00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015 #include "includes.h"
00016
00017 #include "common.h"
00018 #include "crypto/aes_wrap.h"
00019 #include "crypto/crypto.h"
00020 #include "crypto/dh_group5.h"
00021 #include "crypto/sha1.h"
00022 #include "crypto/sha256.h"
00023 #include "wps_i.h"
00024 #include "wps_dev_attr.h"
00025
00026
00027 void wps_kdf(const u8 *key, const u8 *label_prefix, size_t label_prefix_len,
00028 const char *label, u8 *res, size_t res_len)
00029 {
00030 u8 i_buf[4], key_bits[4];
00031 const u8 *addr[4];
00032 size_t len[4];
00033 int i, iter;
00034 u8 hash[SHA256_MAC_LEN], *opos;
00035 size_t left;
00036
00037 WPA_PUT_BE32(key_bits, res_len * 8);
00038
00039 addr[0] = i_buf;
00040 len[0] = sizeof(i_buf);
00041 addr[1] = label_prefix;
00042 len[1] = label_prefix_len;
00043 addr[2] = (const u8 *) label;
00044 len[2] = os_strlen(label);
00045 addr[3] = key_bits;
00046 len[3] = sizeof(key_bits);
00047
00048 iter = (res_len + SHA256_MAC_LEN - 1) / SHA256_MAC_LEN;
00049 opos = res;
00050 left = res_len;
00051
00052 for (i = 1; i <= iter; i++) {
00053 WPA_PUT_BE32(i_buf, i);
00054 hmac_sha256_vector(key, SHA256_MAC_LEN, 4, addr, len, hash);
00055 if (i < iter) {
00056 os_memcpy(opos, hash, SHA256_MAC_LEN);
00057 opos += SHA256_MAC_LEN;
00058 left -= SHA256_MAC_LEN;
00059 } else
00060 os_memcpy(opos, hash, left);
00061 }
00062 }
00063
00064
00065 int wps_derive_keys(struct wps_data *wps)
00066 {
00067 struct wpabuf *pubkey, *dh_shared;
00068 u8 dhkey[SHA256_MAC_LEN], kdk[SHA256_MAC_LEN];
00069 const u8 *addr[3];
00070 size_t len[3];
00071 u8 keys[WPS_AUTHKEY_LEN + WPS_KEYWRAPKEY_LEN + WPS_EMSK_LEN];
00072
00073 if (wps->dh_privkey == NULL) {
00074 wpa_printf(MSG_DEBUG, "WPS: Own DH private key not available");
00075 return -1;
00076 }
00077
00078 pubkey = wps->registrar ? wps->dh_pubkey_e : wps->dh_pubkey_r;
00079 if (pubkey == NULL) {
00080 wpa_printf(MSG_DEBUG, "WPS: Peer DH public key not available");
00081 return -1;
00082 }
00083
00084 dh_shared = dh5_derive_shared(wps->dh_ctx, pubkey, wps->dh_privkey);
00085 dh5_free(wps->dh_ctx);
00086 wps->dh_ctx = NULL;
00087 dh_shared = wpabuf_zeropad(dh_shared, 192);
00088 if (dh_shared == NULL) {
00089 wpa_printf(MSG_DEBUG, "WPS: Failed to derive DH shared key");
00090 return -1;
00091 }
00092
00093
00094 wpabuf_free(wps->dh_privkey);
00095 wps->dh_privkey = NULL;
00096
00097 wpa_hexdump_buf_key(MSG_DEBUG, "WPS: DH shared key", dh_shared);
00098
00099
00100 addr[0] = wpabuf_head(dh_shared);
00101 len[0] = wpabuf_len(dh_shared);
00102 sha256_vector(1, addr, len, dhkey);
00103 wpa_hexdump_key(MSG_DEBUG, "WPS: DHKey", dhkey, sizeof(dhkey));
00104 wpabuf_free(dh_shared);
00105
00106
00107 addr[0] = wps->nonce_e;
00108 len[0] = WPS_NONCE_LEN;
00109 addr[1] = wps->mac_addr_e;
