185732ac8SCy Schubert /*
285732ac8SCy Schubert * DPP functionality shared between hostapd and wpa_supplicant
385732ac8SCy Schubert * Copyright (c) 2017, Qualcomm Atheros, Inc.
4c1d255d3SCy Schubert * Copyright (c) 2018-2020, The Linux Foundation
585732ac8SCy Schubert *
685732ac8SCy Schubert * This software may be distributed under the terms of the BSD license.
785732ac8SCy Schubert * See README for more details.
885732ac8SCy Schubert */
985732ac8SCy Schubert
1085732ac8SCy Schubert #include "utils/includes.h"
1185732ac8SCy Schubert
1285732ac8SCy Schubert #include "utils/common.h"
1385732ac8SCy Schubert #include "utils/base64.h"
1485732ac8SCy Schubert #include "utils/json.h"
1585732ac8SCy Schubert #include "common/ieee802_11_common.h"
1685732ac8SCy Schubert #include "common/wpa_ctrl.h"
174bc52338SCy Schubert #include "common/gas.h"
18c1d255d3SCy Schubert #include "eap_common/eap_defs.h"
1985732ac8SCy Schubert #include "crypto/crypto.h"
2085732ac8SCy Schubert #include "crypto/random.h"
2185732ac8SCy Schubert #include "crypto/aes.h"
2285732ac8SCy Schubert #include "crypto/aes_siv.h"
2385732ac8SCy Schubert #include "drivers/driver.h"
2485732ac8SCy Schubert #include "dpp.h"
25c1d255d3SCy Schubert #include "dpp_i.h"
2685732ac8SCy Schubert
2785732ac8SCy Schubert
28c1d255d3SCy Schubert static const char * dpp_netrole_str(enum dpp_netrole netrole);
29c1d255d3SCy Schubert
3085732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
3132a95656SCy Schubert #ifdef CONFIG_DPP3
3232a95656SCy Schubert int dpp_version_override = 3;
3332a95656SCy Schubert #elif defined(CONFIG_DPP2)
34c1d255d3SCy Schubert int dpp_version_override = 2;
35c1d255d3SCy Schubert #else
36c1d255d3SCy Schubert int dpp_version_override = 1;
37c1d255d3SCy Schubert #endif
3885732ac8SCy Schubert enum dpp_test_behavior dpp_test = DPP_TEST_DISABLED;
3985732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
4085732ac8SCy Schubert
4185732ac8SCy Schubert
dpp_auth_fail(struct dpp_authentication * auth,const char * txt)42c1d255d3SCy Schubert void dpp_auth_fail(struct dpp_authentication *auth, const char *txt)
4385732ac8SCy Schubert {
4485732ac8SCy Schubert wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "%s", txt);
4585732ac8SCy Schubert }
4685732ac8SCy Schubert
4785732ac8SCy Schubert
dpp_alloc_msg(enum dpp_public_action_frame_type type,size_t len)4885732ac8SCy Schubert struct wpabuf * dpp_alloc_msg(enum dpp_public_action_frame_type type,
4985732ac8SCy Schubert size_t len)
5085732ac8SCy Schubert {
5185732ac8SCy Schubert struct wpabuf *msg;
5285732ac8SCy Schubert
5385732ac8SCy Schubert msg = wpabuf_alloc(8 + len);
5485732ac8SCy Schubert if (!msg)
5585732ac8SCy Schubert return NULL;
5685732ac8SCy Schubert wpabuf_put_u8(msg, WLAN_ACTION_PUBLIC);
5785732ac8SCy Schubert wpabuf_put_u8(msg, WLAN_PA_VENDOR_SPECIFIC);
5885732ac8SCy Schubert wpabuf_put_be24(msg, OUI_WFA);
5985732ac8SCy Schubert wpabuf_put_u8(msg, DPP_OUI_TYPE);
6085732ac8SCy Schubert wpabuf_put_u8(msg, 1); /* Crypto Suite */
6185732ac8SCy Schubert wpabuf_put_u8(msg, type);
6285732ac8SCy Schubert return msg;
6385732ac8SCy Schubert }
6485732ac8SCy Schubert
6585732ac8SCy Schubert
dpp_get_attr(const u8 * buf,size_t len,u16 req_id,u16 * ret_len)6685732ac8SCy Schubert const u8 * dpp_get_attr(const u8 *buf, size_t len, u16 req_id, u16 *ret_len)
6785732ac8SCy Schubert {
6885732ac8SCy Schubert u16 id, alen;
6985732ac8SCy Schubert const u8 *pos = buf, *end = buf + len;
7085732ac8SCy Schubert
7185732ac8SCy Schubert while (end - pos >= 4) {
7285732ac8SCy Schubert id = WPA_GET_LE16(pos);
7385732ac8SCy Schubert pos += 2;
7485732ac8SCy Schubert alen = WPA_GET_LE16(pos);
7585732ac8SCy Schubert pos += 2;
7685732ac8SCy Schubert if (alen > end - pos)
7785732ac8SCy Schubert return NULL;
7885732ac8SCy Schubert if (id == req_id) {
7985732ac8SCy Schubert *ret_len = alen;
8085732ac8SCy Schubert return pos;
8185732ac8SCy Schubert }
8285732ac8SCy Schubert pos += alen;
8385732ac8SCy Schubert }
8485732ac8SCy Schubert
8585732ac8SCy Schubert return NULL;
8685732ac8SCy Schubert }
8785732ac8SCy Schubert
8885732ac8SCy Schubert
dpp_get_attr_next(const u8 * prev,const u8 * buf,size_t len,u16 req_id,u16 * ret_len)89c1d255d3SCy Schubert static const u8 * dpp_get_attr_next(const u8 *prev, const u8 *buf, size_t len,
90c1d255d3SCy Schubert u16 req_id, u16 *ret_len)
91c1d255d3SCy Schubert {
92c1d255d3SCy Schubert u16 id, alen;
93c1d255d3SCy Schubert const u8 *pos, *end = buf + len;
94c1d255d3SCy Schubert
95c1d255d3SCy Schubert if (!prev)
96c1d255d3SCy Schubert pos = buf;
97c1d255d3SCy Schubert else
98c1d255d3SCy Schubert pos = prev + WPA_GET_LE16(prev - 2);
99c1d255d3SCy Schubert while (end - pos >= 4) {
100c1d255d3SCy Schubert id = WPA_GET_LE16(pos);
101c1d255d3SCy Schubert pos += 2;
102c1d255d3SCy Schubert alen = WPA_GET_LE16(pos);
103c1d255d3SCy Schubert pos += 2;
104c1d255d3SCy Schubert if (alen > end - pos)
105c1d255d3SCy Schubert return NULL;
106c1d255d3SCy Schubert if (id == req_id) {
107c1d255d3SCy Schubert *ret_len = alen;
108c1d255d3SCy Schubert return pos;
109c1d255d3SCy Schubert }
110c1d255d3SCy Schubert pos += alen;
111c1d255d3SCy Schubert }
112c1d255d3SCy Schubert
113c1d255d3SCy Schubert return NULL;
114c1d255d3SCy Schubert }
115c1d255d3SCy Schubert
116c1d255d3SCy Schubert
dpp_check_attrs(const u8 * buf,size_t len)11785732ac8SCy Schubert int dpp_check_attrs(const u8 *buf, size_t len)
11885732ac8SCy Schubert {
11985732ac8SCy Schubert const u8 *pos, *end;
12085732ac8SCy Schubert int wrapped_data = 0;
12185732ac8SCy Schubert
12285732ac8SCy Schubert pos = buf;
12385732ac8SCy Schubert end = buf + len;
12485732ac8SCy Schubert while (end - pos >= 4) {
12585732ac8SCy Schubert u16 id, alen;
12685732ac8SCy Schubert
12785732ac8SCy Schubert id = WPA_GET_LE16(pos);
12885732ac8SCy Schubert pos += 2;
12985732ac8SCy Schubert alen = WPA_GET_LE16(pos);
13085732ac8SCy Schubert pos += 2;
13185732ac8SCy Schubert wpa_printf(MSG_MSGDUMP, "DPP: Attribute ID %04x len %u",
13285732ac8SCy Schubert id, alen);
13385732ac8SCy Schubert if (alen > end - pos) {
13485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
13585732ac8SCy Schubert "DPP: Truncated message - not enough room for the attribute - dropped");
13685732ac8SCy Schubert return -1;
13785732ac8SCy Schubert }
13885732ac8SCy Schubert if (wrapped_data) {
13985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
14085732ac8SCy Schubert "DPP: An unexpected attribute included after the Wrapped Data attribute");
14185732ac8SCy Schubert return -1;
14285732ac8SCy Schubert }
14385732ac8SCy Schubert if (id == DPP_ATTR_WRAPPED_DATA)
14485732ac8SCy Schubert wrapped_data = 1;
14585732ac8SCy Schubert pos += alen;
14685732ac8SCy Schubert }
14785732ac8SCy Schubert
14885732ac8SCy Schubert if (end != pos) {
14985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
15085732ac8SCy Schubert "DPP: Unexpected octets (%d) after the last attribute",
15185732ac8SCy Schubert (int) (end - pos));
15285732ac8SCy Schubert return -1;
15385732ac8SCy Schubert }
15485732ac8SCy Schubert
15585732ac8SCy Schubert return 0;
15685732ac8SCy Schubert }
15785732ac8SCy Schubert
15885732ac8SCy Schubert
dpp_bootstrap_info_free(struct dpp_bootstrap_info * info)15985732ac8SCy Schubert void dpp_bootstrap_info_free(struct dpp_bootstrap_info *info)
16085732ac8SCy Schubert {
16185732ac8SCy Schubert if (!info)
16285732ac8SCy Schubert return;
16385732ac8SCy Schubert os_free(info->uri);
16485732ac8SCy Schubert os_free(info->info);
165c1d255d3SCy Schubert os_free(info->chan);
166c1d255d3SCy Schubert os_free(info->pk);
1674b72b91aSCy Schubert crypto_ec_key_deinit(info->pubkey);
168c1d255d3SCy Schubert str_clear_free(info->configurator_params);
16985732ac8SCy Schubert os_free(info);
17085732ac8SCy Schubert }
17185732ac8SCy Schubert
17285732ac8SCy Schubert
dpp_bootstrap_type_txt(enum dpp_bootstrap_type type)17385732ac8SCy Schubert const char * dpp_bootstrap_type_txt(enum dpp_bootstrap_type type)
17485732ac8SCy Schubert {
17585732ac8SCy Schubert switch (type) {
17685732ac8SCy Schubert case DPP_BOOTSTRAP_QR_CODE:
17785732ac8SCy Schubert return "QRCODE";
17885732ac8SCy Schubert case DPP_BOOTSTRAP_PKEX:
17985732ac8SCy Schubert return "PKEX";
180c1d255d3SCy Schubert case DPP_BOOTSTRAP_NFC_URI:
181c1d255d3SCy Schubert return "NFC-URI";
18285732ac8SCy Schubert }
18385732ac8SCy Schubert return "??";
18485732ac8SCy Schubert }
18585732ac8SCy Schubert
18685732ac8SCy Schubert
dpp_uri_valid_info(const char * info)18785732ac8SCy Schubert static int dpp_uri_valid_info(const char *info)
18885732ac8SCy Schubert {
18985732ac8SCy Schubert while (*info) {
19085732ac8SCy Schubert unsigned char val = *info++;
19185732ac8SCy Schubert
19285732ac8SCy Schubert if (val < 0x20 || val > 0x7e || val == 0x3b)
19385732ac8SCy Schubert return 0;
19485732ac8SCy Schubert }
19585732ac8SCy Schubert
19685732ac8SCy Schubert return 1;
19785732ac8SCy Schubert }
19885732ac8SCy Schubert
19985732ac8SCy Schubert
dpp_clone_uri(struct dpp_bootstrap_info * bi,const char * uri)20085732ac8SCy Schubert static int dpp_clone_uri(struct dpp_bootstrap_info *bi, const char *uri)
20185732ac8SCy Schubert {
20285732ac8SCy Schubert bi->uri = os_strdup(uri);
20385732ac8SCy Schubert return bi->uri ? 0 : -1;
20485732ac8SCy Schubert }
20585732ac8SCy Schubert
20685732ac8SCy Schubert
dpp_parse_uri_chan_list(struct dpp_bootstrap_info * bi,const char * chan_list)20785732ac8SCy Schubert int dpp_parse_uri_chan_list(struct dpp_bootstrap_info *bi,
20885732ac8SCy Schubert const char *chan_list)
20985732ac8SCy Schubert {
210206b73d0SCy Schubert const char *pos = chan_list, *pos2;
211206b73d0SCy Schubert int opclass = -1, channel, freq;
21285732ac8SCy Schubert
21385732ac8SCy Schubert while (pos && *pos && *pos != ';') {
214206b73d0SCy Schubert pos2 = pos;
215206b73d0SCy Schubert while (*pos2 >= '0' && *pos2 <= '9')
216206b73d0SCy Schubert pos2++;
217206b73d0SCy Schubert if (*pos2 == '/') {
21885732ac8SCy Schubert opclass = atoi(pos);
219206b73d0SCy Schubert pos = pos2 + 1;
220206b73d0SCy Schubert }
22185732ac8SCy Schubert if (opclass <= 0)
22285732ac8SCy Schubert goto fail;
22385732ac8SCy Schubert channel = atoi(pos);
22485732ac8SCy Schubert if (channel <= 0)
22585732ac8SCy Schubert goto fail;
22685732ac8SCy Schubert while (*pos >= '0' && *pos <= '9')
22785732ac8SCy Schubert pos++;
22885732ac8SCy Schubert freq = ieee80211_chan_to_freq(NULL, opclass, channel);
22985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
23085732ac8SCy Schubert "DPP: URI channel-list: opclass=%d channel=%d ==> freq=%d",
23185732ac8SCy Schubert opclass, channel, freq);
232c1d255d3SCy Schubert bi->channels_listed = true;
23385732ac8SCy Schubert if (freq < 0) {
23485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
23585732ac8SCy Schubert "DPP: Ignore unknown URI channel-list channel (opclass=%d channel=%d)",
23685732ac8SCy Schubert opclass, channel);
23785732ac8SCy Schubert } else if (bi->num_freq == DPP_BOOTSTRAP_MAX_FREQ) {
23885732ac8SCy Schubert wpa_printf(MSG_DEBUG,
23985732ac8SCy Schubert "DPP: Too many channels in URI channel-list - ignore list");
24085732ac8SCy Schubert bi->num_freq = 0;
24185732ac8SCy Schubert break;
24285732ac8SCy Schubert } else {
24385732ac8SCy Schubert bi->freq[bi->num_freq++] = freq;
24485732ac8SCy Schubert }
24585732ac8SCy Schubert
24685732ac8SCy Schubert if (*pos == ';' || *pos == '\0')
24785732ac8SCy Schubert break;
24885732ac8SCy Schubert if (*pos != ',')
24985732ac8SCy Schubert goto fail;
25085732ac8SCy Schubert pos++;
25185732ac8SCy Schubert }
25285732ac8SCy Schubert
25385732ac8SCy Schubert return 0;
25485732ac8SCy Schubert fail:
25585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Invalid URI channel-list");
25685732ac8SCy Schubert return -1;
25785732ac8SCy Schubert }
25885732ac8SCy Schubert
25985732ac8SCy Schubert
dpp_parse_uri_mac(struct dpp_bootstrap_info * bi,const char * mac)26085732ac8SCy Schubert int dpp_parse_uri_mac(struct dpp_bootstrap_info *bi, const char *mac)
26185732ac8SCy Schubert {
26285732ac8SCy Schubert if (!mac)
26385732ac8SCy Schubert return 0;
26485732ac8SCy Schubert
26585732ac8SCy Schubert if (hwaddr_aton2(mac, bi->mac_addr) < 0) {
26685732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Invalid URI mac");
26785732ac8SCy Schubert return -1;
26885732ac8SCy Schubert }
26985732ac8SCy Schubert
27085732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: URI mac: " MACSTR, MAC2STR(bi->mac_addr));
27185732ac8SCy Schubert
27285732ac8SCy Schubert return 0;
27385732ac8SCy Schubert }
27485732ac8SCy Schubert
27585732ac8SCy Schubert
dpp_parse_uri_info(struct dpp_bootstrap_info * bi,const char * info)27685732ac8SCy Schubert int dpp_parse_uri_info(struct dpp_bootstrap_info *bi, const char *info)
27785732ac8SCy Schubert {
27885732ac8SCy Schubert const char *end;
27985732ac8SCy Schubert
28085732ac8SCy Schubert if (!info)
28185732ac8SCy Schubert return 0;
28285732ac8SCy Schubert
28385732ac8SCy Schubert end = os_strchr(info, ';');
28485732ac8SCy Schubert if (!end)
28585732ac8SCy Schubert end = info + os_strlen(info);
28685732ac8SCy Schubert bi->info = os_malloc(end - info + 1);
28785732ac8SCy Schubert if (!bi->info)
28885732ac8SCy Schubert return -1;
28985732ac8SCy Schubert os_memcpy(bi->info, info, end - info);
29085732ac8SCy Schubert bi->info[end - info] = '\0';
29185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: URI(information): %s", bi->info);
29285732ac8SCy Schubert if (!dpp_uri_valid_info(bi->info)) {
29385732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Invalid URI information payload");
29485732ac8SCy Schubert return -1;
29585732ac8SCy Schubert }
29685732ac8SCy Schubert
29785732ac8SCy Schubert return 0;
29885732ac8SCy Schubert }
29985732ac8SCy Schubert
30085732ac8SCy Schubert
dpp_parse_uri_version(struct dpp_bootstrap_info * bi,const char * version)301c1d255d3SCy Schubert int dpp_parse_uri_version(struct dpp_bootstrap_info *bi, const char *version)
30285732ac8SCy Schubert {
303c1d255d3SCy Schubert #ifdef CONFIG_DPP2
304c1d255d3SCy Schubert if (!version || DPP_VERSION < 2)
305c1d255d3SCy Schubert return 0;
30685732ac8SCy Schubert
307c1d255d3SCy Schubert if (*version == '1')
308c1d255d3SCy Schubert bi->version = 1;
309c1d255d3SCy Schubert else if (*version == '2')
310c1d255d3SCy Schubert bi->version = 2;
31132a95656SCy Schubert else if (*version == '3')
31232a95656SCy Schubert bi->version = 3;
313c1d255d3SCy Schubert else
314c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unknown URI version");
31585732ac8SCy Schubert
316c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: URI version: %d", bi->version);
317c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
31885732ac8SCy Schubert
319c1d255d3SCy Schubert return 0;
32085732ac8SCy Schubert }
32185732ac8SCy Schubert
32285732ac8SCy Schubert
dpp_parse_uri_pk(struct dpp_bootstrap_info * bi,const char * info)32385732ac8SCy Schubert static int dpp_parse_uri_pk(struct dpp_bootstrap_info *bi, const char *info)
32485732ac8SCy Schubert {
32585732ac8SCy Schubert u8 *data;
32685732ac8SCy Schubert size_t data_len;
32785732ac8SCy Schubert int res;
328c1d255d3SCy Schubert const char *end;
32985732ac8SCy Schubert
33085732ac8SCy Schubert end = os_strchr(info, ';');
33185732ac8SCy Schubert if (!end)
33285732ac8SCy Schubert return -1;
33385732ac8SCy Schubert
334c1d255d3SCy Schubert data = base64_decode(info, end - info, &data_len);
33585732ac8SCy Schubert if (!data) {
33685732ac8SCy Schubert wpa_printf(MSG_DEBUG,
33785732ac8SCy Schubert "DPP: Invalid base64 encoding on URI public-key");
33885732ac8SCy Schubert return -1;
33985732ac8SCy Schubert }
34085732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Base64 decoded URI public-key",
34185732ac8SCy Schubert data, data_len);
34285732ac8SCy Schubert
343c1d255d3SCy Schubert res = dpp_get_subject_public_key(bi, data, data_len);
34485732ac8SCy Schubert os_free(data);
345c1d255d3SCy Schubert return res;
34685732ac8SCy Schubert }
34785732ac8SCy Schubert
34885732ac8SCy Schubert
dpp_parse_uri(const char * uri)34985732ac8SCy Schubert static struct dpp_bootstrap_info * dpp_parse_uri(const char *uri)
35085732ac8SCy Schubert {
35185732ac8SCy Schubert const char *pos = uri;
35285732ac8SCy Schubert const char *end;
35385732ac8SCy Schubert const char *chan_list = NULL, *mac = NULL, *info = NULL, *pk = NULL;
354c1d255d3SCy Schubert const char *version = NULL;
35585732ac8SCy Schubert struct dpp_bootstrap_info *bi;
35685732ac8SCy Schubert
35785732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: URI", uri, os_strlen(uri));
35885732ac8SCy Schubert
35985732ac8SCy Schubert if (os_strncmp(pos, "DPP:", 4) != 0) {
36085732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: Not a DPP URI");
36185732ac8SCy Schubert return NULL;
36285732ac8SCy Schubert }
36385732ac8SCy Schubert pos += 4;
36485732ac8SCy Schubert
36585732ac8SCy Schubert for (;;) {
36685732ac8SCy Schubert end = os_strchr(pos, ';');
36785732ac8SCy Schubert if (!end)
36885732ac8SCy Schubert break;
36985732ac8SCy Schubert
37085732ac8SCy Schubert if (end == pos) {
37185732ac8SCy Schubert /* Handle terminating ";;" and ignore unexpected ";"
37285732ac8SCy Schubert * for parsing robustness. */
37385732ac8SCy Schubert pos++;
37485732ac8SCy Schubert continue;
37585732ac8SCy Schubert }
37685732ac8SCy Schubert
37785732ac8SCy Schubert if (pos[0] == 'C' && pos[1] == ':' && !chan_list)
37885732ac8SCy Schubert chan_list = pos + 2;
37985732ac8SCy Schubert else if (pos[0] == 'M' && pos[1] == ':' && !mac)
38085732ac8SCy Schubert mac = pos + 2;
38185732ac8SCy Schubert else if (pos[0] == 'I' && pos[1] == ':' && !info)
38285732ac8SCy Schubert info = pos + 2;
38385732ac8SCy Schubert else if (pos[0] == 'K' && pos[1] == ':' && !pk)
38485732ac8SCy Schubert pk = pos + 2;
385c1d255d3SCy Schubert else if (pos[0] == 'V' && pos[1] == ':' && !version)
386c1d255d3SCy Schubert version = pos + 2;
38785732ac8SCy Schubert else
38885732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG,
38985732ac8SCy Schubert "DPP: Ignore unrecognized URI parameter",
39085732ac8SCy Schubert pos, end - pos);
39185732ac8SCy Schubert pos = end + 1;
39285732ac8SCy Schubert }
39385732ac8SCy Schubert
39485732ac8SCy Schubert if (!pk) {
39585732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: URI missing public-key");
39685732ac8SCy Schubert return NULL;
39785732ac8SCy Schubert }
39885732ac8SCy Schubert
39985732ac8SCy Schubert bi = os_zalloc(sizeof(*bi));
40085732ac8SCy Schubert if (!bi)
40185732ac8SCy Schubert return NULL;
40285732ac8SCy Schubert
40385732ac8SCy Schubert if (dpp_clone_uri(bi, uri) < 0 ||
40485732ac8SCy Schubert dpp_parse_uri_chan_list(bi, chan_list) < 0 ||
40585732ac8SCy Schubert dpp_parse_uri_mac(bi, mac) < 0 ||
40685732ac8SCy Schubert dpp_parse_uri_info(bi, info) < 0 ||
407c1d255d3SCy Schubert dpp_parse_uri_version(bi, version) < 0 ||
40885732ac8SCy Schubert dpp_parse_uri_pk(bi, pk) < 0) {
40985732ac8SCy Schubert dpp_bootstrap_info_free(bi);
41085732ac8SCy Schubert bi = NULL;
41185732ac8SCy Schubert }
41285732ac8SCy Schubert
41385732ac8SCy Schubert return bi;
41485732ac8SCy Schubert }
41585732ac8SCy Schubert
41685732ac8SCy Schubert
dpp_build_attr_status(struct wpabuf * msg,enum dpp_status_error status)417c1d255d3SCy Schubert void dpp_build_attr_status(struct wpabuf *msg, enum dpp_status_error status)
41885732ac8SCy Schubert {
41985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Status %d", status);
42085732ac8SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_STATUS);
42185732ac8SCy Schubert wpabuf_put_le16(msg, 1);
42285732ac8SCy Schubert wpabuf_put_u8(msg, status);
42385732ac8SCy Schubert }
42485732ac8SCy Schubert
42585732ac8SCy Schubert
dpp_build_attr_r_bootstrap_key_hash(struct wpabuf * msg,const u8 * hash)426c1d255d3SCy Schubert void dpp_build_attr_r_bootstrap_key_hash(struct wpabuf *msg, const u8 *hash)
42785732ac8SCy Schubert {
42885732ac8SCy Schubert if (hash) {
42985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: R-Bootstrap Key Hash");
43085732ac8SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_R_BOOTSTRAP_KEY_HASH);
43185732ac8SCy Schubert wpabuf_put_le16(msg, SHA256_MAC_LEN);
43285732ac8SCy Schubert wpabuf_put_data(msg, hash, SHA256_MAC_LEN);
43385732ac8SCy Schubert }
43485732ac8SCy Schubert }
43585732ac8SCy Schubert
43685732ac8SCy Schubert
dpp_channel_ok_init(struct hostapd_hw_modes * own_modes,u16 num_modes,unsigned int freq)43785732ac8SCy Schubert static int dpp_channel_ok_init(struct hostapd_hw_modes *own_modes,
43885732ac8SCy Schubert u16 num_modes, unsigned int freq)
43985732ac8SCy Schubert {
44085732ac8SCy Schubert u16 m;
44185732ac8SCy Schubert int c, flag;
44285732ac8SCy Schubert
44385732ac8SCy Schubert if (!own_modes || !num_modes)
44485732ac8SCy Schubert return 1;
44585732ac8SCy Schubert
44685732ac8SCy Schubert for (m = 0; m < num_modes; m++) {
44785732ac8SCy Schubert for (c = 0; c < own_modes[m].num_channels; c++) {
44885732ac8SCy Schubert if ((unsigned int) own_modes[m].channels[c].freq !=
44985732ac8SCy Schubert freq)
45085732ac8SCy Schubert continue;
45185732ac8SCy Schubert flag = own_modes[m].channels[c].flag;
45285732ac8SCy Schubert if (!(flag & (HOSTAPD_CHAN_DISABLED |
45385732ac8SCy Schubert HOSTAPD_CHAN_NO_IR |
45485732ac8SCy Schubert HOSTAPD_CHAN_RADAR)))
45585732ac8SCy Schubert return 1;
45685732ac8SCy Schubert }
45785732ac8SCy Schubert }
45885732ac8SCy Schubert
45985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Peer channel %u MHz not supported", freq);
46085732ac8SCy Schubert return 0;
46185732ac8SCy Schubert }
46285732ac8SCy Schubert
46385732ac8SCy Schubert
freq_included(const unsigned int freqs[],unsigned int num,unsigned int freq)46485732ac8SCy Schubert static int freq_included(const unsigned int freqs[], unsigned int num,
46585732ac8SCy Schubert unsigned int freq)
46685732ac8SCy Schubert {
46785732ac8SCy Schubert while (num > 0) {
46885732ac8SCy Schubert if (freqs[--num] == freq)
46985732ac8SCy Schubert return 1;
47085732ac8SCy Schubert }
47185732ac8SCy Schubert return 0;
47285732ac8SCy Schubert }
47385732ac8SCy Schubert
47485732ac8SCy Schubert
freq_to_start(unsigned int freqs[],unsigned int num,unsigned int freq)47585732ac8SCy Schubert static void freq_to_start(unsigned int freqs[], unsigned int num,
47685732ac8SCy Schubert unsigned int freq)
47785732ac8SCy Schubert {
47885732ac8SCy Schubert unsigned int i;
47985732ac8SCy Schubert
48085732ac8SCy Schubert for (i = 0; i < num; i++) {
48185732ac8SCy Schubert if (freqs[i] == freq)
48285732ac8SCy Schubert break;
48385732ac8SCy Schubert }
48485732ac8SCy Schubert if (i == 0 || i >= num)
48585732ac8SCy Schubert return;
48685732ac8SCy Schubert os_memmove(&freqs[1], &freqs[0], i * sizeof(freqs[0]));
48785732ac8SCy Schubert freqs[0] = freq;
48885732ac8SCy Schubert }
48985732ac8SCy Schubert
49085732ac8SCy Schubert
dpp_channel_intersect(struct dpp_authentication * auth,struct hostapd_hw_modes * own_modes,u16 num_modes)49185732ac8SCy Schubert static int dpp_channel_intersect(struct dpp_authentication *auth,
49285732ac8SCy Schubert struct hostapd_hw_modes *own_modes,
49385732ac8SCy Schubert u16 num_modes)
49485732ac8SCy Schubert {
49585732ac8SCy Schubert struct dpp_bootstrap_info *peer_bi = auth->peer_bi;
49685732ac8SCy Schubert unsigned int i, freq;
49785732ac8SCy Schubert
49885732ac8SCy Schubert for (i = 0; i < peer_bi->num_freq; i++) {
49985732ac8SCy Schubert freq = peer_bi->freq[i];
50085732ac8SCy Schubert if (freq_included(auth->freq, auth->num_freq, freq))
50185732ac8SCy Schubert continue;
50285732ac8SCy Schubert if (dpp_channel_ok_init(own_modes, num_modes, freq))
50385732ac8SCy Schubert auth->freq[auth->num_freq++] = freq;
50485732ac8SCy Schubert }
50585732ac8SCy Schubert if (!auth->num_freq) {
50685732ac8SCy Schubert wpa_printf(MSG_INFO,
50785732ac8SCy Schubert "DPP: No available channels for initiating DPP Authentication");
50885732ac8SCy Schubert return -1;
50985732ac8SCy Schubert }
51085732ac8SCy Schubert auth->curr_freq = auth->freq[0];
51185732ac8SCy Schubert return 0;
51285732ac8SCy Schubert }
51385732ac8SCy Schubert
51485732ac8SCy Schubert
dpp_channel_local_list(struct dpp_authentication * auth,struct hostapd_hw_modes * own_modes,u16 num_modes)51585732ac8SCy Schubert static int dpp_channel_local_list(struct dpp_authentication *auth,
51685732ac8SCy Schubert struct hostapd_hw_modes *own_modes,
51785732ac8SCy Schubert u16 num_modes)
51885732ac8SCy Schubert {
51985732ac8SCy Schubert u16 m;
52085732ac8SCy Schubert int c, flag;
52185732ac8SCy Schubert unsigned int freq;
52285732ac8SCy Schubert
52385732ac8SCy Schubert auth->num_freq = 0;
52485732ac8SCy Schubert
52585732ac8SCy Schubert if (!own_modes || !num_modes) {
52685732ac8SCy Schubert auth->freq[0] = 2412;
52785732ac8SCy Schubert auth->freq[1] = 2437;
52885732ac8SCy Schubert auth->freq[2] = 2462;
52985732ac8SCy Schubert auth->num_freq = 3;
53085732ac8SCy Schubert return 0;
53185732ac8SCy Schubert }
53285732ac8SCy Schubert
53385732ac8SCy Schubert for (m = 0; m < num_modes; m++) {
53485732ac8SCy Schubert for (c = 0; c < own_modes[m].num_channels; c++) {
53585732ac8SCy Schubert freq = own_modes[m].channels[c].freq;
53685732ac8SCy Schubert flag = own_modes[m].channels[c].flag;
53785732ac8SCy Schubert if (flag & (HOSTAPD_CHAN_DISABLED |
53885732ac8SCy Schubert HOSTAPD_CHAN_NO_IR |
53985732ac8SCy Schubert HOSTAPD_CHAN_RADAR))
54085732ac8SCy Schubert continue;
54185732ac8SCy Schubert if (freq_included(auth->freq, auth->num_freq, freq))
54285732ac8SCy Schubert continue;
54385732ac8SCy Schubert auth->freq[auth->num_freq++] = freq;
54485732ac8SCy Schubert if (auth->num_freq == DPP_BOOTSTRAP_MAX_FREQ) {
54585732ac8SCy Schubert m = num_modes;
54685732ac8SCy Schubert break;
54785732ac8SCy Schubert }
54885732ac8SCy Schubert }
54985732ac8SCy Schubert }
55085732ac8SCy Schubert
55185732ac8SCy Schubert return auth->num_freq == 0 ? -1 : 0;
55285732ac8SCy Schubert }
55385732ac8SCy Schubert
55485732ac8SCy Schubert
dpp_prepare_channel_list(struct dpp_authentication * auth,unsigned int neg_freq,struct hostapd_hw_modes * own_modes,u16 num_modes)555c1d255d3SCy Schubert int dpp_prepare_channel_list(struct dpp_authentication *auth,
556c1d255d3SCy Schubert unsigned int neg_freq,
557c1d255d3SCy Schubert struct hostapd_hw_modes *own_modes, u16 num_modes)
55885732ac8SCy Schubert {
55985732ac8SCy Schubert int res;
56085732ac8SCy Schubert char freqs[DPP_BOOTSTRAP_MAX_FREQ * 6 + 10], *pos, *end;
56185732ac8SCy Schubert unsigned int i;
56285732ac8SCy Schubert
563c1d255d3SCy Schubert if (!own_modes) {
564c1d255d3SCy Schubert if (!neg_freq)
565c1d255d3SCy Schubert return -1;
566c1d255d3SCy Schubert auth->num_freq = 1;
567c1d255d3SCy Schubert auth->freq[0] = neg_freq;
568c1d255d3SCy Schubert auth->curr_freq = neg_freq;
569c1d255d3SCy Schubert return 0;
570c1d255d3SCy Schubert }
571c1d255d3SCy Schubert
57285732ac8SCy Schubert if (auth->peer_bi->num_freq > 0)
57385732ac8SCy Schubert res = dpp_channel_intersect(auth, own_modes, num_modes);
57485732ac8SCy Schubert else
57585732ac8SCy Schubert res = dpp_channel_local_list(auth, own_modes, num_modes);
57685732ac8SCy Schubert if (res < 0)
57785732ac8SCy Schubert return res;
57885732ac8SCy Schubert
57985732ac8SCy Schubert /* Prioritize 2.4 GHz channels 6, 1, 11 (in this order) to hit the most
58085732ac8SCy Schubert * likely channels first. */
58185732ac8SCy Schubert freq_to_start(auth->freq, auth->num_freq, 2462);
58285732ac8SCy Schubert freq_to_start(auth->freq, auth->num_freq, 2412);
58385732ac8SCy Schubert freq_to_start(auth->freq, auth->num_freq, 2437);
58485732ac8SCy Schubert
58585732ac8SCy Schubert auth->freq_idx = 0;
58685732ac8SCy Schubert auth->curr_freq = auth->freq[0];
58785732ac8SCy Schubert
