wpa_auth.c revision 337817
1/* 2 * IEEE 802.11 RSN / WPA Authenticator 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/state_machine.h" 14#include "utils/bitfield.h" 15#include "common/ieee802_11_defs.h" 16#include "crypto/aes_wrap.h" 17#include "crypto/crypto.h" 18#include "crypto/sha1.h" 19#include "crypto/sha256.h" 20#include "crypto/random.h" 21#include "eapol_auth/eapol_auth_sm.h" 22#include "ap_config.h" 23#include "ieee802_11.h" 24#include "wpa_auth.h" 25#include "pmksa_cache_auth.h" 26#include "wpa_auth_i.h" 27#include "wpa_auth_ie.h" 28 29#define STATE_MACHINE_DATA struct wpa_state_machine 30#define STATE_MACHINE_DEBUG_PREFIX "WPA" 31#define STATE_MACHINE_ADDR sm->addr 32 33 34static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx); 35static int wpa_sm_step(struct wpa_state_machine *sm); 36static int wpa_verify_key_mic(int akmp, struct wpa_ptk *PTK, u8 *data, 37 size_t data_len); 38static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx); 39static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth, 40 struct wpa_group *group); 41static void wpa_request_new_ptk(struct wpa_state_machine *sm); 42static int wpa_gtk_update(struct wpa_authenticator *wpa_auth, 43 struct wpa_group *group); 44static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth, 45 struct wpa_group *group); 46static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce, 47 const u8 *pmk, unsigned int pmk_len, 48 struct wpa_ptk *ptk); 49static void wpa_group_free(struct wpa_authenticator *wpa_auth, 50 struct wpa_group *group); 51static void wpa_group_get(struct wpa_authenticator *wpa_auth, 52 struct wpa_group *group); 53static void wpa_group_put(struct wpa_authenticator *wpa_auth, 54 struct wpa_group *group); 55 56static const u32 dot11RSNAConfigGroupUpdateCount = 4; 57static const u32 dot11RSNAConfigPairwiseUpdateCount = 4; 58static const u32 eapol_key_timeout_first = 100; /* ms */ 59static const u32 eapol_key_timeout_subseq = 1000; /* ms */ 60static const u32 eapol_key_timeout_first_group = 500; /* ms */ 61 62/* TODO: make these configurable */ 63static const int dot11RSNAConfigPMKLifetime = 43200; 64static const int dot11RSNAConfigPMKReauthThreshold = 70; 65static const int dot11RSNAConfigSATimeout = 60; 66 67 68static inline int wpa_auth_mic_failure_report( 69 struct wpa_authenticator *wpa_auth, const u8 *addr) 70{ 71 if (wpa_auth->cb.mic_failure_report) 72 return wpa_auth->cb.mic_failure_report(wpa_auth->cb.ctx, addr); 73 return 0; 74} 75 76 77static inline void wpa_auth_psk_failure_report( 78 struct wpa_authenticator *wpa_auth, const u8 *addr) 79{ 80 if (wpa_auth->cb.psk_failure_report) 81 wpa_auth->cb.psk_failure_report(wpa_auth->cb.ctx, addr); 82} 83 84 85static inline void wpa_auth_set_eapol(struct wpa_authenticator *wpa_auth, 86 const u8 *addr, wpa_eapol_variable var, 87 int value) 88{ 89 if (wpa_auth->cb.set_eapol) 90 wpa_auth->cb.set_eapol(wpa_auth->cb.ctx, addr, var, value); 91} 92 93 94static inline int wpa_auth_get_eapol(struct wpa_authenticator *wpa_auth, 95 const u8 *addr, wpa_eapol_variable var) 96{ 97 if (wpa_auth->cb.get_eapol == NULL) 98 return -1; 99 return wpa_auth->cb.get_eapol(wpa_auth->cb.ctx, addr, var); 100} 101 102 103static inline const u8 * wpa_auth_get_psk(struct wpa_authenticator *wpa_auth, 104 const u8 *addr, 105 const u8 *p2p_dev_addr, 106 const u8 *prev_psk) 107{ 108 if (wpa_auth->cb.get_psk == NULL) 109 return NULL; 110 return wpa_auth->cb.get_psk(wpa_auth->cb.ctx, addr, p2p_dev_addr, 111 prev_psk); 112} 113 114 115static inline int wpa_auth_get_msk(struct wpa_authenticator *wpa_auth, 116 const u8 *addr, u8 *msk, size_t *len) 117{ 118 if (wpa_auth->cb.get_msk == NULL) 119 return -1; 120 return wpa_auth->cb.get_msk(wpa_auth->cb.ctx, addr, msk, len); 121} 122 123 124static inline int wpa_auth_set_key(struct wpa_authenticator *wpa_auth, 125 int vlan_id, 126 enum wpa_alg alg, const u8 *addr, int idx, 127 u8 *key, size_t key_len) 128{ 129 if (wpa_auth->cb.set_key == NULL) 130 return -1; 131 return wpa_auth->cb.set_key(wpa_auth->cb.ctx, vlan_id, alg, addr, idx, 132 key, key_len); 133} 134 135 136static inline int wpa_auth_get_seqnum(struct wpa_authenticator *wpa_auth, 137 const u8 *addr, int idx, u8 *seq) 138{ 139 if (wpa_auth->cb.get_seqnum == NULL) 140 return -1; 141 return wpa_auth->cb.get_seqnum(wpa_auth->cb.ctx, addr, idx, seq); 142} 143 144 145static inline int 146wpa_auth_send_eapol(struct wpa_authenticator *wpa_auth, const u8 *addr, 147 const u8 *data, size_t data_len, int encrypt) 148{ 149 if (wpa_auth->cb.send_eapol == NULL) 150 return -1; 151 return wpa_auth->cb.send_eapol(wpa_auth->cb.ctx, addr, data, data_len, 152 encrypt); 153} 154 155 156#ifdef CONFIG_MESH 157static inline int wpa_auth_start_ampe(struct wpa_authenticator *wpa_auth, 158 const u8 *addr) 159{ 160 if (wpa_auth->cb.start_ampe == NULL) 161 return -1; 162 return wpa_auth->cb.start_ampe(wpa_auth->cb.ctx, addr); 163} 164#endif /* CONFIG_MESH */ 165 166 167int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth, 168 int (*cb)(struct wpa_state_machine *sm, void *ctx), 169 void *cb_ctx) 170{ 171 if (wpa_auth->cb.for_each_sta == NULL) 172 return 0; 173 return wpa_auth->cb.for_each_sta(wpa_auth->cb.ctx, cb, cb_ctx); 174} 175 176 177int wpa_auth_for_each_auth(struct wpa_authenticator *wpa_auth, 178 int (*cb)(struct wpa_authenticator *a, void *ctx), 179 void *cb_ctx) 180{ 181 if (wpa_auth->cb.for_each_auth == NULL) 182 return 0; 183 return wpa_auth->cb.for_each_auth(wpa_auth->cb.ctx, cb, cb_ctx); 184} 185 186 187void wpa_auth_logger(struct wpa_authenticator *wpa_auth, const u8 *addr, 188 logger_level level, const char *txt) 189{ 190 if (wpa_auth->cb.logger == NULL) 191 return; 192 wpa_auth->cb.logger(wpa_auth->cb.ctx, addr, level, txt); 193} 194 195 196void wpa_auth_vlogger(struct wpa_authenticator *wpa_auth, const u8 *addr, 197 logger_level level, const char *fmt, ...) 198{ 199 char *format; 200 int maxlen; 201 va_list ap; 202 203 if (wpa_auth->cb.logger == NULL) 204 return; 205 206 maxlen = os_strlen(fmt) + 100; 207 format = os_malloc(maxlen); 208 if (!format) 209 return; 210 211 va_start(ap, fmt); 212 vsnprintf(format, maxlen, fmt, ap); 213 va_end(ap); 214 215 wpa_auth_logger(wpa_auth, addr, level, format); 216 217 os_free(format); 218} 219 220 221static void wpa_sta_disconnect(struct wpa_authenticator *wpa_auth, 222 const u8 *addr) 223{ 224 if (wpa_auth->cb.disconnect == NULL) 225 return; 226 wpa_printf(MSG_DEBUG, "wpa_sta_disconnect STA " MACSTR, MAC2STR(addr)); 227 wpa_auth->cb.disconnect(wpa_auth->cb.ctx, addr, 228 WLAN_REASON_PREV_AUTH_NOT_VALID); 229} 230 231 232static int wpa_use_aes_cmac(struct wpa_state_machine *sm) 233{ 234 int ret = 0; 235#ifdef CONFIG_IEEE80211R 236 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) 237 ret = 1; 238#endif /* CONFIG_IEEE80211R */ 239#ifdef CONFIG_IEEE80211W 240 if (wpa_key_mgmt_sha256(sm->wpa_key_mgmt)) 241 ret = 1; 242#endif /* CONFIG_IEEE80211W */ 243 if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN) 244 ret = 1; 245 return ret; 246} 247 248 249static void wpa_rekey_gmk(void *eloop_ctx, void *timeout_ctx) 250{ 251 struct wpa_authenticator *wpa_auth = eloop_ctx; 252 253 if (random_get_bytes(wpa_auth->group->GMK, WPA_GMK_LEN)) { 254 wpa_printf(MSG_ERROR, "Failed to get random data for WPA " 255 "initialization."); 256 } else { 257 wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "GMK rekeyd"); 258 wpa_hexdump_key(MSG_DEBUG, "GMK", 259 wpa_auth->group->GMK, WPA_GMK_LEN); 260 } 261 262 if (wpa_auth->conf.wpa_gmk_rekey) { 263 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0, 264 wpa_rekey_gmk, wpa_auth, NULL); 265 } 266} 267 268 269static void wpa_rekey_gtk(void *eloop_ctx, void *timeout_ctx) 270{ 271 struct wpa_authenticator *wpa_auth = eloop_ctx; 272 struct wpa_group *group, *next; 273 274 wpa_auth_logger(wpa_auth, NULL, LOGGER_DEBUG, "rekeying GTK"); 275 group = wpa_auth->group; 276 while (group) { 277 wpa_group_get(wpa_auth, group); 278 279 group->GTKReKey = TRUE; 280 do { 281 group->changed = FALSE; 282 wpa_group_sm_step(wpa_auth, group); 283 } while (group->changed); 284 285 next = group->next; 286 wpa_group_put(wpa_auth, group); 287 group = next; 288 } 289 290 if (wpa_auth->conf.wpa_group_rekey) { 291 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 292 0, wpa_rekey_gtk, wpa_auth, NULL); 293 } 294} 295 296 297static void wpa_rekey_ptk(void *eloop_ctx, void *timeout_ctx) 298{ 299 struct wpa_authenticator *wpa_auth = eloop_ctx; 300 struct wpa_state_machine *sm = timeout_ctx; 301 302 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "rekeying PTK"); 303 wpa_request_new_ptk(sm); 304 wpa_sm_step(sm); 305} 306 307 308static int wpa_auth_pmksa_clear_cb(struct wpa_state_machine *sm, void *ctx) 309{ 310 if (sm->pmksa == ctx) 311 sm->pmksa = NULL; 312 return 0; 313} 314 315 316static void wpa_auth_pmksa_free_cb(struct rsn_pmksa_cache_entry *entry, 317 void *ctx) 318{ 319 struct wpa_authenticator *wpa_auth = ctx; 320 wpa_auth_for_each_sta(wpa_auth, wpa_auth_pmksa_clear_cb, entry); 321} 322 323 324static int wpa_group_init_gmk_and_counter(struct wpa_authenticator *wpa_auth, 325 struct wpa_group *group) 326{ 327 u8 buf[ETH_ALEN + 8 + sizeof(unsigned long)]; 328 u8 rkey[32]; 329 unsigned long ptr; 330 331 if (random_get_bytes(group->GMK, WPA_GMK_LEN) < 0) 332 return -1; 333 wpa_hexdump_key(MSG_DEBUG, "GMK", group->GMK, WPA_GMK_LEN); 334 335 /* 336 * Counter = PRF-256(Random number, "Init Counter", 337 * Local MAC Address || Time) 338 */ 339 os_memcpy(buf, wpa_auth->addr, ETH_ALEN); 340 wpa_get_ntp_timestamp(buf + ETH_ALEN); 341 ptr = (unsigned long) group; 342 os_memcpy(buf + ETH_ALEN + 8, &ptr, sizeof(ptr)); 343 if (random_get_bytes(rkey, sizeof(rkey)) < 0) 344 return -1; 345 346 if (sha1_prf(rkey, sizeof(rkey), "Init Counter", buf, sizeof(buf), 347 group->Counter, WPA_NONCE_LEN) < 0) 348 return -1; 349 wpa_hexdump_key(MSG_DEBUG, "Key Counter", 350 group->Counter, WPA_NONCE_LEN); 351 352 return 0; 353} 354 355 356static struct wpa_group * wpa_group_init(struct wpa_authenticator *wpa_auth, 357 int vlan_id, int delay_init) 358{ 359 struct wpa_group *group; 360 361 group = os_zalloc(sizeof(struct wpa_group)); 362 if (group == NULL) 363 return NULL; 364 365 group->GTKAuthenticator = TRUE; 366 group->vlan_id = vlan_id; 367 group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group); 368 369 if (random_pool_ready() != 1) { 370 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool " 371 "for secure operations - update keys later when " 372 "the first station connects"); 373 } 374 375 /* 376 * Set initial GMK/Counter value here. The actual values that will be 377 * used in negotiations will be set once the first station tries to 378 * connect. This allows more time for collecting additional randomness 379 * on embedded devices. 380 */ 381 if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0) { 382 wpa_printf(MSG_ERROR, "Failed to get random data for WPA " 383 "initialization."); 384 os_free(group); 385 return NULL; 386 } 387 388 group->GInit = TRUE; 389 if (delay_init) { 390 wpa_printf(MSG_DEBUG, "WPA: Delay group state machine start " 391 "until Beacon frames have been configured"); 392 /* Initialization is completed in wpa_init_keys(). */ 393 } else { 394 wpa_group_sm_step(wpa_auth, group); 395 group->GInit = FALSE; 396 wpa_group_sm_step(wpa_auth, group); 397 } 398 399 return group; 400} 401 402 403/** 404 * wpa_init - Initialize WPA authenticator 405 * @addr: Authenticator address 406 * @conf: Configuration for WPA authenticator 407 * @cb: Callback functions for WPA authenticator 408 * Returns: Pointer to WPA authenticator data or %NULL on failure 409 */ 410struct wpa_authenticator * wpa_init(const u8 *addr, 411 struct wpa_auth_config *conf, 412 struct wpa_auth_callbacks *cb) 413{ 414 struct wpa_authenticator *wpa_auth; 415 416 wpa_auth = os_zalloc(sizeof(struct wpa_authenticator)); 417 if (wpa_auth == NULL) 418 return NULL; 419 os_memcpy(wpa_auth->addr, addr, ETH_ALEN); 420 os_memcpy(&wpa_auth->conf, conf, sizeof(*conf)); 421 os_memcpy(&wpa_auth->cb, cb, sizeof(*cb)); 422 423 if (wpa_auth_gen_wpa_ie(wpa_auth)) { 424 wpa_printf(MSG_ERROR, "Could not generate WPA IE."); 425 os_free(wpa_auth); 426 return NULL; 427 } 428 429 wpa_auth->group = wpa_group_init(wpa_auth, 0, 1); 430 if (wpa_auth->group == NULL) { 431 os_free(wpa_auth->wpa_ie); 432 os_free(wpa_auth); 433 return NULL; 434 } 435 436 wpa_auth->pmksa = pmksa_cache_auth_init(wpa_auth_pmksa_free_cb, 437 wpa_auth); 438 if (wpa_auth->pmksa == NULL) { 439 wpa_printf(MSG_ERROR, "PMKSA cache initialization failed."); 440 os_free(wpa_auth->group); 441 os_free(wpa_auth->wpa_ie); 442 os_free(wpa_auth); 443 return NULL; 444 } 445 446#ifdef CONFIG_IEEE80211R 447 wpa_auth->ft_pmk_cache = wpa_ft_pmk_cache_init(); 448 if (wpa_auth->ft_pmk_cache == NULL) { 449 wpa_printf(MSG_ERROR, "FT PMK cache initialization failed."); 450 os_free(wpa_auth->group); 451 os_free(wpa_auth->wpa_ie); 452 pmksa_cache_auth_deinit(wpa_auth->pmksa); 453 os_free(wpa_auth); 454 return NULL; 455 } 456#endif /* CONFIG_IEEE80211R */ 457 458 if (wpa_auth->conf.wpa_gmk_rekey) { 459 eloop_register_timeout(wpa_auth->conf.wpa_gmk_rekey, 0, 460 wpa_rekey_gmk, wpa_auth, NULL); 461 } 462 463 if (wpa_auth->conf.wpa_group_rekey) { 464 eloop_register_timeout(wpa_auth->conf.wpa_group_rekey, 0, 465 wpa_rekey_gtk, wpa_auth, NULL); 466 } 467 468#ifdef CONFIG_P2P 469 if (WPA_GET_BE32(conf->ip_addr_start)) { 470 int count = WPA_GET_BE32(conf->ip_addr_end) - 471 WPA_GET_BE32(conf->ip_addr_start) + 1; 472 if (count > 1000) 473 count = 1000; 474 if (count > 0) 475 wpa_auth->ip_pool = bitfield_alloc(count); 476 } 477#endif /* CONFIG_P2P */ 478 479 return wpa_auth; 480} 481 482 483int wpa_init_keys(struct wpa_authenticator *wpa_auth) 484{ 485 struct wpa_group *group = wpa_auth->group; 486 487 wpa_printf(MSG_DEBUG, "WPA: Start group state machine to set initial " 488 "keys"); 489 wpa_group_sm_step(wpa_auth, group); 490 group->GInit = FALSE; 491 wpa_group_sm_step(wpa_auth, group); 492 if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) 493 return -1; 494 return 0; 495} 496 497 498/** 499 * wpa_deinit - Deinitialize WPA authenticator 500 * @wpa_auth: Pointer to WPA authenticator data from wpa_init() 501 */ 502void wpa_deinit(struct wpa_authenticator *wpa_auth) 503{ 504 struct wpa_group *group, *prev; 505 506 eloop_cancel_timeout(wpa_rekey_gmk, wpa_auth, NULL); 507 eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL); 508 509#ifdef CONFIG_PEERKEY 510 while (wpa_auth->stsl_negotiations) 511 wpa_stsl_remove(wpa_auth, wpa_auth->stsl_negotiations); 512#endif /* CONFIG_PEERKEY */ 513 514 pmksa_cache_auth_deinit(wpa_auth->pmksa); 515 516#ifdef CONFIG_IEEE80211R 517 wpa_ft_pmk_cache_deinit(wpa_auth->ft_pmk_cache); 518 wpa_auth->ft_pmk_cache = NULL; 519#endif /* CONFIG_IEEE80211R */ 520 521#ifdef CONFIG_P2P 522 bitfield_free(wpa_auth->ip_pool); 523#endif /* CONFIG_P2P */ 524 525 526 os_free(wpa_auth->wpa_ie); 527 528 group = wpa_auth->group; 529 while (group) { 530 prev = group; 531 group = group->next; 532 os_free(prev); 533 } 534 535 os_free(wpa_auth); 536} 537 538 539/** 540 * wpa_reconfig - Update WPA authenticator configuration 541 * @wpa_auth: Pointer to WPA authenticator data from wpa_init() 542 * @conf: Configuration for WPA authenticator 543 */ 544int wpa_reconfig(struct wpa_authenticator *wpa_auth, 545 struct wpa_auth_config *conf) 546{ 547 struct wpa_group *group; 548 if (wpa_auth == NULL) 549 return 0; 550 551 os_memcpy(&wpa_auth->conf, conf, sizeof(*conf)); 552 if (wpa_auth_gen_wpa_ie(wpa_auth)) { 553 wpa_printf(MSG_ERROR, "Could not generate WPA IE."); 554 return -1; 555 } 556 557 /* 558 * Reinitialize GTK to make sure it is suitable for the new 559 * configuration. 