1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
8  * Sun elects to license this software under the BSD license.
9  * See README for more details.
10  */
11 
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <time.h>
16 #include <netinet/in.h>
17 #include <sys/ethernet.h>
18 #include <fcntl.h>
19 #include <unistd.h>
20 
21 #include "wpa_impl.h"
22 #include "wpa_enc.h"
23 #include "driver.h"
24 #include "eloop.h"
25 #include "l2_packet.h"
26 
27 static void pmksa_cache_set_expiration(struct wpa_supplicant *);
28 
29 /*
30  * IEEE 802.11i/D3.0
31  */
32 static const int WPA_SELECTOR_LEN = 4;
33 static const uint8_t WPA_OUI_AND_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
34 static const uint8_t
35 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] 		= { 0x00, 0x50, 0xf2, 1 };
36 static const uint8_t
37 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] 		= { 0x00, 0x50, 0xf2, 2 };
38 static const uint8_t WPA_CIPHER_SUITE_NONE[]	= { 0x00, 0x50, 0xf2, 0 };
39 static const uint8_t WPA_CIPHER_SUITE_WEP40[]	= { 0x00, 0x50, 0xf2, 1 };
40 static const uint8_t WPA_CIPHER_SUITE_TKIP[]	= { 0x00, 0x50, 0xf2, 2 };
41 static const uint8_t WPA_CIPHER_SUITE_CCMP[]	= { 0x00, 0x50, 0xf2, 4 };
42 static const uint8_t WPA_CIPHER_SUITE_WEP104[]	= { 0x00, 0x50, 0xf2, 5 };
43 
44 /*
45  * WPA IE version 1
46  * 00-50-f2:1 (OUI:OUI type)
47  * 0x01 0x00 (version; little endian)
48  * (all following fields are optional:)
49  * Group Suite Selector (4 octets) (default: TKIP)
50  * Pairwise Suite Count (2 octets, little endian) (default: 1)
51  * Pairwise Suite List (4 * n octets) (default: TKIP)
52  * Authenticated Key Management Suite Count (2 octets, little endian)
53  * (default: 1)
54  * Authenticated Key Management Suite List (4 * n octets)
55  * (default: unspec 802.1x)
56  * WPA Capabilities (2 octets, little endian) (default: 0)
57  */
58 #pragma pack(1)
59 struct wpa_ie_hdr {
60 	uint8_t		elem_id;
61 	uint8_t		len;
62 	uint8_t		oui[3];
63 	uint8_t		oui_type;
64 	uint16_t	version;
65 };
66 #pragma pack()
67 
68 /*
69  * IEEE 802.11i/D9.0
70  */
71 static const int RSN_SELECTOR_LEN = 4;
72 static const uint16_t RSN_VERSION = 1;
73 static const uint8_t
74 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[]		= { 0x00, 0x0f, 0xac, 1 };
75 static const uint8_t
76 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[]		= { 0x00, 0x0f, 0xac, 2 };
77 static const uint8_t RSN_CIPHER_SUITE_NONE[]	= { 0x00, 0x0f, 0xac, 0 };
78 static const uint8_t RSN_CIPHER_SUITE_WEP40[]	= { 0x00, 0x0f, 0xac, 1 };
79 static const uint8_t RSN_CIPHER_SUITE_TKIP[]	= { 0x00, 0x0f, 0xac, 2 };
80 static const uint8_t RSN_CIPHER_SUITE_CCMP[]	= { 0x00, 0x0f, 0xac, 4 };
81 static const uint8_t RSN_CIPHER_SUITE_WEP104[]	= { 0x00, 0x0f, 0xac, 5 };
82 
83 /*
84  * EAPOL-Key Key Data Encapsulation
85  * GroupKey and STAKey require encryption, otherwise, encryption is optional.
86  */
87 static const uint8_t RSN_KEY_DATA_GROUPKEY[]	= { 0x00, 0x0f, 0xac, 1 };
88 static const uint8_t RSN_KEY_DATA_PMKID[]	= { 0x00, 0x0f, 0xac, 4 };
89 
90 /*
91  * 1/4: PMKID
92  * 2/4: RSN IE
93  * 3/4: one or two RSN IEs + GTK IE (encrypted)
94  * 4/4: empty
95  * 1/2: GTK IE (encrypted)
96  * 2/2: empty
97  */
98 
99 /*
100  * RSN IE version 1
101  * 0x01 0x00 (version; little endian)
102  * (all following fields are optional:)
103  * Group Suite Selector (4 octets) (default: CCMP)
104  * Pairwise Suite Count (2 octets, little endian) (default: 1)
105  * Pairwise Suite List (4 * n octets) (default: CCMP)
106  * Authenticated Key Management Suite Count (2 octets, little endian)
107  *    (default: 1)
108  * Authenticated Key Management Suite List (4 * n octets)
109  *    (default: unspec 802.1x)
110  * RSN Capabilities (2 octets, little endian) (default: 0)
111  * PMKID Count (2 octets) (default: 0)
112  * PMKID List (16 * n octets)
113  */
114 #pragma pack(1)
115 struct rsn_ie_hdr {
116 	uint8_t		elem_id; /* WLAN_EID_RSN */
117 	uint8_t		len;
118 	uint16_t	version;
119 };
120 #pragma pack()
121 
122 static int
random_get_pseudo_bytes(uint8_t * ptr,size_t len)123 random_get_pseudo_bytes(uint8_t *ptr, size_t len)
124 {
125 	int fd;
126 	size_t resid = len;
127 	size_t bytes;
128 
129 	fd = open("/dev/urandom", O_RDONLY);
130 	if (fd == -1) {
131 		wpa_printf(MSG_ERROR, "Could not open /dev/urandom.\n");
132 		return (-1);
133 	}
134 
135 	while (resid != 0) {
136 		bytes = read(fd, ptr, resid);
137 		ptr += bytes;
138 		resid -= bytes;
139 	}
140 
141 	(void) close(fd);
142 
143 	return (0);
144 }
145 
146 static void
inc_byte_array(uint8_t * counter,size_t len)147 inc_byte_array(uint8_t *counter, size_t len)
148 {
149 	int pos = len - 1;
150 	while (pos >= 0) {
151 		counter[pos]++;
152 		if (counter[pos] != 0)
153 			break;
154 		pos--;
155 	}
156 }
157 
158 static int
wpa_selector_to_bitfield(uint8_t * s)159 wpa_selector_to_bitfield(uint8_t *s)
160 {
161 	if (memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == 0)
162 		return (WPA_CIPHER_NONE);
163 	if (memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == 0)
164 		return (WPA_CIPHER_WEP40);
165 	if (memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == 0)
166 		return (WPA_CIPHER_TKIP);
167 	if (memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == 0)
168 		return (WPA_CIPHER_CCMP);
169 	if (memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == 0)
170 		return (WPA_CIPHER_WEP104);
171 	return (0);
172 }
173 
174 static int
wpa_key_mgmt_to_bitfield(uint8_t * s)175 wpa_key_mgmt_to_bitfield(uint8_t *s)
176 {
177 	if (memcmp(s, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X, WPA_SELECTOR_LEN) == 0)
178 		return (WPA_KEY_MGMT_IEEE8021X);
179 	if (memcmp(s, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X, WPA_SELECTOR_LEN) ==
180 	    0)
181 		return (WPA_KEY_MGMT_PSK);
182 	return (0);
183 }
184 
185 static int
rsn_selector_to_bitfield(uint8_t * s)186 rsn_selector_to_bitfield(uint8_t *s)
187 {
188 	if (memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == 0)
189 		return (WPA_CIPHER_NONE);
190 	if (memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == 0)
191 		return (WPA_CIPHER_WEP40);
192 	if (memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == 0)
193 		return (WPA_CIPHER_TKIP);
194 	if (memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == 0)
195 		return (WPA_CIPHER_CCMP);
196 	if (memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == 0)
197 		return (WPA_CIPHER_WEP104);
198 	return (0);
199 }
200 
201 static int
rsn_key_mgmt_to_bitfield(uint8_t * s)202 rsn_key_mgmt_to_bitfield(uint8_t *s)
203 {
204 	if (memcmp(s, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X, RSN_SELECTOR_LEN) == 0)
205 		return (WPA_KEY_MGMT_IEEE8021X);
206 	if (memcmp(s, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X, RSN_SELECTOR_LEN) ==
207 	    0)
208 		return (WPA_KEY_MGMT_PSK);
209 	return (0);
210 }
211 
212 static void
pmksa_cache_free_entry(struct wpa_supplicant * wpa_s,struct rsn_pmksa_cache * entry)213 pmksa_cache_free_entry(struct wpa_supplicant *wpa_s,
214 	struct rsn_pmksa_cache *entry)
215 {
216 	wpa_s->pmksa_count--;
217 	if (wpa_s->cur_pmksa == entry) {
218 		wpa_printf(MSG_DEBUG, "RSN: removed current PMKSA entry");
219 		wpa_s->cur_pmksa = NULL;
220 	}
221 	free(entry);
222 }
223 
224 /* ARGSUSED */
225 static void
pmksa_cache_expire(void * eloop_ctx,void * timeout_ctx)226 pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
227 {
228 	struct wpa_supplicant *wpa_s = eloop_ctx;
229 	time_t now;
230 
231 	(void) time(&now);
232 	while (wpa_s->pmksa && wpa_s->pmksa->expiration <= now) {
233 		struct rsn_pmksa_cache *entry = wpa_s->pmksa;
234 		wpa_s->pmksa = entry->next;
235 		wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for "
236 		    MACSTR, MAC2STR(entry->aa));
237 		pmksa_cache_free_entry(wpa_s, entry);
238 	}
239 
240 	pmksa_cache_set_expiration(wpa_s);
241 }
242 
243 static void
pmksa_cache_set_expiration(struct wpa_supplicant * wpa_s)244 pmksa_cache_set_expiration(struct wpa_supplicant *wpa_s)
245 {
246 	int sec;
247 	eloop_cancel_timeout(pmksa_cache_expire, wpa_s, NULL);
248 	if (wpa_s->pmksa == NULL)
249 		return;
250 	sec = wpa_s->pmksa->expiration - time(NULL);
251 	if (sec < 0)
252 		sec = 0;
253 	(void) eloop_register_timeout(sec + 1, 0, pmksa_cache_expire,
254 	    wpa_s, NULL);
255 }
256 
257 void
pmksa_cache_free(struct wpa_supplicant * wpa_s)258 pmksa_cache_free(struct wpa_supplicant *wpa_s)
259 {
260 	struct rsn_pmksa_cache *entry, *prev;
