contrib/wpa/src/rsn_supp/wpa.c

   1 /*
   2  * WPA Supplicant - WPA state machine and EAPOL-Key processing
   3  * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>
   4  * Copyright(c) 2015 Intel Deutschland GmbH
   5  *
   6  * This software may be distributed under the terms of the BSD license.
   7  * See README for more details.
   8  */
   9
  10 #include "includes.h"
  11
  12 #include "common.h"
  13 #include "crypto/aes.h"
  14 #include "crypto/aes_wrap.h"
  15 #include "crypto/crypto.h"
  16 #include "crypto/random.h"
  17 #include "crypto/aes_siv.h"
  18 #include "crypto/sha256.h"
  19 #include "crypto/sha384.h"
  20 #include "crypto/sha512.h"
  21 #include "common/ieee802_11_defs.h"
  22 #include "common/ieee802_11_common.h"
  23 #include "eap_common/eap_defs.h"
  24 #include "eapol_supp/eapol_supp_sm.h"
  25 #include "wpa.h"
  26 #include "eloop.h"
  27 #include "preauth.h"
  28 #include "pmksa_cache.h"
  29 #include "wpa_i.h"
  30 #include "wpa_ie.h"
  31
  32
  33 static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
  34
  35
  36 /**
  37  * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message
  38  * @sm: Pointer to WPA state machine data from wpa_sm_init()
  39  * @ptk: PTK for Key Confirmation/Encryption Key
  40  * @ver: Version field from Key Info
  41  * @dest: Destination address for the frame
  42  * @proto: Ethertype (usually ETH_P_EAPOL)
  43  * @msg: EAPOL-Key message
  44  * @msg_len: Length of message
  45  * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written
  46  * Returns: >= 0 on success, < 0 on failure
  47  */
  48 int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,
  49                        int ver, const u8 *dest, u16 proto,
  50                        u8 *msg, size_t msg_len, u8 *key_mic)
  51 {
  52         int ret = -1;
  53         size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
  54
  55         wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR
  56                    " ver=%d mic_len=%d key_mgmt=0x%x",
  57                    MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);
  58         if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {
  59                 /*
  60                  * Association event was not yet received; try to fetch
  61                  * BSSID from the driver.
  62                  */
  63                 if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {
  64                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  65                                 "WPA: Failed to read BSSID for "
  66                                 "EAPOL-Key destination address");
  67                 } else {
  68                         dest = sm->bssid;
  69                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
  70                                 "WPA: Use BSSID (" MACSTR
  71                                 ") as the destination for EAPOL-Key",
  72                                 MAC2STR(dest));
  73                 }
  74         }
  75
  76         if (mic_len) {
  77                 if (key_mic && (!ptk || !ptk->kck_len))
  78                         goto out;
  79
  80                 if (key_mic &&
  81                     wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt, ver,
  82                                       msg, msg_len, key_mic)) {
  83                         wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
  84                                 "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",
  85                                 ver, sm->key_mgmt);
  86                         goto out;
  87                 }
  88                 if (ptk)
  89                         wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",
  90                                         ptk->kck, ptk->kck_len);
  91                 wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",
  92                             key_mic, mic_len);
  93         } else {
  94 #ifdef CONFIG_FILS
  95                 /* AEAD cipher - Key MIC field not used */
  96                 struct ieee802_1x_hdr *s_hdr, *hdr;
  97                 struct wpa_eapol_key *s_key, *key;
  98                 u8 *buf, *s_key_data, *key_data;
  99                 size_t buf_len = msg_len + AES_BLOCK_SIZE;
 100                 size_t key_data_len;
 101                 u16 eapol_len;
 102                 const u8 *aad[1];
 103                 size_t aad_len[1];
 104
 105                 if (!ptk || !ptk->kek_len)
 106                         goto out;
 107
 108                 key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -
 109                         sizeof(struct wpa_eapol_key) - 2;
 110
 111                 buf = os_malloc(buf_len);
 112                 if (!buf)
 113                         goto out;
 114
 115                 os_memcpy(buf, msg, msg_len);
 116                 hdr = (struct ieee802_1x_hdr *) buf;
 117                 key = (struct wpa_eapol_key *) (hdr + 1);
 118                 key_data = ((u8 *) (key + 1)) + 2;
 119
 120                 /* Update EAPOL header to include AES-SIV overhead */
 121                 eapol_len = be_to_host16(hdr->length);
 122                 eapol_len += AES_BLOCK_SIZE;
 123                 hdr->length = host_to_be16(eapol_len);
 124
 125                 /* Update Key Data Length field to include AES-SIV overhead */
 126                 WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);
 127
 128                 s_hdr = (struct ieee802_1x_hdr *) msg;
 129                 s_key = (struct wpa_eapol_key *) (s_hdr + 1);
 130                 s_key_data = ((u8 *) (s_key + 1)) + 2;
 131
 132                 wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",
 133                                 s_key_data, key_data_len);
 134
 135                 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
 136                  /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
 137                   * to Key Data (exclusive). */
 138                 aad[0] = buf;
 139                 aad_len[0] = key_data - buf;
 140                 if (aes_siv_encrypt(ptk->kek, ptk->kek_len,
 141                                     s_key_data, key_data_len,
 142                                     1, aad, aad_len, key_data) < 0) {
 143                         os_free(buf);
 144                         goto out;
 145                 }
 146
 147                 wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",
 148                             key_data, AES_BLOCK_SIZE + key_data_len);
 149
 150                 os_free(msg);
 151                 msg = buf;
 152                 msg_len = buf_len;
 153 #else /* CONFIG_FILS */
 154                 goto out;
 155 #endif /* CONFIG_FILS */
 156         }
 157
 158         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);
 159         ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);
 160         eapol_sm_notify_tx_eapol_key(sm->eapol);
 161 out:
 162         os_free(msg);
 163         return ret;
 164 }
 165
 166
 167 /**
 168  * wpa_sm_key_request - Send EAPOL-Key Request
 169  * @sm: Pointer to WPA state machine data from wpa_sm_init()
 170  * @error: Indicate whether this is an Michael MIC error report
 171  * @pairwise: 1 = error report for pairwise packet, 0 = for group packet
 172  *
 173  * Send an EAPOL-Key Request to the current authenticator. This function is
 174  * used to request rekeying and it is usually called when a local Michael MIC
 175  * failure is detected.
 176  */
 177 void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)
 178 {
 179         size_t mic_len, hdrlen, rlen;
 180         struct wpa_eapol_key *reply;
 181         int key_info, ver;
 182         u8 bssid[ETH_ALEN], *rbuf, *key_mic, *mic;
 183
 184         if (wpa_use_akm_defined(sm->key_mgmt))
 185                 ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;
 186         else if (wpa_key_mgmt_ft(sm->key_mgmt) ||
 187                  wpa_key_mgmt_sha256(sm->key_mgmt))
 188                 ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;
 189         else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
 190                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
 191         else
 192                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
 193
 194         if (wpa_sm_get_bssid(sm, bssid) < 0) {
 195                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 196                         "Failed to read BSSID for EAPOL-Key request");
 197                 return;
 198         }
 199
 200         mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
 201         hdrlen = sizeof(*reply) + mic_len + 2;
 202         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
 203                                   hdrlen, &rlen, (void *) &reply);
 204         if (rbuf == NULL)
 205                 return;
 206
 207         reply->type = (sm->proto == WPA_PROTO_RSN ||
 208                        sm->proto == WPA_PROTO_OSEN) ?
 209                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
 210         key_info = WPA_KEY_INFO_REQUEST | ver;
 211         if (sm->ptk_set)
 212                 key_info |= WPA_KEY_INFO_SECURE;
 213         if (sm->ptk_set && mic_len)
 214                 key_info |= WPA_KEY_INFO_MIC;
 215         if (error)
 216                 key_info |= WPA_KEY_INFO_ERROR;
 217         if (pairwise)
 218                 key_info |= WPA_KEY_INFO_KEY_TYPE;
 219         WPA_PUT_BE16(reply->key_info, key_info);
 220         WPA_PUT_BE16(reply->key_length, 0);
 221         os_memcpy(reply->replay_counter, sm->request_counter,
 222                   WPA_REPLAY_COUNTER_LEN);
 223         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
 224
 225         mic = (u8 *) (reply + 1);
 226         WPA_PUT_BE16(mic + mic_len, 0);
 227         if (!(key_info & WPA_KEY_INFO_MIC))
 228                 key_mic = NULL;
 229         else
 230                 key_mic = mic;
 231
 232         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
 233                 "WPA: Sending EAPOL-Key Request (error=%d "
 234                 "pairwise=%d ptk_set=%d len=%lu)",
 235                 error, pairwise, sm->ptk_set, (unsigned long) rlen);
 236         wpa_eapol_key_send(sm, &sm->ptk, ver, bssid, ETH_P_EAPOL, rbuf, rlen,
 237                            key_mic);
 238 }
 239
 240
 241 static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)
 242 {
 243 #ifdef CONFIG_IEEE80211R
 244         if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {
 245                 if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))
 246                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 247                                 "RSN: Cannot set low order 256 bits of MSK for key management offload");
 248         } else {
 249 #endif /* CONFIG_IEEE80211R */
 250                 if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))
 251                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 252                                 "RSN: Cannot set PMK for key management offload");
 253 #ifdef CONFIG_IEEE80211R
 254         }
 255 #endif /* CONFIG_IEEE80211R */
 256 }
 257
 258
 259 static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
 260                                   const unsigned char *src_addr,
 261                                   const u8 *pmkid)
 262 {
 263         int abort_cached = 0;
 264
 265         if (pmkid && !sm->cur_pmksa) {
 266                 /* When using drivers that generate RSN IE, wpa_supplicant may
 267                  * not have enough time to get the association information
 268                  * event before receiving this 1/4 message, so try to find a
 269                  * matching PMKSA cache entry here. */
 270                 sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid,
 271                                                 NULL, 0);
 272                 if (sm->cur_pmksa) {
 273                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 274                                 "RSN: found matching PMKID from PMKSA cache");
 275                 } else {
 276                         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 277                                 "RSN: no matching PMKID found");
 278                         abort_cached = 1;
 279                 }
 280         }
 281
 282         if (pmkid && sm->cur_pmksa &&
 283             os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {
 284                 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
 285                 wpa_sm_set_pmk_from_pmksa(sm);
 286                 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
 287                                 sm->pmk, sm->pmk_len);
 288                 eapol_sm_notify_cached(sm->eapol);
 289 #ifdef CONFIG_IEEE80211R
 290                 sm->xxkey_len = 0;
 291 #ifdef CONFIG_SAE
 292                 if (sm->key_mgmt == WPA_KEY_MGMT_FT_SAE &&
 293                     sm->pmk_len == PMK_LEN) {
 294                         /* Need to allow FT key derivation to proceed with
 295                          * PMK from SAE being used as the XXKey in cases where
 296                          * the PMKID in msg 1/4 matches the PMKSA entry that was
 297                          * just added based on SAE authentication for the
 298                          * initial mobility domain association. */
 299                         os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);
 300                         sm->xxkey_len = sm->pmk_len;
 301                 }
 302 #endif /* CONFIG_SAE */
 303 #endif /* CONFIG_IEEE80211R */
 304         } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {
 305                 int res, pmk_len;
 306
 307                 if (wpa_key_mgmt_sha384(sm->key_mgmt))
 308                         pmk_len = PMK_LEN_SUITE_B_192;
 309                 else
 310                         pmk_len = PMK_LEN;
 311                 res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);
 312                 if (res) {
 313                         if (pmk_len == PMK_LEN) {
 314                                 /*
 315                                  * EAP-LEAP is an exception from other EAP
 316                                  * methods: it uses only 16-byte PMK.
 317                                  */
 318                                 res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);
 319                                 pmk_len = 16;
 320                         }
 321                 } else {
 322 #ifdef CONFIG_IEEE80211R
 323                         u8 buf[2 * PMK_LEN];
 324                         if (eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0)
 325                         {
 326                                 if (wpa_key_mgmt_sha384(sm->key_mgmt)) {
 327                                         os_memcpy(sm->xxkey, buf,
 328                                                   SHA384_MAC_LEN);
 329                                         sm->xxkey_len = SHA384_MAC_LEN;
 330                                 } else {
 331                                         os_memcpy(sm->xxkey, buf + PMK_LEN,
 332                                                   PMK_LEN);
 333                                         sm->xxkey_len = PMK_LEN;
 334                                 }
 335                                 os_memset(buf, 0, sizeof(buf));
 336                         }
 337 #endif /* CONFIG_IEEE80211R */
 338                 }
 339                 if (res == 0) {
 340                         struct rsn_pmksa_cache_entry *sa = NULL;
 341                         const u8 *fils_cache_id = NULL;
 342
 343 #ifdef CONFIG_FILS
 344                         if (sm->fils_cache_id_set)
 345                                 fils_cache_id = sm->fils_cache_id;
 346 #endif /* CONFIG_FILS */
 347
 348                         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
 349                                         "machines", sm->pmk, pmk_len);
 350                         sm->pmk_len = pmk_len;
 351                         wpa_supplicant_key_mgmt_set_pmk(sm);
 352                         if (sm->proto == WPA_PROTO_RSN &&
 353                             !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
 354                             !wpa_key_mgmt_ft(sm->key_mgmt)) {
 355                                 sa = pmksa_cache_add(sm->pmksa,
 356                                                      sm->pmk, pmk_len, NULL,
 357                                                      NULL, 0,
 358                                                      src_addr, sm->own_addr,
 359                                                      sm->network_ctx,
 360                                                      sm->key_mgmt,
 361                                                      fils_cache_id);
 362                         }
 363                         if (!sm->cur_pmksa && pmkid &&
 364                             pmksa_cache_get(sm->pmksa, src_addr, pmkid, NULL,
 365                                     0)) {
 366                                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 367                                         "RSN: the new PMK matches with the "
 368                                         "PMKID");
 369                                 abort_cached = 0;
 370                         } else if (sa && !sm->cur_pmksa && pmkid) {
 371                                 /*
 372                                  * It looks like the authentication server
 373                                  * derived mismatching MSK. This should not
 374                                  * really happen, but bugs happen.. There is not
 375                                  * much we can do here without knowing what
 376                                  * exactly caused the server to misbehave.
 377                                  */
 378                                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
 379                                         "RSN: PMKID mismatch - authentication server may have derived different MSK?!");
 380                                 return -1;
 381                         }
 382
 383                         if (!sm->cur_pmksa)
 384                                 sm->cur_pmksa = sa;
 385                 } else {
 386                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 387                                 "WPA: Failed to get master session key from "
 388                                 "EAPOL state machines - key handshake "
 389                                 "aborted");
 390                         if (sm->cur_pmksa) {
 391                                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 392                                         "RSN: Cancelled PMKSA caching "
 393                                         "attempt");
 394                                 sm->cur_pmksa = NULL;
 395                                 abort_cached = 1;
 396                         } else if (!abort_cached) {
 397                                 return -1;
 398                         }
 399                 }
 400         }
 401
 402         if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&
 403             !wpa_key_mgmt_suite_b(sm->key_mgmt) &&
 404             !wpa_key_mgmt_ft(sm->key_mgmt) && sm->key_mgmt != WPA_KEY_MGMT_OSEN)
 405         {
 406                 /* Send EAPOL-Start to trigger full EAP authentication. */
 407                 u8 *buf;
 408                 size_t buflen;
 409
 410                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 411                         "RSN: no PMKSA entry found - trigger "
 412                         "full EAP authentication");
 413                 buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,
 414                                          NULL, 0, &buflen, NULL);
 415                 if (buf) {
 416                         wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,
 417                                           buf, buflen);
 418                         os_free(buf);
 419                         return -2;
 420                 }
 421
 422                 return -1;
 423         }
 424
 425         return 0;
 426 }
 427
 428
 429 /**
 430  * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake
 431  * @sm: Pointer to WPA state machine data from wpa_sm_init()
 432  * @dst: Destination address for the frame
 433  * @key: Pointer to the EAPOL-Key frame header
 434  * @ver: Version bits from EAPOL-Key Key Info
 435  * @nonce: Nonce value for the EAPOL-Key frame
 436  * @wpa_ie: WPA/RSN IE
 437  * @wpa_ie_len: Length of the WPA/RSN IE
 438  * @ptk: PTK to use for keyed hash and encryption
 439  * Returns: >= 0 on success, < 0 on failure
 440  */
 441 int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,
 442                                const struct wpa_eapol_key *key,
 443                                int ver, const u8 *nonce,
 444                                const u8 *wpa_ie, size_t wpa_ie_len,
 445                                struct wpa_ptk *ptk)
 446 {
 447         size_t mic_len, hdrlen, rlen;
 448         struct wpa_eapol_key *reply;
 449         u8 *rbuf, *key_mic;
 450         u8 *rsn_ie_buf = NULL;
 451         u16 key_info;
 452
 453         if (wpa_ie == NULL) {
 454                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "
 455                         "cannot generate msg 2/4");
 456                 return -1;
 457         }
 458
 459 #ifdef CONFIG_IEEE80211R
 460         if (wpa_key_mgmt_ft(sm->key_mgmt)) {
 461                 int res;
 462
 463                 /*
 464                  * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and
 465                  * FTIE from (Re)Association Response.
 466                  */
 467                 rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +
 468                                        sm->assoc_resp_ies_len);
 469                 if (rsn_ie_buf == NULL)
 470                         return -1;
 471                 os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);
 472                 res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,
 473                                        sm->pmk_r1_name);
 474                 if (res < 0) {
 475                         os_free(rsn_ie_buf);
 476                         return -1;
 477                 }
 478
 479                 if (sm->assoc_resp_ies) {
 480                         os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,
 481                                   sm->assoc_resp_ies_len);
 482                         wpa_ie_len += sm->assoc_resp_ies_len;
 483                 }
 484
 485                 wpa_ie = rsn_ie_buf;
 486         }
 487 #endif /* CONFIG_IEEE80211R */
 488
 489         wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
 490
 491         mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
 492         hdrlen = sizeof(*reply) + mic_len + 2;
 493         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
 494                                   NULL, hdrlen + wpa_ie_len,
 495                                   &rlen, (void *) &reply);
 496         if (rbuf == NULL) {
 497                 os_free(rsn_ie_buf);
 498                 return -1;
 499         }
 500
 501         reply->type = (sm->proto == WPA_PROTO_RSN ||
 502                        sm->proto == WPA_PROTO_OSEN) ?
