usr.lib/wpad/wpa.c

	wpa.c revision a399b7655a1d835aa8606c2b29e4e777baac8635
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
 * Sun elects to license this software under the BSD license.
 * See README for more details.
 */

#pragma ident   "%Z%%M% %I% %E% SMI"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <netinet/in.h>
#include <sys/ethernet.h>
#include <fcntl.h>
#include <unistd.h>

#include "wpa_impl.h"
#include "wpa_enc.h"
#include "driver.h"
#include "eloop.h"
#include "l2_packet.h"

static void pmksa_cache_set_expiration(struct wpa_supplicant *);

/*
 * IEEE 802.11i/D3.0
 */
static const int WPA_SELECTOR_LEN = 4;
static const uint8_t WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
static const uint16_t WPA_VERSION = 1;
static const uint8_t
WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[]       = { 0x00, 0x50, 0xf2, 1 };
static const uint8_t
WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[]         = { 0x00, 0x50, 0xf2, 2 };
static const uint8_t WPA_CIPHER_SUITE_NONE[]    = { 0x00, 0x50, 0xf2, 0 };
static const uint8_t WPA_CIPHER_SUITE_WEP40[]   = { 0x00, 0x50, 0xf2, 1 };
static const uint8_t WPA_CIPHER_SUITE_TKIP[]    = { 0x00, 0x50, 0xf2, 2 };
static const uint8_t WPA_CIPHER_SUITE_CCMP[]    = { 0x00, 0x50, 0xf2, 4 };
static const uint8_t WPA_CIPHER_SUITE_WEP104[]  = { 0x00, 0x50, 0xf2, 5 };

/*
 * WPA IE version 1
 * 00-50-f2:1 (OUI:OUI type)
 * 0x01 0x00 (version; little endian)
 * (all following fields are optional:)
 * Group Suite Selector (4 octets) (default: TKIP)
 * Pairwise Suite Count (2 octets, little endian) (default: 1)
 * Pairwise Suite List (4 * n octets) (default: TKIP)
 * Authenticated Key Management Suite Count (2 octets, little endian)
 * (default: 1)
 * Authenticated Key Management Suite List (4 * n octets)
 * (default: unspec 802.1x)
 * WPA Capabilities (2 octets, little endian) (default: 0)
 */
#pragma pack(1)
struct wpa_ie_hdr {
    uint8_t     elem_id;
    uint8_t     len;
    uint8_t     oui[3];
    uint8_t     oui_type;
    uint16_t    version;
};
#pragma pack()

/*
 * IEEE 802.11i/D9.0
 */
static const int RSN_SELECTOR_LEN = 4;
static const uint16_t RSN_VERSION = 1;
static const uint8_t
RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[]       = { 0x00, 0x0f, 0xac, 1 };
static const uint8_t
RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[]     = { 0x00, 0x0f, 0xac, 2 };
static const uint8_t RSN_CIPHER_SUITE_NONE[]    = { 0x00, 0x0f, 0xac, 0 };
static const uint8_t RSN_CIPHER_SUITE_WEP40[]   = { 0x00, 0x0f, 0xac, 1 };
static const uint8_t RSN_CIPHER_SUITE_TKIP[]    = { 0x00, 0x0f, 0xac, 2 };
static const uint8_t RSN_CIPHER_SUITE_CCMP[]    = { 0x00, 0x0f, 0xac, 4 };
static const uint8_t RSN_CIPHER_SUITE_WEP104[]  = { 0x00, 0x0f, 0xac, 5 };

/*
 * EAPOL-Key Key Data Encapsulation
 * GroupKey and STAKey require encryption, otherwise, encryption is optional.
 */
static const uint8_t RSN_KEY_DATA_GROUPKEY[]    = { 0x00, 0x0f, 0xac, 1 };
static const uint8_t RSN_KEY_DATA_PMKID[]   = { 0x00, 0x0f, 0xac, 4 };

/*
 * 1/4: PMKID
 * 2/4: RSN IE
 * 3/4: one or two RSN IEs + GTK IE (encrypted)
 * 4/4: empty
 * 1/2: GTK IE (encrypted)
 * 2/2: empty
 */

/*
 * RSN IE version 1
 * 0x01 0x00 (version; little endian)
 * (all following fields are optional:)
 * Group Suite Selector (4 octets) (default: CCMP)
 * Pairwise Suite Count (2 octets, little endian) (default: 1)
 * Pairwise Suite List (4 * n octets) (default: CCMP)
 * Authenticated Key Management Suite Count (2 octets, little endian)
 *    (default: 1)
 * Authenticated Key Management Suite List (4 * n octets)
 *    (default: unspec 802.1x)
 * RSN Capabilities (2 octets, little endian) (default: 0)
 * PMKID Count (2 octets) (default: 0)
 * PMKID List (16 * n octets)
 */
#pragma pack(1)
struct rsn_ie_hdr {
    uint8_t     elem_id; /* WLAN_EID_RSN */
    uint8_t     len;
    uint16_t    version;
};
#pragma pack()

static int
random_get_pseudo_bytes(uint8_t *ptr, size_t len)
{
    int fd;
    size_t resid = len;
    size_t bytes;

    fd = open("/dev/urandom", O_RDONLY);
    if (fd == -1) {
        wpa_printf(MSG_ERROR, "Could not open /dev/urandom.\n");
        return (-1);
    }

    while (resid != 0) {
        bytes = read(fd, ptr, resid);
        ptr += bytes;
        resid -= bytes;
    }

    (void) close(fd);

    return (0);
}

static void
inc_byte_array(uint8_t *counter, size_t len)
{
    int pos = len - 1;
    while (pos >= 0) {
        counter[pos]++;
        if (counter[pos] != 0)
            break;
        pos--;
    }
}

static int
wpa_selector_to_bitfield(uint8_t *s)
{
    if (memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_NONE);
    if (memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_WEP40);
    if (memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_TKIP);
    if (memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_CCMP);
    if (memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_WEP104);
    return (0);
}

static int
wpa_key_mgmt_to_bitfield(uint8_t *s)
{
    if (memcmp(s, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X, WPA_SELECTOR_LEN) == 0)
        return (WPA_KEY_MGMT_IEEE8021X);
    if (memcmp(s, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X, WPA_SELECTOR_LEN) ==
        0)
        return (WPA_KEY_MGMT_PSK);
    return (0);
}

static int
rsn_selector_to_bitfield(uint8_t *s)
{
    if (memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_NONE);
    if (memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_WEP40);
    if (memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_TKIP);
    if (memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_CCMP);
    if (memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == 0)
        return (WPA_CIPHER_WEP104);
    return (0);
}

static int
rsn_key_mgmt_to_bitfield(uint8_t *s)
{
    if (memcmp(s, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X, RSN_SELECTOR_LEN) == 0)
        return (WPA_KEY_MGMT_IEEE8021X);
    if (memcmp(s, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X, RSN_SELECTOR_LEN) ==
        0)
        return (WPA_KEY_MGMT_PSK);
    return (0);
}

static void
pmksa_cache_free_entry(struct wpa_supplicant *wpa_s,
    struct rsn_pmksa_cache *entry)
{
    wpa_s->pmksa_count--;
    if (wpa_s->cur_pmksa == entry) {
        wpa_printf(MSG_DEBUG, "RSN: removed current PMKSA entry");
        wpa_s->cur_pmksa = NULL;
    }
    free(entry);
}

/* ARGSUSED */
static void
pmksa_cache_expire(void *eloop_ctx, void *timeout_ctx)
{
    struct wpa_supplicant *wpa_s = eloop_ctx;
    time_t now;