58885732ac8SCy Schubert pos = freqs;
58985732ac8SCy Schubert end = pos + sizeof(freqs);
59085732ac8SCy Schubert for (i = 0; i < auth->num_freq; i++) {
59185732ac8SCy Schubert res = os_snprintf(pos, end - pos, " %u", auth->freq[i]);
59285732ac8SCy Schubert if (os_snprintf_error(end - pos, res))
59385732ac8SCy Schubert break;
59485732ac8SCy Schubert pos += res;
59585732ac8SCy Schubert }
59685732ac8SCy Schubert *pos = '\0';
59785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Possible frequencies for initiating:%s",
59885732ac8SCy Schubert freqs);
59985732ac8SCy Schubert
60085732ac8SCy Schubert return 0;
60185732ac8SCy Schubert }
60285732ac8SCy Schubert
60385732ac8SCy Schubert
dpp_gen_uri(struct dpp_bootstrap_info * bi)604c1d255d3SCy Schubert int dpp_gen_uri(struct dpp_bootstrap_info *bi)
60585732ac8SCy Schubert {
606c1d255d3SCy Schubert char macstr[ETH_ALEN * 2 + 10];
60785732ac8SCy Schubert size_t len;
60885732ac8SCy Schubert
60985732ac8SCy Schubert len = 4; /* "DPP:" */
610c1d255d3SCy Schubert if (bi->chan)
611c1d255d3SCy Schubert len += 3 + os_strlen(bi->chan); /* C:...; */
612c1d255d3SCy Schubert if (is_zero_ether_addr(bi->mac_addr))
613c1d255d3SCy Schubert macstr[0] = '\0';
614c1d255d3SCy Schubert else
615c1d255d3SCy Schubert os_snprintf(macstr, sizeof(macstr), "M:" COMPACT_MACSTR ";",
616c1d255d3SCy Schubert MAC2STR(bi->mac_addr));
617c1d255d3SCy Schubert len += os_strlen(macstr); /* M:...; */
618c1d255d3SCy Schubert if (bi->info)
619c1d255d3SCy Schubert len += 3 + os_strlen(bi->info); /* I:...; */
620c1d255d3SCy Schubert #ifdef CONFIG_DPP2
621c1d255d3SCy Schubert len += 4; /* V:2; */
622c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
623c1d255d3SCy Schubert len += 4 + os_strlen(bi->pk); /* K:...;; */
624c1d255d3SCy Schubert
625c1d255d3SCy Schubert os_free(bi->uri);
62685732ac8SCy Schubert bi->uri = os_malloc(len + 1);
62785732ac8SCy Schubert if (!bi->uri)
62885732ac8SCy Schubert return -1;
629c1d255d3SCy Schubert os_snprintf(bi->uri, len + 1, "DPP:%s%s%s%s%s%s%s%sK:%s;;",
630c1d255d3SCy Schubert bi->chan ? "C:" : "", bi->chan ? bi->chan : "",
631c1d255d3SCy Schubert bi->chan ? ";" : "",
632c1d255d3SCy Schubert macstr,
633c1d255d3SCy Schubert bi->info ? "I:" : "", bi->info ? bi->info : "",
634c1d255d3SCy Schubert bi->info ? ";" : "",
63532a95656SCy Schubert DPP_VERSION == 3 ? "V:3;" :
63632a95656SCy Schubert (DPP_VERSION == 2 ? "V:2;" : ""),
637c1d255d3SCy Schubert bi->pk);
638c1d255d3SCy Schubert return 0;
63985732ac8SCy Schubert }
64085732ac8SCy Schubert
64185732ac8SCy Schubert
642c1d255d3SCy Schubert struct dpp_authentication *
dpp_alloc_auth(struct dpp_global * dpp,void * msg_ctx)643c1d255d3SCy Schubert dpp_alloc_auth(struct dpp_global *dpp, void *msg_ctx)
64485732ac8SCy Schubert {
64585732ac8SCy Schubert struct dpp_authentication *auth;
64685732ac8SCy Schubert
64785732ac8SCy Schubert auth = os_zalloc(sizeof(*auth));
64885732ac8SCy Schubert if (!auth)
64985732ac8SCy Schubert return NULL;
650c1d255d3SCy Schubert auth->global = dpp;
65185732ac8SCy Schubert auth->msg_ctx = msg_ctx;
652c1d255d3SCy Schubert auth->conf_resp_status = 255;
65385732ac8SCy Schubert return auth;
65485732ac8SCy Schubert }
65585732ac8SCy Schubert
65685732ac8SCy Schubert
dpp_build_conf_req_attr(struct dpp_authentication * auth,const char * json)6574bc52338SCy Schubert static struct wpabuf * dpp_build_conf_req_attr(struct dpp_authentication *auth,
65885732ac8SCy Schubert const char *json)
65985732ac8SCy Schubert {
66085732ac8SCy Schubert size_t nonce_len;
66185732ac8SCy Schubert size_t json_len, clear_len;
66285732ac8SCy Schubert struct wpabuf *clear = NULL, *msg = NULL;
66385732ac8SCy Schubert u8 *wrapped;
66485732ac8SCy Schubert size_t attr_len;
66585732ac8SCy Schubert
66685732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Build configuration request");
66785732ac8SCy Schubert
66885732ac8SCy Schubert nonce_len = auth->curve->nonce_len;
66985732ac8SCy Schubert if (random_get_bytes(auth->e_nonce, nonce_len)) {
67085732ac8SCy Schubert wpa_printf(MSG_ERROR, "DPP: Failed to generate E-nonce");
67185732ac8SCy Schubert goto fail;
67285732ac8SCy Schubert }
67385732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: E-nonce", auth->e_nonce, nonce_len);
67485732ac8SCy Schubert json_len = os_strlen(json);
675c1d255d3SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: configRequest JSON", json, json_len);
67685732ac8SCy Schubert
67785732ac8SCy Schubert /* { E-nonce, configAttrib }ke */
67885732ac8SCy Schubert clear_len = 4 + nonce_len + 4 + json_len;
67985732ac8SCy Schubert clear = wpabuf_alloc(clear_len);
68085732ac8SCy Schubert attr_len = 4 + clear_len + AES_BLOCK_SIZE;
68185732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
68285732ac8SCy Schubert if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ)
68385732ac8SCy Schubert attr_len += 5;
68485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
68585732ac8SCy Schubert msg = wpabuf_alloc(attr_len);
68685732ac8SCy Schubert if (!clear || !msg)
68785732ac8SCy Schubert goto fail;
68885732ac8SCy Schubert
68985732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
69085732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_REQ) {
69185732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce");
69285732ac8SCy Schubert goto skip_e_nonce;
69385732ac8SCy Schubert }
69485732ac8SCy Schubert if (dpp_test == DPP_TEST_INVALID_E_NONCE_CONF_REQ) {
69585732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - invalid E-nonce");
69685732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
69785732ac8SCy Schubert wpabuf_put_le16(clear, nonce_len - 1);
69885732ac8SCy Schubert wpabuf_put_data(clear, auth->e_nonce, nonce_len - 1);
69985732ac8SCy Schubert goto skip_e_nonce;
70085732ac8SCy Schubert }
70185732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_REQ) {
70285732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data");
70385732ac8SCy Schubert goto skip_wrapped_data;
70485732ac8SCy Schubert }
70585732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
70685732ac8SCy Schubert
70785732ac8SCy Schubert /* E-nonce */
70885732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
70985732ac8SCy Schubert wpabuf_put_le16(clear, nonce_len);
71085732ac8SCy Schubert wpabuf_put_data(clear, auth->e_nonce, nonce_len);
71185732ac8SCy Schubert
71285732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
71385732ac8SCy Schubert skip_e_nonce:
71485732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_CONFIG_ATTR_OBJ_CONF_REQ) {
71585732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - no configAttrib");
71685732ac8SCy Schubert goto skip_conf_attr_obj;
71785732ac8SCy Schubert }
71885732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
71985732ac8SCy Schubert
72085732ac8SCy Schubert /* configAttrib */
72185732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_CONFIG_ATTR_OBJ);
72285732ac8SCy Schubert wpabuf_put_le16(clear, json_len);
72385732ac8SCy Schubert wpabuf_put_data(clear, json, json_len);
72485732ac8SCy Schubert
72585732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
72685732ac8SCy Schubert skip_conf_attr_obj:
72785732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
72885732ac8SCy Schubert
72985732ac8SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);
73085732ac8SCy Schubert wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
73185732ac8SCy Schubert wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
73285732ac8SCy Schubert
73385732ac8SCy Schubert /* No AES-SIV AD */
73485732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear);
73585732ac8SCy Schubert if (aes_siv_encrypt(auth->ke, auth->curve->hash_len,
73685732ac8SCy Schubert wpabuf_head(clear), wpabuf_len(clear),
73785732ac8SCy Schubert 0, NULL, NULL, wrapped) < 0)
73885732ac8SCy Schubert goto fail;
73985732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
74085732ac8SCy Schubert wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE);
74185732ac8SCy Schubert
74285732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
74385732ac8SCy Schubert if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ) {
74485732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data");
74585732ac8SCy Schubert dpp_build_attr_status(msg, DPP_STATUS_OK);
74685732ac8SCy Schubert }
74785732ac8SCy Schubert skip_wrapped_data:
74885732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
74985732ac8SCy Schubert
75085732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG,
75185732ac8SCy Schubert "DPP: Configuration Request frame attributes", msg);
75285732ac8SCy Schubert wpabuf_free(clear);
75385732ac8SCy Schubert return msg;
75485732ac8SCy Schubert
75585732ac8SCy Schubert fail:
75685732ac8SCy Schubert wpabuf_free(clear);
75785732ac8SCy Schubert wpabuf_free(msg);
75885732ac8SCy Schubert return NULL;
75985732ac8SCy Schubert }
76085732ac8SCy Schubert
76185732ac8SCy Schubert
dpp_write_adv_proto(struct wpabuf * buf)762c1d255d3SCy Schubert void dpp_write_adv_proto(struct wpabuf *buf)
7634bc52338SCy Schubert {
7644bc52338SCy Schubert /* Advertisement Protocol IE */
7654bc52338SCy Schubert wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
7664bc52338SCy Schubert wpabuf_put_u8(buf, 8); /* Length */
7674bc52338SCy Schubert wpabuf_put_u8(buf, 0x7f);
7684bc52338SCy Schubert wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
7694bc52338SCy Schubert wpabuf_put_u8(buf, 5);
7704bc52338SCy Schubert wpabuf_put_be24(buf, OUI_WFA);
7714bc52338SCy Schubert wpabuf_put_u8(buf, DPP_OUI_TYPE);
7724bc52338SCy Schubert wpabuf_put_u8(buf, 0x01);
7734bc52338SCy Schubert }
7744bc52338SCy Schubert
7754bc52338SCy Schubert
dpp_write_gas_query(struct wpabuf * buf,struct wpabuf * query)776c1d255d3SCy Schubert void dpp_write_gas_query(struct wpabuf *buf, struct wpabuf *query)
7774bc52338SCy Schubert {
7784bc52338SCy Schubert /* GAS Query */
7794bc52338SCy Schubert wpabuf_put_le16(buf, wpabuf_len(query));
7804bc52338SCy Schubert wpabuf_put_buf(buf, query);
7814bc52338SCy Schubert }
7824bc52338SCy Schubert
7834bc52338SCy Schubert
dpp_build_conf_req(struct dpp_authentication * auth,const char * json)7844bc52338SCy Schubert struct wpabuf * dpp_build_conf_req(struct dpp_authentication *auth,
7854bc52338SCy Schubert const char *json)
7864bc52338SCy Schubert {
7874bc52338SCy Schubert struct wpabuf *buf, *conf_req;
7884bc52338SCy Schubert
7894bc52338SCy Schubert conf_req = dpp_build_conf_req_attr(auth, json);
7904bc52338SCy Schubert if (!conf_req) {
7914bc52338SCy Schubert wpa_printf(MSG_DEBUG,
7924bc52338SCy Schubert "DPP: No configuration request data available");
7934bc52338SCy Schubert return NULL;
7944bc52338SCy Schubert }
7954bc52338SCy Schubert
7964bc52338SCy Schubert buf = gas_build_initial_req(0, 10 + 2 + wpabuf_len(conf_req));
7974bc52338SCy Schubert if (!buf) {
7984bc52338SCy Schubert wpabuf_free(conf_req);
7994bc52338SCy Schubert return NULL;
8004bc52338SCy Schubert }
8014bc52338SCy Schubert
8024bc52338SCy Schubert dpp_write_adv_proto(buf);
8034bc52338SCy Schubert dpp_write_gas_query(buf, conf_req);
8044bc52338SCy Schubert wpabuf_free(conf_req);
8054bc52338SCy Schubert wpa_hexdump_buf(MSG_MSGDUMP, "DPP: GAS Config Request", buf);
8064bc52338SCy Schubert
8074bc52338SCy Schubert return buf;
8084bc52338SCy Schubert }
8094bc52338SCy Schubert
8104bc52338SCy Schubert
dpp_build_conf_req_helper(struct dpp_authentication * auth,const char * name,enum dpp_netrole netrole,const char * mud_url,int * opclasses)811c1d255d3SCy Schubert struct wpabuf * dpp_build_conf_req_helper(struct dpp_authentication *auth,
812c1d255d3SCy Schubert const char *name,
813c1d255d3SCy Schubert enum dpp_netrole netrole,
814c1d255d3SCy Schubert const char *mud_url, int *opclasses)
81585732ac8SCy Schubert {
816c1d255d3SCy Schubert size_t len, name_len;
817c1d255d3SCy Schubert const char *tech = "infra";
818c1d255d3SCy Schubert const char *dpp_name;
819c1d255d3SCy Schubert struct wpabuf *buf, *json;
820c1d255d3SCy Schubert char *csr = NULL;
82185732ac8SCy Schubert
82285732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
823c1d255d3SCy Schubert if (dpp_test == DPP_TEST_INVALID_CONFIG_ATTR_OBJ_CONF_REQ) {
824c1d255d3SCy Schubert static const char *bogus_tech = "knfra";
82585732ac8SCy Schubert
826c1d255d3SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - invalid Config Attr");
827c1d255d3SCy Schubert tech = bogus_tech;
82885732ac8SCy Schubert }
82985732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
83085732ac8SCy Schubert
831c1d255d3SCy Schubert dpp_name = name ? name : "Test";
832c1d255d3SCy Schubert name_len = os_strlen(dpp_name);
83385732ac8SCy Schubert
834c1d255d3SCy Schubert len = 100 + name_len * 6 + 1 + int_array_len(opclasses) * 4;
835c1d255d3SCy Schubert if (mud_url && mud_url[0])
836c1d255d3SCy Schubert len += 10 + os_strlen(mud_url);
8374bc52338SCy Schubert #ifdef CONFIG_DPP2
838c1d255d3SCy Schubert if (auth->csr) {
839c1d255d3SCy Schubert size_t csr_len;
84085732ac8SCy Schubert
841c1d255d3SCy Schubert csr = base64_encode_no_lf(wpabuf_head(auth->csr),
842c1d255d3SCy Schubert wpabuf_len(auth->csr), &csr_len);
843c1d255d3SCy Schubert if (!csr)
84485732ac8SCy Schubert return NULL;
845c1d255d3SCy Schubert len += 30 + csr_len;
8464bc52338SCy Schubert }
8474bc52338SCy Schubert #endif /* CONFIG_DPP2 */
848c1d255d3SCy Schubert json = wpabuf_alloc(len);
849c1d255d3SCy Schubert if (!json)
850c1d255d3SCy Schubert return NULL;
8514bc52338SCy Schubert
852c1d255d3SCy Schubert json_start_object(json, NULL);
853c1d255d3SCy Schubert if (json_add_string_escape(json, "name", dpp_name, name_len) < 0) {
854c1d255d3SCy Schubert wpabuf_free(json);
85585732ac8SCy Schubert return NULL;
85685732ac8SCy Schubert }
857c1d255d3SCy Schubert json_value_sep(json);
858c1d255d3SCy Schubert json_add_string(json, "wi-fi_tech", tech);
859c1d255d3SCy Schubert json_value_sep(json);
860c1d255d3SCy Schubert json_add_string(json, "netRole", dpp_netrole_str(netrole));
861c1d255d3SCy Schubert if (mud_url && mud_url[0]) {
862c1d255d3SCy Schubert json_value_sep(json);
863c1d255d3SCy Schubert json_add_string(json, "mudurl", mud_url);
86485732ac8SCy Schubert }
865c1d255d3SCy Schubert if (opclasses) {
866c1d255d3SCy Schubert int i;
86785732ac8SCy Schubert
868c1d255d3SCy Schubert json_value_sep(json);
869c1d255d3SCy Schubert json_start_array(json, "bandSupport");
870c1d255d3SCy Schubert for (i = 0; opclasses[i]; i++)
871c1d255d3SCy Schubert wpabuf_printf(json, "%s%u", i ? "," : "", opclasses[i]);
872c1d255d3SCy Schubert json_end_array(json);
87385732ac8SCy Schubert }
874c1d255d3SCy Schubert if (csr) {
875c1d255d3SCy Schubert json_value_sep(json);
876c1d255d3SCy Schubert json_add_string(json, "pkcs10", csr);
87785732ac8SCy Schubert }
878c1d255d3SCy Schubert json_end_object(json);
87985732ac8SCy Schubert
880c1d255d3SCy Schubert buf = dpp_build_conf_req(auth, wpabuf_head(json));
881c1d255d3SCy Schubert wpabuf_free(json);
882c1d255d3SCy Schubert os_free(csr);
88385732ac8SCy Schubert
884c1d255d3SCy Schubert return buf;
88585732ac8SCy Schubert }
88685732ac8SCy Schubert
88785732ac8SCy Schubert
bin_str_eq(const char * val,size_t len,const char * cmp)8884bc52338SCy Schubert static int bin_str_eq(const char *val, size_t len, const char *cmp)
8894bc52338SCy Schubert {
8904bc52338SCy Schubert return os_strlen(cmp) == len && os_memcmp(val, cmp, len) == 0;
8914bc52338SCy Schubert }
8924bc52338SCy Schubert
8934bc52338SCy Schubert
dpp_configuration_alloc(const char * type)8944bc52338SCy Schubert struct dpp_configuration * dpp_configuration_alloc(const char *type)
8954bc52338SCy Schubert {
8964bc52338SCy Schubert struct dpp_configuration *conf;
8974bc52338SCy Schubert const char *end;
8984bc52338SCy Schubert size_t len;
8994bc52338SCy Schubert
9004bc52338SCy Schubert conf = os_zalloc(sizeof(*conf));
9014bc52338SCy Schubert if (!conf)
9024bc52338SCy Schubert goto fail;
9034bc52338SCy Schubert
9044bc52338SCy Schubert end = os_strchr(type, ' ');
9054bc52338SCy Schubert if (end)
9064bc52338SCy Schubert len = end - type;
9074bc52338SCy Schubert else
9084bc52338SCy Schubert len = os_strlen(type);
9094bc52338SCy Schubert
9104bc52338SCy Schubert if (bin_str_eq(type, len, "psk"))
9114bc52338SCy Schubert conf->akm = DPP_AKM_PSK;
9124bc52338SCy Schubert else if (bin_str_eq(type, len, "sae"))
9134bc52338SCy Schubert conf->akm = DPP_AKM_SAE;
9144bc52338SCy Schubert else if (bin_str_eq(type, len, "psk-sae") ||
9154bc52338SCy Schubert bin_str_eq(type, len, "psk+sae"))
9164bc52338SCy Schubert conf->akm = DPP_AKM_PSK_SAE;
9174bc52338SCy Schubert else if (bin_str_eq(type, len, "sae-dpp") ||
9184bc52338SCy Schubert bin_str_eq(type, len, "dpp+sae"))
9194bc52338SCy Schubert conf->akm = DPP_AKM_SAE_DPP;
9204bc52338SCy Schubert else if (bin_str_eq(type, len, "psk-sae-dpp") ||
9214bc52338SCy Schubert bin_str_eq(type, len, "dpp+psk+sae"))
9224bc52338SCy Schubert conf->akm = DPP_AKM_PSK_SAE_DPP;
9234bc52338SCy Schubert else if (bin_str_eq(type, len, "dpp"))
9244bc52338SCy Schubert conf->akm = DPP_AKM_DPP;
925c1d255d3SCy Schubert else if (bin_str_eq(type, len, "dot1x"))
926c1d255d3SCy Schubert conf->akm = DPP_AKM_DOT1X;
9274bc52338SCy Schubert else
9284bc52338SCy Schubert goto fail;
9294bc52338SCy Schubert
9304bc52338SCy Schubert return conf;
9314bc52338SCy Schubert fail:
9324bc52338SCy Schubert dpp_configuration_free(conf);
9334bc52338SCy Schubert return NULL;
9344bc52338SCy Schubert }
9354bc52338SCy Schubert
9364bc52338SCy Schubert
dpp_akm_psk(enum dpp_akm akm)9374bc52338SCy Schubert int dpp_akm_psk(enum dpp_akm akm)
9384bc52338SCy Schubert {
9394bc52338SCy Schubert return akm == DPP_AKM_PSK || akm == DPP_AKM_PSK_SAE ||
9404bc52338SCy Schubert akm == DPP_AKM_PSK_SAE_DPP;
9414bc52338SCy Schubert }
9424bc52338SCy Schubert
9434bc52338SCy Schubert
dpp_akm_sae(enum dpp_akm akm)9444bc52338SCy Schubert int dpp_akm_sae(enum dpp_akm akm)
9454bc52338SCy Schubert {
9464bc52338SCy Schubert return akm == DPP_AKM_SAE || akm == DPP_AKM_PSK_SAE ||
9474bc52338SCy Schubert akm == DPP_AKM_SAE_DPP || akm == DPP_AKM_PSK_SAE_DPP;
9484bc52338SCy Schubert }
9494bc52338SCy Schubert
9504bc52338SCy Schubert
dpp_akm_legacy(enum dpp_akm akm)9514bc52338SCy Schubert int dpp_akm_legacy(enum dpp_akm akm)
9524bc52338SCy Schubert {
9534bc52338SCy Schubert return akm == DPP_AKM_PSK || akm == DPP_AKM_PSK_SAE ||
9544bc52338SCy Schubert akm == DPP_AKM_SAE;
9554bc52338SCy Schubert }
9564bc52338SCy Schubert
9574bc52338SCy Schubert
dpp_akm_dpp(enum dpp_akm akm)9584bc52338SCy Schubert int dpp_akm_dpp(enum dpp_akm akm)
9594bc52338SCy Schubert {
9604bc52338SCy Schubert return akm == DPP_AKM_DPP || akm == DPP_AKM_SAE_DPP ||
9614bc52338SCy Schubert akm == DPP_AKM_PSK_SAE_DPP;
9624bc52338SCy Schubert }
9634bc52338SCy Schubert
9644bc52338SCy Schubert
dpp_akm_ver2(enum dpp_akm akm)9654bc52338SCy Schubert int dpp_akm_ver2(enum dpp_akm akm)
9664bc52338SCy Schubert {
9674bc52338SCy Schubert return akm == DPP_AKM_SAE_DPP || akm == DPP_AKM_PSK_SAE_DPP;
9684bc52338SCy Schubert }
9694bc52338SCy Schubert
9704bc52338SCy Schubert
dpp_configuration_valid(const struct dpp_configuration * conf)9714bc52338SCy Schubert int dpp_configuration_valid(const struct dpp_configuration *conf)
9724bc52338SCy Schubert {
9734bc52338SCy Schubert if (conf->ssid_len == 0)
9744bc52338SCy Schubert return 0;
9754bc52338SCy Schubert if (dpp_akm_psk(conf->akm) && !conf->passphrase && !conf->psk_set)
9764bc52338SCy Schubert return 0;
9774bc52338SCy Schubert if (dpp_akm_sae(conf->akm) && !conf->passphrase)
9784bc52338SCy Schubert return 0;
9794bc52338SCy Schubert return 1;
9804bc52338SCy Schubert }
9814bc52338SCy Schubert
9824bc52338SCy Schubert
dpp_configuration_free(struct dpp_configuration * conf)98385732ac8SCy Schubert void dpp_configuration_free(struct dpp_configuration *conf)
98485732ac8SCy Schubert {
98585732ac8SCy Schubert if (!conf)
98685732ac8SCy Schubert return;
98785732ac8SCy Schubert str_clear_free(conf->passphrase);
98885732ac8SCy Schubert os_free(conf->group_id);
989c1d255d3SCy Schubert os_free(conf->csrattrs);
99085732ac8SCy Schubert bin_clear_free(conf, sizeof(*conf));
99185732ac8SCy Schubert }
99285732ac8SCy Schubert
99385732ac8SCy Schubert
dpp_configuration_parse_helper(struct dpp_authentication * auth,const char * cmd,int idx)994c1d255d3SCy Schubert static int dpp_configuration_parse_helper(struct dpp_authentication *auth,
995c1d255d3SCy Schubert const char *cmd, int idx)
9964bc52338SCy Schubert {
9974bc52338SCy Schubert const char *pos, *end;
9984bc52338SCy Schubert struct dpp_configuration *conf_sta = NULL, *conf_ap = NULL;
9994bc52338SCy Schubert struct dpp_configuration *conf = NULL;
1000c1d255d3SCy Schubert size_t len;
10014bc52338SCy Schubert
10024bc52338SCy Schubert pos = os_strstr(cmd, " conf=sta-");
10034bc52338SCy Schubert if (pos) {
10044bc52338SCy Schubert conf_sta = dpp_configuration_alloc(pos + 10);
10054bc52338SCy Schubert if (!conf_sta)
10064bc52338SCy Schubert goto fail;
1007c1d255d3SCy Schubert conf_sta->netrole = DPP_NETROLE_STA;
10084bc52338SCy Schubert conf = conf_sta;
10094bc52338SCy Schubert }
10104bc52338SCy Schubert
10114bc52338SCy Schubert pos = os_strstr(cmd, " conf=ap-");
10124bc52338SCy Schubert if (pos) {
10134bc52338SCy Schubert conf_ap = dpp_configuration_alloc(pos + 9);
10144bc52338SCy Schubert if (!conf_ap)
10154bc52338SCy Schubert goto fail;
1016c1d255d3SCy Schubert conf_ap->netrole = DPP_NETROLE_AP;
10174bc52338SCy Schubert conf = conf_ap;
10184bc52338SCy Schubert }
10194bc52338SCy Schubert
1020c1d255d3SCy Schubert pos = os_strstr(cmd, " conf=configurator");
1021c1d255d3SCy Schubert if (pos)
1022c1d255d3SCy Schubert auth->provision_configurator = 1;
1023c1d255d3SCy Schubert
10244bc52338SCy Schubert if (!conf)
10254bc52338SCy Schubert return 0;
10264bc52338SCy Schubert
10274bc52338SCy Schubert pos = os_strstr(cmd, " ssid=");
10284bc52338SCy Schubert if (pos) {
10294bc52338SCy Schubert pos += 6;
10304bc52338SCy Schubert end = os_strchr(pos, ' ');
10314bc52338SCy Schubert conf->ssid_len = end ? (size_t) (end - pos) : os_strlen(pos);
10324bc52338SCy Schubert conf->ssid_len /= 2;
10334bc52338SCy Schubert if (conf->ssid_len > sizeof(conf->ssid) ||
10344bc52338SCy Schubert hexstr2bin(pos, conf->ssid, conf->ssid_len) < 0)
10354bc52338SCy Schubert goto fail;
10364bc52338SCy Schubert } else {
10374bc52338SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
10384bc52338SCy Schubert /* use a default SSID for legacy testing reasons */
10394bc52338SCy Schubert os_memcpy(conf->ssid, "test", 4);
10404bc52338SCy Schubert conf->ssid_len = 4;
10414bc52338SCy Schubert #else /* CONFIG_TESTING_OPTIONS */
10424bc52338SCy Schubert goto fail;
10434bc52338SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
10444bc52338SCy Schubert }
10454bc52338SCy Schubert
1046c1d255d3SCy Schubert pos = os_strstr(cmd, " ssid_charset=");
1047c1d255d3SCy Schubert if (pos) {
1048c1d255d3SCy Schubert if (conf_ap) {
1049c1d255d3SCy Schubert wpa_printf(MSG_INFO,
1050c1d255d3SCy Schubert "DPP: ssid64 option (ssid_charset param) not allowed for AP enrollee");
1051c1d255d3SCy Schubert goto fail;
1052c1d255d3SCy Schubert }
1053c1d255d3SCy Schubert conf->ssid_charset = atoi(pos + 14);
1054c1d255d3SCy Schubert }
1055c1d255d3SCy Schubert
10564bc52338SCy Schubert pos = os_strstr(cmd, " pass=");
10574bc52338SCy Schubert if (pos) {
10584bc52338SCy Schubert size_t pass_len;
10594bc52338SCy Schubert
10604bc52338SCy Schubert pos += 6;
10614bc52338SCy Schubert end = os_strchr(pos, ' ');
10624bc52338SCy Schubert pass_len = end ? (size_t) (end - pos) : os_strlen(pos);
10634bc52338SCy Schubert pass_len /= 2;
10644bc52338SCy Schubert if (pass_len > 63 || pass_len < 8)
10654bc52338SCy Schubert goto fail;
10664bc52338SCy Schubert conf->passphrase = os_zalloc(pass_len + 1);
10674bc52338SCy Schubert if (!conf->passphrase ||
10684bc52338SCy Schubert hexstr2bin(pos, (u8 *) conf->passphrase, pass_len) < 0)
10694bc52338SCy Schubert goto fail;
10704bc52338SCy Schubert }
10714bc52338SCy Schubert
10724bc52338SCy Schubert pos = os_strstr(cmd, " psk=");
10734bc52338SCy Schubert if (pos) {
10744bc52338SCy Schubert pos += 5;
10754bc52338SCy Schubert if (hexstr2bin(pos, conf->psk, PMK_LEN) < 0)
10764bc52338SCy Schubert goto fail;
10774bc52338SCy Schubert conf->psk_set = 1;
10784bc52338SCy Schubert }
10794bc52338SCy Schubert
10804bc52338SCy Schubert pos = os_strstr(cmd, " group_id=");
10814bc52338SCy Schubert if (pos) {
10824bc52338SCy Schubert size_t group_id_len;
10834bc52338SCy Schubert
10844bc52338SCy Schubert pos += 10;
10854bc52338SCy Schubert end = os_strchr(pos, ' ');
10864bc52338SCy Schubert group_id_len = end ? (size_t) (end - pos) : os_strlen(pos);
10874bc52338SCy Schubert conf->group_id = os_malloc(group_id_len + 1);
10884bc52338SCy Schubert if (!conf->group_id)
10894bc52338SCy Schubert goto fail;
10904bc52338SCy Schubert os_memcpy(conf->group_id, pos, group_id_len);
10914bc52338SCy Schubert conf->group_id[group_id_len] = '\0';
10924bc52338SCy Schubert }
10934bc52338SCy Schubert
10944bc52338SCy Schubert pos = os_strstr(cmd, " expiry=");
10954bc52338SCy Schubert if (pos) {
10964bc52338SCy Schubert long int val;
10974bc52338SCy Schubert
10984bc52338SCy Schubert pos += 8;
10994bc52338SCy Schubert val = strtol(pos, NULL, 0);
11004bc52338SCy Schubert if (val <= 0)
11014bc52338SCy Schubert goto fail;
11024bc52338SCy Schubert conf->netaccesskey_expiry = val;
11034bc52338SCy Schubert }
11044bc52338SCy Schubert
1105c1d255d3SCy Schubert pos = os_strstr(cmd, " csrattrs=");
1106c1d255d3SCy Schubert if (pos) {
1107c1d255d3SCy Schubert pos += 10;
1108c1d255d3SCy Schubert end = os_strchr(pos, ' ');
1109c1d255d3SCy Schubert len = end ? (size_t) (end - pos) : os_strlen(pos);
1110c1d255d3SCy Schubert conf->csrattrs = os_zalloc(len + 1);
1111c1d255d3SCy Schubert if (!conf->csrattrs)
1112c1d255d3SCy Schubert goto fail;
1113c1d255d3SCy Schubert os_memcpy(conf->csrattrs, pos, len);
1114c1d255d3SCy Schubert }
1115c1d255d3SCy Schubert
11164bc52338SCy Schubert if (!dpp_configuration_valid(conf))
11174bc52338SCy Schubert goto fail;
11184bc52338SCy Schubert
1119c1d255d3SCy Schubert if (idx == 0) {
11204bc52338SCy Schubert auth->conf_sta = conf_sta;
11214bc52338SCy Schubert auth->conf_ap = conf_ap;
1122c1d255d3SCy Schubert } else if (idx == 1) {
1123c1d255d3SCy Schubert auth->conf2_sta = conf_sta;
1124c1d255d3SCy Schubert auth->conf2_ap = conf_ap;
1125c1d255d3SCy Schubert } else {
1126c1d255d3SCy Schubert goto fail;
1127c1d255d3SCy Schubert }
11284bc52338SCy Schubert return 0;
11294bc52338SCy Schubert
11304bc52338SCy Schubert fail:
11314bc52338SCy Schubert dpp_configuration_free(conf_sta);
11324bc52338SCy Schubert dpp_configuration_free(conf_ap);
11334bc52338SCy Schubert return -1;
11344bc52338SCy Schubert }
11354bc52338SCy Schubert
11364bc52338SCy Schubert
dpp_configuration_parse(struct dpp_authentication * auth,const char * cmd)1137c1d255d3SCy Schubert static int dpp_configuration_parse(struct dpp_authentication *auth,
1138c1d255d3SCy Schubert const char *cmd)
1139c1d255d3SCy Schubert {
1140c1d255d3SCy Schubert const char *pos;
1141c1d255d3SCy Schubert char *tmp;
1142c1d255d3SCy Schubert size_t len;
1143c1d255d3SCy Schubert int res;
1144c1d255d3SCy Schubert
1145c1d255d3SCy Schubert pos = os_strstr(cmd, " @CONF-OBJ-SEP@ ");
1146c1d255d3SCy Schubert if (!pos)
1147c1d255d3SCy Schubert return dpp_configuration_parse_helper(auth, cmd, 0);
1148c1d255d3SCy Schubert
1149c1d255d3SCy Schubert len = pos - cmd;
1150c1d255d3SCy Schubert tmp = os_malloc(len + 1);
1151c1d255d3SCy Schubert if (!tmp)
1152c1d255d3SCy Schubert goto fail;
1153c1d255d3SCy Schubert os_memcpy(tmp, cmd, len);
1154c1d255d3SCy Schubert tmp[len] = '\0';
1155c1d255d3SCy Schubert res = dpp_configuration_parse_helper(auth, cmd, 0);
