src/wps/wps_attr_build.c

   1 /*
   2  * Wi-Fi Protected Setup - attribute building
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "crypto/aes_wrap.h"
  19 #include "crypto/crypto.h"
  20 #include "crypto/dh_group5.h"
  21 #include "crypto/sha256.h"
  22 #include "common/ieee802_11_defs.h"
  23 #include "wps_i.h"
  24
  25
  26 int wps_build_public_key(struct wps_data *wps, struct wpabuf *msg)
  27 {
  28         struct wpabuf *pubkey;
  29
  30         wpa_printf(MSG_DEBUG, "WPS:  * Public Key");
  31         wpabuf_free(wps->dh_privkey);
  32         if (wps->dev_pw_id != DEV_PW_DEFAULT && wps->wps->dh_privkey) {
  33                 wpa_printf(MSG_DEBUG, "WPS: Using pre-configured DH keys");
  34                 wps->dh_privkey = wpabuf_dup(wps->wps->dh_privkey);
  35                 wps->dh_ctx = wps->wps->dh_ctx;
  36                 wps->wps->dh_ctx = NULL;
  37                 pubkey = wpabuf_dup(wps->wps->dh_pubkey);
  38         } else {
  39                 wpa_printf(MSG_DEBUG, "WPS: Generate new DH keys");
  40                 wps->dh_privkey = NULL;
  41                 dh5_free(wps->dh_ctx);
  42                 wps->dh_ctx = dh5_init(&wps->dh_privkey, &pubkey);
  43                 pubkey = wpabuf_zeropad(pubkey, 192);
  44         }
  45         if (wps->dh_ctx == NULL || wps->dh_privkey == NULL || pubkey == NULL) {
  46                 wpa_printf(MSG_DEBUG, "WPS: Failed to initialize "
  47                            "Diffie-Hellman handshake");
  48                 wpabuf_free(pubkey);
  49                 return -1;
  50         }
  51         wpa_hexdump_buf_key(MSG_DEBUG, "WPS: DH Private Key", wps->dh_privkey);
  52         wpa_hexdump_buf(MSG_DEBUG, "WPS: DH own Public Key", pubkey);
  53
  54         wpabuf_put_be16(msg, ATTR_PUBLIC_KEY);
  55         wpabuf_put_be16(msg, wpabuf_len(pubkey));
  56         wpabuf_put_buf(msg, pubkey);
  57
  58         if (wps->registrar) {
  59                 wpabuf_free(wps->dh_pubkey_r);
  60                 wps->dh_pubkey_r = pubkey;
  61         } else {
  62                 wpabuf_free(wps->dh_pubkey_e);
  63                 wps->dh_pubkey_e = pubkey;
  64         }
  65
  66         return 0;
  67 }
  68
  69
  70 int wps_build_req_type(struct wpabuf *msg, enum wps_request_type type)
  71 {
  72         wpa_printf(MSG_DEBUG, "WPS:  * Request Type");
  73         wpabuf_put_be16(msg, ATTR_REQUEST_TYPE);
  74         wpabuf_put_be16(msg, 1);
  75         wpabuf_put_u8(msg, type);
  76         return 0;
  77 }
  78
  79
  80 int wps_build_resp_type(struct wpabuf *msg, enum wps_response_type type)
  81 {
  82         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", type);
  83         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
  84         wpabuf_put_be16(msg, 1);
  85         wpabuf_put_u8(msg, type);
  86         return 0;
  87 }
  88
  89
  90 int wps_build_config_methods(struct wpabuf *msg, u16 methods)
  91 {
  92         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
  93         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
  94         wpabuf_put_be16(msg, 2);
  95         wpabuf_put_be16(msg, methods);
  96         return 0;
  97 }
  98
  99
 100 int wps_build_uuid_e(struct wpabuf *msg, const u8 *uuid)
 101 {
