wpa_auth_ie.c revision fb45fd5cfed8bdccd0859c7fc05449fc187e2d06
1/* 2 * hostapd - WPA/RSN IE and KDE definitions 3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "common/ieee802_11_defs.h" 13#include "eapol_auth/eapol_auth_sm.h" 14#include "ap_config.h" 15#include "ieee802_11.h" 16#include "wpa_auth.h" 17#include "pmksa_cache_auth.h" 18#include "wpa_auth_ie.h" 19#include "wpa_auth_i.h" 20 21 22#ifdef CONFIG_RSN_TESTING 23int rsn_testing = 0; 24#endif /* CONFIG_RSN_TESTING */ 25 26 27static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len) 28{ 29 struct wpa_ie_hdr *hdr; 30 int num_suites; 31 u8 *pos, *count; 32 u32 suite; 33 34 hdr = (struct wpa_ie_hdr *) buf; 35 hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC; 36 RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE); 37 WPA_PUT_LE16(hdr->version, WPA_VERSION); 38 pos = (u8 *) (hdr + 1); 39 40 suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group); 41 if (suite == 0) { 42 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", 43 conf->wpa_group); 44 return -1; 45 } 46 RSN_SELECTOR_PUT(pos, suite); 47 pos += WPA_SELECTOR_LEN; 48 49 count = pos; 50 pos += 2; 51 52 num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise); 53 if (num_suites == 0) { 54 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", 55 conf->wpa_pairwise); 56 return -1; 57 } 58 pos += num_suites * WPA_SELECTOR_LEN; 59 WPA_PUT_LE16(count, num_suites); 60 61 num_suites = 0; 62 count = pos; 63 pos += 2; 64 65 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { 66 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X); 67 pos += WPA_SELECTOR_LEN; 68 num_suites++; 69 } 70 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { 71 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X); 72 pos += WPA_SELECTOR_LEN; 73 num_suites++; 74 } 75 76 if (num_suites == 0) { 77 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", 78 conf->wpa_key_mgmt); 79 return -1; 80 } 81 WPA_PUT_LE16(count, num_suites); 82 83 /* WPA Capabilities; use defaults, so no need to include it */ 84 85 hdr->len = (pos - buf) - 2; 86 87 return pos - buf; 88} 89 90 91int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len, 92 const u8 *pmkid) 93{ 94 struct rsn_ie_hdr *hdr; 95 int num_suites, res; 96 u8 *pos, *count; 97 u16 capab; 98 u32 suite; 99 100 hdr = (struct rsn_ie_hdr *) buf; 101 hdr->elem_id = WLAN_EID_RSN; 102 WPA_PUT_LE16(hdr->version, RSN_VERSION); 103 pos = (u8 *) (hdr + 1); 104 105 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group); 106 if (suite == 0) { 107 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", 108 conf->wpa_group); 109 return -1; 110 } 111 RSN_SELECTOR_PUT(pos, suite); 112 pos += RSN_SELECTOR_LEN; 113 114 num_suites = 0; 115 count = pos; 116 pos += 2; 117 118#ifdef CONFIG_RSN_TESTING 119 if (rsn_testing) { 120 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); 121 pos += RSN_SELECTOR_LEN; 122 num_suites++; 123 } 124#endif /* CONFIG_RSN_TESTING */ 125 126 res = rsn_cipher_put_suites(pos, conf->rsn_pairwise); 127 num_suites += res; 128 pos += res * RSN_SELECTOR_LEN; 129 130#ifdef CONFIG_RSN_TESTING 131 if (rsn_testing) { 132 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); 133 pos += RSN_SELECTOR_LEN; 134 num_suites++; 135 } 136#endif /* CONFIG_RSN_TESTING */ 137 138 if (num_suites == 0) { 139 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", 140 conf->rsn_pairwise); 141 return -1; 142 } 143 WPA_PUT_LE16(count, num_suites); 144 145 num_suites = 0; 146 count = pos; 147 pos += 2; 148 149#ifdef CONFIG_RSN_TESTING 150 if (rsn_testing) { 151 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); 152 pos += RSN_SELECTOR_LEN; 153 num_suites++; 154 } 155#endif /* CONFIG_RSN_TESTING */ 156 157 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { 158 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X); 159 pos += RSN_SELECTOR_LEN; 160 num_suites++; 161 } 162 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { 163 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X); 164 pos += RSN_SELECTOR_LEN; 165 num_suites++; 166 } 167#ifdef CONFIG_IEEE80211R 168 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) { 169 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X); 170 pos += RSN_SELECTOR_LEN; 171 num_suites++; 172 } 173 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) { 174 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK); 175 pos += RSN_SELECTOR_LEN; 176 num_suites++; 177 } 178#endif /* CONFIG_IEEE80211R */ 179#ifdef CONFIG_IEEE80211W 180 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) { 181 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256); 182 pos += RSN_SELECTOR_LEN; 183 num_suites++; 184 } 185 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) { 186 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256); 187 pos += RSN_SELECTOR_LEN; 188 num_suites++; 189 } 190#endif /* CONFIG_IEEE80211W */ 191#ifdef CONFIG_SAE 192 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_SAE) { 193 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_SAE); 194 pos += RSN_SELECTOR_LEN; 195 num_suites++; 196 } 197 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_SAE) { 198 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_SAE); 199 pos += RSN_SELECTOR_LEN; 200 num_suites++; 201 } 202#endif /* CONFIG_SAE */ 203 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) { 204 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SUITE_B); 205 pos += RSN_SELECTOR_LEN; 206 num_suites++; 207 } 208 209#ifdef CONFIG_RSN_TESTING 210 if (rsn_testing) { 211 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); 212 pos += RSN_SELECTOR_LEN; 213 num_suites++; 214 } 215#endif /* CONFIG_RSN_TESTING */ 216 217 if (num_suites == 0) { 218 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", 219 conf->wpa_key_mgmt); 220 return -1; 221 } 222 WPA_PUT_LE16(count, num_suites); 223 224 /* RSN Capabilities */ 225 capab = 0; 226 if (conf->rsn_preauth) 227 capab |= WPA_CAPABILITY_PREAUTH; 228 if (conf->peerkey) 229 capab |= WPA_CAPABILITY_PEERKEY_ENABLED; 230 if (conf->wmm_enabled) { 231 /* 4 PTKSA replay counters when using WMM */ 232 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); 233 } 234#ifdef CONFIG_IEEE80211W 235 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { 236 capab |= WPA_CAPABILITY_MFPC; 237 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) 238 capab |= WPA_CAPABILITY_MFPR; 239 } 240#endif /* CONFIG_IEEE80211W */ 241#ifdef CONFIG_RSN_TESTING 242 if (rsn_testing) 243 capab |= BIT(8) | BIT(14) | BIT(15); 244#endif /* CONFIG_RSN_TESTING */ 245 WPA_PUT_LE16(pos, capab); 246 pos += 2; 247 248 if (pmkid) { 249 if (pos + 2 + PMKID_LEN > buf + len) 250 return -1; 251 /* PMKID Count */ 252 WPA_PUT_LE16(pos, 1); 253 pos += 2; 254 os_memcpy(pos, pmkid, PMKID_LEN); 255 pos += PMKID_LEN; 256 } 257 258#ifdef CONFIG_IEEE80211W 259 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { 260 if (pos + 2 + 4 > buf + len) 261 return -1; 262 if (pmkid == NULL) { 263 /* PMKID Count */ 264 WPA_PUT_LE16(pos, 0); 265 pos += 2; 266 } 267 268 /* Management Group Cipher Suite */ 269 switch (conf->group_mgmt_cipher) { 270 case WPA_CIPHER_AES_128_CMAC: 271 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); 272 break; 273 case WPA_CIPHER_BIP_GMAC_128: 274 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_128); 275 break; 276 case WPA_CIPHER_BIP_GMAC_256: 277 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_GMAC_256); 278 break; 279 case WPA_CIPHER_BIP_CMAC_256: 280 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_BIP_CMAC_256); 281 break; 282 default: 283 wpa_printf(MSG_DEBUG, 284 "Invalid group management cipher (0x%x)", 285 conf->group_mgmt_cipher); 286 return -1; 287 } 288 pos += RSN_SELECTOR_LEN; 289 } 290#endif /* CONFIG_IEEE80211W */ 291 292#ifdef CONFIG_RSN_TESTING 293 if (rsn_testing) { 294 /* 295 * Fill in any defined fields and add extra data to the end of 296 * the element. 