1 /* 2 * hostapd - WPA/RSN IE and KDE definitions 3 * Copyright (c) 2004-2008, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "common/ieee802_11_defs.h" 13 #include "eapol_auth/eapol_auth_sm.h" 14 #include "ap_config.h" 15 #include "ieee802_11.h" 16 #include "wpa_auth.h" 17 #include "pmksa_cache_auth.h" 18 #include "wpa_auth_ie.h" 19 #include "wpa_auth_i.h" 20 21 22 #ifdef CONFIG_RSN_TESTING 23 int rsn_testing = 0; 24 #endif /* CONFIG_RSN_TESTING */ 25 26 27 static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len) 28 { 29 struct wpa_ie_hdr *hdr; 30 int num_suites; 31 u8 *pos, *count; 32 u32 suite; 33 34 hdr = (struct wpa_ie_hdr *) buf; 35 hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC; 36 RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE); 37 WPA_PUT_LE16(hdr->version, WPA_VERSION); 38 pos = (u8 *) (hdr + 1); 39 40 suite = wpa_cipher_to_suite(WPA_PROTO_WPA, conf->wpa_group); 41 if (suite == 0) { 42 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", 43 conf->wpa_group); 44 return -1; 45 } 46 RSN_SELECTOR_PUT(pos, suite); 47 pos += WPA_SELECTOR_LEN; 48 49 count = pos; 50 pos += 2; 51 52 num_suites = wpa_cipher_put_suites(pos, conf->wpa_pairwise); 53 if (num_suites == 0) { 54 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", 55 conf->wpa_pairwise); 56 return -1; 57 } 58 pos += num_suites * WPA_SELECTOR_LEN; 59 WPA_PUT_LE16(count, num_suites); 60 61 num_suites = 0; 62 count = pos; 63 pos += 2; 64 65 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { 66 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X); 67 pos += WPA_SELECTOR_LEN; 68 num_suites++; 69 } 70 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { 71 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X); 72 pos += WPA_SELECTOR_LEN; 73 num_suites++; 74 } 75 76 if (num_suites == 0) { 77 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", 78 conf->wpa_key_mgmt); 79 return -1; 80 } 81 WPA_PUT_LE16(count, num_suites); 82 83 /* WPA Capabilities; use defaults, so no need to include it */ 84 85 hdr->len = (pos - buf) - 2; 86 87 return pos - buf; 88 } 89 90 91 int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len, 92 const u8 *pmkid) 93 { 94 struct rsn_ie_hdr *hdr; 95 int num_suites, res; 96 u8 *pos, *count; 97 u16 capab; 98 u32 suite; 99 100 hdr = (struct rsn_ie_hdr *) buf; 101 hdr->elem_id = WLAN_EID_RSN; 102 WPA_PUT_LE16(hdr->version, RSN_VERSION); 103 pos = (u8 *) (hdr + 1); 104 105 suite = wpa_cipher_to_suite(WPA_PROTO_RSN, conf->wpa_group); 106 if (suite == 0) { 107 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).", 108 conf->wpa_group); 109 return -1; 110 } 111 RSN_SELECTOR_PUT(pos, suite); 112 pos += RSN_SELECTOR_LEN; 113 114 num_suites = 0; 115 count = pos; 116 pos += 2; 117 118 #ifdef CONFIG_RSN_TESTING 119 if (rsn_testing) { 120 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); 121 pos += RSN_SELECTOR_LEN; 122 num_suites++; 123 } 124 #endif /* CONFIG_RSN_TESTING */ 125 126 res = rsn_cipher_put_suites(pos, conf->rsn_pairwise); 127 num_suites += res; 128 pos += res * RSN_SELECTOR_LEN; 129 130 #ifdef CONFIG_RSN_TESTING 131 if (rsn_testing) { 132 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); 133 pos += RSN_SELECTOR_LEN; 134 num_suites++; 135 } 136 #endif /* CONFIG_RSN_TESTING */ 137 138 if (num_suites == 0) { 139 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).", 140 conf->rsn_pairwise); 141 return -1; 142 } 143 WPA_PUT_LE16(count, num_suites); 144 145 num_suites = 0; 146 count = pos; 147 pos += 2; 148 149 #ifdef CONFIG_RSN_TESTING 150 if (rsn_testing) { 151 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 1)); 152 pos += RSN_SELECTOR_LEN; 