automake build system

[mech_eap.orig] / src / ap / wpa_auth_ft.c

diff --git a/src/ap/wpa_auth_ft.c b/src/ap/wpa_auth_ft.c
index bb28163..c9871d9 100644 (file)
--- a/src/ap/wpa_auth_ft.c
+++ b/src/ap/wpa_auth_ft.c
@@ -55,6 +55,7 @@ static int wpa_ft_rrb_send(struct wpa_authenticator *wpa_auth, const u8 *dst,
 {
        if (wpa_auth->cb.send_ether == NULL)
                return -1;
+       wpa_printf(MSG_DEBUG, "FT: RRB send to " MACSTR, MAC2STR(dst));
        return wpa_auth->cb.send_ether(wpa_auth->cb.ctx, dst, ETH_P_RRB,
                                       data, data_len);
 }
@@ -97,11 +98,11 @@ int wpa_write_mdie(struct wpa_auth_config *conf, u8 *buf, size_t len)
 }
 
 
-static int wpa_write_ftie(struct wpa_auth_config *conf, const u8 *r0kh_id,
-                         size_t r0kh_id_len,
-                         const u8 *anonce, const u8 *snonce,
-                         u8 *buf, size_t len, const u8 *subelem,
-                         size_t subelem_len)
+int wpa_write_ftie(struct wpa_auth_config *conf, const u8 *r0kh_id,
+                  size_t r0kh_id_len,
+                  const u8 *anonce, const u8 *snonce,
+                  u8 *buf, size_t len, const u8 *subelem,
+                  size_t subelem_len)
 {
        u8 *pos = buf, *ielen;
        struct rsn_ftie *hdr;
@@ -692,6 +693,11 @@ u8 * wpa_sm_write_assoc_resp_ies(struct wpa_state_machine *sm, u8 *pos,
        ftie_len = res;
        pos += res;
 
+       os_free(sm->assoc_resp_ftie);
+       sm->assoc_resp_ftie = os_malloc(ftie_len);
+       if (sm->assoc_resp_ftie)
+               os_memcpy(sm->assoc_resp_ftie, ftie, ftie_len);
+
        _ftie = (struct rsn_ftie *) (ftie + 2);
        if (auth_alg == WLAN_AUTH_FT)
                _ftie->mic_control[1] = 3; /* Information element count */
@@ -1094,6 +1100,7 @@ u16 wpa_ft_validate_reassoc(struct wpa_state_machine *sm, const u8 *ies,
        struct rsn_mdie *mdie;
        struct rsn_ftie *ftie;
        u8 mic[16];
+       unsigned int count;
 
        if (sm == NULL)
                return WLAN_STATUS_UNSPECIFIED_FAILURE;
@@ -1137,6 +1144,74 @@ u16 wpa_ft_validate_reassoc(struct wpa_state_machine *sm, const u8 *ies,
                return WLAN_STATUS_INVALID_FTIE;
        }
 
