contrib/wpa/src/ap/wpa_auth.c

   1 /*
   2  * IEEE 802.11 RSN / WPA Authenticator
   3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "utils/state_machine.h"
  14 #include "utils/bitfield.h"
  15 #include "common/ieee802_11_defs.h"
  16 #include "crypto/aes_wrap.h"
  17 #include "crypto/crypto.h"
  18 #include "crypto/sha1.h"
  19 #include "crypto/sha256.h"
  20 #include "crypto/random.h"
  21 #include "eapol_auth/eapol_auth_sm.h"
  22 #include "ap_config.h"
  23 #include "ieee802_11.h"
  24 #include "wpa_auth.h"
  25 #include "pmksa_cache_auth.h"
  26 #include "wpa_auth_i.h"
  27 #include "wpa_auth_ie.h"
  28
  29 #define STATE_MACHINE_DATA struct wpa_state_machine
  30 #define STATE_MACHINE_DEBUG_PREFIX "WPA"
  31 #define STATE_MACHINE_ADDR sm->addr
  32
  33
  34 static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx);
  35 static int wpa_sm_step(struct wpa_state_machine *sm);
  36 static int wpa_verify_key_mic(int akmp, struct wpa_ptk *PTK, u8 *data,
  37                               size_t data_len);
  38 static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx);
  39 static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth,
  40                               struct wpa_group *group);
  41 static void wpa_request_new_ptk(struct wpa_state_machine *sm);
  42 static int wpa_gtk_update(struct wpa_authenticator *wpa_auth,
  43                           struct wpa_group *group);
  44 static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth,
  45                                        struct wpa_group *group);
  46 static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce,
  47                           const u8 *pmk, unsigned int pmk_len,
  48                           struct wpa_ptk *ptk);
  49 static void wpa_group_free(struct wpa_authenticator *wpa_auth,
  50                            struct wpa_group *group);
  51 static void wpa_group_get(struct wpa_authenticator *wpa_auth,
  52                           struct wpa_group *group);
  53 static void wpa_group_put(struct wpa_authenticator *wpa_auth,
  54                           struct wpa_group *group);
  55
  56 static const u32 dot11RSNAConfigGroupUpdateCount = 4;
  57 static const u32 dot11RSNAConfigPairwiseUpdateCount = 4;
  58 static const u32 eapol_key_timeout_first = 100; /* ms */
  59 static const u32 eapol_key_timeout_subseq = 1000; /* ms */
  60 static const u32 eapol_key_timeout_first_group = 500; /* ms */
  61
  62 /* TODO: make these configurable */
  63 static const int dot11RSNAConfigPMKLifetime = 43200;
  64 static const int dot11RSNAConfigPMKReauthThreshold = 70;
  65 static const int dot11RSNAConfigSATimeout = 60;
  66
  67
  68 static inline int wpa_auth_mic_failure_report(
  69         struct wpa_authenticator *wpa_auth, const u8 *addr)
  70 {
  71         if (wpa_auth->cb.mic_failure_report)
  72                 return wpa_auth->cb.mic_failure_report(wpa_auth->cb.ctx, addr);
  73         return 0;
  74 }
  75
  76
  77 static inline void wpa_auth_psk_failure_report(
  78         struct wpa_authenticator *wpa_auth, const u8 *addr)
  79 {
  80         if (wpa_auth->cb.psk_failure_report)
  81                 wpa_auth->cb.psk_failure_report(wpa_auth->cb.ctx, addr);
  82 }
  83
  84
  85 static inline void wpa_auth_set_eapol(struct wpa_authenticator *wpa_auth,
  86                                       const u8 *addr, wpa_eapol_variable var,
  87                                       int value)
  88 {
  89         if (wpa_auth->cb.set_eapol)
  90                 wpa_auth->cb.set_eapol(wpa_auth->cb.ctx, addr, var, value);
  91 }
  92
  93
  94 static inline int wpa_auth_get_eapol(struct wpa_authenticator *wpa_auth,
  95                                      const u8 *addr, wpa_eapol_variable var)
  96 {
  97         if (wpa_auth->cb.get_eapol == NULL)
  98                 return -1;
  99         return wpa_auth->cb.get_eapol(wpa_auth->cb.ctx, addr, var);
 100 }
 101
 102
 103 static inline const u8 * wpa_auth_get_psk(struct wpa_authenticator *wpa_auth,
 104                                           const u8 *addr,
 105                                           const u8 *p2p_dev_addr,
 106                                           const u8 *prev_psk)
 107 {
 108         if (wpa_auth->cb.get_psk == NULL)
 109                 return NULL;
 110         return wpa_auth->cb.get_psk(wpa_auth->cb.ctx, addr, p2p_dev_addr,
 111                                     prev_psk);
 112 }
 113
 114
 115 static inline int wpa_auth_get_msk(struct wpa_authenticator *wpa_auth,
 116                                    const u8 *addr, u8 *msk, size_t *len)
 117 {
 118         if (wpa_auth->cb.get_msk == NULL)
 119                 return -1;
 120         return wpa_auth->cb.get_msk(wpa_auth->cb.ctx, addr, msk, len);
 121 }
 122
 123
 124 static inline int wpa_auth_set_key(struct wpa_authenticator *wpa_auth,
 125                                    int vlan_id,
 126                                    enum wpa_alg alg, const u8 *addr, int idx,
 127                                    u8 *key, size_t key_len)
 128 {
 129         if (wpa_auth->cb.set_key == NULL)
 130                 return -1;
 131         return wpa_auth->cb.set_key(wpa_auth->cb.ctx, vlan_id, alg, addr, idx,
 132                                     key, key_len);
 133 }
 134
 135
 136 static inline int wpa_auth_get_seqnum(struct wpa_authenticator *wpa_auth,
 137                                       const u8 *addr, int idx, u8 *seq)
 138 {
 139         if (wpa_auth->cb.get_seqnum == NULL)
 140                 return -1;
 141         return wpa_auth->cb.get_seqnum(wpa_auth->cb.ctx, addr, idx, seq);
 142 }
 143
 144
 145 static inline int
 146 wpa_auth_send_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr,
 147                     const u8 *data, size_t data_len, int encrypt)
 148 {
 149         if (wpa_auth->cb.send_eapol == NULL)
 150                 return -1;
 151         return wpa_auth->cb.send_eapol(wpa_auth->cb.ctx, addr, data, data_len,
 152                                        encrypt);
 153 }
 154
 155
 156 #ifdef CONFIG_MESH
 157 static inline int wpa_auth_start_ampe(struct wpa_authenticator *wpa_auth,
 158                                       const u8 *addr)
 159 {
 160         if (wpa_auth->cb.start_ampe == NULL)
 161                 return -1;
 162         return wpa_auth->cb.start_ampe(wpa_auth->cb.ctx, addr);
 163 }
 164 #endif /* CONFIG_MESH */
 165
 166
 167 int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth,
 168                           int (*cb)(struct wpa_state_machine *sm, void *ctx),
 169                           void *cb_ctx)
 170 {
 171         if (wpa_auth->cb.for_each_sta == NULL)
 172                 return 0;
 173         return wpa_auth->cb.for_each_sta(wpa_auth->cb.ctx, cb, cb_ctx);
 174 }
 175
 176
 177 int wpa_auth_for_each_auth(struct wpa_authenticator *wpa_auth,
 178                            int (*cb)(struct wpa_authenticator *a, void *ctx),
 179                            void *cb_ctx)
 180 {
 181         if (wpa_auth->cb.for_each_auth == NULL)
 182                 return 0;
 183         return wpa_auth->cb.for_each_auth(wpa_auth->cb.ctx, cb, cb_ctx);
 184 }
 185
 186
 187 void wpa_auth_logger(struct wpa_authenticator *wpa_auth, const u8 *addr,
 188                      logger_level level, const char *txt)
 189 {
 190         if (wpa_auth->cb.logger == NULL)
 191                 return;
 192         wpa_auth->cb.logger(wpa_auth->cb.ctx, addr, level, txt);
 193 }
 194
 195
 196 void wpa_auth_vlogger(struct wpa_authenticator *wpa_auth, const u8 *addr,
 197                       logger_level level, const char *fmt, ...)
 198 {
 199         char *format;
 200         int maxlen;
 201         va_list ap;
 202
 203         if (wpa_auth->cb.logger == NULL)
 204                 return;
 205
 206         maxlen = os_strlen(fmt) + 100;
 207         format = os_malloc(maxlen);
 208         if (!format)
 209                 return;
 210
 211         va_start(ap, fmt);
 212         vsnprintf(format, maxlen, fmt, ap);
 213         va_end(ap);
 214
 215         wpa_auth_logger(wpa_auth, addr, level, format);
 216
 217         os_free(format);
 218 }
 219
 220
 221 static void wpa_sta_disconnect(struct wpa_authenticator *wpa_auth,
 222                                const u8 *addr)
 223 {
 224         if (wpa_auth->cb.disconnect == NULL)
 225                 return;
 226         wpa_printf(MSG_DEBUG, "wpa_sta_disconnect STA " MACSTR, MAC2STR(addr));
 227         wpa_auth->cb.disconnect(wpa_auth->cb.ctx, addr,
 228                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
 229 }
 230
 231
 232 static int wpa_use_aes_cmac(struct wpa_state_machine *sm)
 233 {
 234         int ret = 0;
 235 #ifdef CONFIG_IEEE80211R
 236         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt))
 237                 ret = 1;
 238 #endif /* CONFIG_IEEE80211R */
 239 #ifdef CONFIG_IEEE80211W
 240         if (wpa_key_mgmt_sha256(sm->wpa_key_mgmt))
 241                 ret = 1;
 242 #endif /* CONFIG_IEEE80211W */
 243         if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN)
 244                 ret = 1;
 245         return ret;
 246 }
 247
 248
 249 static void wpa_rekey_gmk(void *eloop_ctx, void *timeout_ctx)
 250 {
 251         struct wpa_authenticator *wpa_auth = eloop_ctx;
 252
 253         if (random_get_bytes(wpa_auth->group->GMK, WPA_GMK_LEN)) {
 254                 wpa_printf(MSG_ERROR, "Failed to get random data for WPA "
 255                            "initialization.");
 256         } else {
 257                 wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "GMK rekeyd");
 258                 wpa_hexdump_key(MSG_DEBUG, "GMK",
 259                                 wpa_auth->group->GMK, WPA_GMK_LEN);
 260         }
 261
 262         if (wpa_auth->conf.wpa_gmk_rekey) {
 263                 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0,
 264                                        wpa_rekey_gmk, wpa_auth, NULL);
 265         }
 266 }
 267
 268
 269 static void wpa_rekey_gtk(void *eloop_ctx, void *timeout_ctx)
 270 {
 271         struct wpa_authenticator *wpa_auth = eloop_ctx;
 272         struct wpa_group *group, *next;
 273
 274         wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "rekeying GTK");
 275         group = wpa_auth->group;
 276         while (group) {
 277                 wpa_group_get(wpa_auth, group);
 278
 279                 group->GTKReKey = TRUE;
 280                 do {
 281                         group->changed = FALSE;
 282                         wpa_group_sm_step(wpa_auth, group);
 283                 } while (group->changed);
 284
 285                 next = group->next;
 286                 wpa_group_put(wpa_auth, group);
 287                 group = next;
 288         }
 289
 290         if (wpa_auth->conf.wpa_group_rekey) {
 291                 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey,
 292                                        0, wpa_rekey_gtk, wpa_auth, NULL);
 293         }
 294 }
 295
 296
 297 static void wpa_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
 298 {
 299         struct wpa_authenticator *wpa_auth = eloop_ctx;
 300         struct wpa_state_machine *sm = timeout_ctx;
 301
 302         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "rekeying PTK");
 303         wpa_request_new_ptk(sm);
 304         wpa_sm_step(sm);
 305 }
 306
 307
 308 static int wpa_auth_pmksa_clear_cb(struct wpa_state_machine *sm, void *ctx)
 309 {
 310         if (sm->pmksa == ctx)
 311                 sm->pmksa = NULL;
 312         return 0;
 313 }
 314
 315
 316 static void wpa_auth_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
 317                                    void *ctx)
 318 {
 319         struct wpa_authenticator *wpa_auth = ctx;
 320         wpa_auth_for_each_sta(wpa_auth, wpa_auth_pmksa_clear_cb, entry);
 321 }
 322
 323
 324 static int wpa_group_init_gmk_and_counter(struct wpa_authenticator *wpa_auth,
 325                                           struct wpa_group *group)
 326 {
 327         u8 buf[ETH_ALEN + 8 + sizeof(unsigned long)];
 328         u8 rkey[32];
 329         unsigned long ptr;
 330
 331         if (random_get_bytes(group->GMK, WPA_GMK_LEN) < 0)
 332                 return -1;
 333         wpa_hexdump_key(MSG_DEBUG, "GMK", group->GMK, WPA_GMK_LEN);
 334
 335         /*
 336          * Counter = PRF-256(Random number, "Init Counter",
 337          *                   Local MAC Address || Time)
 338          */
 339         os_memcpy(buf, wpa_auth->addr, ETH_ALEN);
 340         wpa_get_ntp_timestamp(buf + ETH_ALEN);
 341         ptr = (unsigned long) group;
 342         os_memcpy(buf + ETH_ALEN + 8, &ptr, sizeof(ptr));
 343         if (random_get_bytes(rkey, sizeof(rkey)) < 0)
 344                 return -1;
 345
 346         if (sha1_prf(rkey, sizeof(rkey), "Init Counter", buf, sizeof(buf),
 347                      group->Counter, WPA_NONCE_LEN) < 0)
 348                 return -1;
 349         wpa_hexdump_key(MSG_DEBUG, "Key Counter",
 350                         group->Counter, WPA_NONCE_LEN);
 351
 352         return 0;
 353 }
 354
 355
 356 static struct wpa_group * wpa_group_init(struct wpa_authenticator *wpa_auth,
 357                                          int vlan_id, int delay_init)
 358 {
 359         struct wpa_group *group;
 360
 361         group = os_zalloc(sizeof(struct wpa_group));
 362         if (group == NULL)
 363                 return NULL;
 364
 365         group->GTKAuthenticator = TRUE;
 366         group->vlan_id = vlan_id;
 367         group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group);
 368
 369         if (random_pool_ready() != 1) {
 370                 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool "
 371                            "for secure operations - update keys later when "
 372                            "the first station connects");
 373         }
 374
 375         /*
 376          * Set initial GMK/Counter value here. The actual values that will be
 377          * used in negotiations will be set once the first station tries to
 378          * connect. This allows more time for collecting additional randomness
 379          * on embedded devices.
 380          */
 381         if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0) {
 382                 wpa_printf(MSG_ERROR, "Failed to get random data for WPA "
 383                            "initialization.");
 384                 os_free(group);
 385                 return NULL;
 386         }
 387
 388         group->GInit = TRUE;
 389         if (delay_init) {
 390                 wpa_printf(MSG_DEBUG, "WPA: Delay group state machine start "
 391                            "until Beacon frames have been configured");
 392                 /* Initialization is completed in wpa_init_keys(). */
 393         } else {
 394                 wpa_group_sm_step(wpa_auth, group);
 395                 group->GInit = FALSE;
 396                 wpa_group_sm_step(wpa_auth, group);
 397         }
 398
 399         return group;
 400 }
 401
 402
 403 /**
 404  * wpa_init - Initialize WPA authenticator
 405  * @addr: Authenticator address
 406  * @conf: Configuration for WPA authenticator
 407  * @cb: Callback functions for WPA authenticator
 408  * Returns: Pointer to WPA authenticator data or %NULL on failure
 409  */
 410 struct wpa_authenticator * wpa_init(const u8 *addr,
 411                                     struct wpa_auth_config *conf,
 412                                     struct wpa_auth_callbacks *cb)
 413 {
 414         struct wpa_authenticator *wpa_auth;
 415
 416         wpa_auth = os_zalloc(sizeof(struct wpa_authenticator));
 417         if (wpa_auth == NULL)
 418                 return NULL;
 419         os_memcpy(wpa_auth->addr, addr, ETH_ALEN);
 420         os_memcpy(&wpa_auth->conf, conf, sizeof(*conf));
 421         os_memcpy(&wpa_auth->cb, cb, sizeof(*cb));
 422
 423         if (wpa_auth_gen_wpa_ie(wpa_auth)) {
 424                 wpa_printf(MSG_ERROR, "Could not generate WPA IE.");
 425                 os_free(wpa_auth);
 426                 return NULL;
 427         }
 428
 429         wpa_auth->group = wpa_group_init(wpa_auth, 0, 1);
 430         if (wpa_auth->group == NULL) {
 431                 os_free(wpa_auth->wpa_ie);
 432                 os_free(wpa_auth);
 433                 return NULL;
 434         }
 435
 436         wpa_auth->pmksa = pmksa_cache_auth_init(wpa_auth_pmksa_free_cb,
 437                                                 wpa_auth);
 438         if (wpa_auth->pmksa == NULL) {
 439                 wpa_printf(MSG_ERROR, "PMKSA cache initialization failed.");
 440                 os_free(wpa_auth->group);
 441                 os_free(wpa_auth->wpa_ie);
 442                 os_free(wpa_auth);
 443                 return NULL;
 444         }
 445
 446 #ifdef CONFIG_IEEE80211R
 447         wpa_auth->ft_pmk_cache = wpa_ft_pmk_cache_init();
 448         if (wpa_auth->ft_pmk_cache == NULL) {
 449                 wpa_printf(MSG_ERROR, "FT PMK cache initialization failed.");
 450                 os_free(wpa_auth->group);
 451                 os_free(wpa_auth->wpa_ie);
 452                 pmksa_cache_auth_deinit(wpa_auth->pmksa);
 453                 os_free(wpa_auth);
 454                 return NULL;
 455         }
 456 #endif /* CONFIG_IEEE80211R */
 457
 458         if (wpa_auth->conf.wpa_gmk_rekey) {
 459                 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0,
 460                                        wpa_rekey_gmk, wpa_auth, NULL);
 461         }
 462
 463         if (wpa_auth->conf.wpa_group_rekey) {
 464                 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 0,
 465                                        wpa_rekey_gtk, wpa_auth, NULL);
 466         }
 467
 468 #ifdef CONFIG_P2P
 469         if (WPA_GET_BE32(conf->ip_addr_start)) {
 470                 int count = WPA_GET_BE32(conf->ip_addr_end) -
 471                         WPA_GET_BE32(conf->ip_addr_start) + 1;
 472                 if (count > 1000)
 473                         count = 1000;
 474                 if (count > 0)
 475                         wpa_auth->ip_pool = bitfield_alloc(count);
 476         }
 477 #endif /* CONFIG_P2P */
 478
 479         return wpa_auth;
 480 }
 481
 482
 483 int wpa_init_keys(struct wpa_authenticator *wpa_auth)
 484 {
 485         struct wpa_group *group = wpa_auth->group;
 486
 487         wpa_printf(MSG_DEBUG, "WPA: Start group state machine to set initial "
 488                    "keys");
 489         wpa_group_sm_step(wpa_auth, group);
 490         group->GInit = FALSE;
 491         wpa_group_sm_step(wpa_auth, group);
 492         if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE)
 493                 return -1;
 494         return 0;
 495 }
 496
 497
 498 /**
 499  * wpa_deinit - Deinitialize WPA authenticator
 500  * @wpa_auth: Pointer to WPA authenticator data from wpa_init()
 501  */
 502 void wpa_deinit(struct wpa_authenticator *wpa_auth)
 503 {
 504         struct wpa_group *group, *prev;
 505
 506         eloop_cancel_timeout(wpa_rekey_gmk, wpa_auth, NULL);
 507         eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL);
 508
 509 #ifdef CONFIG_PEERKEY
 510         while (wpa_auth->stsl_negotiations)
 511                 wpa_stsl_remove(wpa_auth, wpa_auth->stsl_negotiations);
 512 #endif /* CONFIG_PEERKEY */
 513
 514         pmksa_cache_auth_deinit(wpa_auth->pmksa);
 515
 516 #ifdef CONFIG_IEEE80211R
 517         wpa_ft_pmk_cache_deinit(wpa_auth->ft_pmk_cache);
 518         wpa_auth->ft_pmk_cache = NULL;
 519 #endif /* CONFIG_IEEE80211R */
 520
 521 #ifdef CONFIG_P2P
 522         bitfield_free(wpa_auth->ip_pool);
 523 #endif /* CONFIG_P2P */
 524
 525
 526         os_free(wpa_auth->wpa_ie);
 527
 528         group = wpa_auth->group;
 529         while (group) {
 530                 prev = group;
 531                 group = group->next;
 532                 os_free(prev);
 533         }
 534
 535         os_free(wpa_auth);
 536 }
 537
 538
 539 /**
 540  * wpa_reconfig - Update WPA authenticator configuration
 541  * @wpa_auth: Pointer to WPA authenticator data from wpa_init()
 542  * @conf: Configuration for WPA authenticator
 543  */
 544 int wpa_reconfig(struct wpa_authenticator *wpa_auth,
 545                  struct wpa_auth_config *conf)
 546 {
 547         struct wpa_group *group;
 548         if (wpa_auth == NULL)
 549                 return 0;
 550
 551         os_memcpy(&wpa_auth->conf, conf, sizeof(*conf));
 552         if (wpa_auth_gen_wpa_ie(wpa_auth)) {
 553                 wpa_printf(MSG_ERROR, "Could not generate WPA IE.");
 554                 return -1;
 555         }
 556
 557         /*
 558          * Reinitialize GTK to make sure it is suitable for the new
 559          * configuration.