    (void) time(&now);
    while (wpa_s->pmksa && wpa_s->pmksa->expiration <= now) {
        struct rsn_pmksa_cache *entry = wpa_s->pmksa;
        wpa_s->pmksa = entry->next;
        wpa_printf(MSG_DEBUG, "RSN: expired PMKSA cache entry for "
            MACSTR, MAC2STR(entry->aa));
        pmksa_cache_free_entry(wpa_s, entry);
    }

    pmksa_cache_set_expiration(wpa_s);
}

static void
pmksa_cache_set_expiration(struct wpa_supplicant *wpa_s)
{
    int sec;
    eloop_cancel_timeout(pmksa_cache_expire, wpa_s, NULL);
    if (wpa_s->pmksa == NULL)
        return;
    sec = wpa_s->pmksa->expiration - time(NULL);
    if (sec < 0)
        sec = 0;
    (void) eloop_register_timeout(sec + 1, 0, pmksa_cache_expire,
        wpa_s, NULL);
}

void
pmksa_cache_free(struct wpa_supplicant *wpa_s)
{
    struct rsn_pmksa_cache *entry, *prev;

    entry = wpa_s->pmksa;
    wpa_s->pmksa = NULL;
    while (entry) {
        prev = entry;
        entry = entry->next;
        free(prev);
    }
    pmksa_cache_set_expiration(wpa_s);
    wpa_s->cur_pmksa = NULL;
}

struct rsn_pmksa_cache *
pmksa_cache_get(struct wpa_supplicant *wpa_s,
        uint8_t *aa, uint8_t *pmkid)
{
    struct rsn_pmksa_cache *entry = wpa_s->pmksa;
    while (entry) {
        if ((aa == NULL ||
            memcmp(entry->aa, aa, IEEE80211_ADDR_LEN) == 0) &&
            (pmkid == NULL ||
            memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0))
            return (entry);
        entry = entry->next;
    }
    return (NULL);
}

int
pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf, size_t len)
{
    int i, j;
    char *pos = buf;
    struct rsn_pmksa_cache *entry;
    time_t now;

    (void) time(&now);
    pos += snprintf(pos, buf + len - pos,
        "Index / AA / PMKID / expiration (in seconds)\n");
    i = 0;
    entry = wpa_s->pmksa;
    while (entry) {
        i++;
        pos += snprintf(pos, buf + len - pos, "%d " MACSTR " ",
            i, MAC2STR(entry->aa));
        for (j = 0; j < PMKID_LEN; j++)
            pos += snprintf(pos, buf + len - pos, "%02x",
                entry->pmkid[j]);
        pos += snprintf(pos, buf + len - pos, " %d\n",
            (int)(entry->expiration - now));
        entry = entry->next;
    }
    return (pos - buf);
}

void
pmksa_candidate_free(struct wpa_supplicant *wpa_s)
{
    struct rsn_pmksa_candidate *entry, *prev;

    entry = wpa_s->pmksa_candidates;
    wpa_s->pmksa_candidates = NULL;
    while (entry) {
        prev = entry;
        entry = entry->next;
        free(prev);
    }
}

/* ARGSUSED */
static int
wpa_parse_wpa_ie_wpa(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie,
    size_t wpa_ie_len, struct wpa_ie_data *data)
{
    struct wpa_ie_hdr *hdr;
    uint8_t *pos;
    int left;
    int i, count;

    data->proto = WPA_PROTO_WPA;
    data->pairwise_cipher = WPA_CIPHER_TKIP;
    data->group_cipher = WPA_CIPHER_TKIP;
    data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
    data->capabilities = 0;

    if (wpa_ie_len == 0) {
        /* No WPA IE - fail silently */
        return (-1);
    }

    if (wpa_ie_len < sizeof (struct wpa_ie_hdr)) {
        wpa_printf(MSG_DEBUG, "%s: ie len too short %u",
            "wpa_parse_wpa_ie_wpa", wpa_ie_len);
        return (-1);
    }

    hdr = (struct wpa_ie_hdr *)wpa_ie;

    if (hdr->elem_id != GENERIC_INFO_ELEM ||
        hdr->len != wpa_ie_len - 2 ||
        memcmp(&hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN) != 0 ||
        LE_16(hdr->version) != WPA_VERSION) {
        wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
            "wpa_parse_wpa_ie_wpa");
        return (-1);
    }

    pos = (uint8_t *)(hdr + 1);
    left = wpa_ie_len - sizeof (*hdr);

    if (left >= WPA_SELECTOR_LEN) {
        data->group_cipher = wpa_selector_to_bitfield(pos);
        pos += WPA_SELECTOR_LEN;
        left -= WPA_SELECTOR_LEN;
    } else if (left > 0) {
        wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
            "wpa_parse_wpa_ie_wpa", left);
        return (-1);
    }

    if (left >= 2) {
        data->pairwise_cipher = 0;
        count = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
        if (count == 0 || left < count * WPA_SELECTOR_LEN) {
            wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
                "count %u left %u",
                "wpa_parse_wpa_ie_wpa", count, left);
            return (-1);
        }
        for (i = 0; i < count; i++) {
            data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
            pos += WPA_SELECTOR_LEN;
            left -= WPA_SELECTOR_LEN;
        }
    } else if (left == 1) {
        wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
            "wpa_parse_wpa_ie_wpa");
        return (-1);
    }

    if (left >= 2) {
        data->key_mgmt = 0;
        count = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
        if (count == 0 || left < count * WPA_SELECTOR_LEN) {
            wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
                "count %u left %u",
                "wpa_parse_wpa_ie_wpa", count, left);
            return (-1);
        }
        for (i = 0; i < count; i++) {
            data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
            pos += WPA_SELECTOR_LEN;
            left -= WPA_SELECTOR_LEN;
        }
    } else if (left == 1) {
        wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
            "wpa_parse_wpa_ie_wpa");
        return (-1);
    }

    if (left >= 2) {
        data->capabilities = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
    }

    if (left > 0) {
        wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes",
            "wpa_parse_wpa_ie_wpa", left);
        return (-1);
    }

    return (0);
}

/* ARGSUSED */
static int
wpa_parse_wpa_ie_rsn(struct wpa_supplicant *wpa_s, uint8_t *rsn_ie,
    size_t rsn_ie_len, struct wpa_ie_data *data)
{
    struct rsn_ie_hdr *hdr;
    uint8_t *pos;
    int left;
    int i, count;

    data->proto = WPA_PROTO_RSN;
    data->pairwise_cipher = WPA_CIPHER_CCMP;
    data->group_cipher = WPA_CIPHER_CCMP;
    data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
    data->capabilities = 0;

    if (rsn_ie_len == 0) {
        /* No RSN IE - fail silently */
        return (-1);
    }

    if (rsn_ie_len < sizeof (struct rsn_ie_hdr)) {
        wpa_printf(MSG_DEBUG, "%s: ie len too short %u",
            "wpa_parse_wpa_ie_rsn", rsn_ie_len);
        return (-1);
    }

    hdr = (struct rsn_ie_hdr *)rsn_ie;

    if (hdr->elem_id != RSN_INFO_ELEM ||
        hdr->len != rsn_ie_len - 2 ||
        LE_16(hdr->version) != RSN_VERSION) {
        wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
            "wpa_parse_wpa_ie_rsn");
        return (-1);
    }

    pos = (uint8_t *)(hdr + 1);
    left = rsn_ie_len - sizeof (*hdr);

    if (left >= RSN_SELECTOR_LEN) {
        data->group_cipher = rsn_selector_to_bitfield(pos);
        pos += RSN_SELECTOR_LEN;
        left -= RSN_SELECTOR_LEN;
    } else if (left > 0) {
        wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
            "wpa_parse_wpa_ie_rsn", left);
        return (-1);
    }

    if (left >= 2) {
        data->pairwise_cipher = 0;
        count = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
        if (count == 0 || left < count * RSN_SELECTOR_LEN) {
            wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
                "count %u left %u",
                "wpa_parse_wpa_ie_rsn", count, left);
            return (-1);
        }
        for (i = 0; i < count; i++) {
            data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
            pos += RSN_SELECTOR_LEN;
            left -= RSN_SELECTOR_LEN;
        }
    } else if (left == 1) {
        wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
            "wpa_parse_wpa_ie_rsn");
        return (-1);
    }

    if (left >= 2) {
        data->key_mgmt = 0;
        count = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
        if (count == 0 || left < count * RSN_SELECTOR_LEN) {
            wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
                "count %u left %u",
                "wpa_parse_wpa_ie_rsn", count, left);
            return (-1);
        }
        for (i = 0; i < count; i++) {
            data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
            pos += RSN_SELECTOR_LEN;
            left -= RSN_SELECTOR_LEN;
        }
    } else if (left == 1) {
        wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
            "wpa_parse_wpa_ie_rsn");
        return (-1);
    }

