hostapd/wpa_auth_ie.c

   1 /*
   2  * hostapd - WPA/RSN IE and KDE definitions
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "config.h"
  19 #include "ieee802_11.h"
  20 #include "eapol_sm.h"
  21 #include "wpa.h"
  22 #include "pmksa_cache.h"
  23 #include "wpa_auth_ie.h"
  24 #include "wpa_auth_i.h"
  25
  26
  27 static int wpa_write_wpa_ie(struct wpa_auth_config *conf, u8 *buf, size_t len)
  28 {
  29         struct wpa_ie_hdr *hdr;
  30         int num_suites;
  31         u8 *pos, *count;
  32
  33         hdr = (struct wpa_ie_hdr *) buf;
  34         hdr->elem_id = WLAN_EID_VENDOR_SPECIFIC;
  35         RSN_SELECTOR_PUT(hdr->oui, WPA_OUI_TYPE);
  36         WPA_PUT_LE16(hdr->version, WPA_VERSION);
  37         pos = (u8 *) (hdr + 1);
  38
  39         if (conf->wpa_group == WPA_CIPHER_CCMP) {
  40                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
  41         } else if (conf->wpa_group == WPA_CIPHER_TKIP) {
  42                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
  43         } else if (conf->wpa_group == WPA_CIPHER_WEP104) {
  44                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP104);
  45         } else if (conf->wpa_group == WPA_CIPHER_WEP40) {
  46                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_WEP40);
  47         } else {
  48                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
  49                            conf->wpa_group);
  50                 return -1;
  51         }
  52         pos += WPA_SELECTOR_LEN;
  53
  54         num_suites = 0;
  55         count = pos;
  56         pos += 2;
  57
  58         if (conf->wpa_pairwise & WPA_CIPHER_CCMP) {
  59                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
  60                 pos += WPA_SELECTOR_LEN;
  61                 num_suites++;
  62         }
  63         if (conf->wpa_pairwise & WPA_CIPHER_TKIP) {
  64                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
  65                 pos += WPA_SELECTOR_LEN;
  66                 num_suites++;
  67         }
  68         if (conf->wpa_pairwise & WPA_CIPHER_NONE) {
  69                 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
  70                 pos += WPA_SELECTOR_LEN;
  71                 num_suites++;
  72         }
  73
  74         if (num_suites == 0) {
  75                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
  76                            conf->wpa_pairwise);
  77                 return -1;
  78         }
  79         WPA_PUT_LE16(count, num_suites);
  80
  81         num_suites = 0;
  82         count = pos;
  83         pos += 2;
  84
  85         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
  86                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X);
  87                 pos += WPA_SELECTOR_LEN;
  88                 num_suites++;
  89         }
  90         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
  91                 RSN_SELECTOR_PUT(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X);
  92                 pos += WPA_SELECTOR_LEN;
  93                 num_suites++;
  94         }
  95
  96         if (num_suites == 0) {
  97                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
  98                            conf->wpa_key_mgmt);
  99                 return -1;
 100         }
 101         WPA_PUT_LE16(count, num_suites);
 102
 103         /* WPA Capabilities; use defaults, so no need to include it */
 104
 105         hdr->len = (pos - buf) - 2;
 106
 107         return pos - buf;
 108 }
 109
 110
 111 int wpa_write_rsn_ie(struct wpa_auth_config *conf, u8 *buf, size_t len,
 112                      const u8 *pmkid)
 113 {
 114         struct rsn_ie_hdr *hdr;
 115         int num_suites;
 116         u8 *pos, *count;
 117         u16 capab;
 118
 119         hdr = (struct rsn_ie_hdr *) buf;
 120         hdr->elem_id = WLAN_EID_RSN;
 121         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 122         pos = (u8 *) (hdr + 1);
 123
 124         if (conf->wpa_group == WPA_CIPHER_CCMP) {
 125                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 126         } else if (conf->wpa_group == WPA_CIPHER_TKIP) {
 127                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
 128         } else if (conf->wpa_group == WPA_CIPHER_WEP104) {
 129                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP104);
 130         } else if (conf->wpa_group == WPA_CIPHER_WEP40) {
