/*

 * WPA Supplicant - WPA state machine and EAPOL-Key processing

 * Copyright (c) 2003-2018, Jouni Malinen <j@w1.fi>

 * Copyright(c) 2015 Intel Deutschland GmbH

 *

 * This software may be distributed under the terms of the BSD license.

 * See README for more details.

 */

#include "includes.h"

#include "common.h"

#include "crypto/aes.h"

#include "crypto/aes_wrap.h"

#include "crypto/crypto.h"

#include "crypto/random.h"

#include "crypto/aes_siv.h"

#include "crypto/sha256.h"

#include "crypto/sha384.h"

#include "crypto/sha512.h"

#include "common/ieee802_11_defs.h"

#include "common/ieee802_11_common.h"

#include "common/ocv.h"

#include "common/dpp.h"

#include "common/wpa_ctrl.h"

#include "eap_common/eap_defs.h"

#include "eapol_supp/eapol_supp_sm.h"

#include "drivers/driver.h"

#include "wpa.h"

#include "eloop.h"

#include "preauth.h"

#include "pmksa_cache.h"

#include "wpa_i.h"

#include "wpa_ie.h"

static const u8 null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };

static const u8 * wpa_sm_get_ap_rsnxe(struct wpa_sm *sm, size_t *len);

static void _wpa_hexdump_link(int level, u8 link_id, const char *title,

            const void *buf, size_t len, bool key)

{

  char *link_title = NULL;

  if (link_id >= MAX_NUM_MLD_LINKS)

    goto out;

  link_title = os_malloc(os_strlen(title) + 20);

  if (!link_title)

    goto out;

  os_snprintf(link_title, os_strlen(title) + 20, "MLO link[%u]: %s",

        link_id, title);

out:

  if (key)

    wpa_hexdump_key(level, link_title ? link_title : title, buf,

        len);

  else

    wpa_hexdump(level, link_title ? link_title : title, buf, len);

  os_free(link_title);

}

static void wpa_hexdump_link(int level, u8 link_id, const char *title,

           const void *buf, size_t len)

{

  _wpa_hexdump_link(level, link_id, title, buf, len, false);

}

static void wpa_hexdump_link_key(int level, u8 link_id, const char *title,

         const void *buf, size_t len)

{

  _wpa_hexdump_link(level, link_id, title, buf, len, true);

}

/**

 * wpa_eapol_key_send - Send WPA/RSN EAPOL-Key message

 * @sm: Pointer to WPA state machine data from wpa_sm_init()

 * @ptk: PTK for Key Confirmation/Encryption Key

 * @ver: Version field from Key Info

 * @dest: Destination address for the frame

 * @proto: Ethertype (usually ETH_P_EAPOL)

 * @msg: EAPOL-Key message

 * @msg_len: Length of message

 * @key_mic: Pointer to the buffer to which the EAPOL-Key MIC is written

 * Returns: >= 0 on success, < 0 on failure

 */

int wpa_eapol_key_send(struct wpa_sm *sm, struct wpa_ptk *ptk,

           int ver, const u8 *dest, u16 proto,

           u8 *msg, size_t msg_len, u8 *key_mic)

{

  int ret = -1;

  size_t mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg,

             sm->pasn_group);

  wpa_printf(MSG_DEBUG, "WPA: Send EAPOL-Key frame to " MACSTR

       " ver=%d mic_len=%d key_mgmt=0x%x",

       MAC2STR(dest), ver, (int) mic_len, sm->key_mgmt);

  if (is_zero_ether_addr(dest) && is_zero_ether_addr(sm->bssid)) {

    /*

     * Association event was not yet received; try to fetch

     * BSSID from the driver.

     */

    if (wpa_sm_get_bssid(sm, sm->bssid) < 0) {

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "WPA: Failed to read BSSID for "

        "EAPOL-Key destination address");

    } else {

      dest = sm->bssid;

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "WPA: Use BSSID (" MACSTR

        ") as the destination for EAPOL-Key",

        MAC2STR(dest));

    }

  }

  if (mic_len) {

    if (key_mic && (!ptk || !ptk->kck_len))

      goto out;

    if (key_mic &&

        wpa_eapol_key_mic(ptk->kck, ptk->kck_len, sm->key_mgmt,

              sm->hash_alg, ver, msg, msg_len,

              key_mic, sm->pasn_group)) {

      wpa_msg(sm->ctx->msg_ctx, MSG_ERROR,

        "WPA: Failed to generate EAPOL-Key version %d key_mgmt 0x%x MIC",

        ver, sm->key_mgmt);

      goto out;