1156c1d255d3SCy Schubert str_clear_free(tmp);
1157c1d255d3SCy Schubert if (res)
1158c1d255d3SCy Schubert goto fail;
1159c1d255d3SCy Schubert res = dpp_configuration_parse_helper(auth, cmd + len, 1);
1160c1d255d3SCy Schubert if (res)
1161c1d255d3SCy Schubert goto fail;
1162c1d255d3SCy Schubert return 0;
1163c1d255d3SCy Schubert fail:
1164c1d255d3SCy Schubert dpp_configuration_free(auth->conf_sta);
1165c1d255d3SCy Schubert dpp_configuration_free(auth->conf2_sta);
1166c1d255d3SCy Schubert dpp_configuration_free(auth->conf_ap);
1167c1d255d3SCy Schubert dpp_configuration_free(auth->conf2_ap);
1168c1d255d3SCy Schubert return -1;
1169c1d255d3SCy Schubert }
1170c1d255d3SCy Schubert
1171c1d255d3SCy Schubert
11724bc52338SCy Schubert static struct dpp_configurator *
dpp_configurator_get_id(struct dpp_global * dpp,unsigned int id)11734bc52338SCy Schubert dpp_configurator_get_id(struct dpp_global *dpp, unsigned int id)
11744bc52338SCy Schubert {
11754bc52338SCy Schubert struct dpp_configurator *conf;
11764bc52338SCy Schubert
11774bc52338SCy Schubert if (!dpp)
11784bc52338SCy Schubert return NULL;
11794bc52338SCy Schubert
11804bc52338SCy Schubert dl_list_for_each(conf, &dpp->configurator,
11814bc52338SCy Schubert struct dpp_configurator, list) {
11824bc52338SCy Schubert if (conf->id == id)
11834bc52338SCy Schubert return conf;
11844bc52338SCy Schubert }
11854bc52338SCy Schubert return NULL;
11864bc52338SCy Schubert }
11874bc52338SCy Schubert
11884bc52338SCy Schubert
dpp_set_configurator(struct dpp_authentication * auth,const char * cmd)1189c1d255d3SCy Schubert int dpp_set_configurator(struct dpp_authentication *auth, const char *cmd)
11904bc52338SCy Schubert {
11914bc52338SCy Schubert const char *pos;
1192c1d255d3SCy Schubert char *tmp = NULL;
1193c1d255d3SCy Schubert int ret = -1;
11944bc52338SCy Schubert
1195c1d255d3SCy Schubert if (!cmd || auth->configurator_set)
11964bc52338SCy Schubert return 0;
1197c1d255d3SCy Schubert auth->configurator_set = 1;
1198c1d255d3SCy Schubert
1199c1d255d3SCy Schubert if (cmd[0] != ' ') {
1200c1d255d3SCy Schubert size_t len;
1201c1d255d3SCy Schubert
1202c1d255d3SCy Schubert len = os_strlen(cmd);
1203c1d255d3SCy Schubert tmp = os_malloc(len + 2);
1204c1d255d3SCy Schubert if (!tmp)
1205c1d255d3SCy Schubert goto fail;
1206c1d255d3SCy Schubert tmp[0] = ' ';
1207c1d255d3SCy Schubert os_memcpy(tmp + 1, cmd, len + 1);
1208c1d255d3SCy Schubert cmd = tmp;
1209c1d255d3SCy Schubert }
12104bc52338SCy Schubert
12114bc52338SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Set configurator parameters: %s", cmd);
12124bc52338SCy Schubert
12134bc52338SCy Schubert pos = os_strstr(cmd, " configurator=");
1214c1d255d3SCy Schubert if (!auth->conf && pos) {
12154bc52338SCy Schubert pos += 14;
1216c1d255d3SCy Schubert auth->conf = dpp_configurator_get_id(auth->global, atoi(pos));
12174bc52338SCy Schubert if (!auth->conf) {
12184bc52338SCy Schubert wpa_printf(MSG_INFO,
12194bc52338SCy Schubert "DPP: Could not find the specified configurator");
1220c1d255d3SCy Schubert goto fail;
12214bc52338SCy Schubert }
12224bc52338SCy Schubert }
12234bc52338SCy Schubert
1224c1d255d3SCy Schubert pos = os_strstr(cmd, " conn_status=");
1225c1d255d3SCy Schubert if (pos) {
1226c1d255d3SCy Schubert pos += 13;
1227c1d255d3SCy Schubert auth->send_conn_status = atoi(pos);
12284bc52338SCy Schubert }
1229c1d255d3SCy Schubert
1230c1d255d3SCy Schubert pos = os_strstr(cmd, " akm_use_selector=");
1231c1d255d3SCy Schubert if (pos) {
1232c1d255d3SCy Schubert pos += 18;
1233c1d255d3SCy Schubert auth->akm_use_selector = atoi(pos);
1234c1d255d3SCy Schubert }
1235c1d255d3SCy Schubert
1236c1d255d3SCy Schubert if (dpp_configuration_parse(auth, cmd) < 0) {
1237c1d255d3SCy Schubert wpa_msg(auth->msg_ctx, MSG_INFO,
1238c1d255d3SCy Schubert "DPP: Failed to set configurator parameters");
1239c1d255d3SCy Schubert goto fail;
1240c1d255d3SCy Schubert }
1241c1d255d3SCy Schubert ret = 0;
1242c1d255d3SCy Schubert fail:
1243c1d255d3SCy Schubert os_free(tmp);
1244c1d255d3SCy Schubert return ret;
12454bc52338SCy Schubert }
12464bc52338SCy Schubert
12474bc52338SCy Schubert
dpp_auth_deinit(struct dpp_authentication * auth)124885732ac8SCy Schubert void dpp_auth_deinit(struct dpp_authentication *auth)
124985732ac8SCy Schubert {
1250c1d255d3SCy Schubert unsigned int i;
1251c1d255d3SCy Schubert
125285732ac8SCy Schubert if (!auth)
125385732ac8SCy Schubert return;
125485732ac8SCy Schubert dpp_configuration_free(auth->conf_ap);
1255c1d255d3SCy Schubert dpp_configuration_free(auth->conf2_ap);
125685732ac8SCy Schubert dpp_configuration_free(auth->conf_sta);
1257c1d255d3SCy Schubert dpp_configuration_free(auth->conf2_sta);
12584b72b91aSCy Schubert crypto_ec_key_deinit(auth->own_protocol_key);
12594b72b91aSCy Schubert crypto_ec_key_deinit(auth->peer_protocol_key);
12604b72b91aSCy Schubert crypto_ec_key_deinit(auth->reconfig_old_protocol_key);
126185732ac8SCy Schubert wpabuf_free(auth->req_msg);
126285732ac8SCy Schubert wpabuf_free(auth->resp_msg);
126385732ac8SCy Schubert wpabuf_free(auth->conf_req);
1264c1d255d3SCy Schubert wpabuf_free(auth->reconfig_req_msg);
1265c1d255d3SCy Schubert wpabuf_free(auth->reconfig_resp_msg);
1266c1d255d3SCy Schubert for (i = 0; i < auth->num_conf_obj; i++) {
1267c1d255d3SCy Schubert struct dpp_config_obj *conf = &auth->conf_obj[i];
1268c1d255d3SCy Schubert
1269c1d255d3SCy Schubert os_free(conf->connector);
1270c1d255d3SCy Schubert wpabuf_free(conf->c_sign_key);
1271c1d255d3SCy Schubert wpabuf_free(conf->certbag);
1272c1d255d3SCy Schubert wpabuf_free(conf->certs);
1273c1d255d3SCy Schubert wpabuf_free(conf->cacert);
1274c1d255d3SCy Schubert os_free(conf->server_name);
1275c1d255d3SCy Schubert wpabuf_free(conf->pp_key);
1276c1d255d3SCy Schubert }
1277c1d255d3SCy Schubert #ifdef CONFIG_DPP2
1278c1d255d3SCy Schubert dpp_free_asymmetric_key(auth->conf_key_pkg);
1279c1d255d3SCy Schubert os_free(auth->csrattrs);
1280c1d255d3SCy Schubert wpabuf_free(auth->csr);
1281c1d255d3SCy Schubert wpabuf_free(auth->priv_key);
1282c1d255d3SCy Schubert wpabuf_free(auth->cacert);
1283c1d255d3SCy Schubert wpabuf_free(auth->certbag);
1284c1d255d3SCy Schubert os_free(auth->trusted_eap_server_name);
1285c1d255d3SCy Schubert wpabuf_free(auth->conf_resp_tcp);
1286c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
128785732ac8SCy Schubert wpabuf_free(auth->net_access_key);
128885732ac8SCy Schubert dpp_bootstrap_info_free(auth->tmp_own_bi);
1289c1d255d3SCy Schubert if (auth->tmp_peer_bi) {
1290c1d255d3SCy Schubert dl_list_del(&auth->tmp_peer_bi->list);
1291c1d255d3SCy Schubert dpp_bootstrap_info_free(auth->tmp_peer_bi);
1292c1d255d3SCy Schubert }
129385732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
129485732ac8SCy Schubert os_free(auth->config_obj_override);
129585732ac8SCy Schubert os_free(auth->discovery_override);
129685732ac8SCy Schubert os_free(auth->groups_override);
129785732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
129885732ac8SCy Schubert bin_clear_free(auth, sizeof(*auth));
129985732ac8SCy Schubert }
130085732ac8SCy Schubert
130185732ac8SCy Schubert
130285732ac8SCy Schubert static struct wpabuf *
dpp_build_conf_start(struct dpp_authentication * auth,struct dpp_configuration * conf,size_t tailroom)130385732ac8SCy Schubert dpp_build_conf_start(struct dpp_authentication *auth,
130485732ac8SCy Schubert struct dpp_configuration *conf, size_t tailroom)
130585732ac8SCy Schubert {
130685732ac8SCy Schubert struct wpabuf *buf;
130785732ac8SCy Schubert
130885732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
130985732ac8SCy Schubert if (auth->discovery_override)
131085732ac8SCy Schubert tailroom += os_strlen(auth->discovery_override);
131185732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
131285732ac8SCy Schubert
131385732ac8SCy Schubert buf = wpabuf_alloc(200 + tailroom);
131485732ac8SCy Schubert if (!buf)
131585732ac8SCy Schubert return NULL;
1316c1d255d3SCy Schubert json_start_object(buf, NULL);
1317c1d255d3SCy Schubert json_add_string(buf, "wi-fi_tech", "infra");
1318c1d255d3SCy Schubert json_value_sep(buf);
131985732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
132085732ac8SCy Schubert if (auth->discovery_override) {
132185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: TESTING - discovery override: '%s'",
132285732ac8SCy Schubert auth->discovery_override);
1323c1d255d3SCy Schubert wpabuf_put_str(buf, "\"discovery\":");
132485732ac8SCy Schubert wpabuf_put_str(buf, auth->discovery_override);
1325c1d255d3SCy Schubert json_value_sep(buf);
132685732ac8SCy Schubert return buf;
132785732ac8SCy Schubert }
132885732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
1329c1d255d3SCy Schubert json_start_object(buf, "discovery");
1330c1d255d3SCy Schubert if (((!conf->ssid_charset || auth->peer_version < 2) &&
1331c1d255d3SCy Schubert json_add_string_escape(buf, "ssid", conf->ssid,
1332c1d255d3SCy Schubert conf->ssid_len) < 0) ||
1333c1d255d3SCy Schubert ((conf->ssid_charset && auth->peer_version >= 2) &&
1334c1d255d3SCy Schubert json_add_base64url(buf, "ssid64", conf->ssid,
1335c1d255d3SCy Schubert conf->ssid_len) < 0)) {
1336c1d255d3SCy Schubert wpabuf_free(buf);
1337c1d255d3SCy Schubert return NULL;
1338c1d255d3SCy Schubert }
1339c1d255d3SCy Schubert if (conf->ssid_charset > 0) {
1340c1d255d3SCy Schubert json_value_sep(buf);
1341c1d255d3SCy Schubert json_add_int(buf, "ssid_charset", conf->ssid_charset);
1342c1d255d3SCy Schubert }
1343c1d255d3SCy Schubert json_end_object(buf);
1344c1d255d3SCy Schubert json_value_sep(buf);
134585732ac8SCy Schubert
134685732ac8SCy Schubert return buf;
134785732ac8SCy Schubert }
134885732ac8SCy Schubert
134985732ac8SCy Schubert
dpp_build_jwk(struct wpabuf * buf,const char * name,struct crypto_ec_key * key,const char * kid,const struct dpp_curve_params * curve)13504b72b91aSCy Schubert int dpp_build_jwk(struct wpabuf *buf, const char *name,
13514b72b91aSCy Schubert struct crypto_ec_key *key, const char *kid,
13524b72b91aSCy Schubert const struct dpp_curve_params *curve)
135385732ac8SCy Schubert {
135485732ac8SCy Schubert struct wpabuf *pub;
135585732ac8SCy Schubert const u8 *pos;
135685732ac8SCy Schubert int ret = -1;
135785732ac8SCy Schubert
13584b72b91aSCy Schubert pub = crypto_ec_key_get_pubkey_point(key, 0);
135985732ac8SCy Schubert if (!pub)
136085732ac8SCy Schubert goto fail;
136185732ac8SCy Schubert
1362c1d255d3SCy Schubert json_start_object(buf, name);
1363c1d255d3SCy Schubert json_add_string(buf, "kty", "EC");
1364c1d255d3SCy Schubert json_value_sep(buf);
1365c1d255d3SCy Schubert json_add_string(buf, "crv", curve->jwk_crv);
1366c1d255d3SCy Schubert json_value_sep(buf);
1367c1d255d3SCy Schubert pos = wpabuf_head(pub);
1368c1d255d3SCy Schubert if (json_add_base64url(buf, "x", pos, curve->prime_len) < 0)
1369c1d255d3SCy Schubert goto fail;
1370c1d255d3SCy Schubert json_value_sep(buf);
1371c1d255d3SCy Schubert pos += curve->prime_len;
1372c1d255d3SCy Schubert if (json_add_base64url(buf, "y", pos, curve->prime_len) < 0)
1373c1d255d3SCy Schubert goto fail;
137485732ac8SCy Schubert if (kid) {
1375c1d255d3SCy Schubert json_value_sep(buf);
1376c1d255d3SCy Schubert json_add_string(buf, "kid", kid);
137785732ac8SCy Schubert }
1378c1d255d3SCy Schubert json_end_object(buf);
137985732ac8SCy Schubert ret = 0;
138085732ac8SCy Schubert fail:
138185732ac8SCy Schubert wpabuf_free(pub);
138285732ac8SCy Schubert return ret;
138385732ac8SCy Schubert }
138485732ac8SCy Schubert
138585732ac8SCy Schubert
dpp_build_legacy_cred_params(struct wpabuf * buf,struct dpp_configuration * conf)13864bc52338SCy Schubert static void dpp_build_legacy_cred_params(struct wpabuf *buf,
13874bc52338SCy Schubert struct dpp_configuration *conf)
13884bc52338SCy Schubert {
13894bc52338SCy Schubert if (conf->passphrase && os_strlen(conf->passphrase) < 64) {
1390c1d255d3SCy Schubert json_add_string_escape(buf, "pass", conf->passphrase,
13914bc52338SCy Schubert os_strlen(conf->passphrase));
13924bc52338SCy Schubert } else if (conf->psk_set) {
13934bc52338SCy Schubert char psk[2 * sizeof(conf->psk) + 1];
13944bc52338SCy Schubert
13954bc52338SCy Schubert wpa_snprintf_hex(psk, sizeof(psk),
13964bc52338SCy Schubert conf->psk, sizeof(conf->psk));
1397c1d255d3SCy Schubert json_add_string(buf, "psk_hex", psk);
1398c1d255d3SCy Schubert forced_memzero(psk, sizeof(psk));
1399c1d255d3SCy Schubert }
1400c1d255d3SCy Schubert }
1401c1d255d3SCy Schubert
1402c1d255d3SCy Schubert
dpp_netrole_str(enum dpp_netrole netrole)1403c1d255d3SCy Schubert static const char * dpp_netrole_str(enum dpp_netrole netrole)
1404c1d255d3SCy Schubert {
1405c1d255d3SCy Schubert switch (netrole) {
1406c1d255d3SCy Schubert case DPP_NETROLE_STA:
1407c1d255d3SCy Schubert return "sta";
1408c1d255d3SCy Schubert case DPP_NETROLE_AP:
1409c1d255d3SCy Schubert return "ap";
1410c1d255d3SCy Schubert case DPP_NETROLE_CONFIGURATOR:
1411c1d255d3SCy Schubert return "configurator";
1412c1d255d3SCy Schubert default:
1413c1d255d3SCy Schubert return "??";
14144bc52338SCy Schubert }
14154bc52338SCy Schubert }
14164bc52338SCy Schubert
14174bc52338SCy Schubert
141885732ac8SCy Schubert static struct wpabuf *
dpp_build_conf_obj_dpp(struct dpp_authentication * auth,struct dpp_configuration * conf)1419c1d255d3SCy Schubert dpp_build_conf_obj_dpp(struct dpp_authentication *auth,
142085732ac8SCy Schubert struct dpp_configuration *conf)
142185732ac8SCy Schubert {
142285732ac8SCy Schubert struct wpabuf *buf = NULL;
1423c1d255d3SCy Schubert char *signed_conn = NULL;
142485732ac8SCy Schubert size_t tailroom;
142585732ac8SCy Schubert const struct dpp_curve_params *curve;
142685732ac8SCy Schubert struct wpabuf *dppcon = NULL;
142785732ac8SCy Schubert size_t extra_len = 1000;
14284bc52338SCy Schubert int incl_legacy;
14294bc52338SCy Schubert enum dpp_akm akm;
1430c1d255d3SCy Schubert const char *akm_str;
143185732ac8SCy Schubert
143285732ac8SCy Schubert if (!auth->conf) {
143385732ac8SCy Schubert wpa_printf(MSG_INFO,
143485732ac8SCy Schubert "DPP: No configurator specified - cannot generate DPP config object");
143585732ac8SCy Schubert goto fail;
143685732ac8SCy Schubert }
143785732ac8SCy Schubert curve = auth->conf->curve;
143885732ac8SCy Schubert
14394bc52338SCy Schubert akm = conf->akm;
14404bc52338SCy Schubert if (dpp_akm_ver2(akm) && auth->peer_version < 2) {
14414bc52338SCy Schubert wpa_printf(MSG_DEBUG,
14424bc52338SCy Schubert "DPP: Convert DPP+legacy credential to DPP-only for peer that does not support version 2");
14434bc52338SCy Schubert akm = DPP_AKM_DPP;
14444bc52338SCy Schubert }
14454bc52338SCy Schubert
144685732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
144785732ac8SCy Schubert if (auth->groups_override)
144885732ac8SCy Schubert extra_len += os_strlen(auth->groups_override);
144985732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
145085732ac8SCy Schubert
145185732ac8SCy Schubert if (conf->group_id)
145285732ac8SCy Schubert extra_len += os_strlen(conf->group_id);
145385732ac8SCy Schubert
145485732ac8SCy Schubert /* Connector (JSON dppCon object) */
145585732ac8SCy Schubert dppcon = wpabuf_alloc(extra_len + 2 * auth->curve->prime_len * 4 / 3);
145685732ac8SCy Schubert if (!dppcon)
145785732ac8SCy Schubert goto fail;
145885732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
145985732ac8SCy Schubert if (auth->groups_override) {
146085732ac8SCy Schubert wpabuf_put_u8(dppcon, '{');
146185732ac8SCy Schubert if (auth->groups_override) {
146285732ac8SCy Schubert wpa_printf(MSG_DEBUG,
146385732ac8SCy Schubert "DPP: TESTING - groups override: '%s'",
146485732ac8SCy Schubert auth->groups_override);
146585732ac8SCy Schubert wpabuf_put_str(dppcon, "\"groups\":");
146685732ac8SCy Schubert wpabuf_put_str(dppcon, auth->groups_override);
1467c1d255d3SCy Schubert json_value_sep(dppcon);
146885732ac8SCy Schubert }
146985732ac8SCy Schubert goto skip_groups;
147085732ac8SCy Schubert }
147185732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
1472c1d255d3SCy Schubert json_start_object(dppcon, NULL);
1473c1d255d3SCy Schubert json_start_array(dppcon, "groups");
1474c1d255d3SCy Schubert json_start_object(dppcon, NULL);
1475c1d255d3SCy Schubert json_add_string(dppcon, "groupId",
147685732ac8SCy Schubert conf->group_id ? conf->group_id : "*");
1477c1d255d3SCy Schubert json_value_sep(dppcon);
1478c1d255d3SCy Schubert json_add_string(dppcon, "netRole", dpp_netrole_str(conf->netrole));
1479c1d255d3SCy Schubert json_end_object(dppcon);
1480c1d255d3SCy Schubert json_end_array(dppcon);
1481c1d255d3SCy Schubert json_value_sep(dppcon);
148285732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
148385732ac8SCy Schubert skip_groups:
148485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
1485c1d255d3SCy Schubert if (!auth->peer_protocol_key ||
1486c1d255d3SCy Schubert dpp_build_jwk(dppcon, "netAccessKey", auth->peer_protocol_key, NULL,
148785732ac8SCy Schubert auth->curve) < 0) {
148885732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to build netAccessKey JWK");
148985732ac8SCy Schubert goto fail;
149085732ac8SCy Schubert }
149185732ac8SCy Schubert if (conf->netaccesskey_expiry) {
149285732ac8SCy Schubert struct os_tm tm;
1493c1d255d3SCy Schubert char expiry[30];
149485732ac8SCy Schubert
149585732ac8SCy Schubert if (os_gmtime(conf->netaccesskey_expiry, &tm) < 0) {
149685732ac8SCy Schubert wpa_printf(MSG_DEBUG,
149785732ac8SCy Schubert "DPP: Failed to generate expiry string");
149885732ac8SCy Schubert goto fail;
149985732ac8SCy Schubert }
1500c1d255d3SCy Schubert os_snprintf(expiry, sizeof(expiry),
1501c1d255d3SCy Schubert "%04u-%02u-%02uT%02u:%02u:%02uZ",
150285732ac8SCy Schubert tm.year, tm.month, tm.day,
150385732ac8SCy Schubert tm.hour, tm.min, tm.sec);
1504c1d255d3SCy Schubert json_value_sep(dppcon);
1505c1d255d3SCy Schubert json_add_string(dppcon, "expiry", expiry);
150685732ac8SCy Schubert }
150732a95656SCy Schubert #ifdef CONFIG_DPP3
150832a95656SCy Schubert json_value_sep(dppcon);
150932a95656SCy Schubert json_add_int(dppcon, "version", auth->peer_version);
151032a95656SCy Schubert #endif /* CONFIG_DPP3 */
1511c1d255d3SCy Schubert json_end_object(dppcon);
151285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: dppCon: %s",
151385732ac8SCy Schubert (const char *) wpabuf_head(dppcon));
151485732ac8SCy Schubert
1515c1d255d3SCy Schubert signed_conn = dpp_sign_connector(auth->conf, dppcon);
1516c1d255d3SCy Schubert if (!signed_conn)
151785732ac8SCy Schubert goto fail;
151885732ac8SCy Schubert
15194bc52338SCy Schubert incl_legacy = dpp_akm_psk(akm) || dpp_akm_sae(akm);
152085732ac8SCy Schubert tailroom = 1000;
152185732ac8SCy Schubert tailroom += 2 * curve->prime_len * 4 / 3 + os_strlen(auth->conf->kid);
1522c1d255d3SCy Schubert tailroom += os_strlen(signed_conn);
15234bc52338SCy Schubert if (incl_legacy)
15244bc52338SCy Schubert tailroom += 1000;
1525c1d255d3SCy Schubert if (akm == DPP_AKM_DOT1X) {
1526c1d255d3SCy Schubert if (auth->certbag)
1527c1d255d3SCy Schubert tailroom += 2 * wpabuf_len(auth->certbag);
1528c1d255d3SCy Schubert if (auth->cacert)
1529c1d255d3SCy Schubert tailroom += 2 * wpabuf_len(auth->cacert);
1530c1d255d3SCy Schubert if (auth->trusted_eap_server_name)
1531c1d255d3SCy Schubert tailroom += os_strlen(auth->trusted_eap_server_name);
1532c1d255d3SCy Schubert tailroom += 1000;
1533c1d255d3SCy Schubert }
153485732ac8SCy Schubert buf = dpp_build_conf_start(auth, conf, tailroom);
153585732ac8SCy Schubert if (!buf)
153685732ac8SCy Schubert goto fail;
153785732ac8SCy Schubert
1538c1d255d3SCy Schubert if (auth->akm_use_selector && dpp_akm_ver2(akm))
1539c1d255d3SCy Schubert akm_str = dpp_akm_selector_str(akm);
1540c1d255d3SCy Schubert else
1541c1d255d3SCy Schubert akm_str = dpp_akm_str(akm);
1542c1d255d3SCy Schubert json_start_object(buf, "cred");
1543c1d255d3SCy Schubert json_add_string(buf, "akm", akm_str);
1544c1d255d3SCy Schubert json_value_sep(buf);
15454bc52338SCy Schubert if (incl_legacy) {
15464bc52338SCy Schubert dpp_build_legacy_cred_params(buf, conf);
1547c1d255d3SCy Schubert json_value_sep(buf);
1548c1d255d3SCy Schubert }
1549c1d255d3SCy Schubert if (akm == DPP_AKM_DOT1X) {
1550c1d255d3SCy Schubert json_start_object(buf, "entCreds");
1551c1d255d3SCy Schubert if (!auth->certbag)
1552c1d255d3SCy Schubert goto fail;
1553c1d255d3SCy Schubert json_add_base64(buf, "certBag", wpabuf_head(auth->certbag),
1554c1d255d3SCy Schubert wpabuf_len(auth->certbag));
1555c1d255d3SCy Schubert if (auth->cacert) {
1556c1d255d3SCy Schubert json_value_sep(buf);
1557c1d255d3SCy Schubert json_add_base64(buf, "caCert",
1558c1d255d3SCy Schubert wpabuf_head(auth->cacert),
1559c1d255d3SCy Schubert wpabuf_len(auth->cacert));
1560c1d255d3SCy Schubert }
1561c1d255d3SCy Schubert if (auth->trusted_eap_server_name) {
1562c1d255d3SCy Schubert json_value_sep(buf);
1563c1d255d3SCy Schubert json_add_string(buf, "trustedEapServerName",
1564c1d255d3SCy Schubert auth->trusted_eap_server_name);
1565c1d255d3SCy Schubert }
1566c1d255d3SCy Schubert json_value_sep(buf);
1567c1d255d3SCy Schubert json_start_array(buf, "eapMethods");
1568c1d255d3SCy Schubert wpabuf_printf(buf, "%d", EAP_TYPE_TLS);
1569c1d255d3SCy Schubert json_end_array(buf);
1570c1d255d3SCy Schubert json_end_object(buf);
1571c1d255d3SCy Schubert json_value_sep(buf);
15724bc52338SCy Schubert }
15734bc52338SCy Schubert wpabuf_put_str(buf, "\"signedConnector\":\"");
1574c1d255d3SCy Schubert wpabuf_put_str(buf, signed_conn);
1575c1d255d3SCy Schubert wpabuf_put_str(buf, "\"");
1576c1d255d3SCy Schubert json_value_sep(buf);
157785732ac8SCy Schubert if (dpp_build_jwk(buf, "csign", auth->conf->csign, auth->conf->kid,
157885732ac8SCy Schubert curve) < 0) {
157985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to build csign JWK");
158085732ac8SCy Schubert goto fail;
158185732ac8SCy Schubert }
1582c1d255d3SCy Schubert #ifdef CONFIG_DPP2
1583c1d255d3SCy Schubert if (auth->peer_version >= 2 && auth->conf->pp_key) {
1584c1d255d3SCy Schubert json_value_sep(buf);
1585c1d255d3SCy Schubert if (dpp_build_jwk(buf, "ppKey", auth->conf->pp_key, NULL,
1586c1d255d3SCy Schubert curve) < 0) {
1587c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to build ppKey JWK");
1588c1d255d3SCy Schubert goto fail;
1589c1d255d3SCy Schubert }
1590c1d255d3SCy Schubert }
1591c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
159285732ac8SCy Schubert
1593c1d255d3SCy Schubert json_end_object(buf);
1594c1d255d3SCy Schubert json_end_object(buf);
159585732ac8SCy Schubert
159685732ac8SCy Schubert wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object",
159785732ac8SCy Schubert wpabuf_head(buf), wpabuf_len(buf));
159885732ac8SCy Schubert
159985732ac8SCy Schubert out:
1600c1d255d3SCy Schubert os_free(signed_conn);
160185732ac8SCy Schubert wpabuf_free(dppcon);
160285732ac8SCy Schubert return buf;
160385732ac8SCy Schubert fail:
160485732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to build configuration object");
160585732ac8SCy Schubert wpabuf_free(buf);
160685732ac8SCy Schubert buf = NULL;
160785732ac8SCy Schubert goto out;
160885732ac8SCy Schubert }
160985732ac8SCy Schubert
161085732ac8SCy Schubert
161185732ac8SCy Schubert static struct wpabuf *
dpp_build_conf_obj_legacy(struct dpp_authentication * auth,struct dpp_configuration * conf)1612c1d255d3SCy Schubert dpp_build_conf_obj_legacy(struct dpp_authentication *auth,
161385732ac8SCy Schubert struct dpp_configuration *conf)
161485732ac8SCy Schubert {
161585732ac8SCy Schubert struct wpabuf *buf;
1616c1d255d3SCy Schubert const char *akm_str;
161785732ac8SCy Schubert
161885732ac8SCy Schubert buf = dpp_build_conf_start(auth, conf, 1000);
161985732ac8SCy Schubert if (!buf)
162085732ac8SCy Schubert return NULL;
162185732ac8SCy Schubert
1622c1d255d3SCy Schubert if (auth->akm_use_selector && dpp_akm_ver2(conf->akm))
1623c1d255d3SCy Schubert akm_str = dpp_akm_selector_str(conf->akm);
1624c1d255d3SCy Schubert else
1625c1d255d3SCy Schubert akm_str = dpp_akm_str(conf->akm);
1626c1d255d3SCy Schubert json_start_object(buf, "cred");
1627c1d255d3SCy Schubert json_add_string(buf, "akm", akm_str);
1628c1d255d3SCy Schubert json_value_sep(buf);
16294bc52338SCy Schubert dpp_build_legacy_cred_params(buf, conf);
1630c1d255d3SCy Schubert json_end_object(buf);
1631c1d255d3SCy Schubert json_end_object(buf);
163285732ac8SCy Schubert
163385732ac8SCy Schubert wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object (legacy)",
163485732ac8SCy Schubert wpabuf_head(buf), wpabuf_len(buf));
163585732ac8SCy Schubert
163685732ac8SCy Schubert return buf;
163785732ac8SCy Schubert }
163885732ac8SCy Schubert
163985732ac8SCy Schubert
164085732ac8SCy Schubert static struct wpabuf *
dpp_build_conf_obj(struct dpp_authentication * auth,enum dpp_netrole netrole,int idx,bool cert_req)1641c1d255d3SCy Schubert dpp_build_conf_obj(struct dpp_authentication *auth, enum dpp_netrole netrole,
1642c1d255d3SCy Schubert int idx, bool cert_req)
164385732ac8SCy Schubert {
1644c1d255d3SCy Schubert struct dpp_configuration *conf = NULL;
164585732ac8SCy Schubert
164685732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
164785732ac8SCy Schubert if (auth->config_obj_override) {
1648c1d255d3SCy Schubert if (idx != 0)
1649c1d255d3SCy Schubert return NULL;
165085732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Testing - Config Object override");
165185732ac8SCy Schubert return wpabuf_alloc_copy(auth->config_obj_override,
165285732ac8SCy Schubert os_strlen(auth->config_obj_override));
165385732ac8SCy Schubert }
165485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
165585732ac8SCy Schubert
1656c1d255d3SCy Schubert if (idx == 0) {
1657c1d255d3SCy Schubert if (netrole == DPP_NETROLE_STA)
1658c1d255d3SCy Schubert conf = auth->conf_sta;
1659c1d255d3SCy Schubert else if (netrole == DPP_NETROLE_AP)
1660c1d255d3SCy Schubert conf = auth->conf_ap;
1661c1d255d3SCy Schubert } else if (idx == 1) {
1662c1d255d3SCy Schubert if (netrole == DPP_NETROLE_STA)
1663c1d255d3SCy Schubert conf = auth->conf2_sta;
1664c1d255d3SCy Schubert else if (netrole == DPP_NETROLE_AP)
1665c1d255d3SCy Schubert conf = auth->conf2_ap;
1666c1d255d3SCy Schubert }
166785732ac8SCy Schubert if (!conf) {
1668c1d255d3SCy Schubert if (idx == 0)
166985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
167085732ac8SCy Schubert "DPP: No configuration available for Enrollee(%s) - reject configuration request",
1671c1d255d3SCy Schubert dpp_netrole_str(netrole));
167285732ac8SCy Schubert return NULL;
167385732ac8SCy Schubert }
167485732ac8SCy Schubert
1675c1d255d3SCy Schubert if (conf->akm == DPP_AKM_DOT1X) {
1676c1d255d3SCy Schubert if (!auth->conf) {
1677c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
1678c1d255d3SCy Schubert "DPP: No Configurator data available");
1679c1d255d3SCy Schubert return NULL;
1680c1d255d3SCy Schubert }
1681c1d255d3SCy Schubert if (!cert_req && !auth->certbag) {
1682c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
1683c1d255d3SCy Schubert "DPP: No certificate data available for dot1x configuration");
1684c1d255d3SCy Schubert return NULL;
1685c1d255d3SCy Schubert }
1686c1d255d3SCy Schubert return dpp_build_conf_obj_dpp(auth, conf);
1687c1d255d3SCy Schubert }
1688c1d255d3SCy Schubert if (dpp_akm_dpp(conf->akm) || (auth->peer_version >= 2 && auth->conf))
1689c1d255d3SCy Schubert return dpp_build_conf_obj_dpp(auth, conf);
1690c1d255d3SCy Schubert return dpp_build_conf_obj_legacy(auth, conf);
169185732ac8SCy Schubert }
169285732ac8SCy Schubert
169385732ac8SCy Schubert
1694c1d255d3SCy Schubert struct wpabuf *
dpp_build_conf_resp(struct dpp_authentication * auth,const u8 * e_nonce,u16 e_nonce_len,enum dpp_netrole netrole,bool cert_req)169585732ac8SCy Schubert dpp_build_conf_resp(struct dpp_authentication *auth, const u8 *e_nonce,
