rx_eapol.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994
  1. /*
  2. * Received Data frame processing for EAPOL messages
  3. * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2 as
  7. * published by the Free Software Foundation.
  8. *
  9. * Alternatively, this software may be distributed under the terms of BSD
  10. * license.
  11. *
  12. * See README and COPYING for more details.
  13. */
  14. #include "utils/includes.h"
  15. #include "utils/common.h"
  16. #include "crypto/aes_wrap.h"
  17. #include "crypto/crypto.h"
  18. #include "common/defs.h"
  19. #include "common/ieee802_11_defs.h"
  20. #include "common/eapol_common.h"
  21. #include "common/wpa_common.h"
  22. #include "rsn_supp/wpa_ie.h"
  23. #include "wlantest.h"
  24. static int is_zero(const u8 *buf, size_t len)
  25. {
  26. size_t i;
  27. for (i = 0; i < len; i++) {
  28. if (buf[i])
  29. return 0;
  30. }
  31. return 1;
  32. }
  33. static int check_mic(const u8 *kck, int ver, const u8 *data, size_t len)
  34. {
  35. u8 *buf;
  36. int ret = -1;
  37. struct ieee802_1x_hdr *hdr;
  38. struct wpa_eapol_key *key;
  39. u8 rx_mic[16];
  40. buf = os_malloc(len);
  41. if (buf == NULL)
  42. return -1;
  43. os_memcpy(buf, data, len);
  44. hdr = (struct ieee802_1x_hdr *) buf;
  45. key = (struct wpa_eapol_key *) (hdr + 1);
  46. os_memcpy(rx_mic, key->key_mic, 16);
  47. os_memset(key->key_mic, 0, 16);
  48. if (wpa_eapol_key_mic(kck, ver, buf, len, key->key_mic) == 0 &&
  49. os_memcmp(rx_mic, key->key_mic, 16) == 0)
  50. ret = 0;
  51. os_free(buf);
  52. return ret;
  53. }
  54. static void rx_data_eapol_key_1_of_4(struct wlantest *wt, const u8 *dst,
  55. const u8 *src, const u8 *data, size_t len)
  56. {
  57. struct wlantest_bss *bss;
  58. struct wlantest_sta *sta;
  59. const struct ieee802_1x_hdr *eapol;
  60. const struct wpa_eapol_key *hdr;
  61. wpa_printf(MSG_DEBUG, "EAPOL-Key 1/4 " MACSTR " -> " MACSTR,
  62. MAC2STR(src), MAC2STR(dst));
  63. bss = bss_get(wt, src);
  64. if (bss == NULL)
  65. return;
  66. sta = sta_get(bss, dst);
  67. if (sta == NULL)
  68. return;
  69. eapol = (const struct ieee802_1x_hdr *) data;
  70. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  71. if (is_zero(hdr->key_nonce, WPA_NONCE_LEN)) {
  72. wpa_printf(MSG_INFO, "EAPOL-Key 1/4 from " MACSTR " used "
  73. "zero nonce", MAC2STR(src));
  74. }
  75. if (!is_zero(hdr->key_rsc, 8)) {
  76. wpa_printf(MSG_INFO, "EAPOL-Key 1/4 from " MACSTR " used "
  77. "non-zero Key RSC", MAC2STR(src));
  78. }
  79. os_memcpy(sta->anonce, hdr->key_nonce, WPA_NONCE_LEN);
  80. }
  81. static int try_pmk(struct wlantest_bss *bss, struct wlantest_sta *sta,
  82. u16 ver, const u8 *data, size_t len,
  83. struct wlantest_pmk *pmk)
  84. {
  85. struct wpa_ptk ptk;
  86. size_t ptk_len = sta->pairwise_cipher == WPA_CIPHER_TKIP ? 64 : 48;
  87. wpa_pmk_to_ptk(pmk->pmk, sizeof(pmk->pmk),
  88. "Pairwise key expansion",
  89. bss->bssid, sta->addr, sta->anonce, sta->snonce,
  90. (u8 *) &ptk, ptk_len,
  91. wpa_key_mgmt_sha256(sta->key_mgmt));
  92. if (check_mic(ptk.kck, ver, data, len) < 0)
  93. return -1;
  94. wpa_printf(MSG_INFO, "Derived PTK for STA " MACSTR " BSSID " MACSTR,
  95. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  96. sta->counters[WLANTEST_STA_COUNTER_PTK_LEARNED]++;
  97. os_memcpy(&sta->ptk, &ptk, sizeof(ptk));
  98. wpa_hexdump(MSG_DEBUG, "PTK:KCK", sta->ptk.kck, 16);
  99. wpa_hexdump(MSG_DEBUG, "PTK:KEK", sta->ptk.kek, 16);
  100. wpa_hexdump(MSG_DEBUG, "PTK:TK1", sta->ptk.tk1, 16);
  101. if (ptk_len > 48)
  102. wpa_hexdump(MSG_DEBUG, "PTK:TK2", sta->ptk.u.tk2, 16);
  103. sta->ptk_set = 1;
  104. os_memset(sta->rsc_tods, 0, sizeof(sta->rsc_tods));
  105. os_memset(sta->rsc_fromds, 0, sizeof(sta->rsc_fromds));
  106. return 0;
  107. }
  108. static void derive_ptk(struct wlantest *wt, struct wlantest_bss *bss,
  109. struct wlantest_sta *sta, u16 ver,
  110. const u8 *data, size_t len)
  111. {
  112. struct wlantest_pmk *pmk;
  113. wpa_printf(MSG_DEBUG, "Trying to derive PTK for " MACSTR,
  114. MAC2STR(sta->addr));