 560          */
 561         group = wpa_auth->group;
 562         group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group);
 563         group->GInit = TRUE;
 564         wpa_group_sm_step(wpa_auth, group);
 565         group->GInit = FALSE;
 566         wpa_group_sm_step(wpa_auth, group);
 567
 568         return 0;
 569 }
 570
 571
 572 struct wpa_state_machine *
 573 wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr,
 574                   const u8 *p2p_dev_addr)
 575 {
 576         struct wpa_state_machine *sm;
 577
 578         if (wpa_auth->group->wpa_group_state == WPA_GROUP_FATAL_FAILURE)
 579                 return NULL;
 580
 581         sm = os_zalloc(sizeof(struct wpa_state_machine));
 582         if (sm == NULL)
 583                 return NULL;
 584         os_memcpy(sm->addr, addr, ETH_ALEN);
 585         if (p2p_dev_addr)
 586                 os_memcpy(sm->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
 587
 588         sm->wpa_auth = wpa_auth;
 589         sm->group = wpa_auth->group;
 590         wpa_group_get(sm->wpa_auth, sm->group);
 591
 592         return sm;
 593 }
 594
 595
 596 int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth,
 597                             struct wpa_state_machine *sm)
 598 {
 599         if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL)
 600                 return -1;
 601
 602 #ifdef CONFIG_IEEE80211R
 603         if (sm->ft_completed) {
 604                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
 605                                 "FT authentication already completed - do not "
 606                                 "start 4-way handshake");
 607                 /* Go to PTKINITDONE state to allow GTK rekeying */
 608                 sm->wpa_ptk_state = WPA_PTK_PTKINITDONE;
 609                 return 0;
 610         }
 611 #endif /* CONFIG_IEEE80211R */
 612
 613         if (sm->started) {
 614                 os_memset(&sm->key_replay, 0, sizeof(sm->key_replay));
 615                 sm->ReAuthenticationRequest = TRUE;
 616                 return wpa_sm_step(sm);
 617         }
 618
 619         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
 620                         "start authentication");
 621         sm->started = 1;
 622
 623         sm->Init = TRUE;
 624         if (wpa_sm_step(sm) == 1)
 625                 return 1; /* should not really happen */
 626         sm->Init = FALSE;
 627         sm->AuthenticationRequest = TRUE;
 628         return wpa_sm_step(sm);
 629 }
 630
 631
 632 void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm)
 633 {
 634         /* WPA/RSN was not used - clear WPA state. This is needed if the STA
 635          * reassociates back to the same AP while the previous entry for the
 636          * STA has not yet been removed. */
 637         if (sm == NULL)
 638                 return;
 639
 640         sm->wpa_key_mgmt = 0;
 641 }
 642
 643
 644 static void wpa_free_sta_sm(struct wpa_state_machine *sm)
 645 {
 646 #ifdef CONFIG_P2P
 647         if (WPA_GET_BE32(sm->ip_addr)) {
 648                 u32 start;
 649                 wpa_printf(MSG_DEBUG, "P2P: Free assigned IP "
 650                            "address %u.%u.%u.%u from " MACSTR,
 651                            sm->ip_addr[0], sm->ip_addr[1],
 652                            sm->ip_addr[2], sm->ip_addr[3],
 653                            MAC2STR(sm->addr));
 654                 start = WPA_GET_BE32(sm->wpa_auth->conf.ip_addr_start);
 655                 bitfield_clear(sm->wpa_auth->ip_pool,
 656                                WPA_GET_BE32(sm->ip_addr) - start);
 657         }
 658 #endif /* CONFIG_P2P */
 659         if (sm->GUpdateStationKeys) {
 660                 sm->group->GKeyDoneStations--;
 661                 sm->GUpdateStationKeys = FALSE;
 662         }
 663 #ifdef CONFIG_IEEE80211R
 664         os_free(sm->assoc_resp_ftie);
 665         wpabuf_free(sm->ft_pending_req_ies);
 666 #endif /* CONFIG_IEEE80211R */
 667         os_free(sm->last_rx_eapol_key);
 668         os_free(sm->wpa_ie);
 669         wpa_group_put(sm->wpa_auth, sm->group);
 670         os_free(sm);
 671 }
 672
 673
 674 void wpa_auth_sta_deinit(struct wpa_state_machine *sm)
 675 {
 676         if (sm == NULL)
 677                 return;
 678
 679         if (sm->wpa_auth->conf.wpa_strict_rekey && sm->has_GTK) {
 680                 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
 681                                 "strict rekeying - force GTK rekey since STA "
 682                                 "is leaving");
 683                 eloop_cancel_timeout(wpa_rekey_gtk, sm->wpa_auth, NULL);
 684                 eloop_register_timeout(0, 500000, wpa_rekey_gtk, sm->wpa_auth,
 685                                        NULL);
 686         }
 687
 688         eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm);
 689         sm->pending_1_of_4_timeout = 0;
 690         eloop_cancel_timeout(wpa_sm_call_step, sm, NULL);
 691         eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
 692         if (sm->in_step_loop) {
 693                 /* Must not free state machine while wpa_sm_step() is running.
 694                  * Freeing will be completed in the end of wpa_sm_step(). */
 695                 wpa_printf(MSG_DEBUG, "WPA: Registering pending STA state "
 696                            "machine deinit for " MACSTR, MAC2STR(sm->addr));
 697                 sm->pending_deinit = 1;
 698         } else
 699                 wpa_free_sta_sm(sm);
 700 }
 701
 702
 703 static void wpa_request_new_ptk(struct wpa_state_machine *sm)
 704 {
 705         if (sm == NULL)
 706                 return;
 707
 708         sm->PTKRequest = TRUE;
 709         sm->PTK_valid = 0;
 710 }
 711
 712
 713 static int wpa_replay_counter_valid(struct wpa_key_replay_counter *ctr,
 714                                     const u8 *replay_counter)
 715 {
 716         int i;
 717         for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) {
 718                 if (!ctr[i].valid)
 719                         break;
 720                 if (os_memcmp(replay_counter, ctr[i].counter,
 721                               WPA_REPLAY_COUNTER_LEN) == 0)
 722                         return 1;
 723         }
 724         return 0;
 725 }
 726
 727
 728 static void wpa_replay_counter_mark_invalid(struct wpa_key_replay_counter *ctr,
 729                                             const u8 *replay_counter)
 730 {
 731         int i;
 732         for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) {
 733                 if (ctr[i].valid &&
 734                     (replay_counter == NULL ||
 735                      os_memcmp(replay_counter, ctr[i].counter,
 736                                WPA_REPLAY_COUNTER_LEN) == 0))
 737                         ctr[i].valid = FALSE;
 738         }
 739 }
 740
 741
 742 #ifdef CONFIG_IEEE80211R
 743 static int ft_check_msg_2_of_4(struct wpa_authenticator *wpa_auth,
 744                                struct wpa_state_machine *sm,
 745                                struct wpa_eapol_ie_parse *kde)
 746 {
 747         struct wpa_ie_data ie;
 748         struct rsn_mdie *mdie;
 749
 750         if (wpa_parse_wpa_ie_rsn(kde->rsn_ie, kde->rsn_ie_len, &ie) < 0 ||
 751             ie.num_pmkid != 1 || ie.pmkid == NULL) {
 752                 wpa_printf(MSG_DEBUG, "FT: No PMKR1Name in "
 753                            "FT 4-way handshake message 2/4");
 754                 return -1;
 755         }
 756
 757         os_memcpy(sm->sup_pmk_r1_name, ie.pmkid, PMKID_LEN);
 758         wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Supplicant",
 759                     sm->sup_pmk_r1_name, PMKID_LEN);
 760
 761         if (!kde->mdie || !kde->ftie) {
 762                 wpa_printf(MSG_DEBUG, "FT: No %s in FT 4-way handshake "
 763                            "message 2/4", kde->mdie ? "FTIE" : "MDIE");
 764                 return -1;
 765         }
 766
 767         mdie = (struct rsn_mdie *) (kde->mdie + 2);
 768         if (kde->mdie[1] < sizeof(struct rsn_mdie) ||
 769             os_memcmp(wpa_auth->conf.mobility_domain, mdie->mobility_domain,
 770                       MOBILITY_DOMAIN_ID_LEN) != 0) {
 771                 wpa_printf(MSG_DEBUG, "FT: MDIE mismatch");
 772                 return -1;
 773         }
 774
 775         if (sm->assoc_resp_ftie &&
 776             (kde->ftie[1] != sm->assoc_resp_ftie[1] ||
 777              os_memcmp(kde->ftie, sm->assoc_resp_ftie,
 778                        2 + sm->assoc_resp_ftie[1]) != 0)) {
 779                 wpa_printf(MSG_DEBUG, "FT: FTIE mismatch");
 780                 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 2/4",
 781                             kde->ftie, kde->ftie_len);
 782                 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)AssocResp",
 783                             sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]);
 784                 return -1;
 785         }
 786
 787         return 0;
 788 }
 789 #endif /* CONFIG_IEEE80211R */
 790
 791
 792 static int wpa_receive_error_report(struct wpa_authenticator *wpa_auth,
 793                                     struct wpa_state_machine *sm, int group)
 794 {
 795         /* Supplicant reported a Michael MIC error */
 796         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
 797                          "received EAPOL-Key Error Request "
 798                          "(STA detected Michael MIC failure (group=%d))",
 799                          group);
 800
 801         if (group && wpa_auth->conf.wpa_group != WPA_CIPHER_TKIP) {
 802                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
 803                                 "ignore Michael MIC failure report since "
 804                                 "group cipher is not TKIP");
 805         } else if (!group && sm->pairwise != WPA_CIPHER_TKIP) {
 806                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
 807                                 "ignore Michael MIC failure report since "
 808                                 "pairwise cipher is not TKIP");
 809         } else {
 810                 if (wpa_auth_mic_failure_report(wpa_auth, sm->addr) > 0)
 811                         return 1; /* STA entry was removed */
 812                 sm->dot11RSNAStatsTKIPRemoteMICFailures++;
 813                 wpa_auth->dot11RSNAStatsTKIPRemoteMICFailures++;
 814         }
 815
 816         /*
 817          * Error report is not a request for a new key handshake, but since
 818          * Authenticator may do it, let's change the keys now anyway.
 819          */
 820         wpa_request_new_ptk(sm);
 821         return 0;
 822 }
 823
 824
 825 static int wpa_try_alt_snonce(struct wpa_state_machine *sm, u8 *data,
 826                               size_t data_len)
 827 {
 828         struct wpa_ptk PTK;
 829         int ok = 0;
 830         const u8 *pmk = NULL;
 831         unsigned int pmk_len;
 832
 833         for (;;) {
 834                 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
 835                         pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr,
 836                                                sm->p2p_dev_addr, pmk);
 837                         if (pmk == NULL)
 838                                 break;
 839                         pmk_len = PMK_LEN;
 840                 } else {
 841                         pmk = sm->PMK;
 842                         pmk_len = sm->pmk_len;
 843                 }
 844
 845                 wpa_derive_ptk(sm, sm->alt_SNonce, pmk, pmk_len, &PTK);
 846
 847                 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &PTK, data, data_len)
 848                     == 0) {
 849                         ok = 1;
 850                         break;
 851                 }
 852
 853                 if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt))
 854                         break;
 855         }
 856
 857         if (!ok) {
 858                 wpa_printf(MSG_DEBUG,
 859                            "WPA: Earlier SNonce did not result in matching MIC");
 860                 return -1;
 861         }
 862
 863         wpa_printf(MSG_DEBUG,
 864                    "WPA: Earlier SNonce resulted in matching MIC");
 865         sm->alt_snonce_valid = 0;
 866         os_memcpy(sm->SNonce, sm->alt_SNonce, WPA_NONCE_LEN);
 867         os_memcpy(&sm->PTK, &PTK, sizeof(PTK));
 868         sm->PTK_valid = TRUE;
 869
 870         return 0;
 871 }
 872
 873
 874 void wpa_receive(struct wpa_authenticator *wpa_auth,
 875                  struct wpa_state_machine *sm,
 876                  u8 *data, size_t data_len)
 877 {
 878         struct ieee802_1x_hdr *hdr;
 879         struct wpa_eapol_key *key;
 880         struct wpa_eapol_key_192 *key192;
 881         u16 key_info, key_data_length;
 882         enum { PAIRWISE_2, PAIRWISE_4, GROUP_2, REQUEST,
 883                SMK_M1, SMK_M3, SMK_ERROR } msg;
 884         char *msgtxt;
 885         struct wpa_eapol_ie_parse kde;
 886         int ft;
 887         const u8 *eapol_key_ie, *key_data;
 888         size_t eapol_key_ie_len, keyhdrlen, mic_len;
 889
 890         if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL)
 891                 return;
 892
 893         mic_len = wpa_mic_len(sm->wpa_key_mgmt);
 894         keyhdrlen = mic_len == 24 ? sizeof(*key192) : sizeof(*key);
 895
 896         if (data_len < sizeof(*hdr) + keyhdrlen)
 897                 return;
 898
 899         hdr = (struct ieee802_1x_hdr *) data;
 900         key = (struct wpa_eapol_key *) (hdr + 1);
 901         key192 = (struct wpa_eapol_key_192 *) (hdr + 1);
 902         key_info = WPA_GET_BE16(key->key_info);
 903         if (mic_len == 24) {
 904                 key_data = (const u8 *) (key192 + 1);
 905                 key_data_length = WPA_GET_BE16(key192->key_data_length);
 906         } else {
 907                 key_data = (const u8 *) (key + 1);
 908                 key_data_length = WPA_GET_BE16(key->key_data_length);
 909         }
 910         wpa_printf(MSG_DEBUG, "WPA: Received EAPOL-Key from " MACSTR
 911                    " key_info=0x%x type=%u key_data_length=%u",
 912                    MAC2STR(sm->addr), key_info, key->type, key_data_length);
 913         if (key_data_length > data_len - sizeof(*hdr) - keyhdrlen) {
 914                 wpa_printf(MSG_INFO, "WPA: Invalid EAPOL-Key frame - "
 915                            "key_data overflow (%d > %lu)",
 916                            key_data_length,
 917                            (unsigned long) (data_len - sizeof(*hdr) -
 918                                             keyhdrlen));
 919                 return;
 920         }
 921
 922         if (sm->wpa == WPA_VERSION_WPA2) {
 923                 if (key->type == EAPOL_KEY_TYPE_WPA) {
 924                         /*
 925                          * Some deployed station implementations seem to send
 926                          * msg 4/4 with incorrect type value in WPA2 mode.
