LCOV - code coverage report
Current view: top level - src/rsn_supp - peerkey.c (source / functions) Hit Total Coverage
Test: wpa_supplicant/hostapd combined for hwsim test run 1422976643 Lines: 423 546 77.5 %
Date: 2015-02-03 Functions: 23 24 95.8 %

          Line data    Source code
       1             : /*
       2             :  * WPA Supplicant - PeerKey for Direct Link Setup (DLS)
       3             :  * Copyright (c) 2006-2015, Jouni Malinen <j@w1.fi>
       4             :  *
       5             :  * This software may be distributed under the terms of the BSD license.
       6             :  * See README for more details.
       7             :  */
       8             : 
       9             : #include "includes.h"
      10             : 
      11             : #ifdef CONFIG_PEERKEY
      12             : 
      13             : #include "common.h"
      14             : #include "eloop.h"
      15             : #include "crypto/sha1.h"
      16             : #include "crypto/sha256.h"
      17             : #include "crypto/random.h"
      18             : #include "common/ieee802_11_defs.h"
      19             : #include "wpa.h"
      20             : #include "wpa_i.h"
      21             : #include "wpa_ie.h"
      22             : #include "peerkey.h"
      23             : 
      24             : 
      25           7 : static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
      26             : {
      27           7 :         os_memcpy(pos, ie, ie_len);
      28           7 :         return pos + ie_len;
      29             : }
      30             : 
      31             : 
      32          14 : static u8 * wpa_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len)
      33             : {
      34          14 :         *pos++ = WLAN_EID_VENDOR_SPECIFIC;
      35          14 :         *pos++ = RSN_SELECTOR_LEN + data_len;
      36          14 :         RSN_SELECTOR_PUT(pos, kde);
      37          14 :         pos += RSN_SELECTOR_LEN;
      38          14 :         os_memcpy(pos, data, data_len);
      39          14 :         pos += data_len;
      40          14 :         return pos;
      41             : }
      42             : 
      43             : 
      44           0 : static void wpa_supplicant_smk_timeout(void *eloop_ctx, void *timeout_ctx)
      45             : {
      46             : #if 0
      47             :         struct wpa_sm *sm = eloop_ctx;
      48             :         struct wpa_peerkey *peerkey = timeout_ctx;
      49             : #endif
      50             :         /* TODO: time out SMK and any STK that was generated using this SMK */
      51           0 : }
      52             : 
      53             : 
      54           5 : static void wpa_supplicant_peerkey_free(struct wpa_sm *sm,
      55             :                                         struct wpa_peerkey *peerkey)
      56             : {
      57           5 :         eloop_cancel_timeout(wpa_supplicant_smk_timeout, sm, peerkey);
      58           5 :         os_free(peerkey);
      59           5 : }
      60             : 
      61             : 
      62           2 : static int wpa_supplicant_send_smk_error(struct wpa_sm *sm, const u8 *dst,
      63             :                                          const u8 *peer,
      64             :                                          u16 mui, u16 error_type, int ver)
      65             : {
      66             :         size_t rlen;
      67             :         struct wpa_eapol_key *err;
      68             :         struct wpa_eapol_key_192 *err192;
      69             :         struct rsn_error_kde error;
      70             :         u8 *rbuf, *pos;
      71             :         size_t kde_len;
      72             :         u16 key_info;
      73             : 
      74           2 :         kde_len = 2 + RSN_SELECTOR_LEN + sizeof(error);
      75           2 :         if (peer)
      76           2 :                 kde_len += 2 + RSN_SELECTOR_LEN + ETH_ALEN;
      77             : 
      78           2 :         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
      79             :                                   NULL, sizeof(*err) + kde_len, &rlen,
      80             :                                   (void *) &err);
      81           2 :         if (rbuf == NULL)
      82           0 :                 return -1;
      83           2 :         err192 = (struct wpa_eapol_key_192 *) err;
      84             : 
      85           2 :         err->type = EAPOL_KEY_TYPE_RSN;
      86           2 :         key_info = ver | WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
      87             :                 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_ERROR |
      88             :                 WPA_KEY_INFO_REQUEST;
      89           2 :         WPA_PUT_BE16(err->key_info, key_info);
      90           2 :         WPA_PUT_BE16(err->key_length, 0);
      91           2 :         os_memcpy(err->replay_counter, sm->request_counter,
      92             :                   WPA_REPLAY_COUNTER_LEN);
      93           2 :         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
      94             : 
      95           2 :         WPA_PUT_BE16(err->key_data_length, (u16) kde_len);
      96           2 :         pos = (u8 *) (err + 1);
      97             : 
      98           2 :         if (peer) {
      99             :                 /* Peer MAC Address KDE */
     100           2 :                 pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peer, ETH_ALEN);
     101             :         }
     102             : 
     103             :         /* Error KDE */
     104           2 :         error.mui = host_to_be16(mui);
     105           2 :         error.error_type = host_to_be16(error_type);
     106           2 :         wpa_add_kde(pos, RSN_KEY_DATA_ERROR, (u8 *) &error, sizeof(error));
     107             : 
     108           2 :         if (peer) {
     109          14 :                 wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK Error (peer "
     110             :                            MACSTR " mui %d error_type %d)",
     111          12 :                            MAC2STR(peer), mui, error_type);
     112             :         } else {
     113           0 :                 wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK Error "
     114             :                            "(mui %d error_type %d)", mui, error_type);
     115             :         }
     116             : 
     117           2 :         wpa_eapol_key_send(sm, sm->ptk.kck, sm->ptk.kck_len, ver, dst,
     118           2 :                            ETH_P_EAPOL, rbuf, rlen, err192->key_mic);
     119             : 
     120           2 :         return 0;
     121             : }
     122             : 
     123             : 
     124           1 : static int wpa_supplicant_send_smk_m3(struct wpa_sm *sm,
     125             :                                       const unsigned char *src_addr,
     126             :                                       const struct wpa_eapol_key *key,
     127             :                                       int ver, struct wpa_peerkey *peerkey)
     128             : {
     129             :         size_t rlen;
     130             :         struct wpa_eapol_key *reply;
     131             :         struct wpa_eapol_key_192 *reply192;
     132             :         u8 *rbuf, *pos;
     133             :         size_t kde_len;
     134             :         u16 key_info;
     135             : 
     136             :         /* KDEs: Peer RSN IE, Initiator MAC Address, Initiator Nonce */
     137           1 :         kde_len = peerkey->rsnie_p_len +
     138             :                 2 + RSN_SELECTOR_LEN + ETH_ALEN +
     139             :                 2 + RSN_SELECTOR_LEN + WPA_NONCE_LEN;
     140             : 
     141           1 :         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,
     142             :                                   NULL, sizeof(*reply) + kde_len, &rlen,
     143             :                                   (void *) &reply);
     144           1 :         if (rbuf == NULL)
     145           0 :                 return -1;
     146           1 :         reply192 = (struct wpa_eapol_key_192 *) reply;
     147             : 
     148           1 :         reply->type = EAPOL_KEY_TYPE_RSN;
     149           1 :         key_info = ver | WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
     150             :                 WPA_KEY_INFO_SECURE;
     151           1 :         WPA_PUT_BE16(reply->key_info, key_info);
     152           1 :         WPA_PUT_BE16(reply->key_length, 0);
     153           1 :         os_memcpy(reply->replay_counter, key->replay_counter,
     154             :                   WPA_REPLAY_COUNTER_LEN);