  115. dl_list_for_each(pmk, &bss->pmk, struct wlantest_pmk, list) {
  116. wpa_printf(MSG_DEBUG, "Try per-BSS PMK");
  117. if (try_pmk(bss, sta, ver, data, len, pmk) == 0)
  118. return;
  119. }
  120. dl_list_for_each(pmk, &wt->pmk, struct wlantest_pmk, list) {
  121. wpa_printf(MSG_DEBUG, "Try global PMK");
  122. if (try_pmk(bss, sta, ver, data, len, pmk) == 0)
  123. return;
  124. }
  125. wpa_printf(MSG_DEBUG, "No matching PMK found to derive PTK");
  126. }
  127. static void rx_data_eapol_key_2_of_4(struct wlantest *wt, const u8 *dst,
  128. const u8 *src, const u8 *data, size_t len)
  129. {
  130. struct wlantest_bss *bss;
  131. struct wlantest_sta *sta;
  132. const struct ieee802_1x_hdr *eapol;
  133. const struct wpa_eapol_key *hdr;
  134. const u8 *key_data;
  135. u16 key_info, key_data_len;
  136. struct wpa_eapol_ie_parse ie;
  137. wpa_printf(MSG_DEBUG, "EAPOL-Key 2/4 " MACSTR " -> " MACSTR,
  138. MAC2STR(src), MAC2STR(dst));
  139. bss = bss_get(wt, dst);
  140. if (bss == NULL)
  141. return;
  142. sta = sta_get(bss, src);
  143. if (sta == NULL)
  144. return;
  145. eapol = (const struct ieee802_1x_hdr *) data;
  146. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  147. if (is_zero(hdr->key_nonce, WPA_NONCE_LEN)) {
  148. wpa_printf(MSG_INFO, "EAPOL-Key 2/4 from " MACSTR " used "
  149. "zero nonce", MAC2STR(src));
  150. }
  151. if (!is_zero(hdr->key_rsc, 8)) {
  152. wpa_printf(MSG_INFO, "EAPOL-Key 2/4 from " MACSTR " used "
  153. "non-zero Key RSC", MAC2STR(src));
  154. }
  155. os_memcpy(sta->snonce, hdr->key_nonce, WPA_NONCE_LEN);
  156. key_info = WPA_GET_BE16(hdr->key_info);
  157. key_data_len = WPA_GET_BE16(hdr->key_data_length);
  158. derive_ptk(wt, bss, sta, key_info & WPA_KEY_INFO_TYPE_MASK, data, len);
  159. if (!sta->ptk_set) {
  160. wpa_printf(MSG_DEBUG, "No PTK known to process EAPOL-Key 2/4");
  161. return;
  162. }
  163. if (check_mic(sta->ptk.kck, key_info & WPA_KEY_INFO_TYPE_MASK,
  164. data, len) < 0) {
  165. wpa_printf(MSG_INFO, "Mismatch in EAPOL-Key 2/4 MIC");
  166. return;
  167. }
  168. wpa_printf(MSG_DEBUG, "Valid MIC found in EAPOL-Key 2/4");
  169. key_data = (const u8 *) (hdr + 1);
  170. if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0) {
  171. wpa_printf(MSG_INFO, "Failed to parse EAPOL-Key Key Data");
  172. return;
  173. }
  174. if (ie.wpa_ie) {
  175. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - WPA IE",
  176. ie.wpa_ie, ie.wpa_ie_len);
  177. if (os_memcmp(ie.wpa_ie, sta->rsnie, ie.wpa_ie_len) != 0) {
  178. wpa_printf(MSG_INFO, "Mismatch in WPA IE between "
  179. "EAPOL-Key 2/4 and (Re)Association "
  180. "Request from " MACSTR, MAC2STR(sta->addr));
  181. wpa_hexdump(MSG_INFO, "WPA IE in EAPOL-Key",
  182. ie.wpa_ie, ie.wpa_ie_len);
  183. wpa_hexdump(MSG_INFO, "WPA IE in (Re)Association "
  184. "Request",
  185. sta->rsnie,
  186. sta->rsnie[0] ? 2 + sta->rsnie[1] : 0);
  187. }
  188. }
  189. if (ie.rsn_ie) {
  190. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - RSN IE",
  191. ie.rsn_ie, ie.rsn_ie_len);
  192. if (os_memcmp(ie.rsn_ie, sta->rsnie, ie.rsn_ie_len) != 0) {
  193. wpa_printf(MSG_INFO, "Mismatch in RSN IE between "
  194. "EAPOL-Key 2/4 and (Re)Association "
  195. "Request from " MACSTR, MAC2STR(sta->addr));
  196. wpa_hexdump(MSG_INFO, "RSN IE in EAPOL-Key",
  197. ie.rsn_ie, ie.rsn_ie_len);
  198. wpa_hexdump(MSG_INFO, "RSN IE in (Re)Association "
  199. "Request",
  200. sta->rsnie,
  201. sta->rsnie[0] ? 2 + sta->rsnie[1] : 0);
  202. }
  203. }
  204. }
  205. static u8 * decrypt_eapol_key_data_rc4(const u8 *kek,
  206. const struct wpa_eapol_key *hdr,
  207. size_t *len)
  208. {
  209. u8 ek[32], *buf;
  210. u16 keydatalen = WPA_GET_BE16(hdr->key_data_length);
  211. buf = os_malloc(keydatalen);
  212. if (buf == NULL)
  213. return NULL;
  214. os_memcpy(ek, hdr->key_iv, 16);
  215. os_memcpy(ek + 16, kek, 16);
  216. os_memcpy(buf, hdr + 1, keydatalen);
  217. if (rc4_skip(ek, 32, 256, buf, keydatalen)) {
  218. wpa_printf(MSG_INFO, "RC4 failed");
  219. os_free(buf);
  220. return NULL;
