contrib/wpa_supplicant/wpa.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include <stdlib.h>
  16 #include <stdio.h>
  17 #include <sys/time.h>
  18 #ifndef CONFIG_NATIVE_WINDOWS
  19 #include <netinet/in.h>
  20 #endif /* CONFIG_NATIVE_WINDOWS */
  21 #include <string.h>
  22 #include <time.h>
  23
  24 #include "common.h"
  25 #include "md5.h"
  26 #include "sha1.h"
  27 #include "rc4.h"
  28 #include "aes_wrap.h"
  29 #include "wpa.h"
  30 #include "driver.h"
  31 #include "eloop.h"
  32 #include "wpa_supplicant.h"
  33 #include "config.h"
  34 #include "l2_packet.h"
  35 #include "eapol_sm.h"
  36 #include "wpa_supplicant_i.h"
  37
  38 static void rsn_preauth_candidate_process(struct wpa_supplicant *wpa_s);
  39
  40 #define PMKID_CANDIDATE_PRIO_SCAN 1000
  41
  42 /* TODO: make these configurable */
  43 static const int dot11RSNAConfigPMKLifetime = 43200;
  44 static const int dot11RSNAConfigPMKReauthThreshold = 70;
  45 static const int dot11RSNAConfigSATimeout = 60;
  46 static const int pmksa_cache_max_entries = 32;
  47
  48 static const int WPA_SELECTOR_LEN = 4;
  49 static const u8 WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
  50 static const u16 WPA_VERSION = 1;
  51 static const u8 WPA_AUTH_KEY_MGMT_NONE[] = { 0x00, 0x50, 0xf2, 0 };
  52 static const u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x50, 0xf2, 1 };
  53 static const u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x50, 0xf2, 2 };
  54 static const u8 WPA_CIPHER_SUITE_NONE[] = { 0x00, 0x50, 0xf2, 0 };
  55 static const u8 WPA_CIPHER_SUITE_WEP40[] = { 0x00, 0x50, 0xf2, 1 };
  56 static const u8 WPA_CIPHER_SUITE_TKIP[] = { 0x00, 0x50, 0xf2, 2 };
  57 static const u8 WPA_CIPHER_SUITE_WRAP[] = { 0x00, 0x50, 0xf2, 3 };
  58 static const u8 WPA_CIPHER_SUITE_CCMP[] = { 0x00, 0x50, 0xf2, 4 };
  59 static const u8 WPA_CIPHER_SUITE_WEP104[] = { 0x00, 0x50, 0xf2, 5 };
  60
  61 /* WPA IE version 1
  62  * 00-50-f2:1 (OUI:OUI type)
  63  * 0x01 0x00 (version; little endian)
  64  * (all following fields are optional:)
  65  * Group Suite Selector (4 octets) (default: TKIP)
  66  * Pairwise Suite Count (2 octets, little endian) (default: 1)
  67  * Pairwise Suite List (4 * n octets) (default: TKIP)
  68  * Authenticated Key Management Suite Count (2 octets, little endian)
  69  *    (default: 1)
  70  * Authenticated Key Management Suite List (4 * n octets)
  71  *    (default: unspec 802.1x)
  72  * WPA Capabilities (2 octets, little endian) (default: 0)
  73  */
  74
  75 struct wpa_ie_hdr {
  76         u8 elem_id;
  77         u8 len;
  78         u8 oui[3];
  79         u8 oui_type;
  80         u16 version;
  81 } __attribute__ ((packed));
  82
  83
  84 static const int RSN_SELECTOR_LEN = 4;
  85 static const u16 RSN_VERSION = 1;
  86 static const u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x0f, 0xac, 1 };
  87 static const u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x0f, 0xac, 2 };
  88 static const u8 RSN_CIPHER_SUITE_NONE[] = { 0x00, 0x0f, 0xac, 0 };
  89 static const u8 RSN_CIPHER_SUITE_WEP40[] = { 0x00, 0x0f, 0xac, 1 };
  90 static const u8 RSN_CIPHER_SUITE_TKIP[] = { 0x00, 0x0f, 0xac, 2 };
  91 static const u8 RSN_CIPHER_SUITE_WRAP[] = { 0x00, 0x0f, 0xac, 3 };
  92 static const u8 RSN_CIPHER_SUITE_CCMP[] = { 0x00, 0x0f, 0xac, 4 };
  93 static const u8 RSN_CIPHER_SUITE_WEP104[] = { 0x00, 0x0f, 0xac, 5 };
  94
  95 /* EAPOL-Key Key Data Encapsulation
  96  * GroupKey and STAKey require encryption, otherwise, encryption is optional.
  97  */
  98 static const u8 RSN_KEY_DATA_GROUPKEY[] = { 0x00, 0x0f, 0xac, 1 };
  99 static const u8 RSN_KEY_DATA_STAKEY[] = { 0x00, 0x0f, 0xac, 2 };
 100 static const u8 RSN_KEY_DATA_MAC_ADDR[] = { 0x00, 0x0f, 0xac, 3 };
 101 static const u8 RSN_KEY_DATA_PMKID[] = { 0x00, 0x0f, 0xac, 4 };
 102
 103 /* 1/4: PMKID
 104  * 2/4: RSN IE
 105  * 3/4: one or two RSN IEs + GTK IE (encrypted)
 106  * 4/4: empty
 107  * 1/2: GTK IE (encrypted)
 108  * 2/2: empty
 109  */
 110
 111 /* RSN IE version 1
 112  * 0x01 0x00 (version; little endian)
 113  * (all following fields are optional:)
 114  * Group Suite Selector (4 octets) (default: CCMP)
 115  * Pairwise Suite Count (2 octets, little endian) (default: 1)
 116  * Pairwise Suite List (4 * n octets) (default: CCMP)
 117  * Authenticated Key Management Suite Count (2 octets, little endian)
 118  *    (default: 1)
 119  * Authenticated Key Management Suite List (4 * n octets)
 120  *    (default: unspec 802.1x)
 121  * RSN Capabilities (2 octets, little endian) (default: 0)
 122  * PMKID Count (2 octets) (default: 0)
 123  * PMKID List (16 * n octets)
 124  */
 125
 126 struct rsn_ie_hdr {
 127         u8 elem_id; /* WLAN_EID_RSN */
 128         u8 len;
 129         u16 version;
 130 } __attribute__ ((packed));
 131
 132
 133 static int wpa_selector_to_bitfield(u8 *s)
 134 {
 135         if (memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == 0)
 136                 return WPA_CIPHER_NONE;
 137         if (memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == 0)
 138                 return WPA_CIPHER_WEP40;
 139         if (memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == 0)
 140                 return WPA_CIPHER_TKIP;
 141         if (memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == 0)
 142                 return WPA_CIPHER_CCMP;
 143         if (memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == 0)
 144                 return WPA_CIPHER_WEP104;
 145         return 0;
 146 }
 147
 148
 149 static int wpa_key_mgmt_to_bitfield(u8 *s)
 150 {
 151         if (memcmp(s, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X, WPA_SELECTOR_LEN) == 0)
 152                 return WPA_KEY_MGMT_IEEE8021X;
 153         if (memcmp(s, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X, WPA_SELECTOR_LEN) ==
 154             0)
 155                 return WPA_KEY_MGMT_PSK;
 156         if (memcmp(s, WPA_AUTH_KEY_MGMT_NONE, WPA_SELECTOR_LEN) == 0)
 157                 return WPA_KEY_MGMT_WPA_NONE;
 158         return 0;
 159 }
 160
 161
 162 static int rsn_selector_to_bitfield(u8 *s)
 163 {
 164         if (memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == 0)
 165                 return WPA_CIPHER_NONE;
 166         if (memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == 0)
 167                 return WPA_CIPHER_WEP40;
 168         if (memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == 0)
 169                 return WPA_CIPHER_TKIP;
 170         if (memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == 0)
 171                 return WPA_CIPHER_CCMP;
 172         if (memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == 0)
 173                 return WPA_CIPHER_WEP104;
 174         return 0;
 175 }
 176
 177
 178 static int rsn_key_mgmt_to_bitfield(u8 *s)
 179 {
 180         if (memcmp(s, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X, RSN_SELECTOR_LEN) == 0)
 181                 return WPA_KEY_MGMT_IEEE8021X;
 182         if (memcmp(s, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X, RSN_SELECTOR_LEN) ==
 183             0)
 184                 return WPA_KEY_MGMT_PSK;
 185         return 0;
 186 }
 187
 188
 189 static void rsn_pmkid(u8 *pmk, u8 *aa, u8 *spa, u8 *pmkid)
 190 {
 191         char *title = "PMK Name";
 192         const unsigned char *addr[3];
 193         const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
 194         unsigned char hash[SHA1_MAC_LEN];
 195
 196         addr[0] = (unsigned char *) title;
 197         addr[1] = aa;
 198         addr[2] = spa;
 199
 200         hmac_sha1_vector(pmk, PMK_LEN, 3, addr, len, hash);
 201         memcpy(pmkid, hash, PMKID_LEN);
 202 }
 203
 204
 205 static void pmksa_cache_set_expiration(struct wpa_supplicant *wpa_s);
 206
 207
 208 static void pmksa_cache_free_entry(struct wpa_supplicant *wpa_s,
 209                                    struct rsn_pmksa_cache *entry)
 210 {
 211         free(entry);
 212         wpa_s->pmksa_count--;
 213         if (wpa_s->cur_pmksa == entry) {
 214                 wpa_printf(MSG_DEBUG, "RSN: removed current PMKSA entry");
 215                 /* TODO: should drop PMK and PTK and trigger new key
 216                  * negotiation */
 217                 wpa_s->cur_pmksa = NULL;
 218         }
 219 }
 220
 221
 222 static void pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
 223 {
 224         struct wpa_supplicant *wpa_s = eloop_ctx;
 225         time_t now;
 226
 227         time(&now);
 228         while (wpa_s->pmksa && wpa_s->pmksa->expiration <= now) {
 229                 struct rsn_pmksa_cache *entry = wpa_s->pmksa;
 230                 wpa_s->pmksa = entry->next;
 231                 wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for "
 232                            MACSTR, MAC2STR(entry->aa));
 233                 pmksa_cache_free_entry(wpa_s, entry);
 234         }
 235
 236         pmksa_cache_set_expiration(wpa_s);
 237 }
 238
 239
 240 static void pmksa_cache_set_expiration(struct wpa_supplicant *wpa_s)
 241 {
 242         int sec;
 243         eloop_cancel_timeout(pmksa_cache_expire, wpa_s, NULL);
 244         if (wpa_s->pmksa == NULL)
 245                 return;
 246         sec = wpa_s->pmksa->expiration - time(NULL);
 247         if (sec < 0)
 248                 sec = 0;
 249         eloop_register_timeout(sec + 1, 0, pmksa_cache_expire, wpa_s, NULL);
 250 }
 251
 252
 253 static void pmksa_cache_add(struct wpa_supplicant *wpa_s, u8 *pmk,
 254                             size_t pmk_len, u8 *aa, u8 *spa)
 255 {
 256         struct rsn_pmksa_cache *entry, *pos, *prev;
 257
 258         if (wpa_s->proto != WPA_PROTO_RSN || pmk_len > PMK_LEN)
 259                 return;
 260
 261         entry = malloc(sizeof(*entry));
 262         if (entry == NULL)
 263                 return;
 264         memset(entry, 0, sizeof(*entry));
 265         memcpy(entry->pmk, pmk, pmk_len);
 266         entry->pmk_len = pmk_len;
 267         rsn_pmkid(pmk, aa, spa, entry->pmkid);
 268         entry->expiration = time(NULL) + dot11RSNAConfigPMKLifetime;
 269         entry->akmp = WPA_KEY_MGMT_IEEE8021X;
 270         memcpy(entry->aa, aa, ETH_ALEN);
 271
 272         /* Replace an old entry for the same Authenticator (if found) with the
 273          * new entry */
 274         pos = wpa_s->pmksa;
 275         prev = NULL;
 276         while (pos) {
 277                 if (memcmp(aa, pos->aa, ETH_ALEN) == 0) {
 278                         if (prev == NULL)
 279                                 wpa_s->pmksa = pos->next;
 280                         else
 281                                 prev->next = pos->next;
 282                         pmksa_cache_free_entry(wpa_s, pos);
 283                         break;
 284                 }
 285                 prev = pos;
 286                 pos = pos->next;
 287         }
 288
 289         if (wpa_s->pmksa_count >= pmksa_cache_max_entries && wpa_s->pmksa) {
 290                 /* Remove the oldest entry to make room for the new entry */
 291                 pos = wpa_s->pmksa;
 292                 wpa_s->pmksa = pos->next;
 293                 wpa_printf(MSG_DEBUG, "RSN: removed the oldest PMKSA cache "
 294                            "entry (for " MACSTR ") to make room for new one",
 295                            MAC2STR(pos->aa));
 296                 wpa_drv_remove_pmkid(wpa_s, pos->aa, pos->pmkid);
 297                 pmksa_cache_free_entry(wpa_s, pos);
 298         }
 299
 300         /* Add the new entry; order by expiration time */
 301         pos = wpa_s->pmksa;
 302         prev = NULL;
 303         while (pos) {
 304                 if (pos->expiration > entry->expiration)
 305                         break;
 306                 prev = pos;
 307                 pos = pos->next;
 308         }
 309         if (prev == NULL) {
 310                 entry->next = wpa_s->pmksa;
 311                 wpa_s->pmksa = entry;
 312         } else {
 313                 entry->next = prev->next;
 314                 prev->next = entry;
 315         }
 316         wpa_s->pmksa_count++;
 317         wpa_printf(MSG_DEBUG, "RSN: added PMKSA cache entry for " MACSTR,
 318                    MAC2STR(entry->aa));
 319         wpa_drv_add_pmkid(wpa_s, entry->aa, entry->pmkid);
 320 }
 321
 322
 323 void pmksa_cache_free(struct wpa_supplicant *wpa_s)
 324 {
 325         struct rsn_pmksa_cache *entry, *prev;
 326
 327         entry = wpa_s->pmksa;
 328         wpa_s->pmksa = NULL;
 329         while (entry) {
 330                 prev = entry;
 331                 entry = entry->next;
 332                 free(prev);
 333         }
 334         pmksa_cache_set_expiration(wpa_s);
 335         wpa_s->cur_pmksa = NULL;
 336 }
 337
 338
 339 struct rsn_pmksa_cache * pmksa_cache_get(struct wpa_supplicant *wpa_s,
 340                                          u8 *aa, u8 *pmkid)
 341 {
 342         struct rsn_pmksa_cache *entry = wpa_s->pmksa;
 343         while (entry) {
 344                 if ((aa == NULL || memcmp(entry->aa, aa, ETH_ALEN) == 0) &&
 345                     (pmkid == NULL ||
 346                      memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0))
 347                         return entry;
 348                 entry = entry->next;
 349         }
 350         return NULL;
 351 }
 352
 353
 354 int pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf, size_t len)
 355 {
 356         int i, j;
 357         char *pos = buf;
 358         struct rsn_pmksa_cache *entry;
 359         time_t now;
 360
 361         time(&now);
 362         pos += snprintf(pos, buf + len - pos,
 363                         "Index / AA / PMKID / expiration (in seconds)\n");
 364         i = 0;
 365         entry = wpa_s->pmksa;
 366         while (entry) {
 367                 i++;