297 */ 298 int pmkid_count_set = pmkid != NULL; 299 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) 300 pmkid_count_set = 1; 301 /* PMKID Count */ 302 WPA_PUT_LE16(pos, 0); 303 pos += 2; 304 if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) { 305 /* Management Group Cipher Suite */ 306 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); 307 pos += RSN_SELECTOR_LEN; 308 } 309 310 os_memset(pos, 0x12, 17); 311 pos += 17; 312 } 313#endif /* CONFIG_RSN_TESTING */ 314 315 hdr->len = (pos - buf) - 2; 316 317 return pos - buf; 318} 319 320 321static u8 * wpa_write_osen(struct wpa_auth_config *conf, u8 *eid) 322{ 323 u8 *len; 324 u16 capab; 325 326 *eid++ = WLAN_EID_VENDOR_SPECIFIC; 327 len = eid++; /* to be filled */ 328 WPA_PUT_BE24(eid, OUI_WFA); 329 eid += 3; 330 *eid++ = HS20_OSEN_OUI_TYPE; 331 332 /* Group Data Cipher Suite */ 333 RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 334 eid += RSN_SELECTOR_LEN; 335 336 /* Pairwise Cipher Suite Count and List */ 337 WPA_PUT_LE16(eid, 1); 338 eid += 2; 339 RSN_SELECTOR_PUT(eid, RSN_CIPHER_SUITE_CCMP); 340 eid += RSN_SELECTOR_LEN; 341 342 /* AKM Suite Count and List */ 343 WPA_PUT_LE16(eid, 1); 344 eid += 2; 345 RSN_SELECTOR_PUT(eid, RSN_AUTH_KEY_MGMT_OSEN); 346 eid += RSN_SELECTOR_LEN; 347 348 /* RSN Capabilities */ 349 capab = 0; 350 if (conf->wmm_enabled) { 351 /* 4 PTKSA replay counters when using WMM */ 352 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); 353 } 354#ifdef CONFIG_IEEE80211W 355 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { 356 capab |= WPA_CAPABILITY_MFPC; 357 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) 358 capab |= WPA_CAPABILITY_MFPR; 359 } 360#endif /* CONFIG_IEEE80211W */ 361 WPA_PUT_LE16(eid, capab); 362 eid += 2; 363 364 *len = eid - len - 1; 365 366 return eid; 367} 368 369 370int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth) 371{ 372 u8 *pos, buf[128]; 373 int res; 374 375 pos = buf; 376 377 if (wpa_auth->conf.wpa == WPA_PROTO_OSEN) { 378 pos = wpa_write_osen(&wpa_auth->conf, pos); 379 } 380 if (wpa_auth->conf.wpa & WPA_PROTO_RSN) { 381 res = wpa_write_rsn_ie(&wpa_auth->conf, 382 pos, buf + sizeof(buf) - pos, NULL); 383 if (res < 0) 384 return res; 385 pos += res; 386 } 387#ifdef CONFIG_IEEE80211R 388 if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) { 389 res = wpa_write_mdie(&wpa_auth->conf, pos, 390 buf + sizeof(buf) - pos); 391 if (res < 0) 392 return res; 393 pos += res; 394 } 395#endif /* CONFIG_IEEE80211R */ 396 if (wpa_auth->conf.wpa & WPA_PROTO_WPA) { 397 res = wpa_write_wpa_ie(&wpa_auth->conf, 398 pos, buf + sizeof(buf) - pos); 399 if (res < 0) 400 return res; 401 pos += res; 402 } 403 404 os_free(wpa_auth->wpa_ie); 405 wpa_auth->wpa_ie = os_malloc(pos - buf); 406 if (wpa_auth->wpa_ie == NULL) 407 return -1; 408 os_memcpy(wpa_auth->wpa_ie, buf, pos - buf); 409 wpa_auth->wpa_ie_len = pos - buf; 410 411 return 0; 412} 413 414 415u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len, 416 const u8 *data2, size_t data2_len) 417{ 418 *pos++ = WLAN_EID_VENDOR_SPECIFIC; 419 *pos++ = RSN_SELECTOR_LEN + data_len + data2_len; 420 RSN_SELECTOR_PUT(pos, kde); 421 pos += RSN_SELECTOR_LEN; 422 os_memcpy(pos, data, data_len); 423 pos += data_len; 424 if (data2) { 425 os_memcpy(pos, data2, data2_len); 426 pos += data2_len; 427 } 428 return pos; 429} 430 431 432struct wpa_auth_okc_iter_data { 433 struct