261 
262 	entry = wpa_s->pmksa;
263 	wpa_s->pmksa = NULL;
264 	while (entry) {
265 		prev = entry;
266 		entry = entry->next;
267 		free(prev);
268 	}
269 	pmksa_cache_set_expiration(wpa_s);
270 	wpa_s->cur_pmksa = NULL;
271 }
272 
273 struct rsn_pmksa_cache *
pmksa_cache_get(struct wpa_supplicant * wpa_s,uint8_t * aa,uint8_t * pmkid)274 pmksa_cache_get(struct wpa_supplicant *wpa_s,
275 		uint8_t *aa, uint8_t *pmkid)
276 {
277 	struct rsn_pmksa_cache *entry = wpa_s->pmksa;
278 	while (entry) {
279 		if ((aa == NULL ||
280 		    memcmp(entry->aa, aa, IEEE80211_ADDR_LEN) == 0) &&
281 		    (pmkid == NULL ||
282 		    memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0))
283 			return (entry);
284 		entry = entry->next;
285 	}
286 	return (NULL);
287 }
288 
289 int
pmksa_cache_list(struct wpa_supplicant * wpa_s,char * buf,size_t len)290 pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf, size_t len)
291 {
292 	int i, j;
293 	char *pos = buf;
294 	struct rsn_pmksa_cache *entry;
295 	time_t now;
296 
297 	(void) time(&now);
298 	pos += snprintf(pos, buf + len - pos,
299 	    "Index / AA / PMKID / expiration (in seconds)\n");
300 	i = 0;
301 	entry = wpa_s->pmksa;
302 	while (entry) {
303 		i++;
304 		pos += snprintf(pos, buf + len - pos, "%d " MACSTR " ",
305 		    i, MAC2STR(entry->aa));
306 		for (j = 0; j < PMKID_LEN; j++)
307 			pos += snprintf(pos, buf + len - pos, "%02x",
308 			    entry->pmkid[j]);
309 		pos += snprintf(pos, buf + len - pos, " %d\n",
310 		    (int)(entry->expiration - now));
311 		entry = entry->next;
312 	}
313 	return (pos - buf);
314 }
315 
316 void
pmksa_candidate_free(struct wpa_supplicant * wpa_s)317 pmksa_candidate_free(struct wpa_supplicant *wpa_s)
318 {
319 	struct rsn_pmksa_candidate *entry, *prev;
320 
321 	entry = wpa_s->pmksa_candidates;
322 	wpa_s->pmksa_candidates = NULL;
323 	while (entry) {
324 		prev = entry;
325 		entry = entry->next;
326 		free(prev);
327 	}
328 }
329 
330 /* ARGSUSED */
331 static int
wpa_parse_wpa_ie_wpa(struct wpa_supplicant * wpa_s,uint8_t * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)332 wpa_parse_wpa_ie_wpa(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie,
333     size_t wpa_ie_len, struct wpa_ie_data *data)
334 {
335 	struct wpa_ie_hdr *hdr;
336 	uint8_t *pos;
337 	int left;
338 	int i, count;
339 
340 	data->proto = WPA_PROTO_WPA;
341 	data->pairwise_cipher = WPA_CIPHER_TKIP;
342 	data->group_cipher = WPA_CIPHER_TKIP;
343 	data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
344 	data->capabilities = 0;
345 
346 	if (wpa_ie_len == 0) {
347 		/* No WPA IE - fail silently */
348 		return (-1);
349 	}
350 
351 	if (wpa_ie_len < sizeof (struct wpa_ie_hdr)) {
352 		wpa_printf(MSG_DEBUG, "%s: ie len too short %u",
353 		    "wpa_parse_wpa_ie_wpa", wpa_ie_len);
354 		return (-1);
355 	}
356 
357 	hdr = (struct wpa_ie_hdr *)wpa_ie;
358 
359 	if (hdr->elem_id != GENERIC_INFO_ELEM ||
360 	    hdr->len != wpa_ie_len - 2 ||
361 	    memcmp(&hdr->oui, WPA_OUI_AND_TYPE, WPA_SELECTOR_LEN) != 0 ||
362 	    LE_16(hdr->version) != WPA_VERSION) {
363 		wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
364 		    "wpa_parse_wpa_ie_wpa");
365 		return (-1);
366 	}
367 
368 	pos = (uint8_t *)(hdr + 1);
369 	left = wpa_ie_len - sizeof (*hdr);
370 
371 	if (left >= WPA_SELECTOR_LEN) {
372 		data->group_cipher = wpa_selector_to_bitfield(pos);
373 		pos += WPA_SELECTOR_LEN;
374 		left -= WPA_SELECTOR_LEN;
375 	} else if (left > 0) {
376 		wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
377 		    "wpa_parse_wpa_ie_wpa", left);
378 		return (-1);
379 	}
380 
381 	if (left >= 2) {
382 		data->pairwise_cipher = 0;
383 		count = pos[0] | (pos[1] << 8);
384 		pos += 2;
385 		left -= 2;
386 		if (count == 0 || left < count * WPA_SELECTOR_LEN) {
387 			wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
388 			    "count %u left %u",
389 			    "wpa_parse_wpa_ie_wpa", count, left);
390 			return (-1);
391 		}
392 		for (i = 0; i < count; i++) {
393 			data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
394 			pos += WPA_SELECTOR_LEN;
395 			left -= WPA_SELECTOR_LEN;
396 		}
397 	} else if (left == 1) {
398 		wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
399 		    "wpa_parse_wpa_ie_wpa");
400 		return (-1);
401 	}
402 
403 	if (left >= 2) {
404 		data->key_mgmt = 0;
405 		count = pos[0] | (pos[1] << 8);
406 		pos += 2;
407 		left -= 2;
408 		if (count == 0 || left < count * WPA_SELECTOR_LEN) {
409 			wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
410 			    "count %u left %u",
411 			    "wpa_parse_wpa_ie_wpa", count, left);
412 			return (-1);
413 		}
414 		for (i = 0; i < count; i++) {
415 			data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
416 			pos += WPA_SELECTOR_LEN;
417 			left -= WPA_SELECTOR_LEN;
418 		}
419 	} else if (left == 1) {
420 		wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
421 		    "wpa_parse_wpa_ie_wpa");
422 		return (-1);
423 	}
424 
425 	if (left >= 2) {
426 		data->capabilities = pos[0] | (pos[1] << 8);
427 		pos += 2;
428 		left -= 2;
429 	}
430 
431 	if (left > 0) {
432 		wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes",
433 		    "wpa_parse_wpa_ie_wpa", left);
434 		return (-1);
435 	}
436 
437 	return (0);
438 }
439 
440 /* ARGSUSED */
441 static int
wpa_parse_wpa_ie_rsn(struct wpa_supplicant * wpa_s,uint8_t * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)442 wpa_parse_wpa_ie_rsn(struct wpa_supplicant *wpa_s, uint8_t *rsn_ie,
443     size_t rsn_ie_len, struct wpa_ie_data *data)
444 {
445 	struct rsn_ie_hdr *hdr;
446 	uint8_t *pos;
447 	int left;
448 	int i, count;
449 
450 	data->proto = WPA_PROTO_RSN;
451 	data->pairwise_cipher = WPA_CIPHER_CCMP;
452 	data->group_cipher = WPA_CIPHER_CCMP;
453 	data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
454 	data->capabilities = 0;
455 
456 	if (rsn_ie_len == 0) {
457 		/* No RSN IE - fail silently */
458 		return (-1);
459 	}
460 
461 	if (rsn_ie_len < sizeof (struct rsn_ie_hdr)) {
462 		wpa_printf(MSG_DEBUG, "%s: ie len too short %u",
463 		    "wpa_parse_wpa_ie_rsn", rsn_ie_len);
464 		return (-1);
465 	}
466 
467 	hdr = (struct rsn_ie_hdr *)rsn_ie;
468 
469 	if (hdr->elem_id != RSN_INFO_ELEM ||
470 	    hdr->len != rsn_ie_len - 2 ||
471 	    LE_16(hdr->version) != RSN_VERSION) {
472 		wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
473 		    "wpa_parse_wpa_ie_rsn");
474 		return (-1);
475 	}
476 
477 	pos = (uint8_t *)(hdr + 1);
478 	left = rsn_ie_len - sizeof (*hdr);
479 
480 	if (left >= RSN_SELECTOR_LEN) {
481 		data->group_cipher = rsn_selector_to_bitfield(pos);
482 		pos += RSN_SELECTOR_LEN;
483 		left -= RSN_SELECTOR_LEN;
484 	} else if (left > 0) {
485 		wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
486 		    "wpa_parse_wpa_ie_rsn", left);
487 		return (-1);
488 	}
489 
490 	if (left >= 2) {
491 		data->pairwise_cipher = 0;
492 		count = pos[0] | (pos[1] << 8);
493 		pos += 2;
494 		left -= 2;
495 		if (count == 0 || left < count * RSN_SELECTOR_LEN) {
496 			wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
497 			    "count %u left %u",
498 			    "wpa_parse_wpa_ie_rsn", count, left);
499 			return (-1);
500 		}
501 		for (i = 0; i < count; i++) {
502 			data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
503 			pos += RSN_SELECTOR_LEN;
504 			left -= RSN_SELECTOR_LEN;
505 		}
506 	} else if (left == 1) {
507 		wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
508 		    "wpa_parse_wpa_ie_rsn");
509 		return (-1);
510 	}
511 
512 	if (left >= 2) {
513 		data->key_mgmt = 0;
514 		count = pos[0] | (pos[1] << 8);
515 		pos += 2;
516 		left -= 2;
517 		if (count == 0 || left < count * RSN_SELECTOR_LEN) {
518 			wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
519 			    "count %u left %u",
520 			    "wpa_parse_wpa_ie_rsn", count, left);
521 			return (-1);
522 		}
523 		for (i = 0; i < count; i++) {
524 			data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
525 			pos += RSN_SELECTOR_LEN;
526 			left -= RSN_SELECTOR_LEN;
527 		}
528 	} else if (left == 1) {
529 		wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
530 		    "wpa_parse_wpa_ie_rsn");
531 		return (-1);
532 	}
533 
534 	if (left >= 2) {
535 		data->capabilities = pos[0] | (pos[1] << 8);
536 		pos += 2;
537 		left -= 2;
538 	}
539 
540 	if (left > 0) {
541 		/*
542 		 * RSN IE could include PMKID data, but Authenticator should
543 		 * never include it, so no need to parse it in the Supplicant.