    if (left >= 2) {
        data->capabilities = pos[0] | (pos[1] << 8);
        pos += 2;
        left -= 2;
    }

    if (left > 0) {
        /*
         * RSN IE could include PMKID data, but Authenticator should
         * never include it, so no need to parse it in the Supplicant.
         */
        wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
            "wpa_parse_wpa_ie_rsn", left);
    }

    return (0);
}

int
wpa_parse_wpa_ie(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie,
    size_t wpa_ie_len, struct wpa_ie_data *data)
{
    if (wpa_ie_len >= 1 && wpa_ie[0] == RSN_INFO_ELEM)
        return (wpa_parse_wpa_ie_rsn(wpa_s, wpa_ie, wpa_ie_len, data));
    else
        return (wpa_parse_wpa_ie_wpa(wpa_s, wpa_ie, wpa_ie_len, data));
}

static int
wpa_gen_wpa_ie_wpa(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie)
{
    uint8_t *pos;
    struct wpa_ie_hdr *hdr;

    hdr = (struct wpa_ie_hdr *)wpa_ie;
    hdr->elem_id = GENERIC_INFO_ELEM;
    (void) memcpy(&hdr->oui, WPA_OUI_TYPE, WPA_SELECTOR_LEN);
    hdr->version = LE_16(WPA_VERSION);
    pos = (uint8_t *)(hdr + 1);

    if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
            wpa_s->group_cipher);
        return (-1);
    }
    pos += WPA_SELECTOR_LEN;

    *pos++ = 1;
    *pos++ = 0;
    if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN);
    } else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN);
    } else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
        (void) memcpy(pos, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
            wpa_s->pairwise_cipher);
        return (-1);
    }
    pos += WPA_SELECTOR_LEN;

    *pos++ = 1;
    *pos++ = 0;
    if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
        (void) memcpy(pos, WPA_AUTH_KEY_MGMT_UNSPEC_802_1X,
            WPA_SELECTOR_LEN);
    } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
        (void) memcpy(pos, WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X,
            WPA_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
            wpa_s->key_mgmt);
        return (-1);
    }
    pos += WPA_SELECTOR_LEN;

    /*
     * WPA Capabilities; use defaults, so no need to include it
     */
    hdr->len = (pos - wpa_ie) - 2;

    return (pos - wpa_ie);
}

static int
wpa_gen_wpa_ie_rsn(struct wpa_supplicant *wpa_s, uint8_t *rsn_ie)
{
    uint8_t *pos;
    struct rsn_ie_hdr *hdr;

    hdr = (struct rsn_ie_hdr *)rsn_ie;
    hdr->elem_id = RSN_INFO_ELEM;
    hdr->version = LE_16(RSN_VERSION);
    pos = (uint8_t *)(hdr + 1);

    if (wpa_s->group_cipher == WPA_CIPHER_CCMP) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_WEP104) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN);
    } else if (wpa_s->group_cipher == WPA_CIPHER_WEP40) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid group cipher (%d).",
            wpa_s->group_cipher);
        return (-1);
    }
    pos += RSN_SELECTOR_LEN;

    *pos++ = 1;
    *pos++ = 0;
    if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN);
    } else if (wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN);
    } else if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
        (void) memcpy(pos, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid pairwise cipher (%d).",
            wpa_s->pairwise_cipher);
        return (-1);
    }
    pos += RSN_SELECTOR_LEN;

    *pos++ = 1;
    *pos++ = 0;
    if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X) {
        (void) memcpy(pos, RSN_AUTH_KEY_MGMT_UNSPEC_802_1X,
            RSN_SELECTOR_LEN);
    } else if (wpa_s->key_mgmt == WPA_KEY_MGMT_PSK) {
        (void) memcpy(pos, RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X,
            RSN_SELECTOR_LEN);
    } else {
        wpa_printf(MSG_WARNING, "Invalid key management type (%d).",
            wpa_s->key_mgmt);
        return (-1);
    }
    pos += RSN_SELECTOR_LEN;

    /* RSN Capabilities */
    *pos++ = 0;
    *pos++ = 0;

    if (wpa_s->cur_pmksa) {
        /* PMKID Count (2 octets, little endian) */
        *pos++ = 1;
        *pos++ = 0;
        /* PMKID */
        (void) memcpy(pos, wpa_s->cur_pmksa->pmkid, PMKID_LEN);
        pos += PMKID_LEN;
    }

    hdr->len = (pos - rsn_ie) - 2;

    return (pos - rsn_ie);
}

int
wpa_gen_wpa_ie(struct wpa_supplicant *wpa_s, uint8_t *wpa_ie)
{
    if (wpa_s->proto == WPA_PROTO_RSN)
        return (wpa_gen_wpa_ie_rsn(wpa_s, wpa_ie));
    else
        return (wpa_gen_wpa_ie_wpa(wpa_s, wpa_ie));
}

static void
wpa_pmk_to_ptk(uint8_t *pmk, uint8_t *addr1, uint8_t *addr2,
    uint8_t *nonce1, uint8_t *nonce2, uint8_t *ptk, size_t ptk_len)
{
    uint8_t data[2 * IEEE80211_ADDR_LEN + 2 * WPA_PMK_LEN];

    /*
     * PTK = PRF-X(PMK, "Pairwise key expansion",
     *  Min(AA, SA) || Max(AA, SA) ||
     *  Min(ANonce, SNonce) || Max(ANonce, SNonce))
     */

    if (memcmp(addr1, addr2, IEEE80211_ADDR_LEN) < 0) {
        (void) memcpy(data, addr1, IEEE80211_ADDR_LEN);
        (void) memcpy(data + IEEE80211_ADDR_LEN, addr2,
            IEEE80211_ADDR_LEN);
    } else {
        (void) memcpy(data, addr2, IEEE80211_ADDR_LEN);
        (void) memcpy(data + IEEE80211_ADDR_LEN, addr1,
            IEEE80211_ADDR_LEN);
    }

    if (memcmp(nonce1, nonce2, WPA_PMK_LEN) < 0) {
        (void) memcpy(data + 2 * IEEE80211_ADDR_LEN, nonce1,
            WPA_PMK_LEN);
        (void) memcpy(data + 2 * IEEE80211_ADDR_LEN + WPA_PMK_LEN,
            nonce2, WPA_PMK_LEN);
    } else {
        (void) memcpy(data + 2 * IEEE80211_ADDR_LEN, nonce2,
            WPA_PMK_LEN);
        (void) memcpy(data + 2 * IEEE80211_ADDR_LEN + WPA_PMK_LEN,
            nonce1, WPA_PMK_LEN);
    }

    sha1_prf(pmk, WPA_PMK_LEN, "Pairwise key expansion", data,
        sizeof (data), ptk, ptk_len);

    wpa_hexdump(MSG_DEBUG, "WPA: PMK", pmk, WPA_PMK_LEN);
    wpa_hexdump(MSG_DEBUG, "WPA: PTK", ptk, ptk_len);
}

struct wpa_ssid *
wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
{
    struct wpa_ssid *entry;
    uint8_t ssid[MAX_ESSID_LENGTH];
    int ssid_len;
    uint8_t bssid[IEEE80211_ADDR_LEN];

