xref: /openbsd/sys/net80211/ieee80211_crypto.c (revision 097a140d) 
1 /*	$OpenBSD: ieee80211_crypto.c,v 1.77 2020/12/10 12:53:03 stsp Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/param.h>
20 #include <sys/systm.h>
21 #include <sys/mbuf.h>
22 #include <sys/malloc.h>
23 #include <sys/kernel.h>
24 #include <sys/socket.h>
25 #include <sys/sockio.h>
26 #include <sys/endian.h>
27 #include <sys/errno.h>
28 #include <sys/sysctl.h>
29 
30 #include <net/if.h>
31 #include <net/if_dl.h>
32 #include <net/if_media.h>
33 
34 #include <netinet/in.h>
35 #include <netinet/if_ether.h>
36 
37 #include <net80211/ieee80211_var.h>
38 #include <net80211/ieee80211_priv.h>
39 
40 #include <crypto/arc4.h>
41 #include <crypto/md5.h>
42 #include <crypto/sha1.h>
43 #include <crypto/sha2.h>
44 #include <crypto/hmac.h>
45 #include <crypto/aes.h>
46 #include <crypto/cmac.h>
47 #include <crypto/key_wrap.h>
48 
49 void	ieee80211_prf(const u_int8_t *, size_t, const u_int8_t *, size_t,
50 	    const u_int8_t *, size_t, u_int8_t *, size_t);
51 void	ieee80211_kdf(const u_int8_t *, size_t, const u_int8_t *, size_t,
52 	    const u_int8_t *, size_t, u_int8_t *, size_t);
53 void	ieee80211_derive_pmkid(enum ieee80211_akm, const u_int8_t *,
54 	    const u_int8_t *, const u_int8_t *, u_int8_t *);
55 
56 void
57 ieee80211_crypto_attach(struct ifnet *ifp)
58 {
59 	struct ieee80211com *ic = (void *)ifp;
60 
61 	TAILQ_INIT(&ic->ic_pmksa);
62 	if (ic->ic_caps & IEEE80211_C_RSN) {
63 		ic->ic_rsnprotos = IEEE80211_PROTO_RSN;
64 		ic->ic_rsnakms = IEEE80211_AKM_PSK;
65 		ic->ic_rsnciphers = IEEE80211_CIPHER_CCMP;
66 		ic->ic_rsngroupcipher = IEEE80211_CIPHER_CCMP;
67 		ic->ic_rsngroupmgmtcipher = IEEE80211_CIPHER_BIP;
68 	}
69 	ic->ic_set_key = ieee80211_set_key;
70 	ic->ic_delete_key = ieee80211_delete_key;
71 #ifndef IEEE80211_STA_ONLY
72 	timeout_set(&ic->ic_tkip_micfail_timeout,
73 	    ieee80211_michael_mic_failure_timeout, ic);
74 #endif
75 }
76 
77 void
78 ieee80211_crypto_detach(struct ifnet *ifp)
79 {
80 	struct ieee80211com *ic = (void *)ifp;
81 	struct ieee80211_pmk *pmk;
82 
83 	/* purge the PMKSA cache */
84 	while ((pmk = TAILQ_FIRST(&ic->ic_pmksa)) != NULL) {
85 		TAILQ_REMOVE(&ic->ic_pmksa, pmk, pmk_next);
86 		explicit_bzero(pmk, sizeof(*pmk));
87 		free(pmk, M_DEVBUF, sizeof(*pmk));
88 	}
89 
90 	/* clear all group keys from memory */
91 	ieee80211_crypto_clear_groupkeys(ic);
92 
93 	/* clear pre-shared key from memory */
94 	explicit_bzero(ic->ic_psk, IEEE80211_PMK_LEN);
95 
96 #ifndef IEEE80211_STA_ONLY
97 	timeout_del(&ic->ic_tkip_micfail_timeout);
98 #endif
99 }
100 
101 void
102 ieee80211_crypto_clear_groupkeys(struct ieee80211com *ic)
103 {
104 	int i;
105 
106 	for (i = 0; i < IEEE80211_GROUP_NKID; i++) {
107 		struct ieee80211_key *k = &ic->ic_nw_keys[i];
108 		if (k->k_cipher != IEEE80211_CIPHER_NONE)
109 			(*ic->ic_delete_key)(ic, NULL, k);
110 		explicit_bzero(k, sizeof(*k));
111 	}
112 }
113 
114 /*
115  * Return the length in bytes of a cipher suite key (see Table 60).