 131                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_WEP40);
 132         } else {
 133                 wpa_printf(MSG_DEBUG, "Invalid group cipher (%d).",
 134                            conf->wpa_group);
 135                 return -1;
 136         }
 137         pos += RSN_SELECTOR_LEN;
 138
 139         num_suites = 0;
 140         count = pos;
 141         pos += 2;
 142
 143         if (conf->rsn_pairwise & WPA_CIPHER_CCMP) {
 144                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 145                 pos += RSN_SELECTOR_LEN;
 146                 num_suites++;
 147         }
 148         if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
 149                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
 150                 pos += RSN_SELECTOR_LEN;
 151                 num_suites++;
 152         }
 153         if (conf->rsn_pairwise & WPA_CIPHER_NONE) {
 154                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
 155                 pos += RSN_SELECTOR_LEN;
 156                 num_suites++;
 157         }
 158
 159         if (num_suites == 0) {
 160                 wpa_printf(MSG_DEBUG, "Invalid pairwise cipher (%d).",
 161                            conf->rsn_pairwise);
 162                 return -1;
 163         }
 164         WPA_PUT_LE16(count, num_suites);
 165
 166         num_suites = 0;
 167         count = pos;
 168         pos += 2;
 169
 170         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X) {
 171                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X);
 172                 pos += RSN_SELECTOR_LEN;
 173                 num_suites++;
 174         }
 175         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK) {
 176                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X);
 177                 pos += RSN_SELECTOR_LEN;
 178                 num_suites++;
 179         }
 180 #ifdef CONFIG_IEEE80211R
 181         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X) {
 182                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_802_1X);
 183                 pos += RSN_SELECTOR_LEN;
 184                 num_suites++;
 185         }
 186         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_FT_PSK) {
 187                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_FT_PSK);
 188                 pos += RSN_SELECTOR_LEN;
 189                 num_suites++;
 190         }
 191 #endif /* CONFIG_IEEE80211R */
 192 #ifdef CONFIG_IEEE80211W
 193         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256) {
 194                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_802_1X_SHA256);
 195                 pos += RSN_SELECTOR_LEN;
 196                 num_suites++;
 197         }
 198         if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK_SHA256) {
 199                 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_PSK_SHA256);
 200                 pos += RSN_SELECTOR_LEN;
 201                 num_suites++;
 202         }
 203 #endif /* CONFIG_IEEE80211W */
 204
 205         if (num_suites == 0) {
 206                 wpa_printf(MSG_DEBUG, "Invalid key management type (%d).",
 207                            conf->wpa_key_mgmt);
 208                 return -1;
 209         }
 210         WPA_PUT_LE16(count, num_suites);
 211
 212         /* RSN Capabilities */
 213         capab = 0;
 214         if (conf->rsn_preauth)
 215                 capab |= WPA_CAPABILITY_PREAUTH;
 216         if (conf->peerkey)
 217                 capab |= WPA_CAPABILITY_PEERKEY_ENABLED;
 218         if (conf->wme_enabled) {
 219                 /* 4 PTKSA replay counters when using WME */
 220                 capab |= (RSN_NUM_REPLAY_COUNTERS_16 << 2);
 221         }
 222 #ifdef CONFIG_IEEE80211W
 223         if (conf->ieee80211w != WPA_NO_IEEE80211W) {
 224                 capab |= WPA_CAPABILITY_MFPC;
 225                 if (conf->ieee80211w == IEEE80211W_REQUIRED)
 226                         capab |= WPA_CAPABILITY_MFPR;
 227         }
 228 #endif /* CONFIG_IEEE80211W */
 229         WPA_PUT_LE16(pos, capab);
 230         pos += 2;
 231
 232         if (pmkid) {
 233                 if (pos + 2 + PMKID_LEN > buf + len)
 234                         return -1;
 235                 /* PMKID Count */
 236                 WPA_PUT_LE16(pos, 1);
 237                 pos += 2;
 238                 os_memcpy(pos, pmkid, PMKID_LEN);
 239                 pos += PMKID_LEN;
