2 * DPP functionality shared between hostapd and wpa_supplicant
3 * Copyright (c) 2017, Qualcomm Atheros, Inc.
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include <openssl/x509.h>
14 #include "utils/list.h"
15 #include "common/wpa_common.h"
16 #include "crypto/sha256.h"
18 #define DPP_HDR_LEN (4 + 2) /* OUI, OUI Type, Crypto Suite, DPP frame type */
20 enum dpp_public_action_frame_type
{
21 DPP_PA_AUTHENTICATION_REQ
= 0,
22 DPP_PA_AUTHENTICATION_RESP
= 1,
23 DPP_PA_AUTHENTICATION_CONF
= 2,
24 DPP_PA_PEER_DISCOVERY_REQ
= 5,
25 DPP_PA_PEER_DISCOVERY_RESP
= 6,
26 DPP_PA_PKEX_EXCHANGE_REQ
= 7,
27 DPP_PA_PKEX_EXCHANGE_RESP
= 8,
28 DPP_PA_PKEX_COMMIT_REVEAL_REQ
= 9,
29 DPP_PA_PKEX_COMMIT_REVEAL_RESP
= 10,
32 enum dpp_attribute_id
{
33 DPP_ATTR_STATUS
= 0x1000,
34 DPP_ATTR_I_BOOTSTRAP_KEY_HASH
= 0x1001,
35 DPP_ATTR_R_BOOTSTRAP_KEY_HASH
= 0x1002,
36 DPP_ATTR_I_PROTOCOL_KEY
= 0x1003,
37 DPP_ATTR_WRAPPED_DATA
= 0x1004,
38 DPP_ATTR_I_NONCE
= 0x1005,
39 DPP_ATTR_I_CAPABILITIES
= 0x1006,
40 DPP_ATTR_R_NONCE
= 0x1007,
41 DPP_ATTR_R_CAPABILITIES
= 0x1008,
42 DPP_ATTR_R_PROTOCOL_KEY
= 0x1009,
43 DPP_ATTR_I_AUTH_TAG
= 0x100A,
44 DPP_ATTR_R_AUTH_TAG
= 0x100B,
45 DPP_ATTR_CONFIG_OBJ
= 0x100C,
46 DPP_ATTR_CONNECTOR
= 0x100D,
47 DPP_ATTR_CONFIG_ATTR_OBJ
= 0x100E,
48 DPP_ATTR_BOOTSTRAP_KEY
= 0x100F,
49 DPP_ATTR_OWN_NET_NK_HASH
= 0x1011,
50 DPP_ATTR_FINITE_CYCLIC_GROUP
= 0x1012,
51 DPP_ATTR_ENCRYPTED_KEY
= 0x1013,
52 DPP_ATTR_ENROLLEE_NONCE
= 0x1014,
53 DPP_ATTR_CODE_IDENTIFIER
= 0x1015,
54 DPP_ATTR_TRANSACTION_ID
= 0x1016,
55 DPP_ATTR_TESTING
= 0x10ff, /* not defined in the DPP tech spec */
58 enum dpp_status_error
{
60 DPP_STATUS_NOT_COMPATIBLE
= 1,
61 DPP_STATUS_AUTH_FAILURE
= 2,
62 DPP_STATUS_UNWRAP_FAILURE
= 3,
63 DPP_STATUS_BAD_GROUP
= 4,
64 DPP_STATUS_CONFIGURE_FAILURE
= 5,
65 DPP_STATUS_RESPONSE_PENDING
= 6,
68 #define DPP_CAPAB_ENROLLEE BIT(0)
69 #define DPP_CAPAB_CONFIGURATOR BIT(1)
70 #define DPP_CAPAB_ROLE_MASK (BIT(0) | BIT(1))
72 #define DPP_BOOTSTRAP_MAX_FREQ 30
73 #define DPP_MAX_NONCE_LEN 32
74 #define DPP_MAX_HASH_LEN 64
75 #define DPP_MAX_SHARED_SECRET_LEN 66
77 struct dpp_curve_params
{
80 size_t aes_siv_key_len
;
88 enum dpp_bootstrap_type
{
89 DPP_BOOTSTRAP_QR_CODE
,
93 struct dpp_bootstrap_info
{
96 enum dpp_bootstrap_type type
;
98 u8 mac_addr
[ETH_ALEN
];
100 unsigned int freq
[DPP_BOOTSTRAP_MAX_FREQ
];
101 unsigned int num_freq
;
104 u8 pubkey_hash
[SHA256_MAC_LEN
];
105 const struct dpp_curve_params
*curve
;
109 unsigned int initiator
:1;
110 unsigned int exchange_done
:1;
111 struct dpp_bootstrap_info
*own_bi
;
112 u8 own_mac
[ETH_ALEN
];
113 u8 peer_mac
[ETH_ALEN
];
118 u8 Mx
[DPP_MAX_SHARED_SECRET_LEN
];
119 u8 Nx
[DPP_MAX_SHARED_SECRET_LEN
];
120 u8 z
[DPP_MAX_HASH_LEN
];
121 EVP_PKEY
*peer_bootstrap_key
;
122 struct wpabuf
*exchange_req
;
123 struct wpabuf
*exchange_resp
;
126 struct dpp_configuration
{
129 int dpp
; /* whether to use DPP or legacy configuration */
131 /* For DPP configuration (connector) */
132 os_time_t netaccesskey_expiry
;
136 /* For legacy configuration */
141 struct dpp_authentication
{
143 const struct dpp_curve_params
*curve
;
144 struct dpp_bootstrap_info
*peer_bi
