/* * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the * above copyright notice and this permission notice appear in all * copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR * PERFORMANCE OF THIS SOFTWARE. */ /* * This file was originally distributed by Qualcomm Atheros, Inc. * under proprietary terms before Copyright ownership was assigned * to the Linux Foundation. */ /* * $File: //depot/software/projects/feature_branches/gen5_phase1/os/linux/classic/ap/apps/ssm/auth8021x/ani8021xSuppRsnFsm.c $ * * Contains definitions for the RSN EAPOL-Key FSM on the * supplicant side. This is based on 802.11i. * * Author: Mayank D. Upadhyay * Date: 19-December-2002 * History:- * Date Modified by Modification Information * ------------------------------------------------------ * */ #include "bapRsnSsmServices.h" #include "bapRsnSsmEapol.h" #include "bapRsnErrors.h" #include "bapRsn8021xSuppRsnFsm.h" #include "vos_utils.h" #include "bapRsnTxRx.h" #include "btampFsm.h" // The different states that this FSM transitions through #define INITIALIZE 0 #define AUTHENTICATION 1 #define GOT_PMK 2 #define STA_KEY_START 3 #define STA_KEY_SET 4 #define KEY_UPDATE 5 #define REKEY_MSG 6 #define GROUP_KEY_SET 7 #define NUM_STATES (GROUP_KEY_SET + 1) static tSuppRsnFsmConsts suppConsts = { 2000, 3 }; //timeout, retry limit int gReadToSetKey; /************************************** * Static functions in this module **************************************/ static int zeroOutPtk(tSuppRsnFsm *fsm); static int checkMic(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t pwKeyExchange); static int checkInfoElement(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data); static int checkPeerReplayCounter(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t *retransmit, v_BOOL_t actualMicFlag, v_BOOL_t reTxMicFlag ); static int derivePtk(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data); static int checkTransition(tSuppRsnFsm *fsm, void *arg); static int gotoStateInit(tSuppRsnFsm *fsm); static int suppRsnRxFrameHandler( v_PVOID_t pvosGCtx, vos_pkt_t *pPacket ); static int suppRsnTxCompleteHandler( v_PVOID_t pvosGCtx, vos_pkt_t *pPacket, VOS_STATUS retStatus ); /************************* * Internal Functions *************************/ int suppRsnAuthStartEventHandler(tSuppRsnFsm *fsm); /************************* * The exported functions *************************/ /** * suppRsnFsmInit * * FUNCTION: * Initializes the constants and the callbacks needed by this FSM * module. * * @param cb callbacks to the various procedures needed by this FSM * * @return ANI_OK if the operation succeeds */ int suppRsnFsmInit(void) { // TODO: Read the constants in from config // consts = constsIn; suppConsts.timeoutPeriod = 2000; suppConsts.maxTries = 3; return ANI_OK; } /** * suppRsnFsmCreate * * FUNCTION * Allocates and initializes the state of an RSN key FSM instance for * the given BP context. * * @parm ctx the BP context whose instance is being created * @param pskBased pass in eANI_BOOLEAN_TRUE is this BP is to be * authenticated based on a