contrib/wpa/src/common/wpa_common.c

   1 /*
   2  * WPA/RSN - Shared functions for supplicant and authenticator
   3  * Copyright (c) 2002-2018, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/sha384.h"
  16 #include "crypto/sha512.h"
  17 #include "crypto/aes_wrap.h"
  18 #include "crypto/crypto.h"
  19 #include "ieee802_11_defs.h"
  20 #include "defs.h"
  21 #include "wpa_common.h"
  22
  23
  24 static unsigned int wpa_kck_len(int akmp, size_t pmk_len)
  25 {
  26         switch (akmp) {
  27         case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
  28         case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
  29                 return 24;
  30         case WPA_KEY_MGMT_FILS_SHA256:
  31         case WPA_KEY_MGMT_FT_FILS_SHA256:
  32         case WPA_KEY_MGMT_FILS_SHA384:
  33         case WPA_KEY_MGMT_FT_FILS_SHA384:
  34                 return 0;
  35         case WPA_KEY_MGMT_DPP:
  36                 return pmk_len / 2;
  37         case WPA_KEY_MGMT_OWE:
  38                 return pmk_len / 2;
  39         default:
  40                 return 16;
  41         }
  42 }
  43
  44
  45 #ifdef CONFIG_IEEE80211R
  46 static unsigned int wpa_kck2_len(int akmp)
  47 {
  48         switch (akmp) {
  49         case WPA_KEY_MGMT_FT_FILS_SHA256:
  50                 return 16;
  51         case WPA_KEY_MGMT_FT_FILS_SHA384:
  52                 return 24;
  53         default:
  54                 return 0;
  55         }
  56 }
  57 #endif /* CONFIG_IEEE80211R */
  58
  59
  60 static unsigned int wpa_kek_len(int akmp, size_t pmk_len)
  61 {
  62         switch (akmp) {
  63         case WPA_KEY_MGMT_FILS_SHA384:
  64         case WPA_KEY_MGMT_FT_FILS_SHA384:
  65                 return 64;
  66         case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
  67         case WPA_KEY_MGMT_FILS_SHA256:
  68         case WPA_KEY_MGMT_FT_FILS_SHA256:
  69         case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
  70                 return 32;
  71         case WPA_KEY_MGMT_DPP:
  72                 return pmk_len <= 32 ? 16 : 32;
  73         case WPA_KEY_MGMT_OWE:
  74                 return pmk_len <= 32 ? 16 : 32;
  75         default:
  76                 return 16;
  77         }
  78 }
  79
  80
  81 #ifdef CONFIG_IEEE80211R
  82 static unsigned int wpa_kek2_len(int akmp)
  83 {
  84         switch (akmp) {
  85         case WPA_KEY_MGMT_FT_FILS_SHA256:
  86                 return 16;
  87         case WPA_KEY_MGMT_FT_FILS_SHA384:
  88                 return 32;
  89         default:
  90                 return 0;
  91         }
  92 }
  93 #endif /* CONFIG_IEEE80211R */
  94
  95
  96 unsigned int wpa_mic_len(int akmp, size_t pmk_len)
  97 {
  98         switch (akmp) {
  99         case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
 100         case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
 101                 return 24;
 102         case WPA_KEY_MGMT_FILS_SHA256:
 103         case WPA_KEY_MGMT_FILS_SHA384:
 104         case WPA_KEY_MGMT_FT_FILS_SHA256:
 105         case WPA_KEY_MGMT_FT_FILS_SHA384:
 106                 return 0;
 107         case WPA_KEY_MGMT_DPP:
 108                 return pmk_len / 2;
 109         case WPA_KEY_MGMT_OWE:
 110                 return pmk_len / 2;
 111         default:
 112                 return 16;
 113         }
 114 }
 115
 116
 117 /**
 118  * wpa_use_akm_defined - Is AKM-defined Key Descriptor Version used
 119  * @akmp: WPA_KEY_MGMT_* used in key derivation
 120  * Returns: 1 if AKM-defined Key Descriptor Version is used; 0 otherwise
 121  */
 122 int wpa_use_akm_defined(int akmp)
 123 {
 124         return akmp == WPA_KEY_MGMT_OSEN ||
 125                 akmp == WPA_KEY_MGMT_OWE ||
 126                 akmp == WPA_KEY_MGMT_DPP ||
 127                 akmp == WPA_KEY_MGMT_FT_IEEE8021X_SHA384 ||
 128                 wpa_key_mgmt_sae(akmp) ||
 129                 wpa_key_mgmt_suite_b(akmp) ||
 130                 wpa_key_mgmt_fils(akmp);
 131 }
 132
 133
 134 /**
 135  * wpa_use_cmac - Is CMAC integrity algorithm used for EAPOL-Key MIC
 136  * @akmp: WPA_KEY_MGMT_* used in key derivation
 137  * Returns: 1 if CMAC is used; 0 otherwise
 138  */
 139 int wpa_use_cmac(int akmp)
 140 {
 141         return akmp == WPA_KEY_MGMT_OSEN ||
 142                 akmp == WPA_KEY_MGMT_OWE ||
 143                 akmp == WPA_KEY_MGMT_DPP ||
 144                 wpa_key_mgmt_ft(akmp) ||
 145                 wpa_key_mgmt_sha256(akmp) ||
 146                 wpa_key_mgmt_sae(akmp) ||
 147                 wpa_key_mgmt_suite_b(akmp);
 148 }
 149
 150
 151 /**
 152  * wpa_use_aes_key_wrap - Is AES Keywrap algorithm used for EAPOL-Key Key Data
 153  * @akmp: WPA_KEY_MGMT_* used in key derivation
 154  * Returns: 1 if AES Keywrap is used; 0 otherwise
 155  *
 156  * Note: AKM 00-0F-AC:1 and 00-0F-AC:2 have special rules for selecting whether
 157  * to use AES Keywrap based on the negotiated pairwise cipher. This function
 158  * does not cover those special cases.
 159  */
 160 int wpa_use_aes_key_wrap(int akmp)
 161 {
 162         return akmp == WPA_KEY_MGMT_OSEN ||
 163                 akmp == WPA_KEY_MGMT_OWE ||
 164                 akmp == WPA_KEY_MGMT_DPP ||
 165                 wpa_key_mgmt_ft(akmp) ||
 166                 wpa_key_mgmt_sha256(akmp) ||
 167                 wpa_key_mgmt_sae(akmp) ||
 168                 wpa_key_mgmt_suite_b(akmp);
 169 }
 170
 171
 172 /**
 173  * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
 174  * @key: EAPOL-Key Key Confirmation Key (KCK)
 175  * @key_len: KCK length in octets
 176  * @akmp: WPA_KEY_MGMT_* used in key derivation
 177  * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
 178  * @buf: Pointer to the beginning of the EAPOL header (version field)
 179  * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
 180  * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
 181  * Returns: 0 on success, -1 on failure
 182  *
 183  * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
 184  * to be cleared (all zeroes) when calling this function.
 185  *
 186  * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
 187  * description of the Key MIC calculation. It includes packet data from the
 188  * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
 189  * happened during final editing of the standard and the correct behavior is
 190  * defined in the last draft (IEEE 802.11i/D10).
 191  */
 192 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
 193                       const u8 *buf, size_t len, u8 *mic)
 194 {
 195         u8 hash[SHA512_MAC_LEN];
 196
 197         if (key_len == 0) {
 198                 wpa_printf(MSG_DEBUG,
 199                            "WPA: KCK not set - cannot calculate MIC");
 200                 return -1;
 201         }
 202
 203         switch (ver) {
 204 #ifndef CONFIG_FIPS
 205         case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
 206                 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-MD5");
 207                 return hmac_md5(key, key_len, buf, len, mic);
 208 #endif /* CONFIG_FIPS */
 209         case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
 210                 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using HMAC-SHA1");
 211                 if (hmac_sha1(key, key_len, buf, len, hash))
 212                         return -1;
 213                 os_memcpy(mic, hash, MD5_MAC_LEN);
 214                 break;
 215 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_IEEE80211W)
 216         case WPA_KEY_INFO_TYPE_AES_128_CMAC:
 217                 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key MIC using AES-CMAC");
 218                 return omac1_aes_128(key, buf, len, mic);
 219 #endif /* CONFIG_IEEE80211R || CONFIG_IEEE80211W */
 220         case WPA_KEY_INFO_TYPE_AKM_DEFINED:
 221                 switch (akmp) {
 222 #ifdef CONFIG_SAE
 223                 case WPA_KEY_MGMT_SAE:
 224                 case WPA_KEY_MGMT_FT_SAE:
 225                         wpa_printf(MSG_DEBUG,
 226                                    "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - SAE)");
 227                         return omac1_aes_128(key, buf, len, mic);
 228 #endif /* CONFIG_SAE */
 229 #ifdef CONFIG_HS20
 230                 case WPA_KEY_MGMT_OSEN:
 231                         wpa_printf(MSG_DEBUG,
 232                                    "WPA: EAPOL-Key MIC using AES-CMAC (AKM-defined - OSEN)");
 233                         return omac1_aes_128(key, buf, len, mic);
 234 #endif /* CONFIG_HS20 */
 235 #ifdef CONFIG_SUITEB
 236                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
 237                         wpa_printf(MSG_DEBUG,
 238                                    "WPA: EAPOL-Key MIC using HMAC-SHA256 (AKM-defined - Suite B)");
 239                         if (hmac_sha256(key, key_len, buf, len, hash))
 240                                 return -1;
 241                         os_memcpy(mic, hash, MD5_MAC_LEN);
 242                         break;
 243 #endif /* CONFIG_SUITEB */
 244 #ifdef CONFIG_SUITEB192
 245                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
 246                         wpa_printf(MSG_DEBUG,
 247                                    "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - Suite B 192-bit)");
 248                         if (hmac_sha384(key, key_len, buf, len, hash))
 249                                 return -1;
 250                         os_memcpy(mic, hash, 24);
 251                         break;
 252 #endif /* CONFIG_SUITEB192 */
 253 #ifdef CONFIG_OWE
 254                 case WPA_KEY_MGMT_OWE:
 255                         wpa_printf(MSG_DEBUG,
 256                                    "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - OWE)",
 257                                    (unsigned int) key_len * 8 * 2);
 258                         if (key_len == 128 / 8) {
 259                                 if (hmac_sha256(key, key_len, buf, len, hash))
 260                                         return -1;
 261                         } else if (key_len == 192 / 8) {
 262                                 if (hmac_sha384(key, key_len, buf, len, hash))
 263                                         return -1;
 264                         } else if (key_len == 256 / 8) {
 265                                 if (hmac_sha512(key, key_len, buf, len, hash))
 266                                         return -1;
 267                         } else {
 268                                 wpa_printf(MSG_INFO,
 269                                            "OWE: Unsupported KCK length: %u",
 270                                            (unsigned int) key_len);
 271                                 return -1;
 272                         }
 273                         os_memcpy(mic, hash, key_len);
 274                         break;
 275 #endif /* CONFIG_OWE */
 276 #ifdef CONFIG_DPP
 277                 case WPA_KEY_MGMT_DPP:
 278                         wpa_printf(MSG_DEBUG,
 279                                    "WPA: EAPOL-Key MIC using HMAC-SHA%u (AKM-defined - DPP)",
 280                                    (unsigned int) key_len * 8 * 2);
 281                         if (key_len == 128 / 8) {
 282                                 if (hmac_sha256(key, key_len, buf, len, hash))
 283                                         return -1;
 284                         } else if (key_len == 192 / 8) {
 285                                 if (hmac_sha384(key, key_len, buf, len, hash))
 286                                         return -1;
 287                         } else if (key_len == 256 / 8) {
 288                                 if (hmac_sha512(key, key_len, buf, len, hash))
 289                                         return -1;
 290                         } else {
 291                                 wpa_printf(MSG_INFO,
 292                                            "DPP: Unsupported KCK length: %u",
 293                                            (unsigned int) key_len);
 294                                 return -1;
 295                         }
 296                         os_memcpy(mic, hash, key_len);
 297                         break;
 298 #endif /* CONFIG_DPP */
 299 #if defined(CONFIG_IEEE80211R) && defined(CONFIG_SHA384)
 300                 case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
 301                         wpa_printf(MSG_DEBUG,
 302                                    "WPA: EAPOL-Key MIC using HMAC-SHA384 (AKM-defined - FT 802.1X SHA384)");
 303                         if (hmac_sha384(key, key_len, buf, len, hash))
 304                                 return -1;
 305                         os_memcpy(mic, hash, 24);
 306                         break;
 307 #endif /* CONFIG_IEEE80211R && CONFIG_SHA384 */
 308                 default:
 309                         wpa_printf(MSG_DEBUG,
 310                                    "WPA: EAPOL-Key MIC algorithm not known (AKM-defined - akmp=0x%x)",
 311                                    akmp);
 312                         return -1;
 313                 }
 314                 break;
 315         default:
 316                 wpa_printf(MSG_DEBUG,
 317                            "WPA: EAPOL-Key MIC algorithm not known (ver=%d)",
 318                            ver);
 319                 return -1;
 320         }
 321
 322         return 0;
 323 }
 324
 325
 326 /**
 327  * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
 328  * @pmk: Pairwise master key
 329  * @pmk_len: Length of PMK
 330  * @label: Label to use in derivation
 331  * @addr1: AA or SA
 332  * @addr2: SA or AA
 333  * @nonce1: ANonce or SNonce
 334  * @nonce2: SNonce or ANonce
 335  * @ptk: Buffer for pairwise transient key
 336  * @akmp: Negotiated AKM
 337  * @cipher: Negotiated pairwise cipher
 338  * Returns: 0 on success, -1 on failure
 339  *
 340  * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
 341  * PTK = PRF-X(PMK, "Pairwise key expansion",
 342  *             Min(AA, SA) || Max(AA, SA) ||
 343  *             Min(ANonce, SNonce) || Max(ANonce, SNonce))
 344  */
 345 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
 346                    const u8 *addr1, const u8 *addr2,
 347                    const u8 *nonce1, const u8 *nonce2,
 348                    struct wpa_ptk *ptk, int akmp, int cipher)