560 */ 561 group = wpa_auth->group; 562 group->GTK_len = wpa_cipher_key_len(wpa_auth->conf.wpa_group); 563 group->GInit = TRUE; 564 wpa_group_sm_step(wpa_auth, group); 565 group->GInit = FALSE; 566 wpa_group_sm_step(wpa_auth, group); 567 568 return 0; 569} 570 571 572struct wpa_state_machine * 573wpa_auth_sta_init(struct wpa_authenticator *wpa_auth, const u8 *addr, 574 const u8 *p2p_dev_addr) 575{ 576 struct wpa_state_machine *sm; 577 578 if (wpa_auth->group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) 579 return NULL; 580 581 sm = os_zalloc(sizeof(struct wpa_state_machine)); 582 if (sm == NULL) 583 return NULL; 584 os_memcpy(sm->addr, addr, ETH_ALEN); 585 if (p2p_dev_addr) 586 os_memcpy(sm->p2p_dev_addr, p2p_dev_addr, ETH_ALEN); 587 588 sm->wpa_auth = wpa_auth; 589 sm->group = wpa_auth->group; 590 wpa_group_get(sm->wpa_auth, sm->group); 591 592 return sm; 593} 594 595 596int wpa_auth_sta_associated(struct wpa_authenticator *wpa_auth, 597 struct wpa_state_machine *sm) 598{ 599 if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL) 600 return -1; 601 602#ifdef CONFIG_IEEE80211R 603 if (sm->ft_completed) { 604 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, 605 "FT authentication already completed - do not " 606 "start 4-way handshake"); 607 /* Go to PTKINITDONE state to allow GTK rekeying */ 608 sm->wpa_ptk_state = WPA_PTK_PTKINITDONE; 609 return 0; 610 } 611#endif /* CONFIG_IEEE80211R */ 612 613 if (sm->started) { 614 os_memset(&sm->key_replay, 0, sizeof(sm->key_replay)); 615 sm->ReAuthenticationRequest = TRUE; 616 return wpa_sm_step(sm); 617 } 618 619 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, 620 "start authentication"); 621 sm->started = 1; 622 623 sm->Init = TRUE; 624 if (wpa_sm_step(sm) == 1) 625 return 1; /* should not really happen */ 626 sm->Init = FALSE; 627 sm->AuthenticationRequest = TRUE; 628 return wpa_sm_step(sm); 629} 630 631 632void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm) 633{ 634 /* WPA/RSN was not used - clear WPA state. This is needed if the STA 635 * reassociates back to the same AP while the previous entry for the 636 * STA has not yet been removed. */ 637 if (sm == NULL) 638 return; 639 640 sm->wpa_key_mgmt = 0; 641} 642 643 644static void wpa_free_sta_sm(struct wpa_state_machine *sm) 645{ 646#ifdef CONFIG_P2P 647 if (WPA_GET_BE32(sm->ip_addr)) { 648 u32 start; 649 wpa_printf(MSG_DEBUG, "P2P: Free assigned IP " 650 "address %u.%u.%u.%u from " MACSTR, 651 sm->ip_addr[0], sm->ip_addr[1], 652 sm->ip_addr[2], sm->ip_addr[3], 653 MAC2STR(sm->addr)); 654 start = WPA_GET_BE32(sm->wpa_auth->conf.ip_addr_start); 655 bitfield_clear(sm->wpa_auth->ip_pool, 656 WPA_GET_BE32(sm->ip_addr) - start); 657 } 658#endif /* CONFIG_P2P */ 659 if (sm->GUpdateStationKeys) { 660 sm->group->GKeyDoneStations--; 661 sm->GUpdateStationKeys = FALSE; 662 } 663#ifdef CONFIG_IEEE80211R 664 os_free(sm->assoc_resp_ftie); 665 wpabuf_free(sm->ft_pending_req_ies); 666#endif /* CONFIG_IEEE80211R */ 667 os_free(sm->last_rx_eapol_key); 668 os_free(sm->wpa_ie); 669 wpa_group_put(sm->wpa_auth, sm->group); 670 os_free(sm); 671} 672 673 674void wpa_auth_sta_deinit(struct wpa_state_machine *sm) 675{ 676 if (sm == NULL) 677 return; 678 679 if (sm->wpa_auth->conf.wpa_strict_rekey && sm->has_GTK) { 680 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 681 "strict rekeying - force GTK rekey since STA " 682 "is leaving"); 683 eloop_cancel_timeout(wpa_rekey_gtk, sm->wpa_auth, NULL); 684 eloop_register_timeout(0, 500000, wpa_rekey_gtk, sm->wpa_auth, 685 NULL); 686 } 687 688 eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm); 689 sm->pending_1_of_4_timeout = 0; 690 eloop_cancel_timeout(wpa_sm_call_step, sm, NULL); 691 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); 692 if (sm->in_step_loop) { 693 /* Must not free state machine while wpa_sm_step() is running. 694 * Freeing will be completed in the end of wpa_sm_step(). */ 695 wpa_printf(MSG_DEBUG, "WPA: Registering pending STA state " 696 "machine deinit for " MACSTR, MAC2STR(sm->addr)); 697 sm->pending_deinit = 1; 698 } else 699 wpa_free_sta_sm(sm); 700} 701 702 703static void wpa_request_new_ptk(struct wpa_state_machine *sm) 704{ 705 if (sm == NULL) 706 return; 707 708 sm->PTKRequest = TRUE; 709 sm->PTK_valid = 0; 710} 711 712 713static int wpa_replay_counter_valid(struct wpa_key_replay_counter *ctr, 714 const u8 *replay_counter) 715{ 716 int i; 717 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { 718 if (!ctr[i].valid) 719 break; 720 if (os_memcmp(replay_counter, ctr[i].counter, 721 WPA_REPLAY_COUNTER_LEN) == 0) 722 return 1; 723 } 724 return 0; 725} 726 727 728static void wpa_replay_counter_mark_invalid(struct wpa_key_replay_counter *ctr, 729 const u8 *replay_counter) 730{ 731 int i; 732 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { 733 if (ctr[i].valid && 734 (replay_counter == NULL || 735 os_memcmp(replay_counter, ctr[i].counter, 736 WPA_REPLAY_COUNTER_LEN) == 0)) 737 ctr[i].valid = FALSE; 738 } 739} 740 741 742#ifdef CONFIG_IEEE80211R 743static int ft_check_msg_2_of_4(struct wpa_authenticator *wpa_auth, 744 struct wpa_state_machine *sm, 745 struct wpa_eapol_ie_parse *kde) 746{ 747 struct wpa_ie_data ie; 748 struct rsn_mdie *mdie; 749 750 if (wpa_parse_wpa_ie_rsn(kde->rsn_ie, kde->rsn_ie_len, &ie) < 0 || 751 ie.num_pmkid != 1 || ie.pmkid == NULL) { 752 wpa_printf(MSG_DEBUG, "FT: No PMKR1Name in " 753 "FT 4-way handshake message 2/4"); 754 return -1; 755 } 756 757 os_memcpy(sm->sup_pmk_r1_name, ie.pmkid, PMKID_LEN); 758 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from Supplicant", 759 sm->sup_pmk_r1_name, PMKID_LEN); 760 761 if (!kde->mdie || !kde->ftie) { 762 wpa_printf(MSG_DEBUG, "FT: No %s in FT 4-way handshake " 763 "message 2/4", kde->mdie ? "FTIE" : "MDIE"); 764 return -1; 765 } 766 767 mdie = (struct rsn_mdie *) (kde->mdie + 2); 768 if (kde->mdie[1] < sizeof(struct rsn_mdie) || 769 os_memcmp(wpa_auth->conf.mobility_domain, mdie->mobility_domain, 770 MOBILITY_DOMAIN_ID_LEN) != 0) { 771 wpa_printf(MSG_DEBUG, "FT: MDIE mismatch"); 772 return -1; 773 } 774 775 if (sm->assoc_resp_ftie && 776 (kde->ftie[1] != sm->assoc_resp_ftie[1] || 777 os_memcmp(kde->ftie, sm->assoc_resp_ftie, 778 2 + sm->assoc_resp_ftie[1]) != 0)) { 779 wpa_printf(MSG_DEBUG, "FT: FTIE mismatch"); 780 wpa_hexdump(MSG_DEBUG, "FT: FTIE in EAPOL-Key msg 2/4", 781 kde->ftie, kde->ftie_len); 782 wpa_hexdump(MSG_DEBUG, "FT: FTIE in (Re)AssocResp", 783 sm->assoc_resp_ftie, 2 + sm->assoc_resp_ftie[1]); 784 return -1; 785 } 786 787 return 0; 788} 789#endif /* CONFIG_IEEE80211R */ 790 791 792static int wpa_receive_error_report(struct wpa_authenticator *wpa_auth, 793 struct wpa_state_machine *sm, int group) 794{ 795 /* Supplicant reported a Michael MIC error */ 796 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, 797 "received EAPOL-Key Error Request " 798 "(STA detected Michael MIC failure (group=%d))", 799 group); 800 801 if (group && wpa_auth->conf.wpa_group != WPA_CIPHER_TKIP) { 802 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 803 "ignore Michael MIC failure report since " 804 "group cipher is not TKIP"); 805 } else if (!group && sm->pairwise != WPA_CIPHER_TKIP) { 806 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 807 "ignore Michael MIC failure report since " 808 "pairwise cipher is not TKIP"); 809 } else { 810 if (wpa_auth_mic_failure_report(wpa_auth, sm->addr) > 0) 811 return 1; /* STA entry was removed */ 812 sm->dot11RSNAStatsTKIPRemoteMICFailures++; 813 wpa_auth->dot11RSNAStatsTKIPRemoteMICFailures++; 814 } 815 816 /* 817 * Error report is not a request for a new key handshake, but since 818 * Authenticator may do it, let's change the keys now anyway. 819 */ 820 wpa_request_new_ptk(sm); 821 return 0; 822} 823 824 825static int wpa_try_alt_snonce(struct wpa_state_machine *sm, u8 *data, 826 size_t data_len) 827{ 828 struct wpa_ptk PTK; 829 int ok = 0; 830 const u8 *pmk = NULL; 831 unsigned int pmk_len; 832 833 for (;;) { 834 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { 835 pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, 836 sm->p2p_dev_addr, pmk); 837 if (pmk == NULL) 838 break; 839 pmk_len = PMK_LEN; 840 } else { 841 pmk = sm->PMK; 842 pmk_len = sm->pmk_len; 843 } 844 845 wpa_derive_ptk(sm, sm->alt_SNonce, pmk, pmk_len, &PTK); 846 847 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &PTK, data, data_len) 848 == 0) { 849 ok = 1; 850 break; 851 } 852 853 if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) 854 break; 855 } 856 857 if (!ok) { 858 wpa_printf(MSG_DEBUG, 859 "WPA: Earlier SNonce did not result in matching MIC"); 860 return -1; 861 } 862 863 wpa_printf(MSG_DEBUG, 864 "WPA: Earlier SNonce resulted in matching MIC"); 865 sm->alt_snonce_valid = 0; 866 os_memcpy(sm->SNonce, sm->alt_SNonce, WPA_NONCE_LEN); 867 os_memcpy(&sm->PTK, &PTK, sizeof(PTK)); 868 sm->PTK_valid = TRUE; 869 870 return 0; 871} 872 873 874void wpa_receive(struct wpa_authenticator *wpa_auth, 875 struct wpa_state_machine *sm, 876 u8 *data, size_t data_len) 877{ 878 struct ieee802_1x_hdr *hdr; 879 struct wpa_eapol_key *key; 880 struct wpa_eapol_key_192 *key192; 881 u16 key_info, key_data_length; 882 enum { PAIRWISE_2, PAIRWISE_4, GROUP_2, REQUEST, 883 SMK_M1, SMK_M3, SMK_ERROR } msg; 884 char *msgtxt; 885 struct wpa_eapol_ie_parse kde; 886 int ft; 887 const u8 *eapol_key_ie, *key_data; 888 size_t eapol_key_ie_len, keyhdrlen, mic_len; 889 890 if (wpa_auth == NULL || !wpa_auth->conf.wpa || sm == NULL) 891 return; 892 893 mic_len = wpa_mic_len(sm->wpa_key_mgmt); 894 keyhdrlen = mic_len == 24 ? sizeof(*key192) : sizeof(*key); 895 896 if (data_len < sizeof(*hdr) + keyhdrlen) 897 return; 898 899 hdr = (struct ieee802_1x_hdr *) data; 900 key = (struct wpa_eapol_key *) (hdr + 1); 901 key192 = (struct wpa_eapol_key_192 *) (hdr + 1); 902 key_info = WPA_GET_BE16(key->key_info); 903 if (mic_len == 24) { 904 key_data = (const u8 *) (key192 + 1); 905 key_data_length = WPA_GET_BE16(key192->key_data_length); 906 } else { 907 key_data = (const u8 *) (key + 1); 908 key_data_length = WPA_GET_BE16(key->key_data_length); 909 } 910 wpa_printf(MSG_DEBUG, "WPA: Received EAPOL-Key from " MACSTR 911 " key_info=0x%x type=%u key_data_length=%u", 912 MAC2STR(sm->addr), key_info, key->type, key_data_length); 913 if (key_data_length > data_len - sizeof(*hdr) - keyhdrlen) { 914 wpa_printf(MSG_INFO, "WPA: Invalid EAPOL-Key frame - " 915 "key_data overflow (%d > %lu)", 916 key_data_length, 917 (unsigned long) (data_len - sizeof(*hdr) - 918 keyhdrlen)); 919 return; 920 } 921 922 if (sm->wpa == WPA_VERSION_WPA2) { 923 if (key->type == EAPOL_KEY_TYPE_WPA) { 924 /* 925 * Some deployed station implementations seem to send 926 * msg 4/4 with incorrect type value in WPA2 mode. 927 */ 928 wpa_printf(MSG_DEBUG, "Workaround: Allow EAPOL-Key " 929 "with unexpected WPA type in RSN mode"); 930 } else if (key->type != EAPOL_KEY_TYPE_RSN) { 931 wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with " 932 "unexpected type %d in RSN mode", 933 key->type); 934 return; 935 } 936 } else { 937 if (key->type != EAPOL_KEY_TYPE_WPA) { 938 wpa_printf(MSG_DEBUG, "Ignore EAPOL-Key with " 939 "unexpected type %d in WPA mode", 940 key->type); 941 return; 942 } 943 } 944 945 wpa_hexdump(MSG_DEBUG, "WPA: Received Key Nonce", key->key_nonce, 946 WPA_NONCE_LEN); 947 wpa_hexdump(MSG_DEBUG, "WPA: Received Replay Counter", 948 key->replay_counter, WPA_REPLAY_COUNTER_LEN); 949 950 /* FIX: verify that the EAPOL-Key frame was encrypted if pairwise keys 951 * are set */ 952 953 if ((key_info & (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) == 954 (WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_REQUEST)) { 955 if (key_info & WPA_KEY_INFO_ERROR) { 956 msg = SMK_ERROR; 957 msgtxt = "SMK Error"; 958 } else { 959 msg = SMK_M1; 960 msgtxt = "SMK M1"; 961 } 962 } else if (key_info & WPA_KEY_INFO_SMK_MESSAGE) { 963 msg = SMK_M3; 964 msgtxt = "SMK M3"; 965 } else if (key_info & WPA_KEY_INFO_REQUEST) { 966 msg = REQUEST; 967 msgtxt = "Request"; 968 } else if (!