    }

    if (ptk)

      wpa_hexdump_key(MSG_DEBUG, "WPA: KCK",

          ptk->kck, ptk->kck_len);

    wpa_hexdump(MSG_DEBUG, "WPA: Derived Key MIC",

          key_mic, mic_len);

  } else {

#ifdef CONFIG_FILS

    /* AEAD cipher - Key MIC field not used */

    struct ieee802_1x_hdr *s_hdr, *hdr;

    struct wpa_eapol_key *s_key, *key;

    u8 *buf, *s_key_data, *key_data;

    size_t buf_len = msg_len + AES_BLOCK_SIZE;

    size_t key_data_len;

    u16 eapol_len;

    const u8 *aad[1];

    size_t aad_len[1];

    if (!ptk || !ptk->kek_len)

      goto out;

    key_data_len = msg_len - sizeof(struct ieee802_1x_hdr) -

      sizeof(struct wpa_eapol_key) - 2;

    buf = os_malloc(buf_len);

    if (!buf)

      goto out;

    os_memcpy(buf, msg, msg_len);

    hdr = (struct ieee802_1x_hdr *) buf;

    key = (struct wpa_eapol_key *) (hdr + 1);

    key_data = ((u8 *) (key + 1)) + 2;

    /* Update EAPOL header to include AES-SIV overhead */

    eapol_len = be_to_host16(hdr->length);

    eapol_len += AES_BLOCK_SIZE;

    hdr->length = host_to_be16(eapol_len);

    /* Update Key Data Length field to include AES-SIV overhead */

    WPA_PUT_BE16((u8 *) (key + 1), AES_BLOCK_SIZE + key_data_len);

    s_hdr = (struct ieee802_1x_hdr *) msg;

    s_key = (struct wpa_eapol_key *) (s_hdr + 1);

    s_key_data = ((u8 *) (s_key + 1)) + 2;

    wpa_hexdump_key(MSG_DEBUG, "WPA: Plaintext Key Data",

        s_key_data, key_data_len);

    wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);

     /* AES-SIV AAD from EAPOL protocol version field (inclusive) to

      * to Key Data (exclusive). */

    aad[0] = buf;

    aad_len[0] = key_data - buf;

    if (aes_siv_encrypt(ptk->kek, ptk->kek_len,

            s_key_data, key_data_len,

            1, aad, aad_len, key_data) < 0) {

      os_free(buf);

      goto out;

    }

    wpa_hexdump(MSG_DEBUG, "WPA: Encrypted Key Data from SIV",

          key_data, AES_BLOCK_SIZE + key_data_len);

    os_free(msg);

    msg = buf;

    msg_len = buf_len;

#else /* CONFIG_FILS */

    goto out;

#endif /* CONFIG_FILS */

  }

  wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key", msg, msg_len);

  ret = wpa_sm_ether_send(sm, dest, proto, msg, msg_len);

  eapol_sm_notify_tx_eapol_key(sm->eapol);

out:

  os_free(msg);

  return ret;

}

/**

 * wpa_sm_key_request - Send EAPOL-Key Request

 * @sm: Pointer to WPA state machine data from wpa_sm_init()

 * @error: Indicate whether this is an Michael MIC error report

 * @pairwise: 1 = error report for pairwise packet, 0 = for group packet

 *

 * Send an EAPOL-Key Request to the current authenticator. This function is

 * used to request rekeying and it is usually called when a local Michael MIC

 * failure is detected.

 */

void wpa_sm_key_request(struct wpa_sm *sm, int error, int pairwise)

{

  size_t mic_len, hdrlen, rlen;

  struct wpa_eapol_key *reply;

  int key_info, ver;

  u8 *rbuf, *key_mic, *mic;

  if (pairwise && sm->wpa_deny_ptk0_rekey && !sm->use_ext_key_id &&

      wpa_sm_get_state(sm) == WPA_COMPLETED && !error) {

    wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

      "WPA: PTK0 rekey not allowed, reconnecting");

    wpa_sm_reconnect(sm);

    return;

  }

  if (!sm->ptk_set) {

    wpa_printf(MSG_INFO,

         "WPA: No PTK derived yet - cannot send EAPOL-Key Request");

    return;

  }

  if (wpa_use_akm_defined(sm->key_mgmt))

    ver = WPA_KEY_INFO_TYPE_AKM_DEFINED;

  else if (wpa_key_mgmt_ft(sm->key_mgmt) ||

     wpa_key_mgmt_sha256(sm->key_mgmt))

    ver = WPA_KEY_INFO_TYPE_AES_128_CMAC;

  else if (sm->pairwise_cipher != WPA_CIPHER_TKIP)

    ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;

  else

    ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;

  mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg,

            sm->pasn_group);

  hdrlen = sizeof(*reply) + mic_len + 2;

  rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY, NULL,

          hdrlen, &rlen, (void *) &reply);

  if (rbuf == NULL)

    return;

  reply->type = (sm->proto == WPA_PROTO_RSN) ?