    (void) memset(ssid, 0, MAX_ESSID_LENGTH);
    ssid_len = wpa_s->driver->get_ssid(wpa_s->ifname, (char *)ssid);
    if (ssid_len < 0) {
        wpa_printf(MSG_WARNING, "Could not read SSID from driver.");
        return (NULL);
    }

    if (wpa_s->driver->get_bssid(wpa_s->ifname, (char *)bssid) < 0) {
        wpa_printf(MSG_WARNING, "Could not read BSSID from driver.");
        return (NULL);
    }

    entry = wpa_s->conf->ssid;
    wpa_printf(MSG_DEBUG, "entry len=%d ssid=%s,"
        " driver len=%d ssid=%s",
        entry->ssid_len, entry->ssid, ssid_len, ssid);

    if (ssid_len == entry->ssid_len &&
        memcmp(ssid, entry->ssid, ssid_len) == 0 &&
        (!entry->bssid_set ||
        memcmp(bssid, entry->bssid, IEEE80211_ADDR_LEN) == 0))
        return (entry);

    return (NULL);
}

static void
wpa_eapol_key_mic(uint8_t *key, int ver, uint8_t *buf, size_t len, uint8_t *mic)
{
    if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
        hmac_md5(key, 16, buf, len, mic);
    } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
        uint8_t hash[SHA1_MAC_LEN];
        hmac_sha1(key, 16, buf, len, hash);
        (void) memcpy(mic, hash, MD5_MAC_LEN);
    }
}

void
wpa_supplicant_key_request(struct wpa_supplicant *wpa_s,
    int error, int pairwise)
{
    int rlen;
    struct ieee802_1x_hdr *hdr;
    struct wpa_eapol_key *reply;
    unsigned char *rbuf;
    struct l2_ethhdr *ethhdr;
    int key_info, ver;
    uint8_t bssid[IEEE80211_ADDR_LEN];

    if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP)
        ver = WPA_KEY_INFO_TYPE_HMAC_SHA1_AES;
    else
        ver = WPA_KEY_INFO_TYPE_HMAC_MD5_RC4;

    if (wpa_s->driver->get_bssid(wpa_s->ifname, (char *)bssid) < 0) {
        wpa_printf(MSG_WARNING, "Failed to read BSSID for EAPOL-Key "
            "request");
        return;
    }

    rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
    rbuf = malloc(rlen);
    if (rbuf == NULL)
        return;

    (void) memset(rbuf, 0, rlen);
    ethhdr = (struct l2_ethhdr *)rbuf;
    (void) memcpy(ethhdr->h_dest, bssid, IEEE80211_ADDR_LEN);
    (void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
    ethhdr->h_proto = htons(ETHERTYPE_EAPOL);

    hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
    hdr->version = wpa_s->conf->eapol_version;
    hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
    hdr->length = htons(sizeof (*reply));

    reply = (struct wpa_eapol_key *)(hdr + 1);
    reply->type = wpa_s->proto == WPA_PROTO_RSN ?
        EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
    key_info = WPA_KEY_INFO_REQUEST | ver;
    if (wpa_s->ptk_set)
        key_info |= WPA_KEY_INFO_MIC;
    if (error)
        key_info |= WPA_KEY_INFO_ERROR;
    if (pairwise)
        key_info |= WPA_KEY_INFO_KEY_TYPE;
    reply->key_info = BE_16(key_info);
    reply->key_length = 0;
    (void) memcpy(reply->replay_counter, wpa_s->request_counter,
        WPA_REPLAY_COUNTER_LEN);
    inc_byte_array(wpa_s->request_counter, WPA_REPLAY_COUNTER_LEN);

    reply->key_data_length = BE_16(0);

    if (key_info & WPA_KEY_INFO_MIC) {
        wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
            rlen - sizeof (*ethhdr), reply->key_mic);
    }

    wpa_printf(MSG_INFO, "WPA: Sending EAPOL-Key Request (error=%d "
        "pairwise=%d ptk_set=%d len=%d)",
        error, pairwise, wpa_s->ptk_set, rlen);
    wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key Request", rbuf, rlen);
    (void) l2_packet_send(wpa_s->l2, rbuf, rlen);
    free(rbuf);
}

static void
wpa_supplicant_process_1_of_4(struct wpa_supplicant *wpa_s,
    unsigned char *src_addr, struct wpa_eapol_key *key, int ver)
{
    int rlen;
    struct ieee802_1x_hdr *hdr;
    struct wpa_eapol_key *reply;
    unsigned char *rbuf;
    struct l2_ethhdr *ethhdr;
    struct wpa_ssid *ssid;
    struct wpa_ptk *ptk;
    uint8_t buf[8], wpa_ie_buf[80], *wpa_ie, *pmkid = NULL;
    int wpa_ie_len;

    wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
    wpa_printf(MSG_DEBUG, "WPA: RX message 1 of 4-Way Handshake from "
        MACSTR " (ver=%d)", MAC2STR(src_addr), ver);

    ssid = wpa_supplicant_get_ssid(wpa_s);
    if (ssid == NULL) {
        wpa_printf(MSG_WARNING,
            "WPA: No SSID info found (msg 1 of 4).");
        return;
    }

    if (wpa_s->proto == WPA_PROTO_RSN) {
        /* RSN: msg 1/4 should contain PMKID for the selected PMK */
        uint8_t *pos = (uint8_t *)(key + 1);
        uint8_t *end = pos + BE_16(key->key_data_length);

        wpa_hexdump(MSG_DEBUG, "RSN: msg 1/4 key data",
            pos, BE_16(key->key_data_length));

        while (pos + 1 < end) {
            if (pos + 2 + pos[1] > end) {
                wpa_printf(MSG_DEBUG, "RSN: key data "
                    "underflow (ie=%d len=%d)",
                    pos[0], pos[1]);
                break;
            }
            if (pos[0] == GENERIC_INFO_ELEM &&
                pos + 1 + RSN_SELECTOR_LEN < end &&
                pos[1] >= RSN_SELECTOR_LEN + PMKID_LEN &&
                memcmp(pos + 2, RSN_KEY_DATA_PMKID,
                RSN_SELECTOR_LEN) == 0) {
                pmkid = pos + 2 + RSN_SELECTOR_LEN;
                wpa_hexdump(MSG_DEBUG, "RSN: PMKID from "
                    "Authenticator", pmkid, PMKID_LEN);
                break;
            } else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0)
                break;
            pos += 2 + pos[1];
        }
    }

    wpa_ie = wpa_ie_buf;
    wpa_ie_len = wpa_gen_wpa_ie(wpa_s, wpa_ie);
    if (wpa_ie_len < 0) {
        wpa_printf(MSG_WARNING, "WPA: Failed to generate "
            "WPA IE (for msg 2 of 4).");
        return;
    }
    wpa_hexdump(MSG_DEBUG, "WPA: WPA IE for msg 2/4", wpa_ie, wpa_ie_len);

    rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply) + wpa_ie_len;
    rbuf = malloc(rlen);
    if (rbuf == NULL)
        return;

    (void) memset(rbuf, 0, rlen);
    ethhdr = (struct l2_ethhdr *)rbuf;
    (void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
    (void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
    ethhdr->h_proto = htons(ETHERTYPE_EAPOL);

    hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
    hdr->version = wpa_s->conf->eapol_version;
    hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
    hdr->length = htons(sizeof (*reply) + wpa_ie_len);

    reply = (struct wpa_eapol_key *)(hdr + 1);
    reply->type = wpa_s->proto == WPA_PROTO_RSN ?
        EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
    reply->key_info = BE_16(ver | WPA_KEY_INFO_KEY_TYPE |
                    WPA_KEY_INFO_MIC);
    reply->key_length = key->key_length;
    (void) memcpy(reply->replay_counter, key->replay_counter,
        WPA_REPLAY_COUNTER_LEN);

    reply->key_data_length = BE_16(wpa_ie_len);
    (void) memcpy(reply + 1, wpa_ie, wpa_ie_len);

    if (wpa_s->renew_snonce) {
        if (random_get_pseudo_bytes(wpa_s->snonce, WPA_NONCE_LEN)) {
            wpa_printf(MSG_WARNING, "WPA: Failed to get "
                "random data for SNonce");
            free(rbuf);
            return;
        }

        wpa_s->renew_snonce = 0;
        wpa_hexdump(MSG_DEBUG, "WPA: Renewed SNonce",
            wpa_s->snonce, WPA_NONCE_LEN);
    }
    (void) memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
    ptk = &wpa_s->tptk;
    (void) memcpy(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN);

    wpa_pmk_to_ptk(wpa_s->pmk, wpa_s->own_addr, src_addr,
        wpa_s->snonce, key->key_nonce, (uint8_t *)ptk, sizeof (*ptk));