 240         }
 241
 242 #ifdef CONFIG_IEEE80211W
 243         if (conf->ieee80211w != WPA_NO_IEEE80211W) {
 244                 if (pos + 2 + 4 > buf + len)
 245                         return -1;
 246                 if (pmkid == NULL) {
 247                         /* PMKID Count */
 248                         WPA_PUT_LE16(pos, 0);
 249                         pos += 2;
 250                 }
 251
 252                 /* Management Group Cipher Suite */
 253                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_AES_128_CMAC);
 254                 pos += RSN_SELECTOR_LEN;
 255         }
 256 #endif /* CONFIG_IEEE80211W */
 257
 258         hdr->len = (pos - buf) - 2;
 259
 260         return pos - buf;
 261 }
 262
 263
 264 int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
 265 {
 266         u8 *pos, buf[128];
 267         int res;
 268
 269         pos = buf;
 270
 271         if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
 272                 res = wpa_write_rsn_ie(&wpa_auth->conf,
 273                                        pos, buf + sizeof(buf) - pos, NULL);
 274                 if (res < 0)
 275                         return res;
 276                 pos += res;
 277         }
 278 #ifdef CONFIG_IEEE80211R
 279         if (wpa_auth->conf.wpa_key_mgmt &
 280             (WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK)) {
 281                 res = wpa_write_mdie(&wpa_auth->conf, pos,
 282                                      buf + sizeof(buf) - pos);
 283                 if (res < 0)
 284                         return res;
 285                 pos += res;
 286         }
 287 #endif /* CONFIG_IEEE80211R */
 288         if (wpa_auth->conf.wpa & WPA_PROTO_WPA) {
 289                 res = wpa_write_wpa_ie(&wpa_auth->conf,
 290                                        pos, buf + sizeof(buf) - pos);
 291                 if (res < 0)
 292                         return res;
 293                 pos += res;
 294         }
 295
 296         os_free(wpa_auth->wpa_ie);
 297         wpa_auth->wpa_ie = os_malloc(pos - buf);
 298         if (wpa_auth->wpa_ie == NULL)
 299                 return -1;
 300         os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
 301         wpa_auth->wpa_ie_len = pos - buf;
 302
 303         return 0;
 304 }
 305
 306
 307 u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len,
 308                  const u8 *data2, size_t data2_len)
 309 {
 310         *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 311         *pos++ = RSN_SELECTOR_LEN + data_len + data2_len;
 312         RSN_SELECTOR_PUT(pos, kde);
 313         pos += RSN_SELECTOR_LEN;
 314         os_memcpy(pos, data, data_len);
 315         pos += data_len;
 316         if (data2) {
 317                 os_memcpy(pos, data2, data2_len);
 318                 pos += data2_len;
 319         }
 320         return pos;
 321 }
 322
 323
 324 static int wpa_selector_to_bitfield(const u8 *s)
 325 {
 326         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
 327                 return WPA_CIPHER_NONE;
 328         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP40)
 329                 return WPA_CIPHER_WEP40;
 330         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
 331                 return WPA_CIPHER_TKIP;
 332         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
 333                 return WPA_CIPHER_CCMP;
 334         if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP104)
 335                 return WPA_CIPHER_WEP104;
 336         return 0;
 337 }
 338
 339
 340 static int wpa_key_mgmt_to_bitfield(const u8 *s)
 341 {
 342         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
 343                 return WPA_KEY_MGMT_IEEE8021X;
 344         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
 345                 return WPA_KEY_MGMT_PSK;
 346         if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
 347                 return WPA_KEY_MGMT_WPA_NONE;
 348         return 0;
 349 }
 350
 351
 352 static int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
 353                                 struct wpa_ie_data *data)
 354 {
 355         const struct wpa_ie_hdr *hdr;
 356         const u8 *pos;
 357         int left;
 358         int i, count;
 359
 360         os_memset(data, 0, sizeof(*data));
 361         data->pairwise_cipher = WPA_CIPHER_TKIP;
 362         data->group_cipher = WPA_CIPHER_TKIP;