1696c1d255d3SCy Schubert u16 e_nonce_len, enum dpp_netrole netrole, bool cert_req)
169785732ac8SCy Schubert {
1698c1d255d3SCy Schubert struct wpabuf *conf = NULL, *conf2 = NULL, *env_data = NULL;
169985732ac8SCy Schubert size_t clear_len, attr_len;
170085732ac8SCy Schubert struct wpabuf *clear = NULL, *msg = NULL;
170185732ac8SCy Schubert u8 *wrapped;
170285732ac8SCy Schubert const u8 *addr[1];
170385732ac8SCy Schubert size_t len[1];
170485732ac8SCy Schubert enum dpp_status_error status;
170585732ac8SCy Schubert
1706c1d255d3SCy Schubert if (auth->force_conf_resp_status != DPP_STATUS_OK) {
1707c1d255d3SCy Schubert status = auth->force_conf_resp_status;
1708c1d255d3SCy Schubert goto forced_status;
170985732ac8SCy Schubert }
1710c1d255d3SCy Schubert
1711c1d255d3SCy Schubert if (netrole == DPP_NETROLE_CONFIGURATOR) {
1712c1d255d3SCy Schubert #ifdef CONFIG_DPP2
1713c1d255d3SCy Schubert env_data = dpp_build_enveloped_data(auth);
1714c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
1715c1d255d3SCy Schubert } else {
1716c1d255d3SCy Schubert conf = dpp_build_conf_obj(auth, netrole, 0, cert_req);
1717c1d255d3SCy Schubert if (conf) {
1718c1d255d3SCy Schubert wpa_hexdump_ascii(MSG_DEBUG,
1719c1d255d3SCy Schubert "DPP: configurationObject JSON",
1720c1d255d3SCy Schubert wpabuf_head(conf), wpabuf_len(conf));
1721c1d255d3SCy Schubert conf2 = dpp_build_conf_obj(auth, netrole, 1, cert_req);
1722c1d255d3SCy Schubert }
1723c1d255d3SCy Schubert }
1724c1d255d3SCy Schubert
1725c1d255d3SCy Schubert if (conf || env_data)
1726c1d255d3SCy Schubert status = DPP_STATUS_OK;
1727c1d255d3SCy Schubert else if (!cert_req && netrole == DPP_NETROLE_STA && auth->conf_sta &&
1728c1d255d3SCy Schubert auth->conf_sta->akm == DPP_AKM_DOT1X && !auth->waiting_csr)
1729c1d255d3SCy Schubert status = DPP_STATUS_CSR_NEEDED;
1730c1d255d3SCy Schubert else
1731c1d255d3SCy Schubert status = DPP_STATUS_CONFIGURE_FAILURE;
1732c1d255d3SCy Schubert forced_status:
17334bc52338SCy Schubert auth->conf_resp_status = status;
173485732ac8SCy Schubert
1735c1d255d3SCy Schubert /* { E-nonce, configurationObject[, sendConnStatus]}ke */
173685732ac8SCy Schubert clear_len = 4 + e_nonce_len;
173785732ac8SCy Schubert if (conf)
173885732ac8SCy Schubert clear_len += 4 + wpabuf_len(conf);
1739c1d255d3SCy Schubert if (conf2)
1740c1d255d3SCy Schubert clear_len += 4 + wpabuf_len(conf2);
1741c1d255d3SCy Schubert if (env_data)
1742c1d255d3SCy Schubert clear_len += 4 + wpabuf_len(env_data);
1743c1d255d3SCy Schubert if (auth->peer_version >= 2 && auth->send_conn_status &&
1744c1d255d3SCy Schubert netrole == DPP_NETROLE_STA)
1745c1d255d3SCy Schubert clear_len += 4;
1746c1d255d3SCy Schubert if (status == DPP_STATUS_CSR_NEEDED && auth->conf_sta &&
1747c1d255d3SCy Schubert auth->conf_sta->csrattrs)
1748c1d255d3SCy Schubert clear_len += 4 + os_strlen(auth->conf_sta->csrattrs);
174985732ac8SCy Schubert clear = wpabuf_alloc(clear_len);
175085732ac8SCy Schubert attr_len = 4 + 1 + 4 + clear_len + AES_BLOCK_SIZE;
175185732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
175285732ac8SCy Schubert if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP)
175385732ac8SCy Schubert attr_len += 5;
175485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
175585732ac8SCy Schubert msg = wpabuf_alloc(attr_len);
175685732ac8SCy Schubert if (!clear || !msg)
175785732ac8SCy Schubert goto fail;
175885732ac8SCy Schubert
175985732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
176085732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_RESP) {
176185732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce");
176285732ac8SCy Schubert goto skip_e_nonce;
176385732ac8SCy Schubert }
176485732ac8SCy Schubert if (dpp_test == DPP_TEST_E_NONCE_MISMATCH_CONF_RESP) {
176585732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - E-nonce mismatch");
176685732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
176785732ac8SCy Schubert wpabuf_put_le16(clear, e_nonce_len);
176885732ac8SCy Schubert wpabuf_put_data(clear, e_nonce, e_nonce_len - 1);
176985732ac8SCy Schubert wpabuf_put_u8(clear, e_nonce[e_nonce_len - 1] ^ 0x01);
177085732ac8SCy Schubert goto skip_e_nonce;
177185732ac8SCy Schubert }
177285732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_RESP) {
177385732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data");
177485732ac8SCy Schubert goto skip_wrapped_data;
177585732ac8SCy Schubert }
177685732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
177785732ac8SCy Schubert
177885732ac8SCy Schubert /* E-nonce */
177985732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
178085732ac8SCy Schubert wpabuf_put_le16(clear, e_nonce_len);
178185732ac8SCy Schubert wpabuf_put_data(clear, e_nonce, e_nonce_len);
178285732ac8SCy Schubert
178385732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
178485732ac8SCy Schubert skip_e_nonce:
178585732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_CONFIG_OBJ_CONF_RESP) {
178685732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - Config Object");
178785732ac8SCy Schubert goto skip_config_obj;
178885732ac8SCy Schubert }
178985732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
179085732ac8SCy Schubert
179185732ac8SCy Schubert if (conf) {
179285732ac8SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_CONFIG_OBJ);
179385732ac8SCy Schubert wpabuf_put_le16(clear, wpabuf_len(conf));
179485732ac8SCy Schubert wpabuf_put_buf(clear, conf);
179585732ac8SCy Schubert }
1796c1d255d3SCy Schubert if (auth->peer_version >= 2 && conf2) {
1797c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_CONFIG_OBJ);
1798c1d255d3SCy Schubert wpabuf_put_le16(clear, wpabuf_len(conf2));
1799c1d255d3SCy Schubert wpabuf_put_buf(clear, conf2);
1800c1d255d3SCy Schubert } else if (conf2) {
1801c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
1802c1d255d3SCy Schubert "DPP: Second Config Object available, but peer does not support more than one");
1803c1d255d3SCy Schubert }
1804c1d255d3SCy Schubert if (env_data) {
1805c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENVELOPED_DATA);
1806c1d255d3SCy Schubert wpabuf_put_le16(clear, wpabuf_len(env_data));
1807c1d255d3SCy Schubert wpabuf_put_buf(clear, env_data);
1808c1d255d3SCy Schubert }
1809c1d255d3SCy Schubert
1810c1d255d3SCy Schubert if (auth->peer_version >= 2 && auth->send_conn_status &&
1811c1d255d3SCy Schubert netrole == DPP_NETROLE_STA && status == DPP_STATUS_OK) {
1812c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: sendConnStatus");
1813c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_SEND_CONN_STATUS);
1814c1d255d3SCy Schubert wpabuf_put_le16(clear, 0);
1815c1d255d3SCy Schubert }
1816c1d255d3SCy Schubert
1817c1d255d3SCy Schubert if (status == DPP_STATUS_CSR_NEEDED && auth->conf_sta &&
1818c1d255d3SCy Schubert auth->conf_sta->csrattrs) {
1819c1d255d3SCy Schubert auth->waiting_csr = true;
1820c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: CSR Attributes Request");
1821c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_CSR_ATTR_REQ);
1822c1d255d3SCy Schubert wpabuf_put_le16(clear, os_strlen(auth->conf_sta->csrattrs));
1823c1d255d3SCy Schubert wpabuf_put_str(clear, auth->conf_sta->csrattrs);
1824c1d255d3SCy Schubert }
182585732ac8SCy Schubert
182685732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
182785732ac8SCy Schubert skip_config_obj:
182885732ac8SCy Schubert if (dpp_test == DPP_TEST_NO_STATUS_CONF_RESP) {
182985732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - Status");
183085732ac8SCy Schubert goto skip_status;
183185732ac8SCy Schubert }
183285732ac8SCy Schubert if (dpp_test == DPP_TEST_INVALID_STATUS_CONF_RESP) {
183385732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status");
183485732ac8SCy Schubert status = 255;
183585732ac8SCy Schubert }
183685732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
183785732ac8SCy Schubert
183885732ac8SCy Schubert /* DPP Status */
183985732ac8SCy Schubert dpp_build_attr_status(msg, status);
184085732ac8SCy Schubert
184185732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
184285732ac8SCy Schubert skip_status:
184385732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
184485732ac8SCy Schubert
184585732ac8SCy Schubert addr[0] = wpabuf_head(msg);
184685732ac8SCy Schubert len[0] = wpabuf_len(msg);
184785732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD", addr[0], len[0]);
184885732ac8SCy Schubert
184985732ac8SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);
185085732ac8SCy Schubert wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
185185732ac8SCy Schubert wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
185285732ac8SCy Schubert
185385732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear);
185485732ac8SCy Schubert if (aes_siv_encrypt(auth->ke, auth->curve->hash_len,
185585732ac8SCy Schubert wpabuf_head(clear), wpabuf_len(clear),
185685732ac8SCy Schubert 1, addr, len, wrapped) < 0)
185785732ac8SCy Schubert goto fail;
185885732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
185985732ac8SCy Schubert wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE);
186085732ac8SCy Schubert
186185732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
186285732ac8SCy Schubert if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP) {
186385732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data");
186485732ac8SCy Schubert dpp_build_attr_status(msg, DPP_STATUS_OK);
186585732ac8SCy Schubert }
186685732ac8SCy Schubert skip_wrapped_data:
186785732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
186885732ac8SCy Schubert
186985732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG,
187085732ac8SCy Schubert "DPP: Configuration Response attributes", msg);
187185732ac8SCy Schubert out:
1872c1d255d3SCy Schubert wpabuf_clear_free(conf);
1873c1d255d3SCy Schubert wpabuf_clear_free(conf2);
1874c1d255d3SCy Schubert wpabuf_clear_free(env_data);
1875c1d255d3SCy Schubert wpabuf_clear_free(clear);
187685732ac8SCy Schubert
187785732ac8SCy Schubert return msg;
187885732ac8SCy Schubert fail:
187985732ac8SCy Schubert wpabuf_free(msg);
188085732ac8SCy Schubert msg = NULL;
188185732ac8SCy Schubert goto out;
188285732ac8SCy Schubert }
188385732ac8SCy Schubert
188485732ac8SCy Schubert
188585732ac8SCy Schubert struct wpabuf *
dpp_conf_req_rx(struct dpp_authentication * auth,const u8 * attr_start,size_t attr_len)188685732ac8SCy Schubert dpp_conf_req_rx(struct dpp_authentication *auth, const u8 *attr_start,
188785732ac8SCy Schubert size_t attr_len)
188885732ac8SCy Schubert {
188985732ac8SCy Schubert const u8 *wrapped_data, *e_nonce, *config_attr;
189085732ac8SCy Schubert u16 wrapped_data_len, e_nonce_len, config_attr_len;
189185732ac8SCy Schubert u8 *unwrapped = NULL;
189285732ac8SCy Schubert size_t unwrapped_len = 0;
189385732ac8SCy Schubert struct wpabuf *resp = NULL;
189485732ac8SCy Schubert struct json_token *root = NULL, *token;
1895c1d255d3SCy Schubert enum dpp_netrole netrole;
1896c1d255d3SCy Schubert struct wpabuf *cert_req = NULL;
189785732ac8SCy Schubert
189885732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
189985732ac8SCy Schubert if (dpp_test == DPP_TEST_STOP_AT_CONF_REQ) {
190085732ac8SCy Schubert wpa_printf(MSG_INFO,
190185732ac8SCy Schubert "DPP: TESTING - stop at Config Request");
190285732ac8SCy Schubert return NULL;
190385732ac8SCy Schubert }
190485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
190585732ac8SCy Schubert
190685732ac8SCy Schubert if (dpp_check_attrs(attr_start, attr_len) < 0) {
190785732ac8SCy Schubert dpp_auth_fail(auth, "Invalid attribute in config request");
190885732ac8SCy Schubert return NULL;
190985732ac8SCy Schubert }
191085732ac8SCy Schubert
191185732ac8SCy Schubert wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,
191285732ac8SCy Schubert &wrapped_data_len);
191385732ac8SCy Schubert if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) {
191485732ac8SCy Schubert dpp_auth_fail(auth,
191585732ac8SCy Schubert "Missing or invalid required Wrapped Data attribute");
191685732ac8SCy Schubert return NULL;
191785732ac8SCy Schubert }
191885732ac8SCy Schubert
191985732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
192085732ac8SCy Schubert wrapped_data, wrapped_data_len);
192185732ac8SCy Schubert unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE;
192285732ac8SCy Schubert unwrapped = os_malloc(unwrapped_len);
192385732ac8SCy Schubert if (!unwrapped)
192485732ac8SCy Schubert return NULL;
192585732ac8SCy Schubert if (aes_siv_decrypt(auth->ke, auth->curve->hash_len,
192685732ac8SCy Schubert wrapped_data, wrapped_data_len,
192785732ac8SCy Schubert 0, NULL, NULL, unwrapped) < 0) {
192885732ac8SCy Schubert dpp_auth_fail(auth, "AES-SIV decryption failed");
192985732ac8SCy Schubert goto fail;
193085732ac8SCy Schubert }
193185732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext",
193285732ac8SCy Schubert unwrapped, unwrapped_len);
193385732ac8SCy Schubert
193485732ac8SCy Schubert if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) {
193585732ac8SCy Schubert dpp_auth_fail(auth, "Invalid attribute in unwrapped data");
193685732ac8SCy Schubert goto fail;
193785732ac8SCy Schubert }
193885732ac8SCy Schubert
193985732ac8SCy Schubert e_nonce = dpp_get_attr(unwrapped, unwrapped_len,
194085732ac8SCy Schubert DPP_ATTR_ENROLLEE_NONCE,
194185732ac8SCy Schubert &e_nonce_len);
194285732ac8SCy Schubert if (!e_nonce || e_nonce_len != auth->curve->nonce_len) {
194385732ac8SCy Schubert dpp_auth_fail(auth,
194485732ac8SCy Schubert "Missing or invalid Enrollee Nonce attribute");
194585732ac8SCy Schubert goto fail;
194685732ac8SCy Schubert }
194785732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len);
19484bc52338SCy Schubert os_memcpy(auth->e_nonce, e_nonce, e_nonce_len);
194985732ac8SCy Schubert
195085732ac8SCy Schubert config_attr = dpp_get_attr(unwrapped, unwrapped_len,
195185732ac8SCy Schubert DPP_ATTR_CONFIG_ATTR_OBJ,
195285732ac8SCy Schubert &config_attr_len);
195385732ac8SCy Schubert if (!config_attr) {
195485732ac8SCy Schubert dpp_auth_fail(auth,
195585732ac8SCy Schubert "Missing or invalid Config Attributes attribute");
195685732ac8SCy Schubert goto fail;
195785732ac8SCy Schubert }
195885732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: Config Attributes",
195985732ac8SCy Schubert config_attr, config_attr_len);
196085732ac8SCy Schubert
196185732ac8SCy Schubert root = json_parse((const char *) config_attr, config_attr_len);
196285732ac8SCy Schubert if (!root) {
196385732ac8SCy Schubert dpp_auth_fail(auth, "Could not parse Config Attributes");
196485732ac8SCy Schubert goto fail;
196585732ac8SCy Schubert }
196685732ac8SCy Schubert
196785732ac8SCy Schubert token = json_get_member(root, "name");
196885732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
196985732ac8SCy Schubert dpp_auth_fail(auth, "No Config Attributes - name");
197085732ac8SCy Schubert goto fail;
197185732ac8SCy Schubert }
197285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Enrollee name = '%s'", token->string);
197385732ac8SCy Schubert
197485732ac8SCy Schubert token = json_get_member(root, "wi-fi_tech");
197585732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
197685732ac8SCy Schubert dpp_auth_fail(auth, "No Config Attributes - wi-fi_tech");
197785732ac8SCy Schubert goto fail;
197885732ac8SCy Schubert }
197985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: wi-fi_tech = '%s'", token->string);
198085732ac8SCy Schubert if (os_strcmp(token->string, "infra") != 0) {
198185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unsupported wi-fi_tech '%s'",
198285732ac8SCy Schubert token->string);
198385732ac8SCy Schubert dpp_auth_fail(auth, "Unsupported wi-fi_tech");
198485732ac8SCy Schubert goto fail;
198585732ac8SCy Schubert }
198685732ac8SCy Schubert
198785732ac8SCy Schubert token = json_get_member(root, "netRole");
198885732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
198985732ac8SCy Schubert dpp_auth_fail(auth, "No Config Attributes - netRole");
199085732ac8SCy Schubert goto fail;
199185732ac8SCy Schubert }
199285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: netRole = '%s'", token->string);
199385732ac8SCy Schubert if (os_strcmp(token->string, "sta") == 0) {
1994c1d255d3SCy Schubert netrole = DPP_NETROLE_STA;
199585732ac8SCy Schubert } else if (os_strcmp(token->string, "ap") == 0) {
1996c1d255d3SCy Schubert netrole = DPP_NETROLE_AP;
1997c1d255d3SCy Schubert } else if (os_strcmp(token->string, "configurator") == 0) {
1998c1d255d3SCy Schubert netrole = DPP_NETROLE_CONFIGURATOR;
199985732ac8SCy Schubert } else {
200085732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unsupported netRole '%s'",
200185732ac8SCy Schubert token->string);
200285732ac8SCy Schubert dpp_auth_fail(auth, "Unsupported netRole");
200385732ac8SCy Schubert goto fail;
200485732ac8SCy Schubert }
2005c1d255d3SCy Schubert auth->e_netrole = netrole;
200685732ac8SCy Schubert
2007c1d255d3SCy Schubert token = json_get_member(root, "mudurl");
2008c1d255d3SCy Schubert if (token && token->type == JSON_STRING) {
2009c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: mudurl = '%s'", token->string);
2010c1d255d3SCy Schubert wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_MUD_URL "%s",
2011c1d255d3SCy Schubert token->string);
2012c1d255d3SCy Schubert }
2013c1d255d3SCy Schubert
2014c1d255d3SCy Schubert token = json_get_member(root, "bandSupport");
2015c1d255d3SCy Schubert if (token && token->type == JSON_ARRAY) {
2016c1d255d3SCy Schubert int *opclass = NULL;
2017c1d255d3SCy Schubert char txt[200], *pos, *end;
2018c1d255d3SCy Schubert int i, res;
2019c1d255d3SCy Schubert
2020c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: bandSupport");
2021c1d255d3SCy Schubert token = token->child;
2022c1d255d3SCy Schubert while (token) {
2023c1d255d3SCy Schubert if (token->type != JSON_NUMBER) {
2024c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
2025c1d255d3SCy Schubert "DPP: Invalid bandSupport array member type");
2026c1d255d3SCy Schubert } else {
2027c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
2028c1d255d3SCy Schubert "DPP: Supported global operating class: %d",
2029c1d255d3SCy Schubert token->number);
2030c1d255d3SCy Schubert int_array_add_unique(&opclass, token->number);
2031c1d255d3SCy Schubert }
2032c1d255d3SCy Schubert token = token->sibling;
2033c1d255d3SCy Schubert }
2034c1d255d3SCy Schubert
2035c1d255d3SCy Schubert txt[0] = '\0';
2036c1d255d3SCy Schubert pos = txt;
2037c1d255d3SCy Schubert end = txt + sizeof(txt);
2038c1d255d3SCy Schubert for (i = 0; opclass && opclass[i]; i++) {
2039c1d255d3SCy Schubert res = os_snprintf(pos, end - pos, "%s%d",
2040c1d255d3SCy Schubert pos == txt ? "" : ",", opclass[i]);
2041c1d255d3SCy Schubert if (os_snprintf_error(end - pos, res)) {
2042c1d255d3SCy Schubert *pos = '\0';
2043c1d255d3SCy Schubert break;
2044c1d255d3SCy Schubert }
2045c1d255d3SCy Schubert pos += res;
2046c1d255d3SCy Schubert }
2047c1d255d3SCy Schubert os_free(opclass);
2048c1d255d3SCy Schubert wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_BAND_SUPPORT "%s",
2049c1d255d3SCy Schubert txt);
2050c1d255d3SCy Schubert }
2051c1d255d3SCy Schubert
2052c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2053c1d255d3SCy Schubert cert_req = json_get_member_base64(root, "pkcs10");
2054c1d255d3SCy Schubert if (cert_req) {
2055c1d255d3SCy Schubert char *txt;
2056c1d255d3SCy Schubert int id;
2057c1d255d3SCy Schubert
2058c1d255d3SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: CertificateRequest", cert_req);
2059c1d255d3SCy Schubert if (dpp_validate_csr(auth, cert_req) < 0) {
2060c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: CSR is not valid");
2061c1d255d3SCy Schubert auth->force_conf_resp_status = DPP_STATUS_CSR_BAD;
2062c1d255d3SCy Schubert goto cont;
2063c1d255d3SCy Schubert }
2064c1d255d3SCy Schubert
2065c1d255d3SCy Schubert if (auth->peer_bi) {
2066c1d255d3SCy Schubert id = auth->peer_bi->id;
2067c1d255d3SCy Schubert } else if (auth->tmp_peer_bi) {
2068c1d255d3SCy Schubert id = auth->tmp_peer_bi->id;
2069c1d255d3SCy Schubert } else {
2070c1d255d3SCy Schubert struct dpp_bootstrap_info *bi;
2071c1d255d3SCy Schubert
2072c1d255d3SCy Schubert bi = os_zalloc(sizeof(*bi));
2073c1d255d3SCy Schubert if (!bi)
2074c1d255d3SCy Schubert goto fail;
2075c1d255d3SCy Schubert bi->id = dpp_next_id(auth->global);
2076c1d255d3SCy Schubert dl_list_add(&auth->global->bootstrap, &bi->list);
2077c1d255d3SCy Schubert auth->tmp_peer_bi = bi;
2078c1d255d3SCy Schubert id = bi->id;
2079c1d255d3SCy Schubert }
2080c1d255d3SCy Schubert
2081c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: CSR is valid - forward to CA/RA");
2082c1d255d3SCy Schubert txt = base64_encode_no_lf(wpabuf_head(cert_req),
2083c1d255d3SCy Schubert wpabuf_len(cert_req), NULL);
2084c1d255d3SCy Schubert if (!txt)
2085c1d255d3SCy Schubert goto fail;
2086c1d255d3SCy Schubert
2087c1d255d3SCy Schubert wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_CSR "peer=%d csr=%s",
2088c1d255d3SCy Schubert id, txt);
2089c1d255d3SCy Schubert os_free(txt);
2090c1d255d3SCy Schubert auth->waiting_csr = false;
2091c1d255d3SCy Schubert auth->waiting_cert = true;
2092c1d255d3SCy Schubert goto fail;
2093c1d255d3SCy Schubert }
2094c1d255d3SCy Schubert cont:
2095c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
2096c1d255d3SCy Schubert
2097c1d255d3SCy Schubert resp = dpp_build_conf_resp(auth, e_nonce, e_nonce_len, netrole,
2098c1d255d3SCy Schubert cert_req);
209985732ac8SCy Schubert
210085732ac8SCy Schubert fail:
2101c1d255d3SCy Schubert wpabuf_free(cert_req);
210285732ac8SCy Schubert json_free(root);
210385732ac8SCy Schubert os_free(unwrapped);
210485732ac8SCy Schubert return resp;
210585732ac8SCy Schubert }
210685732ac8SCy Schubert
210785732ac8SCy Schubert
dpp_parse_cred_legacy(struct dpp_config_obj * conf,struct json_token * cred)2108c1d255d3SCy Schubert static int dpp_parse_cred_legacy(struct dpp_config_obj *conf,
210985732ac8SCy Schubert struct json_token *cred)
211085732ac8SCy Schubert {
211185732ac8SCy Schubert struct json_token *pass, *psk_hex;
211285732ac8SCy Schubert
211385732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Legacy akm=psk credential");
211485732ac8SCy Schubert
211585732ac8SCy Schubert pass = json_get_member(cred, "pass");
211685732ac8SCy Schubert psk_hex = json_get_member(cred, "psk_hex");
211785732ac8SCy Schubert
211885732ac8SCy Schubert if (pass && pass->type == JSON_STRING) {
211985732ac8SCy Schubert size_t len = os_strlen(pass->string);
212085732ac8SCy Schubert
212185732ac8SCy Schubert wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Legacy passphrase",
212285732ac8SCy Schubert pass->string, len);
212385732ac8SCy Schubert if (len < 8 || len > 63)
212485732ac8SCy Schubert return -1;
2125c1d255d3SCy Schubert os_strlcpy(conf->passphrase, pass->string,
2126c1d255d3SCy Schubert sizeof(conf->passphrase));
212785732ac8SCy Schubert } else if (psk_hex && psk_hex->type == JSON_STRING) {
2128c1d255d3SCy Schubert if (dpp_akm_sae(conf->akm) && !dpp_akm_psk(conf->akm)) {
212985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
213085732ac8SCy Schubert "DPP: Unexpected psk_hex with akm=sae");
213185732ac8SCy Schubert return -1;
213285732ac8SCy Schubert }
213385732ac8SCy Schubert if (os_strlen(psk_hex->string) != PMK_LEN * 2 ||
2134c1d255d3SCy Schubert hexstr2bin(psk_hex->string, conf->psk, PMK_LEN) < 0) {
213585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Invalid psk_hex encoding");
213685732ac8SCy Schubert return -1;
213785732ac8SCy Schubert }
213885732ac8SCy Schubert wpa_hexdump_key(MSG_DEBUG, "DPP: Legacy PSK",
2139c1d255d3SCy Schubert conf->psk, PMK_LEN);
2140c1d255d3SCy Schubert conf->psk_set = 1;
214185732ac8SCy Schubert } else {
214285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No pass or psk_hex strings found");
214385732ac8SCy Schubert return -1;
214485732ac8SCy Schubert }
214585732ac8SCy Schubert
2146c1d255d3SCy Schubert if (dpp_akm_sae(conf->akm) && !conf->passphrase[0]) {
214785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No pass for sae found");
214885732ac8SCy Schubert return -1;
214985732ac8SCy Schubert }
215085732ac8SCy Schubert
215185732ac8SCy Schubert return 0;
215285732ac8SCy Schubert }
215385732ac8SCy Schubert
215485732ac8SCy Schubert
dpp_parse_jwk(struct json_token * jwk,const struct dpp_curve_params ** key_curve)21554b72b91aSCy Schubert struct crypto_ec_key * dpp_parse_jwk(struct json_token *jwk,
215685732ac8SCy Schubert const struct dpp_curve_params **key_curve)
215785732ac8SCy Schubert {
215885732ac8SCy Schubert struct json_token *token;
215985732ac8SCy Schubert const struct dpp_curve_params *curve;
216085732ac8SCy Schubert struct wpabuf *x = NULL, *y = NULL;
21614b72b91aSCy Schubert struct crypto_ec_key *key = NULL;
216285732ac8SCy Schubert
216385732ac8SCy Schubert token = json_get_member(jwk, "kty");
216485732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
216585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No kty in JWK");
216685732ac8SCy Schubert goto fail;
216785732ac8SCy Schubert }
216885732ac8SCy Schubert if (os_strcmp(token->string, "EC") != 0) {
216985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unexpected JWK kty '%s'",
217085732ac8SCy Schubert token->string);
217185732ac8SCy Schubert goto fail;
217285732ac8SCy Schubert }
217385732ac8SCy Schubert
217485732ac8SCy Schubert token = json_get_member(jwk, "crv");
217585732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
217685732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No crv in JWK");
217785732ac8SCy Schubert goto fail;
217885732ac8SCy Schubert }
217985732ac8SCy Schubert curve = dpp_get_curve_jwk_crv(token->string);
218085732ac8SCy Schubert if (!curve) {
218185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unsupported JWK crv '%s'",
218285732ac8SCy Schubert token->string);
218385732ac8SCy Schubert goto fail;
218485732ac8SCy Schubert }
218585732ac8SCy Schubert
218685732ac8SCy Schubert x = json_get_member_base64url(jwk, "x");
218785732ac8SCy Schubert if (!x) {
218885732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No x in JWK");
218985732ac8SCy Schubert goto fail;
219085732ac8SCy Schubert }
219185732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK x", x);
219285732ac8SCy Schubert if (wpabuf_len(x) != curve->prime_len) {
219385732ac8SCy Schubert wpa_printf(MSG_DEBUG,
219485732ac8SCy Schubert "DPP: Unexpected JWK x length %u (expected %u for curve %s)",
219585732ac8SCy Schubert (unsigned int) wpabuf_len(x),
219685732ac8SCy Schubert (unsigned int) curve->prime_len, curve->name);
219785732ac8SCy Schubert goto fail;
219885732ac8SCy Schubert }
219985732ac8SCy Schubert
220085732ac8SCy Schubert y = json_get_member_base64url(jwk, "y");
220185732ac8SCy Schubert if (!y) {
220285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No y in JWK");
220385732ac8SCy Schubert goto fail;
220485732ac8SCy Schubert }
220585732ac8SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK y", y);
220685732ac8SCy Schubert if (wpabuf_len(y) != curve->prime_len) {
220785732ac8SCy Schubert wpa_printf(MSG_DEBUG,
220885732ac8SCy Schubert "DPP: Unexpected JWK y length %u (expected %u for curve %s)",
220985732ac8SCy Schubert (unsigned int) wpabuf_len(y),
221085732ac8SCy Schubert (unsigned int) curve->prime_len, curve->name);
221185732ac8SCy Schubert goto fail;
221285732ac8SCy Schubert }
221385732ac8SCy Schubert
22144b72b91aSCy Schubert key = crypto_ec_key_set_pub(curve->ike_group, wpabuf_head(x),
22154b72b91aSCy Schubert wpabuf_head(y), wpabuf_len(x));
22164b72b91aSCy Schubert if (!key)
221785732ac8SCy Schubert goto fail;