 368                 pos += snprintf(pos, buf + len - pos, "%d " MACSTR " ",
 369                                 i, MAC2STR(entry->aa));
 370                 for (j = 0; j < PMKID_LEN; j++)
 371                         pos += snprintf(pos, buf + len - pos, "%02x",
 372                                         entry->pmkid[j]);
 373                 pos += snprintf(pos, buf + len - pos, " %d\n",
 374                                 (int) (entry->expiration - now));
 375                 entry = entry->next;
 376         }
 377         return pos - buf;
 378 }
 379
 380
 381 void pmksa_candidate_free(struct wpa_supplicant *wpa_s)
 382 {
 383         struct rsn_pmksa_candidate *entry, *prev;
 384
 385         entry = wpa_s->pmksa_candidates;
 386         wpa_s->pmksa_candidates = NULL;
 387         while (entry) {
 388                 prev = entry;
 389                 entry = entry->next;
 390                 free(prev);
 391         }
 392 }
 393
 394
 395 static int wpa_parse_wpa_ie_wpa(struct wpa_supplicant *wpa_s, u8 *wpa_ie,
 396                                 size_t wpa_ie_len, struct wpa_ie_data *data)
 397 {
 398         struct wpa_ie_hdr *hdr;
 399         u8 *pos;
 400         int left;
 401         int i, count;
 402
 403         data->proto = WPA_PROTO_WPA;
 404         data->pairwise_cipher = WPA_CIPHER_TKIP;
 405         data->group_cipher = WPA_CIPHER_TKIP;
 406         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 407         data->capabilities = 0;
 408         data->pmkid = NULL;
 409         data->num_pmkid = 0;
 410
 411         if (wpa_ie_len == 0) {
 412                 /* No WPA IE - fail silently */
 413                 return -1;
 414         }
 415
 416         if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
 417                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
 418                            __func__, (unsigned long) wpa_ie_len);
 419                 return -1;
 420         }
 421
 422         hdr = (struct wpa_ie_hdr *) wpa_ie;
 423
 424         if (hdr->elem_id != GENERIC_INFO_ELEM ||
 425             hdr->len != wpa_ie_len - 2 ||
 426             memcmp(&hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN) != 0 ||
 427             le_to_host16(hdr->version) != WPA_VERSION) {
 428                 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
 429                            __func__);
 430                 return -1;
 431         }
 432
 433         pos = (u8 *) (hdr + 1);
 434         left = wpa_ie_len - sizeof(*hdr);
 435
 436         if (left >= WPA_SELECTOR_LEN) {
 437                 data->group_cipher = wpa_selector_to_bitfield(pos);
 438                 pos += WPA_SELECTOR_LEN;
 439                 left -= WPA_SELECTOR_LEN;
 440         } else if (left > 0) {
 441                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
 442                            __func__, left);
 443                 return -1;
 444         }
 445
 446         if (left >= 2) {
 447                 data->pairwise_cipher = 0;
 448                 count = pos[0] | (pos[1] << 8);
 449                 pos += 2;
 450                 left -= 2;
 451                 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
 452                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
 453                                    "count %u left %u", __func__, count, left);
 454                         return -1;
 455                 }
 456                 for (i = 0; i < count; i++) {
 457                         data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
 458                         pos += WPA_SELECTOR_LEN;
 459                         left -= WPA_SELECTOR_LEN;
 460                 }
 461         } else if (left == 1) {
 462                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
 463                            __func__);
 464                 return -1;
 465         }
 466
 467         if (left >= 2) {
 468                 data->key_mgmt = 0;
 469                 count = pos[0] | (pos[1] << 8);
 470                 pos += 2;
 471                 left -= 2;
 472                 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
 473                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
 474                                    "count %u left %u", __func__, count, left);
 475                         return -1;
 476                 }
 477                 for (i = 0; i < count; i++) {
 478                         data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
 479                         pos += WPA_SELECTOR_LEN;
 480                         left -= WPA_SELECTOR_LEN;
 481                 }
 482         } else if (left == 1) {
 483                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
 484                            __func__);
 485                 return -1;
 486         }
 487
 488         if (left >= 2) {
 489                 data->capabilities = pos[0] | (pos[1] << 8);
 490                 pos += 2;
 491                 left -= 2;
 492         }
 493
 494         if (left > 0) {
 495                 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes",
 496                            __func__, left);
 497                 return -1;
 498         }
 499
 500         return 0;
 501 }
 502
 503
 504 static int wpa_parse_wpa_ie_rsn(struct wpa_supplicant *wpa_s, u8 *rsn_ie,
 505                                 size_t rsn_ie_len, struct wpa_ie_data *data)
 506 {
 507         struct rsn_ie_hdr *hdr;
 508         u8 *pos;
 509         int left;
 510         int i, count;
 511
 512         data->proto = WPA_PROTO_RSN;
 513         data->pairwise_cipher = WPA_CIPHER_CCMP;
 514         data->group_cipher = WPA_CIPHER_CCMP;
 515         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 516         data->capabilities = 0;
 517         data->pmkid = NULL;
 518         data->num_pmkid = 0;
 519
 520         if (rsn_ie_len == 0) {
 521                 /* No RSN IE - fail silently */
 522                 return -1;
 523         }
 524
 525         if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
 526                 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
 527                            __func__, (unsigned long) rsn_ie_len);
 528                 return -1;
 529         }
 530
 531         hdr = (struct rsn_ie_hdr *) rsn_ie;
 532
 533         if (hdr->elem_id != RSN_INFO_ELEM ||
 534             hdr->len != rsn_ie_len - 2 ||
 535             le_to_host16(hdr->version) != RSN_VERSION) {
 536                 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
 537                            __func__);
 538                 return -1;
 539         }
 540
 541         pos = (u8 *) (hdr + 1);
 542         left = rsn_ie_len - sizeof(*hdr);
 543
 544         if (left >= RSN_SELECTOR_LEN) {
 545                 data->group_cipher = rsn_selector_to_bitfield(pos);
 546                 pos += RSN_SELECTOR_LEN;
 547                 left -= RSN_SELECTOR_LEN;
 548         } else if (left > 0) {
 549                 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
 550                            __func__, left);
 551                 return -1;
 552         }
 553
 554         if (left >= 2) {
 555                 data->pairwise_cipher = 0;
 556                 count = pos[0] | (pos[1] << 8);
 557                 pos += 2;
 558                 left -= 2;
 559                 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
 560                         wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
 561                                    "count %u left %u", __func__, count, left);
 562                         return -1;
 563                 }
 564                 for (i = 0; i < count; i++) {
 565                         data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
 566                         pos += RSN_SELECTOR_LEN;
 567                         left -= RSN_SELECTOR_LEN;
 568                 }
 569         } else if (left == 1) {
 570                 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
 571                            __func__);
 572                 return -1;
 573         }
 574
 575         if (left >= 2) {
 576                 data->key_mgmt = 0;
 577                 count = pos[0] | (pos[1] << 8);
 578                 pos += 2;
 579                 left -= 2;
 580                 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
 581                         wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
 582                                    "count %u left %u", __func__, count, left);
 583                         return -1;
 584                 }
 585                 for (i = 0; i < count; i++) {
 586                         data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
 587                         pos += RSN_SELECTOR_LEN;
 588                         left -= RSN_SELECTOR_LEN;
 589                 }
 590         } else if (left == 1) {
 591                 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
 592                            __func__);
 593                 return -1;
 594         }
 595
 596         if (left >= 2) {
 597                 data->capabilities = pos[0] | (pos[1] << 8);
 598                 pos += 2;
 599                 left -= 2;
 600         }
 601
 602         if (left >= 2) {
 603                 data->num_pmkid = pos[0] | (pos[1] << 8);
 604                 pos += 2;
 605                 left -= 2;
 606                 if (left < data->num_pmkid * PMKID_LEN) {
 607                         wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
 608                                    "(num_pmkid=%d left=%d)",
 609                                    __func__, data->num_pmkid, left);
 610                         data->num_pmkid = 0;
 611                 } else {
 612                         data->pmkid = pos;
 613                         pos += data->num_pmkid * PMKID_LEN;
 614                         left -= data->num_pmkid * PMKID_LEN;
 615                 }
 616         }
 617
 618         if (left > 0) {
 619                 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
 620                            __func__, left);
 621         }
 622
 623         return 0;
 624 }
 625
 626
 627 int wpa_parse_wpa_ie(struct wpa_supplicant *wpa_s, u8 *wpa_ie,
 628                      size_t wpa_ie_len, struct wpa_ie_data *data)
 629 {
 630         if (wpa_ie_len >= 1 && wpa_ie[0] == RSN_INFO_ELEM)
 631                 return wpa_parse_wpa_ie_rsn(wpa_s, wpa_ie, wpa_ie_len, data);
 632         else
 633                 return wpa_parse_wpa_ie_wpa(wpa_s, wpa_ie, wpa_ie_len, data);
 634 }
 635
 636
 637 static int wpa_gen_wpa_ie_wpa(struct wpa_supplicant *wpa_s, u8 *wpa_ie)
 638 {
 639         u8 *pos;
 640         struct wpa_ie_hdr *hdr;
 641
 642         hdr = (struct wpa_ie_hdr *) wpa_ie;
 643         hdr->elem_id = GENERIC_INFO_ELEM;
 644         memcpy(&hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN);
 645         hdr->version = host_to_le16(WPA_VERSION);
 646         pos = (u8 *) (hdr + 1);
 647
 648         if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
 649                 memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
 650         } else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
 651                 memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
 652         } else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
 653                 memcpy(pos, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN);
 654         } else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
 655                 memcpy(pos, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN);
 656         } else {
 657                 wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
 658                            wpa_s->group_cipher);
 659                 return -1;
 660         }
 661         pos += WPA_SELECTOR_LEN;
 662
 663         *pos++ = 1;
 664         *pos++ = 0;
 665         if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
 666                 memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
 667         } else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
 668                 memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
 669         } else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
 670                 memcpy(pos, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN);
 671         } else {
 672                 wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
 673                            wpa_s->pairwise_cipher);
 674                 return -1;
 675         }
 676         pos += WPA_SELECTOR_LEN;
 677
 678         *pos++ = 1;
 679         *pos++ = 0;
 680         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
 681                 memcpy(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X, WPA_SELECTOR_LEN);
 682         } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
 683                 memcpy(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X,
 684                        WPA_SELECTOR_LEN);
 685         } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
 686                 memcpy(pos, WPA_AUTH_KEY_MGMT_NONE, WPA_SELECTOR_LEN);
 687         } else {
 688                 wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
 689                            wpa_s->key_mgmt);
 690                 return -1;
 691         }
 692         pos += WPA_SELECTOR_LEN;
 693
 694         /* WPA Capabilities; use defaults, so no need to include it */
 695
 696         hdr->len = (pos - wpa_ie) - 2;
 697
 698         return pos - wpa_ie;
 699 }
 700
 701
 702 static int wpa_gen_wpa_ie_rsn(struct wpa_supplicant *wpa_s, u8 *rsn_ie)
 703 {
 704         u8 *pos;
 705         struct rsn_ie_hdr *hdr;
 706
 707         hdr = (struct rsn_ie_hdr *) rsn_ie;