    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;

  key_info = WPA_KEY_INFO_REQUEST | ver;

  key_info |= WPA_KEY_INFO_SECURE;

  if (mic_len)

    key_info |= WPA_KEY_INFO_MIC;

  else

    key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;

  if (error)

    key_info |= WPA_KEY_INFO_ERROR;

  if (pairwise)

    key_info |= WPA_KEY_INFO_KEY_TYPE;

  WPA_PUT_BE16(reply->key_info, key_info);

  WPA_PUT_BE16(reply->key_length, 0);

  os_memcpy(reply->replay_counter, sm->request_counter,

      WPA_REPLAY_COUNTER_LEN);

  inc_byte_array(sm->request_counter, WPA_REPLAY_COUNTER_LEN);

  mic = (u8 *) (reply + 1);

  WPA_PUT_BE16(mic + mic_len, 0);

  if (!(key_info & WPA_KEY_INFO_MIC))

    key_mic = NULL;

  else

    key_mic = mic;

  wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

    "WPA: Sending EAPOL-Key Request (error=%d "

    "pairwise=%d ptk_set=%d len=%lu)",

    error, pairwise, sm->ptk_set, (unsigned long) rlen);

  wpa_eapol_key_send(sm, &sm->ptk, ver, wpa_sm_get_auth_addr(sm),

         ETH_P_EAPOL, rbuf, rlen, key_mic);

}

static void wpa_supplicant_key_mgmt_set_pmk(struct wpa_sm *sm)

{

#ifdef CONFIG_IEEE80211R

  if (sm->key_mgmt == WPA_KEY_MGMT_FT_IEEE8021X) {

    if (wpa_sm_key_mgmt_set_pmk(sm, sm->xxkey, sm->xxkey_len))

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "RSN: Cannot set low order 256 bits of MSK for key management offload");

  } else {

#endif /* CONFIG_IEEE80211R */

    if (wpa_sm_key_mgmt_set_pmk(sm, sm->pmk, sm->pmk_len))

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "RSN: Cannot set PMK for key management offload");

#ifdef CONFIG_IEEE80211R

  }

#endif /* CONFIG_IEEE80211R */

}

static int wpa_supplicant_get_pmk(struct wpa_sm *sm,

          const unsigned char *src_addr,

          const u8 *pmkid)

{

  int abort_cached = 0;

  if (pmkid && !sm->cur_pmksa) {

    /* When using drivers that generate RSN IE, wpa_supplicant may

     * not have enough time to get the association information

     * event before receiving this 1/4 message, so try to find a

     * matching PMKSA cache entry here. */

    sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr,

            sm->own_addr, pmkid,

            sm->network_ctx, sm->key_mgmt);

    if (sm->cur_pmksa) {

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "RSN: found matching PMKID from PMKSA cache");

    } else {

      wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

        "RSN: no matching PMKID found");

      abort_cached = 1;

    }

  }

  if (pmkid && sm->cur_pmksa &&

      os_memcmp_const(pmkid, sm->cur_pmksa->pmkid, PMKID_LEN) == 0) {

    wpa_hexdump(MSG_DEBUG, "RSN: matched PMKID", pmkid, PMKID_LEN);

    wpa_sm_set_pmk_from_pmksa(sm);

    wpa_hexdump_key(MSG_DEBUG, "RSN: PMK from PMKSA cache",

        sm->pmk, sm->pmk_len);

    eapol_sm_notify_cached(sm->eapol);

#ifdef CONFIG_IEEE80211R

    sm->xxkey_len = 0;

#ifdef CONFIG_SAE

    if ((sm->key_mgmt == WPA_KEY_MGMT_FT_SAE ||

         sm->key_mgmt == WPA_KEY_MGMT_FT_SAE_EXT_KEY) &&

        sm->pmk_len == PMK_LEN) {

      /* Need to allow FT key derivation to proceed with

       * PMK from SAE being used as the XXKey in cases where

       * the PMKID in msg 1/4 matches the PMKSA entry that was

       * just added based on SAE authentication for the

       * initial mobility domain association. */

      os_memcpy(sm->xxkey, sm->pmk, sm->pmk_len);

      sm->xxkey_len = sm->pmk_len;