153 num_suites++; 154 } 155 #endif /* CONFIG_RSN_TESTING */ 156 157 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) { 158 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X); 159 pos += RSN_SELECTOR_LEN; 160 num_suites++; 161 } 162 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) { 163 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X); 164 pos += RSN_SELECTOR_LEN; 165 num_suites++; 166 } 167 #ifdef CONFIG_IEEE80211R 168 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) { 169 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X); 170 pos += RSN_SELECTOR_LEN; 171 num_suites++; 172 } 173 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) { 174 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK); 175 pos += RSN_SELECTOR_LEN; 176 num_suites++; 177 } 178 #endif /* CONFIG_IEEE80211R */ 179 #ifdef CONFIG_IEEE80211W 180 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) { 181 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256); 182 pos += RSN_SELECTOR_LEN; 183 num_suites++; 184 } 185 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) { 186 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256); 187 pos += RSN_SELECTOR_LEN; 188 num_suites++; 189 } 190 #endif /* CONFIG_IEEE80211W */ 191 192 #ifdef CONFIG_RSN_TESTING 193 if (rsn_testing) { 194 RSN_SELECTOR_PUT(pos, RSN_SELECTOR(0x12, 0x34, 0x56, 2)); 195 pos += RSN_SELECTOR_LEN; 196 num_suites++; 197 } 198 #endif /* CONFIG_RSN_TESTING */ 199 200 if (num_suites == 0) { 201 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).", 202 conf->wpa_key_mgmt); 203 return -1; 204 } 205 WPA_PUT_LE16(count, num_suites); 206 207 /* RSN Capabilities */ 208 capab = 0; 209 if (conf->rsn_preauth) 210 capab |= WPA_CAPABILITY_PREAUTH; 211 if (conf->peerkey) 212 capab |= WPA_CAPABILITY_PEERKEY_ENABLED; 213 if (conf->wmm_enabled) { 214 /* 4 PTKSA replay counters when using WMM */ 215 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2); 216 } 217 #ifdef CONFIG_IEEE80211W 218 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { 219 capab |= WPA_CAPABILITY_MFPC; 220 if (conf->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) 221 capab |= WPA_CAPABILITY_MFPR; 222 } 223 #endif /* CONFIG_IEEE80211W */ 224 #ifdef CONFIG_RSN_TESTING 225 if (rsn_testing) 226 capab |= BIT(8) | BIT(14) | BIT(15); 227 #endif /* CONFIG_RSN_TESTING */ 228 WPA_PUT_LE16(pos, capab); 229 pos += 2; 230 231 if (pmkid) { 232 if (pos + 2 + PMKID_LEN > buf + len) 233 return -1; 234 /* PMKID Count */ 235 WPA_PUT_LE16(pos, 1); 236 pos += 2; 237 os_memcpy(pos, pmkid, PMKID_LEN); 238 pos += PMKID_LEN; 239 } 240 241 #ifdef CONFIG_IEEE80211W 242 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) { 243 if (pos + 2 + 4 > buf + len) 244 return -1; 245 if (pmkid == NULL) { 246 /* PMKID Count */ 247 WPA_PUT_LE16(pos, 0); 248 pos += 2; 249 } 250 251 /* Management Group Cipher Suite */ 252 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); 253 pos += RSN_SELECTOR_LEN; 254 } 255 #endif /* CONFIG_IEEE80211W */ 256 257 #ifdef CONFIG_RSN_TESTING 258 if (rsn_testing) { 259 /* 260 * Fill in any defined fields and add extra data to the end of 261 * the element. 