(key_info & WPA_KEY_INFO_KEY_TYPE)) { 969 msg = GROUP_2; 970 msgtxt = "2/2 Group"; 971 } else if (key_data_length == 0) { 972 msg = PAIRWISE_4; 973 msgtxt = "4/4 Pairwise"; 974 } else { 975 msg = PAIRWISE_2; 976 msgtxt = "2/4 Pairwise"; 977 } 978 979 /* TODO: key_info type validation for PeerKey */ 980 if (msg == REQUEST || msg == PAIRWISE_2 || msg == PAIRWISE_4 || 981 msg == GROUP_2) { 982 u16 ver = key_info & WPA_KEY_INFO_TYPE_MASK; 983 if (sm->pairwise == WPA_CIPHER_CCMP || 984 sm->pairwise == WPA_CIPHER_GCMP) { 985 if (wpa_use_aes_cmac(sm) && 986 sm->wpa_key_mgmt != WPA_KEY_MGMT_OSEN && 987 !wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) && 988 ver != WPA_KEY_INFO_TYPE_AES_128_CMAC) { 989 wpa_auth_logger(wpa_auth, sm->addr, 990 LOGGER_WARNING, 991 "advertised support for " 992 "AES-128-CMAC, but did not " 993 "use it"); 994 return; 995 } 996 997 if (!wpa_use_aes_cmac(sm) && 998 ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { 999 wpa_auth_logger(wpa_auth, sm->addr, 1000 LOGGER_WARNING, 1001 "did not use HMAC-SHA1-AES " 1002 "with CCMP/GCMP"); 1003 return; 1004 } 1005 } 1006 1007 if (wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) && 1008 ver != WPA_KEY_INFO_TYPE_AKM_DEFINED) { 1009 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, 1010 "did not use EAPOL-Key descriptor version 0 as required for AKM-defined cases"); 1011 return; 1012 } 1013 } 1014 1015 if (key_info & WPA_KEY_INFO_REQUEST) { 1016 if (sm->req_replay_counter_used && 1017 os_memcmp(key->replay_counter, sm->req_replay_counter, 1018 WPA_REPLAY_COUNTER_LEN) <= 0) { 1019 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_WARNING, 1020 "received EAPOL-Key request with " 1021 "replayed counter"); 1022 return; 1023 } 1024 } 1025 1026 if (!(key_info & WPA_KEY_INFO_REQUEST) && 1027 !wpa_replay_counter_valid(sm->key_replay, key->replay_counter)) { 1028 int i; 1029 1030 if (msg == PAIRWISE_2 && 1031 wpa_replay_counter_valid(sm->prev_key_replay, 1032 key->replay_counter) && 1033 sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING && 1034 os_memcmp(sm->SNonce, key->key_nonce, WPA_NONCE_LEN) != 0) 1035 { 1036 /* 1037 * Some supplicant implementations (e.g., Windows XP 1038 * WZC) update SNonce for each EAPOL-Key 2/4. This 1039 * breaks the workaround on accepting any of the 1040 * pending requests, so allow the SNonce to be updated 1041 * even if we have already sent out EAPOL-Key 3/4. 1042 */ 1043 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 1044 "Process SNonce update from STA " 1045 "based on retransmitted EAPOL-Key " 1046 "1/4"); 1047 sm->update_snonce = 1; 1048 os_memcpy(sm->alt_SNonce, sm->SNonce, WPA_NONCE_LEN); 1049 sm->alt_snonce_valid = TRUE; 1050 os_memcpy(sm->alt_replay_counter, 1051 sm->key_replay[0].counter, 1052 WPA_REPLAY_COUNTER_LEN); 1053 goto continue_processing; 1054 } 1055 1056 if (msg == PAIRWISE_4 && sm->alt_snonce_valid && 1057 sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING && 1058 os_memcmp(key->replay_counter, sm->alt_replay_counter, 1059 WPA_REPLAY_COUNTER_LEN) == 0) { 1060 /* 1061 * Supplicant may still be using the old SNonce since 1062 * there was two EAPOL-Key 2/4 messages and they had 1063 * different SNonce values. 1064 */ 1065 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 1066 "Try to process received EAPOL-Key 4/4 based on old Replay Counter and SNonce from an earlier EAPOL-Key 1/4"); 1067 goto continue_processing; 1068 } 1069 1070 if (msg == PAIRWISE_2 && 1071 wpa_replay_counter_valid(sm->prev_key_replay, 1072 key->replay_counter) && 1073 sm->wpa_ptk_state == WPA_PTK_PTKINITNEGOTIATING) { 1074 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 1075 "ignore retransmitted EAPOL-Key %s - " 1076 "SNonce did not change", msgtxt); 1077 } else { 1078 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 1079 "received EAPOL-Key %s with " 1080 "unexpected replay counter", msgtxt); 1081 } 1082 for (i = 0; i < RSNA_MAX_EAPOL_RETRIES; i++) { 1083 if (!sm->key_replay[i].valid) 1084 break; 1085 wpa_hexdump(MSG_DEBUG, "pending replay counter", 1086 sm->key_replay[i].counter, 1087 WPA_REPLAY_COUNTER_LEN); 1088 } 1089 wpa_hexdump(MSG_DEBUG, "received replay counter", 1090 key->replay_counter, WPA_REPLAY_COUNTER_LEN); 1091 return; 1092 } 1093 1094continue_processing: 1095 switch (msg) { 1096 case PAIRWISE_2: 1097 if (sm->wpa_ptk_state != WPA_PTK_PTKSTART && 1098 sm->wpa_ptk_state != WPA_PTK_PTKCALCNEGOTIATING && 1099 (!sm->update_snonce || 1100 sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING)) { 1101 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, 1102 "received EAPOL-Key msg 2/4 in " 1103 "invalid state (%d) - dropped", 1104 sm->wpa_ptk_state); 1105 return; 1106 } 1107 random_add_randomness(key->key_nonce, WPA_NONCE_LEN); 1108 if (sm->group->reject_4way_hs_for_entropy) { 1109 /* 1110 * The system did not have enough entropy to generate 1111 * strong random numbers. Reject the first 4-way 1112 * handshake(s) and collect some entropy based on the 1113 * information from it. Once enough entropy is 1114 * available, the next atempt will trigger GMK/Key 1115 * Counter update and the station will be allowed to 1116 * continue. 1117 */ 1118 wpa_printf(MSG_DEBUG, "WPA: Reject 4-way handshake to " 1119 "collect more entropy for random number " 1120 "generation"); 1121 random_mark_pool_ready(); 1122 wpa_sta_disconnect(wpa_auth, sm->addr); 1123 return; 1124 } 1125 if (wpa_parse_kde_ies(key_data, key_data_length, &kde) < 0) { 1126 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, 1127 "received EAPOL-Key msg 2/4 with " 1128 "invalid Key Data contents"); 1129 return; 1130 } 1131 if (kde.rsn_ie) { 1132 eapol_key_ie = kde.rsn_ie; 1133 eapol_key_ie_len = kde.rsn_ie_len; 1134 } else if (kde.osen) { 1135 eapol_key_ie = kde.osen; 1136 eapol_key_ie_len = kde.osen_len; 1137 } else { 1138 eapol_key_ie = kde.wpa_ie; 1139 eapol_key_ie_len = kde.wpa_ie_len; 1140 } 1141 ft = sm->wpa == WPA_VERSION_WPA2 && 1142 wpa_key_mgmt_ft(sm->wpa_key_mgmt); 1143 if (sm->wpa_ie == NULL || 1144 wpa_compare_rsn_ie(ft, 1145 sm->wpa_ie, sm->wpa_ie_len, 1146 eapol_key_ie, eapol_key_ie_len)) { 1147 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1148 "WPA IE from (Re)AssocReq did not " 1149 "match with msg 2/4"); 1150 if (sm->wpa_ie) { 1151 wpa_hexdump(MSG_DEBUG, "WPA IE in AssocReq", 1152 sm->wpa_ie, sm->wpa_ie_len); 1153 } 1154 wpa_hexdump(MSG_DEBUG, "WPA IE in msg 2/4", 1155 eapol_key_ie, eapol_key_ie_len); 1156 /* MLME-DEAUTHENTICATE.request */ 1157 wpa_sta_disconnect(wpa_auth, sm->addr); 1158 return; 1159 } 1160#ifdef CONFIG_IEEE80211R 1161 if (ft && ft_check_msg_2_of_4(wpa_auth, sm, &kde) < 0) { 1162 wpa_sta_disconnect(wpa_auth, sm->addr); 1163 return; 1164 } 1165#endif /* CONFIG_IEEE80211R */ 1166#ifdef CONFIG_P2P 1167 if (kde.ip_addr_req && kde.ip_addr_req[0] && 1168 wpa_auth->ip_pool && WPA_GET_BE32(sm->ip_addr) == 0) { 1169 int idx; 1170 wpa_printf(MSG_DEBUG, "P2P: IP address requested in " 1171 "EAPOL-Key exchange"); 1172 idx = bitfield_get_first_zero(wpa_auth->ip_pool); 1173 if (idx >= 0) { 1174 u32 start = WPA_GET_BE32(wpa_auth->conf. 1175 ip_addr_start); 1176 bitfield_set(wpa_auth->ip_pool, idx); 1177 WPA_PUT_BE32(sm->ip_addr, start + idx); 1178 wpa_printf(MSG_DEBUG, "P2P: Assigned IP " 1179 "address %u.%u.%u.%u to " MACSTR, 1180 sm->ip_addr[0], sm->ip_addr[1], 1181 sm->ip_addr[2], sm->ip_addr[3], 1182 MAC2STR(sm->addr)); 1183 } 1184 } 1185#endif /* CONFIG_P2P */ 1186 break; 1187 case PAIRWISE_4: 1188 if (sm->wpa_ptk_state != WPA_PTK_PTKINITNEGOTIATING || 1189 !sm->PTK_valid) { 1190 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, 1191 "received EAPOL-Key msg 4/4 in " 1192 "invalid state (%d) - dropped", 1193 sm->wpa_ptk_state); 1194 return; 1195 } 1196 break; 1197 case GROUP_2: 1198 if (sm->wpa_ptk_group_state != WPA_PTK_GROUP_REKEYNEGOTIATING 1199 || !sm->PTK_valid) { 1200 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_INFO, 1201 "received EAPOL-Key msg 2/2 in " 1202 "invalid state (%d) - dropped", 1203 sm->wpa_ptk_group_state); 1204 return; 1205 } 1206 break; 1207#ifdef CONFIG_PEERKEY 1208 case SMK_M1: 1209 case SMK_M3: 1210 case SMK_ERROR: 1211 if (!wpa_auth->conf.peerkey) { 1212 wpa_printf(MSG_DEBUG, "RSN: SMK M1/M3/Error, but " 1213 "PeerKey use disabled - ignoring message"); 1214 return; 1215 } 1216 if (!sm->PTK_valid) { 1217 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1218 "received EAPOL-Key msg SMK in " 1219 "invalid state - dropped"); 1220 return; 1221 } 1222 break; 1223#else /* CONFIG_PEERKEY */ 1224 case SMK_M1: 1225 case SMK_M3: 1226 case SMK_ERROR: 1227 return; /* STSL disabled - ignore SMK messages */ 1228#endif /* CONFIG_PEERKEY */ 1229 case REQUEST: 1230 break; 1231 } 1232 1233 wpa_auth_vlogger(wpa_auth, sm->addr, LOGGER_DEBUG, 1234 "received EAPOL-Key frame (%s)", msgtxt); 1235 1236 if (key_info & WPA_KEY_INFO_ACK) { 1237 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1238 "received invalid EAPOL-Key: Key Ack set"); 1239 return; 1240 } 1241 1242 if (!(key_info & WPA_KEY_INFO_MIC)) { 1243 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1244 "received invalid EAPOL-Key: Key MIC not set"); 1245 return; 1246 } 1247 1248 sm->MICVerified = FALSE; 1249 if (sm->PTK_valid && !sm->update_snonce) { 1250 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &sm->PTK, data, 1251 data_len) && 1252 (msg != PAIRWISE_4 || !sm->alt_snonce_valid || 1253 wpa_try_alt_snonce(sm, data, data_len))) { 1254 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1255 "received EAPOL-Key with invalid MIC"); 1256 return; 1257 } 1258 sm->MICVerified = TRUE; 1259 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm); 1260 sm->pending_1_of_4_timeout = 0; 1261 } 1262 1263 if (key_info & WPA_KEY_INFO_REQUEST) { 1264 if (sm->MICVerified) { 1265 sm->req_replay_counter_used = 1; 1266 os_memcpy(sm->req_replay_counter, key->replay_counter, 1267 WPA_REPLAY_COUNTER_LEN); 1268 } else { 1269 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1270 "received EAPOL-Key request with " 1271 "invalid MIC"); 1272 return; 1273 } 1274 1275 /* 1276 * TODO: should decrypt key data field if encryption was used; 1277 * even though MAC address KDE is not normally encrypted, 1278 * supplicant is allowed to encrypt it. 1279 */ 1280 if (msg == SMK_ERROR) { 1281#ifdef CONFIG_PEERKEY 1282 wpa_smk_error(wpa_auth, sm, key_data, key_data_length); 1283#endif /* CONFIG_PEERKEY */ 1284 return; 1285 } else if (key_info & WPA_KEY_INFO_ERROR) { 1286 if (wpa_receive_error_report( 1287 wpa_auth, sm, 1288 !(key_info & WPA_KEY_INFO_KEY_TYPE)) > 0) 1289 return; /* STA entry was removed */ 1290 } else if (key_info & WPA_KEY_INFO_KEY_TYPE) { 1291 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1292 "received EAPOL-Key Request for new " 1293 "4-Way Handshake"); 1294 wpa_request_new_ptk(sm); 1295#ifdef CONFIG_PEERKEY 1296 } else if (msg == SMK_M1) { 1297 wpa_smk_m1(wpa_auth, sm, key, key_data, 1298 key_data_length); 1299#endif /* CONFIG_PEERKEY */ 1300 } else if (key_data_length > 0 && 1301 wpa_parse_kde_ies(key_data, key_data_length, 1302 &kde) == 0 && 1303 kde.mac_addr) { 1304 } else { 1305 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1306 "received EAPOL-Key Request for GTK " 1307 "rekeying"); 1308 eloop_cancel_timeout(wpa_rekey_gtk, wpa_auth, NULL); 1309 wpa_rekey_gtk(wpa_auth, NULL); 1310 } 1311 } else { 1312 /* Do not allow the same key replay counter to be reused. */ 1313 wpa_replay_counter_mark_invalid(sm->key_replay, 1314 key->replay_counter); 1315 1316 if (msg == PAIRWISE_2) { 1317 /* 1318 * Maintain a copy of the pending EAPOL-Key frames in 1319 * case the EAPOL-Key frame was retransmitted. This is 1320 * needed to allow EAPOL-Key msg 2/4 reply to another 1321 * pending msg 1/4 to update the SNonce to work around 1322 * unexpected supplicant behavior. 1323 */ 1324 os_memcpy(sm->prev_key_replay, sm->key_replay, 1325 sizeof(sm->key_replay)); 1326 } else { 1327 os_memset(sm->prev_key_replay, 0, 1328 sizeof(sm->prev_key_replay)); 1329 } 1330 1331 /* 1332 * Make sure old valid counters are not accepted anymore and 1333 * do not get copied again. 1334 */ 1335 wpa_replay_counter_mark_invalid(sm->key_replay, NULL); 1336 } 1337 1338#ifdef CONFIG_PEERKEY 1339 if (msg == SMK_M3) { 1340 wpa_smk_m3(wpa_auth, sm, key, key_data, key_data_length); 1341 return; 1342 } 1343#endif /* CONFIG_PEERKEY */ 1344 1345 os_free(sm->last_rx_eapol_key); 1346 sm->last_rx_eapol_key = os_malloc(data_len); 1347 if (sm->last_rx_eapol_key == NULL) 1348 return; 1349 os_memcpy(sm->last_rx_eapol_key, data, data_len); 1350 sm->last_rx_eapol_key_len = data_len; 1351 1352 sm->rx_eapol_key_secure = !!(key_info & WPA_KEY_INFO_SECURE); 1353 sm->EAPOLKeyReceived = TRUE; 1354 sm->EAPOLKeyPairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE); 1355 sm->EAPOLKeyRequest = !!