pre-shared key as opposed to EAP. * * @return ANI_OK if the operation succeeds */ int suppRsnFsmCreate(tBtampContext *ctx) { int retVal = ANI_OK; tSuppRsnFsm *fsm = &ctx->uFsm.suppFsm; // First, clear everything out vos_mem_zero( fsm, sizeof(tSuppRsnFsm)); if( !VOS_IS_STATUS_SUCCESS( bapRsnRegisterTxRxCallbacks( suppRsnTxCompleteHandler, suppRsnRxFrameHandler ) ) ) { return ANI_ERROR; } if( !VOS_IS_STATUS_SUCCESS( bapRsnRegisterRxCallback( ctx->pvosGCtx ) ) ) { return ANI_ERROR; } // Allocate the supplicant context fsm->suppCtx = (tSuppContext *)vos_mem_malloc( sizeof(tSuppContext) ); if (fsm->suppCtx == NULL) { retVal = ANI_E_MALLOC_FAILED; VOS_ASSERT( 0 ); goto error; } // Clear out the supplicant context vos_mem_zero( fsm->suppCtx, sizeof(tSuppContext)); fsm->ctx = ctx; //Only support CCMP fsm->suppCtx->pwCipherType = eCSR_ENCRYPT_TYPE_AES; retVal = aniAsfPacketAllocateExplicit(&fsm->lastEapol, RSN_MAX_PACKET_SIZE, EAPOL_TX_HEADER_SIZE); if (retVal != ANI_OK) { VOS_ASSERT( 0 ); goto error; } aniAsfPacketAllocate(&fsm->suppCtx->pmk); if (fsm->suppCtx->pmk == NULL) { retVal = ANI_E_MALLOC_FAILED; VOS_ASSERT( 0 ); goto error; } fsm->suppCtx->ieAp = NULL; fsm->cryptHandle = 0; if( !VOS_IS_STATUS_SUCCESS( vos_crypto_init( &fsm->cryptHandle ) ) ) { retVal = ANI_E_FAILED; VOS_ASSERT( 0 ); } fsm->currentState = INITIALIZE; gotoStateInit(fsm); suppRsnFsmProcessEvent( fsm, RSN_FSM_AUTH_START, NULL ); return ANI_OK; error: suppRsnFsmFree( ctx ); return retVal; } /** * suppRsnFsmFree * * FUNCTION * Frees a previously allocated RSN Key FSM in a BP context. If the * RSN Key FSM is not yet allocated, then this is an error. * * @param ctx the BP context whose FSM instance is to be freed * * @return ANI_OK if the operation succeeds */ int suppRsnFsmFree(tBtampContext *ctx) { tSuppRsnFsm *fsm; fsm = &ctx->uFsm.suppFsm; if( fsm->cryptHandle ) { vos_crypto_deinit( fsm->cryptHandle ); } bapRsnClearTxRxCallbacks(); if (fsm->lastEapol) aniAsfPacketFree(fsm->lastEapol); if( fsm->suppCtx ) { if ( fsm->suppCtx->pmk ) { aniAsfPacketFree(fsm->suppCtx->pmk); } vos_mem_free( fsm->suppCtx ); } // Finally, clear everything out vos_mem_zero( fsm, sizeof(tSuppRsnFsm)); return ANI_OK; } /** * suppRsnFsmProcessEvent * * FUNCTION * Passes an event to the RSN key FSM instance for immediate processing. * * @param fsm the RSN Key FSM instance * @param eventId the AAG event to process * @param arg an optional argument for this event * * @return ANI_OK if the operation succeeds */ int suppRsnFsmProcessEvent(tSuppRsnFsm *fsm, tRsnFsmEvent eventId, void *arg) { switch (eventId) { case RSN_FSM_TIMER_EXPIRED: // Proceed straight to checkTransition break; case RSN_FSM_AUTH_START: fsm->authReq = eANI_BOOLEAN_TRUE; suppRsnAuthStartEventHandler(fsm); break; case RSN_FSM_EAPOL_FRAME_AVAILABLE: fsm->eapolAvail = eANI_BOOLEAN_TRUE; break; case RSN_FSM_INTEG_FAILED: fsm->integFailed = eANI_BOOLEAN_TRUE; break; default: VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp unknown event for SuppFsm: %d\n", eventId); VOS_ASSERT( 0 ); return ANI_E_ILLEGAL_ARG; break; } checkTransition(fsm, arg); return