 927                          */
 928                         wpa_printf(MSG_DEBUG, "Workaround: Allow EAPOL-Key "
 929                                    "with unexpected WPA type in RSN mode");
 930                 } else if (key->type != EAPOL_KEY_TYPE_RSN) {
 931                         wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with "
 932                                    "unexpected type %d in RSN mode",
 933                                    key->type);
 934                         return;
 935                 }
 936         } else {
 937                 if (key->type != EAPOL_KEY_TYPE_WPA) {
 938                         wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with "
 939                                    "unexpected type %d in WPA mode",
 940                                    key->type);
 941                         return;
 942                 }
 943         }
 944
 945         wpa_hexdump(MSG_DEBUG, "WPA: Received Key Nonce", key->key_nonce,
 946                     WPA_NONCE_LEN);
 947         wpa_hexdump(MSG_DEBUG, "WPA: Received Replay Counter",
 948                     key->replay_counter, WPA_REPLAY_COUNTER_LEN);
 949
 950         /* FIX: verify that the EAPOL-Key frame was encrypted if pairwise keys
 951          * are set */
 952
 953         if ((key_info & (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) ==
 954             (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) {
 955                 if (key_info & WPA_KEY_INFO_ERROR) {
 956                         msg = SMK_ERROR;
 957                         msgtxt = "SMK Error";
 958                 } else {
 959                         msg = SMK_M1;
 960                         msgtxt = "SMK M1";
 961                 }
 962         } else if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
 963                 msg = SMK_M3;
 964                 msgtxt = "SMK M3";
 965         } else if (key_info & WPA_KEY_INFO_REQUEST) {
 966                 msg = REQUEST;
 967                 msgtxt = "Request";
 968         } else if (!(key_info & WPA_KEY_INFO_KEY_TYPE)) {
 969                 msg = GROUP_2;
 970                 msgtxt = "2/2 Group";
 971         } else if (key_data_length == 0) {
 972                 msg = PAIRWISE_4;
 973                 msgtxt = "4/4 Pairwise";
 974         } else {
 975                 msg = PAIRWISE_2;
 976                 msgtxt = "2/4 Pairwise";
 977         }
 978
 979         /* TODO: key_info type validation for PeerKey */
 980         if (msg == REQUEST || msg == PAIRWISE_2 || msg == PAIRWISE_4 ||
 981             msg == GROUP_2) {
 982                 u16 ver = key_info & WPA_KEY_INFO_TYPE_MASK;
 983                 if (sm->pairwise == WPA_CIPHER_CCMP ||
 984                     sm->pairwise == WPA_CIPHER_GCMP) {
 985                         if (wpa_use_aes_cmac(sm) &&
 986                             sm->wpa_key_mgmt != WPA_KEY_MGMT_OSEN &&
 987                             !wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) &&
 988                             ver != WPA_KEY_INFO_TYPE_AES_128_CMAC) {
 989                                 wpa_auth_logger(wpa_auth, sm->addr,
 990                                                 LOGGER_WARNING,
 991                                                 "advertised support for "
 992                                                 "AES-128-CMAC, but did not "
 993                                                 "use it");
 994                                 return;
 995                         }
 996
 997                         if (!wpa_use_aes_cmac(sm) &&
 998                             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
 999                                 wpa_auth_logger(wpa_auth, sm->addr,
1000                                                 LOGGER_WARNING,
1001                                                 "did not use HMAC-SHA1-AES "
1002                                                 "with CCMP/GCMP");
1003                                 return;
1004                         }
1005                 }
1006
1007                 if (wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) &&
1008                     ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
1009                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING,
1010                                         "did not use EAPOL-Key descriptor version 0 as required for AKM-defined cases");
1011                         return;
1012                 }
1013         }
1014
1015         if (key_info & WPA_KEY_INFO_REQUEST) {
1016                 if (sm->req_replay_counter_used &&
1017                     os_memcmp(key->replay_counter, sm->req_replay_counter,
1018                               WPA_REPLAY_COUNTER_LEN) <= 0) {
1019                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING,
1020                                         "received EAPOL-Key request with "
1021                                         "replayed counter");
1022                         return;
1023                 }
1024         }
1025
1026         if (!(key_info & WPA_KEY_INFO_REQUEST) &&
1027             !wpa_replay_counter_valid(sm->key_replay, key->replay_counter)) {
1028                 int i;
1029
1030                 if (msg == PAIRWISE_2 &&
1031                     wpa_replay_counter_valid(sm->prev_key_replay,
1032                                              key->replay_counter) &&
1033                     sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING &&
1034                     os_memcmp(sm->SNonce, key->key_nonce, WPA_NONCE_LEN) != 0)
1035                 {
1036                         /*
1037                          * Some supplicant implementations (e.g., Windows XP
1038                          * WZC) update SNonce for each EAPOL-Key 2/4. This
1039                          * breaks the workaround on accepting any of the
1040                          * pending requests, so allow the SNonce to be updated
1041                          * even if we have already sent out EAPOL-Key 3/4.
1042                          */
1043                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1044                                          "Process SNonce update from STA "
1045                                          "based on retransmitted EAPOL-Key "
1046                                          "1/4");
1047                         sm->update_snonce = 1;
1048                         os_memcpy(sm->alt_SNonce, sm->SNonce, WPA_NONCE_LEN);
1049                         sm->alt_snonce_valid = TRUE;
1050                         os_memcpy(sm->alt_replay_counter,
1051                                   sm->key_replay[0].counter,
1052                                   WPA_REPLAY_COUNTER_LEN);
1053                         goto continue_processing;
1054                 }
1055
1056                 if (msg == PAIRWISE_4 && sm->alt_snonce_valid &&
1057                     sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING &&
1058                     os_memcmp(key->replay_counter, sm->alt_replay_counter,
1059                               WPA_REPLAY_COUNTER_LEN) == 0) {
1060                         /*
1061                          * Supplicant may still be using the old SNonce since
1062                          * there was two EAPOL-Key 2/4 messages and they had
1063                          * different SNonce values.
1064                          */
1065                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1066                                          "Try to process received EAPOL-Key 4/4 based on old Replay Counter and SNonce from an earlier EAPOL-Key 1/4");
1067                         goto continue_processing;
1068                 }
1069
1070                 if (msg == PAIRWISE_2 &&
1071                     wpa_replay_counter_valid(sm->prev_key_replay,
1072                                              key->replay_counter) &&
1073                     sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING) {
1074                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1075                                          "ignore retransmitted EAPOL-Key %s - "
1076                                          "SNonce did not change", msgtxt);
1077                 } else {
1078                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1079                                          "received EAPOL-Key %s with "
1080                                          "unexpected replay counter", msgtxt);
1081                 }
1082                 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) {
1083                         if (!sm->key_replay[i].valid)
1084                                 break;
1085                         wpa_hexdump(MSG_DEBUG, "pending replay counter",
1086                                     sm->key_replay[i].counter,
1087                                     WPA_REPLAY_COUNTER_LEN);
1088                 }
1089                 wpa_hexdump(MSG_DEBUG, "received replay counter",
1090                             key->replay_counter, WPA_REPLAY_COUNTER_LEN);
1091                 return;
1092         }
1093
1094 continue_processing:
1095         switch (msg) {
1096         case PAIRWISE_2:
1097                 if (sm->wpa_ptk_state != WPA_PTK_PTKSTART &&
1098                     sm->wpa_ptk_state != WPA_PTK_PTKCALCNEGOTIATING &&
1099                     (!sm->update_snonce ||
1100                      sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING)) {
1101                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
1102                                          "received EAPOL-Key msg 2/4 in "
1103                                          "invalid state (%d) - dropped",
1104                                          sm->wpa_ptk_state);
1105                         return;
1106                 }
1107                 random_add_randomness(key->key_nonce, WPA_NONCE_LEN);
1108                 if (sm->group->reject_4way_hs_for_entropy) {
1109                         /*
1110                          * The system did not have enough entropy to generate
1111                          * strong random numbers. Reject the first 4-way
1112                          * handshake(s) and collect some entropy based on the
1113                          * information from it. Once enough entropy is
1114                          * available, the next atempt will trigger GMK/Key
1115                          * Counter update and the station will be allowed to
1116                          * continue.
1117                          */
1118                         wpa_printf(MSG_DEBUG, "WPA: Reject 4-way handshake to "
1119                                    "collect more entropy for random number "
1120                                    "generation");
1121                         random_mark_pool_ready();
1122                         wpa_sta_disconnect(wpa_auth, sm->addr);
1123                         return;
1124                 }
1125                 if (wpa_parse_kde_ies(key_data, key_data_length, &kde) < 0) {
1126                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
1127                                          "received EAPOL-Key msg 2/4 with "
1128                                          "invalid Key Data contents");
1129                         return;
1130                 }
1131                 if (kde.rsn_ie) {
1132                         eapol_key_ie = kde.rsn_ie;
1133                         eapol_key_ie_len = kde.rsn_ie_len;
1134                 } else if (kde.osen) {
1135                         eapol_key_ie = kde.osen;
1136                         eapol_key_ie_len = kde.osen_len;
1137                 } else {
1138                         eapol_key_ie = kde.wpa_ie;
1139                         eapol_key_ie_len = kde.wpa_ie_len;
1140                 }
1141                 ft = sm->wpa == WPA_VERSION_WPA2 &&
1142                         wpa_key_mgmt_ft(sm->wpa_key_mgmt);
1143                 if (sm->wpa_ie == NULL ||
1144                     wpa_compare_rsn_ie(ft,
1145                                        sm->wpa_ie, sm->wpa_ie_len,
1146                                        eapol_key_ie, eapol_key_ie_len)) {
1147                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1148                                         "WPA IE from (Re)AssocReq did not "
1149                                         "match with msg 2/4");
1150                         if (sm->wpa_ie) {
1151                                 wpa_hexdump(MSG_DEBUG, "WPA IE in AssocReq",
1152                                             sm->wpa_ie, sm->wpa_ie_len);
1153                         }
1154                         wpa_hexdump(MSG_DEBUG, "WPA IE in msg 2/4",
1155                                     eapol_key_ie, eapol_key_ie_len);
1156                         /* MLME-DEAUTHENTICATE.request */
1157                         wpa_sta_disconnect(wpa_auth, sm->addr);
1158                         return;
1159                 }
1160 #ifdef CONFIG_IEEE80211R
1161                 if (ft && ft_check_msg_2_of_4(wpa_auth, sm, &kde) < 0) {
1162                         wpa_sta_disconnect(wpa_auth, sm->addr);
1163                         return;
1164                 }
1165 #endif /* CONFIG_IEEE80211R */
1166 #ifdef CONFIG_P2P
1167                 if (kde.ip_addr_req && kde.ip_addr_req[0] &&
1168                     wpa_auth->ip_pool && WPA_GET_BE32(sm->ip_addr) == 0) {
1169                         int idx;
1170                         wpa_printf(MSG_DEBUG, "P2P: IP address requested in "
1171                                    "EAPOL-Key exchange");
1172                         idx = bitfield_get_first_zero(wpa_auth->ip_pool);
1173                         if (idx >= 0) {
1174                                 u32 start = WPA_GET_BE32(wpa_auth->conf.
1175                                                          ip_addr_start);
1176                                 bitfield_set(wpa_auth->ip_pool, idx);
1177                                 WPA_PUT_BE32(sm->ip_addr, start + idx);
1178                                 wpa_printf(MSG_DEBUG, "P2P: Assigned IP "
1179                                            "address %u.%u.%u.%u to " MACSTR,
1180                                            sm->ip_addr[0], sm->ip_addr[1],
1181                                            sm->ip_addr[2], sm->ip_addr[3],
1182                                            MAC2STR(sm->addr));
1183                         }
1184                 }
1185 #endif /* CONFIG_P2P */
1186                 break;
1187         case PAIRWISE_4:
1188                 if (sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING ||
1189                     !sm->PTK_valid) {
1190                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
1191                                          "received EAPOL-Key msg 4/4 in "
1192                                          "invalid state (%d) - dropped",
1193                                          sm->wpa_ptk_state);
1194                         return;
1195                 }
1196                 break;
1197         case GROUP_2:
1198                 if (sm->wpa_ptk_group_state != WPA_PTK_GROUP_REKEYNEGOTIATING
1199                     || !sm->PTK_valid) {
1200                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO,
1201                                          "received EAPOL-Key msg 2/2 in "
1202                                          "invalid state (%d) - dropped",
1203                                          sm->wpa_ptk_group_state);
1204                         return;
1205                 }
1206                 break;
1207 #ifdef CONFIG_PEERKEY
1208         case SMK_M1:
1209         case SMK_M3:
1210         case SMK_ERROR:
1211                 if (!wpa_auth->conf.peerkey) {
1212                         wpa_printf(MSG_DEBUG, "RSN: SMK M1/M3/Error, but "
1213                                    "PeerKey use disabled - ignoring message");
1214                         return;
1215                 }
1216                 if (!sm->PTK_valid) {
1217                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1218                                         "received EAPOL-Key msg SMK in "
1219                                         "invalid state - dropped");
1220                         return;
1221                 }
1222                 break;
1223 #else /* CONFIG_PEERKEY */
1224         case SMK_M1:
1225         case SMK_M3:
1226         case SMK_ERROR:
1227                 return; /* STSL disabled - ignore SMK messages */
1228 #endif /* CONFIG_PEERKEY */
1229         case REQUEST:
1230                 break;
1231         }
1232
1233         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
1234                          "received EAPOL-Key frame (%s)", msgtxt);
1235
1236         if (key_info & WPA_KEY_INFO_ACK) {
1237                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1238                                 "received invalid EAPOL-Key: Key Ack set");
1239                 return;
1240         }
1241
1242         if (!(key_info & WPA_KEY_INFO_MIC)) {
1243                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1244                                 "received invalid EAPOL-Key: Key MIC not set");
1245                 return;
1246         }
1247
1248         sm->MICVerified = FALSE;
1249         if (sm->PTK_valid && !sm->update_snonce) {
1250                 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &sm->PTK, data,
1251                                        data_len) &&
1252                     (msg != PAIRWISE_4 || !sm->alt_snonce_valid ||
1253                      wpa_try_alt_snonce(sm, data, data_len))) {
1254                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1255                                         "received EAPOL-Key with invalid MIC");
1256                         return;
1257                 }
1258                 sm->MICVerified = TRUE;
1259                 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm);
1260                 sm->pending_1_of_4_timeout = 0;
1261         }
1262
1263         if (key_info & WPA_KEY_INFO_REQUEST) {
1264                 if (sm->MICVerified) {
1265                         sm->req_replay_counter_used = 1;
1266                         os_memcpy(sm->req_replay_counter, key->replay_counter,
1267                                   WPA_REPLAY_COUNTER_LEN);
1268                 } else {
1269                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1270                                         "received EAPOL-Key request with "
1271                                         "invalid MIC");
1272                         return;
1273                 }
1274
1275                 /*
1276                  * TODO: should decrypt key data field if encryption was used;
1277                  * even though MAC address KDE is not normally encrypted,
1278                  * supplicant is allowed to encrypt it.
1279                  */
1280                 if (msg == SMK_ERROR) {
1281 #ifdef CONFIG_PEERKEY
1282                         wpa_smk_error(wpa_auth, sm, key_data, key_data_length);
1283 #endif /* CONFIG_PEERKEY */
1284                         return;
1285                 } else if (key_info & WPA_KEY_INFO_ERROR) {
1286                         if (wpa_receive_error_report(
1287                                     wpa_auth, sm,
1288                                     !(key_info & WPA_KEY_INFO_KEY_TYPE)) > 0)
1289                                 return; /* STA entry was removed */
1290                 } else if (key_info & WPA_KEY_INFO_KEY_TYPE) {
1291                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1292                                         "received EAPOL-Key Request for new "
1293                                         "4-Way Handshake");
1294                         wpa_request_new_ptk(sm);
1295 #ifdef CONFIG_PEERKEY
1296                 } else if (msg == SMK_M1) {
1297                         wpa_smk_m1(wpa_auth, sm, key, key_data,
1298                                    key_data_length);
1299 #endif /* CONFIG_PEERKEY */
1300                 } else if (key_data_length > 0 &&
1301                            wpa_parse_kde_ies(key_data, key_data_length,
1302                                              &kde) == 0 &&
1303                            kde.mac_addr) {
1304                 } else {
1305                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1306                                         "received EAPOL-Key Request for GTK "
1307                                         "rekeying");
1308                         eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL);
1309                         wpa_rekey_gtk(wpa_auth, NULL);
1310                 }
1311         } else {
1312                 /* Do not allow the same key replay counter to be reused. */
1313                 wpa_replay_counter_mark_invalid(sm->key_replay,
1314                                                 key->replay_counter);
1315
1316                 if (msg == PAIRWISE_2) {
1317                         /*
1318                          * Maintain a copy of the pending EAPOL-Key frames in
1319                          * case the EAPOL-Key frame was retransmitted. This is
1320                          * needed to allow EAPOL-Key msg 2/4 reply to another
1321                          * pending msg 1/4 to update the SNonce to work around
1322                          * unexpected supplicant behavior.
1323                          */
1324                         os_memcpy(sm->prev_key_replay, sm->key_replay,
1325                                   sizeof(sm->key_replay));
1326                 } else {
1327                         os_memset(sm->prev_key_replay, 0,
1328                                   sizeof(sm->prev_key_replay));
1329                 }
1330
1331                 /*
1332                  * Make sure old valid counters are not accepted anymore and
1333                  * do not get copied again.
1334                  */
1335                 wpa_replay_counter_mark_invalid(sm->key_replay, NULL);
1336         }
1337
1338 #ifdef CONFIG_PEERKEY
1339         if (msg == SMK_M3) {
1340                 wpa_smk_m3(wpa_auth, sm, key, key_data, key_data_length);
1341                 return;
1342         }
1343 #endif /* CONFIG_PEERKEY */
1344
1345         os_free(sm->last_rx_eapol_key);
1346         sm->last_rx_eapol_key = os_malloc(data_len);
1347         if (sm->last_rx_eapol_key == NULL)
1348                 return;
1349         os_memcpy(sm->last_rx_eapol_key, data, data_len);
1350         sm->last_rx_eapol_key_len = data_len;
1351
1352         sm->rx_eapol_key_secure = !!(key_info & WPA_KEY_INFO_SECURE);
1353         sm->EAPOLKeyReceived = TRUE;
1354         sm->EAPOLKeyPairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE);
1355         sm->EAPOLKeyRequest = !!(key_info & WPA_KEY_INFO_REQUEST);
1356         os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN);
1357         wpa_sm_step(sm);
1358 }
1359
1360
1361 static int wpa_gmk_to_gtk(const u8 *gmk, const char *label, const u8 *addr,
1362                           const u8 *gnonce, u8 *gtk, size_t gtk_len)
1363 {
1364         u8 data[ETH_ALEN + WPA_NONCE_LEN + 8 + 16];
1365         u8 *pos;
1366         int ret = 0;
1367
1368         /* GTK = PRF-X(GMK, "Group key expansion",
1369          *      AA || GNonce || Time || random data)
1370          * The example described in the IEEE 802.11 standard uses only AA and
1371          * GNonce as inputs here. Add some more entropy since this derivation
1372          * is done only at the Authenticator and as such, does not need to be
1373          * exactly same.