(key_info & WPA_KEY_INFO_REQUEST); 1356 os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN); 1357 wpa_sm_step(sm); 1358} 1359 1360 1361static int wpa_gmk_to_gtk(const u8 *gmk, const char *label, const u8 *addr, 1362 const u8 *gnonce, u8 *gtk, size_t gtk_len) 1363{ 1364 u8 data[ETH_ALEN + WPA_NONCE_LEN + 8 + 16]; 1365 u8 *pos; 1366 int ret = 0; 1367 1368 /* GTK = PRF-X(GMK, "Group key expansion", 1369 * AA || GNonce || Time || random data) 1370 * The example described in the IEEE 802.11 standard uses only AA and 1371 * GNonce as inputs here. Add some more entropy since this derivation 1372 * is done only at the Authenticator and as such, does not need to be 1373 * exactly same. 1374 */ 1375 os_memcpy(data, addr, ETH_ALEN); 1376 os_memcpy(data + ETH_ALEN, gnonce, WPA_NONCE_LEN); 1377 pos = data + ETH_ALEN + WPA_NONCE_LEN; 1378 wpa_get_ntp_timestamp(pos); 1379 pos += 8; 1380 if (random_get_bytes(pos, 16) < 0) 1381 ret = -1; 1382 1383#ifdef CONFIG_IEEE80211W 1384 sha256_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len); 1385#else /* CONFIG_IEEE80211W */ 1386 if (sha1_prf(gmk, WPA_GMK_LEN, label, data, sizeof(data), gtk, gtk_len) 1387 < 0) 1388 ret = -1; 1389#endif /* CONFIG_IEEE80211W */ 1390 1391 return ret; 1392} 1393 1394 1395static void wpa_send_eapol_timeout(void *eloop_ctx, void *timeout_ctx) 1396{ 1397 struct wpa_authenticator *wpa_auth = eloop_ctx; 1398 struct wpa_state_machine *sm = timeout_ctx; 1399 1400 sm->pending_1_of_4_timeout = 0; 1401 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "EAPOL-Key timeout"); 1402 sm->TimeoutEvt = TRUE; 1403 wpa_sm_step(sm); 1404} 1405 1406 1407void __wpa_send_eapol(struct wpa_authenticator *wpa_auth, 1408 struct wpa_state_machine *sm, int key_info, 1409 const u8 *key_rsc, const u8 *nonce, 1410 const u8 *kde, size_t kde_len, 1411 int keyidx, int encr, int force_version) 1412{ 1413 struct ieee802_1x_hdr *hdr; 1414 struct wpa_eapol_key *key; 1415 struct wpa_eapol_key_192 *key192; 1416 size_t len, mic_len, keyhdrlen; 1417 int alg; 1418 int key_data_len, pad_len = 0; 1419 u8 *buf, *pos; 1420 int version, pairwise; 1421 int i; 1422 u8 *key_data; 1423 1424 mic_len = wpa_mic_len(sm->wpa_key_mgmt); 1425 keyhdrlen = mic_len == 24 ? sizeof(*key192) : sizeof(*key); 1426 1427 len = sizeof(struct ieee802_1x_hdr) + keyhdrlen; 1428 1429 if (force_version) 1430 version = force_version; 1431 else if (sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN || 1432 wpa_key_mgmt_suite_b(sm->wpa_key_mgmt)) 1433 version = WPA_KEY_INFO_TYPE_AKM_DEFINED; 1434 else if (wpa_use_aes_cmac(sm)) 1435 version = WPA_KEY_INFO_TYPE_AES_128_CMAC; 1436 else if (sm->pairwise != WPA_CIPHER_TKIP) 1437 version = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES; 1438 else 1439 version = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4; 1440 1441 pairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE); 1442 1443 wpa_printf(MSG_DEBUG, "WPA: Send EAPOL(version=%d secure=%d mic=%d " 1444 "ack=%d install=%d pairwise=%d kde_len=%lu keyidx=%d " 1445 "encr=%d)", 1446 version, 1447 (key_info & WPA_KEY_INFO_SECURE) ? 1 : 0, 1448 (key_info & WPA_KEY_INFO_MIC) ? 1 : 0, 1449 (key_info & WPA_KEY_INFO_ACK) ? 1 : 0, 1450 (key_info & WPA_KEY_INFO_INSTALL) ? 1 : 0, 1451 pairwise, (unsigned long) kde_len, keyidx, encr); 1452 1453 key_data_len = kde_len; 1454 1455 if ((version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES || 1456 sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN || 1457 wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) || 1458 version == WPA_KEY_INFO_TYPE_AES_128_CMAC) && encr) { 1459 pad_len = key_data_len % 8; 1460 if (pad_len) 1461 pad_len = 8 - pad_len; 1462 key_data_len += pad_len + 8; 1463 } 1464 1465 len += key_data_len; 1466 1467 hdr = os_zalloc(len); 1468 if (hdr == NULL) 1469 return; 1470 hdr->version = wpa_auth->conf.eapol_version; 1471 hdr->type = IEEE802_1X_TYPE_EAPOL_KEY; 1472 hdr->length = host_to_be16(len - sizeof(*hdr)); 1473 key = (struct wpa_eapol_key *) (hdr + 1); 1474 key192 = (struct wpa_eapol_key_192 *) (hdr + 1); 1475 key_data = ((u8 *) (hdr + 1)) + keyhdrlen; 1476 1477 key->type = sm->wpa == WPA_VERSION_WPA2 ? 1478 EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA; 1479 key_info |= version; 1480 if (encr && sm->wpa == WPA_VERSION_WPA2) 1481 key_info |= WPA_KEY_INFO_ENCR_KEY_DATA; 1482 if (sm->wpa != WPA_VERSION_WPA2) 1483 key_info |= keyidx << WPA_KEY_INFO_KEY_INDEX_SHIFT; 1484 WPA_PUT_BE16(key->key_info, key_info); 1485 1486 alg = pairwise ? sm->pairwise : wpa_auth->conf.wpa_group; 1487 WPA_PUT_BE16(key->key_length, wpa_cipher_key_len(alg)); 1488 if (key_info & WPA_KEY_INFO_SMK_MESSAGE) 1489 WPA_PUT_BE16(key->key_length, 0); 1490 1491 /* FIX: STSL: what to use as key_replay_counter? */ 1492 for (i = RSNA_MAX_EAPOL_RETRIES - 1; i > 0; i--) { 1493 sm->key_replay[i].valid = sm->key_replay[i - 1].valid; 1494 os_memcpy(sm->key_replay[i].counter, 1495 sm->key_replay[i - 1].counter, 1496 WPA_REPLAY_COUNTER_LEN); 1497 } 1498 inc_byte_array(sm->key_replay[0].counter, WPA_REPLAY_COUNTER_LEN); 1499 os_memcpy(key->replay_counter, sm->key_replay[0].counter, 1500 WPA_REPLAY_COUNTER_LEN); 1501 wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", 1502 key->replay_counter, WPA_REPLAY_COUNTER_LEN); 1503 sm->key_replay[0].valid = TRUE; 1504 1505 if (nonce) 1506 os_memcpy(key->key_nonce, nonce, WPA_NONCE_LEN); 1507 1508 if (key_rsc) 1509 os_memcpy(key->key_rsc, key_rsc, WPA_KEY_RSC_LEN); 1510 1511 if (kde && !encr) { 1512 os_memcpy(key_data, kde, kde_len); 1513 if (mic_len == 24) 1514 WPA_PUT_BE16(key192->key_data_length, kde_len); 1515 else 1516 WPA_PUT_BE16(key->key_data_length, kde_len); 1517 } else if (encr && kde) { 1518 buf = os_zalloc(key_data_len); 1519 if (buf == NULL) { 1520 os_free(hdr); 1521 return; 1522 } 1523 pos = buf; 1524 os_memcpy(pos, kde, kde_len); 1525 pos += kde_len; 1526 1527 if (pad_len) 1528 *pos++ = 0xdd; 1529 1530 wpa_hexdump_key(MSG_DEBUG, "Plaintext EAPOL-Key Key Data", 1531 buf, key_data_len); 1532 if (version == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES || 1533 sm->wpa_key_mgmt == WPA_KEY_MGMT_OSEN || 1534 wpa_key_mgmt_suite_b(sm->wpa_key_mgmt) || 1535 version == WPA_KEY_INFO_TYPE_AES_128_CMAC) { 1536 if (aes_wrap(sm->PTK.kek, sm->PTK.kek_len, 1537 (key_data_len - 8) / 8, buf, key_data)) { 1538 os_free(hdr); 1539 os_free(buf); 1540 return; 1541 } 1542 if (mic_len == 24) 1543 WPA_PUT_BE16(key192->key_data_length, 1544 key_data_len); 1545 else 1546 WPA_PUT_BE16(key->key_data_length, 1547 key_data_len); 1548#ifndef CONFIG_NO_RC4 1549 } else if (sm->PTK.kek_len == 16) { 1550 u8 ek[32]; 1551 os_memcpy(key->key_iv, 1552 sm->group->Counter + WPA_NONCE_LEN - 16, 16); 1553 inc_byte_array(sm->group->Counter, WPA_NONCE_LEN); 1554 os_memcpy(ek, key->key_iv, 16); 1555 os_memcpy(ek + 16, sm->PTK.kek, sm->PTK.kek_len); 1556 os_memcpy(key_data, buf, key_data_len); 1557 rc4_skip(ek, 32, 256, key_data, key_data_len); 1558 if (mic_len == 24) 1559 WPA_PUT_BE16(key192->key_data_length, 1560 key_data_len); 1561 else 1562 WPA_PUT_BE16(key->key_data_length, 1563 key_data_len); 1564#endif /* CONFIG_NO_RC4 */ 1565 } else { 1566 os_free(hdr); 1567 os_free(buf); 1568 return; 1569 } 1570 os_free(buf); 1571 } 1572 1573 if (key_info & WPA_KEY_INFO_MIC) { 1574 u8 *key_mic; 1575 1576 if (!sm->PTK_valid) { 1577 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, 1578 "PTK not valid when sending EAPOL-Key " 1579 "frame"); 1580 os_free(hdr); 1581 return; 1582 } 1583 1584 key_mic = key192->key_mic; /* same offset for key and key192 */ 1585 wpa_eapol_key_mic(sm->PTK.kck, sm->PTK.kck_len, 1586 sm->wpa_key_mgmt, version, 1587 (u8 *) hdr, len, key_mic); 1588#ifdef CONFIG_TESTING_OPTIONS 1589 if (!pairwise && 1590 wpa_auth->conf.corrupt_gtk_rekey_mic_probability > 0.0 && 1591 drand48() < 1592 wpa_auth->conf.corrupt_gtk_rekey_mic_probability) { 1593 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO, 1594 "Corrupting group EAPOL-Key Key MIC"); 1595 key_mic[0]++; 1596 } 1597#endif /* CONFIG_TESTING_OPTIONS */ 1598 } 1599 1600 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_inc_EapolFramesTx, 1601 1); 1602 wpa_auth_send_eapol(wpa_auth, sm->addr, (u8 *) hdr, len, 1603 sm->pairwise_set); 1604 os_free(hdr); 1605} 1606 1607 1608static void wpa_send_eapol(struct wpa_authenticator *wpa_auth, 1609 struct wpa_state_machine *sm, int key_info, 1610 const u8 *key_rsc, const u8 *nonce, 1611 const u8 *kde, size_t kde_len, 1612 int keyidx, int encr) 1613{ 1614 int timeout_ms; 1615 int pairwise = key_info & WPA_KEY_INFO_KEY_TYPE; 1616 int ctr; 1617 1618 if (sm == NULL) 1619 return; 1620 1621 __wpa_send_eapol(wpa_auth, sm, key_info, key_rsc, nonce, kde, kde_len, 1622 keyidx, encr, 0); 1623 1624 ctr = pairwise ? sm->TimeoutCtr : sm->GTimeoutCtr; 1625 if (ctr == 1 && wpa_auth->conf.tx_status) 1626 timeout_ms = pairwise ? eapol_key_timeout_first : 1627 eapol_key_timeout_first_group; 1628 else 1629 timeout_ms = eapol_key_timeout_subseq; 1630 if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC)) 1631 sm->pending_1_of_4_timeout = 1; 1632 wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry " 1633 "counter %d)", timeout_ms, ctr); 1634 eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000, 1635 wpa_send_eapol_timeout, wpa_auth, sm); 1636} 1637 1638 1639static int wpa_verify_key_mic(int akmp, struct wpa_ptk *PTK, u8 *data, 1640 size_t data_len) 1641{ 1642 struct ieee802_1x_hdr *hdr; 1643 struct wpa_eapol_key *key; 1644 struct wpa_eapol_key_192 *key192; 1645 u16 key_info; 1646 int ret = 0; 1647 u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN]; 1648 size_t mic_len = wpa_mic_len(akmp); 1649 1650 if (data_len < sizeof(*hdr) + sizeof(*key)) 1651 return -1; 1652 1653 hdr = (struct ieee802_1x_hdr *) data; 1654 key = (struct wpa_eapol_key *) (hdr + 1); 1655 key192 = (struct wpa_eapol_key_192 *) (hdr + 1); 1656 key_info = WPA_GET_BE16(key->key_info); 1657 os_memcpy(mic, key192->key_mic, mic_len); 1658 os_memset(key192->key_mic, 0, mic_len); 1659 if (wpa_eapol_key_mic(PTK->kck, PTK->kck_len, akmp, 1660 key_info & WPA_KEY_INFO_TYPE_MASK, 1661 data, data_len, key192->key_mic) || 1662 os_memcmp_const(mic, key192->key_mic, mic_len) != 0) 1663 ret = -1; 1664 os_memcpy(key192->key_mic, mic, mic_len); 1665 return ret; 1666} 1667 1668 1669void wpa_remove_ptk(struct wpa_state_machine *sm) 1670{ 1671 sm->PTK_valid = FALSE; 1672 os_memset(&sm->PTK, 0, sizeof(sm->PTK)); 1673 wpa_auth_set_key(sm->wpa_auth, 0, WPA_ALG_NONE, sm->addr, 0, NULL, 0); 1674 sm->pairwise_set = FALSE; 1675 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); 1676} 1677 1678 1679int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event) 1680{ 1681 int remove_ptk = 1; 1682 1683 if (sm == NULL) 1684 return -1; 1685 1686 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 1687 "event %d notification", event); 1688 1689 switch (event) { 1690 case WPA_AUTH: 1691#ifdef CONFIG_MESH 1692 /* PTKs are derived through AMPE */ 1693 if (wpa_auth_start_ampe(sm->wpa_auth, sm->addr)) { 1694 /* not mesh */ 1695 break; 1696 } 1697 return 0; 1698#endif /* CONFIG_MESH */ 1699 case WPA_ASSOC: 1700 break; 1701 case WPA_DEAUTH: 1702 case WPA_DISASSOC: 1703 sm->DeauthenticationRequest = TRUE; 1704 break; 1705 case WPA_REAUTH: 1706 case WPA_REAUTH_EAPOL: 1707 if (!sm->started) { 1708 /* 1709 * When using WPS, we may end up here if the STA 1710 * manages to re-associate without the previous STA 1711 * entry getting removed. Consequently, we need to make 1712 * sure that the WPA state machines gets initialized 1713 * properly at this point. 1714 */ 1715 wpa_printf(MSG_DEBUG, "WPA state machine had not been " 1716 "started - initialize now"); 1717 sm->started = 1; 1718 sm->Init = TRUE; 1719 if (wpa_sm_step(sm) == 1) 1720 return 1; /* should not really happen */ 1721 sm->Init = FALSE; 1722 sm->AuthenticationRequest = TRUE; 1723 break; 1724 } 1725 if (sm->GUpdateStationKeys) { 1726 /* 1727 * Reauthentication cancels the pending group key 1728 * update for this STA. 1729 */ 1730 sm->group->GKeyDoneStations--; 1731 sm->GUpdateStationKeys = FALSE; 1732 sm->PtkGroupInit = TRUE; 1733 } 1734 sm->ReAuthenticationRequest = TRUE; 1735 break; 1736 case WPA_ASSOC_FT: 1737#ifdef CONFIG_IEEE80211R 1738 wpa_printf(MSG_DEBUG, "FT: Retry PTK configuration " 1739 "after association"); 1740 wpa_ft_install_ptk(sm); 1741 1742 /* Using FT protocol, not WPA auth state machine */ 1743 sm->ft_completed = 1; 1744 return 0; 1745#else /* CONFIG_IEEE80211R */ 1746 break; 1747#endif /* CONFIG_IEEE80211R */ 1748 case WPA_DRV_STA_REMOVED: 1749 sm->tk_already_set = FALSE; 1750 return 0; 1751 } 1752 1753#ifdef CONFIG_IEEE80211R 1754 sm->ft_completed = 0; 1755#endif /* CONFIG_IEEE80211R */ 1756 1757#ifdef CONFIG_IEEE80211W 1758 if (sm->mgmt_frame_prot && event == WPA_AUTH) 1759 remove_ptk = 0; 1760#endif /* CONFIG_IEEE80211W */ 1761 1762 if (remove_ptk) { 1763 sm->PTK_valid = FALSE; 1764 os_memset(&sm->PTK, 0, sizeof(sm->PTK)); 1765 1766 if (event != WPA_REAUTH_EAPOL) 1767 wpa_remove_ptk(sm); 1768 } 1769 1770 if (sm->in_step_loop) { 1771 /* 1772 * wpa_sm_step() is already running - avoid recursive call to 1773 * it by making the existing loop process the new update. 1774 */ 1775 sm->changed = TRUE; 1776 return 0; 1777 } 1778 return wpa_sm_step(sm); 1779} 1780 1781 1782SM_STATE(WPA_PTK, INITIALIZE) 1783{ 1784 SM_ENTRY_MA(WPA_PTK, INITIALIZE, wpa_ptk); 1785 if (sm->Init) { 1786 /* Init flag is not cleared here, so avoid busy 1787 * loop by claiming nothing changed. */ 1788 sm->changed = FALSE; 1789 } 1790 1791 sm->keycount = 0; 1792 if (sm->GUpdateStationKeys) 1793 sm->group->GKeyDoneStations--; 1794 sm->GUpdateStationKeys = FALSE; 1795 if (sm->wpa == WPA_VERSION_WPA) 1796 sm->PInitAKeys = FALSE; 1797 if (1 /* Unicast cipher supported AND (ESS OR ((IBSS or WDS) and 1798 * Local AA > Remote AA)) */) { 1799 sm->Pair = TRUE; 1800 } 1801 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 0); 1802 wpa_remove_ptk(sm); 1803 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 0); 1804 sm->TimeoutCtr = 0; 1805 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { 1806 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, 1807 WPA_EAPOL_authorized, 0); 1808 } 1809} 1810 1811 1812SM_STATE(WPA_PTK, DISCONNECT) 1813{ 1814 SM_ENTRY_MA(WPA_PTK, DISCONNECT, wpa_ptk); 1815 sm->Disconnect = FALSE; 1816 wpa_sta_disconnect(sm->wpa_auth, sm->addr); 1817} 1818 1819 1820SM_STATE(WPA_PTK, DISCONNECTED) 1821{ 1822 SM_ENTRY_MA(WPA_PTK, DISCONNECTED, wpa_ptk); 1823 sm->DeauthenticationRequest = FALSE; 1824} 1825 1826 1827SM_STATE(WPA_PTK, AUTHENTICATION) 1828{ 1829 SM_ENTRY_MA(WPA_PTK, AUTHENTICATION, wpa_ptk); 1830 os_memset(&sm->PTK, 0, sizeof(sm->PTK)); 1831 sm->PTK_valid = FALSE; 1832 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portControl_Auto, 1833 1); 1834 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portEnabled, 1); 1835 sm->AuthenticationRequest = FALSE; 1836} 1837 1838 1839static void wpa_group_ensure_init(struct wpa_authenticator *wpa_auth, 1840 struct wpa_group *group) 1841{ 1842 if (group->first_sta_seen) 1843 return; 1844 /* 1845 * System has run bit further than at the time hostapd was started 1846 * potentially very early during boot up. This provides better chances 1847 * of collecting more randomness on embedded systems. Re-initialize the 1848 * GMK and Counter here to improve their strength if there was not 1849 * enough entropy available immediately after system startup. 