+       if (os_memcmp(ftie->snonce, sm->SNonce, WPA_NONCE_LEN) != 0) {
+               wpa_printf(MSG_DEBUG, "FT: SNonce mismatch in FTIE");
+               wpa_hexdump(MSG_DEBUG, "FT: Received SNonce",
+                           ftie->snonce, WPA_NONCE_LEN);
+               wpa_hexdump(MSG_DEBUG, "FT: Expected SNonce",
+                           sm->SNonce, WPA_NONCE_LEN);
+               return -1;
+       }
+
+       if (os_memcmp(ftie->anonce, sm->ANonce, WPA_NONCE_LEN) != 0) {
+               wpa_printf(MSG_DEBUG, "FT: ANonce mismatch in FTIE");
+               wpa_hexdump(MSG_DEBUG, "FT: Received ANonce",
+                           ftie->anonce, WPA_NONCE_LEN);
+               wpa_hexdump(MSG_DEBUG, "FT: Expected ANonce",
+                           sm->ANonce, WPA_NONCE_LEN);
+               return -1;
+       }
+
+
+       if (parse.r0kh_id == NULL) {
+               wpa_printf(MSG_DEBUG, "FT: No R0KH-ID subelem in FTIE");
+               return -1;
+       }
+
+       if (parse.r0kh_id_len != sm->r0kh_id_len ||
+           os_memcmp(parse.r0kh_id, sm->r0kh_id, parse.r0kh_id_len) != 0) {
+               wpa_printf(MSG_DEBUG, "FT: R0KH-ID in FTIE did not match with "
+                          "the current R0KH-ID");
+               wpa_hexdump(MSG_DEBUG, "FT: R0KH-ID in FTIE",
+                           parse.r0kh_id, parse.r0kh_id_len);
+               wpa_hexdump(MSG_DEBUG, "FT: The current R0KH-ID",
+                           sm->r0kh_id, sm->r0kh_id_len);
+               return -1;
+       }
+
+       if (parse.r1kh_id == NULL) {
+               wpa_printf(MSG_DEBUG, "FT: No R1KH-ID subelem in FTIE");
+               return -1;
+       }
+
+       if (os_memcmp(parse.r1kh_id, sm->wpa_auth->conf.r1_key_holder,
+                     FT_R1KH_ID_LEN) != 0) {
+               wpa_printf(MSG_DEBUG, "FT: Unknown R1KH-ID used in "
+                          "ReassocReq");
+               wpa_hexdump(MSG_DEBUG, "FT: R1KH-ID in FTIE",
+                           parse.r1kh_id, FT_R1KH_ID_LEN);
+               wpa_hexdump(MSG_DEBUG, "FT: Expected R1KH-ID",
+                           sm->wpa_auth->conf.r1_key_holder, FT_R1KH_ID_LEN);
+               return -1;
+       }
+
+       if (parse.rsn_pmkid == NULL ||
+           os_memcmp(parse.rsn_pmkid, sm->pmk_r1_name, WPA_PMK_NAME_LEN)) {
+               wpa_printf(MSG_DEBUG, "FT: No matching PMKR1Name (PMKID) in "
+                          "RSNIE (pmkid=%d)", !!parse.rsn_pmkid);
+               return -1;
+       }
+
+       count = 3;
+       if (parse.ric)
+               count++;
+       if (ftie->mic_control[1] != count) {
+               wpa_printf(MSG_DEBUG, "FT: Unexpected IE count in MIC "
+                          "Control: received %u expected %u",
+                          ftie->mic_control[1], count);
+               return -1;
+       }
+
        if (wpa_ft_mic(sm->PTK.kck, sm->addr, sm->wpa_auth->addr, 5,
                       parse.mdie - 2, parse.mdie_len + 2,
                       parse.ftie - 2, parse.ftie_len + 2,
@@ -1357,7 +1432,7 @@ static int wpa_ft_rrb_rx_pull(struct wpa_authenticator *wpa_auth,
        wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", r.pmk_r1, PMK_LEN);
        wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name", r.pmk_r1_name,
                    WPA_PMK_NAME_LEN);
-       r.pairwise = pairwise;
+       r.pairwise = host_to_le16(pairwise);
 
        if (aes_wrap(r1kh->key, (FT_R0KH_R1KH_RESP_DATA_LEN + 7) / 8,
                     r.nonce, resp.nonce) < 0) {
@@ -1660,7 +1735,7 @@ static void wpa_ft_generate_pmk_r1(struct wpa_authenticator *wpa_auth,
                    WPA_PMK_NAME_LEN);
        os_get_time(&now);
        WPA_PUT_LE32(f.timestamp, now.sec);
-       f.pairwise = pairwise;
+       f.pairwise = host_to_le16(pairwise);
        if (aes_wrap(r1kh->key, (FT_R0KH_R1KH_PUSH_DATA_LEN + 7) / 8,
                     f.timestamp, frame.timestamp) < 0)
                return;