 363         data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 364         data->mgmt_group_cipher = 0;
 365
 366         if (wpa_ie_len < sizeof(struct wpa_ie_hdr))
 367                 return -1;
 368
 369         hdr = (const struct wpa_ie_hdr *) wpa_ie;
 370
 371         if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
 372             hdr->len != wpa_ie_len - 2 ||
 373             RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
 374             WPA_GET_LE16(hdr->version) != WPA_VERSION) {
 375                 return -2;
 376         }
 377
 378         pos = (const u8 *) (hdr + 1);
 379         left = wpa_ie_len - sizeof(*hdr);
 380
 381         if (left >= WPA_SELECTOR_LEN) {
 382                 data->group_cipher = wpa_selector_to_bitfield(pos);
 383                 pos += WPA_SELECTOR_LEN;
 384                 left -= WPA_SELECTOR_LEN;
 385         } else if (left > 0)
 386                   return -3;
 387
 388         if (left >= 2) {
 389                 data->pairwise_cipher = 0;
 390                 count = WPA_GET_LE16(pos);
 391                 pos += 2;
 392                 left -= 2;
 393                 if (count == 0 || left < count * WPA_SELECTOR_LEN)
 394                         return -4;
 395                 for (i = 0; i < count; i++) {
 396                         data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
 397                         pos += WPA_SELECTOR_LEN;
 398                         left -= WPA_SELECTOR_LEN;
 399                 }
 400         } else if (left == 1)
 401                 return -5;
 402
 403         if (left >= 2) {
 404                 data->key_mgmt = 0;
 405                 count = WPA_GET_LE16(pos);
 406                 pos += 2;
 407                 left -= 2;
 408                 if (count == 0 || left < count * WPA_SELECTOR_LEN)
 409                         return -6;
 410                 for (i = 0; i < count; i++) {
 411                         data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
 412                         pos += WPA_SELECTOR_LEN;
 413                         left -= WPA_SELECTOR_LEN;
 414                 }
 415         } else if (left == 1)
 416                 return -7;
 417
 418         if (left >= 2) {
 419                 data->capabilities = WPA_GET_LE16(pos);
 420                 pos += 2;
 421                 left -= 2;
 422         }
 423
 424         if (left > 0) {
 425                 return -8;
 426         }
 427
 428         return 0;
 429 }
 430
 431
 432 struct wpa_auth_okc_iter_data {
 433         struct rsn_pmksa_cache_entry *pmksa;
 434         const u8 *aa;
 435         const u8 *spa;
 436         const u8 *pmkid;
 437 };
 438
 439
 440 static int wpa_auth_okc_iter(struct wpa_authenticator *a, void *ctx)
 441 {
 442         struct wpa_auth_okc_iter_data *data = ctx;
 443         data->pmksa = pmksa_cache_get_okc(a->pmksa, data->aa, data->spa,
 444                                           data->pmkid);
 445         if (data->pmksa)
 446                 return 1;
 447         return 0;
 448 }
 449
 450
 451 int wpa_validate_wpa_ie(struct wpa_authenticator *wpa_auth,
 452                         struct wpa_state_machine *sm,
 453                         const u8 *wpa_ie, size_t wpa_ie_len,
 454                         const u8 *mdie, size_t mdie_len)
 455 {
 456         struct wpa_ie_data data;
 457         int ciphers, key_mgmt, res, version;
 458         u32 selector;
 459         size_t i;
 460         const u8 *pmkid = NULL;
 461
 462         if (wpa_auth == NULL || sm == NULL)
 463                 return WPA_NOT_ENABLED;
 464
 465         if (wpa_ie == NULL || wpa_ie_len < 1)
 466                 return WPA_INVALID_IE;
 467
 468         if (wpa_ie[0] == WLAN_EID_RSN)
 469                 version = WPA_PROTO_RSN;
 470         else
 471                 version = WPA_PROTO_WPA;
 472
 473         if (version == WPA_PROTO_RSN) {
 474                 res = wpa_parse_wpa_ie_rsn(wpa_ie, wpa_ie_len, &data);
 475
 476                 selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 477                 if (0) {
 478                 }
 479 #ifdef CONFIG_IEEE80211R
 480                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 481                         selector = RSN_AUTH_KEY_MGMT_FT_802_1X;
 482                 else if (data.key_mgmt & WPA_KEY_MGMT_FT_PSK)
 483                         selector = RSN_AUTH_KEY_MGMT_FT_PSK;
 484 #endif /* CONFIG_IEEE80211R */
 485 #ifdef CONFIG_IEEE80211W