1374          */
1375         os_memcpy(data, addr, ETH_ALEN);
1376         os_memcpy(data + ETH_ALEN, gnonce, WPA_NONCE_LEN);
1377         pos = data + ETH_ALEN + WPA_NONCE_LEN;
1378         wpa_get_ntp_timestamp(pos);
1379         pos += 8;
1380         if (random_get_bytes(pos, 16) < 0)
1381                 ret = -1;
1382
1383 #ifdef CONFIG_IEEE80211W
1384         sha256_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len);
1385 #else /* CONFIG_IEEE80211W */
1386         if (sha1_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len)
1387             < 0)
1388                 ret = -1;
1389 #endif /* CONFIG_IEEE80211W */
1390
1391         return ret;
1392 }
1393
1394
1395 static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx)
1396 {
1397         struct wpa_authenticator *wpa_auth = eloop_ctx;
1398         struct wpa_state_machine *sm = timeout_ctx;
1399
1400         sm->pending_1_of_4_timeout = 0;
1401         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "EAPOL-Key timeout");
1402         sm->TimeoutEvt = TRUE;
1403         wpa_sm_step(sm);
1404 }
1405
1406
1407 void __wpa_send_eapol(struct wpa_authenticator *wpa_auth,
1408                       struct wpa_state_machine *sm, int key_info,
1409                       const u8 *key_rsc, const u8 *nonce,
1410                       const u8 *kde, size_t kde_len,
1411                       int keyidx, int encr, int force_version)
1412 {
1413         struct ieee802_1x_hdr *hdr;
1414         struct wpa_eapol_key *key;
1415         struct wpa_eapol_key_192 *key192;
1416         size_t len, mic_len, keyhdrlen;
1417         int alg;
1418         int key_data_len, pad_len = 0;
1419         u8 *buf, *pos;
1420         int version, pairwise;
1421         int i;
1422         u8 *key_data;
1423
1424         mic_len = wpa_mic_len(sm->wpa_key_mgmt);
1425         keyhdrlen = mic_len == 24 ? sizeof(*key192) : sizeof(*key);
1426
1427         len = sizeof(struct ieee802_1x_hdr) + keyhdrlen;
1428
1429         if (force_version)
1430                 version = force_version;
1431         else if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN ||
1432                  wpa_key_mgmt_suite_b(sm->wpa_key_mgmt))
1433                 version = WPA_KEY_INFO_TYPE_AKM_DEFINED;
1434         else if (wpa_use_aes_cmac(sm))
1435                 version = WPA_KEY_INFO_TYPE_AES_128_CMAC;
1436         else if (sm->pairwise != WPA_CIPHER_TKIP)
1437                 version = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
1438         else
1439                 version = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
1440
1441         pairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE);
1442
1443         wpa_printf(MSG_DEBUG, "WPA: Send EAPOL(version=%d secure=%d mic=%d "
1444                    "ack=%d install=%d pairwise=%d kde_len=%lu keyidx=%d "
1445                    "encr=%d)",
1446                    version,
1447                    (key_info & WPA_KEY_INFO_SECURE) ? 1 : 0,
1448                    (key_info & WPA_KEY_INFO_MIC) ? 1 : 0,
1449                    (key_info & WPA_KEY_INFO_ACK) ? 1 : 0,
1450                    (key_info & WPA_KEY_INFO_INSTALL) ? 1 : 0,
1451                    pairwise, (unsigned long) kde_len, keyidx, encr);
1452
1453         key_data_len = kde_len;
1454
1455         if ((version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
1456              sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN ||
1457              wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) ||
1458              version == WPA_KEY_INFO_TYPE_AES_128_CMAC) && encr) {
1459                 pad_len = key_data_len % 8;
1460                 if (pad_len)
1461                         pad_len = 8 - pad_len;
1462                 key_data_len += pad_len + 8;
1463         }
1464
1465         len += key_data_len;
1466
1467         hdr = os_zalloc(len);
1468         if (hdr == NULL)
1469                 return;
1470         hdr->version = wpa_auth->conf.eapol_version;
1471         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1472         hdr->length = host_to_be16(len  - sizeof(*hdr));
1473         key = (struct wpa_eapol_key *) (hdr + 1);
1474         key192 = (struct wpa_eapol_key_192 *) (hdr + 1);
1475         key_data = ((u8 *) (hdr + 1)) + keyhdrlen;
1476
1477         key->type = sm->wpa == WPA_VERSION_WPA2 ?
1478                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1479         key_info |= version;
1480         if (encr && sm->wpa == WPA_VERSION_WPA2)
1481                 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
1482         if (sm->wpa != WPA_VERSION_WPA2)
1483                 key_info |= keyidx << WPA_KEY_INFO_KEY_INDEX_SHIFT;
1484         WPA_PUT_BE16(key->key_info, key_info);
1485
1486         alg = pairwise ? sm->pairwise : wpa_auth->conf.wpa_group;
1487         WPA_PUT_BE16(key->key_length, wpa_cipher_key_len(alg));
1488         if (key_info & WPA_KEY_INFO_SMK_MESSAGE)
1489                 WPA_PUT_BE16(key->key_length, 0);
1490
1491         /* FIX: STSL: what to use as key_replay_counter? */
1492         for (i = RSNA_MAX_EAPOL_RETRIES - 1; i > 0; i--) {
1493                 sm->key_replay[i].valid = sm->key_replay[i - 1].valid;
1494                 os_memcpy(sm->key_replay[i].counter,
1495                           sm->key_replay[i - 1].counter,
1496                           WPA_REPLAY_COUNTER_LEN);
1497         }
1498         inc_byte_array(sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN);
1499         os_memcpy(key->replay_counter, sm->key_replay[0].counter,
1500                   WPA_REPLAY_COUNTER_LEN);
1501         wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter",
1502                     key->replay_counter, WPA_REPLAY_COUNTER_LEN);
1503         sm->key_replay[0].valid = TRUE;
1504
1505         if (nonce)
1506                 os_memcpy(key->key_nonce, nonce, WPA_NONCE_LEN);
1507
1508         if (key_rsc)
1509                 os_memcpy(key->key_rsc, key_rsc, WPA_KEY_RSC_LEN);
1510
1511         if (kde && !encr) {
1512                 os_memcpy(key_data, kde, kde_len);
1513                 if (mic_len == 24)
1514                         WPA_PUT_BE16(key192->key_data_length, kde_len);
1515                 else
1516                         WPA_PUT_BE16(key->key_data_length, kde_len);
1517         } else if (encr && kde) {
1518                 buf = os_zalloc(key_data_len);
1519                 if (buf == NULL) {
1520                         os_free(hdr);
1521                         return;
1522                 }
1523                 pos = buf;
1524                 os_memcpy(pos, kde, kde_len);
1525                 pos += kde_len;
1526
1527                 if (pad_len)
1528                         *pos++ = 0xdd;
1529
1530                 wpa_hexdump_key(MSG_DEBUG, "Plaintext EAPOL-Key Key Data",
1531                                 buf, key_data_len);
1532                 if (version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
1533                     sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN ||
1534                     wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) ||
1535                     version == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
1536                         if (aes_wrap(sm->PTK.kek, sm->PTK.kek_len,
1537                                      (key_data_len - 8) / 8, buf, key_data)) {
1538                                 os_free(hdr);
1539                                 os_free(buf);
1540                                 return;
1541                         }
1542                         if (mic_len == 24)
1543                                 WPA_PUT_BE16(key192->key_data_length,
1544                                              key_data_len);
1545                         else
1546                                 WPA_PUT_BE16(key->key_data_length,
1547                                              key_data_len);
1548 #ifndef CONFIG_NO_RC4
1549                 } else if (sm->PTK.kek_len == 16) {
1550                         u8 ek[32];
1551                         os_memcpy(key->key_iv,
1552                                   sm->group->Counter + WPA_NONCE_LEN - 16, 16);
1553                         inc_byte_array(sm->group->Counter, WPA_NONCE_LEN);
1554                         os_memcpy(ek, key->key_iv, 16);
1555                         os_memcpy(ek + 16, sm->PTK.kek, sm->PTK.kek_len);
1556                         os_memcpy(key_data, buf, key_data_len);
1557                         rc4_skip(ek, 32, 256, key_data, key_data_len);
1558                         if (mic_len == 24)
1559                                 WPA_PUT_BE16(key192->key_data_length,
1560                                              key_data_len);
1561                         else
1562                                 WPA_PUT_BE16(key->key_data_length,
1563                                              key_data_len);
1564 #endif /* CONFIG_NO_RC4 */
1565                 } else {
1566                         os_free(hdr);
1567                         os_free(buf);
1568                         return;
1569                 }
1570                 os_free(buf);
1571         }
1572
1573         if (key_info & WPA_KEY_INFO_MIC) {
1574                 u8 *key_mic;
1575
1576                 if (!sm->PTK_valid) {
1577                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
1578                                         "PTK not valid when sending EAPOL-Key "
1579                                         "frame");
1580                         os_free(hdr);
1581                         return;
1582                 }
1583
1584                 key_mic = key192->key_mic; /* same offset for key and key192 */
1585                 wpa_eapol_key_mic(sm->PTK.kck, sm->PTK.kck_len,
1586                                   sm->wpa_key_mgmt, version,
1587                                   (u8 *) hdr, len, key_mic);
1588 #ifdef CONFIG_TESTING_OPTIONS
1589                 if (!pairwise &&
1590                     wpa_auth->conf.corrupt_gtk_rekey_mic_probability > 0.0 &&
1591                     drand48() <
1592                     wpa_auth->conf.corrupt_gtk_rekey_mic_probability) {
1593                         wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
1594                                         "Corrupting group EAPOL-Key Key MIC");
1595                         key_mic[0]++;
1596                 }
1597 #endif /* CONFIG_TESTING_OPTIONS */
1598         }
1599
1600         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_inc_EapolFramesTx,
1601                            1);
1602         wpa_auth_send_eapol(wpa_auth, sm->addr, (u8 *) hdr, len,
1603                             sm->pairwise_set);
1604         os_free(hdr);
1605 }
1606
1607
1608 static void wpa_send_eapol(struct wpa_authenticator *wpa_auth,
1609                            struct wpa_state_machine *sm, int key_info,
1610                            const u8 *key_rsc, const u8 *nonce,
1611                            const u8 *kde, size_t kde_len,
1612                            int keyidx, int encr)
1613 {
1614         int timeout_ms;
1615         int pairwise = key_info & WPA_KEY_INFO_KEY_TYPE;
1616         int ctr;
1617
1618         if (sm == NULL)
1619                 return;
1620
1621         __wpa_send_eapol(wpa_auth, sm, key_info, key_rsc, nonce, kde, kde_len,
1622                          keyidx, encr, 0);
1623
1624         ctr = pairwise ? sm->TimeoutCtr : sm->GTimeoutCtr;
1625         if (ctr == 1 && wpa_auth->conf.tx_status)
1626                 timeout_ms = pairwise ? eapol_key_timeout_first :
1627                         eapol_key_timeout_first_group;
1628         else
1629                 timeout_ms = eapol_key_timeout_subseq;
1630         if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC))
1631                 sm->pending_1_of_4_timeout = 1;
1632         wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry "
1633                    "counter %d)", timeout_ms, ctr);
1634         eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000,
1635                                wpa_send_eapol_timeout, wpa_auth, sm);
1636 }
1637
1638
1639 static int wpa_verify_key_mic(int akmp, struct wpa_ptk *PTK, u8 *data,
1640                               size_t data_len)
1641 {
1642         struct ieee802_1x_hdr *hdr;
1643         struct wpa_eapol_key *key;
1644         struct wpa_eapol_key_192 *key192;
1645         u16 key_info;
1646         int ret = 0;
1647         u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
1648         size_t mic_len = wpa_mic_len(akmp);
1649
1650         if (data_len < sizeof(*hdr) + sizeof(*key))
1651                 return -1;
1652
1653         hdr = (struct ieee802_1x_hdr *) data;
1654         key = (struct wpa_eapol_key *) (hdr + 1);
1655         key192 = (struct wpa_eapol_key_192 *) (hdr + 1);
1656         key_info = WPA_GET_BE16(key->key_info);
1657         os_memcpy(mic, key192->key_mic, mic_len);
1658         os_memset(key192->key_mic, 0, mic_len);
1659         if (wpa_eapol_key_mic(PTK->kck, PTK->kck_len, akmp,
1660                               key_info & WPA_KEY_INFO_TYPE_MASK,
1661                               data, data_len, key192->key_mic) ||
1662             os_memcmp_const(mic, key192->key_mic, mic_len) != 0)
1663                 ret = -1;
1664         os_memcpy(key192->key_mic, mic, mic_len);
1665         return ret;
1666 }
1667
1668
1669 void wpa_remove_ptk(struct wpa_state_machine *sm)
1670 {
1671         sm->PTK_valid = FALSE;
1672         os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1673         wpa_auth_set_key(sm->wpa_auth, 0, WPA_ALG_NONE, sm->addr, 0, NULL, 0);
1674         sm->pairwise_set = FALSE;
1675         eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
1676 }
1677
1678
1679 int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event)
1680 {
1681         int remove_ptk = 1;
1682
1683         if (sm == NULL)
1684                 return -1;
1685
1686         wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
1687                          "event %d notification", event);
1688
1689         switch (event) {
1690         case WPA_AUTH:
1691 #ifdef CONFIG_MESH
1692                 /* PTKs are derived through AMPE */
1693                 if (wpa_auth_start_ampe(sm->wpa_auth, sm->addr)) {
1694                         /* not mesh */
1695                         break;
1696                 }
1697                 return 0;
1698 #endif /* CONFIG_MESH */
1699         case WPA_ASSOC:
1700                 break;
1701         case WPA_DEAUTH:
1702         case WPA_DISASSOC:
1703                 sm->DeauthenticationRequest = TRUE;
1704                 break;
1705         case WPA_REAUTH:
1706         case WPA_REAUTH_EAPOL:
1707                 if (!sm->started) {
1708                         /*
1709                          * When using WPS, we may end up here if the STA
1710                          * manages to re-associate without the previous STA
1711                          * entry getting removed. Consequently, we need to make
1712                          * sure that the WPA state machines gets initialized
1713                          * properly at this point.
1714                          */
1715                         wpa_printf(MSG_DEBUG, "WPA state machine had not been "
1716                                    "started - initialize now");
1717                         sm->started = 1;
1718                         sm->Init = TRUE;
1719                         if (wpa_sm_step(sm) == 1)
1720                                 return 1; /* should not really happen */
1721                         sm->Init = FALSE;
1722                         sm->AuthenticationRequest = TRUE;
1723                         break;
1724                 }
1725                 if (sm->GUpdateStationKeys) {
1726                         /*
1727                          * Reauthentication cancels the pending group key
1728                          * update for this STA.
1729                          */
1730                         sm->group->GKeyDoneStations--;
1731                         sm->GUpdateStationKeys = FALSE;
1732                         sm->PtkGroupInit = TRUE;
1733                 }
1734                 sm->ReAuthenticationRequest = TRUE;
1735                 break;
1736         case WPA_ASSOC_FT:
1737 #ifdef CONFIG_IEEE80211R
1738                 wpa_printf(MSG_DEBUG, "FT: Retry PTK configuration "
1739                            "after association");
1740                 wpa_ft_install_ptk(sm);
1741
1742                 /* Using FT protocol, not WPA auth state machine */
1743                 sm->ft_completed = 1;
1744                 return 0;
1745 #else /* CONFIG_IEEE80211R */
1746                 break;
1747 #endif /* CONFIG_IEEE80211R */
1748         case WPA_DRV_STA_REMOVED:
1749                 sm->tk_already_set = FALSE;
1750                 return 0;
1751         }
1752
1753 #ifdef CONFIG_IEEE80211R
1754         sm->ft_completed = 0;
1755 #endif /* CONFIG_IEEE80211R */
1756
1757 #ifdef CONFIG_IEEE80211W
1758         if (sm->mgmt_frame_prot && event == WPA_AUTH)
1759                 remove_ptk = 0;
1760 #endif /* CONFIG_IEEE80211W */
1761
1762         if (remove_ptk) {
1763                 sm->PTK_valid = FALSE;
1764                 os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1765
1766                 if (event != WPA_REAUTH_EAPOL)
1767                         wpa_remove_ptk(sm);
1768         }
1769
1770         if (sm->in_step_loop) {
1771                 /*
1772                  * wpa_sm_step() is already running - avoid recursive call to
1773                  * it by making the existing loop process the new update.
1774                  */
1775                 sm->changed = TRUE;
1776                 return 0;
1777         }
1778         return wpa_sm_step(sm);
1779 }
1780
1781
1782 SM_STATE(WPA_PTK, INITIALIZE)
1783 {
1784         SM_ENTRY_MA(WPA_PTK, INITIALIZE, wpa_ptk);
1785         if (sm->Init) {
1786                 /* Init flag is not cleared here, so avoid busy
1787                  * loop by claiming nothing changed. */
1788                 sm->changed = FALSE;
1789         }
1790
1791         sm->keycount = 0;
1792         if (sm->GUpdateStationKeys)
1793                 sm->group->GKeyDoneStations--;
1794         sm->GUpdateStationKeys = FALSE;
1795         if (sm->wpa == WPA_VERSION_WPA)
1796                 sm->PInitAKeys = FALSE;
1797         if (1 /* Unicast cipher supported AND (ESS OR ((IBSS or WDS) and
1798                * Local AA > Remote AA)) */) {
1799                 sm->Pair = TRUE;
1800         }
1801         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 0);
1802         wpa_remove_ptk(sm);
1803         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 0);
1804         sm->TimeoutCtr = 0;
1805         if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
1806                 wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
1807                                    WPA_EAPOL_authorized, 0);
1808         }
1809 }
1810
1811
1812 SM_STATE(WPA_PTK, DISCONNECT)
1813 {
1814         SM_ENTRY_MA(WPA_PTK, DISCONNECT, wpa_ptk);
1815         sm->Disconnect = FALSE;
1816         wpa_sta_disconnect(sm->wpa_auth, sm->addr);
1817 }
1818
1819
1820 SM_STATE(WPA_PTK, DISCONNECTED)
1821 {
1822         SM_ENTRY_MA(WPA_PTK, DISCONNECTED, wpa_ptk);
1823         sm->DeauthenticationRequest = FALSE;
1824 }
1825
1826
1827 SM_STATE(WPA_PTK, AUTHENTICATION)
1828 {
1829         SM_ENTRY_MA(WPA_PTK, AUTHENTICATION, wpa_ptk);
1830         os_memset(&sm->PTK, 0, sizeof(sm->PTK));
1831         sm->PTK_valid = FALSE;
1832         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portControl_Auto,
1833                            1);
1834         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 1);
1835         sm->AuthenticationRequest = FALSE;
1836 }
1837
1838
1839 static void wpa_group_ensure_init(struct wpa_authenticator *wpa_auth,
1840                                   struct wpa_group *group)
1841 {
1842         if (group->first_sta_seen)
1843                 return;
1844         /*
1845          * System has run bit further than at the time hostapd was started
1846          * potentially very early during boot up. This provides better chances
1847          * of collecting more randomness on embedded systems. Re-initialize the
1848          * GMK and Counter here to improve their strength if there was not
1849          * enough entropy available immediately after system startup.