00110 len[1] = ETH_ALEN;
00111 addr[2] = wps->nonce_r;
00112 len[2] = WPS_NONCE_LEN;
00113 hmac_sha256_vector(dhkey, sizeof(dhkey), 3, addr, len, kdk);
00114 wpa_hexdump_key(MSG_DEBUG, "WPS: KDK", kdk, sizeof(kdk));
00115
00116 wps_kdf(kdk, NULL, 0, "Wi-Fi Easy and Secure Key Derivation",
00117 keys, sizeof(keys));
00118 os_memcpy(wps->authkey, keys, WPS_AUTHKEY_LEN);
00119 os_memcpy(wps->keywrapkey, keys + WPS_AUTHKEY_LEN, WPS_KEYWRAPKEY_LEN);
00120 os_memcpy(wps->emsk, keys + WPS_AUTHKEY_LEN + WPS_KEYWRAPKEY_LEN,
00121 WPS_EMSK_LEN);
00122
00123 wpa_hexdump_key(MSG_DEBUG, "WPS: AuthKey",
00124 wps->authkey, WPS_AUTHKEY_LEN);
00125 wpa_hexdump_key(MSG_DEBUG, "WPS: KeyWrapKey",
00126 wps->keywrapkey, WPS_KEYWRAPKEY_LEN);
00127 wpa_hexdump_key(MSG_DEBUG, "WPS: EMSK", wps->emsk, WPS_EMSK_LEN);
00128
00129 return 0;
00130 }
00131
00132
00133 void wps_derive_psk(struct wps_data *wps, const u8 *dev_passwd,
00134 size_t dev_passwd_len)
00135 {
00136 u8 hash[SHA256_MAC_LEN];
00137
00138 hmac_sha256(wps->authkey, WPS_AUTHKEY_LEN, dev_passwd,
00139 (dev_passwd_len + 1) / 2, hash);
00140 os_memcpy(wps->psk1, hash, WPS_PSK_LEN);
00141 hmac_sha256(wps->authkey, WPS_AUTHKEY_LEN,
00142 dev_passwd + (dev_passwd_len + 1) / 2,
00143 dev_passwd_len / 2, hash);
00144 os_memcpy(wps->psk2, hash, WPS_PSK_LEN);
00145
00146 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Device Password",
00147 dev_passwd, dev_passwd_len);
00148 wpa_hexdump_key(MSG_DEBUG, "WPS: PSK1", wps->psk1, WPS_PSK_LEN);
00149 wpa_hexdump_key(MSG_DEBUG, "WPS: PSK2", wps->psk2, WPS_PSK_LEN);
00150 }
00151
00152
00153 struct wpabuf * wps_decrypt_encr_settings(struct wps_data *wps, const u8 *encr,
00154 size_t encr_len)
00155 {
00156 struct wpabuf *decrypted;
00157 const size_t block_size = 16;
00158 size_t i;
00159 u8 pad;
00160 const u8 *pos;
00161
00162
00163 if (encr == NULL || encr_len < 2 * block_size || encr_len % block_size)
00164 {
00165 wpa_printf(MSG_DEBUG, "WPS: No Encrypted Settings received");
00166 return NULL;
00167 }
00168
00169 decrypted = wpabuf_alloc(encr_len - block_size);
00170 if (decrypted == NULL)
00171 return NULL;
00172
00173 wpa_hexdump(MSG_MSGDUMP, "WPS: Encrypted Settings", encr, encr_len);
00174 wpabuf_put_data(decrypted, encr + block_size, encr_len - block_size);
00175 if (aes_128_cbc_decrypt(wps->keywrapkey, encr, wpabuf_mhead(decrypted),
00176 wpabuf_len(decrypted))) {
00177 wpabuf_free(decrypted);
00178 return NULL;
00179 }
00180
00181 wpa_hexdump_buf_key(MSG_MSGDUMP, "WPS: Decrypted Encrypted Settings",
00182 decrypted);
00183
00184 pos = wpabuf_head_u8(decrypted) + wpabuf_len(decrypted) - 1;
00185 pad = *pos;
00186 if (pad > wpabuf_len(decrypted)) {
00187 wpa_printf(MSG_DEBUG, "WPS: Invalid PKCS#5 v2.0 pad value");