 102         wpa_printf(MSG_DEBUG, "WPS:  * UUID-E");
 103         wpabuf_put_be16(msg, ATTR_UUID_E);
 104         wpabuf_put_be16(msg, WPS_UUID_LEN);
 105         wpabuf_put_data(msg, uuid, WPS_UUID_LEN);
 106         return 0;
 107 }
 108
 109
 110 int wps_build_dev_password_id(struct wpabuf *msg, u16 id)
 111 {
 112         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 113         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 114         wpabuf_put_be16(msg, 2);
 115         wpabuf_put_be16(msg, id);
 116         return 0;
 117 }
 118
 119
 120 int wps_build_config_error(struct wpabuf *msg, u16 err)
 121 {
 122         wpa_printf(MSG_DEBUG, "WPS:  * Configuration Error (%d)", err);
 123         wpabuf_put_be16(msg, ATTR_CONFIG_ERROR);
 124         wpabuf_put_be16(msg, 2);
 125         wpabuf_put_be16(msg, err);
 126         return 0;
 127 }
 128
 129
 130 int wps_build_authenticator(struct wps_data *wps, struct wpabuf *msg)
 131 {
 132         u8 hash[SHA256_MAC_LEN];
 133         const u8 *addr[2];
 134         size_t len[2];
 135
 136         if (wps->last_msg == NULL) {
 137                 wpa_printf(MSG_DEBUG, "WPS: Last message not available for "
 138                            "building authenticator");
 139                 return -1;
 140         }
 141
 142         /* Authenticator = HMAC-SHA256_AuthKey(M_prev || M_curr*)
 143          * (M_curr* is M_curr without the Authenticator attribute)
 144          */
 145         addr[0] = wpabuf_head(wps->last_msg);
 146         len[0] = wpabuf_len(wps->last_msg);
 147         addr[1] = wpabuf_head(msg);
 148         len[1] = wpabuf_len(msg);
 149         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 2, addr, len, hash);
 150
 151         wpa_printf(MSG_DEBUG, "WPS:  * Authenticator");
 152         wpabuf_put_be16(msg, ATTR_AUTHENTICATOR);
 153         wpabuf_put_be16(msg, WPS_AUTHENTICATOR_LEN);
 154         wpabuf_put_data(msg, hash, WPS_AUTHENTICATOR_LEN);
 155
 156         return 0;
 157 }
 158
 159
 160 int wps_build_version(struct wpabuf *msg)
 161 {
 162         /*
 163          * Note: This attribute is deprecated and set to hardcoded 0x10 for
 164          * backwards compatibility reasons. The real version negotiation is
 165          * done with Version2.
 166          */
 167         wpa_printf(MSG_DEBUG, "WPS:  * Version (hardcoded 0x10)");
 168         wpabuf_put_be16(msg, ATTR_VERSION);
 169         wpabuf_put_be16(msg, 1);
 170         wpabuf_put_u8(msg, 0x10);
 171         return 0;
 172 }
 173
 174
 175 int wps_build_version2(struct wpabuf *msg)
 176 {
 177         wpa_printf(MSG_DEBUG, "WPS:  * Version2 (0x%x)", WPS_VERSION);
 178         wpabuf_put_be16(msg, ATTR_VERSION2);
 179         wpabuf_put_be16(msg, 1);
 180         wpabuf_put_u8(msg, WPS_VERSION);
 181         return 0;
 182 }
 183
 184
 185 int wps_build_msg_type(struct wpabuf *msg, enum wps_msg_type msg_type)
 186 {
 187         wpa_printf(MSG_DEBUG, "WPS:  * Message Type (%d)", msg_type);
 188         wpabuf_put_be16(msg, ATTR_MSG_TYPE);
 189         wpabuf_put_be16(msg, 1);
 190         wpabuf_put_u8(msg, msg_type);
 191         return 0;
 192 }
 193
 194
 195 int wps_build_enrollee_nonce(struct wps_data *wps, struct wpabuf *msg)
 196 {
 197         wpa_printf(MSG_DEBUG, "WPS:  * Enrollee Nonce");