 503                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
 504         key_info = ver | WPA_KEY_INFO_KEY_TYPE;
 505         if (mic_len)
 506                 key_info |= WPA_KEY_INFO_MIC;
 507         else
 508                 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
 509         WPA_PUT_BE16(reply->key_info, key_info);
 510         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
 511                 WPA_PUT_BE16(reply->key_length, 0);
 512         else
 513                 os_memcpy(reply->key_length, key->key_length, 2);
 514         os_memcpy(reply->replay_counter, key->replay_counter,
 515                   WPA_REPLAY_COUNTER_LEN);
 516         wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,
 517                     WPA_REPLAY_COUNTER_LEN);
 518
 519         key_mic = (u8 *) (reply + 1);
 520         WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len); /* Key Data Length */
 521         os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */
 522         os_free(rsn_ie_buf);
 523
 524         os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);
 525
 526         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
 527         return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
 528                                   key_mic);
 529 }
 530
 531
 532 static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,
 533                           const struct wpa_eapol_key *key, struct wpa_ptk *ptk)
 534 {
 535 #ifdef CONFIG_IEEE80211R
 536         if (wpa_key_mgmt_ft(sm->key_mgmt))
 537                 return wpa_derive_ptk_ft(sm, src_addr, key, ptk);
 538 #endif /* CONFIG_IEEE80211R */
 539
 540         return wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",
 541                               sm->own_addr, sm->bssid, sm->snonce,
 542                               key->key_nonce, ptk, sm->key_mgmt,
 543                               sm->pairwise_cipher);
 544 }
 545
 546
 547 static void wpa_supplicant_process_1_of_4(struct wpa_sm *sm,
 548                                           const unsigned char *src_addr,
 549                                           const struct wpa_eapol_key *key,
 550                                           u16 ver, const u8 *key_data,
 551                                           size_t key_data_len)
 552 {
 553         struct wpa_eapol_ie_parse ie;
 554         struct wpa_ptk *ptk;
 555         int res;
 556         u8 *kde, *kde_buf = NULL;
 557         size_t kde_len;
 558
 559         if (wpa_sm_get_network_ctx(sm) == NULL) {
 560                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No SSID info "
 561                         "found (msg 1 of 4)");
 562                 return;
 563         }
 564
 565         wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
 566         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of 4-Way "
 567                 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
 568
 569         os_memset(&ie, 0, sizeof(ie));
 570
 571         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
 572                 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
 573                 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
 574                             key_data, key_data_len);
 575                 if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
 576                         goto failed;
 577                 if (ie.pmkid) {
 578                         wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
 579                                     "Authenticator", ie.pmkid, PMKID_LEN);
 580                 }
 581         }
 582
 583         res = wpa_supplicant_get_pmk(sm, src_addr, ie.pmkid);
 584         if (res == -2) {
 585                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: Do not reply to "
 586                         "msg 1/4 - requesting full EAP authentication");
 587                 return;
 588         }
 589         if (res)
 590                 goto failed;
 591
 592         if (sm->renew_snonce) {
 593                 if (random_get_bytes(sm->snonce, WPA_NONCE_LEN)) {
 594                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 595                                 "WPA: Failed to get random data for SNonce");
 596                         goto failed;
 597                 }
 598                 sm->renew_snonce = 0;
 599                 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
 600                             sm->snonce, WPA_NONCE_LEN);
 601         }
 602
 603         /* Calculate PTK which will be stored as a temporary PTK until it has
 604          * been verified when processing message 3/4. */
 605         ptk = &sm->tptk;
 606         if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
 607                 goto failed;
 608         if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
 609                 u8 buf[8];
 610                 /* Supplicant: swap tx/rx Mic keys */
 611                 os_memcpy(buf, &ptk->tk[16], 8);
 612                 os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);
 613                 os_memcpy(&ptk->tk[24], buf, 8);
 614                 os_memset(buf, 0, sizeof(buf));
 615         }
 616         sm->tptk_set = 1;
 617
 618         kde = sm->assoc_wpa_ie;
 619         kde_len = sm->assoc_wpa_ie_len;
 620
 621 #ifdef CONFIG_P2P
 622         if (sm->p2p) {
 623                 kde_buf = os_malloc(kde_len + 2 + RSN_SELECTOR_LEN + 1);
 624                 if (kde_buf) {
 625                         u8 *pos;
 626                         wpa_printf(MSG_DEBUG, "P2P: Add IP Address Request KDE "
 627                                    "into EAPOL-Key 2/4");
 628                         os_memcpy(kde_buf, kde, kde_len);
 629                         kde = kde_buf;
 630                         pos = kde + kde_len;
 631                         *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 632                         *pos++ = RSN_SELECTOR_LEN + 1;
 633                         RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_IP_ADDR_REQ);
 634                         pos += RSN_SELECTOR_LEN;
 635                         *pos++ = 0x01;
 636                         kde_len = pos - kde;
 637                 }
 638         }
 639 #endif /* CONFIG_P2P */
 640
 641         if (wpa_supplicant_send_2_of_4(sm, sm->bssid, key, ver, sm->snonce,
 642                                        kde, kde_len, ptk) < 0)
 643                 goto failed;
 644
 645         os_free(kde_buf);
 646         os_memcpy(sm->anonce, key->key_nonce, WPA_NONCE_LEN);
 647         return;
 648
 649 failed:
 650         os_free(kde_buf);
 651         wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
 652 }
 653
 654
 655 static void wpa_sm_start_preauth(void *eloop_ctx, void *timeout_ctx)
 656 {
 657         struct wpa_sm *sm = eloop_ctx;
 658         rsn_preauth_candidate_process(sm);
 659 }
 660
 661
 662 static void wpa_supplicant_key_neg_complete(struct wpa_sm *sm,
 663                                             const u8 *addr, int secure)
 664 {
 665         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
 666                 "WPA: Key negotiation completed with "
 667                 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
 668                 wpa_cipher_txt(sm->pairwise_cipher),
 669                 wpa_cipher_txt(sm->group_cipher));
 670         wpa_sm_cancel_auth_timeout(sm);
 671         wpa_sm_set_state(sm, WPA_COMPLETED);
 672
 673         if (secure) {
 674                 wpa_sm_mlme_setprotection(
 675                         sm, addr, MLME_SETPROTECTION_PROTECT_TYPE_RX_TX,
 676                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 677                 eapol_sm_notify_portValid(sm->eapol, TRUE);
 678                 if (wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
 679                     sm->key_mgmt == WPA_KEY_MGMT_DPP ||
 680                     sm->key_mgmt == WPA_KEY_MGMT_OWE)
 681                         eapol_sm_notify_eap_success(sm->eapol, TRUE);
 682                 /*
 683                  * Start preauthentication after a short wait to avoid a
 684                  * possible race condition between the data receive and key
 685                  * configuration after the 4-Way Handshake. This increases the
 686                  * likelihood of the first preauth EAPOL-Start frame getting to
 687                  * the target AP.
 688                  */
 689                 eloop_register_timeout(1, 0, wpa_sm_start_preauth, sm, NULL);
 690         }
 691
 692         if (sm->cur_pmksa && sm->cur_pmksa->opportunistic) {
 693                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 694                         "RSN: Authenticator accepted "
 695                         "opportunistic PMKSA entry - marking it valid");
 696                 sm->cur_pmksa->opportunistic = 0;
 697         }
 698
 699 #ifdef CONFIG_IEEE80211R
 700         if (wpa_key_mgmt_ft(sm->key_mgmt)) {
 701                 /* Prepare for the next transition */
 702                 wpa_ft_prepare_auth_request(sm, NULL);
 703         }
 704 #endif /* CONFIG_IEEE80211R */
 705 }
 706
 707
 708 static void wpa_sm_rekey_ptk(void *eloop_ctx, void *timeout_ctx)
 709 {
 710         struct wpa_sm *sm = eloop_ctx;
 711         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Request PTK rekeying");
 712         wpa_sm_key_request(sm, 0, 1);
 713 }
 714
 715
 716 static int wpa_supplicant_install_ptk(struct wpa_sm *sm,
 717                                       const struct wpa_eapol_key *key)
 718 {
 719         int keylen, rsclen;
 720         enum wpa_alg alg;
 721         const u8 *key_rsc;
 722
 723         if (sm->ptk.installed) {
 724                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 725                         "WPA: Do not re-install same PTK to the driver");
 726                 return 0;
 727         }
 728
 729         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 730                 "WPA: Installing PTK to the driver");
 731
 732         if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
 733                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Pairwise Cipher "
 734                         "Suite: NONE - do not use pairwise keys");
 735                 return 0;
 736         }
 737
 738         if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
 739                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 740                         "WPA: Unsupported pairwise cipher %d",
 741                         sm->pairwise_cipher);
 742                 return -1;
 743         }
 744
 745         alg = wpa_cipher_to_alg(sm->pairwise_cipher);
 746         keylen = wpa_cipher_key_len(sm->pairwise_cipher);
 747         if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
 748                 wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
 749                            keylen, (long unsigned int) sm->ptk.tk_len);
 750                 return -1;
 751         }
 752         rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
 753
 754         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
 755                 key_rsc = null_rsc;
 756         } else {
 757                 key_rsc = key->key_rsc;
 758                 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
 759         }
 760
 761         if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, key_rsc, rsclen,
 762                            sm->ptk.tk, keylen) < 0) {
 763                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 764                         "WPA: Failed to set PTK to the "
 765                         "driver (alg=%d keylen=%d bssid=" MACSTR ")",
 766                         alg, keylen, MAC2STR(sm->bssid));
 767                 return -1;
 768         }
 769
 770         /* TK is not needed anymore in supplicant */
 771         os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
 772         sm->ptk.tk_len = 0;
 773         sm->ptk.installed = 1;
 774
 775         if (sm->wpa_ptk_rekey) {
 776                 eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
 777                 eloop_register_timeout(sm->wpa_ptk_rekey, 0, wpa_sm_rekey_ptk,
 778                                        sm, NULL);
 779         }
 780
 781         return 0;
 782 }
 783
 784
 785 static int wpa_supplicant_check_group_cipher(struct wpa_sm *sm,
 786                                              int group_cipher,
 787                                              int keylen, int maxkeylen,
 788                                              int *key_rsc_len,
 789                                              enum wpa_alg *alg)
 790 {
 791         int klen;
 792
 793         *alg = wpa_cipher_to_alg(group_cipher);
 794         if (*alg == WPA_ALG_NONE) {
 795                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 796                         "WPA: Unsupported Group Cipher %d",
 797                         group_cipher);
 798                 return -1;
 799         }
 800         *key_rsc_len = wpa_cipher_rsc_len(group_cipher);
 801
 802         klen = wpa_cipher_key_len(group_cipher);
 803         if (keylen != klen || maxkeylen < klen) {
 804                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 805                         "WPA: Unsupported %s Group Cipher key length %d (%d)",
 806                         wpa_cipher_txt(group_cipher), keylen, maxkeylen);
 807                 return -1;
 808         }
 809         return 0;
 810 }
 811
 812
 813 struct wpa_gtk_data {
 814         enum wpa_alg alg;
 815         int tx, key_rsc_len, keyidx;
 816         u8 gtk[32];
 817         int gtk_len;
 818 };
 819
 820
 821 static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
 822                                       const struct wpa_gtk_data *gd,
 823                                       const u8 *key_rsc, int wnm_sleep)
 824 {
 825         const u8 *_gtk = gd->gtk;
 826         u8 gtk_buf[32];
 827
 828         /* Detect possible key reinstallation */
 829         if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
 830              os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
 831             (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
 832              os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
 833                        sm->gtk_wnm_sleep.gtk_len) == 0)) {
 834                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 835                         "WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
 836                         gd->keyidx, gd->tx, gd->gtk_len);
 837                 return 0;
 838         }
 839
 840         wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
 841         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 842                 "WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
 843                 gd->keyidx, gd->tx, gd->gtk_len);
 844         wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, gd->key_rsc_len);
 845         if (sm->group_cipher == WPA_CIPHER_TKIP) {
 846                 /* Swap Tx/Rx keys for Michael MIC */
 847                 os_memcpy(gtk_buf, gd->gtk, 16);
 848                 os_memcpy(gtk_buf + 16, gd->gtk + 24, 8);
 849                 os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
 850                 _gtk = gtk_buf;
 851         }
 852         if (sm->pairwise_cipher == WPA_CIPHER_NONE) {
 853                 if (wpa_sm_set_key(sm, gd->alg, NULL,
 854                                    gd->keyidx, 1, key_rsc, gd->key_rsc_len,
 855                                    _gtk, gd->gtk_len) < 0) {
 856                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 857                                 "WPA: Failed to set GTK to the driver "
 858                                 "(Group only)");
 859                         os_memset(gtk_buf, 0, sizeof(gtk_buf));
 860                         return -1;
 861                 }
 862         } else if (wpa_sm_set_key(sm, gd->alg, broadcast_ether_addr,
 863                                   gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len,
 864                                   _gtk, gd->gtk_len) < 0) {
 865                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 866                         "WPA: Failed to set GTK to "
 867                         "the driver (alg=%d keylen=%d keyidx=%d)",
 868                         gd->alg, gd->gtk_len, gd->keyidx);
 869                 os_memset(gtk_buf, 0, sizeof(gtk_buf));
 870                 return -1;
 871         }
 872         os_memset(gtk_buf, 0, sizeof(gtk_buf));
 873
 874         if (wnm_sleep) {
 875                 sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
 876                 os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
 877                           sm->gtk_wnm_sleep.gtk_len);
 878         } else {
 879                 sm->gtk.gtk_len = gd->gtk_len;
 880                 os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
 881         }
 882
 883         return 0;
 884 }
 885
 886
 887 static int wpa_supplicant_gtk_tx_bit_workaround(const struct wpa_sm *sm,
 888                                                 int tx)
 889 {
 890         if (tx && sm->pairwise_cipher != WPA_CIPHER_NONE) {
 891                 /* Ignore Tx bit for GTK if a pairwise key is used. One AP
 892                  * seemed to set this bit (incorrectly, since Tx is only when
 893                  * doing Group Key only APs) and without this workaround, the
 894                  * data connection does not work because wpa_supplicant
 895                  * configured non-zero keyidx to be used for unicast. */
 896                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
 897                         "WPA: Tx bit set for GTK, but pairwise "
 898                         "keys are used - ignore Tx bit");
 899                 return 0;
 900         }
 901         return tx;
 902 }
 903
 904
 905 static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
 906                                          const u8 *rsc)
 907 {
 908         int rsclen;
 909
 910         if (!sm->wpa_rsc_relaxation)
 911                 return 0;
 912
 913         rsclen = wpa_cipher_rsc_len(sm->group_cipher);
 914
 915         /*
 916          * Try to detect RSC (endian) corruption issue where the AP sends
 917          * the RSC bytes in EAPOL-Key message in the wrong order, both if
 918          * it's actually a 6-byte field (as it should be) and if it treats
 919          * it as an 8-byte field.
 920          * An AP model known to have this bug is the Sapido RB-1632.
 921          */
 922         if (rsclen == 6 && ((rsc[5] && !rsc[0]) || rsc[6] || rsc[7])) {
 923                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
 924                         "RSC %02x%02x%02x%02x%02x%02x%02x%02x is likely bogus, using 0",
 925                         rsc[0], rsc[1], rsc[2], rsc[3],
 926                         rsc[4], rsc[5], rsc[6], rsc[7]);
 927
 928                 return 1;
 929         }
 930
 931         return 0;
 932 }
 933
 934
 935 static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm,
 936                                        const struct wpa_eapol_key *key,
 937                                        const u8 *gtk, size_t gtk_len,
 938                                        int key_info)
 939 {
 940         struct wpa_gtk_data gd;
 941         const u8 *key_rsc;
 942
 943         /*
 944          * IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames - Figure 43x
 945          * GTK KDE format:
 946          * KeyID[bits 0-1], Tx [bit 2], Reserved [bits 3-7]
 947          * Reserved [bits 0-7]
 948          * GTK
 949          */
 950
 951         os_memset(&gd, 0, sizeof(gd));
 952         wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
 953                         gtk, gtk_len);
 954
 955         if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk))
 956                 return -1;
 957
 958         gd.keyidx = gtk[0] & 0x3;
 959         gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
 960                                                      !!(gtk[0] & BIT(2)));
 961         gtk += 2;
 962         gtk_len -= 2;
 963
 964         os_memcpy(gd.gtk, gtk, gtk_len);
 965         gd.gtk_len = gtk_len;
 966
 967         key_rsc = key->key_rsc;
 968         if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
 969                 key_rsc = null_rsc;
 970
 971         if (sm->group_cipher != WPA_CIPHER_GTK_NOT_USED &&
 972             (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
 973                                                gtk_len, gtk_len,
 974                                                &gd.key_rsc_len, &gd.alg) ||
 975              wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
 976                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
 977                         "RSN: Failed to install GTK");
 978                 os_memset(&gd, 0, sizeof(gd));
 979                 return -1;
 980         }
 981         os_memset(&gd, 0, sizeof(gd));
 982
 983         wpa_supplicant_key_neg_complete(sm, sm->bssid,
 984                                         key_info & WPA_KEY_INFO_SECURE);
 985         return 0;
 986 }
 987
 988
 989 #ifdef CONFIG_IEEE80211W
 990 static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
 991                                        const struct wpa_igtk_kde *igtk,
 992                                        int wnm_sleep)
 993 {
 994         size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
 995         u16 keyidx = WPA_GET_LE16(igtk->keyid);
 996
 997         /* Detect possible key reinstallation */
 998         if ((sm->igtk.igtk_len == len &&
 999              os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
1000             (sm->igtk_wnm_sleep.igtk_len == len &&
1001              os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1002                        sm->igtk_wnm_sleep.igtk_len) == 0)) {
1003                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1004                         "WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
1005                         keyidx);
1006                 return  0;
1007         }
1008
1009         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1010                 "WPA: IGTK keyid %d pn " COMPACT_MACSTR,
1011                 keyidx, MAC2STR(igtk->pn));
1012         wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
1013         if (keyidx > 4095) {
1014                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1015                         "WPA: Invalid IGTK KeyID %d", keyidx);
1016                 return -1;
1017         }
1018         if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
1019                            broadcast_ether_addr,
1020                            keyidx, 0, igtk->pn, sizeof(igtk->pn),
1021                            igtk->igtk, len) < 0) {
1022                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1023                         "WPA: Failed to configure IGTK to the driver");
1024                 return -1;
1025         }
1026
1027         if (wnm_sleep) {
1028                 sm->igtk_wnm_sleep.igtk_len = len;
1029                 os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
1030                           sm->igtk_wnm_sleep.igtk_len);
1031         } else {
1032                 sm->igtk.igtk_len = len;
1033                 os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
1034         }
1035
1036         return 0;
1037 }
1038 #endif /* CONFIG_IEEE80211W */
1039
1040
1041 static int ieee80211w_set_keys(struct wpa_sm *sm,
1042                                struct wpa_eapol_ie_parse *ie)
1043 {
1044 #ifdef CONFIG_IEEE80211W
1045         if (!wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher))
1046                 return 0;
1047
1048         if (ie->igtk) {
1049                 size_t len;
1050                 const struct wpa_igtk_kde *igtk;
1051
1052                 len = wpa_cipher_key_len(sm->mgmt_group_cipher);
1053                 if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
1054                         return -1;
1055
1056                 igtk = (const struct wpa_igtk_kde *) ie->igtk;
1057                 if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
1058                         return -1;
1059         }
1060
1061         return 0;
1062 #else /* CONFIG_IEEE80211W */
1063         return 0;
1064 #endif /* CONFIG_IEEE80211W */
1065 }
1066
1067
1068 static void wpa_report_ie_mismatch(struct wpa_sm *sm,
1069                                    const char *reason, const u8 *src_addr,
1070                                    const u8 *wpa_ie, size_t wpa_ie_len,
1071                                    const u8 *rsn_ie, size_t rsn_ie_len)
1072 {
1073         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
1074                 reason, MAC2STR(src_addr));
1075
1076         if (sm->ap_wpa_ie) {
1077                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1078                             sm->ap_wpa_ie, sm->ap_wpa_ie_len);
1079         }
1080         if (wpa_ie) {
1081                 if (!sm->ap_wpa_ie) {
1082                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1083                                 "WPA: No WPA IE in Beacon/ProbeResp");
1084                 }
1085                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1086                             wpa_ie, wpa_ie_len);
1087         }
1088
1089         if (sm->ap_rsn_ie) {
1090                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1091                             sm->ap_rsn_ie, sm->ap_rsn_ie_len);
1092         }
1093         if (rsn_ie) {
1094                 if (!sm->ap_rsn_ie) {
1095                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1096                                 "WPA: No RSN IE in Beacon/ProbeResp");
1097                 }
1098                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1099                             rsn_ie, rsn_ie_len);
1100         }
1101
1102         wpa_sm_deauthenticate(sm, WLAN_REASON_IE_IN_4WAY_DIFFERS);
1103 }
1104
1105
1106 #ifdef CONFIG_IEEE80211R
1107
1108 static int ft_validate_mdie(struct wpa_sm *sm,
1109                             const unsigned char *src_addr,
1110                             struct wpa_eapol_ie_parse *ie,
1111                             const u8 *assoc_resp_mdie)
1112 {
1113         struct rsn_mdie *mdie;
1114
1115         mdie = (struct rsn_mdie *) (ie->mdie + 2);
1116         if (ie->mdie == NULL || ie->mdie_len < 2 + sizeof(*mdie) ||
1117             os_memcmp(mdie->mobility_domain, sm->mobility_domain,
1118                       MOBILITY_DOMAIN_ID_LEN) != 0) {
1119                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE in msg 3/4 did "
1120                         "not match with the current mobility domain");
1121                 return -1;
1122         }
1123
1124         if (assoc_resp_mdie &&
1125             (assoc_resp_mdie[1] != ie->mdie[1] ||
1126              os_memcmp(assoc_resp_mdie, ie->mdie, 2 + ie->mdie[1]) != 0)) {
1127                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: MDIE mismatch");
1128                 wpa_hexdump(MSG_DEBUG, "FT: MDIE in EAPOL-Key msg 3/4",
1129                             ie->mdie, 2 + ie->mdie[1]);
1130                 wpa_hexdump(MSG_DEBUG, "FT: MDIE in (Re)Association Response",
1131                             assoc_resp_mdie, 2 + assoc_resp_mdie[1]);
1132                 return -1;
1133         }
1134
1135         return 0;
1136 }
1137
1138
1139 static int ft_validate_ftie(struct wpa_sm *sm,
1140                             const unsigned char *src_addr,
1141                             struct wpa_eapol_ie_parse *ie,
1142                             const u8 *assoc_resp_ftie)
1143 {
1144         if (ie->ftie == NULL) {
1145                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1146                         "FT: No FTIE in EAPOL-Key msg 3/4");
1147                 return -1;
1148         }
1149
1150         if (assoc_resp_ftie == NULL)
1151                 return 0;
1152
1153         if (assoc_resp_ftie[1] != ie->ftie[1] ||
1154             os_memcmp(assoc_resp_ftie, ie->ftie, 2 + ie->ftie[1]) != 0) {
1155                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: FTIE mismatch");
1156                 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 3/4",
1157                             ie->ftie, 2 + ie->ftie[1]);
1158                 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)Association Response",
1159                             assoc_resp_ftie, 2 + assoc_resp_ftie[1]);
1160                 return -1;
1161         }
1162
1163         return 0;
1164 }
1165
1166
1167 static int ft_validate_rsnie(struct wpa_sm *sm,
1168                              const unsigned char *src_addr,
1169                              struct wpa_eapol_ie_parse *ie)
1170 {
1171         struct wpa_ie_data rsn;
1172
1173         if (!ie->rsn_ie)
1174                 return 0;
1175
1176         /*
1177          * Verify that PMKR1Name from EAPOL-Key message 3/4
1178          * matches with the value we derived.