ANI_OK; } int suppRsnAuthStartEventHandler(tSuppRsnFsm *fsm) { // Copy required info vos_mem_copy( &fsm->suppCtx->authMac, fsm->ctx->peer_mac_addr, 6); vos_mem_copy( &fsm->suppCtx->suppMac, fsm->ctx->self_mac_addr, 6); aniAsfPacketAppendBuffer( fsm->suppCtx->pmk, fsm->ctx->key_material, fsm->ctx->key_length); return ANI_OK; } /*********************** * The static functions ***********************/ static int gotoStateInit(tSuppRsnFsm *fsm) { fsm->currentState = INITIALIZE; fsm->authReq = eANI_BOOLEAN_FALSE; fsm->eapolAvail = eANI_BOOLEAN_FALSE; fsm->integFailed = eANI_BOOLEAN_FALSE; fsm->pmkAvail = eANI_BOOLEAN_FALSE; // Create two replay counter's..one for our requests, and another // for STA's requests. Initialize the first one randomly. aniSsmReplayCtrCreate(fsm->cryptHandle, &fsm->localReplayCtr, ANI_EAPOL_KEY_RSN_RSC_SIZE, 0); aniSsmReplayCtrCreate(fsm->cryptHandle, &fsm->peerReplayCtr, ANI_EAPOL_KEY_RSN_RSC_SIZE, 0); return ANI_OK; } static int gotoStateAuthentication(tSuppRsnFsm *fsm) { fsm->currentState = AUTHENTICATION; if( VOS_IS_STATUS_SUCCESS( vos_rand_get_bytes( fsm->cryptHandle, fsm->sNonce, ANI_EAPOL_KEY_RSN_NONCE_SIZE ) ) ) { zeroOutPtk(fsm); // TODO: Zero out all GTK's fsm->authReq = eANI_BOOLEAN_FALSE; /////getPmk(fsm->suppCtx); } else { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp fail to random number\n" ); return ANI_ERROR; } return ANI_OK; } static int gotoStateGotPmk(tSuppRsnFsm *fsm) { fsm->currentState = GOT_PMK; return ANI_OK; } static int gotoStateStaKeyStart(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t retransmit) { int retVal; tAniEapolRsnKeyDesc txDesc; tAniEapolRsnKeyDesc *rxDesc; static v_U8_t btampRSNIE[] = {0x30, 0x14, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x02, 0x00, 0x00 }; fsm->currentState = STA_KEY_START; // Create a new EAPOL frame if we don't have to retransmit // if (!retransmit) //{ rxDesc = data->keyDesc; if( NULL == rxDesc) { return ANI_E_NULL_VALUE; } aniAsfPacketEmptyExplicit( fsm->lastEapol, EAPOL_TX_HEADER_SIZE ); retVal = derivePtk(fsm, data); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp derivePtk failed with code %d!\n", retVal); return retVal; } vos_mem_zero( &txDesc, sizeof(txDesc) ); // The Key Information bits... if (fsm->suppCtx->pwCipherType == eCSR_ENCRYPT_TYPE_AES) { txDesc.info.keyDescVers = ANI_EAPOL_KEY_DESC_VERS_AES; } txDesc.info.unicastFlag = eANI_BOOLEAN_TRUE; txDesc.info.micFlag = eANI_BOOLEAN_TRUE; txDesc.keyLen = 0; //RSN_80211_KEY_LEN; // Send back the same replayCtr that the authenticator sent vos_mem_copy(txDesc.replayCounter, rxDesc->replayCounter, sizeof(txDesc.replayCounter)); vos_mem_copy(txDesc.keyNonce, fsm->sNonce, sizeof(txDesc.keyNonce)); txDesc.keyDataLen = sizeof(btampRSNIE);//aniAsfPacketGetBytes(fsm->suppCtx->ieBp, //&txDesc.keyData); txDesc.keyData = btampRSNIE; retVal = aniEapolWriteKey(fsm->cryptHandle, fsm->lastEapol, fsm->suppCtx->authMac, fsm->suppCtx->suppMac, ANI_EAPOL_KEY_DESC_TYPE_RSN_NEW, &txDesc, fsm->suppCtx->ptk, CSR_AES_KEY_LEN); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp gotoStateStaKeyStart fail to write key %d\n", retVal); return retVal; } //} if( VOS_IS_STATUS_SUCCESS( bapRsnSendEapolFrame( fsm->ctx->pvosGCtx, fsm->lastEapol ) ) ) { retVal = ANI_OK; } else { retVal = ANI_ERROR; } return retVal; } static int gotoStateStaKeySet(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t retransmit) { int retVal=0; tAniEapolRsnKeyDesc txDesc; tAniEapolRsnKeyDesc *rxDesc = NULL; fsm->currentState = STA_KEY_SET; if (data == NULL) { // We don't need to do anything return ANI_OK; } // Create a new EAPOL frame if we don't have to retransmit if (!retransmit) { // First check the IE that the AP sent retVal = checkInfoElement(fsm, data); if (retVal != ANI_OK) { //FIX_RSN aagSetSuppFailureAndCleanup(fsm->suppCtx); // FSM does not exist after this... return retVal; } // Create a new EAPOL frame rxDesc = data->keyDesc; if( NULL == rxDesc ) return ANI_E_NULL_VALUE; aniAsfPacketEmptyExplicit(fsm->lastEapol, EAPOL_TX_HEADER_SIZE ); vos_mem_zero( &txDesc, sizeof(txDesc) ); // The Key Information bits... if (fsm->suppCtx->pwCipherType == eCSR_ENCRYPT_TYPE_AES) { txDesc.info.keyDescVers = ANI_EAPOL_KEY_DESC_VERS_AES; } txDesc.info.unicastFlag = eANI_BOOLEAN_TRUE; txDesc.info.micFlag = eANI_BOOLEAN_TRUE; txDesc.info.secureFlag = eANI_BOOLEAN_TRUE; txDesc.keyLen = 0; //RSN_80211_KEY_LEN; // Send back the same replayCtr that the authenticator sent vos_mem_copy(txDesc.replayCounter, rxDesc->replayCounter, sizeof(txDesc.replayCounter)); retVal = aniEapolWriteKey(fsm->cryptHandle, fsm->lastEapol, fsm->suppCtx->authMac, fsm->suppCtx->suppMac, ANI_EAPOL_KEY_DESC_TYPE_RSN_NEW, &txDesc, fsm->suppCtx->ptk, CSR_AES_KEY_LEN); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) { return retVal; } } gReadToSetKey = BAP_SET_RSN_KEY; if( !VOS_IS_STATUS_SUCCESS( bapRsnSendEapolFrame( fsm->ctx->pvosGCtx, fsm->lastEapol ) ) ) { /* making it global to access in bapTxRx file */ #if 0 tCsrRoamSetKey setKeyInfo; vos_mem_zero( &setKeyInfo, sizeof( tCsrRoamSetKey ) ); setKeyInfo.encType = eCSR_ENCRYPT_TYPE_AES; setKeyInfo.keyDirection = eSIR_TX_RX; vos_mem_copy( setKeyInfo.peerMac, fsm->suppCtx->authMac, sizeof( tAniMacAddr ) ); setKeyInfo.paeRole = 0; //this is a supplicant setKeyInfo.keyId = 0; //always setKeyInfo.keyLength = CSR_AES_KEY_LEN; vos_mem_copy( setKeyInfo.Key, (v_U8_t *)fsm->suppCtx->ptk + (2 * CSR_AES_KEY_LEN ), CSR_AES_KEY_LEN ); //fsm->suppCtx->ptk contains the 3 16-bytes keys. We need the last one. /* We will move the Set key to EAPOL Completion handler. We found a race condition betweem sending EAPOL frame and setting Key */ if( !VOS_IS_STATUS_SUCCESS( bapSetKey( fsm->ctx->pvosGCtx, &setKeyInfo ) ) ) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, " Supp: gotoStateStaKeySet fail to set key\n" ); retVal = ANI_ERROR; } #endif gReadToSetKey = BAP_RESET_RSN_KEY; retVal = ANI_ERROR; } return retVal; } static int gotoStateGroupKeySet(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data) { int retVal; tAniEapolRsnKeyDesc txDesc; tAniEapolRsnKeyDesc *rxDesc; int groupKeyLen; fsm->currentState = GROUP_KEY_SET; do { rxDesc = (tAniEapolRsnKeyDesc *) data->keyDesc; if( NULL == rxDesc) { retVal = ANI_E_NULL_VALUE; break; } if (rxDesc->keyDataLen == 0 || rxDesc->keyData == NULL) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: AP sent no group key in group EAPOL-Key message!