221885732ac8SCy Schubert
221985732ac8SCy Schubert *key_curve = curve;
222085732ac8SCy Schubert
222185732ac8SCy Schubert fail:
222285732ac8SCy Schubert wpabuf_free(x);
222385732ac8SCy Schubert wpabuf_free(y);
222485732ac8SCy Schubert
22254b72b91aSCy Schubert return key;
222685732ac8SCy Schubert }
222785732ac8SCy Schubert
222885732ac8SCy Schubert
dpp_key_expired(const char * timestamp,os_time_t * expiry)222985732ac8SCy Schubert int dpp_key_expired(const char *timestamp, os_time_t *expiry)
223085732ac8SCy Schubert {
223185732ac8SCy Schubert struct os_time now;
223285732ac8SCy Schubert unsigned int year, month, day, hour, min, sec;
223385732ac8SCy Schubert os_time_t utime;
223485732ac8SCy Schubert const char *pos;
223585732ac8SCy Schubert
223685732ac8SCy Schubert /* ISO 8601 date and time:
223785732ac8SCy Schubert * <date>T<time>
223885732ac8SCy Schubert * YYYY-MM-DDTHH:MM:SSZ
223985732ac8SCy Schubert * YYYY-MM-DDTHH:MM:SS+03:00
224085732ac8SCy Schubert */
224185732ac8SCy Schubert if (os_strlen(timestamp) < 19) {
224285732ac8SCy Schubert wpa_printf(MSG_DEBUG,
224385732ac8SCy Schubert "DPP: Too short timestamp - assume expired key");
224485732ac8SCy Schubert return 1;
224585732ac8SCy Schubert }
224685732ac8SCy Schubert if (sscanf(timestamp, "%04u-%02u-%02uT%02u:%02u:%02u",
224785732ac8SCy Schubert &year, &month, &day, &hour, &min, &sec) != 6) {
224885732ac8SCy Schubert wpa_printf(MSG_DEBUG,
224985732ac8SCy Schubert "DPP: Failed to parse expiration day - assume expired key");
225085732ac8SCy Schubert return 1;
225185732ac8SCy Schubert }
225285732ac8SCy Schubert
225385732ac8SCy Schubert if (os_mktime(year, month, day, hour, min, sec, &utime) < 0) {
225485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
225585732ac8SCy Schubert "DPP: Invalid date/time information - assume expired key");
225685732ac8SCy Schubert return 1;
225785732ac8SCy Schubert }
225885732ac8SCy Schubert
225985732ac8SCy Schubert pos = timestamp + 19;
226085732ac8SCy Schubert if (*pos == 'Z' || *pos == '\0') {
226185732ac8SCy Schubert /* In UTC - no need to adjust */
226285732ac8SCy Schubert } else if (*pos == '-' || *pos == '+') {
226385732ac8SCy Schubert int items;
226485732ac8SCy Schubert
226585732ac8SCy Schubert /* Adjust local time to UTC */
226685732ac8SCy Schubert items = sscanf(pos + 1, "%02u:%02u", &hour, &min);
226785732ac8SCy Schubert if (items < 1) {
226885732ac8SCy Schubert wpa_printf(MSG_DEBUG,
226985732ac8SCy Schubert "DPP: Invalid time zone designator (%s) - assume expired key",
227085732ac8SCy Schubert pos);
227185732ac8SCy Schubert return 1;
227285732ac8SCy Schubert }
227385732ac8SCy Schubert if (*pos == '-')
227485732ac8SCy Schubert utime += 3600 * hour;
227585732ac8SCy Schubert if (*pos == '+')
227685732ac8SCy Schubert utime -= 3600 * hour;
227785732ac8SCy Schubert if (items > 1) {
227885732ac8SCy Schubert if (*pos == '-')
227985732ac8SCy Schubert utime += 60 * min;
228085732ac8SCy Schubert if (*pos == '+')
228185732ac8SCy Schubert utime -= 60 * min;
228285732ac8SCy Schubert }
228385732ac8SCy Schubert } else {
228485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
228585732ac8SCy Schubert "DPP: Invalid time zone designator (%s) - assume expired key",
228685732ac8SCy Schubert pos);
228785732ac8SCy Schubert return 1;
228885732ac8SCy Schubert }
228985732ac8SCy Schubert if (expiry)
229085732ac8SCy Schubert *expiry = utime;
229185732ac8SCy Schubert
229285732ac8SCy Schubert if (os_get_time(&now) < 0) {
229385732ac8SCy Schubert wpa_printf(MSG_DEBUG,
229485732ac8SCy Schubert "DPP: Cannot get current time - assume expired key");
229585732ac8SCy Schubert return 1;
229685732ac8SCy Schubert }
229785732ac8SCy Schubert
229885732ac8SCy Schubert if (now.sec > utime) {
229985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Key has expired (%lu < %lu)",
230085732ac8SCy Schubert utime, now.sec);
230185732ac8SCy Schubert return 1;
230285732ac8SCy Schubert }
230385732ac8SCy Schubert
230485732ac8SCy Schubert return 0;
230585732ac8SCy Schubert }
230685732ac8SCy Schubert
230785732ac8SCy Schubert
dpp_parse_connector(struct dpp_authentication * auth,struct dpp_config_obj * conf,const unsigned char * payload,u16 payload_len)230885732ac8SCy Schubert static int dpp_parse_connector(struct dpp_authentication *auth,
2309c1d255d3SCy Schubert struct dpp_config_obj *conf,
231085732ac8SCy Schubert const unsigned char *payload,
231185732ac8SCy Schubert u16 payload_len)
231285732ac8SCy Schubert {
231385732ac8SCy Schubert struct json_token *root, *groups, *netkey, *token;
231485732ac8SCy Schubert int ret = -1;
23154b72b91aSCy Schubert struct crypto_ec_key *key = NULL;
231685732ac8SCy Schubert const struct dpp_curve_params *curve;
231785732ac8SCy Schubert unsigned int rules = 0;
231885732ac8SCy Schubert
231985732ac8SCy Schubert root = json_parse((const char *) payload, payload_len);
232085732ac8SCy Schubert if (!root) {
232185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: JSON parsing of connector failed");
232285732ac8SCy Schubert goto fail;
232385732ac8SCy Schubert }
232485732ac8SCy Schubert
232585732ac8SCy Schubert groups = json_get_member(root, "groups");
232685732ac8SCy Schubert if (!groups || groups->type != JSON_ARRAY) {
232785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No groups array found");
232885732ac8SCy Schubert goto skip_groups;
232985732ac8SCy Schubert }
233085732ac8SCy Schubert for (token = groups->child; token; token = token->sibling) {
233185732ac8SCy Schubert struct json_token *id, *role;
233285732ac8SCy Schubert
233385732ac8SCy Schubert id = json_get_member(token, "groupId");
233485732ac8SCy Schubert if (!id || id->type != JSON_STRING) {
233585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Missing groupId string");
233685732ac8SCy Schubert goto fail;
233785732ac8SCy Schubert }
233885732ac8SCy Schubert
233985732ac8SCy Schubert role = json_get_member(token, "netRole");
234085732ac8SCy Schubert if (!role || role->type != JSON_STRING) {
234185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Missing netRole string");
234285732ac8SCy Schubert goto fail;
234385732ac8SCy Schubert }
234485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
234585732ac8SCy Schubert "DPP: connector group: groupId='%s' netRole='%s'",
234685732ac8SCy Schubert id->string, role->string);
234785732ac8SCy Schubert rules++;
234885732ac8SCy Schubert }
234985732ac8SCy Schubert skip_groups:
235085732ac8SCy Schubert
235185732ac8SCy Schubert if (!rules) {
235285732ac8SCy Schubert wpa_printf(MSG_DEBUG,
235385732ac8SCy Schubert "DPP: Connector includes no groups");
235485732ac8SCy Schubert goto fail;
235585732ac8SCy Schubert }
235685732ac8SCy Schubert
235785732ac8SCy Schubert token = json_get_member(root, "expiry");
235885732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
235985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
236085732ac8SCy Schubert "DPP: No expiry string found - connector does not expire");
236185732ac8SCy Schubert } else {
236285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: expiry = %s", token->string);
236385732ac8SCy Schubert if (dpp_key_expired(token->string,
236485732ac8SCy Schubert &auth->net_access_key_expiry)) {
236585732ac8SCy Schubert wpa_printf(MSG_DEBUG,
236685732ac8SCy Schubert "DPP: Connector (netAccessKey) has expired");
236785732ac8SCy Schubert goto fail;
236885732ac8SCy Schubert }
236985732ac8SCy Schubert }
237085732ac8SCy Schubert
237185732ac8SCy Schubert netkey = json_get_member(root, "netAccessKey");
237285732ac8SCy Schubert if (!netkey || netkey->type != JSON_OBJECT) {
237385732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No netAccessKey object found");
237485732ac8SCy Schubert goto fail;
237585732ac8SCy Schubert }
237685732ac8SCy Schubert
237785732ac8SCy Schubert key = dpp_parse_jwk(netkey, &curve);
237885732ac8SCy Schubert if (!key)
237985732ac8SCy Schubert goto fail;
238085732ac8SCy Schubert dpp_debug_print_key("DPP: Received netAccessKey", key);
238185732ac8SCy Schubert
23824b72b91aSCy Schubert if (crypto_ec_key_cmp(key, auth->own_protocol_key)) {
238385732ac8SCy Schubert wpa_printf(MSG_DEBUG,
238485732ac8SCy Schubert "DPP: netAccessKey in connector does not match own protocol key");
238585732ac8SCy Schubert #ifdef CONFIG_TESTING_OPTIONS
238685732ac8SCy Schubert if (auth->ignore_netaccesskey_mismatch) {
238785732ac8SCy Schubert wpa_printf(MSG_DEBUG,
238885732ac8SCy Schubert "DPP: TESTING - skip netAccessKey mismatch");
238985732ac8SCy Schubert } else {
239085732ac8SCy Schubert goto fail;
239185732ac8SCy Schubert }
239285732ac8SCy Schubert #else /* CONFIG_TESTING_OPTIONS */
239385732ac8SCy Schubert goto fail;
239485732ac8SCy Schubert #endif /* CONFIG_TESTING_OPTIONS */
239585732ac8SCy Schubert }
239685732ac8SCy Schubert
239785732ac8SCy Schubert ret = 0;
239885732ac8SCy Schubert fail:
23994b72b91aSCy Schubert crypto_ec_key_deinit(key);
240085732ac8SCy Schubert json_free(root);
240185732ac8SCy Schubert return ret;
240285732ac8SCy Schubert }
240385732ac8SCy Schubert
240485732ac8SCy Schubert
dpp_copy_csign(struct dpp_config_obj * conf,struct crypto_ec_key * csign)24054b72b91aSCy Schubert static void dpp_copy_csign(struct dpp_config_obj *conf,
24064b72b91aSCy Schubert struct crypto_ec_key *csign)
240785732ac8SCy Schubert {
24084b72b91aSCy Schubert struct wpabuf *c_sign_key;
240985732ac8SCy Schubert
24104b72b91aSCy Schubert c_sign_key = crypto_ec_key_get_subject_public_key(csign);
24114b72b91aSCy Schubert if (!c_sign_key)
241285732ac8SCy Schubert return;
24134b72b91aSCy Schubert
2414c1d255d3SCy Schubert wpabuf_free(conf->c_sign_key);
24154b72b91aSCy Schubert conf->c_sign_key = c_sign_key;
241685732ac8SCy Schubert }
241785732ac8SCy Schubert
241885732ac8SCy Schubert
dpp_copy_ppkey(struct dpp_config_obj * conf,struct crypto_ec_key * ppkey)24194b72b91aSCy Schubert static void dpp_copy_ppkey(struct dpp_config_obj *conf,
24204b72b91aSCy Schubert struct crypto_ec_key *ppkey)
2421c1d255d3SCy Schubert {
24224b72b91aSCy Schubert struct wpabuf *pp_key;
2423c1d255d3SCy Schubert
24244b72b91aSCy Schubert pp_key = crypto_ec_key_get_subject_public_key(ppkey);
24254b72b91aSCy Schubert if (!pp_key)
2426c1d255d3SCy Schubert return;
24274b72b91aSCy Schubert
2428c1d255d3SCy Schubert wpabuf_free(conf->pp_key);
24294b72b91aSCy Schubert conf->pp_key = pp_key;
2430c1d255d3SCy Schubert }
2431c1d255d3SCy Schubert
2432c1d255d3SCy Schubert
dpp_copy_netaccesskey(struct dpp_authentication * auth,struct dpp_config_obj * conf)2433c1d255d3SCy Schubert static void dpp_copy_netaccesskey(struct dpp_authentication *auth,
2434c1d255d3SCy Schubert struct dpp_config_obj *conf)
243585732ac8SCy Schubert {
24364b72b91aSCy Schubert struct wpabuf *net_access_key;
24374b72b91aSCy Schubert struct crypto_ec_key *own_key;
243885732ac8SCy Schubert
2439c1d255d3SCy Schubert own_key = auth->own_protocol_key;
2440c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2441c1d255d3SCy Schubert if (auth->reconfig_connector_key == DPP_CONFIG_REUSEKEY &&
2442c1d255d3SCy Schubert auth->reconfig_old_protocol_key)
2443c1d255d3SCy Schubert own_key = auth->reconfig_old_protocol_key;
2444c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
24454b72b91aSCy Schubert
24464b72b91aSCy Schubert net_access_key = crypto_ec_key_get_ecprivate_key(own_key, true);
24474b72b91aSCy Schubert if (!net_access_key)
244885732ac8SCy Schubert return;
244985732ac8SCy Schubert
245085732ac8SCy Schubert wpabuf_free(auth->net_access_key);
24514b72b91aSCy Schubert auth->net_access_key = net_access_key;
245285732ac8SCy Schubert }
245385732ac8SCy Schubert
245485732ac8SCy Schubert
dpp_parse_cred_dpp(struct dpp_authentication * auth,struct dpp_config_obj * conf,struct json_token * cred)245585732ac8SCy Schubert static int dpp_parse_cred_dpp(struct dpp_authentication *auth,
2456c1d255d3SCy Schubert struct dpp_config_obj *conf,
245785732ac8SCy Schubert struct json_token *cred)
245885732ac8SCy Schubert {
245985732ac8SCy Schubert struct dpp_signed_connector_info info;
2460c1d255d3SCy Schubert struct json_token *token, *csign, *ppkey;
246185732ac8SCy Schubert int ret = -1;
24624b72b91aSCy Schubert struct crypto_ec_key *csign_pub = NULL, *pp_pub = NULL;
2463c1d255d3SCy Schubert const struct dpp_curve_params *key_curve = NULL, *pp_curve = NULL;
246485732ac8SCy Schubert const char *signed_connector;
246585732ac8SCy Schubert
246685732ac8SCy Schubert os_memset(&info, 0, sizeof(info));
246785732ac8SCy Schubert
2468c1d255d3SCy Schubert if (dpp_akm_psk(conf->akm) || dpp_akm_sae(conf->akm)) {
24694bc52338SCy Schubert wpa_printf(MSG_DEBUG,
24704bc52338SCy Schubert "DPP: Legacy credential included in Connector credential");
2471c1d255d3SCy Schubert if (dpp_parse_cred_legacy(conf, cred) < 0)
24724bc52338SCy Schubert return -1;
24734bc52338SCy Schubert }
24744bc52338SCy Schubert
247585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Connector credential");
247685732ac8SCy Schubert
247785732ac8SCy Schubert csign = json_get_member(cred, "csign");
247885732ac8SCy Schubert if (!csign || csign->type != JSON_OBJECT) {
247985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No csign JWK in JSON");
248085732ac8SCy Schubert goto fail;
248185732ac8SCy Schubert }
248285732ac8SCy Schubert
248385732ac8SCy Schubert csign_pub = dpp_parse_jwk(csign, &key_curve);
248485732ac8SCy Schubert if (!csign_pub) {
248585732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to parse csign JWK");
248685732ac8SCy Schubert goto fail;
248785732ac8SCy Schubert }
248885732ac8SCy Schubert dpp_debug_print_key("DPP: Received C-sign-key", csign_pub);
248985732ac8SCy Schubert
2490c1d255d3SCy Schubert ppkey = json_get_member(cred, "ppKey");
2491c1d255d3SCy Schubert if (ppkey && ppkey->type == JSON_OBJECT) {
2492c1d255d3SCy Schubert pp_pub = dpp_parse_jwk(ppkey, &pp_curve);
2493c1d255d3SCy Schubert if (!pp_pub) {
2494c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to parse ppKey JWK");
2495c1d255d3SCy Schubert goto fail;
2496c1d255d3SCy Schubert }
2497c1d255d3SCy Schubert dpp_debug_print_key("DPP: Received ppKey", pp_pub);
2498c1d255d3SCy Schubert if (key_curve != pp_curve) {
2499c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
2500c1d255d3SCy Schubert "DPP: C-sign-key and ppKey do not use the same curve");
2501c1d255d3SCy Schubert goto fail;
2502c1d255d3SCy Schubert }
2503c1d255d3SCy Schubert }
2504c1d255d3SCy Schubert
250585732ac8SCy Schubert token = json_get_member(cred, "signedConnector");
250685732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
250785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No signedConnector string found");
250885732ac8SCy Schubert goto fail;
250985732ac8SCy Schubert }
251085732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: signedConnector",
251185732ac8SCy Schubert token->string, os_strlen(token->string));
251285732ac8SCy Schubert signed_connector = token->string;
251385732ac8SCy Schubert
251485732ac8SCy Schubert if (os_strchr(signed_connector, '"') ||
251585732ac8SCy Schubert os_strchr(signed_connector, '\n')) {
251685732ac8SCy Schubert wpa_printf(MSG_DEBUG,
251785732ac8SCy Schubert "DPP: Unexpected character in signedConnector");
251885732ac8SCy Schubert goto fail;
251985732ac8SCy Schubert }
252085732ac8SCy Schubert
252185732ac8SCy Schubert if (dpp_process_signed_connector(&info, csign_pub,
252285732ac8SCy Schubert signed_connector) != DPP_STATUS_OK)
252385732ac8SCy Schubert goto fail;
252485732ac8SCy Schubert
2525c1d255d3SCy Schubert if (dpp_parse_connector(auth, conf,
2526c1d255d3SCy Schubert info.payload, info.payload_len) < 0) {
252785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to parse connector");
252885732ac8SCy Schubert goto fail;
252985732ac8SCy Schubert }
253085732ac8SCy Schubert
2531c1d255d3SCy Schubert os_free(conf->connector);
2532c1d255d3SCy Schubert conf->connector = os_strdup(signed_connector);
253385732ac8SCy Schubert
2534c1d255d3SCy Schubert dpp_copy_csign(conf, csign_pub);
2535c1d255d3SCy Schubert if (pp_pub)
2536c1d255d3SCy Schubert dpp_copy_ppkey(conf, pp_pub);
2537c1d255d3SCy Schubert if (dpp_akm_dpp(conf->akm) || auth->peer_version >= 2)
2538c1d255d3SCy Schubert dpp_copy_netaccesskey(auth, conf);
253985732ac8SCy Schubert
254085732ac8SCy Schubert ret = 0;
254185732ac8SCy Schubert fail:
25424b72b91aSCy Schubert crypto_ec_key_deinit(csign_pub);
25434b72b91aSCy Schubert crypto_ec_key_deinit(pp_pub);
254485732ac8SCy Schubert os_free(info.payload);
254585732ac8SCy Schubert return ret;
254685732ac8SCy Schubert }
254785732ac8SCy Schubert
254885732ac8SCy Schubert
2549c1d255d3SCy Schubert #ifdef CONFIG_DPP2
dpp_parse_cred_dot1x(struct dpp_authentication * auth,struct dpp_config_obj * conf,struct json_token * cred)2550c1d255d3SCy Schubert static int dpp_parse_cred_dot1x(struct dpp_authentication *auth,
2551c1d255d3SCy Schubert struct dpp_config_obj *conf,
2552c1d255d3SCy Schubert struct json_token *cred)
2553c1d255d3SCy Schubert {
2554c1d255d3SCy Schubert struct json_token *ent, *name;
2555c1d255d3SCy Schubert
2556c1d255d3SCy Schubert ent = json_get_member(cred, "entCreds");
2557c1d255d3SCy Schubert if (!ent || ent->type != JSON_OBJECT) {
2558c1d255d3SCy Schubert dpp_auth_fail(auth, "No entCreds in JSON");
2559c1d255d3SCy Schubert return -1;
2560c1d255d3SCy Schubert }
2561c1d255d3SCy Schubert
2562c1d255d3SCy Schubert conf->certbag = json_get_member_base64(ent, "certBag");
2563c1d255d3SCy Schubert if (!conf->certbag) {
2564c1d255d3SCy Schubert dpp_auth_fail(auth, "No certBag in JSON");
2565c1d255d3SCy Schubert return -1;
2566c1d255d3SCy Schubert }
2567c1d255d3SCy Schubert wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Received certBag", conf->certbag);
25684b72b91aSCy Schubert conf->certs = crypto_pkcs7_get_certificates(conf->certbag);
2569c1d255d3SCy Schubert if (!conf->certs) {
2570c1d255d3SCy Schubert dpp_auth_fail(auth, "No certificates in certBag");
2571c1d255d3SCy Schubert return -1;
2572c1d255d3SCy Schubert }
2573c1d255d3SCy Schubert
2574c1d255d3SCy Schubert conf->cacert = json_get_member_base64(ent, "caCert");
2575c1d255d3SCy Schubert if (conf->cacert)
2576c1d255d3SCy Schubert wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Received caCert",
2577c1d255d3SCy Schubert conf->cacert);
2578c1d255d3SCy Schubert
2579c1d255d3SCy Schubert name = json_get_member(ent, "trustedEapServerName");
2580c1d255d3SCy Schubert if (name &&
2581c1d255d3SCy Schubert (name->type != JSON_STRING ||
2582c1d255d3SCy Schubert has_ctrl_char((const u8 *) name->string,
2583c1d255d3SCy Schubert os_strlen(name->string)))) {
2584c1d255d3SCy Schubert dpp_auth_fail(auth,
2585c1d255d3SCy Schubert "Invalid trustedEapServerName type in JSON");
2586c1d255d3SCy Schubert return -1;
2587c1d255d3SCy Schubert }
2588c1d255d3SCy Schubert if (name && name->string) {
2589c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Received trustedEapServerName: %s",
2590c1d255d3SCy Schubert name->string);
2591c1d255d3SCy Schubert conf->server_name = os_strdup(name->string);
2592c1d255d3SCy Schubert if (!conf->server_name)
2593c1d255d3SCy Schubert return -1;
2594c1d255d3SCy Schubert }
2595c1d255d3SCy Schubert
2596c1d255d3SCy Schubert return 0;
2597c1d255d3SCy Schubert }
2598c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
2599c1d255d3SCy Schubert
2600c1d255d3SCy Schubert
dpp_akm_str(enum dpp_akm akm)260185732ac8SCy Schubert const char * dpp_akm_str(enum dpp_akm akm)
260285732ac8SCy Schubert {
260385732ac8SCy Schubert switch (akm) {
260485732ac8SCy Schubert case DPP_AKM_DPP:
260585732ac8SCy Schubert return "dpp";
260685732ac8SCy Schubert case DPP_AKM_PSK:
260785732ac8SCy Schubert return "psk";
260885732ac8SCy Schubert case DPP_AKM_SAE:
260985732ac8SCy Schubert return "sae";
261085732ac8SCy Schubert case DPP_AKM_PSK_SAE:
261185732ac8SCy Schubert return "psk+sae";
26124bc52338SCy Schubert case DPP_AKM_SAE_DPP:
26134bc52338SCy Schubert return "dpp+sae";
26144bc52338SCy Schubert case DPP_AKM_PSK_SAE_DPP:
26154bc52338SCy Schubert return "dpp+psk+sae";
2616c1d255d3SCy Schubert case DPP_AKM_DOT1X:
2617c1d255d3SCy Schubert return "dot1x";
2618c1d255d3SCy Schubert default:
2619c1d255d3SCy Schubert return "??";
2620c1d255d3SCy Schubert }
2621c1d255d3SCy Schubert }
2622c1d255d3SCy Schubert
2623c1d255d3SCy Schubert
dpp_akm_selector_str(enum dpp_akm akm)2624c1d255d3SCy Schubert const char * dpp_akm_selector_str(enum dpp_akm akm)
2625c1d255d3SCy Schubert {
2626c1d255d3SCy Schubert switch (akm) {
2627c1d255d3SCy Schubert case DPP_AKM_DPP:
2628c1d255d3SCy Schubert return "506F9A02";
2629c1d255d3SCy Schubert case DPP_AKM_PSK:
2630c1d255d3SCy Schubert return "000FAC02+000FAC06";
2631c1d255d3SCy Schubert case DPP_AKM_SAE:
2632c1d255d3SCy Schubert return "000FAC08";
2633c1d255d3SCy Schubert case DPP_AKM_PSK_SAE:
2634c1d255d3SCy Schubert return "000FAC02+000FAC06+000FAC08";
2635c1d255d3SCy Schubert case DPP_AKM_SAE_DPP:
2636c1d255d3SCy Schubert return "506F9A02+000FAC08";
2637c1d255d3SCy Schubert case DPP_AKM_PSK_SAE_DPP:
2638c1d255d3SCy Schubert return "506F9A02+000FAC08+000FAC02+000FAC06";
2639c1d255d3SCy Schubert case DPP_AKM_DOT1X:
2640c1d255d3SCy Schubert return "000FAC01+000FAC05";
264185732ac8SCy Schubert default:
264285732ac8SCy Schubert return "??";
264385732ac8SCy Schubert }
264485732ac8SCy Schubert }
264585732ac8SCy Schubert
264685732ac8SCy Schubert
dpp_akm_from_str(const char * akm)264785732ac8SCy Schubert static enum dpp_akm dpp_akm_from_str(const char *akm)
264885732ac8SCy Schubert {
2649c1d255d3SCy Schubert const char *pos;
2650c1d255d3SCy Schubert int dpp = 0, psk = 0, sae = 0, dot1x = 0;
2651c1d255d3SCy Schubert
265285732ac8SCy Schubert if (os_strcmp(akm, "psk") == 0)
265385732ac8SCy Schubert return DPP_AKM_PSK;
265485732ac8SCy Schubert if (os_strcmp(akm, "sae") == 0)
265585732ac8SCy Schubert return DPP_AKM_SAE;
265685732ac8SCy Schubert if (os_strcmp(akm, "psk+sae") == 0)
265785732ac8SCy Schubert return DPP_AKM_PSK_SAE;
265885732ac8SCy Schubert if (os_strcmp(akm, "dpp") == 0)
265985732ac8SCy Schubert return DPP_AKM_DPP;
26604bc52338SCy Schubert if (os_strcmp(akm, "dpp+sae") == 0)
26614bc52338SCy Schubert return DPP_AKM_SAE_DPP;
26624bc52338SCy Schubert if (os_strcmp(akm, "dpp+psk+sae") == 0)
26634bc52338SCy Schubert return DPP_AKM_PSK_SAE_DPP;
2664c1d255d3SCy Schubert if (os_strcmp(akm, "dot1x") == 0)
2665c1d255d3SCy Schubert return DPP_AKM_DOT1X;
2666c1d255d3SCy Schubert
2667c1d255d3SCy Schubert pos = akm;
2668c1d255d3SCy Schubert while (*pos) {
2669c1d255d3SCy Schubert if (os_strlen(pos) < 8)
2670c1d255d3SCy Schubert break;
2671c1d255d3SCy Schubert if (os_strncasecmp(pos, "506F9A02", 8) == 0)
2672c1d255d3SCy Schubert dpp = 1;
2673c1d255d3SCy Schubert else if (os_strncasecmp(pos, "000FAC02", 8) == 0)
2674c1d255d3SCy Schubert psk = 1;
2675c1d255d3SCy Schubert else if (os_strncasecmp(pos, "000FAC06", 8) == 0)
2676c1d255d3SCy Schubert psk = 1;
2677c1d255d3SCy Schubert else if (os_strncasecmp(pos, "000FAC08", 8) == 0)
2678c1d255d3SCy Schubert sae = 1;
2679c1d255d3SCy Schubert else if (os_strncasecmp(pos, "000FAC01", 8) == 0)
2680c1d255d3SCy Schubert dot1x = 1;
2681c1d255d3SCy Schubert else if (os_strncasecmp(pos, "000FAC05", 8) == 0)
2682c1d255d3SCy Schubert dot1x = 1;
2683c1d255d3SCy Schubert pos += 8;
2684c1d255d3SCy Schubert if (*pos != '+')
2685c1d255d3SCy Schubert break;
2686c1d255d3SCy Schubert pos++;
2687c1d255d3SCy Schubert }
2688c1d255d3SCy Schubert
2689c1d255d3SCy Schubert if (dpp && psk && sae)
2690c1d255d3SCy Schubert return DPP_AKM_PSK_SAE_DPP;
2691c1d255d3SCy Schubert if (dpp && sae)
2692c1d255d3SCy Schubert return DPP_AKM_SAE_DPP;
2693c1d255d3SCy Schubert if (dpp)
2694c1d255d3SCy Schubert return DPP_AKM_DPP;
2695c1d255d3SCy Schubert if (psk && sae)
2696c1d255d3SCy Schubert return DPP_AKM_PSK_SAE;
2697c1d255d3SCy Schubert if (sae)
2698c1d255d3SCy Schubert return DPP_AKM_SAE;
2699c1d255d3SCy Schubert if (psk)
2700c1d255d3SCy Schubert return DPP_AKM_PSK;
2701c1d255d3SCy Schubert if (dot1x)
2702c1d255d3SCy Schubert return DPP_AKM_DOT1X;
2703c1d255d3SCy Schubert
270485732ac8SCy Schubert return DPP_AKM_UNKNOWN;
270585732ac8SCy Schubert }
270685732ac8SCy Schubert
270785732ac8SCy Schubert
dpp_parse_conf_obj(struct dpp_authentication * auth,const u8 * conf_obj,u16 conf_obj_len)270885732ac8SCy Schubert static int dpp_parse_conf_obj(struct dpp_authentication *auth,
270985732ac8SCy Schubert const u8 *conf_obj, u16 conf_obj_len)
271085732ac8SCy Schubert {
271185732ac8SCy Schubert int ret = -1;
271285732ac8SCy Schubert struct json_token *root, *token, *discovery, *cred;
2713c1d255d3SCy Schubert struct dpp_config_obj *conf;
2714c1d255d3SCy Schubert struct wpabuf *ssid64 = NULL;
2715c1d255d3SCy Schubert int legacy;
271685732ac8SCy Schubert
271785732ac8SCy Schubert root = json_parse((const char *) conf_obj, conf_obj_len);
271885732ac8SCy Schubert if (!root)
271985732ac8SCy Schubert return -1;
272085732ac8SCy Schubert if (root->type != JSON_OBJECT) {
272185732ac8SCy Schubert dpp_auth_fail(auth, "JSON root is not an object");
272285732ac8SCy Schubert goto fail;
272385732ac8SCy Schubert }
272485732ac8SCy Schubert
272585732ac8SCy Schubert token = json_get_member(root, "wi-fi_tech");
272685732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
272785732ac8SCy Schubert dpp_auth_fail(auth, "No wi-fi_tech string value found");
272885732ac8SCy Schubert goto fail;
272985732ac8SCy Schubert }
273085732ac8SCy Schubert if (os_strcmp(token->string, "infra") != 0) {
273185732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unsupported wi-fi_tech value: '%s'",
273285732ac8SCy Schubert token->string);
273385732ac8SCy Schubert dpp_auth_fail(auth, "Unsupported wi-fi_tech value");
273485732ac8SCy Schubert goto fail;
273585732ac8SCy Schubert }
273685732ac8SCy Schubert
273785732ac8SCy Schubert discovery = json_get_member(root, "discovery");
273885732ac8SCy Schubert if (!discovery || discovery->type != JSON_OBJECT) {
273985732ac8SCy Schubert dpp_auth_fail(auth, "No discovery object in JSON");
274085732ac8SCy Schubert goto fail;
274185732ac8SCy Schubert }
274285732ac8SCy Schubert
2743c1d255d3SCy Schubert ssid64 = json_get_member_base64url(discovery, "ssid64");
2744c1d255d3SCy Schubert if (ssid64) {
2745c1d255d3SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: discovery::ssid64",
2746c1d255d3SCy Schubert wpabuf_head(ssid64), wpabuf_len(ssid64));
2747c1d255d3SCy Schubert if (wpabuf_len(ssid64) > SSID_MAX_LEN) {
2748c1d255d3SCy Schubert dpp_auth_fail(auth, "Too long discovery::ssid64 value");
2749c1d255d3SCy Schubert goto fail;
2750c1d255d3SCy Schubert }
2751c1d255d3SCy Schubert } else {
275285732ac8SCy Schubert token = json_get_member(discovery, "ssid");
275385732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
2754c1d255d3SCy Schubert dpp_auth_fail(auth,
2755c1d255d3SCy Schubert "No discovery::ssid string value found");
275685732ac8SCy Schubert goto fail;
275785732ac8SCy Schubert }
275885732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: discovery::ssid",
275985732ac8SCy Schubert token->string, os_strlen(token->string));
276085732ac8SCy Schubert if (os_strlen(token->string) > SSID_MAX_LEN) {
2761c1d255d3SCy Schubert dpp_auth_fail(auth,
2762c1d255d3SCy Schubert "Too long discovery::ssid string value");
276385732ac8SCy Schubert goto fail;
276485732ac8SCy Schubert }
2765c1d255d3SCy Schubert }
2766c1d255d3SCy Schubert
2767c1d255d3SCy Schubert if (auth->num_conf_obj == DPP_MAX_CONF_OBJ) {
2768c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
2769c1d255d3SCy Schubert "DPP: No room for this many Config Objects - ignore this one");
2770c1d255d3SCy Schubert ret = 0;
2771c1d255d3SCy Schubert goto fail;
2772c1d255d3SCy Schubert }
2773c1d255d3SCy Schubert conf = &auth->conf_obj[auth->num_conf_obj++];
2774c1d255d3SCy Schubert