rsn_pmksa_cache_entry *pmksa; 434 const u8 *aa; 435 const u8 *spa; 436 const u8 *pmkid; 437}; 438 439 440static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx) 441{ 442 struct wpa_auth_okc_iter_data *data = ctx; 443 data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa, 444 data->pmkid); 445 if (data->pmksa) 446 return 1; 447 return 0; 448} 449 450 451int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, 452 struct wpa_state_machine *sm, 453 const u8 *wpa_ie, size_t wpa_ie_len, 454 const u8 *mdie, size_t mdie_len) 455{ 456 struct wpa_ie_data data; 457 int ciphers, key_mgmt, res, version; 458 u32 selector; 459 size_t i; 460 const u8 *pmkid = NULL; 461 462 if (wpa_auth == NULL || sm == NULL) 463 return WPA_NOT_ENABLED; 464 465 if (wpa_ie == NULL || wpa_ie_len < 1) 466 return WPA_INVALID_IE; 467 468 if (wpa_ie[0] == WLAN_EID_RSN) 469 version = WPA_PROTO_RSN; 470 else 471 version = WPA_PROTO_WPA; 472 473 if (!(wpa_auth->conf.wpa & version)) { 474 wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR, 475 version, MAC2STR(sm->addr)); 476 return WPA_INVALID_PROTO; 477 } 478 479 if (version == WPA_PROTO_RSN) { 480 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data); 481 482 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; 483 if (0) { 484 } 485 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) 486 selector = RSN_AUTH_KEY_MGMT_802_1X_SUITE_B; 487#ifdef CONFIG_IEEE80211R 488 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) 489 selector = RSN_AUTH_KEY_MGMT_FT_802_1X; 490 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) 491 selector = RSN_AUTH_KEY_MGMT_FT_PSK; 492#endif /* CONFIG_IEEE80211R */ 493#ifdef CONFIG_IEEE80211W 494 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) 495 selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256; 496 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) 497 selector = RSN_AUTH_KEY_MGMT_PSK_SHA256; 498#endif /* CONFIG_IEEE80211W */ 499#ifdef CONFIG_SAE 500 else if (data.key_mgmt & WPA_KEY_MGMT_SAE) 501 selector = RSN_AUTH_KEY_MGMT_SAE; 502 else if (data.key_mgmt & WPA_KEY_MGMT_FT_SAE) 503 selector = RSN_AUTH_KEY_MGMT_FT_SAE; 504#endif /* CONFIG_SAE */ 505 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) 506 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; 507 else if (data.key_mgmt & WPA_KEY_MGMT_PSK) 508 selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X; 509 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; 510 511 selector = wpa_cipher_to_suite(WPA_PROTO_RSN, 512 data.pairwise_cipher); 513 if (!selector) 514 selector = RSN_CIPHER_SUITE_CCMP; 515 wpa_auth->dot11RSNAPairwiseCipherSelected = selector; 516 517 selector = wpa_cipher_to_suite(WPA_PROTO_RSN, 518 data.group_cipher); 519 if (!selector) 520 selector = RSN_CIPHER_SUITE_CCMP; 521 wpa_auth->dot11RSNAGroupCipherSelected = selector; 522 } else { 523 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data); 524 525 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; 526 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) 527 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; 528 else if (data.key_mgmt & WPA_KEY_MGMT_PSK) 529 selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X; 530 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; 531 532 selector = wpa_cipher_to_suite(WPA_PROTO_WPA, 533 data.pairwise_cipher); 534 if (!selector) 535 selector = RSN_CIPHER_SUITE_TKIP; 536 wpa_auth->dot11RSNAPairwiseCipherSelected = selector; 537 538 selector = wpa_cipher_to_suite(WPA_PROTO_WPA, 539 data.group_cipher); 540 if (!selector) 541 selector = WPA_CIPHER_SUITE_TKIP; 542 wpa_auth->dot11RSNAGroupCipherSelected = selector; 543 } 544 if (res) { 545 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from " 546 MACSTR " (res=%d)", MAC2STR(sm->addr), res); 