116  */
117 int
118 ieee80211_cipher_keylen(enum ieee80211_cipher cipher)
119 {
120 	switch (cipher) {
121 	case IEEE80211_CIPHER_WEP40:
122 		return 5;
123 	case IEEE80211_CIPHER_TKIP:
124 		return 32;
125 	case IEEE80211_CIPHER_CCMP:
126 		return 16;
127 	case IEEE80211_CIPHER_WEP104:
128 		return 13;
129 	case IEEE80211_CIPHER_BIP:
130 		return 16;
131 	default:	/* unknown cipher */
132 		return 0;
133 	}
134 }
135 
136 int
137 ieee80211_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
138     struct ieee80211_key *k)
139 {
140 	int error;
141 
142 	switch (k->k_cipher) {
143 	case IEEE80211_CIPHER_WEP40:
144 	case IEEE80211_CIPHER_WEP104:
145 		error = ieee80211_wep_set_key(ic, k);
146 		break;
147 	case IEEE80211_CIPHER_TKIP:
148 		error = ieee80211_tkip_set_key(ic, k);
149 		break;
150 	case IEEE80211_CIPHER_CCMP:
151 		error = ieee80211_ccmp_set_key(ic, k);
152 		break;
153 	case IEEE80211_CIPHER_BIP:
154 		error = ieee80211_bip_set_key(ic, k);
155 		break;
156 	default:
157 		/* should not get there */
158 		error = EINVAL;
159 	}
160 
161 	if (error == 0)
162 		k->k_flags |= IEEE80211_KEY_SWCRYPTO;
163 
164 	return error;
165 }
166 
167 void
168 ieee80211_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
169     struct ieee80211_key *k)
170 {
171 	switch (k->k_cipher) {
172 	case IEEE80211_CIPHER_WEP40:
173 	case IEEE80211_CIPHER_WEP104:
174 		ieee80211_wep_delete_key(ic, k);
175 		break;
176 	case IEEE80211_CIPHER_TKIP:
177 		ieee80211_tkip_delete_key(ic, k);
178 		break;
179 	case IEEE80211_CIPHER_CCMP:
180 		ieee80211_ccmp_delete_key(ic, k);
181 		break;
182 	case IEEE80211_CIPHER_BIP:
183 		ieee80211_bip_delete_key(ic, k);
184 		break;
185 	default:
186 		/* should not get there */
187 		break;
188 	}
189 	explicit_bzero(k, sizeof(*k));
190 }
191 
192 struct ieee80211_key *
193 ieee80211_get_txkey(struct ieee80211com *ic, const struct ieee80211_frame *wh,
194     struct ieee80211_node *ni)
195 {
196 	int kid;
197 
198 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
199 	    !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
200 	    ni->ni_rsncipher != IEEE80211_CIPHER_USEGROUP)
201 		return &ni->ni_pairwise_key;
202 
203 	/* All other cases (including WEP) use a group key. */
204 	if (ni->ni_flags & IEEE80211_NODE_MFP)
205 		kid = ic->ic_igtk_kid;
206 	else
207 		kid = ic->ic_def_txkey;
208 
209 	return &ic->ic_nw_keys[kid];
210 }
211 
212 struct ieee80211_key *
213 ieee80211_get_rxkey(struct ieee80211com *ic, struct mbuf *m,
214     struct ieee80211_node *ni)
215 {
216 	struct ieee80211_key *k = NULL;
217 	struct ieee80211_frame *wh;
218 	u_int16_t kid;
219 	u_int8_t *ivp, *mmie;
220 	int hdrlen;
221 
222 	wh = mtod(m, struct ieee80211_frame *);
223 	if ((ic->ic_flags & IEEE80211_F_RSNON) &&
224 	    !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
225 	    ni->ni_rsncipher != IEEE80211_CIPHER_USEGROUP) {
226 		k = &ni->ni_pairwise_key;
227 	} else if (!IEEE80211_IS_MULTICAST(wh->i_addr1) ||
228 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
229 	    IEEE80211_FC0_TYPE_MGT) {
230 		/* retrieve group data key id from IV field */
231 		hdrlen = ieee80211_get_hdrlen(wh);
232 		/* check that IV field is present */
233 		if (m->m_len < hdrlen + 4)
234 			return NULL;