1850 */ 1851 wpa_printf(MSG_DEBUG, "WPA: Re-initialize GMK/Counter on first " 1852 "station"); 1853 if (random_pool_ready() != 1) { 1854 wpa_printf(MSG_INFO, "WPA: Not enough entropy in random pool " 1855 "to proceed - reject first 4-way handshake"); 1856 group->reject_4way_hs_for_entropy = TRUE; 1857 } else { 1858 group->first_sta_seen = TRUE; 1859 group->reject_4way_hs_for_entropy = FALSE; 1860 } 1861 1862 if (wpa_group_init_gmk_and_counter(wpa_auth, group) < 0 || 1863 wpa_gtk_update(wpa_auth, group) < 0 || 1864 wpa_group_config_group_keys(wpa_auth, group) < 0) { 1865 wpa_printf(MSG_INFO, "WPA: GMK/GTK setup failed"); 1866 group->first_sta_seen = FALSE; 1867 group->reject_4way_hs_for_entropy = TRUE; 1868 } 1869} 1870 1871 1872SM_STATE(WPA_PTK, AUTHENTICATION2) 1873{ 1874 SM_ENTRY_MA(WPA_PTK, AUTHENTICATION2, wpa_ptk); 1875 1876 wpa_group_ensure_init(sm->wpa_auth, sm->group); 1877 sm->ReAuthenticationRequest = FALSE; 1878 1879 /* 1880 * Definition of ANonce selection in IEEE Std 802.11i-2004 is somewhat 1881 * ambiguous. The Authenticator state machine uses a counter that is 1882 * incremented by one for each 4-way handshake. However, the security 1883 * analysis of 4-way handshake points out that unpredictable nonces 1884 * help in preventing precomputation attacks. Instead of the state 1885 * machine definition, use an unpredictable nonce value here to provide 1886 * stronger protection against potential precomputation attacks. 1887 */ 1888 if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { 1889 wpa_printf(MSG_ERROR, "WPA: Failed to get random data for " 1890 "ANonce."); 1891 sm->Disconnect = TRUE; 1892 return; 1893 } 1894 wpa_hexdump(MSG_DEBUG, "WPA: Assign ANonce", sm->ANonce, 1895 WPA_NONCE_LEN); 1896 /* IEEE 802.11i does not clear TimeoutCtr here, but this is more 1897 * logical place than INITIALIZE since AUTHENTICATION2 can be 1898 * re-entered on ReAuthenticationRequest without going through 1899 * INITIALIZE. */ 1900 sm->TimeoutCtr = 0; 1901} 1902 1903 1904static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm) 1905{ 1906 if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) { 1907 wpa_printf(MSG_ERROR, 1908 "WPA: Failed to get random data for ANonce"); 1909 sm->Disconnect = TRUE; 1910 return -1; 1911 } 1912 wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce, 1913 WPA_NONCE_LEN); 1914 sm->TimeoutCtr = 0; 1915 return 0; 1916} 1917 1918 1919SM_STATE(WPA_PTK, INITPMK) 1920{ 1921 u8 msk[2 * PMK_LEN]; 1922 size_t len = 2 * PMK_LEN; 1923 1924 SM_ENTRY_MA(WPA_PTK, INITPMK, wpa_ptk); 1925#ifdef CONFIG_IEEE80211R 1926 sm->xxkey_len = 0; 1927#endif /* CONFIG_IEEE80211R */ 1928 if (sm->pmksa) { 1929 wpa_printf(MSG_DEBUG, "WPA: PMK from PMKSA cache"); 1930 os_memcpy(sm->PMK, sm->pmksa->pmk, sm->pmksa->pmk_len); 1931 sm->pmk_len = sm->pmksa->pmk_len; 1932 } else if (wpa_auth_get_msk(sm->wpa_auth, sm->addr, msk, &len) == 0) { 1933 unsigned int pmk_len; 1934 1935 if (sm->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) 1936 pmk_len = PMK_LEN_SUITE_B_192; 1937 else 1938 pmk_len = PMK_LEN; 1939 wpa_printf(MSG_DEBUG, "WPA: PMK from EAPOL state machine " 1940 "(MSK len=%lu PMK len=%u)", (unsigned long) len, 1941 pmk_len); 1942 if (len < pmk_len) { 1943 wpa_printf(MSG_DEBUG, 1944 "WPA: MSK not long enough (%u) to create PMK (%u)", 1945 (unsigned int) len, (unsigned int) pmk_len); 1946 sm->Disconnect = TRUE; 1947 return; 1948 } 1949 os_memcpy(sm->PMK, msk, pmk_len); 1950 sm->pmk_len = pmk_len; 1951#ifdef CONFIG_IEEE80211R 1952 if (len >= 2 * PMK_LEN) { 1953 os_memcpy(sm->xxkey, msk + PMK_LEN, PMK_LEN); 1954 sm->xxkey_len = PMK_LEN; 1955 } 1956#endif /* CONFIG_IEEE80211R */ 1957 } else { 1958 wpa_printf(MSG_DEBUG, "WPA: Could not get PMK, get_msk: %p", 1959 sm->wpa_auth->cb.get_msk); 1960 sm->Disconnect = TRUE; 1961 return; 1962 } 1963 os_memset(msk, 0, sizeof(msk)); 1964 1965 sm->req_replay_counter_used = 0; 1966 /* IEEE 802.11i does not set keyRun to FALSE, but not doing this 1967 * will break reauthentication since EAPOL state machines may not be 1968 * get into AUTHENTICATING state that clears keyRun before WPA state 1969 * machine enters AUTHENTICATION2 state and goes immediately to INITPMK 1970 * state and takes PMK from the previously used AAA Key. This will 1971 * eventually fail in 4-Way Handshake because Supplicant uses PMK 1972 * derived from the new AAA Key. Setting keyRun = FALSE here seems to 1973 * be good workaround for this issue. */ 1974 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyRun, 0); 1975} 1976 1977 1978SM_STATE(WPA_PTK, INITPSK) 1979{ 1980 const u8 *psk; 1981 SM_ENTRY_MA(WPA_PTK, INITPSK, wpa_ptk); 1982 psk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, NULL); 1983 if (psk) { 1984 os_memcpy(sm->PMK, psk, PMK_LEN); 1985 sm->pmk_len = PMK_LEN; 1986#ifdef CONFIG_IEEE80211R 1987 os_memcpy(sm->xxkey, psk, PMK_LEN); 1988 sm->xxkey_len = PMK_LEN; 1989#endif /* CONFIG_IEEE80211R */ 1990 } 1991 sm->req_replay_counter_used = 0; 1992} 1993 1994 1995SM_STATE(WPA_PTK, PTKSTART) 1996{ 1997 u8 buf[2 + RSN_SELECTOR_LEN + PMKID_LEN], *pmkid = NULL; 1998 size_t pmkid_len = 0; 1999 2000 SM_ENTRY_MA(WPA_PTK, PTKSTART, wpa_ptk); 2001 sm->PTKRequest = FALSE; 2002 sm->TimeoutEvt = FALSE; 2003 sm->alt_snonce_valid = FALSE; 2004 2005 sm->TimeoutCtr++; 2006 if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) { 2007 /* No point in sending the EAPOL-Key - we will disconnect 2008 * immediately following this. */ 2009 return; 2010 } 2011 2012 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2013 "sending 1/4 msg of 4-Way Handshake"); 2014 /* 2015 * TODO: Could add PMKID even with WPA2-PSK, but only if there is only 2016 * one possible PSK for this STA. 2017 */ 2018 if (sm->wpa == WPA_VERSION_WPA2 && 2019 wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) && 2020 sm->wpa_key_mgmt != WPA_KEY_MGMT_OSEN) { 2021 pmkid = buf; 2022 pmkid_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN; 2023 pmkid[0] = WLAN_EID_VENDOR_SPECIFIC; 2024 pmkid[1] = RSN_SELECTOR_LEN + PMKID_LEN; 2025 RSN_SELECTOR_PUT(&pmkid[2], RSN_KEY_DATA_PMKID); 2026 if (sm->pmksa) { 2027 os_memcpy(&pmkid[2 + RSN_SELECTOR_LEN], 2028 sm->pmksa->pmkid, PMKID_LEN); 2029 } else if (wpa_key_mgmt_suite_b(sm->wpa_key_mgmt)) { 2030 /* No KCK available to derive PMKID */ 2031 pmkid = NULL; 2032 } else { 2033 /* 2034 * Calculate PMKID since no PMKSA cache entry was 2035 * available with pre-calculated PMKID. 2036 */ 2037 rsn_pmkid(sm->PMK, sm->pmk_len, sm->wpa_auth->addr, 2038 sm->addr, &pmkid[2 + RSN_SELECTOR_LEN], 2039 wpa_key_mgmt_sha256(sm->wpa_key_mgmt)); 2040 } 2041 } 2042 wpa_send_eapol(sm->wpa_auth, sm, 2043 WPA_KEY_INFO_ACK | WPA_KEY_INFO_KEY_TYPE, NULL, 2044 sm->ANonce, pmkid, pmkid_len, 0, 0); 2045} 2046 2047 2048static int wpa_derive_ptk(struct wpa_state_machine *sm, const u8 *snonce, 2049 const u8 *pmk, unsigned int pmk_len, 2050 struct wpa_ptk *ptk) 2051{ 2052#ifdef CONFIG_IEEE80211R 2053 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) 2054 return wpa_auth_derive_ptk_ft(sm, pmk, ptk); 2055#endif /* CONFIG_IEEE80211R */ 2056 2057 return wpa_pmk_to_ptk(pmk, pmk_len, "Pairwise key expansion", 2058 sm->wpa_auth->addr, sm->addr, sm->ANonce, snonce, 2059 ptk, sm->wpa_key_mgmt, sm->pairwise); 2060} 2061 2062 2063SM_STATE(WPA_PTK, PTKCALCNEGOTIATING) 2064{ 2065 struct wpa_ptk PTK; 2066 int ok = 0, psk_found = 0; 2067 const u8 *pmk = NULL; 2068 unsigned int pmk_len; 2069 2070 SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING, wpa_ptk); 2071 sm->EAPOLKeyReceived = FALSE; 2072 sm->update_snonce = FALSE; 2073 2074 /* WPA with IEEE 802.1X: use the derived PMK from EAP 2075 * WPA-PSK: iterate through possible PSKs and select the one matching 2076 * the packet */ 2077 for (;;) { 2078 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { 2079 pmk = wpa_auth_get_psk(sm->wpa_auth, sm->addr, 2080 sm->p2p_dev_addr, pmk); 2081 if (pmk == NULL) 2082 break; 2083 psk_found = 1; 2084 pmk_len = PMK_LEN; 2085 } else { 2086 pmk = sm->PMK; 2087 pmk_len = sm->pmk_len; 2088 } 2089 2090 wpa_derive_ptk(sm, sm->SNonce, pmk, pmk_len, &PTK); 2091 2092 if (wpa_verify_key_mic(sm->wpa_key_mgmt, &PTK, 2093 sm->last_rx_eapol_key, 2094 sm->last_rx_eapol_key_len) == 0) { 2095 ok = 1; 2096 break; 2097 } 2098 2099 if (!wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) 2100 break; 2101 } 2102 2103 if (!ok) { 2104 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2105 "invalid MIC in msg 2/4 of 4-Way Handshake"); 2106 if (psk_found) 2107 wpa_auth_psk_failure_report(sm->wpa_auth, sm->addr); 2108 return; 2109 } 2110 2111#ifdef CONFIG_IEEE80211R 2112 if (sm->wpa == WPA_VERSION_WPA2 && wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 2113 /* 2114 * Verify that PMKR1Name from EAPOL-Key message 2/4 matches 2115 * with the value we derived. 2116 */ 2117 if (os_memcmp_const(sm->sup_pmk_r1_name, sm->pmk_r1_name, 2118 WPA_PMK_NAME_LEN) != 0) { 2119 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2120 "PMKR1Name mismatch in FT 4-way " 2121 "handshake"); 2122 wpa_hexdump(MSG_DEBUG, "FT: PMKR1Name from " 2123 "Supplicant", 2124 sm->sup_pmk_r1_name, WPA_PMK_NAME_LEN); 2125 wpa_hexdump(MSG_DEBUG, "FT: Derived PMKR1Name", 2126 sm->pmk_r1_name, WPA_PMK_NAME_LEN); 2127 return; 2128 } 2129 } 2130#endif /* CONFIG_IEEE80211R */ 2131 2132 sm->pending_1_of_4_timeout = 0; 2133 eloop_cancel_timeout(wpa_send_eapol_timeout, sm->wpa_auth, sm); 2134 2135 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { 2136 /* PSK may have changed from the previous choice, so update 2137 * state machine data based on whatever PSK was selected here. 2138 */ 2139 os_memcpy(sm->PMK, pmk, PMK_LEN); 2140 sm->pmk_len = PMK_LEN; 2141 } 2142 2143 sm->MICVerified = TRUE; 2144 2145 os_memcpy(&sm->PTK, &PTK, sizeof(PTK)); 2146 sm->PTK_valid = TRUE; 2147} 2148 2149 2150SM_STATE(WPA_PTK, PTKCALCNEGOTIATING2) 2151{ 2152 SM_ENTRY_MA(WPA_PTK, PTKCALCNEGOTIATING2, wpa_ptk); 2153 sm->TimeoutCtr = 0; 2154} 2155 2156 2157#ifdef CONFIG_IEEE80211W 2158 2159static int ieee80211w_kde_len(struct wpa_state_machine *sm) 2160{ 2161 if (sm->mgmt_frame_prot) { 2162 size_t len; 2163 len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); 2164 return 2 + RSN_SELECTOR_LEN + WPA_IGTK_KDE_PREFIX_LEN + len; 2165 } 2166 2167 return 0; 2168} 2169 2170 2171static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos) 2172{ 2173 struct wpa_igtk_kde igtk; 2174 struct wpa_group *gsm = sm->group; 2175 u8 rsc[WPA_KEY_RSC_LEN]; 2176 size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); 2177 2178 if (!sm->mgmt_frame_prot) 2179 return pos; 2180 2181 igtk.keyid[0] = gsm->GN_igtk; 2182 igtk.keyid[1] = 0; 2183 if (gsm->wpa_group_state != WPA_GROUP_SETKEYSDONE || 2184 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, rsc) < 0) 2185 os_memset(igtk.pn, 0, sizeof(igtk.pn)); 2186 else 2187 os_memcpy(igtk.pn, rsc, sizeof(igtk.pn)); 2188 os_memcpy(igtk.igtk, gsm->IGTK[gsm->GN_igtk - 4], len); 2189 if (sm->wpa_auth->conf.disable_gtk) { 2190 /* 2191 * Provide unique random IGTK to each STA to prevent use of 2192 * IGTK in the BSS. 2193 */ 2194 if (random_get_bytes(igtk.igtk, len) < 0) 2195 return pos; 2196 } 2197 pos = wpa_add_kde(pos, RSN_KEY_DATA_IGTK, 2198 (const u8 *) &igtk, WPA_IGTK_KDE_PREFIX_LEN + len, 2199 NULL, 0); 2200 2201 return pos; 2202} 2203 2204#else /* CONFIG_IEEE80211W */ 2205 2206static int ieee80211w_kde_len(struct wpa_state_machine *sm) 2207{ 2208 return 0; 2209} 2210 2211 2212static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos) 2213{ 2214 return pos; 2215} 2216 2217#endif /* CONFIG_IEEE80211W */ 2218 2219 2220SM_STATE(WPA_PTK, PTKINITNEGOTIATING) 2221{ 2222 u8 rsc[WPA_KEY_RSC_LEN], *_rsc, *gtk, *kde, *pos, dummy_gtk[32]; 2223 size_t gtk_len, kde_len; 2224 struct wpa_group *gsm = sm->group; 2225 u8 *wpa_ie; 2226 int wpa_ie_len, secure, keyidx, encr = 0; 2227 2228 SM_ENTRY_MA(WPA_PTK, PTKINITNEGOTIATING, wpa_ptk); 2229 sm->TimeoutEvt = FALSE; 2230 2231 sm->TimeoutCtr++; 2232 if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) { 2233 /* No point in sending the EAPOL-Key - we will disconnect 2234 * immediately following this. */ 2235 return; 2236 } 2237 2238 /* Send EAPOL(1, 1, 1, Pair, P, RSC, ANonce, MIC(PTK), RSNIE, [MDIE], 2239 GTK[GN], IGTK, [FTIE], [TIE * 2]) 2240 */ 2241 os_memset(rsc, 0, WPA_KEY_RSC_LEN); 2242 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc); 2243 /* If FT is used, wpa_auth->wpa_ie includes both RSNIE and MDIE */ 2244 wpa_ie = sm->wpa_auth->wpa_ie; 2245 wpa_ie_len = sm->wpa_auth->wpa_ie_len; 2246 if (sm->wpa == WPA_VERSION_WPA && 2247 (sm->wpa_auth->conf.wpa & WPA_PROTO_RSN) && 2248 wpa_ie_len > wpa_ie[1] + 2 && wpa_ie[0] == WLAN_EID_RSN) { 2249 /* WPA-only STA, remove RSN IE and possible MDIE */ 2250 wpa_ie = wpa_ie + wpa_ie[1] + 2; 2251 if (wpa_ie[0] == WLAN_EID_MOBILITY_DOMAIN) 2252 wpa_ie = wpa_ie + wpa_ie[1] + 2; 2253 wpa_ie_len = wpa_ie[1] + 2; 2254 } 2255 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2256 "sending 3/4 msg of 4-Way Handshake"); 2257 if (sm->wpa == WPA_VERSION_WPA2) { 2258 /* WPA2 send GTK in the 4-way handshake */ 2259 secure = 1; 2260 gtk = gsm->GTK[gsm->GN - 1]; 2261 gtk_len = gsm->GTK_len; 2262 if (sm->wpa_auth->conf.disable_gtk) { 2263 /* 2264 * Provide unique random GTK to each STA to prevent use 2265 * of GTK in the BSS. 2266 */ 2267 if (random_get_bytes(dummy_gtk, gtk_len) < 0) 2268 return; 2269 gtk = dummy_gtk; 2270 } 2271 keyidx = gsm->GN; 2272 _rsc = rsc; 2273 encr = 1; 2274 } else { 2275 /* WPA does not include GTK in msg 3/4 */ 2276 secure = 0; 2277 gtk = NULL; 2278 gtk_len = 0; 2279 keyidx = 0; 2280 _rsc = NULL; 2281 if (sm->rx_eapol_key_secure) { 2282 /* 2283 * It looks like Windows 7 supplicant tries to use 2284 * Secure bit in msg 2/4 after having reported Michael 2285 * MIC failure and it then rejects the 4-way handshake 2286 * if msg 3/4 does not set Secure bit. Work around this 2287 * by setting the Secure bit here even in the case of 2288 * WPA if the supplicant used it first. 