1179          */
1180         if (wpa_parse_wpa_ie_rsn(ie->rsn_ie, ie->rsn_ie_len, &rsn) < 0 ||
1181             rsn.num_pmkid != 1 || rsn.pmkid == NULL) {
1182                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "FT: No PMKR1Name in "
1183                         "FT 4-way handshake message 3/4");
1184                 return -1;
1185         }
1186
1187         if (os_memcmp_const(rsn.pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN) != 0)
1188         {
1189                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1190                         "FT: PMKR1Name mismatch in "
1191                         "FT 4-way handshake message 3/4");
1192                 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Authenticator",
1193                             rsn.pmkid, WPA_PMK_NAME_LEN);
1194                 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name",
1195                             sm->pmk_r1_name, WPA_PMK_NAME_LEN);
1196                 return -1;
1197         }
1198
1199         return 0;
1200 }
1201
1202
1203 static int wpa_supplicant_validate_ie_ft(struct wpa_sm *sm,
1204                                          const unsigned char *src_addr,
1205                                          struct wpa_eapol_ie_parse *ie)
1206 {
1207         const u8 *pos, *end, *mdie = NULL, *ftie = NULL;
1208
1209         if (sm->assoc_resp_ies) {
1210                 pos = sm->assoc_resp_ies;
1211                 end = pos + sm->assoc_resp_ies_len;
1212                 while (end - pos > 2) {
1213                         if (2 + pos[1] > end - pos)
1214                                 break;
1215                         switch (*pos) {
1216                         case WLAN_EID_MOBILITY_DOMAIN:
1217                                 mdie = pos;
1218                                 break;
1219                         case WLAN_EID_FAST_BSS_TRANSITION:
1220                                 ftie = pos;
1221                                 break;
1222                         }
1223                         pos += 2 + pos[1];
1224                 }
1225         }
1226
1227         if (ft_validate_mdie(sm, src_addr, ie, mdie) < 0 ||
1228             ft_validate_ftie(sm, src_addr, ie, ftie) < 0 ||
1229             ft_validate_rsnie(sm, src_addr, ie) < 0)
1230                 return -1;
1231
1232         return 0;
1233 }
1234
1235 #endif /* CONFIG_IEEE80211R */
1236
1237
1238 static int wpa_supplicant_validate_ie(struct wpa_sm *sm,
1239                                       const unsigned char *src_addr,
1240                                       struct wpa_eapol_ie_parse *ie)
1241 {
1242         if (sm->ap_wpa_ie == NULL && sm->ap_rsn_ie == NULL) {
1243                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1244                         "WPA: No WPA/RSN IE for this AP known. "
1245                         "Trying to get from scan results");
1246                 if (wpa_sm_get_beacon_ie(sm) < 0) {
1247                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1248                                 "WPA: Could not find AP from "
1249                                 "the scan results");
1250                 } else {
1251                         wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,
1252                                 "WPA: Found the current AP from "
1253                                 "updated scan results");
1254                 }
1255         }
1256
1257         if (ie->wpa_ie == NULL && ie->rsn_ie == NULL &&
1258             (sm->ap_wpa_ie || sm->ap_rsn_ie)) {
1259                 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1260                                        "with IE in Beacon/ProbeResp (no IE?)",
1261                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1262                                        ie->rsn_ie, ie->rsn_ie_len);
1263                 return -1;
1264         }
1265
1266         if ((ie->wpa_ie && sm->ap_wpa_ie &&
1267              (ie->wpa_ie_len != sm->ap_wpa_ie_len ||
1268               os_memcmp(ie->wpa_ie, sm->ap_wpa_ie, ie->wpa_ie_len) != 0)) ||
1269             (ie->rsn_ie && sm->ap_rsn_ie &&
1270              wpa_compare_rsn_ie(wpa_key_mgmt_ft(sm->key_mgmt),
1271                                 sm->ap_rsn_ie, sm->ap_rsn_ie_len,
1272                                 ie->rsn_ie, ie->rsn_ie_len))) {
1273                 wpa_report_ie_mismatch(sm, "IE in 3/4 msg does not match "
1274                                        "with IE in Beacon/ProbeResp",
1275                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1276                                        ie->rsn_ie, ie->rsn_ie_len);
1277                 return -1;
1278         }
1279
1280         if (sm->proto == WPA_PROTO_WPA &&
1281             ie->rsn_ie && sm->ap_rsn_ie == NULL && sm->rsn_enabled) {
1282                 wpa_report_ie_mismatch(sm, "Possible downgrade attack "
1283                                        "detected - RSN was enabled and RSN IE "
1284                                        "was in msg 3/4, but not in "
1285                                        "Beacon/ProbeResp",
1286                                        src_addr, ie->wpa_ie, ie->wpa_ie_len,
1287                                        ie->rsn_ie, ie->rsn_ie_len);
1288                 return -1;
1289         }
1290
1291 #ifdef CONFIG_IEEE80211R
1292         if (wpa_key_mgmt_ft(sm->key_mgmt) &&
1293             wpa_supplicant_validate_ie_ft(sm, src_addr, ie) < 0)
1294                 return -1;
1295 #endif /* CONFIG_IEEE80211R */
1296
1297         return 0;
1298 }
1299
1300
1301 /**
1302  * wpa_supplicant_send_4_of_4 - Send message 4 of WPA/RSN 4-Way Handshake
1303  * @sm: Pointer to WPA state machine data from wpa_sm_init()
1304  * @dst: Destination address for the frame
1305  * @key: Pointer to the EAPOL-Key frame header
1306  * @ver: Version bits from EAPOL-Key Key Info
1307  * @key_info: Key Info
1308  * @ptk: PTK to use for keyed hash and encryption
1309  * Returns: >= 0 on success, < 0 on failure
1310  */
1311 int wpa_supplicant_send_4_of_4(struct wpa_sm *sm, const unsigned char *dst,
1312                                const struct wpa_eapol_key *key,
1313                                u16 ver, u16 key_info,
1314                                struct wpa_ptk *ptk)
1315 {
1316         size_t mic_len, hdrlen, rlen;
1317         struct wpa_eapol_key *reply;
1318         u8 *rbuf, *key_mic;
1319
1320         mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
1321         hdrlen = sizeof(*reply) + mic_len + 2;
1322         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1323                                   hdrlen, &rlen, (void *) &reply);
1324         if (rbuf == NULL)
1325                 return -1;
1326
1327         reply->type = (sm->proto == WPA_PROTO_RSN ||
1328                        sm->proto == WPA_PROTO_OSEN) ?
1329                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1330         key_info &= WPA_KEY_INFO_SECURE;
1331         key_info |= ver | WPA_KEY_INFO_KEY_TYPE;
1332         if (mic_len)
1333                 key_info |= WPA_KEY_INFO_MIC;
1334         else
1335                 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
1336         WPA_PUT_BE16(reply->key_info, key_info);
1337         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
1338                 WPA_PUT_BE16(reply->key_length, 0);
1339         else
1340                 os_memcpy(reply->key_length, key->key_length, 2);
1341         os_memcpy(reply->replay_counter, key->replay_counter,
1342                   WPA_REPLAY_COUNTER_LEN);
1343
1344         key_mic = (u8 *) (reply + 1);
1345         WPA_PUT_BE16(key_mic + mic_len, 0);
1346
1347         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
1348         return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,
1349                                   key_mic);
1350 }
1351
1352
1353 static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm,
1354                                           const struct wpa_eapol_key *key,
1355                                           u16 ver, const u8 *key_data,
1356                                           size_t key_data_len)
1357 {
1358         u16 key_info, keylen;
1359         struct wpa_eapol_ie_parse ie;
1360
1361         wpa_sm_set_state(sm, WPA_4WAY_HANDSHAKE);
1362         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 3 of 4-Way "
1363                 "Handshake from " MACSTR " (ver=%d)", MAC2STR(sm->bssid), ver);
1364
1365         key_info = WPA_GET_BE16(key->key_info);
1366
1367         wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", key_data, key_data_len);
1368         if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
1369                 goto failed;
1370         if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1371                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1372                         "WPA: GTK IE in unencrypted key data");
1373                 goto failed;
1374         }
1375 #ifdef CONFIG_IEEE80211W
1376         if (ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1377                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1378                         "WPA: IGTK KDE in unencrypted key data");
1379                 goto failed;
1380         }
1381
1382         if (ie.igtk &&
1383             wpa_cipher_valid_mgmt_group(sm->mgmt_group_cipher) &&
1384             ie.igtk_len != WPA_IGTK_KDE_PREFIX_LEN +
1385             (unsigned int) wpa_cipher_key_len(sm->mgmt_group_cipher)) {
1386                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1387                         "WPA: Invalid IGTK KDE length %lu",
1388                         (unsigned long) ie.igtk_len);
1389                 goto failed;
1390         }
1391 #endif /* CONFIG_IEEE80211W */
1392
1393         if (wpa_supplicant_validate_ie(sm, sm->bssid, &ie) < 0)
1394                 goto failed;
1395
1396         if (os_memcmp(sm->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
1397                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1398                         "WPA: ANonce from message 1 of 4-Way Handshake "
1399                         "differs from 3 of 4-Way Handshake - drop packet (src="
1400                         MACSTR ")", MAC2STR(sm->bssid));
1401                 goto failed;
1402         }
1403
1404         keylen = WPA_GET_BE16(key->key_length);
1405         if (keylen != wpa_cipher_key_len(sm->pairwise_cipher)) {
1406                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1407                         "WPA: Invalid %s key length %d (src=" MACSTR
1408                         ")", wpa_cipher_txt(sm->pairwise_cipher), keylen,
1409                         MAC2STR(sm->bssid));
1410                 goto failed;
1411         }
1412
1413 #ifdef CONFIG_P2P
1414         if (ie.ip_addr_alloc) {
1415                 os_memcpy(sm->p2p_ip_addr, ie.ip_addr_alloc, 3 * 4);
1416                 wpa_hexdump(MSG_DEBUG, "P2P: IP address info",
1417                             sm->p2p_ip_addr, sizeof(sm->p2p_ip_addr));
1418         }
1419 #endif /* CONFIG_P2P */
1420
1421         if (wpa_supplicant_send_4_of_4(sm, sm->bssid, key, ver, key_info,
1422                                        &sm->ptk) < 0) {
1423                 goto failed;
1424         }
1425
1426         /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1427          * for the next 4-Way Handshake. If msg 3 is received again, the old
1428          * SNonce will still be used to avoid changing PTK. */
1429         sm->renew_snonce = 1;
1430
1431         if (key_info & WPA_KEY_INFO_INSTALL) {
1432                 if (wpa_supplicant_install_ptk(sm, key))
1433                         goto failed;
1434         }
1435
1436         if (key_info & WPA_KEY_INFO_SECURE) {
1437                 wpa_sm_mlme_setprotection(
1438                         sm, sm->bssid, MLME_SETPROTECTION_PROTECT_TYPE_RX,
1439                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
1440                 eapol_sm_notify_portValid(sm->eapol, TRUE);
1441         }
1442         wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1443
1444         if (sm->group_cipher == WPA_CIPHER_GTK_NOT_USED) {
1445                 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1446                                                 key_info & WPA_KEY_INFO_SECURE);
1447         } else if (ie.gtk &&
1448             wpa_supplicant_pairwise_gtk(sm, key,
1449                                         ie.gtk, ie.gtk_len, key_info) < 0) {
1450                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1451                         "RSN: Failed to configure GTK");
1452                 goto failed;
1453         }
1454
1455         if (ieee80211w_set_keys(sm, &ie) < 0) {
1456                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1457                         "RSN: Failed to configure IGTK");
1458                 goto failed;
1459         }
1460
1461         if (ie.gtk)
1462                 wpa_sm_set_rekey_offload(sm);
1463
1464         /* Add PMKSA cache entry for Suite B AKMs here since PMKID can be
1465          * calculated only after KCK has been derived. Though, do not replace an
1466          * existing PMKSA entry after each 4-way handshake (i.e., new KCK/PMKID)
1467          * to avoid unnecessary changes of PMKID while continuing to use the
1468          * same PMK. */
1469         if (sm->proto == WPA_PROTO_RSN && wpa_key_mgmt_suite_b(sm->key_mgmt) &&
1470             !sm->cur_pmksa) {
1471                 struct rsn_pmksa_cache_entry *sa;
1472
1473                 sa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, NULL,
1474                                      sm->ptk.kck, sm->ptk.kck_len,
1475                                      sm->bssid, sm->own_addr,
1476                                      sm->network_ctx, sm->key_mgmt, NULL);
1477                 if (!sm->cur_pmksa)
1478                         sm->cur_pmksa = sa;
1479         }
1480
1481         sm->msg_3_of_4_ok = 1;
1482         return;
1483
1484 failed:
1485         wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
1486 }
1487
1488
1489 static int wpa_supplicant_process_1_of_2_rsn(struct wpa_sm *sm,
1490                                              const u8 *keydata,
1491                                              size_t keydatalen,
1492                                              u16 key_info,
1493                                              struct wpa_gtk_data *gd)
1494 {
1495         int maxkeylen;
1496         struct wpa_eapol_ie_parse ie;
1497
1498         wpa_hexdump_key(MSG_DEBUG, "RSN: msg 1/2 key data",
1499                         keydata, keydatalen);
1500         if (wpa_supplicant_parse_ies(keydata, keydatalen, &ie) < 0)
1501                 return -1;
1502         if (ie.gtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1503                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1504                         "WPA: GTK IE in unencrypted key data");
1505                 return -1;
1506         }
1507         if (ie.gtk == NULL) {
1508                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1509                         "WPA: No GTK IE in Group Key msg 1/2");
1510                 return -1;
1511         }
1512         maxkeylen = gd->gtk_len = ie.gtk_len - 2;
1513
1514         if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1515                                               gd->gtk_len, maxkeylen,
1516                                               &gd->key_rsc_len, &gd->alg))
1517                 return -1;
1518
1519         wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in group key handshake",
1520                         ie.gtk, ie.gtk_len);
1521         gd->keyidx = ie.gtk[0] & 0x3;
1522         gd->tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
1523                                                       !!(ie.gtk[0] & BIT(2)));
1524         if (ie.gtk_len - 2 > sizeof(gd->gtk)) {
1525                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1526                         "RSN: Too long GTK in GTK IE (len=%lu)",
1527                         (unsigned long) ie.gtk_len - 2);
1528                 return -1;
1529         }
1530         os_memcpy(gd->gtk, ie.gtk + 2, ie.gtk_len - 2);
1531
1532         if (ieee80211w_set_keys(sm, &ie) < 0)
1533                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1534                         "RSN: Failed to configure IGTK");
1535
1536         return 0;
1537 }
1538
1539
1540 static int wpa_supplicant_process_1_of_2_wpa(struct wpa_sm *sm,
1541                                              const struct wpa_eapol_key *key,
1542                                              const u8 *key_data,
1543                                              size_t key_data_len, u16 key_info,
1544                                              u16 ver, struct wpa_gtk_data *gd)
1545 {
1546         size_t maxkeylen;
1547         u16 gtk_len;
1548
1549         gtk_len = WPA_GET_BE16(key->key_length);
1550         maxkeylen = key_data_len;
1551         if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1552                 if (maxkeylen < 8) {
1553                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1554                                 "WPA: Too short maxkeylen (%lu)",
1555                                 (unsigned long) maxkeylen);
1556                         return -1;
1557                 }
1558                 maxkeylen -= 8;
1559         }
1560
1561         if (gtk_len > maxkeylen ||
1562             wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
1563                                               gtk_len, maxkeylen,
1564                                               &gd->key_rsc_len, &gd->alg))
1565                 return -1;
1566
1567         gd->gtk_len = gtk_len;
1568         gd->keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1569                 WPA_KEY_INFO_KEY_INDEX_SHIFT;
1570         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
1571 #ifdef CONFIG_NO_RC4
1572                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1573                         "WPA: RC4 not supported in the build");
1574                 return -1;
1575 #else /* CONFIG_NO_RC4 */
1576                 u8 ek[32];
1577                 if (key_data_len > sizeof(gd->gtk)) {
1578                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1579                                 "WPA: RC4 key data too long (%lu)",
1580                                 (unsigned long) key_data_len);
1581                         return -1;
1582                 }
1583                 os_memcpy(ek, key->key_iv, 16);
1584                 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
1585                 os_memcpy(gd->gtk, key_data, key_data_len);
1586                 if (rc4_skip(ek, 32, 256, gd->gtk, key_data_len)) {
1587                         os_memset(ek, 0, sizeof(ek));
1588                         wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1589                                 "WPA: RC4 failed");
1590                         return -1;
1591                 }
1592                 os_memset(ek, 0, sizeof(ek));
1593 #endif /* CONFIG_NO_RC4 */
1594         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1595                 if (maxkeylen % 8) {
1596                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1597                                 "WPA: Unsupported AES-WRAP len %lu",
1598                                 (unsigned long) maxkeylen);
1599                         return -1;
1600                 }
1601                 if (maxkeylen > sizeof(gd->gtk)) {
1602                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1603                                 "WPA: AES-WRAP key data "
1604                                 "too long (keydatalen=%lu maxkeylen=%lu)",
1605                                 (unsigned long) key_data_len,
1606                                 (unsigned long) maxkeylen);
1607                         return -1;
1608                 }
1609                 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, maxkeylen / 8,
1610                                key_data, gd->gtk)) {
1611                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1612                                 "WPA: AES unwrap failed - could not decrypt "
1613                                 "GTK");
1614                         return -1;
1615                 }
1616         } else {
1617                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1618                         "WPA: Unsupported key_info type %d", ver);
1619                 return -1;
1620         }
1621         gd->tx = wpa_supplicant_gtk_tx_bit_workaround(
1622                 sm, !!(key_info & WPA_KEY_INFO_TXRX));
1623         return 0;
1624 }
1625
1626
1627 static int wpa_supplicant_send_2_of_2(struct wpa_sm *sm,
1628                                       const struct wpa_eapol_key *key,
1629                                       int ver, u16 key_info)
1630 {
1631         size_t mic_len, hdrlen, rlen;
1632         struct wpa_eapol_key *reply;
1633         u8 *rbuf, *key_mic;
1634
1635         mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
1636         hdrlen = sizeof(*reply) + mic_len + 2;
1637         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
1638                                   hdrlen, &rlen, (void *) &reply);
1639         if (rbuf == NULL)
1640                 return -1;
1641
1642         reply->type = (sm->proto == WPA_PROTO_RSN ||
1643                        sm->proto == WPA_PROTO_OSEN) ?
1644                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1645         key_info &= WPA_KEY_INFO_KEY_INDEX_MASK;
1646         key_info |= ver | WPA_KEY_INFO_SECURE;
1647         if (mic_len)
1648                 key_info |= WPA_KEY_INFO_MIC;
1649         else
1650                 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;
1651         WPA_PUT_BE16(reply->key_info, key_info);
1652         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN)
1653                 WPA_PUT_BE16(reply->key_length, 0);
1654         else
1655                 os_memcpy(reply->key_length, key->key_length, 2);
1656         os_memcpy(reply->replay_counter, key->replay_counter,
1657                   WPA_REPLAY_COUNTER_LEN);
1658
1659         key_mic = (u8 *) (reply + 1);
1660         WPA_PUT_BE16(key_mic + mic_len, 0);
1661
1662         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
1663         return wpa_eapol_key_send(sm, &sm->ptk, ver, sm->bssid, ETH_P_EAPOL,
1664                                   rbuf, rlen, key_mic);
1665 }
1666
1667
1668 static void wpa_supplicant_process_1_of_2(struct wpa_sm *sm,
1669                                           const unsigned char *src_addr,
1670                                           const struct wpa_eapol_key *key,
1671                                           const u8 *key_data,
1672                                           size_t key_data_len, u16 ver)
1673 {
1674         u16 key_info;
1675         int rekey, ret;
1676         struct wpa_gtk_data gd;
1677         const u8 *key_rsc;
1678
1679         if (!sm->msg_3_of_4_ok && !wpa_fils_is_completed(sm)) {
1680                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
1681                         "WPA: Group Key Handshake started prior to completion of 4-way handshake");
1682                 goto failed;
1683         }
1684
1685         os_memset(&gd, 0, sizeof(gd));
1686
1687         rekey = wpa_sm_get_state(sm) == WPA_COMPLETED;
1688         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: RX message 1 of Group Key "
1689                 "Handshake from " MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1690
1691         key_info = WPA_GET_BE16(key->key_info);
1692
1693         if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
1694                 ret = wpa_supplicant_process_1_of_2_rsn(sm, key_data,
1695                                                         key_data_len, key_info,
1696                                                         &gd);
1697         } else {
1698                 ret = wpa_supplicant_process_1_of_2_wpa(sm, key, key_data,
1699                                                         key_data_len,
1700                                                         key_info, ver, &gd);
1701         }
1702
1703         wpa_sm_set_state(sm, WPA_GROUP_HANDSHAKE);
1704
1705         if (ret)
1706                 goto failed;
1707
1708         key_rsc = key->key_rsc;
1709         if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
1710                 key_rsc = null_rsc;
1711
1712         if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
1713             wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
1714                 goto failed;
1715         os_memset(&gd, 0, sizeof(gd));
1716
1717         if (rekey) {
1718                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Group rekeying "
1719                         "completed with " MACSTR " [GTK=%s]",
1720                         MAC2STR(sm->bssid), wpa_cipher_txt(sm->group_cipher));
1721                 wpa_sm_cancel_auth_timeout(sm);
1722                 wpa_sm_set_state(sm, WPA_COMPLETED);
1723         } else {
1724                 wpa_supplicant_key_neg_complete(sm, sm->bssid,
1725                                                 key_info &
1726                                                 WPA_KEY_INFO_SECURE);
1727         }
1728
1729         wpa_sm_set_rekey_offload(sm);
1730
1731         return;
1732
1733 failed:
1734         os_memset(&gd, 0, sizeof(gd));
1735         wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
1736 }
1737
1738
1739 static int wpa_supplicant_verify_eapol_key_mic(struct wpa_sm *sm,
1740                                                struct wpa_eapol_key *key,
1741                                                u16 ver,
1742                                                const u8 *buf, size_t len)
1743 {
1744         u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
1745         int ok = 0;
1746         size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
1747
1748         os_memcpy(mic, key + 1, mic_len);
1749         if (sm->tptk_set) {
1750                 os_memset(key + 1, 0, mic_len);
1751                 if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
1752                                       sm->key_mgmt,
1753                                       ver, buf, len, (u8 *) (key + 1)) < 0 ||
1754                     os_memcmp_const(mic, key + 1, mic_len) != 0) {
1755                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1756                                 "WPA: Invalid EAPOL-Key MIC "
1757                                 "when using TPTK - ignoring TPTK");
1758                 } else {
1759                         ok = 1;
1760                         sm->tptk_set = 0;
1761                         sm->ptk_set = 1;
1762                         os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
1763                         os_memset(&sm->tptk, 0, sizeof(sm->tptk));
1764                         /*
1765                          * This assures the same TPTK in sm->tptk can never be
1766                          * copied twice to sm->ptk as the new PTK. In
1767                          * combination with the installed flag in the wpa_ptk
1768                          * struct, this assures the same PTK is only installed
1769                          * once.