235 		ivp = (u_int8_t *)wh + hdrlen;
236 		kid = ivp[3] >> 6;
237 		k = &ic->ic_nw_keys[kid];
238 	} else {
239 		/* retrieve integrity group key id from MMIE */
240 		if (m->m_len < sizeof(*wh) + IEEE80211_MMIE_LEN)
241 			return NULL;
242 		/* it is assumed management frames are contiguous */
243 		mmie = (u_int8_t *)wh + m->m_len - IEEE80211_MMIE_LEN;
244 		/* check that MMIE is valid */
245 		if (mmie[0] != IEEE80211_ELEMID_MMIE || mmie[1] != 16)
246 			return NULL;
247 		kid = LE_READ_2(&mmie[2]);
248 		if (kid != 4 && kid != 5)
249 			return NULL;
250 		k = &ic->ic_nw_keys[kid];
251 	}
252 
253 	return k;
254 }
255 
256 struct mbuf *
257 ieee80211_encrypt(struct ieee80211com *ic, struct mbuf *m0,
258     struct ieee80211_key *k)
259 {
260 	if ((k->k_flags & IEEE80211_KEY_SWCRYPTO) == 0)
261 		panic("%s: key unset for sw crypto: %d", __func__, k->k_id);
262 
263 	switch (k->k_cipher) {
264 	case IEEE80211_CIPHER_WEP40:
265 	case IEEE80211_CIPHER_WEP104:
266 		m0 = ieee80211_wep_encrypt(ic, m0, k);
267 		break;
268 	case IEEE80211_CIPHER_TKIP:
269 		m0 = ieee80211_tkip_encrypt(ic, m0, k);
270 		break;
271 	case IEEE80211_CIPHER_CCMP:
272 		m0 = ieee80211_ccmp_encrypt(ic, m0, k);
273 		break;
274 	case IEEE80211_CIPHER_BIP:
275 		m0 = ieee80211_bip_encap(ic, m0, k);
276 		break;
277 	default:
278 		/* should not get there */
279 		panic("invalid key cipher 0x%x", k->k_cipher);
280 	}
281 	return m0;
282 }
283 
284 struct mbuf *
285 ieee80211_decrypt(struct ieee80211com *ic, struct mbuf *m0,
286     struct ieee80211_node *ni)
287 {
288 	struct ieee80211_key *k;
289 
290 	/* find key for decryption */
291 	k = ieee80211_get_rxkey(ic, m0, ni);
292 	if (k == NULL || (k->k_flags & IEEE80211_KEY_SWCRYPTO) == 0) {
293 		m_freem(m0);
294 		return NULL;
295 	}
296 
297 	switch (k->k_cipher) {
298 	case IEEE80211_CIPHER_WEP40:
299 	case IEEE80211_CIPHER_WEP104:
300 		m0 = ieee80211_wep_decrypt(ic, m0, k);
301 		break;
302 	case IEEE80211_CIPHER_TKIP:
303 		m0 = ieee80211_tkip_decrypt(ic, m0, k);
304 		break;
305 	case IEEE80211_CIPHER_CCMP:
306 		m0 = ieee80211_ccmp_decrypt(ic, m0, k);
307 		break;
308 	case IEEE80211_CIPHER_BIP:
309 		m0 = ieee80211_bip_decap(ic, m0, k);
310 		break;
311 	default:
312 		/* key not defined */
313 		m_freem(m0);
314 		m0 = NULL;
315 	}
316 	return m0;
317 }
318 
319 /*
320  * SHA1-based Pseudo-Random Function (see 8.5.1.1).
321  */
322 void
323 ieee80211_prf(const u_int8_t *key, size_t key_len, const u_int8_t *label,
324     size_t label_len, const u_int8_t *context, size_t context_len,
325     u_int8_t *output, size_t len)
326 {
327 	HMAC_SHA1_CTX ctx;
328 	u_int8_t digest[SHA1_DIGEST_LENGTH];
329 	u_int8_t count;
330 
331 	for (count = 0; len != 0; count++) {
332 		HMAC_SHA1_Init(&ctx, key, key_len);
333 		HMAC_SHA1_Update(&ctx, label, label_len);
334 		HMAC_SHA1_Update(&ctx, context, context_len);
335 		HMAC_SHA1_Update(&ctx, &count, 1);
336 		if (len < SHA1_DIGEST_LENGTH) {
337 			HMAC_SHA1_Final(digest, &ctx);
338 			/* truncate HMAC-SHA1 to len bytes */
339 			memcpy(output, digest, len);
340 			break;
341 		}
342 		HMAC_SHA1_Final(output, &ctx);
343 		output += SHA1_DIGEST_LENGTH;
344 		len -= SHA1_DIGEST_LENGTH;
345 	}
346 }
347 
348 /*
349  * SHA256-based Key Derivation Function (see 8.5.1.5.2).