     155             : 
     156           1 :         os_memcpy(reply->key_nonce, peerkey->pnonce, WPA_NONCE_LEN);
     157             : 
     158           1 :         WPA_PUT_BE16(reply->key_data_length, (u16) kde_len);
     159           1 :         pos = (u8 *) (reply + 1);
     160             : 
     161             :         /* Peer RSN IE */
     162           1 :         pos = wpa_add_ie(pos, peerkey->rsnie_p, peerkey->rsnie_p_len);
     163             : 
     164             :         /* Initiator MAC Address KDE */
     165           1 :         pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peerkey->addr, ETH_ALEN);
     166             : 
     167             :         /* Initiator Nonce */
     168           1 :         wpa_add_kde(pos, RSN_KEY_DATA_NONCE, peerkey->inonce, WPA_NONCE_LEN);
     169             : 
     170           1 :         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key SMK M3");
     171           1 :         wpa_eapol_key_send(sm, sm->ptk.kck, sm->ptk.kck_len, ver, src_addr,
     172           1 :                            ETH_P_EAPOL, rbuf, rlen, reply192->key_mic);
     173             : 
     174           1 :         return 0;
     175             : }
     176             : 
     177             : 
     178           3 : static int wpa_supplicant_process_smk_m2(
     179             :         struct wpa_sm *sm, const unsigned char *src_addr,
     180             :         const struct wpa_eapol_key *key, size_t extra_len, int ver)
     181             : {
     182             :         struct wpa_peerkey *peerkey;
     183             :         struct wpa_eapol_ie_parse kde;
     184             :         struct wpa_ie_data ie;
     185             :         int cipher;
     186             :         struct rsn_ie_hdr *hdr;
     187             :         u8 *pos;
     188             : 
     189           3 :         wpa_printf(MSG_DEBUG, "RSN: Received SMK M2");
     190             : 
     191           3 :         if (!sm->peerkey_enabled || sm->proto != WPA_PROTO_RSN) {
     192           0 :                 wpa_printf(MSG_INFO, "RSN: SMK handshake not allowed for "
     193             :                            "the current network");
     194           0 :                 return -1;
     195             :         }
     196             : 
     197           3 :         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
     198             :             0) {
     199           0 :                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK M2");
     200           0 :                 return -1;
     201             :         }
     202             : 
     203           6 :         if (kde.rsn_ie == NULL || kde.mac_addr == NULL ||
     204           3 :             kde.mac_addr_len < ETH_ALEN) {
     205           0 :                 wpa_printf(MSG_INFO, "RSN: No RSN IE or MAC address KDE in "
     206             :                            "SMK M2");
     207           0 :                 return -1;
     208             :         }
     209             : 
     210          18 :         wpa_printf(MSG_DEBUG, "RSN: SMK M2 - SMK initiator " MACSTR,
     211          18 :                    MAC2STR(kde.mac_addr));
     212             : 
     213           3 :         if (kde.rsn_ie_len > PEERKEY_MAX_IE_LEN) {
     214           0 :                 wpa_printf(MSG_INFO, "RSN: Too long Initiator RSN IE in SMK "
     215             :                            "M2");
     216           0 :                 return -1;
     217             :         }
     218             : 
     219           3 :         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
     220           0 :                 wpa_printf(MSG_INFO, "RSN: Failed to parse RSN IE in SMK M2");
     221           0 :                 return -1;
     222             :         }
     223             : 
     224           6 :         cipher = wpa_pick_pairwise_cipher(ie.pairwise_cipher &
     225           3 :                                           sm->allowed_pairwise_cipher, 0);
     226           3 :         if (cipher < 0) {
     227           2 :                 wpa_printf(MSG_INFO, "RSN: No acceptable cipher in SMK M2");
     228           2 :                 wpa_supplicant_send_smk_error(sm, src_addr, kde.mac_addr,
     229             :                                               STK_MUI_SMK, STK_ERR_CPHR_NS,
     230             :                                               ver);
     231           2 :                 return -1;
     232             :         }
     233           1 :         wpa_printf(MSG_DEBUG, "RSN: Using %s for PeerKey",
     234             :                    wpa_cipher_txt(cipher));
     235             : 
     236             :         /* TODO: find existing entry and if found, use that instead of adding
     237             :          * a new one; how to handle the case where both ends initiate at the
     238             :          * same time? */
     239           1 :         peerkey = os_zalloc(sizeof(*peerkey));
     240           1 :         if (peerkey == NULL)
     241           0 :                 return -1;
     242           1 :         os_memcpy(peerkey->addr, kde.mac_addr, ETH_ALEN);
     243           1 :         os_memcpy(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN);
     244           1 :         os_memcpy(peerkey->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
     245           1 :         peerkey->rsnie_i_len = kde.rsn_ie_len;
     246           1 :         peerkey->cipher = cipher;
     247           1 :         peerkey->akmp = ie.key_mgmt;
     248             : 
     249           1 :         if (random_get_bytes(peerkey->pnonce, WPA_NONCE_LEN)) {
     250           0 :                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
     251             :                         "WPA: Failed to get random data for PNonce");
     252           0 :                 wpa_supplicant_peerkey_free(sm, peerkey);
     253           0 :                 return -1;
     254             :         }
     255             : 
     256           1 :         hdr = (struct rsn_ie_hdr *) peerkey->rsnie_p;
     257           1 :         hdr->elem_id = WLAN_EID_RSN;
     258           1 :         WPA_PUT_LE16(hdr->version, RSN_VERSION);
     259           1 :         pos = (u8 *) (hdr + 1);
     260             :         /* Group Suite can be anything for SMK RSN IE; receiver will just
     261             :          * ignore it. */
     262           1 :         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
     263           1 :         pos += RSN_SELECTOR_LEN;
     264             :         /* Include only the selected cipher in pairwise cipher suite */
     265           1 :         WPA_PUT_LE16(pos, 1);
     266           1 :         pos += 2;
     267           1 :         RSN_SELECTOR_PUT(pos, wpa_cipher_to_suite(WPA_PROTO_RSN, cipher));
     268           1 :         pos += RSN_SELECTOR_LEN;
     269             : 
     270           1 :         hdr->len = (pos - peerkey->rsnie_p) - 2;
     271           1 :         peerkey->rsnie_p_len = pos - peerkey->rsnie_p;
     272           2 :         wpa_hexdump(MSG_DEBUG, "WPA: RSN IE for SMK handshake",
     273           1 :                     peerkey->rsnie_p, peerkey->rsnie_p_len);
     274             : 
     275           1 :         wpa_supplicant_send_smk_m3(sm, src_addr, key, ver, peerkey);
     276             : 
     277           1 :         peerkey->next = sm->peerkey;
     278           1 :         sm->peerkey = peerkey;
     279             : 
     280           1 :         return 0;
     281             : }
     282             : 
     283             : 
     284             : /**
     285             :  * rsn_smkid - Derive SMK identifier
     286             :  * @smk: Station master key (32 bytes)
     287             :  * @pnonce: Peer Nonce
     288             :  * @mac_p: Peer MAC address
     289             :  * @inonce: Initiator Nonce
     290             :  * @mac_i: Initiator MAC address
     291             :  * @akmp: Negotiated AKM
     292             :  *
     293             :  * 8.5.1.4 Station to station (STK) key hierarchy
     294             :  * SMKID = HMAC-SHA1-128(SMK, "SMK Name" || PNonce || MAC_P || INonce || MAC_I)
     295             :  */
     296           2 : static void rsn_smkid(const u8 *smk, const u8 *pnonce, const u8 *mac_p,
     297             :                       const u8 *inonce, const u8 *mac_i, u8 *smkid,
     298             :                       int akmp)
     299             : {
     300           2 :         char *title = "SMK Name";
     301             :         const u8 *addr[5];
     302           2 :         const size_t len[5] = { 8, WPA_NONCE_LEN, ETH_ALEN, WPA_NONCE_LEN,