2289 */ 2290 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2291 "STA used Secure bit in WPA msg 2/4 - " 2292 "set Secure for 3/4 as workaround"); 2293 secure = 1; 2294 } 2295 } 2296 2297 kde_len = wpa_ie_len + ieee80211w_kde_len(sm); 2298 if (gtk) 2299 kde_len += 2 + RSN_SELECTOR_LEN + 2 + gtk_len; 2300#ifdef CONFIG_IEEE80211R 2301 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 2302 kde_len += 2 + PMKID_LEN; /* PMKR1Name into RSN IE */ 2303 kde_len += 300; /* FTIE + 2 * TIE */ 2304 } 2305#endif /* CONFIG_IEEE80211R */ 2306#ifdef CONFIG_P2P 2307 if (WPA_GET_BE32(sm->ip_addr) > 0) 2308 kde_len += 2 + RSN_SELECTOR_LEN + 3 * 4; 2309#endif /* CONFIG_P2P */ 2310 kde = os_malloc(kde_len); 2311 if (kde == NULL) 2312 return; 2313 2314 pos = kde; 2315 os_memcpy(pos, wpa_ie, wpa_ie_len); 2316 pos += wpa_ie_len; 2317#ifdef CONFIG_IEEE80211R 2318 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 2319 int res; 2320 size_t elen; 2321 2322 elen = pos - kde; 2323 res = wpa_insert_pmkid(kde, &elen, sm->pmk_r1_name); 2324 if (res < 0) { 2325 wpa_printf(MSG_ERROR, "FT: Failed to insert " 2326 "PMKR1Name into RSN IE in EAPOL-Key data"); 2327 os_free(kde); 2328 return; 2329 } 2330 pos -= wpa_ie_len; 2331 pos += elen; 2332 } 2333#endif /* CONFIG_IEEE80211R */ 2334 if (gtk) { 2335 u8 hdr[2]; 2336 hdr[0] = keyidx & 0x03; 2337 hdr[1] = 0; 2338 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, 2339 gtk, gtk_len); 2340 } 2341 pos = ieee80211w_kde_add(sm, pos); 2342 2343#ifdef CONFIG_IEEE80211R 2344 if (wpa_key_mgmt_ft(sm->wpa_key_mgmt)) { 2345 int res; 2346 struct wpa_auth_config *conf; 2347 2348 conf = &sm->wpa_auth->conf; 2349 if (sm->assoc_resp_ftie && 2350 kde + kde_len - pos >= 2 + sm->assoc_resp_ftie[1]) { 2351 os_memcpy(pos, sm->assoc_resp_ftie, 2352 2 + sm->assoc_resp_ftie[1]); 2353 res = 2 + sm->assoc_resp_ftie[1]; 2354 } else { 2355 res = wpa_write_ftie(conf, conf->r0_key_holder, 2356 conf->r0_key_holder_len, 2357 NULL, NULL, pos, 2358 kde + kde_len - pos, 2359 NULL, 0); 2360 } 2361 if (res < 0) { 2362 wpa_printf(MSG_ERROR, "FT: Failed to insert FTIE " 2363 "into EAPOL-Key Key Data"); 2364 os_free(kde); 2365 return; 2366 } 2367 pos += res; 2368 2369 /* TIE[ReassociationDeadline] (TU) */ 2370 *pos++ = WLAN_EID_TIMEOUT_INTERVAL; 2371 *pos++ = 5; 2372 *pos++ = WLAN_TIMEOUT_REASSOC_DEADLINE; 2373 WPA_PUT_LE32(pos, conf->reassociation_deadline); 2374 pos += 4; 2375 2376 /* TIE[KeyLifetime] (seconds) */ 2377 *pos++ = WLAN_EID_TIMEOUT_INTERVAL; 2378 *pos++ = 5; 2379 *pos++ = WLAN_TIMEOUT_KEY_LIFETIME; 2380 WPA_PUT_LE32(pos, conf->r0_key_lifetime * 60); 2381 pos += 4; 2382 } 2383#endif /* CONFIG_IEEE80211R */ 2384#ifdef CONFIG_P2P 2385 if (WPA_GET_BE32(sm->ip_addr) > 0) { 2386 u8 addr[3 * 4]; 2387 os_memcpy(addr, sm->ip_addr, 4); 2388 os_memcpy(addr + 4, sm->wpa_auth->conf.ip_addr_mask, 4); 2389 os_memcpy(addr + 8, sm->wpa_auth->conf.ip_addr_go, 4); 2390 pos = wpa_add_kde(pos, WFA_KEY_DATA_IP_ADDR_ALLOC, 2391 addr, sizeof(addr), NULL, 0); 2392 } 2393#endif /* CONFIG_P2P */ 2394 2395 wpa_send_eapol(sm->wpa_auth, sm, 2396 (secure ? WPA_KEY_INFO_SECURE : 0) | WPA_KEY_INFO_MIC | 2397 WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL | 2398 WPA_KEY_INFO_KEY_TYPE, 2399 _rsc, sm->ANonce, kde, pos - kde, keyidx, encr); 2400 os_free(kde); 2401} 2402 2403 2404SM_STATE(WPA_PTK, PTKINITDONE) 2405{ 2406 SM_ENTRY_MA(WPA_PTK, PTKINITDONE, wpa_ptk); 2407 sm->EAPOLKeyReceived = FALSE; 2408 if (sm->Pair) { 2409 enum wpa_alg alg = wpa_cipher_to_alg(sm->pairwise); 2410 int klen = wpa_cipher_key_len(sm->pairwise); 2411 if (wpa_auth_set_key(sm->wpa_auth, 0, alg, sm->addr, 0, 2412 sm->PTK.tk, klen)) { 2413 wpa_sta_disconnect(sm->wpa_auth, sm->addr); 2414 return; 2415 } 2416 /* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */ 2417 sm->pairwise_set = TRUE; 2418 2419 if (sm->wpa_auth->conf.wpa_ptk_rekey) { 2420 eloop_cancel_timeout(wpa_rekey_ptk, sm->wpa_auth, sm); 2421 eloop_register_timeout(sm->wpa_auth->conf. 2422 wpa_ptk_rekey, 0, wpa_rekey_ptk, 2423 sm->wpa_auth, sm); 2424 } 2425 2426 if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt)) { 2427 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, 2428 WPA_EAPOL_authorized, 1); 2429 } 2430 } 2431 2432 if (0 /* IBSS == TRUE */) { 2433 sm->keycount++; 2434 if (sm->keycount == 2) { 2435 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, 2436 WPA_EAPOL_portValid, 1); 2437 } 2438 } else { 2439 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_portValid, 2440 1); 2441 } 2442 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyAvailable, 0); 2443 wpa_auth_set_eapol(sm->wpa_auth, sm->addr, WPA_EAPOL_keyDone, 1); 2444 if (sm->wpa == WPA_VERSION_WPA) 2445 sm->PInitAKeys = TRUE; 2446 else 2447 sm->has_GTK = TRUE; 2448 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO, 2449 "pairwise key handshake completed (%s)", 2450 sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN"); 2451 2452#ifdef CONFIG_IEEE80211R 2453 wpa_ft_push_pmk_r1(sm->wpa_auth, sm->addr); 2454#endif /* CONFIG_IEEE80211R */ 2455} 2456 2457 2458SM_STEP(WPA_PTK) 2459{ 2460 struct wpa_authenticator *wpa_auth = sm->wpa_auth; 2461 2462 if (sm->Init) 2463 SM_ENTER(WPA_PTK, INITIALIZE); 2464 else if (sm->Disconnect 2465 /* || FIX: dot11RSNAConfigSALifetime timeout */) { 2466 wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, 2467 "WPA_PTK: sm->Disconnect"); 2468 SM_ENTER(WPA_PTK, DISCONNECT); 2469 } 2470 else if (sm->DeauthenticationRequest) 2471 SM_ENTER(WPA_PTK, DISCONNECTED); 2472 else if (sm->AuthenticationRequest) 2473 SM_ENTER(WPA_PTK, AUTHENTICATION); 2474 else if (sm->ReAuthenticationRequest) 2475 SM_ENTER(WPA_PTK, AUTHENTICATION2); 2476 else if (sm->PTKRequest) { 2477 if (wpa_auth_sm_ptk_update(sm) < 0) 2478 SM_ENTER(WPA_PTK, DISCONNECTED); 2479 else 2480 SM_ENTER(WPA_PTK, PTKSTART); 2481 } else switch (sm->wpa_ptk_state) { 2482 case WPA_PTK_INITIALIZE: 2483 break; 2484 case WPA_PTK_DISCONNECT: 2485 SM_ENTER(WPA_PTK, DISCONNECTED); 2486 break; 2487 case WPA_PTK_DISCONNECTED: 2488 SM_ENTER(WPA_PTK, INITIALIZE); 2489 break; 2490 case WPA_PTK_AUTHENTICATION: 2491 SM_ENTER(WPA_PTK, AUTHENTICATION2); 2492 break; 2493 case WPA_PTK_AUTHENTICATION2: 2494 if (wpa_key_mgmt_wpa_ieee8021x(sm->wpa_key_mgmt) && 2495 wpa_auth_get_eapol(sm->wpa_auth, sm->addr, 2496 WPA_EAPOL_keyRun) > 0) 2497 SM_ENTER(WPA_PTK, INITPMK); 2498 else if (wpa_key_mgmt_wpa_psk(sm->wpa_key_mgmt) 2499 /* FIX: && 802.1X::keyRun */) 2500 SM_ENTER(WPA_PTK, INITPSK); 2501 break; 2502 case WPA_PTK_INITPMK: 2503 if (wpa_auth_get_eapol(sm->wpa_auth, sm->addr, 2504 WPA_EAPOL_keyAvailable) > 0) 2505 SM_ENTER(WPA_PTK, PTKSTART); 2506 else { 2507 wpa_auth->dot11RSNA4WayHandshakeFailures++; 2508 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, 2509 "INITPMK - keyAvailable = false"); 2510 SM_ENTER(WPA_PTK, DISCONNECT); 2511 } 2512 break; 2513 case WPA_PTK_INITPSK: 2514 if (wpa_auth_get_psk(sm->wpa_auth, sm->addr, sm->p2p_dev_addr, 2515 NULL)) 2516 SM_ENTER(WPA_PTK, PTKSTART); 2517 else { 2518 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_INFO, 2519 "no PSK configured for the STA"); 2520 wpa_auth->dot11RSNA4WayHandshakeFailures++; 2521 SM_ENTER(WPA_PTK, DISCONNECT); 2522 } 2523 break; 2524 case WPA_PTK_PTKSTART: 2525 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && 2526 sm->EAPOLKeyPairwise) 2527 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); 2528 else if (sm->TimeoutCtr > 2529 (int) dot11RSNAConfigPairwiseUpdateCount) { 2530 wpa_auth->dot11RSNA4WayHandshakeFailures++; 2531 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2532 "PTKSTART: Retry limit %d reached", 2533 dot11RSNAConfigPairwiseUpdateCount); 2534 SM_ENTER(WPA_PTK, DISCONNECT); 2535 } else if (sm->TimeoutEvt) 2536 SM_ENTER(WPA_PTK, PTKSTART); 2537 break; 2538 case WPA_PTK_PTKCALCNEGOTIATING: 2539 if (sm->MICVerified) 2540 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING2); 2541 else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && 2542 sm->EAPOLKeyPairwise) 2543 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); 2544 else if (sm->TimeoutEvt) 2545 SM_ENTER(WPA_PTK, PTKSTART); 2546 break; 2547 case WPA_PTK_PTKCALCNEGOTIATING2: 2548 SM_ENTER(WPA_PTK, PTKINITNEGOTIATING); 2549 break; 2550 case WPA_PTK_PTKINITNEGOTIATING: 2551 if (sm->update_snonce) 2552 SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING); 2553 else if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && 2554 sm->EAPOLKeyPairwise && sm->MICVerified) 2555 SM_ENTER(WPA_PTK, PTKINITDONE); 2556 else if (sm->TimeoutCtr > 2557 (int) dot11RSNAConfigPairwiseUpdateCount) { 2558 wpa_auth->dot11RSNA4WayHandshakeFailures++; 2559 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2560 "PTKINITNEGOTIATING: Retry limit %d " 2561 "reached", 2562 dot11RSNAConfigPairwiseUpdateCount); 2563 SM_ENTER(WPA_PTK, DISCONNECT); 2564 } else if (sm->TimeoutEvt) 2565 SM_ENTER(WPA_PTK, PTKINITNEGOTIATING); 2566 break; 2567 case WPA_PTK_PTKINITDONE: 2568 break; 2569 } 2570} 2571 2572 2573SM_STATE(WPA_PTK_GROUP, IDLE) 2574{ 2575 SM_ENTRY_MA(WPA_PTK_GROUP, IDLE, wpa_ptk_group); 2576 if (sm->Init) { 2577 /* Init flag is not cleared here, so avoid busy 2578 * loop by claiming nothing changed. */ 2579 sm->changed = FALSE; 2580 } 2581 sm->GTimeoutCtr = 0; 2582} 2583 2584 2585SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING) 2586{ 2587 u8 rsc[WPA_KEY_RSC_LEN]; 2588 struct wpa_group *gsm = sm->group; 2589 const u8 *kde; 2590 u8 *kde_buf = NULL, *pos, hdr[2]; 2591 size_t kde_len; 2592 u8 *gtk, dummy_gtk[32]; 2593 2594 SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group); 2595 2596 sm->GTimeoutCtr++; 2597 if (sm->GTimeoutCtr > (int) dot11RSNAConfigGroupUpdateCount) { 2598 /* No point in sending the EAPOL-Key - we will disconnect 2599 * immediately following this. */ 2600 return; 2601 } 2602 2603 if (sm->wpa == WPA_VERSION_WPA) 2604 sm->PInitAKeys = FALSE; 2605 sm->TimeoutEvt = FALSE; 2606 /* Send EAPOL(1, 1, 1, !Pair, G, RSC, GNonce, MIC(PTK), GTK[GN]) */ 2607 os_memset(rsc, 0, WPA_KEY_RSC_LEN); 2608 if (gsm->wpa_group_state == WPA_GROUP_SETKEYSDONE) 2609 wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, rsc); 2610 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2611 "sending 1/2 msg of Group Key Handshake"); 2612 2613 gtk = gsm->GTK[gsm->GN - 1]; 2614 if (sm->wpa_auth->conf.disable_gtk) { 2615 /* 2616 * Provide unique random GTK to each STA to prevent use 2617 * of GTK in the BSS. 2618 */ 2619 if (random_get_bytes(dummy_gtk, gsm->GTK_len) < 0) 2620 return; 2621 gtk = dummy_gtk; 2622 } 2623 if (sm->wpa == WPA_VERSION_WPA2) { 2624 kde_len = 2 + RSN_SELECTOR_LEN + 2 + gsm->GTK_len + 2625 ieee80211w_kde_len(sm); 2626 kde_buf = os_malloc(kde_len); 2627 if (kde_buf == NULL) 2628 return; 2629 2630 kde = pos = kde_buf; 2631 hdr[0] = gsm->GN & 0x03; 2632 hdr[1] = 0; 2633 pos = wpa_add_kde(pos, RSN_KEY_DATA_GROUPKEY, hdr, 2, 2634 gtk, gsm->GTK_len); 2635 pos = ieee80211w_kde_add(sm, pos); 2636 kde_len = pos - kde; 2637 } else { 2638 kde = gtk; 2639 kde_len = gsm->GTK_len; 2640 } 2641 2642 wpa_send_eapol(sm->wpa_auth, sm, 2643 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC | 2644 WPA_KEY_INFO_ACK | 2645 (!sm->Pair ? WPA_KEY_INFO_INSTALL : 0), 2646 rsc, gsm->GNonce, kde, kde_len, gsm->GN, 1); 2647 2648 os_free(kde_buf); 2649} 2650 2651 2652SM_STATE(WPA_PTK_GROUP, REKEYESTABLISHED) 2653{ 2654 SM_ENTRY_MA(WPA_PTK_GROUP, REKEYESTABLISHED, wpa_ptk_group); 2655 sm->EAPOLKeyReceived = FALSE; 2656 if (sm->GUpdateStationKeys) 2657 sm->group->GKeyDoneStations--; 2658 sm->GUpdateStationKeys = FALSE; 2659 sm->GTimeoutCtr = 0; 2660 /* FIX: MLME.SetProtection.Request(TA, Tx_Rx) */ 2661 wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_INFO, 2662 "group key handshake completed (%s)", 2663 sm->wpa == WPA_VERSION_WPA ? "WPA" : "RSN"); 2664 sm->has_GTK = TRUE; 2665} 2666 2667 2668SM_STATE(WPA_PTK_GROUP, KEYERROR) 2669{ 2670 SM_ENTRY_MA(WPA_PTK_GROUP, KEYERROR, wpa_ptk_group); 2671 if (sm->GUpdateStationKeys) 2672 sm->group->GKeyDoneStations--; 2673 sm->GUpdateStationKeys = FALSE; 2674 sm->Disconnect = TRUE; 2675} 2676 2677 2678SM_STEP(WPA_PTK_GROUP) 2679{ 2680 if (sm->Init || sm->PtkGroupInit) { 2681 SM_ENTER(WPA_PTK_GROUP, IDLE); 2682 sm->PtkGroupInit = FALSE; 2683 } else switch (sm->wpa_ptk_group_state) { 2684 case WPA_PTK_GROUP_IDLE: 2685 if (sm->GUpdateStationKeys || 2686 (sm->wpa == WPA_VERSION_WPA && sm->PInitAKeys)) 2687 SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING); 2688 break; 2689 case WPA_PTK_GROUP_REKEYNEGOTIATING: 2690 if (sm->EAPOLKeyReceived && !sm->EAPOLKeyRequest && 2691 !sm->EAPOLKeyPairwise && sm->MICVerified) 2692 SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED); 2693 else if (sm->GTimeoutCtr > 2694 (int) dot11RSNAConfigGroupUpdateCount) 2695 SM_ENTER(WPA_PTK_GROUP, KEYERROR); 2696 else if (sm->TimeoutEvt) 2697 SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING); 2698 break; 2699 case WPA_PTK_GROUP_KEYERROR: 2700 SM_ENTER(WPA_PTK_GROUP, IDLE); 2701 break; 2702 case WPA_PTK_GROUP_REKEYESTABLISHED: 2703 SM_ENTER(WPA_PTK_GROUP, IDLE); 2704 break; 2705 } 2706} 2707 2708 2709static int wpa_gtk_update(struct wpa_authenticator *wpa_auth, 2710 struct wpa_group *group) 2711{ 2712 int ret = 0; 2713 2714 os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN); 2715 inc_byte_array(group->Counter, WPA_NONCE_LEN); 2716 if (wpa_gmk_to_gtk(group->GMK, "Group key expansion", 2717 wpa_auth->addr, group->GNonce, 2718 group->GTK[group->GN - 1], group->GTK_len) < 0) 2719 ret = -1; 2720 wpa_hexdump_key(MSG_DEBUG, "GTK", 2721 group->GTK[group->GN - 1], group->GTK_len); 2722 2723#ifdef CONFIG_IEEE80211W 2724 if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) { 2725 size_t len; 2726 len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher); 2727 os_memcpy(group->GNonce, group->Counter, WPA_NONCE_LEN); 2728 inc_byte_array(group->Counter, WPA_NONCE_LEN); 2729 if (wpa_gmk_to_gtk(group->GMK, "IGTK key expansion", 2730 wpa_auth->addr, group->GNonce, 2731 group->IGTK[group->GN_igtk - 4], len) < 0) 2732 ret = -1; 2733 wpa_hexdump_key(MSG_DEBUG, "IGTK", 2734 group->IGTK[group->GN_igtk - 4], len); 2735 } 2736#endif /* CONFIG_IEEE80211W */ 2737 2738 return ret; 2739} 2740 2741 2742static void wpa_group_gtk_init(struct wpa_authenticator *wpa_auth, 2743 struct wpa_group *group) 2744{ 2745 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " 2746 "GTK_INIT (VLAN-ID %d)", group->vlan_id); 2747 group->changed = FALSE; /* GInit is not cleared here; avoid loop */ 2748 group->wpa_group_state = WPA_GROUP_GTK_INIT; 2749 2750 /* GTK[0..N] = 0 */ 2751 os_memset(group->GTK, 0, sizeof(group->GTK)); 2752 group->GN = 1; 2753 group->GM = 2; 2754#ifdef CONFIG_IEEE80211W 2755 group->GN_igtk = 4; 2756 group->GM_igtk = 5; 2757#endif /* CONFIG_IEEE80211W */ 2758 /* GTK[GN] = CalcGTK() */ 2759 wpa_gtk_update(wpa_auth, group); 2760} 2761 2762 2763static int wpa_group_update_sta(struct wpa_state_machine *sm, void *ctx) 2764{ 2765 if (ctx != NULL && ctx != sm->group) 2766 return 0; 2767 2768 if (sm->wpa_ptk_state != WPA_PTK_PTKINITDONE) { 2769 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2770 "Not in PTKINITDONE; skip Group Key update"); 2771 sm->GUpdateStationKeys = FALSE; 2772 return 0; 2773 } 2774 if (sm->GUpdateStationKeys) { 2775 /* 2776 * This should not really happen, so add a debug log entry. 