350  */
351 void
352 ieee80211_kdf(const u_int8_t *key, size_t key_len, const u_int8_t *label,
353     size_t label_len, const u_int8_t *context, size_t context_len,
354     u_int8_t *output, size_t len)
355 {
356 	HMAC_SHA256_CTX ctx;
357 	u_int8_t digest[SHA256_DIGEST_LENGTH];
358 	u_int16_t i, iter, length;
359 
360 	length = htole16(len * NBBY);
361 	for (i = 1; len != 0; i++) {
362 		HMAC_SHA256_Init(&ctx, key, key_len);
363 		iter = htole16(i);
364 		HMAC_SHA256_Update(&ctx, (u_int8_t *)&iter, sizeof iter);
365 		HMAC_SHA256_Update(&ctx, label, label_len);
366 		HMAC_SHA256_Update(&ctx, context, context_len);
367 		HMAC_SHA256_Update(&ctx, (u_int8_t *)&length, sizeof length);
368 		if (len < SHA256_DIGEST_LENGTH) {
369 			HMAC_SHA256_Final(digest, &ctx);
370 			/* truncate HMAC-SHA-256 to len bytes */
371 			memcpy(output, digest, len);
372 			break;
373 		}
374 		HMAC_SHA256_Final(output, &ctx);
375 		output += SHA256_DIGEST_LENGTH;
376 		len -= SHA256_DIGEST_LENGTH;
377 	}
378 }
379 
380 /*
381  * Derive Pairwise Transient Key (PTK) (see 8.5.1.2).
382  */
383 void
384 ieee80211_derive_ptk(enum ieee80211_akm akm, const u_int8_t *pmk,
385     const u_int8_t *aa, const u_int8_t *spa, const u_int8_t *anonce,
386     const u_int8_t *snonce, struct ieee80211_ptk *ptk)
387 {
388 	void (*kdf)(const u_int8_t *, size_t, const u_int8_t *, size_t,
389 	    const u_int8_t *, size_t, u_int8_t *, size_t);
390 	u_int8_t buf[2 * IEEE80211_ADDR_LEN + 2 * EAPOL_KEY_NONCE_LEN];
391 	int ret;
392 
393 	/* Min(AA,SPA) || Max(AA,SPA) */
394 	ret = memcmp(aa, spa, IEEE80211_ADDR_LEN) < 0;
395 	memcpy(&buf[ 0], ret ? aa : spa, IEEE80211_ADDR_LEN);
396 	memcpy(&buf[ 6], ret ? spa : aa, IEEE80211_ADDR_LEN);
397 
398 	/* Min(ANonce,SNonce) || Max(ANonce,SNonce) */
399 	ret = memcmp(anonce, snonce, EAPOL_KEY_NONCE_LEN) < 0;
400 	memcpy(&buf[12], ret ? anonce : snonce, EAPOL_KEY_NONCE_LEN);
401 	memcpy(&buf[44], ret ? snonce : anonce, EAPOL_KEY_NONCE_LEN);
402 
403 	kdf = ieee80211_is_sha256_akm(akm) ? ieee80211_kdf : ieee80211_prf;
404 	(*kdf)(pmk, IEEE80211_PMK_LEN, "Pairwise key expansion", 23,
405 	    buf, sizeof buf, (u_int8_t *)ptk, sizeof(*ptk));
406 }
407 
408 static void
409 ieee80211_pmkid_sha1(const u_int8_t *pmk, const u_int8_t *aa,
410     const u_int8_t *spa, u_int8_t *pmkid)
411 {
412 	HMAC_SHA1_CTX ctx;
413 	u_int8_t digest[SHA1_DIGEST_LENGTH];
414 
415 	HMAC_SHA1_Init(&ctx, pmk, IEEE80211_PMK_LEN);
416 	HMAC_SHA1_Update(&ctx, "PMK Name", 8);
417 	HMAC_SHA1_Update(&ctx, aa, IEEE80211_ADDR_LEN);
418 	HMAC_SHA1_Update(&ctx, spa, IEEE80211_ADDR_LEN);