1850          */
1851         wpa_printf(MSG_DEBUG, "WPA: Re-initialize GMK/Counter on first "
1852                    "station");
1853         if (random_pool_ready() != 1) {
1854                 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool "
1855                            "to proceed - reject first 4-way handshake");
1856                 group->reject_4way_hs_for_entropy = TRUE;
1857         } else {
1858                 group->first_sta_seen = TRUE;
1859                 group->reject_4way_hs_for_entropy = FALSE;
1860         }
1861
1862         if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0 ||
1863             wpa_gtk_update(wpa_auth, group) < 0 ||
1864             wpa_group_config_group_keys(wpa_auth, group) < 0) {
1865                 wpa_printf(MSG_INFO, "WPA: GMK/GTK setup failed");
1866                 group->first_sta_seen = FALSE;
1867                 group->reject_4way_hs_for_entropy = TRUE;
1868         }
1869 }
1870
1871
1872 SM_STATE(WPA_PTK, AUTHENTICATION2)
1873 {
1874         SM_ENTRY_MA(WPA_PTK, AUTHENTICATION2, wpa_ptk);
1875
1876         wpa_group_ensure_init(sm->wpa_auth, sm->group);
1877         sm->ReAuthenticationRequest = FALSE;
1878
1879         /*
1880          * Definition of ANonce selection in IEEE Std 802.11i-2004 is somewhat
1881          * ambiguous. The Authenticator state machine uses a counter that is
1882          * incremented by one for each 4-way handshake. However, the security
1883          * analysis of 4-way handshake points out that unpredictable nonces
1884          * help in preventing precomputation attacks. Instead of the state
1885          * machine definition, use an unpredictable nonce value here to provide
1886          * stronger protection against potential precomputation attacks.
1887          */
1888         if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
1889                 wpa_printf(MSG_ERROR, "WPA: Failed to get random data for "
1890                            "ANonce.");
1891                 sm->Disconnect = TRUE;
1892                 return;
1893         }
1894         wpa_hexdump(MSG_DEBUG, "WPA: Assign ANonce", sm->ANonce,
1895                     WPA_NONCE_LEN);
1896         /* IEEE 802.11i does not clear TimeoutCtr here, but this is more
1897          * logical place than INITIALIZE since AUTHENTICATION2 can be
1898          * re-entered on ReAuthenticationRequest without going through
1899          * INITIALIZE. */
1900         sm->TimeoutCtr = 0;
1901 }
1902
1903
1904 static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
1905 {
1906         if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
1907                 wpa_printf(MSG_ERROR,
1908                            "WPA: Failed to get random data for ANonce");
1909                 sm->Disconnect = TRUE;
1910                 return -1;
1911         }
1912         wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
1913                     WPA_NONCE_LEN);
1914         sm->TimeoutCtr = 0;
1915         return 0;
1916 }
1917
1918
1919 SM_STATE(WPA_PTK, INITPMK)
1920 {
1921         u8 msk[2 * PMK_LEN];
1922         size_t len = 2 * PMK_LEN;
1923
1924         SM_ENTRY_MA(WPA_PTK, INITPMK, wpa_ptk);
1925 #ifdef CONFIG_IEEE80211R
1926         sm->xxkey_len = 0;
1927 #endif /* CONFIG_IEEE80211R */
1928         if (sm->pmksa) {
1929                 wpa_printf(MSG_DEBUG, "WPA: PMK from PMKSA cache");
1930                 os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len);
1931                 sm->pmk_len = sm->pmksa->pmk_len;
1932         } else if (wpa_auth_get_msk(sm->wpa_auth, sm->addr, msk, &len) == 0) {
1933                 unsigned int pmk_len;
1934
1935                 if (sm->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
1936                         pmk_len = PMK_LEN_SUITE_B_192;
1937                 else
1938                         pmk_len = PMK_LEN;
1939                 wpa_printf(MSG_DEBUG, "WPA: PMK from EAPOL state machine "
1940                            "(MSK len=%lu PMK len=%u)", (unsigned long) len,
1941                            pmk_len);
1942                 if (len < pmk_len) {
1943                         wpa_printf(MSG_DEBUG,
1944                                    "WPA: MSK not long enough (%u) to create PMK (%u)",
1945                                    (unsigned int) len, (unsigned int) pmk_len);
1946                         sm->Disconnect = TRUE;
1947                         return;
1948                 }
1949                 os_memcpy(sm->PMK, msk, pmk_len);
1950                 sm->pmk_len = pmk_len;
1951 #ifdef CONFIG_IEEE80211R
1952                 if (len >= 2 * PMK_LEN) {
1953                         os_memcpy(sm->xxkey, msk + PMK_LEN, PMK_LEN);
1954                         sm->xxkey_len = PMK_LEN;
1955                 }
1956 #endif /* CONFIG_IEEE80211R */
1957         } else {
1958                 wpa_printf(MSG_DEBUG, "WPA: Could not get PMK, get_msk: %p",
1959                            sm->wpa_auth->cb.get_msk);
1960                 sm->Disconnect = TRUE;
1961                 return;
1962         }
1963         os_memset(msk, 0, sizeof(msk));
1964
1965         sm->req_replay_counter_used = 0;
1966         /* IEEE 802.11i does not set keyRun to FALSE, but not doing this
1967          * will break reauthentication since EAPOL state machines may not be
1968          * get into AUTHENTICATING state that clears keyRun before WPA state
1969          * machine enters AUTHENTICATION2 state and goes immediately to INITPMK
1970          * state and takes PMK from the previously used AAA Key. This will
1971          * eventually fail in 4-Way Handshake because Supplicant uses PMK
1972          * derived from the new AAA Key. Setting keyRun = FALSE here seems to
1973          * be good workaround for this issue. */
1974         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyRun, 0);
1975 }
1976
1977
1978 SM_STATE(WPA_PTK, INITPSK)
1979 {
1980         const u8 *psk;
1981         SM_ENTRY_MA(WPA_PTK, INITPSK, wpa_ptk);
1982         psk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, NULL);
1983         if (psk) {
1984                 os_memcpy(sm->PMK, psk, PMK_LEN);
1985                 sm->pmk_len = PMK_LEN;
1986 #ifdef CONFIG_IEEE80211R
1987                 os_memcpy(sm->xxkey, psk, PMK_LEN);
1988                 sm->xxkey_len = PMK_LEN;
1989 #endif /* CONFIG_IEEE80211R */
1990         }
1991         sm->req_replay_counter_used = 0;
1992 }
1993
1994
1995 SM_STATE(WPA_PTK, PTKSTART)
1996 {
1997         u8 buf[2 + RSN_SELECTOR_LEN + PMKID_LEN], *pmkid = NULL;
1998         size_t pmkid_len = 0;
1999
2000         SM_ENTRY_MA(WPA_PTK, PTKSTART, wpa_ptk);
2001         sm->PTKRequest = FALSE;
2002         sm->TimeoutEvt = FALSE;
2003         sm->alt_snonce_valid = FALSE;
2004
2005         sm->TimeoutCtr++;
2006         if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
2007                 /* No point in sending the EAPOL-Key - we will disconnect
2008                  * immediately following this. */
2009                 return;
2010         }
2011
2012         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2013                         "sending 1/4 msg of 4-Way Handshake");
2014         /*
2015          * TODO: Could add PMKID even with WPA2-PSK, but only if there is only
2016          * one possible PSK for this STA.
2017          */
2018         if (sm->wpa == WPA_VERSION_WPA2 &&
2019             wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) &&
2020             sm->wpa_key_mgmt != WPA_KEY_MGMT_OSEN) {
2021                 pmkid = buf;
2022                 pmkid_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN;
2023                 pmkid[0] = WLAN_EID_VENDOR_SPECIFIC;
2024                 pmkid[1] = RSN_SELECTOR_LEN + PMKID_LEN;
2025                 RSN_SELECTOR_PUT(&pmkid[2], RSN_KEY_DATA_PMKID);
2026                 if (sm->pmksa) {
2027                         os_memcpy(&pmkid[2 + RSN_SELECTOR_LEN],
2028                                   sm->pmksa->pmkid, PMKID_LEN);
2029                 } else if (wpa_key_mgmt_suite_b(sm->wpa_key_mgmt)) {
2030                         /* No KCK available to derive PMKID */
2031                         pmkid = NULL;
2032                 } else {
2033                         /*
2034                          * Calculate PMKID since no PMKSA cache entry was
2035                          * available with pre-calculated PMKID.
2036                          */
2037                         rsn_pmkid(sm->PMK, sm->pmk_len, sm->wpa_auth->addr,
2038                                   sm->addr, &pmkid[2 + RSN_SELECTOR_LEN],
2039                                   wpa_key_mgmt_sha256(sm->wpa_key_mgmt));
2040                 }
2041         }
2042         wpa_send_eapol(sm->wpa_auth, sm,
2043                        WPA_KEY_INFO_ACK | WPA_KEY_INFO_KEY_TYPE, NULL,
2044                        sm->ANonce, pmkid, pmkid_len, 0, 0);
2045 }
2046
2047
2048 static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce,
2049                           const u8 *pmk, unsigned int pmk_len,
2050                           struct wpa_ptk *ptk)
2051 {
2052 #ifdef CONFIG_IEEE80211R
2053         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt))
2054                 return wpa_auth_derive_ptk_ft(sm, pmk, ptk);
2055 #endif /* CONFIG_IEEE80211R */
2056
2057         return wpa_pmk_to_ptk(pmk, pmk_len, "Pairwise key expansion",
2058                               sm->wpa_auth->addr, sm->addr, sm->ANonce, snonce,
2059                               ptk, sm->wpa_key_mgmt, sm->pairwise);
2060 }
2061
2062
2063 SM_STATE(WPA_PTK, PTKCALCNEGOTIATING)
2064 {
2065         struct wpa_ptk PTK;
2066         int ok = 0, psk_found = 0;
2067         const u8 *pmk = NULL;
2068         unsigned int pmk_len;
2069
2070         SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING, wpa_ptk);
2071         sm->EAPOLKeyReceived = FALSE;
2072         sm->update_snonce = FALSE;
2073
2074         /* WPA with IEEE 802.1X: use the derived PMK from EAP
2075          * WPA-PSK: iterate through possible PSKs and select the one matching
2076          * the packet */
2077         for (;;) {
2078                 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
2079                         pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr,
2080                                                sm->p2p_dev_addr, pmk);
2081                         if (pmk == NULL)
2082                                 break;
2083                         psk_found = 1;
2084                         pmk_len = PMK_LEN;
2085                 } else {
2086                         pmk = sm->PMK;
2087                         pmk_len = sm->pmk_len;
2088                 }
2089
2090                 wpa_derive_ptk(sm, sm->SNonce, pmk, pmk_len, &PTK);
2091
2092                 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &PTK,
2093                                        sm->last_rx_eapol_key,
2094                                        sm->last_rx_eapol_key_len) == 0) {
2095                         ok = 1;
2096                         break;
2097                 }
2098
2099                 if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt))
2100                         break;
2101         }
2102
2103         if (!ok) {
2104                 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2105                                 "invalid MIC in msg 2/4 of 4-Way Handshake");
2106                 if (psk_found)
2107                         wpa_auth_psk_failure_report(sm->wpa_auth, sm->addr);
2108                 return;
2109         }
2110
2111 #ifdef CONFIG_IEEE80211R
2112         if (sm->wpa == WPA_VERSION_WPA2 && wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
2113                 /*
2114                  * Verify that PMKR1Name from EAPOL-Key message 2/4 matches
2115                  * with the value we derived.
2116                  */
2117                 if (os_memcmp_const(sm->sup_pmk_r1_name, sm->pmk_r1_name,
2118                                     WPA_PMK_NAME_LEN) != 0) {
2119                         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2120                                         "PMKR1Name mismatch in FT 4-way "
2121                                         "handshake");
2122                         wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from "
2123                                     "Supplicant",
2124                                     sm->sup_pmk_r1_name, WPA_PMK_NAME_LEN);
2125                         wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
2126                                     sm->pmk_r1_name, WPA_PMK_NAME_LEN);
2127                         return;
2128                 }
2129         }
2130 #endif /* CONFIG_IEEE80211R */
2131
2132         sm->pending_1_of_4_timeout = 0;
2133         eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm);
2134
2135         if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
2136                 /* PSK may have changed from the previous choice, so update
2137                  * state machine data based on whatever PSK was selected here.
2138                  */
2139                 os_memcpy(sm->PMK, pmk, PMK_LEN);
2140                 sm->pmk_len = PMK_LEN;
2141         }
2142
2143         sm->MICVerified = TRUE;
2144
2145         os_memcpy(&sm->PTK, &PTK, sizeof(PTK));
2146         sm->PTK_valid = TRUE;
2147 }
2148
2149
2150 SM_STATE(WPA_PTK, PTKCALCNEGOTIATING2)
2151 {
2152         SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING2, wpa_ptk);
2153         sm->TimeoutCtr = 0;
2154 }
2155
2156
2157 #ifdef CONFIG_IEEE80211W
2158
2159 static int ieee80211w_kde_len(struct wpa_state_machine *sm)
2160 {
2161         if (sm->mgmt_frame_prot) {
2162                 size_t len;
2163                 len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher);
2164                 return 2 + RSN_SELECTOR_LEN + WPA_IGTK_KDE_PREFIX_LEN + len;
2165         }
2166
2167         return 0;
2168 }
2169
2170
2171 static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos)
2172 {
2173         struct wpa_igtk_kde igtk;
2174         struct wpa_group *gsm = sm->group;
2175         u8 rsc[WPA_KEY_RSC_LEN];
2176         size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher);
2177
2178         if (!sm->mgmt_frame_prot)
2179                 return pos;
2180
2181         igtk.keyid[0] = gsm->GN_igtk;
2182         igtk.keyid[1] = 0;
2183         if (gsm->wpa_group_state != WPA_GROUP_SETKEYSDONE ||
2184             wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, rsc) < 0)
2185                 os_memset(igtk.pn, 0, sizeof(igtk.pn));
2186         else
2187                 os_memcpy(igtk.pn, rsc, sizeof(igtk.pn));
2188         os_memcpy(igtk.igtk, gsm->IGTK[gsm->GN_igtk - 4], len);
2189         if (sm->wpa_auth->conf.disable_gtk) {
2190                 /*
2191                  * Provide unique random IGTK to each STA to prevent use of
2192                  * IGTK in the BSS.
2193                  */
2194                 if (random_get_bytes(igtk.igtk, len) < 0)
2195                         return pos;
2196         }
2197         pos = wpa_add_kde(pos, RSN_KEY_DATA_IGTK,
2198                           (const u8 *) &igtk, WPA_IGTK_KDE_PREFIX_LEN + len,
2199                           NULL, 0);
2200
2201         return pos;
2202 }
2203
2204 #else /* CONFIG_IEEE80211W */
2205
2206 static int ieee80211w_kde_len(struct wpa_state_machine *sm)
2207 {
2208         return 0;
2209 }
2210
2211
2212 static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos)
2213 {
2214         return pos;
2215 }
2216
2217 #endif /* CONFIG_IEEE80211W */
2218
2219
2220 SM_STATE(WPA_PTK, PTKINITNEGOTIATING)
2221 {
2222         u8 rsc[WPA_KEY_RSC_LEN], *_rsc, *gtk, *kde, *pos, dummy_gtk[32];
2223         size_t gtk_len, kde_len;
2224         struct wpa_group *gsm = sm->group;
2225         u8 *wpa_ie;
2226         int wpa_ie_len, secure, keyidx, encr = 0;
2227
2228         SM_ENTRY_MA(WPA_PTK, PTKINITNEGOTIATING, wpa_ptk);
2229         sm->TimeoutEvt = FALSE;
2230
2231         sm->TimeoutCtr++;
2232         if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
2233                 /* No point in sending the EAPOL-Key - we will disconnect
2234                  * immediately following this. */
2235                 return;
2236         }
2237
2238         /* Send EAPOL(1, 1, 1, Pair, P, RSC, ANonce, MIC(PTK), RSNIE, [MDIE],
2239            GTK[GN], IGTK, [FTIE], [TIE * 2])
2240          */
2241         os_memset(rsc, 0, WPA_KEY_RSC_LEN);
2242         wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc);
2243         /* If FT is used, wpa_auth->wpa_ie includes both RSNIE and MDIE */
2244         wpa_ie = sm->wpa_auth->wpa_ie;
2245         wpa_ie_len = sm->wpa_auth->wpa_ie_len;
2246         if (sm->wpa == WPA_VERSION_WPA &&
2247             (sm->wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
2248             wpa_ie_len > wpa_ie[1] + 2 && wpa_ie[0] == WLAN_EID_RSN) {
2249                 /* WPA-only STA, remove RSN IE and possible MDIE */
2250                 wpa_ie = wpa_ie + wpa_ie[1] + 2;
2251                 if (wpa_ie[0] == WLAN_EID_MOBILITY_DOMAIN)
2252                         wpa_ie = wpa_ie + wpa_ie[1] + 2;
2253                 wpa_ie_len = wpa_ie[1] + 2;
2254         }
2255         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2256                         "sending 3/4 msg of 4-Way Handshake");
2257         if (sm->wpa == WPA_VERSION_WPA2) {
2258                 /* WPA2 send GTK in the 4-way handshake */
2259                 secure = 1;
2260                 gtk = gsm->GTK[gsm->GN - 1];
2261                 gtk_len = gsm->GTK_len;
2262                 if (sm->wpa_auth->conf.disable_gtk) {
2263                         /*
2264                          * Provide unique random GTK to each STA to prevent use
2265                          * of GTK in the BSS.