547 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len); 548 return WPA_INVALID_IE; 549 } 550 551 if (data.group_cipher != wpa_auth->conf.wpa_group) { 552 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from " 553 MACSTR, data.group_cipher, MAC2STR(sm->addr)); 554 return WPA_INVALID_GROUP; 555 } 556 557 key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt; 558 if (!key_mgmt) { 559 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from " 560 MACSTR, data.key_mgmt, MAC2STR(sm->addr)); 561 return WPA_INVALID_AKMP; 562 } 563 if (0) { 564 } 565 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B) 566 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B; 567#ifdef CONFIG_IEEE80211R 568 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) 569 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X; 570 else if (key_mgmt & WPA_KEY_MGMT_FT_PSK) 571 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK; 572#endif /* CONFIG_IEEE80211R */ 573#ifdef CONFIG_IEEE80211W 574 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) 575 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256; 576 else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256) 577 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256; 578#endif /* CONFIG_IEEE80211W */ 579#ifdef CONFIG_SAE 580 else if (key_mgmt & WPA_KEY_MGMT_SAE) 581 sm->wpa_key_mgmt = WPA_KEY_MGMT_SAE; 582 else if (key_mgmt & WPA_KEY_MGMT_FT_SAE) 583 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_SAE; 584#endif /* CONFIG_SAE */ 585 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X) 586 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X; 587 else 588 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK; 589 590 if (version == WPA_PROTO_RSN) 591 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise; 592 else 593 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise; 594 if (!ciphers) { 595 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) " 596 "from " MACSTR, 597 version == WPA_PROTO_RSN ? "RSN" : "WPA", 598 data.pairwise_cipher, MAC2STR(sm->addr)); 599 return WPA_INVALID_PAIRWISE; 600 } 601 602#ifdef CONFIG_IEEE80211W 603 if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) { 604 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) { 605 wpa_printf(MSG_DEBUG, "Management frame protection " 606 "required, but client did not enable it"); 607 return WPA_MGMT_FRAME_PROTECTION_VIOLATION; 608 } 609 610 if (ciphers & WPA_CIPHER_TKIP) { 611 wpa_printf(MSG_DEBUG, "Management frame protection " 612 "cannot use TKIP"); 613 return WPA_MGMT_FRAME_PROTECTION_VIOLATION; 614 } 615 616 if (data.mgmt_group_cipher != wpa_auth->conf.group_mgmt_cipher) 617 { 618 wpa_printf(MSG_DEBUG, "Unsupported management group " 619 "cipher %d", data.mgmt_group_cipher); 620 return WPA_INVALID_MGMT_GROUP_CIPHER; 621 } 622 } 623 624 if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION || 625 !(data.capabilities & WPA_CAPABILITY_MFPC)) 626 sm->mgmt_frame_prot = 0; 627 else 628 sm->mgmt_frame_prot = 1; 629#endif /* CONFIG_IEEE80211W */ 630 631#ifdef CONFIG_IEEE80211R 632 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 633 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) { 634 wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but " 635 "MDIE not included"); 636 return WPA_INVALID_MDIE; 637 } 638 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain, 639 MOBILITY_DOMAIN_ID_LEN) != 0) { 640 wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown " 641 "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN); 642 return WPA_INVALID_MDIE; 643 } 644 } 645#endif /* CONFIG_IEEE80211R */ 646 647 sm->pairwise = wpa_pick_pairwise_cipher(ciphers, 0); 648 if (sm->pairwise < 0) 649 return WPA_INVALID_PAIRWISE; 650 651 /* TODO: clear