\n" ); retVal = ANI_E_ILLEGAL_ARG; break; } if ( rxDesc->info.keyDescVers == ANI_EAPOL_KEY_DESC_VERS_AES ) { groupKeyLen = rxDesc->keyDataLen - ANI_SSM_AES_KEY_WRAP_BLOCK_SIZE; if( groupKeyLen <= 0 ) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: AP sent GTK too short\n" ); retVal = ANI_E_ILLEGAL_ARG; break; } } else { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: AP sent unsupported keyDescVer %d!\n", rxDesc->info.keyDescVers ); retVal = ANI_E_ILLEGAL_ARG; break; } // Always create a new EAPOL frame aniAsfPacketEmptyExplicit( fsm->lastEapol, EAPOL_TX_HEADER_SIZE ); vos_mem_zero( &txDesc, sizeof(txDesc) ); // The Key Information bits... if (fsm->suppCtx->grpCipherType == eCSR_ENCRYPT_TYPE_AES) { txDesc.info.keyDescVers = ANI_EAPOL_KEY_DESC_VERS_AES; } txDesc.info.unicastFlag = eANI_BOOLEAN_FALSE; txDesc.info.keyId = rxDesc->info.keyId; txDesc.info.micFlag = eANI_BOOLEAN_TRUE; txDesc.info.secureFlag = eANI_BOOLEAN_TRUE; txDesc.keyLen = RSN_80211_KEY_LEN; // Send back the same replayCtr that the authenticator sent vos_mem_copy(txDesc.replayCounter, rxDesc->replayCounter, sizeof(txDesc.replayCounter)); retVal = aniEapolWriteKey(fsm->cryptHandle, fsm->lastEapol, fsm->suppCtx->authMac, fsm->suppCtx->suppMac, ANI_EAPOL_KEY_DESC_TYPE_RSN_NEW, &txDesc, fsm->suppCtx->ptk, CSR_AES_KEY_LEN); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) break; if( !VOS_IS_STATUS_SUCCESS( bapRsnSendEapolFrame( fsm->ctx->pvosGCtx, fsm->lastEapol ) ) ) { retVal = ANI_ERROR; VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp could not send eapol. Disconnect\n" ); break; } //FIX_RSN there is no need to set GTK retVal = setGtk(fsm->suppCtx, rxDesc->keyRecvSeqCounter); // This is never retransmitted aniAsfPacketEmptyExplicit( fsm->lastEapol, EAPOL_TX_HEADER_SIZE ); checkTransition(fsm, NULL); // UCT rule }while( 0 ); return retVal; } static int gotoStateKeyUpdate(tSuppRsnFsm *fsm, tSirMicFailureInfo *micFailureInfo) { //we don't update keys bapSuppDisconnect( fsm->ctx ); return ANI_OK; } static int gotoStateRekeyMsg(tSuppRsnFsm *fsm, tSirMicFailureInfo *micFailureInfo) { //We don't support rekey, simply disconnect bapSuppDisconnect( fsm->ctx ); return ANI_OK; } static int zeroOutPtk(tSuppRsnFsm *fsm) { return ANI_OK; } static int derivePtk(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data) { v_U32_t prfLen; tAniEapolRsnKeyDesc *rxDesc; switch (fsm->suppCtx->pwCipherType) { case eCSR_ENCRYPT_TYPE_AES: prfLen = AAG_RSN_PTK_PRF_LEN_CCMP; fsm->suppCtx->pwKeyLen = AAG_RSN_KEY_MATERIAL_LEN_CCMP; break; default: VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Cannot generate PTK for BP for invalid algorithm %d\n", fsm->suppCtx->pwCipherType); return ANI_E_ILLEGAL_ARG; break; }; rxDesc = (tAniEapolRsnKeyDesc *) data->keyDesc; return