  221. }
  222. *len = keydatalen;
  223. return buf;
  224. }
  225. static u8 * decrypt_eapol_key_data_aes(const u8 *kek,
  226. const struct wpa_eapol_key *hdr,
  227. size_t *len)
  228. {
  229. u8 *buf;
  230. u16 keydatalen = WPA_GET_BE16(hdr->key_data_length);
  231. if (keydatalen % 8) {
  232. wpa_printf(MSG_INFO, "Unsupported AES-WRAP len %d",
  233. keydatalen);
  234. return NULL;
  235. }
  236. keydatalen -= 8; /* AES-WRAP adds 8 bytes */
  237. buf = os_malloc(keydatalen);
  238. if (buf == NULL)
  239. return NULL;
  240. if (aes_unwrap(kek, keydatalen / 8, (u8 *) (hdr + 1), buf)) {
  241. os_free(buf);
  242. wpa_printf(MSG_INFO, "AES unwrap failed - "
  243. "could not decrypt EAPOL-Key key data");
  244. return NULL;
  245. }
  246. *len = keydatalen;
  247. return buf;
  248. }
  249. static u8 * decrypt_eapol_key_data(const u8 *kek, u16 ver,
  250. const struct wpa_eapol_key *hdr,
  251. size_t *len)
  252. {
  253. switch (ver) {
  254. case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
  255. return decrypt_eapol_key_data_rc4(kek, hdr, len);
  256. case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
  257. case WPA_KEY_INFO_TYPE_AES_128_CMAC:
  258. return decrypt_eapol_key_data_aes(kek, hdr, len);
  259. default:
  260. wpa_printf(MSG_INFO, "Unsupported EAPOL-Key Key Descriptor "
  261. "Version %u", ver);
  262. return NULL;
  263. }
  264. }
  265. static void learn_kde_keys(struct wlantest_bss *bss, const u8 *buf, size_t len,
  266. const u8 *rsc)
  267. {
  268. struct wpa_eapol_ie_parse ie;
  269. if (wpa_supplicant_parse_ies(buf, len, &ie) < 0) {
  270. wpa_printf(MSG_INFO, "Failed to parse EAPOL-Key Key Data");
  271. return;
  272. }
  273. if (ie.wpa_ie) {
  274. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - WPA IE",
  275. ie.wpa_ie, ie.wpa_ie_len);
  276. }
  277. if (ie.rsn_ie) {
  278. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - RSN IE",
  279. ie.rsn_ie, ie.rsn_ie_len);
  280. }
  281. if (ie.gtk) {
  282. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - GTK KDE",
  283. ie.gtk, ie.gtk_len);
  284. if (ie.gtk_len >= 2 && ie.gtk_len <= 2 + 32) {
  285. int id;
  286. id = ie.gtk[0] & 0x03;
  287. wpa_printf(MSG_DEBUG, "GTK KeyID=%u tx=%u",
  288. id, !!(ie.gtk[0] & 0x04));
  289. if ((ie.gtk[0] & 0xf8) || ie.gtk[1])
  290. wpa_printf(MSG_INFO, "GTK KDE: Reserved field "
  291. "set: %02x %02x",
  292. ie.gtk[0], ie.gtk[1]);
  293. wpa_hexdump(MSG_DEBUG, "GTK", ie.gtk + 2,
  294. ie.gtk_len - 2);
  295. bss->gtk_len[id] = ie.gtk_len - 2;
  296. os_memcpy(bss->gtk[id], ie.gtk + 2, ie.gtk_len - 2);
  297. bss->rsc[id][0] = rsc[5];
  298. bss->rsc[id][1] = rsc[4];
  299. bss->rsc[id][2] = rsc[3];
  300. bss->rsc[id][3] = rsc[2];
  301. bss->rsc[id][4] = rsc[1];
  302. bss->rsc[id][5] = rsc[0];
  303. bss->gtk_idx = id;
  304. wpa_hexdump(MSG_DEBUG, "RSC", bss->rsc[id], 6);
  305. } else {
  306. wpa_printf(MSG_INFO, "Invalid GTK KDE length %u",
  307. (unsigned) ie.gtk_len);
  308. }
  309. }
  310. if (ie.igtk) {
  311. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - IGTK KDE",
  312. ie.igtk, ie.igtk_len);
  313. if (ie.igtk_len == 24) {
  314. u16 id;
  315. id = WPA_GET_LE16(ie.igtk);
  316. if (id > 5) {
  317. wpa_printf(MSG_INFO, "Unexpected IGTK KeyID "
  318. "%u", id);
  319. } else {
  320. const u8 *ipn;
  321. wpa_printf(MSG_DEBUG, "IGTK KeyID %u", id);
  322. wpa_hexdump(MSG_DEBUG, "IPN", ie.igtk + 2, 6);
  323. wpa_hexdump(MSG_DEBUG, "IGTK", ie.igtk + 8,
  324. 16);
  325. os_memcpy(bss->igtk[id], ie.igtk + 8, 16);
  326. bss->igtk_set[id] = 1;
  327. ipn = ie.igtk + 2;
  328. bss->ipn[id][0] = ipn[5];
  329. bss->ipn[id][1] = ipn[4];
  330. bss->ipn[id][2] = ipn[3];
  331. bss->ipn[id][3] = ipn[2];
  332. bss->ipn[id][4] = ipn[1];
  333. bss->ipn[id][5] = ipn[0];
  334. bss->igtk_idx = id;
  335. }
  336. } else {
  337. wpa_printf(MSG_INFO, "Invalid IGTK KDE length %u",
  338. (unsigned) ie.igtk_len);
  339. }
  340. }
  341. }
  342. static void rx_data_eapol_key_3_of_4(struct wlantest *wt, const u8 *dst,