 708         hdr->elem_id = RSN_INFO_ELEM;
 709         hdr->version = host_to_le16(RSN_VERSION);
 710         pos = (u8 *) (hdr + 1);
 711
 712         if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
 713                 memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
 714         } else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
 715                 memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
 716         } else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
 717                 memcpy(pos, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN);
 718         } else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
 719                 memcpy(pos, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN);
 720         } else {
 721                 wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
 722                            wpa_s->group_cipher);
 723                 return -1;
 724         }
 725         pos += RSN_SELECTOR_LEN;
 726
 727         *pos++ = 1;
 728         *pos++ = 0;
 729         if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
 730                 memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
 731         } else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
 732                 memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
 733         } else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
 734                 memcpy(pos, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN);
 735         } else {
 736                 wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
 737                            wpa_s->pairwise_cipher);
 738                 return -1;
 739         }
 740         pos += RSN_SELECTOR_LEN;
 741
 742         *pos++ = 1;
 743         *pos++ = 0;
 744         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
 745                 memcpy(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X, RSN_SELECTOR_LEN);
 746         } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
 747                 memcpy(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X,
 748                        RSN_SELECTOR_LEN);
 749         } else {
 750                 wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
 751                            wpa_s->key_mgmt);
 752                 return -1;
 753         }
 754         pos += RSN_SELECTOR_LEN;
 755
 756         /* RSN Capabilities */
 757         *pos++ = 0;
 758         *pos++ = 0;
 759
 760         if (wpa_s->cur_pmksa) {
 761                 /* PMKID Count (2 octets, little endian) */
 762                 *pos++ = 1;
 763                 *pos++ = 0;
 764                 /* PMKID */
 765                 memcpy(pos, wpa_s->cur_pmksa->pmkid, PMKID_LEN);
 766                 pos += PMKID_LEN;
 767         }
 768
 769         hdr->len = (pos - rsn_ie) - 2;
 770
 771         return pos - rsn_ie;
 772 }
 773
 774
 775 int wpa_gen_wpa_ie(struct wpa_supplicant *wpa_s, u8 *wpa_ie)
 776 {
 777         if (wpa_s->proto == WPA_PROTO_RSN)
 778                 return wpa_gen_wpa_ie_rsn(wpa_s, wpa_ie);
 779         else
 780                 return wpa_gen_wpa_ie_wpa(wpa_s, wpa_ie);
 781 }
 782
 783
 784 static void wpa_pmk_to_ptk(u8 *pmk, size_t pmk_len, u8 *addr1, u8 *addr2,
 785                            u8 *nonce1, u8 *nonce2, u8 *ptk, size_t ptk_len)
 786 {
 787         u8 data[2 * ETH_ALEN + 2 * 32];
 788
 789         /* PTK = PRF-X(PMK, "Pairwise key expansion",
 790          *             Min(AA, SA) || Max(AA, SA) ||
 791          *             Min(ANonce, SNonce) || Max(ANonce, SNonce)) */
 792
 793         if (memcmp(addr1, addr2, ETH_ALEN) < 0) {
 794                 memcpy(data, addr1, ETH_ALEN);
 795                 memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
 796         } else {
 797                 memcpy(data, addr2, ETH_ALEN);
 798                 memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
 799         }
 800
 801         if (memcmp(nonce1, nonce2, 32) < 0) {
 802                 memcpy(data + 2 * ETH_ALEN, nonce1, 32);
 803                 memcpy(data + 2 * ETH_ALEN + 32, nonce2, 32);
 804         } else {
 805                 memcpy(data + 2 * ETH_ALEN, nonce2, 32);
 806                 memcpy(data + 2 * ETH_ALEN + 32, nonce1, 32);
 807         }
 808
 809         sha1_prf(pmk, pmk_len, "Pairwise key expansion", data, sizeof(data),
 810                  ptk, ptk_len);
 811
 812         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK", pmk, pmk_len);
 813         wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", ptk, ptk_len);
 814 }
 815
 816
 817 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
 818 {
 819         struct wpa_ssid *entry;
 820         u8 ssid[MAX_SSID_LEN];
 821         int ssid_len;
 822         u8 bssid[ETH_ALEN];
 823
 824         ssid_len = wpa_drv_get_ssid(wpa_s, ssid);
 825         if (ssid_len < 0) {
 826                 wpa_printf(MSG_WARNING, "Could not read SSID from driver.");
 827                 return NULL;
 828         }
 829
 830         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
 831                 wpa_printf(MSG_WARNING, "Could not read BSSID from driver.");
 832                 return NULL;
 833         }
 834
 835         entry = wpa_s->conf->ssid;
 836         while (entry) {
 837                 if (ssid_len == entry->ssid_len &&
 838                     memcmp(ssid, entry->ssid, ssid_len) == 0 &&
 839                     (!entry->bssid_set ||
 840                      memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
 841                         return entry;
 842                 entry = entry->next;
 843         }
 844
 845         return NULL;
 846 }
 847
 848
 849 static void wpa_eapol_key_mic(u8 *key, int ver, u8 *buf, size_t len, u8 *mic)
 850 {
 851         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
 852                 hmac_md5(key, 16, buf, len, mic);
 853         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
 854                 u8 hash[SHA1_MAC_LEN];
 855                 hmac_sha1(key, 16, buf, len, hash);
 856                 memcpy(mic, hash, MD5_MAC_LEN);
 857         }
 858 }
 859
 860
 861 void wpa_supplicant_key_request(struct wpa_supplicant *wpa_s,
 862                                 int error, int pairwise)
 863 {
 864         int rlen;
 865         struct ieee802_1x_hdr *hdr;
 866         struct wpa_eapol_key *reply;
 867         unsigned char *rbuf;
 868         struct l2_ethhdr *ethhdr;
 869         int key_info, ver;
 870         u8 bssid[ETH_ALEN];
 871
 872         if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP)
 873                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
 874         else
 875                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
 876
 877         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
 878                 wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
 879                            "request");
 880                 return;
 881         }
 882
 883         rlen = sizeof(*ethhdr) + sizeof(*hdr) + sizeof(*reply);
 884         rbuf = malloc(rlen);
 885         if (rbuf == NULL)
 886                 return;
 887
 888         memset(rbuf, 0, rlen);
 889         ethhdr = (struct l2_ethhdr *) rbuf;
 890         memcpy(ethhdr->h_dest, bssid, ETH_ALEN);
 891         memcpy(ethhdr->h_source, wpa_s->own_addr, ETH_ALEN);
 892         ethhdr->h_proto = htons(ETH_P_EAPOL);
 893
 894         hdr = (struct ieee802_1x_hdr *) (ethhdr + 1);
 895         hdr->version = wpa_s->conf->eapol_version;
 896         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
 897         hdr->length = htons(sizeof(*reply));
 898
 899         reply = (struct wpa_eapol_key *) (hdr + 1);
 900         reply->type = wpa_s->proto == WPA_PROTO_RSN ?
 901                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
 902         key_info = WPA_KEY_INFO_REQUEST | ver;
 903         if (wpa_s->ptk_set)
 904                 key_info |= WPA_KEY_INFO_MIC;
 905         if (error)
 906                 key_info |= WPA_KEY_INFO_ERROR;
 907         if (pairwise)
 908                 key_info |= WPA_KEY_INFO_KEY_TYPE;
 909         reply->key_info = host_to_be16(key_info);
 910         reply->key_length = 0;
 911         memcpy(reply->replay_counter, wpa_s->request_counter,
 912                WPA_REPLAY_COUNTER_LEN);
 913         inc_byte_array(wpa_s->request_counter, WPA_REPLAY_COUNTER_LEN);
 914
 915         reply->key_data_length = host_to_be16(0);
 916
 917         if (key_info & WPA_KEY_INFO_MIC) {
 918                 wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (u8 *) hdr,
 919                          rlen - sizeof(*ethhdr), reply->key_mic);
 920         }
 921
 922         wpa_printf(MSG_INFO, "WPA: Sending EAPOL-Key Request (error=%d "
 923                    "pairwise=%d ptk_set=%d len=%d)",
 924                    error, pairwise, wpa_s->ptk_set, rlen);
 925         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key Request", rbuf, rlen);
 926         l2_packet_send(wpa_s->l2, rbuf, rlen);
 927         eapol_sm_notify_tx_eapol_key(wpa_s->eapol);
 928         free(rbuf);
 929 }
 930
 931
 932 static void wpa_supplicant_process_1_of_4(struct wpa_supplicant *wpa_s,
 933                                           unsigned char *src_addr,
 934                                           struct wpa_eapol_key *key, int ver)
 935 {
 936         int rlen;
 937         struct ieee802_1x_hdr *hdr;
 938         struct wpa_eapol_key *reply;
 939         unsigned char *rbuf;
 940         struct l2_ethhdr *ethhdr;
 941         struct wpa_ssid *ssid;
 942         struct wpa_ptk *ptk;
 943         u8 buf[8], wpa_ie_buf[80], *wpa_ie, *pmkid = NULL;
 944         int wpa_ie_len;
 945         int abort_cached = 0;
 946
 947         wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
 948         wpa_printf(MSG_DEBUG, "WPA: RX message 1 of 4-Way Handshake from "
 949                    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
 950
 951         ssid = wpa_supplicant_get_ssid(wpa_s);
 952         if (ssid == NULL) {
 953                 wpa_printf(MSG_WARNING, "WPA: No SSID info found (msg 1 of "
 954                            "4).");
 955                 return;
 956         }
 957
 958         if (wpa_s->proto == WPA_PROTO_RSN) {
 959                 /* RSN: msg 1/4 should contain PMKID for the selected PMK */
 960                 u8 *pos = (u8 *) (key + 1);
 961                 u8 *end = pos + be_to_host16(key->key_data_length);
 962                 wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
 963                             pos, be_to_host16(key->key_data_length));
 964                 while (pos + 1 < end) {
 965                         if (pos + 2 + pos[1] > end) {
 966                                 wpa_printf(MSG_DEBUG, "RSN: key data "
 967                                            "underflow (ie=%d len=%d)",
 968                                            pos[0], pos[1]);
 969                                 break;
 970                         }
 971                         if (pos[0] == GENERIC_INFO_ELEM &&
 972                             pos + 1 + RSN_SELECTOR_LEN < end &&
 973                             pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
 974                             memcmp(pos + 2, RSN_KEY_DATA_PMKID,
 975                                    RSN_SELECTOR_LEN) == 0) {
 976                                 pmkid = pos + 2 + RSN_SELECTOR_LEN;
 977                                 wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
 978                                             "Authenticator", pmkid, PMKID_LEN);
 979                                 break;
 980                         } else if (pos[0] == GENERIC_INFO_ELEM &&
 981                                    pos[1] == 0)
 982                                 break;
 983                         pos += 2 + pos[1];
 984                 }
 985         }
 986
 987         if (wpa_s->assoc_wpa_ie) {
 988                 /* The driver reported a WPA IE that may be different from the
 989                  * one that the Supplicant would use. Message 2/4 has to use
 990                  * the exact copy of the WPA IE from the Association Request,
 991                  * so use the value reported by the driver. */
 992                 wpa_ie = wpa_s->assoc_wpa_ie;
 993                 wpa_ie_len = wpa_s->assoc_wpa_ie_len;
 994         } else {
 995                 wpa_ie = wpa_ie_buf;
 996                 wpa_ie_len = wpa_gen_wpa_ie(wpa_s, wpa_ie);
 997                 if (wpa_ie_len < 0) {
 998                         wpa_printf(MSG_WARNING, "WPA: Failed to generate "
 999                                    "WPA IE (for msg 2 of 4).");
1000                         return;
1001                 }
1002                 wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4",
1003                             wpa_ie, wpa_ie_len);
1004         }
1005
1006         rlen = sizeof(*ethhdr) + sizeof(*hdr) + sizeof(*reply) + wpa_ie_len;
1007         rbuf = malloc(rlen);
1008         if (rbuf == NULL)
1009                 return;
1010
1011         memset(rbuf, 0, rlen);
1012         ethhdr = (struct l2_ethhdr *) rbuf;
1013         memcpy(ethhdr->h_dest, src_addr, ETH_ALEN);
1014         memcpy(ethhdr->h_source, wpa_s->own_addr, ETH_ALEN);
1015         ethhdr->h_proto = htons(ETH_P_EAPOL);
1016
1017         hdr = (struct ieee802_1x_hdr *) (ethhdr + 1);
1018         hdr->version = wpa_s->conf->eapol_version;
1019         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1020         hdr->length = htons(sizeof(*reply) + wpa_ie_len);
1021
1022         reply = (struct wpa_eapol_key *) (hdr + 1);
1023         reply->type = wpa_s->proto == WPA_PROTO_RSN ?