    /*
     * Supplicant: swap tx/rx Mic keys
     */
    (void) memcpy(buf, ptk->u.auth.tx_mic_key, 8);
    (void) memcpy(ptk->u.auth.tx_mic_key, ptk->u.auth.rx_mic_key, 8);
    (void) memcpy(ptk->u.auth.rx_mic_key, buf, 8);
    wpa_s->tptk_set = 1;
    wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, (uint8_t *)hdr,
            rlen - sizeof (*ethhdr), reply->key_mic);
    wpa_hexdump(MSG_DEBUG, "WPA: EAPOL-Key MIC", reply->key_mic, 16);

    wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/4");
    wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/4", rbuf, rlen);
    (void) l2_packet_send(wpa_s->l2, rbuf, rlen);

    free(rbuf);
}

static void
wpa_supplicant_process_3_of_4_gtk(struct wpa_supplicant *wpa_s,
    unsigned char *src_addr, struct wpa_eapol_key *key,
    uint8_t *gtk, int gtk_len)
{
    int keyidx, tx, key_rsc_len = 0, alg;

    wpa_hexdump(MSG_DEBUG,
        "WPA: received GTK in pairwise handshake", gtk, gtk_len);

    keyidx = gtk[0] & 0x3;
    tx = !!(gtk[0] & BIT(2));
    if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
        /*
         * Ignore Tx bit in GTK IE if a pairwise key is used.
         * One AP seemed to set this bit (incorrectly, since Tx
         * is only when doing Group Key only APs) and without
         * this workaround, the data connection does not work
         * because wpa_supplicant configured non-zero keyidx to
         * be used for unicast.
         */
        wpa_printf(MSG_INFO, "RSN: Tx bit set for GTK IE, but "
            "pairwise keys are used - ignore Tx bit");
        tx = 0;
    }

    gtk += 2;
    gtk_len -= 2;
    wpa_hexdump(MSG_DEBUG, "WPA: Group Key", gtk, gtk_len);

    switch (wpa_s->group_cipher) {
    case WPA_CIPHER_CCMP:
        if (gtk_len != 16) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported CCMP"
                " Group Cipher key length %d.", gtk_len);
            return;
        }
        key_rsc_len = 6;
        alg = WPA_ALG_CCMP;
        break;
    case WPA_CIPHER_TKIP:
        if (gtk_len != 32) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported TKIP"
                " Group Cipher key length %d.", gtk_len);
            return;
        }
        key_rsc_len = 6;
        alg = WPA_ALG_TKIP;
        break;
    case WPA_CIPHER_WEP104:
        if (gtk_len != 13) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported "
                "WEP104 Group Cipher key length " "%d.", gtk_len);
            return;
        }
        alg = WPA_ALG_WEP;
        break;
    case WPA_CIPHER_WEP40:
        if (gtk_len != 5) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported "
                "WEP40 Group Cipher key length %d.", gtk_len);
            return;
        }
        alg = WPA_ALG_WEP;
        break;
    default:
        wpa_printf(MSG_WARNING, "WPA: Unsupport Group Cipher "
            "%d", wpa_s->group_cipher);
        return;
    }

    wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver "
        "(keyidx=%d tx=%d).", keyidx, tx);
    wpa_hexdump(MSG_DEBUG, "WPA: RSC", key->key_rsc, key_rsc_len);
    if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
        uint8_t tmpbuf[8];
        /*
         * Swap Tx/Rx keys for Michael MIC
         */
        (void) memcpy(tmpbuf, gtk + 16, 8);
        (void) memcpy(gtk + 16, gtk + 24, 8);
        (void) memcpy(gtk + 24, tmpbuf, 8);
    }
    if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
        if (wpa_s->driver->set_key(wpa_s->ifname, alg,
            (uint8_t *)"\xff\xff\xff\xff\xff\xff",
            keyidx, 1, key->key_rsc,
            key_rsc_len, gtk, gtk_len) < 0)
            wpa_printf(MSG_WARNING, "WPA: Failed to set "
                "GTK to the driver (Group only).");
    } else if (wpa_s->driver->set_key(wpa_s->ifname, alg,
            (uint8_t *)"\xff\xff\xff\xff\xff\xff",
            keyidx, tx,
            key->key_rsc, key_rsc_len,
            gtk, gtk_len) < 0) {
        wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to "
            "the driver.");
    }

    wpa_printf(MSG_INFO, "WPA: Key negotiation completed with "
        MACSTR, MAC2STR(src_addr));
    eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
    wpa_supplicant_cancel_auth_timeout(wpa_s);
    wpa_s->wpa_state = WPA_COMPLETED;
}

static void
wpa_supplicant_process_3_of_4(struct wpa_supplicant *wpa_s,
    unsigned char *src_addr, struct wpa_eapol_key *key,
    int extra_len, int ver)
{
    int rlen;
    struct ieee802_1x_hdr *hdr;
    struct wpa_eapol_key *reply;
    unsigned char *rbuf;
    struct l2_ethhdr *ethhdr;
    int key_info, ie_len = 0, keylen, gtk_len = 0;
    uint8_t *ie = NULL, *gtk = NULL, *key_rsc;
    uint8_t null_rsc[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };

    wpa_s->wpa_state = WPA_4WAY_HANDSHAKE;
    wpa_printf(MSG_DEBUG, "WPA: RX message 3 of 4-Way Handshake from "
        MACSTR " (ver=%d)", MAC2STR(src_addr), ver);

    key_info = BE_16(key->key_info);

    if (wpa_s->proto == WPA_PROTO_RSN) {
        uint8_t *pos = (uint8_t *)(key + 1);
        uint8_t *end = pos + BE_16(key->key_data_length);
        while (pos + 1 < end) {
            if (pos + 2 + pos[1] > end) {
                wpa_printf(MSG_DEBUG, "RSN: key data "
                    "underflow (ie=%d len=%d)",
                    pos[0], pos[1]);
                break;
            }
            if (*pos == RSN_INFO_ELEM) {
                ie = pos;
                ie_len = pos[1] + 2;
            } else if (pos[0] == GENERIC_INFO_ELEM &&
                    pos + 1 + RSN_SELECTOR_LEN < end &&
                    pos[1] > RSN_SELECTOR_LEN + 2 &&
                    memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
                    RSN_SELECTOR_LEN) == 0) {
                if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
                    wpa_printf(MSG_WARNING, "WPA: GTK IE "
                        "in unencrypted key data");
                    return;
                }
                gtk = pos + 2 + RSN_SELECTOR_LEN;
                gtk_len = pos[1] - RSN_SELECTOR_LEN;
            } else if (pos[0] == GENERIC_INFO_ELEM && pos[1] == 0)
                break;

            pos += 2 + pos[1];
        }
    } else {
        ie = (uint8_t *)(key + 1);
        ie_len = BE_16(key->key_data_length);
        if (ie_len > extra_len) {
            wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
                " ie_len=%d > extra_len=%d",
                ie_len, extra_len);
            return;
        }
    }

    if (wpa_s->ap_wpa_ie &&
        (wpa_s->ap_wpa_ie_len != ie_len ||
        memcmp(wpa_s->ap_wpa_ie, ie, ie_len) != 0)) {
        wpa_printf(MSG_WARNING, "WPA: WPA IE in 3/4 msg does not match"
            " with WPA IE in Beacon/ProbeResp (src=" MACSTR ")",
            MAC2STR(src_addr));
        wpa_hexdump(MSG_INFO, "WPA: WPA IE in Beacon/ProbeResp",
            wpa_s->ap_wpa_ie, wpa_s->ap_wpa_ie_len);
        wpa_hexdump(MSG_INFO, "WPA: WPA IE in 3/4 msg", ie, ie_len);
        wpa_supplicant_disassociate(wpa_s, REASON_IE_IN_4WAY_DIFFERS);
        wpa_supplicant_req_scan(wpa_s, 0, 0);
        return;
    }

    if (memcmp(wpa_s->anonce, key->key_nonce, WPA_NONCE_LEN) != 0) {
        wpa_printf(MSG_WARNING, "WPA: ANonce from message 1 of 4-Way "
            "Handshake differs from 3 of 4-Way Handshake - drop"
            " packet (src=" MACSTR ")", MAC2STR(src_addr));
        return;
    }

    keylen = BE_16(key->key_length);
    switch (wpa_s->pairwise_cipher) {
    case WPA_CIPHER_CCMP:
        if (keylen != 16) {
            wpa_printf(MSG_WARNING, "WPA: Invalid CCMP key length "
                "%d (src=" MACSTR ")",
                keylen, MAC2STR(src_addr));
            return;
        }
        break;
    case WPA_CIPHER_TKIP:
        if (keylen != 32) {
            wpa_printf(MSG_WARNING, "WPA: Invalid TKIP key length "
                "%d (src=" MACSTR ")",
                keylen, MAC2STR(src_addr));
            return;
        }
        break;
    }

    rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
    rbuf = malloc(rlen);
    if (rbuf == NULL)
        return;