 349 {
 350         u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN];
 351         u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN];
 352         size_t ptk_len;
 353
 354         if (pmk_len == 0) {
 355                 wpa_printf(MSG_ERROR, "WPA: No PMK set for PTK derivation");
 356                 return -1;
 357         }
 358
 359         if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
 360                 os_memcpy(data, addr1, ETH_ALEN);
 361                 os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
 362         } else {
 363                 os_memcpy(data, addr2, ETH_ALEN);
 364                 os_memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
 365         }
 366
 367         if (os_memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
 368                 os_memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
 369                 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
 370                           WPA_NONCE_LEN);
 371         } else {
 372                 os_memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
 373                 os_memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
 374                           WPA_NONCE_LEN);
 375         }
 376
 377         ptk->kck_len = wpa_kck_len(akmp, pmk_len);
 378         ptk->kek_len = wpa_kek_len(akmp, pmk_len);
 379         ptk->tk_len = wpa_cipher_key_len(cipher);
 380         if (ptk->tk_len == 0) {
 381                 wpa_printf(MSG_ERROR,
 382                            "WPA: Unsupported cipher (0x%x) used in PTK derivation",
 383                            cipher);
 384                 return -1;
 385         }
 386         ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len;
 387
 388         if (wpa_key_mgmt_sha384(akmp)) {
 389 #if defined(CONFIG_SUITEB192) || defined(CONFIG_FILS)
 390                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
 391                 if (sha384_prf(pmk, pmk_len, label, data, sizeof(data),
 392                                tmp, ptk_len) < 0)
 393                         return -1;
 394 #else /* CONFIG_SUITEB192 || CONFIG_FILS */
 395                 return -1;
 396 #endif /* CONFIG_SUITEB192 || CONFIG_FILS */
 397         } else if (wpa_key_mgmt_sha256(akmp) || akmp == WPA_KEY_MGMT_OWE) {
 398 #if defined(CONFIG_IEEE80211W) || defined(CONFIG_SAE) || defined(CONFIG_FILS)
 399                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
 400                 if (sha256_prf(pmk, pmk_len, label, data, sizeof(data),
 401                                tmp, ptk_len) < 0)
 402                         return -1;
 403 #else /* CONFIG_IEEE80211W or CONFIG_SAE or CONFIG_FILS */
 404                 return -1;
 405 #endif /* CONFIG_IEEE80211W or CONFIG_SAE or CONFIG_FILS */
 406 #ifdef CONFIG_DPP
 407         } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 32) {
 408                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA256)");
 409                 if (sha256_prf(pmk, pmk_len, label, data, sizeof(data),
 410                                tmp, ptk_len) < 0)
 411                         return -1;
 412         } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 48) {
 413                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
 414                 if (sha384_prf(pmk, pmk_len, label, data, sizeof(data),
 415                                tmp, ptk_len) < 0)
 416                         return -1;
 417         } else if (akmp == WPA_KEY_MGMT_DPP && pmk_len == 64) {
 418                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA512)");
 419                 if (sha512_prf(pmk, pmk_len, label, data, sizeof(data),
 420                                tmp, ptk_len) < 0)
 421                         return -1;
 422         } else if (akmp == WPA_KEY_MGMT_DPP) {
 423                 wpa_printf(MSG_INFO, "DPP: Unknown PMK length %u",
 424                            (unsigned int) pmk_len);
 425                 return -1;
 426 #endif /* CONFIG_DPP */
 427         } else {
 428                 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA1)");
 429                 if (sha1_prf(pmk, pmk_len, label, data, sizeof(data), tmp,
 430                              ptk_len) < 0)
 431                         return -1;
 432         }
 433
 434         wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR,
 435                    MAC2STR(addr1), MAC2STR(addr2));
 436         wpa_hexdump(MSG_DEBUG, "WPA: Nonce1", nonce1, WPA_NONCE_LEN);
 437         wpa_hexdump(MSG_DEBUG, "WPA: Nonce2", nonce2, WPA_NONCE_LEN);
 438         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
 439         wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
 440
 441         os_memcpy(ptk->kck, tmp, ptk->kck_len);
 442         wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
 443
 444         os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
 445         wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
 446
 447         os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
 448         wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
 449
 450         ptk->kek2_len = 0;
 451         ptk->kck2_len = 0;
 452
 453         os_memset(tmp, 0, sizeof(tmp));
 454         return 0;
 455 }
 456
 457 #ifdef CONFIG_FILS
 458
 459 int fils_rmsk_to_pmk(int akmp, const u8 *rmsk, size_t rmsk_len,
 460                      const u8 *snonce, const u8 *anonce, const u8 *dh_ss,
 461                      size_t dh_ss_len, u8 *pmk, size_t *pmk_len)
 462 {
 463         u8 nonces[2 * FILS_NONCE_LEN];
 464         const u8 *addr[2];
 465         size_t len[2];
 466         size_t num_elem;
 467         int res;
 468
 469         /* PMK = HMAC-Hash(SNonce || ANonce, rMSK [ || DHss ]) */
 470         wpa_printf(MSG_DEBUG, "FILS: rMSK to PMK derivation");
 471
 472         if (wpa_key_mgmt_sha384(akmp))
 473                 *pmk_len = SHA384_MAC_LEN;
 474         else if (wpa_key_mgmt_sha256(akmp))
 475                 *pmk_len = SHA256_MAC_LEN;
 476         else
 477                 return -1;
 478
 479         wpa_hexdump_key(MSG_DEBUG, "FILS: rMSK", rmsk, rmsk_len);
 480         wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
 481         wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
 482         wpa_hexdump(MSG_DEBUG, "FILS: DHss", dh_ss, dh_ss_len);
 483
 484         os_memcpy(nonces, snonce, FILS_NONCE_LEN);
 485         os_memcpy(&nonces[FILS_NONCE_LEN], anonce, FILS_NONCE_LEN);
 486         addr[0] = rmsk;
 487         len[0] = rmsk_len;
 488         num_elem = 1;
 489         if (dh_ss) {
 490                 addr[1] = dh_ss;
 491                 len[1] = dh_ss_len;
 492                 num_elem++;
 493         }
 494         if (wpa_key_mgmt_sha384(akmp))
 495                 res = hmac_sha384_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
 496                                          addr, len, pmk);
 497         else
 498                 res = hmac_sha256_vector(nonces, 2 * FILS_NONCE_LEN, num_elem,
 499                                          addr, len, pmk);
 500         if (res == 0)
 501                 wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, *pmk_len);
 502         else
 503                 *pmk_len = 0;
 504         return res;
 505 }
 506
 507
 508 int fils_pmkid_erp(int akmp, const u8 *reauth, size_t reauth_len,
 509                    u8 *pmkid)
 510 {
 511         const u8 *addr[1];
 512         size_t len[1];
 513         u8 hash[SHA384_MAC_LEN];
 514         int res;
 515
 516         /* PMKID = Truncate-128(Hash(EAP-Initiate/Reauth)) */
 517         addr[0] = reauth;
 518         len[0] = reauth_len;
 519         if (wpa_key_mgmt_sha384(akmp))
 520                 res = sha384_vector(1, addr, len, hash);
 521         else if (wpa_key_mgmt_sha256(akmp))
 522                 res = sha256_vector(1, addr, len, hash);
 523         else
 524                 return -1;
 525         if (res)
 526                 return res;
 527         os_memcpy(pmkid, hash, PMKID_LEN);
 528         wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
 529         return 0;
 530 }
 531
 532
 533 int fils_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const u8 *spa, const u8 *aa,
 534                     const u8 *snonce, const u8 *anonce, const u8 *dhss,
 535                     size_t dhss_len, struct wpa_ptk *ptk,
 536                     u8 *ick, size_t *ick_len, int akmp, int cipher,
 537                     u8 *fils_ft, size_t *fils_ft_len)
 538 {
 539         u8 *data, *pos;
 540         size_t data_len;
 541         u8 tmp[FILS_ICK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN +
 542                FILS_FT_MAX_LEN];
 543         size_t key_data_len;
 544         const char *label = "FILS PTK Derivation";
 545         int ret = -1;
 546
 547         /*
 548          * FILS-Key-Data = PRF-X(PMK, "FILS PTK Derivation",
 549          *                       SPA || AA || SNonce || ANonce [ || DHss ])
 550          * ICK = L(FILS-Key-Data, 0, ICK_bits)
 551          * KEK = L(FILS-Key-Data, ICK_bits, KEK_bits)
 552          * TK = L(FILS-Key-Data, ICK_bits + KEK_bits, TK_bits)
 553          * If doing FT initial mobility domain association:
 554          * FILS-FT = L(FILS-Key-Data, ICK_bits + KEK_bits + TK_bits,
 555          *             FILS-FT_bits)
 556          */
 557         data_len = 2 * ETH_ALEN + 2 * FILS_NONCE_LEN + dhss_len;
 558         data = os_malloc(data_len);
 559         if (!data)
 560                 goto err;
 561         pos = data;
 562         os_memcpy(pos, spa, ETH_ALEN);
 563         pos += ETH_ALEN;
 564         os_memcpy(pos, aa, ETH_ALEN);
 565         pos += ETH_ALEN;
 566         os_memcpy(pos, snonce, FILS_NONCE_LEN);
 567         pos += FILS_NONCE_LEN;
 568         os_memcpy(pos, anonce, FILS_NONCE_LEN);
 569         pos += FILS_NONCE_LEN;
 570         if (dhss)
 571                 os_memcpy(pos, dhss, dhss_len);
 572
 573         ptk->kck_len = 0;
 574         ptk->kek_len = wpa_kek_len(akmp, pmk_len);
 575         ptk->tk_len = wpa_cipher_key_len(cipher);
 576         if (wpa_key_mgmt_sha384(akmp))
 577                 *ick_len = 48;
 578         else if (wpa_key_mgmt_sha256(akmp))
 579                 *ick_len = 32;
 580         else
 581                 goto err;
 582         key_data_len = *ick_len + ptk->kek_len + ptk->tk_len;
 583
 584         if (fils_ft && fils_ft_len) {
 585                 if (akmp == WPA_KEY_MGMT_FT_FILS_SHA256) {
 586                         *fils_ft_len = 32;
 587                 } else if (akmp == WPA_KEY_MGMT_FT_FILS_SHA384) {
 588                         *fils_ft_len = 48;
 589                 } else {
 590                         *fils_ft_len = 0;
 591                         fils_ft = NULL;
 592                 }
 593                 key_data_len += *fils_ft_len;
 594         }
 595
 596         if (wpa_key_mgmt_sha384(akmp)) {
 597                 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA384)");
 598                 if (sha384_prf(pmk, pmk_len, label, data, data_len,
 599                                tmp, key_data_len) < 0)
 600                         goto err;
 601         } else {
 602                 wpa_printf(MSG_DEBUG, "FILS: PTK derivation using PRF(SHA256)");
 603                 if (sha256_prf(pmk, pmk_len, label, data, data_len,
 604                                tmp, key_data_len) < 0)
 605                         goto err;
 606         }
 607
 608         wpa_printf(MSG_DEBUG, "FILS: PTK derivation - SPA=" MACSTR
 609                    " AA=" MACSTR, MAC2STR(spa), MAC2STR(aa));
 610         wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
 611         wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
 612         if (dhss)
 613                 wpa_hexdump_key(MSG_DEBUG, "FILS: DHss", dhss, dhss_len);
 614         wpa_hexdump_key(MSG_DEBUG, "FILS: PMK", pmk, pmk_len);
 615         wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-Key-Data", tmp, key_data_len);
 616
 617         os_memcpy(ick, tmp, *ick_len);
 618         wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, *ick_len);
 619
 620         os_memcpy(ptk->kek, tmp + *ick_len, ptk->kek_len);
 621         wpa_hexdump_key(MSG_DEBUG, "FILS: KEK", ptk->kek, ptk->kek_len);
 622
 623         os_memcpy(ptk->tk, tmp + *ick_len + ptk->kek_len, ptk->tk_len);
 624         wpa_hexdump_key(MSG_DEBUG, "FILS: TK", ptk->tk, ptk->tk_len);
 625
 626         if (fils_ft && fils_ft_len) {
 627                 os_memcpy(fils_ft, tmp + *ick_len + ptk->kek_len + ptk->tk_len,
 628                           *fils_ft_len);
 629                 wpa_hexdump_key(MSG_DEBUG, "FILS: FILS-FT",
 630                                 fils_ft, *fils_ft_len);
 631         }
 632
 633         ptk->kek2_len = 0;
 634         ptk->kck2_len = 0;
 635
 636         os_memset(tmp, 0, sizeof(tmp));
 637         ret = 0;
 638 err:
 639         bin_clear_free(data, data_len);
 640         return ret;
 641 }
 642
 643
 644 int fils_key_auth_sk(const u8 *ick, size_t ick_len, const u8 *snonce,
 645                      const u8 *anonce, const u8 *sta_addr, const u8 *bssid,
 646                      const u8 *g_sta, size_t g_sta_len,
 647                      const u8 *g_ap, size_t g_ap_len,
 648                      int akmp, u8 *key_auth_sta, u8 *key_auth_ap,
 649                      size_t *key_auth_len)
 650 {
 651         const u8 *addr[6];
 652         size_t len[6];
 653         size_t num_elem = 4;
 654         int res;
 655
 656         wpa_printf(MSG_DEBUG, "FILS: Key-Auth derivation: STA-MAC=" MACSTR
 657                    " AP-BSSID=" MACSTR, MAC2STR(sta_addr), MAC2STR(bssid));
 658         wpa_hexdump_key(MSG_DEBUG, "FILS: ICK", ick, ick_len);
 659         wpa_hexdump(MSG_DEBUG, "FILS: SNonce", snonce, FILS_NONCE_LEN);
 660         wpa_hexdump(MSG_DEBUG, "FILS: ANonce", anonce, FILS_NONCE_LEN);
 661         wpa_hexdump(MSG_DEBUG, "FILS: gSTA", g_sta, g_sta_len);
 662         wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
 663
 664         /*
 665          * For (Re)Association Request frame (STA->AP):
 666          * Key-Auth = HMAC-Hash(ICK, SNonce || ANonce || STA-MAC || AP-BSSID
 667          *                      [ || gSTA || gAP ])
 668          */
 669         addr[0] = snonce;