1770                          */
1771                         sm->renew_snonce = 1;
1772                 }
1773         }
1774
1775         if (!ok && sm->ptk_set) {
1776                 os_memset(key + 1, 0, mic_len);
1777                 if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
1778                                       sm->key_mgmt,
1779                                       ver, buf, len, (u8 *) (key + 1)) < 0 ||
1780                     os_memcmp_const(mic, key + 1, mic_len) != 0) {
1781                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1782                                 "WPA: Invalid EAPOL-Key MIC - "
1783                                 "dropping packet");
1784                         return -1;
1785                 }
1786                 ok = 1;
1787         }
1788
1789         if (!ok) {
1790                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1791                         "WPA: Could not verify EAPOL-Key MIC - "
1792                         "dropping packet");
1793                 return -1;
1794         }
1795
1796         os_memcpy(sm->rx_replay_counter, key->replay_counter,
1797                   WPA_REPLAY_COUNTER_LEN);
1798         sm->rx_replay_counter_set = 1;
1799         return 0;
1800 }
1801
1802
1803 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
1804 static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
1805                                            struct wpa_eapol_key *key,
1806                                            size_t mic_len, u16 ver,
1807                                            u8 *key_data, size_t *key_data_len)
1808 {
1809         wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
1810                     key_data, *key_data_len);
1811         if (!sm->ptk_set) {
1812                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1813                         "WPA: PTK not available, cannot decrypt EAPOL-Key Key "
1814                         "Data");
1815                 return -1;
1816         }
1817
1818         /* Decrypt key data here so that this operation does not need
1819          * to be implemented separately for each message type. */
1820         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && sm->ptk.kek_len == 16) {
1821 #ifdef CONFIG_NO_RC4
1822                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1823                         "WPA: RC4 not supported in the build");
1824                 return -1;
1825 #else /* CONFIG_NO_RC4 */
1826                 u8 ek[32];
1827
1828                 wpa_printf(MSG_DEBUG, "WPA: Decrypt Key Data using RC4");
1829                 os_memcpy(ek, key->key_iv, 16);
1830                 os_memcpy(ek + 16, sm->ptk.kek, sm->ptk.kek_len);
1831                 if (rc4_skip(ek, 32, 256, key_data, *key_data_len)) {
1832                         os_memset(ek, 0, sizeof(ek));
1833                         wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
1834                                 "WPA: RC4 failed");
1835                         return -1;
1836                 }
1837                 os_memset(ek, 0, sizeof(ek));
1838 #endif /* CONFIG_NO_RC4 */
1839         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES ||
1840                    ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
1841                    wpa_use_aes_key_wrap(sm->key_mgmt)) {
1842                 u8 *buf;
1843
1844                 wpa_printf(MSG_DEBUG,
1845                            "WPA: Decrypt Key Data using AES-UNWRAP (KEK length %u)",
1846                            (unsigned int) sm->ptk.kek_len);
1847                 if (*key_data_len < 8 || *key_data_len % 8) {
1848                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1849                                 "WPA: Unsupported AES-WRAP len %u",
1850                                 (unsigned int) *key_data_len);
1851                         return -1;
1852                 }
1853                 *key_data_len -= 8; /* AES-WRAP adds 8 bytes */
1854                 buf = os_malloc(*key_data_len);
1855                 if (buf == NULL) {
1856                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1857                                 "WPA: No memory for AES-UNWRAP buffer");
1858                         return -1;
1859                 }
1860                 if (aes_unwrap(sm->ptk.kek, sm->ptk.kek_len, *key_data_len / 8,
1861                                key_data, buf)) {
1862                         bin_clear_free(buf, *key_data_len);
1863                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1864                                 "WPA: AES unwrap failed - "
1865                                 "could not decrypt EAPOL-Key key data");
1866                         return -1;
1867                 }
1868                 os_memcpy(key_data, buf, *key_data_len);
1869                 bin_clear_free(buf, *key_data_len);
1870                 WPA_PUT_BE16(((u8 *) (key + 1)) + mic_len, *key_data_len);
1871         } else {
1872                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1873                         "WPA: Unsupported key_info type %d", ver);
1874                 return -1;
1875         }
1876         wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
1877                         key_data, *key_data_len);
1878         return 0;
1879 }
1880
1881
1882 /**
1883  * wpa_sm_aborted_cached - Notify WPA that PMKSA caching was aborted
1884  * @sm: Pointer to WPA state machine data from wpa_sm_init()
1885  */
1886 void wpa_sm_aborted_cached(struct wpa_sm *sm)
1887 {
1888         if (sm && sm->cur_pmksa) {
1889                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1890                         "RSN: Cancelling PMKSA caching attempt");
1891                 sm->cur_pmksa = NULL;
1892         }
1893 }
1894
1895
1896 static void wpa_eapol_key_dump(struct wpa_sm *sm,
1897                                const struct wpa_eapol_key *key,
1898                                unsigned int key_data_len,
1899                                const u8 *mic, unsigned int mic_len)
1900 {
1901 #ifndef CONFIG_NO_STDOUT_DEBUG
1902         u16 key_info = WPA_GET_BE16(key->key_info);
1903
1904         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "  EAPOL-Key type=%d", key->type);
1905         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1906                 "  key_info 0x%x (ver=%d keyidx=%d rsvd=%d %s%s%s%s%s%s%s%s)",
1907                 key_info, key_info & WPA_KEY_INFO_TYPE_MASK,
1908                 (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1909                 WPA_KEY_INFO_KEY_INDEX_SHIFT,
1910                 (key_info & (BIT(13) | BIT(14) | BIT(15))) >> 13,
1911                 key_info & WPA_KEY_INFO_KEY_TYPE ? "Pairwise" : "Group",
1912                 key_info & WPA_KEY_INFO_INSTALL ? " Install" : "",
1913                 key_info & WPA_KEY_INFO_ACK ? " Ack" : "",
1914                 key_info & WPA_KEY_INFO_MIC ? " MIC" : "",
1915                 key_info & WPA_KEY_INFO_SECURE ? " Secure" : "",
1916                 key_info & WPA_KEY_INFO_ERROR ? " Error" : "",
1917                 key_info & WPA_KEY_INFO_REQUEST ? " Request" : "",
1918                 key_info & WPA_KEY_INFO_ENCR_KEY_DATA ? " Encr" : "");
1919         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
1920                 "  key_length=%u key_data_length=%u",
1921                 WPA_GET_BE16(key->key_length), key_data_len);
1922         wpa_hexdump(MSG_DEBUG, "  replay_counter",
1923                     key->replay_counter, WPA_REPLAY_COUNTER_LEN);
1924         wpa_hexdump(MSG_DEBUG, "  key_nonce", key->key_nonce, WPA_NONCE_LEN);
1925         wpa_hexdump(MSG_DEBUG, "  key_iv", key->key_iv, 16);
1926         wpa_hexdump(MSG_DEBUG, "  key_rsc", key->key_rsc, 8);
1927         wpa_hexdump(MSG_DEBUG, "  key_id (reserved)", key->key_id, 8);
1928         wpa_hexdump(MSG_DEBUG, "  key_mic", mic, mic_len);
1929 #endif /* CONFIG_NO_STDOUT_DEBUG */
1930 }
1931
1932
1933 #ifdef CONFIG_FILS
1934 static int wpa_supp_aead_decrypt(struct wpa_sm *sm, u8 *buf, size_t buf_len,
1935                                  size_t *key_data_len)
1936 {
1937         struct wpa_ptk *ptk;
1938         struct ieee802_1x_hdr *hdr;
1939         struct wpa_eapol_key *key;
1940         u8 *pos, *tmp;
1941         const u8 *aad[1];
1942         size_t aad_len[1];
1943
1944         if (*key_data_len < AES_BLOCK_SIZE) {
1945                 wpa_printf(MSG_INFO, "No room for AES-SIV data in the frame");
1946                 return -1;
1947         }
1948
1949         if (sm->tptk_set)
1950                 ptk = &sm->tptk;
1951         else if (sm->ptk_set)
1952                 ptk = &sm->ptk;
1953         else
1954                 return -1;
1955
1956         hdr = (struct ieee802_1x_hdr *) buf;
1957         key = (struct wpa_eapol_key *) (hdr + 1);
1958         pos = (u8 *) (key + 1);
1959         pos += 2; /* Pointing at the Encrypted Key Data field */
1960
1961         tmp = os_malloc(*key_data_len);
1962         if (!tmp)
1963                 return -1;
1964
1965         /* AES-SIV AAD from EAPOL protocol version field (inclusive) to
1966          * to Key Data (exclusive). */
1967         aad[0] = buf;
1968         aad_len[0] = pos - buf;
1969         if (aes_siv_decrypt(ptk->kek, ptk->kek_len, pos, *key_data_len,
1970                             1, aad, aad_len, tmp) < 0) {
1971                 wpa_printf(MSG_INFO, "Invalid AES-SIV data in the frame");
1972                 bin_clear_free(tmp, *key_data_len);
1973                 return -1;
1974         }
1975
1976         /* AEAD decryption and validation completed successfully */
1977         (*key_data_len) -= AES_BLOCK_SIZE;
1978         wpa_hexdump_key(MSG_DEBUG, "WPA: Decrypted Key Data",
1979                         tmp, *key_data_len);
1980
1981         /* Replace Key Data field with the decrypted version */
1982         os_memcpy(pos, tmp, *key_data_len);
1983         pos -= 2; /* Key Data Length field */
1984         WPA_PUT_BE16(pos, *key_data_len);
1985         bin_clear_free(tmp, *key_data_len);
1986
1987         if (sm->tptk_set) {
1988                 sm->tptk_set = 0;
1989                 sm->ptk_set = 1;
1990                 os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
1991                 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
1992         }
1993
1994         os_memcpy(sm->rx_replay_counter, key->replay_counter,
1995                   WPA_REPLAY_COUNTER_LEN);
1996         sm->rx_replay_counter_set = 1;
1997
1998         return 0;
1999 }
2000 #endif /* CONFIG_FILS */
2001
2002
2003 /**
2004  * wpa_sm_rx_eapol - Process received WPA EAPOL frames
2005  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2006  * @src_addr: Source MAC address of the EAPOL packet
2007  * @buf: Pointer to the beginning of the EAPOL data (EAPOL header)
2008  * @len: Length of the EAPOL frame
2009  * Returns: 1 = WPA EAPOL-Key processed, 0 = not a WPA EAPOL-Key, -1 failure
2010  *
2011  * This function is called for each received EAPOL frame. Other than EAPOL-Key
2012  * frames can be skipped if filtering is done elsewhere. wpa_sm_rx_eapol() is
2013  * only processing WPA and WPA2 EAPOL-Key frames.
2014  *
2015  * The received EAPOL-Key packets are validated and valid packets are replied
2016  * to. In addition, key material (PTK, GTK) is configured at the end of a
2017  * successful key handshake.
2018  */
2019 int wpa_sm_rx_eapol(struct wpa_sm *sm, const u8 *src_addr,
2020                     const u8 *buf, size_t len)
2021 {
2022         size_t plen, data_len, key_data_len;
2023         const struct ieee802_1x_hdr *hdr;
2024         struct wpa_eapol_key *key;
2025         u16 key_info, ver;
2026         u8 *tmp = NULL;
2027         int ret = -1;
2028         u8 *mic, *key_data;
2029         size_t mic_len, keyhdrlen;
2030
2031 #ifdef CONFIG_IEEE80211R
2032         sm->ft_completed = 0;
2033 #endif /* CONFIG_IEEE80211R */
2034
2035         mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len);
2036         keyhdrlen = sizeof(*key) + mic_len + 2;
2037
2038         if (len < sizeof(*hdr) + keyhdrlen) {
2039                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2040                         "WPA: EAPOL frame too short to be a WPA "
2041                         "EAPOL-Key (len %lu, expecting at least %lu)",
2042                         (unsigned long) len,
2043                         (unsigned long) sizeof(*hdr) + keyhdrlen);
2044                 return 0;
2045         }
2046
2047         hdr = (const struct ieee802_1x_hdr *) buf;
2048         plen = be_to_host16(hdr->length);
2049         data_len = plen + sizeof(*hdr);
2050         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2051                 "IEEE 802.1X RX: version=%d type=%d length=%lu",
2052                 hdr->version, hdr->type, (unsigned long) plen);
2053
2054         if (hdr->version < EAPOL_VERSION) {
2055                 /* TODO: backwards compatibility */
2056         }
2057         if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
2058                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2059                         "WPA: EAPOL frame (type %u) discarded, "
2060                         "not a Key frame", hdr->type);
2061                 ret = 0;
2062                 goto out;
2063         }
2064         wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
2065         if (plen > len - sizeof(*hdr) || plen < keyhdrlen) {
2066                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2067                         "WPA: EAPOL frame payload size %lu "
2068                         "invalid (frame size %lu)",
2069                         (unsigned long) plen, (unsigned long) len);
2070                 ret = 0;
2071                 goto out;
2072         }
2073         if (data_len < len) {
2074                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2075                         "WPA: ignoring %lu bytes after the IEEE 802.1X data",
2076                         (unsigned long) len - data_len);
2077         }
2078
2079         /*
2080          * Make a copy of the frame since we need to modify the buffer during
2081          * MAC validation and Key Data decryption.
2082          */
2083         tmp = os_memdup(buf, data_len);
2084         if (tmp == NULL)
2085                 goto out;
2086         key = (struct wpa_eapol_key *) (tmp + sizeof(struct ieee802_1x_hdr));
2087         mic = (u8 *) (key + 1);
2088         key_data = mic + mic_len + 2;
2089
2090         if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
2091         {
2092                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2093                         "WPA: EAPOL-Key type (%d) unknown, discarded",
2094                         key->type);
2095                 ret = 0;
2096                 goto out;
2097         }
2098
2099         key_data_len = WPA_GET_BE16(mic + mic_len);
2100         wpa_eapol_key_dump(sm, key, key_data_len, mic, mic_len);
2101
2102         if (key_data_len > plen - keyhdrlen) {
2103                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO, "WPA: Invalid EAPOL-Key "
2104                         "frame - key_data overflow (%u > %u)",
2105                         (unsigned int) key_data_len,
2106                         (unsigned int) (plen - keyhdrlen));
2107                 goto out;
2108         }
2109
2110         eapol_sm_notify_lower_layer_success(sm->eapol, 0);
2111         key_info = WPA_GET_BE16(key->key_info);
2112         ver = key_info & WPA_KEY_INFO_TYPE_MASK;
2113         if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
2114 #if defined(CONFIG_IEEE80211R) || defined(CONFIG_IEEE80211W)
2115             ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2116 #endif /* CONFIG_IEEE80211R || CONFIG_IEEE80211W */
2117             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
2118             !wpa_use_akm_defined(sm->key_mgmt)) {
2119                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2120                         "WPA: Unsupported EAPOL-Key descriptor version %d",
2121                         ver);
2122                 goto out;
2123         }
2124
2125         if (wpa_use_akm_defined(sm->key_mgmt) &&
2126             ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) {
2127                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2128                         "RSN: Unsupported EAPOL-Key descriptor version %d (expected AKM defined = 0)",
2129                         ver);
2130                 goto out;
2131         }
2132
2133 #ifdef CONFIG_IEEE80211R
2134         if (wpa_key_mgmt_ft(sm->key_mgmt)) {
2135                 /* IEEE 802.11r uses a new key_info type (AES-128-CMAC). */
2136                 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2137                     !wpa_use_akm_defined(sm->key_mgmt)) {
2138                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2139                                 "FT: AP did not use AES-128-CMAC");
2140                         goto out;
2141                 }
2142         } else
2143 #endif /* CONFIG_IEEE80211R */
2144 #ifdef CONFIG_IEEE80211W
2145         if (wpa_key_mgmt_sha256(sm->key_mgmt)) {
2146                 if (ver != WPA_KEY_INFO_TYPE_AES_128_CMAC &&
2147                     !wpa_use_akm_defined(sm->key_mgmt)) {
2148                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2149                                 "WPA: AP did not use the "
2150                                 "negotiated AES-128-CMAC");
2151                         goto out;
2152                 }
2153         } else
2154 #endif /* CONFIG_IEEE80211W */
2155         if (sm->pairwise_cipher == WPA_CIPHER_CCMP &&
2156             !wpa_use_akm_defined(sm->key_mgmt) &&
2157             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
2158                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2159                         "WPA: CCMP is used, but EAPOL-Key "
2160                         "descriptor version (%d) is not 2", ver);
2161                 if (sm->group_cipher != WPA_CIPHER_CCMP &&
2162                     !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
2163                         /* Earlier versions of IEEE 802.11i did not explicitly
2164                          * require version 2 descriptor for all EAPOL-Key
2165                          * packets, so allow group keys to use version 1 if
2166                          * CCMP is not used for them. */
2167                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2168                                 "WPA: Backwards compatibility: allow invalid "
2169                                 "version for non-CCMP group keys");
2170                 } else if (ver == WPA_KEY_INFO_TYPE_AES_128_CMAC) {
2171                         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2172                                 "WPA: Interoperability workaround: allow incorrect (should have been HMAC-SHA1), but stronger (is AES-128-CMAC), descriptor version to be used");
2173                 } else
2174                         goto out;
2175         } else if (sm->pairwise_cipher == WPA_CIPHER_GCMP &&
2176                    !wpa_use_akm_defined(sm->key_mgmt) &&
2177                    ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
2178                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2179                         "WPA: GCMP is used, but EAPOL-Key "
2180                         "descriptor version (%d) is not 2", ver);
2181                 goto out;
2182         }
2183
2184         if (sm->rx_replay_counter_set &&
2185             os_memcmp(key->replay_counter, sm->rx_replay_counter,
2186                       WPA_REPLAY_COUNTER_LEN) <= 0) {
2187                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2188                         "WPA: EAPOL-Key Replay Counter did not increase - "
2189                         "dropping packet");
2190                 goto out;
2191         }
2192
2193         if (key_info & WPA_KEY_INFO_SMK_MESSAGE) {
2194                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2195                         "WPA: Unsupported SMK bit in key_info");
2196                 goto out;
2197         }
2198
2199         if (!(key_info & WPA_KEY_INFO_ACK)) {
2200                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2201                         "WPA: No Ack bit in key_info");
2202                 goto out;
2203         }
2204
2205         if (key_info & WPA_KEY_INFO_REQUEST) {
2206                 wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
2207                         "WPA: EAPOL-Key with Request bit - dropped");
2208                 goto out;
2209         }
2210
2211         if ((key_info & WPA_KEY_INFO_MIC) &&
2212             wpa_supplicant_verify_eapol_key_mic(sm, key, ver, tmp, data_len))
2213                 goto out;
2214
2215 #ifdef CONFIG_FILS
2216         if (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
2217                 if (wpa_supp_aead_decrypt(sm, tmp, data_len, &key_data_len))
2218                         goto out;
2219         }
2220 #endif /* CONFIG_FILS */
2221
2222         if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) &&
2223             (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
2224                 /*
2225                  * Only decrypt the Key Data field if the frame's authenticity
2226                  * was verified. When using AES-SIV (FILS), the MIC flag is not
2227                  * set, so this check should only be performed if mic_len != 0
2228                  * which is the case in this code branch.
2229                  */
2230                 if (!(key_info & WPA_KEY_INFO_MIC)) {
2231                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2232                                 "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
2233                         goto out;
2234                 }
2235                 if (wpa_supplicant_decrypt_key_data(sm, key, mic_len,
2236                                                     ver, key_data,
2237                                                     &key_data_len))
2238                         goto out;
2239         }
2240
2241         if (key_info & WPA_KEY_INFO_KEY_TYPE) {
2242                 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
2243                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2244                                 "WPA: Ignored EAPOL-Key (Pairwise) with "
2245                                 "non-zero key index");
2246                         goto out;
2247                 }
2248                 if (key_info & (WPA_KEY_INFO_MIC |
2249                                 WPA_KEY_INFO_ENCR_KEY_DATA)) {
2250                         /* 3/4 4-Way Handshake */
2251                         wpa_supplicant_process_3_of_4(sm, key, ver, key_data,
2252                                                       key_data_len);
2253                 } else {
2254                         /* 1/4 4-Way Handshake */
2255                         wpa_supplicant_process_1_of_4(sm, src_addr, key,
2256                                                       ver, key_data,
2257                                                       key_data_len);
2258                 }
2259         } else {
2260                 if ((mic_len && (key_info & WPA_KEY_INFO_MIC)) ||
2261                     (!mic_len && (key_info & WPA_KEY_INFO_ENCR_KEY_DATA))) {
2262                         /* 1/2 Group Key Handshake */
2263                         wpa_supplicant_process_1_of_2(sm, src_addr, key,
2264                                                       key_data, key_data_len,
2265                                                       ver);
2266                 } else {
2267                         wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
2268                                 "WPA: EAPOL-Key (Group) without Mic/Encr bit - "
2269                                 "dropped");
2270                 }
2271         }
2272
2273         ret = 1;
2274
2275 out:
2276         bin_clear_free(tmp, data_len);
2277         return ret;
2278 }
2279
2280
2281 #ifdef CONFIG_CTRL_IFACE
2282 static u32 wpa_key_mgmt_suite(struct wpa_sm *sm)
2283 {
2284         switch (sm->key_mgmt) {
2285         case WPA_KEY_MGMT_IEEE8021X:
2286                 return ((sm->proto == WPA_PROTO_RSN ||
2287                          sm->proto == WPA_PROTO_OSEN) ?