262 */ 263 int pmkid_count_set = pmkid != NULL; 264 if (conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) 265 pmkid_count_set = 1; 266 /* PMKID Count */ 267 WPA_PUT_LE16(pos, 0); 268 pos += 2; 269 if (conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) { 270 /* Management Group Cipher Suite */ 271 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC); 272 pos += RSN_SELECTOR_LEN; 273 } 274 275 os_memset(pos, 0x12, 17); 276 pos += 17; 277 } 278 #endif /* CONFIG_RSN_TESTING */ 279 280 hdr->len = (pos - buf) - 2; 281 282 return pos - buf; 283 } 284 285 286 int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth) 287 { 288 u8 *pos, buf[128]; 289 int res; 290 291 pos = buf; 292 293 if (wpa_auth->conf.wpa & WPA_PROTO_RSN) { 294 res = wpa_write_rsn_ie(&wpa_auth->conf, 295 pos, buf + sizeof(buf) - pos, NULL); 296 if (res < 0) 297 return res; 298 pos += res; 299 } 300 #ifdef CONFIG_IEEE80211R 301 if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) { 302 res = wpa_write_mdie(&wpa_auth->conf, pos, 303 buf + sizeof(buf) - pos); 304 if (res < 0) 305 return res; 306 pos += res; 307 } 308 #endif /* CONFIG_IEEE80211R */ 309 if (wpa_auth->conf.wpa & WPA_PROTO_WPA) { 310 res = wpa_write_wpa_ie(&wpa_auth->conf, 311 pos, buf + sizeof(buf) - pos); 312 if (res < 0) 313 return res; 314 pos += res; 315 } 316 317 os_free(wpa_auth->wpa_ie); 318 wpa_auth->wpa_ie = os_malloc(pos - buf); 319 if (wpa_auth->wpa_ie == NULL) 320 return -1; 321 os_memcpy(wpa_auth->wpa_ie, buf, pos - buf); 322 wpa_auth->wpa_ie_len = pos - buf; 323 324 return 0; 325 } 326 327 328 u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len, 329 const u8 *data2, size_t data2_len) 330 { 331 *pos++ = WLAN_EID_VENDOR_SPECIFIC; 332 *pos++ = RSN_SELECTOR_LEN + data_len + data2_len; 333 RSN_SELECTOR_PUT(pos, kde); 334 pos += RSN_SELECTOR_LEN; 335 os_memcpy(pos, data, data_len); 336 pos += data_len; 337 if (data2) { 338 os_memcpy(pos, data2, data2_len); 339 pos += data2_len; 340 } 341 return pos; 342 } 343 344 345 struct wpa_auth_okc_iter_data { 346 struct rsn_pmksa_cache_entry *pmksa; 347 const u8 *aa; 348 const u8 *spa; 349 const u8 *pmkid; 350 }; 351 352 353 static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx) 354 { 355 struct wpa_auth_okc_iter_data *data = ctx; 356 data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa, 357 data->pmkid); 358 if (data->pmksa) 359 return 1; 360 return 0; 361 } 362 363 364 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth, 365 struct wpa_state_machine *sm, 366 const u8 *wpa_ie, size_t wpa_ie_len, 367 const u8 *mdie, size_t mdie_len) 368 { 369 struct wpa_ie_data data; 370 int ciphers, key_mgmt, res, version; 371 u32 selector; 372 size_t i; 373 const u8 *pmkid = NULL; 374 375 if (wpa_auth == NULL || sm == NULL) 376 return WPA_NOT_ENABLED; 377 378 if (wpa_ie == NULL || wpa_ie_len < 1) 379 return WPA_INVALID_IE; 380 381 if (wpa_ie[0] == WLAN_EID_RSN) 382 version = WPA_PROTO_RSN; 383 else 384 version = WPA_PROTO_WPA; 385 386 if (!(wpa_auth->conf.wpa & version)) { 387 wpa_printf(MSG_DEBUG, "Invalid WPA proto (%d) from " MACSTR, 388 version, MAC2STR(sm->addr)); 389 return WPA_INVALID_PROTO; 390 } 391 392 if (version == WPA_PROTO_RSN) { 393 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data); 394 395 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; 396 if (0) { 397 } 398 #ifdef CONFIG_IEEE80211R 399 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) 400 selector = RSN_AUTH_KEY_MGMT_FT_802_1X; 401 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK) 402 selector = RSN_AUTH_KEY_MGMT_FT_PSK; 403 #endif /* CONFIG_IEEE80211R */ 404 #ifdef CONFIG_IEEE80211W 405 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) 406 selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256; 407 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256) 408 selector = RSN_AUTH_KEY_MGMT_PSK_SHA256; 409 #endif /* CONFIG_IEEE80211W */ 410 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) 411 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X; 412 else if (data.key_mgmt & WPA_KEY_MGMT_PSK) 413 selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X; 414 