 670         len[0] = FILS_NONCE_LEN;
 671         addr[1] = anonce;
 672         len[1] = FILS_NONCE_LEN;
 673         addr[2] = sta_addr;
 674         len[2] = ETH_ALEN;
 675         addr[3] = bssid;
 676         len[3] = ETH_ALEN;
 677         if (g_sta && g_ap_len && g_ap && g_ap_len) {
 678                 addr[4] = g_sta;
 679                 len[4] = g_sta_len;
 680                 addr[5] = g_ap;
 681                 len[5] = g_ap_len;
 682                 num_elem = 6;
 683         }
 684
 685         if (wpa_key_mgmt_sha384(akmp)) {
 686                 *key_auth_len = 48;
 687                 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
 688                                          key_auth_sta);
 689         } else if (wpa_key_mgmt_sha256(akmp)) {
 690                 *key_auth_len = 32;
 691                 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
 692                                          key_auth_sta);
 693         } else {
 694                 return -1;
 695         }
 696         if (res < 0)
 697                 return res;
 698
 699         /*
 700          * For (Re)Association Response frame (AP->STA):
 701          * Key-Auth = HMAC-Hash(ICK, ANonce || SNonce || AP-BSSID || STA-MAC
 702          *                      [ || gAP || gSTA ])
 703          */
 704         addr[0] = anonce;
 705         addr[1] = snonce;
 706         addr[2] = bssid;
 707         addr[3] = sta_addr;
 708         if (g_sta && g_ap_len && g_ap && g_ap_len) {
 709                 addr[4] = g_ap;
 710                 len[4] = g_ap_len;
 711                 addr[5] = g_sta;
 712                 len[5] = g_sta_len;
 713         }
 714
 715         if (wpa_key_mgmt_sha384(akmp))
 716                 res = hmac_sha384_vector(ick, ick_len, num_elem, addr, len,
 717                                          key_auth_ap);
 718         else if (wpa_key_mgmt_sha256(akmp))
 719                 res = hmac_sha256_vector(ick, ick_len, num_elem, addr, len,
 720                                          key_auth_ap);
 721         if (res < 0)
 722                 return res;
 723
 724         wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (STA)",
 725                     key_auth_sta, *key_auth_len);
 726         wpa_hexdump(MSG_DEBUG, "FILS: Key-Auth (AP)",
 727                     key_auth_ap, *key_auth_len);
 728
 729         return 0;
 730 }
 731
 732 #endif /* CONFIG_FILS */
 733
 734
 735 #ifdef CONFIG_IEEE80211R
 736 int wpa_ft_mic(const u8 *kck, size_t kck_len, const u8 *sta_addr,
 737                const u8 *ap_addr, u8 transaction_seqnum,
 738                const u8 *mdie, size_t mdie_len,
 739                const u8 *ftie, size_t ftie_len,
 740                const u8 *rsnie, size_t rsnie_len,
 741                const u8 *ric, size_t ric_len, u8 *mic)
 742 {
 743         const u8 *addr[9];
 744         size_t len[9];
 745         size_t i, num_elem = 0;
 746         u8 zero_mic[24];
 747         size_t mic_len, fte_fixed_len;
 748
 749         if (kck_len == 16) {
 750                 mic_len = 16;
 751 #ifdef CONFIG_SHA384
 752         } else if (kck_len == 24) {
 753                 mic_len = 24;
 754 #endif /* CONFIG_SHA384 */
 755         } else {
 756                 wpa_printf(MSG_WARNING, "FT: Unsupported KCK length %u",
 757                            (unsigned int) kck_len);
 758                 return -1;
 759         }
 760
 761         fte_fixed_len = sizeof(struct rsn_ftie) - 16 + mic_len;
 762
 763         addr[num_elem] = sta_addr;
 764         len[num_elem] = ETH_ALEN;
 765         num_elem++;
 766
 767         addr[num_elem] = ap_addr;
 768         len[num_elem] = ETH_ALEN;
 769         num_elem++;
 770
 771         addr[num_elem] = &transaction_seqnum;
 772         len[num_elem] = 1;
 773         num_elem++;
 774
 775         if (rsnie) {
 776                 addr[num_elem] = rsnie;
 777                 len[num_elem] = rsnie_len;
 778                 num_elem++;
 779         }
 780         if (mdie) {
 781                 addr[num_elem] = mdie;
 782                 len[num_elem] = mdie_len;
 783                 num_elem++;
 784         }
 785         if (ftie) {
 786                 if (ftie_len < 2 + fte_fixed_len)
 787                         return -1;
 788
 789                 /* IE hdr and mic_control */
 790                 addr[num_elem] = ftie;
 791                 len[num_elem] = 2 + 2;
 792                 num_elem++;
 793
 794                 /* MIC field with all zeros */
 795                 os_memset(zero_mic, 0, mic_len);
 796                 addr[num_elem] = zero_mic;
 797                 len[num_elem] = mic_len;
 798                 num_elem++;
 799
 800                 /* Rest of FTIE */
 801                 addr[num_elem] = ftie + 2 + 2 + mic_len;
 802                 len[num_elem] = ftie_len - (2 + 2 + mic_len);
 803                 num_elem++;
 804         }
 805         if (ric) {
 806                 addr[num_elem] = ric;
 807                 len[num_elem] = ric_len;
 808                 num_elem++;
 809         }
 810
 811         for (i = 0; i < num_elem; i++)
 812                 wpa_hexdump(MSG_MSGDUMP, "FT: MIC data", addr[i], len[i]);
 813 #ifdef CONFIG_SHA384
 814         if (kck_len == 24) {
 815                 u8 hash[SHA384_MAC_LEN];
 816
 817                 if (hmac_sha384_vector(kck, kck_len, num_elem, addr, len, hash))
 818                         return -1;
 819                 os_memcpy(mic, hash, 24);
 820         }
 821 #endif /* CONFIG_SHA384 */
 822         if (kck_len == 16 &&
 823             omac1_aes_128_vector(kck, num_elem, addr, len, mic))
 824                 return -1;
 825
 826         return 0;
 827 }
 828
 829
 830 static int wpa_ft_parse_ftie(const u8 *ie, size_t ie_len,
 831                              struct wpa_ft_ies *parse, int use_sha384)
 832 {
 833         const u8 *end, *pos;
 834
 835         parse->ftie = ie;
 836         parse->ftie_len = ie_len;
 837
 838         pos = ie + (use_sha384 ? sizeof(struct rsn_ftie_sha384) :
 839                     sizeof(struct rsn_ftie));
 840         end = ie + ie_len;
 841         wpa_hexdump(MSG_DEBUG, "FT: Parse FTE subelements", pos, end - pos);
 842
 843         while (end - pos >= 2) {
 844                 u8 id, len;
 845
 846                 id = *pos++;
 847                 len = *pos++;
 848                 if (len > end - pos) {
 849                         wpa_printf(MSG_DEBUG, "FT: Truncated subelement");
 850                         break;
 851                 }
 852
 853                 switch (id) {
 854                 case FTIE_SUBELEM_R1KH_ID:
 855                         if (len != FT_R1KH_ID_LEN) {
 856                                 wpa_printf(MSG_DEBUG,
 857                                            "FT: Invalid R1KH-ID length in FTIE: %d",
 858                                            len);
 859                                 return -1;
 860                         }
 861                         parse->r1kh_id = pos;
 862                         break;
 863                 case FTIE_SUBELEM_GTK:
 864                         parse->gtk = pos;
 865                         parse->gtk_len = len;
 866                         break;
 867                 case FTIE_SUBELEM_R0KH_ID:
 868                         if (len < 1 || len > FT_R0KH_ID_MAX_LEN) {
 869                                 wpa_printf(MSG_DEBUG,
 870                                            "FT: Invalid R0KH-ID length in FTIE: %d",
 871                                            len);
 872                                 return -1;
 873                         }
 874                         parse->r0kh_id = pos;
 875                         parse->r0kh_id_len = len;
 876                         break;
 877 #ifdef CONFIG_IEEE80211W
 878                 case FTIE_SUBELEM_IGTK:
 879                         parse->igtk = pos;
 880                         parse->igtk_len = len;
 881                         break;
 882 #endif /* CONFIG_IEEE80211W */
 883                 default:
 884                         wpa_printf(MSG_DEBUG, "FT: Unknown subelem id %u", id);
 885                         break;
 886                 }
 887
 888                 pos += len;
 889         }
 890
 891         return 0;
 892 }
 893
 894
 895 int wpa_ft_parse_ies(const u8 *ies, size_t ies_len,
 896                      struct wpa_ft_ies *parse, int use_sha384)
 897 {
 898         const u8 *end, *pos;
 899         struct wpa_ie_data data;
 900         int ret;
 901         const struct rsn_ftie *ftie;
 902         int prot_ie_count = 0;
 903         int update_use_sha384 = 0;
 904
 905         if (use_sha384 < 0) {
 906                 use_sha384 = 0;
 907                 update_use_sha384 = 1;
 908         }
 909
 910         os_memset(parse, 0, sizeof(*parse));
 911         if (ies == NULL)
 912                 return 0;
 913
 914         pos = ies;
 915         end = ies + ies_len;
 916         while (end - pos >= 2) {
 917                 u8 id, len;
 918
 919                 id = *pos++;
 920                 len = *pos++;
 921                 if (len > end - pos)
 922                         break;
 923
 924                 switch (id) {
 925                 case WLAN_EID_RSN:
 926                         wpa_hexdump(MSG_DEBUG, "FT: RSNE", pos, len);
 927                         parse->rsn = pos;
 928                         parse->rsn_len = len;
 929                         ret = wpa_parse_wpa_ie_rsn(parse->rsn - 2,
 930                                                    parse->rsn_len + 2,
 931                                                    &data);
 932                         if (ret < 0) {
 933                                 wpa_printf(MSG_DEBUG, "FT: Failed to parse "
 934                                            "RSN IE: %d", ret);
 935                                 return -1;
 936                         }
 937                         if (data.num_pmkid == 1 && data.pmkid)
 938                                 parse->rsn_pmkid = data.pmkid;
 939                         parse->key_mgmt = data.key_mgmt;
 940                         parse->pairwise_cipher = data.pairwise_cipher;
 941                         if (update_use_sha384) {
 942                                 use_sha384 =
 943                                         wpa_key_mgmt_sha384(parse->key_mgmt);
 944                                 update_use_sha384 = 0;
 945                         }
 946                         break;
 947                 case WLAN_EID_MOBILITY_DOMAIN:
 948                         wpa_hexdump(MSG_DEBUG, "FT: MDE", pos, len);
 949                         if (len < sizeof(struct rsn_mdie))
 950                                 return -1;
 951                         parse->mdie = pos;
 952                         parse->mdie_len = len;
 953                         break;
 954                 case WLAN_EID_FAST_BSS_TRANSITION:
 955                         wpa_hexdump(MSG_DEBUG, "FT: FTE", pos, len);
 956                         if (use_sha384) {
 957                                 const struct rsn_ftie_sha384 *ftie_sha384;
 958
 959                                 if (len < sizeof(*ftie_sha384))
 960                                         return -1;
 961                                 ftie_sha384 =
 962                                         (const struct rsn_ftie_sha384 *) pos;
 963                                 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control",
 964                                             ftie_sha384->mic_control, 2);
 965                                 wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC",
 966                                             ftie_sha384->mic,
 967                                             sizeof(ftie_sha384->mic));
 968                                 wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
 969                                             ftie_sha384->anonce,
 970                                             WPA_NONCE_LEN);
 971                                 wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
 972                                             ftie_sha384->snonce,
 973                                             WPA_NONCE_LEN);
 974                                 prot_ie_count = ftie_sha384->mic_control[1];
 975                                 if (wpa_ft_parse_ftie(pos, len, parse, 1) < 0)
 976                                         return -1;
 977                                 break;
 978                         }
 979
 980                         if (len < sizeof(*ftie))
 981                                 return -1;
 982                         ftie = (const struct rsn_ftie *) pos;
 983                         wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC Control",
 984                                     ftie->mic_control, 2);
 985                         wpa_hexdump(MSG_DEBUG, "FT: FTE-MIC",
 986                                     ftie->mic, sizeof(ftie->mic));
 987                         wpa_hexdump(MSG_DEBUG, "FT: FTE-ANonce",
 988                                     ftie->anonce, WPA_NONCE_LEN);
 989                         wpa_hexdump(MSG_DEBUG, "FT: FTE-SNonce",
 990                                     ftie->snonce, WPA_NONCE_LEN);
 991                         prot_ie_count = ftie->mic_control[1];
 992                         if (wpa_ft_parse_ftie(pos, len, parse, 0) < 0)
 993                                 return -1;
 994                         break;
 995                 case WLAN_EID_TIMEOUT_INTERVAL:
 996                         wpa_hexdump(MSG_DEBUG, "FT: Timeout Interval",
 997                                     pos, len);
 998                         if (len != 5)
 999                                 break;
1000                         parse->tie = pos;
1001                         parse->tie_len = len;
1002                         break;
1003                 case WLAN_EID_RIC_DATA:
1004                         if (parse->ric == NULL)
1005                                 parse->ric = pos - 2;
1006                         break;
1007                 }
1008
1009                 pos += len;
1010         }
1011
1012         if (prot_ie_count == 0)
1013                 return 0; /* no MIC */
1014
1015         /*
1016          * Check that the protected IE count matches with IEs included in the
1017          * frame.