2288                         RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2289                         WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2290         case WPA_KEY_MGMT_PSK:
2291                 return (sm->proto == WPA_PROTO_RSN ?
2292                         RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2293                         WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2294 #ifdef CONFIG_IEEE80211R
2295         case WPA_KEY_MGMT_FT_IEEE8021X:
2296                 return RSN_AUTH_KEY_MGMT_FT_802_1X;
2297         case WPA_KEY_MGMT_FT_PSK:
2298                 return RSN_AUTH_KEY_MGMT_FT_PSK;
2299 #endif /* CONFIG_IEEE80211R */
2300 #ifdef CONFIG_IEEE80211W
2301         case WPA_KEY_MGMT_IEEE8021X_SHA256:
2302                 return RSN_AUTH_KEY_MGMT_802_1X_SHA256;
2303         case WPA_KEY_MGMT_PSK_SHA256:
2304                 return RSN_AUTH_KEY_MGMT_PSK_SHA256;
2305 #endif /* CONFIG_IEEE80211W */
2306         case WPA_KEY_MGMT_CCKM:
2307                 return (sm->proto == WPA_PROTO_RSN ?
2308                         RSN_AUTH_KEY_MGMT_CCKM:
2309                         WPA_AUTH_KEY_MGMT_CCKM);
2310         case WPA_KEY_MGMT_WPA_NONE:
2311                 return WPA_AUTH_KEY_MGMT_NONE;
2312         case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
2313                 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B;
2314         case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
2315                 return RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192;
2316         default:
2317                 return 0;
2318         }
2319 }
2320
2321
2322 #define RSN_SUITE "%02x-%02x-%02x-%d"
2323 #define RSN_SUITE_ARG(s) \
2324 ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
2325
2326 /**
2327  * wpa_sm_get_mib - Dump text list of MIB entries
2328  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2329  * @buf: Buffer for the list
2330  * @buflen: Length of the buffer
2331  * Returns: Number of bytes written to buffer
2332  *
2333  * This function is used fetch dot11 MIB variables.
2334  */
2335 int wpa_sm_get_mib(struct wpa_sm *sm, char *buf, size_t buflen)
2336 {
2337         char pmkid_txt[PMKID_LEN * 2 + 1];
2338         int rsna, ret;
2339         size_t len;
2340
2341         if (sm->cur_pmksa) {
2342                 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt),
2343                                  sm->cur_pmksa->pmkid, PMKID_LEN);
2344         } else
2345                 pmkid_txt[0] = '\0';
2346
2347         if ((wpa_key_mgmt_wpa_psk(sm->key_mgmt) ||
2348              wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt)) &&
2349             sm->proto == WPA_PROTO_RSN)
2350                 rsna = 1;
2351         else
2352                 rsna = 0;
2353
2354         ret = os_snprintf(buf, buflen,
2355                           "dot11RSNAOptionImplemented=TRUE\n"
2356                           "dot11RSNAPreauthenticationImplemented=TRUE\n"
2357                           "dot11RSNAEnabled=%s\n"
2358                           "dot11RSNAPreauthenticationEnabled=%s\n"
2359                           "dot11RSNAConfigVersion=%d\n"
2360                           "dot11RSNAConfigPairwiseKeysSupported=5\n"
2361                           "dot11RSNAConfigGroupCipherSize=%d\n"
2362                           "dot11RSNAConfigPMKLifetime=%d\n"
2363                           "dot11RSNAConfigPMKReauthThreshold=%d\n"
2364                           "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2365                           "dot11RSNAConfigSATimeout=%d\n",
2366                           rsna ? "TRUE" : "FALSE",
2367                           rsna ? "TRUE" : "FALSE",
2368                           RSN_VERSION,
2369                           wpa_cipher_key_len(sm->group_cipher) * 8,
2370                           sm->dot11RSNAConfigPMKLifetime,
2371                           sm->dot11RSNAConfigPMKReauthThreshold,
2372                           sm->dot11RSNAConfigSATimeout);
2373         if (os_snprintf_error(buflen, ret))
2374                 return 0;
2375         len = ret;
2376
2377         ret = os_snprintf(
2378                 buf + len, buflen - len,
2379                 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2380                 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2381                 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2382                 "dot11RSNAPMKIDUsed=%s\n"
2383                 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2384                 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2385                 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2386                 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n"
2387                 "dot11RSNA4WayHandshakeFailures=%u\n",
2388                 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
2389                 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2390                                                   sm->pairwise_cipher)),
2391                 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2392                                                   sm->group_cipher)),
2393                 pmkid_txt,
2394                 RSN_SUITE_ARG(wpa_key_mgmt_suite(sm)),
2395                 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2396                                                   sm->pairwise_cipher)),
2397                 RSN_SUITE_ARG(wpa_cipher_to_suite(sm->proto,
2398                                                   sm->group_cipher)),
2399                 sm->dot11RSNA4WayHandshakeFailures);
2400         if (!os_snprintf_error(buflen - len, ret))
2401                 len += ret;
2402
2403         return (int) len;
2404 }
2405 #endif /* CONFIG_CTRL_IFACE */
2406
2407
2408 static void wpa_sm_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry,
2409                                  void *ctx, enum pmksa_free_reason reason)
2410 {
2411         struct wpa_sm *sm = ctx;
2412         int deauth = 0;
2413
2414         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: PMKSA cache entry free_cb: "
2415                 MACSTR " reason=%d", MAC2STR(entry->aa), reason);
2416
2417         if (sm->cur_pmksa == entry) {
2418                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2419                         "RSN: %s current PMKSA entry",
2420                         reason == PMKSA_REPLACE ? "replaced" : "removed");
2421                 pmksa_cache_clear_current(sm);
2422
2423                 /*
2424                  * If an entry is simply being replaced, there's no need to
2425                  * deauthenticate because it will be immediately re-added.
2426                  * This happens when EAP authentication is completed again
2427                  * (reauth or failed PMKSA caching attempt).
2428                  */
2429                 if (reason != PMKSA_REPLACE)
2430                         deauth = 1;
2431         }
2432
2433         if (reason == PMKSA_EXPIRE &&
2434             (sm->pmk_len == entry->pmk_len &&
2435              os_memcmp(sm->pmk, entry->pmk, sm->pmk_len) == 0)) {
2436                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2437                         "RSN: deauthenticating due to expired PMK");
2438                 pmksa_cache_clear_current(sm);
2439                 deauth = 1;
2440         }
2441
2442         if (deauth) {
2443                 sm->pmk_len = 0;
2444                 os_memset(sm->pmk, 0, sizeof(sm->pmk));
2445                 wpa_sm_deauthenticate(sm, WLAN_REASON_UNSPECIFIED);
2446         }
2447 }
2448
2449
2450 /**
2451  * wpa_sm_init - Initialize WPA state machine
2452  * @ctx: Context pointer for callbacks; this needs to be an allocated buffer
2453  * Returns: Pointer to the allocated WPA state machine data
2454  *
2455  * This function is used to allocate a new WPA state machine and the returned
2456  * value is passed to all WPA state machine calls.
2457  */
2458 struct wpa_sm * wpa_sm_init(struct wpa_sm_ctx *ctx)
2459 {
2460         struct wpa_sm *sm;
2461
2462         sm = os_zalloc(sizeof(*sm));
2463         if (sm == NULL)
2464                 return NULL;
2465         dl_list_init(&sm->pmksa_candidates);
2466         sm->renew_snonce = 1;
2467         sm->ctx = ctx;
2468
2469         sm->dot11RSNAConfigPMKLifetime = 43200;
2470         sm->dot11RSNAConfigPMKReauthThreshold = 70;
2471         sm->dot11RSNAConfigSATimeout = 60;
2472
2473         sm->pmksa = pmksa_cache_init(wpa_sm_pmksa_free_cb, sm, sm);
2474         if (sm->pmksa == NULL) {
2475                 wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,
2476                         "RSN: PMKSA cache initialization failed");
2477                 os_free(sm);
2478                 return NULL;
2479         }
2480
2481         return sm;
2482 }
2483
2484
2485 /**
2486  * wpa_sm_deinit - Deinitialize WPA state machine
2487  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2488  */
2489 void wpa_sm_deinit(struct wpa_sm *sm)
2490 {
2491         if (sm == NULL)
2492                 return;
2493         pmksa_cache_deinit(sm->pmksa);
2494         eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2495         eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
2496         os_free(sm->assoc_wpa_ie);
2497         os_free(sm->ap_wpa_ie);
2498         os_free(sm->ap_rsn_ie);
2499         wpa_sm_drop_sa(sm);
2500         os_free(sm->ctx);
2501 #ifdef CONFIG_IEEE80211R
2502         os_free(sm->assoc_resp_ies);
2503 #endif /* CONFIG_IEEE80211R */
2504 #ifdef CONFIG_TESTING_OPTIONS
2505         wpabuf_free(sm->test_assoc_ie);
2506 #endif /* CONFIG_TESTING_OPTIONS */
2507 #ifdef CONFIG_FILS_SK_PFS
2508         crypto_ecdh_deinit(sm->fils_ecdh);
2509 #endif /* CONFIG_FILS_SK_PFS */
2510 #ifdef CONFIG_FILS
2511         wpabuf_free(sm->fils_ft_ies);
2512 #endif /* CONFIG_FILS */
2513 #ifdef CONFIG_OWE
2514         crypto_ecdh_deinit(sm->owe_ecdh);
2515 #endif /* CONFIG_OWE */
2516         os_free(sm);
2517 }
2518
2519
2520 /**
2521  * wpa_sm_notify_assoc - Notify WPA state machine about association
2522  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2523  * @bssid: The BSSID of the new association
2524  *
2525  * This function is called to let WPA state machine know that the connection
2526  * was established.
2527  */
2528 void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
2529 {
2530         int clear_keys = 1;
2531
2532         if (sm == NULL)
2533                 return;
2534
2535         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
2536                 "WPA: Association event - clear replay counter");
2537         os_memcpy(sm->bssid, bssid, ETH_ALEN);
2538         os_memset(sm->rx_replay_counter, 0, WPA_REPLAY_COUNTER_LEN);
2539         sm->rx_replay_counter_set = 0;
2540         sm->renew_snonce = 1;
2541         if (os_memcmp(sm->preauth_bssid, bssid, ETH_ALEN) == 0)
2542                 rsn_preauth_deinit(sm);
2543
2544 #ifdef CONFIG_IEEE80211R
2545         if (wpa_ft_is_completed(sm)) {
2546                 /*
2547                  * Clear portValid to kick EAPOL state machine to re-enter
2548                  * AUTHENTICATED state to get the EAPOL port Authorized.
2549                  */
2550                 eapol_sm_notify_portValid(sm->eapol, FALSE);
2551                 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2552
2553                 /* Prepare for the next transition */
2554                 wpa_ft_prepare_auth_request(sm, NULL);
2555
2556                 clear_keys = 0;
2557         }
2558 #endif /* CONFIG_IEEE80211R */
2559 #ifdef CONFIG_FILS
2560         if (sm->fils_completed) {
2561                 /*
2562                  * Clear portValid to kick EAPOL state machine to re-enter
2563                  * AUTHENTICATED state to get the EAPOL port Authorized.
2564                  */
2565                 wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
2566                 clear_keys = 0;
2567         }
2568 #endif /* CONFIG_FILS */
2569
2570         if (clear_keys) {
2571                 /*
2572                  * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
2573                  * this is not part of a Fast BSS Transition.
2574                  */
2575                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PTK");
2576                 sm->ptk_set = 0;
2577                 os_memset(&sm->ptk, 0, sizeof(sm->ptk));
2578                 sm->tptk_set = 0;
2579                 os_memset(&sm->tptk, 0, sizeof(sm->tptk));
2580                 os_memset(&sm->gtk, 0, sizeof(sm->gtk));
2581                 os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
2582 #ifdef CONFIG_IEEE80211W
2583                 os_memset(&sm->igtk, 0, sizeof(sm->igtk));
2584                 os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
2585 #endif /* CONFIG_IEEE80211W */
2586         }
2587
2588 #ifdef CONFIG_TDLS
2589         wpa_tdls_assoc(sm);
2590 #endif /* CONFIG_TDLS */
2591
2592 #ifdef CONFIG_P2P
2593         os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
2594 #endif /* CONFIG_P2P */
2595 }
2596
2597
2598 /**
2599  * wpa_sm_notify_disassoc - Notify WPA state machine about disassociation
2600  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2601  *
2602  * This function is called to let WPA state machine know that the connection
2603  * was lost. This will abort any existing pre-authentication session.
2604  */
2605 void wpa_sm_notify_disassoc(struct wpa_sm *sm)
2606 {
2607         eloop_cancel_timeout(wpa_sm_start_preauth, sm, NULL);
2608         eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
2609         rsn_preauth_deinit(sm);
2610         pmksa_cache_clear_current(sm);
2611         if (wpa_sm_get_state(sm) == WPA_4WAY_HANDSHAKE)
2612                 sm->dot11RSNA4WayHandshakeFailures++;
2613 #ifdef CONFIG_TDLS
2614         wpa_tdls_disassoc(sm);
2615 #endif /* CONFIG_TDLS */
2616 #ifdef CONFIG_FILS
2617         sm->fils_completed = 0;
2618 #endif /* CONFIG_FILS */
2619 #ifdef CONFIG_IEEE80211R
2620         sm->ft_reassoc_completed = 0;
2621 #endif /* CONFIG_IEEE80211R */
2622
2623         /* Keys are not needed in the WPA state machine anymore */
2624         wpa_sm_drop_sa(sm);
2625
2626         sm->msg_3_of_4_ok = 0;
2627         os_memset(sm->bssid, 0, ETH_ALEN);
2628 }
2629
2630
2631 /**
2632  * wpa_sm_set_pmk - Set PMK
2633  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2634  * @pmk: The new PMK
2635  * @pmk_len: The length of the new PMK in bytes
2636  * @pmkid: Calculated PMKID
2637  * @bssid: AA to add into PMKSA cache or %NULL to not cache the PMK
2638  *
2639  * Configure the PMK for WPA state machine.
2640  */
2641 void wpa_sm_set_pmk(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
2642                     const u8 *pmkid, const u8 *bssid)
2643 {
2644         if (sm == NULL)
2645                 return;
2646
2647         wpa_hexdump_key(MSG_DEBUG, "WPA: Set PMK based on external data",
2648                         pmk, pmk_len);
2649         sm->pmk_len = pmk_len;
2650         os_memcpy(sm->pmk, pmk, pmk_len);
2651
2652 #ifdef CONFIG_IEEE80211R
2653         /* Set XXKey to be PSK for FT key derivation */
2654         sm->xxkey_len = pmk_len;
2655         os_memcpy(sm->xxkey, pmk, pmk_len);
2656 #endif /* CONFIG_IEEE80211R */
2657
2658         if (bssid) {
2659                 pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
2660                                 bssid, sm->own_addr,
2661                                 sm->network_ctx, sm->key_mgmt, NULL);
2662         }
2663 }
2664
2665
2666 /**
2667  * wpa_sm_set_pmk_from_pmksa - Set PMK based on the current PMKSA
2668  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2669  *
2670  * Take the PMK from the current PMKSA into use. If no PMKSA is active, the PMK
2671  * will be cleared.
2672  */
2673 void wpa_sm_set_pmk_from_pmksa(struct wpa_sm *sm)
2674 {
2675         if (sm == NULL)
2676                 return;
2677
2678         if (sm->cur_pmksa) {
2679                 wpa_hexdump_key(MSG_DEBUG,
2680                                 "WPA: Set PMK based on current PMKSA",
2681                                 sm->cur_pmksa->pmk, sm->cur_pmksa->pmk_len);
2682                 sm->pmk_len = sm->cur_pmksa->pmk_len;
2683                 os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
2684         } else {
2685                 wpa_printf(MSG_DEBUG, "WPA: No current PMKSA - clear PMK");
2686                 sm->pmk_len = 0;
2687                 os_memset(sm->pmk, 0, PMK_LEN_MAX);
2688         }
2689 }
2690
2691
2692 /**
2693  * wpa_sm_set_fast_reauth - Set fast reauthentication (EAP) enabled/disabled
2694  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2695  * @fast_reauth: Whether fast reauthentication (EAP) is allowed
2696  */
2697 void wpa_sm_set_fast_reauth(struct wpa_sm *sm, int fast_reauth)
2698 {
2699         if (sm)
2700                 sm->fast_reauth = fast_reauth;
2701 }
2702
2703
2704 /**
2705  * wpa_sm_set_scard_ctx - Set context pointer for smartcard callbacks
2706  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2707  * @scard_ctx: Context pointer for smartcard related callback functions
2708  */
2709 void wpa_sm_set_scard_ctx(struct wpa_sm *sm, void *scard_ctx)
2710 {
2711         if (sm == NULL)
2712                 return;
2713         sm->scard_ctx = scard_ctx;
2714         if (sm->preauth_eapol)
2715                 eapol_sm_register_scard_ctx(sm->preauth_eapol, scard_ctx);
2716 }
2717
2718
2719 /**
2720  * wpa_sm_set_config - Notification of current configration change
2721  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2722  * @config: Pointer to current network configuration
2723  *
2724  * Notify WPA state machine that configuration has changed. config will be
2725  * stored as a backpointer to network configuration. This can be %NULL to clear
2726  * the stored pointed.
2727  */
2728 void wpa_sm_set_config(struct wpa_sm *sm, struct rsn_supp_config *config)
2729 {
2730         if (!sm)
2731                 return;
2732
2733         if (config) {
2734                 sm->network_ctx = config->network_ctx;
2735                 sm->allowed_pairwise_cipher = config->allowed_pairwise_cipher;
2736                 sm->proactive_key_caching = config->proactive_key_caching;
2737                 sm->eap_workaround = config->eap_workaround;
2738                 sm->eap_conf_ctx = config->eap_conf_ctx;
2739                 if (config->ssid) {
2740                         os_memcpy(sm->ssid, config->ssid, config->ssid_len);
2741                         sm->ssid_len = config->ssid_len;
2742                 } else
2743                         sm->ssid_len = 0;
2744                 sm->wpa_ptk_rekey = config->wpa_ptk_rekey;
2745                 sm->p2p = config->p2p;
2746                 sm->wpa_rsc_relaxation = config->wpa_rsc_relaxation;
2747 #ifdef CONFIG_FILS
2748                 if (config->fils_cache_id) {
2749                         sm->fils_cache_id_set = 1;
2750                         os_memcpy(sm->fils_cache_id, config->fils_cache_id,
2751                                   FILS_CACHE_ID_LEN);
2752                 } else {
2753                         sm->fils_cache_id_set = 0;
2754                 }
2755 #endif /* CONFIG_FILS */
2756         } else {
2757                 sm->network_ctx = NULL;
2758                 sm->allowed_pairwise_cipher = 0;
2759                 sm->proactive_key_caching = 0;
2760                 sm->eap_workaround = 0;
2761                 sm->eap_conf_ctx = NULL;
2762                 sm->ssid_len = 0;
2763                 sm->wpa_ptk_rekey = 0;
2764                 sm->p2p = 0;
2765                 sm->wpa_rsc_relaxation = 0;
2766         }
2767 }
2768
2769
2770 /**
2771  * wpa_sm_set_own_addr - Set own MAC address
2772  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2773  * @addr: Own MAC address
2774  */
2775 void wpa_sm_set_own_addr(struct wpa_sm *sm, const u8 *addr)
2776 {
2777         if (sm)
2778                 os_memcpy(sm->own_addr, addr, ETH_ALEN);
2779 }
2780
2781
2782 /**
2783  * wpa_sm_set_ifname - Set network interface name
2784  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2785  * @ifname: Interface name
2786  * @bridge_ifname: Optional bridge interface name (for pre-auth)
2787  */
2788 void wpa_sm_set_ifname(struct wpa_sm *sm, const char *ifname,
2789                        const char *bridge_ifname)
2790 {
2791         if (sm) {
2792                 sm->ifname = ifname;
2793                 sm->bridge_ifname = bridge_ifname;
2794         }
2795 }
2796
2797
2798 /**
2799  * wpa_sm_set_eapol - Set EAPOL state machine pointer
2800  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2801  * @eapol: Pointer to EAPOL state machine allocated with eapol_sm_init()
2802  */
2803 void wpa_sm_set_eapol(struct wpa_sm *sm, struct eapol_sm *eapol)
2804 {
2805         if (sm)
2806                 sm->eapol = eapol;
2807 }
2808
2809
2810 /**
2811  * wpa_sm_set_param - Set WPA state machine parameters
2812  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2813  * @param: Parameter field
2814  * @value: Parameter value
2815  * Returns: 0 on success, -1 on failure
2816  */
2817 int wpa_sm_set_param(struct wpa_sm *sm, enum wpa_sm_conf_params param,
2818                      unsigned int value)
2819 {
2820         int ret = 0;
2821
2822         if (sm == NULL)
2823                 return -1;
2824
2825         switch (param) {
2826         case RSNA_PMK_LIFETIME:
2827                 if (value > 0)
2828                         sm->dot11RSNAConfigPMKLifetime = value;
2829                 else
2830                         ret = -1;
2831                 break;
2832         case RSNA_PMK_REAUTH_THRESHOLD:
2833                 if (value > 0 && value <= 100)
2834                         sm->dot11RSNAConfigPMKReauthThreshold = value;
2835                 else
2836                         ret = -1;
2837                 break;
2838         case RSNA_SA_TIMEOUT:
2839                 if (value > 0)
2840                         sm->dot11RSNAConfigSATimeout = value;
2841                 else
2842                         ret = -1;
2843                 break;
2844         case WPA_PARAM_PROTO:
2845                 sm->proto = value;
2846                 break;
2847         case WPA_PARAM_PAIRWISE:
2848                 sm->pairwise_cipher = value;
2849                 break;
2850         case WPA_PARAM_GROUP:
2851                 sm->group_cipher = value;
2852                 break;
2853         case WPA_PARAM_KEY_MGMT:
2854                 sm->key_mgmt = value;
2855                 break;
2856 #ifdef CONFIG_IEEE80211W
2857         case WPA_PARAM_MGMT_GROUP:
2858                 sm->mgmt_group_cipher = value;
2859                 break;
2860 #endif /* CONFIG_IEEE80211W */
2861         case WPA_PARAM_RSN_ENABLED:
2862                 sm->rsn_enabled = value;
2863                 break;
2864         case WPA_PARAM_MFP:
2865                 sm->mfp = value;
2866                 break;
2867         default:
2868                 break;
2869         }
2870
2871         return ret;
2872 }
2873
2874
2875 /**
2876  * wpa_sm_get_status - Get WPA state machine
2877  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2878  * @buf: Buffer for status information
2879  * @buflen: Maximum buffer length
2880  * @verbose: Whether to include verbose status information
2881  * Returns: Number of bytes written to buf.