544 		 */
545 		wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
546 		    "wpa_parse_wpa_ie_rsn", left);
547 	}
548 
549 	return (0);
550 }
551 
552 int
wpa_parse_wpa_ie(struct wpa_supplicant * wpa_s,uint8_t * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)553 wpa_parse_wpa_ie(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie,
554     size_t wpa_ie_len, struct wpa_ie_data *data)
555 {
556 	if (wpa_ie_len >= 1 && wpa_ie[0] == RSN_INFO_ELEM)
557 		return (wpa_parse_wpa_ie_rsn(wpa_s, wpa_ie, wpa_ie_len, data));
558 	else
559 		return (wpa_parse_wpa_ie_wpa(wpa_s, wpa_ie, wpa_ie_len, data));
560 }
561 
562 static int
wpa_gen_wpa_ie_wpa(struct wpa_supplicant * wpa_s,uint8_t * wpa_ie)563 wpa_gen_wpa_ie_wpa(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie)
564 {
565 	uint8_t *pos;
566 	struct wpa_ie_hdr *hdr;
567 
568 	hdr = (struct wpa_ie_hdr *)wpa_ie;
569 	hdr->elem_id = GENERIC_INFO_ELEM;
570 	(void) memcpy(&hdr->oui, WPA_OUI_AND_TYPE, WPA_SELECTOR_LEN);
571 	hdr->version = LE_16(WPA_VERSION);
572 	pos = (uint8_t *)(hdr + 1);
573 
574 	if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
575 		(void) memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
576 	} else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
577 		(void) memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
578 	} else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
579 		(void) memcpy(pos, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN);
580 	} else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
581 		(void) memcpy(pos, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN);
582 	} else {
583 		wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
584 		    wpa_s->group_cipher);
585 		return (-1);
586 	}
587 	pos += WPA_SELECTOR_LEN;
588 
589 	*pos++ = 1;
590 	*pos++ = 0;
591 	if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
592 		(void) memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
593 	} else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
594 		(void) memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
595 	} else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
596 		(void) memcpy(pos, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN);
597 	} else {
598 		wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
599 		    wpa_s->pairwise_cipher);
600 		return (-1);
601 	}
602 	pos += WPA_SELECTOR_LEN;
603 
604 	*pos++ = 1;
605 	*pos++ = 0;
606 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
607 		(void) memcpy(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X,
608 		    WPA_SELECTOR_LEN);
609 	} else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
610 		(void) memcpy(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X,
611 		    WPA_SELECTOR_LEN);
612 	} else {
613 		wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
614 		    wpa_s->key_mgmt);
615 		return (-1);
616 	}
617 	pos += WPA_SELECTOR_LEN;
618 
619 	/*
620 	 * WPA Capabilities; use defaults, so no need to include it
621 	 */
622 	hdr->len = (pos - wpa_ie) - 2;
623 
624 	return (pos - wpa_ie);
625 }
626 
627 static int
wpa_gen_wpa_ie_rsn(struct wpa_supplicant * wpa_s,uint8_t * rsn_ie)628 wpa_gen_wpa_ie_rsn(struct wpa_supplicant *wpa_s, uint8_t *rsn_ie)
629 {
630 	uint8_t *pos;
631 	struct rsn_ie_hdr *hdr;
632 
633 	hdr = (struct rsn_ie_hdr *)rsn_ie;
634 	hdr->elem_id = RSN_INFO_ELEM;
635 	hdr->version = LE_16(RSN_VERSION);
636 	pos = (uint8_t *)(hdr + 1);
637 
638 	if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
639 		(void) memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
640 	} else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
641 		(void) memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
642 	} else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
643 		(void) memcpy(pos, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN);
644 	} else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
645 		(void) memcpy(pos, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN);
646 	} else {
647 		wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
648 		    wpa_s->group_cipher);
649 		return (-1);
650 	}
651 	pos += RSN_SELECTOR_LEN;
652 
653 	*pos++ = 1;
654 	*pos++ = 0;
655 	if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
656 		(void) memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
657 	} else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
658 		(void) memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
659 	} else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
660 		(void) memcpy(pos, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN);
661 	} else {
662 		wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
663 		    wpa_s->pairwise_cipher);
664 		return (-1);
665 	}
666 	pos += RSN_SELECTOR_LEN;
667 
668 	*pos++ = 1;
669 	*pos++ = 0;
670 	if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
671 		(void) memcpy(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X,
672 		    RSN_SELECTOR_LEN);
673 	} else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
674 		(void) memcpy(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X,
675 		    RSN_SELECTOR_LEN);
676 	} else {
677 		wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
678 		    wpa_s->key_mgmt);
679 		return (-1);
680 	}
681 	pos += RSN_SELECTOR_LEN;
682 
683 	/* RSN Capabilities */
684 	*pos++ = 0;
685 	*pos++ = 0;
686 
687 	if (wpa_s->cur_pmksa) {
688 		/* PMKID Count (2 octets, little endian) */
689 		*pos++ = 1;
690 		*pos++ = 0;
691 		/* PMKID */
692 		(void) memcpy(pos, wpa_s->cur_pmksa->pmkid, PMKID_LEN);
693 		pos += PMKID_LEN;
694 	}
695 
696 	hdr->len = (pos - rsn_ie) - 2;
697 
698 	return (pos - rsn_ie);
699 }
700 
701 int
wpa_gen_wpa_ie(struct wpa_supplicant * wpa_s,uint8_t * wpa_ie)702 wpa_gen_wpa_ie(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie)
703 {
704 	if (wpa_s->proto == WPA_PROTO_RSN)
705 		return (wpa_gen_wpa_ie_rsn(wpa_s, wpa_ie));
706 	else
707 		return (wpa_gen_wpa_ie_wpa(wpa_s, wpa_ie));
708 }
709 
710 static void
wpa_pmk_to_ptk(uint8_t * pmk,uint8_t * addr1,uint8_t * addr2,uint8_t * nonce1,uint8_t * nonce2,uint8_t * ptk,size_t ptk_len)711 wpa_pmk_to_ptk(uint8_t *pmk, uint8_t *addr1, uint8_t *addr2,
712     uint8_t *nonce1, uint8_t *nonce2, uint8_t *ptk, size_t ptk_len)
713 {
714 	uint8_t data[2 * IEEE80211_ADDR_LEN + 2 * WPA_PMK_LEN];
715 
716 	/*
717 	 * PTK = PRF-X(PMK, "Pairwise key expansion",
718 	 * 	Min(AA, SA) || Max(AA, SA) ||
719 	 * 	Min(ANonce, SNonce) || Max(ANonce, SNonce))
720 	 */
721 
722 	if (memcmp(addr1, addr2, IEEE80211_ADDR_LEN) < 0) {
723 		(void) memcpy(data, addr1, IEEE80211_ADDR_LEN);
724 		(void) memcpy(data + IEEE80211_ADDR_LEN, addr2,
725 		    IEEE80211_ADDR_LEN);
726 	} else {
727 		(void) memcpy(data, addr2, IEEE80211_ADDR_LEN);
728 		(void) memcpy(data + IEEE80211_ADDR_LEN, addr1,
729 		    IEEE80211_ADDR_LEN);
730 	}
731 
732 	if (memcmp(nonce1, nonce2, WPA_PMK_LEN) < 0) {
733 		(void) memcpy(data + 2 * IEEE80211_ADDR_LEN, nonce1,
734 		    WPA_PMK_LEN);
735 		(void) memcpy(data + 2 * IEEE80211_ADDR_LEN + WPA_PMK_LEN,
736 		    nonce2, WPA_PMK_LEN);
737 	} else {
738 		(void) memcpy(data + 2 * IEEE80211_ADDR_LEN, nonce2,
739 		    WPA_PMK_LEN);
740 		(void) memcpy(data + 2 * IEEE80211_ADDR_LEN + WPA_PMK_LEN,
741 		    nonce1, WPA_PMK_LEN);
742 	}
743 
744 	sha1_prf(pmk, WPA_PMK_LEN, "Pairwise key expansion", data,