;
145 struct dpp_bootstrap_info
*own_bi
;
146 u8 waiting_pubkey_hash
[SHA256_MAC_LEN
];
147 int response_pending
;
148 enum dpp_status_error auth_resp_status
;
149 u8 peer_mac_addr
[ETH_ALEN
];
150 u8 i_nonce
[DPP_MAX_NONCE_LEN
];
151 u8 r_nonce
[DPP_MAX_NONCE_LEN
];
152 u8 e_nonce
[DPP_MAX_NONCE_LEN
];
155 EVP_PKEY
*own_protocol_key
;
156 EVP_PKEY
*peer_protocol_key
;
157 struct wpabuf
*req_msg
;
158 struct wpabuf
*resp_msg
;
159 unsigned int curr_freq
;
161 u8 Mx
[DPP_MAX_SHARED_SECRET_LEN
];
162 u8 Nx
[DPP_MAX_SHARED_SECRET_LEN
];
163 u8 Lx
[DPP_MAX_SHARED_SECRET_LEN
];
164 u8 k1
[DPP_MAX_HASH_LEN
];
165 u8 k2
[DPP_MAX_HASH_LEN
];
166 u8 ke
[DPP_MAX_HASH_LEN
];
169 int remove_on_tx_status
;
171 struct wpabuf
*conf_req
;
172 struct dpp_configuration
*conf_ap
;
173 struct dpp_configuration
*conf_sta
;
174 struct dpp_configurator
*conf
;
175 char *connector
; /* received signedConnector */
176 u8 ssid
[SSID_MAX_LEN
];
181 struct wpabuf
*net_access_key
;
182 os_time_t net_access_key_expiry
;
183 struct wpabuf
*c_sign_key
;
184 #ifdef CONFIG_TESTING_OPTIONS
185 char *config_obj_override
;
186 char *discovery_override
;
187 char *groups_override
;
188 unsigned int ignore_netaccesskey_mismatch
:1;
189 #endif /* CONFIG_TESTING_OPTIONS */
192 struct dpp_configurator
{
198 const struct dpp_curve_params
*curve
;
201 struct dpp_introduction
{
207 #ifdef CONFIG_TESTING_OPTIONS
208 enum dpp_test_behavior
{
209 DPP_TEST_DISABLED
= 0,
210 DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ
= 1,
211 DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP
= 2,
212 DPP_TEST_AFTER_WRAPPED_DATA_AUTH_CONF
= 3,
213 DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_REQ
= 4,
214 DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_RESP
= 5,
215 DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ
= 6,
216 DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP
= 7,
217 DPP_TEST_ZERO_I_CAPAB
= 8,
218 DPP_TEST_ZERO_R_CAPAB
= 9,
219 DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_REQ
= 10,
220 DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_REQ
= 11,
221 DPP_TEST_NO_I_PROTO_KEY_AUTH_REQ
= 12,
222 DPP_TEST_NO_I_NONCE_AUTH_REQ
= 13,
223 DPP_TEST_NO_I_CAPAB_AUTH_REQ
= 14,
224 DPP_TEST_NO_WRAPPED_DATA_AUTH_REQ
= 15,
225 DPP_TEST_NO_STATUS_AUTH_RESP
= 16,
226 DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP
= 17,
227 DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP
= 18,
228 DPP_TEST_NO_R_PROTO_KEY_AUTH_RESP
= 19,
229 DPP_TEST_NO_R_NONCE_AUTH_RESP
= 20,
230 DPP_TEST_NO_I_NONCE_AUTH_RESP
= 21,
231 DPP_TEST_NO_R_CAPAB_AUTH_RESP
= 22,
232 DPP_TEST_NO_R_AUTH_AUTH_RESP
= 23,
233 DPP_TEST_NO_WRAPPED_DATA_AUTH_RESP
= 24,
234 DPP_TEST_NO_STATUS_AUTH_CONF
= 25,
235 DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_CONF
= 26,
236 DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_CONF
= 27,
237 DPP_TEST_NO_I_AUTH_AUTH_CONF
= 28,
238 DPP_TEST_NO_WRAPPED_DATA_AUTH_CONF
= 29,
239 DPP_TEST_I_NONCE_MISMATCH_AUTH_RESP
= 30,
240 DPP_TEST_INCOMPATIBLE_R_CAPAB_AUTH_RESP
= 31,
241 DPP_TEST_R_AUTH_MISMATCH_AUTH_RESP
= 32,
242 DPP_TEST_I_AUTH_MISMATCH_AUTH_CONF
= 33,
245 extern enum dpp_test_behavior dpp_test
;