    }

#endif /* CONFIG_SAE */

#endif /* CONFIG_IEEE80211R */

  } else if (wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) && sm->eapol) {

    int res, pmk_len;

#ifdef CONFIG_IEEE80211R

    u8 buf[2 * PMK_LEN];

#endif /* CONFIG_IEEE80211R */

    if (wpa_key_mgmt_sha384(sm->key_mgmt))

      pmk_len = PMK_LEN_SUITE_B_192;

    else

      pmk_len = PMK_LEN;

#ifdef CONFIG_PQC

    if (wpa_key_mgmt_pqc(sm->key_mgmt) && sm->security_profile) {

      const struct ieee80211_pqc_profile *c;

      c = pqc_profile_get(sm->security_profile->number);

      if (c)

        pmk_len = wpa_hash_len(c->hash);

    }

#endif /* CONFIG_PQC */

    res = eapol_sm_get_key(sm->eapol, sm->pmk, pmk_len);

    if (res) {

      if (pmk_len == PMK_LEN) {

        /*

         * EAP-LEAP is an exception from other EAP

         * methods: it uses only 16-byte PMK.

         */

        res = eapol_sm_get_key(sm->eapol, sm->pmk, 16);

        pmk_len = 16;

      }

    }

#ifdef CONFIG_IEEE80211R

    if (res == 0 &&

        eapol_sm_get_key(sm->eapol, buf, 2 * PMK_LEN) == 0) {

      if (wpa_key_mgmt_sha384(sm->key_mgmt)) {

        os_memcpy(sm->xxkey, buf, SHA384_MAC_LEN);

        sm->xxkey_len = SHA384_MAC_LEN;

      } else {

        os_memcpy(sm->xxkey, buf + PMK_LEN, PMK_LEN);

        sm->xxkey_len = PMK_LEN;

      }

      forced_memzero(buf, sizeof(buf));

      if (sm->proto == WPA_PROTO_RSN &&

          wpa_key_mgmt_ft(sm->key_mgmt)) {

        struct rsn_pmksa_cache_entry *sa = NULL;

        const u8 *fils_cache_id = NULL;

#ifdef CONFIG_FILS

        if (sm->fils_cache_id_set)

          fils_cache_id = sm->fils_cache_id;

#endif /* CONFIG_FILS */

        wpa_hexdump_key(MSG_DEBUG,

            "FT: Cache XXKey/MPMK",

            sm->xxkey, sm->xxkey_len);

        sa = pmksa_cache_add(sm->pmksa,

                 sm->xxkey, sm->xxkey_len,

                 NULL, NULL, 0,

                 src_addr, sm->own_addr,

                 sm->network_ctx,

                 sm->key_mgmt,

                 fils_cache_id, 0,

                 RSN_HASH_NOT_SPECIFIED);

        if (!sm->cur_pmksa)

          sm->cur_pmksa = sa;

      }

    }

#endif /* CONFIG_IEEE80211R */

    if (res == 0) {

      struct rsn_pmksa_cache_entry *sa = NULL;

      const u8 *fils_cache_id = NULL;

      enum rsn_hash_alg hash = sm->hash_alg;

#ifdef CONFIG_FILS

      if (sm->fils_cache_id_set)

        fils_cache_id = sm->fils_cache_id;

#endif /* CONFIG_FILS */

      wpa_hexdump_key(MSG_DEBUG, "WPA: PMK from EAPOL state "

          "machines", sm->pmk, pmk_len);

      sm->pmk_len = pmk_len;

      wpa_supplicant_key_mgmt_set_pmk(sm);

      if (sm->proto == WPA_PROTO_RSN &&

          !wpa_key_mgmt_suite_b(sm->key_mgmt) &&

          !wpa_key_mgmt_ft(sm->key_mgmt)) {

        sa = pmksa_cache_add(sm->pmksa,

                 sm->pmk, pmk_len, NULL,

                 NULL, 0,

                 src_addr, sm->own_addr,

                 sm->network_ctx,

                 sm->key_mgmt,

                 fils_cache_id, 0, hash);

      }

      if (!sm->cur_pmksa && pmkid &&

          sm->disable_pmksa_caching &&

          sm->proto == WPA_PROTO_RSN &&

          !wpa_key_mgmt_suite_b(sm->key_mgmt) &&

          !wpa_key_mgmt_ft(sm->key_mgmt)) {

        u8 new_pmkid[PMKID_LEN];

        rsn_pmkid(sm->pmk, sm->pmk_len, src_addr,

            sm->own_addr, new_pmkid,

            sm->key_mgmt, hash);

        if (os_memcmp_const(pmkid, new_pmkid,

                PMKID_LEN) != 0) {

          wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

            "RSN: PMKID mismatch with PMKSA caching disabled");

          return -1;