 486                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 487                         selector = RSN_AUTH_KEY_MGMT_802_1X_SHA256;
 488                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 489                         selector = RSN_AUTH_KEY_MGMT_PSK_SHA256;
 490 #endif /* CONFIG_IEEE80211W */
 491                 else if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 492                         selector = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
 493                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 494                         selector = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 495                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 496
 497                 selector = RSN_CIPHER_SUITE_CCMP;
 498                 if (data.pairwise_cipher & WPA_CIPHER_CCMP)
 499                         selector = RSN_CIPHER_SUITE_CCMP;
 500                 else if (data.pairwise_cipher & WPA_CIPHER_TKIP)
 501                         selector = RSN_CIPHER_SUITE_TKIP;
 502                 else if (data.pairwise_cipher & WPA_CIPHER_WEP104)
 503                         selector = RSN_CIPHER_SUITE_WEP104;
 504                 else if (data.pairwise_cipher & WPA_CIPHER_WEP40)
 505                         selector = RSN_CIPHER_SUITE_WEP40;
 506                 else if (data.pairwise_cipher & WPA_CIPHER_NONE)
 507                         selector = RSN_CIPHER_SUITE_NONE;
 508                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 509
 510                 selector = RSN_CIPHER_SUITE_CCMP;
 511                 if (data.group_cipher & WPA_CIPHER_CCMP)
 512                         selector = RSN_CIPHER_SUITE_CCMP;
 513                 else if (data.group_cipher & WPA_CIPHER_TKIP)
 514                         selector = RSN_CIPHER_SUITE_TKIP;
 515                 else if (data.group_cipher & WPA_CIPHER_WEP104)
 516                         selector = RSN_CIPHER_SUITE_WEP104;
 517                 else if (data.group_cipher & WPA_CIPHER_WEP40)
 518                         selector = RSN_CIPHER_SUITE_WEP40;
 519                 else if (data.group_cipher & WPA_CIPHER_NONE)
 520                         selector = RSN_CIPHER_SUITE_NONE;
 521                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 522         } else {
 523                 res = wpa_parse_wpa_ie_wpa(wpa_ie, wpa_ie_len, &data);
 524
 525                 selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 526                 if (data.key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 527                         selector = WPA_AUTH_KEY_MGMT_UNSPEC_802_1X;
 528                 else if (data.key_mgmt & WPA_KEY_MGMT_PSK)
 529                         selector = WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X;
 530                 wpa_auth->dot11RSNAAuthenticationSuiteSelected = selector;
 531
 532                 selector = WPA_CIPHER_SUITE_TKIP;
 533                 if (data.pairwise_cipher & WPA_CIPHER_CCMP)
 534                         selector = WPA_CIPHER_SUITE_CCMP;
 535                 else if (data.pairwise_cipher & WPA_CIPHER_TKIP)
 536                         selector = WPA_CIPHER_SUITE_TKIP;
 537                 else if (data.pairwise_cipher & WPA_CIPHER_WEP104)
 538                         selector = WPA_CIPHER_SUITE_WEP104;
 539                 else if (data.pairwise_cipher & WPA_CIPHER_WEP40)
 540                         selector = WPA_CIPHER_SUITE_WEP40;
 541                 else if (data.pairwise_cipher & WPA_CIPHER_NONE)
 542                         selector = WPA_CIPHER_SUITE_NONE;
 543                 wpa_auth->dot11RSNAPairwiseCipherSelected = selector;
 544
 545                 selector = WPA_CIPHER_SUITE_TKIP;
 546                 if (data.group_cipher & WPA_CIPHER_CCMP)
 547                         selector = WPA_CIPHER_SUITE_CCMP;
 548                 else if (data.group_cipher & WPA_CIPHER_TKIP)
 549                         selector = WPA_CIPHER_SUITE_TKIP;
 550                 else if (data.group_cipher & WPA_CIPHER_WEP104)
 551                         selector = WPA_CIPHER_SUITE_WEP104;
 552                 else if (data.group_cipher & WPA_CIPHER_WEP40)
 553                         selector = WPA_CIPHER_SUITE_WEP40;
 554                 else if (data.group_cipher & WPA_CIPHER_NONE)
 555                         selector = WPA_CIPHER_SUITE_NONE;
 556                 wpa_auth->dot11RSNAGroupCipherSelected = selector;
 557         }
 558         if (res) {
 559                 wpa_printf(MSG_DEBUG, "Failed to parse WPA/RSN IE from "