2266                          */
2267                         if (random_get_bytes(dummy_gtk, gtk_len) < 0)
2268                                 return;
2269                         gtk = dummy_gtk;
2270                 }
2271                 keyidx = gsm->GN;
2272                 _rsc = rsc;
2273                 encr = 1;
2274         } else {
2275                 /* WPA does not include GTK in msg 3/4 */
2276                 secure = 0;
2277                 gtk = NULL;
2278                 gtk_len = 0;
2279                 keyidx = 0;
2280                 _rsc = NULL;
2281                 if (sm->rx_eapol_key_secure) {
2282                         /*
2283                          * It looks like Windows 7 supplicant tries to use
2284                          * Secure bit in msg 2/4 after having reported Michael
2285                          * MIC failure and it then rejects the 4-way handshake
2286                          * if msg 3/4 does not set Secure bit. Work around this
2287                          * by setting the Secure bit here even in the case of
2288                          * WPA if the supplicant used it first.
2289                          */
2290                         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2291                                         "STA used Secure bit in WPA msg 2/4 - "
2292                                         "set Secure for 3/4 as workaround");
2293                         secure = 1;
2294                 }
2295         }
2296
2297         kde_len = wpa_ie_len + ieee80211w_kde_len(sm);
2298         if (gtk)
2299                 kde_len += 2 + RSN_SELECTOR_LEN + 2 + gtk_len;
2300 #ifdef CONFIG_IEEE80211R
2301         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
2302                 kde_len += 2 + PMKID_LEN; /* PMKR1Name into RSN IE */
2303                 kde_len += 300; /* FTIE + 2 * TIE */
2304         }
2305 #endif /* CONFIG_IEEE80211R */
2306 #ifdef CONFIG_P2P
2307         if (WPA_GET_BE32(sm->ip_addr) > 0)
2308                 kde_len += 2 + RSN_SELECTOR_LEN + 3 * 4;
2309 #endif /* CONFIG_P2P */
2310         kde = os_malloc(kde_len);
2311         if (kde == NULL)
2312                 return;
2313
2314         pos = kde;
2315         os_memcpy(pos, wpa_ie, wpa_ie_len);
2316         pos += wpa_ie_len;
2317 #ifdef CONFIG_IEEE80211R
2318         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
2319                 int res;
2320                 size_t elen;
2321
2322                 elen = pos - kde;
2323                 res = wpa_insert_pmkid(kde, &elen, sm->pmk_r1_name);
2324                 if (res < 0) {
2325                         wpa_printf(MSG_ERROR, "FT: Failed to insert "
2326                                    "PMKR1Name into RSN IE in EAPOL-Key data");
2327                         os_free(kde);
2328                         return;
2329                 }
2330                 pos -= wpa_ie_len;
2331                 pos += elen;
2332         }
2333 #endif /* CONFIG_IEEE80211R */
2334         if (gtk) {
2335                 u8 hdr[2];
2336                 hdr[0] = keyidx & 0x03;
2337                 hdr[1] = 0;
2338                 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2,
2339                                   gtk, gtk_len);
2340         }
2341         pos = ieee80211w_kde_add(sm, pos);
2342
2343 #ifdef CONFIG_IEEE80211R
2344         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
2345                 int res;
2346                 struct wpa_auth_config *conf;
2347
2348                 conf = &sm->wpa_auth->conf;
2349                 if (sm->assoc_resp_ftie &&
2350                     kde + kde_len - pos >= 2 + sm->assoc_resp_ftie[1]) {
2351                         os_memcpy(pos, sm->assoc_resp_ftie,
2352                                   2 + sm->assoc_resp_ftie[1]);
2353                         res = 2 + sm->assoc_resp_ftie[1];
2354                 } else {
2355                         res = wpa_write_ftie(conf, conf->r0_key_holder,
2356                                              conf->r0_key_holder_len,
2357                                              NULL, NULL, pos,
2358                                              kde + kde_len - pos,
2359                                              NULL, 0);
2360                 }
2361                 if (res < 0) {
2362                         wpa_printf(MSG_ERROR, "FT: Failed to insert FTIE "
2363                                    "into EAPOL-Key Key Data");
2364                         os_free(kde);
2365                         return;
2366                 }
2367                 pos += res;
2368
2369                 /* TIE[ReassociationDeadline] (TU) */
2370                 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
2371                 *pos++ = 5;
2372                 *pos++ = WLAN_TIMEOUT_REASSOC_DEADLINE;
2373                 WPA_PUT_LE32(pos, conf->reassociation_deadline);
2374                 pos += 4;
2375
2376                 /* TIE[KeyLifetime] (seconds) */
2377                 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
2378                 *pos++ = 5;
2379                 *pos++ = WLAN_TIMEOUT_KEY_LIFETIME;
2380                 WPA_PUT_LE32(pos, conf->r0_key_lifetime * 60);
2381                 pos += 4;
2382         }
2383 #endif /* CONFIG_IEEE80211R */
2384 #ifdef CONFIG_P2P
2385         if (WPA_GET_BE32(sm->ip_addr) > 0) {
2386                 u8 addr[3 * 4];
2387                 os_memcpy(addr, sm->ip_addr, 4);
2388                 os_memcpy(addr + 4, sm->wpa_auth->conf.ip_addr_mask, 4);
2389                 os_memcpy(addr + 8, sm->wpa_auth->conf.ip_addr_go, 4);
2390                 pos = wpa_add_kde(pos, WFA_KEY_DATA_IP_ADDR_ALLOC,
2391                                   addr, sizeof(addr), NULL, 0);
2392         }
2393 #endif /* CONFIG_P2P */
2394
2395         wpa_send_eapol(sm->wpa_auth, sm,
2396                        (secure ? WPA_KEY_INFO_SECURE : 0) | WPA_KEY_INFO_MIC |
2397                        WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL |
2398                        WPA_KEY_INFO_KEY_TYPE,
2399                        _rsc, sm->ANonce, kde, pos - kde, keyidx, encr);
2400         os_free(kde);
2401 }
2402
2403
2404 SM_STATE(WPA_PTK, PTKINITDONE)
2405 {
2406         SM_ENTRY_MA(WPA_PTK, PTKINITDONE, wpa_ptk);
2407         sm->EAPOLKeyReceived = FALSE;
2408         if (sm->Pair) {
2409                 enum wpa_alg alg = wpa_cipher_to_alg(sm->pairwise);
2410                 int klen = wpa_cipher_key_len(sm->pairwise);
2411                 if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0,
2412                                      sm->PTK.tk, klen)) {
2413                         wpa_sta_disconnect(sm->wpa_auth, sm->addr);
2414                         return;
2415                 }
2416                 /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
2417                 sm->pairwise_set = TRUE;
2418
2419                 if (sm->wpa_auth->conf.wpa_ptk_rekey) {
2420                         eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm);
2421                         eloop_register_timeout(sm->wpa_auth->conf.
2422                                                wpa_ptk_rekey, 0, wpa_rekey_ptk,
2423                                                sm->wpa_auth, sm);
2424                 }
2425
2426                 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) {
2427                         wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
2428                                            WPA_EAPOL_authorized, 1);
2429                 }
2430         }
2431
2432         if (0 /* IBSS == TRUE */) {
2433                 sm->keycount++;
2434                 if (sm->keycount == 2) {
2435                         wpa_auth_set_eapol(sm->wpa_auth, sm->addr,
2436                                            WPA_EAPOL_portValid, 1);
2437                 }
2438         } else {
2439                 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid,
2440                                    1);
2441         }
2442         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyAvailable, 0);
2443         wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyDone, 1);
2444         if (sm->wpa == WPA_VERSION_WPA)
2445                 sm->PInitAKeys = TRUE;
2446         else
2447                 sm->has_GTK = TRUE;
2448         wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2449                          "pairwise key handshake completed (%s)",
2450                          sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN");
2451
2452 #ifdef CONFIG_IEEE80211R
2453         wpa_ft_push_pmk_r1(sm->wpa_auth, sm->addr);
2454 #endif /* CONFIG_IEEE80211R */
2455 }
2456
2457
2458 SM_STEP(WPA_PTK)
2459 {
2460         struct wpa_authenticator *wpa_auth = sm->wpa_auth;
2461
2462         if (sm->Init)
2463                 SM_ENTER(WPA_PTK, INITIALIZE);
2464         else if (sm->Disconnect
2465                  /* || FIX: dot11RSNAConfigSALifetime timeout */) {
2466                 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
2467                                 "WPA_PTK: sm->Disconnect");
2468                 SM_ENTER(WPA_PTK, DISCONNECT);
2469         }
2470         else if (sm->DeauthenticationRequest)
2471                 SM_ENTER(WPA_PTK, DISCONNECTED);
2472         else if (sm->AuthenticationRequest)
2473                 SM_ENTER(WPA_PTK, AUTHENTICATION);
2474         else if (sm->ReAuthenticationRequest)
2475                 SM_ENTER(WPA_PTK, AUTHENTICATION2);
2476         else if (sm->PTKRequest) {
2477                 if (wpa_auth_sm_ptk_update(sm) < 0)
2478                         SM_ENTER(WPA_PTK, DISCONNECTED);
2479                 else
2480                         SM_ENTER(WPA_PTK, PTKSTART);
2481         } else switch (sm->wpa_ptk_state) {
2482         case WPA_PTK_INITIALIZE:
2483                 break;
2484         case WPA_PTK_DISCONNECT:
2485                 SM_ENTER(WPA_PTK, DISCONNECTED);
2486                 break;
2487         case WPA_PTK_DISCONNECTED:
2488                 SM_ENTER(WPA_PTK, INITIALIZE);
2489                 break;
2490         case WPA_PTK_AUTHENTICATION:
2491                 SM_ENTER(WPA_PTK, AUTHENTICATION2);
2492                 break;
2493         case WPA_PTK_AUTHENTICATION2:
2494                 if (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) &&
2495                     wpa_auth_get_eapol(sm->wpa_auth, sm->addr,
2496                                        WPA_EAPOL_keyRun) > 0)
2497                         SM_ENTER(WPA_PTK, INITPMK);
2498                 else if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)
2499                          /* FIX: && 802.1X::keyRun */)
2500                         SM_ENTER(WPA_PTK, INITPSK);
2501                 break;
2502         case WPA_PTK_INITPMK:
2503                 if (wpa_auth_get_eapol(sm->wpa_auth, sm->addr,
2504                                        WPA_EAPOL_keyAvailable) > 0)
2505                         SM_ENTER(WPA_PTK, PTKSTART);
2506                 else {
2507                         wpa_auth->dot11RSNA4WayHandshakeFailures++;
2508                         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2509                                         "INITPMK - keyAvailable = false");
2510                         SM_ENTER(WPA_PTK, DISCONNECT);
2511                 }
2512                 break;
2513         case WPA_PTK_INITPSK:
2514                 if (wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr,
2515                                      NULL))
2516                         SM_ENTER(WPA_PTK, PTKSTART);
2517                 else {
2518                         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2519                                         "no PSK configured for the STA");
2520                         wpa_auth->dot11RSNA4WayHandshakeFailures++;
2521                         SM_ENTER(WPA_PTK, DISCONNECT);
2522                 }
2523                 break;
2524         case WPA_PTK_PTKSTART:
2525                 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2526                     sm->EAPOLKeyPairwise)
2527                         SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
2528                 else if (sm->TimeoutCtr >
2529                          (int) dot11RSNAConfigPairwiseUpdateCount) {
2530                         wpa_auth->dot11RSNA4WayHandshakeFailures++;
2531                         wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2532                                          "PTKSTART: Retry limit %d reached",
2533                                          dot11RSNAConfigPairwiseUpdateCount);
2534                         SM_ENTER(WPA_PTK, DISCONNECT);
2535                 } else if (sm->TimeoutEvt)
2536                         SM_ENTER(WPA_PTK, PTKSTART);
2537                 break;
2538         case WPA_PTK_PTKCALCNEGOTIATING:
2539                 if (sm->MICVerified)
2540                         SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING2);
2541                 else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2542                          sm->EAPOLKeyPairwise)
2543                         SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
2544                 else if (sm->TimeoutEvt)
2545                         SM_ENTER(WPA_PTK, PTKSTART);
2546                 break;
2547         case WPA_PTK_PTKCALCNEGOTIATING2:
2548                 SM_ENTER(WPA_PTK, PTKINITNEGOTIATING);
2549                 break;
2550         case WPA_PTK_PTKINITNEGOTIATING:
2551                 if (sm->update_snonce)
2552                         SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
2553                 else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2554                          sm->EAPOLKeyPairwise && sm->MICVerified)
2555                         SM_ENTER(WPA_PTK, PTKINITDONE);
2556                 else if (sm->TimeoutCtr >
2557                          (int) dot11RSNAConfigPairwiseUpdateCount) {
2558                         wpa_auth->dot11RSNA4WayHandshakeFailures++;
2559                         wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2560                                          "PTKINITNEGOTIATING: Retry limit %d "
2561                                          "reached",
2562                                          dot11RSNAConfigPairwiseUpdateCount);
2563                         SM_ENTER(WPA_PTK, DISCONNECT);
2564                 } else if (sm->TimeoutEvt)
2565                         SM_ENTER(WPA_PTK, PTKINITNEGOTIATING);
2566                 break;
2567         case WPA_PTK_PTKINITDONE:
2568                 break;
2569         }
2570 }
2571
2572
2573 SM_STATE(WPA_PTK_GROUP, IDLE)
2574 {
2575         SM_ENTRY_MA(WPA_PTK_GROUP, IDLE, wpa_ptk_group);
2576         if (sm->Init) {
2577                 /* Init flag is not cleared here, so avoid busy
2578                  * loop by claiming nothing changed. */
2579                 sm->changed = FALSE;
2580         }
2581         sm->GTimeoutCtr = 0;
2582 }
2583
2584
2585 SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING)
2586 {
2587         u8 rsc[WPA_KEY_RSC_LEN];
2588         struct wpa_group *gsm = sm->group;
2589         const u8 *kde;
2590         u8 *kde_buf = NULL, *pos, hdr[2];
2591         size_t kde_len;
2592         u8 *gtk, dummy_gtk[32];
2593
2594         SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group);
2595
2596         sm->GTimeoutCtr++;
2597         if (sm->GTimeoutCtr > (int) dot11RSNAConfigGroupUpdateCount) {
2598                 /* No point in sending the EAPOL-Key - we will disconnect
2599                  * immediately following this. */
2600                 return;
2601         }
2602
2603         if (sm->wpa == WPA_VERSION_WPA)
2604                 sm->PInitAKeys = FALSE;
2605         sm->TimeoutEvt = FALSE;
2606         /* Send EAPOL(1, 1, 1, !Pair, G, RSC, GNonce, MIC(PTK), GTK[GN]) */
2607         os_memset(rsc, 0, WPA_KEY_RSC_LEN);
2608         if (gsm->wpa_group_state == WPA_GROUP_SETKEYSDONE)
2609                 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc);
2610         wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2611                         "sending 1/2 msg of Group Key Handshake");
2612
2613         gtk = gsm->GTK[gsm->GN - 1];
2614         if (sm->wpa_auth->conf.disable_gtk) {
2615                 /*
2616                  * Provide unique random GTK to each STA to prevent use
2617                  * of GTK in the BSS.
