]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/common/dpp.h
hs20-osu-client: Fix build with new OpenSSL and BoringSSL
[thirdparty/hostap.git] / src / common / dpp.h
CommitLineData
be27e185
JM
1/*
2 * DPP functionality shared between hostapd and wpa_supplicant
3 * Copyright (c) 2017, Qualcomm Atheros, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#ifndef DPP_H
10#define DPP_H
11
12#include <openssl/x509.h>
13
14#include "utils/list.h"
650a70a7 15#include "common/wpa_common.h"
be27e185
JM
16#include "crypto/sha256.h"
17
30d27b04
JM
18enum dpp_public_action_frame_type {
19 DPP_PA_AUTHENTICATION_REQ = 0,
20 DPP_PA_AUTHENTICATION_RESP = 1,
21 DPP_PA_AUTHENTICATION_CONF = 2,
22 DPP_PA_PEER_DISCOVERY_REQ = 5,
23 DPP_PA_PEER_DISCOVERY_RESP = 6,
24 DPP_PA_PKEX_EXCHANGE_REQ = 7,
25 DPP_PA_PKEX_EXCHANGE_RESP = 8,
26 DPP_PA_PKEX_COMMIT_REVEAL_REQ = 9,
27 DPP_PA_PKEX_COMMIT_REVEAL_RESP = 10,
28};
29
30enum dpp_attribute_id {
31 DPP_ATTR_STATUS = 0x1000,
32 DPP_ATTR_I_BOOTSTRAP_KEY_HASH = 0x1001,
33 DPP_ATTR_R_BOOTSTRAP_KEY_HASH = 0x1002,
34 DPP_ATTR_I_PROTOCOL_KEY = 0x1003,
35 DPP_ATTR_WRAPPED_DATA = 0x1004,
36 DPP_ATTR_I_NONCE = 0x1005,
37 DPP_ATTR_I_CAPABILITIES = 0x1006,
38 DPP_ATTR_R_NONCE = 0x1007,
39 DPP_ATTR_R_CAPABILITIES = 0x1008,
40 DPP_ATTR_R_PROTOCOL_KEY = 0x1009,
41 DPP_ATTR_I_AUTH_TAG = 0x100A,
42 DPP_ATTR_R_AUTH_TAG = 0x100B,
43 DPP_ATTR_CONFIG_OBJ = 0x100C,
44 DPP_ATTR_CONNECTOR = 0x100D,
45 DPP_ATTR_CONFIG_ATTR_OBJ = 0x100E,
46 DPP_ATTR_BOOTSTRAP_KEY = 0x100F,
47 DPP_ATTR_PEER_NET_PK_HASH = 0x1010,
48 DPP_ATTR_OWN_NET_NK_HASH = 0x1011,
49 DPP_ATTR_FINITE_CYCLIC_GROUP = 0x1012,
50 DPP_ATTR_ENCRYPTED_KEY = 0x1013,
51 DPP_ATTR_ENROLLEE_NONCE = 0x1014,
52 DPP_ATTR_CODE_IDENTIFIER = 0x1015,
53};
54
55enum dpp_status_error {
56 DPP_STATUS_OK = 0,
57 DPP_STATUS_NOT_COMPATIBLE = 1,
58 DPP_STATUS_AUTH_FAILURE = 2,
59 DPP_STATUS_UNWRAP_FAILURE = 3,
60 DPP_STATUS_BAD_GROUP = 4,
61 DPP_STATUS_CONFIGURE_FAILURE = 5,
62 DPP_STATUS_RESPONSE_PENDING = 6,
63};
64
65#define DPP_CAPAB_ENROLLEE BIT(0)
66#define DPP_CAPAB_CONFIGURATOR BIT(1)
67#define DPP_CAPAB_ROLE_MASK (BIT(0) | BIT(1))
68
be27e185 69#define DPP_BOOTSTRAP_MAX_FREQ 30
30d27b04
JM
70#define DPP_MAX_NONCE_LEN 32
71#define DPP_MAX_HASH_LEN 64
72#define DPP_MAX_SHARED_SECRET_LEN 66
be27e185
JM
73
74struct dpp_curve_params {
75 const char *name;
76 size_t hash_len;
77 size_t aes_siv_key_len;
78 size_t nonce_len;
79 size_t prime_len;
80 const char *jwk_crv;
500ed7f0 81 u16 ike_group;
31f03cb0 82 const char *jws_alg;
be27e185
JM
83};
84
85enum dpp_bootstrap_type {
86 DPP_BOOTSTRAP_QR_CODE,
500ed7f0 87 DPP_BOOTSTRAP_PKEX,
be27e185
JM
88};
89
90struct dpp_bootstrap_info {
91 struct dl_list list;
92 unsigned int id;
93 enum dpp_bootstrap_type type;
94 char *uri;
95 u8 mac_addr[ETH_ALEN];
96 char *info;
97 unsigned int freq[DPP_BOOTSTRAP_MAX_FREQ];
98 unsigned int num_freq;
99 int own;
100 EVP_PKEY *pubkey;
101 u8 pubkey_hash[SHA256_MAC_LEN];
102 const struct dpp_curve_params *curve;
103};
104
500ed7f0
JM
105struct dpp_pkex {
106 unsigned int initiator:1;
107 unsigned int exchange_done:1;
108 struct dpp_bootstrap_info *own_bi;