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; 415 416 selector = wpa_cipher_to_suite(WPA_PROTO_RSN, 417 data.pairwise_cipher); 418 if (!selector) 419 selector = RSN_CIPHER_SUITE_CCMP; 420 wpa_auth->dot11RSNAPairwiseCipherSelected = selector; 421 422 selector = wpa_cipher_to_suite(WPA_PROTO_RSN, 423 data.group_cipher); 424 if (!selector) 425 selector = RSN_CIPHER_SUITE_CCMP; 426 wpa_auth->dot11RSNAGroupCipherSelected = selector; 427 } else { 428 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data); 429 430 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; 431 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X) 432 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X; 433 else if (data.key_mgmt & WPA_KEY_MGMT_PSK) 434 selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X; 435 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector; 436 437 selector = wpa_cipher_to_suite(WPA_PROTO_WPA, 438 data.pairwise_cipher); 439 if (!selector) 440 selector = RSN_CIPHER_SUITE_TKIP; 441 wpa_auth->dot11RSNAPairwiseCipherSelected = selector; 442 443 selector = wpa_cipher_to_suite(WPA_PROTO_WPA, 444 data.group_cipher); 445 if (!selector) 446 selector = WPA_CIPHER_SUITE_TKIP; 447 wpa_auth->dot11RSNAGroupCipherSelected = selector; 448 } 449 if (res) { 450 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from " 451 MACSTR " (res=%d)", MAC2STR(sm->addr), res); 452 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len); 453 return WPA_INVALID_IE; 454 } 455 456 if (data.group_cipher != wpa_auth->conf.wpa_group) { 457 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from " 458 MACSTR, data.group_cipher, MAC2STR(sm->addr)); 459 return WPA_INVALID_GROUP; 460 } 461 462 key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt; 463 if (!key_mgmt) { 464 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from " 465 MACSTR, data.key_mgmt, MAC2STR(sm->addr)); 466 return WPA_INVALID_AKMP; 467 } 468 if (0) { 469 } 470 #ifdef CONFIG_IEEE80211R 471 else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) 472 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X; 473 else if (key_mgmt & WPA_KEY_MGMT_FT_PSK) 474 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK; 475 #endif /* CONFIG_IEEE80211R */ 476 #ifdef CONFIG_IEEE80211W 477 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) 478 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256; 479 else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256) 480 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256; 481 #endif /* CONFIG_IEEE80211W */ 482 else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X) 483 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X; 484 else 485 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK; 486 487 if (version == WPA_PROTO_RSN) 488 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise; 489 else 490 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise; 491 if (!ciphers) { 492 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) " 493 "from " MACSTR, 494 version == WPA_PROTO_RSN ? "RSN" : "WPA", 495 data.pairwise_cipher, MAC2STR(sm->addr)); 496 return WPA_INVALID_PAIRWISE; 497 } 498 499 #ifdef CONFIG_IEEE80211W 500 if (wpa_auth->conf.ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) { 501 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) { 502 wpa_printf(MSG_DEBUG, "Management frame protection " 503 "required, but client did not enable it"); 504 return WPA_MGMT_FRAME_PROTECTION_VIOLATION; 505 } 506 507 if (ciphers & WPA_CIPHER_TKIP) { 508 wpa_printf(MSG_DEBUG, "Management frame protection " 509 "cannot use TKIP"); 510 return WPA_MGMT_FRAME_PROTECTION_VIOLATION; 511 } 512 513 if (data.mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC) { 514 wpa_printf(MSG_DEBUG, "Unsupported management group " 515 "cipher %d", data.mgmt_group_cipher); 516 return WPA_INVALID_MGMT_GROUP_CIPHER; 517 } 518 } 519 520 if (wpa_auth->conf.ieee80211w == NO_MGMT_FRAME_PROTECTION || 521 !