1024                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1025         reply->key_info = host_to_be16(ver | WPA_KEY_INFO_KEY_TYPE |
1026                                        WPA_KEY_INFO_MIC);
1027         reply->key_length = key->key_length;
1028         memcpy(reply->replay_counter, key->replay_counter,
1029                WPA_REPLAY_COUNTER_LEN);
1030
1031         reply->key_data_length = host_to_be16(wpa_ie_len);
1032         memcpy(reply + 1, wpa_ie, wpa_ie_len);
1033
1034         if (wpa_s->renew_snonce) {
1035                 if (hostapd_get_rand(wpa_s->snonce, WPA_NONCE_LEN)) {
1036                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to get "
1037                                 "random data for SNonce");
1038                         free(rbuf);
1039                         return;
1040                 }
1041                 wpa_s->renew_snonce = 0;
1042                 wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
1043                             wpa_s->snonce, WPA_NONCE_LEN);
1044         }
1045         memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
1046         ptk = &wpa_s->tptk;
1047         memcpy(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN);
1048         if (pmkid && !wpa_s->cur_pmksa) {
1049                 /* When using drivers that generate RSN IE, wpa_supplicant may
1050                  * not have enough time to get the association information
1051                  * event before receiving this 1/4 message, so try to find a
1052                  * matching PMKSA cache entry here. */
1053                 wpa_s->cur_pmksa = pmksa_cache_get(wpa_s, src_addr, pmkid);
1054                 if (wpa_s->cur_pmksa) {
1055                         wpa_printf(MSG_DEBUG, "RSN: found matching PMKID from "
1056                                    "PMKSA cache");
1057                 } else {
1058                         wpa_printf(MSG_DEBUG, "RSN: no matching PMKID found");
1059                         abort_cached = 1;
1060                 }
1061         }
1062
1063         if (pmkid && wpa_s->cur_pmksa &&
1064             memcmp(pmkid, wpa_s->cur_pmksa->pmkid, PMKID_LEN) == 0) {
1065                 wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);
1066                 memcpy(wpa_s->pmk, wpa_s->cur_pmksa->pmk, PMK_LEN);
1067                 wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",
1068                                 wpa_s->pmk, PMK_LEN);
1069                 eapol_sm_notify_cached(wpa_s->eapol);
1070         } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X && wpa_s->eapol) {
1071                 int res, pmk_len;
1072                 pmk_len = PMK_LEN;
1073                 res = eapol_sm_get_key(wpa_s->eapol, wpa_s->pmk, PMK_LEN);
1074 #ifdef EAP_LEAP
1075                 if (res) {
1076                         res = eapol_sm_get_key(wpa_s->eapol, wpa_s->pmk, 16);
1077                         pmk_len = 16;
1078                 }
1079 #endif /* EAP_LEAP */
1080                 if (res == 0) {
1081                         wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "
1082                                         "machines", wpa_s->pmk, pmk_len);
1083                         wpa_s->pmk_len = pmk_len;
1084                         pmksa_cache_add(wpa_s, wpa_s->pmk, pmk_len, src_addr,
1085                                         wpa_s->own_addr);
1086                         if (!wpa_s->cur_pmksa && pmkid &&
1087                             pmksa_cache_get(wpa_s, src_addr, pmkid)) {
1088                                 wpa_printf(MSG_DEBUG, "RSN: the new PMK "
1089                                            "matches with the PMKID");
1090                                 abort_cached = 0;
1091                         }
1092                 } else {
1093                         wpa_msg(wpa_s, MSG_WARNING,
1094                                 "WPA: Failed to get master session key from "
1095                                 "EAPOL state machines");
1096                         wpa_msg(wpa_s, MSG_WARNING,
1097                                 "WPA: Key handshake aborted");
1098                         if (wpa_s->cur_pmksa) {
1099                                 wpa_printf(MSG_DEBUG, "RSN: Cancelled PMKSA "
1100                                            "caching attempt");
1101                                 wpa_s->cur_pmksa = NULL;
1102                                 abort_cached = 1;
1103                         } else {
1104                                 free(rbuf);
1105                                 return;
1106                         }
1107                 }
1108 #ifdef CONFIG_XSUPPLICANT_IFACE
1109         } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X &&
1110                    !wpa_s->ext_pmk_received) {
1111                 wpa_printf(MSG_INFO, "WPA: Master session has not yet "
1112                            "been received from the external IEEE "
1113                            "802.1X Supplicant - ignoring WPA "
1114                            "EAPOL-Key frame");
1115                 free(rbuf);
1116                 return;
1117 #endif /* CONFIG_XSUPPLICANT_IFACE */
1118         }
1119
1120         if (abort_cached && wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
1121                 /* Send EAPOL-Start to trigger full EAP authentication. */
1122                 wpa_printf(MSG_DEBUG, "RSN: no PMKSA entry found - trigger "
1123                            "full EAP authenication");
1124                 wpa_eapol_send(wpa_s, IEEE802_1X_TYPE_EAPOL_START,
1125                                (u8 *) "", 0);
1126                 free(rbuf);
1127                 return;
1128         }
1129
1130         wpa_pmk_to_ptk(wpa_s->pmk, wpa_s->pmk_len, wpa_s->own_addr, src_addr,
1131                        wpa_s->snonce, key->key_nonce,
1132                        (u8 *) ptk, sizeof(*ptk));
1133         /* Supplicant: swap tx/rx Mic keys */
1134         memcpy(buf, ptk->u.auth.tx_mic_key, 8);
1135         memcpy(ptk->u.auth.tx_mic_key, ptk->u.auth.rx_mic_key, 8);
1136         memcpy(ptk->u.auth.rx_mic_key, buf, 8);
1137         wpa_s->tptk_set = 1;
1138         wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, (u8 *) hdr,
1139                           rlen - sizeof(*ethhdr), reply->key_mic);
1140         wpa_hexdump(MSG_DEBUG, "WPA: EAPOL-Key MIC", reply->key_mic, 16);
1141
1142         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
1143         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/4", rbuf, rlen);
1144         l2_packet_send(wpa_s->l2, rbuf, rlen);
1145         eapol_sm_notify_tx_eapol_key(wpa_s->eapol);
1146         free(rbuf);
1147 }
1148
1149
1150 static void wpa_supplicant_key_neg_complete(struct wpa_supplicant *wpa_s,
1151                                             u8 *addr, int secure)
1152 {
1153         wpa_msg(wpa_s, MSG_INFO, "WPA: Key negotiation completed with "
1154                 MACSTR " [PTK=%s GTK=%s]", MAC2STR(addr),
1155                 wpa_cipher_txt(wpa_s->pairwise_cipher),
1156                 wpa_cipher_txt(wpa_s->group_cipher));
1157         eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
1158         wpa_supplicant_cancel_auth_timeout(wpa_s);
1159         wpa_s->wpa_state = WPA_COMPLETED;
1160
1161         if (secure) {
1162                 /* MLME.SETPROTECTION.request(TA, Tx_Rx) */
1163                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
1164                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK)
1165                         eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
1166                 rsn_preauth_candidate_process(wpa_s);
1167         }
1168 }
1169
1170
1171 static int wpa_supplicant_install_ptk(struct wpa_supplicant *wpa_s,
1172                                       unsigned char *src_addr,
1173                                       struct wpa_eapol_key *key)
1174 {
1175         int alg, keylen, rsclen;
1176         u8 *key_rsc;
1177         u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
1178
1179         wpa_printf(MSG_DEBUG, "WPA: Installing PTK to the driver.");
1180
1181         switch (wpa_s->pairwise_cipher) {
1182         case WPA_CIPHER_CCMP:
1183                 alg = WPA_ALG_CCMP;
1184                 keylen = 16;
1185                 rsclen = 6;
1186                 break;
1187         case WPA_CIPHER_TKIP:
1188                 alg = WPA_ALG_TKIP;
1189                 keylen = 32;
1190                 rsclen = 6;
1191                 break;
1192         case WPA_CIPHER_NONE:
1193                 wpa_printf(MSG_DEBUG, "WPA: Pairwise Cipher Suite: "
1194                            "NONE - do not use pairwise keys");
1195                 return 0;
1196         default:
1197                 wpa_printf(MSG_WARNING, "WPA: Unsupported pairwise cipher %d",
1198                            wpa_s->pairwise_cipher);
1199                 return -1;
1200         }
1201
1202         if (wpa_s->proto == WPA_PROTO_RSN) {
1203                 key_rsc = null_rsc;
1204         } else {
1205                 key_rsc = key->key_rsc;
1206                 wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
1207         }
1208
1209         wpa_s->keys_cleared = 0;
1210         if (wpa_drv_set_key(wpa_s, alg, src_addr, 0, 1, key_rsc, rsclen,
1211                             (u8 *) &wpa_s->ptk.tk1, keylen) < 0) {
1212                 wpa_printf(MSG_WARNING, "WPA: Failed to set PTK to the "
1213                            "driver.");
1214                 return -1;
1215         }
1216         return 0;
1217 }
1218
1219
1220 static int wpa_supplicant_check_group_cipher(struct wpa_supplicant *wpa_s,
1221                                              int keylen, int maxkeylen,
1222                                              int *key_rsc_len, int *alg)
1223 {
1224         switch (wpa_s->group_cipher) {
1225         case WPA_CIPHER_CCMP:
1226                 if (keylen != 16 || maxkeylen < 16) {
1227                         wpa_printf(MSG_WARNING, "WPA: Unsupported CCMP Group "
1228                                    "Cipher key length %d (%d).",
1229                                    keylen, maxkeylen);
1230                         return -1;
1231                 }
1232                 *key_rsc_len = 6;
1233                 *alg = WPA_ALG_CCMP;
1234                 break;
1235         case WPA_CIPHER_TKIP:
1236                 if (keylen != 32 || maxkeylen < 32) {
1237                         wpa_printf(MSG_WARNING, "WPA: Unsupported TKIP Group "
1238                                    "Cipher key length %d (%d).",
1239                                    keylen, maxkeylen);
1240                         return -1;
1241                 }
1242                 *key_rsc_len = 6;
1243                 *alg = WPA_ALG_TKIP;
1244                 break;
1245         case WPA_CIPHER_WEP104:
1246                 if (keylen != 13 || maxkeylen < 13) {
1247                         wpa_printf(MSG_WARNING, "WPA: Unsupported WEP104 Group"
1248                                    " Cipher key length %d (%d).",
1249                                    keylen, maxkeylen);
1250                         return -1;
1251                 }
1252                 *key_rsc_len = 0;
1253                 *alg = WPA_ALG_WEP;
1254                 break;
1255         case WPA_CIPHER_WEP40:
1256                 if (keylen != 5 || maxkeylen < 5) {
1257                         wpa_printf(MSG_WARNING, "WPA: Unsupported WEP40 Group "
1258                                    "Cipher key length %d (%d).",
1259                                    keylen, maxkeylen);
1260                         return -1;
1261                 }
1262                 *key_rsc_len = 0;
1263                 *alg = WPA_ALG_WEP;
1264                 break;
1265         default:
1266                 wpa_printf(MSG_WARNING, "WPA: Unsupport Group Cipher %d",
1267                            wpa_s->group_cipher);
1268                 return -1;
1269         }
1270
1271         return 0;
1272 }
1273
1274
1275 static int wpa_supplicant_install_gtk(struct wpa_supplicant *wpa_s,
1276                                       struct wpa_eapol_key *key, int alg,
1277                                       u8 *gtk, int gtk_len, int keyidx,
1278                                       int key_rsc_len, int tx)