 560                            MACSTR " (res=%d)", MAC2STR(sm->addr), res);
 561                 wpa_hexdump(MSG_DEBUG, "WPA/RSN IE", wpa_ie, wpa_ie_len);
 562                 return WPA_INVALID_IE;
 563         }
 564
 565         if (data.group_cipher != wpa_auth->conf.wpa_group) {
 566                 wpa_printf(MSG_DEBUG, "Invalid WPA group cipher (0x%x) from "
 567                            MACSTR, data.group_cipher, MAC2STR(sm->addr));
 568                 return WPA_INVALID_GROUP;
 569         }
 570
 571         key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
 572         if (!key_mgmt) {
 573                 wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
 574                            MACSTR, data.key_mgmt, MAC2STR(sm->addr));
 575                 return WPA_INVALID_AKMP;
 576         }
 577         if (0) {
 578         }
 579 #ifdef CONFIG_IEEE80211R
 580         else if (key_mgmt & WPA_KEY_MGMT_FT_IEEE8021X)
 581                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
 582         else if (key_mgmt & WPA_KEY_MGMT_FT_PSK)
 583                 sm->wpa_key_mgmt = WPA_KEY_MGMT_FT_PSK;
 584 #endif /* CONFIG_IEEE80211R */
 585 #ifdef CONFIG_IEEE80211W
 586         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X_SHA256)
 587                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
 588         else if (key_mgmt & WPA_KEY_MGMT_PSK_SHA256)
 589                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
 590 #endif /* CONFIG_IEEE80211W */
 591         else if (key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 592                 sm->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 593         else
 594                 sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
 595
 596         if (version == WPA_PROTO_RSN)
 597                 ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
 598         else
 599                 ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
 600         if (!ciphers) {
 601                 wpa_printf(MSG_DEBUG, "Invalid %s pairwise cipher (0x%x) "
 602                            "from " MACSTR,
 603                            version == WPA_PROTO_RSN ? "RSN" : "WPA",
 604                            data.pairwise_cipher, MAC2STR(sm->addr));
 605                 return WPA_INVALID_PAIRWISE;
 606         }
 607
 608 #ifdef CONFIG_IEEE80211W
 609         if (wpa_auth->conf.ieee80211w == WPA_IEEE80211W_REQUIRED) {
 610                 if (!(data.capabilities & WPA_CAPABILITY_MFPC)) {
 611                         wpa_printf(MSG_DEBUG, "Management frame protection "
 612                                    "required, but client did not enable it");
 613                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 614                 }
 615
 616                 if (ciphers & WPA_CIPHER_TKIP) {
 617                         wpa_printf(MSG_DEBUG, "Management frame protection "
 618                                    "cannot use TKIP");
 619                         return WPA_MGMT_FRAME_PROTECTION_VIOLATION;
 620                 }
 621
 622                 if (data.mgmt_group_cipher != WPA_CIPHER_AES_128_CMAC) {
 623                         wpa_printf(MSG_DEBUG, "Unsupported management group "
 624                                    "cipher %d", data.mgmt_group_cipher);
 625                         return WPA_INVALID_MGMT_GROUP_CIPHER;
 626                 }
 627         }
 628
 629         if (wpa_auth->conf.ieee80211w == WPA_NO_IEEE80211W ||
 630             !(data.capabilities & WPA_CAPABILITY_MFPC))
 631                 sm->mgmt_frame_prot = 0;
 632         else
 633                 sm->mgmt_frame_prot = 1;
 634 #endif /* CONFIG_IEEE80211W */
 635
 636 #ifdef CONFIG_IEEE80211R
 637         if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) {
 638                 if (mdie == NULL || mdie_len < MOBILITY_DOMAIN_ID_LEN + 1) {
 639                         wpa_printf(MSG_DEBUG, "RSN: Trying to use FT, but "
 640                                    "MDIE not included");
 641                         return WPA_INVALID_MDIE;
 642                 }
 643                 if (os_memcmp(mdie, wpa_auth->conf.mobility_domain,
 644                               MOBILITY_DOMAIN_ID_LEN) != 0) {
 645                         wpa_hexdump(MSG_DEBUG, "RSN: Attempted to use unknown "
 646                                     "MDIE", mdie, MOBILITY_DOMAIN_ID_LEN);
 647                         return WPA_INVALID_MDIE;