2882  *
2883  * Query WPA state machine for status information. This function fills in
2884  * a text area with current status information. If the buffer (buf) is not
2885  * large enough, status information will be truncated to fit the buffer.
2886  */
2887 int wpa_sm_get_status(struct wpa_sm *sm, char *buf, size_t buflen,
2888                       int verbose)
2889 {
2890         char *pos = buf, *end = buf + buflen;
2891         int ret;
2892
2893         ret = os_snprintf(pos, end - pos,
2894                           "pairwise_cipher=%s\n"
2895                           "group_cipher=%s\n"
2896                           "key_mgmt=%s\n",
2897                           wpa_cipher_txt(sm->pairwise_cipher),
2898                           wpa_cipher_txt(sm->group_cipher),
2899                           wpa_key_mgmt_txt(sm->key_mgmt, sm->proto));
2900         if (os_snprintf_error(end - pos, ret))
2901                 return pos - buf;
2902         pos += ret;
2903
2904         if (sm->mfp != NO_MGMT_FRAME_PROTECTION && sm->ap_rsn_ie) {
2905                 struct wpa_ie_data rsn;
2906                 if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn)
2907                     >= 0 &&
2908                     rsn.capabilities & (WPA_CAPABILITY_MFPR |
2909                                         WPA_CAPABILITY_MFPC)) {
2910                         ret = os_snprintf(pos, end - pos, "pmf=%d\n"
2911                                           "mgmt_group_cipher=%s\n",
2912                                           (rsn.capabilities &
2913                                            WPA_CAPABILITY_MFPR) ? 2 : 1,
2914                                           wpa_cipher_txt(
2915                                                   sm->mgmt_group_cipher));
2916                         if (os_snprintf_error(end - pos, ret))
2917                                 return pos - buf;
2918                         pos += ret;
2919                 }
2920         }
2921
2922         return pos - buf;
2923 }
2924
2925
2926 int wpa_sm_pmf_enabled(struct wpa_sm *sm)
2927 {
2928         struct wpa_ie_data rsn;
2929
2930         if (sm->mfp == NO_MGMT_FRAME_PROTECTION || !sm->ap_rsn_ie)
2931                 return 0;
2932
2933         if (wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &rsn) >= 0 &&
2934             rsn.capabilities & (WPA_CAPABILITY_MFPR | WPA_CAPABILITY_MFPC))
2935                 return 1;
2936
2937         return 0;
2938 }
2939
2940
2941 /**
2942  * wpa_sm_set_assoc_wpa_ie_default - Generate own WPA/RSN IE from configuration
2943  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2944  * @wpa_ie: Pointer to buffer for WPA/RSN IE
2945  * @wpa_ie_len: Pointer to the length of the wpa_ie buffer
2946  * Returns: 0 on success, -1 on failure
2947  */
2948 int wpa_sm_set_assoc_wpa_ie_default(struct wpa_sm *sm, u8 *wpa_ie,
2949                                     size_t *wpa_ie_len)
2950 {
2951         int res;
2952
2953         if (sm == NULL)
2954                 return -1;
2955
2956 #ifdef CONFIG_TESTING_OPTIONS
2957         if (sm->test_assoc_ie) {
2958                 wpa_printf(MSG_DEBUG,
2959                            "TESTING: Replace association WPA/RSN IE");
2960                 if (*wpa_ie_len < wpabuf_len(sm->test_assoc_ie))
2961                         return -1;
2962                 os_memcpy(wpa_ie, wpabuf_head(sm->test_assoc_ie),
2963                           wpabuf_len(sm->test_assoc_ie));
2964                 res = wpabuf_len(sm->test_assoc_ie);
2965         } else
2966 #endif /* CONFIG_TESTING_OPTIONS */
2967         res = wpa_gen_wpa_ie(sm, wpa_ie, *wpa_ie_len);
2968         if (res < 0)
2969                 return -1;
2970         *wpa_ie_len = res;
2971
2972         wpa_hexdump(MSG_DEBUG, "WPA: Set own WPA IE default",
2973                     wpa_ie, *wpa_ie_len);
2974
2975         if (sm->assoc_wpa_ie == NULL) {
2976                 /*
2977                  * Make a copy of the WPA/RSN IE so that 4-Way Handshake gets
2978                  * the correct version of the IE even if PMKSA caching is
2979                  * aborted (which would remove PMKID from IE generation).
2980                  */
2981                 sm->assoc_wpa_ie = os_memdup(wpa_ie, *wpa_ie_len);
2982                 if (sm->assoc_wpa_ie == NULL)
2983                         return -1;
2984
2985                 sm->assoc_wpa_ie_len = *wpa_ie_len;
2986         } else {
2987                 wpa_hexdump(MSG_DEBUG,
2988                             "WPA: Leave previously set WPA IE default",
2989                             sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
2990         }
2991
2992         return 0;
2993 }
2994
2995
2996 /**
2997  * wpa_sm_set_assoc_wpa_ie - Set own WPA/RSN IE from (Re)AssocReq
2998  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2999  * @ie: Pointer to IE data (starting from id)
3000  * @len: IE length
3001  * Returns: 0 on success, -1 on failure
3002  *
3003  * Inform WPA state machine about the WPA/RSN IE used in (Re)Association
3004  * Request frame. The IE will be used to override the default value generated
3005  * with wpa_sm_set_assoc_wpa_ie_default().
3006  */
3007 int wpa_sm_set_assoc_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3008 {
3009         if (sm == NULL)
3010                 return -1;
3011
3012         os_free(sm->assoc_wpa_ie);
3013         if (ie == NULL || len == 0) {
3014                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3015                         "WPA: clearing own WPA/RSN IE");
3016                 sm->assoc_wpa_ie = NULL;
3017                 sm->assoc_wpa_ie_len = 0;
3018         } else {
3019                 wpa_hexdump(MSG_DEBUG, "WPA: set own WPA/RSN IE", ie, len);
3020                 sm->assoc_wpa_ie = os_memdup(ie, len);
3021                 if (sm->assoc_wpa_ie == NULL)
3022                         return -1;
3023
3024                 sm->assoc_wpa_ie_len = len;
3025         }
3026
3027         return 0;
3028 }
3029
3030
3031 /**
3032  * wpa_sm_set_ap_wpa_ie - Set AP WPA IE from Beacon/ProbeResp
3033  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3034  * @ie: Pointer to IE data (starting from id)
3035  * @len: IE length
3036  * Returns: 0 on success, -1 on failure
3037  *
3038  * Inform WPA state machine about the WPA IE used in Beacon / Probe Response
3039  * frame.
3040  */
3041 int wpa_sm_set_ap_wpa_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3042 {
3043         if (sm == NULL)
3044                 return -1;
3045
3046         os_free(sm->ap_wpa_ie);
3047         if (ie == NULL || len == 0) {
3048                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3049                         "WPA: clearing AP WPA IE");
3050                 sm->ap_wpa_ie = NULL;
3051                 sm->ap_wpa_ie_len = 0;
3052         } else {
3053                 wpa_hexdump(MSG_DEBUG, "WPA: set AP WPA IE", ie, len);
3054                 sm->ap_wpa_ie = os_memdup(ie, len);
3055                 if (sm->ap_wpa_ie == NULL)
3056                         return -1;
3057
3058                 sm->ap_wpa_ie_len = len;
3059         }
3060
3061         return 0;
3062 }
3063
3064
3065 /**
3066  * wpa_sm_set_ap_rsn_ie - Set AP RSN IE from Beacon/ProbeResp
3067  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3068  * @ie: Pointer to IE data (starting from id)
3069  * @len: IE length
3070  * Returns: 0 on success, -1 on failure
3071  *
3072  * Inform WPA state machine about the RSN IE used in Beacon / Probe Response
3073  * frame.
3074  */
3075 int wpa_sm_set_ap_rsn_ie(struct wpa_sm *sm, const u8 *ie, size_t len)
3076 {
3077         if (sm == NULL)
3078                 return -1;
3079
3080         os_free(sm->ap_rsn_ie);
3081         if (ie == NULL || len == 0) {
3082                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3083                         "WPA: clearing AP RSN IE");
3084                 sm->ap_rsn_ie = NULL;
3085                 sm->ap_rsn_ie_len = 0;
3086         } else {
3087                 wpa_hexdump(MSG_DEBUG, "WPA: set AP RSN IE", ie, len);
3088                 sm->ap_rsn_ie = os_memdup(ie, len);
3089                 if (sm->ap_rsn_ie == NULL)
3090                         return -1;
3091
3092                 sm->ap_rsn_ie_len = len;
3093         }
3094
3095         return 0;
3096 }
3097
3098
3099 /**
3100  * wpa_sm_parse_own_wpa_ie - Parse own WPA/RSN IE
3101  * @sm: Pointer to WPA state machine data from wpa_sm_init()
3102  * @data: Pointer to data area for parsing results
3103  * Returns: 0 on success, -1 if IE is not known, or -2 on parsing failure
3104  *
3105  * Parse the contents of the own WPA or RSN IE from (Re)AssocReq and write the
3106  * parsed data into data.
3107  */
3108 int wpa_sm_parse_own_wpa_ie(struct wpa_sm *sm, struct wpa_ie_data *data)
3109 {
3110         if (sm == NULL)
3111                 return -1;
3112
3113         if (sm->assoc_wpa_ie == NULL) {
3114                 wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
3115                         "WPA: No WPA/RSN IE available from association info");
3116                 return -1;
3117         }
3118         if (wpa_parse_wpa_ie(sm->assoc_wpa_ie, sm->assoc_wpa_ie_len, data))
3119                 return -2;
3120         return 0;
3121 }
3122
3123
3124 int wpa_sm_pmksa_cache_list(struct wpa_sm *sm, char *buf, size_t len)
3125 {
3126         return pmksa_cache_list(sm->pmksa, buf, len);
3127 }
3128
3129
3130 struct rsn_pmksa_cache_entry * wpa_sm_pmksa_cache_head(struct wpa_sm *sm)
3131 {
3132         return pmksa_cache_head(sm->pmksa);
3133 }
3134
3135
3136 struct rsn_pmksa_cache_entry *
3137 wpa_sm_pmksa_cache_add_entry(struct wpa_sm *sm,
3138                              struct rsn_pmksa_cache_entry * entry)
3139 {
3140         return pmksa_cache_add_entry(sm->pmksa, entry);
3141 }
3142
3143
3144 void wpa_sm_pmksa_cache_add(struct wpa_sm *sm, const u8 *pmk, size_t pmk_len,
3145                             const u8 *pmkid, const u8 *bssid,
3146                             const u8 *fils_cache_id)
3147 {
3148         sm->cur_pmksa = pmksa_cache_add(sm->pmksa, pmk, pmk_len, pmkid, NULL, 0,
3149                                         bssid, sm->own_addr, sm->network_ctx,
3150                                         sm->key_mgmt, fils_cache_id);
3151 }
3152
3153
3154 int wpa_sm_pmksa_exists(struct wpa_sm *sm, const u8 *bssid,
3155                         const void *network_ctx)
3156 {
3157         return pmksa_cache_get(sm->pmksa, bssid, NULL, network_ctx, 0) != NULL;
3158 }
3159
3160
3161 void wpa_sm_drop_sa(struct wpa_sm *sm)
3162 {
3163         wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Clear old PMK and PTK");
3164         sm->ptk_set = 0;
3165         sm->tptk_set = 0;
3166         sm->pmk_len = 0;
3167         os_memset(sm->pmk, 0, sizeof(sm->pmk));
3168         os_memset(&sm->ptk, 0, sizeof(sm->ptk));
3169         os_memset(&sm->tptk, 0, sizeof(sm->tptk));
3170         os_memset(&sm->gtk, 0, sizeof(sm->gtk));
3171         os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
3172 #ifdef CONFIG_IEEE80211W
3173         os_memset(&sm->igtk, 0, sizeof(sm->igtk));
3174         os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
3175 #endif /* CONFIG_IEEE80211W */
3176 #ifdef CONFIG_IEEE80211R
3177         os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
3178         sm->xxkey_len = 0;
3179         os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
3180         sm->pmk_r0_len = 0;
3181         os_memset(sm->pmk_r1, 0, sizeof(sm->pmk_r1));
3182         sm->pmk_r1_len = 0;
3183 #endif /* CONFIG_IEEE80211R */
3184 }
3185
3186
3187 int wpa_sm_has_ptk(struct wpa_sm *sm)
3188 {
3189         if (sm == NULL)
3190                 return 0;
3191         return sm->ptk_set;
3192 }
3193
3194
3195 void wpa_sm_update_replay_ctr(struct wpa_sm *sm, const u8 *replay_ctr)
3196 {
3197         os_memcpy(sm->rx_replay_counter, replay_ctr, WPA_REPLAY_COUNTER_LEN);
3198 }
3199
3200
3201 void wpa_sm_pmksa_cache_flush(struct wpa_sm *sm, void *network_ctx)
3202 {
3203         pmksa_cache_flush(sm->pmksa, network_ctx, NULL, 0);
3204 }
3205
3206
3207 #ifdef CONFIG_WNM
3208 int wpa_wnmsleep_install_key(struct wpa_sm *sm, u8 subelem_id, u8 *buf)
3209 {
3210         u16 keyinfo;
3211         u8 keylen;  /* plaintext key len */
3212         u8 *key_rsc;
3213
3214         if (subelem_id == WNM_SLEEP_SUBELEM_GTK) {
3215                 struct wpa_gtk_data gd;
3216
3217                 os_memset(&gd, 0, sizeof(gd));
3218                 keylen = wpa_cipher_key_len(sm->group_cipher);
3219                 gd.key_rsc_len = wpa_cipher_rsc_len(sm->group_cipher);
3220                 gd.alg = wpa_cipher_to_alg(sm->group_cipher);
3221                 if (gd.alg == WPA_ALG_NONE) {
3222                         wpa_printf(MSG_DEBUG, "Unsupported group cipher suite");
3223                         return -1;
3224                 }
3225
3226                 key_rsc = buf + 5;
3227                 keyinfo = WPA_GET_LE16(buf + 2);
3228                 gd.gtk_len = keylen;
3229                 if (gd.gtk_len != buf[4]) {
3230                         wpa_printf(MSG_DEBUG, "GTK len mismatch len %d vs %d",
3231                                    gd.gtk_len, buf[4]);
3232                         return -1;
3233                 }
3234                 gd.keyidx = keyinfo & 0x03; /* B0 - B1 */
3235                 gd.tx = wpa_supplicant_gtk_tx_bit_workaround(
3236                          sm, !!(keyinfo & WPA_KEY_INFO_TXRX));
3237
3238                 os_memcpy(gd.gtk, buf + 13, gd.gtk_len);
3239
3240                 wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
3241                                 gd.gtk, gd.gtk_len);
3242                 if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
3243                         os_memset(&gd, 0, sizeof(gd));
3244                         wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
3245                                    "WNM mode");
3246                         return -1;
3247                 }
3248                 os_memset(&gd, 0, sizeof(gd));
3249 #ifdef CONFIG_IEEE80211W
3250         } else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
3251                 const struct wpa_igtk_kde *igtk;
3252
3253                 igtk = (const struct wpa_igtk_kde *) (buf + 2);
3254                 if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
3255                         return -1;
3256 #endif /* CONFIG_IEEE80211W */
3257         } else {
3258                 wpa_printf(MSG_DEBUG, "Unknown element id");
3259                 return -1;
3260         }
3261
3262         return 0;
3263 }
3264 #endif /* CONFIG_WNM */
3265
3266
3267 #ifdef CONFIG_P2P
3268
3269 int wpa_sm_get_p2p_ip_addr(struct wpa_sm *sm, u8 *buf)
3270 {
3271         if (sm == NULL || WPA_GET_BE32(sm->p2p_ip_addr) == 0)
3272                 return -1;
3273         os_memcpy(buf, sm->p2p_ip_addr, 3 * 4);
3274         return 0;
3275 }
3276
3277 #endif /* CONFIG_P2P */
3278
3279
3280 void wpa_sm_set_rx_replay_ctr(struct wpa_sm *sm, const u8 *rx_replay_counter)
3281 {
3282         if (rx_replay_counter == NULL)
3283                 return;
3284
3285         os_memcpy(sm->rx_replay_counter, rx_replay_counter,
3286                   WPA_REPLAY_COUNTER_LEN);
3287         sm->rx_replay_counter_set = 1;
3288         wpa_printf(MSG_DEBUG, "Updated key replay counter");
3289 }
3290
3291
3292 void wpa_sm_set_ptk_kck_kek(struct wpa_sm *sm,
3293                             const u8 *ptk_kck, size_t ptk_kck_len,
3294                             const u8 *ptk_kek, size_t ptk_kek_len)
3295 {
3296         if (ptk_kck && ptk_kck_len <= WPA_KCK_MAX_LEN) {
3297                 os_memcpy(sm->ptk.kck, ptk_kck, ptk_kck_len);
3298                 sm->ptk.kck_len = ptk_kck_len;
3299                 wpa_printf(MSG_DEBUG, "Updated PTK KCK");
3300         }
3301         if (ptk_kek && ptk_kek_len <= WPA_KEK_MAX_LEN) {
3302                 os_memcpy(sm->ptk.kek, ptk_kek, ptk_kek_len);
3303                 sm->ptk.kek_len = ptk_kek_len;
3304                 wpa_printf(MSG_DEBUG, "Updated PTK KEK");
3305         }
3306         sm->ptk_set = 1;
3307 }
3308
3309
3310 #ifdef CONFIG_TESTING_OPTIONS
3311
3312 void wpa_sm_set_test_assoc_ie(struct wpa_sm *sm, struct wpabuf *buf)
3313 {
3314         wpabuf_free(sm->test_assoc_ie);
3315         sm->test_assoc_ie = buf;
3316 }
3317
3318
3319 const u8 * wpa_sm_get_anonce(struct wpa_sm *sm)
3320 {
3321         return sm->anonce;
3322 }
3323
3324 #endif /* CONFIG_TESTING_OPTIONS */
3325
3326
3327 unsigned int wpa_sm_get_key_mgmt(struct wpa_sm *sm)
3328 {
3329         return sm->key_mgmt;
3330 }
3331
3332
3333 #ifdef CONFIG_FILS
3334
3335 struct wpabuf * fils_build_auth(struct wpa_sm *sm, int dh_group, const u8 *md)
3336 {
3337         struct wpabuf *buf = NULL;
3338         struct wpabuf *erp_msg;
3339         struct wpabuf *pub = NULL;
3340
3341         erp_msg = eapol_sm_build_erp_reauth_start(sm->eapol);
3342         if (!erp_msg && !sm->cur_pmksa) {
3343                 wpa_printf(MSG_DEBUG,
3344                            "FILS: Neither ERP EAP-Initiate/Re-auth nor PMKSA cache entry is available - skip FILS");
3345                 goto fail;
3346         }
3347
3348         wpa_printf(MSG_DEBUG, "FILS: Try to use FILS (erp=%d pmksa_cache=%d)",
3349                    erp_msg != NULL, sm->cur_pmksa != NULL);
3350
3351         sm->fils_completed = 0;
3352
3353         if (!sm->assoc_wpa_ie) {
3354                 wpa_printf(MSG_INFO, "FILS: No own RSN IE set for FILS");
3355                 goto fail;
3356         }
3357
3358         if (random_get_bytes(sm->fils_nonce, FILS_NONCE_LEN) < 0 ||
3359             random_get_bytes(sm->fils_session, FILS_SESSION_LEN) < 0)
3360                 goto fail;
3361
3362         wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Nonce",
3363                     sm->fils_nonce, FILS_NONCE_LEN);
3364         wpa_hexdump(MSG_DEBUG, "FILS: Generated FILS Session",
3365                     sm->fils_session, FILS_SESSION_LEN);
3366
3367 #ifdef CONFIG_FILS_SK_PFS
3368         sm->fils_dh_group = dh_group;
3369         if (dh_group) {
3370                 crypto_ecdh_deinit(sm->fils_ecdh);
3371                 sm->fils_ecdh = crypto_ecdh_init(dh_group);
3372                 if (!sm->fils_ecdh) {
3373                         wpa_printf(MSG_INFO,
3374                                    "FILS: Could not initialize ECDH with group %d",
3375                                    dh_group);
3376                         goto fail;
3377                 }
3378                 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3379                 if (!pub)
3380                         goto fail;
3381                 wpa_hexdump_buf(MSG_DEBUG, "FILS: Element (DH public key)",
3382                                 pub);
3383                 sm->fils_dh_elem_len = wpabuf_len(pub);
3384         }
3385 #endif /* CONFIG_FILS_SK_PFS */
3386
3387         buf = wpabuf_alloc(1000 + sm->assoc_wpa_ie_len +
3388                            (pub ? wpabuf_len(pub) : 0));
3389         if (!buf)
3390                 goto fail;
3391
3392         /* Fields following the Authentication algorithm number field */
3393
3394         /* Authentication Transaction seq# */
3395         wpabuf_put_le16(buf, 1);
3396
3397         /* Status Code */
3398         wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
3399
3400         /* TODO: FILS PK */
3401 #ifdef CONFIG_FILS_SK_PFS
3402         if (dh_group) {
3403                 /* Finite Cyclic Group */
3404                 wpabuf_put_le16(buf, dh_group);
3405                 /* Element */
3406                 wpabuf_put_buf(buf, pub);
3407         }
3408 #endif /* CONFIG_FILS_SK_PFS */
3409
3410         /* RSNE */
3411         wpa_hexdump(MSG_DEBUG, "FILS: RSNE in FILS Authentication frame",
3412                     sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3413         wpabuf_put_data(buf, sm->assoc_wpa_ie, sm->assoc_wpa_ie_len);
3414
3415         if (md) {
3416                 /* MDE when using FILS for FT initial association */
3417                 struct rsn_mdie *mdie;
3418
3419                 wpabuf_put_u8(buf, WLAN_EID_MOBILITY_DOMAIN);
3420                 wpabuf_put_u8(buf, sizeof(*mdie));
3421                 mdie = wpabuf_put(buf, sizeof(*mdie));
3422                 os_memcpy(mdie->mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
3423                 mdie->ft_capab = 0;
3424         }
3425
3426         /* FILS Nonce */
3427         wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3428         wpabuf_put_u8(buf, 1 + FILS_NONCE_LEN); /* Length */
3429         /* Element ID Extension */
3430         wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_NONCE);
3431         wpabuf_put_data(buf, sm->fils_nonce, FILS_NONCE_LEN);
3432
3433         /* FILS Session */
3434         wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3435         wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
3436         /* Element ID Extension */
3437         wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
3438         wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
3439
3440         /* FILS Wrapped Data */
3441         sm->fils_erp_pmkid_set = 0;
3442         if (erp_msg) {
3443                 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3444                 wpabuf_put_u8(buf, 1 + wpabuf_len(erp_msg)); /* Length */
3445                 /* Element ID Extension */
3446                 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_WRAPPED_DATA);
3447                 wpabuf_put_buf(buf, erp_msg);
3448                 /* Calculate pending PMKID here so that we do not need to
3449                  * maintain a copy of the EAP-Initiate/Reauth message. */
3450                 if (fils_pmkid_erp(sm->key_mgmt, wpabuf_head(erp_msg),