00188 wpabuf_free(decrypted);
00189 return NULL;
00190 }
00191 for (i = 0; i < pad; i++) {
00192 if (*pos-- != pad) {
00193 wpa_printf(MSG_DEBUG, "WPS: Invalid PKCS#5 v2.0 pad "
00194 "string");
00195 wpabuf_free(decrypted);
00196 return NULL;
00197 }
00198 }
00199 decrypted->used -= pad;
00200
00201 return decrypted;
00202 }
00203
00204
00210 unsigned int wps_pin_checksum(unsigned int pin)
00211 {
00212 unsigned int accum = 0;
00213 while (pin) {
00214 accum += 3 * (pin % 10);
00215 pin /= 10;
00216 accum += pin % 10;
00217 pin /= 10;
00218 }
00219
00220 return (10 - accum % 10) % 10;
00221 }
00222
00223
00229 unsigned int wps_pin_valid(unsigned int pin)
00230 {
00231 return wps_pin_checksum(pin / 10) == (pin % 10);
00232 }
00233
00234
00239 unsigned int wps_generate_pin(void)
00240 {
00241 unsigned int val;
00242
00243
00244 if (os_get_random((unsigned char *) &val, sizeof(val)) < 0) {
00245 struct os_time now;
00246 os_get_time(&now);
00247 val = os_random() ^ now.sec ^ now.usec;
00248 }
00249 val %= 10000000;
00250
00251
00252 return val * 10 + wps_pin_checksum(val);
00253 }
00254
00255
00256 void wps_fail_event(struct wps_context *wps, enum wps_msg_type msg)
00257 {
00258 union wps_event_data data;
00259
00260 if (wps->event_cb == NULL)
00261 return;
00262
00263 os_memset(&data, 0, sizeof(data));
00264 data.fail.msg = msg;
00265 wps->event_cb(wps->cb_ctx, WPS_EV_FAIL, &data);
00266 }
00267
00268
00269 void wps_success_event(struct wps_context *wps)
00270 {
00271 if (wps->event_cb == NULL)
00272 return;
00273
00274 wps->event_cb(wps->cb_ctx, WPS_EV_SUCCESS, NULL);
00275 }
00276
00277
00278 void wps_pwd_auth_fail_event(struct wps_context *wps, int enrollee, int part)
00279 {
00280 union wps_event_data data;
00281
00282 if (wps->event_cb == NULL)
00283 return;
00284
00285 os_memset(&data, 0, sizeof(data));
00286 data.pwd_auth_fail.enrollee = enrollee;
00287 data.pwd_auth_fail.part = part;
00288 wps->event_cb(wps->cb_ctx, WPS_EV_PWD_AUTH_FAIL, &data);
00289 }
00290
00291
00292 void wps_pbc_overlap_event(struct wps_context *wps)
00293 {
00294 if (wps->event_cb == NULL)
00295 return;
00296
00297 wps->event_cb(wps->cb_ctx, WPS_EV_PBC_OVERLAP, NULL);
00298 }
00299
00300
00301 void wps_pbc_timeout_event(struct wps_context *wps)
00302 {
00303 if (wps->event_cb == NULL)
00304 return;
00305
00306 wps->event_cb(wps->cb_ctx, WPS_EV_PBC_TIMEOUT, NULL);
00307 }
00308
00309
00310 #ifdef CONFIG_WPS_OOB
00311
00312 static struct wpabuf * wps_get_oob_cred(struct wps_context *wps)
00313 {
00314 struct wps_data data;
00315 struct wpabuf *plain;
00316
00317 plain = wpabuf_alloc(500);
00318 if (plain == NULL) {
00319 wpa_printf(MSG_ERROR, "WPS: Failed to allocate memory for OOB "
00320 "credential");
00321 return NULL;
00322 }
00323
00324 os_memset(&data, 0, sizeof(data));