  343. const u8 *src, const u8 *data, size_t len)
  344. {
  345. struct wlantest_bss *bss;
  346. struct wlantest_sta *sta;
  347. const struct ieee802_1x_hdr *eapol;
  348. const struct wpa_eapol_key *hdr;
  349. const u8 *key_data;
  350. int recalc = 0;
  351. u16 key_info, ver;
  352. u8 *decrypted_buf = NULL;
  353. const u8 *decrypted;
  354. size_t decrypted_len = 0;
  355. struct wpa_eapol_ie_parse ie;
  356. wpa_printf(MSG_DEBUG, "EAPOL-Key 3/4 " MACSTR " -> " MACSTR,
  357. MAC2STR(src), MAC2STR(dst));
  358. bss = bss_get(wt, src);
  359. if (bss == NULL)
  360. return;
  361. sta = sta_get(bss, dst);
  362. if (sta == NULL)
  363. return;
  364. eapol = (const struct ieee802_1x_hdr *) data;
  365. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  366. key_info = WPA_GET_BE16(hdr->key_info);
  367. if (os_memcmp(sta->anonce, hdr->key_nonce, WPA_NONCE_LEN) != 0) {
  368. wpa_printf(MSG_INFO, "EAPOL-Key ANonce mismatch between 1/4 "
  369. "and 3/4");
  370. recalc = 1;
  371. }
  372. os_memcpy(sta->anonce, hdr->key_nonce, WPA_NONCE_LEN);
  373. if (recalc) {
  374. derive_ptk(wt, bss, sta, key_info & WPA_KEY_INFO_TYPE_MASK,
  375. data, len);
  376. }
  377. if (!sta->ptk_set) {
  378. wpa_printf(MSG_DEBUG, "No PTK known to process EAPOL-Key 3/4");
  379. return;
  380. }
  381. if (check_mic(sta->ptk.kck, key_info & WPA_KEY_INFO_TYPE_MASK,
  382. data, len) < 0) {
  383. wpa_printf(MSG_INFO, "Mismatch in EAPOL-Key 3/4 MIC");
  384. return;
  385. }
  386. wpa_printf(MSG_DEBUG, "Valid MIC found in EAPOL-Key 3/4");
  387. key_data = (const u8 *) (hdr + 1);
  388. if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
  389. if (sta->proto & WPA_PROTO_RSN)
  390. wpa_printf(MSG_INFO, "EAPOL-Key 3/4 without "
  391. "EncrKeyData bit");
  392. decrypted = key_data;
  393. decrypted_len = WPA_GET_BE16(hdr->key_data_length);
  394. } else {
  395. ver = key_info & WPA_KEY_INFO_TYPE_MASK;
  396. decrypted_buf = decrypt_eapol_key_data(sta->ptk.kek, ver, hdr,
  397. &decrypted_len);
  398. if (decrypted_buf == NULL) {
  399. wpa_printf(MSG_INFO, "Failed to decrypt EAPOL-Key Key "
  400. "Data");
  401. return;
  402. }
  403. decrypted = decrypted_buf;
  404. wpa_hexdump(MSG_DEBUG, "Decrypted EAPOL-Key Key Data",
  405. decrypted, decrypted_len);
  406. }
  407. if (wt->write_pcap_dumper && decrypted != key_data) {
  408. /* Fill in a dummy Data frame header */
  409. u8 buf[24 + 8 + sizeof(*eapol) + sizeof(*hdr)];
  410. struct ieee80211_hdr *h;
  411. struct wpa_eapol_key *k;
  412. const u8 *p;
  413. u8 *pos;
  414. size_t plain_len;
  415. plain_len = decrypted_len;
  416. p = decrypted;
  417. while (p + 1 < decrypted + decrypted_len) {
  418. if (p[0] == 0xdd && p[1] == 0x00) {
  419. /* Remove padding */
  420. plain_len = p - decrypted;
  421. break;
  422. }
  423. p += 2 + p[1];
  424. }
  425. os_memset(buf, 0, sizeof(buf));
  426. h = (struct ieee80211_hdr *) buf;
  427. h->frame_control = host_to_le16(0x0208);
  428. os_memcpy(h->addr1, dst, ETH_ALEN);
  429. os_memcpy(h->addr2, src, ETH_ALEN);
  430. os_memcpy(h->addr3, src, ETH_ALEN);
  431. pos = (u8 *) (h + 1);
  432. os_memcpy(pos, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8);
  433. pos += 8;
  434. os_memcpy(pos, eapol, sizeof(*eapol));
  435. pos += sizeof(*eapol);
  436. os_memcpy(pos, hdr, sizeof(*hdr));
  437. k = (struct wpa_eapol_key *) pos;
  438. WPA_PUT_BE16(k->key_info,
  439. key_info & ~WPA_KEY_INFO_ENCR_KEY_DATA);
  440. WPA_PUT_BE16(k->key_data_length, plain_len);
  441. write_pcap_decrypted(wt, buf, sizeof(buf),
  442. decrypted, plain_len);
  443. }
  444. if (wpa_supplicant_parse_ies(decrypted, decrypted_len, &ie) < 0) {
  445. wpa_printf(MSG_INFO, "Failed to parse EAPOL-Key Key Data");
  446. os_free(decrypted_buf);
  447. return;
  448. }
  449. if ((ie.wpa_ie &&
  450. os_memcmp(ie.wpa_ie, bss->wpaie, ie.wpa_ie_len) != 0) ||
  451. (ie.wpa_ie == NULL && bss->wpaie[0])) {
  452. wpa_printf(MSG_INFO, "Mismatch in WPA IE between "
  453. "EAPOL-Key 3/4 and Beacon/Probe Response "
  454. "from " MACSTR, MAC2STR(bss->bssid));