2775c1d255d3SCy Schubert if (ssid64) {
2776c1d255d3SCy Schubert conf->ssid_len = wpabuf_len(ssid64);
2777c1d255d3SCy Schubert os_memcpy(conf->ssid, wpabuf_head(ssid64), conf->ssid_len);
2778c1d255d3SCy Schubert } else {
2779c1d255d3SCy Schubert conf->ssid_len = os_strlen(token->string);
2780c1d255d3SCy Schubert os_memcpy(conf->ssid, token->string, conf->ssid_len);
2781c1d255d3SCy Schubert }
2782c1d255d3SCy Schubert
2783c1d255d3SCy Schubert token = json_get_member(discovery, "ssid_charset");
2784c1d255d3SCy Schubert if (token && token->type == JSON_NUMBER) {
2785c1d255d3SCy Schubert conf->ssid_charset = token->number;
2786c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: ssid_charset=%d",
2787c1d255d3SCy Schubert conf->ssid_charset);
2788c1d255d3SCy Schubert }
278985732ac8SCy Schubert
279085732ac8SCy Schubert cred = json_get_member(root, "cred");
279185732ac8SCy Schubert if (!cred || cred->type != JSON_OBJECT) {
279285732ac8SCy Schubert dpp_auth_fail(auth, "No cred object in JSON");
279385732ac8SCy Schubert goto fail;
279485732ac8SCy Schubert }
279585732ac8SCy Schubert
279685732ac8SCy Schubert token = json_get_member(cred, "akm");
279785732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
279885732ac8SCy Schubert dpp_auth_fail(auth, "No cred::akm string value found");
279985732ac8SCy Schubert goto fail;
280085732ac8SCy Schubert }
2801c1d255d3SCy Schubert conf->akm = dpp_akm_from_str(token->string);
280285732ac8SCy Schubert
2803c1d255d3SCy Schubert legacy = dpp_akm_legacy(conf->akm);
2804c1d255d3SCy Schubert if (legacy && auth->peer_version >= 2) {
2805c1d255d3SCy Schubert struct json_token *csign, *s_conn;
2806c1d255d3SCy Schubert
2807c1d255d3SCy Schubert csign = json_get_member(cred, "csign");
2808c1d255d3SCy Schubert s_conn = json_get_member(cred, "signedConnector");
2809c1d255d3SCy Schubert if (csign && csign->type == JSON_OBJECT &&
2810c1d255d3SCy Schubert s_conn && s_conn->type == JSON_STRING)
2811c1d255d3SCy Schubert legacy = 0;
2812c1d255d3SCy Schubert }
2813c1d255d3SCy Schubert if (legacy) {
2814c1d255d3SCy Schubert if (dpp_parse_cred_legacy(conf, cred) < 0)
281585732ac8SCy Schubert goto fail;
2816c1d255d3SCy Schubert } else if (dpp_akm_dpp(conf->akm) ||
2817c1d255d3SCy Schubert (auth->peer_version >= 2 && dpp_akm_legacy(conf->akm))) {
2818c1d255d3SCy Schubert if (dpp_parse_cred_dpp(auth, conf, cred) < 0)
281985732ac8SCy Schubert goto fail;
2820c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2821c1d255d3SCy Schubert } else if (conf->akm == DPP_AKM_DOT1X) {
2822c1d255d3SCy Schubert if (dpp_parse_cred_dot1x(auth, conf, cred) < 0 ||
2823c1d255d3SCy Schubert dpp_parse_cred_dpp(auth, conf, cred) < 0)
2824c1d255d3SCy Schubert goto fail;
2825c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
282685732ac8SCy Schubert } else {
282785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Unsupported akm: %s",
282885732ac8SCy Schubert token->string);
282985732ac8SCy Schubert dpp_auth_fail(auth, "Unsupported akm");
283085732ac8SCy Schubert goto fail;
283185732ac8SCy Schubert }
283285732ac8SCy Schubert
283385732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: JSON parsing completed successfully");
283485732ac8SCy Schubert ret = 0;
283585732ac8SCy Schubert fail:
2836c1d255d3SCy Schubert wpabuf_free(ssid64);
283785732ac8SCy Schubert json_free(root);
283885732ac8SCy Schubert return ret;
283985732ac8SCy Schubert }
284085732ac8SCy Schubert
284185732ac8SCy Schubert
2842c1d255d3SCy Schubert #ifdef CONFIG_DPP2
dpp_get_csr_attrs(const u8 * attrs,size_t attrs_len,size_t * len)2843c1d255d3SCy Schubert static u8 * dpp_get_csr_attrs(const u8 *attrs, size_t attrs_len, size_t *len)
2844c1d255d3SCy Schubert {
2845c1d255d3SCy Schubert const u8 *b64;
2846c1d255d3SCy Schubert u16 b64_len;
2847c1d255d3SCy Schubert
2848c1d255d3SCy Schubert b64 = dpp_get_attr(attrs, attrs_len, DPP_ATTR_CSR_ATTR_REQ, &b64_len);
2849c1d255d3SCy Schubert if (!b64)
2850c1d255d3SCy Schubert return NULL;
2851c1d255d3SCy Schubert return base64_decode((const char *) b64, b64_len, len);
2852c1d255d3SCy Schubert }
2853c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
2854c1d255d3SCy Schubert
2855c1d255d3SCy Schubert
dpp_conf_resp_rx(struct dpp_authentication * auth,const struct wpabuf * resp)285685732ac8SCy Schubert int dpp_conf_resp_rx(struct dpp_authentication *auth,
285785732ac8SCy Schubert const struct wpabuf *resp)
285885732ac8SCy Schubert {
285985732ac8SCy Schubert const u8 *wrapped_data, *e_nonce, *status, *conf_obj;
286085732ac8SCy Schubert u16 wrapped_data_len, e_nonce_len, status_len, conf_obj_len;
2861c1d255d3SCy Schubert const u8 *env_data;
2862c1d255d3SCy Schubert u16 env_data_len;
286385732ac8SCy Schubert const u8 *addr[1];
286485732ac8SCy Schubert size_t len[1];
286585732ac8SCy Schubert u8 *unwrapped = NULL;
286685732ac8SCy Schubert size_t unwrapped_len = 0;
286785732ac8SCy Schubert int ret = -1;
286885732ac8SCy Schubert
28694bc52338SCy Schubert auth->conf_resp_status = 255;
28704bc52338SCy Schubert
287185732ac8SCy Schubert if (dpp_check_attrs(wpabuf_head(resp), wpabuf_len(resp)) < 0) {
287285732ac8SCy Schubert dpp_auth_fail(auth, "Invalid attribute in config response");
287385732ac8SCy Schubert return -1;
287485732ac8SCy Schubert }
287585732ac8SCy Schubert
287685732ac8SCy Schubert wrapped_data = dpp_get_attr(wpabuf_head(resp), wpabuf_len(resp),
287785732ac8SCy Schubert DPP_ATTR_WRAPPED_DATA,
287885732ac8SCy Schubert &wrapped_data_len);
287985732ac8SCy Schubert if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) {
288085732ac8SCy Schubert dpp_auth_fail(auth,
288185732ac8SCy Schubert "Missing or invalid required Wrapped Data attribute");
288285732ac8SCy Schubert return -1;
288385732ac8SCy Schubert }
288485732ac8SCy Schubert
288585732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
288685732ac8SCy Schubert wrapped_data, wrapped_data_len);
288785732ac8SCy Schubert unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE;
288885732ac8SCy Schubert unwrapped = os_malloc(unwrapped_len);
288985732ac8SCy Schubert if (!unwrapped)
289085732ac8SCy Schubert return -1;
289185732ac8SCy Schubert
289285732ac8SCy Schubert addr[0] = wpabuf_head(resp);
289385732ac8SCy Schubert len[0] = wrapped_data - 4 - (const u8 *) wpabuf_head(resp);
289485732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD", addr[0], len[0]);
289585732ac8SCy Schubert
289685732ac8SCy Schubert if (aes_siv_decrypt(auth->ke, auth->curve->hash_len,
289785732ac8SCy Schubert wrapped_data, wrapped_data_len,
289885732ac8SCy Schubert 1, addr, len, unwrapped) < 0) {
289985732ac8SCy Schubert dpp_auth_fail(auth, "AES-SIV decryption failed");
290085732ac8SCy Schubert goto fail;
290185732ac8SCy Schubert }
290285732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext",
290385732ac8SCy Schubert unwrapped, unwrapped_len);
290485732ac8SCy Schubert
290585732ac8SCy Schubert if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) {
290685732ac8SCy Schubert dpp_auth_fail(auth, "Invalid attribute in unwrapped data");
290785732ac8SCy Schubert goto fail;
290885732ac8SCy Schubert }
290985732ac8SCy Schubert
291085732ac8SCy Schubert e_nonce = dpp_get_attr(unwrapped, unwrapped_len,
291185732ac8SCy Schubert DPP_ATTR_ENROLLEE_NONCE,
291285732ac8SCy Schubert &e_nonce_len);
291385732ac8SCy Schubert if (!e_nonce || e_nonce_len != auth->curve->nonce_len) {
291485732ac8SCy Schubert dpp_auth_fail(auth,
291585732ac8SCy Schubert "Missing or invalid Enrollee Nonce attribute");
291685732ac8SCy Schubert goto fail;
291785732ac8SCy Schubert }
291885732ac8SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len);
291985732ac8SCy Schubert if (os_memcmp(e_nonce, auth->e_nonce, e_nonce_len) != 0) {
292085732ac8SCy Schubert dpp_auth_fail(auth, "Enrollee Nonce mismatch");
292185732ac8SCy Schubert goto fail;
292285732ac8SCy Schubert }
292385732ac8SCy Schubert
292485732ac8SCy Schubert status = dpp_get_attr(wpabuf_head(resp), wpabuf_len(resp),
292585732ac8SCy Schubert DPP_ATTR_STATUS, &status_len);
292685732ac8SCy Schubert if (!status || status_len < 1) {
292785732ac8SCy Schubert dpp_auth_fail(auth,
292885732ac8SCy Schubert "Missing or invalid required DPP Status attribute");
292985732ac8SCy Schubert goto fail;
293085732ac8SCy Schubert }
29314bc52338SCy Schubert auth->conf_resp_status = status[0];
293285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]);
2933c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2934c1d255d3SCy Schubert if (status[0] == DPP_STATUS_CSR_NEEDED) {
2935c1d255d3SCy Schubert u8 *csrattrs;
2936c1d255d3SCy Schubert size_t csrattrs_len;
2937c1d255d3SCy Schubert
2938c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Configurator requested CSR");
2939c1d255d3SCy Schubert
2940c1d255d3SCy Schubert csrattrs = dpp_get_csr_attrs(unwrapped, unwrapped_len,
2941c1d255d3SCy Schubert &csrattrs_len);
2942c1d255d3SCy Schubert if (!csrattrs) {
2943c1d255d3SCy Schubert dpp_auth_fail(auth,
2944c1d255d3SCy Schubert "Missing or invalid CSR Attributes Request attribute");
2945c1d255d3SCy Schubert goto fail;
2946c1d255d3SCy Schubert }
2947c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: CsrAttrs", csrattrs, csrattrs_len);
2948c1d255d3SCy Schubert os_free(auth->csrattrs);
2949c1d255d3SCy Schubert auth->csrattrs = csrattrs;
2950c1d255d3SCy Schubert auth->csrattrs_len = csrattrs_len;
2951c1d255d3SCy Schubert ret = -2;
2952c1d255d3SCy Schubert goto fail;
2953c1d255d3SCy Schubert }
2954c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
295585732ac8SCy Schubert if (status[0] != DPP_STATUS_OK) {
295685732ac8SCy Schubert dpp_auth_fail(auth, "Configurator rejected configuration");
295785732ac8SCy Schubert goto fail;
295885732ac8SCy Schubert }
295985732ac8SCy Schubert
2960c1d255d3SCy Schubert env_data = dpp_get_attr(unwrapped, unwrapped_len,
2961c1d255d3SCy Schubert DPP_ATTR_ENVELOPED_DATA, &env_data_len);
2962c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2963c1d255d3SCy Schubert if (env_data &&
2964c1d255d3SCy Schubert dpp_conf_resp_env_data(auth, env_data, env_data_len) < 0)
2965c1d255d3SCy Schubert goto fail;
2966c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
2967c1d255d3SCy Schubert
2968c1d255d3SCy Schubert conf_obj = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_CONFIG_OBJ,
2969c1d255d3SCy Schubert &conf_obj_len);
2970c1d255d3SCy Schubert if (!conf_obj && !env_data) {
297185732ac8SCy Schubert dpp_auth_fail(auth,
297285732ac8SCy Schubert "Missing required Configuration Object attribute");
297385732ac8SCy Schubert goto fail;
297485732ac8SCy Schubert }
2975c1d255d3SCy Schubert while (conf_obj) {
297685732ac8SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: configurationObject JSON",
297785732ac8SCy Schubert conf_obj, conf_obj_len);
297885732ac8SCy Schubert if (dpp_parse_conf_obj(auth, conf_obj, conf_obj_len) < 0)
297985732ac8SCy Schubert goto fail;
2980c1d255d3SCy Schubert conf_obj = dpp_get_attr_next(conf_obj, unwrapped, unwrapped_len,
2981c1d255d3SCy Schubert DPP_ATTR_CONFIG_OBJ,
2982c1d255d3SCy Schubert &conf_obj_len);
2983c1d255d3SCy Schubert }
2984c1d255d3SCy Schubert
2985c1d255d3SCy Schubert #ifdef CONFIG_DPP2
2986c1d255d3SCy Schubert status = dpp_get_attr(unwrapped, unwrapped_len,
2987c1d255d3SCy Schubert DPP_ATTR_SEND_CONN_STATUS, &status_len);
2988c1d255d3SCy Schubert if (status) {
2989c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
2990c1d255d3SCy Schubert "DPP: Configurator requested connection status result");
2991c1d255d3SCy Schubert auth->conn_status_requested = 1;
2992c1d255d3SCy Schubert }
2993c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
299485732ac8SCy Schubert
299585732ac8SCy Schubert ret = 0;
299685732ac8SCy Schubert
299785732ac8SCy Schubert fail:
299885732ac8SCy Schubert os_free(unwrapped);
299985732ac8SCy Schubert return ret;
300085732ac8SCy Schubert }
300185732ac8SCy Schubert
300285732ac8SCy Schubert
30034bc52338SCy Schubert #ifdef CONFIG_DPP2
3004c1d255d3SCy Schubert
dpp_conf_result_rx(struct dpp_authentication * auth,const u8 * hdr,const u8 * attr_start,size_t attr_len)30054bc52338SCy Schubert enum dpp_status_error dpp_conf_result_rx(struct dpp_authentication *auth,
30064bc52338SCy Schubert const u8 *hdr,
30074bc52338SCy Schubert const u8 *attr_start, size_t attr_len)
30084bc52338SCy Schubert {
30094bc52338SCy Schubert const u8 *wrapped_data, *status, *e_nonce;
30104bc52338SCy Schubert u16 wrapped_data_len, status_len, e_nonce_len;
30114bc52338SCy Schubert const u8 *addr[2];
30124bc52338SCy Schubert size_t len[2];
30134bc52338SCy Schubert u8 *unwrapped = NULL;
30144bc52338SCy Schubert size_t unwrapped_len = 0;
30154bc52338SCy Schubert enum dpp_status_error ret = 256;
30164bc52338SCy Schubert
30174bc52338SCy Schubert wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,
30184bc52338SCy Schubert &wrapped_data_len);
30194bc52338SCy Schubert if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) {
30204bc52338SCy Schubert dpp_auth_fail(auth,
30214bc52338SCy Schubert "Missing or invalid required Wrapped Data attribute");
30224bc52338SCy Schubert goto fail;
30234bc52338SCy Schubert }
30244bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data",
30254bc52338SCy Schubert wrapped_data, wrapped_data_len);
30264bc52338SCy Schubert
30274bc52338SCy Schubert attr_len = wrapped_data - 4 - attr_start;
30284bc52338SCy Schubert
30294bc52338SCy Schubert addr[0] = hdr;
30304bc52338SCy Schubert len[0] = DPP_HDR_LEN;
30314bc52338SCy Schubert addr[1] = attr_start;
30324bc52338SCy Schubert len[1] = attr_len;
30334bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);
30344bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);
30354bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
30364bc52338SCy Schubert wrapped_data, wrapped_data_len);
30374bc52338SCy Schubert unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE;
30384bc52338SCy Schubert unwrapped = os_malloc(unwrapped_len);
30394bc52338SCy Schubert if (!unwrapped)
30404bc52338SCy Schubert goto fail;
30414bc52338SCy Schubert if (aes_siv_decrypt(auth->ke, auth->curve->hash_len,
30424bc52338SCy Schubert wrapped_data, wrapped_data_len,
30434bc52338SCy Schubert 2, addr, len, unwrapped) < 0) {
30444bc52338SCy Schubert dpp_auth_fail(auth, "AES-SIV decryption failed");
30454bc52338SCy Schubert goto fail;
30464bc52338SCy Schubert }
30474bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext",
30484bc52338SCy Schubert unwrapped, unwrapped_len);
30494bc52338SCy Schubert
30504bc52338SCy Schubert if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) {
30514bc52338SCy Schubert dpp_auth_fail(auth, "Invalid attribute in unwrapped data");
30524bc52338SCy Schubert goto fail;
30534bc52338SCy Schubert }
30544bc52338SCy Schubert
30554bc52338SCy Schubert e_nonce = dpp_get_attr(unwrapped, unwrapped_len,
30564bc52338SCy Schubert DPP_ATTR_ENROLLEE_NONCE,
30574bc52338SCy Schubert &e_nonce_len);
30584bc52338SCy Schubert if (!e_nonce || e_nonce_len != auth->curve->nonce_len) {
30594bc52338SCy Schubert dpp_auth_fail(auth,
30604bc52338SCy Schubert "Missing or invalid Enrollee Nonce attribute");
30614bc52338SCy Schubert goto fail;
30624bc52338SCy Schubert }
30634bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len);
30644bc52338SCy Schubert if (os_memcmp(e_nonce, auth->e_nonce, e_nonce_len) != 0) {
30654bc52338SCy Schubert dpp_auth_fail(auth, "Enrollee Nonce mismatch");
30664bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Expected Enrollee Nonce",
30674bc52338SCy Schubert auth->e_nonce, e_nonce_len);
30684bc52338SCy Schubert goto fail;
30694bc52338SCy Schubert }
30704bc52338SCy Schubert
30714bc52338SCy Schubert status = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_STATUS,
30724bc52338SCy Schubert &status_len);
30734bc52338SCy Schubert if (!status || status_len < 1) {
30744bc52338SCy Schubert dpp_auth_fail(auth,
30754bc52338SCy Schubert "Missing or invalid required DPP Status attribute");
30764bc52338SCy Schubert goto fail;
30774bc52338SCy Schubert }
30784bc52338SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]);
30794bc52338SCy Schubert ret = status[0];
30804bc52338SCy Schubert
30814bc52338SCy Schubert fail:
30824bc52338SCy Schubert bin_clear_free(unwrapped, unwrapped_len);
30834bc52338SCy Schubert return ret;
30844bc52338SCy Schubert }
30854bc52338SCy Schubert
30864bc52338SCy Schubert
dpp_build_conf_result(struct dpp_authentication * auth,enum dpp_status_error status)30874bc52338SCy Schubert struct wpabuf * dpp_build_conf_result(struct dpp_authentication *auth,
30884bc52338SCy Schubert enum dpp_status_error status)
30894bc52338SCy Schubert {
30904bc52338SCy Schubert struct wpabuf *msg, *clear;
30914bc52338SCy Schubert size_t nonce_len, clear_len, attr_len;
30924bc52338SCy Schubert const u8 *addr[2];
30934bc52338SCy Schubert size_t len[2];
30944bc52338SCy Schubert u8 *wrapped;
30954bc52338SCy Schubert
30964bc52338SCy Schubert nonce_len = auth->curve->nonce_len;
30974bc52338SCy Schubert clear_len = 5 + 4 + nonce_len;
30984bc52338SCy Schubert attr_len = 4 + clear_len + AES_BLOCK_SIZE;
30994bc52338SCy Schubert clear = wpabuf_alloc(clear_len);
31004bc52338SCy Schubert msg = dpp_alloc_msg(DPP_PA_CONFIGURATION_RESULT, attr_len);
31014bc52338SCy Schubert if (!clear || !msg)
3102c1d255d3SCy Schubert goto fail;
31034bc52338SCy Schubert
31044bc52338SCy Schubert /* DPP Status */
31054bc52338SCy Schubert dpp_build_attr_status(clear, status);
31064bc52338SCy Schubert
31074bc52338SCy Schubert /* E-nonce */
31084bc52338SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
31094bc52338SCy Schubert wpabuf_put_le16(clear, nonce_len);
31104bc52338SCy Schubert wpabuf_put_data(clear, auth->e_nonce, nonce_len);
31114bc52338SCy Schubert
31124bc52338SCy Schubert /* OUI, OUI type, Crypto Suite, DPP frame type */
31134bc52338SCy Schubert addr[0] = wpabuf_head_u8(msg) + 2;
31144bc52338SCy Schubert len[0] = 3 + 1 + 1 + 1;
31154bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);
31164bc52338SCy Schubert
31174bc52338SCy Schubert /* Attributes before Wrapped Data (none) */
31184bc52338SCy Schubert addr[1] = wpabuf_put(msg, 0);
31194bc52338SCy Schubert len[1] = 0;
31204bc52338SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);
31214bc52338SCy Schubert
31224bc52338SCy Schubert /* Wrapped Data */
31234bc52338SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);
31244bc52338SCy Schubert wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
31254bc52338SCy Schubert wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
31264bc52338SCy Schubert
31274bc52338SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear);
31284bc52338SCy Schubert if (aes_siv_encrypt(auth->ke, auth->curve->hash_len,
31294bc52338SCy Schubert wpabuf_head(clear), wpabuf_len(clear),
31304bc52338SCy Schubert 2, addr, len, wrapped) < 0)
31314bc52338SCy Schubert goto fail;
31324bc52338SCy Schubert
31334bc52338SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Result attributes", msg);
31344bc52338SCy Schubert wpabuf_free(clear);
31354bc52338SCy Schubert return msg;
31364bc52338SCy Schubert fail:
31374bc52338SCy Schubert wpabuf_free(clear);
31384bc52338SCy Schubert wpabuf_free(msg);
31394bc52338SCy Schubert return NULL;
31404bc52338SCy Schubert }
31414bc52338SCy Schubert
31424bc52338SCy Schubert
valid_channel_list(const char * val)3143c1d255d3SCy Schubert static int valid_channel_list(const char *val)
3144c1d255d3SCy Schubert {
3145c1d255d3SCy Schubert while (*val) {
3146c1d255d3SCy Schubert if (!((*val >= '0' && *val <= '9') ||
3147c1d255d3SCy Schubert *val == '/' || *val == ','))
3148c1d255d3SCy Schubert return 0;
3149c1d255d3SCy Schubert val++;
3150c1d255d3SCy Schubert }
3151c1d255d3SCy Schubert
3152c1d255d3SCy Schubert return 1;
3153c1d255d3SCy Schubert }
3154c1d255d3SCy Schubert
3155c1d255d3SCy Schubert
dpp_conn_status_result_rx(struct dpp_authentication * auth,const u8 * hdr,const u8 * attr_start,size_t attr_len,u8 * ssid,size_t * ssid_len,char ** channel_list)3156c1d255d3SCy Schubert enum dpp_status_error dpp_conn_status_result_rx(struct dpp_authentication *auth,
3157c1d255d3SCy Schubert const u8 *hdr,
3158c1d255d3SCy Schubert const u8 *attr_start,
3159c1d255d3SCy Schubert size_t attr_len,
3160c1d255d3SCy Schubert u8 *ssid, size_t *ssid_len,
3161c1d255d3SCy Schubert char **channel_list)
3162c1d255d3SCy Schubert {
3163c1d255d3SCy Schubert const u8 *wrapped_data, *status, *e_nonce;
3164c1d255d3SCy Schubert u16 wrapped_data_len, status_len, e_nonce_len;
3165c1d255d3SCy Schubert const u8 *addr[2];
3166c1d255d3SCy Schubert size_t len[2];
3167c1d255d3SCy Schubert u8 *unwrapped = NULL;
3168c1d255d3SCy Schubert size_t unwrapped_len = 0;
3169c1d255d3SCy Schubert enum dpp_status_error ret = 256;
3170c1d255d3SCy Schubert struct json_token *root = NULL, *token;
3171c1d255d3SCy Schubert struct wpabuf *ssid64;
3172c1d255d3SCy Schubert
3173c1d255d3SCy Schubert *ssid_len = 0;
3174c1d255d3SCy Schubert *channel_list = NULL;
3175c1d255d3SCy Schubert
3176c1d255d3SCy Schubert wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,
3177c1d255d3SCy Schubert &wrapped_data_len);
3178c1d255d3SCy Schubert if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) {
3179c1d255d3SCy Schubert dpp_auth_fail(auth,
3180c1d255d3SCy Schubert "Missing or invalid required Wrapped Data attribute");
3181c1d255d3SCy Schubert goto fail;
3182c1d255d3SCy Schubert }
3183c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data",
3184c1d255d3SCy Schubert wrapped_data, wrapped_data_len);
3185c1d255d3SCy Schubert
3186c1d255d3SCy Schubert attr_len = wrapped_data - 4 - attr_start;
3187c1d255d3SCy Schubert
3188c1d255d3SCy Schubert addr[0] = hdr;
3189c1d255d3SCy Schubert len[0] = DPP_HDR_LEN;
3190c1d255d3SCy Schubert addr[1] = attr_start;
3191c1d255d3SCy Schubert len[1] = attr_len;
3192c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);
3193c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);
3194c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",
3195c1d255d3SCy Schubert wrapped_data, wrapped_data_len);
3196c1d255d3SCy Schubert unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE;
3197c1d255d3SCy Schubert unwrapped = os_malloc(unwrapped_len);
3198c1d255d3SCy Schubert if (!unwrapped)
3199c1d255d3SCy Schubert goto fail;
3200c1d255d3SCy Schubert if (aes_siv_decrypt(auth->ke, auth->curve->hash_len,
3201c1d255d3SCy Schubert wrapped_data, wrapped_data_len,
3202c1d255d3SCy Schubert 2, addr, len, unwrapped) < 0) {
3203c1d255d3SCy Schubert dpp_auth_fail(auth, "AES-SIV decryption failed");
3204c1d255d3SCy Schubert goto fail;
3205c1d255d3SCy Schubert }
3206c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext",
3207c1d255d3SCy Schubert unwrapped, unwrapped_len);
3208c1d255d3SCy Schubert
3209c1d255d3SCy Schubert if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) {
3210c1d255d3SCy Schubert dpp_auth_fail(auth, "Invalid attribute in unwrapped data");
3211c1d255d3SCy Schubert goto fail;
3212c1d255d3SCy Schubert }
3213c1d255d3SCy Schubert
3214c1d255d3SCy Schubert e_nonce = dpp_get_attr(unwrapped, unwrapped_len,
3215c1d255d3SCy Schubert DPP_ATTR_ENROLLEE_NONCE,
3216c1d255d3SCy Schubert &e_nonce_len);
3217c1d255d3SCy Schubert if (!e_nonce || e_nonce_len != auth->curve->nonce_len) {
3218c1d255d3SCy Schubert dpp_auth_fail(auth,
3219c1d255d3SCy Schubert "Missing or invalid Enrollee Nonce attribute");
3220c1d255d3SCy Schubert goto fail;
3221c1d255d3SCy Schubert }
3222c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len);
3223c1d255d3SCy Schubert if (os_memcmp(e_nonce, auth->e_nonce, e_nonce_len) != 0) {
3224c1d255d3SCy Schubert dpp_auth_fail(auth, "Enrollee Nonce mismatch");
3225c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DPP: Expected Enrollee Nonce",
3226c1d255d3SCy Schubert auth->e_nonce, e_nonce_len);
3227c1d255d3SCy Schubert goto fail;
3228c1d255d3SCy Schubert }
3229c1d255d3SCy Schubert
3230c1d255d3SCy Schubert status = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_CONN_STATUS,
3231c1d255d3SCy Schubert &status_len);
3232c1d255d3SCy Schubert if (!status) {
3233c1d255d3SCy Schubert dpp_auth_fail(auth,
3234c1d255d3SCy Schubert "Missing required DPP Connection Status attribute");
3235c1d255d3SCy Schubert goto fail;
3236c1d255d3SCy Schubert }
3237c1d255d3SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: connStatus JSON",
3238c1d255d3SCy Schubert status, status_len);
3239c1d255d3SCy Schubert
3240c1d255d3SCy Schubert root = json_parse((const char *) status, status_len);
3241c1d255d3SCy Schubert if (!root) {
3242c1d255d3SCy Schubert dpp_auth_fail(auth, "Could not parse connStatus");
3243c1d255d3SCy Schubert goto fail;
3244c1d255d3SCy Schubert }
3245c1d255d3SCy Schubert
3246c1d255d3SCy Schubert ssid64 = json_get_member_base64url(root, "ssid64");
3247c1d255d3SCy Schubert if (ssid64 && wpabuf_len(ssid64) <= SSID_MAX_LEN) {
3248c1d255d3SCy Schubert *ssid_len = wpabuf_len(ssid64);
3249c1d255d3SCy Schubert os_memcpy(ssid, wpabuf_head(ssid64), *ssid_len);
3250c1d255d3SCy Schubert }
3251c1d255d3SCy Schubert wpabuf_free(ssid64);
3252c1d255d3SCy Schubert
3253c1d255d3SCy Schubert token = json_get_member(root, "channelList");
3254c1d255d3SCy Schubert if (token && token->type == JSON_STRING &&
3255c1d255d3SCy Schubert valid_channel_list(token->string))
3256c1d255d3SCy Schubert *channel_list = os_strdup(token->string);
3257c1d255d3SCy Schubert
3258c1d255d3SCy Schubert token = json_get_member(root, "result");
3259c1d255d3SCy Schubert if (!token || token->type != JSON_NUMBER) {
3260c1d255d3SCy Schubert dpp_auth_fail(auth, "No connStatus - result");
3261c1d255d3SCy Schubert goto fail;
3262c1d255d3SCy Schubert }
3263c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: result %d", token->number);
3264c1d255d3SCy Schubert ret = token->number;
3265c1d255d3SCy Schubert
3266c1d255d3SCy Schubert fail:
3267c1d255d3SCy Schubert json_free(root);
3268c1d255d3SCy Schubert bin_clear_free(unwrapped, unwrapped_len);
3269c1d255d3SCy Schubert return ret;
3270c1d255d3SCy Schubert }
3271c1d255d3SCy Schubert
3272c1d255d3SCy Schubert
dpp_build_conn_status(enum dpp_status_error result,const u8 * ssid,size_t ssid_len,const char * channel_list)3273c1d255d3SCy Schubert struct wpabuf * dpp_build_conn_status(enum dpp_status_error result,
3274c1d255d3SCy Schubert const u8 *ssid, size_t ssid_len,
3275c1d255d3SCy Schubert const char *channel_list)
3276c1d255d3SCy Schubert {
3277c1d255d3SCy Schubert struct wpabuf *json;
3278c1d255d3SCy Schubert
3279c1d255d3SCy Schubert json = wpabuf_alloc(1000);
3280c1d255d3SCy Schubert if (!json)
3281c1d255d3SCy Schubert return NULL;
3282c1d255d3SCy Schubert json_start_object(json, NULL);
3283c1d255d3SCy Schubert json_add_int(json, "result", result);
3284c1d255d3SCy Schubert if (ssid) {
3285c1d255d3SCy Schubert json_value_sep(json);
3286c1d255d3SCy Schubert if (json_add_base64url(json, "ssid64", ssid, ssid_len) < 0) {
3287c1d255d3SCy Schubert wpabuf_free(json);
3288c1d255d3SCy Schubert return NULL;
3289c1d255d3SCy Schubert }
3290c1d255d3SCy Schubert }
3291c1d255d3SCy Schubert if (channel_list) {
3292c1d255d3SCy Schubert json_value_sep(json);
3293c1d255d3SCy Schubert json_add_string(json, "channelList", channel_list);
3294c1d255d3SCy Schubert }
3295c1d255d3SCy Schubert json_end_object(json);
3296c1d255d3SCy Schubert wpa_hexdump_ascii(MSG_DEBUG, "DPP: connStatus JSON",
3297c1d255d3SCy Schubert wpabuf_head(json), wpabuf_len(json));
3298c1d255d3SCy Schubert
3299c1d255d3SCy Schubert return json;
3300c1d255d3SCy Schubert }
3301c1d255d3SCy Schubert
3302c1d255d3SCy Schubert
dpp_build_conn_status_result(struct dpp_authentication * auth,enum dpp_status_error result,const u8 * ssid,size_t ssid_len,const char * channel_list)3303c1d255d3SCy Schubert struct wpabuf * dpp_build_conn_status_result(struct dpp_authentication *auth,