00325 data.wps = wps;
00326 data.auth_type = wps->auth_types;
00327 data.encr_type = wps->encr_types;
00328 if (wps_build_version(plain) || wps_build_cred(&data, plain)) {
00329 wpabuf_free(plain);
00330 return NULL;
00331 }
00332
00333 return plain;
00334 }
00335
00336
00337 static struct wpabuf * wps_get_oob_dev_pwd(struct wps_context *wps)
00338 {
00339 struct wpabuf *data;
00340
00341 data = wpabuf_alloc(9 + WPS_OOB_DEVICE_PASSWORD_ATTR_LEN);
00342 if (data == NULL) {
00343 wpa_printf(MSG_ERROR, "WPS: Failed to allocate memory for OOB "
00344 "device password attribute");
00345 return NULL;
00346 }
00347
00348 wpabuf_free(wps->oob_conf.dev_password);
00349 wps->oob_conf.dev_password =
00350 wpabuf_alloc(WPS_OOB_DEVICE_PASSWORD_LEN * 2 + 1);
00351 if (wps->oob_conf.dev_password == NULL) {
00352 wpa_printf(MSG_ERROR, "WPS: Failed to allocate memory for OOB "
00353 "device password");
00354 wpabuf_free(data);
00355 return NULL;
00356 }
00357
00358 if (wps_build_version(data) ||
00359 wps_build_oob_dev_password(data, wps)) {
00360 wpa_printf(MSG_ERROR, "WPS: Build OOB device password "
00361 "attribute error");
00362 wpabuf_free(data);
00363 return NULL;
00364 }
00365
00366 return data;
00367 }
00368
00369
00370 static int wps_parse_oob_dev_pwd(struct wps_context *wps,
00371 struct wpabuf *data)
00372 {
00373 struct oob_conf_data *oob_conf = &wps->oob_conf;
00374 struct wps_parse_attr attr;
00375 const u8 *pos;
00376
00377 if (wps_parse_msg(data, &attr) < 0 ||
00378 attr.oob_dev_password == NULL) {
00379 wpa_printf(MSG_ERROR, "WPS: OOB device password not found");
00380 return -1;
00381 }
00382
00383 pos = attr.oob_dev_password;
00384
00385 oob_conf->pubkey_hash =
00386 wpabuf_alloc_copy(pos, WPS_OOB_PUBKEY_HASH_LEN);
00387 if (oob_conf->pubkey_hash == NULL) {
00388 wpa_printf(MSG_ERROR, "WPS: Failed to allocate memory for OOB "
00389 "public key hash");
00390 return -1;
00391 }
00392 pos += WPS_OOB_PUBKEY_HASH_LEN;
00393
00394 wps->oob_dev_pw_id = WPA_GET_BE16(pos);
00395 pos += sizeof(wps->oob_dev_pw_id);
00396
00397 oob_conf->dev_password =
00398 wpabuf_alloc(WPS_OOB_DEVICE_PASSWORD_LEN * 2 + 1);
00399 if (oob_conf->dev_password == NULL) {
00400 wpa_printf(MSG_ERROR, "WPS: Failed to allocate memory for OOB "
00401 "device password");
00402 return -1;
00403 }
00404 wpa_snprintf_hex_uppercase(wpabuf_put(oob_conf->dev_password,
00405 wpabuf_size(oob_conf->dev_password)),
00406 wpabuf_size(oob_conf->dev_password), pos,
00407 WPS_OOB_DEVICE_PASSWORD_LEN);
00408
00409 return 0;
00410 }
00411
00412
00413 static int wps_parse_oob_cred(struct wps_context *wps, struct wpabuf *data)
00414 {
00415 struct wpabuf msg;
00416 struct wps_parse_attr attr;
00417 size_t i;
00418
00419 if (wps_parse_msg(data, &attr) < 0 || attr.num_cred <= 0) {