     303             :                                 ETH_ALEN };
     304             :         unsigned char hash[SHA256_MAC_LEN];
     305             : 
     306           2 :         addr[0] = (u8 *) title;
     307           2 :         addr[1] = pnonce;
     308           2 :         addr[2] = mac_p;
     309           2 :         addr[3] = inonce;
     310           2 :         addr[4] = mac_i;
     311             : 
     312             : #ifdef CONFIG_IEEE80211W
     313           2 :         if (wpa_key_mgmt_sha256(akmp))
     314           0 :                 hmac_sha256_vector(smk, PMK_LEN, 5, addr, len, hash);
     315             :         else
     316             : #endif /* CONFIG_IEEE80211W */
     317           2 :                 hmac_sha1_vector(smk, PMK_LEN, 5, addr, len, hash);
     318           2 :         os_memcpy(smkid, hash, PMKID_LEN);
     319           2 : }
     320             : 
     321             : 
     322           1 : static void wpa_supplicant_send_stk_1_of_4(struct wpa_sm *sm,
     323             :                                            struct wpa_peerkey *peerkey)
     324             : {
     325             :         size_t mlen;
     326             :         struct wpa_eapol_key *msg;
     327             :         u8 *mbuf;
     328             :         size_t kde_len;
     329             :         u16 key_info, ver;
     330             : 
     331           1 :         kde_len = 2 + RSN_SELECTOR_LEN + PMKID_LEN;
     332             : 
     333           1 :         mbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
     334             :                                   sizeof(*msg) + kde_len, &mlen,
     335             :                                   (void *) &msg);
     336           1 :         if (mbuf == NULL)
     337           0 :                 return;
     338             : 
     339           1 :         msg->type = EAPOL_KEY_TYPE_RSN;
     340             : 
     341           1 :         if (peerkey->cipher != WPA_CIPHER_TKIP)
     342           1 :                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
     343             :         else
     344           0 :                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
     345             : 
     346           1 :         key_info = ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_ACK;
     347           1 :         WPA_PUT_BE16(msg->key_info, key_info);
     348             : 
     349           1 :         if (peerkey->cipher != WPA_CIPHER_TKIP)
     350           1 :                 WPA_PUT_BE16(msg->key_length, 16);
     351             :         else
     352           0 :                 WPA_PUT_BE16(msg->key_length, 32);
     353             : 
     354           1 :         os_memcpy(msg->replay_counter, peerkey->replay_counter,
     355             :                   WPA_REPLAY_COUNTER_LEN);
     356           1 :         inc_byte_array(peerkey->replay_counter, WPA_REPLAY_COUNTER_LEN);
     357             : 
     358           1 :         WPA_PUT_BE16(msg->key_data_length, kde_len);
     359           1 :         wpa_add_kde((u8 *) (msg + 1), RSN_KEY_DATA_PMKID,
     360           1 :                     peerkey->smkid, PMKID_LEN);
     361             : 
     362           1 :         if (random_get_bytes(peerkey->inonce, WPA_NONCE_LEN)) {
     363           0 :                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
     364             :                         "RSN: Failed to get random data for INonce (STK)");
     365           0 :                 os_free(mbuf);
     366           0 :                 return;
     367             :         }
     368           1 :         wpa_hexdump(MSG_DEBUG, "RSN: INonce for STK 4-Way Handshake",
     369           1 :                     peerkey->inonce, WPA_NONCE_LEN);
     370           1 :         os_memcpy(msg->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
     371             : 
     372           6 :         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key STK 1/4 to " MACSTR,
     373           6 :                    MAC2STR(peerkey->addr));
     374           1 :         wpa_eapol_key_send(sm, NULL, 0, ver, peerkey->addr, ETH_P_EAPOL,
     375             :                            mbuf, mlen, NULL);
     376             : }
     377             : 
     378             : 
     379           1 : static void wpa_supplicant_send_stk_3_of_4(struct wpa_sm *sm,
     380             :                                            struct wpa_peerkey *peerkey)
     381             : {
     382             :         size_t mlen;
     383             :         struct wpa_eapol_key *msg;
     384             :         u8 *mbuf, *pos;
     385             :         size_t kde_len;
     386             :         u16 key_info, ver;
     387             :         be32 lifetime;
     388             : 
     389           1 :         kde_len = peerkey->rsnie_i_len +
     390             :                 2 + RSN_SELECTOR_LEN + sizeof(lifetime);
     391             : 
     392           1 :         mbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
     393             :                                   sizeof(*msg) + kde_len, &mlen,
     394             :                                   (void *) &msg);
     395           1 :         if (mbuf == NULL)
     396           1 :                 return;
     397             : 
     398           1 :         msg->type = EAPOL_KEY_TYPE_RSN;
     399             : 
     400           1 :         if (peerkey->cipher != WPA_CIPHER_TKIP)
     401           1 :                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
     402             :         else
     403           0 :                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
     404             : 
     405           1 :         key_info = ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_ACK |
     406             :                 WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE;
     407           1 :         WPA_PUT_BE16(msg->key_info, key_info);
     408             : 
     409           1 :         if (peerkey->cipher != WPA_CIPHER_TKIP)
     410           1 :                 WPA_PUT_BE16(msg->key_length, 16);
     411             :         else
     412           0 :                 WPA_PUT_BE16(msg->key_length, 32);
     413             : 
     414           1 :         os_memcpy(msg->replay_counter, peerkey->replay_counter,
     415             :                   WPA_REPLAY_COUNTER_LEN);
     416           1 :         inc_byte_array(peerkey->replay_counter, WPA_REPLAY_COUNTER_LEN);
     417             : 
     418           1 :         WPA_PUT_BE16(msg->key_data_length, kde_len);
     419           1 :         pos = (u8 *) (msg + 1);
     420           1 :         pos = wpa_add_ie(pos, peerkey->rsnie_i, peerkey->rsnie_i_len);
     421           1 :         lifetime = host_to_be32(peerkey->lifetime);
     422           1 :         wpa_add_kde(pos, RSN_KEY_DATA_LIFETIME,
     423             :                     (u8 *) &lifetime, sizeof(lifetime));
     424             : 
     425           1 :         os_memcpy(msg->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
     426             : 
     427           6 :         wpa_printf(MSG_DEBUG, "RSN: Sending EAPOL-Key STK 3/4 to " MACSTR,
     428           6 :                    MAC2STR(peerkey->addr));
     429           2 :         wpa_eapol_key_send(sm, peerkey->stk.kck, peerkey->stk.kck_len, ver,
     430           1 :                            peerkey->addr, ETH_P_EAPOL, mbuf, mlen,
     431           1 :                            msg->key_mic);
     432             : }
     433             : 
     434             : 
     435           1 : static int wpa_supplicant_process_smk_m4(struct wpa_peerkey *peerkey,
     436             :                                          struct wpa_eapol_ie_parse *kde)
     437             : {
     438           6 :         wpa_printf(MSG_DEBUG, "RSN: Received SMK M4 (Initiator " MACSTR ")",
     439           6 :                    MAC2STR(kde->mac_addr));
     440             : 
     441           1 :         if (os_memcmp(kde->smk + PMK_LEN, peerkey->pnonce, WPA_NONCE_LEN) != 0)
     442             :         {
     443           0 :                 wpa_printf(MSG_INFO, "RSN: PNonce in SMK KDE does not "
     444             :                            "match with the one used in SMK M3");
     445           0 :                 return -1;
     446             :         }
     447             : 
     448           1 :         if (os_memcmp(kde->nonce, peerkey->inonce, WPA_NONCE_LEN) != 0) {
     449           0 :                 wpa_printf(MSG_INFO, "RSN: INonce in SMK M4 did not "
     450             :                            "match with the one received in SMK M2");