745 	    sizeof (data), ptk, ptk_len);
746 
747 	wpa_hexdump(MSG_DEBUG, "WPA: PMK", pmk, WPA_PMK_LEN);
748 	wpa_hexdump(MSG_DEBUG, "WPA: PTK", ptk, ptk_len);
749 }
750 
751 struct wpa_ssid *
wpa_supplicant_get_ssid(struct wpa_supplicant * wpa_s)752 wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
753 {
754 	struct wpa_ssid *entry;
755 	uint8_t ssid[MAX_ESSID_LENGTH];
756 	int ssid_len;
757 	uint8_t bssid[IEEE80211_ADDR_LEN];
758 
759 	(void) memset(ssid, 0, MAX_ESSID_LENGTH);
760 	ssid_len = wpa_s->driver->get_ssid(wpa_s->handle, wpa_s->linkid,
761 	    (char *)ssid);
762 	if (ssid_len < 0) {
763 		wpa_printf(MSG_WARNING, "Could not read SSID from driver.");
764 		return (NULL);
765 	}
766 
767 	if (wpa_s->driver->get_bssid(wpa_s->handle, wpa_s->linkid,
768 	    (char *)bssid) < 0) {
769 		wpa_printf(MSG_WARNING, "Could not read BSSID from driver.");
770 		return (NULL);
771 	}
772 
773 	entry = wpa_s->conf->ssid;
774 	wpa_printf(MSG_DEBUG, "entry len=%d ssid=%s,"
775 	    " driver len=%d ssid=%s",
776 	    entry->ssid_len, entry->ssid, ssid_len, ssid);
777 
778 	if (ssid_len == entry->ssid_len &&
779 	    memcmp(ssid, entry->ssid, ssid_len) == 0 &&
780 	    (!entry->bssid_set ||
781 	    memcmp(bssid, entry->bssid, IEEE80211_ADDR_LEN) == 0))
782 		return (entry);
783 
784 	return (NULL);
785 }
786 
787 static void
wpa_eapol_key_mic(uint8_t * key,int ver,uint8_t * buf,size_t len,uint8_t * mic)788 wpa_eapol_key_mic(uint8_t *key, int ver, uint8_t *buf, size_t len, uint8_t *mic)
789 {
790 	if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
791 		hmac_md5(key, 16, buf, len, mic);
792 	} else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
793 		uint8_t hash[SHA1_MAC_LEN];
794 		hmac_sha1(key, 16, buf, len, hash);
795 		(void) memcpy(mic, hash, MD5_MAC_LEN);
796 	}
797 }
798 
799 void
wpa_supplicant_key_request(struct wpa_supplicant * wpa_s,int error,int pairwise)800 wpa_supplicant_key_request(struct wpa_supplicant *wpa_s,
801 	int error, int pairwise)
802 {
803 	int rlen;
804 	struct ieee802_1x_hdr *hdr;
805 	struct wpa_eapol_key *reply;
806 	unsigned char *rbuf;
807 	struct l2_ethhdr *ethhdr;
808 	int key_info, ver;
809 	uint8_t bssid[IEEE80211_ADDR_LEN];
810 
811 	if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP)
812 		ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
813 	else
814 		ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;
815 
816 	if (wpa_s->driver->get_bssid(wpa_s->handle, wpa_s->linkid,
817 	    (char *)bssid) < 0) {
818 		wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
819 		    "request");
820 		return;
821 	}
822 
823 	rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
824 	rbuf = malloc(rlen);
825 	if (rbuf == NULL)
826 		return;
827 
828 	(void) memset(rbuf, 0, rlen);
829 	ethhdr = (struct l2_ethhdr *)rbuf;
830 	(void) memcpy(ethhdr->h_dest, bssid, IEEE80211_ADDR_LEN);
831 	(void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
832 	ethhdr->h_proto = htons(ETHERTYPE_EAPOL);
833 
834 	hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
835 	hdr->version = wpa_s->conf->eapol_version;
836 	hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
837 	hdr->length = htons(sizeof (*reply));
838 
839 	reply = (struct wpa_eapol_key *)(hdr + 1);
840 	reply->type = wpa_s->proto == WPA_PROTO_RSN ?
841 	    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
842 	key_info = WPA_KEY_INFO_REQUEST | ver;
843 	if (wpa_s->ptk_set)
844 		key_info |= WPA_KEY_INFO_MIC;
845 	if (error)
846 		key_info |= WPA_KEY_INFO_ERROR;
847 	if (pairwise)
848 		key_info |= WPA_KEY_INFO_KEY_TYPE;
849 	reply->key_info = BE_16(key_info);
850 	reply->key_length = 0;
851 	(void) memcpy(reply->replay_counter, wpa_s->request_counter,
852 	    WPA_REPLAY_COUNTER_LEN);
853 	inc_byte_array(wpa_s->request_counter, WPA_REPLAY_COUNTER_LEN);
854 
855 	reply->key_data_length = BE_16(0);
856 
857 	if (key_info & WPA_KEY_INFO_MIC) {
858 		wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
859 		    rlen - sizeof (*ethhdr), reply->key_mic);
860 	}
861 
862 	wpa_printf(MSG_INFO, "WPA: Sending EAPOL-Key Request (error=%d "
863 	    "pairwise=%d ptk_set=%d len=%d)",
864 	    error, pairwise, wpa_s->ptk_set, rlen);
865 	wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key Request", rbuf, rlen);
866 	(void) l2_packet_send(wpa_s->l2, rbuf, rlen);
867 	free(rbuf);
868 }
869 
870 static void
wpa_supplicant_process_1_of_4(struct wpa_supplicant * wpa_s,unsigned char * src_addr,struct wpa_eapol_key * key,int ver)871 wpa_supplicant_process_1_of_4(struct wpa_supplicant *wpa_s,
872     unsigned char *src_addr, struct wpa_eapol_key *key, int ver)
873 {
874 	int rlen;
875 	struct ieee802_1x_hdr *hdr;
876 	struct wpa_eapol_key *reply;
877 	unsigned char *rbuf;
878 	struct l2_ethhdr *ethhdr;
879 	struct wpa_ssid *ssid;
880 	struct wpa_ptk *ptk;
881 	uint8_t buf[8], wpa_ie_buf[80], *wpa_ie, *pmkid = NULL;
882 	int wpa_ie_len;
883 
884 	wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
885 	wpa_printf(MSG_DEBUG, "WPA: RX message 1 of 4-Way Handshake from "
886 	    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
887 
888 	ssid = wpa_supplicant_get_ssid(wpa_s);
889 	if (ssid == NULL) {
890 		wpa_printf(MSG_WARNING,
891 		    "WPA: No SSID info found (msg 1 of 4).");
892 		return;
893 	}
894 
895 	if (wpa_s->proto == WPA_PROTO_RSN) {
896 		/* RSN: msg 1/4 should contain PMKID for the selected PMK */
897 		uint8_t *pos = (uint8_t *)(key + 1);
898 		uint8_t *end = pos + BE_16(key->key_data_length);
899 
900 		wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
901 		    pos, BE_16(key->key_data_length));
902 
903 		while (pos + 1 < end) {
904 			if (pos + 2 + pos[1] > end) {
905 				wpa_printf(MSG_DEBUG, "RSN: key data "
906 				    "underflow (ie=%d len=%d)",
907 				    pos[0], pos[1]);
908 				break;
909 			}
910 			if (pos[0] == GENERIC_INFO_ELEM &&
911 			    pos + 1 + RSN_SELECTOR_LEN < end &&
912 			    pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
913 			    memcmp(pos + 2, RSN_KEY_DATA_PMKID,
914 			    RSN_SELECTOR_LEN) == 0) {
915 				pmkid = pos + 2 + RSN_SELECTOR_LEN;
916 				wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
917 				    "Authenticator", pmkid, PMKID_LEN);
918 				break;
919 			} else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0)
920 				break;
921 			pos += 2 + pos[1];
922 		}
923 	}
924 
925 	wpa_ie = wpa_ie_buf;
926 	wpa_ie_len = wpa_gen_wpa_ie(wpa_s, wpa_ie);
927 	if (wpa_ie_len < 0) {
928 		wpa_printf(MSG_WARNING, "WPA: Failed to generate "
929 		    "WPA IE (for msg 2 of 4).");
930 		return;
931 	}
932 	wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);
933 
934 	rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply) + wpa_ie_len;
935 	rbuf = malloc(rlen);
936 	if (rbuf == NULL)
937 		return;
938 
939 	(void) memset(rbuf, 0, rlen);
940 	ethhdr = (struct l2_ethhdr *)rbuf;
941 	(void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
942 	(void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
943 	ethhdr->h_proto = htons(ETHERTYPE_EAPOL);
944 
945 	hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
946 	hdr->version = wpa_s->conf->eapol_version;
947 	hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
948 	hdr->length = htons(sizeof (*reply) + wpa_ie_len);
949 
950 	reply = (struct wpa_eapol_key *)(hdr + 1);
951 	reply->type = wpa_s->proto == WPA_PROTO_RSN ?