00420 wpa_printf(MSG_ERROR, "WPS: OOB credential not found");
00421 return -1;
00422 }
00423
00424 for (i = 0; i < attr.num_cred; i++) {
00425 struct wps_credential local_cred;
00426 struct wps_parse_attr cattr;
00427
00428 os_memset(&local_cred, 0, sizeof(local_cred));
00429 wpabuf_set(&msg, attr.cred[i], attr.cred_len[i]);
00430 if (wps_parse_msg(&msg, &cattr) < 0 ||
00431 wps_process_cred(&cattr, &local_cred)) {
00432 wpa_printf(MSG_ERROR, "WPS: Failed to parse OOB "
00433 "credential");
00434 return -1;
00435 }
00436 wps->cred_cb(wps->cb_ctx, &local_cred);
00437 }
00438
00439 return 0;
00440 }
00441
00442
00443 int wps_process_oob(struct wps_context *wps, struct oob_device_data *oob_dev,
00444 int registrar)
00445 {
00446 struct wpabuf *data;
00447 int ret, write_f, oob_method = wps->oob_conf.oob_method;
00448 void *oob_priv;
00449
00450 write_f = oob_method == OOB_METHOD_DEV_PWD_E ? !registrar : registrar;
00451
00452 oob_priv = oob_dev->init_func(wps, oob_dev, registrar);
00453 if (oob_priv == NULL) {
00454 wpa_printf(MSG_ERROR, "WPS: Failed to initialize OOB device");
00455 return -1;
00456 }
00457
00458 if (write_f) {
00459 if (oob_method == OOB_METHOD_CRED)
00460 data = wps_get_oob_cred(wps);
00461 else
00462 data = wps_get_oob_dev_pwd(wps);
00463
00464 ret = 0;
00465 if (data == NULL || oob_dev->write_func(oob_priv, data) < 0)
00466 ret = -1;
00467 } else {
00468 data = oob_dev->read_func(oob_priv);
00469 if (data == NULL)
00470 ret = -1;
00471 else {
00472 if (oob_method == OOB_METHOD_CRED)
00473 ret = wps_parse_oob_cred(wps, data);
00474 else
00475 ret = wps_parse_oob_dev_pwd(wps, data);
00476 }
00477 }
00478 wpabuf_free(data);
00479 oob_dev->deinit_func(oob_priv);
00480
00481 if (ret < 0) {
00482 wpa_printf(MSG_ERROR, "WPS: Failed to process OOB data");
00483 return -1;
00484 }
00485
00486 return 0;
00487 }
00488
00489
00490 struct oob_device_data * wps_get_oob_device(char *device_type)
00491 {
00492 #ifdef CONFIG_WPS_UFD
00493 if (os_strstr(device_type, "ufd") != NULL)
00494 return &oob_ufd_device_data;
00495 #endif
00496 #ifdef CONFIG_WPS_NFC
00497 if (os_strstr(device_type, "nfc") != NULL)
00498 return &oob_nfc_device_data;
00499 #endif
00500
00501 return NULL;
00502 }
00503
00504
00505 #ifdef CONFIG_WPS_NFC
00506 struct oob_nfc_device_data * wps_get_oob_nfc_device(char *device_name)
00507 {
00508 if (device_name == NULL)
00509 return NULL;
00510 #ifdef CONFIG_WPS_NFC_PN531
00511 if (os_strstr(device_name, "pn531") != NULL)
00512 return &oob_nfc_pn531_device_data;
00513 #endif
00514
00515 return NULL;
00516 }
00517 #endif
00518
00519
00520 int wps_get_oob_method(char *method)
00521 {
00522 if (os_strstr(method, "pin-e") != NULL)
00523 return OOB_METHOD_DEV_PWD_E;
00524 if (os_strstr(method, "pin-r") != NULL)