     451           0 :                 return -1;
     452             :         }
     453             : 
     454           1 :         return 0;
     455             : }
     456             : 
     457             : 
     458           1 : static int wpa_supplicant_process_smk_m5(struct wpa_sm *sm,
     459             :                                          const unsigned char *src_addr,
     460             :                                          const struct wpa_eapol_key *key,
     461             :                                          int ver,
     462             :                                          struct wpa_peerkey *peerkey,
     463             :                                          struct wpa_eapol_ie_parse *kde)
     464             : {
     465             :         int cipher;
     466             :         struct wpa_ie_data ie;
     467             : 
     468           6 :         wpa_printf(MSG_DEBUG, "RSN: Received SMK M5 (Peer " MACSTR ")",
     469           6 :                    MAC2STR(kde->mac_addr));
     470           2 :         if (kde->rsn_ie == NULL || kde->rsn_ie_len > PEERKEY_MAX_IE_LEN ||
     471           1 :             wpa_parse_wpa_ie_rsn(kde->rsn_ie, kde->rsn_ie_len, &ie) < 0) {
     472           0 :                 wpa_printf(MSG_INFO, "RSN: No RSN IE in SMK M5");
     473             :                 /* TODO: abort negotiation */
     474           0 :                 return -1;
     475             :         }
     476             : 
     477           1 :         if (os_memcmp(key->key_nonce, peerkey->inonce, WPA_NONCE_LEN) != 0) {
     478           0 :                 wpa_printf(MSG_INFO, "RSN: Key Nonce in SMK M5 does "
     479             :                            "not match with INonce used in SMK M1");
     480           0 :                 return -1;
     481             :         }
     482             : 
     483           1 :         if (os_memcmp(kde->smk + PMK_LEN, peerkey->inonce, WPA_NONCE_LEN) != 0)
     484             :         {
     485           0 :                 wpa_printf(MSG_INFO, "RSN: INonce in SMK KDE does not "
     486             :                            "match with the one used in SMK M1");
     487           0 :                 return -1;
     488             :         }
     489             : 
     490           1 :         os_memcpy(peerkey->rsnie_p, kde->rsn_ie, kde->rsn_ie_len);
     491           1 :         peerkey->rsnie_p_len = kde->rsn_ie_len;
     492           1 :         os_memcpy(peerkey->pnonce, kde->nonce, WPA_NONCE_LEN);
     493             : 
     494           2 :         cipher = wpa_pick_pairwise_cipher(ie.pairwise_cipher &
     495           1 :                                           sm->allowed_pairwise_cipher, 0);
     496           1 :         if (cipher < 0) {
     497           0 :                 wpa_printf(MSG_INFO, "RSN: SMK Peer STA " MACSTR " selected "
     498           0 :                            "unacceptable cipher", MAC2STR(kde->mac_addr));
     499           0 :                 wpa_supplicant_send_smk_error(sm, src_addr, kde->mac_addr,
     500             :                                               STK_MUI_SMK, STK_ERR_CPHR_NS,
     501             :                                               ver);
     502             :                 /* TODO: abort negotiation */
     503           0 :                 return -1;
     504             :         }
     505           1 :         wpa_printf(MSG_DEBUG, "RSN: Using %s for PeerKey",
     506             :                    wpa_cipher_txt(cipher));
     507           1 :         peerkey->cipher = cipher;
     508             : 
     509           1 :         return 0;
     510             : }
     511             : 
     512             : 
     513           2 : static int wpa_supplicant_process_smk_m45(
     514             :         struct wpa_sm *sm, const unsigned char *src_addr,
     515             :         const struct wpa_eapol_key *key, size_t extra_len, int ver)
     516             : {
     517             :         struct wpa_peerkey *peerkey;
     518             :         struct wpa_eapol_ie_parse kde;
     519             :         u32 lifetime;
     520             : 
     521           2 :         if (!sm->peerkey_enabled || sm->proto != WPA_PROTO_RSN) {
     522           0 :                 wpa_printf(MSG_DEBUG, "RSN: SMK handshake not allowed for "
     523             :                            "the current network");
     524           0 :                 return -1;
     525             :         }
     526             : 
     527           2 :         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
     528             :             0) {
     529           0 :                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK M4/M5");
     530           0 :                 return -1;
     531             :         }
     532             : 
     533           4 :         if (kde.mac_addr == NULL || kde.mac_addr_len < ETH_ALEN ||
     534           6 :             kde.nonce == NULL || kde.nonce_len < WPA_NONCE_LEN ||
     535           6 :             kde.smk == NULL || kde.smk_len < PMK_LEN + WPA_NONCE_LEN ||
     536           4 :             kde.lifetime == NULL || kde.lifetime_len < 4) {
     537           0 :                 wpa_printf(MSG_INFO, "RSN: No MAC Address, Nonce, SMK, or "
     538             :                            "Lifetime KDE in SMK M4/M5");
     539           0 :                 return -1;
     540             :         }
     541             : 
     542           2 :         for (peerkey = sm->peerkey; peerkey; peerkey = peerkey->next) {
     543           4 :                 if (os_memcmp(peerkey->addr, kde.mac_addr, ETH_ALEN) == 0 &&
     544           2 :                     os_memcmp(peerkey->initiator ? peerkey->inonce :
     545             :                            peerkey->pnonce,
     546             :                            key->key_nonce, WPA_NONCE_LEN) == 0)
     547           2 :                         break;
     548             :         }
     549           2 :         if (peerkey == NULL) {
     550           0 :                 wpa_printf(MSG_INFO, "RSN: No matching SMK handshake found "
     551             :                            "for SMK M4/M5: peer " MACSTR,
     552           0 :                            MAC2STR(kde.mac_addr));
     553           0 :                 return -1;
     554             :         }
     555             : 
     556           2 :         if (peerkey->initiator) {
     557           1 :                 if (wpa_supplicant_process_smk_m5(sm, src_addr, key, ver,
     558             :                                                   peerkey, &kde) < 0)
     559           0 :                         return -1;
     560             :         } else {
     561           1 :                 if (wpa_supplicant_process_smk_m4(peerkey, &kde) < 0)
     562           0 :                         return -1;
     563             :         }
     564             : 
     565           2 :         os_memcpy(peerkey->smk, kde.smk, PMK_LEN);
     566           2 :         peerkey->smk_complete = 1;
     567           2 :         wpa_hexdump_key(MSG_DEBUG, "RSN: SMK", peerkey->smk, PMK_LEN);
     568           2 :         lifetime = WPA_GET_BE32(kde.lifetime);
     569           2 :         wpa_printf(MSG_DEBUG, "RSN: SMK lifetime %u seconds", lifetime);
     570           2 :         if (lifetime > 1000000000)
     571           0 :                 lifetime = 1000000000; /* avoid overflowing eloop time */
     572           2 :         peerkey->lifetime = lifetime;
     573           2 :         eloop_register_timeout(lifetime, 0, wpa_supplicant_smk_timeout,
     574             :                                sm, peerkey);
     575             : 
     576           2 :         if (peerkey->initiator) {
     577           2 :                 rsn_smkid(peerkey->smk, peerkey->pnonce, peerkey->addr,
     578           1 :                           peerkey->inonce, sm->own_addr, peerkey->smkid,
     579             :                           peerkey->akmp);
     580           1 :                 wpa_supplicant_send_stk_1_of_4(sm, peerkey);
     581             :         } else {
     582           2 :                 rsn_smkid(peerkey->smk, peerkey->pnonce, sm->own_addr,
     583           1 :                           peerkey->inonce, peerkey->addr, peerkey->smkid,
     584             :                           peerkey->akmp);
     585             :         }
     586           2 :         wpa_hexdump(MSG_DEBUG, "RSN: SMKID", peerkey->smkid, PMKID_LEN);
     587             : 
     588           2 :         return 0;
     589             : }
     590             : 
     591             : 
     592           3 : static int wpa_supplicant_process_smk_error(