  455. wpa_hexdump(MSG_INFO, "WPA IE in EAPOL-Key",
  456. ie.wpa_ie, ie.wpa_ie_len);
  457. wpa_hexdump(MSG_INFO, "WPA IE in Beacon/Probe "
  458. "Response",
  459. bss->wpaie,
  460. bss->wpaie[0] ? 2 + bss->wpaie[1] : 0);
  461. }
  462. if ((ie.rsn_ie &&
  463. os_memcmp(ie.rsn_ie, bss->rsnie, ie.rsn_ie_len) != 0) ||
  464. (ie.rsn_ie == NULL && bss->rsnie[0])) {
  465. wpa_printf(MSG_INFO, "Mismatch in RSN IE between "
  466. "EAPOL-Key 3/4 and Beacon/Probe Response "
  467. "from " MACSTR, MAC2STR(bss->bssid));
  468. wpa_hexdump(MSG_INFO, "RSN IE in EAPOL-Key",
  469. ie.rsn_ie, ie.rsn_ie_len);
  470. wpa_hexdump(MSG_INFO, "RSN IE in (Re)Association "
  471. "Request",
  472. bss->rsnie,
  473. bss->rsnie[0] ? 2 + bss->rsnie[1] : 0);
  474. }
  475. learn_kde_keys(bss, decrypted, decrypted_len, hdr->key_rsc);
  476. os_free(decrypted_buf);
  477. }
  478. static void rx_data_eapol_key_4_of_4(struct wlantest *wt, const u8 *dst,
  479. const u8 *src, const u8 *data, size_t len)
  480. {
  481. struct wlantest_bss *bss;
  482. struct wlantest_sta *sta;
  483. const struct ieee802_1x_hdr *eapol;
  484. const struct wpa_eapol_key *hdr;
  485. u16 key_info;
  486. wpa_printf(MSG_DEBUG, "EAPOL-Key 4/4 " MACSTR " -> " MACSTR,
  487. MAC2STR(src), MAC2STR(dst));
  488. bss = bss_get(wt, dst);
  489. if (bss == NULL)
  490. return;
  491. sta = sta_get(bss, src);
  492. if (sta == NULL)
  493. return;
  494. eapol = (const struct ieee802_1x_hdr *) data;
  495. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  496. if (!is_zero(hdr->key_rsc, 8)) {
  497. wpa_printf(MSG_INFO, "EAPOL-Key 4/4 from " MACSTR " used "
  498. "non-zero Key RSC", MAC2STR(src));
  499. }
  500. key_info = WPA_GET_BE16(hdr->key_info);
  501. if (!sta->ptk_set) {
  502. wpa_printf(MSG_DEBUG, "No PTK known to process EAPOL-Key 4/4");
  503. return;
  504. }
  505. if (sta->ptk_set &&
  506. check_mic(sta->ptk.kck, key_info & WPA_KEY_INFO_TYPE_MASK,
  507. data, len) < 0) {
  508. wpa_printf(MSG_INFO, "Mismatch in EAPOL-Key 4/4 MIC");
  509. return;
  510. }
  511. wpa_printf(MSG_DEBUG, "Valid MIC found in EAPOL-Key 4/4");
  512. }
  513. static void rx_data_eapol_key_1_of_2(struct wlantest *wt, const u8 *dst,
  514. const u8 *src, const u8 *data, size_t len)
  515. {
  516. struct wlantest_bss *bss;
  517. struct wlantest_sta *sta;
  518. const struct ieee802_1x_hdr *eapol;
  519. const struct wpa_eapol_key *hdr;
  520. const u8 *key_data;
  521. u16 key_info, ver;
  522. u8 *decrypted;
  523. size_t decrypted_len = 0;
  524. wpa_printf(MSG_DEBUG, "EAPOL-Key 1/2 " MACSTR " -> " MACSTR,
  525. MAC2STR(src), MAC2STR(dst));
  526. bss = bss_get(wt, src);
  527. if (bss == NULL)
  528. return;
  529. sta = sta_get(bss, dst);
  530. if (sta == NULL)
  531. return;
  532. eapol = (const struct ieee802_1x_hdr *) data;
  533. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  534. key_info = WPA_GET_BE16(hdr->key_info);
  535. if (!sta->ptk_set) {
  536. wpa_printf(MSG_DEBUG, "No PTK known to process EAPOL-Key 1/2");
  537. return;
  538. }
  539. if (sta->ptk_set &&
  540. check_mic(sta->ptk.kck, key_info & WPA_KEY_INFO_TYPE_MASK,
  541. data, len) < 0) {
  542. wpa_printf(MSG_INFO, "Mismatch in EAPOL-Key 1/2 MIC");
  543. return;
  544. }
  545. wpa_printf(MSG_DEBUG, "Valid MIC found in EAPOL-Key 1/2");
  546. key_data = (const u8 *) (hdr + 1);
  547. if (sta->proto & WPA_PROTO_RSN &&
  548. !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
  549. wpa_printf(MSG_INFO, "EAPOL-Key 1/2 without EncrKeyData bit");
  550. return;
  551. }
  552. ver = key_info & WPA_KEY_INFO_TYPE_MASK;
  553. decrypted = decrypt_eapol_key_data(sta->ptk.kek, ver, hdr,
  554. &decrypted_len);
  555. if (decrypted == NULL) {
  556. wpa_printf(MSG_INFO, "Failed to decrypt EAPOL-Key Key Data");
  557. return;
  558. }
  559. wpa_hexdump(MSG_DEBUG, "Decrypted EAPOL-Key Key Data",
  560. decrypted, decrypted_len);
  561. if (wt->write_pcap_dumper) {
  562. /* Fill in a dummy Data frame header */
  563. u8 buf[24 + 8 + sizeof(*eapol) + sizeof(*hdr)];
  564. struct ieee80211_hdr *h;