00525 return OOB_METHOD_DEV_PWD_R;
00526 if (os_strstr(method, "cred") != NULL)
00527 return OOB_METHOD_CRED;
00528 return OOB_METHOD_UNKNOWN;
00529 }
00530
00531 #endif
00532
00533
00534 int wps_dev_type_str2bin(const char *str, u8 dev_type[WPS_DEV_TYPE_LEN])
00535 {
00536 const char *pos;
00537
00538
00539 WPA_PUT_BE16(dev_type, atoi(str));
00540 pos = os_strchr(str, '-');
00541 if (pos == NULL)
00542 return -1;
00543 pos++;
00544 if (hexstr2bin(pos, &dev_type[2], 4))
00545 return -1;
00546 pos = os_strchr(pos, '-');
00547 if (pos == NULL)
00548 return -1;
00549 pos++;
00550 WPA_PUT_BE16(&dev_type[6], atoi(pos));
00551
00552
00553 return 0;
00554 }
00555
00556
00557 char * wps_dev_type_bin2str(const u8 dev_type[WPS_DEV_TYPE_LEN], char *buf,
00558 size_t buf_len)
00559 {
00560 int ret;
00561
00562 ret = os_snprintf(buf, buf_len, "%u-%08X-%u",
00563 WPA_GET_BE16(dev_type), WPA_GET_BE32(&dev_type[2]),
00564 WPA_GET_BE16(&dev_type[6]));
00565 if (ret < 0 || (unsigned int) ret >= buf_len)
00566 return NULL;
00567
00568 return buf;
00569 }
00570
00571
00572 void uuid_gen_mac_addr(const u8 *mac_addr, u8 *uuid)
00573 {
00574 const u8 *addr[2];
00575 size_t len[2];
00576 u8 hash[SHA1_MAC_LEN];
00577 u8 nsid[16] = {
00578 0x52, 0x64, 0x80, 0xf8,
00579 0xc9, 0x9b,
00580 0x4b, 0xe5,
00581 0xa6, 0x55,
00582 0x58, 0xed, 0x5f, 0x5d, 0x60, 0x84
00583 };
00584
00585 addr[0] = nsid;
00586 len[0] = sizeof(nsid);
00587 addr[1] = mac_addr;
00588 len[1] = 6;
00589 sha1_vector(2, addr, len, hash);
00590 os_memcpy(uuid, hash, 16);
00591
00592
00593 uuid[6] = (5 << 4) | (uuid[6] & 0x0f);
00594
00595
00596 uuid[8] = 0x80 | (uuid[8] & 0x3f);
00597 }
00598
00599
00600 u16 wps_config_methods_str2bin(const char *str)
00601 {
00602 u16 methods = 0;
00603
00604 if (str == NULL) {
00605
00606 methods |= WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD;
00607 #ifdef CONFIG_WPS_UFD
00608 methods |= WPS_CONFIG_USBA;
00609 #endif
00610 #ifdef CONFIG_WPS_NFC
00611 methods |= WPS_CONFIG_NFC_INTERFACE;
00612 #endif
00613 } else {
00614 if (os_strstr(str, "usba"))
00615 methods |= WPS_CONFIG_USBA;
00616 if (os_strstr(str, "ethernet"))
00617 methods |= WPS_CONFIG_ETHERNET;
00618 if (os_strstr(str, "label"))
00619 methods |= WPS_CONFIG_LABEL;
00620 if (os_strstr(str, "display"))
00621 methods |= WPS_CONFIG_DISPLAY;
00622 if (os_strstr(str, "ext_nfc_token"))
00623 methods |= WPS_CONFIG_EXT_NFC_TOKEN;
00624 if (os_strstr(str, "int_nfc_token"))
00625 methods |= WPS_CONFIG_INT_NFC_TOKEN;
00626 if (os_strstr(str, "nfc_interface"))
00627 methods |= WPS_CONFIG_NFC_INTERFACE;
00628 if (os_strstr(str, "push_button"))
00629 methods |= WPS_CONFIG_PUSHBUTTON;
00630 if (os_strstr(str, "keypad"))
00631 methods |= WPS_CONFIG_KEYPAD;
00632 }
00633
00634 return methods;
00635 }