109 u8 own_mac[ETH_ALEN];
110 u8 peer_mac[ETH_ALEN];
111 char *identifier;
112 char *code;
113 EVP_PKEY *x;
114 EVP_PKEY *y;
115 u8 Mx[DPP_MAX_SHARED_SECRET_LEN];
116 u8 Nx[DPP_MAX_SHARED_SECRET_LEN];
117 u8 z[DPP_MAX_HASH_LEN];
118 EVP_PKEY *peer_bootstrap_key;
119 struct wpabuf *exchange_req;
120 struct wpabuf *exchange_resp;
121};
122
461d39af
JM
123struct dpp_configuration {
124 u8 ssid[32];
125 size_t ssid_len;
126 int dpp; /* whether to use DPP or legacy configuration */
127
128 /* For DPP configuration (connector) */
129 os_time_t netaccesskey_expiry;
130
a4bf0078 131 /* TODO: groups */
461d39af
JM
132
133 /* For legacy configuration */
134 char *passphrase;
135 u8 psk[32];
136};
137
30d27b04
JM
138struct dpp_authentication {
139 void *msg_ctx;
140 const struct dpp_curve_params *curve;
141 struct dpp_bootstrap_info *peer_bi;
142 struct dpp_bootstrap_info *own_bi;
143 u8 waiting_pubkey_hash[SHA256_MAC_LEN];
144 int response_pending;
145 enum dpp_status_error auth_resp_status;
146 u8 peer_mac_addr[ETH_ALEN];
147 u8 i_nonce[DPP_MAX_NONCE_LEN];
148 u8 r_nonce[DPP_MAX_NONCE_LEN];
461d39af 149 u8 e_nonce[DPP_MAX_NONCE_LEN];
30d27b04
JM
150 u8 i_capab;
151 u8 r_capab;
152 EVP_PKEY *own_protocol_key;
153 EVP_PKEY *peer_protocol_key;
154 struct wpabuf *req_attr;
155 struct wpabuf *resp_attr;
156 unsigned int curr_freq;
157 size_t secret_len;
158 u8 Mx[DPP_MAX_SHARED_SECRET_LEN];
159 u8 Nx[DPP_MAX_SHARED_SECRET_LEN];
160 u8 Lx[DPP_MAX_SHARED_SECRET_LEN];
161 u8 k1[DPP_MAX_HASH_LEN];
162 u8 k2[DPP_MAX_HASH_LEN];
163 u8 ke[DPP_MAX_HASH_LEN];
164 int initiator;
165 int configurator;
166 int remove_on_tx_status;
167 int auth_success;
461d39af
JM
168 struct wpabuf *conf_req;
169 struct dpp_configuration *conf_ap;
170 struct dpp_configuration *conf_sta;
171 struct dpp_configurator *conf;
172 char *connector; /* received signedConnector */
173 u8 ssid[SSID_MAX_LEN];
174 u8 ssid_len;
8528994e
JM
175 char passphrase[64];
176 u8 psk[PMK_LEN];
177 int psk_set;
461d39af
JM
178 struct wpabuf *net_access_key;
179 os_time_t net_access_key_expiry;
180 struct wpabuf *c_sign_key;
181 os_time_t c_sign_key_expiry;
182#ifdef CONFIG_TESTING_OPTIONS
183 char *config_obj_override;
184 char *discovery_override;
185 char *groups_override;
461d39af
JM
186 unsigned int ignore_netaccesskey_mismatch:1;
187#endif /* CONFIG_TESTING_OPTIONS */
188};
189
190struct dpp_configurator {
191 struct dl_list list;
192 unsigned int id;
193 int own;
194 EVP_PKEY *csign;
195 char *kid;
196 const struct dpp_curve_params *curve;
197 os_time_t csign_expiry;
30d27b04
JM
198};
199
650a70a7
JM
200struct dpp_introduction {
201 u8 pmkid[PMKID_LEN];
202 u8 pmk[PMK_LEN_MAX];
203 size_t pmk_len;
204 u8 pk_hash[SHA256_MAC_LEN];
205 u8 nk_hash[SHA256_MAC_LEN];
206};
207
be27e185 208void dpp_bootstrap_info_free(struct dpp_bootstrap_info *info);
484788b8 209const char * dpp_bootstrap_type_txt(enum dpp_bootstrap_type type);
500ed7f0 210int dpp_bootstrap_key_hash(struct dpp_bootstrap_info *bi);
be27e185
JM
211int dpp_parse_uri_chan_list(struct dpp_bootstrap_info *bi,
212 const char *chan_list);
213int dpp_parse_uri_mac(struct dpp_bootstrap_info *bi, const char *mac);