2618                  */
2619                 if (random_get_bytes(dummy_gtk, gsm->GTK_len) < 0)
2620                         return;
2621                 gtk = dummy_gtk;
2622         }
2623         if (sm->wpa == WPA_VERSION_WPA2) {
2624                 kde_len = 2 + RSN_SELECTOR_LEN + 2 + gsm->GTK_len +
2625                         ieee80211w_kde_len(sm);
2626                 kde_buf = os_malloc(kde_len);
2627                 if (kde_buf == NULL)
2628                         return;
2629
2630                 kde = pos = kde_buf;
2631                 hdr[0] = gsm->GN & 0x03;
2632                 hdr[1] = 0;
2633                 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2,
2634                                   gtk, gsm->GTK_len);
2635                 pos = ieee80211w_kde_add(sm, pos);
2636                 kde_len = pos - kde;
2637         } else {
2638                 kde = gtk;
2639                 kde_len = gsm->GTK_len;
2640         }
2641
2642         wpa_send_eapol(sm->wpa_auth, sm,
2643                        WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC |
2644                        WPA_KEY_INFO_ACK |
2645                        (!sm->Pair ? WPA_KEY_INFO_INSTALL : 0),
2646                        rsc, gsm->GNonce, kde, kde_len, gsm->GN, 1);
2647
2648         os_free(kde_buf);
2649 }
2650
2651
2652 SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED)
2653 {
2654         SM_ENTRY_MA(WPA_PTK_GROUP, REKEYESTABLISHED, wpa_ptk_group);
2655         sm->EAPOLKeyReceived = FALSE;
2656         if (sm->GUpdateStationKeys)
2657                 sm->group->GKeyDoneStations--;
2658         sm->GUpdateStationKeys = FALSE;
2659         sm->GTimeoutCtr = 0;
2660         /* FIX: MLME.SetProtection.Request(TA, Tx_Rx) */
2661         wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO,
2662                          "group key handshake completed (%s)",
2663                          sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN");
2664         sm->has_GTK = TRUE;
2665 }
2666
2667
2668 SM_STATE(WPA_PTK_GROUP, KEYERROR)
2669 {
2670         SM_ENTRY_MA(WPA_PTK_GROUP, KEYERROR, wpa_ptk_group);
2671         if (sm->GUpdateStationKeys)
2672                 sm->group->GKeyDoneStations--;
2673         sm->GUpdateStationKeys = FALSE;
2674         sm->Disconnect = TRUE;
2675 }
2676
2677
2678 SM_STEP(WPA_PTK_GROUP)
2679 {
2680         if (sm->Init || sm->PtkGroupInit) {
2681                 SM_ENTER(WPA_PTK_GROUP, IDLE);
2682                 sm->PtkGroupInit = FALSE;
2683         } else switch (sm->wpa_ptk_group_state) {
2684         case WPA_PTK_GROUP_IDLE:
2685                 if (sm->GUpdateStationKeys ||
2686                     (sm->wpa == WPA_VERSION_WPA && sm->PInitAKeys))
2687                         SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
2688                 break;
2689         case WPA_PTK_GROUP_REKEYNEGOTIATING:
2690                 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest &&
2691                     !sm->EAPOLKeyPairwise && sm->MICVerified)
2692                         SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED);
2693                 else if (sm->GTimeoutCtr >
2694                          (int) dot11RSNAConfigGroupUpdateCount)
2695                         SM_ENTER(WPA_PTK_GROUP, KEYERROR);
2696                 else if (sm->TimeoutEvt)
2697                         SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
2698                 break;
2699         case WPA_PTK_GROUP_KEYERROR:
2700                 SM_ENTER(WPA_PTK_GROUP, IDLE);
2701                 break;
2702         case WPA_PTK_GROUP_REKEYESTABLISHED:
2703                 SM_ENTER(WPA_PTK_GROUP, IDLE);
2704                 break;
2705         }
2706 }
2707
2708
2709 static int wpa_gtk_update(struct wpa_authenticator *wpa_auth,
2710                           struct wpa_group *group)
2711 {
2712         int ret = 0;
2713
2714         os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN);
2715         inc_byte_array(group->Counter, WPA_NONCE_LEN);
2716         if (wpa_gmk_to_gtk(group->GMK, "Group key expansion",
2717                            wpa_auth->addr, group->GNonce,
2718                            group->GTK[group->GN - 1], group->GTK_len) < 0)
2719                 ret = -1;
2720         wpa_hexdump_key(MSG_DEBUG, "GTK",
2721                         group->GTK[group->GN - 1], group->GTK_len);
2722
2723 #ifdef CONFIG_IEEE80211W
2724         if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) {
2725                 size_t len;
2726                 len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher);
2727                 os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN);
2728                 inc_byte_array(group->Counter, WPA_NONCE_LEN);
2729                 if (wpa_gmk_to_gtk(group->GMK, "IGTK key expansion",
2730                                    wpa_auth->addr, group->GNonce,
2731                                    group->IGTK[group->GN_igtk - 4], len) < 0)
2732                         ret = -1;
2733                 wpa_hexdump_key(MSG_DEBUG, "IGTK",
2734                                 group->IGTK[group->GN_igtk - 4], len);
2735         }
2736 #endif /* CONFIG_IEEE80211W */
2737
2738         return ret;
2739 }
2740
2741
2742 static void wpa_group_gtk_init(struct wpa_authenticator *wpa_auth,
2743                                struct wpa_group *group)
2744 {
2745         wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2746                    "GTK_INIT (VLAN-ID %d)", group->vlan_id);
2747         group->changed = FALSE; /* GInit is not cleared here; avoid loop */
2748         group->wpa_group_state = WPA_GROUP_GTK_INIT;
2749
2750         /* GTK[0..N] = 0 */
2751         os_memset(group->GTK, 0, sizeof(group->GTK));
2752         group->GN = 1;
2753         group->GM = 2;
2754 #ifdef CONFIG_IEEE80211W
2755         group->GN_igtk = 4;
2756         group->GM_igtk = 5;
2757 #endif /* CONFIG_IEEE80211W */
2758         /* GTK[GN] = CalcGTK() */
2759         wpa_gtk_update(wpa_auth, group);
2760 }
2761
2762
2763 static int wpa_group_update_sta(struct wpa_state_machine *sm, void *ctx)
2764 {
2765         if (ctx != NULL && ctx != sm->group)
2766                 return 0;
2767
2768         if (sm->wpa_ptk_state != WPA_PTK_PTKINITDONE) {
2769                 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2770                                 "Not in PTKINITDONE; skip Group Key update");
2771                 sm->GUpdateStationKeys = FALSE;
2772                 return 0;
2773         }
2774         if (sm->GUpdateStationKeys) {
2775                 /*
2776                  * This should not really happen, so add a debug log entry.
2777                  * Since we clear the GKeyDoneStations before the loop, the
2778                  * station needs to be counted here anyway.
2779                  */
2780                 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
2781                                 "GUpdateStationKeys was already set when "
2782                                 "marking station for GTK rekeying");
2783         }
2784
2785         /* Do not rekey GTK/IGTK when STA is in WNM-Sleep Mode */
2786         if (sm->is_wnmsleep)
2787                 return 0;
2788
2789         sm->group->GKeyDoneStations++;
2790         sm->GUpdateStationKeys = TRUE;
2791
2792         wpa_sm_step(sm);
2793         return 0;
2794 }
2795
2796
2797 #ifdef CONFIG_WNM
2798 /* update GTK when exiting WNM-Sleep Mode */
2799 void wpa_wnmsleep_rekey_gtk(struct wpa_state_machine *sm)
2800 {
2801         if (sm == NULL || sm->is_wnmsleep)
2802                 return;
2803
2804         wpa_group_update_sta(sm, NULL);
2805 }
2806
2807
2808 void wpa_set_wnmsleep(struct wpa_state_machine *sm, int flag)
2809 {
2810         if (sm)
2811                 sm->is_wnmsleep = !!flag;
2812 }
2813
2814
2815 int wpa_wnmsleep_gtk_subelem(struct wpa_state_machine *sm, u8 *pos)
2816 {
2817         struct wpa_group *gsm = sm->group;
2818         u8 *start = pos;
2819
2820         /*
2821          * GTK subelement:
2822          * Sub-elem ID[1] | Length[1] | Key Info[2] | Key Length[1] | RSC[8] |
2823          * Key[5..32]
2824          */
2825         *pos++ = WNM_SLEEP_SUBELEM_GTK;
2826         *pos++ = 11 + gsm->GTK_len;
2827         /* Key ID in B0-B1 of Key Info */
2828         WPA_PUT_LE16(pos, gsm->GN & 0x03);
2829         pos += 2;
2830         *pos++ = gsm->GTK_len;
2831         if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, pos) != 0)
2832                 return 0;
2833         pos += 8;
2834         os_memcpy(pos, gsm->GTK[gsm->GN - 1], gsm->GTK_len);
2835         pos += gsm->GTK_len;
2836
2837         wpa_printf(MSG_DEBUG, "WNM: GTK Key ID %u in WNM-Sleep Mode exit",
2838                    gsm->GN);
2839         wpa_hexdump_key(MSG_DEBUG, "WNM: GTK in WNM-Sleep Mode exit",
2840                         gsm->GTK[gsm->GN - 1], gsm->GTK_len);
2841
2842         return pos - start;
2843 }
2844
2845
2846 #ifdef CONFIG_IEEE80211W
2847 int wpa_wnmsleep_igtk_subelem(struct wpa_state_machine *sm, u8 *pos)
2848 {
2849         struct wpa_group *gsm = sm->group;
2850         u8 *start = pos;
2851         size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher);
2852
2853         /*
2854          * IGTK subelement:
2855          * Sub-elem ID[1] | Length[1] | KeyID[2] | PN[6] | Key[16]
2856          */
2857         *pos++ = WNM_SLEEP_SUBELEM_IGTK;
2858         *pos++ = 2 + 6 + len;
2859         WPA_PUT_LE16(pos, gsm->GN_igtk);
2860         pos += 2;
2861         if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, pos) != 0)
2862                 return 0;
2863         pos += 6;
2864
2865         os_memcpy(pos, gsm->IGTK[gsm->GN_igtk - 4], len);
2866         pos += len;
2867
2868         wpa_printf(MSG_DEBUG, "WNM: IGTK Key ID %u in WNM-Sleep Mode exit",
2869                    gsm->GN_igtk);
2870         wpa_hexdump_key(MSG_DEBUG, "WNM: IGTK in WNM-Sleep Mode exit",
2871                         gsm->IGTK[gsm->GN_igtk - 4], len);
2872
2873         return pos - start;
2874 }
2875 #endif /* CONFIG_IEEE80211W */
2876 #endif /* CONFIG_WNM */
2877
2878
2879 static void wpa_group_setkeys(struct wpa_authenticator *wpa_auth,
2880                               struct wpa_group *group)
2881 {
2882         int tmp;
2883
2884         wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2885                    "SETKEYS (VLAN-ID %d)", group->vlan_id);
2886         group->changed = TRUE;
2887         group->wpa_group_state = WPA_GROUP_SETKEYS;
2888         group->GTKReKey = FALSE;
2889         tmp = group->GM;
2890         group->GM = group->GN;
2891         group->GN = tmp;
2892 #ifdef CONFIG_IEEE80211W
2893         tmp = group->GM_igtk;
2894         group->GM_igtk = group->GN_igtk;
2895         group->GN_igtk = tmp;
2896 #endif /* CONFIG_IEEE80211W */
2897         /* "GKeyDoneStations = GNoStations" is done in more robust way by
2898          * counting the STAs that are marked with GUpdateStationKeys instead of
2899          * including all STAs that could be in not-yet-completed state. */
2900         wpa_gtk_update(wpa_auth, group);
2901
2902         if (group->GKeyDoneStations) {
2903                 wpa_printf(MSG_DEBUG, "wpa_group_setkeys: Unexpected "
2904                            "GKeyDoneStations=%d when starting new GTK rekey",
2905                            group->GKeyDoneStations);
2906                 group->GKeyDoneStations = 0;
2907         }
2908         wpa_auth_for_each_sta(wpa_auth, wpa_group_update_sta, group);
2909         wpa_printf(MSG_DEBUG, "wpa_group_setkeys: GKeyDoneStations=%d",
2910                    group->GKeyDoneStations);
2911 }
2912
2913
2914 static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth,
2915                                        struct wpa_group *group)
2916 {
2917         int ret = 0;
2918
2919         if (wpa_auth_set_key(wpa_auth, group->vlan_id,
2920                              wpa_cipher_to_alg(wpa_auth->conf.wpa_group),
2921                              broadcast_ether_addr, group->GN,
2922                              group->GTK[group->GN - 1], group->GTK_len) < 0)
2923                 ret = -1;
2924
2925 #ifdef CONFIG_IEEE80211W
2926         if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) {
2927                 enum wpa_alg alg;
2928                 size_t len;
2929
2930                 alg = wpa_cipher_to_alg(wpa_auth->conf.group_mgmt_cipher);
2931                 len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher);
2932
2933                 if (ret == 0 &&
2934                     wpa_auth_set_key(wpa_auth, group->vlan_id, alg,
2935                                      broadcast_ether_addr, group->GN_igtk,
2936                                      group->IGTK[group->GN_igtk - 4], len) < 0)
2937                         ret = -1;
2938         }
2939 #endif /* CONFIG_IEEE80211W */
2940
2941         return ret;
2942 }
2943
2944
2945 static int wpa_group_disconnect_cb(struct wpa_state_machine *sm, void *ctx)
2946 {
2947         if (sm->group == ctx) {
2948                 wpa_printf(MSG_DEBUG, "WPA: Mark STA " MACSTR
2949                            " for discconnection due to fatal failure",
2950                            MAC2STR(sm->addr));
2951                 sm->Disconnect = TRUE;
2952         }
2953
2954         return 0;
2955 }
2956
2957
2958 static void wpa_group_fatal_failure(struct wpa_authenticator *wpa_auth,
2959                                     struct wpa_group *group)
2960 {
2961         wpa_printf(MSG_DEBUG, "WPA: group state machine entering state FATAL_FAILURE");
2962         group->changed = TRUE;
2963         group->wpa_group_state = WPA_GROUP_FATAL_FAILURE;
2964         wpa_auth_for_each_sta(wpa_auth, wpa_group_disconnect_cb, group);
2965 }
2966
2967
2968 static int wpa_group_setkeysdone(struct wpa_authenticator *wpa_auth,
2969                                  struct wpa_group *group)
2970 {
2971         wpa_printf(MSG_DEBUG, "WPA: group state machine entering state "
2972                    "SETKEYSDONE (VLAN-ID %d)", group->vlan_id);
2973         group->changed = TRUE;
2974         group->wpa_group_state = WPA_GROUP_SETKEYSDONE;
2975
2976         if (wpa_group_config_group_keys(wpa_auth, group) < 0) {
2977                 wpa_group_fatal_failure(wpa_auth, group);
2978                 return -1;
2979         }
2980
2981         return 0;
2982 }
2983
2984
2985 static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth,
2986                               struct wpa_group *group)
2987 {
2988         if (group->GInit) {
2989                 wpa_group_gtk_init(wpa_auth, group);
2990         } else if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) {
2991                 /* Do not allow group operations */
2992         } else if (group->wpa_group_state == WPA_GROUP_GTK_INIT &&
2993                    group->GTKAuthenticator) {
2994                 wpa_group_setkeysdone(wpa_auth, group);
2995         } else if (group->wpa_group_state == WPA_GROUP_SETKEYSDONE &&
2996                    group->GTKReKey) {
2997                 wpa_group_setkeys(wpa_auth, group);
2998         } else if (group->wpa_group_state == WPA_GROUP_SETKEYS) {
2999                 if (group->GKeyDoneStations == 0)
3000                         wpa_group_setkeysdone(wpa_auth, group);
3001                 else if (group->GTKReKey)
3002                         wpa_group_setkeys(wpa_auth, group);
3003         }
3004 }
3005
3006
3007 static int wpa_sm_step(struct wpa_state_machine *sm)
3008 {
3009         if (sm == NULL)
3010                 return 0;
3011
3012         if (sm->in_step_loop) {
3013                 /* This should not happen, but if it does, make sure we do not
3014                  * end up freeing the state machine too early by exiting the
3015                  * recursive call. */
3016                 wpa_printf(MSG_ERROR, "WPA: wpa_sm_step() called recursively");
3017                 return 0;
3018         }
3019
3020         sm->in_step_loop = 1;
3021         do {
3022                 if (sm->pending_deinit)
3023                         break;
3024
3025                 sm->changed = FALSE;
3026                 sm->wpa_auth->group->changed = FALSE;
3027
3028                 SM_STEP_RUN(WPA_PTK);
3029                 if (sm->pending_deinit)
3030                         break;
3031                 SM_STEP_RUN(WPA_PTK_GROUP);
3032                 if (sm->pending_deinit)
3033                         break;
3034                 wpa_group_sm_step(sm->wpa_auth, sm->group);
3035         } while (sm->changed || sm->wpa_auth->group->changed);
3036         sm->in_step_loop = 0;
3037
3038         if (sm->pending_deinit) {
3039                 wpa_printf(MSG_DEBUG, "WPA: Completing pending STA state "
3040                            "machine deinit for " MACSTR, MAC2STR(sm->addr));
3041                 wpa_free_sta_sm(sm);
3042                 return 1;
3043         }
3044         return 0;
3045 }
3046
3047
3048 static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx)
3049 {
3050         struct wpa_state_machine *sm = eloop_ctx;
3051         wpa_sm_step(sm);
3052 }
3053
3054
3055 void wpa_auth_sm_notify(struct wpa_state_machine *sm)
3056 {
3057         if (sm == NULL)
3058                 return;
3059         eloop_register_timeout(0, 0, wpa_sm_call_step, sm, NULL);
3060 }
3061
3062
3063 void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth)
3064 {
3065         int tmp, i;
3066         struct wpa_group *group;
3067
3068         if (wpa_auth == NULL)
3069                 return;
3070
3071         group = wpa_auth->group;
3072
3073         for (i = 0; i < 2; i++) {
3074                 tmp = group->GM;
3075                 group->GM = group->GN;
3076                 group->GN = tmp;
3077 #ifdef CONFIG_IEEE80211W
3078                 tmp = group->GM_igtk;
3079                 group->GM_igtk = group->GN_igtk;
3080                 group->GN_igtk = tmp;
3081 #endif /* CONFIG_IEEE80211W */
3082                 wpa_gtk_update(wpa_auth, group);
3083                 wpa_group_config_group_keys(wpa_auth, group);
3084         }
3085 }
3086
3087
3088 static const char * wpa_bool_txt(int val)
3089 {
3090         return val ? "TRUE" : "FALSE";
3091 }
3092
3093
3094 #define RSN_SUITE "%02x-%02x-%02x-%d"
3095 #define RSN_SUITE_ARG(s) \
3096 ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
3097
3098 int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen)
3099 {
3100         int len = 0, ret;
3101         char pmkid_txt[PMKID_LEN * 2 + 1];
3102 #ifdef CONFIG_RSN_PREAUTH
3103         const int preauth = 1;
3104 #else /* CONFIG_RSN_PREAUTH */
3105         const int preauth = 0;
3106 #endif /* CONFIG_RSN_PREAUTH */
3107
3108         if (wpa_auth == NULL)
3109                 return len;
3110
3111         ret = os_snprintf(buf + len, buflen - len,
3112                           "dot11RSNAOptionImplemented=TRUE\n"
3113                           "dot11RSNAPreauthenticationImplemented=%s\n"
3114                           "dot11RSNAEnabled=%s\n"
3115                           "dot11RSNAPreauthenticationEnabled=%s\n",
3116                           wpa_bool_txt(preauth),
3117                           wpa_bool_txt(wpa_auth->conf.wpa & WPA_PROTO_RSN),
3118                           wpa_bool_txt(wpa_auth->conf.rsn_preauth));
3119         if (os_snprintf_error(buflen - len, ret))
3120                 return len;
3121         len += ret;
3122
3123         wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
3124                          wpa_auth->dot11RSNAPMKIDUsed, PMKID_LEN);
3125
3126         ret = os_snprintf(
3127                 buf + len, buflen - len,
3128                 "dot11RSNAConfigVersion=%u\n"
3129                 "dot11RSNAConfigPairwiseKeysSupported=9999\n"
3130                 /* FIX: dot11RSNAConfigGroupCipher */
3131                 /* FIX: dot11RSNAConfigGroupRekeyMethod */
3132                 /* FIX: dot11RSNAConfigGroupRekeyTime */
3133                 /* FIX: dot11RSNAConfigGroupRekeyPackets */
3134                 "dot11RSNAConfigGroupRekeyStrict=%u\n"
3135                 "dot11RSNAConfigGroupUpdateCount=%u\n"
3136                 "dot11RSNAConfigPairwiseUpdateCount=%u\n"
3137                 "dot11RSNAConfigGroupCipherSize=%u\n"
3138                 "dot11RSNAConfigPMKLifetime=%u\n"
3139                 "dot11RSNAConfigPMKReauthThreshold=%u\n"
3140                 "dot11RSNAConfigNumberOfPTKSAReplayCounters=0\n"
3141                 "dot11RSNAConfigSATimeout=%u\n"
3142                 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
3143                 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
3144                 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
3145                 "dot11RSNAPMKIDUsed=%s\n"
3146                 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
3147                 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
3148                 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
3149                 "dot11RSNATKIPCounterMeasuresInvoked=%u\n"
3150                 "dot11RSNA4WayHandshakeFailures=%u\n"
3151                 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n",
3152                 RSN_VERSION,
3153                 !!wpa_auth->conf.wpa_strict_rekey,
3154                 dot11RSNAConfigGroupUpdateCount,
3155                 dot11RSNAConfigPairwiseUpdateCount,
3156                 wpa_cipher_key_len(wpa_auth->conf.wpa_group) * 8,
3157                 dot11RSNAConfigPMKLifetime,
3158                 dot11RSNAConfigPMKReauthThreshold,
3159                 dot11RSNAConfigSATimeout,
3160                 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteSelected),
3161                 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherSelected),
3162                 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherSelected),
3163                 pmkid_txt,
3164                 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteRequested),
3165                 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherRequested),
3166                 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherRequested),
3167                 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked,
3168                 wpa_auth->dot11RSNA4WayHandshakeFailures);
3169         if (os_snprintf_error(buflen - len, ret))
3170                 return len;
3171         len += ret;
3172
3173         /* TODO: dot11RSNAConfigPairwiseCiphersTable */
3174         /* TODO: dot11RSNAConfigAuthenticationSuitesTable */
3175
3176         /* Private MIB */
3177         ret = os_snprintf(buf + len, buflen - len, "hostapdWPAGroupState=%d\n",
3178                           wpa_auth->group->wpa_group_state);
3179         if (os_snprintf_error(buflen - len, ret))
3180                 return len;
3181         len += ret;
3182
3183         return len;
3184 }
3185
3186
3187 int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen)
3188 {
3189         int len = 0, ret;
3190         u32 pairwise = 0;
3191
3192         if (sm == NULL)
3193                 return 0;
3194
3195         /* TODO: FF-FF-FF-FF-FF-FF entry for broadcast/multicast stats */
3196
3197         /* dot11RSNAStatsEntry */
3198
3199         pairwise = wpa_cipher_to_suite(sm->wpa == WPA_VERSION_WPA2 ?