2777 * Since we clear the GKeyDoneStations before the loop, the 2778 * station needs to be counted here anyway. 2779 */ 2780 wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG, 2781 "GUpdateStationKeys was already set when " 2782 "marking station for GTK rekeying"); 2783 } 2784 2785 /* Do not rekey GTK/IGTK when STA is in WNM-Sleep Mode */ 2786 if (sm->is_wnmsleep) 2787 return 0; 2788 2789 sm->group->GKeyDoneStations++; 2790 sm->GUpdateStationKeys = TRUE; 2791 2792 wpa_sm_step(sm); 2793 return 0; 2794} 2795 2796 2797#ifdef CONFIG_WNM 2798/* update GTK when exiting WNM-Sleep Mode */ 2799void wpa_wnmsleep_rekey_gtk(struct wpa_state_machine *sm) 2800{ 2801 if (sm == NULL || sm->is_wnmsleep) 2802 return; 2803 2804 wpa_group_update_sta(sm, NULL); 2805} 2806 2807 2808void wpa_set_wnmsleep(struct wpa_state_machine *sm, int flag) 2809{ 2810 if (sm) 2811 sm->is_wnmsleep = !!flag; 2812} 2813 2814 2815int wpa_wnmsleep_gtk_subelem(struct wpa_state_machine *sm, u8 *pos) 2816{ 2817 struct wpa_group *gsm = sm->group; 2818 u8 *start = pos; 2819 2820 /* 2821 * GTK subelement: 2822 * Sub-elem ID[1] | Length[1] | Key Info[2] | Key Length[1] | RSC[8] | 2823 * Key[5..32] 2824 */ 2825 *pos++ = WNM_SLEEP_SUBELEM_GTK; 2826 *pos++ = 11 + gsm->GTK_len; 2827 /* Key ID in B0-B1 of Key Info */ 2828 WPA_PUT_LE16(pos, gsm->GN & 0x03); 2829 pos += 2; 2830 *pos++ = gsm->GTK_len; 2831 if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN, pos) != 0) 2832 return 0; 2833 pos += 8; 2834 os_memcpy(pos, gsm->GTK[gsm->GN - 1], gsm->GTK_len); 2835 pos += gsm->GTK_len; 2836 2837 wpa_printf(MSG_DEBUG, "WNM: GTK Key ID %u in WNM-Sleep Mode exit", 2838 gsm->GN); 2839 wpa_hexdump_key(MSG_DEBUG, "WNM: GTK in WNM-Sleep Mode exit", 2840 gsm->GTK[gsm->GN - 1], gsm->GTK_len); 2841 2842 return pos - start; 2843} 2844 2845 2846#ifdef CONFIG_IEEE80211W 2847int wpa_wnmsleep_igtk_subelem(struct wpa_state_machine *sm, u8 *pos) 2848{ 2849 struct wpa_group *gsm = sm->group; 2850 u8 *start = pos; 2851 size_t len = wpa_cipher_key_len(sm->wpa_auth->conf.group_mgmt_cipher); 2852 2853 /* 2854 * IGTK subelement: 2855 * Sub-elem ID[1] | Length[1] | KeyID[2] | PN[6] | Key[16] 2856 */ 2857 *pos++ = WNM_SLEEP_SUBELEM_IGTK; 2858 *pos++ = 2 + 6 + len; 2859 WPA_PUT_LE16(pos, gsm->GN_igtk); 2860 pos += 2; 2861 if (wpa_auth_get_seqnum(sm->wpa_auth, NULL, gsm->GN_igtk, pos) != 0) 2862 return 0; 2863 pos += 6; 2864 2865 os_memcpy(pos, gsm->IGTK[gsm->GN_igtk - 4], len); 2866 pos += len; 2867 2868 wpa_printf(MSG_DEBUG, "WNM: IGTK Key ID %u in WNM-Sleep Mode exit", 2869 gsm->GN_igtk); 2870 wpa_hexdump_key(MSG_DEBUG, "WNM: IGTK in WNM-Sleep Mode exit", 2871 gsm->IGTK[gsm->GN_igtk - 4], len); 2872 2873 return pos - start; 2874} 2875#endif /* CONFIG_IEEE80211W */ 2876#endif /* CONFIG_WNM */ 2877 2878 2879static void wpa_group_setkeys(struct wpa_authenticator *wpa_auth, 2880 struct wpa_group *group) 2881{ 2882 int tmp; 2883 2884 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " 2885 "SETKEYS (VLAN-ID %d)", group->vlan_id); 2886 group->changed = TRUE; 2887 group->wpa_group_state = WPA_GROUP_SETKEYS; 2888 group->GTKReKey = FALSE; 2889 tmp = group->GM; 2890 group->GM = group->GN; 2891 group->GN = tmp; 2892#ifdef CONFIG_IEEE80211W 2893 tmp = group->GM_igtk; 2894 group->GM_igtk = group->GN_igtk; 2895 group->GN_igtk = tmp; 2896#endif /* CONFIG_IEEE80211W */ 2897 /* "GKeyDoneStations = GNoStations" is done in more robust way by 2898 * counting the STAs that are marked with GUpdateStationKeys instead of 2899 * including all STAs that could be in not-yet-completed state. */ 2900 wpa_gtk_update(wpa_auth, group); 2901 2902 if (group->GKeyDoneStations) { 2903 wpa_printf(MSG_DEBUG, "wpa_group_setkeys: Unexpected " 2904 "GKeyDoneStations=%d when starting new GTK rekey", 2905 group->GKeyDoneStations); 2906 group->GKeyDoneStations = 0; 2907 } 2908 wpa_auth_for_each_sta(wpa_auth, wpa_group_update_sta, group); 2909 wpa_printf(MSG_DEBUG, "wpa_group_setkeys: GKeyDoneStations=%d", 2910 group->GKeyDoneStations); 2911} 2912 2913 2914static int wpa_group_config_group_keys(struct wpa_authenticator *wpa_auth, 2915 struct wpa_group *group) 2916{ 2917 int ret = 0; 2918 2919 if (wpa_auth_set_key(wpa_auth, group->vlan_id, 2920 wpa_cipher_to_alg(wpa_auth->conf.wpa_group), 2921 broadcast_ether_addr, group->GN, 2922 group->GTK[group->GN - 1], group->GTK_len) < 0) 2923 ret = -1; 2924 2925#ifdef CONFIG_IEEE80211W 2926 if (wpa_auth->conf.ieee80211w != NO_MGMT_FRAME_PROTECTION) { 2927 enum wpa_alg alg; 2928 size_t len; 2929 2930 alg = wpa_cipher_to_alg(wpa_auth->conf.group_mgmt_cipher); 2931 len = wpa_cipher_key_len(wpa_auth->conf.group_mgmt_cipher); 2932 2933 if (ret == 0 && 2934 wpa_auth_set_key(wpa_auth, group->vlan_id, alg, 2935 broadcast_ether_addr, group->GN_igtk, 2936 group->IGTK[group->GN_igtk - 4], len) < 0) 2937 ret = -1; 2938 } 2939#endif /* CONFIG_IEEE80211W */ 2940 2941 return ret; 2942} 2943 2944 2945static int wpa_group_disconnect_cb(struct wpa_state_machine *sm, void *ctx) 2946{ 2947 if (sm->group == ctx) { 2948 wpa_printf(MSG_DEBUG, "WPA: Mark STA " MACSTR 2949 " for discconnection due to fatal failure", 2950 MAC2STR(sm->addr)); 2951 sm->Disconnect = TRUE; 2952 } 2953 2954 return 0; 2955} 2956 2957 2958static void wpa_group_fatal_failure(struct wpa_authenticator *wpa_auth, 2959 struct wpa_group *group) 2960{ 2961 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state FATAL_FAILURE"); 2962 group->changed = TRUE; 2963 group->wpa_group_state = WPA_GROUP_FATAL_FAILURE; 2964 wpa_auth_for_each_sta(wpa_auth, wpa_group_disconnect_cb, group); 2965} 2966 2967 2968static int wpa_group_setkeysdone(struct wpa_authenticator *wpa_auth, 2969 struct wpa_group *group) 2970{ 2971 wpa_printf(MSG_DEBUG, "WPA: group state machine entering state " 2972 "SETKEYSDONE (VLAN-ID %d)", group->vlan_id); 2973 group->changed = TRUE; 2974 group->wpa_group_state = WPA_GROUP_SETKEYSDONE; 2975 2976 if (wpa_group_config_group_keys(wpa_auth, group) < 0) { 2977 wpa_group_fatal_failure(wpa_auth, group); 2978 return -1; 2979 } 2980 2981 return 0; 2982} 2983 2984 2985static void wpa_group_sm_step(struct wpa_authenticator *wpa_auth, 2986 struct wpa_group *group) 2987{ 2988 if (group->GInit) { 2989 wpa_group_gtk_init(wpa_auth, group); 2990 } else if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) { 2991 /* Do not allow group operations */ 2992 } else if (group->wpa_group_state == WPA_GROUP_GTK_INIT && 2993 group->GTKAuthenticator) { 2994 wpa_group_setkeysdone(wpa_auth, group); 2995 } else if (group->wpa_group_state == WPA_GROUP_SETKEYSDONE && 2996 group->GTKReKey) { 2997 wpa_group_setkeys(wpa_auth, group); 2998 } else if (group->wpa_group_state == WPA_GROUP_SETKEYS) { 2999 if (group->GKeyDoneStations == 0) 3000 wpa_group_setkeysdone(wpa_auth, group); 3001 else if (group->GTKReKey) 3002 wpa_group_setkeys(wpa_auth, group); 3003 } 3004} 3005 3006 3007static int wpa_sm_step(struct wpa_state_machine *sm) 3008{ 3009 if (sm == NULL) 3010 return 0; 3011 3012 if (sm->in_step_loop) { 3013 /* This should not happen, but if it does, make sure we do not 3014 * end up freeing the state machine too early by exiting the 3015 * recursive call. */ 3016 wpa_printf(MSG_ERROR, "WPA: wpa_sm_step() called recursively"); 3017 return 0; 3018 } 3019 3020 sm->in_step_loop = 1; 3021 do { 3022 if (sm->pending_deinit) 3023 break; 3024 3025 sm->changed = FALSE; 3026 sm->wpa_auth->group->changed = FALSE; 3027 3028 SM_STEP_RUN(WPA_PTK); 3029 if (sm->pending_deinit) 3030 break; 3031 SM_STEP_RUN(WPA_PTK_GROUP); 3032 if (sm->pending_deinit) 3033 break; 3034 wpa_group_sm_step(sm->wpa_auth, sm->group); 3035 } while (sm->changed || sm->wpa_auth->group->changed); 3036 sm->in_step_loop = 0; 3037 3038 if (sm->pending_deinit) { 3039 wpa_printf(MSG_DEBUG, "WPA: Completing pending STA state " 3040 "machine deinit for " MACSTR, MAC2STR(sm->addr)); 3041 wpa_free_sta_sm(sm); 3042 return 1; 3043 } 3044 return 0; 3045} 3046 3047 3048static void wpa_sm_call_step(void *eloop_ctx, void *timeout_ctx) 3049{ 3050 struct wpa_state_machine *sm = eloop_ctx; 3051 wpa_sm_step(sm); 3052} 3053 3054 3055void wpa_auth_sm_notify(struct wpa_state_machine *sm) 3056{ 3057 if (sm == NULL) 3058 return; 3059 eloop_register_timeout(0, 0, wpa_sm_call_step, sm, NULL); 3060} 3061 3062 3063void wpa_gtk_rekey(struct wpa_authenticator *wpa_auth) 3064{ 3065 int tmp, i; 3066 struct wpa_group *group; 3067 3068 if (wpa_auth == NULL) 3069 return; 3070 3071 group = wpa_auth->group; 3072 3073 for (i = 0; i < 2; i++) { 3074 tmp = group->GM; 3075 group->GM = group->GN; 3076 group->GN = tmp; 3077#ifdef CONFIG_IEEE80211W 3078 tmp = group->GM_igtk; 3079 group->GM_igtk = group->GN_igtk; 3080 group->GN_igtk = tmp; 3081#endif /* CONFIG_IEEE80211W */ 3082 wpa_gtk_update(wpa_auth, group); 3083 wpa_group_config_group_keys(wpa_auth, group); 3084 } 3085} 3086 3087 3088static const char * wpa_bool_txt(int val) 3089{ 3090 return val ? "TRUE" : "FALSE"; 3091} 3092 3093 3094#define RSN_SUITE "%02x-%02x-%02x-%d" 3095#define RSN_SUITE_ARG(s) \ 3096((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff 3097 3098int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen) 3099{ 3100 int len = 0, ret; 3101 char pmkid_txt[PMKID_LEN * 2 + 1]; 3102#ifdef CONFIG_RSN_PREAUTH 3103 const int preauth = 1; 3104#else /* CONFIG_RSN_PREAUTH */ 3105 const int preauth = 0; 3106#endif /* CONFIG_RSN_PREAUTH */ 3107 3108 if (wpa_auth == NULL) 3109 return len; 3110 3111 ret = os_snprintf(buf + len, buflen - len, 3112 "dot11RSNAOptionImplemented=TRUE\n" 3113 "dot11RSNAPreauthenticationImplemented=%s\n" 3114 "dot11RSNAEnabled=%s\n" 3115 "dot11RSNAPreauthenticationEnabled=%s\n", 3116 wpa_bool_txt(preauth), 3117 wpa_bool_txt(wpa_auth->conf.wpa & WPA_PROTO_RSN), 3118 wpa_bool_txt(wpa_auth->conf.rsn_preauth)); 3119 if (os_snprintf_error(buflen - len, ret)) 3120 return len; 3121 len += ret; 3122 3123 wpa_snprintf_hex(pmkid_txt, sizeof(pmkid_txt), 3124 wpa_auth->dot11RSNAPMKIDUsed, PMKID_LEN); 3125 3126 ret = os_snprintf( 3127 buf + len, buflen - len, 3128 "dot11RSNAConfigVersion=%u\n" 3129 "dot11RSNAConfigPairwiseKeysSupported=9999\n" 3130 /* FIX: dot11RSNAConfigGroupCipher */ 3131 /* FIX: dot11RSNAConfigGroupRekeyMethod */ 3132 /* FIX: dot11RSNAConfigGroupRekeyTime */ 3133 /* FIX: dot11RSNAConfigGroupRekeyPackets */ 3134 "dot11RSNAConfigGroupRekeyStrict=%u\n" 3135 "dot11RSNAConfigGroupUpdateCount=%u\n" 3136 "dot11RSNAConfigPairwiseUpdateCount=%u\n" 3137 "dot11RSNAConfigGroupCipherSize=%u\n" 3138 "dot11RSNAConfigPMKLifetime=%u\n" 3139 "dot11RSNAConfigPMKReauthThreshold=%u\n" 3140 "dot11RSNAConfigNumberOfPTKSAReplayCounters=0\n" 3141 "dot11RSNAConfigSATimeout=%u\n" 3142 "dot11RSNAAuthenticationSuiteSelected=" RSN_SUITE "\n" 3143 "dot11RSNAPairwiseCipherSelected=" RSN_SUITE "\n" 3144 "dot11RSNAGroupCipherSelected=" RSN_SUITE "\n" 3145 "dot11RSNAPMKIDUsed=%s\n" 3146 "dot11RSNAAuthenticationSuiteRequested=" RSN_SUITE "\n" 3147 "dot11RSNAPairwiseCipherRequested=" RSN_SUITE "\n" 3148 "dot11RSNAGroupCipherRequested=" RSN_SUITE "\n" 3149 "dot11RSNATKIPCounterMeasuresInvoked=%u\n" 3150 "dot11RSNA4WayHandshakeFailures=%u\n" 3151 "dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n", 3152 RSN_VERSION, 3153 !!wpa_auth->conf.wpa_strict_rekey, 3154 dot11RSNAConfigGroupUpdateCount, 3155 dot11RSNAConfigPairwiseUpdateCount, 3156 wpa_cipher_key_len(wpa_auth->conf.wpa_group) * 8, 3157 dot11RSNAConfigPMKLifetime, 3158 dot11RSNAConfigPMKReauthThreshold, 3159 dot11RSNAConfigSATimeout, 3160 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteSelected), 3161 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherSelected), 3162 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherSelected), 3163 pmkid_txt, 3164 RSN_SUITE_ARG(wpa_auth->dot11RSNAAuthenticationSuiteRequested), 3165 RSN_SUITE_ARG(wpa_auth->dot11RSNAPairwiseCipherRequested), 3166 RSN_SUITE_ARG(wpa_auth->dot11RSNAGroupCipherRequested), 3167 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked, 3168 wpa_auth->dot11RSNA4WayHandshakeFailures); 3169 if (os_snprintf_error(buflen - len, ret)) 3170 return len; 3171 len += ret; 3172 3173 /* TODO: dot11RSNAConfigPairwiseCiphersTable */ 3174 /* TODO: dot11RSNAConfigAuthenticationSuitesTable */ 3175 3176 /* Private MIB */ 3177 ret = os_snprintf(buf + len, buflen - len, "hostapdWPAGroupState=%d\n", 3178 wpa_auth->group->wpa_group_state); 3179 if (os_snprintf_error(buflen - len, ret)) 3180 return len; 3181 len += ret; 3182 3183 return len; 3184} 3185 3186 3187int wpa_get_mib_sta(struct wpa_state_machine *sm, char *buf, size_t buflen) 3188{ 3189 int len = 0, ret; 3190 u32 pairwise = 0; 3191 3192 if (sm == NULL) 3193 return 0; 3194 3195 /* TODO: FF-FF-FF-FF-FF-FF entry for broadcast/multicast stats */ 3196 3197 /* dot11RSNAStatsEntry */ 3198 3199 pairwise = wpa_cipher_to_suite(sm->wpa == WPA_VERSION_WPA2 ? 