419 	HMAC_SHA1_Final(digest, &ctx);
420 	/* use the first 128 bits of HMAC-SHA1 */
421 	memcpy(pmkid, digest, IEEE80211_PMKID_LEN);
422 }
423 
424 static void
425 ieee80211_pmkid_sha256(const u_int8_t *pmk, const u_int8_t *aa,
426     const u_int8_t *spa, u_int8_t *pmkid)
427 {
428 	HMAC_SHA256_CTX ctx;
429 	u_int8_t digest[SHA256_DIGEST_LENGTH];
430 
431 	HMAC_SHA256_Init(&ctx, pmk, IEEE80211_PMK_LEN);
432 	HMAC_SHA256_Update(&ctx, "PMK Name", 8);
433 	HMAC_SHA256_Update(&ctx, aa, IEEE80211_ADDR_LEN);
434 	HMAC_SHA256_Update(&ctx, spa, IEEE80211_ADDR_LEN);
435 	HMAC_SHA256_Final(digest, &ctx);
436 	/* use the first 128 bits of HMAC-SHA-256 */
437 	memcpy(pmkid, digest, IEEE80211_PMKID_LEN);
438 }
439 
440 /*
441  * Derive Pairwise Master Key Identifier (PMKID) (see 8.5.1.2).
442  */
443 void
444 ieee80211_derive_pmkid(enum ieee80211_akm akm, const u_int8_t *pmk,
445     const u_int8_t *aa, const u_int8_t *spa, u_int8_t *pmkid)
446 {
447 	if (ieee80211_is_sha256_akm(akm))
448 		ieee80211_pmkid_sha256(pmk, aa, spa, pmkid);
449 	else
450 		ieee80211_pmkid_sha1(pmk, aa, spa, pmkid);
451 }
452 
453 typedef union _ANY_CTX {
454 	HMAC_MD5_CTX	md5;
455 	HMAC_SHA1_CTX	sha1;
456 	AES_CMAC_CTX	cmac;
457 } ANY_CTX;
458 
459 /*
460  * Compute the Key MIC field of an EAPOL-Key frame using the specified Key
461  * Confirmation Key (KCK).  The hash function can be HMAC-MD5, HMAC-SHA1
462  * or AES-128-CMAC depending on the EAPOL-Key Key Descriptor Version.
463  */
464 void
465 ieee80211_eapol_key_mic(struct ieee80211_eapol_key *key, const u_int8_t *kck)
466 {
467 	u_int8_t digest[SHA1_DIGEST_LENGTH];
468 	ANY_CTX ctx;	/* XXX off stack? */
469 	u_int len;
470 
471 	len = BE_READ_2(key->len) + 4;
472 
473 	switch (BE_READ_2(key->info) & EAPOL_KEY_VERSION_MASK) {
474 	case EAPOL_KEY_DESC_V1:
475 		HMAC_MD5_Init(&ctx.md5, kck, 16);
476 		HMAC_MD5_Update(&ctx.md5, (u_int8_t *)key, len);
477 		HMAC_MD5_Final(key->mic, &ctx.md5);
478 		break;
479 	case EAPOL_KEY_DESC_V2:
480 		HMAC_SHA1_Init(&ctx.sha1, kck, 16);
481 		HMAC_SHA1_Update(&ctx.sha1, (u_int8_t *)key, len);
482 		HMAC_SHA1_Final(digest, &ctx.sha1);
483 		/* truncate HMAC-SHA1 to its 128 MSBs */
484 		memcpy(key->mic, digest, EAPOL_KEY_MIC_LEN);
485 		break;
486 	case EAPOL_KEY_DESC_V3:
487 		AES_CMAC_Init(&ctx.cmac);
488 		AES_CMAC_SetKey(&ctx.cmac, kck);
489 		AES_CMAC_Update(&ctx.cmac, (u_int8_t *)key, len);
490 		AES_CMAC_Final(key->mic, &ctx.cmac);
491 		break;
492 	}
493 }
494 
495 /*
496  * Check the MIC of a received EAPOL-Key frame using the specified Key
497  * Confirmation Key (KCK).