 648                 }
 649         }
 650 #endif /* CONFIG_IEEE80211R */
 651
 652         if (ciphers & WPA_CIPHER_CCMP)
 653                 sm->pairwise = WPA_CIPHER_CCMP;
 654         else
 655                 sm->pairwise = WPA_CIPHER_TKIP;
 656
 657         /* TODO: clear WPA/WPA2 state if STA changes from one to another */
 658         if (wpa_ie[0] == WLAN_EID_RSN)
 659                 sm->wpa = WPA_VERSION_WPA2;
 660         else
 661                 sm->wpa = WPA_VERSION_WPA;
 662
 663         sm->pmksa = NULL;
 664         for (i = 0; i < data.num_pmkid; i++) {
 665                 wpa_hexdump(MSG_DEBUG, "RSN IE: STA PMKID",
 666                             &data.pmkid[i * PMKID_LEN], PMKID_LEN);
 667                 sm->pmksa = pmksa_cache_get(wpa_auth->pmksa, sm->addr,
 668                                             &data.pmkid[i * PMKID_LEN]);
 669                 if (sm->pmksa) {
 670                         pmkid = sm->pmksa->pmkid;
 671                         break;
 672                 }
 673         }
 674         for (i = 0; sm->pmksa == NULL && wpa_auth->conf.okc &&
 675                      i < data.num_pmkid; i++) {
 676                 struct wpa_auth_okc_iter_data idata;
 677                 idata.pmksa = NULL;
 678                 idata.aa = wpa_auth->addr;
 679                 idata.spa = sm->addr;
 680                 idata.pmkid = &data.pmkid[i * PMKID_LEN];
 681                 wpa_auth_for_each_auth(wpa_auth, wpa_auth_okc_iter, &idata);
 682                 if (idata.pmksa) {
 683                         wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 684                                          "OKC match for PMKID");
 685                         sm->pmksa = pmksa_cache_add_okc(wpa_auth->pmksa,
 686                                                         idata.pmksa,
 687                                                         wpa_auth->addr,
 688                                                         idata.pmkid);
 689                         pmkid = idata.pmkid;
 690                         break;
 691                 }
 692         }
 693         if (sm->pmksa) {
 694                 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG,
 695                                  "PMKID found from PMKSA cache "
 696                                  "eap_type=%d vlan_id=%d",
 697                                  sm->pmksa->eap_type_authsrv,
 698                                  sm->pmksa->vlan_id);
 699                 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmkid, PMKID_LEN);
 700         }
 701
 702         if (sm->wpa_ie == NULL || sm->wpa_ie_len < wpa_ie_len) {
 703                 os_free(sm->wpa_ie);
 704                 sm->wpa_ie = os_malloc(wpa_ie_len);
 705                 if (sm->wpa_ie == NULL)
 706                         return WPA_ALLOC_FAIL;
 707         }
 708         os_memcpy(sm->wpa_ie, wpa_ie, wpa_ie_len);
 709         sm->wpa_ie_len = wpa_ie_len;
 710
 711         return WPA_IE_OK;
 712 }
 713
 714
 715 /**
 716  * wpa_parse_generic - Parse EAPOL-Key Key Data Generic IEs
 717  * @pos: Pointer to the IE header
 718  * @end: Pointer to the end of the Key Data buffer
 719  * @ie: Pointer to parsed IE data
 720  * Returns: 0 on success, 1 if end mark is found, -1 on failure
 721  */
 722 static int wpa_parse_generic(const u8 *pos, const u8 *end,
 723                              struct wpa_eapol_ie_parse *ie)
 724 {
 725         if (pos[1] == 0)
 726                 return 1;
 727
 728         if (pos[1] >= 6 &&
 729             RSN_SELECTOR_GET(pos + 2) == WPA_OUI_TYPE &&
 730             pos[2 + WPA_SELECTOR_LEN] == 1 &&
 731             pos[2 + WPA_SELECTOR_LEN + 1] == 0) {
 732                 ie->wpa_ie = pos;
 733                 ie->wpa_ie_len = pos[1] + 2;
 734                 return 0;
 735         }
 736
 737         if (pos + 1 + RSN_SELECTOR_LEN < end &&
 738             pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
 739             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_PMKID) {
 740                 ie->pmkid = pos + 2 + RSN_SELECTOR_LEN;
 741                 return 0;
 742         }
 743
 744         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 745             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_GROUPKEY) {
 746                 ie->gtk = pos + 2 + RSN_SELECTOR_LEN;
 747                 ie->gtk_len = pos[1] - RSN_SELECTOR_LEN;
 748                 return 0;
 749         }
 750
