of the IE even if PMKSA caching is
4181                  * aborted (which would remove PMKID from IE generation).
4182                  */
4183                 sm->assoc_wpa_ie = os_malloc(*wpa_ie_len);
4184                 if (sm->assoc_wpa_ie == NULL)
4185                         return -1;
4186
4187                 os_memcpy(sm->assoc_wpa_ie, wpa_ie, *wpa_ie_len);
4188                 sm->assoc_wpa_ie_len = *wpa_ie_len;
4189         }
4190
4191         return 0;
4192 }
4193
4194
4195 /**
4196  * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
4197  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4198  * @ie: Pointer to IE data (starting from id)
4199  * @len: IE length
4200  * Returns: 0 on success, -1 on failure
4201  *
4202  * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
4203  * Request frame. The IE will be used to override the default value generated
4204  * with wpa_sm_set_assoc_wpa_ie_default().
4205  */
4206 int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
4207 {
4208         if (sm == NULL)
4209                 return -1;
4210
4211         os_free(sm->assoc_wpa_ie);
4212         if (ie == NULL || len == 0) {
4213                 wpa_printf(MSG_DEBUG, "WPA: clearing own WPA/RSN IE");
4214                 sm->assoc_wpa_ie = NULL;
4215                 sm->assoc_wpa_ie_len = 0;
4216         } else {
4217                 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
4218                 sm->assoc_wpa_ie = os_malloc(len);
4219                 if (sm->assoc_wpa_ie == NULL)
4220                         return -1;
4221
4222                 os_memcpy(sm->assoc_wpa_ie, ie, len);
4223                 sm->assoc_wpa_ie_len = len;
4224         }
4225
4226         return 0;
4227 }
4228
4229
4230 /**
4231  * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
4232  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4233  * @ie: Pointer to IE data (starting from id)
4234  * @len: IE length
4235  * Returns: 0 on success, -1 on failure
4236  *
4237  * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
4238  * frame.
4239  */
4240 int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
4241 {
4242         if (sm == NULL)
4243                 return -1;
4244
4245         os_free(sm->ap_wpa_ie);
4246         if (ie == NULL || len == 0) {
4247                 wpa_printf(MSG_DEBUG, "WPA: clearing AP WPA IE");
4248                 sm->ap_wpa_ie = NULL;
4249                 sm->ap_wpa_ie_len = 0;
4250         } else {
4251                 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
4252                 sm->ap_wpa_ie = os_malloc(len);
4253                 if (sm->ap_wpa_ie == NULL)
4254                         return -1;
4255
4256                 os_memcpy(sm->ap_wpa_ie, ie, len);
4257                 sm->ap_wpa_ie_len = len;
4258         }
4259
4260         return 0;
4261 }
4262
4263
4264 /**
4265  * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
4266  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4267  * @ie: Pointer to IE data (starting from id)
4268  * @len: IE length
4269  * Returns: 0 on success, -1 on failure
4270  *
4271  * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
4272  * frame.
4273  */
4274 int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
4275 {
4276         if (sm == NULL)
4277                 return -1;
4278
4279         os_free(sm->ap_rsn_ie);
4280         if (ie == NULL || len == 0) {
4281                 wpa_printf(MSG_DEBUG, "WPA: clearing AP RSN IE");
4282                 sm->ap_rsn_ie = NULL;
4283                 sm->ap_rsn_ie_len = 0;
4284         } else {
4285                 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
4286                 sm->ap_rsn_ie = os_malloc(len);
4287                 if (sm->ap_rsn_ie == NULL)
4288                         return -1;
4289
4290                 os_memcpy(sm->ap_rsn_ie, ie, len);
4291                 sm->ap_rsn_ie_len = len;
4292         }
4293
4294         return 0;
4295 }
4296
4297
4298 /**
4299  * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
4300  * @sm: Pointer to WPA state machine data from wpa_sm_init()
4301  * @data: Pointer to data area for parsing results
4302  * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
4303  *
4304  * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
4305  * parsed data into data.
4306  */
4307 int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
4308 {
4309         if (sm == NULL || sm->assoc_wpa_ie == NULL) {
4310                 wpa_printf(MSG_DEBUG, "WPA: No WPA/RSN IE available from "
4311                            "association info");
4312                 return -1;
4313         }
4314         if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
4315                 return -2;
4316         return 0;
4317 }