aagPtkPrf(fsm->cryptHandle, fsm->suppCtx->ptk, prfLen, fsm->suppCtx->pmk, fsm->suppCtx->authMac, fsm->suppCtx->suppMac, rxDesc->keyNonce, fsm->sNonce); } static int checkMic(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t pwKeyExchange) { int retVal; retVal = aniEapolKeyCheckMic(fsm->cryptHandle, data->eapolFrame, ANI_EAPOL_KEY_DESC_TYPE_RSN_NEW, data->keyDesc, fsm->suppCtx->ptk, CSR_AES_KEY_LEN); return retVal; } static int checkInfoElement(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data) { tAniEapolRsnKeyDesc *desc; v_U8_t *ieApBytes; int ieApLen; desc = (tAniEapolRsnKeyDesc *) data->keyDesc; if( NULL == desc ) { return ANI_E_NULL_VALUE; } ieApLen = aniAsfPacketGetBytes(fsm->suppCtx->ieAp, &ieApBytes); if( ANI_IS_STATUS_SUCCESS( ieApLen ) ) { if ((desc->keyDataLen != ieApLen) || ( vos_mem_compare(desc->keyData, ieApBytes, ieApLen) )) { // TODO: Send a fault here VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp AP sent inconsistent RSN IE!\n" ); return ANI_E_FAILED; } } return ANI_OK; } static int checkPeerReplayCounter(tSuppRsnFsm *fsm, tAniEapolKeyAvailEventData *data, v_BOOL_t *retransmit, v_BOOL_t actualMicFlag, v_BOOL_t reTxMicFlag) { int retVal = ANI_OK; int cmp; tAniEapolRsnKeyDesc *rxDesc; rxDesc = data->keyDesc; if( NULL == rxDesc ) { return ANI_E_NULL_VALUE; } *retransmit = eANI_BOOLEAN_FALSE; cmp = aniSsmReplayCtrCmp(fsm->peerReplayCtr, rxDesc->replayCounter); // The AP should send us a replay counter greater than or equal to // the last one it sent /*Unless we are forgiving with this we will have interop issues with some vendros like CSR*/ if (cmp > 0) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "BP got old EAPOL replay counter from AP" ); retVal = ANI_E_REPLAY_CHECK_FAILED; } else if (cmp <= 0) { if ( actualMicFlag == reTxMicFlag ) { *retransmit = eANI_BOOLEAN_TRUE; } } return retVal; } static int checkTransition(tSuppRsnFsm *fsm, void *arg) { tAniEapolKeyAvailEventData *data; tAniEapolRsnKeyDesc *rxDesc; v_BOOL_t retransmit; int retVal; if (fsm->authReq) { gotoStateAuthentication(fsm); return ANI_OK; } switch (fsm->currentState) { case INITIALIZE: break; case AUTHENTICATION: gotoStateGotPmk(fsm); checkTransition(fsm, arg); break; case GOT_PMK: if (fsm->eapolAvail) { fsm->eapolAvail = eANI_BOOLEAN_FALSE; data = (tAniEapolKeyAvailEventData *) arg; rxDesc = (tAniEapolRsnKeyDesc *) data->keyDesc; if (rxDesc->info.ackFlag) { aniSsmReplayCtrUpdate(fsm->peerReplayCtr, rxDesc->replayCounter); // Going from one state to another cannot be a retransmit retVal = gotoStateStaKeyStart(fsm, data, eANI_BOOLEAN_FALSE); } } break; case STA_KEY_START: if (fsm->eapolAvail) { fsm->eapolAvail = eANI_BOOLEAN_FALSE; data = (tAniEapolKeyAvailEventData *) arg; rxDesc = (tAniEapolRsnKeyDesc *) data->keyDesc; if (rxDesc->info.ackFlag) { retVal = checkPeerReplayCounter( fsm, data, &retransmit, rxDesc->info.micFlag, 0); // MIC not set means check for re-Tx M1. if (retVal != ANI_OK) return ANI_OK; // Caller should not fail if (retransmit) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Resending