  565. struct wpa_eapol_key *k;
  566. u8 *pos;
  567. size_t plain_len;
  568. plain_len = decrypted_len;
  569. pos = decrypted;
  570. while (pos + 1 < decrypted + decrypted_len) {
  571. if (pos[0] == 0xdd && pos[1] == 0x00) {
  572. /* Remove padding */
  573. plain_len = pos - decrypted;
  574. break;
  575. }
  576. pos += 2 + pos[1];
  577. }
  578. os_memset(buf, 0, sizeof(buf));
  579. h = (struct ieee80211_hdr *) buf;
  580. h->frame_control = host_to_le16(0x0208);
  581. os_memcpy(h->addr1, dst, ETH_ALEN);
  582. os_memcpy(h->addr2, src, ETH_ALEN);
  583. os_memcpy(h->addr3, src, ETH_ALEN);
  584. pos = (u8 *) (h + 1);
  585. os_memcpy(pos, "\xaa\xaa\x03\x00\x00\x00\x88\x8e", 8);
  586. pos += 8;
  587. os_memcpy(pos, eapol, sizeof(*eapol));
  588. pos += sizeof(*eapol);
  589. os_memcpy(pos, hdr, sizeof(*hdr));
  590. k = (struct wpa_eapol_key *) pos;
  591. WPA_PUT_BE16(k->key_info,
  592. key_info & ~WPA_KEY_INFO_ENCR_KEY_DATA);
  593. WPA_PUT_BE16(k->key_data_length, plain_len);
  594. write_pcap_decrypted(wt, buf, sizeof(buf),
  595. decrypted, plain_len);
  596. }
  597. if (sta->proto & WPA_PROTO_RSN)
  598. learn_kde_keys(bss, decrypted, decrypted_len, hdr->key_rsc);
  599. else {
  600. int klen = bss->group_cipher == WPA_CIPHER_TKIP ? 32 : 16;
  601. if (decrypted_len == klen) {
  602. const u8 *rsc = hdr->key_rsc;
  603. int id;
  604. id = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
  605. WPA_KEY_INFO_KEY_INDEX_SHIFT;
  606. wpa_printf(MSG_DEBUG, "GTK key index %d", id);
  607. wpa_hexdump(MSG_DEBUG, "GTK", decrypted,
  608. decrypted_len);
  609. bss->gtk_len[id] = decrypted_len;
  610. os_memcpy(bss->gtk[id], decrypted, decrypted_len);
  611. bss->rsc[id][0] = rsc[5];
  612. bss->rsc[id][1] = rsc[4];
  613. bss->rsc[id][2] = rsc[3];
  614. bss->rsc[id][3] = rsc[2];
  615. bss->rsc[id][4] = rsc[1];
  616. bss->rsc[id][5] = rsc[0];
  617. wpa_hexdump(MSG_DEBUG, "RSC", bss->rsc[id], 6);
  618. } else {
  619. wpa_printf(MSG_INFO, "Unexpected WPA Key Data length "
  620. "in Group Key msg 1/2 from " MACSTR,
  621. MAC2STR(src));
  622. }
  623. }
  624. os_free(decrypted);
  625. }
  626. static void rx_data_eapol_key_2_of_2(struct wlantest *wt, const u8 *dst,
  627. const u8 *src, const u8 *data, size_t len)
  628. {
  629. struct wlantest_bss *bss;
  630. struct wlantest_sta *sta;
  631. const struct ieee802_1x_hdr *eapol;
  632. const struct wpa_eapol_key *hdr;
  633. u16 key_info;
  634. wpa_printf(MSG_DEBUG, "EAPOL-Key 2/2 " MACSTR " -> " MACSTR,
  635. MAC2STR(src), MAC2STR(dst));
  636. bss = bss_get(wt, dst);
  637. if (bss == NULL)
  638. return;
  639. sta = sta_get(bss, src);
  640. if (sta == NULL)
  641. return;
  642. eapol = (const struct ieee802_1x_hdr *) data;
  643. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  644. if (!is_zero(hdr->key_rsc, 8)) {
  645. wpa_printf(MSG_INFO, "EAPOL-Key 2/2 from " MACSTR " used "
  646. "non-zero Key RSC", MAC2STR(src));
  647. }
  648. key_info = WPA_GET_BE16(hdr->key_info);
  649. if (!sta->ptk_set) {
  650. wpa_printf(MSG_DEBUG, "No PTK known to process EAPOL-Key 2/2");
  651. return;
  652. }
  653. if (sta->ptk_set &&
  654. check_mic(sta->ptk.kck, key_info & WPA_KEY_INFO_TYPE_MASK,
  655. data, len) < 0) {
  656. wpa_printf(MSG_INFO, "Mismatch in EAPOL-Key 2/2 MIC");
  657. return;
  658. }
  659. wpa_printf(MSG_DEBUG, "Valid MIC found in EAPOL-Key 2/2");
  660. }
  661. static void rx_data_eapol_key(struct wlantest *wt, const u8 *dst,
  662. const u8 *src, const u8 *data, size_t len,
  663. int prot)
  664. {
  665. const struct ieee802_1x_hdr *eapol;
  666. const struct wpa_eapol_key *hdr;
  667. const u8 *key_data;
  668. u16 key_info, key_length, ver, key_data_length;
  669. eapol = (const struct ieee802_1x_hdr *) data;
  670. hdr = (const struct wpa_eapol_key *) (eapol + 1);
  671. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key",
  672. (const u8 *) hdr, len - sizeof(*eapol));
  673. if (len < sizeof(*hdr)) {
  674. wpa_printf(MSG_INFO, "Too short EAPOL-Key frame from " MACSTR,
  675. MAC2STR(src));
  676. return;
  677. }