WPA/WPA2 state if STA changes from one to another */ 652 if (wpa_ie[0] == WLAN_EID_RSN) 653 sm->wpa = WPA_VERSION_WPA2; 654 else 655 sm->wpa = WPA_VERSION_WPA; 656 657 sm->pmksa = NULL; 658 for (i = 0; i < data.num_pmkid; i++) { 659 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID", 660 &data.pmkid[i * PMKID_LEN], PMKID_LEN); 661 sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr, 662 &data.pmkid[i * PMKID_LEN]); 663 if (sm->pmksa) { 664 pmkid = sm->pmksa->pmkid; 665 break; 666 } 667 } 668 for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc && 669 i < data.num_pmkid; i++) { 670 struct wpa_auth_okc_iter_data idata; 671 idata.pmksa = NULL; 672 idata.aa = wpa_auth->addr; 673 idata.spa = sm->addr; 674 idata.pmkid = &data.pmkid[i * PMKID_LEN]; 675 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata); 676 if (idata.pmksa) { 677 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 678 "OKC match for PMKID"); 679 sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa, 680 idata.pmksa, 681 wpa_auth->addr, 682 idata.pmkid); 683 pmkid = idata.pmkid; 684 break; 685 } 686 } 687 if (sm->pmksa && pmkid) { 688 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 689 "PMKID found from PMKSA cache " 690 "eap_type=%d vlan_id=%d", 691 sm->pmksa->eap_type_authsrv, 692 sm->pmksa->vlan_id); 693 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN); 694 } 695 696 if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) { 697 os_free(sm->wpa_ie); 698 sm->wpa_ie = os_malloc(wpa_ie_len); 699 if (sm->wpa_ie == NULL) 700 return WPA_ALLOC_FAIL; 701 } 702 os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len); 703 sm->wpa_ie_len = wpa_ie_len; 704 705 return WPA_IE_OK; 706} 707 708 709#ifdef CONFIG_HS20 710int wpa_validate_osen(struct wpa_authenticator *wpa_auth, 711 struct wpa_state_machine *sm, 712 const u8 *osen_ie, size_t osen_ie_len) 713{ 714 if (wpa_auth == NULL || sm == NULL) 715 return -1; 716 717 /* TODO: parse OSEN element */ 718 sm->wpa_key_mgmt = WPA_KEY_MGMT_OSEN; 719 sm->mgmt_frame_prot = 1; 720 sm->pairwise = WPA_CIPHER_CCMP; 721 sm->wpa = WPA_VERSION_WPA2; 722 723 if (sm->wpa_ie == NULL || sm->wpa_ie_len < osen_ie_len) { 724 os_free(sm->wpa_ie); 725 sm->wpa_ie = os_malloc(osen_ie_len); 726 if (sm->wpa_ie == NULL) 727 return -1; 728 } 729 730 os_memcpy(sm->wpa_ie, osen_ie, osen_ie_len); 731 sm->wpa_ie_len = osen_ie_len; 732 733 return 0; 734} 735 736#endif /* CONFIG_HS20 */ 737 738 739/** 740 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs 741 * @pos: Pointer to the IE header 742 * @end: Pointer to the end of the Key Data buffer 743 * @ie: Pointer to parsed IE data 744 * Returns: 0 on success, 1 if end mark is found, -1 on failure 745 */ 746static int wpa_parse_generic(const u8 *pos, const u8 *end, 747 struct wpa_eapol_ie_parse *ie) 748{ 749 if (pos[1] == 0) 750 return 1; 751 752 if (pos[1] >= 6 && 753 RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE && 754 pos[2 + WPA_SELECTOR_LEN] == 1 && 755 pos[2 + WPA_SELECTOR_LEN + 1] == 0) { 756 ie->wpa_ie = pos; 757 ie->wpa_ie_len = pos[1] + 2; 758 return 0; 759 } 760 761 if (pos[1] >= 4 && WPA_GET_BE32(pos + 2) == OSEN_IE_VENDOR_TYPE) { 762 ie->osen = pos; 763 ie->osen_len = pos[1] + 2; 764 return 0; 765 } 766 767 if (pos + 1 + RSN_SELECTOR_LEN < end && 768 pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN && 769 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) { 770 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN; 771 return 0; 772 } 773 774 if (pos[1] > RSN_SELECTOR_LEN + 2 && 775 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) { 776 ie->gtk = pos + 2 + RSN_SELECTOR_LEN; 777 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN; 778 return 0; 779 } 780 781 if (pos[1] > RSN_SELECTOR_LEN + 2 && 782 