3200                                        WPA_PROTO_RSN : WPA_PROTO_WPA,
3201                                        sm->pairwise);
3202         if (pairwise == 0)
3203                 return 0;
3204
3205         ret = os_snprintf(
3206                 buf + len, buflen - len,
3207                 /* TODO: dot11RSNAStatsIndex */
3208                 "dot11RSNAStatsSTAAddress=" MACSTR "\n"
3209                 "dot11RSNAStatsVersion=1\n"
3210                 "dot11RSNAStatsSelectedPairwiseCipher=" RSN_SUITE "\n"
3211                 /* TODO: dot11RSNAStatsTKIPICVErrors */
3212                 "dot11RSNAStatsTKIPLocalMICFailures=%u\n"
3213                 "dot11RSNAStatsTKIPRemoteMICFailures=%u\n"
3214                 /* TODO: dot11RSNAStatsCCMPReplays */
3215                 /* TODO: dot11RSNAStatsCCMPDecryptErrors */
3216                 /* TODO: dot11RSNAStatsTKIPReplays */,
3217                 MAC2STR(sm->addr),
3218                 RSN_SUITE_ARG(pairwise),
3219                 sm->dot11RSNAStatsTKIPLocalMICFailures,
3220                 sm->dot11RSNAStatsTKIPRemoteMICFailures);
3221         if (os_snprintf_error(buflen - len, ret))
3222                 return len;
3223         len += ret;
3224
3225         /* Private MIB */
3226         ret = os_snprintf(buf + len, buflen - len,
3227                           "hostapdWPAPTKState=%d\n"
3228                           "hostapdWPAPTKGroupState=%d\n",
3229                           sm->wpa_ptk_state,
3230                           sm->wpa_ptk_group_state);
3231         if (os_snprintf_error(buflen - len, ret))
3232                 return len;
3233         len += ret;
3234
3235         return len;
3236 }
3237
3238
3239 void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth)
3240 {
3241         if (wpa_auth)
3242                 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked++;
3243 }
3244
3245
3246 int wpa_auth_pairwise_set(struct wpa_state_machine *sm)
3247 {
3248         return sm && sm->pairwise_set;
3249 }
3250
3251
3252 int wpa_auth_get_pairwise(struct wpa_state_machine *sm)
3253 {
3254         return sm->pairwise;
3255 }
3256
3257
3258 int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm)
3259 {
3260         if (sm == NULL)
3261                 return -1;
3262         return sm->wpa_key_mgmt;
3263 }
3264
3265
3266 int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm)
3267 {
3268         if (sm == NULL)
3269                 return 0;
3270         return sm->wpa;
3271 }
3272
3273
3274 int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
3275 {
3276         if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
3277                 return 0;
3278         return sm->tk_already_set;
3279 }
3280
3281
3282 int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
3283                              struct rsn_pmksa_cache_entry *entry)
3284 {
3285         if (sm == NULL || sm->pmksa != entry)
3286                 return -1;
3287         sm->pmksa = NULL;
3288         return 0;
3289 }
3290
3291
3292 struct rsn_pmksa_cache_entry *
3293 wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm)
3294 {
3295         return sm ? sm->pmksa : NULL;
3296 }
3297
3298
3299 void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm)
3300 {
3301         if (sm)
3302                 sm->dot11RSNAStatsTKIPLocalMICFailures++;
3303 }
3304
3305
3306 const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth, size_t *len)
3307 {
3308         if (wpa_auth == NULL)
3309                 return NULL;
3310         *len = wpa_auth->wpa_ie_len;
3311         return wpa_auth->wpa_ie;
3312 }
3313
3314
3315 int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk,
3316                        unsigned int pmk_len,
3317                        int session_timeout, struct eapol_state_machine *eapol)
3318 {
3319         if (sm == NULL || sm->wpa != WPA_VERSION_WPA2 ||
3320             sm->wpa_auth->conf.disable_pmksa_caching)
3321                 return -1;
3322
3323         if (sm->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
3324                 if (pmk_len > PMK_LEN_SUITE_B_192)
3325                         pmk_len = PMK_LEN_SUITE_B_192;
3326         } else if (pmk_len > PMK_LEN) {
3327                 pmk_len = PMK_LEN;
3328         }
3329
3330         if (pmksa_cache_auth_add(sm->wpa_auth->pmksa, pmk, pmk_len, NULL,
3331                                  sm->PTK.kck, sm->PTK.kck_len,
3332                                  sm->wpa_auth->addr, sm->addr, session_timeout,
3333                                  eapol, sm->wpa_key_mgmt))
3334                 return 0;
3335
3336         return -1;
3337 }
3338
3339
3340 int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth,
3341                                const u8 *pmk, size_t len, const u8 *sta_addr,
3342                                int session_timeout,
3343                                struct eapol_state_machine *eapol)
3344 {
3345         if (wpa_auth == NULL)
3346                 return -1;
3347
3348         if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, len, NULL,
3349                                  NULL, 0,
3350                                  wpa_auth->addr,
3351                                  sta_addr, session_timeout, eapol,
3352                                  WPA_KEY_MGMT_IEEE8021X))
3353                 return 0;
3354
3355         return -1;
3356 }
3357
3358
3359 int wpa_auth_pmksa_add_sae(struct wpa_authenticator *wpa_auth, const u8 *addr,
3360                            const u8 *pmk, const u8 *pmkid)
3361 {
3362         if (wpa_auth->conf.disable_pmksa_caching)
3363                 return -1;
3364
3365         if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, PMK_LEN, pmkid,
3366                                  NULL, 0,
3367                                  wpa_auth->addr, addr, 0, NULL,
3368                                  WPA_KEY_MGMT_SAE))
3369                 return 0;
3370
3371         return -1;
3372 }
3373
3374
3375 void wpa_auth_pmksa_remove(struct wpa_authenticator *wpa_auth,
3376                            const u8 *sta_addr)
3377 {
3378         struct rsn_pmksa_cache_entry *pmksa;
3379
3380         if (wpa_auth == NULL || wpa_auth->pmksa == NULL)
3381                 return;
3382         pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, NULL);
3383         if (pmksa) {
3384                 wpa_printf(MSG_DEBUG, "WPA: Remove PMKSA cache entry for "
3385                            MACSTR " based on request", MAC2STR(sta_addr));
3386                 pmksa_cache_free_entry(wpa_auth->pmksa, pmksa);
3387         }
3388 }
3389
3390
3391 int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf,
3392                         size_t len)
3393 {
3394         if (!wpa_auth || !wpa_auth->pmksa)
3395                 return 0;
3396         return pmksa_cache_auth_list(wpa_auth->pmksa, buf, len);
3397 }
3398
3399
3400 void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth)
3401 {
3402         if (wpa_auth && wpa_auth->pmksa)
3403                 pmksa_cache_auth_flush(wpa_auth->pmksa);
3404 }
3405
3406
3407 struct rsn_pmksa_cache_entry *
3408 wpa_auth_pmksa_get(struct wpa_authenticator *wpa_auth, const u8 *sta_addr)
3409 {
3410         if (!wpa_auth || !wpa_auth->pmksa)
3411                 return NULL;
3412         return pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, NULL);
3413 }
3414
3415
3416 void wpa_auth_pmksa_set_to_sm(struct rsn_pmksa_cache_entry *pmksa,
3417                               struct wpa_state_machine *sm,
3418                               struct wpa_authenticator *wpa_auth,
3419                               u8 *pmkid, u8 *pmk)
3420 {
3421         if (!sm)
3422                 return;
3423
3424         sm->pmksa = pmksa;
3425         os_memcpy(pmk, pmksa->pmk, PMK_LEN);
3426         os_memcpy(pmkid, pmksa->pmkid, PMKID_LEN);
3427         os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmksa->pmkid, PMKID_LEN);
3428 }
3429
3430
3431 /*
3432  * Remove and free the group from wpa_authenticator. This is triggered by a
3433  * callback to make sure nobody is currently iterating the group list while it
3434  * gets modified.
3435  */
3436 static void wpa_group_free(struct wpa_authenticator *wpa_auth,
3437                            struct wpa_group *group)
3438 {
3439         struct wpa_group *prev = wpa_auth->group;
3440
3441         wpa_printf(MSG_DEBUG, "WPA: Remove group state machine for VLAN-ID %d",
3442                    group->vlan_id);
3443
3444         while (prev) {
3445                 if (prev->next == group) {
3446                         /* This never frees the special first group as needed */
3447                         prev->next = group->next;
3448                         os_free(group);
3449                         break;
3450                 }
3451                 prev = prev->next;
3452         }
3453
3454 }
3455
3456
3457 /* Increase the reference counter for group */
3458 static void wpa_group_get(struct wpa_authenticator *wpa_auth,
3459                           struct wpa_group *group)
3460 {
3461         /* Skip the special first group */
3462         if (wpa_auth->group == group)
3463                 return;
3464
3465         group->references++;
3466 }
3467
3468
3469 /* Decrease the reference counter and maybe free the group */
3470 static void wpa_group_put(struct wpa_authenticator *wpa_auth,
3471                           struct wpa_group *group)
3472 {
3473         /* Skip the special first group */
3474         if (wpa_auth->group == group)
3475                 return;
3476
3477         group->references--;
3478         if (group->references)
3479                 return;
3480         wpa_group_free(wpa_auth, group);
3481 }
3482
3483
3484 /*
3485  * Add a group that has its references counter set to zero. Caller needs to
3486  * call wpa_group_get() on the return value to mark the entry in use.
3487  */
3488 static struct wpa_group *
3489 wpa_auth_add_group(struct wpa_authenticator *wpa_auth, int vlan_id)
3490 {
3491         struct wpa_group *group;
3492
3493         if (wpa_auth == NULL || wpa_auth->group == NULL)
3494                 return NULL;
3495
3496         wpa_printf(MSG_DEBUG, "WPA: Add group state machine for VLAN-ID %d",
3497                    vlan_id);
3498         group = wpa_group_init(wpa_auth, vlan_id, 0);
3499         if (group == NULL)
3500                 return NULL;
3501
3502         group->next = wpa_auth->group->next;
3503         wpa_auth->group->next = group;
3504
3505         return group;
3506 }
3507
3508
3509 /*
3510  * Enforce that the group state machine for the VLAN is running, increase
3511  * reference counter as interface is up. References might have been increased
3512  * even if a negative value is returned.
3513  * Returns: -1 on error (group missing, group already failed); otherwise, 0
3514  */
3515 int wpa_auth_ensure_group(struct wpa_authenticator *wpa_auth, int vlan_id)
3516 {
3517         struct wpa_group *group;
3518
3519         if (wpa_auth == NULL)
3520                 return 0;
3521
3522         group = wpa_auth->group;
3523         while (group) {
3524                 if (group->vlan_id == vlan_id)
3525                         break;
3526                 group = group->next;
3527         }
3528
3529         if (group == NULL) {
3530                 group = wpa_auth_add_group(wpa_auth, vlan_id);
3531                 if (group == NULL)
3532                         return -1;
3533         }
3534
3535         wpa_printf(MSG_DEBUG,
3536                    "WPA: Ensure group state machine running for VLAN ID %d",
3537                    vlan_id);
3538
3539         wpa_group_get(wpa_auth, group);
3540         group->num_setup_iface++;
3541
3542         if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE)
3543                 return -1;
3544
3545         return 0;
3546 }
3547
3548
3549 /*
3550  * Decrease reference counter, expected to be zero afterwards.
3551  * returns: -1 on error (group not found, group in fail state)
3552  *          -2 if wpa_group is still referenced
3553  *           0 else
3554  */
3555 int wpa_auth_release_group(struct wpa_authenticator *wpa_auth, int vlan_id)
3556 {
3557         struct wpa_group *group;
3558         int ret = 0;
3559
3560         if (wpa_auth == NULL)
3561                 return 0;
3562
3563         group = wpa_auth->group;
3564         while (group) {
3565                 if (group->vlan_id == vlan_id)
3566                         break;
3567                 group = group->next;
3568         }
3569
3570         if (group == NULL)
3571                 return -1;
3572
3573         wpa_printf(MSG_DEBUG,
3574                    "WPA: Try stopping group state machine for VLAN ID %d",
3575                    vlan_id);
3576
3577         if (group->num_setup_iface <= 0) {
3578                 wpa_printf(MSG_ERROR,
3579                            "WPA: wpa_auth_release_group called more often than wpa_auth_ensure_group for VLAN ID %d, skipping.",
3580                            vlan_id);
3581                 return -1;
3582         }
3583         group->num_setup_iface--;
3584
3585         if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE)
3586                 ret = -1;
3587
3588         if (group->references > 1) {
3589                 wpa_printf(MSG_DEBUG,
3590                            "WPA: Cannot stop group state machine for VLAN ID %d as references are still hold",
3591                            vlan_id);
3592                 ret = -2;
3593         }
3594
3595         wpa_group_put(wpa_auth, group);
3596
3597         return ret;
3598 }
3599
3600
3601 int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id)
3602 {
3603         struct wpa_group *group;
3604
3605         if (sm == NULL || sm->wpa_auth == NULL)
3606                 return 0;
3607
3608         group = sm->wpa_auth->group;
3609         while (group) {
3610                 if (group->vlan_id == vlan_id)
3611                         break;
3612                 group = group->next;
3613         }
3614
3615         if (group == NULL) {
3616                 group = wpa_auth_add_group(sm->wpa_auth, vlan_id);
3617                 if (group == NULL)
3618                         return -1;
3619         }
3620
3621         if (sm->group == group)
3622                 return 0;
3623
3624         if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE)
3625                 return -1;
3626
3627         wpa_printf(MSG_DEBUG, "WPA: Moving STA " MACSTR " to use group state "
3628                    "machine for VLAN ID %d", MAC2STR(sm->addr), vlan_id);
3629
3630         wpa_group_get(sm->wpa_auth, group);
3631         wpa_group_put(sm->wpa_auth, sm->group);
3632         sm->group = group;
3633
3634         return 0;
3635 }
3636
3637
3638 void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth,
3639                                   struct wpa_state_machine *sm, int ack)
3640 {
3641         if (wpa_auth == NULL || sm == NULL)
3642                 return;
3643         wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key TX status for STA " MACSTR
3644                    " ack=%d", MAC2STR(sm->addr), ack);
3645         if (sm->pending_1_of_4_timeout && ack) {
3646                 /*
3647                  * Some deployed supplicant implementations update their SNonce
3648                  * for each EAPOL-Key 2/4 message even within the same 4-way
3649                  * handshake and then fail to use the first SNonce when
3650                  * deriving the PTK. This results in unsuccessful 4-way
3651                  * handshake whenever the relatively short initial timeout is
3652                  * reached and EAPOL-Key 1/4 is retransmitted. Try to work
3653                  * around this by increasing the timeout now that we know that
3654                  * the station has received the frame.
3655                  */
3656                 int timeout_ms = eapol_key_timeout_subseq;
3657                 wpa_printf(MSG_DEBUG, "WPA: Increase initial EAPOL-Key 1/4 "
3658                            "timeout by %u ms because of acknowledged frame",
3659                            timeout_ms);
3660                 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm);
3661                 eloop_register_timeout(timeout_ms / 1000,
3662                                        (timeout_ms % 1000) * 1000,
3663                                        wpa_send_eapol_timeout, wpa_auth, sm);
3664         }
3665 }
3666
3667
3668 int wpa_auth_uses_sae(struct wpa_state_machine *sm)
3669 {
3670         if (sm == NULL)
3671                 return 0;
3672         return wpa_key_mgmt_sae(sm->wpa_key_mgmt);
3673 }
3674
3675
3676 int wpa_auth_uses_ft_sae(struct wpa_state_machine *sm)
3677 {
3678         if (sm == NULL)
3679                 return 0;
3680         return sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_SAE;
3681 }
3682
3683
3684 #ifdef CONFIG_P2P
3685 int wpa_auth_get_ip_addr(struct wpa_state_machine *sm, u8 *addr)
3686 {
3687         if (sm == NULL || WPA_GET_BE32(sm->ip_addr) == 0)
3688                 return -1;
3689         os_memcpy(addr, sm->ip_addr, 4);
3690         return 0;
3691 }
3692 #endif /* CONFIG_P2P */
3693
3694
3695 int wpa_auth_radius_das_disconnect_pmksa(struct wpa_authenticator *wpa_auth,
3696                                          struct radius_das_attrs *attr)
3697 {
3698         return pmksa_cache_auth_radius_das_disconnect(wpa_auth->pmksa, attr);
3699 }
3700
3701
3702 void wpa_auth_reconfig_group_keys(struct wpa_authenticator *wpa_auth)
3703 {
3704         struct wpa_group *group;
3705
3706         if (!wpa_auth)
3707                 return;
3708         for (group = wpa_auth->group; group; group = group->next)
3709                 wpa_group_config_group_keys(wpa_auth, group);
3710 }