3451                                    wpabuf_len(erp_msg),
3452                                    sm->fils_erp_pmkid) == 0)
3453                         sm->fils_erp_pmkid_set = 1;
3454         }
3455
3456         wpa_hexdump_buf(MSG_DEBUG, "RSN: FILS fields for Authentication frame",
3457                         buf);
3458
3459 fail:
3460         wpabuf_free(erp_msg);
3461         wpabuf_free(pub);
3462         return buf;
3463 }
3464
3465
3466 int fils_process_auth(struct wpa_sm *sm, const u8 *bssid, const u8 *data,
3467                       size_t len)
3468 {
3469         const u8 *pos, *end;
3470         struct ieee802_11_elems elems;
3471         struct wpa_ie_data rsn;
3472         int pmkid_match = 0;
3473         u8 ick[FILS_ICK_MAX_LEN];
3474         size_t ick_len;
3475         int res;
3476         struct wpabuf *dh_ss = NULL;
3477         const u8 *g_sta = NULL;
3478         size_t g_sta_len = 0;
3479         const u8 *g_ap = NULL;
3480         size_t g_ap_len = 0;
3481         struct wpabuf *pub = NULL;
3482
3483         os_memcpy(sm->bssid, bssid, ETH_ALEN);
3484
3485         wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
3486                     data, len);
3487         pos = data;
3488         end = data + len;
3489
3490         /* TODO: FILS PK */
3491 #ifdef CONFIG_FILS_SK_PFS
3492         if (sm->fils_dh_group) {
3493                 u16 group;
3494
3495                 /* Using FILS PFS */
3496
3497                 /* Finite Cyclic Group */
3498                 if (end - pos < 2) {
3499                         wpa_printf(MSG_DEBUG,
3500                                    "FILS: No room for Finite Cyclic Group");
3501                         goto fail;
3502                 }
3503                 group = WPA_GET_LE16(pos);
3504                 pos += 2;
3505                 if (group != sm->fils_dh_group) {
3506                         wpa_printf(MSG_DEBUG,
3507                                    "FILS: Unexpected change in Finite Cyclic Group: %u (expected %u)",
3508                                    group, sm->fils_dh_group);
3509                         goto fail;
3510                 }
3511
3512                 /* Element */
3513                 if ((size_t) (end - pos) < sm->fils_dh_elem_len) {
3514                         wpa_printf(MSG_DEBUG, "FILS: No room for Element");
3515                         goto fail;
3516                 }
3517
3518                 if (!sm->fils_ecdh) {
3519                         wpa_printf(MSG_DEBUG, "FILS: No ECDH state available");
3520                         goto fail;
3521                 }
3522                 dh_ss = crypto_ecdh_set_peerkey(sm->fils_ecdh, 1, pos,
3523                                                 sm->fils_dh_elem_len);
3524                 if (!dh_ss) {
3525                         wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
3526                         goto fail;
3527                 }
3528                 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", dh_ss);
3529                 g_ap = pos;
3530                 g_ap_len = sm->fils_dh_elem_len;
3531                 pos += sm->fils_dh_elem_len;
3532         }
3533 #endif /* CONFIG_FILS_SK_PFS */
3534
3535         wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
3536         if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
3537                 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
3538                 goto fail;
3539         }
3540
3541         /* RSNE */
3542         wpa_hexdump(MSG_DEBUG, "FILS: RSN element", elems.rsn_ie,
3543                     elems.rsn_ie_len);
3544         if (!elems.rsn_ie ||
3545             wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
3546                                  &rsn) < 0) {
3547                 wpa_printf(MSG_DEBUG, "FILS: No RSN element");
3548                 goto fail;
3549         }
3550
3551         if (!elems.fils_nonce) {
3552                 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
3553                 goto fail;
3554         }
3555         os_memcpy(sm->fils_anonce, elems.fils_nonce, FILS_NONCE_LEN);
3556         wpa_hexdump(MSG_DEBUG, "FILS: ANonce", sm->fils_anonce, FILS_NONCE_LEN);
3557
3558 #ifdef CONFIG_IEEE80211R
3559         if (wpa_key_mgmt_ft(sm->key_mgmt)) {
3560                 struct wpa_ft_ies parse;
3561
3562                 if (!elems.mdie || !elems.ftie) {
3563                         wpa_printf(MSG_DEBUG, "FILS+FT: No MDE or FTE");
3564                         goto fail;
3565                 }
3566
3567                 if (wpa_ft_parse_ies(pos, end - pos, &parse,
3568                                      wpa_key_mgmt_sha384(sm->key_mgmt)) < 0) {
3569                         wpa_printf(MSG_DEBUG, "FILS+FT: Failed to parse IEs");
3570                         goto fail;
3571                 }
3572
3573                 if (!parse.r0kh_id) {
3574                         wpa_printf(MSG_DEBUG,
3575                                    "FILS+FT: No R0KH-ID subelem in FTE");
3576                         goto fail;
3577                 }
3578                 os_memcpy(sm->r0kh_id, parse.r0kh_id, parse.r0kh_id_len);
3579                 sm->r0kh_id_len = parse.r0kh_id_len;
3580                 wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
3581                                   sm->r0kh_id, sm->r0kh_id_len);
3582
3583                 if (!parse.r1kh_id) {
3584                         wpa_printf(MSG_DEBUG,
3585                                    "FILS+FT: No R1KH-ID subelem in FTE");
3586                         goto fail;
3587                 }
3588                 os_memcpy(sm->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
3589                 wpa_hexdump(MSG_DEBUG, "FILS+FT: R1KH-ID",
3590                             sm->r1kh_id, FT_R1KH_ID_LEN);
3591
3592                 /* TODO: Check MDE and FTE payload */
3593
3594                 wpabuf_free(sm->fils_ft_ies);
3595                 sm->fils_ft_ies = wpabuf_alloc(2 + elems.mdie_len +
3596                                                2 + elems.ftie_len);
3597                 if (!sm->fils_ft_ies)
3598                         goto fail;
3599                 wpabuf_put_data(sm->fils_ft_ies, elems.mdie - 2,
3600                                 2 + elems.mdie_len);
3601                 wpabuf_put_data(sm->fils_ft_ies, elems.ftie - 2,
3602                                 2 + elems.ftie_len);
3603         } else {
3604                 wpabuf_free(sm->fils_ft_ies);
3605                 sm->fils_ft_ies = NULL;
3606         }
3607 #endif /* CONFIG_IEEE80211R */
3608
3609         /* PMKID List */
3610         if (rsn.pmkid && rsn.num_pmkid > 0) {
3611                 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
3612                             rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
3613
3614                 if (rsn.num_pmkid != 1) {
3615                         wpa_printf(MSG_DEBUG, "FILS: Invalid PMKID selection");
3616                         goto fail;
3617                 }
3618                 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", rsn.pmkid, PMKID_LEN);
3619                 if (os_memcmp(sm->cur_pmksa->pmkid, rsn.pmkid, PMKID_LEN) != 0)
3620                 {
3621                         wpa_printf(MSG_DEBUG, "FILS: PMKID mismatch");
3622                         wpa_hexdump(MSG_DEBUG, "FILS: Expected PMKID",
3623                                     sm->cur_pmksa->pmkid, PMKID_LEN);
3624                         goto fail;
3625                 }
3626                 wpa_printf(MSG_DEBUG,
3627                            "FILS: Matching PMKID - continue using PMKSA caching");
3628                 pmkid_match = 1;
3629         }
3630         if (!pmkid_match && sm->cur_pmksa) {
3631                 wpa_printf(MSG_DEBUG,
3632                            "FILS: No PMKID match - cannot use cached PMKSA entry");
3633                 sm->cur_pmksa = NULL;
3634         }
3635
3636         /* FILS Session */
3637         if (!elems.fils_session) {
3638                 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
3639                 goto fail;
3640         }
3641         wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
3642                     FILS_SESSION_LEN);
3643         if (os_memcmp(sm->fils_session, elems.fils_session, FILS_SESSION_LEN)
3644             != 0) {
3645                 wpa_printf(MSG_DEBUG, "FILS: Session mismatch");
3646                 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
3647                             sm->fils_session, FILS_SESSION_LEN);
3648                 goto fail;
3649         }
3650
3651         /* FILS Wrapped Data */
3652         if (!sm->cur_pmksa && elems.fils_wrapped_data) {
3653                 u8 rmsk[ERP_MAX_KEY_LEN];
3654                 size_t rmsk_len;
3655
3656                 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
3657                             elems.fils_wrapped_data,
3658                             elems.fils_wrapped_data_len);
3659                 eapol_sm_process_erp_finish(sm->eapol, elems.fils_wrapped_data,
3660                                             elems.fils_wrapped_data_len);
3661                 if (eapol_sm_failed(sm->eapol))
3662                         goto fail;
3663
3664                 rmsk_len = ERP_MAX_KEY_LEN;
3665                 res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
3666                 if (res == PMK_LEN) {
3667                         rmsk_len = PMK_LEN;
3668                         res = eapol_sm_get_key(sm->eapol, rmsk, rmsk_len);
3669                 }
3670                 if (res)
3671                         goto fail;
3672
3673                 res = fils_rmsk_to_pmk(sm->key_mgmt, rmsk, rmsk_len,
3674                                        sm->fils_nonce, sm->fils_anonce,
3675                                        dh_ss ? wpabuf_head(dh_ss) : NULL,
3676                                        dh_ss ? wpabuf_len(dh_ss) : 0,
3677                                        sm->pmk, &sm->pmk_len);
3678                 os_memset(rmsk, 0, sizeof(rmsk));
3679
3680                 /* Don't use DHss in PTK derivation if PMKSA caching is not
3681                  * used. */
3682                 wpabuf_clear_free(dh_ss);
3683                 dh_ss = NULL;
3684
3685                 if (res)
3686                         goto fail;
3687
3688                 if (!sm->fils_erp_pmkid_set) {
3689                         wpa_printf(MSG_DEBUG, "FILS: PMKID not available");
3690                         goto fail;
3691                 }
3692                 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", sm->fils_erp_pmkid,
3693                             PMKID_LEN);
3694                 wpa_printf(MSG_DEBUG, "FILS: ERP processing succeeded - add PMKSA cache entry for the result");
3695                 sm->cur_pmksa = pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len,
3696                                                 sm->fils_erp_pmkid, NULL, 0,
3697                                                 sm->bssid, sm->own_addr,
3698                                                 sm->network_ctx, sm->key_mgmt,
3699                                                 NULL);
3700         }
3701
3702         if (!sm->cur_pmksa) {
3703                 wpa_printf(MSG_DEBUG,
3704                            "FILS: No remaining options to continue FILS authentication");
3705                 goto fail;
3706         }
3707
3708         if (fils_pmk_to_ptk(sm->pmk, sm->pmk_len, sm->own_addr, sm->bssid,
3709                             sm->fils_nonce, sm->fils_anonce,
3710                             dh_ss ? wpabuf_head(dh_ss) : NULL,
3711                             dh_ss ? wpabuf_len(dh_ss) : 0,
3712                             &sm->ptk, ick, &ick_len,
3713                             sm->key_mgmt, sm->pairwise_cipher,
3714                             sm->fils_ft, &sm->fils_ft_len) < 0) {
3715                 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PTK");
3716                 goto fail;
3717         }
3718
3719         wpabuf_clear_free(dh_ss);
3720         dh_ss = NULL;
3721
3722         sm->ptk_set = 1;
3723         sm->tptk_set = 0;
3724         os_memset(&sm->tptk, 0, sizeof(sm->tptk));
3725
3726 #ifdef CONFIG_FILS_SK_PFS
3727         if (sm->fils_dh_group) {
3728                 if (!sm->fils_ecdh) {
3729                         wpa_printf(MSG_INFO, "FILS: ECDH not initialized");
3730                         goto fail;
3731                 }
3732                 pub = crypto_ecdh_get_pubkey(sm->fils_ecdh, 1);
3733                 if (!pub)
3734                         goto fail;
3735                 wpa_hexdump_buf(MSG_DEBUG, "FILS: gSTA", pub);
3736                 g_sta = wpabuf_head(pub);
3737                 g_sta_len = wpabuf_len(pub);
3738                 if (!g_ap) {
3739                         wpa_printf(MSG_INFO, "FILS: gAP not available");
3740                         goto fail;
3741                 }
3742                 wpa_hexdump(MSG_DEBUG, "FILS: gAP", g_ap, g_ap_len);
3743         }
3744 #endif /* CONFIG_FILS_SK_PFS */
3745
3746         res = fils_key_auth_sk(ick, ick_len, sm->fils_nonce,
3747                                sm->fils_anonce, sm->own_addr, sm->bssid,
3748                                g_sta, g_sta_len, g_ap, g_ap_len,
3749                                sm->key_mgmt, sm->fils_key_auth_sta,
3750                                sm->fils_key_auth_ap,
3751                                &sm->fils_key_auth_len);
3752         wpabuf_free(pub);
3753         os_memset(ick, 0, sizeof(ick));
3754         return res;
3755 fail:
3756         wpabuf_free(pub);
3757         wpabuf_clear_free(dh_ss);
3758         return -1;
3759 }
3760
3761
3762 #ifdef CONFIG_IEEE80211R
3763 static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
3764 {
3765         struct rsn_ie_hdr *rsnie;
3766         u16 capab;
3767         u8 *pos;
3768         int use_sha384 = wpa_key_mgmt_sha384(sm->key_mgmt);
3769
3770         /* RSNIE[PMKR0Name/PMKR1Name] */
3771         rsnie = wpabuf_put(buf, sizeof(*rsnie));
3772         rsnie->elem_id = WLAN_EID_RSN;
3773         WPA_PUT_LE16(rsnie->version, RSN_VERSION);
3774
3775         /* Group Suite Selector */
3776         if (!wpa_cipher_valid_group(sm->group_cipher)) {
3777                 wpa_printf(MSG_WARNING, "FT: Invalid group cipher (%d)",
3778                            sm->group_cipher);
3779                 return -1;
3780         }
3781         pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3782         RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
3783                                                   sm->group_cipher));
3784
3785         /* Pairwise Suite Count */
3786         wpabuf_put_le16(buf, 1);
3787
3788         /* Pairwise Suite List */
3789         if (!wpa_cipher_valid_pairwise(sm->pairwise_cipher)) {
3790                 wpa_printf(MSG_WARNING, "FT: Invalid pairwise cipher (%d)",
3791                            sm->pairwise_cipher);
3792                 return -1;
3793         }
3794         pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3795         RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN,
3796                                                   sm->pairwise_cipher));
3797
3798         /* Authenticated Key Management Suite Count */
3799         wpabuf_put_le16(buf, 1);
3800
3801         /* Authenticated Key Management Suite List */
3802         pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3803         if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA256)
3804                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA256);
3805         else if (sm->key_mgmt == WPA_KEY_MGMT_FT_FILS_SHA384)
3806                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_FILS_SHA384);
3807         else {
3808                 wpa_printf(MSG_WARNING,
3809                            "FILS+FT: Invalid key management type (%d)",
3810                            sm->key_mgmt);
3811                 return -1;
3812         }
3813
3814         /* RSN Capabilities */
3815         capab = 0;
3816 #ifdef CONFIG_IEEE80211W
3817         if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC)
3818                 capab |= WPA_CAPABILITY_MFPC;
3819 #endif /* CONFIG_IEEE80211W */
3820         wpabuf_put_le16(buf, capab);
3821
3822         /* PMKID Count */
3823         wpabuf_put_le16(buf, 1);
3824
3825         /* PMKID List [PMKR1Name] */
3826         wpa_hexdump_key(MSG_DEBUG, "FILS+FT: XXKey (FILS-FT)",
3827                         sm->fils_ft, sm->fils_ft_len);
3828         wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: SSID", sm->ssid, sm->ssid_len);
3829         wpa_hexdump(MSG_DEBUG, "FILS+FT: MDID",
3830                     sm->mobility_domain, MOBILITY_DOMAIN_ID_LEN);
3831         wpa_hexdump_ascii(MSG_DEBUG, "FILS+FT: R0KH-ID",
3832                           sm->r0kh_id, sm->r0kh_id_len);
3833         if (wpa_derive_pmk_r0(sm->fils_ft, sm->fils_ft_len, sm->ssid,
3834                               sm->ssid_len, sm->mobility_domain,
3835                               sm->r0kh_id, sm->r0kh_id_len, sm->own_addr,
3836                               sm->pmk_r0, sm->pmk_r0_name, use_sha384) < 0) {
3837                 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMK-R0");
3838                 return -1;
3839         }
3840         sm->pmk_r0_len = use_sha384 ? SHA384_MAC_LEN : PMK_LEN;
3841         wpa_hexdump_key(MSG_DEBUG, "FILS+FT: PMK-R0",
3842                         sm->pmk_r0, sm->pmk_r0_len);
3843         wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR0Name",
3844                     sm->pmk_r0_name, WPA_PMK_NAME_LEN);
3845         wpa_printf(MSG_DEBUG, "FILS+FT: R1KH-ID: " MACSTR,
3846                    MAC2STR(sm->r1kh_id));
3847         pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
3848         if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
3849                                    pos, use_sha384) < 0) {
3850                 wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
3851                 return -1;
3852         }
3853         wpa_hexdump(MSG_DEBUG, "FILS+FT: PMKR1Name", pos, WPA_PMK_NAME_LEN);
3854
3855 #ifdef CONFIG_IEEE80211W
3856         if (sm->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
3857                 /* Management Group Cipher Suite */
3858                 pos = wpabuf_put(buf, RSN_SELECTOR_LEN);
3859                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
3860         }
3861 #endif /* CONFIG_IEEE80211W */
3862
3863         rsnie->len = ((u8 *) wpabuf_put(buf, 0) - (u8 *) rsnie) - 2;
3864         return 0;
3865 }
3866 #endif /* CONFIG_IEEE80211R */
3867
3868
3869 struct wpabuf * fils_build_assoc_req(struct wpa_sm *sm, const u8 **kek,
3870                                      size_t *kek_len, const u8 **snonce,
3871                                      const u8 **anonce,
3872                                      const struct wpabuf **hlp,
3873                                      unsigned int num_hlp)
3874 {
3875         struct wpabuf *buf;
3876         size_t len;
3877         unsigned int i;
3878
3879         len = 1000;
3880 #ifdef CONFIG_IEEE80211R
3881         if (sm->fils_ft_ies)
3882                 len += wpabuf_len(sm->fils_ft_ies);
3883         if (wpa_key_mgmt_ft(sm->key_mgmt))
3884                 len += 256;
3885 #endif /* CONFIG_IEEE80211R */
3886         for (i = 0; hlp && i < num_hlp; i++)
3887                 len += 10 + wpabuf_len(hlp[i]);
3888         buf = wpabuf_alloc(len);
3889         if (!buf)
3890                 return NULL;
3891
3892 #ifdef CONFIG_IEEE80211R
3893         if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->fils_ft_ies) {
3894                 /* MDE and FTE when using FILS+FT */
3895                 wpabuf_put_buf(buf, sm->fils_ft_ies);
3896                 /* RSNE with PMKR1Name in PMKID field */
3897                 if (fils_ft_build_assoc_req_rsne(sm, buf) < 0) {
3898                         wpabuf_free(buf);
3899                         return NULL;
3900                 }
3901         }
3902 #endif /* CONFIG_IEEE80211R */
3903
3904         /* FILS Session */
3905         wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3906         wpabuf_put_u8(buf, 1 + FILS_SESSION_LEN); /* Length */
3907         /* Element ID Extension */
3908         wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_SESSION);
3909         wpabuf_put_data(buf, sm->fils_session, FILS_SESSION_LEN);
3910
3911         /* Everything after FILS Session element gets encrypted in the driver
3912          * with KEK. The buffer returned from here is the plaintext version. */
3913
3914         /* TODO: FILS Public Key */
3915
3916         /* FILS Key Confirm */
3917         wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3918         wpabuf_put_u8(buf, 1 + sm->fils_key_auth_len); /* Length */
3919         /* Element ID Extension */
3920         wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_KEY_CONFIRM);
3921         wpabuf_put_data(buf, sm->fils_key_auth_sta, sm->fils_key_auth_len);
3922
3923         /* FILS HLP Container */
3924         for (i = 0; hlp && i < num_hlp; i++) {
3925                 const u8 *pos = wpabuf_head(hlp[i]);
3926                 size_t left = wpabuf_len(hlp[i]);
3927
3928                 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); /* Element ID */
3929                 if (left <= 254)
3930                         len = 1 + left;
3931                 else
3932                         len = 255;
3933                 wpabuf_put_u8(buf, len); /* Length */
3934                 /* Element ID Extension */
3935                 wpabuf_put_u8(buf, WLAN_EID_EXT_FILS_HLP_CONTAINER);
3936                 /* Destination MAC Address, Source MAC Address, HLP Packet.