1279 {
1280         wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gtk, gtk_len);
1281         wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver "
1282                    "(keyidx=%d tx=%d).", keyidx, tx);
1283         wpa_hexdump(MSG_DEBUG, "WPA: RSC", key->key_rsc, key_rsc_len);
1284         if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
1285                 /* Swap Tx/Rx keys for Michael MIC */
1286                 u8 tmpbuf[8];
1287                 memcpy(tmpbuf, gtk + 16, 8);
1288                 memcpy(gtk + 16, gtk + 24, 8);
1289                 memcpy(gtk + 24, tmpbuf, 8);
1290         }
1291         wpa_s->keys_cleared = 0;
1292         if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
1293                 if (wpa_drv_set_key(wpa_s, alg,
1294                                     (u8 *) "\xff\xff\xff\xff\xff\xff",
1295                                     keyidx, 1, key->key_rsc, key_rsc_len,
1296                                     gtk, gtk_len) < 0) {
1297                         wpa_printf(MSG_WARNING, "WPA: Failed to set "
1298                                    "GTK to the driver (Group only).");
1299                         return -1;
1300                 }
1301         } else if (wpa_drv_set_key(wpa_s, alg,
1302                                    (u8 *) "\xff\xff\xff\xff\xff\xff",
1303                                    keyidx, tx, key->key_rsc, key_rsc_len,
1304                                    gtk, gtk_len) < 0) {
1305                 wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to "
1306                            "the driver.");
1307                 return -1;
1308         }
1309
1310         return 0;
1311 }
1312
1313
1314 static int wpa_supplicant_pairwise_gtk(struct wpa_supplicant *wpa_s,
1315                                        unsigned char *src_addr,
1316                                        struct wpa_eapol_key *key,
1317                                        u8 *gtk, int gtk_len, int key_info)
1318 {
1319         int keyidx, tx, key_rsc_len = 0, alg;
1320
1321         wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake",
1322                         gtk, gtk_len);
1323
1324         keyidx = gtk[0] & 0x3;
1325         tx = !!(gtk[0] & BIT(2));
1326         if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
1327                 /* Ignore Tx bit in GTK IE if a pairwise key is used. One AP
1328                  * seemed to set this bit (incorrectly, since Tx is only when
1329                  * doing Group Key only APs) and without this workaround, the
1330                  * data connection does not work because wpa_supplicant
1331                  * configured non-zero keyidx to be used for unicast. */
1332                 wpa_printf(MSG_INFO, "RSN: Tx bit set for GTK IE, but "
1333                            "pairwise keys are used - ignore Tx bit");
1334                 tx = 0;
1335         }
1336         gtk += 2;
1337         gtk_len -= 2;
1338
1339         if (wpa_supplicant_check_group_cipher(wpa_s, gtk_len, gtk_len,
1340                                               &key_rsc_len, &alg)) {
1341                 return -1;
1342         }
1343
1344         if (wpa_supplicant_install_gtk(wpa_s, key, alg, gtk, gtk_len, keyidx,
1345                                        key_rsc_len, tx)) {
1346                 return -1;
1347         }
1348
1349         wpa_supplicant_key_neg_complete(wpa_s, src_addr,
1350                                         key_info & WPA_KEY_INFO_SECURE);
1351         return 0;
1352 }
1353
1354
1355 static void wpa_report_ie_mismatch(struct wpa_supplicant *wpa_s,
1356                                    const char *reason, const u8 *src_addr,
1357                                    const u8 *wpa_ie, size_t wpa_ie_len,
1358                                    const u8 *rsn_ie, size_t rsn_ie_len)
1359 {
1360         wpa_msg(wpa_s, MSG_WARNING, "WPA: %s (src=" MACSTR ")",
1361                 reason, MAC2STR(src_addr));
1362
1363         if (wpa_s->ap_wpa_ie) {
1364                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1365                             wpa_s->ap_wpa_ie, wpa_s->ap_wpa_ie_len);
1366         }
1367         if (wpa_ie) {
1368                 if (!wpa_s->ap_wpa_ie) {
1369                         wpa_printf(MSG_INFO, "WPA: No WPA IE in "
1370                                    "Beacon/ProbeResp");
1371                 }
1372                 wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg",
1373                             wpa_ie, wpa_ie_len);
1374         }
1375
1376         if (wpa_s->ap_rsn_ie) {
1377                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in Beacon/ProbeResp",
1378                             wpa_s->ap_rsn_ie, wpa_s->ap_rsn_ie_len);
1379         }
1380         if (rsn_ie) {
1381                 if (!wpa_s->ap_rsn_ie) {
1382                         wpa_printf(MSG_INFO, "WPA: No RSN IE in "
1383                                    "Beacon/ProbeResp");
1384                 }
1385                 wpa_hexdump(MSG_INFO, "WPA: RSN IE in 3/4 msg",
1386                             rsn_ie, rsn_ie_len);
1387         }
1388
1389         wpa_supplicant_disassociate(wpa_s, REASON_IE_IN_4WAY_DIFFERS);
1390         wpa_supplicant_req_scan(wpa_s, 0, 0);
1391 }
1392
1393
1394 static void wpa_supplicant_process_3_of_4(struct wpa_supplicant *wpa_s,
1395                                           unsigned char *src_addr,
1396                                           struct wpa_eapol_key *key,
1397                                           int extra_len, int ver)
1398 {
1399         int rlen;
1400         struct ieee802_1x_hdr *hdr;
1401         struct wpa_eapol_key *reply;
1402         unsigned char *rbuf;
1403         struct l2_ethhdr *ethhdr;
1404         int key_info, wpa_ie_len = 0, rsn_ie_len = 0, keylen, gtk_len = 0;
1405         u8 *wpa_ie = NULL, *rsn_ie = NULL, *gtk = NULL;
1406         u8 *pos, *end;
1407         u16 len;
1408         struct wpa_ssid *ssid = wpa_s->current_ssid;
1409
1410         wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
1411         wpa_printf(MSG_DEBUG, "WPA: RX message 3 of 4-Way Handshake from "
1412                    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1413
1414         key_info = be_to_host16(key->key_info);
1415
1416         pos = (u8 *) (key + 1);
1417         len = be_to_host16(key->key_data_length);
1418         end = pos + len;
1419         wpa_hexdump(MSG_DEBUG, "WPA: IE KeyData", pos, len);
1420         while (pos + 1 < end) {
1421                 if (pos + 2 + pos[1] > end) {
1422                         wpa_printf(MSG_DEBUG, "WPA: key data underflow (ie=%d "
1423                                    "len=%d)", pos[0], pos[1]);
1424                         break;
1425                 }
1426                 if (*pos == RSN_INFO_ELEM) {
1427                         rsn_ie = pos;
1428                         rsn_ie_len = pos[1] + 2;
1429                 } else if (*pos == GENERIC_INFO_ELEM && pos[1] >= 6 &&
1430                            memcmp(pos + 2, WPA_OUI_TYPE, WPA_SELECTOR_LEN) == 0
1431                            && pos[2 + WPA_SELECTOR_LEN] == 1 &&
1432                            pos[2 + WPA_SELECTOR_LEN + 1] == 0) {
1433                         wpa_ie = pos;
1434                         wpa_ie_len = pos[1] + 2;
1435                 } else if (pos[0] == GENERIC_INFO_ELEM &&
1436                            pos[1] > RSN_SELECTOR_LEN + 2 &&
1437                            memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
1438                                   RSN_SELECTOR_LEN) == 0) {
1439                         if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1440                                 wpa_printf(MSG_WARNING, "WPA: GTK IE in "
1441                                            "unencrypted key data");
1442                                 return;
1443                         }
1444                         gtk = pos + 2 + RSN_SELECTOR_LEN;
1445                         gtk_len = pos[1] - RSN_SELECTOR_LEN;
1446                 } else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0)
1447                         break;
1448
1449                 pos += 2 + pos[1];
1450         }
1451
1452         if (wpa_s->ap_wpa_ie == NULL && wpa_s->ap_rsn_ie == NULL) {
1453                 wpa_printf(MSG_DEBUG, "WPA: No WPA/RSN IE for this AP known. "
1454                            "Trying to get from scan results");
1455                 if (wpa_supplicant_get_beacon_ie(wpa_s) < 0) {
1456                         wpa_printf(MSG_WARNING, "WPA: Could not find AP from "
1457                                    "the scan results");
1458                 } else {
1459                         wpa_printf(MSG_DEBUG, "WPA: Found the current AP from "
1460                                    "updated scan results");
1461                 }
1462         }
1463
1464         if ((wpa_ie && wpa_s->ap_wpa_ie &&
1465              (wpa_ie_len != wpa_s->ap_wpa_ie_len ||
1466               memcmp(wpa_ie, wpa_s->ap_wpa_ie, wpa_ie_len) != 0)) ||
1467             (rsn_ie && wpa_s->ap_rsn_ie &&
1468              (rsn_ie_len != wpa_s->ap_rsn_ie_len ||
1469               memcmp(rsn_ie, wpa_s->ap_rsn_ie, rsn_ie_len) != 0))) {
1470                 wpa_report_ie_mismatch(wpa_s, "IE in 3/4 msg does not match "
1471                                        "with IE in Beacon/ProbeResp",
1472                                        src_addr, wpa_ie, wpa_ie_len,
1473                                        rsn_ie, rsn_ie_len);
1474                 return;
1475         }
1476
1477         if (wpa_s->proto == WPA_PROTO_WPA &&
1478             rsn_ie && wpa_s->ap_rsn_ie == NULL &&
1479             ssid && (ssid->proto & WPA_PROTO_RSN)) {
1480                 wpa_report_ie_mismatch(wpa_s, "Possible downgrade attack "
1481                                        "detected - RSN was enabled and RSN IE "
1482                                        "was in msg 3/4, but not in "
1483                                        "Beacon/ProbeResp",
1484                                        src_addr, wpa_ie, wpa_ie_len,
1485                                        rsn_ie, rsn_ie_len);
1486                 return;
1487         }
1488
1489         if (memcmp(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
1490                 wpa_printf(MSG_WARNING, "WPA: ANonce from message 1 of 4-Way "
1491                            "Handshake differs from 3 of 4-Way Handshake - drop"
1492                            " packet (src=" MACSTR ")", MAC2STR(src_addr));
1493                 return;
1494         }
1495
1496         keylen = be_to_host16(key->key_length);
1497         switch (wpa_s->pairwise_cipher) {
1498         case WPA_CIPHER_CCMP:
1499                 if (keylen != 16) {
1500                         wpa_printf(MSG_WARNING, "WPA: Invalid CCMP key length "
1501                                    "%d (src=" MACSTR ")",
1502                                    keylen, MAC2STR(src_addr));
1503                         return;
1504                 }
1505                 break;
1506         case WPA_CIPHER_TKIP:
1507                 if (keylen != 32) {
1508                         wpa_printf(MSG_WARNING, "WPA: Invalid TKIP key length "
1509                                    "%d (src=" MACSTR ")",
1510                                    keylen, MAC2STR(src_addr));
1511                         return;
1512                 }
1513                 break;
1514         }
1515
1516         rlen = sizeof(*ethhdr) + sizeof(*hdr) + sizeof(*reply);
1517         rbuf = malloc(rlen);
1518         if (rbuf == NULL)
1519                 return;
1520
1521         memset(rbuf, 0, rlen);
1522         ethhdr = (struct l2_ethhdr *) rbuf;
1523         memcpy(ethhdr->h_dest, src_addr, ETH_ALEN);
1524         memcpy(ethhdr->h_source, wpa_s->own_addr, ETH_ALEN);
1525         ethhdr->h_proto = htons(ETH_P_EAPOL);
1526
1527         hdr = (struct ieee802_1x_hdr *) (ethhdr + 1);
1528         hdr->version = wpa_s->conf->eapol_version;
1529         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1530         hdr->length = htons(sizeof(*reply));
1531
1532         reply = (struct wpa_eapol_key *) (hdr + 1);
1533         reply->type = wpa_s->proto == WPA_PROTO_RSN ?