     593             :         struct wpa_sm *sm, const unsigned char *src_addr,
     594             :         const struct wpa_eapol_key *key, size_t extra_len)
     595             : {
     596             :         struct wpa_eapol_ie_parse kde;
     597             :         struct rsn_error_kde error;
     598             :         u8 peer[ETH_ALEN];
     599             :         u16 error_type;
     600             : 
     601           3 :         wpa_printf(MSG_DEBUG, "RSN: Received SMK Error");
     602             : 
     603           3 :         if (!sm->peerkey_enabled || sm->proto != WPA_PROTO_RSN) {
     604           0 :                 wpa_printf(MSG_DEBUG, "RSN: SMK handshake not allowed for "
     605             :                            "the current network");
     606           0 :                 return -1;
     607             :         }
     608             : 
     609           3 :         if (wpa_supplicant_parse_ies((const u8 *) (key + 1), extra_len, &kde) <
     610             :             0) {
     611           0 :                 wpa_printf(MSG_INFO, "RSN: Failed to parse KDEs in SMK Error");
     612           0 :                 return -1;
     613             :         }
     614             : 
     615           3 :         if (kde.error == NULL || kde.error_len < sizeof(error)) {
     616           0 :                 wpa_printf(MSG_INFO, "RSN: No Error KDE in SMK Error");
     617           0 :                 return -1;
     618             :         }
     619             : 
     620           3 :         if (kde.mac_addr && kde.mac_addr_len >= ETH_ALEN)
     621           3 :                 os_memcpy(peer, kde.mac_addr, ETH_ALEN);
     622             :         else
     623           0 :                 os_memset(peer, 0, ETH_ALEN);
     624           3 :         os_memcpy(&error, kde.error, sizeof(error));
     625           3 :         error_type = be_to_host16(error.error_type);
     626          21 :         wpa_msg(sm->ctx->msg_ctx, MSG_INFO,
     627             :                 "RSN: SMK Error KDE received: MUI %d error_type %d peer "
     628             :                 MACSTR,
     629           3 :                 be_to_host16(error.mui), error_type,
     630          18 :                 MAC2STR(peer));
     631             : 
     632           3 :         if (kde.mac_addr &&
     633           2 :             (error_type == STK_ERR_STA_NR || error_type == STK_ERR_STA_NRSN ||
     634             :              error_type == STK_ERR_CPHR_NS)) {
     635             :                 struct wpa_peerkey *peerkey;
     636             : 
     637           3 :                 for (peerkey = sm->peerkey; peerkey; peerkey = peerkey->next) {
     638           3 :                         if (os_memcmp(peerkey->addr, kde.mac_addr, ETH_ALEN) ==
     639             :                             0)
     640           3 :                                 break;
     641             :                 }
     642           3 :                 if (peerkey == NULL) {
     643           0 :                         wpa_printf(MSG_DEBUG, "RSN: No matching SMK handshake "
     644             :                                    "found for SMK Error");
     645           0 :                         return -1;
     646             :                 }
     647             :                 /* TODO: abort SMK/STK handshake and remove all related keys */
     648             :         }
     649             : 
     650           3 :         return 0;
     651             : }
     652             : 
     653             : 
     654           1 : static void wpa_supplicant_process_stk_1_of_4(struct wpa_sm *sm,
     655             :                                               struct wpa_peerkey *peerkey,
     656             :                                               const struct wpa_eapol_key *key,
     657             :                                               u16 ver, const u8 *key_data,
     658             :                                               size_t key_data_len)
     659             : {
     660             :         struct wpa_eapol_ie_parse ie;
     661             :         size_t kde_buf_len;
     662             :         struct wpa_ptk *stk;
     663             :         u8 buf[8], *kde_buf, *pos;
     664             :         be32 lifetime;
     665             : 
     666           7 :         wpa_printf(MSG_DEBUG, "RSN: RX message 1 of STK 4-Way Handshake from "
     667           6 :                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
     668             : 
     669           1 :         os_memset(&ie, 0, sizeof(ie));
     670             : 
     671             :         /* RSN: msg 1/4 should contain SMKID for the selected SMK */
     672           1 :         wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data", key_data, key_data_len);
     673           2 :         if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0 ||
     674           1 :             ie.pmkid == NULL) {
     675           0 :                 wpa_printf(MSG_DEBUG, "RSN: No SMKID in STK 1/4");
     676           0 :                 return;
     677             :         }
     678           1 :         if (os_memcmp_const(ie.pmkid, peerkey->smkid, PMKID_LEN) != 0) {
     679           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Unknown SMKID in STK 1/4",
     680           0 :                             ie.pmkid, PMKID_LEN);
     681           0 :                 return;
     682             :         }
     683             : 
     684           1 :         if (random_get_bytes(peerkey->pnonce, WPA_NONCE_LEN)) {
     685           0 :                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
     686             :                         "RSN: Failed to get random data for PNonce");
     687           0 :                 return;
     688             :         }
     689           1 :         wpa_hexdump(MSG_DEBUG, "WPA: Renewed PNonce",
     690           1 :                     peerkey->pnonce, WPA_NONCE_LEN);
     691             : 
     692             :         /* Calculate STK which will be stored as a temporary STK until it has
     693             :          * been verified when processing message 3/4. */
     694           1 :         stk = &peerkey->tstk;
     695           2 :         wpa_pmk_to_ptk(peerkey->smk, PMK_LEN, "Peer key expansion",
     696           1 :                        sm->own_addr, peerkey->addr,
     697           1 :                        peerkey->pnonce, key->key_nonce,
     698             :                        stk, peerkey->akmp, peerkey->cipher);
     699             :         /* Supplicant: swap tx/rx Mic keys */
     700           1 :         os_memcpy(buf, &stk->tk[16], 8);
     701           1 :         os_memcpy(&stk->tk[16], &stk->tk[24], 8);
     702           1 :         os_memcpy(&stk->tk[24], buf, 8);
     703           1 :         peerkey->tstk_set = 1;
     704             : 
     705           1 :         kde_buf_len = peerkey->rsnie_p_len +
     706             :                 2 + RSN_SELECTOR_LEN + sizeof(lifetime) +
     707             :                 2 + RSN_SELECTOR_LEN + PMKID_LEN;
     708           1 :         kde_buf = os_malloc(kde_buf_len);
     709           1 :         if (kde_buf == NULL)
     710           0 :                 return;
     711           1 :         pos = kde_buf;
     712           1 :         pos = wpa_add_ie(pos, peerkey->rsnie_p, peerkey->rsnie_p_len);
     713           1 :         lifetime = host_to_be32(peerkey->lifetime);
     714           1 :         pos = wpa_add_kde(pos, RSN_KEY_DATA_LIFETIME,
     715             :                           (u8 *) &lifetime, sizeof(lifetime));
     716           1 :         wpa_add_kde(pos, RSN_KEY_DATA_PMKID, peerkey->smkid, PMKID_LEN);
     717             : 
     718           1 :         if (wpa_supplicant_send_2_of_4(sm, peerkey->addr, key, ver,
     719           1 :                                        peerkey->pnonce, kde_buf, kde_buf_len,
     720             :                                        stk)) {
     721           0 :                 os_free(kde_buf);
     722           0 :                 return;
     723             :         }
     724           1 :         os_free(kde_buf);
     725             : 
     726           1 :         os_memcpy(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN);
     727             : }
     728             : 
     729             : 
     730           2 : static void wpa_supplicant_update_smk_lifetime(struct wpa_sm *sm,
     731             :                                                struct wpa_peerkey *peerkey,
     732             :                                                struct wpa_eapol_ie_parse *kde)
     733             : {