    (void) memset(rbuf, 0, rlen);
    ethhdr = (struct l2_ethhdr *)rbuf;
    (void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
    (void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
    ethhdr->h_proto = htons(ETHERTYPE_EAPOL);

    hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
    hdr->version = wpa_s->conf->eapol_version;
    hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
    hdr->length = htons(sizeof (*reply));

    reply = (struct wpa_eapol_key *)(hdr + 1);
    reply->type = wpa_s->proto == WPA_PROTO_RSN ?
        EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
    reply->key_info = BE_16(ver | WPA_KEY_INFO_KEY_TYPE |
                    WPA_KEY_INFO_MIC |
                    (key_info & WPA_KEY_INFO_SECURE));
    reply->key_length = key->key_length;
    (void) memcpy(reply->replay_counter, key->replay_counter,
        WPA_REPLAY_COUNTER_LEN);

    reply->key_data_length = BE_16(0);

    (void) memcpy(reply->key_nonce, wpa_s->snonce, WPA_NONCE_LEN);
    wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
        rlen - sizeof (*ethhdr), reply->key_mic);

    wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 4/4");
    wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 4/4", rbuf, rlen);
    (void) l2_packet_send(wpa_s->l2, rbuf, rlen);

    free(rbuf);

    /*
     * SNonce was successfully used in msg 3/4, so mark it to be renewed
     * for the next 4-Way Handshake. If msg 3 is received again, the old
     * SNonce will still be used to avoid changing PTK.
     */
    wpa_s->renew_snonce = 1;

    if (key_info & WPA_KEY_INFO_INSTALL) {
        int alg, keylen, rsclen;
        wpa_printf(MSG_DEBUG, "WPA: Installing PTK to the driver.");
        switch (wpa_s->pairwise_cipher) {
        case WPA_CIPHER_CCMP:
            alg = WPA_ALG_CCMP;
            keylen = 16;
            rsclen = 6;
            break;
        case WPA_CIPHER_TKIP:
            alg = WPA_ALG_TKIP;
            keylen = 32;
            rsclen = 6;
            break;
        case WPA_CIPHER_NONE:
            wpa_printf(MSG_DEBUG, "WPA: Pairwise Cipher Suite: "
                "NONE - do not use pairwise keys");
            return;
        default:
            wpa_printf(MSG_WARNING, "WPA: Unsupported pairwise "
                "cipher %d", wpa_s->pairwise_cipher);
            return;
        }
        if (wpa_s->proto == WPA_PROTO_RSN) {
            key_rsc = null_rsc;
        } else {
            key_rsc = key->key_rsc;
            wpa_hexdump(MSG_DEBUG, "WPA: RSC", key_rsc, rsclen);
        }

        if (wpa_s->driver->set_key(wpa_s->ifname, alg, src_addr,
            0, 1, key_rsc, rsclen,
            (uint8_t *)&wpa_s->ptk.tk1, keylen) < 0) {
            wpa_printf(MSG_WARNING, "WPA: Failed to set PTK to the"
                " driver.");
        }
    }

    wpa_printf(MSG_DEBUG, "%s: key_info=%x gtk=%p\n",
        "wpa_supplicant_process_3_of_4", key_info, gtk);
    wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;

    if (gtk)
        wpa_supplicant_process_3_of_4_gtk(wpa_s,
            src_addr, key, gtk, gtk_len);
}

static void
wpa_supplicant_process_1_of_2(struct wpa_supplicant *wpa_s,
    unsigned char *src_addr, struct wpa_eapol_key *key,
    int extra_len, int ver)
{
    int rlen;
    struct ieee802_1x_hdr *hdr;
    struct wpa_eapol_key *reply;
    unsigned char *rbuf;
    struct l2_ethhdr *ethhdr;
    int key_info, keylen, keydatalen, maxkeylen, keyidx, key_rsc_len = 0;
    int alg, tx;
    uint8_t ek[32], tmpbuf[8], gtk[32];
    uint8_t *gtk_ie = NULL;
    size_t gtk_ie_len = 0;

    wpa_s->wpa_state = WPA_GROUP_HANDSHAKE;
    wpa_printf(MSG_DEBUG, "WPA: RX message 1 of Group Key Handshake from "
        MACSTR " (ver=%d)", MAC2STR(src_addr), ver);

    key_info = BE_16(key->key_info);
    keydatalen = BE_16(key->key_data_length);

    if (wpa_s->proto == WPA_PROTO_RSN) {
        uint8_t *pos = (uint8_t *)(key + 1);
        uint8_t *end = pos + keydatalen;
        while (pos + 1 < end) {
            if (pos + 2 + pos[1] > end) {
                wpa_printf(MSG_DEBUG, "RSN: key data "
                    "underflow (ie=%d len=%d)",
                    pos[0], pos[1]);
                break;
            }
            if (pos[0] == GENERIC_INFO_ELEM &&
                pos + 1 + RSN_SELECTOR_LEN < end &&
                pos[1] > RSN_SELECTOR_LEN + 2 &&
                memcmp(pos + 2, RSN_KEY_DATA_GROUPKEY,
                RSN_SELECTOR_LEN) == 0) {
                if (!(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
                    wpa_printf(MSG_WARNING, "WPA: GTK IE "
                        "in unencrypted key data");
                    return;
                }
                gtk_ie = pos + 2 + RSN_SELECTOR_LEN;
                gtk_ie_len = pos[1] - RSN_SELECTOR_LEN;
                break;
            } else if (pos[0] == GENERIC_INFO_ELEM &&
                    pos[1] == 0)
                break;

            pos += 2 + pos[1];
        }

        if (gtk_ie == NULL) {
            wpa_printf(MSG_INFO, "WPA: No GTK IE in Group Key "
                "message 1/2");
            return;
        }
        maxkeylen = keylen = gtk_ie_len - 2;
    } else {
        keylen = BE_16(key->key_length);
        maxkeylen = keydatalen;
        if (keydatalen > extra_len) {
            wpa_printf(MSG_INFO, "WPA: Truncated EAPOL-Key packet:"
                " key_data_length=%d > extra_len=%d",
                keydatalen, extra_len);
            return;
        }
        if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES)
            maxkeylen -= 8;
    }

    switch (wpa_s->group_cipher) {
    case WPA_CIPHER_CCMP:
        if (keylen != 16 || maxkeylen < 16) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported CCMP Group "
                "Cipher key length %d (%d).", keylen, maxkeylen);
            return;
        }
        key_rsc_len = 6;
        alg = WPA_ALG_CCMP;
        break;
    case WPA_CIPHER_TKIP:
        if (keylen != 32 || maxkeylen < 32) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported TKIP Group "
                "Cipher key length %d (%d).", keylen, maxkeylen);
            return;
        }
        key_rsc_len = 6; /* key->key_data; */
        alg = WPA_ALG_TKIP;
        break;
    case WPA_CIPHER_WEP104:
        if (keylen != 13 || maxkeylen < 13) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported WEP104 Group"
                " Cipher key length %d (%d).", keylen, maxkeylen);
            return;
        }
        alg = WPA_ALG_WEP;
        break;
    case WPA_CIPHER_WEP40:
        if (keylen != 5 || maxkeylen < 5) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported WEP40 Group "
                "Cipher key length %d (%d).", keylen, maxkeylen);
            return;
        }
        alg = WPA_ALG_WEP;
        break;
    default:
        wpa_printf(MSG_WARNING, "WPA: Unsupport Group Cipher %d",
            wpa_s->group_cipher);
        return;
    }