1534                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1535         reply->key_info = host_to_be16(ver | WPA_KEY_INFO_KEY_TYPE |
1536                                        WPA_KEY_INFO_MIC |
1537                                        (key_info & WPA_KEY_INFO_SECURE));
1538         reply->key_length = key->key_length;
1539         memcpy(reply->replay_counter, key->replay_counter,
1540                WPA_REPLAY_COUNTER_LEN);
1541
1542         reply->key_data_length = host_to_be16(0);
1543
1544         memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
1545         wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (u8 *) hdr,
1546                           rlen - sizeof(*ethhdr), reply->key_mic);
1547
1548         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
1549         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 4/4", rbuf, rlen);
1550         l2_packet_send(wpa_s->l2, rbuf, rlen);
1551         eapol_sm_notify_tx_eapol_key(wpa_s->eapol);
1552         free(rbuf);
1553
1554         /* SNonce was successfully used in msg 3/4, so mark it to be renewed
1555          * for the next 4-Way Handshake. If msg 3 is received again, the old
1556          * SNonce will still be used to avoid changing PTK. */
1557         wpa_s->renew_snonce = 1;
1558
1559         if (key_info & WPA_KEY_INFO_INSTALL) {
1560                 wpa_supplicant_install_ptk(wpa_s, src_addr, key);
1561         }
1562
1563         if (key_info & WPA_KEY_INFO_SECURE) {
1564                 /* MLME.SETPROTECTION.request(TA, Tx_Rx) */
1565                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
1566         }
1567         wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;
1568
1569         if (gtk) {
1570                 wpa_supplicant_pairwise_gtk(wpa_s, src_addr, key,
1571                                             gtk, gtk_len, key_info);
1572         }
1573 }
1574
1575
1576 static void wpa_supplicant_process_1_of_2(struct wpa_supplicant *wpa_s,
1577                                           unsigned char *src_addr,
1578                                           struct wpa_eapol_key *key,
1579                                           int extra_len, int ver)
1580 {
1581         int rlen;
1582         struct ieee802_1x_hdr *hdr;
1583         struct wpa_eapol_key *reply;
1584         unsigned char *rbuf;
1585         struct l2_ethhdr *ethhdr;
1586         int key_info, keylen, keydatalen, maxkeylen, keyidx, key_rsc_len = 0;
1587         int alg, tx, rekey;
1588         u8 ek[32], gtk[32];
1589         u8 *gtk_ie = NULL;
1590         size_t gtk_ie_len = 0;
1591
1592         rekey = wpa_s->wpa_state == WPA_COMPLETED;
1593         wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;
1594         wpa_printf(MSG_DEBUG, "WPA: RX message 1 of Group Key Handshake from "
1595                    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1596
1597         key_info = be_to_host16(key->key_info);
1598         keydatalen = be_to_host16(key->key_data_length);
1599
1600         if (wpa_s->proto == WPA_PROTO_RSN) {
1601                 u8 *pos = (u8 *) (key + 1);
1602                 u8 *end = pos + keydatalen;
1603                 while (pos + 1 < end) {
1604                         if (pos + 2 + pos[1] > end) {
1605                                 wpa_printf(MSG_DEBUG, "RSN: key data "
1606                                            "underflow (ie=%d len=%d)",
1607                                            pos[0], pos[1]);
1608                                 break;
1609                         }
1610                         if (pos[0] == GENERIC_INFO_ELEM &&
1611                             pos + 1 + RSN_SELECTOR_LEN < end &&
1612                             pos[1] > RSN_SELECTOR_LEN + 2 &&
1613                             memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
1614                                    RSN_SELECTOR_LEN) == 0) {
1615                                 if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1616                                         wpa_printf(MSG_WARNING, "WPA: GTK IE "
1617                                                    "in unencrypted key data");
1618                                         return;
1619                                 }
1620                                 gtk_ie = pos + 2 + RSN_SELECTOR_LEN;
1621                                 gtk_ie_len = pos[1] - RSN_SELECTOR_LEN;
1622                                 break;
1623                         } else if (pos[0] == GENERIC_INFO_ELEM &&
1624                                    pos[1] == 0)
1625                                 break;
1626
1627                         pos += 2 + pos[1];
1628                 }
1629
1630                 if (gtk_ie == NULL) {
1631                         wpa_printf(MSG_INFO, "WPA: No GTK IE in Group Key "
1632                                    "message 1/2");
1633                         return;
1634                 }
1635                 maxkeylen = keylen = gtk_ie_len - 2;
1636         } else {
1637                 keylen = be_to_host16(key->key_length);
1638                 maxkeylen = keydatalen;
1639                 if (keydatalen > extra_len) {
1640                         wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
1641                                    " key_data_length=%d > extra_len=%d",
1642                                    keydatalen, extra_len);
1643                         return;
1644                 }
1645                 if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES)
1646                         maxkeylen -= 8;
1647         }
1648
1649         if (wpa_supplicant_check_group_cipher(wpa_s, keylen, maxkeylen,
1650                                               &key_rsc_len, &alg)) {
1651                 return;
1652         }
1653
1654         if (wpa_s->proto == WPA_PROTO_RSN) {
1655                 wpa_hexdump(MSG_DEBUG,
1656                             "RSN: received GTK in group key handshake",
1657                             gtk_ie, gtk_ie_len);
1658                 keyidx = gtk_ie[0] & 0x3;
1659                 tx = !!(gtk_ie[0] & BIT(2));
1660                 if (gtk_ie_len - 2 > sizeof(gtk)) {
1661                         wpa_printf(MSG_INFO, "RSN: Too long GTK in GTK IE "
1662                                    "(len=%lu)",
1663                                    (unsigned long) gtk_ie_len - 2);
1664                         return;
1665                 }
1666                 memcpy(gtk, gtk_ie + 2, gtk_ie_len - 2);
1667         } else {
1668                 keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1669                         WPA_KEY_INFO_KEY_INDEX_SHIFT;
1670                 if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
1671                         memcpy(ek, key->key_iv, 16);
1672                         memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
1673                         rc4_skip(ek, 32, 256, (u8 *) (key + 1), keydatalen);
1674                         memcpy(gtk, key + 1, keylen);
1675                 } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1676                         if (keydatalen % 8) {
1677                                 wpa_printf(MSG_WARNING, "WPA: Unsupported "
1678                                            "AES-WRAP len %d", keydatalen);
1679                                 return;
1680                         }
1681                         if (aes_unwrap(wpa_s->ptk.encr_key, maxkeylen / 8,
1682                                        (u8 *) (key + 1), gtk)) {
1683                                 wpa_printf(MSG_WARNING, "WPA: AES unwrap "
1684                                            "failed - could not decrypt GTK");
1685                                 return;
1686                         }
1687                 }
1688                 tx = !!(key_info & WPA_KEY_INFO_TXRX);
1689         }
1690
1691         if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
1692                 /* Ignore Tx bit in Group Key message if a pairwise key
1693                  * is used. Some APs seem to setting this bit
1694                  * (incorrectly, since Tx is only when doing Group Key
1695                  * only APs) and without this workaround, the data
1696                  * connection does not work because wpa_supplicant
1697                  * configured non-zero keyidx to be used for unicast.
1698                  */
1699                 wpa_printf(MSG_INFO, "WPA: Tx bit set for GTK, but "
1700                            "pairwise keys are used - ignore Tx bit");
1701                 tx = 0;
1702         }
1703
1704         wpa_supplicant_install_gtk(wpa_s, key, alg, gtk, keylen, keyidx,
1705                                    key_rsc_len, tx);
1706
1707         rlen = sizeof(*ethhdr) + sizeof(*hdr) + sizeof(*reply);
1708         rbuf = malloc(rlen);
1709         if (rbuf == NULL)
1710                 return;
1711
1712         memset(rbuf, 0, rlen);
1713         ethhdr = (struct l2_ethhdr *) rbuf;
1714         memcpy(ethhdr->h_dest, src_addr, ETH_ALEN);
1715         memcpy(ethhdr->h_source, wpa_s->own_addr, ETH_ALEN);
1716         ethhdr->h_proto = htons(ETH_P_EAPOL);
1717
1718         hdr = (struct ieee802_1x_hdr *) (ethhdr + 1);
1719         hdr->version = wpa_s->conf->eapol_version;
1720         hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1721         hdr->length = htons(sizeof(*reply));
1722
1723         reply = (struct wpa_eapol_key *) (hdr + 1);
1724         reply->type = wpa_s->proto == WPA_PROTO_RSN ?
1725                 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1726         reply->key_info =
1727                 host_to_be16(ver | WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE |
1728                              (key_info & WPA_KEY_INFO_KEY_INDEX_MASK));
1729         reply->key_length = key->key_length;
1730         memcpy(reply->replay_counter, key->replay_counter,
1731                 WPA_REPLAY_COUNTER_LEN);
1732
1733         reply->key_data_length = host_to_be16(0);
1734
1735         wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (u8 *) hdr,
1736                           rlen - sizeof(*ethhdr), reply->key_mic);
1737
1738         wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
1739         wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/2", rbuf, rlen);
1740         l2_packet_send(wpa_s->l2, rbuf, rlen);
1741         eapol_sm_notify_tx_eapol_key(wpa_s->eapol);
1742         free(rbuf);
1743
1744         if (rekey) {
1745                 wpa_msg(wpa_s, MSG_INFO, "WPA: Group rekeying completed with "
1746                         MACSTR " [GTK=%s]", MAC2STR(src_addr),
1747                         wpa_cipher_txt(wpa_s->group_cipher));
1748                 wpa_s->wpa_state = WPA_COMPLETED;
1749         } else {
1750                 wpa_supplicant_key_neg_complete(wpa_s, src_addr,
1751                                                 key_info &
1752                                                 WPA_KEY_INFO_SECURE);
1753         }
1754 }
1755
1756
1757 static int wpa_supplicant_verify_eapol_key_mic(struct wpa_supplicant *wpa_s,
1758                                                struct wpa_eapol_key *key,
1759                                                int ver, u8 *buf, size_t len)
1760 {
1761         u8 mic[16];
1762         int ok = 0;
1763
1764         memcpy(mic, key->key_mic, 16);
1765         if (wpa_s->tptk_set) {
1766                 memset(key->key_mic, 0, 16);
1767                 wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, buf, len,
1768                                   key->key_mic);
1769                 if (memcmp(mic, key->key_mic, 16) != 0) {
1770                         wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
1771                                    "when using TPTK - ignoring TPTK");
1772                 } else {
1773                         ok = 1;
1774                         wpa_s->tptk_set = 0;
1775                         wpa_s->ptk_set = 1;
1776                         memcpy(&wpa_s->ptk, &wpa_s->tptk, sizeof(wpa_s->ptk));
1777                 }
1778         }
1779
1780         if (!ok && wpa_s->ptk_set) {
1781                 memset(key->key_mic, 0, 16);
1782                 wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, buf, len,
1783                                   key->key_mic);
1784                 if (memcmp(mic, key->key_mic, 16) != 0) {
1785                         wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
1786                                    "- dropping packet");
1787                         return -1;
1788                 }
1789                 ok = 1;
1790         }
1791
1792         if (!ok) {
1793                 wpa_printf(MSG_WARNING, "WPA: Could not verify EAPOL-Key MIC "
1794                            "- dropping packet");
1795                 return -1;
1796         }
1797
1798         memcpy(wpa_s->rx_replay_counter, key->replay_counter,
1799                WPA_REPLAY_COUNTER_LEN);
1800         wpa_s->rx_replay_counter_set = 1;
1801         return 0;
1802 }
1803
1804
1805 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
1806 static int wpa_supplicant_decrypt_key_data(struct wpa_supplicant *wpa_s,
1807                                            struct wpa_eapol_key *key, int ver)
1808 {
1809         int keydatalen = be_to_host16(key->key_data_length);
1810
1811         wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
1812                     (u8 *) (key + 1), keydatalen);
1813         if (!wpa_s->ptk_set) {
1814                 wpa_printf(MSG_WARNING, "WPA: PTK not available, "