1018          */
1019         if (parse->rsn)
1020                 prot_ie_count--;
1021         if (parse->mdie)
1022                 prot_ie_count--;
1023         if (parse->ftie)
1024                 prot_ie_count--;
1025         if (prot_ie_count < 0) {
1026                 wpa_printf(MSG_DEBUG, "FT: Some required IEs not included in "
1027                            "the protected IE count");
1028                 return -1;
1029         }
1030
1031         if (prot_ie_count == 0 && parse->ric) {
1032                 wpa_printf(MSG_DEBUG, "FT: RIC IE(s) in the frame, but not "
1033                            "included in protected IE count");
1034                 return -1;
1035         }
1036
1037         /* Determine the end of the RIC IE(s) */
1038         if (parse->ric) {
1039                 pos = parse->ric;
1040                 while (end - pos >= 2 && 2 + pos[1] <= end - pos &&
1041                        prot_ie_count) {
1042                         prot_ie_count--;
1043                         pos += 2 + pos[1];
1044                 }
1045                 parse->ric_len = pos - parse->ric;
1046         }
1047         if (prot_ie_count) {
1048                 wpa_printf(MSG_DEBUG, "FT: %d protected IEs missing from "
1049                            "frame", (int) prot_ie_count);
1050                 return -1;
1051         }
1052
1053         return 0;
1054 }
1055 #endif /* CONFIG_IEEE80211R */
1056
1057
1058 static int rsn_selector_to_bitfield(const u8 *s)
1059 {
1060         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NONE)
1061                 return WPA_CIPHER_NONE;
1062         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_TKIP)
1063                 return WPA_CIPHER_TKIP;
1064         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP)
1065                 return WPA_CIPHER_CCMP;
1066 #ifdef CONFIG_IEEE80211W
1067         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_AES_128_CMAC)
1068                 return WPA_CIPHER_AES_128_CMAC;
1069 #endif /* CONFIG_IEEE80211W */
1070         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP)
1071                 return WPA_CIPHER_GCMP;
1072         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP_256)
1073                 return WPA_CIPHER_CCMP_256;
1074         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP_256)
1075                 return WPA_CIPHER_GCMP_256;
1076         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_128)
1077                 return WPA_CIPHER_BIP_GMAC_128;
1078         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_256)
1079                 return WPA_CIPHER_BIP_GMAC_256;
1080         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_CMAC_256)
1081                 return WPA_CIPHER_BIP_CMAC_256;
1082         if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED)
1083                 return WPA_CIPHER_GTK_NOT_USED;
1084         return 0;
1085 }
1086
1087
1088 static int rsn_key_mgmt_to_bitfield(const u8 *s)
1089 {
1090         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_UNSPEC_802_1X)
1091                 return WPA_KEY_MGMT_IEEE8021X;
1092         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1093                 return WPA_KEY_MGMT_PSK;
1094 #ifdef CONFIG_IEEE80211R
1095         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X)
1096                 return WPA_KEY_MGMT_FT_IEEE8021X;
1097         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_PSK)
1098                 return WPA_KEY_MGMT_FT_PSK;
1099 #ifdef CONFIG_SHA384
1100         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384)
1101                 return WPA_KEY_MGMT_FT_IEEE8021X_SHA384;
1102 #endif /* CONFIG_SHA384 */
1103 #endif /* CONFIG_IEEE80211R */
1104 #ifdef CONFIG_IEEE80211W
1105         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
1106                 return WPA_KEY_MGMT_IEEE8021X_SHA256;
1107         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
1108                 return WPA_KEY_MGMT_PSK_SHA256;
1109 #endif /* CONFIG_IEEE80211W */
1110 #ifdef CONFIG_SAE
1111         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE)
1112                 return WPA_KEY_MGMT_SAE;
1113         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_SAE)
1114                 return WPA_KEY_MGMT_FT_SAE;
1115 #endif /* CONFIG_SAE */
1116         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B)
1117                 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1118         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192)
1119                 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1120         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA256)
1121                 return WPA_KEY_MGMT_FILS_SHA256;
1122         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FILS_SHA384)
1123                 return WPA_KEY_MGMT_FILS_SHA384;
1124         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA256)
1125                 return WPA_KEY_MGMT_FT_FILS_SHA256;
1126         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_FILS_SHA384)
1127                 return WPA_KEY_MGMT_FT_FILS_SHA384;
1128 #ifdef CONFIG_OWE
1129         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OWE)
1130                 return WPA_KEY_MGMT_OWE;
1131 #endif /* CONFIG_OWE */
1132 #ifdef CONFIG_DPP
1133         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_DPP)
1134                 return WPA_KEY_MGMT_DPP;
1135 #endif /* CONFIG_DPP */
1136         if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_OSEN)
1137                 return WPA_KEY_MGMT_OSEN;
1138         return 0;
1139 }
1140
1141
1142 int wpa_cipher_valid_group(int cipher)
1143 {
1144         return wpa_cipher_valid_pairwise(cipher) ||
1145                 cipher == WPA_CIPHER_GTK_NOT_USED;
1146 }
1147
1148
1149 #ifdef CONFIG_IEEE80211W
1150 int wpa_cipher_valid_mgmt_group(int cipher)
1151 {
1152         return cipher == WPA_CIPHER_AES_128_CMAC ||
1153                 cipher == WPA_CIPHER_BIP_GMAC_128 ||
1154                 cipher == WPA_CIPHER_BIP_GMAC_256 ||
1155                 cipher == WPA_CIPHER_BIP_CMAC_256;
1156 }
1157 #endif /* CONFIG_IEEE80211W */
1158
1159
1160 /**
1161  * wpa_parse_wpa_ie_rsn - Parse RSN IE
1162  * @rsn_ie: Buffer containing RSN IE
1163  * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
1164  * @data: Pointer to structure that will be filled in with parsed data
1165  * Returns: 0 on success, <0 on failure
1166  */
1167 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
1168                          struct wpa_ie_data *data)
1169 {
1170         const u8 *pos;
1171         int left;
1172         int i, count;
1173
1174         os_memset(data, 0, sizeof(*data));
1175         data->proto = WPA_PROTO_RSN;
1176         data->pairwise_cipher = WPA_CIPHER_CCMP;
1177         data->group_cipher = WPA_CIPHER_CCMP;
1178         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1179         data->capabilities = 0;
1180         data->pmkid = NULL;
1181         data->num_pmkid = 0;
1182 #ifdef CONFIG_IEEE80211W
1183         data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1184 #else /* CONFIG_IEEE80211W */
1185         data->mgmt_group_cipher = 0;
1186 #endif /* CONFIG_IEEE80211W */
1187
1188         if (rsn_ie_len == 0) {
1189                 /* No RSN IE - fail silently */
1190                 return -1;
1191         }
1192
1193         if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
1194                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1195                            __func__, (unsigned long) rsn_ie_len);
1196                 return -1;
1197         }
1198
1199         if (rsn_ie_len >= 6 && rsn_ie[1] >= 4 &&
1200             rsn_ie[1] == rsn_ie_len - 2 &&
1201             WPA_GET_BE32(&rsn_ie[2]) == OSEN_IE_VENDOR_TYPE) {
1202                 pos = rsn_ie + 6;
1203                 left = rsn_ie_len - 6;
1204
1205                 data->group_cipher = WPA_CIPHER_GTK_NOT_USED;
1206                 data->key_mgmt = WPA_KEY_MGMT_OSEN;
1207                 data->proto = WPA_PROTO_OSEN;
1208         } else {
1209                 const struct rsn_ie_hdr *hdr;
1210
1211                 hdr = (const struct rsn_ie_hdr *) rsn_ie;
1212
1213                 if (hdr->elem_id != WLAN_EID_RSN ||
1214                     hdr->len != rsn_ie_len - 2 ||
1215                     WPA_GET_LE16(hdr->version) != RSN_VERSION) {
1216                         wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1217                                    __func__);
1218                         return -2;
1219                 }
1220
1221                 pos = (const u8 *) (hdr + 1);
1222                 left = rsn_ie_len - sizeof(*hdr);
1223         }
1224
1225         if (left >= RSN_SELECTOR_LEN) {
1226                 data->group_cipher = rsn_selector_to_bitfield(pos);
1227                 if (!wpa_cipher_valid_group(data->group_cipher)) {
1228                         wpa_printf(MSG_DEBUG,
1229                                    "%s: invalid group cipher 0x%x (%08x)",
1230                                    __func__, data->group_cipher,
1231                                    WPA_GET_BE32(pos));
1232                         return -1;
1233                 }
1234                 pos += RSN_SELECTOR_LEN;
1235                 left -= RSN_SELECTOR_LEN;
1236         } else if (left > 0) {
1237                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1238                            __func__, left);
1239                 return -3;
1240         }
1241
1242         if (left >= 2) {
1243                 data->pairwise_cipher = 0;
1244                 count = WPA_GET_LE16(pos);
1245                 pos += 2;
1246                 left -= 2;
1247                 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1248                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1249                                    "count %u left %u", __func__, count, left);
1250                         return -4;
1251                 }
1252                 for (i = 0; i < count; i++) {
1253                         data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
1254                         pos += RSN_SELECTOR_LEN;
1255                         left -= RSN_SELECTOR_LEN;
1256                 }
1257 #ifdef CONFIG_IEEE80211W
1258                 if (data->pairwise_cipher & WPA_CIPHER_AES_128_CMAC) {
1259                         wpa_printf(MSG_DEBUG, "%s: AES-128-CMAC used as "
1260                                    "pairwise cipher", __func__);
1261                         return -1;
1262                 }
1263 #endif /* CONFIG_IEEE80211W */
1264         } else if (left == 1) {
1265                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1266                            __func__);
1267                 return -5;
1268         }
1269
1270         if (left >= 2) {
1271                 data->key_mgmt = 0;
1272                 count = WPA_GET_LE16(pos);
1273                 pos += 2;
1274                 left -= 2;
1275                 if (count == 0 || count > left / RSN_SELECTOR_LEN) {
1276                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1277                                    "count %u left %u", __func__, count, left);
1278                         return -6;
1279                 }
1280                 for (i = 0; i < count; i++) {
1281                         data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
1282                         pos += RSN_SELECTOR_LEN;
1283                         left -= RSN_SELECTOR_LEN;
1284                 }
1285         } else if (left == 1) {
1286                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
1287                            __func__);
1288                 return -7;
1289         }
1290
1291         if (left >= 2) {
1292                 data->capabilities = WPA_GET_LE16(pos);
1293                 pos += 2;
1294                 left -= 2;
1295         }
1296
1297         if (left >= 2) {
1298                 u16 num_pmkid = WPA_GET_LE16(pos);
1299                 pos += 2;
1300                 left -= 2;
1301                 if (num_pmkid > (unsigned int) left / PMKID_LEN) {
1302                         wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
1303                                    "(num_pmkid=%u left=%d)",
1304                                    __func__, num_pmkid, left);
1305                         data->num_pmkid = 0;
1306                         return -9;
1307                 } else {
1308                         data->num_pmkid = num_pmkid;
1309                         data->pmkid = pos;
1310                         pos += data->num_pmkid * PMKID_LEN;
1311                         left -= data->num_pmkid * PMKID_LEN;
1312                 }
1313         }
1314
1315 #ifdef CONFIG_IEEE80211W
1316         if (left >= 4) {