 198         wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE);
 199         wpabuf_put_be16(msg, WPS_NONCE_LEN);
 200         wpabuf_put_data(msg, wps->nonce_e, WPS_NONCE_LEN);
 201         return 0;
 202 }
 203
 204
 205 int wps_build_registrar_nonce(struct wps_data *wps, struct wpabuf *msg)
 206 {
 207         wpa_printf(MSG_DEBUG, "WPS:  * Registrar Nonce");
 208         wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
 209         wpabuf_put_be16(msg, WPS_NONCE_LEN);
 210         wpabuf_put_data(msg, wps->nonce_r, WPS_NONCE_LEN);
 211         return 0;
 212 }
 213
 214
 215 int wps_build_auth_type_flags(struct wps_data *wps, struct wpabuf *msg)
 216 {
 217         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type Flags");
 218         wpabuf_put_be16(msg, ATTR_AUTH_TYPE_FLAGS);
 219         wpabuf_put_be16(msg, 2);
 220         wpabuf_put_be16(msg, WPS_AUTH_TYPES);
 221         return 0;
 222 }
 223
 224
 225 int wps_build_encr_type_flags(struct wps_data *wps, struct wpabuf *msg)
 226 {
 227         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type Flags");
 228         wpabuf_put_be16(msg, ATTR_ENCR_TYPE_FLAGS);
 229         wpabuf_put_be16(msg, 2);
 230         wpabuf_put_be16(msg, WPS_ENCR_TYPES);
 231         return 0;
 232 }
 233
 234
 235 int wps_build_conn_type_flags(struct wps_data *wps, struct wpabuf *msg)
 236 {
 237         wpa_printf(MSG_DEBUG, "WPS:  * Connection Type Flags");
 238         wpabuf_put_be16(msg, ATTR_CONN_TYPE_FLAGS);
 239         wpabuf_put_be16(msg, 1);
 240         wpabuf_put_u8(msg, WPS_CONN_ESS);
 241         return 0;
 242 }
 243
 244
 245 int wps_build_assoc_state(struct wps_data *wps, struct wpabuf *msg)
 246 {
 247         wpa_printf(MSG_DEBUG, "WPS:  * Association State");
 248         wpabuf_put_be16(msg, ATTR_ASSOC_STATE);
 249         wpabuf_put_be16(msg, 2);
 250         wpabuf_put_be16(msg, WPS_ASSOC_NOT_ASSOC);
 251         return 0;
 252 }
 253
 254
 255 int wps_build_key_wrap_auth(struct wps_data *wps, struct wpabuf *msg)
 256 {
 257         u8 hash[SHA256_MAC_LEN];
 258
 259         wpa_printf(MSG_DEBUG, "WPS:  * Key Wrap Authenticator");
 260         hmac_sha256(wps->authkey, WPS_AUTHKEY_LEN, wpabuf_head(msg),
 261                     wpabuf_len(msg), hash);
 262
 263         wpabuf_put_be16(msg, ATTR_KEY_WRAP_AUTH);
 264         wpabuf_put_be16(msg, WPS_KWA_LEN);
 265         wpabuf_put_data(msg, hash, WPS_KWA_LEN);
 266         return 0;
 267 }
 268
 269
 270 int wps_build_encr_settings(struct wps_data *wps, struct wpabuf *msg,
 271                             struct wpabuf *plain)
 272 {
 273         size_t pad_len;
 274         const size_t block_size = 16;
 275         u8 *iv, *data;
 276
 277         wpa_printf(MSG_DEBUG, "WPS:  * Encrypted Settings");
 278
 279         /* PKCS#5 v2.0 pad */
 280         pad_len = block_size - wpabuf_len(plain) % block_size;
 281         os_memset(wpabuf_put(plain, pad_len), pad_len, pad_len);
 282
 283         wpabuf_put_be16(msg, ATTR_ENCR_SETTINGS);
 284         wpabuf_put_be16(msg, block_size + wpabuf_len(plain));
 285
 286         iv = wpabuf_put(msg, block_size);
 287         if (os_get_random(iv, block_size) < 0)
 288                 return -1;
 289
 290         data = wpabuf_put(msg, 0);
 291         wpabuf_put_buf(msg, plain);