3937                  * HLP Packet is in MSDU format (i.e., included the LLC/SNAP
3938                  * header when LPD is used). */
3939                 wpabuf_put_data(buf, pos, len - 1);
3940                 pos += len - 1;
3941                 left -= len - 1;
3942                 while (left) {
3943                         wpabuf_put_u8(buf, WLAN_EID_FRAGMENT);
3944                         len = left > 255 ? 255 : left;
3945                         wpabuf_put_u8(buf, len);
3946                         wpabuf_put_data(buf, pos, len);
3947                         pos += len;
3948                         left -= len;
3949                 }
3950         }
3951
3952         /* TODO: FILS IP Address Assignment */
3953
3954         wpa_hexdump_buf(MSG_DEBUG, "FILS: Association Request plaintext", buf);
3955
3956         *kek = sm->ptk.kek;
3957         *kek_len = sm->ptk.kek_len;
3958         wpa_hexdump_key(MSG_DEBUG, "FILS: KEK for AEAD", *kek, *kek_len);
3959         *snonce = sm->fils_nonce;
3960         wpa_hexdump(MSG_DEBUG, "FILS: SNonce for AEAD AAD",
3961                     *snonce, FILS_NONCE_LEN);
3962         *anonce = sm->fils_anonce;
3963         wpa_hexdump(MSG_DEBUG, "FILS: ANonce for AEAD AAD",
3964                     *anonce, FILS_NONCE_LEN);
3965
3966         return buf;
3967 }
3968
3969
3970 static void fils_process_hlp_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
3971 {
3972         const u8 *pos, *end;
3973
3974         wpa_hexdump(MSG_MSGDUMP, "FILS: HLP response", resp, len);
3975         if (len < 2 * ETH_ALEN)
3976                 return;
3977         pos = resp + 2 * ETH_ALEN;
3978         end = resp + len;
3979         if (end - pos >= 6 &&
3980             os_memcmp(pos, "\xaa\xaa\x03\x00\x00\x00", 6) == 0)
3981                 pos += 6; /* Remove SNAP/LLC header */
3982         wpa_sm_fils_hlp_rx(sm, resp, resp + ETH_ALEN, pos, end - pos);
3983 }
3984
3985
3986 static void fils_process_hlp_container(struct wpa_sm *sm, const u8 *pos,
3987                                        size_t len)
3988 {
3989         const u8 *end = pos + len;
3990         u8 *tmp, *tmp_pos;
3991
3992         /* Check if there are any FILS HLP Container elements */
3993         while (end - pos >= 2) {
3994                 if (2 + pos[1] > end - pos)
3995                         return;
3996                 if (pos[0] == WLAN_EID_EXTENSION &&
3997                     pos[1] >= 1 + 2 * ETH_ALEN &&
3998                     pos[2] == WLAN_EID_EXT_FILS_HLP_CONTAINER)
3999                         break;
4000                 pos += 2 + pos[1];
4001         }
4002         if (end - pos < 2)
4003                 return; /* No FILS HLP Container elements */
4004
4005         tmp = os_malloc(end - pos);
4006         if (!tmp)
4007                 return;
4008
4009         while (end - pos >= 2) {
4010                 if (2 + pos[1] > end - pos ||
4011                     pos[0] != WLAN_EID_EXTENSION ||
4012                     pos[1] < 1 + 2 * ETH_ALEN ||
4013                     pos[2] != WLAN_EID_EXT_FILS_HLP_CONTAINER)
4014                         break;
4015                 tmp_pos = tmp;
4016                 os_memcpy(tmp_pos, pos + 3, pos[1] - 1);
4017                 tmp_pos += pos[1] - 1;
4018                 pos += 2 + pos[1];
4019
4020                 /* Add possible fragments */
4021                 while (end - pos >= 2 && pos[0] == WLAN_EID_FRAGMENT &&
4022                        2 + pos[1] <= end - pos) {
4023                         os_memcpy(tmp_pos, pos + 2, pos[1]);
4024                         tmp_pos += pos[1];
4025                         pos += 2 + pos[1];
4026                 }
4027
4028                 fils_process_hlp_resp(sm, tmp, tmp_pos - tmp);
4029         }
4030
4031         os_free(tmp);
4032 }
4033
4034
4035 int fils_process_assoc_resp(struct wpa_sm *sm, const u8 *resp, size_t len)
4036 {
4037         const struct ieee80211_mgmt *mgmt;
4038         const u8 *end, *ie_start;
4039         struct ieee802_11_elems elems;
4040         int keylen, rsclen;
4041         enum wpa_alg alg;
4042         struct wpa_gtk_data gd;
4043         int maxkeylen;
4044         struct wpa_eapol_ie_parse kde;
4045
4046         if (!sm || !sm->ptk_set) {
4047                 wpa_printf(MSG_DEBUG, "FILS: No KEK available");
4048                 return -1;
4049         }
4050
4051         if (!wpa_key_mgmt_fils(sm->key_mgmt)) {
4052                 wpa_printf(MSG_DEBUG, "FILS: Not a FILS AKM");
4053                 return -1;
4054         }
4055
4056         if (sm->fils_completed) {
4057                 wpa_printf(MSG_DEBUG,
4058                            "FILS: Association has already been completed for this FILS authentication - ignore unexpected retransmission");
4059                 return -1;
4060         }
4061
4062         wpa_hexdump(MSG_DEBUG, "FILS: (Re)Association Response frame",
4063                     resp, len);
4064
4065         mgmt = (const struct ieee80211_mgmt *) resp;
4066         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp))
4067                 return -1;
4068
4069         end = resp + len;
4070         /* Same offset for Association Response and Reassociation Response */
4071         ie_start = mgmt->u.assoc_resp.variable;
4072
4073         if (ieee802_11_parse_elems(ie_start, end - ie_start, &elems, 1) ==
4074             ParseFailed) {
4075                 wpa_printf(MSG_DEBUG,
4076                            "FILS: Failed to parse decrypted elements");
4077                 goto fail;
4078         }
4079
4080         if (!elems.fils_session) {
4081                 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
4082                 return -1;
4083         }
4084         if (os_memcmp(elems.fils_session, sm->fils_session,
4085                       FILS_SESSION_LEN) != 0) {
4086                 wpa_printf(MSG_DEBUG, "FILS: FILS Session mismatch");
4087                 wpa_hexdump(MSG_DEBUG, "FILS: Received FILS Session",
4088                             elems.fils_session, FILS_SESSION_LEN);
4089                 wpa_hexdump(MSG_DEBUG, "FILS: Expected FILS Session",
4090                             sm->fils_session, FILS_SESSION_LEN);
4091         }
4092
4093         /* TODO: FILS Public Key */
4094
4095         if (!elems.fils_key_confirm) {
4096                 wpa_printf(MSG_DEBUG, "FILS: No FILS Key Confirm element");
4097                 goto fail;
4098         }
4099         if (elems.fils_key_confirm_len != sm->fils_key_auth_len) {
4100                 wpa_printf(MSG_DEBUG,
4101                            "FILS: Unexpected Key-Auth length %d (expected %d)",
4102                            elems.fils_key_confirm_len,
4103                            (int) sm->fils_key_auth_len);
4104                 goto fail;
4105         }
4106         if (os_memcmp(elems.fils_key_confirm, sm->fils_key_auth_ap,
4107                       sm->fils_key_auth_len) != 0) {
4108                 wpa_printf(MSG_DEBUG, "FILS: Key-Auth mismatch");
4109                 wpa_hexdump(MSG_DEBUG, "FILS: Received Key-Auth",
4110                             elems.fils_key_confirm,
4111                             elems.fils_key_confirm_len);
4112                 wpa_hexdump(MSG_DEBUG, "FILS: Expected Key-Auth",
4113                             sm->fils_key_auth_ap, sm->fils_key_auth_len);
4114                 goto fail;
4115         }
4116
4117         /* Key Delivery */
4118         if (!elems.key_delivery) {
4119                 wpa_printf(MSG_DEBUG, "FILS: No Key Delivery element");
4120                 goto fail;
4121         }
4122
4123         /* Parse GTK and set the key to the driver */
4124         os_memset(&gd, 0, sizeof(gd));
4125         if (wpa_supplicant_parse_ies(elems.key_delivery + WPA_KEY_RSC_LEN,
4126                                      elems.key_delivery_len - WPA_KEY_RSC_LEN,
4127                                      &kde) < 0) {
4128                 wpa_printf(MSG_DEBUG, "FILS: Failed to parse KDEs");
4129                 goto fail;
4130         }
4131         if (!kde.gtk) {
4132                 wpa_printf(MSG_DEBUG, "FILS: No GTK KDE");
4133                 goto fail;
4134         }
4135         maxkeylen = gd.gtk_len = kde.gtk_len - 2;
4136         if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
4137                                               gd.gtk_len, maxkeylen,
4138                                               &gd.key_rsc_len, &gd.alg))
4139                 goto fail;
4140
4141         wpa_hexdump_key(MSG_DEBUG, "FILS: Received GTK", kde.gtk, kde.gtk_len);
4142         gd.keyidx = kde.gtk[0] & 0x3;
4143         gd.tx = wpa_supplicant_gtk_tx_bit_workaround(sm,
4144                                                      !!(kde.gtk[0] & BIT(2)));
4145         if (kde.gtk_len - 2 > sizeof(gd.gtk)) {
4146                 wpa_printf(MSG_DEBUG, "FILS: Too long GTK in GTK KDE (len=%lu)",
4147                            (unsigned long) kde.gtk_len - 2);
4148                 goto fail;
4149         }
4150         os_memcpy(gd.gtk, kde.gtk + 2, kde.gtk_len - 2);
4151
4152         wpa_printf(MSG_DEBUG, "FILS: Set GTK to driver");
4153         if (wpa_supplicant_install_gtk(sm, &gd, elems.key_delivery, 0) < 0) {
4154                 wpa_printf(MSG_DEBUG, "FILS: Failed to set GTK");
4155                 goto fail;
4156         }
4157
4158         if (ieee80211w_set_keys(sm, &kde) < 0) {
4159                 wpa_printf(MSG_DEBUG, "FILS: Failed to set IGTK");
4160                 goto fail;
4161         }
4162
4163         alg = wpa_cipher_to_alg(sm->pairwise_cipher);
4164         keylen = wpa_cipher_key_len(sm->pairwise_cipher);
4165         if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
4166                 wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
4167                            keylen, (long unsigned int) sm->ptk.tk_len);
4168                 goto fail;
4169         }
4170         rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
4171         wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
4172                         sm->ptk.tk, keylen);
4173         if (wpa_sm_set_key(sm, alg, sm->bssid, 0, 1, null_rsc, rsclen,
4174                            sm->ptk.tk, keylen) < 0) {
4175                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
4176                         "FILS: Failed to set PTK to the driver (alg=%d keylen=%d bssid="
4177                         MACSTR ")",
4178                         alg, keylen, MAC2STR(sm->bssid));
4179                 goto fail;
4180         }
4181
4182         /* TODO: TK could be cleared after auth frame exchange now that driver
4183          * takes care of association frame encryption/decryption. */
4184         /* TK is not needed anymore in supplicant */
4185         os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
4186         sm->ptk.tk_len = 0;
4187         sm->ptk.installed = 1;
4188
4189         /* FILS HLP Container */
4190         fils_process_hlp_container(sm, ie_start, end - ie_start);
4191
4192         /* TODO: FILS IP Address Assignment */
4193
4194         wpa_printf(MSG_DEBUG, "FILS: Auth+Assoc completed successfully");
4195         sm->fils_completed = 1;
4196
4197         return 0;
4198 fail:
4199         return -1;
4200 }
4201
4202
4203 void wpa_sm_set_reset_fils_completed(struct wpa_sm *sm, int set)
4204 {
4205         if (sm)
4206                 sm->fils_completed = !!set;
4207 }
4208
4209 #endif /* CONFIG_FILS */
4210
4211
4212 int wpa_fils_is_completed(struct wpa_sm *sm)
4213 {
4214 #ifdef CONFIG_FILS
4215         return sm && sm->fils_completed;
4216 #else /* CONFIG_FILS */
4217         return 0;
4218 #endif /* CONFIG_FILS */
4219 }
4220
4221
4222 #ifdef CONFIG_OWE
4223
4224 struct wpabuf * owe_build_assoc_req(struct wpa_sm *sm, u16 group)
4225 {
4226         struct wpabuf *ie = NULL, *pub = NULL;
4227         size_t prime_len;
4228
4229         if (group == 19)
4230                 prime_len = 32;
4231         else if (group == 20)
4232                 prime_len = 48;
4233         else if (group == 21)
4234                 prime_len = 66;
4235         else
4236                 return NULL;
4237
4238         crypto_ecdh_deinit(sm->owe_ecdh);
4239         sm->owe_ecdh = crypto_ecdh_init(group);
4240         if (!sm->owe_ecdh)
4241                 goto fail;
4242         sm->owe_group = group;
4243         pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4244         pub = wpabuf_zeropad(pub, prime_len);
4245         if (!pub)
4246                 goto fail;
4247
4248         ie = wpabuf_alloc(5 + wpabuf_len(pub));
4249         if (!ie)
4250                 goto fail;
4251         wpabuf_put_u8(ie, WLAN_EID_EXTENSION);
4252         wpabuf_put_u8(ie, 1 + 2 + wpabuf_len(pub));
4253         wpabuf_put_u8(ie, WLAN_EID_EXT_OWE_DH_PARAM);
4254         wpabuf_put_le16(ie, group);
4255         wpabuf_put_buf(ie, pub);
4256         wpabuf_free(pub);
4257         wpa_hexdump_buf(MSG_DEBUG, "OWE: Diffie-Hellman Parameter element",
4258                         ie);
4259
4260         return ie;
4261 fail:
4262         wpabuf_free(pub);
4263         crypto_ecdh_deinit(sm->owe_ecdh);
4264         sm->owe_ecdh = NULL;
4265         return NULL;
4266 }
4267
4268
4269 int owe_process_assoc_resp(struct wpa_sm *sm, const u8 *bssid,
4270                            const u8 *resp_ies, size_t resp_ies_len)
4271 {
4272         struct ieee802_11_elems elems;
4273         u16 group;
4274         struct wpabuf *secret, *pub, *hkey;
4275         int res;
4276         u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
4277         const char *info = "OWE Key Generation";
4278         const u8 *addr[2];
4279         size_t len[2];
4280         size_t hash_len, prime_len;
4281         struct wpa_ie_data data;
4282
4283         if (!resp_ies ||
4284             ieee802_11_parse_elems(resp_ies, resp_ies_len, &elems, 1) ==
4285             ParseFailed) {
4286                 wpa_printf(MSG_INFO,
4287                            "OWE: Could not parse Association Response frame elements");
4288                 return -1;
4289         }
4290
4291         if (sm->cur_pmksa && elems.rsn_ie &&
4292             wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, 2 + elems.rsn_ie_len,
4293                                  &data) == 0 &&
4294             data.num_pmkid == 1 && data.pmkid &&
4295             os_memcmp(sm->cur_pmksa->pmkid, data.pmkid, PMKID_LEN) == 0) {
4296                 wpa_printf(MSG_DEBUG, "OWE: Use PMKSA caching");
4297                 wpa_sm_set_pmk_from_pmksa(sm);
4298                 return 0;
4299         }
4300
4301         if (!elems.owe_dh) {
4302                 wpa_printf(MSG_INFO,
4303                            "OWE: No Diffie-Hellman Parameter element found in Association Response frame");
4304                 return -1;
4305         }
4306
4307         group = WPA_GET_LE16(elems.owe_dh);
4308         if (group != sm->owe_group) {
4309                 wpa_printf(MSG_INFO,
4310                            "OWE: Unexpected Diffie-Hellman group in response: %u",
4311                            group);
4312                 return -1;
4313         }
4314
4315         if (!sm->owe_ecdh) {
4316                 wpa_printf(MSG_INFO, "OWE: No ECDH state available");
4317                 return -1;
4318         }
4319
4320         if (group == 19)
4321                 prime_len = 32;
4322         else if (group == 20)
4323                 prime_len = 48;
4324         else if (group == 21)
4325                 prime_len = 66;
4326         else
4327                 return -1;
4328
4329         secret = crypto_ecdh_set_peerkey(sm->owe_ecdh, 0,
4330                                          elems.owe_dh + 2,
4331                                          elems.owe_dh_len - 2);
4332         secret = wpabuf_zeropad(secret, prime_len);
4333         if (!secret) {
4334                 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
4335                 return -1;
4336         }
4337         wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
4338
4339         /* prk = HKDF-extract(C | A | group, z) */
4340
4341         pub = crypto_ecdh_get_pubkey(sm->owe_ecdh, 0);
4342         if (!pub) {
4343                 wpabuf_clear_free(secret);
4344                 return -1;
4345         }
4346
4347         /* PMKID = Truncate-128(Hash(C | A)) */
4348         addr[0] = wpabuf_head(pub);
4349         len[0] = wpabuf_len(pub);
4350         addr[1] = elems.owe_dh + 2;
4351         len[1] = elems.owe_dh_len - 2;
4352         if (group == 19) {
4353                 res = sha256_vector(2, addr, len, pmkid);
4354                 hash_len = SHA256_MAC_LEN;
4355         } else if (group == 20) {
4356                 res = sha384_vector(2, addr, len, pmkid);
4357                 hash_len = SHA384_MAC_LEN;
4358         } else if (group == 21) {
4359                 res = sha512_vector(2, addr, len, pmkid);
4360                 hash_len = SHA512_MAC_LEN;
4361         } else {
4362                 res = -1;
4363                 hash_len = 0;
4364         }
4365         pub = wpabuf_zeropad(pub, prime_len);
4366         if (res < 0 || !pub) {
4367                 wpabuf_free(pub);
4368                 wpabuf_clear_free(secret);
4369                 return -1;
4370         }
4371
4372         hkey = wpabuf_alloc(wpabuf_len(pub) + elems.owe_dh_len - 2 + 2);
4373         if (!hkey) {
4374                 wpabuf_free(pub);
4375                 wpabuf_clear_free(secret);
4376                 return -1;
4377         }
4378
4379         wpabuf_put_buf(hkey, pub); /* C */
4380         wpabuf_free(pub);
4381         wpabuf_put_data(hkey, elems.owe_dh + 2, elems.owe_dh_len - 2); /* A */
4382         wpabuf_put_le16(hkey, sm->owe_group); /* group */
4383         if (group == 19)
4384                 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
4385                                   wpabuf_head(secret), wpabuf_len(secret), prk);
4386         else if (group == 20)
4387                 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
4388                                   wpabuf_head(secret), wpabuf_len(secret), prk);
4389         else if (group == 21)
4390                 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
4391                                   wpabuf_head(secret), wpabuf_len(secret), prk);
4392         wpabuf_clear_free(hkey);
4393         wpabuf_clear_free(secret);
4394         if (res < 0)
4395                 return -1;
4396
4397         wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
4398
4399         /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
4400
4401         if (group == 19)
4402                 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
4403                                       os_strlen(info), sm->pmk, hash_len);
4404         else if (group == 20)
4405                 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
4406                                       os_strlen(info), sm->pmk, hash_len);
4407         else if (group == 21)
4408                 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
4409                                       os_strlen(info), sm->pmk, hash_len);
4410         os_memset(prk, 0, SHA512_MAC_LEN);
4411         if (res < 0) {
4412                 sm->pmk_len = 0;
4413                 return -1;
4414         }
4415         sm->pmk_len = hash_len;
4416
4417         wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sm->pmk, sm->pmk_len);
4418         wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
4419         pmksa_cache_add(sm->pmksa, sm->pmk, sm->pmk_len, pmkid, NULL, 0,
4420                         bssid, sm->own_addr, sm->network_ctx, sm->key_mgmt,
4421                         NULL);
4422
4423         return 0;
4424 }
4425
4426 #endif /* CONFIG_OWE */
4427
4428
4429 void wpa_sm_set_fils_cache_id(struct wpa_sm *sm, const u8 *fils_cache_id)
4430 {
4431 #ifdef CONFIG_FILS
4432         if (sm && fils_cache_id) {
4433                 sm->fils_cache_id_set = 1;
4434                 os_memcpy(sm->fils_cache_id, fils_cache_id, FILS_CACHE_ID_LEN);
4435         }
4436 #endif /* CONFIG_FILS */
4437 }