498  */
499 int
500 ieee80211_eapol_key_check_mic(struct ieee80211_eapol_key *key,
501     const u_int8_t *kck)
502 {
503 	u_int8_t mic[EAPOL_KEY_MIC_LEN];
504 
505 	memcpy(mic, key->mic, EAPOL_KEY_MIC_LEN);
506 	memset(key->mic, 0, EAPOL_KEY_MIC_LEN);
507 	ieee80211_eapol_key_mic(key, kck);
508 
509 	return timingsafe_bcmp(key->mic, mic, EAPOL_KEY_MIC_LEN) != 0;
510 }
511 
512 #ifndef IEEE80211_STA_ONLY
513 /*
514  * Encrypt the Key Data field of an EAPOL-Key frame using the specified Key
515  * Encryption Key (KEK).  The encryption algorithm can be either ARC4 or
516  * AES Key Wrap depending on the EAPOL-Key Key Descriptor Version.
517  */
518 void
519 ieee80211_eapol_key_encrypt(struct ieee80211com *ic,
520     struct ieee80211_eapol_key *key, const u_int8_t *kek)
521 {
522 	union {
523 		struct rc4_ctx rc4;
524 		aes_key_wrap_ctx aes;
525 	} ctx;	/* XXX off stack? */
526 	u_int8_t keybuf[EAPOL_KEY_IV_LEN + 16];
527 	u_int16_t len, info;
528 	u_int8_t *data;
529 	int n;
530 
531 	len  = BE_READ_2(key->paylen);
532 	info = BE_READ_2(key->info);
533 	data = (u_int8_t *)(key + 1);
534 
535 	switch (info & EAPOL_KEY_VERSION_MASK) {
536 	case EAPOL_KEY_DESC_V1:
537 		/* set IV to the lower 16 octets of our global key counter */
538 		memcpy(key->iv, ic->ic_globalcnt + 16, 16);
539 		/* increment our global key counter (256-bit, big-endian) */
540 		for (n = 31; n >= 0 && ++ic->ic_globalcnt[n] == 0; n--);
541 
542 		/* concatenate the EAPOL-Key IV field and the KEK */
543 		memcpy(keybuf, key->iv, EAPOL_KEY_IV_LEN);
544 		memcpy(keybuf + EAPOL_KEY_IV_LEN, kek, 16);
545 
546 		rc4_keysetup(&ctx.rc4, keybuf, sizeof keybuf);
547 		/* discard the first 256 octets of the ARC4 key stream */
548 		rc4_skip(&ctx.rc4, RC4STATE);
549 		rc4_crypt(&ctx.rc4, data, data, len);
550 		break;
551 	case EAPOL_KEY_DESC_V2:
552 	case EAPOL_KEY_DESC_V3:
553 		if (len < 16 || (len & 7) != 0) {
554 			/* insert padding */
555 			n = (len < 16) ? 16 - len : 8 - (len & 7);
556 			data[len++] = IEEE80211_ELEMID_VENDOR;
557 			memset(&data[len], 0, n - 1);
558 			len += n - 1;
559 		}
560 		aes_key_wrap_set_key_wrap_only(&ctx.aes, kek, 16);
561 		aes_key_wrap(&ctx.aes, data, len / 8, data);
562 		len += 8;	/* AES Key Wrap adds 8 bytes */
563 		/* update key data length */
564 		BE_WRITE_2(key->paylen, len);
565 		/* update packet body length */
566 		BE_WRITE_2(key->len, sizeof(*key) + len - 4);
567 		break;
568 	}
569 }
570 #endif	/* IEEE80211_STA_ONLY */
571 
572 /*
573  * Decrypt the Key Data field of an EAPOL-Key frame using the specified Key
574  * Encryption Key (KEK).  The encryption algorithm can be either ARC4 or
575  * AES Key Wrap depending on the EAPOL-Key Key Descriptor Version.