952 	    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
953 	reply->key_info = BE_16(ver | WPA_KEY_INFO_KEY_TYPE | WPA_KEY_INFO_MIC);
954 	reply->key_length = key->key_length;
955 	(void) memcpy(reply->replay_counter, key->replay_counter,
956 	    WPA_REPLAY_COUNTER_LEN);
957 
958 	reply->key_data_length = BE_16(wpa_ie_len);
959 	(void) memcpy(reply + 1, wpa_ie, wpa_ie_len);
960 
961 	if (wpa_s->renew_snonce) {
962 		if (random_get_pseudo_bytes(wpa_s->snonce, WPA_NONCE_LEN)) {
963 			wpa_printf(MSG_WARNING, "WPA: Failed to get "
964 			    "random data for SNonce");
965 			free(rbuf);
966 			return;
967 		}
968 
969 		wpa_s->renew_snonce = 0;
970 		wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
971 		    wpa_s->snonce, WPA_NONCE_LEN);
972 	}
973 	(void) memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
974 	ptk = &wpa_s->tptk;
975 	(void) memcpy(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN);
976 
977 	wpa_pmk_to_ptk(wpa_s->pmk, wpa_s->own_addr, src_addr,
978 	    wpa_s->snonce, key->key_nonce, (uint8_t *)ptk, sizeof (*ptk));
979 
980 	/*
981 	 * Supplicant: swap tx/rx Mic keys
982 	 */
983 	(void) memcpy(buf, ptk->u.auth.tx_mic_key, 8);
984 	(void) memcpy(ptk->u.auth.tx_mic_key, ptk->u.auth.rx_mic_key, 8);
985 	(void) memcpy(ptk->u.auth.rx_mic_key, buf, 8);
986 	wpa_s->tptk_set = 1;
987 	wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, (uint8_t *)hdr,
988 	    rlen - sizeof (*ethhdr), reply->key_mic);
989 	wpa_hexdump(MSG_DEBUG, "WPA: EAPOL-Key MIC", reply->key_mic, 16);
990 
991 	wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
992 	wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/4", rbuf, rlen);
993 	(void) l2_packet_send(wpa_s->l2, rbuf, rlen);
994 
995 	free(rbuf);
996 }
997 
998 static void
wpa_supplicant_process_3_of_4_gtk(struct wpa_supplicant * wpa_s,unsigned char * src_addr,struct wpa_eapol_key * key,uint8_t * gtk,int gtk_len)999 wpa_supplicant_process_3_of_4_gtk(struct wpa_supplicant *wpa_s,
1000     unsigned char *src_addr, struct wpa_eapol_key *key,
1001     uint8_t *gtk, int gtk_len)
1002 {
1003 	int keyidx, tx, key_rsc_len = 0, alg;
1004 
1005 	wpa_hexdump(MSG_DEBUG,
1006 	    "WPA: received GTK in pairwise handshake", gtk, gtk_len);
1007 
1008 	keyidx = gtk[0] & 0x3;
1009 	tx = !!(gtk[0] & BIT(2));
1010 	if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
1011 		/*
1012 		 * Ignore Tx bit in GTK IE if a pairwise key is used.
1013 		 * One AP seemed to set this bit (incorrectly, since Tx
1014 		 * is only when doing Group Key only APs) and without
1015 		 * this workaround, the data connection does not work
1016 		 * because wpa_supplicant configured non-zero keyidx to
1017 		 * be used for unicast.
1018 		 */
1019 		wpa_printf(MSG_INFO, "RSN: Tx bit set for GTK IE, but "
1020 		    "pairwise keys are used - ignore Tx bit");
1021 		tx = 0;
1022 	}
1023 
1024 	gtk += 2;
1025 	gtk_len -= 2;
1026 	wpa_hexdump(MSG_DEBUG, "WPA: Group Key", gtk, gtk_len);
1027 
1028 	switch (wpa_s->group_cipher) {
1029 	case WPA_CIPHER_CCMP:
1030 		if (gtk_len != 16) {
1031 			wpa_printf(MSG_WARNING, "WPA: Unsupported CCMP"
1032 			    " Group Cipher key length %d.", gtk_len);
1033 			return;
1034 		}
1035 		key_rsc_len = 6;
1036 		alg = WPA_ALG_CCMP;
1037 		break;
1038 	case WPA_CIPHER_TKIP:
1039 		if (gtk_len != 32) {
1040 			wpa_printf(MSG_WARNING, "WPA: Unsupported TKIP"
1041 			    " Group Cipher key length %d.", gtk_len);
1042 			return;
1043 		}
1044 		key_rsc_len = 6;
1045 		alg = WPA_ALG_TKIP;
1046 		break;
1047 	case WPA_CIPHER_WEP104:
1048 		if (gtk_len != 13) {
1049 			wpa_printf(MSG_WARNING, "WPA: Unsupported "
1050 			    "WEP104 Group Cipher key length " "%d.", gtk_len);
1051 			return;
1052 		}
1053 		alg = WPA_ALG_WEP;
1054 		break;
1055 	case WPA_CIPHER_WEP40:
1056 		if (gtk_len != 5) {
1057 			wpa_printf(MSG_WARNING, "WPA: Unsupported "
1058 			    "WEP40 Group Cipher key length %d.", gtk_len);
1059 			return;
1060 		}
1061 		alg = WPA_ALG_WEP;
1062 		break;
1063 	default:
1064 		wpa_printf(MSG_WARNING, "WPA: Unsupport Group Cipher "
1065 		    "%d", wpa_s->group_cipher);
1066 		return;
1067 	}
1068 
1069 	wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver "
1070 	    "(keyidx=%d tx=%d).", keyidx, tx);
1071 	wpa_hexdump(MSG_DEBUG, "WPA: RSC", key->key_rsc, key_rsc_len);
1072 	if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
1073 		uint8_t tmpbuf[8];
1074 		/*
1075 		 * Swap Tx/Rx keys for Michael MIC
1076 		 */
1077 		(void) memcpy(tmpbuf, gtk + 16, 8);
1078 		(void) memcpy(gtk + 16, gtk + 24, 8);
1079 		(void) memcpy(gtk + 24, tmpbuf, 8);
1080 	}
1081 	if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
1082 		if (wpa_s->driver->set_key(wpa_s->handle, wpa_s->linkid, alg,
1083 		    (uint8_t *)"\xff\xff\xff\xff\xff\xff",
1084 		    keyidx, 1, key->key_rsc,
1085 		    key_rsc_len, gtk, gtk_len) < 0)
1086 			wpa_printf(MSG_WARNING, "WPA: Failed to set "
1087 			    "GTK to the driver (Group only).");
1088 	} else if (wpa_s->driver->set_key(wpa_s->handle, wpa_s->linkid, alg,
1089 	    (uint8_t *)"\xff\xff\xff\xff\xff\xff", keyidx, tx,
1090 	    key->key_rsc, key_rsc_len, gtk, gtk_len) < 0) {
1091 		wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to "
1092 		    "the driver.");
1093 	}
1094 
1095 	wpa_printf(MSG_INFO, "WPA: Key negotiation completed with "
1096 	    MACSTR, MAC2STR(src_addr));
1097 	eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
1098 	wpa_supplicant_cancel_auth_timeout(wpa_s);
1099 	wpa_s->wpa_state = WPA_COMPLETED;
1100 }
1101 
1102 static void
wpa_supplicant_process_3_of_4(struct wpa_supplicant * wpa_s,unsigned char * src_addr,struct wpa_eapol_key * key,int extra_len,int ver)1103 wpa_supplicant_process_3_of_4(struct wpa_supplicant *wpa_s,
1104     unsigned char *src_addr, struct wpa_eapol_key *key,
1105     int extra_len, int ver)
1106 {
1107 	int rlen;
1108 	struct ieee802_1x_hdr *hdr;
1109 	struct wpa_eapol_key *reply;
1110 	unsigned char *rbuf;
1111 	struct l2_ethhdr *ethhdr;
1112 	int key_info, ie_len = 0, keylen, gtk_len = 0;
1113 	uint8_t *ie = NULL, *gtk = NULL, *key_rsc;
1114 	uint8_t null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
1115 
1116 	wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
1117 	wpa_printf(MSG_DEBUG, "WPA: RX message 3 of 4-Way Handshake from "
1118 	    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1119 
1120 	key_info = BE_16(key->key_info);
1121 
1122 	if (wpa_s->proto == WPA_PROTO_RSN) {
1123 		uint8_t *pos = (uint8_t *)(key + 1);
1124 		uint8_t *end = pos + BE_16(key->key_data_length);
1125 		while (pos + 1 < end) {
1126 			if (pos + 2 + pos[1] > end) {
1127 				wpa_printf(MSG_DEBUG, "RSN: key data "
1128 				    "underflow (ie=%d len=%d)",
1129 				    pos[0], pos[1]);
1130 				break;
1131 			}
1132 			if (*pos == RSN_INFO_ELEM) {
1133 				ie = pos;
1134 				ie_len = pos[1] + 2;
1135 			} else if (pos[0] == GENERIC_INFO_ELEM &&
1136 			    pos + 1 + RSN_SELECTOR_LEN < end &&
1137 			    pos[1] > RSN_SELECTOR_LEN + 2 &&
1138 			    memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
1139 			    RSN_SELECTOR_LEN) == 0) {
1140 				if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1141 					wpa_printf(MSG_WARNING, "WPA: GTK IE "
1142 					    "in unencrypted key data");
1143 					return;
1144 				}
1145 				gtk = pos + 2 + RSN_SELECTOR_LEN;
1146 				gtk_len = pos[1] - RSN_SELECTOR_LEN;
1147 			} else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0)
1148 				break;
1149 
1150 			pos += 2 + pos[1];
1151 		}
1152 	} else {
1153 		ie = (uint8_t *)(key + 1);
1154 		ie_len = BE_16(key->key_data_length);
1155 		if (ie_len > extra_len) {
1156 			wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
1157 			    " ie_len=%d > extra_len=%d",
1158 			    ie_len, extra_len);
1159 			return;
1160 		}
1161 	}
1162 
1163 	if (wpa_s->ap_wpa_ie &&
1164 	    (wpa_s->ap_wpa_ie_len != ie_len ||
1165 	    memcmp(wpa_s->ap_wpa_ie, ie, ie_len) != 0)) {
1166 		wpa_printf(MSG_WARNING, "WPA: WPA IE in 3/4 msg does not match"
1167 		    " with WPA IE in Beacon/ProbeResp (src=" MACSTR ")",
1168 		    MAC2STR(src_addr));
1169 		wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
1170 		    wpa_s->ap_wpa_ie, wpa_s->ap_wpa_ie_len);
1171 		wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg", ie, ie_len);
1172 		wpa_supplicant_disassociate(wpa_s, REASON_IE_IN_4WAY_DIFFERS);
1173 		wpa_supplicant_req_scan(wpa_s, 0, 0);
1174 		return;
1175 	}
1176 
1177 	if (memcmp(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
1178 		wpa_printf(MSG_WARNING, "WPA: ANonce from message 1 of 4-Way "
1179 		    "Handshake differs from 3 of 4-Way Handshake - drop"
1180 		    " packet (src=" MACSTR ")", MAC2STR(src_addr));
1181 		return;
1182 	}
1183 
1184 	keylen = BE_16(key->key_length);
1185 	switch (wpa_s->pairwise_cipher) {
1186 	case WPA_CIPHER_CCMP:
1187 		if (keylen != 16) {
1188 			wpa_printf(MSG_WARNING, "WPA: Invalid CCMP key length "
1189 			    "%d (src=" MACSTR ")",
1190 			    keylen, MAC2STR(src_addr));
1191 			return;
1192 		}
1193 		break;
1194 	case WPA_CIPHER_TKIP:
1195 		if (keylen != 32) {
1196 			wpa_printf(MSG_WARNING, "WPA: Invalid TKIP key length "
1197 			    "%d (src=" MACSTR ")",
1198 			    keylen, MAC2STR(src_addr));
1199 			return;
1200 		}
1201 		break;
1202 	}
1203 
1204 	rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
1205 	rbuf = malloc(rlen);
1206 	if (rbuf == NULL)
1207 		return;
1208 
1209 	(void) memset(rbuf, 0, rlen);
1210 	ethhdr = (struct l2_ethhdr *)rbuf;
1211 	(void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
1212 	(void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
1213 	ethhdr->h_proto = htons(ETHERTYPE_EAPOL);
1214 
1215 	hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
1216 	hdr->version = wpa_s->conf->eapol_version;
1217 	hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1218 	hdr->length = htons(sizeof (*reply));
1219 
1220 	reply = (struct wpa_eapol_key *)(hdr + 1);
1221 	reply->type = wpa_s->proto == WPA_PROTO_RSN ?