 751         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 752             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_MAC_ADDR) {
 753                 ie->mac_addr = pos + 2 + RSN_SELECTOR_LEN;
 754                 ie->mac_addr_len = pos[1] - RSN_SELECTOR_LEN;
 755                 return 0;
 756         }
 757
 758 #ifdef CONFIG_PEERKEY
 759         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 760             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_SMK) {
 761                 ie->smk = pos + 2 + RSN_SELECTOR_LEN;
 762                 ie->smk_len = pos[1] - RSN_SELECTOR_LEN;
 763                 return 0;
 764         }
 765
 766         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 767             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_NONCE) {
 768                 ie->nonce = pos + 2 + RSN_SELECTOR_LEN;
 769                 ie->nonce_len = pos[1] - RSN_SELECTOR_LEN;
 770                 return 0;
 771         }
 772
 773         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 774             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_LIFETIME) {
 775                 ie->lifetime = pos + 2 + RSN_SELECTOR_LEN;
 776                 ie->lifetime_len = pos[1] - RSN_SELECTOR_LEN;
 777                 return 0;
 778         }
 779
 780         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 781             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_ERROR) {
 782                 ie->error = pos + 2 + RSN_SELECTOR_LEN;
 783                 ie->error_len = pos[1] - RSN_SELECTOR_LEN;
 784                 return 0;
 785         }
 786 #endif /* CONFIG_PEERKEY */
 787
 788 #ifdef CONFIG_IEEE80211W
 789         if (pos[1] > RSN_SELECTOR_LEN + 2 &&
 790             RSN_SELECTOR_GET(pos + 2) == RSN_KEY_DATA_IGTK) {
 791                 ie->igtk = pos + 2 + RSN_SELECTOR_LEN;
 792                 ie->igtk_len = pos[1] - RSN_SELECTOR_LEN;
 793                 return 0;
 794         }
 795 #endif /* CONFIG_IEEE80211W */
 796
 797         return 0;
 798 }
 799
 800
 801 /**
 802  * wpa_parse_kde_ies - Parse EAPOL-Key Key Data IEs
 803  * @buf: Pointer to the Key Data buffer
 804  * @len: Key Data Length
 805  * @ie: Pointer to parsed IE data
 806  * Returns: 0 on success, -1 on failure
 807  */
 808 int wpa_parse_kde_ies(const u8 *buf, size_t len, struct wpa_eapol_ie_parse *ie)
 809 {
 810         const u8 *pos, *end;
 811         int ret = 0;
 812
 813         os_memset(ie, 0, sizeof(*ie));
 814         for (pos = buf, end = pos + len; pos + 1 < end; pos += 2 + pos[1]) {
 815                 if (pos[0] == 0xdd &&
 816                     ((pos == buf + len - 1) || pos[1] == 0)) {
 817                         /* Ignore padding */
 818                         break;
 819                 }
 820                 if (pos + 2 + pos[1] > end) {
 821                         wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key Key Data "
 822                                    "underflow (ie=%d len=%d pos=%d)",
 823                                    pos[0], pos[1], (int) (pos - buf));
 824                         wpa_hexdump_key(MSG_DEBUG, "WPA: Key Data",
 825                                         buf, len);
 826                         ret = -1;
 827                         break;
 828                 }
 829                 if (*pos == WLAN_EID_RSN) {
 830                         ie->rsn_ie = pos;
 831                         ie->rsn_ie_len = pos[1] + 2;
 832 #ifdef CONFIG_IEEE80211R
 833                 } else if (*pos == WLAN_EID_MOBILITY_DOMAIN) {
 834                         ie->mdie = pos;
 835                         ie->mdie_len = pos[1] + 2;
 836 #endif /* CONFIG_IEEE80211R */
 837                 } else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
 838                         ret = wpa_parse_generic(pos, end, ie);
 839                         if (ret < 0)
 840                                 break;
 841                         if (ret > 0) {
 842                                 ret = 0;
 843                                 break;
 844                         }
 845                 } else {
 846                         wpa_hexdump(MSG_DEBUG, "WPA: Unrecognized EAPOL-Key "
 847                                     "Key Data IE", pos, 2 + pos[1]);
 848                 }
 849         }
 850
 851         return ret;
 852 }
 853
 854
 855 int wpa_auth_uses_mfp(struct wpa_state_machine *sm)
 856 {
 857         return sm ? sm->mgmt_frame_prot : 0;
 858 }