3304c1d255d3SCy Schubert enum dpp_status_error result,
3305c1d255d3SCy Schubert const u8 *ssid, size_t ssid_len,
3306c1d255d3SCy Schubert const char *channel_list)
3307c1d255d3SCy Schubert {
3308c1d255d3SCy Schubert struct wpabuf *msg = NULL, *clear = NULL, *json;
3309c1d255d3SCy Schubert size_t nonce_len, clear_len, attr_len;
3310c1d255d3SCy Schubert const u8 *addr[2];
3311c1d255d3SCy Schubert size_t len[2];
3312c1d255d3SCy Schubert u8 *wrapped;
3313c1d255d3SCy Schubert
3314c1d255d3SCy Schubert json = dpp_build_conn_status(result, ssid, ssid_len, channel_list);
3315c1d255d3SCy Schubert if (!json)
3316c1d255d3SCy Schubert return NULL;
3317c1d255d3SCy Schubert
3318c1d255d3SCy Schubert nonce_len = auth->curve->nonce_len;
3319c1d255d3SCy Schubert clear_len = 5 + 4 + nonce_len + 4 + wpabuf_len(json);
3320c1d255d3SCy Schubert attr_len = 4 + clear_len + AES_BLOCK_SIZE;
3321c1d255d3SCy Schubert clear = wpabuf_alloc(clear_len);
3322c1d255d3SCy Schubert msg = dpp_alloc_msg(DPP_PA_CONNECTION_STATUS_RESULT, attr_len);
3323c1d255d3SCy Schubert if (!clear || !msg)
3324c1d255d3SCy Schubert goto fail;
3325c1d255d3SCy Schubert
3326c1d255d3SCy Schubert /* E-nonce */
3327c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE);
3328c1d255d3SCy Schubert wpabuf_put_le16(clear, nonce_len);
3329c1d255d3SCy Schubert wpabuf_put_data(clear, auth->e_nonce, nonce_len);
3330c1d255d3SCy Schubert
3331c1d255d3SCy Schubert /* DPP Connection Status */
3332c1d255d3SCy Schubert wpabuf_put_le16(clear, DPP_ATTR_CONN_STATUS);
3333c1d255d3SCy Schubert wpabuf_put_le16(clear, wpabuf_len(json));
3334c1d255d3SCy Schubert wpabuf_put_buf(clear, json);
3335c1d255d3SCy Schubert
3336c1d255d3SCy Schubert /* OUI, OUI type, Crypto Suite, DPP frame type */
3337c1d255d3SCy Schubert addr[0] = wpabuf_head_u8(msg) + 2;
3338c1d255d3SCy Schubert len[0] = 3 + 1 + 1 + 1;
3339c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);
3340c1d255d3SCy Schubert
3341c1d255d3SCy Schubert /* Attributes before Wrapped Data (none) */
3342c1d255d3SCy Schubert addr[1] = wpabuf_put(msg, 0);
3343c1d255d3SCy Schubert len[1] = 0;
3344c1d255d3SCy Schubert wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);
3345c1d255d3SCy Schubert
3346c1d255d3SCy Schubert /* Wrapped Data */
3347c1d255d3SCy Schubert wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);
3348c1d255d3SCy Schubert wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
3349c1d255d3SCy Schubert wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE);
3350c1d255d3SCy Schubert
3351c1d255d3SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear);
3352c1d255d3SCy Schubert if (aes_siv_encrypt(auth->ke, auth->curve->hash_len,
3353c1d255d3SCy Schubert wpabuf_head(clear), wpabuf_len(clear),
3354c1d255d3SCy Schubert 2, addr, len, wrapped) < 0)
3355c1d255d3SCy Schubert goto fail;
3356c1d255d3SCy Schubert
3357c1d255d3SCy Schubert wpa_hexdump_buf(MSG_DEBUG, "DPP: Connection Status Result attributes",
3358c1d255d3SCy Schubert msg);
3359c1d255d3SCy Schubert wpabuf_free(json);
3360c1d255d3SCy Schubert wpabuf_free(clear);
3361c1d255d3SCy Schubert return msg;
3362c1d255d3SCy Schubert fail:
3363c1d255d3SCy Schubert wpabuf_free(json);
3364c1d255d3SCy Schubert wpabuf_free(clear);
3365c1d255d3SCy Schubert wpabuf_free(msg);
3366c1d255d3SCy Schubert return NULL;
3367c1d255d3SCy Schubert }
3368c1d255d3SCy Schubert
3369c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
3370c1d255d3SCy Schubert
3371c1d255d3SCy Schubert
dpp_configurator_free(struct dpp_configurator * conf)337285732ac8SCy Schubert void dpp_configurator_free(struct dpp_configurator *conf)
337385732ac8SCy Schubert {
337485732ac8SCy Schubert if (!conf)
337585732ac8SCy Schubert return;
33764b72b91aSCy Schubert crypto_ec_key_deinit(conf->csign);
337785732ac8SCy Schubert os_free(conf->kid);
3378c1d255d3SCy Schubert os_free(conf->connector);
33794b72b91aSCy Schubert crypto_ec_key_deinit(conf->connector_key);
33804b72b91aSCy Schubert crypto_ec_key_deinit(conf->pp_key);
338185732ac8SCy Schubert os_free(conf);
338285732ac8SCy Schubert }
338385732ac8SCy Schubert
338485732ac8SCy Schubert
dpp_configurator_get_key(const struct dpp_configurator * conf,char * buf,size_t buflen)338585732ac8SCy Schubert int dpp_configurator_get_key(const struct dpp_configurator *conf, char *buf,
338685732ac8SCy Schubert size_t buflen)
338785732ac8SCy Schubert {
33884b72b91aSCy Schubert struct wpabuf *key;
33894b72b91aSCy Schubert int ret = -1;
339085732ac8SCy Schubert
339185732ac8SCy Schubert if (!conf->csign)
339285732ac8SCy Schubert return -1;
339385732ac8SCy Schubert
33944b72b91aSCy Schubert key = crypto_ec_key_get_ecprivate_key(conf->csign, true);
33954b72b91aSCy Schubert if (!key)
339685732ac8SCy Schubert return -1;
339785732ac8SCy Schubert
33984b72b91aSCy Schubert ret = wpa_snprintf_hex(buf, buflen, wpabuf_head(key), wpabuf_len(key));
339985732ac8SCy Schubert
34004b72b91aSCy Schubert wpabuf_clear_free(key);
340185732ac8SCy Schubert return ret;
340285732ac8SCy Schubert }
340385732ac8SCy Schubert
340485732ac8SCy Schubert
dpp_configurator_gen_kid(struct dpp_configurator * conf)3405c1d255d3SCy Schubert static int dpp_configurator_gen_kid(struct dpp_configurator *conf)
340685732ac8SCy Schubert {
340785732ac8SCy Schubert struct wpabuf *csign_pub = NULL;
340885732ac8SCy Schubert const u8 *addr[1];
340985732ac8SCy Schubert size_t len[1];
3410c1d255d3SCy Schubert int res;
341185732ac8SCy Schubert
34124b72b91aSCy Schubert csign_pub = crypto_ec_key_get_pubkey_point(conf->csign, 1);
341385732ac8SCy Schubert if (!csign_pub) {
341485732ac8SCy Schubert wpa_printf(MSG_INFO, "DPP: Failed to extract C-sign-key");
3415c1d255d3SCy Schubert return -1;
341685732ac8SCy Schubert }
341785732ac8SCy Schubert
341885732ac8SCy Schubert /* kid = SHA256(ANSI X9.63 uncompressed C-sign-key) */
341985732ac8SCy Schubert addr[0] = wpabuf_head(csign_pub);
342085732ac8SCy Schubert len[0] = wpabuf_len(csign_pub);
3421c1d255d3SCy Schubert res = sha256_vector(1, addr, len, conf->kid_hash);
3422c1d255d3SCy Schubert wpabuf_free(csign_pub);
3423c1d255d3SCy Schubert if (res < 0) {
342485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
342585732ac8SCy Schubert "DPP: Failed to derive kid for C-sign-key");
3426c1d255d3SCy Schubert return -1;
342785732ac8SCy Schubert }
342885732ac8SCy Schubert
3429c1d255d3SCy Schubert conf->kid = base64_url_encode(conf->kid_hash, sizeof(conf->kid_hash),
3430c1d255d3SCy Schubert NULL);
3431c1d255d3SCy Schubert return conf->kid ? 0 : -1;
3432c1d255d3SCy Schubert }
3433c1d255d3SCy Schubert
3434c1d255d3SCy Schubert
3435c1d255d3SCy Schubert static struct dpp_configurator *
dpp_keygen_configurator(const char * curve,const u8 * privkey,size_t privkey_len,const u8 * pp_key,size_t pp_key_len)3436c1d255d3SCy Schubert dpp_keygen_configurator(const char *curve, const u8 *privkey,
3437c1d255d3SCy Schubert size_t privkey_len, const u8 *pp_key, size_t pp_key_len)
3438c1d255d3SCy Schubert {
3439c1d255d3SCy Schubert struct dpp_configurator *conf;
3440c1d255d3SCy Schubert
3441c1d255d3SCy Schubert conf = os_zalloc(sizeof(*conf));
3442c1d255d3SCy Schubert if (!conf)
3443c1d255d3SCy Schubert return NULL;
3444c1d255d3SCy Schubert
3445c1d255d3SCy Schubert conf->curve = dpp_get_curve_name(curve);
3446c1d255d3SCy Schubert if (!conf->curve) {
3447c1d255d3SCy Schubert wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", curve);
3448c1d255d3SCy Schubert os_free(conf);
3449c1d255d3SCy Schubert return NULL;
3450c1d255d3SCy Schubert }
3451c1d255d3SCy Schubert
3452c1d255d3SCy Schubert if (privkey)
3453c1d255d3SCy Schubert conf->csign = dpp_set_keypair(&conf->curve, privkey,
3454c1d255d3SCy Schubert privkey_len);
3455c1d255d3SCy Schubert else
3456c1d255d3SCy Schubert conf->csign = dpp_gen_keypair(conf->curve);
3457c1d255d3SCy Schubert if (pp_key)
3458c1d255d3SCy Schubert conf->pp_key = dpp_set_keypair(&conf->curve, pp_key,
3459c1d255d3SCy Schubert pp_key_len);
3460c1d255d3SCy Schubert else
3461c1d255d3SCy Schubert conf->pp_key = dpp_gen_keypair(conf->curve);
3462c1d255d3SCy Schubert if (!conf->csign || !conf->pp_key)
346385732ac8SCy Schubert goto fail;
3464c1d255d3SCy Schubert conf->own = 1;
3465c1d255d3SCy Schubert
3466c1d255d3SCy Schubert if (dpp_configurator_gen_kid(conf) < 0)
3467c1d255d3SCy Schubert goto fail;
346885732ac8SCy Schubert return conf;
346985732ac8SCy Schubert fail:
347085732ac8SCy Schubert dpp_configurator_free(conf);
3471c1d255d3SCy Schubert return NULL;
347285732ac8SCy Schubert }
347385732ac8SCy Schubert
347485732ac8SCy Schubert
dpp_configurator_own_config(struct dpp_authentication * auth,const char * curve,int ap)347585732ac8SCy Schubert int dpp_configurator_own_config(struct dpp_authentication *auth,
347685732ac8SCy Schubert const char *curve, int ap)
347785732ac8SCy Schubert {
347885732ac8SCy Schubert struct wpabuf *conf_obj;
347985732ac8SCy Schubert int ret = -1;
348085732ac8SCy Schubert
348185732ac8SCy Schubert if (!auth->conf) {
348285732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No configurator specified");
348385732ac8SCy Schubert return -1;
348485732ac8SCy Schubert }
348585732ac8SCy Schubert
348685732ac8SCy Schubert auth->curve = dpp_get_curve_name(curve);
348785732ac8SCy Schubert if (!auth->curve) {
3488c1d255d3SCy Schubert wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", curve);
348985732ac8SCy Schubert return -1;
349085732ac8SCy Schubert }
3491c1d255d3SCy Schubert
349285732ac8SCy Schubert wpa_printf(MSG_DEBUG,
349385732ac8SCy Schubert "DPP: Building own configuration/connector with curve %s",
349485732ac8SCy Schubert auth->curve->name);
349585732ac8SCy Schubert
349685732ac8SCy Schubert auth->own_protocol_key = dpp_gen_keypair(auth->curve);
349785732ac8SCy Schubert if (!auth->own_protocol_key)
349885732ac8SCy Schubert return -1;
3499c1d255d3SCy Schubert dpp_copy_netaccesskey(auth, &auth->conf_obj[0]);
350085732ac8SCy Schubert auth->peer_protocol_key = auth->own_protocol_key;
3501c1d255d3SCy Schubert dpp_copy_csign(&auth->conf_obj[0], auth->conf->csign);
350285732ac8SCy Schubert
3503c1d255d3SCy Schubert conf_obj = dpp_build_conf_obj(auth, ap, 0, NULL);
3504c1d255d3SCy Schubert if (!conf_obj) {
3505c1d255d3SCy Schubert wpabuf_free(auth->conf_obj[0].c_sign_key);
3506c1d255d3SCy Schubert auth->conf_obj[0].c_sign_key = NULL;
350785732ac8SCy Schubert goto fail;
3508c1d255d3SCy Schubert }
350985732ac8SCy Schubert ret = dpp_parse_conf_obj(auth, wpabuf_head(conf_obj),
351085732ac8SCy Schubert wpabuf_len(conf_obj));
351185732ac8SCy Schubert fail:
351285732ac8SCy Schubert wpabuf_free(conf_obj);
351385732ac8SCy Schubert auth->peer_protocol_key = NULL;
351485732ac8SCy Schubert return ret;
351585732ac8SCy Schubert }
351685732ac8SCy Schubert
351785732ac8SCy Schubert
dpp_compatible_netrole(const char * role1,const char * role2)351885732ac8SCy Schubert static int dpp_compatible_netrole(const char *role1, const char *role2)
351985732ac8SCy Schubert {
352085732ac8SCy Schubert return (os_strcmp(role1, "sta") == 0 && os_strcmp(role2, "ap") == 0) ||
352185732ac8SCy Schubert (os_strcmp(role1, "ap") == 0 && os_strcmp(role2, "sta") == 0);
352285732ac8SCy Schubert }
352385732ac8SCy Schubert
352485732ac8SCy Schubert
dpp_connector_compatible_group(struct json_token * root,const char * group_id,const char * net_role,bool reconfig)352585732ac8SCy Schubert static int dpp_connector_compatible_group(struct json_token *root,
352685732ac8SCy Schubert const char *group_id,
3527c1d255d3SCy Schubert const char *net_role,
3528c1d255d3SCy Schubert bool reconfig)
352985732ac8SCy Schubert {
353085732ac8SCy Schubert struct json_token *groups, *token;
353185732ac8SCy Schubert
353285732ac8SCy Schubert groups = json_get_member(root, "groups");
353385732ac8SCy Schubert if (!groups || groups->type != JSON_ARRAY)
353485732ac8SCy Schubert return 0;
353585732ac8SCy Schubert
353685732ac8SCy Schubert for (token = groups->child; token; token = token->sibling) {
353785732ac8SCy Schubert struct json_token *id, *role;
353885732ac8SCy Schubert
353985732ac8SCy Schubert id = json_get_member(token, "groupId");
354085732ac8SCy Schubert if (!id || id->type != JSON_STRING)
354185732ac8SCy Schubert continue;
354285732ac8SCy Schubert
354385732ac8SCy Schubert role = json_get_member(token, "netRole");
354485732ac8SCy Schubert if (!role || role->type != JSON_STRING)
354585732ac8SCy Schubert continue;
354685732ac8SCy Schubert
354785732ac8SCy Schubert if (os_strcmp(id->string, "*") != 0 &&
354885732ac8SCy Schubert os_strcmp(group_id, "*") != 0 &&
354985732ac8SCy Schubert os_strcmp(id->string, group_id) != 0)
355085732ac8SCy Schubert continue;
355185732ac8SCy Schubert
3552c1d255d3SCy Schubert if (reconfig && os_strcmp(net_role, "configurator") == 0)
3553c1d255d3SCy Schubert return 1;
3554c1d255d3SCy Schubert if (!reconfig && dpp_compatible_netrole(role->string, net_role))
355585732ac8SCy Schubert return 1;
355685732ac8SCy Schubert }
355785732ac8SCy Schubert
355885732ac8SCy Schubert return 0;
355985732ac8SCy Schubert }
356085732ac8SCy Schubert
356185732ac8SCy Schubert
dpp_connector_match_groups(struct json_token * own_root,struct json_token * peer_root,bool reconfig)3562c1d255d3SCy Schubert int dpp_connector_match_groups(struct json_token *own_root,
3563c1d255d3SCy Schubert struct json_token *peer_root, bool reconfig)
356485732ac8SCy Schubert {
356585732ac8SCy Schubert struct json_token *groups, *token;
356685732ac8SCy Schubert
356785732ac8SCy Schubert groups = json_get_member(peer_root, "groups");
356885732ac8SCy Schubert if (!groups || groups->type != JSON_ARRAY) {
356985732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No peer groups array found");
357085732ac8SCy Schubert return 0;
357185732ac8SCy Schubert }
357285732ac8SCy Schubert
357385732ac8SCy Schubert for (token = groups->child; token; token = token->sibling) {
357485732ac8SCy Schubert struct json_token *id, *role;
357585732ac8SCy Schubert
357685732ac8SCy Schubert id = json_get_member(token, "groupId");
357785732ac8SCy Schubert if (!id || id->type != JSON_STRING) {
357885732ac8SCy Schubert wpa_printf(MSG_DEBUG,
357985732ac8SCy Schubert "DPP: Missing peer groupId string");
358085732ac8SCy Schubert continue;
358185732ac8SCy Schubert }
358285732ac8SCy Schubert
358385732ac8SCy Schubert role = json_get_member(token, "netRole");
358485732ac8SCy Schubert if (!role || role->type != JSON_STRING) {
358585732ac8SCy Schubert wpa_printf(MSG_DEBUG,
358685732ac8SCy Schubert "DPP: Missing peer groups::netRole string");
358785732ac8SCy Schubert continue;
358885732ac8SCy Schubert }
358985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
359085732ac8SCy Schubert "DPP: peer connector group: groupId='%s' netRole='%s'",
359185732ac8SCy Schubert id->string, role->string);
359285732ac8SCy Schubert if (dpp_connector_compatible_group(own_root, id->string,
3593c1d255d3SCy Schubert role->string, reconfig)) {
359485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
359585732ac8SCy Schubert "DPP: Compatible group/netRole in own connector");
359685732ac8SCy Schubert return 1;
359785732ac8SCy Schubert }
359885732ac8SCy Schubert }
359985732ac8SCy Schubert
360085732ac8SCy Schubert return 0;
360185732ac8SCy Schubert }
360285732ac8SCy Schubert
360385732ac8SCy Schubert
dpp_parse_own_connector(const char * own_connector)3604c1d255d3SCy Schubert struct json_token * dpp_parse_own_connector(const char *own_connector)
360585732ac8SCy Schubert {
3606c1d255d3SCy Schubert unsigned char *own_conn;
3607c1d255d3SCy Schubert size_t own_conn_len;
3608c1d255d3SCy Schubert const char *pos, *end;
3609c1d255d3SCy Schubert struct json_token *own_root;
361085732ac8SCy Schubert
3611c1d255d3SCy Schubert pos = os_strchr(own_connector, '.');
3612c1d255d3SCy Schubert if (!pos) {
3613c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Own connector is missing the first dot (.)");
3614c1d255d3SCy Schubert return NULL;
3615c1d255d3SCy Schubert }
3616c1d255d3SCy Schubert pos++;
3617c1d255d3SCy Schubert end = os_strchr(pos, '.');
3618c1d255d3SCy Schubert if (!end) {
3619c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Own connector is missing the second dot (.)");
3620c1d255d3SCy Schubert return NULL;
3621c1d255d3SCy Schubert }
3622c1d255d3SCy Schubert own_conn = base64_url_decode(pos, end - pos, &own_conn_len);
3623c1d255d3SCy Schubert if (!own_conn) {
3624c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
3625c1d255d3SCy Schubert "DPP: Failed to base64url decode own signedConnector JWS Payload");
3626c1d255d3SCy Schubert return NULL;
362785732ac8SCy Schubert }
362885732ac8SCy Schubert
3629c1d255d3SCy Schubert own_root = json_parse((const char *) own_conn, own_conn_len);
3630c1d255d3SCy Schubert os_free(own_conn);
3631c1d255d3SCy Schubert if (!own_root)
3632c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Failed to parse local connector");
363385732ac8SCy Schubert
3634c1d255d3SCy Schubert return own_root;
363585732ac8SCy Schubert }
363685732ac8SCy Schubert
363785732ac8SCy Schubert
363885732ac8SCy Schubert enum dpp_status_error
dpp_peer_intro(struct dpp_introduction * intro,const char * own_connector,const u8 * net_access_key,size_t net_access_key_len,const u8 * csign_key,size_t csign_key_len,const u8 * peer_connector,size_t peer_connector_len,os_time_t * expiry)363985732ac8SCy Schubert dpp_peer_intro(struct dpp_introduction *intro, const char *own_connector,
364085732ac8SCy Schubert const u8 *net_access_key, size_t net_access_key_len,
364185732ac8SCy Schubert const u8 *csign_key, size_t csign_key_len,
364285732ac8SCy Schubert const u8 *peer_connector, size_t peer_connector_len,
364385732ac8SCy Schubert os_time_t *expiry)
364485732ac8SCy Schubert {
364585732ac8SCy Schubert struct json_token *root = NULL, *netkey, *token;
364685732ac8SCy Schubert struct json_token *own_root = NULL;
364785732ac8SCy Schubert enum dpp_status_error ret = 255, res;
36484b72b91aSCy Schubert struct crypto_ec_key *own_key = NULL, *peer_key = NULL;
364985732ac8SCy Schubert struct wpabuf *own_key_pub = NULL;
365085732ac8SCy Schubert const struct dpp_curve_params *curve, *own_curve;
365185732ac8SCy Schubert struct dpp_signed_connector_info info;
365285732ac8SCy Schubert size_t Nx_len;
365385732ac8SCy Schubert u8 Nx[DPP_MAX_SHARED_SECRET_LEN];
365485732ac8SCy Schubert
365585732ac8SCy Schubert os_memset(intro, 0, sizeof(*intro));
365685732ac8SCy Schubert os_memset(&info, 0, sizeof(info));
365785732ac8SCy Schubert if (expiry)
365885732ac8SCy Schubert *expiry = 0;
365985732ac8SCy Schubert
366085732ac8SCy Schubert own_key = dpp_set_keypair(&own_curve, net_access_key,
366185732ac8SCy Schubert net_access_key_len);
366285732ac8SCy Schubert if (!own_key) {
366385732ac8SCy Schubert wpa_printf(MSG_ERROR, "DPP: Failed to parse own netAccessKey");
366485732ac8SCy Schubert goto fail;
366585732ac8SCy Schubert }
366685732ac8SCy Schubert
3667c1d255d3SCy Schubert own_root = dpp_parse_own_connector(own_connector);
3668c1d255d3SCy Schubert if (!own_root)
366985732ac8SCy Schubert goto fail;
367085732ac8SCy Schubert
3671c1d255d3SCy Schubert res = dpp_check_signed_connector(&info, csign_key, csign_key_len,
367285732ac8SCy Schubert peer_connector, peer_connector_len);
367385732ac8SCy Schubert if (res != DPP_STATUS_OK) {
367485732ac8SCy Schubert ret = res;
367585732ac8SCy Schubert goto fail;
367685732ac8SCy Schubert }
367785732ac8SCy Schubert
367885732ac8SCy Schubert root = json_parse((const char *) info.payload, info.payload_len);
367985732ac8SCy Schubert if (!root) {
368085732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: JSON parsing of connector failed");
368185732ac8SCy Schubert ret = DPP_STATUS_INVALID_CONNECTOR;
368285732ac8SCy Schubert goto fail;
368385732ac8SCy Schubert }
368485732ac8SCy Schubert
3685c1d255d3SCy Schubert if (!dpp_connector_match_groups(own_root, root, false)) {
368685732ac8SCy Schubert wpa_printf(MSG_DEBUG,
368785732ac8SCy Schubert "DPP: Peer connector does not include compatible group netrole with own connector");
368885732ac8SCy Schubert ret = DPP_STATUS_NO_MATCH;
368985732ac8SCy Schubert goto fail;
369085732ac8SCy Schubert }
369185732ac8SCy Schubert
369285732ac8SCy Schubert token = json_get_member(root, "expiry");
369385732ac8SCy Schubert if (!token || token->type != JSON_STRING) {
369485732ac8SCy Schubert wpa_printf(MSG_DEBUG,
369585732ac8SCy Schubert "DPP: No expiry string found - connector does not expire");
369685732ac8SCy Schubert } else {
369785732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: expiry = %s", token->string);
369885732ac8SCy Schubert if (dpp_key_expired(token->string, expiry)) {
369985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
370085732ac8SCy Schubert "DPP: Connector (netAccessKey) has expired");
370185732ac8SCy Schubert ret = DPP_STATUS_INVALID_CONNECTOR;
370285732ac8SCy Schubert goto fail;
370385732ac8SCy Schubert }
370485732ac8SCy Schubert }
370585732ac8SCy Schubert
370632a95656SCy Schubert #ifdef CONFIG_DPP3
370732a95656SCy Schubert token = json_get_member(root, "version");
370832a95656SCy Schubert if (token && token->type == JSON_NUMBER) {
370932a95656SCy Schubert wpa_printf(MSG_DEBUG, "DPP: version = %d", token->number);
371032a95656SCy Schubert intro->peer_version = token->number;
371132a95656SCy Schubert }
371232a95656SCy Schubert #endif /* CONFIG_DPP3 */
371332a95656SCy Schubert
371485732ac8SCy Schubert netkey = json_get_member(root, "netAccessKey");
371585732ac8SCy Schubert if (!netkey || netkey->type != JSON_OBJECT) {
371685732ac8SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No netAccessKey object found");
371785732ac8SCy Schubert ret = DPP_STATUS_INVALID_CONNECTOR;
371885732ac8SCy Schubert goto fail;
371985732ac8SCy Schubert }
372085732ac8SCy Schubert
372185732ac8SCy Schubert peer_key = dpp_parse_jwk(netkey, &curve);
372285732ac8SCy Schubert if (!peer_key) {
372385732ac8SCy Schubert ret = DPP_STATUS_INVALID_CONNECTOR;
372485732ac8SCy Schubert goto fail;
372585732ac8SCy Schubert }
372685732ac8SCy Schubert dpp_debug_print_key("DPP: Received netAccessKey", peer_key);
372785732ac8SCy Schubert
372885732ac8SCy Schubert if (own_curve != curve) {
372985732ac8SCy Schubert wpa_printf(MSG_DEBUG,
373085732ac8SCy Schubert "DPP: Mismatching netAccessKey curves (%s != %s)",
373185732ac8SCy Schubert own_curve->name, curve->name);
373285732ac8SCy Schubert ret = DPP_STATUS_INVALID_CONNECTOR;
373385732ac8SCy Schubert goto fail;
373485732ac8SCy Schubert }
373585732ac8SCy Schubert
373685732ac8SCy Schubert /* ECDH: N = nk * PK */
3737206b73d0SCy Schubert if (dpp_ecdh(own_key, peer_key, Nx, &Nx_len) < 0)
373885732ac8SCy Schubert goto fail;
373985732ac8SCy Schubert
374085732ac8SCy Schubert wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)",
374185732ac8SCy Schubert Nx, Nx_len);
374285732ac8SCy Schubert
374385732ac8SCy Schubert /* PMK = HKDF(<>, "DPP PMK", N.x) */
374485732ac8SCy Schubert if (dpp_derive_pmk(Nx, Nx_len, intro->pmk, curve->hash_len) < 0) {
374585732ac8SCy Schubert wpa_printf(MSG_ERROR, "DPP: Failed to derive PMK");
374685732ac8SCy Schubert goto fail;
374785732ac8SCy Schubert }
374885732ac8SCy Schubert intro->pmk_len = curve->hash_len;
374985732ac8SCy Schubert
375085732ac8SCy Schubert /* PMKID = Truncate-128(H(min(NK.x, PK.x) | max(NK.x, PK.x))) */
375185732ac8SCy Schubert if (dpp_derive_pmkid(curve, own_key, peer_key, intro->pmkid) < 0) {
375285732ac8SCy Schubert wpa_printf(MSG_ERROR, "DPP: Failed to derive PMKID");
375385732ac8SCy Schubert goto fail;
375485732ac8SCy Schubert }
375585732ac8SCy Schubert
375685732ac8SCy Schubert ret = DPP_STATUS_OK;
375785732ac8SCy Schubert fail:
375885732ac8SCy Schubert if (ret != DPP_STATUS_OK)
375985732ac8SCy Schubert os_memset(intro, 0, sizeof(*intro));
376085732ac8SCy Schubert os_memset(Nx, 0, sizeof(Nx));
376185732ac8SCy Schubert os_free(info.payload);
37624b72b91aSCy Schubert crypto_ec_key_deinit(own_key);
376385732ac8SCy Schubert wpabuf_free(own_key_pub);
37644b72b91aSCy Schubert crypto_ec_key_deinit(peer_key);
376585732ac8SCy Schubert json_free(root);
376685732ac8SCy Schubert json_free(own_root);
376785732ac8SCy Schubert return ret;
376885732ac8SCy Schubert }
376985732ac8SCy Schubert
377085732ac8SCy Schubert
377132a95656SCy Schubert #ifdef CONFIG_DPP3
dpp_get_connector_version(const char * connector)377232a95656SCy Schubert int dpp_get_connector_version(const char *connector)
377332a95656SCy Schubert {
377432a95656SCy Schubert struct json_token *root, *token;
377532a95656SCy Schubert int ver = -1;
377632a95656SCy Schubert
377732a95656SCy Schubert root = dpp_parse_own_connector(connector);
377832a95656SCy Schubert if (!root)
377932a95656SCy Schubert return -1;
378032a95656SCy Schubert
378132a95656SCy Schubert token = json_get_member(root, "version");
378232a95656SCy Schubert if (token && token->type == JSON_NUMBER)
378332a95656SCy Schubert ver = token->number;
378432a95656SCy Schubert
378532a95656SCy Schubert json_free(root);
378632a95656SCy Schubert return ver;
378732a95656SCy Schubert }
378832a95656SCy Schubert #endif /* CONFIG_DPP3 */
378932a95656SCy Schubert
379032a95656SCy Schubert
dpp_next_id(struct dpp_global * dpp)3791c1d255d3SCy Schubert unsigned int dpp_next_id(struct dpp_global *dpp)
37924bc52338SCy Schubert {
37934bc52338SCy Schubert struct dpp_bootstrap_info *bi;
37944bc52338SCy Schubert unsigned int max_id = 0;
37954bc52338SCy Schubert
37964bc52338SCy Schubert dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) {
37974bc52338SCy Schubert if (bi->id > max_id)
37984bc52338SCy Schubert max_id = bi->id;
37994bc52338SCy Schubert }
38004bc52338SCy Schubert return max_id + 1;
38014bc52338SCy Schubert }
38024bc52338SCy Schubert
38034bc52338SCy Schubert
dpp_bootstrap_del(struct dpp_global * dpp,unsigned int id)38044bc52338SCy Schubert static int dpp_bootstrap_del(struct dpp_global *dpp, unsigned int id)
38054bc52338SCy Schubert {
38064bc52338SCy Schubert struct dpp_bootstrap_info *bi, *tmp;
38074bc52338SCy Schubert int found = 0;
38084bc52338SCy Schubert
38094bc52338SCy Schubert if (!dpp)
38104bc52338SCy Schubert return -1;
38114bc52338SCy Schubert
38124bc52338SCy Schubert dl_list_for_each_safe(bi, tmp, &dpp->bootstrap,
38134bc52338SCy Schubert struct dpp_bootstrap_info, list) {
38144bc52338SCy Schubert if (id && bi->id != id)
38154bc52338SCy Schubert continue;
38164bc52338SCy Schubert found = 1;
3817c1d255d3SCy Schubert #ifdef CONFIG_DPP2
3818c1d255d3SCy Schubert if (dpp->remove_bi)
3819c1d255d3SCy Schubert dpp->remove_bi(dpp->cb_ctx, bi);
3820c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
38214bc52338SCy Schubert dl_list_del(&bi->list);
38224bc52338SCy Schubert dpp_bootstrap_info_free(bi);
38234bc52338SCy Schubert }
38244bc52338SCy Schubert
38254bc52338SCy Schubert if (id == 0)
38264bc52338SCy Schubert return 0; /* flush succeeds regardless of entries found */
38274bc52338SCy Schubert return found ? 0 : -1;
38284bc52338SCy Schubert }
38294bc52338SCy Schubert
38304bc52338SCy Schubert
dpp_add_qr_code(struct dpp_global * dpp,const char * uri)38314bc52338SCy Schubert struct dpp_bootstrap_info * dpp_add_qr_code(struct dpp_global *dpp,
38324bc52338SCy Schubert const char *uri)
38334bc52338SCy Schubert {
38344bc52338SCy Schubert struct dpp_bootstrap_info *bi;
38354bc52338SCy Schubert
38364bc52338SCy Schubert if (!dpp)
38374bc52338SCy Schubert return NULL;
38384bc52338SCy Schubert
3839c1d255d3SCy Schubert bi = dpp_parse_uri(uri);
38404bc52338SCy Schubert if (!bi)
38414bc52338SCy Schubert return NULL;
38424bc52338SCy Schubert
3843c1d255d3SCy Schubert bi->type = DPP_BOOTSTRAP_QR_CODE;
3844c1d255d3SCy Schubert bi->id = dpp_next_id(dpp);
3845c1d255d3SCy Schubert dl_list_add(&dpp->bootstrap, &bi->list);
3846c1d255d3SCy Schubert return bi;
3847c1d255d3SCy Schubert }