    if (wpa_s->proto == WPA_PROTO_RSN) {
        wpa_hexdump(MSG_DEBUG,
            "WPA: received GTK in group key handshake",
            gtk_ie, gtk_ie_len);
        keyidx = gtk_ie[0] & 0x3;
        tx = !!(gtk_ie[0] & BIT(2));
        if (gtk_ie_len - 2 > sizeof (gtk)) {
            wpa_printf(MSG_INFO, "WPA: Too long GTK in GTK IE "
                "(len=%d)", gtk_ie_len - 2);
            return;
        }
        (void) memcpy(gtk, gtk_ie + 2, gtk_ie_len - 2);
    } else {
        keyidx = (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) >>
            WPA_KEY_INFO_KEY_INDEX_SHIFT;
        if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
            (void) memcpy(ek, key->key_iv, 16);
            (void) memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
            rc4_skip(ek, 32, 256, (uint8_t *)(key + 1), keydatalen);
            (void) memcpy(gtk, key + 1, keylen);
        } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
            if (keydatalen % 8) {
                wpa_printf(MSG_WARNING, "WPA: Unsupported "
                    "AES-WRAP len %d", keydatalen);
                return;
            }
            if (aes_unwrap(wpa_s->ptk.encr_key, maxkeylen / 8,
                    (uint8_t *)(key + 1), gtk)) {
                wpa_printf(MSG_WARNING, "WPA: AES unwrap "
                    "failed - could not decrypt GTK");
                return;
            }
        }
        tx = !!(key_info & WPA_KEY_INFO_TXRX);
        if (tx && wpa_s->pairwise_cipher != WPA_CIPHER_NONE) {
            /*
             * Ignore Tx bit in Group Key message if a pairwise key
             * is used. Some APs seem to setting this bit
             * (incorrectly, since Tx is only when doing Group Key
             * only APs) and without this workaround, the data
             * connection does not work because wpa_supplicant
             * configured non-zero keyidx to be used for unicast.
             */
            wpa_printf(MSG_INFO, "WPA: Tx bit set for GTK, but "
                "pairwise keys are used - ignore Tx bit");
            tx = 0;
        }
    }
    wpa_hexdump(MSG_DEBUG, "WPA: Group Key", gtk, keylen);
    wpa_printf(MSG_DEBUG, "WPA: Installing GTK to the driver (keyidx=%d "
        "tx=%d).", keyidx, tx);
    wpa_hexdump(MSG_DEBUG, "WPA: RSC", key->key_rsc, key_rsc_len);
    if (wpa_s->group_cipher == WPA_CIPHER_TKIP) {
        /*
         * Swap Tx/Rx keys for Michael MIC
         */
        (void) memcpy(tmpbuf, gtk + 16, 8);
        (void) memcpy(gtk + 16, gtk + 24, 8);
        (void) memcpy(gtk + 24, tmpbuf, 8);
    }
    if (wpa_s->pairwise_cipher == WPA_CIPHER_NONE) {
        if (wpa_s->driver->set_key(wpa_s->ifname, alg,
            (uint8_t *)"\xff\xff\xff\xff\xff\xff",
            keyidx, 1, key->key_rsc,
            key_rsc_len, gtk, keylen) < 0)
            wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to the"
                " driver (Group only).");
    } else if (wpa_s->driver->set_key(wpa_s->ifname, alg,
        (uint8_t *)"\xff\xff\xff\xff\xff\xff",
        keyidx, tx,
        key->key_rsc, key_rsc_len,
        gtk, keylen) < 0) {
        wpa_printf(MSG_WARNING, "WPA: Failed to set GTK to the "
            "driver.");
    }

    rlen = sizeof (*ethhdr) + sizeof (*hdr) + sizeof (*reply);
    rbuf = malloc(rlen);
    if (rbuf == NULL)
        return;

    (void) memset(rbuf, 0, rlen);
    ethhdr = (struct l2_ethhdr *)rbuf;
    (void) memcpy(ethhdr->h_dest, src_addr, IEEE80211_ADDR_LEN);
    (void) memcpy(ethhdr->h_source, wpa_s->own_addr, IEEE80211_ADDR_LEN);
    ethhdr->h_proto = htons(ETHERTYPE_EAPOL);

    hdr = (struct ieee802_1x_hdr *)(ethhdr + 1);
    hdr->version = wpa_s->conf->eapol_version;
    hdr->type = IEEE802_1X_TYPE_EAPOL_KEY;
    hdr->length = htons(sizeof (*reply));

    reply = (struct wpa_eapol_key *)(hdr + 1);
    reply->type = wpa_s->proto == WPA_PROTO_RSN ?
        EAPOL_KEY_TYPE_RSN : EAPOL_KEY_TYPE_WPA;
    reply->key_info =
        BE_16(ver | WPA_KEY_INFO_MIC | WPA_KEY_INFO_SECURE |
        (key_info & WPA_KEY_INFO_KEY_INDEX_MASK));
    reply->key_length = key->key_length;
    (void) memcpy(reply->replay_counter, key->replay_counter,
        WPA_REPLAY_COUNTER_LEN);

    reply->key_data_length = BE_16(0);

    wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, (uint8_t *)hdr,
        rlen - sizeof (*ethhdr), reply->key_mic);

    wpa_printf(MSG_DEBUG, "WPA: Sending EAPOL-Key 2/2");
    wpa_hexdump(MSG_MSGDUMP, "WPA: TX EAPOL-Key 2/2", rbuf, rlen);
    (void) l2_packet_send(wpa_s->l2, rbuf, rlen);
    free(rbuf);

    wpa_printf(MSG_INFO, "WPA: Key negotiation completed with " MACSTR,
        MAC2STR(src_addr));
    eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
    wpa_supplicant_cancel_auth_timeout(wpa_s);
    wpa_s->wpa_state = WPA_COMPLETED;
    wpa_printf(MSG_INFO, "-----------------------------------\n");
}

static int
wpa_supplicant_verify_eapol_key_mic(struct wpa_supplicant *wpa_s,
    struct wpa_eapol_key *key, int ver, uint8_t *buf, size_t len)
{
    uint8_t mic[16];
    int ok = 0;

    (void) memcpy(mic, key->key_mic, 16);
    if (wpa_s->tptk_set) {
        (void) memset(key->key_mic, 0, 16);
        wpa_eapol_key_mic(wpa_s->tptk.mic_key, ver, buf, len,
            key->key_mic);
        if (memcmp(mic, key->key_mic, 16) != 0) {
            wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
                "when using TPTK - ignoring TPTK");
        } else {
            ok = 1;
            wpa_s->tptk_set = 0;
            wpa_s->ptk_set = 1;
            (void) memcpy(&wpa_s->ptk, &wpa_s->tptk,
                sizeof (wpa_s->ptk));
        }
    }

    if (!ok && wpa_s->ptk_set) {
        (void) memset(key->key_mic, 0, 16);
        wpa_eapol_key_mic(wpa_s->ptk.mic_key, ver, buf, len,
            key->key_mic);
        if (memcmp(mic, key->key_mic, 16) != 0) {
            wpa_printf(MSG_WARNING, "WPA: Invalid EAPOL-Key MIC "
                "- dropping packet");
            return (-1);
        }
        ok = 1;
    }

    if (!ok) {
        wpa_printf(MSG_WARNING, "WPA: Could not verify EAPOL-Key MIC "
            "- dropping packet");
        return (-1);
    }

    (void) memcpy(wpa_s->rx_replay_counter, key->replay_counter,
        WPA_REPLAY_COUNTER_LEN);
    wpa_s->rx_replay_counter_set = 1;

    return (0);
}

/* Decrypt RSN EAPOL-Key key data (RC4 or AES-WRAP) */
static int
wpa_supplicant_decrypt_key_data(struct wpa_supplicant *wpa_s,
    struct wpa_eapol_key *key, int ver)
{
    int keydatalen = BE_16(key->key_data_length);

    wpa_hexdump(MSG_DEBUG, "RSN: encrypted key data",
        (uint8_t *)(key + 1), keydatalen);
    if (!wpa_s->ptk_set) {
        wpa_printf(MSG_WARNING, "WPA: PTK not available, "
            "cannot decrypt EAPOL-Key key data.");
        return (-1);
    }