1815                            "cannot decrypt EAPOL-Key key data.");
1816                 return -1;
1817         }
1818
1819         /* Decrypt key data here so that this operation does not need
1820          * to be implemented separately for each message type. */
1821         if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
1822                 u8 ek[32];
1823                 memcpy(ek, key->key_iv, 16);
1824                 memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
1825                 rc4_skip(ek, 32, 256, (u8 *) (key + 1), keydatalen);
1826         } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1827                 u8 *buf;
1828                 if (keydatalen % 8) {
1829                         wpa_printf(MSG_WARNING, "WPA: Unsupported "
1830                                    "AES-WRAP len %d", keydatalen);
1831                         return -1;
1832                 }
1833                 keydatalen -= 8; /* AES-WRAP adds 8 bytes */
1834                 buf = malloc(keydatalen);
1835                 if (buf == NULL) {
1836                         wpa_printf(MSG_WARNING, "WPA: No memory for "
1837                                    "AES-UNWRAP buffer");
1838                         return -1;
1839                 }
1840                 if (aes_unwrap(wpa_s->ptk.encr_key, keydatalen / 8,
1841                                (u8 *) (key + 1), buf)) {
1842                         free(buf);
1843                         wpa_printf(MSG_WARNING, "WPA: AES unwrap failed - "
1844                                    "could not decrypt EAPOL-Key key data");
1845                         return -1;
1846                 }
1847                 memcpy(key + 1, buf, keydatalen);
1848                 free(buf);
1849                 key->key_data_length = host_to_be16(keydatalen);
1850         }
1851         wpa_hexdump_key(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
1852                         (u8 *) (key + 1), keydatalen);
1853         return 0;
1854 }
1855
1856
1857 static void wpa_sm_rx_eapol(struct wpa_supplicant *wpa_s,
1858                             unsigned char *src_addr, unsigned char *buf,
1859                             size_t len)
1860 {
1861         size_t plen, data_len, extra_len;
1862         struct ieee802_1x_hdr *hdr;
1863         struct wpa_eapol_key *key;
1864         int key_info, ver;
1865
1866         hdr = (struct ieee802_1x_hdr *) buf;
1867         key = (struct wpa_eapol_key *) (hdr + 1);
1868         if (len < sizeof(*hdr) + sizeof(*key)) {
1869                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame too short, len %lu, "
1870                            "expecting at least %lu",
1871                            (unsigned long) len,
1872                            (unsigned long) sizeof(*hdr) + sizeof(*key));
1873                 return;
1874         }
1875         plen = ntohs(hdr->length);
1876         data_len = plen + sizeof(*hdr);
1877         wpa_printf(MSG_DEBUG, "IEEE 802.1X RX: version=%d type=%d length=%lu",
1878                    hdr->version, hdr->type, (unsigned long) plen);
1879
1880         wpa_drv_poll(wpa_s);
1881
1882         if (hdr->version < EAPOL_VERSION) {
1883                 /* TODO: backwards compatibility */
1884         }
1885         if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
1886                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame (type %u) discarded, "
1887                         "not a Key frame", hdr->type);
1888                 if (wpa_s->cur_pmksa) {
1889                         wpa_printf(MSG_DEBUG, "WPA: Cancelling PMKSA caching "
1890                                    "attempt - attempt full EAP "
1891                                    "authentication");
1892                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 0);
1893                 }
1894                 return;
1895         }
1896         if (plen > len - sizeof(*hdr) || plen < sizeof(*key)) {
1897                 wpa_printf(MSG_DEBUG, "WPA: EAPOL frame payload size %lu "
1898                            "invalid (frame size %lu)",
1899                            (unsigned long) plen, (unsigned long) len);
1900                 return;
1901         }
1902
1903         wpa_printf(MSG_DEBUG, "  EAPOL-Key type=%d", key->type);
1904         if (key->type != EAPOL_KEY_TYPE_WPA && key->type != EAPOL_KEY_TYPE_RSN)
1905         {
1906                 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key type (%d) unknown, "
1907                            "discarded", key->type);
1908                 return;
1909         }
1910
1911         wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
1912         if (data_len < len) {
1913                 wpa_printf(MSG_DEBUG, "WPA: ignoring %lu bytes after the IEEE "
1914                            "802.1X data", (unsigned long) len - data_len);
1915         }
1916         key_info = be_to_host16(key->key_info);
1917         ver = key_info & WPA_KEY_INFO_TYPE_MASK;
1918         if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
1919             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1920                 wpa_printf(MSG_INFO, "WPA: Unsupported EAPOL-Key descriptor "
1921                            "version %d.", ver);
1922                 return;
1923         }
1924
1925         if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP &&
1926             ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1927                 wpa_printf(MSG_INFO, "WPA: CCMP is used, but EAPOL-Key "
1928                            "descriptor version (%d) is not 2.", ver);
1929                 if (wpa_s->group_cipher != WPA_CIPHER_CCMP &&
1930                     !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
1931                         /* Earlier versions of IEEE 802.11i did not explicitly
1932                          * require version 2 descriptor for all EAPOL-Key
1933                          * packets, so allow group keys to use version 1 if
1934                          * CCMP is not used for them. */
1935                         wpa_printf(MSG_INFO, "WPA: Backwards compatibility: "
1936                                    "allow invalid version for non-CCMP group "
1937                                    "keys");
1938                 } else
1939                         return;
1940         }
1941
1942         if (wpa_s->rx_replay_counter_set &&
1943             memcmp(key->replay_counter, wpa_s->rx_replay_counter,
1944                    WPA_REPLAY_COUNTER_LEN) <= 0) {
1945                 wpa_printf(MSG_WARNING, "WPA: EAPOL-Key Replay Counter did not"
1946                            " increase - dropping packet");
1947                 return;
1948         }
1949
1950         if (!(key_info & WPA_KEY_INFO_ACK)) {
1951                 wpa_printf(MSG_INFO, "WPA: No Ack bit in key_info");
1952                 return;
1953         }
1954
1955         if (key_info & WPA_KEY_INFO_REQUEST) {
1956                 wpa_printf(MSG_INFO, "WPA: EAPOL-Key with Request bit - "
1957                            "dropped");
1958                 return;
1959         }
1960
1961         if ((key_info & WPA_KEY_INFO_MIC) &&
1962             wpa_supplicant_verify_eapol_key_mic(wpa_s, key, ver, buf,
1963                                                 data_len))
1964                 return;
1965
1966         extra_len = data_len - sizeof(*hdr) - sizeof(*key);
1967
1968         if (be_to_host16(key->key_data_length) > extra_len) {
1969                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid EAPOL-Key frame - "
1970                         "key_data overflow (%d > %lu)",
1971                         be_to_host16(key->key_data_length),
1972                         (unsigned long) extra_len);
1973                 return;
1974         }
1975
1976         if (wpa_s->proto == WPA_PROTO_RSN &&
1977             (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) &&
1978             wpa_supplicant_decrypt_key_data(wpa_s, key, ver))
1979                 return;
1980
1981         if (key_info & WPA_KEY_INFO_KEY_TYPE) {
1982                 if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
1983                         wpa_printf(MSG_WARNING, "WPA: Ignored EAPOL-Key "
1984                                    "(Pairwise) with non-zero key index");
1985                         return;
1986                 }
1987                 if (key_info & WPA_KEY_INFO_MIC) {
1988                         /* 3/4 4-Way Handshake */
1989                         wpa_supplicant_process_3_of_4(wpa_s, src_addr, key,
1990                                                       extra_len, ver);
1991                 } else {
1992                         /* 1/4 4-Way Handshake */
1993                         wpa_supplicant_process_1_of_4(wpa_s, src_addr, key,
1994                                                       ver);
1995                 }
1996         } else {
1997                 if (key_info & WPA_KEY_INFO_MIC) {
1998                         /* 1/2 Group Key Handshake */
1999                         wpa_supplicant_process_1_of_2(wpa_s, src_addr, key,
2000                                                       extra_len, ver);
2001                 } else {
2002                         wpa_printf(MSG_WARNING, "WPA: EAPOL-Key (Group) "
2003                                    "without Mic bit - dropped");
2004                 }
2005         }
2006 }
2007
2008
2009 void wpa_supplicant_rx_eapol(void *ctx, unsigned char *src_addr,
2010                              unsigned char *buf, size_t len)
2011 {
2012         struct wpa_supplicant *wpa_s = ctx;
2013
2014         wpa_printf(MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2015         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2016
2017         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2018                 wpa_printf(MSG_DEBUG, "Ignored received EAPOL frame since "
2019                            "no key management is configured");
2020                 return;
2021         }
2022
2023         if (wpa_s->eapol_received == 0) {
2024                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2025                 wpa_supplicant_req_auth_timeout(
2026                         wpa_s,
2027                         (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X ||
2028                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) ?
2029                         70 : 10, 0);
2030         }
2031         wpa_s->eapol_received++;
2032
2033         if (wpa_s->countermeasures) {
2034                 wpa_printf(MSG_INFO, "WPA: Countermeasures - dropped EAPOL "
2035                            "packet");
2036                 return;
2037         }
2038
2039         /* Source address of the incoming EAPOL frame could be compared to the
2040          * current BSSID. However, it is possible that a centralized
2041          * Authenticator could be using another MAC address than the BSSID of
2042          * an AP, so just allow any address to be used for now. The replies are
2043          * still sent to the current BSSID (if available), though. */
2044
2045         memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
2046         eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len);
2047         wpa_sm_rx_eapol(wpa_s, src_addr, buf, len);
2048 }
2049
2050
2051 static int wpa_cipher_bits(int cipher)
2052 {
2053         switch (cipher) {
2054         case WPA_CIPHER_CCMP:
2055                 return 128;
2056         case WPA_CIPHER_TKIP:
2057                 return 256;
2058         case WPA_CIPHER_WEP104:
2059                 return 104;
2060         case WPA_CIPHER_WEP40:
2061                 return 40;
2062         default:
2063                 return 0;
2064         }
2065 }
2066
2067
2068 static const u8 * wpa_key_mgmt_suite(struct wpa_supplicant *wpa_s)
2069 {
2070         static const u8 *dummy = (u8 *) "\x00\x00\x00\x00";
2071         switch (wpa_s->key_mgmt) {
2072         case WPA_KEY_MGMT_IEEE8021X:
2073                 return (wpa_s->proto == WPA_PROTO_RSN ?
2074                         RSN_AUTH_KEY_MGMT_UNSPEC_802_1X :
2075                         WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
2076         case WPA_KEY_MGMT_PSK:
2077                 return (wpa_s->proto == WPA_PROTO_RSN ?
2078                         RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X :
2079                         WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
2080         case WPA_KEY_MGMT_WPA_NONE:
2081                 return WPA_AUTH_KEY_MGMT_NONE;
2082         default:
2083                 return dummy;
2084         }
2085 }
2086
2087
2088 static const u8 * wpa_cipher_suite(struct wpa_supplicant *wpa_s, int cipher)
2089 {
2090         static const u8 *dummy = (u8 *) "\x00\x00\x00\x00";
2091         switch (cipher) {
2092         case WPA_CIPHER_CCMP:
2093                 return (wpa_s->proto == WPA_PROTO_RSN ?
2094                         RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
2095         case WPA_CIPHER_TKIP:
2096                 return (wpa_s->proto == WPA_PROTO_RSN ?
2097                         RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
2098         case WPA_CIPHER_WEP104:
2099                 return (wpa_s->proto == WPA_PROTO_RSN ?
2100                         RSN_CIPHER_SUITE_WEP104 : WPA_CIPHER_SUITE_WEP104);
2101         case WPA_CIPHER_WEP40:
2102                 return (wpa_s->proto == WPA_PROTO_RSN ?
2103                         RSN_CIPHER_SUITE_WEP40 : WPA_CIPHER_SUITE_WEP40);
2104         case WPA_CIPHER_NONE:
2105                 return (wpa_s->proto == WPA_PROTO_RSN ?