3848c1d255d3SCy Schubert
3849c1d255d3SCy Schubert
dpp_add_nfc_uri(struct dpp_global * dpp,const char * uri)3850c1d255d3SCy Schubert struct dpp_bootstrap_info * dpp_add_nfc_uri(struct dpp_global *dpp,
3851c1d255d3SCy Schubert const char *uri)
3852c1d255d3SCy Schubert {
3853c1d255d3SCy Schubert struct dpp_bootstrap_info *bi;
3854c1d255d3SCy Schubert
3855c1d255d3SCy Schubert if (!dpp)
3856c1d255d3SCy Schubert return NULL;
3857c1d255d3SCy Schubert
3858c1d255d3SCy Schubert bi = dpp_parse_uri(uri);
3859c1d255d3SCy Schubert if (!bi)
3860c1d255d3SCy Schubert return NULL;
3861c1d255d3SCy Schubert
3862c1d255d3SCy Schubert bi->type = DPP_BOOTSTRAP_NFC_URI;
38634bc52338SCy Schubert bi->id = dpp_next_id(dpp);
38644bc52338SCy Schubert dl_list_add(&dpp->bootstrap, &bi->list);
38654bc52338SCy Schubert return bi;
38664bc52338SCy Schubert }
38674bc52338SCy Schubert
38684bc52338SCy Schubert
dpp_bootstrap_gen(struct dpp_global * dpp,const char * cmd)38694bc52338SCy Schubert int dpp_bootstrap_gen(struct dpp_global *dpp, const char *cmd)
38704bc52338SCy Schubert {
3871c1d255d3SCy Schubert char *mac = NULL, *info = NULL, *curve = NULL;
38724bc52338SCy Schubert char *key = NULL;
38734bc52338SCy Schubert u8 *privkey = NULL;
38744bc52338SCy Schubert size_t privkey_len = 0;
38754bc52338SCy Schubert int ret = -1;
38764bc52338SCy Schubert struct dpp_bootstrap_info *bi;
38774bc52338SCy Schubert
38784bc52338SCy Schubert if (!dpp)
38794bc52338SCy Schubert return -1;
38804bc52338SCy Schubert
38814bc52338SCy Schubert bi = os_zalloc(sizeof(*bi));
38824bc52338SCy Schubert if (!bi)
38834bc52338SCy Schubert goto fail;
38844bc52338SCy Schubert
38854bc52338SCy Schubert if (os_strstr(cmd, "type=qrcode"))
38864bc52338SCy Schubert bi->type = DPP_BOOTSTRAP_QR_CODE;
38874bc52338SCy Schubert else if (os_strstr(cmd, "type=pkex"))
38884bc52338SCy Schubert bi->type = DPP_BOOTSTRAP_PKEX;
3889c1d255d3SCy Schubert else if (os_strstr(cmd, "type=nfc-uri"))
3890c1d255d3SCy Schubert bi->type = DPP_BOOTSTRAP_NFC_URI;
38914bc52338SCy Schubert else
38924bc52338SCy Schubert goto fail;
38934bc52338SCy Schubert
3894c1d255d3SCy Schubert bi->chan = get_param(cmd, " chan=");
38954bc52338SCy Schubert mac = get_param(cmd, " mac=");
38964bc52338SCy Schubert info = get_param(cmd, " info=");
38974bc52338SCy Schubert curve = get_param(cmd, " curve=");
38984bc52338SCy Schubert key = get_param(cmd, " key=");
38994bc52338SCy Schubert
39004bc52338SCy Schubert if (key) {
39014bc52338SCy Schubert privkey_len = os_strlen(key) / 2;
39024bc52338SCy Schubert privkey = os_malloc(privkey_len);
39034bc52338SCy Schubert if (!privkey ||
39044bc52338SCy Schubert hexstr2bin(key, privkey, privkey_len) < 0)
39054bc52338SCy Schubert goto fail;
39064bc52338SCy Schubert }
39074bc52338SCy Schubert
3908c1d255d3SCy Schubert if (dpp_keygen(bi, curve, privkey, privkey_len) < 0 ||
3909c1d255d3SCy Schubert dpp_parse_uri_chan_list(bi, bi->chan) < 0 ||
3910c1d255d3SCy Schubert dpp_parse_uri_mac(bi, mac) < 0 ||
3911c1d255d3SCy Schubert dpp_parse_uri_info(bi, info) < 0 ||
3912c1d255d3SCy Schubert dpp_gen_uri(bi) < 0)
39134bc52338SCy Schubert goto fail;
39144bc52338SCy Schubert
39154bc52338SCy Schubert bi->id = dpp_next_id(dpp);
39164bc52338SCy Schubert dl_list_add(&dpp->bootstrap, &bi->list);
39174bc52338SCy Schubert ret = bi->id;
39184bc52338SCy Schubert bi = NULL;
39194bc52338SCy Schubert fail:
39204bc52338SCy Schubert os_free(curve);
39214bc52338SCy Schubert os_free(mac);
39224bc52338SCy Schubert os_free(info);
39234bc52338SCy Schubert str_clear_free(key);
39244bc52338SCy Schubert bin_clear_free(privkey, privkey_len);
39254bc52338SCy Schubert dpp_bootstrap_info_free(bi);
39264bc52338SCy Schubert return ret;
39274bc52338SCy Schubert }
39284bc52338SCy Schubert
39294bc52338SCy Schubert
39304bc52338SCy Schubert struct dpp_bootstrap_info *
dpp_bootstrap_get_id(struct dpp_global * dpp,unsigned int id)39314bc52338SCy Schubert dpp_bootstrap_get_id(struct dpp_global *dpp, unsigned int id)
39324bc52338SCy Schubert {
39334bc52338SCy Schubert struct dpp_bootstrap_info *bi;
39344bc52338SCy Schubert
39354bc52338SCy Schubert if (!dpp)
39364bc52338SCy Schubert return NULL;
39374bc52338SCy Schubert
39384bc52338SCy Schubert dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) {
39394bc52338SCy Schubert if (bi->id == id)
39404bc52338SCy Schubert return bi;
39414bc52338SCy Schubert }
39424bc52338SCy Schubert return NULL;
39434bc52338SCy Schubert }
39444bc52338SCy Schubert
39454bc52338SCy Schubert
dpp_bootstrap_remove(struct dpp_global * dpp,const char * id)39464bc52338SCy Schubert int dpp_bootstrap_remove(struct dpp_global *dpp, const char *id)
39474bc52338SCy Schubert {
39484bc52338SCy Schubert unsigned int id_val;
39494bc52338SCy Schubert
39504bc52338SCy Schubert if (os_strcmp(id, "*") == 0) {
39514bc52338SCy Schubert id_val = 0;
39524bc52338SCy Schubert } else {
39534bc52338SCy Schubert id_val = atoi(id);
39544bc52338SCy Schubert if (id_val == 0)
39554bc52338SCy Schubert return -1;
39564bc52338SCy Schubert }
39574bc52338SCy Schubert
39584bc52338SCy Schubert return dpp_bootstrap_del(dpp, id_val);
39594bc52338SCy Schubert }
39604bc52338SCy Schubert
39614bc52338SCy Schubert
dpp_bootstrap_get_uri(struct dpp_global * dpp,unsigned int id)39624bc52338SCy Schubert const char * dpp_bootstrap_get_uri(struct dpp_global *dpp, unsigned int id)
39634bc52338SCy Schubert {
39644bc52338SCy Schubert struct dpp_bootstrap_info *bi;
39654bc52338SCy Schubert
39664bc52338SCy Schubert bi = dpp_bootstrap_get_id(dpp, id);
39674bc52338SCy Schubert if (!bi)
39684bc52338SCy Schubert return NULL;
39694bc52338SCy Schubert return bi->uri;
39704bc52338SCy Schubert }
39714bc52338SCy Schubert
39724bc52338SCy Schubert
dpp_bootstrap_info(struct dpp_global * dpp,int id,char * reply,int reply_size)39734bc52338SCy Schubert int dpp_bootstrap_info(struct dpp_global *dpp, int id,
39744bc52338SCy Schubert char *reply, int reply_size)
39754bc52338SCy Schubert {
39764bc52338SCy Schubert struct dpp_bootstrap_info *bi;
3977206b73d0SCy Schubert char pkhash[2 * SHA256_MAC_LEN + 1];
39784bc52338SCy Schubert
39794bc52338SCy Schubert bi = dpp_bootstrap_get_id(dpp, id);
39804bc52338SCy Schubert if (!bi)
39814bc52338SCy Schubert return -1;
3982206b73d0SCy Schubert wpa_snprintf_hex(pkhash, sizeof(pkhash), bi->pubkey_hash,
3983206b73d0SCy Schubert SHA256_MAC_LEN);
39844bc52338SCy Schubert return os_snprintf(reply, reply_size, "type=%s\n"
39854bc52338SCy Schubert "mac_addr=" MACSTR "\n"
39864bc52338SCy Schubert "info=%s\n"
39874bc52338SCy Schubert "num_freq=%u\n"
3988c1d255d3SCy Schubert "use_freq=%u\n"
3989206b73d0SCy Schubert "curve=%s\n"
3990c1d255d3SCy Schubert "pkhash=%s\n"
3991c1d255d3SCy Schubert "version=%d\n",
39924bc52338SCy Schubert dpp_bootstrap_type_txt(bi->type),
39934bc52338SCy Schubert MAC2STR(bi->mac_addr),
39944bc52338SCy Schubert bi->info ? bi->info : "",
39954bc52338SCy Schubert bi->num_freq,
3996c1d255d3SCy Schubert bi->num_freq == 1 ? bi->freq[0] : 0,
3997206b73d0SCy Schubert bi->curve->name,
3998c1d255d3SCy Schubert pkhash,
3999c1d255d3SCy Schubert bi->version);
4000c1d255d3SCy Schubert }
4001c1d255d3SCy Schubert
4002c1d255d3SCy Schubert
dpp_bootstrap_set(struct dpp_global * dpp,int id,const char * params)4003c1d255d3SCy Schubert int dpp_bootstrap_set(struct dpp_global *dpp, int id, const char *params)
4004c1d255d3SCy Schubert {
4005c1d255d3SCy Schubert struct dpp_bootstrap_info *bi;
4006c1d255d3SCy Schubert
4007c1d255d3SCy Schubert bi = dpp_bootstrap_get_id(dpp, id);
4008c1d255d3SCy Schubert if (!bi)
4009c1d255d3SCy Schubert return -1;
4010c1d255d3SCy Schubert
4011c1d255d3SCy Schubert str_clear_free(bi->configurator_params);
4012c1d255d3SCy Schubert
4013c1d255d3SCy Schubert if (params) {
4014c1d255d3SCy Schubert bi->configurator_params = os_strdup(params);
4015c1d255d3SCy Schubert return bi->configurator_params ? 0 : -1;
4016c1d255d3SCy Schubert }
4017c1d255d3SCy Schubert
4018c1d255d3SCy Schubert bi->configurator_params = NULL;
4019c1d255d3SCy Schubert return 0;
40204bc52338SCy Schubert }
40214bc52338SCy Schubert
40224bc52338SCy Schubert
dpp_bootstrap_find_pair(struct dpp_global * dpp,const u8 * i_bootstrap,const u8 * r_bootstrap,struct dpp_bootstrap_info ** own_bi,struct dpp_bootstrap_info ** peer_bi)40234bc52338SCy Schubert void dpp_bootstrap_find_pair(struct dpp_global *dpp, const u8 *i_bootstrap,
40244bc52338SCy Schubert const u8 *r_bootstrap,
40254bc52338SCy Schubert struct dpp_bootstrap_info **own_bi,
40264bc52338SCy Schubert struct dpp_bootstrap_info **peer_bi)
40274bc52338SCy Schubert {
40284bc52338SCy Schubert struct dpp_bootstrap_info *bi;
40294bc52338SCy Schubert
40304bc52338SCy Schubert *own_bi = NULL;
40314bc52338SCy Schubert *peer_bi = NULL;
40324bc52338SCy Schubert if (!dpp)
40334bc52338SCy Schubert return;
40344bc52338SCy Schubert
40354bc52338SCy Schubert dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) {
40364bc52338SCy Schubert if (!*own_bi && bi->own &&
40374bc52338SCy Schubert os_memcmp(bi->pubkey_hash, r_bootstrap,
40384bc52338SCy Schubert SHA256_MAC_LEN) == 0) {
40394bc52338SCy Schubert wpa_printf(MSG_DEBUG,
40404bc52338SCy Schubert "DPP: Found matching own bootstrapping information");
40414bc52338SCy Schubert *own_bi = bi;
40424bc52338SCy Schubert }
40434bc52338SCy Schubert
40444bc52338SCy Schubert if (!*peer_bi && !bi->own &&
40454bc52338SCy Schubert os_memcmp(bi->pubkey_hash, i_bootstrap,
40464bc52338SCy Schubert SHA256_MAC_LEN) == 0) {
40474bc52338SCy Schubert wpa_printf(MSG_DEBUG,
40484bc52338SCy Schubert "DPP: Found matching peer bootstrapping information");
40494bc52338SCy Schubert *peer_bi = bi;
40504bc52338SCy Schubert }
40514bc52338SCy Schubert
40524bc52338SCy Schubert if (*own_bi && *peer_bi)
40534bc52338SCy Schubert break;
40544bc52338SCy Schubert }
4055c1d255d3SCy Schubert }
40564bc52338SCy Schubert
4057c1d255d3SCy Schubert
4058c1d255d3SCy Schubert #ifdef CONFIG_DPP2
dpp_bootstrap_find_chirp(struct dpp_global * dpp,const u8 * hash)4059c1d255d3SCy Schubert struct dpp_bootstrap_info * dpp_bootstrap_find_chirp(struct dpp_global *dpp,
4060c1d255d3SCy Schubert const u8 *hash)
4061c1d255d3SCy Schubert {
4062c1d255d3SCy Schubert struct dpp_bootstrap_info *bi;
4063c1d255d3SCy Schubert
4064c1d255d3SCy Schubert if (!dpp)
4065c1d255d3SCy Schubert return NULL;
4066c1d255d3SCy Schubert
4067c1d255d3SCy Schubert dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) {
4068c1d255d3SCy Schubert if (!bi->own && os_memcmp(bi->pubkey_hash_chirp, hash,
4069c1d255d3SCy Schubert SHA256_MAC_LEN) == 0)
4070c1d255d3SCy Schubert return bi;
4071c1d255d3SCy Schubert }
4072c1d255d3SCy Schubert
4073c1d255d3SCy Schubert return NULL;
4074c1d255d3SCy Schubert }
4075c1d255d3SCy Schubert #endif /* CONFIG_DPP2 */
4076c1d255d3SCy Schubert
4077c1d255d3SCy Schubert
dpp_nfc_update_bi_channel(struct dpp_bootstrap_info * own_bi,struct dpp_bootstrap_info * peer_bi)4078c1d255d3SCy Schubert static int dpp_nfc_update_bi_channel(struct dpp_bootstrap_info *own_bi,
4079c1d255d3SCy Schubert struct dpp_bootstrap_info *peer_bi)
4080c1d255d3SCy Schubert {
4081c1d255d3SCy Schubert unsigned int i, freq = 0;
4082c1d255d3SCy Schubert enum hostapd_hw_mode mode;
4083c1d255d3SCy Schubert u8 op_class, channel;
4084c1d255d3SCy Schubert char chan[20];
4085c1d255d3SCy Schubert
4086c1d255d3SCy Schubert if (peer_bi->num_freq == 0 && !peer_bi->channels_listed)
4087c1d255d3SCy Schubert return 0; /* no channel preference/constraint */
4088c1d255d3SCy Schubert
4089c1d255d3SCy Schubert for (i = 0; i < peer_bi->num_freq; i++) {
4090c1d255d3SCy Schubert if ((own_bi->num_freq == 0 && !own_bi->channels_listed) ||
4091c1d255d3SCy Schubert freq_included(own_bi->freq, own_bi->num_freq,
4092c1d255d3SCy Schubert peer_bi->freq[i])) {
4093c1d255d3SCy Schubert freq = peer_bi->freq[i];
4094c1d255d3SCy Schubert break;
4095c1d255d3SCy Schubert }
4096c1d255d3SCy Schubert }
4097c1d255d3SCy Schubert if (!freq) {
4098c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: No common channel found");
4099c1d255d3SCy Schubert return -1;
4100c1d255d3SCy Schubert }
4101c1d255d3SCy Schubert
4102c1d255d3SCy Schubert mode = ieee80211_freq_to_channel_ext(freq, 0, 0, &op_class, &channel);
4103c1d255d3SCy Schubert if (mode == NUM_HOSTAPD_MODES) {
4104c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
4105c1d255d3SCy Schubert "DPP: Could not determine operating class or channel number for %u MHz",
4106c1d255d3SCy Schubert freq);
4107c1d255d3SCy Schubert }
4108c1d255d3SCy Schubert
4109c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
4110c1d255d3SCy Schubert "DPP: Selected %u MHz (op_class %u channel %u) as the negotiation channel based on information from NFC negotiated handover",
4111c1d255d3SCy Schubert freq, op_class, channel);
4112c1d255d3SCy Schubert os_snprintf(chan, sizeof(chan), "%u/%u", op_class, channel);
4113c1d255d3SCy Schubert os_free(own_bi->chan);
4114c1d255d3SCy Schubert own_bi->chan = os_strdup(chan);
4115c1d255d3SCy Schubert own_bi->freq[0] = freq;
4116c1d255d3SCy Schubert own_bi->num_freq = 1;
4117c1d255d3SCy Schubert os_free(peer_bi->chan);
4118c1d255d3SCy Schubert peer_bi->chan = os_strdup(chan);
4119c1d255d3SCy Schubert peer_bi->freq[0] = freq;
4120c1d255d3SCy Schubert peer_bi->num_freq = 1;
4121c1d255d3SCy Schubert
4122c1d255d3SCy Schubert return dpp_gen_uri(own_bi);
4123c1d255d3SCy Schubert }
4124c1d255d3SCy Schubert
4125c1d255d3SCy Schubert
dpp_nfc_update_bi_key(struct dpp_bootstrap_info * own_bi,struct dpp_bootstrap_info * peer_bi)4126c1d255d3SCy Schubert static int dpp_nfc_update_bi_key(struct dpp_bootstrap_info *own_bi,
4127c1d255d3SCy Schubert struct dpp_bootstrap_info *peer_bi)
4128c1d255d3SCy Schubert {
4129c1d255d3SCy Schubert if (peer_bi->curve == own_bi->curve)
4130c1d255d3SCy Schubert return 0;
4131c1d255d3SCy Schubert
4132c1d255d3SCy Schubert wpa_printf(MSG_DEBUG,
4133c1d255d3SCy Schubert "DPP: Update own bootstrapping key to match peer curve from NFC handover");
4134c1d255d3SCy Schubert
41354b72b91aSCy Schubert crypto_ec_key_deinit(own_bi->pubkey);
4136c1d255d3SCy Schubert own_bi->pubkey = NULL;
4137c1d255d3SCy Schubert
4138c1d255d3SCy Schubert if (dpp_keygen(own_bi, peer_bi->curve->name, NULL, 0) < 0 ||
4139c1d255d3SCy Schubert dpp_gen_uri(own_bi) < 0)
4140c1d255d3SCy Schubert goto fail;
4141c1d255d3SCy Schubert
4142c1d255d3SCy Schubert return 0;
4143c1d255d3SCy Schubert fail:
4144c1d255d3SCy Schubert dl_list_del(&own_bi->list);
4145c1d255d3SCy Schubert dpp_bootstrap_info_free(own_bi);
4146c1d255d3SCy Schubert return -1;
4147c1d255d3SCy Schubert }
4148c1d255d3SCy Schubert
4149c1d255d3SCy Schubert
dpp_nfc_update_bi(struct dpp_bootstrap_info * own_bi,struct dpp_bootstrap_info * peer_bi)4150c1d255d3SCy Schubert int dpp_nfc_update_bi(struct dpp_bootstrap_info *own_bi,
4151c1d255d3SCy Schubert struct dpp_bootstrap_info *peer_bi)
4152c1d255d3SCy Schubert {
4153c1d255d3SCy Schubert if (dpp_nfc_update_bi_channel(own_bi, peer_bi) < 0 ||
4154c1d255d3SCy Schubert dpp_nfc_update_bi_key(own_bi, peer_bi) < 0)
4155c1d255d3SCy Schubert return -1;
4156c1d255d3SCy Schubert return 0;
41574bc52338SCy Schubert }
41584bc52338SCy Schubert
41594bc52338SCy Schubert
dpp_next_configurator_id(struct dpp_global * dpp)41604bc52338SCy Schubert static unsigned int dpp_next_configurator_id(struct dpp_global *dpp)
41614bc52338SCy Schubert {
41624bc52338SCy Schubert struct dpp_configurator *conf;
41634bc52338SCy Schubert unsigned int max_id = 0;
41644bc52338SCy Schubert
41654bc52338SCy Schubert dl_list_for_each(conf, &dpp->configurator, struct dpp_configurator,
41664bc52338SCy Schubert list) {
41674bc52338SCy Schubert if (conf->id > max_id)
41684bc52338SCy Schubert max_id = conf->id;
41694bc52338SCy Schubert }
41704bc52338SCy Schubert return max_id + 1;
41714bc52338SCy Schubert }
41724bc52338SCy Schubert
41734bc52338SCy Schubert
dpp_configurator_add(struct dpp_global * dpp,const char * cmd)41744bc52338SCy Schubert int dpp_configurator_add(struct dpp_global *dpp, const char *cmd)
41754bc52338SCy Schubert {
41764bc52338SCy Schubert char *curve = NULL;
4177c1d255d3SCy Schubert char *key = NULL, *ppkey = NULL;
4178c1d255d3SCy Schubert u8 *privkey = NULL, *pp_key = NULL;
4179c1d255d3SCy Schubert size_t privkey_len = 0, pp_key_len = 0;
41804bc52338SCy Schubert int ret = -1;
41814bc52338SCy Schubert struct dpp_configurator *conf = NULL;
41824bc52338SCy Schubert
41834bc52338SCy Schubert curve = get_param(cmd, " curve=");
41844bc52338SCy Schubert key = get_param(cmd, " key=");
4185c1d255d3SCy Schubert ppkey = get_param(cmd, " ppkey=");
41864bc52338SCy Schubert
41874bc52338SCy Schubert if (key) {
41884bc52338SCy Schubert privkey_len = os_strlen(key) / 2;
41894bc52338SCy Schubert privkey = os_malloc(privkey_len);
41904bc52338SCy Schubert if (!privkey ||
41914bc52338SCy Schubert hexstr2bin(key, privkey, privkey_len) < 0)
41924bc52338SCy Schubert goto fail;
41934bc52338SCy Schubert }
41944bc52338SCy Schubert
4195c1d255d3SCy Schubert if (ppkey) {
4196c1d255d3SCy Schubert pp_key_len = os_strlen(ppkey) / 2;
4197c1d255d3SCy Schubert pp_key = os_malloc(pp_key_len);
4198c1d255d3SCy Schubert if (!pp_key ||
4199c1d255d3SCy Schubert hexstr2bin(ppkey, pp_key, pp_key_len) < 0)
4200c1d255d3SCy Schubert goto fail;
4201c1d255d3SCy Schubert }
4202c1d255d3SCy Schubert
4203c1d255d3SCy Schubert conf = dpp_keygen_configurator(curve, privkey, privkey_len,
4204c1d255d3SCy Schubert pp_key, pp_key_len);
42054bc52338SCy Schubert if (!conf)
42064bc52338SCy Schubert goto fail;
42074bc52338SCy Schubert
42084bc52338SCy Schubert conf->id = dpp_next_configurator_id(dpp);
42094bc52338SCy Schubert dl_list_add(&dpp->configurator, &conf->list);
42104bc52338SCy Schubert ret = conf->id;
42114bc52338SCy Schubert conf = NULL;
42124bc52338SCy Schubert fail:
42134bc52338SCy Schubert os_free(curve);
42144bc52338SCy Schubert str_clear_free(key);
4215c1d255d3SCy Schubert str_clear_free(ppkey);
42164bc52338SCy Schubert bin_clear_free(privkey, privkey_len);
4217c1d255d3SCy Schubert bin_clear_free(pp_key, pp_key_len);
42184bc52338SCy Schubert dpp_configurator_free(conf);
42194bc52338SCy Schubert return ret;
42204bc52338SCy Schubert }
42214bc52338SCy Schubert
42224bc52338SCy Schubert
dpp_configurator_del(struct dpp_global * dpp,unsigned int id)42234bc52338SCy Schubert static int dpp_configurator_del(struct dpp_global *dpp, unsigned int id)
42244bc52338SCy Schubert {
42254bc52338SCy Schubert struct dpp_configurator *conf, *tmp;
42264bc52338SCy Schubert int found = 0;
42274bc52338SCy Schubert
42284bc52338SCy Schubert if (!dpp)
42294bc52338SCy Schubert return -1;
42304bc52338SCy Schubert
42314bc52338SCy Schubert dl_list_for_each_safe(conf, tmp, &dpp->configurator,
42324bc52338SCy Schubert struct dpp_configurator, list) {
42334bc52338SCy Schubert if (id && conf->id != id)
42344bc52338SCy Schubert continue;
42354bc52338SCy Schubert found = 1;
42364bc52338SCy Schubert dl_list_del(&conf->list);
42374bc52338SCy Schubert dpp_configurator_free(conf);
42384bc52338SCy Schubert }
42394bc52338SCy Schubert
42404bc52338SCy Schubert if (id == 0)
42414bc52338SCy Schubert return 0; /* flush succeeds regardless of entries found */
42424bc52338SCy Schubert return found ? 0 : -1;
42434bc52338SCy Schubert }
42444bc52338SCy Schubert
42454bc52338SCy Schubert
dpp_configurator_remove(struct dpp_global * dpp,const char * id)42464bc52338SCy Schubert int dpp_configurator_remove(struct dpp_global *dpp, const char *id)
42474bc52338SCy Schubert {
42484bc52338SCy Schubert unsigned int id_val;
42494bc52338SCy Schubert
42504bc52338SCy Schubert if (os_strcmp(id, "*") == 0) {
42514bc52338SCy Schubert id_val = 0;
42524bc52338SCy Schubert } else {
42534bc52338SCy Schubert id_val = atoi(id);
42544bc52338SCy Schubert if (id_val == 0)
42554bc52338SCy Schubert return -1;
42564bc52338SCy Schubert }
42574bc52338SCy Schubert
42584bc52338SCy Schubert return dpp_configurator_del(dpp, id_val);
42594bc52338SCy Schubert }
42604bc52338SCy Schubert
42614bc52338SCy Schubert
dpp_configurator_get_key_id(struct dpp_global * dpp,unsigned int id,char * buf,size_t buflen)42624bc52338SCy Schubert int dpp_configurator_get_key_id(struct dpp_global *dpp, unsigned int id,
42634bc52338SCy Schubert char *buf, size_t buflen)
42644bc52338SCy Schubert {
42654bc52338SCy Schubert struct dpp_configurator *conf;
42664bc52338SCy Schubert
42674bc52338SCy Schubert conf = dpp_configurator_get_id(dpp, id);
42684bc52338SCy Schubert if (!conf)
42694bc52338SCy Schubert return -1;
42704bc52338SCy Schubert
42714bc52338SCy Schubert return dpp_configurator_get_key(conf, buf, buflen);
42724bc52338SCy Schubert }
42734bc52338SCy Schubert
42744bc52338SCy Schubert
4275206b73d0SCy Schubert #ifdef CONFIG_DPP2
4276206b73d0SCy Schubert
dpp_configurator_from_backup(struct dpp_global * dpp,struct dpp_asymmetric_key * key)4277c1d255d3SCy Schubert int dpp_configurator_from_backup(struct dpp_global *dpp,
4278c1d255d3SCy Schubert struct dpp_asymmetric_key *key)
4279206b73d0SCy Schubert {
4280c1d255d3SCy Schubert struct dpp_configurator *conf;
42814b72b91aSCy Schubert const struct dpp_curve_params *curve, *curve_pp;
4282c1d255d3SCy Schubert
4283c1d255d3SCy Schubert if (!key->csign || !key->pp_key)
4284c1d255d3SCy Schubert return -1;
42854b72b91aSCy Schubert
42864b72b91aSCy Schubert curve = dpp_get_curve_ike_group(crypto_ec_key_group(key->csign));
4287c1d255d3SCy Schubert if (!curve) {
4288c1d255d3SCy Schubert wpa_printf(MSG_INFO, "DPP: Unsupported group in c-sign-key");
4289c1d255d3SCy Schubert return -1;
4290206b73d0SCy Schubert }
42914b72b91aSCy Schubert
42924b72b91aSCy Schubert curve_pp = dpp_get_curve_ike_group(crypto_ec_key_group(key->pp_key));
42934b72b91aSCy Schubert if (!curve_pp) {
42944b72b91aSCy Schubert wpa_printf(MSG_INFO, "DPP: Unsupported group in ppKey");
4295c1d255d3SCy Schubert return -1;
42964b72b91aSCy Schubert }
42974b72b91aSCy Schubert
42984b72b91aSCy Schubert if (curve != curve_pp) {
4299c1d255d3SCy Schubert wpa_printf(MSG_INFO,
4300c1d255d3SCy Schubert "DPP: Mismatch in c-sign-key and ppKey groups");
4301c1d255d3SCy Schubert return -1;
4302c1d255d3SCy Schubert }
4303c1d255d3SCy Schubert
4304c1d255d3SCy Schubert conf = os_zalloc(sizeof(*conf));
4305c1d255d3SCy Schubert if (!conf)
4306c1d255d3SCy Schubert return -1;
4307c1d255d3SCy Schubert conf->curve = curve;
4308c1d255d3SCy Schubert conf->csign = key->csign;
4309c1d255d3SCy Schubert key->csign = NULL;
4310c1d255d3SCy Schubert conf->pp_key = key->pp_key;
4311c1d255d3SCy Schubert key->pp_key = NULL;
4312c1d255d3SCy Schubert conf->own = 1;
4313c1d255d3SCy Schubert if (dpp_configurator_gen_kid(conf) < 0) {
4314c1d255d3SCy Schubert dpp_configurator_free(conf);
4315c1d255d3SCy Schubert return -1;
4316c1d255d3SCy Schubert }
4317c1d255d3SCy Schubert
4318c1d255d3SCy Schubert conf->id = dpp_next_configurator_id(dpp);
4319c1d255d3SCy Schubert dl_list_add(&dpp->configurator, &conf->list);
4320c1d255d3SCy Schubert return conf->id;
4321206b73d0SCy Schubert }
4322206b73d0SCy Schubert
4323206b73d0SCy Schubert
dpp_configurator_find_kid(struct dpp_global * dpp,const u8 * kid)4324c1d255d3SCy Schubert struct dpp_configurator * dpp_configurator_find_kid(struct dpp_global *dpp,
4325c1d255d3SCy Schubert const u8 *kid)
4326206b73d0SCy Schubert {
4327c1d255d3SCy Schubert struct dpp_configurator *conf;
4328206b73d0SCy Schubert
4329206b73d0SCy Schubert if (!dpp)
4330c1d255d3SCy Schubert return NULL;
4331206b73d0SCy Schubert
4332c1d255d3SCy Schubert dl_list_for_each(conf, &dpp->configurator,
4333c1d255d3SCy Schubert struct dpp_configurator, list) {
4334c1d255d3SCy Schubert if (os_memcmp(conf->kid_hash, kid, SHA256_MAC_LEN) == 0)
4335c1d255d3SCy Schubert return conf;
4336206b73d0SCy Schubert }
4337c1d255d3SCy Schubert return NULL;
4338206b73d0SCy Schubert }
4339206b73d0SCy Schubert
4340206b73d0SCy Schubert #endif /* CONFIG_DPP2 */
4341206b73d0SCy Schubert
4342206b73d0SCy Schubert
dpp_global_init(struct dpp_global_config * config)4343206b73d0SCy Schubert struct dpp_global * dpp_global_init(struct dpp_global_config *config)
43444bc52338SCy Schubert {
43454bc52338SCy Schubert struct dpp_global *dpp;
43464bc52338SCy Schubert
43474bc52338SCy Schubert dpp = os_zalloc(sizeof(*dpp));
43484bc52338SCy Schubert if (!dpp)
43494bc52338SCy Schubert return NULL;
4350206b73d0SCy Schubert #ifdef CONFIG_DPP2
4351206b73d0SCy Schubert dpp->cb_ctx = config->cb_ctx;
4352c1d255d3SCy Schubert dpp->remove_bi = config->remove_bi;
4353206b73d0SCy Schubert #endif /* CONFIG_DPP2 */
43544bc52338SCy Schubert
43554bc52338SCy Schubert dl_list_init(&dpp->bootstrap);
43564bc52338SCy Schubert dl_list_init(&dpp->configurator);
4357206b73d0SCy Schubert #ifdef CONFIG_DPP2
4358206b73d0SCy Schubert dl_list_init(&dpp->controllers);
4359206b73d0SCy Schubert dl_list_init(&dpp->tcp_init);
4360206b73d0SCy Schubert #endif /* CONFIG_DPP2 */
43614bc52338SCy Schubert
43624bc52338SCy Schubert return dpp;
43634bc52338SCy Schubert }
43644bc52338SCy Schubert
43654bc52338SCy Schubert
dpp_global_clear(struct dpp_global * dpp)43664bc52338SCy Schubert void dpp_global_clear(struct dpp_global *dpp)
43674bc52338SCy Schubert {
43684bc52338SCy Schubert if (!dpp)
43694bc52338SCy Schubert return;
43704bc52338SCy Schubert
43714bc52338SCy Schubert dpp_bootstrap_del(dpp, 0);
43724bc52338SCy Schubert dpp_configurator_del(dpp, 0);
4373206b73d0SCy Schubert #ifdef CONFIG_DPP2
4374206b73d0SCy Schubert dpp_tcp_init_flush(dpp);
4375206b73d0SCy Schubert dpp_relay_flush_controllers(dpp);
4376206b73d0SCy Schubert dpp_controller_stop(dpp);
4377206b73d0SCy Schubert #endif /* CONFIG_DPP2 */
43784bc52338SCy Schubert }
43794bc52338SCy Schubert
43804bc52338SCy Schubert
dpp_global_deinit(struct dpp_global * dpp)43814bc52338SCy Schubert void dpp_global_deinit(struct dpp_global *dpp)
43824bc52338SCy Schubert {
43834bc52338SCy Schubert dpp_global_clear(dpp);
43844bc52338SCy Schubert os_free(dpp);
43854bc52338SCy Schubert }
4386206b73d0SCy Schubert
4387206b73d0SCy Schubert
4388206b73d0SCy Schubert #ifdef CONFIG_DPP2
4389206b73d0SCy Schubert
dpp_build_presence_announcement(struct dpp_bootstrap_info * bi)4390c1d255d3SCy Schubert struct wpabuf * dpp_build_presence_announcement(struct dpp_bootstrap_info *bi)
4391206b73d0SCy Schubert {
4392206b73d0SCy Schubert struct wpabuf *msg;
4393206b73d0SCy Schubert
4394c1d255d3SCy Schubert wpa_printf(MSG_DEBUG, "DPP: Build Presence Announcement frame");
4395c1d255d3SCy Schubert
4396c1d255d3SCy Schubert msg = dpp_alloc_msg(DPP_PA_PRESENCE_ANNOUNCEMENT, 4 + SHA256_MAC_LEN);
4397206b73d0SCy Schubert if (!msg)
4398206b73d0SCy Schubert return NULL;
4399c1d255d3SCy Schubert
4400c1d255d3SCy Schubert /* Responder Bootstrapping Key Hash */
4401c1d255d3SCy Schubert dpp_build_attr_r_bootstrap_key_hash(msg, bi->pubkey_hash_chirp);
4402c1d255d3SCy Schubert wpa_hexdump_buf(MSG_DEBUG,
4403c1d255d3SCy Schubert "DPP: Presence Announcement frame attributes", msg);
4404206b73d0SCy Schubert return msg;
4405206b73d0SCy Schubert }
4406206b73d0SCy Schubert
4407206b73d0SCy Schubert
dpp_notify_chirp_received(void * msg_ctx,int id,const u8 * src,unsigned int freq,const u8 * hash)4408c1d255d3SCy Schubert void dpp_notify_chirp_received(void *msg_ctx, int id, const u8 *src,
4409c1d255d3SCy Schubert unsigned int freq, const u8 *hash)
4410206b73d0SCy Schubert {
4411c1d255d3SCy Schubert char hex[SHA256_MAC_LEN * 2 + 1];
4412206b73d0SCy Schubert
4413c1d255d3SCy Schubert wpa_snprintf_hex(hex, sizeof(hex), hash, SHA256_MAC_LEN);
4414c1d255d3SCy Schubert wpa_msg(msg_ctx, MSG_INFO,
4415c1d255d3SCy Schubert DPP_EVENT_CHIRP_RX "id=%d src=" MACSTR " freq=%u hash=%s",
4416c1d255d3SCy Schubert id, MAC2STR(src), freq, hex);
4417206b73d0SCy Schubert }
4418206b73d0SCy Schubert
4419206b73d0SCy Schubert #endif /* CONFIG_DPP2 */
4420