  678. if (hdr->type == EAPOL_KEY_TYPE_RC4) {
  679. /* TODO: EAPOL-Key RC4 for WEP */
  680. wpa_printf(MSG_INFO, "EAPOL-Key Descriptor Type RC4 from "
  681. MACSTR, MAC2STR(src));
  682. return;
  683. }
  684. if (hdr->type != EAPOL_KEY_TYPE_RSN &&
  685. hdr->type != EAPOL_KEY_TYPE_WPA) {
  686. wpa_printf(MSG_INFO, "Unsupported EAPOL-Key Descriptor Type "
  687. "%u from " MACSTR, hdr->type, MAC2STR(src));
  688. return;
  689. }
  690. key_info = WPA_GET_BE16(hdr->key_info);
  691. key_length = WPA_GET_BE16(hdr->key_length);
  692. key_data_length = WPA_GET_BE16(hdr->key_data_length);
  693. key_data = (const u8 *) (hdr + 1);
  694. if (key_data + key_data_length > data + len) {
  695. wpa_printf(MSG_INFO, "Truncated EAPOL-Key from " MACSTR,
  696. MAC2STR(src));
  697. return;
  698. }
  699. if (key_data + key_data_length < data + len) {
  700. wpa_hexdump(MSG_DEBUG, "Extra data after EAPOL-Key Key Data "
  701. "field", key_data + key_data_length,
  702. data + len - key_data - key_data_length);
  703. }
  704. ver = key_info & WPA_KEY_INFO_TYPE_MASK;
  705. wpa_printf(MSG_DEBUG, "EAPOL-Key ver=%u %c idx=%u%s%s%s%s%s%s%s%s "
  706. "datalen=%u",
  707. ver, key_info & WPA_KEY_INFO_KEY_TYPE ? 'P' : 'G',
  708. (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
  709. WPA_KEY_INFO_KEY_INDEX_SHIFT,
  710. (key_info & WPA_KEY_INFO_INSTALL) ? " Install" : "",
  711. (key_info & WPA_KEY_INFO_ACK) ? " ACK" : "",
  712. (key_info & WPA_KEY_INFO_MIC) ? " MIC" : "",
  713. (key_info & WPA_KEY_INFO_SECURE) ? " Secure" : "",
  714. (key_info & WPA_KEY_INFO_ERROR) ? " Error" : "",
  715. (key_info & WPA_KEY_INFO_REQUEST) ? " Request" : "",
  716. (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) ? " Encr" : "",
  717. (key_info & WPA_KEY_INFO_SMK_MESSAGE) ? " SMK" : "",
  718. key_data_length);
  719. if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
  720. ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES &&
  721. ver != WPA_KEY_INFO_TYPE_AES_128_CMAC) {
  722. wpa_printf(MSG_INFO, "Unsupported EAPOL-Key Key Descriptor "
  723. "Version %u from " MACSTR, ver, MAC2STR(src));
  724. return;
  725. }
  726. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Replay Counter",
  727. hdr->replay_counter, WPA_REPLAY_COUNTER_LEN);
  728. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Nonce",
  729. hdr->key_nonce, WPA_NONCE_LEN);
  730. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key IV",
  731. hdr->key_iv, 16);
  732. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key RSC",
  733. hdr->key_rsc, WPA_KEY_RSC_LEN);
  734. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key MIC",
  735. hdr->key_mic, 16);
  736. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data",
  737. key_data, key_data_length);
  738. if (hdr->type == EAPOL_KEY_TYPE_RSN &&
  739. (key_info & (WPA_KEY_INFO_KEY_INDEX_MASK | BIT(14) | BIT(15))) !=
  740. 0) {
  741. wpa_printf(MSG_INFO, "RSN EAPOL-Key with non-zero reserved "
  742. "Key Info bits 0x%x from " MACSTR,
  743. key_info, MAC2STR(src));
  744. }
  745. if (hdr->type == EAPOL_KEY_TYPE_WPA &&
  746. (key_info & (WPA_KEY_INFO_ENCR_KEY_DATA |
  747. WPA_KEY_INFO_SMK_MESSAGE |BIT(14) | BIT(15))) != 0) {
  748. wpa_printf(MSG_INFO, "WPA EAPOL-Key with non-zero reserved "
  749. "Key Info bits 0x%x from " MACSTR,
  750. key_info, MAC2STR(src));
  751. }
  752. if (key_length > 32) {
  753. wpa_printf(MSG_INFO, "EAPOL-Key with invalid Key Length %d "
  754. "from " MACSTR, key_length, MAC2STR(src));
  755. }
  756. if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
  757. !is_zero(hdr->key_iv, 16)) {
  758. wpa_printf(MSG_INFO, "EAPOL-Key with non-zero Key IV "
  759. "(reserved with ver=%d) field from " MACSTR,
  760. ver, MAC2STR(src));
  761. wpa_hexdump(MSG_INFO, "EAPOL-Key Key IV (reserved)",
  762. hdr->key_iv, 16);
  763. }
  764. if (!is_zero(hdr->key_id, 8)) {
  765. wpa_printf(MSG_INFO, "EAPOL-Key with non-zero Key ID "
  766. "(reserved) field from " MACSTR, MAC2STR(src));
  767. wpa_hexdump(MSG_INFO, "EAPOL-Key Key ID (reserved)",