1317                 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
1318                 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
1319                         wpa_printf(MSG_DEBUG,
1320                                    "%s: Unsupported management group cipher 0x%x (%08x)",
1321                                    __func__, data->mgmt_group_cipher,
1322                                    WPA_GET_BE32(pos));
1323                         return -10;
1324                 }
1325                 pos += RSN_SELECTOR_LEN;
1326                 left -= RSN_SELECTOR_LEN;
1327         }
1328 #endif /* CONFIG_IEEE80211W */
1329
1330         if (left > 0) {
1331                 wpa_hexdump(MSG_DEBUG,
1332                             "wpa_parse_wpa_ie_rsn: ignore trailing bytes",
1333                             pos, left);
1334         }
1335
1336         return 0;
1337 }
1338
1339
1340 static int wpa_selector_to_bitfield(const u8 *s)
1341 {
1342         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
1343                 return WPA_CIPHER_NONE;
1344         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
1345                 return WPA_CIPHER_TKIP;
1346         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
1347                 return WPA_CIPHER_CCMP;
1348         return 0;
1349 }
1350
1351
1352 static int wpa_key_mgmt_to_bitfield(const u8 *s)
1353 {
1354         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
1355                 return WPA_KEY_MGMT_IEEE8021X;
1356         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
1357                 return WPA_KEY_MGMT_PSK;
1358         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
1359                 return WPA_KEY_MGMT_WPA_NONE;
1360         return 0;
1361 }
1362
1363
1364 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
1365                          struct wpa_ie_data *data)
1366 {
1367         const struct wpa_ie_hdr *hdr;
1368         const u8 *pos;
1369         int left;
1370         int i, count;
1371
1372         os_memset(data, 0, sizeof(*data));
1373         data->proto = WPA_PROTO_WPA;
1374         data->pairwise_cipher = WPA_CIPHER_TKIP;
1375         data->group_cipher = WPA_CIPHER_TKIP;
1376         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1377         data->capabilities = 0;
1378         data->pmkid = NULL;
1379         data->num_pmkid = 0;
1380         data->mgmt_group_cipher = 0;
1381
1382         if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
1383                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
1384                            __func__, (unsigned long) wpa_ie_len);
1385                 return -1;
1386         }
1387
1388         hdr = (const struct wpa_ie_hdr *) wpa_ie;
1389
1390         if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
1391             hdr->len != wpa_ie_len - 2 ||
1392             RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
1393             WPA_GET_LE16(hdr->version) != WPA_VERSION) {
1394                 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
1395                            __func__);
1396                 return -2;
1397         }
1398
1399         pos = (const u8 *) (hdr + 1);
1400         left = wpa_ie_len - sizeof(*hdr);
1401
1402         if (left >= WPA_SELECTOR_LEN) {
1403                 data->group_cipher = wpa_selector_to_bitfield(pos);
1404                 pos += WPA_SELECTOR_LEN;
1405                 left -= WPA_SELECTOR_LEN;
1406         } else if (left > 0) {
1407                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
1408                            __func__, left);
1409                 return -3;
1410         }
1411
1412         if (left >= 2) {
1413                 data->pairwise_cipher = 0;
1414                 count = WPA_GET_LE16(pos);
1415                 pos += 2;
1416                 left -= 2;
1417                 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
1418                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
1419                                    "count %u left %u", __func__, count, left);
1420                         return -4;
1421                 }
1422                 for (i = 0; i < count; i++) {
1423                         data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
1424                         pos += WPA_SELECTOR_LEN;
1425                         left -= WPA_SELECTOR_LEN;
1426                 }
1427         } else if (left == 1) {
1428                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
1429                            __func__);
1430                 return -5;
1431         }
1432
1433         if (left >= 2) {
1434                 data->key_mgmt = 0;
1435                 count = WPA_GET_LE16(pos);
1436                 pos += 2;
1437                 left -= 2;
1438                 if (count == 0 || count > left / WPA_SELECTOR_LEN) {
1439                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
1440                                    "count %u left %u", __func__, count, left);
1441                         return -6;
1442                 }
1443                 for (i = 0; i < count; i++) {
1444                         data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
1445                         pos += WPA_SELECTOR_LEN;
1446                         left -= WPA_SELECTOR_LEN;
1447                 }
1448         } else if (left == 1) {
1449                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
1450                            __func__);
1451                 return -7;
1452         }
1453
1454         if (left >= 2) {
1455                 data->capabilities = WPA_GET_LE16(pos);
1456                 pos += 2;
1457                 left -= 2;
1458         }
1459
1460         if (left > 0) {
1461                 wpa_hexdump(MSG_DEBUG,
1462                             "wpa_parse_wpa_ie_wpa: ignore trailing bytes",
1463                             pos, left);
1464         }
1465
1466         return 0;
1467 }
1468
1469
1470 #ifdef CONFIG_IEEE80211R
1471
1472 /**
1473  * wpa_derive_pmk_r0 - Derive PMK-R0 and PMKR0Name
1474  *
1475  * IEEE Std 802.11r-2008 - 8.5.1.5.3
1476  */
1477 int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
1478                       const u8 *ssid, size_t ssid_len,
1479                       const u8 *mdid, const u8 *r0kh_id, size_t r0kh_id_len,
1480                       const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
1481                       int use_sha384)
1482 {
1483         u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
1484                FT_R0KH_ID_MAX_LEN + ETH_ALEN];
1485         u8 *pos, r0_key_data[64], hash[48];
1486         const u8 *addr[2];
1487         size_t len[2];
1488         size_t q = use_sha384 ? 48 : 32;
1489         size_t r0_key_data_len = q + 16;
1490
1491         /*
1492          * R0-Key-Data = KDF-384(XXKey, "FT-R0",
1493          *                       SSIDlength || SSID || MDID || R0KHlength ||
1494          *                       R0KH-ID || S0KH-ID)
1495          * XXKey is either the second 256 bits of MSK or PSK; or the first
1496          * 384 bits of MSK for FT-EAP-SHA384.
1497          * PMK-R0 = L(R0-Key-Data, 0, Q)
1498          * PMK-R0Name-Salt = L(R0-Key-Data, Q, 128)
1499          * Q = 384 for FT-EAP-SHA384; otherwise, 256
1500          */
1501         if (ssid_len > SSID_MAX_LEN || r0kh_id_len > FT_R0KH_ID_MAX_LEN)
1502                 return -1;
1503         wpa_printf(MSG_DEBUG, "FT: Derive PMK-R0 using KDF-%s",
1504                    use_sha384 ? "SHA384" : "SHA256");
1505         wpa_hexdump_key(MSG_DEBUG, "FT: XXKey", xxkey, xxkey_len);
1506         wpa_hexdump_ascii(MSG_DEBUG, "FT: SSID", ssid, ssid_len);
1507         wpa_hexdump(MSG_DEBUG, "FT: MDID", mdid, MOBILITY_DOMAIN_ID_LEN);
1508         wpa_hexdump_ascii(MSG_DEBUG, "FT: R0KH-ID", r0kh_id, r0kh_id_len);
1509         wpa_printf(MSG_DEBUG, "FT: S0KH-ID: " MACSTR, MAC2STR(s0kh_id));
1510         pos = buf;
1511         *pos++ = ssid_len;
1512         os_memcpy(pos, ssid, ssid_len);
1513         pos += ssid_len;
1514         os_memcpy(pos, mdid, MOBILITY_DOMAIN_ID_LEN);
1515         pos += MOBILITY_DOMAIN_ID_LEN;
1516         *pos++ = r0kh_id_len;
1517         os_memcpy(pos, r0kh_id, r0kh_id_len);
1518         pos += r0kh_id_len;
1519         os_memcpy(pos, s0kh_id, ETH_ALEN);
1520         pos += ETH_ALEN;
1521
1522 #ifdef CONFIG_SHA384
1523         if (use_sha384) {
1524                 if (xxkey_len != SHA384_MAC_LEN) {
1525                         wpa_printf(MSG_ERROR,
1526                                    "FT: Unexpected XXKey length %d (expected %d)",
1527                                    (int) xxkey_len, SHA384_MAC_LEN);
1528                         return -1;
1529                 }
1530                 if (sha384_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
1531                                r0_key_data, r0_key_data_len) < 0)
1532                         return -1;
1533         }
1534 #endif /* CONFIG_SHA384 */
1535         if (!use_sha384) {
1536                 if (xxkey_len != PMK_LEN) {
1537                         wpa_printf(MSG_ERROR,
1538                                    "FT: Unexpected XXKey length %d (expected %d)",
1539                                    (int) xxkey_len, PMK_LEN);
1540                         return -1;
1541                 }
1542                 if (sha256_prf(xxkey, xxkey_len, "FT-R0", buf, pos - buf,
1543                                r0_key_data, r0_key_data_len) < 0)
1544                         return -1;
1545         }
1546         os_memcpy(pmk_r0, r0_key_data, q);
1547         wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, q);
1548         wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
1549
1550         /*
1551          * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
1552          */
1553         addr[0] = (const u8 *) "FT-R0N";
1554         len[0] = 6;
1555         addr[1] = &r0_key_data[q];
1556         len[1] = 16;
1557
1558 #ifdef CONFIG_SHA384
1559         if (use_sha384 && sha384_vector(2, addr, len, hash) < 0)
1560                 return -1;
1561 #endif /* CONFIG_SHA384 */
1562         if (!use_sha384 && sha256_vector(2, addr, len, hash) < 0)
1563                 return -1;
1564         os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
1565         os_memset(r0_key_data, 0, sizeof(r0_key_data));
1566         return 0;
1567 }
1568
1569
1570 /**
1571  * wpa_derive_pmk_r1_name - Derive PMKR1Name
1572  *
1573  * IEEE Std 802.11r-2008 - 8.5.1.5.4
1574  */
1575 int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
1576                            const u8 *s1kh_id, u8 *pmk_r1_name, int use_sha384)
1577 {
1578         u8 hash[48];
1579         const u8 *addr[4];
1580         size_t len[4];
1581
1582         /*
1583          * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
1584          *                               R1KH-ID || S1KH-ID))
1585          */
1586         addr[0] = (const u8 *) "FT-R1N";
1587         len[0] = 6;
1588         addr[1] = pmk_r0_name;
1589         len[1] = WPA_PMK_NAME_LEN;
1590         addr[2] = r1kh_id;
1591         len[2] = FT_R1KH_ID_LEN;
1592         addr[3] = s1kh_id;
1593         len[3] = ETH_ALEN;
1594
1595 #ifdef CONFIG_SHA384
1596         if (use_sha384 && sha384_vector(4, addr, len, hash) < 0)
1597                 return -1;
1598 #endif /* CONFIG_SHA384 */
1599         if (!use_sha384 && sha256_vector(4, addr, len, hash) < 0)
1600                 return -1;
1601         os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
1602         return 0;
1603 }
1604
1605
1606 /**
1607  * wpa_derive_pmk_r1 - Derive PMK-R1 and PMKR1Name from PMK-R0
1608  *
1609  * IEEE Std 802.11r-2008 - 8.5.1.5.4
1610  */
1611 int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
1612                       const u8 *pmk_r0_name,
1613                       const u8 *r1kh_id, const u8 *s1kh_id,
1614                       u8 *pmk_r1, u8 *pmk_r1_name)
1615 {
1616         u8 buf[FT_R1KH_ID_LEN + ETH_ALEN];
1617         u8 *pos;
1618
1619         /* PMK-R1 = KDF-256(PMK-R0, "FT-R1", R1KH-ID || S1KH-ID) */
1620         wpa_printf(MSG_DEBUG, "FT: Derive PMK-R1 using KDF-%s",
1621                    pmk_r0_len == SHA384_MAC_LEN ? "SHA384" : "SHA256");
1622         wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0", pmk_r0, pmk_r0_len);
1623         wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID", r1kh_id, FT_R1KH_ID_LEN);
1624         wpa_printf(MSG_DEBUG, "FT: S1KH-ID: " MACSTR, MAC2STR(s1kh_id));
1625         pos = buf;
1626         os_memcpy(pos, r1kh_id, FT_R1KH_ID_LEN);
1627         pos += FT_R1KH_ID_LEN;
1628         os_memcpy(pos, s1kh_id, ETH_ALEN);
1629         pos += ETH_ALEN;
1630
1631 #ifdef CONFIG_SHA384
1632         if (pmk_r0_len == SHA384_MAC_LEN &&
1633             sha384_prf(pmk_r0, pmk_r0_len, "FT-R1",