     734             :         u32 lifetime;
     735             : 
     736           2 :         if (kde->lifetime == NULL || kde->lifetime_len < sizeof(lifetime))
     737           0 :                 return;
     738             : 
     739           2 :         lifetime = WPA_GET_BE32(kde->lifetime);
     740             : 
     741           2 :         if (lifetime >= peerkey->lifetime) {
     742           2 :                 wpa_printf(MSG_DEBUG, "RSN: Peer used SMK lifetime %u seconds "
     743             :                            "which is larger than or equal to own value %u "
     744             :                            "seconds - ignored", lifetime, peerkey->lifetime);
     745           2 :                 return;
     746             :         }
     747             : 
     748           0 :         wpa_printf(MSG_DEBUG, "RSN: Peer used shorter SMK lifetime %u seconds "
     749             :                    "(own was %u seconds) - updated",
     750             :                    lifetime, peerkey->lifetime);
     751           0 :         peerkey->lifetime = lifetime;
     752             : 
     753           0 :         eloop_cancel_timeout(wpa_supplicant_smk_timeout, sm, peerkey);
     754           0 :         eloop_register_timeout(lifetime, 0, wpa_supplicant_smk_timeout,
     755             :                                sm, peerkey);
     756             : }
     757             : 
     758             : 
     759           1 : static void wpa_supplicant_process_stk_2_of_4(struct wpa_sm *sm,
     760             :                                               struct wpa_peerkey *peerkey,
     761             :                                               const struct wpa_eapol_key *key,
     762             :                                               u16 ver, const u8 *key_data,
     763             :                                               size_t key_data_len)
     764             : {
     765             :         struct wpa_eapol_ie_parse kde;
     766             : 
     767           7 :         wpa_printf(MSG_DEBUG, "RSN: RX message 2 of STK 4-Way Handshake from "
     768           6 :                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
     769             : 
     770           1 :         os_memset(&kde, 0, sizeof(kde));
     771             : 
     772             :         /* RSN: msg 2/4 should contain SMKID for the selected SMK and RSN IE
     773             :          * from the peer. It may also include Lifetime KDE. */
     774           1 :         wpa_hexdump(MSG_DEBUG, "RSN: msg 2/4 key data", key_data, key_data_len);
     775           2 :         if (wpa_supplicant_parse_ies(key_data, key_data_len, &kde) < 0 ||
     776           2 :             kde.pmkid == NULL || kde.rsn_ie == NULL) {
     777           0 :                 wpa_printf(MSG_DEBUG, "RSN: No SMKID or RSN IE in STK 2/4");
     778           0 :                 return;
     779             :         }
     780             : 
     781           1 :         if (os_memcmp_const(kde.pmkid, peerkey->smkid, PMKID_LEN) != 0) {
     782           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Unknown SMKID in STK 2/4",
     783           0 :                             kde.pmkid, PMKID_LEN);
     784           0 :                 return;
     785             :         }
     786             : 
     787           2 :         if (kde.rsn_ie_len != peerkey->rsnie_p_len ||
     788           1 :             os_memcmp(kde.rsn_ie, peerkey->rsnie_p, kde.rsn_ie_len) != 0) {
     789           0 :                 wpa_printf(MSG_INFO, "RSN: Peer RSN IE in SMK and STK "
     790             :                            "handshakes did not match");
     791           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Peer RSN IE in SMK handshake",
     792           0 :                             peerkey->rsnie_p, peerkey->rsnie_p_len);
     793           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Peer RSN IE in STK handshake",
     794           0 :                             kde.rsn_ie, kde.rsn_ie_len);
     795           0 :                 return;
     796             :         }
     797             : 
     798           1 :         wpa_supplicant_update_smk_lifetime(sm, peerkey, &kde);
     799             : 
     800           1 :         wpa_supplicant_send_stk_3_of_4(sm, peerkey);
     801           1 :         os_memcpy(peerkey->pnonce, key->key_nonce, WPA_NONCE_LEN);
     802             : }
     803             : 
     804             : 
     805           1 : static void wpa_supplicant_process_stk_3_of_4(struct wpa_sm *sm,
     806             :                                               struct wpa_peerkey *peerkey,
     807             :                                               const struct wpa_eapol_key *key,
     808             :                                               u16 ver, const u8 *key_data,
     809             :                                               size_t key_data_len)
     810             : {
     811             :         struct wpa_eapol_ie_parse kde;
     812             :         size_t key_len;
     813             :         const u8 *_key;
     814             :         u8 key_buf[32], rsc[6];
     815             : 
     816           7 :         wpa_printf(MSG_DEBUG, "RSN: RX message 3 of STK 4-Way Handshake from "
     817           6 :                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
     818             : 
     819           1 :         os_memset(&kde, 0, sizeof(kde));
     820             : 
     821             :         /* RSN: msg 3/4 should contain Initiator RSN IE. It may also include
     822             :          * Lifetime KDE. */
     823           1 :         wpa_hexdump(MSG_DEBUG, "RSN: msg 3/4 key data", key_data, key_data_len);
     824           1 :         if (wpa_supplicant_parse_ies(key_data, key_data_len, &kde) < 0) {
     825           0 :                 wpa_printf(MSG_DEBUG, "RSN: Failed to parse key data in "
     826             :                            "STK 3/4");
     827           0 :                 return;
     828             :         }
     829             : 
     830           2 :         if (kde.rsn_ie_len != peerkey->rsnie_i_len ||
     831           1 :             os_memcmp(kde.rsn_ie, peerkey->rsnie_i, kde.rsn_ie_len) != 0) {
     832           0 :                 wpa_printf(MSG_INFO, "RSN: Initiator RSN IE in SMK and STK "
     833             :                            "handshakes did not match");
     834           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Initiator RSN IE in SMK "
     835             :                             "handshake",
     836           0 :                             peerkey->rsnie_i, peerkey->rsnie_i_len);
     837           0 :                 wpa_hexdump(MSG_DEBUG, "RSN: Initiator RSN IE in STK "
     838             :                             "handshake",
     839           0 :                             kde.rsn_ie, kde.rsn_ie_len);
     840           0 :                 return;
     841             :         }
     842             : 
     843           1 :         if (os_memcmp(peerkey->inonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
     844           0 :                 wpa_printf(MSG_WARNING, "RSN: INonce from message 1 of STK "
     845             :                            "4-Way Handshake differs from 3 of STK 4-Way "
     846             :                            "Handshake - drop packet (src=" MACSTR ")",
     847           0 :                            MAC2STR(peerkey->addr));
     848           0 :                 return;
     849             :         }
     850             : 
     851           1 :         wpa_supplicant_update_smk_lifetime(sm, peerkey, &kde);
     852             : 
     853           2 :         if (wpa_supplicant_send_4_of_4(sm, peerkey->addr, key, ver,
     854           1 :                                        WPA_GET_BE16(key->key_info),
     855             :                                        &peerkey->stk))
     856           0 :                 return;
     857             : 
     858           1 :         _key = peerkey->stk.tk;
     859           1 :         if (peerkey->cipher == WPA_CIPHER_TKIP) {
     860             :                 /* Swap Tx/Rx keys for Michael MIC */
     861           0 :                 os_memcpy(key_buf, _key, 16);
     862           0 :                 os_memcpy(key_buf + 16, _key + 24, 8);
     863           0 :                 os_memcpy(key_buf + 24, _key + 16, 8);
     864           0 :                 _key = key_buf;
     865           0 :                 key_len = 32;
     866             :         } else
     867           1 :                 key_len = 16;
     868             : 
     869           1 :         os_memset(rsc, 0, 6);