  768. hdr->key_id, 8);
  769. }
  770. if (hdr->key_rsc[6] || hdr->key_rsc[7]) {
  771. wpa_printf(MSG_INFO, "EAPOL-Key with non-zero Key RSC octets "
  772. "(last two are unused)" MACSTR, MAC2STR(src));
  773. }
  774. if (key_info & (WPA_KEY_INFO_ERROR | WPA_KEY_INFO_REQUEST))
  775. return;
  776. if (key_info & WPA_KEY_INFO_SMK_MESSAGE)
  777. return;
  778. if (key_info & WPA_KEY_INFO_KEY_TYPE) {
  779. /* 4-Way Handshake */
  780. switch (key_info & (WPA_KEY_INFO_SECURE |
  781. WPA_KEY_INFO_MIC |
  782. WPA_KEY_INFO_ACK |
  783. WPA_KEY_INFO_INSTALL)) {
  784. case WPA_KEY_INFO_ACK:
  785. rx_data_eapol_key_1_of_4(wt, dst, src, data, len);
  786. break;
  787. case WPA_KEY_INFO_MIC:
  788. if (key_data_length == 0)
  789. rx_data_eapol_key_4_of_4(wt, dst, src, data,
  790. len);
  791. else
  792. rx_data_eapol_key_2_of_4(wt, dst, src, data,
  793. len);
  794. break;
  795. case WPA_KEY_INFO_MIC | WPA_KEY_INFO_ACK |
  796. WPA_KEY_INFO_INSTALL:
  797. /* WPA does not include Secure bit in 3/4 */
  798. rx_data_eapol_key_3_of_4(wt, dst, src, data, len);
  799. break;
  800. case WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC |
  801. WPA_KEY_INFO_ACK | WPA_KEY_INFO_INSTALL:
  802. rx_data_eapol_key_3_of_4(wt, dst, src, data, len);
  803. break;
  804. case WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC:
  805. rx_data_eapol_key_4_of_4(wt, dst, src, data, len);
  806. break;
  807. default:
  808. wpa_printf(MSG_DEBUG, "Unsupported EAPOL-Key frame");
  809. break;
  810. }
  811. } else {
  812. /* Group Key Handshake */
  813. switch (key_info & (WPA_KEY_INFO_SECURE |
  814. WPA_KEY_INFO_MIC |
  815. WPA_KEY_INFO_ACK)) {
  816. case WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC |
  817. WPA_KEY_INFO_ACK:
  818. rx_data_eapol_key_1_of_2(wt, dst, src, data, len);
  819. break;
  820. case WPA_KEY_INFO_SECURE | WPA_KEY_INFO_MIC:
  821. rx_data_eapol_key_2_of_2(wt, dst, src, data, len);
  822. break;
  823. default:
  824. wpa_printf(MSG_DEBUG, "Unsupported EAPOL-Key frame");
  825. break;
  826. }
  827. }
  828. }
  829. void rx_data_eapol(struct wlantest *wt, const u8 *dst, const u8 *src,
  830. const u8 *data, size_t len, int prot)
  831. {
  832. const struct ieee802_1x_hdr *hdr;
  833. u16 length;
  834. const u8 *p;
  835. wpa_hexdump(MSG_EXCESSIVE, "EAPOL", data, len);
  836. if (len < sizeof(*hdr)) {
  837. wpa_printf(MSG_INFO, "Too short EAPOL frame from " MACSTR,
  838. MAC2STR(src));
  839. return;
  840. }
  841. hdr = (const struct ieee802_1x_hdr *) data;
  842. length = be_to_host16(hdr->length);
  843. wpa_printf(MSG_DEBUG, "RX EAPOL: " MACSTR " -> " MACSTR "%s ver=%u "
  844. "type=%u len=%u",
  845. MAC2STR(src), MAC2STR(dst), prot ? " Prot" : "",
  846. hdr->version, hdr->type, length);
  847. if (hdr->version < 1 || hdr->version > 3) {
  848. wpa_printf(MSG_INFO, "Unexpected EAPOL version %u from "
  849. MACSTR, hdr->version, MAC2STR(src));
  850. }
  851. if (sizeof(*hdr) + length > len) {
  852. wpa_printf(MSG_INFO, "Truncated EAPOL frame from " MACSTR,
  853. MAC2STR(src));
  854. return;
  855. }
  856. if (sizeof(*hdr) + length < len) {
  857. wpa_printf(MSG_INFO, "EAPOL frame with %d extra bytes",
  858. (int) (len - sizeof(*hdr) - length));
  859. }
  860. p = (const u8 *) (hdr + 1);
  861. switch (hdr->type) {
  862. case IEEE802_1X_TYPE_EAP_PACKET:
  863. wpa_hexdump(MSG_MSGDUMP, "EAPOL - EAP packet", p, length);
  864. break;
  865. case IEEE802_1X_TYPE_EAPOL_START:
  866. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Start", p, length);
  867. break;
  868. case IEEE802_1X_TYPE_EAPOL_LOGOFF:
  869. wpa_hexdump(MSG_MSGDUMP, "EAPOL-Logoff", p, length);
  870. break;
  871. case IEEE802_1X_TYPE_EAPOL_KEY:
  872. rx_data_eapol_key(wt, dst, src, data, sizeof(*hdr) + length,
  873. prot);
  874. break;
  875. case IEEE802_1X_TYPE_EAPOL_ENCAPSULATED_ASF_ALERT:
  876. wpa_hexdump(MSG_MSGDUMP, "EAPOL - Encapsulated ASF alert",
  877. p, length);
  878. break;
  879. default:
  880. wpa_hexdump(MSG_MSGDUMP, "Unknown EAPOL payload", p, length);
  881. break;
  882. }
  883. }