    /*
     * Decrypt key data here so that this operation does not need
     * to be implemented separately for each message type.
     */
    if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) {
        uint8_t ek[32];
        (void) memcpy(ek, key->key_iv, 16);
        (void) memcpy(ek + 16, wpa_s->ptk.encr_key, 16);
        rc4_skip(ek, 32, 256, (uint8_t *)(key + 1), keydatalen);
    } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
        uint8_t *buf;
        if (keydatalen % 8) {
            wpa_printf(MSG_WARNING, "WPA: Unsupported "
                "AES-WRAP len %d", keydatalen);
            return (-1);
        }
        keydatalen -= 8; /* AES-WRAP adds 8 bytes */
        buf = malloc(keydatalen);
        if (buf == NULL) {
            wpa_printf(MSG_WARNING, "WPA: No memory for "
                "AES-UNWRAP buffer");
            return (-1);
        }
        if (aes_unwrap(wpa_s->ptk.encr_key, keydatalen / 8,
            (uint8_t *)(key + 1), buf)) {
            free(buf);
            wpa_printf(MSG_WARNING, "WPA: AES unwrap failed - "
                "could not decrypt EAPOL-Key key data");
            return (-1);
        }
        (void) memcpy(key + 1, buf, keydatalen);
        free(buf);
        key->key_data_length = BE_16(keydatalen);
    }
    wpa_hexdump(MSG_DEBUG, "WPA: decrypted EAPOL-Key key data",
        (uint8_t *)(key + 1), keydatalen);

    return (0);
}

static void
wpa_sm_rx_eapol(struct wpa_supplicant *wpa_s,
    unsigned char *src_addr, unsigned char *buf, size_t len)
{
    size_t plen, data_len, extra_len;
    struct ieee802_1x_hdr *hdr;
    struct wpa_eapol_key *key;
    int key_info, ver;

    wpa_printf(MSG_DEBUG, "WPA: EAPOL frame len %u\n ", len);

    hdr = (struct ieee802_1x_hdr *)buf;
    key = (struct wpa_eapol_key *)(hdr + 1);
    wpa_printf(MSG_DEBUG, "hdr_len=%u, key_len=%u",
        sizeof (*hdr), sizeof (*key));
    if (len < sizeof (*hdr) + sizeof (*key)) {
        wpa_printf(MSG_DEBUG, "WPA: EAPOL frame too short, len %u, "
            "expecting at least %u",
            len, sizeof (*hdr) + sizeof (*key));
        return;
    }
    plen = ntohs(hdr->length);
    data_len = plen + sizeof (*hdr);
    wpa_printf(MSG_DEBUG, "IEEE 802.1X RX: version=%d type=%d length=%d",
        hdr->version, hdr->type, plen);

    if (hdr->type != IEEE802_1X_TYPE_EAPOL_KEY) {
        wpa_printf(MSG_DEBUG, "WPA: EAPOL frame (type %u) discarded, "
            "not a Key frame", hdr->type);
        return;
    }
    if (plen > len - sizeof (*hdr) || plen < sizeof (*key)) {
        wpa_printf(MSG_DEBUG, "WPA: EAPOL frame payload size %u "
            "invalid (frame size %u)", plen, len);
        return;
    }

    wpa_printf(MSG_DEBUG, "  EAPOL-Key type=%d", key->type);
    if (key->type != EAPOL_KEY_TYPE_WPA && key->type !=
        EAPOL_KEY_TYPE_RSN) {
        wpa_printf(MSG_DEBUG, "WPA: EAPOL-Key type (%d) unknown, "
            "discarded", key->type);
        return;
    }

    wpa_hexdump(MSG_MSGDUMP, "WPA: RX EAPOL-Key", buf, len);
    if (data_len < len) {
        wpa_printf(MSG_DEBUG, "WPA: ignoring %d bytes after the IEEE "
            "802.1X data", len - data_len);
    }
    key_info = BE_16(key->key_info);
    ver = key_info & WPA_KEY_INFO_TYPE_MASK;
    if (ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 &&
        ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
        wpa_printf(MSG_INFO, "WPA: Unsupported EAPOL-Key descriptor "
            "version %d.", ver);
        return;
    }

    if (wpa_s->pairwise_cipher == WPA_CIPHER_CCMP &&
        ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) {
        wpa_printf(MSG_INFO, "WPA: CCMP is used, but EAPOL-Key "
            "descriptor version (%d) is not 2.", ver);
        if (wpa_s->group_cipher != WPA_CIPHER_CCMP &&
            !(key_info & WPA_KEY_INFO_KEY_TYPE)) {
            /*
             * Earlier versions of IEEE 802.11i did not explicitly
             * require version 2 descriptor for all EAPOL-Key
             * packets, so allow group keys to use version 1 if
             * CCMP is not used for them.
             */
            wpa_printf(MSG_INFO, "WPA: Backwards compatibility: "
                "allow invalid version for non-CCMP group keys");
        } else
            return;
    }

    if (wpa_s->rx_replay_counter_set &&
        memcmp(key->replay_counter, wpa_s->rx_replay_counter,
        WPA_REPLAY_COUNTER_LEN) <= 0) {
        wpa_printf(MSG_WARNING, "WPA: EAPOL-Key Replay Counter did not"
            " increase - dropping packet");
        return;
    }

    if (!(key_info & WPA_KEY_INFO_ACK)) {
        wpa_printf(MSG_INFO, "WPA: No Ack bit in key_info");
        return;
    }

    if (key_info & WPA_KEY_INFO_REQUEST) {
        wpa_printf(MSG_INFO, "WPA: EAPOL-Key with Request bit - "
            "dropped");
        return;
    }

    if ((key_info & WPA_KEY_INFO_MIC) &&
        wpa_supplicant_verify_eapol_key_mic(wpa_s, key, ver, buf,
            data_len))
        return;

    extra_len = data_len - sizeof (*hdr) - sizeof (*key);

    if (wpa_s->proto == WPA_PROTO_RSN &&
        (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) &&
        wpa_supplicant_decrypt_key_data(wpa_s, key, ver))
        return;

    if (key_info & WPA_KEY_INFO_KEY_TYPE) {
        if (key_info & WPA_KEY_INFO_KEY_INDEX_MASK) {
            wpa_printf(MSG_WARNING, "WPA: Ignored EAPOL-Key "
                "(Pairwise) with non-zero key index");
            return;
        }
        if (key_info & WPA_KEY_INFO_MIC) {
            /* 3/4 4-Way Handshake */
            wpa_supplicant_process_3_of_4(wpa_s, src_addr, key,
                extra_len, ver);
        } else {
            /* 1/4 4-Way Handshake */
            wpa_supplicant_process_1_of_4(wpa_s, src_addr, key,
                ver);
        }
    } else {
        if (key_info & WPA_KEY_INFO_MIC) {
            /* 1/2 Group Key Handshake */
            wpa_supplicant_process_1_of_2(wpa_s, src_addr, key,
                extra_len, ver);
        } else {
            wpa_printf(MSG_WARNING, "WPA: EAPOL-Key (Group) "
                "without Mic bit - dropped");
        }
    }
}

void
wpa_supplicant_rx_eapol(void *ctx, unsigned char *src_addr,
    unsigned char *buf, size_t len)
{
    struct wpa_supplicant *wpa_s = ctx;

    wpa_printf(MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
    wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);

    if (wpa_s->eapol_received == 0) {
        /* Timeout for completing IEEE 802.1X and WPA authentication */
        wpa_supplicant_req_auth_timeout(
            wpa_s, wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X ?
            70 : 10, 0);
    }
    wpa_s->eapol_received++;

    /*
     * Source address of the incoming EAPOL frame could be compared to the
     * current BSSID. However, it is possible that a centralized
     * Authenticator could be using another MAC address than the BSSID of
     * an AP, so just allow any address to be used for now. The replies are
     * still sent to the current BSSID (if available), though.
     */
    wpa_sm_rx_eapol(wpa_s, src_addr, buf, len);
}