        }

        wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

          "RSN: PMKID matches fresh PMK with PMKSA caching disabled");

        abort_cached = 0;

      } else if (!sm->cur_pmksa && pmkid &&

          pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr,

              pmkid, NULL, 0)) {

        wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

          "RSN: the new PMK matches with the "

          "PMKID");

        abort_cached = 0;

      } else if (sa && !sm->cur_pmksa && pmkid) {

        /*

         * It looks like the authentication server

         * derived mismatching MSK. This should not

         * really happen, but bugs happen.. There is not

         * much we can do here without knowing what

         * exactly caused the server to misbehave.

         */

        wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

          "RSN: PMKID mismatch - authentication server may have derived different MSK?!");

        return -1;

      }

      if (!sm->cur_pmksa)

        sm->cur_pmksa = sa;

#ifdef CONFIG_IEEE80211R

    } else if (wpa_key_mgmt_ft(sm->key_mgmt) && sm->ft_protocol) {

      wpa_printf(MSG_DEBUG,

           "FT: Continue 4-way handshake without PMK/PMKID for association using FT protocol");

#endif /* CONFIG_IEEE80211R */

    } else {

      wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,

        "WPA: Failed to get master session key from "

        "EAPOL state machines - key handshake "

        "aborted");

      if (sm->cur_pmksa) {

        wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

          "RSN: Cancelled PMKSA caching "

          "attempt");

        sm->cur_pmksa = NULL;

        abort_cached = 1;

      } else if (!abort_cached) {

        return -1;

      }

    }

  }

  if (abort_cached && wpa_key_mgmt_wpa_ieee8021x(sm->key_mgmt) &&

      !wpa_key_mgmt_suite_b(sm->key_mgmt) &&

      !wpa_key_mgmt_ft(sm->key_mgmt)) {

    /* Send EAPOL-Start to trigger full EAP authentication. */

    u8 *buf;

    size_t buflen;

    wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

      "RSN: no PMKSA entry found - trigger "

      "full EAP authentication");

    buf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_START,

           NULL, 0, &buflen, NULL);

    if (buf) {

      /* Set and reset eapFail to allow EAP state machine to

       * proceed with new authentication. */

      eapol_sm_notify_eap_fail(sm->eapol, true);

      eapol_sm_notify_eap_fail(sm->eapol, false);

      wpa_sm_ether_send(sm, sm->bssid, ETH_P_EAPOL,

            buf, buflen);

      os_free(buf);

      return -2;

    }

    return -1;

  }

  return 0;

}

/**

 * wpa_supplicant_send_2_of_4 - Send message 2 of WPA/RSN 4-Way Handshake

 * @sm: Pointer to WPA state machine data from wpa_sm_init()

 * @dst: Destination address for the frame

 * @key: Pointer to the EAPOL-Key frame header

 * @ver: Version bits from EAPOL-Key Key Info

 * @nonce: Nonce value for the EAPOL-Key frame

 * @wpa_ie: WPA/RSN IE

 * @wpa_ie_len: Length of the WPA/RSN IE

 * @ptk: PTK to use for keyed hash and encryption

 * Returns: >= 0 on success, < 0 on failure

 */

int wpa_supplicant_send_2_of_4(struct wpa_sm *sm, const unsigned char *dst,

             const struct wpa_eapol_key *key,

             int ver, const u8 *nonce,

             const u8 *wpa_ie, size_t wpa_ie_len,

             struct wpa_ptk *ptk)

{

  size_t mic_len, hdrlen, rlen, extra_len = 0;

  struct wpa_eapol_key *reply;

  u8 *rbuf, *key_mic;

  u8 *rsn_ie_buf = NULL, *buf2 = NULL;

  u16 key_info;

#ifdef CONFIG_TESTING_OPTIONS

  size_t pad_len = 0;

#endif /* CONFIG_TESTING_OPTIONS */

  if (wpa_ie == NULL) {

    wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: No wpa_ie set - "

      "cannot generate msg 2/4");

    return -1;

  }

#ifdef CONFIG_IEEE80211R

  if (wpa_key_mgmt_ft(sm->key_mgmt)) {

    int res;

    wpa_hexdump(MSG_DEBUG, "WPA: WPA IE before FT processing",

          wpa_ie, wpa_ie_len);

    /*

     * Add PMKR1Name into RSN IE (PMKID-List) and add MDIE and

     * FTIE from (Re)Association Response.