EAPOL-Key Msg2 from " "supplicant to AP" ); retVal = gotoStateStaKeyStart(fsm, data, eANI_BOOLEAN_TRUE); } else { retVal = checkMic(fsm, data, rxDesc->info.unicastFlag); if (retVal != ANI_OK) { bapSuppDisconnect( fsm->ctx ); return retVal; } aniSsmReplayCtrUpdate(fsm->peerReplayCtr, rxDesc->replayCounter); gotoStateStaKeySet(fsm, data, eANI_BOOLEAN_FALSE); } } } break; case STA_KEY_SET: if (fsm->eapolAvail) { fsm->eapolAvail = eANI_BOOLEAN_FALSE; data = (tAniEapolKeyAvailEventData *) arg; rxDesc = (tAniEapolRsnKeyDesc *) data->keyDesc; retVal = checkPeerReplayCounter( fsm, data, &retransmit, rxDesc->info.micFlag, 1); // MIC set means check for re-Tx M3. if (retVal != ANI_OK) return ANI_OK; // Caller should not fail if (!retransmit) { retVal = checkMic(fsm, data, rxDesc->info.unicastFlag); if (retVal != ANI_OK) { bapSuppDisconnect( fsm->ctx ); return retVal; } aniSsmReplayCtrUpdate(fsm->peerReplayCtr, rxDesc->replayCounter); } if (rxDesc->info.unicastFlag) { /* * Handle pairwise key message...in this state * pairwise key messages can only be for retransmissions. */ if (retransmit) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Resending EAPOL-Key Msg4 from " "supplicant \n" ); retVal = gotoStateStaKeySet(fsm, data, eANI_BOOLEAN_TRUE); } } else { /* * Handle group key message...with group key messages, * the replay counter has to change on * retransmissions. */ if (!retransmit) { retVal = gotoStateGroupKeySet(fsm, data); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) { bapSuppDisconnect( fsm->ctx ); return retVal; } } } } else { if (fsm->integFailed) { gotoStateKeyUpdate(fsm, arg); } } break; case GROUP_KEY_SET: gotoStateStaKeySet(fsm, NULL, eANI_BOOLEAN_FALSE); break; case KEY_UPDATE: gotoStateRekeyMsg(fsm, arg); break; default: VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Illegal state for SuppRsnFsm: %d", fsm->currentState); VOS_ASSERT( 0 ); return ANI_E_FAILED; } return ANI_OK; } static int suppEapolKeyHandler( tSuppRsnFsm *fsm, tAniPacket *eapolFrame, tAniMacAddr suppMac) { int retVal; int descType; void *keyDesc; tAniEapolRsnKeyDesc *rsnDesc; tAniEapolKeyAvailEventData data; do { retVal = aniEapolParseKey(eapolFrame, &descType, &keyDesc); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) { return retVal; } if (descType == ANI_EAPOL_KEY_DESC_TYPE_RSN_NEW) { rsnDesc = (tAniEapolRsnKeyDesc *) keyDesc; /* * Pass on the event to the RSN FSM irrespective if it is * pairwise or not. */ data.keyDesc = keyDesc; data.eapolFrame = eapolFrame; retVal = suppRsnFsmProcessEvent(fsm, RSN_FSM_EAPOL_FRAME_AVAILABLE, &data); } else { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: Got unexpected 802.1x RC4 Key message \n" ); retVal = ANI_E_FAILED; break; } }while( 0 ); aniEapolKeyFreeDesc(descType, keyDesc); return retVal; } // //This function alwasy assume the incoming vos_packet is 802_3 frame. static int suppRsnRxFrameHandler( v_PVOID_t pvosGCtx, vos_pkt_t *pPacket ) { int retVal = ANI_ERROR; tAniPacket *pAniPacket; tBtampContext *ctx; tSuppRsnFsm *fsm; /* Validate params */ if ((pvosGCtx == NULL) || (NULL == pPacket)) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "param is NULL in %s", __func__); return retVal; } ctx = (tBtampContext *)VOS_GET_BAP_CB( pvosGCtx ); if (NULL == ctx) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "ctx is NULL in %s", __func__); return retVal; } fsm = &ctx->uFsm.suppFsm; if (NULL == fsm) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "fsm is NULL in %s", __func__); return retVal; } do { //ToDO: We need to synchronize this. For now, use the simplest form, drop the packet comes later. if( fsm->fReceiving ) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, " ******suppRsnRxFrameHandler receive eapol packet while processing. Drop the new comer\n" ); break; } fsm->fReceiving = VOS_TRUE; retVal = bapRsnFormPktFromVosPkt( &pAniPacket, pPacket ); if( !ANI_IS_STATUS_SUCCESS( retVal ) ) break; //Now we can process the eapol frame //handler will free the pAniPacket bapRsnEapolHandler( fsm, pAniPacket, VOS_FALSE ); }while( 0 ); fsm->fReceiving = VOS_FALSE; vos_pkt_return_packet( pPacket ); return retVal; } static int suppRsnTxCompleteHandler( v_PVOID_t pvosGCtx, vos_pkt_t *pPacket, VOS_STATUS retStatus ) { tBtampContext *ctx = (tBtampContext *)VOS_GET_BAP_CB( pvosGCtx ); tAuthRsnFsm *fsm; vos_pkt_return_packet( pPacket ); if (pvosGCtx == NULL) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "param is NULL in %s", __func__); return ANI_ERROR; } if (NULL == ctx) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "ctx is NULL in %s", __func__); return ANI_ERROR; } fsm = &ctx->uFsm.authFsm; if (NULL == fsm) { VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "fsm is NULL in %s", __func__); return ANI_ERROR; } //Synchronization needed if(!VOS_IS_STATUS_SUCCESS( retStatus ) ) { //This is bad. VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: TL Tx complete with error %d current state is %d\n", retStatus, fsm->currentState ); if( fsm->numTries <= suppConsts.maxTries ) { //retransmit fsm->numTries++; if( !VOS_IS_STATUS_SUCCESS( bapRsnSendEapolFrame( fsm->ctx->pvosGCtx, fsm->lastEapol ) ) ) { bapSuppDisconnect( fsm->ctx->pvosGCtx ); } } else { bapSuppDisconnect( fsm->ctx->pvosGCtx ); } } return ANI_OK; } /** * suppEapolHandler * * Handles an incoming EAPOL frame on the supplicant side. * * @param eapolFrame the packet containing the EAPOL frame, with the * head of the packet still at the start of the EAPOL frame * @param dstMac the dstMac pointing inside the frame * @param srcMac the srcMac pointing inside the frame * @param type the type pointing inside the frame at the type field * * @return ANI_OK if the operation succeeds */ void suppEapolHandler( tSuppRsnFsm *fsm, tAniPacket *eapolFrame, tAniMacAddr dstMac, tAniMacAddr srcMac, v_U8_t *type ) { switch (*type) { case ANI_EAPOL_TYPE_PACKET: // Ignore EAP becasue it is only WPA2-PSK break; case ANI_EAPOL_TYPE_KEY: suppEapolKeyHandler( fsm, eapolFrame, dstMac ); break; case ANI_EAPOL_TYPE_ASF_ALERT: default: VOS_TRACE( VOS_MODULE_ID_BAP, VOS_TRACE_LEVEL_ERROR, "Supp: EAPOL type not implemented: %.2x\n", *type); break; } }