3200 WPA_PROTO_RSN : WPA_PROTO_WPA, 3201 sm->pairwise); 3202 if (pairwise == 0) 3203 return 0; 3204 3205 ret = os_snprintf( 3206 buf + len, buflen - len, 3207 /* TODO: dot11RSNAStatsIndex */ 3208 "dot11RSNAStatsSTAAddress=" MACSTR "\n" 3209 "dot11RSNAStatsVersion=1\n" 3210 "dot11RSNAStatsSelectedPairwiseCipher=" RSN_SUITE "\n" 3211 /* TODO: dot11RSNAStatsTKIPICVErrors */ 3212 "dot11RSNAStatsTKIPLocalMICFailures=%u\n" 3213 "dot11RSNAStatsTKIPRemoteMICFailures=%u\n" 3214 /* TODO: dot11RSNAStatsCCMPReplays */ 3215 /* TODO: dot11RSNAStatsCCMPDecryptErrors */ 3216 /* TODO: dot11RSNAStatsTKIPReplays */, 3217 MAC2STR(sm->addr), 3218 RSN_SUITE_ARG(pairwise), 3219 sm->dot11RSNAStatsTKIPLocalMICFailures, 3220 sm->dot11RSNAStatsTKIPRemoteMICFailures); 3221 if (os_snprintf_error(buflen - len, ret)) 3222 return len; 3223 len += ret; 3224 3225 /* Private MIB */ 3226 ret = os_snprintf(buf + len, buflen - len, 3227 "hostapdWPAPTKState=%d\n" 3228 "hostapdWPAPTKGroupState=%d\n", 3229 sm->wpa_ptk_state, 3230 sm->wpa_ptk_group_state); 3231 if (os_snprintf_error(buflen - len, ret)) 3232 return len; 3233 len += ret; 3234 3235 return len; 3236} 3237 3238 3239void wpa_auth_countermeasures_start(struct wpa_authenticator *wpa_auth) 3240{ 3241 if (wpa_auth) 3242 wpa_auth->dot11RSNATKIPCounterMeasuresInvoked++; 3243} 3244 3245 3246int wpa_auth_pairwise_set(struct wpa_state_machine *sm) 3247{ 3248 return sm && sm->pairwise_set; 3249} 3250 3251 3252int wpa_auth_get_pairwise(struct wpa_state_machine *sm) 3253{ 3254 return sm->pairwise; 3255} 3256 3257 3258int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm) 3259{ 3260 if (sm == NULL) 3261 return -1; 3262 return sm->wpa_key_mgmt; 3263} 3264 3265 3266int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm) 3267{ 3268 if (sm == NULL) 3269 return 0; 3270 return sm->wpa; 3271} 3272 3273 3274int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm) 3275{ 3276 if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt)) 3277 return 0; 3278 return sm->tk_already_set; 3279} 3280 3281 3282int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm, 3283 struct rsn_pmksa_cache_entry *entry) 3284{ 3285 if (sm == NULL || sm->pmksa != entry) 3286 return -1; 3287 sm->pmksa = NULL; 3288 return 0; 3289} 3290 3291 3292struct rsn_pmksa_cache_entry * 3293wpa_auth_sta_get_pmksa(struct wpa_state_machine *sm) 3294{ 3295 return sm ? sm->pmksa : NULL; 3296} 3297 3298 3299void wpa_auth_sta_local_mic_failure_report(struct wpa_state_machine *sm) 3300{ 3301 if (sm) 3302 sm->dot11RSNAStatsTKIPLocalMICFailures++; 3303} 3304 3305 3306const u8 * wpa_auth_get_wpa_ie(struct wpa_authenticator *wpa_auth, size_t *len) 3307{ 3308 if (wpa_auth == NULL) 3309 return NULL; 3310 *len = wpa_auth->wpa_ie_len; 3311 return wpa_auth->wpa_ie; 3312} 3313 3314 3315int wpa_auth_pmksa_add(struct wpa_state_machine *sm, const u8 *pmk, 3316 unsigned int pmk_len, 3317 int session_timeout, struct eapol_state_machine *eapol) 3318{ 3319 if (sm == NULL || sm->wpa != WPA_VERSION_WPA2 || 3320 sm->wpa_auth->conf.disable_pmksa_caching) 3321 return -1; 3322 3323 if (sm->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) { 3324 if (pmk_len > PMK_LEN_SUITE_B_192) 3325 pmk_len = PMK_LEN_SUITE_B_192; 3326 } else if (pmk_len > PMK_LEN) { 3327 pmk_len = PMK_LEN; 3328 } 3329 3330 if (pmksa_cache_auth_add(sm->wpa_auth->pmksa, pmk, pmk_len, NULL, 3331 sm->PTK.kck, sm->PTK.kck_len, 3332 sm->wpa_auth->addr, sm->addr, session_timeout, 3333 eapol, sm->wpa_key_mgmt)) 3334 return 0; 3335 3336 return -1; 3337} 3338 3339 3340int wpa_auth_pmksa_add_preauth(struct wpa_authenticator *wpa_auth, 3341 const u8 *pmk, size_t len, const u8 *sta_addr, 3342 int session_timeout, 3343 struct eapol_state_machine *eapol) 3344{ 3345 if (wpa_auth == NULL) 3346 return -1; 3347 3348 if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, len, NULL, 3349 NULL, 0, 3350 wpa_auth->addr, 3351 sta_addr, session_timeout, eapol, 3352 WPA_KEY_MGMT_IEEE8021X)) 3353 return 0; 3354 3355 return -1; 3356} 3357 3358 3359int wpa_auth_pmksa_add_sae(struct wpa_authenticator *wpa_auth, const u8 *addr, 3360 const u8 *pmk, const u8 *pmkid) 3361{ 3362 if (wpa_auth->conf.disable_pmksa_caching) 3363 return -1; 3364 3365 if (pmksa_cache_auth_add(wpa_auth->pmksa, pmk, PMK_LEN, pmkid, 3366 NULL, 0, 3367 wpa_auth->addr, addr, 0, NULL, 3368 WPA_KEY_MGMT_SAE)) 3369 return 0; 3370 3371 return -1; 3372} 3373 3374 3375void wpa_auth_pmksa_remove(struct wpa_authenticator *wpa_auth, 3376 const u8 *sta_addr) 3377{ 3378 struct rsn_pmksa_cache_entry *pmksa; 3379 3380 if (wpa_auth == NULL || wpa_auth->pmksa == NULL) 3381 return; 3382 pmksa = pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, NULL); 3383 if (pmksa) { 3384 wpa_printf(MSG_DEBUG, "WPA: Remove PMKSA cache entry for " 3385 MACSTR " based on request", MAC2STR(sta_addr)); 3386 pmksa_cache_free_entry(wpa_auth->pmksa, pmksa); 3387 } 3388} 3389 3390 3391int wpa_auth_pmksa_list(struct wpa_authenticator *wpa_auth, char *buf, 3392 size_t len) 3393{ 3394 if (!wpa_auth || !wpa_auth->pmksa) 3395 return 0; 3396 return pmksa_cache_auth_list(wpa_auth->pmksa, buf, len); 3397} 3398 3399 3400void wpa_auth_pmksa_flush(struct wpa_authenticator *wpa_auth) 3401{ 3402 if (wpa_auth && wpa_auth->pmksa) 3403 pmksa_cache_auth_flush(wpa_auth->pmksa); 3404} 3405 3406 3407struct rsn_pmksa_cache_entry * 3408wpa_auth_pmksa_get(struct wpa_authenticator *wpa_auth, const u8 *sta_addr) 3409{ 3410 if (!wpa_auth || !wpa_auth->pmksa) 3411 return NULL; 3412 return pmksa_cache_auth_get(wpa_auth->pmksa, sta_addr, NULL); 3413} 3414 3415 3416void wpa_auth_pmksa_set_to_sm(struct rsn_pmksa_cache_entry *pmksa, 3417 struct wpa_state_machine *sm, 3418 struct wpa_authenticator *wpa_auth, 3419 u8 *pmkid, u8 *pmk) 3420{ 3421 if (!sm) 3422 return; 3423 3424 sm->pmksa = pmksa; 3425 os_memcpy(pmk, pmksa->pmk, PMK_LEN); 3426 os_memcpy(pmkid, pmksa->pmkid, PMKID_LEN); 3427 os_memcpy(wpa_auth->dot11RSNAPMKIDUsed, pmksa->pmkid, PMKID_LEN); 3428} 3429 3430 3431/* 3432 * Remove and free the group from wpa_authenticator. This is triggered by a 3433 * callback to make sure nobody is currently iterating the group list while it 3434 * gets modified. 3435 */ 3436static void wpa_group_free(struct wpa_authenticator *wpa_auth, 3437 struct wpa_group *group) 3438{ 3439 struct wpa_group *prev = wpa_auth->group; 3440 3441 wpa_printf(MSG_DEBUG, "WPA: Remove group state machine for VLAN-ID %d", 3442 group->vlan_id); 3443 3444 while (prev) { 3445 if (prev->next == group) { 3446 /* This never frees the special first group as needed */ 3447 prev->next = group->next; 3448 os_free(group); 3449 break; 3450 } 3451 prev = prev->next; 3452 } 3453 3454} 3455 3456 3457/* Increase the reference counter for group */ 3458static void wpa_group_get(struct wpa_authenticator *wpa_auth, 3459 struct wpa_group *group) 3460{ 3461 /* Skip the special first group */ 3462 if (wpa_auth->group == group) 3463 return; 3464 3465 group->references++; 3466} 3467 3468 3469/* Decrease the reference counter and maybe free the group */ 3470static void wpa_group_put(struct wpa_authenticator *wpa_auth, 3471 struct wpa_group *group) 3472{ 3473 /* Skip the special first group */ 3474 if (wpa_auth->group == group) 3475 return; 3476 3477 group->references--; 3478 if (group->references) 3479 return; 3480 wpa_group_free(wpa_auth, group); 3481} 3482 3483 3484/* 3485 * Add a group that has its references counter set to zero. Caller needs to 3486 * call wpa_group_get() on the return value to mark the entry in use. 3487 */ 3488static struct wpa_group * 3489wpa_auth_add_group(struct wpa_authenticator *wpa_auth, int vlan_id) 3490{ 3491 struct wpa_group *group; 3492 3493 if (wpa_auth == NULL || wpa_auth->group == NULL) 3494 return NULL; 3495 3496 wpa_printf(MSG_DEBUG, "WPA: Add group state machine for VLAN-ID %d", 3497 vlan_id); 3498 group = wpa_group_init(wpa_auth, vlan_id, 0); 3499 if (group == NULL) 3500 return NULL; 3501 3502 group->next = wpa_auth->group->next; 3503 wpa_auth->group->next = group; 3504 3505 return group; 3506} 3507 3508 3509/* 3510 * Enforce that the group state machine for the VLAN is running, increase 3511 * reference counter as interface is up. References might have been increased 3512 * even if a negative value is returned. 3513 * Returns: -1 on error (group missing, group already failed); otherwise, 0 3514 */ 3515int wpa_auth_ensure_group(struct wpa_authenticator *wpa_auth, int vlan_id) 3516{ 3517 struct wpa_group *group; 3518 3519 if (wpa_auth == NULL) 3520 return 0; 3521 3522 group = wpa_auth->group; 3523 while (group) { 3524 if (group->vlan_id == vlan_id) 3525 break; 3526 group = group->next; 3527 } 3528 3529 if (group == NULL) { 3530 group = wpa_auth_add_group(wpa_auth, vlan_id); 3531 if (group == NULL) 3532 return -1; 3533 } 3534 3535 wpa_printf(MSG_DEBUG, 3536 "WPA: Ensure group state machine running for VLAN ID %d", 3537 vlan_id); 3538 3539 wpa_group_get(wpa_auth, group); 3540 group->num_setup_iface++; 3541 3542 if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) 3543 return -1; 3544 3545 return 0; 3546} 3547 3548 3549/* 3550 * Decrease reference counter, expected to be zero afterwards. 3551 * returns: -1 on error (group not found, group in fail state) 3552 * -2 if wpa_group is still referenced 3553 * 0 else 3554 */ 3555int wpa_auth_release_group(struct wpa_authenticator *wpa_auth, int vlan_id) 3556{ 3557 struct wpa_group *group; 3558 int ret = 0; 3559 3560 if (wpa_auth == NULL) 3561 return 0; 3562 3563 group = wpa_auth->group; 3564 while (group) { 3565 if (group->vlan_id == vlan_id) 3566 break; 3567 group = group->next; 3568 } 3569 3570 if (group == NULL) 3571 return -1; 3572 3573 wpa_printf(MSG_DEBUG, 3574 "WPA: Try stopping group state machine for VLAN ID %d", 3575 vlan_id); 3576 3577 if (group->num_setup_iface <= 0) { 3578 wpa_printf(MSG_ERROR, 3579 "WPA: wpa_auth_release_group called more often than wpa_auth_ensure_group for VLAN ID %d, skipping.", 3580 vlan_id); 3581 return -1; 3582 } 3583 group->num_setup_iface--; 3584 3585 if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) 3586 ret = -1; 3587 3588 if (group->references > 1) { 3589 wpa_printf(MSG_DEBUG, 3590 "WPA: Cannot stop group state machine for VLAN ID %d as references are still hold", 3591 vlan_id); 3592 ret = -2; 3593 } 3594 3595 wpa_group_put(wpa_auth, group); 3596 3597 return ret; 3598} 3599 3600 3601int wpa_auth_sta_set_vlan(struct wpa_state_machine *sm, int vlan_id) 3602{ 3603 struct wpa_group *group; 3604 3605 if (sm == NULL || sm->wpa_auth == NULL) 3606 return 0; 3607 3608 group = sm->wpa_auth->group; 3609 while (group) { 3610 if (group->vlan_id == vlan_id) 3611 break; 3612 group = group->next; 3613 } 3614 3615 if (group == NULL) { 3616 group = wpa_auth_add_group(sm->wpa_auth, vlan_id); 3617 if (group == NULL) 3618 return -1; 3619 } 3620 3621 if (sm->group == group) 3622 return 0; 3623 3624 if (group->wpa_group_state == WPA_GROUP_FATAL_FAILURE) 3625 return -1; 3626 3627 wpa_printf(MSG_DEBUG, "WPA: Moving STA " MACSTR " to use group state " 3628 "machine for VLAN ID %d", MAC2STR(sm->addr), vlan_id); 3629 3630 wpa_group_get(sm->wpa_auth, group); 3631 wpa_group_put(sm->wpa_auth, sm->group); 3632 sm->group = group; 3633 3634 return 0; 3635} 3636 3637 3638void wpa_auth_eapol_key_tx_status(struct wpa_authenticator *wpa_auth, 3639 struct wpa_state_machine *sm, int ack) 3640{ 3641 if (wpa_auth == NULL || sm == NULL) 3642 return; 3643 wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key TX status for STA " MACSTR 3644 " ack=%d", MAC2STR(sm->addr), ack); 3645 if (sm->pending_1_of_4_timeout && ack) { 3646 /* 3647 * Some deployed supplicant implementations update their SNonce 3648 * for each EAPOL-Key 2/4 message even within the same 4-way 3649 * handshake and then fail to use the first SNonce when 3650 * deriving the PTK. This results in unsuccessful 4-way 3651 * handshake whenever the relatively short initial timeout is 3652 * reached and EAPOL-Key 1/4 is retransmitted. Try to work 3653 * around this by increasing the timeout now that we know that 3654 * the station has received the frame. 3655 */ 3656 int timeout_ms = eapol_key_timeout_subseq; 3657 wpa_printf(MSG_DEBUG, "WPA: Increase initial EAPOL-Key 1/4 " 3658 "timeout by %u ms because of acknowledged frame", 3659 timeout_ms); 3660 eloop_cancel_timeout(wpa_send_eapol_timeout, wpa_auth, sm); 3661 eloop_register_timeout(timeout_ms / 1000, 3662 (timeout_ms % 1000) * 1000, 3663 wpa_send_eapol_timeout, wpa_auth, sm); 3664 } 3665} 3666 3667 3668int wpa_auth_uses_sae(struct wpa_state_machine *sm) 3669{ 3670 if (sm == NULL) 3671 return 0; 3672 return wpa_key_mgmt_sae(sm->wpa_key_mgmt); 3673} 3674 3675 3676int wpa_auth_uses_ft_sae(struct wpa_state_machine *sm) 3677{ 3678 if (sm == NULL) 3679 return 0; 3680 return sm->wpa_key_mgmt == WPA_KEY_MGMT_FT_SAE; 3681} 3682 3683 3684#ifdef CONFIG_P2P 3685int wpa_auth_get_ip_addr(struct wpa_state_machine *sm, u8 *addr) 3686{ 3687 if (sm == NULL || WPA_GET_BE32(sm->ip_addr) == 0) 3688 return -1; 3689 os_memcpy(addr, sm->ip_addr, 4); 3690 return 0; 3691} 3692#endif /* CONFIG_P2P */ 3693 3694 3695int wpa_auth_radius_das_disconnect_pmksa(struct wpa_authenticator *wpa_auth, 3696 struct radius_das_attrs *attr) 3697{ 3698 return pmksa_cache_auth_radius_das_disconnect(wpa_auth->pmksa, attr); 3699} 3700 3701 3702void wpa_auth_reconfig_group_keys(struct wpa_authenticator *wpa_auth) 3703{ 3704 struct wpa_group *group; 3705 3706 if (!wpa_auth) 3707 return; 3708 for (group = wpa_auth->group; group; group = group->next) 3709 wpa_group_config_group_keys(wpa_auth, group); 3710} 3711