     */

    rsn_ie_buf = os_malloc(wpa_ie_len + 2 + 2 + PMKID_LEN +

               sm->assoc_resp_ies_len);

    if (rsn_ie_buf == NULL)

      return -1;

    os_memcpy(rsn_ie_buf, wpa_ie, wpa_ie_len);

    res = wpa_insert_pmkid(rsn_ie_buf, &wpa_ie_len,

               sm->pmk_r1_name, !sm->ft_prepend_pmkid);

    if (res < 0) {

      os_free(rsn_ie_buf);

      return -1;

    }

    wpa_hexdump(MSG_DEBUG,

          "WPA: WPA IE after PMKID[PMKR1Name] addition into RSNE",

          rsn_ie_buf, wpa_ie_len);

    if (sm->assoc_resp_ies) {

      wpa_hexdump(MSG_DEBUG, "WPA: Add assoc_resp_ies",

            sm->assoc_resp_ies,

            sm->assoc_resp_ies_len);

      os_memcpy(rsn_ie_buf + wpa_ie_len, sm->assoc_resp_ies,

          sm->assoc_resp_ies_len);

      wpa_ie_len += sm->assoc_resp_ies_len;

    }

    wpa_ie = rsn_ie_buf;

  }

#endif /* CONFIG_IEEE80211R */

  if (sm->rsn_override != RSN_OVERRIDE_NOT_USED) {

    u8 *pos;

    buf2 = os_malloc(wpa_ie_len + 2 + 4 + 1);

    if (!buf2) {

      os_free(rsn_ie_buf);

      return -1;

    }

    os_memcpy(buf2, wpa_ie, wpa_ie_len);

    pos = buf2 + wpa_ie_len;

    *pos++ = WLAN_EID_VENDOR_SPECIFIC;

    *pos++ = 4 + 1;

    WPA_PUT_BE32(pos, RSN_SELECTION_IE_VENDOR_TYPE);

    pos += 4;

    if (sm->rsn_override == RSN_OVERRIDE_RSNE) {

      *pos++ = RSN_SELECTION_RSNE;

    } else if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE) {

      *pos++ = RSN_SELECTION_RSNE_OVERRIDE;

    } else if (sm->rsn_override == RSN_OVERRIDE_RSNE_OVERRIDE_2) {

      *pos++ = RSN_SELECTION_RSNE_OVERRIDE_2;

    } else {

      os_free(rsn_ie_buf);

      os_free(buf2);

      return -1;

    }

    wpa_ie = buf2;

    wpa_ie_len += 2 + 4 + 1;

  }

  wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);

#ifdef CONFIG_TESTING_OPTIONS

  if (sm->test_eapol_m2_elems)

    extra_len = wpabuf_len(sm->test_eapol_m2_elems);

  if (sm->encrypt_eapol_m2) {

    pad_len = (wpa_ie_len + extra_len) % 8;

    if (pad_len)

      pad_len = 8 - pad_len;

    extra_len += pad_len + 8;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  mic_len = wpa_mic_len(sm->key_mgmt, sm->pmk_len, sm->hash_alg,

            sm->pasn_group);

  hdrlen = sizeof(*reply) + mic_len + 2;

  rbuf = wpa_sm_alloc_eapol(sm, IEEE802_1X_TYPE_EAPOL_KEY,

          NULL, hdrlen + wpa_ie_len + extra_len,

          &rlen, (void *) &reply);

  if (rbuf == NULL) {

    os_free(rsn_ie_buf);

    os_free(buf2);

    return -1;

  }

  reply->type = (sm->proto == WPA_PROTO_RSN) ?

    EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;

  key_info = ver | WPA_KEY_INFO_KEY_TYPE;

  if (sm->ptk_set && sm->proto != WPA_PROTO_WPA)

    key_info |= WPA_KEY_INFO_SECURE;

  if (mic_len)

    key_info |= WPA_KEY_INFO_MIC;

  else

    key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;

#ifdef CONFIG_TESTING_OPTIONS

  if (sm->encrypt_eapol_m2)

    key_info |= WPA_KEY_INFO_ENCR_KEY_DATA;

  if (sm->eapol_2_key_info_set_mask)

    key_info |= sm->eapol_2_key_info_set_mask;

#endif /* CONFIG_TESTING_OPTIONS */

  WPA_PUT_BE16(reply->key_info, key_info);

  if (sm->proto == WPA_PROTO_RSN)