1222 	    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1223 	reply->key_info = BE_16(ver | WPA_KEY_INFO_KEY_TYPE |
1224 	    WPA_KEY_INFO_MIC | (key_info & WPA_KEY_INFO_SECURE));
1225 	reply->key_length = key->key_length;
1226 	(void) memcpy(reply->replay_counter, key->replay_counter,
1227 	    WPA_REPLAY_COUNTER_LEN);
1228 
1229 	reply->key_data_length = BE_16(0);
1230 
1231 	(void) memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
1232 	wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
1233 	    rlen - sizeof (*ethhdr), reply->key_mic);
1234 
1235 	wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
1236 	wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 4/4", rbuf, rlen);
1237 	(void) l2_packet_send(wpa_s->l2, rbuf, rlen);
1238 
1239 	free(rbuf);
1240 
1241 	/*
1242 	 * SNonce was successfully used in msg 3/4, so mark it to be renewed
1243 	 * for the next 4-Way Handshake. If msg 3 is received again, the old
1244 	 * SNonce will still be used to avoid changing PTK.
1245 	 */
1246 	wpa_s->renew_snonce = 1;
1247 
1248 	if (key_info & WPA_KEY_INFO_INSTALL) {
1249 		int alg, keylen, rsclen;
1250 		wpa_printf(MSG_DEBUG, "WPA: Installing PTK to the driver.");
1251 		switch (wpa_s->pairwise_cipher) {
1252 		case WPA_CIPHER_CCMP:
1253 			alg = WPA_ALG_CCMP;
1254 			keylen = 16;
1255 			rsclen = 6;
1256 			break;
1257 		case WPA_CIPHER_TKIP:
1258 			alg = WPA_ALG_TKIP;
1259 			keylen = 32;
1260 			rsclen = 6;
1261 			break;
1262 		case WPA_CIPHER_NONE:
1263 			wpa_printf(MSG_DEBUG, "WPA: Pairwise Cipher Suite: "
1264 			    "NONE - do not use pairwise keys");
1265 			return;
1266 		default:
1267 			wpa_printf(MSG_WARNING, "WPA: Unsupported pairwise "
1268 			    "cipher %d", wpa_s->pairwise_cipher);
1269 			return;
1270 		}
1271 		if (wpa_s->proto == WPA_PROTO_RSN) {
1272 			key_rsc = null_rsc;
1273 		} else {
1274 			key_rsc = key->key_rsc;
1275 			wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
1276 		}
1277 
1278 		if (wpa_s->driver->set_key(wpa_s->handle, wpa_s->linkid, alg,
1279 		    src_addr, 0, 1, key_rsc, rsclen,
1280 		    (uint8_t *)&wpa_s->ptk.tk1, keylen) < 0) {
1281 			wpa_printf(MSG_WARNING, "WPA: Failed to set PTK to the"
1282 			    " driver.");
1283 		}
1284 	}
1285 
1286 	wpa_printf(MSG_DEBUG, "%s: key_info=%x gtk=%p\n",
1287 	    "wpa_supplicant_process_3_of_4", key_info, gtk);
1288 	wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;
1289 
1290 	if (gtk)
1291 		wpa_supplicant_process_3_of_4_gtk(wpa_s,
1292 		    src_addr, key, gtk, gtk_len);
1293 }
1294 
1295 static void
wpa_supplicant_process_1_of_2(struct wpa_supplicant * wpa_s,unsigned char * src_addr,struct wpa_eapol_key * key,int extra_len,int ver)1296 wpa_supplicant_process_1_of_2(struct wpa_supplicant *wpa_s,
1297     unsigned char *src_addr, struct wpa_eapol_key *key,
1298     int extra_len, int ver)
1299 {
1300 	int rlen;
1301 	struct ieee802_1x_hdr *hdr;
1302 	struct wpa_eapol_key *reply;
1303 	unsigned char *rbuf;
1304 	struct l2_ethhdr *ethhdr;
1305 	int key_info, keylen, keydatalen, maxkeylen, keyidx, key_rsc_len = 0;
1306 	int alg, tx;
1307 	uint8_t ek[32], tmpbuf[8], gtk[32];
1308 	uint8_t *gtk_ie = NULL;
1309 	size_t gtk_ie_len = 0;
1310 
1311 	wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;
1312 	wpa_printf(MSG_DEBUG, "WPA: RX message 1 of Group Key Handshake from "
1313 	    MACSTR " (ver=%d)", MAC2STR(src_addr), ver);
1314 
1315 	key_info = BE_16(key->key_info);
1316 	keydatalen = BE_16(key->key_data_length);
1317 
1318 	if (wpa_s->proto == WPA_PROTO_RSN) {
1319 		uint8_t *pos = (uint8_t *)(key + 1);
1320 		uint8_t *end = pos + keydatalen;
1321 		while (pos + 1 < end) {
1322 			if (pos + 2 + pos[1] > end) {
1323 				wpa_printf(MSG_DEBUG, "RSN: key data "
1324 				    "underflow (ie=%d len=%d)",
1325 				    pos[0], pos[1]);
1326 				break;
1327 			}
1328 			if (pos[0] == GENERIC_INFO_ELEM &&
1329 			    pos + 1 + RSN_SELECTOR_LEN < end &&
1330 			    pos[1] > RSN_SELECTOR_LEN + 2 &&
1331 			    memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
1332 			    RSN_SELECTOR_LEN) == 0) {
1333 				if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
1334 					wpa_printf(MSG_WARNING, "WPA: GTK IE "
1335 					    "in unencrypted key data");
1336 					return;
1337 				}
1338 				gtk_ie = pos + 2 + RSN_SELECTOR_LEN;
1339 				gtk_ie_len = pos[1] - RSN_SELECTOR_LEN;
1340 				break;
1341 			} else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0) {
1342 				break;
1343 			}
1344 
1345 			pos += 2 + pos[1];
1346 		}
1347 
1348 		if (gtk_ie == NULL) {
1349 			wpa_printf(MSG_INFO, "WPA: No GTK IE in Group Key "
1350 			    "message 1/2");
1351 			return;
1352 		}
1353 		maxkeylen = keylen = gtk_ie_len - 2;
1354 	} else {
1355 		keylen = BE_16(key->key_length);
1356 		maxkeylen = keydatalen;
1357 		if (keydatalen > extra_len) {
1358 			wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
1359 			    " key_data_length=%d > extra_len=%d",
1360 			    keydatalen, extra_len);
1361 			return;
1362 		}
1363 		if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES)
1364 			maxkeylen -= 8;
1365 	}
1366 
1367 	switch (wpa_s->group_cipher) {
1368 	case WPA_CIPHER_CCMP:
1369 		if (keylen != 16 || maxkeylen < 16) {
1370 			wpa_printf(MSG_WARNING, "WPA: Unsupported CCMP Group "
1371 			    "Cipher key length %d (%d).", keylen, maxkeylen);
1372 			return;
1373 		}
1374 		key_rsc_len = 6;
1375 		alg = WPA_ALG_CCMP;
1376 		break;
1377 	case WPA_CIPHER_TKIP:
1378 		if (keylen != 32 || maxkeylen < 32) {
1379 			wpa_printf(MSG_WARNING, "WPA: Unsupported TKIP Group "
1380 			    "Cipher key length %d (%d).", keylen, maxkeylen);
1381 			return;
1382 		}
1383 		key_rsc_len = 6; /* key->key_data; */
1384 		alg = WPA_ALG_TKIP;
1385 		break;
1386 	case WPA_CIPHER_WEP104:
1387 		if (keylen != 13 || maxkeylen < 13) {
1388 			wpa_printf(MSG_WARNING, "WPA: Unsupported WEP104 Group"
1389 			    " Cipher key length %d (%d).", keylen, maxkeylen);
1390 			return;
1391 		}
1392 		alg = WPA_ALG_WEP;
1393 		break;
1394 	case WPA_CIPHER_WEP40:
1395 		if (keylen != 5 || maxkeylen < 5) {
1396 			wpa_printf(MSG_WARNING, "WPA: Unsupported WEP40 Group "
1397 			    "Cipher key length %d (%d).", keylen, maxkeylen);
1398 			return;
1399 		}
1400 		alg = WPA_ALG_WEP;
1401 		break;
1402 	default:
1403 		wpa_printf(MSG_WARNING, "WPA: Unsupport Group Cipher %d",
1404 		    wpa_s->group_cipher);
1405 		return;
1406 	}
1407 
1408 	if (wpa_s->proto == WPA_PROTO_RSN) {
1409 		wpa_hexdump(MSG_DEBUG,
1410 		    "WPA: received GTK in group key handshake",
1411 		    gtk_ie, gtk_ie_len);
1412 		keyidx = gtk_ie[0] & 0x3;
1413 		tx = !!(gtk_ie[0] & BIT(2));
1414 		if (gtk_ie_len - 2 > sizeof (gtk)) {
1415 			wpa_printf(MSG_INFO, "WPA: Too long GTK in GTK IE "
1416 			    "(len=%d)", gtk_ie_len - 2);
1417 			return;
1418 		}
1419 		(void) memcpy(gtk, gtk_ie + 2, gtk_ie_len - 2);