1634                        buf, pos - buf, pmk_r1, pmk_r0_len) < 0)
1635                 return -1;
1636 #endif /* CONFIG_SHA384 */
1637         if (pmk_r0_len == PMK_LEN &&
1638             sha256_prf(pmk_r0, pmk_r0_len, "FT-R1",
1639                        buf, pos - buf, pmk_r1, pmk_r0_len) < 0)
1640                 return -1;
1641         if (pmk_r0_len != SHA384_MAC_LEN && pmk_r0_len != PMK_LEN) {
1642                 wpa_printf(MSG_ERROR, "FT: Unexpected PMK-R0 length %d",
1643                            (int) pmk_r0_len);
1644                 return -1;
1645         }
1646         wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
1647
1648         return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
1649                                       pmk_r1_name,
1650                                       pmk_r0_len == SHA384_MAC_LEN);
1651 }
1652
1653
1654 /**
1655  * wpa_pmk_r1_to_ptk - Derive PTK and PTKName from PMK-R1
1656  *
1657  * IEEE Std 802.11r-2008 - 8.5.1.5.5
1658  */
1659 int wpa_pmk_r1_to_ptk(const u8 *pmk_r1, size_t pmk_r1_len,
1660                       const u8 *snonce, const u8 *anonce,
1661                       const u8 *sta_addr, const u8 *bssid,
1662                       const u8 *pmk_r1_name,
1663                       struct wpa_ptk *ptk, u8 *ptk_name, int akmp, int cipher)
1664 {
1665         u8 buf[2 * WPA_NONCE_LEN + 2 * ETH_ALEN];
1666         u8 *pos, hash[32];
1667         const u8 *addr[6];
1668         size_t len[6];
1669         u8 tmp[2 * WPA_KCK_MAX_LEN + 2 * WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN];
1670         size_t ptk_len, offset;
1671         int use_sha384 = wpa_key_mgmt_sha384(akmp);
1672
1673         /*
1674          * PTK = KDF-PTKLen(PMK-R1, "FT-PTK", SNonce || ANonce ||
1675          *                  BSSID || STA-ADDR)
1676          */
1677         wpa_printf(MSG_DEBUG, "FT: Derive PTK using KDF-%s",
1678                    use_sha384 ? "SHA384" : "SHA256");
1679         wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r1_len);
1680         wpa_hexdump(MSG_DEBUG, "FT: SNonce", snonce, WPA_NONCE_LEN);
1681         wpa_hexdump(MSG_DEBUG, "FT: ANonce", anonce, WPA_NONCE_LEN);
1682         wpa_printf(MSG_DEBUG, "FT: BSSID=" MACSTR " STA-ADDR=" MACSTR,
1683                    MAC2STR(bssid), MAC2STR(sta_addr));
1684         pos = buf;
1685         os_memcpy(pos, snonce, WPA_NONCE_LEN);
1686         pos += WPA_NONCE_LEN;
1687         os_memcpy(pos, anonce, WPA_NONCE_LEN);
1688         pos += WPA_NONCE_LEN;
1689         os_memcpy(pos, bssid, ETH_ALEN);
1690         pos += ETH_ALEN;
1691         os_memcpy(pos, sta_addr, ETH_ALEN);
1692         pos += ETH_ALEN;
1693
1694         ptk->kck_len = wpa_kck_len(akmp, PMK_LEN);
1695         ptk->kck2_len = wpa_kck2_len(akmp);
1696         ptk->kek_len = wpa_kek_len(akmp, PMK_LEN);
1697         ptk->kek2_len = wpa_kek2_len(akmp);
1698         ptk->tk_len = wpa_cipher_key_len(cipher);
1699         ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len +
1700                 ptk->kck2_len + ptk->kek2_len;
1701
1702 #ifdef CONFIG_SHA384
1703         if (use_sha384) {
1704                 if (pmk_r1_len != SHA384_MAC_LEN) {
1705                         wpa_printf(MSG_ERROR,
1706                                    "FT: Unexpected PMK-R1 length %d (expected %d)",
1707                                    (int) pmk_r1_len, SHA384_MAC_LEN);
1708                         return -1;
1709                 }
1710                 if (sha384_prf(pmk_r1, pmk_r1_len, "FT-PTK",
1711                                buf, pos - buf, tmp, ptk_len) < 0)
1712                         return -1;
1713         }
1714 #endif /* CONFIG_SHA384 */
1715         if (!use_sha384) {
1716                 if (pmk_r1_len != PMK_LEN) {
1717                         wpa_printf(MSG_ERROR,
1718                                    "FT: Unexpected PMK-R1 length %d (expected %d)",
1719                                    (int) pmk_r1_len, PMK_LEN);
1720                         return -1;
1721                 }
1722                 if (sha256_prf(pmk_r1, pmk_r1_len, "FT-PTK",
1723                                buf, pos - buf, tmp, ptk_len) < 0)
1724                         return -1;
1725         }
1726         wpa_hexdump_key(MSG_DEBUG, "FT: PTK", tmp, ptk_len);
1727
1728         /*
1729          * PTKName = Truncate-128(SHA-256(PMKR1Name || "FT-PTKN" || SNonce ||
1730          *                                ANonce || BSSID || STA-ADDR))
1731          */
1732         wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", pmk_r1_name, WPA_PMK_NAME_LEN);
1733         addr[0] = pmk_r1_name;
1734         len[0] = WPA_PMK_NAME_LEN;
1735         addr[1] = (const u8 *) "FT-PTKN";
1736         len[1] = 7;
1737         addr[2] = snonce;
1738         len[2] = WPA_NONCE_LEN;
1739         addr[3] = anonce;
1740         len[3] = WPA_NONCE_LEN;
1741         addr[4] = bssid;
1742         len[4] = ETH_ALEN;
1743         addr[5] = sta_addr;
1744         len[5] = ETH_ALEN;
1745
1746         if (sha256_vector(6, addr, len, hash) < 0)
1747                 return -1;
1748         os_memcpy(ptk_name, hash, WPA_PMK_NAME_LEN);
1749
1750         os_memcpy(ptk->kck, tmp, ptk->kck_len);
1751         offset = ptk->kck_len;
1752         os_memcpy(ptk->kek, tmp + offset, ptk->kek_len);
1753         offset += ptk->kek_len;
1754         os_memcpy(ptk->tk, tmp + offset, ptk->tk_len);
1755         offset += ptk->tk_len;
1756         os_memcpy(ptk->kck2, tmp + offset, ptk->kck2_len);
1757         offset = ptk->kck2_len;
1758         os_memcpy(ptk->kek2, tmp + offset, ptk->kek2_len);
1759
1760         wpa_hexdump_key(MSG_DEBUG, "FT: KCK", ptk->kck, ptk->kck_len);
1761         wpa_hexdump_key(MSG_DEBUG, "FT: KEK", ptk->kek, ptk->kek_len);
1762         if (ptk->kck2_len)
1763                 wpa_hexdump_key(MSG_DEBUG, "FT: KCK2",
1764                                 ptk->kck2, ptk->kck2_len);
1765         if (ptk->kek2_len)
1766                 wpa_hexdump_key(MSG_DEBUG, "FT: KEK2",
1767                                 ptk->kek2, ptk->kek2_len);
1768         wpa_hexdump_key(MSG_DEBUG, "FT: TK", ptk->tk, ptk->tk_len);
1769         wpa_hexdump(MSG_DEBUG, "FT: PTKName", ptk_name, WPA_PMK_NAME_LEN);
1770
1771         os_memset(tmp, 0, sizeof(tmp));
1772
1773         return 0;
1774 }
1775
1776 #endif /* CONFIG_IEEE80211R */
1777
1778
1779 /**
1780  * rsn_pmkid - Calculate PMK identifier
1781  * @pmk: Pairwise master key
1782  * @pmk_len: Length of pmk in bytes
1783  * @aa: Authenticator address
1784  * @spa: Supplicant address
1785  * @pmkid: Buffer for PMKID
1786  * @akmp: Negotiated key management protocol
1787  *
1788  * IEEE Std 802.11-2016 - 12.7.1.3 Pairwise key hierarchy
1789  * AKM: 00-0F-AC:5, 00-0F-AC:6, 00-0F-AC:14, 00-0F-AC:16
1790  * PMKID = Truncate-128(HMAC-SHA-256(PMK, "PMK Name" || AA || SPA))
1791  * AKM: 00-0F-AC:11
1792  * See rsn_pmkid_suite_b()
1793  * AKM: 00-0F-AC:12
1794  * See rsn_pmkid_suite_b_192()
1795  * AKM: 00-0F-AC:13, 00-0F-AC:15, 00-0F-AC:17
1796  * PMKID = Truncate-128(HMAC-SHA-384(PMK, "PMK Name" || AA || SPA))
1797  * Otherwise:
1798  * PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name" || AA || SPA))
1799  */
1800 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
1801                u8 *pmkid, int akmp)
1802 {
1803         char *title = "PMK Name";
1804         const u8 *addr[3];
1805         const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
1806         unsigned char hash[SHA384_MAC_LEN];
1807
1808         addr[0] = (u8 *) title;
1809         addr[1] = aa;
1810         addr[2] = spa;
1811
1812         if (0) {
1813 #if defined(CONFIG_FILS) || defined(CONFIG_SHA384)
1814         } else if (wpa_key_mgmt_sha384(akmp)) {
1815                 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-384");
1816                 hmac_sha384_vector(pmk, pmk_len, 3, addr, len, hash);
1817 #endif /* CONFIG_FILS || CONFIG_SHA384 */
1818 #if defined(CONFIG_IEEE80211W) || defined(CONFIG_FILS)
1819         } else if (wpa_key_mgmt_sha256(akmp)) {
1820                 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-256");
1821                 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
1822 #endif /* CONFIG_IEEE80211W || CONFIG_FILS */
1823         } else {
1824                 wpa_printf(MSG_DEBUG, "RSN: Derive PMKID using HMAC-SHA-1");
1825                 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
1826         }
1827         wpa_hexdump(MSG_DEBUG, "RSN: Derived PMKID", hash, PMKID_LEN);
1828         os_memcpy(pmkid, hash, PMKID_LEN);
1829 }
1830
1831
1832 #ifdef CONFIG_SUITEB
1833 /**
1834  * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
1835  * @kck: Key confirmation key
1836  * @kck_len: Length of kck in bytes
1837  * @aa: Authenticator address
1838  * @spa: Supplicant address
1839  * @pmkid: Buffer for PMKID
1840  * Returns: 0 on success, -1 on failure
1841  *
1842  * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
1843  * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
1844  */
1845 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
1846                       const u8 *spa, u8 *pmkid)
1847 {
1848         char *title = "PMK Name";
1849         const u8 *addr[3];
1850         const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
1851         unsigned char hash[SHA256_MAC_LEN];
1852
1853         addr[0] = (u8 *) title;
1854         addr[1] = aa;
1855         addr[2] = spa;
1856
1857         if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
1858                 return -1;
1859         os_memcpy(pmkid, hash, PMKID_LEN);
1860         return 0;
1861 }
1862 #endif /* CONFIG_SUITEB */
1863
1864
1865 #ifdef CONFIG_SUITEB192
1866 /**
1867  * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
1868  * @kck: Key confirmation key
1869  * @kck_len: Length of kck in bytes
1870  * @aa: Authenticator address
1871  * @spa: Supplicant address
1872  * @pmkid: Buffer for PMKID
1873  * Returns: 0 on success, -1 on failure
1874  *
1875  * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
1876  * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
1877  */
1878 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
1879                           const u8 *spa, u8 *pmkid)
1880 {
1881         char *title = "PMK Name";
1882         const u8 *addr[3];
1883         const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
1884         unsigned char hash[SHA384_MAC_LEN];
1885
1886         addr[0] = (u8 *) title;
1887         addr[1] = aa;
1888         addr[2] = spa;
1889
1890         if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
1891                 return -1;
1892         os_memcpy(pmkid, hash, PMKID_LEN);
1893         return 0;
1894 }
1895 #endif /* CONFIG_SUITEB192 */
1896
1897
1898 /**
1899  * wpa_cipher_txt - Convert cipher suite to a text string
1900  * @cipher: Cipher suite (WPA_CIPHER_* enum)
1901  * Returns: Pointer to a text string of the cipher suite name
1902  */
1903 const char * wpa_cipher_txt(int cipher)
1904 {
1905         switch (cipher) {
1906         case WPA_CIPHER_NONE:
1907                 return "NONE";
1908         case WPA_CIPHER_WEP40:
1909                 return "WEP-40";
1910         case WPA_CIPHER_WEP104:
1911                 return "WEP-104";
1912         case WPA_CIPHER_TKIP:
1913                 return "TKIP";
1914         case WPA_CIPHER_CCMP:
1915                 return "CCMP";
1916         case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
1917                 return "CCMP+TKIP";
1918         case WPA_CIPHER_GCMP:
1919                 return "GCMP";
1920         case WPA_CIPHER_GCMP_256:
1921                 return "GCMP-256";
1922         case WPA_CIPHER_CCMP_256:
1923                 return "CCMP-256";
1924         case WPA_CIPHER_AES_128_CMAC:
1925                 return "BIP";
1926         case WPA_CIPHER_BIP_GMAC_128:
1927                 return "BIP-GMAC-128";
1928         case WPA_CIPHER_BIP_GMAC_256:
1929                 return "BIP-GMAC-256";
1930         case WPA_CIPHER_BIP_CMAC_256:
1931                 return "BIP-CMAC-256";
1932         case WPA_CIPHER_GTK_NOT_USED:
1933                 return "GTK_NOT_USED";
1934         default:
1935                 return "UNKNOWN";
1936         }
1937 }
1938
1939
1940 /**
1941  * wpa_key_mgmt_txt - Convert key management suite to a text string
1942  * @key_mgmt: Key management suite (WPA_KEY_MGMT_* enum)
1943  * @proto: WPA/WPA2 version (WPA_PROTO_*)
1944  * Returns: Pointer to a text string of the key management suite name
1945  */
1946 const char * wpa_key_mgmt_txt(int key_mgmt, int proto)
1947 {
1948         switch (key_mgmt) {
1949         case WPA_KEY_MGMT_IEEE8021X:
1950                 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
1951                         return "WPA2+WPA/IEEE 802.1X/EAP";
1952                 return proto == WPA_PROTO_RSN ?