576  */
577 int
578 ieee80211_eapol_key_decrypt(struct ieee80211_eapol_key *key,
579     const u_int8_t *kek)
580 {
581 	union {
582 		struct rc4_ctx rc4;
583 		aes_key_wrap_ctx aes;
584 	} ctx;	/* XXX off stack? */
585 	u_int8_t keybuf[EAPOL_KEY_IV_LEN + 16];
586 	u_int16_t len, info;
587 	u_int8_t *data;
588 
589 	len  = BE_READ_2(key->paylen);
590 	info = BE_READ_2(key->info);
591 	data = (u_int8_t *)(key + 1);
592 
593 	switch (info & EAPOL_KEY_VERSION_MASK) {
594 	case EAPOL_KEY_DESC_V1:
595 		/* concatenate the EAPOL-Key IV field and the KEK */
596 		memcpy(keybuf, key->iv, EAPOL_KEY_IV_LEN);
597 		memcpy(keybuf + EAPOL_KEY_IV_LEN, kek, 16);
598 
599 		rc4_keysetup(&ctx.rc4, keybuf, sizeof keybuf);
600 		/* discard the first 256 octets of the ARC4 key stream */
601 		rc4_skip(&ctx.rc4, RC4STATE);
602 		rc4_crypt(&ctx.rc4, data, data, len);
603 		return 0;
604 	case EAPOL_KEY_DESC_V2:
605 	case EAPOL_KEY_DESC_V3:
606 		/* Key Data Length must be a multiple of 8 */
607 		if (len < 16 + 8 || (len & 7) != 0)
608 			return 1;
609 		len -= 8;	/* AES Key Wrap adds 8 bytes */
610 		aes_key_wrap_set_key(&ctx.aes, kek, 16);
611 		return aes_key_unwrap(&ctx.aes, data, data, len / 8);
612 	}
613 
614 	return 1;	/* unknown Key Descriptor Version */
615 }
616 
617 /*
618  * Add a PMK entry to the PMKSA cache.
619  */
620 struct ieee80211_pmk *
621 ieee80211_pmksa_add(struct ieee80211com *ic, enum ieee80211_akm akm,
622     const u_int8_t *macaddr, const u_int8_t *key, u_int32_t lifetime)
623 {
624 	struct ieee80211_pmk *pmk;
625 
626 	/* check if an entry already exists for this (STA,AKMP) */
627 	TAILQ_FOREACH(pmk, &ic->ic_pmksa, pmk_next) {
628 		if (pmk->pmk_akm == akm &&
629 		    IEEE80211_ADDR_EQ(pmk->pmk_macaddr, macaddr))
630 			break;
631 	}
632 	if (pmk == NULL) {
633 		/* allocate a new PMKSA entry */
634 		if ((pmk = malloc(sizeof(*pmk), M_DEVBUF, M_NOWAIT)) == NULL)
635 			return NULL;
636 		pmk->pmk_akm = akm;
637 		IEEE80211_ADDR_COPY(pmk->pmk_macaddr, macaddr);
638 		TAILQ_INSERT_TAIL(&ic->ic_pmksa, pmk, pmk_next);
639 	}
640 	memcpy(pmk->pmk_key, key, IEEE80211_PMK_LEN);
641 	pmk->pmk_lifetime = lifetime;	/* XXX not used yet */
642 #ifndef IEEE80211_STA_ONLY
643 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
644 		ieee80211_derive_pmkid(pmk->pmk_akm, pmk->pmk_key,
645 		    ic->ic_myaddr, macaddr, pmk->pmk_pmkid);
646 	} else
647 #endif
648 	{
649 		ieee80211_derive_pmkid(pmk->pmk_akm, pmk->pmk_key,
650 		    macaddr, ic->ic_myaddr, pmk->pmk_pmkid);
651 	}
652 	return pmk;
653 }
654 
655 /*
656  * Check if we have a cached PMK entry for the specified node and PMKID.
657  */
658 struct ieee80211_pmk *
659 ieee80211_pmksa_find(struct ieee80211com *ic, struct ieee80211_node *ni,
660     const u_int8_t *pmkid)
661 {
662 	struct ieee80211_pmk *pmk;
663 
664 	TAILQ_FOREACH(pmk, &ic->ic_pmksa, pmk_next) {
665 		if (pmk->pmk_akm == ni->ni_rsnakms &&
666 		    IEEE80211_ADDR_EQ(pmk->pmk_macaddr, ni->ni_macaddr) &&
667 		    (pmkid == NULL ||
668 		     memcmp(pmk->pmk_pmkid, pmkid, IEEE80211_PMKID_LEN) == 0))
669 			break;
670 	}
671 	return pmk;
672 }
673