1420 	} else {
1421 		keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
1422 		    WPA_KEY_INFO_KEY_INDEX_SHIFT;
1423 		if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
1424 			(void) memcpy(ek, key->key_iv, 16);
1425 			(void) memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
1426 			rc4_skip(ek, 32, 256, (uint8_t *)(key + 1), keydatalen);
1427 			(void) memcpy(gtk, key + 1, keylen);
1428 		} else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1429 			if (keydatalen % 8) {
1430 				wpa_printf(MSG_WARNING, "WPA: Unsupported "
1431 				    "AES-WRAP len %d", keydatalen);
1432 				return;
1433 			}
1434 			if (aes_unwrap(wpa_s->ptk.encr_key, maxkeylen / 8,
1435 			    (uint8_t *)(key + 1), gtk)) {
1436 				wpa_printf(MSG_WARNING, "WPA: AES unwrap "
1437 				    "failed - could not decrypt GTK");
1438 				return;
1439 			}
1440 		}
1441 		tx = !!(key_info & WPA_KEY_INFO_TXRX);
1442 		if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
1443 			/*
1444 			 * Ignore Tx bit in Group Key message if a pairwise key
1445 			 * is used. Some APs seem to setting this bit
1446 			 * (incorrectly, since Tx is only when doing Group Key
1447 			 * only APs) and without this workaround, the data
1448 			 * connection does not work because wpa_supplicant
1449 			 * configured non-zero keyidx to be used for unicast.
1450 			 */
1451 			wpa_printf(MSG_INFO, "WPA: Tx bit set for GTK, but "
1452 			    "pairwise keys are used - ignore Tx bit");
1453 			tx = 0;
1454 		}
1455 	}
1456 	wpa_hexdump(MSG_DEBUG, "WPA: Group Key", gtk, keylen);
1457 	wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver (keyidx=%d "
1458 	    "tx=%d).", keyidx, tx);
1459 	wpa_hexdump(MSG_DEBUG, "WPA: RSC", key->key_rsc, key_rsc_len);
1460 	if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
1461 		/*
1462 		 * Swap Tx/Rx keys for Michael MIC
1463 		 */
1464 		(void) memcpy(tmpbuf, gtk + 16, 8);
1465 		(void) memcpy(gtk + 16, gtk + 24, 8);
1466 		(void) memcpy(gtk + 24, tmpbuf, 8);
1467 	}
1468 	if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
1469 		if (wpa_s->driver->set_key(wpa_s->handle, wpa_s->linkid, alg,
1470 		    (uint8_t *)"\xff\xff\xff\xff\xff\xff",
1471 		    keyidx, 1, key->key_rsc,
1472 		    key_rsc_len, gtk, keylen) < 0)
1473 			wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to the"
1474 			    " driver (Group only).");
1475 	} else if (wpa_s->driver->set_key(wpa_s->handle, wpa_s->linkid, alg,
1476 	    (uint8_t *)"\xff\xff\xff\xff\xff\xff",
1477 	    keyidx, tx,
1478 	    key->key_rsc, key_rsc_len,
1479 	    gtk, keylen) < 0) {
1480 		wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to the "
1481 		    "driver.");
1482 	}
1483 
1484 	rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
1485 	rbuf = malloc(rlen);
1486 	if (rbuf == NULL)
1487 		return;
1488 
1489 	(void) memset(rbuf, 0, rlen);
1490 	ethhdr = (struct l2_ethhdr *)rbuf;
1491 	(void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
1492 	(void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
1493 	ethhdr->h_proto = htons(ETHERTYPE_EAPOL);
1494 
1495 	hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
1496 	hdr->version = wpa_s->conf->eapol_version;
1497 	hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
1498 	hdr->length = htons(sizeof (*reply));
1499 
1500 	reply = (struct wpa_eapol_key *)(hdr + 1);
1501 	reply->type = wpa_s->proto == WPA_PROTO_RSN ?
1502 	    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
1503 	reply->key_info =
1504 	    BE_16(ver | WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE |
1505 	    (key_info & WPA_KEY_INFO_KEY_INDEX_MASK));
1506 	reply->key_length = key->key_length;
1507 	(void) memcpy(reply->replay_counter, key->replay_counter,
1508 	    WPA_REPLAY_COUNTER_LEN);
1509 
1510 	reply->key_data_length = BE_16(0);
1511 
1512 	wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
1513 	    rlen - sizeof (*ethhdr), reply->key_mic);
1514 
1515 	wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
1516 	wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/2", rbuf, rlen);
1517 	(void) l2_packet_send(wpa_s->l2, rbuf, rlen);
1518 	free(rbuf);
1519 
1520 	wpa_printf(MSG_INFO, "WPA: Key negotiation completed with " MACSTR,
1521 	    MAC2STR(src_addr));
1522 	eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
1523 	wpa_supplicant_cancel_auth_timeout(wpa_s);
1524 	wpa_s->wpa_state = WPA_COMPLETED;
1525 	wpa_printf(MSG_INFO, "-----------------------------------\n");
1526 }
1527 
1528 static int
wpa_supplicant_verify_eapol_key_mic(struct wpa_supplicant * wpa_s,struct wpa_eapol_key * key,int ver,uint8_t * buf,size_t len)1529 wpa_supplicant_verify_eapol_key_mic(struct wpa_supplicant *wpa_s,
1530     struct wpa_eapol_key *key, int ver, uint8_t *buf, size_t len)
1531 {
1532 	uint8_t mic[16];
1533 	int ok = 0;
1534 
1535 	(void) memcpy(mic, key->key_mic, 16);
1536 	if (wpa_s->tptk_set) {
1537 		(void) memset(key->key_mic, 0, 16);
1538 		wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, buf, len,
1539 		    key->key_mic);
1540 		if (memcmp(mic, key->key_mic, 16) != 0) {
1541 			wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
1542 			    "when using TPTK - ignoring TPTK");
1543 		} else {
1544 			ok = 1;
1545 			wpa_s->tptk_set = 0;
1546 			wpa_s->ptk_set = 1;
1547 			(void) memcpy(&wpa_s->ptk, &wpa_s->tptk,
1548 			    sizeof (wpa_s->ptk));
1549 		}
1550 	}
1551 
1552 	if (!ok && wpa_s->ptk_set) {
1553 		(void) memset(key->key_mic, 0, 16);
1554 		wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, buf, len,
1555 		    key->key_mic);
1556 		if (memcmp(mic, key->key_mic, 16) != 0) {
1557 			wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
1558 			    "- dropping packet");
1559 			return (-1);
1560 		}
1561 		ok = 1;
1562 	}
1563 
1564 	if (!ok) {
1565 		wpa_printf(MSG_WARNING, "WPA: Could not verify EAPOL-Key MIC "
1566 		    "- dropping packet");
1567 		return (-1);
1568 	}
1569 
1570 	(void) memcpy(wpa_s->rx_replay_counter, key->replay_counter,
1571 	    WPA_REPLAY_COUNTER_LEN);
1572 	wpa_s->rx_replay_counter_set = 1;
1573 
1574 	return (0);
1575 }
1576 
1577 /* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
1578 static int
wpa_supplicant_decrypt_key_data(struct wpa_supplicant * wpa_s,struct wpa_eapol_key * key,int ver)1579 wpa_supplicant_decrypt_key_data(struct wpa_supplicant *wpa_s,
1580 	struct wpa_eapol_key *key, int ver)
1581 {
1582 	int keydatalen = BE_16(key->key_data_length);
1583 
1584 	wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
1585 	    (uint8_t *)(key + 1), keydatalen);
1586 	if (!wpa_s->ptk_set) {
1587 		wpa_printf(MSG_WARNING, "WPA: PTK not available, "
1588 		    "cannot decrypt EAPOL-Key key data.");
1589 		return (-1);
1590 	}
1591 
1592 	/*
1593 	 * Decrypt key data here so that this operation does not need
1594 	 * to be implemented separately for each message type.