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) { 783 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN; 784 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN; 785 return 0; 786 } 787 788#ifdef CONFIG_PEERKEY 789 if (pos[1] > RSN_SELECTOR_LEN + 2 && 790 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) { 791 ie->smk = pos + 2 + RSN_SELECTOR_LEN; 792 ie->smk_len = pos[1] - RSN_SELECTOR_LEN; 793 return 0; 794 } 795 796 if (pos[1] > RSN_SELECTOR_LEN + 2 && 797 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) { 798 ie->nonce = pos + 2 + RSN_SELECTOR_LEN; 799 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN; 800 return 0; 801 } 802 803 if (pos[1] > RSN_SELECTOR_LEN + 2 && 804 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) { 805 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN; 806 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN; 807 return 0; 808 } 809 810 if (pos[1] > RSN_SELECTOR_LEN + 2 && 811 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) { 812 ie->error = pos + 2 + RSN_SELECTOR_LEN; 813 ie->error_len = pos[1] - RSN_SELECTOR_LEN; 814 return 0; 815 } 816#endif /* CONFIG_PEERKEY */ 817 818#ifdef CONFIG_IEEE80211W 819 if (pos[1] > RSN_SELECTOR_LEN + 2 && 820 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) { 821 ie->igtk = pos + 2 + RSN_SELECTOR_LEN; 822 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN; 823 return 0; 824 } 825#endif /* CONFIG_IEEE80211W */ 826 827#ifdef CONFIG_P2P 828 if (pos[1] >= RSN_SELECTOR_LEN + 1 && 829 RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_REQ) { 830 ie->ip_addr_req = pos + 2 + RSN_SELECTOR_LEN; 831 wpa_hexdump(MSG_DEBUG, "WPA: IP Address Request in EAPOL-Key", 832 ie->ip_addr_req, pos[1] - RSN_SELECTOR_LEN); 833 return 0; 834 } 835 836 if (pos[1] >= RSN_SELECTOR_LEN + 3 * 4 && 837 RSN_SELECTOR_GET(pos + 2) == WFA_KEY_DATA_IP_ADDR_ALLOC) { 838 ie->ip_addr_alloc = pos + 2 + RSN_SELECTOR_LEN; 839 wpa_hexdump(MSG_DEBUG, 840 "WPA: IP Address Allocation in EAPOL-Key", 841 ie->ip_addr_alloc, pos[1] - RSN_SELECTOR_LEN); 842 return 0; 843 } 844#endif /* CONFIG_P2P */ 845 846 return 0; 847} 848 849 850/** 851 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs 852 * @buf: Pointer to the Key Data buffer 853 * @len: Key Data Length 854 * @ie: Pointer to parsed IE data 855 * Returns: 0 on success, -1 on failure 856 */ 857int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie) 858{ 859 const u8 *pos, *end; 860 int ret = 0; 861 862 os_memset(ie, 0, sizeof(*ie)); 863 for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) { 864 if (pos[0] == 0xdd && 865 ((pos == buf + len - 1) || pos[1] == 0)) { 866 /* Ignore padding */ 867 break; 868 } 869 if (pos + 2 + pos[1] > end) { 870 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data " 871 "underflow (ie=%d len=%d pos=%d)", 872 pos[0], pos[1], (int) (pos - buf)); 873 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", 874 buf, len); 875 ret = -1; 876 break; 877 } 878 if (*pos == WLAN_EID_RSN) { 879 ie->rsn_ie = pos; 880 ie->rsn_ie_len = pos[1] + 2; 881#ifdef CONFIG_IEEE80211R 882 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) { 883 ie->mdie = pos; 884 ie->mdie_len = pos[1] + 2; 885 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) { 886 ie->ftie = pos; 887 ie->ftie_len = pos[1] + 2; 888#endif /* CONFIG_IEEE80211R */ 889 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) { 890 ret = wpa_parse_generic(pos, end, ie); 891 if (ret < 0) 892 break; 893 if (ret > 0) { 894 ret = 0; 895 break; 896 } 897 } else { 898 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key " 899 "Key Data IE", pos, 2 + pos[1]); 900 } 901 } 902 903 return ret; 904} 905 906 907int wpa_auth_uses_mfp(struct wpa_state_machine *sm) 908{ 909 return sm ? sm->mgmt_frame_prot : 0; 910} 911