     870           1 :         if (wpa_sm_set_key(sm, peerkey->cipher, peerkey->addr, 0, 1,
     871             :                            rsc, sizeof(rsc), _key, key_len) < 0) {
     872           1 :                 os_memset(key_buf, 0, sizeof(key_buf));
     873           1 :                 wpa_printf(MSG_WARNING, "RSN: Failed to set STK to the "
     874             :                            "driver.");
     875           1 :                 return;
     876             :         }
     877           0 :         os_memset(key_buf, 0, sizeof(key_buf));
     878             : }
     879             : 
     880             : 
     881           1 : static void wpa_supplicant_process_stk_4_of_4(struct wpa_sm *sm,
     882             :                                               struct wpa_peerkey *peerkey,
     883             :                                               const struct wpa_eapol_key *key,
     884             :                                               u16 ver)
     885             : {
     886             :         u8 rsc[6];
     887             : 
     888           7 :         wpa_printf(MSG_DEBUG, "RSN: RX message 4 of STK 4-Way Handshake from "
     889           6 :                    MACSTR " (ver=%d)", MAC2STR(peerkey->addr), ver);
     890             : 
     891           1 :         os_memset(rsc, 0, 6);
     892           2 :         if (wpa_sm_set_key(sm, peerkey->cipher, peerkey->addr, 0, 1,
     893           1 :                            rsc, sizeof(rsc), peerkey->stk.tk,
     894           1 :                            peerkey->cipher == WPA_CIPHER_TKIP ? 32 : 16) < 0) {
     895           1 :                 wpa_printf(MSG_WARNING, "RSN: Failed to set STK to the "
     896             :                            "driver.");
     897           1 :                 return;
     898             :         }
     899             : }
     900             : 
     901             : 
     902             : /**
     903             :  * peerkey_verify_eapol_key_mic - Verify PeerKey MIC
     904             :  * @sm: Pointer to WPA state machine data from wpa_sm_init()
     905             :  * @peerkey: Pointer to the PeerKey data for the peer
     906             :  * @key: Pointer to the EAPOL-Key frame header
     907             :  * @ver: Version bits from EAPOL-Key Key Info
     908             :  * @buf: Pointer to the beginning of EAPOL-Key frame
     909             :  * @len: Length of the EAPOL-Key frame
     910             :  * Returns: 0 on success, -1 on failure
     911             :  */
     912           3 : int peerkey_verify_eapol_key_mic(struct wpa_sm *sm,
     913             :                                  struct wpa_peerkey *peerkey,
     914             :                                  struct wpa_eapol_key_192 *key, u16 ver,
     915             :                                  const u8 *buf, size_t len)
     916             : {
     917             :         u8 mic[WPA_EAPOL_KEY_MIC_MAX_LEN];
     918           3 :         size_t mic_len = 16;
     919           3 :         int ok = 0;
     920             : 
     921           3 :         if (peerkey->initiator && !peerkey->stk_set) {
     922           2 :                 wpa_pmk_to_ptk(peerkey->smk, PMK_LEN, "Peer key expansion",
     923           1 :                                sm->own_addr, peerkey->addr,
     924           1 :                                peerkey->inonce, key->key_nonce,
     925             :                                &peerkey->stk, peerkey->akmp, peerkey->cipher);
     926           1 :                 peerkey->stk_set = 1;
     927             :         }
     928             : 
     929           3 :         os_memcpy(mic, key->key_mic, mic_len);
     930           3 :         if (peerkey->tstk_set) {
     931           1 :                 os_memset(key->key_mic, 0, mic_len);
     932           2 :                 wpa_eapol_key_mic(peerkey->tstk.kck, peerkey->tstk.kck_len,
     933           2 :                                   sm->key_mgmt, ver, buf, len, key->key_mic);
     934           1 :                 if (os_memcmp_const(mic, key->key_mic, mic_len) != 0) {
     935           0 :                         wpa_printf(MSG_WARNING, "RSN: Invalid EAPOL-Key MIC "
     936             :                                    "when using TSTK - ignoring TSTK");
     937             :                 } else {
     938           1 :                         ok = 1;
     939           1 :                         peerkey->tstk_set = 0;
     940           1 :                         peerkey->stk_set = 1;
     941           1 :                         os_memcpy(&peerkey->stk, &peerkey->tstk,
     942             :                                   sizeof(peerkey->stk));
     943           1 :                         os_memset(&peerkey->tstk, 0, sizeof(peerkey->tstk));
     944             :                 }
     945             :         }
     946             : 
     947           3 :         if (!ok && peerkey->stk_set) {
     948           2 :                 os_memset(key->key_mic, 0, mic_len);
     949           4 :                 wpa_eapol_key_mic(peerkey->stk.kck, peerkey->stk.kck_len,
     950           4 :                                   sm->key_mgmt, ver, buf, len, key->key_mic);
     951           2 :                 if (os_memcmp_const(mic, key->key_mic, mic_len) != 0) {
     952           0 :                         wpa_printf(MSG_WARNING, "RSN: Invalid EAPOL-Key MIC "
     953             :                                    "- dropping packet");
     954           0 :                         return -1;
     955             :                 }
     956           2 :                 ok = 1;
     957             :         }
     958             : 
     959           3 :         if (!ok) {
     960           0 :                 wpa_printf(MSG_WARNING, "RSN: Could not verify EAPOL-Key MIC "
     961             :                            "- dropping packet");
     962           0 :                 return -1;
     963             :         }
     964             : 
     965           3 :         os_memcpy(peerkey->replay_counter, key->replay_counter,
     966             :                   WPA_REPLAY_COUNTER_LEN);
     967           3 :         peerkey->replay_counter_set = 1;
     968           3 :         return 0;
     969             : }
     970             : 
     971             : 
     972             : /**
     973             :  * wpa_sm_stkstart - Send EAPOL-Key Request for STK handshake (STK M1)
     974             :  * @sm: Pointer to WPA state machine data from wpa_sm_init()
     975             :  * @peer: MAC address of the peer STA
     976             :  * Returns: 0 on success, or -1 on failure
     977             :  *
     978             :  * Send an EAPOL-Key Request to the current authenticator to start STK
     979             :  * handshake with the peer.
     980             :  */
     981           5 : int wpa_sm_stkstart(struct wpa_sm *sm, const u8 *peer)
     982             : {
     983             :         size_t rlen, kde_len;
     984             :         struct wpa_eapol_key *req;
     985             :         int key_info, ver;
     986             :         u8 bssid[ETH_ALEN], *rbuf, *pos, *count_pos;
     987             :         u16 count;
     988             :         struct rsn_ie_hdr *hdr;
     989             :         struct wpa_peerkey *peerkey;
     990             :         struct wpa_ie_data ie;
     991             : 
     992           5 :         if (sm->proto != WPA_PROTO_RSN || !sm->ptk_set || !sm->peerkey_enabled)
     993           1 :                 return -1;
     994             : 
     995           8 :         if (sm->ap_rsn_ie &&
     996           8 :             wpa_parse_wpa_ie_rsn(sm->ap_rsn_ie, sm->ap_rsn_ie_len, &ie) == 0 &&
     997           4 :             !(ie.capabilities & WPA_CAPABILITY_PEERKEY_ENABLED)) {
     998           0 :                 wpa_printf(MSG_DEBUG, "RSN: Current AP does not support STK");
     999           0 :                 return -1;
    1000             :         }
    1001             : 
    1002           4 :         if (sm->pairwise_cipher != WPA_CIPHER_TKIP)
    1003           3 :                 ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
    1004             :         else
    1005           1 :                 ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
    1006             : 
    1007           4 :         if (wpa_sm_get_bssid(sm, bssid) < 0) {
    1008           0 :                 wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
    1009             :                            "SMK M1");
    1010           0 :                 return -1;
    1011             :         }
    1012             : 