 292         if (aes_128_cbc_encrypt(wps->keywrapkey, iv, data, wpabuf_len(plain)))
 293                 return -1;
 294
 295         return 0;
 296 }
 297
 298
 299 #ifdef CONFIG_WPS_OOB
 300 int wps_build_oob_dev_password(struct wpabuf *msg, struct wps_context *wps)
 301 {
 302         size_t hash_len;
 303         const u8 *addr[1];
 304         u8 pubkey_hash[WPS_HASH_LEN];
 305         u8 dev_password_bin[WPS_OOB_DEVICE_PASSWORD_LEN];
 306
 307         wpa_printf(MSG_DEBUG, "WPS:  * OOB Device Password");
 308
 309         addr[0] = wpabuf_head(wps->dh_pubkey);
 310         hash_len = wpabuf_len(wps->dh_pubkey);
 311         sha256_vector(1, addr, &hash_len, pubkey_hash);
 312
 313         if (os_get_random((u8 *) &wps->oob_dev_pw_id, sizeof(u16)) < 0) {
 314                 wpa_printf(MSG_ERROR, "WPS: device password id "
 315                            "generation error");
 316                 return -1;
 317         }
 318         wps->oob_dev_pw_id |= 0x0010;
 319
 320         if (os_get_random(dev_password_bin, WPS_OOB_DEVICE_PASSWORD_LEN) < 0) {
 321                 wpa_printf(MSG_ERROR, "WPS: OOB device password "
 322                            "generation error");
 323                 return -1;
 324         }
 325
 326         wpabuf_put_be16(msg, ATTR_OOB_DEVICE_PASSWORD);
 327         wpabuf_put_be16(msg, WPS_OOB_DEVICE_PASSWORD_ATTR_LEN);
 328         wpabuf_put_data(msg, pubkey_hash, WPS_OOB_PUBKEY_HASH_LEN);
 329         wpabuf_put_be16(msg, wps->oob_dev_pw_id);
 330         wpabuf_put_data(msg, dev_password_bin, WPS_OOB_DEVICE_PASSWORD_LEN);
 331
 332         wpa_snprintf_hex_uppercase(
 333                 wpabuf_put(wps->oob_conf.dev_password,
 334                            wpabuf_size(wps->oob_conf.dev_password)),
 335                 wpabuf_size(wps->oob_conf.dev_password),
 336                 dev_password_bin, WPS_OOB_DEVICE_PASSWORD_LEN);
 337
 338         return 0;
 339 }
 340 #endif /* CONFIG_WPS_OOB */
 341
 342
 343 int wps_build_req_to_enroll(struct wpabuf *msg)
 344 {
 345         wpa_printf(MSG_DEBUG, "WPS:  * Request to Enroll (1)");
 346         wpabuf_put_be16(msg, ATTR_REQUEST_TO_ENROLL);
 347         wpabuf_put_be16(msg, 1);
 348         wpabuf_put_u8(msg, 1);
 349         return 0;
 350 }
 351
 352
 353 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 354 struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 355 {
 356         struct wpabuf *ie;
 357         const u8 *pos, *end;
 358
 359         ie = wpabuf_alloc(wpabuf_len(data) + 100);
 360         if (ie == NULL) {
 361                 wpabuf_free(data);
 362                 return NULL;
 363         }
 364
 365         pos = wpabuf_head(data);
 366         end = pos + wpabuf_len(data);
 367
 368         while (end > pos) {
 369                 size_t frag_len = end - pos;
 370                 if (frag_len > 251)
 371                         frag_len = 251;
 372                 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 373                 wpabuf_put_u8(ie, 4 + frag_len);
 374                 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
 375                 wpabuf_put_data(ie, pos, frag_len);
 376                 pos += frag_len;
 377         }
 378
 379         wpabuf_free(data);
 380
 381         return ie;
 382 }