2106                         RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
2107         default:
2108                 return dummy;
2109         }
2110 }
2111
2112
2113 #define RSN_SUITE "%02x-%02x-%02x-%d"
2114 #define RSN_SUITE_ARG(s) (s)[0], (s)[1], (s)[2], (s)[3]
2115
2116 int wpa_get_mib(struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
2117 {
2118         int len, i;
2119         char pmkid_txt[PMKID_LEN * 2 + 1];
2120
2121         if (wpa_s->cur_pmksa) {
2122                 char *pos = pmkid_txt;
2123                 for (i = 0; i < PMKID_LEN; i++) {
2124                         pos += sprintf(pos, "%02x",
2125                                        wpa_s->cur_pmksa->pmkid[i]);
2126                 }
2127         } else
2128                 pmkid_txt[0] = '\0';
2129
2130         len = snprintf(buf, buflen,
2131                        "dot11RSNAConfigVersion=%d\n"
2132                        "dot11RSNAConfigPairwiseKeysSupported=5\n"
2133                        "dot11RSNAConfigGroupCipherSize=%d\n"
2134                        "dot11RSNAConfigPMKLifetime=%d\n"
2135                        "dot11RSNAConfigPMKReauthThreshold=%d\n"
2136                        "dot11RSNAConfigNumberOfPTKSAReplayCounters=1\n"
2137                        "dot11RSNAConfigSATimeout=%d\n"
2138                        "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n"
2139                        "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n"
2140                        "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n"
2141                        "dot11RSNAPMKIDUsed=%s\n"
2142                        "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n"
2143                        "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n"
2144                        "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n"
2145                        "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n",
2146                        RSN_VERSION,
2147                        wpa_cipher_bits(wpa_s->group_cipher),
2148                        dot11RSNAConfigPMKLifetime,
2149                        dot11RSNAConfigPMKReauthThreshold,
2150                        dot11RSNAConfigSATimeout,
2151                        RSN_SUITE_ARG(wpa_key_mgmt_suite(wpa_s)),
2152                        RSN_SUITE_ARG(wpa_cipher_suite(wpa_s,
2153                                                       wpa_s->pairwise_cipher)),
2154                        RSN_SUITE_ARG(wpa_cipher_suite(wpa_s,
2155                                                       wpa_s->group_cipher)),
2156                        pmkid_txt,
2157                        RSN_SUITE_ARG(wpa_key_mgmt_suite(wpa_s)),
2158                        RSN_SUITE_ARG(wpa_cipher_suite(wpa_s,
2159                                                       wpa_s->pairwise_cipher)),
2160                        RSN_SUITE_ARG(wpa_cipher_suite(wpa_s,
2161                                                       wpa_s->group_cipher)));
2162         return len;
2163 }
2164
2165
2166 #ifdef IEEE8021X_EAPOL
2167
2168 static void rsn_preauth_receive(void *ctx, unsigned char *src_addr,
2169                                 unsigned char *buf, size_t len)
2170 {
2171         struct wpa_supplicant *wpa_s = ctx;
2172
2173         wpa_printf(MSG_DEBUG, "RX pre-auth from " MACSTR, MAC2STR(src_addr));
2174         wpa_hexdump(MSG_MSGDUMP, "RX pre-auth", buf, len);
2175
2176         if (wpa_s->preauth_eapol == NULL ||
2177             memcmp(wpa_s->preauth_bssid, "\x00\x00\x00\x00\x00\x00",
2178                    ETH_ALEN) == 0 ||
2179             memcmp(wpa_s->preauth_bssid, src_addr, ETH_ALEN) != 0) {
2180                 wpa_printf(MSG_WARNING, "RSN pre-auth frame received from "
2181                            "unexpected source " MACSTR " - dropped",
2182                            MAC2STR(src_addr));
2183                 return;
2184         }
2185
2186         eapol_sm_rx_eapol(wpa_s->preauth_eapol, src_addr, buf, len);
2187 }
2188
2189
2190 static void rsn_preauth_eapol_cb(struct eapol_sm *eapol, int success,
2191                                  void *ctx)
2192 {
2193         struct wpa_supplicant *wpa_s = ctx;
2194         u8 pmk[PMK_LEN];
2195
2196         wpa_msg(wpa_s, MSG_INFO, "RSN: pre-authentication with " MACSTR
2197                 " %s", MAC2STR(wpa_s->preauth_bssid),
2198                 success ? "completed successfully" : "failed");
2199
2200         if (success) {
2201                 int res, pmk_len;
2202                 pmk_len = PMK_LEN;
2203                 res = eapol_sm_get_key(eapol, pmk, PMK_LEN);
2204 #ifdef EAP_LEAP
2205                 if (res) {
2206                         res = eapol_sm_get_key(eapol, pmk, 16);
2207                         pmk_len = 16;
2208                 }
2209 #endif /* EAP_LEAP */
2210                 if (res == 0) {
2211                         wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from pre-auth",
2212                                         pmk, pmk_len);
2213                         wpa_s->pmk_len = pmk_len;
2214                         pmksa_cache_add(wpa_s, pmk, pmk_len,
2215                                         wpa_s->preauth_bssid, wpa_s->own_addr);
2216                 } else {
2217                         wpa_msg(wpa_s, MSG_INFO, "RSN: failed to get master "
2218                                 "session key from pre-auth EAPOL state "
2219                                 "machines");
2220                 }
2221         }
2222
2223         rsn_preauth_deinit(wpa_s);
2224         rsn_preauth_candidate_process(wpa_s);
2225 }
2226
2227
2228 static void rsn_preauth_timeout(void *eloop_ctx, void *timeout_ctx)
2229 {
2230         struct wpa_supplicant *wpa_s = eloop_ctx;
2231         wpa_msg(wpa_s, MSG_INFO, "RSN: pre-authentication with " MACSTR
2232                 " timed out", MAC2STR(wpa_s->preauth_bssid));
2233         rsn_preauth_deinit(wpa_s);
2234         rsn_preauth_candidate_process(wpa_s);
2235 }
2236
2237
2238 int rsn_preauth_init(struct wpa_supplicant *wpa_s, u8 *dst)
2239 {
2240         struct eapol_config eapol_conf;
2241         struct eapol_ctx *ctx;
2242
2243         if (wpa_s->preauth_eapol)
2244                 return -1;
2245
2246         wpa_msg(wpa_s, MSG_DEBUG, "RSN: starting pre-authentication with "
2247                 MACSTR, MAC2STR(dst));
2248
2249         wpa_s->l2_preauth = l2_packet_init(wpa_s->ifname,
2250                                            wpa_drv_get_mac_addr(wpa_s),
2251                                            ETH_P_RSN_PREAUTH,
2252                                            rsn_preauth_receive, wpa_s);
2253         if (wpa_s->l2_preauth == NULL) {
2254                 wpa_printf(MSG_WARNING, "RSN: Failed to initialize L2 packet "
2255                            "processing for pre-authentication");
2256                 return -2;
2257         }
2258
2259         ctx = malloc(sizeof(*ctx));
2260         if (ctx == NULL) {
2261                 wpa_printf(MSG_WARNING, "Failed to allocate EAPOL context.");
2262                 return -4;
2263         }
2264         memset(ctx, 0, sizeof(*ctx));
2265         ctx->ctx = wpa_s;
2266         ctx->msg_ctx = wpa_s;
2267         ctx->preauth = 1;
2268         ctx->cb = rsn_preauth_eapol_cb;
2269         ctx->cb_ctx = wpa_s;
2270         ctx->scard_ctx = wpa_s->scard;
2271         ctx->eapol_done_cb = wpa_supplicant_notify_eapol_done;
2272         ctx->eapol_send = wpa_eapol_send_preauth;
2273
2274         wpa_s->preauth_eapol = eapol_sm_init(ctx);
2275         if (wpa_s->preauth_eapol == NULL) {
2276                 free(ctx);
2277                 wpa_printf(MSG_WARNING, "RSN: Failed to initialize EAPOL "
2278                            "state machines for pre-authentication");
2279                 return -3;
2280         }
2281         memset(&eapol_conf, 0, sizeof(eapol_conf));
2282         eapol_conf.accept_802_1x_keys = 0;
2283         eapol_conf.required_keys = 0;
2284         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
2285         if (wpa_s->current_ssid)
2286                 eapol_conf.workaround = wpa_s->current_ssid->eap_workaround;
2287         eapol_sm_notify_config(wpa_s->preauth_eapol, wpa_s->current_ssid,
2288                                &eapol_conf);
2289         memcpy(wpa_s->preauth_bssid, dst, ETH_ALEN);
2290
2291         eapol_sm_notify_portValid(wpa_s->preauth_eapol, TRUE);
2292         /* 802.1X::portControl = Auto */
2293         eapol_sm_notify_portEnabled(wpa_s->preauth_eapol, TRUE);
2294
2295         eloop_register_timeout(60, 0, rsn_preauth_timeout, wpa_s, NULL);
2296
2297         return 0;
2298 }
2299
2300
2301 void rsn_preauth_deinit(struct wpa_supplicant *wpa_s)
2302 {
2303         if (!wpa_s->preauth_eapol)
2304                 return;
2305
2306         eloop_cancel_timeout(rsn_preauth_timeout, wpa_s, NULL);
2307         eapol_sm_deinit(wpa_s->preauth_eapol);
2308         wpa_s->preauth_eapol = NULL;
2309         memset(wpa_s->preauth_bssid, 0, ETH_ALEN);
2310
2311         l2_packet_deinit(wpa_s->l2_preauth);
2312         wpa_s->l2_preauth = NULL;
2313 }
2314
2315
2316 static void rsn_preauth_candidate_process(struct wpa_supplicant *wpa_s)
2317 {
2318         struct rsn_pmksa_candidate *candidate;
2319
2320         if (wpa_s->pmksa_candidates == NULL)
2321                 return;
2322
2323         /* TODO: drop priority for old candidate entries */
2324
2325         wpa_msg(wpa_s, MSG_DEBUG, "RSN: processing PMKSA candidate list");
2326         if (wpa_s->preauth_eapol ||
2327             wpa_s->proto != WPA_PROTO_RSN ||
2328             wpa_s->wpa_state != WPA_COMPLETED ||
2329             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X) {
2330                 wpa_msg(wpa_s, MSG_DEBUG, "RSN: not in suitable state for new "
2331                         "pre-authentication");
2332                 return; /* invalid state for new pre-auth */
2333         }
2334
2335         while (wpa_s->pmksa_candidates) {
2336                 struct rsn_pmksa_cache *p = NULL;
2337                 candidate = wpa_s->pmksa_candidates;
2338                 p = pmksa_cache_get(wpa_s, candidate->bssid, NULL);
2339                 if (memcmp(wpa_s->bssid, candidate->bssid, ETH_ALEN) != 0 &&
2340                     p == NULL) {
2341                         wpa_msg(wpa_s, MSG_DEBUG, "RSN: PMKSA candidate "
2342                                 MACSTR " selected for pre-authentication",
2343                                 MAC2STR(candidate->bssid));
2344                         wpa_s->pmksa_candidates = candidate->next;
2345                         rsn_preauth_init(wpa_s, candidate->bssid);
2346                         free(candidate);
2347                         return;
2348                 }
2349                 wpa_msg(wpa_s, MSG_DEBUG, "RSN: PMKSA candidate " MACSTR
2350                         " does not need pre-authentication anymore",
2351                         MAC2STR(candidate->bssid));
2352                 /* Some drivers (e.g., NDIS) expect to get notified about the
2353                  * PMKIDs again, so report the existing data now. */
2354                 if (p)
2355                         wpa_drv_add_pmkid(wpa_s, candidate->bssid, p->pmkid);
2356
2357                 wpa_s->pmksa_candidates = candidate->next;
2358                 free(candidate);
2359         }
2360         wpa_msg(wpa_s, MSG_DEBUG, "RSN: no more pending PMKSA candidates");
2361 }
2362
2363
2364 void pmksa_candidate_add(struct wpa_supplicant *wpa_s, const u8 *bssid,
2365                          int prio)
2366 {
2367         struct rsn_pmksa_candidate *cand, *prev, *pos;
2368
2369         /* If BSSID already on candidate list, update the priority of the old
2370          * entry. Do not override priority based on normal scan results. */
2371         prev = NULL;
2372         cand = wpa_s->pmksa_candidates;
2373         while (cand) {
2374                 if (memcmp(cand->bssid, bssid, ETH_ALEN) == 0) {
2375                         if (prev)
2376                                 prev->next = cand->next;
2377                         else
2378                                 wpa_s->pmksa_candidates = cand->next;
2379                         break;
2380                 }
2381                 prev = cand;
2382                 cand = cand->next;
2383         }
2384
2385         if (cand) {
2386                 if (prio < PMKID_CANDIDATE_PRIO_SCAN)
2387                         cand->priority = prio;
2388         } else {
2389                 cand = malloc(sizeof(*cand));
2390                 if (cand == NULL)
2391                         return;
2392                 memset(cand, 0, sizeof(*cand));
2393                 memcpy(cand->bssid, bssid, ETH_ALEN);
2394                 cand->priority = prio;
2395         }
2396
2397         /* Add candidate to the list; order by increasing priority value. i.e.,
2398          * highest priority (smallest value) first. */
2399         prev = NULL;
2400         pos = wpa_s->pmksa_candidates;
2401         while (pos) {
2402                 if (cand->priority <= pos->priority)
2403                         break;
2404                 prev = pos;
2405                 pos = pos->next;
2406         }
2407         cand->next = pos;
2408         if (prev)
2409                 prev->next = cand;
2410         else
2411                 wpa_s->pmksa_candidates = cand;
2412
2413         wpa_msg(wpa_s, MSG_DEBUG, "RSN: added PMKSA cache "
2414                 "candidate " MACSTR " prio %d", MAC2STR(bssid), prio);
2415         rsn_preauth_candidate_process(wpa_s);
2416 }
2417
2418
2419 /* TODO: schedule periodic scans if current AP supports preauth */
2420 void rsn_preauth_scan_results(struct wpa_supplicant *wpa_s,
2421                               struct wpa_scan_result *results, int count)
2422 {
2423         struct wpa_scan_result *r;
2424         struct wpa_ie_data ie;
2425         int i;
2426
2427         if (wpa_s->current_ssid == NULL)
2428                 return;
2429
2430         pmksa_candidate_free(wpa_s);
2431
2432         for (i = count - 1; i >= 0; i--) {
2433                 r = &results[i];
2434                 if (r->ssid_len == wpa_s->current_ssid->ssid_len &&
2435                     memcmp(r->ssid, wpa_s->current_ssid->ssid, r->ssid_len) ==
2436                     0 &&
2437                     memcmp(r->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
2438                     r->rsn_ie_len > 0 &&
2439                     wpa_parse_wpa_ie(wpa_s, r->rsn_ie, r->rsn_ie_len, &ie) ==
2440                     0 &&
2441                     (ie.capabilities & WPA_CAPABILITY_PREAUTH) &&
2442                     pmksa_cache_get(wpa_s, r->bssid, NULL) == NULL) {
2443                         /* Give less priority to candidates found from normal
2444                          * scan results. */
2445                         pmksa_candidate_add(wpa_s, r->bssid,
2446                                             PMKID_CANDIDATE_PRIO_SCAN);
2447                 }
2448         }
2449 }
2450
2451 #else /* IEEE8021X_EAPOL */
2452
2453 static void rsn_preauth_candidate_process(struct wpa_supplicant *wpa_s)
2454 {
2455 }
2456
2457 #endif /* IEEE8021X_EAPOL */