246 #endif /* CONFIG_TESTING_OPTIONS */
248 void dpp_bootstrap_info_free(struct dpp_bootstrap_info
*info
);
249 const char * dpp_bootstrap_type_txt(enum dpp_bootstrap_type type
);
250 int dpp_bootstrap_key_hash(struct dpp_bootstrap_info
*bi
);
251 int dpp_parse_uri_chan_list(struct dpp_bootstrap_info
*bi
,
252 const char *chan_list
);
253 int dpp_parse_uri_mac(struct dpp_bootstrap_info
*bi
, const char *mac
);
254 int dpp_parse_uri_info(struct dpp_bootstrap_info
*bi
, const char *info
);
255 struct dpp_bootstrap_info
* dpp_parse_qr_code(const char *uri
);
256 char * dpp_keygen(struct dpp_bootstrap_info
*bi
, const char *curve
,
257 const u8
*privkey
, size_t privkey_len
);
258 struct dpp_authentication
* dpp_auth_init(void *msg_ctx
,
259 struct dpp_bootstrap_info
*peer_bi
,
260 struct dpp_bootstrap_info
*own_bi
,
262 struct dpp_authentication
*
263 dpp_auth_req_rx(void *msg_ctx
, u8 dpp_allowed_roles
, int qr_mutual
,
264 struct dpp_bootstrap_info
*peer_bi
,
265 struct dpp_bootstrap_info
*own_bi
,
266 unsigned int freq
, const u8
*hdr
, const u8
*attr_start
,
269 dpp_auth_resp_rx(struct dpp_authentication
*auth
, const u8
*hdr
,
270 const u8
*attr_start
, size_t attr_len
);
271 struct wpabuf
* dpp_build_conf_req(struct dpp_authentication
*auth
,
273 int dpp_auth_conf_rx(struct dpp_authentication
*auth
, const u8
*hdr
,
274 const u8
*attr_start
, size_t attr_len
);
275 int dpp_notify_new_qr_code(struct dpp_authentication
*auth
,
276 struct dpp_bootstrap_info
*peer_bi
);
277 void dpp_configuration_free(struct dpp_configuration
*conf
);
278 void dpp_auth_deinit(struct dpp_authentication
*auth
);
280 dpp_conf_req_rx(struct dpp_authentication
*auth
, const u8
*attr_start
,
282 int dpp_conf_resp_rx(struct dpp_authentication
*auth
,
283 const struct wpabuf
*resp
);
284 struct wpabuf
* dpp_alloc_msg(enum dpp_public_action_frame_type type
,
286 const u8
* dpp_get_attr(const u8
*buf
, size_t len
, u16 req_id
, u16
*ret_len
);
287 int dpp_check_attrs(const u8
*buf
, size_t len
);
288 int dpp_key_expired(const char *timestamp
, os_time_t
*expiry
);
289 void dpp_configurator_free(struct dpp_configurator
*conf
);
290 struct dpp_configurator
*
291 dpp_keygen_configurator(const char *curve
, const u8
*privkey
,
293 int dpp_configurator_own_config(struct dpp_authentication
*auth
,
295 int dpp_peer_intro(struct dpp_introduction
*intro
, const char *own_connector
,
296 const u8
*net_access_key
, size_t net_access_key_len
,
297 const u8
*csign_key
, size_t csign_key_len
,
298 const u8
*peer_connector
, size_t peer_connector_len
,
300 struct dpp_pkex
* dpp_pkex_init(struct dpp_bootstrap_info
*bi
,
302 const char *identifier
,
304 struct dpp_pkex
* dpp_pkex_rx_exchange_req(struct dpp_bootstrap_info
*bi
,
307 const char *identifier
,
309 const u8
*buf
, size_t len
);
310 struct wpabuf
* dpp_pkex_rx_exchange_resp(struct dpp_pkex
*pkex
,
311 const u8
*buf
, size_t len
);
312 struct wpabuf
* dpp_pkex_rx_commit_reveal_req(struct dpp_pkex
*pkex
,
314 const u8
*buf
, size_t len
);
315 int dpp_pkex_rx_commit_reveal_resp(struct dpp_pkex
*pkex
, const u8
*hdr
,
316 const u8
*buf
, size_t len
);
317 void dpp_pkex_free(struct dpp_pkex
*pkex
);