    WPA_PUT_BE16(reply->key_length, 0);

  else

    os_memcpy(reply->key_length, key->key_length, 2);

  os_memcpy(reply->replay_counter, key->replay_counter,

      WPA_REPLAY_COUNTER_LEN);

  wpa_hexdump(MSG_DEBUG, "WPA: Replay Counter", reply->replay_counter,

        WPA_REPLAY_COUNTER_LEN);

  key_mic = (u8 *) (reply + 1);

  /* Key Data Length */

  WPA_PUT_BE16(key_mic + mic_len, wpa_ie_len + extra_len);

  os_memcpy(key_mic + mic_len + 2, wpa_ie, wpa_ie_len); /* Key Data */

  os_free(rsn_ie_buf);

  os_free(buf2);

#ifdef CONFIG_TESTING_OPTIONS

  if (sm->test_eapol_m2_elems) {

    os_memcpy(key_mic + mic_len + 2 + wpa_ie_len,

        wpabuf_head(sm->test_eapol_m2_elems),

        wpabuf_len(sm->test_eapol_m2_elems));

  }

  if (sm->encrypt_eapol_m2) {

    u8 *plain;

    size_t plain_len;

    if (sm->test_eapol_m2_elems)

      extra_len = wpabuf_len(sm->test_eapol_m2_elems);

    else

      extra_len = 0;

    plain_len = wpa_ie_len + extra_len + pad_len;

    plain = os_memdup(key_mic + mic_len + 2, plain_len);

    if (!plain) {

      os_free(rbuf);

      return -1;

    }

    if (pad_len)

      plain[plain_len - pad_len] = 0xdd;

    wpa_hexdump_key(MSG_DEBUG, "RSN: AES-WRAP using KEK",

        ptk->kek, ptk->kek_len);

    if (aes_wrap(ptk->kek, ptk->kek_len, plain_len / 8, plain,

           key_mic + mic_len + 2)) {

      os_free(plain);

      os_free(rbuf);

      return -1;

    }

    wpa_hexdump(MSG_DEBUG,

          "RSN: Encrypted Key Data from AES-WRAP",

          key_mic + mic_len + 2, plain_len + 8);

    os_free(plain);

  }

#endif /* CONFIG_TESTING_OPTIONS */

  os_memcpy(reply->key_nonce, nonce, WPA_NONCE_LEN);

  wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");

  return wpa_eapol_key_send(sm, ptk, ver, dst, ETH_P_EAPOL, rbuf, rlen,

          key_mic);

}

static int wpa_derive_ptk(struct wpa_sm *sm, const unsigned char *src_addr,

        const struct wpa_eapol_key *key, struct wpa_ptk *ptk)

{

  int ret;

  const u8 *z = NULL, *ap_rsnxe;

  size_t z_len = 0, kdk_len, ap_rsnxe_len;

  int akmp;

  ap_rsnxe = wpa_sm_get_ap_rsnxe(sm, &ap_rsnxe_len);

#ifdef CONFIG_IEEE80211R

  if (wpa_key_mgmt_ft(sm->key_mgmt))

    return wpa_derive_ptk_ft(sm, src_addr, key, ptk);

#endif /* CONFIG_IEEE80211R */

#ifdef CONFIG_DPP2

  if (sm->key_mgmt == WPA_KEY_MGMT_DPP && sm->dpp_z) {

    z = wpabuf_head(sm->dpp_z);

    z_len = wpabuf_len(sm->dpp_z);

  }

#endif /* CONFIG_DPP2 */

  akmp = sm->key_mgmt;

#ifdef CONFIG_OWE

  if (sm->owe_ptk_workaround && akmp == WPA_KEY_MGMT_OWE &&

      sm->pmk_len > 32) {

    wpa_printf(MSG_DEBUG,

         "OWE: Force SHA256 for PTK derivation");

    akmp |= WPA_KEY_MGMT_PSK_SHA256;

  }

#endif /* CONFIG_OWE */

  if (sm->force_kdk_derivation ||

      (sm->secure_ltf &&

       ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF)))

    kdk_len = WPA_KDK_MAX_LEN;

  else

    kdk_len = 0;

  ret = wpa_pmk_to_ptk(sm->pmk, sm->pmk_len, "Pairwise key expansion",

           sm->own_addr, wpa_sm_get_auth_addr(sm), sm->snonce,

           key->key_nonce, ptk, akmp,

           sm->pairwise_cipher, z, z_len,

           kdk_len, sm->pasn_group);

  if (ret) {

    wpa_printf(MSG_ERROR, "WPA: PTK derivation failed");

    return ret;