(data.capabilities & WPA_CAPABILITY_MFPC)) 522 sm->mgmt_frame_prot = 0; 523 else 524 sm->mgmt_frame_prot = 1; 525 #endif /* CONFIG_IEEE80211W */ 526 527 #ifdef CONFIG_IEEE80211R 528 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 529 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) { 530 wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but " 531 "MDIE not included"); 532 return WPA_INVALID_MDIE; 533 } 534 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain, 535 MOBILITY_DOMAIN_ID_LEN) != 0) { 536 wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown " 537 "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN); 538 return WPA_INVALID_MDIE; 539 } 540 } 541 #endif /* CONFIG_IEEE80211R */ 542 543 if (ciphers & WPA_CIPHER_CCMP) 544 sm->pairwise = WPA_CIPHER_CCMP; 545 else if (ciphers & WPA_CIPHER_GCMP) 546 sm->pairwise = WPA_CIPHER_GCMP; 547 else 548 sm->pairwise = WPA_CIPHER_TKIP; 549 550 /* TODO: clear WPA/WPA2 state if STA changes from one to another */ 551 if (wpa_ie[0] == WLAN_EID_RSN) 552 sm->wpa = WPA_VERSION_WPA2; 553 else 554 sm->wpa = WPA_VERSION_WPA; 555 556 sm->pmksa = NULL; 557 for (i = 0; i < data.num_pmkid; i++) { 558 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID", 559 &data.pmkid[i * PMKID_LEN], PMKID_LEN); 560 sm->pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sm->addr, 561 &data.pmkid[i * PMKID_LEN]); 562 if (sm->pmksa) { 563 pmkid = sm->pmksa->pmkid; 564 break; 565 } 566 } 567 for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc && 568 i < data.num_pmkid; i++) { 569 struct wpa_auth_okc_iter_data idata; 570 idata.pmksa = NULL; 571 idata.aa = wpa_auth->addr; 572 idata.spa = sm->addr; 573 idata.pmkid = &data.pmkid[i * PMKID_LEN]; 574 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata); 575 if (idata.pmksa) { 576 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 577 "OKC match for PMKID"); 578 sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa, 579 idata.pmksa, 580 wpa_auth->addr, 581 idata.pmkid); 582 pmkid = idata.pmkid; 583 break; 584 } 585 } 586 if (sm->pmksa) { 587 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 588 "PMKID found from PMKSA cache " 589 "eap_type=%d vlan_id=%d", 590 sm->pmksa->eap_type_authsrv, 591 sm->pmksa->vlan_id); 592 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN); 593 } 594 595 if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) { 596 os_free(sm->wpa_ie); 597 sm->wpa_ie = os_malloc(wpa_ie_len); 598 if (sm->wpa_ie == NULL) 599 return WPA_ALLOC_FAIL; 600 } 601 os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len); 602 sm->wpa_ie_len = wpa_ie_len; 603 604 return WPA_IE_OK; 605 } 606 607 608 /** 609 * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs 610 * @pos: Pointer to the IE header 611 * @end: Pointer to the end of the Key Data buffer 612 * @ie: Pointer to parsed IE data 613 * Returns: 0 on success, 1 if end mark is found, -1 on failure 614 */ 615 static int wpa_parse_generic(const u8 *pos, const u8 *end, 616 struct wpa_eapol_ie_parse *ie) 617 { 618 if (pos[1] == 0) 619 return 1; 620 621 if (pos[1] >= 6 && 622 RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE && 623 pos[2 + WPA_SELECTOR_LEN] == 1 && 624 pos[2 + WPA_SELECTOR_LEN + 1] == 0) { 625 ie->wpa_ie = pos; 626 ie->wpa_ie_len = pos[1] + 2; 627 return 0; 628 } 629 630 if (pos + 1 + RSN_SELECTOR_LEN < end && 631 pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN && 632 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) { 633 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN; 634 return 0; 635 } 636 637 if (pos[1] > RSN_SELECTOR_LEN + 2 && 638 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) { 639 ie->gtk = pos + 2 + RSN_SELECTOR_LEN; 640 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN; 641 return 0; 642 } 643 644 if (pos[1] > RSN_SELECTOR_LEN + 2 && 645 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) { 646 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN; 647 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN; 648 return 0; 649 } 650 651 #ifdef CONFIG_PEERKEY 652 if (pos[1] > RSN_SELECTOR_LEN + 2 && 653 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) { 654 ie->smk = pos + 2 + RSN_SELECTOR_LEN; 655 ie->smk_len = pos[1] - RSN_SELECTOR_LEN; 656 return 0; 657 } 658 659 if (pos[1] > RSN_SELECTOR_LEN + 2 && 660 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) { 661 ie->nonce = pos + 2 + RSN_SELECTOR_LEN; 662 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN; 663 return 0; 664 } 665 666 if (pos[1] > RSN_SELECTOR_LEN + 2 && 667 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) { 668 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN; 669 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN; 670 return 0; 671 } 672 673 if (pos[1] > RSN_SELECTOR_LEN + 2 && 674 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) { 675 ie->error = pos + 2 + RSN_SELECTOR_LEN; 676 ie->error_len = pos[1] - RSN_SELECTOR_LEN; 677 return 0; 678 } 679 #endif /* CONFIG_PEERKEY */ 680 681 #ifdef CONFIG_IEEE80211W 682 if (pos[1] > RSN_SELECTOR_LEN + 2 && 683 RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) { 684 ie->igtk = pos + 2 + RSN_SELECTOR_LEN; 685 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN; 686 return 0; 687 } 688 #endif /* CONFIG_IEEE80211W */ 689 690 return 0; 691 } 692 693 694 /** 695 * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs 696 * @buf: Pointer to the Key Data buffer 697 * @len: Key Data Length 698 * @ie: Pointer to parsed IE data 699 * Returns: 0 on success, -1 on failure 700 */ 701 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie) 702 { 703 const u8 *pos, *end; 704 int ret = 0; 705 706 os_memset(ie, 0, sizeof(*ie)); 707 for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) { 708 if (pos[0] == 0xdd && 709 ((pos == buf + len - 1) || pos[1] == 0)) { 710 /* Ignore padding */ 711 break; 712 } 713 if (pos + 2 + pos[1] > end) { 714 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data " 715 "underflow (ie=%d len=%d pos=%d)", 716 pos[0], pos[1], (int) (pos - buf)); 717 wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data", 718 buf, len); 719 ret = -1; 720 break; 721 } 722 if (*pos == WLAN_EID_RSN) { 723 ie->rsn_ie = pos; 724 ie->rsn_ie_len = pos[1] + 2; 725 #ifdef CONFIG_IEEE80211R 726 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) { 727 ie->mdie = pos; 728 ie->mdie_len = pos[1] + 2; 729 } else if (*pos == WLAN_EID_FAST_BSS_TRANSITION) { 730 ie->ftie = pos; 731 ie->ftie_len = pos[1] + 2; 732 #endif /* CONFIG_IEEE80211R */ 733 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) { 734 ret = wpa_parse_generic(pos, end, ie); 735 if (ret < 0) 736 break; 737 if (ret > 0) { 738 ret = 0; 739 break; 740 } 741 } else { 742 wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key " 743 "Key Data IE", pos, 2 + pos[1]); 744 } 745 } 746 747 return ret; 748 } 749 750 751 int wpa_auth_uses_mfp(struct wpa_state_machine *sm) 752 { 753 return sm ? sm->mgmt_frame_prot : 0; 754 } 755