1595 	 */
1596 	if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
1597 		uint8_t ek[32];
1598 		(void) memcpy(ek, key->key_iv, 16);
1599 		(void) memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
1600 		rc4_skip(ek, 32, 256, (uint8_t *)(key + 1), keydatalen);
1601 	} else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1602 		uint8_t *buf;
1603 		if (keydatalen % 8) {
1604 			wpa_printf(MSG_WARNING, "WPA: Unsupported "
1605 			    "AES-WRAP len %d", keydatalen);
1606 			return (-1);
1607 		}
1608 		keydatalen -= 8; /* AES-WRAP adds 8 bytes */
1609 		buf = malloc(keydatalen);
1610 		if (buf == NULL) {
1611 			wpa_printf(MSG_WARNING, "WPA: No memory for "
1612 			    "AES-UNWRAP buffer");
1613 			return (-1);
1614 		}
1615 		if (aes_unwrap(wpa_s->ptk.encr_key, keydatalen / 8,
1616 		    (uint8_t *)(key + 1), buf)) {
1617 			free(buf);
1618 			wpa_printf(MSG_WARNING, "WPA: AES unwrap failed - "
1619 			    "could not decrypt EAPOL-Key key data");
1620 			return (-1);
1621 		}
1622 		(void) memcpy(key + 1, buf, keydatalen);
1623 		free(buf);
1624 		key->key_data_length = BE_16(keydatalen);
1625 	}
1626 	wpa_hexdump(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
1627 	    (uint8_t *)(key + 1), keydatalen);
1628 
1629 	return (0);
1630 }
1631 
1632 static void
wpa_sm_rx_eapol(struct wpa_supplicant * wpa_s,unsigned char * src_addr,unsigned char * buf,size_t len)1633 wpa_sm_rx_eapol(struct wpa_supplicant *wpa_s,
1634     unsigned char *src_addr, unsigned char *buf, size_t len)
1635 {
1636 	size_t plen, data_len, extra_len;
1637 	struct ieee802_1x_hdr *hdr;
1638 	struct wpa_eapol_key *key;
1639 	int key_info, ver;
1640 
1641 	wpa_printf(MSG_DEBUG, "WPA: EAPOL frame len %u\n ", len);
1642 
1643 	hdr = (struct ieee802_1x_hdr *)buf;
1644 	key = (struct wpa_eapol_key *)(hdr + 1);
1645 	wpa_printf(MSG_DEBUG, "hdr_len=%u, key_len=%u",
1646 	    sizeof (*hdr), sizeof (*key));
1647 	if (len < sizeof (*hdr) + sizeof (*key)) {
1648 		wpa_printf(MSG_DEBUG, "WPA: EAPOL frame too short, len %u, "
1649 		    "expecting at least %u",
1650 		    len, sizeof (*hdr) + sizeof (*key));
1651 		return;
1652 	}
1653 	plen = ntohs(hdr->length);
1654 	data_len = plen + sizeof (*hdr);
1655 	wpa_printf(MSG_DEBUG, "IEEE 802.1X RX: version=%d type=%d length=%d",
1656 	    hdr->version, hdr->type, plen);
1657 
1658 	if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
1659 		wpa_printf(MSG_DEBUG, "WPA: EAPOL frame (type %u) discarded, "
1660 		    "not a Key frame", hdr->type);
1661 		return;
1662 	}
1663 	if (plen > len - sizeof (*hdr) || plen < sizeof (*key)) {
1664 		wpa_printf(MSG_DEBUG, "WPA: EAPOL frame payload size %u "
1665 		    "invalid (frame size %u)", plen, len);
1666 		return;
1667 	}
1668 
1669 	wpa_printf(MSG_DEBUG, "  EAPOL-Key type=%d", key->type);
1670 	if (key->type != EAPOL_KEY_TYPE_WPA && key->type !=
1671 	    EAPOL_KEY_TYPE_RSN) {
1672 		wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key type (%d) unknown, "
1673 		    "discarded", key->type);
1674 		return;
1675 	}
1676 
1677 	wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
1678 	if (data_len < len) {
1679 		wpa_printf(MSG_DEBUG, "WPA: ignoring %d bytes after the IEEE "
1680 		    "802.1X data", len - data_len);
1681 	}
1682 	key_info = BE_16(key->key_info);
1683 	ver = key_info & WPA_KEY_INFO_TYPE_MASK;
1684 	if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
1685 	    ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1686 		wpa_printf(MSG_INFO, "WPA: Unsupported EAPOL-Key descriptor "
1687 		    "version %d.", ver);
1688 		return;
1689 	}
1690 
1691 	if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP &&
1692 	    ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
1693 		wpa_printf(MSG_INFO, "WPA: CCMP is used, but EAPOL-Key "
1694 		    "descriptor version (%d) is not 2.", ver);
1695 		if (wpa_s->group_cipher != WPA_CIPHER_CCMP &&
1696 		    !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
1697 			/*
1698 			 * Earlier versions of IEEE 802.11i did not explicitly
1699 			 * require version 2 descriptor for all EAPOL-Key
1700 			 * packets, so allow group keys to use version 1 if
1701 			 * CCMP is not used for them.
1702 			 */
1703 			wpa_printf(MSG_INFO, "WPA: Backwards compatibility: "
1704 			    "allow invalid version for non-CCMP group keys");
1705 		} else
1706 			return;
1707 	}
1708 
1709 	if (wpa_s->rx_replay_counter_set &&
1710 	    memcmp(key->replay_counter, wpa_s->rx_replay_counter,
1711 	    WPA_REPLAY_COUNTER_LEN) <= 0) {
1712 		wpa_printf(MSG_WARNING, "WPA: EAPOL-Key Replay Counter did not"
1713 		    " increase - dropping packet");
1714 		return;
1715 	}
1716 
1717 	if (!(key_info & WPA_KEY_INFO_ACK)) {
1718 		wpa_printf(MSG_INFO, "WPA: No Ack bit in key_info");
1719 		return;
1720 	}
1721 
1722 	if (key_info & WPA_KEY_INFO_REQUEST) {
1723 		wpa_printf(MSG_INFO, "WPA: EAPOL-Key with Request bit - "
1724 		    "dropped");
1725 		return;
1726 	}
1727 
1728 	if ((key_info & WPA_KEY_INFO_MIC) &&
1729 	    wpa_supplicant_verify_eapol_key_mic(wpa_s, key, ver, buf,
1730 	    data_len)) {
1731 		return;
1732 	}
1733 
1734 	extra_len = data_len - sizeof (*hdr) - sizeof (*key);
1735 
1736 	if (wpa_s->proto == WPA_PROTO_RSN &&
1737 	    (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) &&
1738 	    wpa_supplicant_decrypt_key_data(wpa_s, key, ver))
1739 		return;
1740 
1741 	if (key_info & WPA_KEY_INFO_KEY_TYPE) {
1742 		if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
1743 			wpa_printf(MSG_WARNING, "WPA: Ignored EAPOL-Key "
1744 			    "(Pairwise) with non-zero key index");
1745 			return;
1746 		}
1747 		if (key_info & WPA_KEY_INFO_MIC) {
1748 			/* 3/4 4-Way Handshake */
1749 			wpa_supplicant_process_3_of_4(wpa_s, src_addr, key,
1750 			    extra_len, ver);
1751 		} else {
1752 			/* 1/4 4-Way Handshake */
1753 			wpa_supplicant_process_1_of_4(wpa_s, src_addr, key,
1754 			    ver);
1755 		}
1756 	} else {
1757 		if (key_info & WPA_KEY_INFO_MIC) {
1758 			/* 1/2 Group Key Handshake */
1759 			wpa_supplicant_process_1_of_2(wpa_s, src_addr, key,
1760 			    extra_len, ver);
1761 		} else {
1762 			wpa_printf(MSG_WARNING, "WPA: EAPOL-Key (Group) "
1763 			    "without Mic bit - dropped");
1764 		}
1765 	}
1766 }
1767 
1768 void
wpa_supplicant_rx_eapol(void * ctx,unsigned char * src_addr,unsigned char * buf,size_t len)1769 wpa_supplicant_rx_eapol(void *ctx, unsigned char *src_addr,
1770     unsigned char *buf, size_t len)
1771 {
1772 	struct wpa_supplicant *wpa_s = ctx;
1773 
1774 	wpa_printf(MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
1775 	wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
1776 
1777 	if (wpa_s->eapol_received == 0) {
1778 		/* Timeout for completing IEEE 802.1X and WPA authentication */
1779 		wpa_supplicant_req_auth_timeout(
1780 		    wpa_s, wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X ?
1781 		    70 : 10, 0);
1782 	}
1783 	wpa_s->eapol_received++;
1784 
1785 	/*
1786 	 * Source address of the incoming EAPOL frame could be compared to the
1787 	 * current BSSID. However, it is possible that a centralized
1788 	 * Authenticator could be using another MAC address than the BSSID of
1789 	 * an AP, so just allow any address to be used for now. The replies are
1790 	 * still sent to the current BSSID (if available), though.
1791 	 */
1792 	wpa_sm_rx_eapol(wpa_s, src_addr, buf, len);
1793 }
1794