    1013             :         /* TODO: find existing entry and if found, use that instead of adding
    1014             :          * a new one */
    1015           4 :         peerkey = os_zalloc(sizeof(*peerkey));
    1016           4 :         if (peerkey == NULL)
    1017           0 :                 return -1;
    1018           4 :         peerkey->initiator = 1;
    1019           4 :         os_memcpy(peerkey->addr, peer, ETH_ALEN);
    1020           4 :         peerkey->akmp = sm->key_mgmt;
    1021             : 
    1022             :         /* SMK M1:
    1023             :          * EAPOL-Key(S=1, M=1, A=0, I=0, K=0, SM=1, KeyRSC=0, Nonce=INonce,
    1024             :          *           MIC=MIC, DataKDs=(RSNIE_I, MAC_P KDE))
    1025             :          */
    1026             : 
    1027           4 :         hdr = (struct rsn_ie_hdr *) peerkey->rsnie_i;
    1028           4 :         hdr->elem_id = WLAN_EID_RSN;
    1029           4 :         WPA_PUT_LE16(hdr->version, RSN_VERSION);
    1030           4 :         pos = (u8 *) (hdr + 1);
    1031             :         /* Group Suite can be anything for SMK RSN IE; receiver will just
    1032             :          * ignore it. */
    1033           4 :         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
    1034           4 :         pos += RSN_SELECTOR_LEN;
    1035           4 :         count_pos = pos;
    1036           4 :         pos += 2;
    1037             : 
    1038           4 :         count = rsn_cipher_put_suites(pos, sm->allowed_pairwise_cipher);
    1039           4 :         pos += count * RSN_SELECTOR_LEN;
    1040           4 :         WPA_PUT_LE16(count_pos, count);
    1041             : 
    1042           4 :         hdr->len = (pos - peerkey->rsnie_i) - 2;
    1043           4 :         peerkey->rsnie_i_len = pos - peerkey->rsnie_i;
    1044           8 :         wpa_hexdump(MSG_DEBUG, "WPA: RSN IE for SMK handshake",
    1045           4 :                     peerkey->rsnie_i, peerkey->rsnie_i_len);
    1046             : 
    1047           4 :         kde_len = peerkey->rsnie_i_len + 2 + RSN_SELECTOR_LEN + ETH_ALEN;
    1048             : 
    1049           4 :         rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,
    1050             :                                   sizeof(*req) + kde_len, &rlen,
    1051             :                                   (void *) &req);
    1052           4 :         if (rbuf == NULL) {
    1053           0 :                 wpa_supplicant_peerkey_free(sm, peerkey);
    1054           0 :                 return -1;
    1055             :         }
    1056             : 
    1057           4 :         req->type = EAPOL_KEY_TYPE_RSN;
    1058           4 :         key_info = WPA_KEY_INFO_SMK_MESSAGE | WPA_KEY_INFO_MIC |
    1059             :                 WPA_KEY_INFO_SECURE | WPA_KEY_INFO_REQUEST | ver;
    1060           4 :         WPA_PUT_BE16(req->key_info, key_info);
    1061           4 :         WPA_PUT_BE16(req->key_length, 0);
    1062           4 :         os_memcpy(req->replay_counter, sm->request_counter,
    1063             :                   WPA_REPLAY_COUNTER_LEN);
    1064           4 :         inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);
    1065             : 
    1066           4 :         if (random_get_bytes(peerkey->inonce, WPA_NONCE_LEN)) {
    1067           0 :                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
    1068             :                         "WPA: Failed to get random data for INonce");
    1069           0 :                 os_free(rbuf);
    1070           0 :                 wpa_supplicant_peerkey_free(sm, peerkey);
    1071           0 :                 return -1;
    1072             :         }
    1073           4 :         os_memcpy(req->key_nonce, peerkey->inonce, WPA_NONCE_LEN);
    1074           4 :         wpa_hexdump(MSG_DEBUG, "WPA: INonce for SMK handshake",
    1075           4 :                     req->key_nonce, WPA_NONCE_LEN);
    1076             : 
    1077           4 :         WPA_PUT_BE16(req->key_data_length, (u16) kde_len);
    1078           4 :         pos = (u8 *) (req + 1);
    1079             : 
    1080             :         /* Initiator RSN IE */
    1081           4 :         pos = wpa_add_ie(pos, peerkey->rsnie_i, peerkey->rsnie_i_len);
    1082             :         /* Peer MAC address KDE */
    1083           4 :         wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peer, ETH_ALEN);
    1084             : 
    1085          24 :         wpa_printf(MSG_INFO, "RSN: Sending EAPOL-Key SMK M1 Request (peer "
    1086          24 :                    MACSTR ")", MAC2STR(peer));
    1087           4 :         wpa_eapol_key_send(sm, sm->ptk.kck, sm->ptk.kck_len, ver, bssid,
    1088           4 :                            ETH_P_EAPOL, rbuf, rlen, req->key_mic);
    1089             : 
    1090           4 :         peerkey->next = sm->peerkey;
    1091           4 :         sm->peerkey = peerkey;
    1092             : 
    1093           4 :         return 0;
    1094             : }
    1095             : 
    1096             : 
    1097             : /**
    1098             :  * peerkey_deinit - Free PeerKey values
    1099             :  * @sm: Pointer to WPA state machine data from wpa_sm_init()
    1100             :  */
    1101        2536 : void peerkey_deinit(struct wpa_sm *sm)
    1102             : {
    1103        2536 :         struct wpa_peerkey *prev, *peerkey = sm->peerkey;
    1104        5077 :         while (peerkey) {
    1105           5 :                 prev = peerkey;
    1106           5 :                 peerkey = peerkey->next;
    1107           5 :                 wpa_supplicant_peerkey_free(sm, prev);
    1108             :         }
    1109        2536 :         sm->peerkey = NULL;
    1110        2536 : }
    1111             : 
    1112             : 
    1113           4 : void peerkey_rx_eapol_4way(struct wpa_sm *sm, struct wpa_peerkey *peerkey,
    1114             :                            struct wpa_eapol_key *key, u16 key_info, u16 ver,
    1115             :                            const u8 *key_data, size_t key_data_len)
    1116             : {
    1117           4 :         if ((key_info & (WPA_KEY_INFO_MIC | WPA_KEY_INFO_ACK)) ==
    1118             :             (WPA_KEY_INFO_MIC | WPA_KEY_INFO_ACK)) {
    1119             :                 /* 3/4 STK 4-Way Handshake */
    1120           1 :                 wpa_supplicant_process_stk_3_of_4(sm, peerkey, key, ver,
    1121             :                                                   key_data, key_data_len);
    1122           3 :         } else if (key_info & WPA_KEY_INFO_ACK) {
    1123             :                 /* 1/4 STK 4-Way Handshake */
    1124           1 :                 wpa_supplicant_process_stk_1_of_4(sm, peerkey, key, ver,
    1125             :                                                   key_data, key_data_len);
    1126           2 :         } else if (key_info & WPA_KEY_INFO_SECURE) {
    1127             :                 /* 4/4 STK 4-Way Handshake */
    1128           1 :                 wpa_supplicant_process_stk_4_of_4(sm, peerkey, key, ver);
    1129             :         } else {
    1130             :                 /* 2/4 STK 4-Way Handshake */
    1131           1 :                 wpa_supplicant_process_stk_2_of_4(sm, peerkey, key, ver,
    1132             :                                                   key_data, key_data_len);
    1133             :         }
    1134           4 : }
    1135             : 
    1136             : 
    1137           8 : void peerkey_rx_eapol_smk(struct wpa_sm *sm, const u8 *src_addr,
    1138             :                           struct wpa_eapol_key *key, size_t extra_len,
    1139             :                           u16 key_info, u16 ver)
    1140             : {
    1141           8 :         if (key_info & WPA_KEY_INFO_ERROR) {
    1142             :                 /* SMK Error */
    1143           3 :                 wpa_supplicant_process_smk_error(sm, src_addr, key, extra_len);
    1144           5 :         } else if (key_info & WPA_KEY_INFO_ACK) {
    1145             :                 /* SMK M2 */
    1146           3 :                 wpa_supplicant_process_smk_m2(sm, src_addr, key, extra_len,
    1147             :                                               ver);
    1148             :         } else {
    1149             :                 /* SMK M4 or M5 */
    1150           2 :                 wpa_supplicant_process_smk_m45(sm, src_addr, key, extra_len,
    1151             :                                                ver);
    1152             :         }
    1153           8 : }
    1154             : 
    1155             : #endif /* CONFIG_PEERKEY */

Generated by: LCOV version 1.10