1953                         "WPA2/IEEE 802.1X/EAP" : "WPA/IEEE 802.1X/EAP";
1954         case WPA_KEY_MGMT_PSK:
1955                 if (proto == (WPA_PROTO_RSN | WPA_PROTO_WPA))
1956                         return "WPA2-PSK+WPA-PSK";
1957                 return proto == WPA_PROTO_RSN ?
1958                         "WPA2-PSK" : "WPA-PSK";
1959         case WPA_KEY_MGMT_NONE:
1960                 return "NONE";
1961         case WPA_KEY_MGMT_WPA_NONE:
1962                 return "WPA-NONE";
1963         case WPA_KEY_MGMT_IEEE8021X_NO_WPA:
1964                 return "IEEE 802.1X (no WPA)";
1965 #ifdef CONFIG_IEEE80211R
1966         case WPA_KEY_MGMT_FT_IEEE8021X:
1967                 return "FT-EAP";
1968         case WPA_KEY_MGMT_FT_IEEE8021X_SHA384:
1969                 return "FT-EAP-SHA384";
1970         case WPA_KEY_MGMT_FT_PSK:
1971                 return "FT-PSK";
1972 #endif /* CONFIG_IEEE80211R */
1973 #ifdef CONFIG_IEEE80211W
1974         case WPA_KEY_MGMT_IEEE8021X_SHA256:
1975                 return "WPA2-EAP-SHA256";
1976         case WPA_KEY_MGMT_PSK_SHA256:
1977                 return "WPA2-PSK-SHA256";
1978 #endif /* CONFIG_IEEE80211W */
1979         case WPA_KEY_MGMT_WPS:
1980                 return "WPS";
1981         case WPA_KEY_MGMT_SAE:
1982                 return "SAE";
1983         case WPA_KEY_MGMT_FT_SAE:
1984                 return "FT-SAE";
1985         case WPA_KEY_MGMT_OSEN:
1986                 return "OSEN";
1987         case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
1988                 return "WPA2-EAP-SUITE-B";
1989         case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
1990                 return "WPA2-EAP-SUITE-B-192";
1991         case WPA_KEY_MGMT_FILS_SHA256:
1992                 return "FILS-SHA256";
1993         case WPA_KEY_MGMT_FILS_SHA384:
1994                 return "FILS-SHA384";
1995         case WPA_KEY_MGMT_FT_FILS_SHA256:
1996                 return "FT-FILS-SHA256";
1997         case WPA_KEY_MGMT_FT_FILS_SHA384:
1998                 return "FT-FILS-SHA384";
1999         case WPA_KEY_MGMT_OWE:
2000                 return "OWE";
2001         case WPA_KEY_MGMT_DPP:
2002                 return "DPP";
2003         default:
2004                 return "UNKNOWN";
2005         }
2006 }
2007
2008
2009 u32 wpa_akm_to_suite(int akm)
2010 {
2011         if (akm & WPA_KEY_MGMT_FT_IEEE8021X_SHA384)
2012                 return RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384;
2013         if (akm & WPA_KEY_MGMT_FT_IEEE8021X)
2014                 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2015         if (akm & WPA_KEY_MGMT_FT_PSK)
2016                 return RSN_AUTH_KEY_MGMT_FT_PSK;
2017         if (akm & WPA_KEY_MGMT_IEEE8021X_SHA256)
2018                 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2019         if (akm & WPA_KEY_MGMT_IEEE8021X)
2020                 return RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
2021         if (akm & WPA_KEY_MGMT_PSK_SHA256)
2022                 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2023         if (akm & WPA_KEY_MGMT_PSK)
2024                 return RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
2025         if (akm & WPA_KEY_MGMT_CCKM)
2026                 return RSN_AUTH_KEY_MGMT_CCKM;
2027         if (akm & WPA_KEY_MGMT_OSEN)
2028                 return RSN_AUTH_KEY_MGMT_OSEN;
2029         if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B)
2030                 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2031         if (akm & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2032                 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2033         if (akm & WPA_KEY_MGMT_FILS_SHA256)
2034                 return RSN_AUTH_KEY_MGMT_FILS_SHA256;
2035         if (akm & WPA_KEY_MGMT_FILS_SHA384)
2036                 return RSN_AUTH_KEY_MGMT_FILS_SHA384;
2037         if (akm & WPA_KEY_MGMT_FT_FILS_SHA256)
2038                 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA256;
2039         if (akm & WPA_KEY_MGMT_FT_FILS_SHA384)
2040                 return RSN_AUTH_KEY_MGMT_FT_FILS_SHA384;
2041         return 0;
2042 }
2043
2044
2045 int wpa_compare_rsn_ie(int ft_initial_assoc,
2046                        const u8 *ie1, size_t ie1len,
2047                        const u8 *ie2, size_t ie2len)
2048 {
2049         if (ie1 == NULL || ie2 == NULL)
2050                 return -1;
2051
2052         if (ie1len == ie2len && os_memcmp(ie1, ie2, ie1len) == 0)
2053                 return 0; /* identical IEs */
2054
2055 #ifdef CONFIG_IEEE80211R
2056         if (ft_initial_assoc) {
2057                 struct wpa_ie_data ie1d, ie2d;
2058                 /*
2059                  * The PMKID-List in RSN IE is different between Beacon/Probe
2060                  * Response/(Re)Association Request frames and EAPOL-Key
2061                  * messages in FT initial mobility domain association. Allow
2062                  * for this, but verify that other parts of the RSN IEs are
2063                  * identical.
2064                  */
2065                 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
2066                     wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
2067                         return -1;
2068                 if (ie1d.proto == ie2d.proto &&
2069                     ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
2070                     ie1d.group_cipher == ie2d.group_cipher &&
2071                     ie1d.key_mgmt == ie2d.key_mgmt &&
2072                     ie1d.capabilities == ie2d.capabilities &&
2073                     ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
2074                         return 0;
2075         }
2076 #endif /* CONFIG_IEEE80211R */
2077
2078         return -1;
2079 }
2080
2081
2082 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
2083 int wpa_insert_pmkid(u8 *ies, size_t *ies_len, const u8 *pmkid)
2084 {
2085         u8 *start, *end, *rpos, *rend;
2086         int added = 0;
2087
2088         start = ies;
2089         end = ies + *ies_len;
2090
2091         while (start < end) {
2092                 if (*start == WLAN_EID_RSN)
2093                         break;
2094                 start += 2 + start[1];
2095         }
2096         if (start >= end) {
2097                 wpa_printf(MSG_ERROR, "FT: Could not find RSN IE in "
2098                            "IEs data");
2099                 return -1;
2100         }
2101         wpa_hexdump(MSG_DEBUG, "FT: RSN IE before modification",
2102                     start, 2 + start[1]);
2103
2104         /* Find start of PMKID-Count */
2105         rpos = start + 2;
2106         rend = rpos + start[1];
2107
2108         /* Skip Version and Group Data Cipher Suite */
2109         rpos += 2 + 4;
2110         /* Skip Pairwise Cipher Suite Count and List */
2111         rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2112         /* Skip AKM Suite Count and List */
2113         rpos += 2 + WPA_GET_LE16(rpos) * RSN_SELECTOR_LEN;
2114
2115         if (rpos == rend) {
2116                 /* Add RSN Capabilities */
2117                 os_memmove(rpos + 2, rpos, end - rpos);
2118                 *rpos++ = 0;
2119                 *rpos++ = 0;
2120                 added += 2;
2121                 start[1] += 2;
2122                 rend = rpos;
2123         } else {
2124                 /* Skip RSN Capabilities */
2125                 rpos += 2;
2126                 if (rpos > rend) {
2127                         wpa_printf(MSG_ERROR, "FT: Could not parse RSN IE in "
2128                                    "IEs data");
2129                         return -1;
2130                 }
2131         }
2132
2133         if (rpos == rend) {
2134                 /* No PMKID-Count field included; add it */
2135                 os_memmove(rpos + 2 + PMKID_LEN, rpos, end + added - rpos);
2136                 WPA_PUT_LE16(rpos, 1);
2137                 rpos += 2;
2138                 os_memcpy(rpos, pmkid, PMKID_LEN);
2139                 added += 2 + PMKID_LEN;
2140                 start[1] += 2 + PMKID_LEN;
2141         } else {
2142                 u16 num_pmkid;
2143
2144                 if (rend - rpos < 2)
2145                         return -1;
2146                 num_pmkid = WPA_GET_LE16(rpos);
2147                 /* PMKID-Count was included; use it */
2148                 if (num_pmkid != 0) {
2149                         u8 *after;
2150
2151                         if (num_pmkid * PMKID_LEN > rend - rpos - 2)
2152                                 return -1;
2153                         /*
2154                          * PMKID may have been included in RSN IE in
2155                          * (Re)Association Request frame, so remove the old
2156                          * PMKID(s) first before adding the new one.
2157                          */
2158                         wpa_printf(MSG_DEBUG,
2159                                    "FT: Remove %u old PMKID(s) from RSN IE",
2160                                    num_pmkid);
2161                         after = rpos + 2 + num_pmkid * PMKID_LEN;
2162                         os_memmove(rpos + 2, after, rend - after);
2163                         start[1] -= num_pmkid * PMKID_LEN;
2164                         added -= num_pmkid * PMKID_LEN;
2165                 }
2166                 WPA_PUT_LE16(rpos, 1);
2167                 rpos += 2;
2168                 os_memmove(rpos + PMKID_LEN, rpos, end + added - rpos);
2169                 os_memcpy(rpos, pmkid, PMKID_LEN);
2170                 added += PMKID_LEN;
2171                 start[1] += PMKID_LEN;
2172         }
2173
2174         wpa_hexdump(MSG_DEBUG, "FT: RSN IE after modification "
2175                     "(PMKID inserted)", start, 2 + start[1]);
2176
2177         *ies_len += added;
2178
2179         return 0;
2180 }
2181 #endif /* CONFIG_IEEE80211R || CONFIG_FILS */
2182
2183
2184 int wpa_cipher_key_len(int cipher)
2185 {
2186         switch (cipher) {
2187         case WPA_CIPHER_CCMP_256:
2188         case WPA_CIPHER_GCMP_256:
2189         case WPA_CIPHER_BIP_GMAC_256:
2190         case WPA_CIPHER_BIP_CMAC_256:
2191                 return 32;
2192         case WPA_CIPHER_CCMP:
2193         case WPA_CIPHER_GCMP:
2194         case WPA_CIPHER_AES_128_CMAC:
2195         case WPA_CIPHER_BIP_GMAC_128:
2196                 return 16;
2197         case WPA_CIPHER_TKIP:
2198                 return 32;
2199         }
2200
2201         return 0;
2202 }
2203
2204
2205 int wpa_cipher_rsc_len(int cipher)
2206 {
2207         switch (cipher) {
2208         case WPA_CIPHER_CCMP_256:
2209         case WPA_CIPHER_GCMP_256:
2210         case WPA_CIPHER_CCMP:
2211         case WPA_CIPHER_GCMP:
2212         case WPA_CIPHER_TKIP:
2213                 return 6;
2214         }
2215
2216         return 0;
2217 }
2218
2219
2220 enum wpa_alg wpa_cipher_to_alg(int cipher)
2221 {
2222         switch (cipher) {
2223         case WPA_CIPHER_CCMP_256:
2224                 return WPA_ALG_CCMP_256;
2225         case WPA_CIPHER_GCMP_256:
2226                 return WPA_ALG_GCMP_256;
2227         case WPA_CIPHER_CCMP:
2228                 return WPA_ALG_CCMP;
2229         case WPA_CIPHER_GCMP:
2230                 return WPA_ALG_GCMP;
2231         case WPA_CIPHER_TKIP:
2232                 return WPA_ALG_TKIP;
2233         case WPA_CIPHER_AES_128_CMAC:
2234                 return WPA_ALG_IGTK;
2235         case WPA_CIPHER_BIP_GMAC_128:
2236                 return WPA_ALG_BIP_GMAC_128;
2237         case WPA_CIPHER_BIP_GMAC_256:
2238                 return WPA_ALG_BIP_GMAC_256;
2239         case WPA_CIPHER_BIP_CMAC_256:
2240                 return WPA_ALG_BIP_CMAC_256;
2241         }
2242         return WPA_ALG_NONE;
2243 }
2244
2245
2246 int wpa_cipher_valid_pairwise(int cipher)
2247 {
2248         return cipher == WPA_CIPHER_CCMP_256 ||
2249                 cipher == WPA_CIPHER_GCMP_256 ||
2250                 cipher == WPA_CIPHER_CCMP ||
2251                 cipher == WPA_CIPHER_GCMP ||
2252                 cipher == WPA_CIPHER_TKIP;
2253 }
2254
2255
2256 u32 wpa_cipher_to_suite(int proto, int cipher)
2257 {
2258         if (cipher & WPA_CIPHER_CCMP_256)
2259                 return RSN_CIPHER_SUITE_CCMP_256;
2260         if (cipher & WPA_CIPHER_GCMP_256)
2261                 return RSN_CIPHER_SUITE_GCMP_256;
2262         if (cipher & WPA_CIPHER_CCMP)
2263                 return (proto == WPA_PROTO_RSN ?