214int dpp_parse_uri_info(struct dpp_bootstrap_info *bi, const char *info);
215struct dpp_bootstrap_info * dpp_parse_qr_code(const char *uri);
216char * dpp_keygen(struct dpp_bootstrap_info *bi, const char *curve,
217 const u8 *privkey, size_t privkey_len);
30d27b04
JM
218struct dpp_authentication * dpp_auth_init(void *msg_ctx,
219 struct dpp_bootstrap_info *peer_bi,
220 struct dpp_bootstrap_info *own_bi,
221 int configurator);
222struct dpp_authentication *
223dpp_auth_req_rx(void *msg_ctx, u8 dpp_allowed_roles, int qr_mutual,
224 struct dpp_bootstrap_info *peer_bi,
225 struct dpp_bootstrap_info *own_bi,
226 unsigned int freq, const u8 *attr_start,
227 const u8 *wrapped_data, u16 wrapped_data_len);
228struct wpabuf *
229dpp_auth_resp_rx(struct dpp_authentication *auth, const u8 *attr_start,
230 size_t attr_len);
461d39af
JM
231struct wpabuf * dpp_build_conf_req(struct dpp_authentication *auth,
232 const char *json);
30d27b04
JM
233int dpp_auth_conf_rx(struct dpp_authentication *auth, const u8 *attr_start,
234 size_t attr_len);
235int dpp_notify_new_qr_code(struct dpp_authentication *auth,
236 struct dpp_bootstrap_info *peer_bi);
461d39af 237void dpp_configuration_free(struct dpp_configuration *conf);
30d27b04 238void dpp_auth_deinit(struct dpp_authentication *auth);
461d39af
JM
239struct wpabuf *
240dpp_conf_req_rx(struct dpp_authentication *auth, const u8 *attr_start,
241 size_t attr_len);
242int dpp_conf_resp_rx(struct dpp_authentication *auth,
243 const struct wpabuf *resp);
30d27b04
JM
244struct wpabuf * dpp_alloc_msg(enum dpp_public_action_frame_type type,
245 size_t len);
246const u8 * dpp_get_attr(const u8 *buf, size_t len, u16 req_id, u16 *ret_len);
247int dpp_check_attrs(const u8 *buf, size_t len);
461d39af
JM
248int dpp_key_expired(const char *timestamp, os_time_t *expiry);
249void dpp_configurator_free(struct dpp_configurator *conf);
250struct dpp_configurator *
251dpp_keygen_configurator(const char *curve, const u8 *privkey,
252 size_t privkey_len);
f522bb23
JM
253int dpp_configurator_own_config(struct dpp_authentication *auth,
254 const char *curve);
650a70a7
JM
255int dpp_peer_intro(struct dpp_introduction *intro, const char *own_connector,
256 const u8 *net_access_key, size_t net_access_key_len,
257 const u8 *csign_key, size_t csign_key_len,
787615b3
JM
258 const u8 *peer_connector, size_t peer_connector_len,
259 os_time_t *expiry);
500ed7f0
JM
260struct dpp_pkex * dpp_pkex_init(struct dpp_bootstrap_info *bi,
261 const u8 *own_mac,
262 const char *identifier,
263 const char *code);
264struct dpp_pkex * dpp_pkex_rx_exchange_req(struct dpp_bootstrap_info *bi,
265 const u8 *own_mac,
266 const u8 *peer_mac,
267 const char *identifier,
268 const char *code,
269 const u8 *buf, size_t len);
270struct wpabuf * dpp_pkex_rx_exchange_resp(struct dpp_pkex *pkex,
271 const u8 *buf, size_t len);
272struct wpabuf * dpp_pkex_rx_commit_reveal_req(struct dpp_pkex *pkex,
273 const u8 *buf, size_t len);
274int dpp_pkex_rx_commit_reveal_resp(struct dpp_pkex *pkex,
275 const u8 *buf, size_t len);
276void dpp_pkex_free(struct dpp_pkex *pkex);
be27e185
JM
277
278#endif /* DPP_H */