  }

#ifdef CONFIG_PASN

  if (sm->secure_ltf &&

      ieee802_11_rsnx_capab(ap_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF))

    ret = wpa_ltf_keyseed(ptk, akmp, sm->pairwise_cipher);

#endif /* CONFIG_PASN */

  return ret;

}

static int wpa_handle_ext_key_id(struct wpa_sm *sm,

         struct wpa_eapol_ie_parse *kde)

{

  if (sm->ext_key_id) {

    u16 key_id;

    if (!kde->key_id) {

      wpa_msg(sm->ctx->msg_ctx,

        sm->use_ext_key_id ? MSG_INFO : MSG_DEBUG,

        "RSN: No Key ID in Extended Key ID handshake");

      sm->keyidx_active = 0;

      return sm->use_ext_key_id ? -1 : 0;

    }

    key_id = kde->key_id[0] & 0x03;

    if (key_id > 1) {

      wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

        "RSN: Invalid Extended Key ID: %d", key_id);

      return -1;

    }

    wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,

      "RSN: Using Extended Key ID %d", key_id);

    sm->keyidx_active = key_id;

    sm->use_ext_key_id = 1;

  } else {

    if (kde->key_id && (kde->key_id[0] & 0x03)) {

      wpa_msg(sm->ctx->msg_ctx, MSG_INFO,

        "RSN: Non-zero Extended Key ID Key ID in PTK0 handshake");

      return -1;

    }

    if (kde->key_id) {

      /* This is not supposed to be included here, but ignore

       * the case of matching Key ID 0 just in case. */

      wpa_msg(sm->ctx->msg_ctx, MSG_DEBUG,

        "RSN: Extended Key ID Key ID 0 in PTK0 handshake");

    }

    sm->keyidx_active = 0;

    sm->use_ext_key_id = 0;

  }

  return 0;

}

static u8 * rsn_add_kde(u8 *pos, u32 kde, const u8 *data, size_t data_len)

{

  *pos++ = WLAN_EID_VENDOR_SPECIFIC;

  *pos++ = RSN_SELECTOR_LEN + data_len;

  RSN_SELECTOR_PUT(pos, kde);

  pos += RSN_SELECTOR_LEN;

  os_memcpy(pos, data, data_len);

  pos += data_len;

  return pos;

}

static size_t wpa_mlo_link_kde_len(struct wpa_sm *sm)

{

  int i;

  unsigned int num_links = 0;

  for_each_link(sm->mlo.req_links, i) {

    if (sm->mlo.assoc_link_id != i)

      num_links++;

  }

  return num_links * (RSN_SELECTOR_LEN + 1 + ETH_ALEN + 2);

}

static u8 * wpa_mlo_link_kde(struct wpa_sm *sm, u8 *pos)

{

  int i;

  u8 hdr[1 + ETH_ALEN];

  for_each_link(sm->mlo.req_links, i) {

    if (sm->mlo.assoc_link_id == i)

      continue;

    wpa_printf(MSG_DEBUG,

         "MLO: Add MLO Link %d KDE in EAPOL-Key 2/4", i);

    hdr[0] = i & 0xF; /* LinkID; no RSNE or RSNXE */

    os_memcpy(&hdr[1], sm->mlo.links[i].addr, ETH_ALEN);

    pos = rsn_add_kde(pos, RSN_KEY_DATA_MLO_LINK, hdr, sizeof(hdr));

  }

  return pos;

}

static bool is_valid_ap_mld_mac_kde(struct wpa_sm *sm, const u8 *mac_kde)

{

  return mac_kde &&

    ether_addr_equal(mac_kde, sm->mlo.ap_mld_addr);

}

static void wpas_swap_tkip_mic_keys(struct wpa_ptk *ptk)

{

  u8 buf[8];

  /* Supplicant: swap tx/rx Mic keys */

  os_memcpy(buf, &ptk->tk[16], 8);

  os_memcpy(&ptk->tk[16], &ptk->tk[24], 8);

  os_memcpy(&ptk->tk[24], buf, 8);

  forced_memzero(buf, sizeof(buf));

}

static void wpa_supplicant_process_1_of_4_wpa(struct wpa_sm *sm,

                const unsigned char *src_addr,

                const struct wpa_eapol_key *key,

                u16 ver, const u8 *key_data,

                size_t key_data_len,

                enum frame_encryption encrypted)

{

  struct wpa_eapol_ie_parse ie;

  struct wpa_ptk *ptk;

  int res;

  if (wpa_sm_get_network_ctx(sm) == NULL) {

    wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,

      "WPA: No SSID info found (msg 1 of 4)");

    return;