2264                         RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
2265         if (cipher & WPA_CIPHER_GCMP)
2266                 return RSN_CIPHER_SUITE_GCMP;
2267         if (cipher & WPA_CIPHER_TKIP)
2268                 return (proto == WPA_PROTO_RSN ?
2269                         RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
2270         if (cipher & WPA_CIPHER_NONE)
2271                 return (proto == WPA_PROTO_RSN ?
2272                         RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
2273         if (cipher & WPA_CIPHER_GTK_NOT_USED)
2274                 return RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED;
2275         if (cipher & WPA_CIPHER_AES_128_CMAC)
2276                 return RSN_CIPHER_SUITE_AES_128_CMAC;
2277         if (cipher & WPA_CIPHER_BIP_GMAC_128)
2278                 return RSN_CIPHER_SUITE_BIP_GMAC_128;
2279         if (cipher & WPA_CIPHER_BIP_GMAC_256)
2280                 return RSN_CIPHER_SUITE_BIP_GMAC_256;
2281         if (cipher & WPA_CIPHER_BIP_CMAC_256)
2282                 return RSN_CIPHER_SUITE_BIP_CMAC_256;
2283         return 0;
2284 }
2285
2286
2287 int rsn_cipher_put_suites(u8 *start, int ciphers)
2288 {
2289         u8 *pos = start;
2290
2291         if (ciphers & WPA_CIPHER_CCMP_256) {
2292                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP_256);
2293                 pos += RSN_SELECTOR_LEN;
2294         }
2295         if (ciphers & WPA_CIPHER_GCMP_256) {
2296                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
2297                 pos += RSN_SELECTOR_LEN;
2298         }
2299         if (ciphers & WPA_CIPHER_CCMP) {
2300                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2301                 pos += RSN_SELECTOR_LEN;
2302         }
2303         if (ciphers & WPA_CIPHER_GCMP) {
2304                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
2305                 pos += RSN_SELECTOR_LEN;
2306         }
2307         if (ciphers & WPA_CIPHER_TKIP) {
2308                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
2309                 pos += RSN_SELECTOR_LEN;
2310         }
2311         if (ciphers & WPA_CIPHER_NONE) {
2312                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
2313                 pos += RSN_SELECTOR_LEN;
2314         }
2315
2316         return (pos - start) / RSN_SELECTOR_LEN;
2317 }
2318
2319
2320 int wpa_cipher_put_suites(u8 *start, int ciphers)
2321 {
2322         u8 *pos = start;
2323
2324         if (ciphers & WPA_CIPHER_CCMP) {
2325                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
2326                 pos += WPA_SELECTOR_LEN;
2327         }
2328         if (ciphers & WPA_CIPHER_TKIP) {
2329                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
2330                 pos += WPA_SELECTOR_LEN;
2331         }
2332         if (ciphers & WPA_CIPHER_NONE) {
2333                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
2334                 pos += WPA_SELECTOR_LEN;
2335         }
2336
2337         return (pos - start) / RSN_SELECTOR_LEN;
2338 }
2339
2340
2341 int wpa_pick_pairwise_cipher(int ciphers, int none_allowed)
2342 {
2343         if (ciphers & WPA_CIPHER_CCMP_256)
2344                 return WPA_CIPHER_CCMP_256;
2345         if (ciphers & WPA_CIPHER_GCMP_256)
2346                 return WPA_CIPHER_GCMP_256;
2347         if (ciphers & WPA_CIPHER_CCMP)
2348                 return WPA_CIPHER_CCMP;
2349         if (ciphers & WPA_CIPHER_GCMP)
2350                 return WPA_CIPHER_GCMP;
2351         if (ciphers & WPA_CIPHER_TKIP)
2352                 return WPA_CIPHER_TKIP;
2353         if (none_allowed && (ciphers & WPA_CIPHER_NONE))
2354                 return WPA_CIPHER_NONE;
2355         return -1;
2356 }
2357
2358
2359 int wpa_pick_group_cipher(int ciphers)
2360 {
2361         if (ciphers & WPA_CIPHER_CCMP_256)
2362                 return WPA_CIPHER_CCMP_256;
2363         if (ciphers & WPA_CIPHER_GCMP_256)
2364                 return WPA_CIPHER_GCMP_256;
2365         if (ciphers & WPA_CIPHER_CCMP)
2366                 return WPA_CIPHER_CCMP;
2367         if (ciphers & WPA_CIPHER_GCMP)
2368                 return WPA_CIPHER_GCMP;
2369         if (ciphers & WPA_CIPHER_GTK_NOT_USED)
2370                 return WPA_CIPHER_GTK_NOT_USED;
2371         if (ciphers & WPA_CIPHER_TKIP)
2372                 return WPA_CIPHER_TKIP;
2373         return -1;
2374 }
2375
2376
2377 int wpa_parse_cipher(const char *value)
2378 {
2379         int val = 0, last;
2380         char *start, *end, *buf;
2381
2382         buf = os_strdup(value);
2383         if (buf == NULL)
2384                 return -1;
2385         start = buf;
2386
2387         while (*start != '\0') {
2388                 while (*start == ' ' || *start == '\t')
2389                         start++;
2390                 if (*start == '\0')
2391                         break;
2392                 end = start;
2393                 while (*end != ' ' && *end != '\t' && *end != '\0')
2394                         end++;
2395                 last = *end == '\0';
2396                 *end = '\0';
2397                 if (os_strcmp(start, "CCMP-256") == 0)
2398                         val |= WPA_CIPHER_CCMP_256;
2399                 else if (os_strcmp(start, "GCMP-256") == 0)
2400                         val |= WPA_CIPHER_GCMP_256;
2401                 else if (os_strcmp(start, "CCMP") == 0)
2402                         val |= WPA_CIPHER_CCMP;
2403                 else if (os_strcmp(start, "GCMP") == 0)
2404                         val |= WPA_CIPHER_GCMP;
2405                 else if (os_strcmp(start, "TKIP") == 0)
2406                         val |= WPA_CIPHER_TKIP;
2407                 else if (os_strcmp(start, "WEP104") == 0)
2408                         val |= WPA_CIPHER_WEP104;
2409                 else if (os_strcmp(start, "WEP40") == 0)
2410                         val |= WPA_CIPHER_WEP40;
2411                 else if (os_strcmp(start, "NONE") == 0)
2412                         val |= WPA_CIPHER_NONE;
2413                 else if (os_strcmp(start, "GTK_NOT_USED") == 0)
2414                         val |= WPA_CIPHER_GTK_NOT_USED;
2415                 else if (os_strcmp(start, "AES-128-CMAC") == 0)
2416                         val |= WPA_CIPHER_AES_128_CMAC;
2417                 else if (os_strcmp(start, "BIP-GMAC-128") == 0)
2418                         val |= WPA_CIPHER_BIP_GMAC_128;
2419                 else if (os_strcmp(start, "BIP-GMAC-256") == 0)
2420                         val |= WPA_CIPHER_BIP_GMAC_256;
2421                 else if (os_strcmp(start, "BIP-CMAC-256") == 0)
2422                         val |= WPA_CIPHER_BIP_CMAC_256;
2423                 else {
2424                         os_free(buf);
2425                         return -1;
2426                 }
2427
2428                 if (last)
2429                         break;
2430                 start = end + 1;
2431         }
2432         os_free(buf);
2433
2434         return val;
2435 }
2436
2437
2438 int wpa_write_ciphers(char *start, char *end, int ciphers, const char *delim)
2439 {
2440         char *pos = start;
2441         int ret;
2442
2443         if (ciphers & WPA_CIPHER_CCMP_256) {
2444                 ret = os_snprintf(pos, end - pos, "%sCCMP-256",
2445                                   pos == start ? "" : delim);
2446                 if (os_snprintf_error(end - pos, ret))
2447                         return -1;
2448                 pos += ret;
2449         }
2450         if (ciphers & WPA_CIPHER_GCMP_256) {
2451                 ret = os_snprintf(pos, end - pos, "%sGCMP-256",
2452                                   pos == start ? "" : delim);
2453                 if (os_snprintf_error(end - pos, ret))
2454                         return -1;
2455                 pos += ret;
2456         }
2457         if (ciphers & WPA_CIPHER_CCMP) {
2458                 ret = os_snprintf(pos, end - pos, "%sCCMP",
2459                                   pos == start ? "" : delim);
2460                 if (os_snprintf_error(end - pos, ret))
2461                         return -1;
2462                 pos += ret;
2463         }
2464         if (ciphers & WPA_CIPHER_GCMP) {
2465                 ret = os_snprintf(pos, end - pos, "%sGCMP",
2466                                   pos == start ? "" : delim);
2467                 if (os_snprintf_error(end - pos, ret))
2468                         return -1;
2469                 pos += ret;
2470         }
2471         if (ciphers & WPA_CIPHER_TKIP) {
2472                 ret = os_snprintf(pos, end - pos, "%sTKIP",
2473                                   pos == start ? "" : delim);
2474                 if (os_snprintf_error(end - pos, ret))
2475                         return -1;
2476                 pos += ret;
2477         }
2478         if (ciphers & WPA_CIPHER_AES_128_CMAC) {
2479                 ret = os_snprintf(pos, end - pos, "%sAES-128-CMAC",
2480                                   pos == start ? "" : delim);
2481                 if (os_snprintf_error(end - pos, ret))
2482                         return -1;
2483                 pos += ret;
2484         }
2485         if (ciphers & WPA_CIPHER_BIP_GMAC_128) {
2486                 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-128",
2487                                   pos == start ? "" : delim);
2488                 if (os_snprintf_error(end - pos, ret))
2489                         return -1;
2490                 pos += ret;
2491         }
2492         if (ciphers & WPA_CIPHER_BIP_GMAC_256) {
2493                 ret = os_snprintf(pos, end - pos, "%sBIP-GMAC-256",
2494                                   pos == start ? "" : delim);
2495                 if (os_snprintf_error(end - pos, ret))
2496                         return -1;
2497                 pos += ret;
2498         }
2499         if (ciphers & WPA_CIPHER_BIP_CMAC_256) {
2500                 ret = os_snprintf(pos, end - pos, "%sBIP-CMAC-256",
2501                                   pos == start ? "" : delim);
2502                 if (os_snprintf_error(end - pos, ret))
2503                         return -1;
2504                 pos += ret;
2505         }
2506         if (ciphers & WPA_CIPHER_NONE) {
2507                 ret = os_snprintf(pos, end - pos, "%sNONE",
2508                                   pos == start ? "" : delim);
2509                 if (os_snprintf_error(end - pos, ret))
2510                         return -1;
2511                 pos += ret;
2512         }
2513
2514         return pos - start;
2515 }
2516
2517
2518 int wpa_select_ap_group_cipher(int wpa, int wpa_pairwise, int rsn_pairwise)
2519 {
2520         int pairwise = 0;
2521
2522         /* Select group cipher based on the enabled pairwise cipher suites */
2523         if (wpa & 1)
2524                 pairwise |= wpa_pairwise;
2525         if (wpa & 2)
2526                 pairwise |= rsn_pairwise;
2527
2528         if (pairwise & WPA_CIPHER_TKIP)
2529                 return WPA_CIPHER_TKIP;
2530         if ((pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP)
2531                 return WPA_CIPHER_GCMP;
2532         if ((pairwise & (WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP |
2533                          WPA_CIPHER_GCMP)) == WPA_CIPHER_GCMP_256)
2534                 return WPA_CIPHER_GCMP_256;
2535         if ((pairwise & (WPA_CIPHER_CCMP_256 | WPA_CIPHER_CCMP |
2536                          WPA_CIPHER_GCMP)) == WPA_CIPHER_CCMP_256)
2537                 return WPA_CIPHER_CCMP_256;
2538         return WPA_CIPHER_CCMP;
2539 }
2540
2541
2542 #ifdef CONFIG_FILS
2543 int fils_domain_name_hash(const char *domain, u8 *hash)
2544 {
2545         char buf[255], *wpos = buf;
2546         const char *pos = domain;
2547         size_t len;
2548         const u8 *addr[1];
2549         u8 mac[SHA256_MAC_LEN];
2550
2551         for (len = 0; len < sizeof(buf) && *pos; len++) {
2552                 if (isalpha(*pos) && isupper(*pos))
2553                         *wpos++ = tolower(*pos);
2554                 else
2555                         *wpos++ = *pos;
2556                 pos++;
2557         }
2558
2559         addr[0] = (const u8 *) buf;
2560         if (sha256_vector(1, addr, &len, mac) < 0)
2561                 return -1;
2562         os_memcpy(hash, mac, 2);
2563         return 0;
2564 }
2565 #endif /* CONFIG_FILS */