wps_attr_process.c revision c5ec7f57ead87efa365800228aa0b09a12d9e6c4 
1/*
2 * Wi-Fi Protected Setup - attribute processing
3 * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#include "includes.h"
10
11#include "common.h"
12#include "crypto/sha256.h"
13#include "wps_i.h"
14
15
16int wps_process_authenticator(struct wps_data *wps, const u8 *authenticator,
17			      const struct wpabuf *msg)
18{
19	u8 hash[SHA256_MAC_LEN];
20	const u8 *addr[2];
21	size_t len[2];
22
23	if (authenticator == NULL) {
24		wpa_printf(MSG_DEBUG, "WPS: No Authenticator attribute "
25			   "included");
26		return -1;
27	}
28
29	if (wps->last_msg == NULL) {
30		wpa_printf(MSG_DEBUG, "WPS: Last message not available for "
31			   "validating authenticator");
32		return -1;
33	}
34
35	/* Authenticator = HMAC-SHA256_AuthKey(M_prev || M_curr*)
36	 * (M_curr* is M_curr without the Authenticator attribute)
37	 */
38	addr[0] = wpabuf_head(wps->last_msg);
39	len[0] = wpabuf_len(wps->last_msg);
40	addr[1] = wpabuf_head(msg);
41	len[1] = wpabuf_len(msg) - 4 - WPS_AUTHENTICATOR_LEN;
42	hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 2, addr, len, hash);
43
44	if (os_memcmp(hash, authenticator, WPS_AUTHENTICATOR_LEN) != 0) {
45		wpa_printf(MSG_DEBUG, "WPS: Incorrect Authenticator");
46		return -1;
47	}
48
49	return 0;
50}
51
52
53int wps_process_key_wrap_auth(struct wps_data *wps, struct wpabuf *msg,
54			      const u8 *key_wrap_auth)
55{
56	u8 hash[SHA256_MAC_LEN];
57	const u8 *head;
58	size_t len;
59
60	if (key_wrap_auth == NULL) {
61		wpa_printf(MSG_DEBUG, "WPS: No KWA in decrypted attribute");
62		return -1;
63	}
64
65	head = wpabuf_head(msg);
66	len = wpabuf_len(msg) - 4 - WPS_KWA_LEN;
67	if (head + len != key_wrap_auth - 4) {
68		wpa_printf(MSG_DEBUG, "WPS: KWA not in the end of the "
69			   "decrypted attribute");
70		return -1;
71	}
72
73	hmac_sha256(wps->authkey, WPS_AUTHKEY_LEN, head, len, hash);
74	if (os_memcmp(hash, key_wrap_auth, WPS_KWA_LEN) != 0) {
75		wpa_printf(MSG_DEBUG, "WPS: Invalid KWA");
76		return -1;
77	}
78
79	return 0;
80}
81
82
83static int wps_process_cred_network_idx(struct wps_credential *cred,
84					const u8 *idx)
85{
86	if (idx == NULL) {
87		wpa_printf(MSG_DEBUG, "WPS: Credential did not include "
88			   "Network Index");
89		return -1;
90	}
91
92	wpa_printf(MSG_DEBUG, "WPS: Network Index: %d", *idx);
93
94	return 0;
95}
96
97
98static int wps_process_cred_ssid(struct wps_credential *cred, const u8 *ssid,
99				 size_t ssid_len)
100{
101	if (ssid == NULL) {
102		wpa_printf(MSG_DEBUG, "WPS: Credential did not include SSID");
103		return -1;
104	}
105
106	/* Remove zero-padding since some Registrar implementations seem to use
107	 * hardcoded 32-octet length for this attribute */
108	while (ssid_len > 0 && ssid[ssid_len - 1] == 0)
109		ssid_len--;
110
111	wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", ssid, ssid_len);
112	if (ssid_len <= sizeof(cred->ssid)) {
113		os_memcpy(cred->ssid, ssid, ssid_len);
114		cred->ssid_len = ssid_len;
115	}
116
117	return 0;
118}
119
120
121static int wps_process_cred_auth_type(struct wps_credential *cred,
122				      const u8 *auth_type)
123{
124	if (auth_type == NULL) {
125		wpa_printf(MSG_DEBUG, "WPS: Credential did not include "
126			   "Authentication Type");
127		return -1;
128	}
129
130	cred->auth_type = WPA_GET_BE16(auth_type);
131	wpa_printf(MSG_DEBUG, "WPS: Authentication Type: 0x%x",
132		   cred->auth_type);
133
134	return 0;
135}
136
137
138static int wps_process_cred_encr_type(struct wps_credential *cred,
139				      const u8 *encr_type)
140{
141	if (encr_type == NULL) {
142		wpa_printf(MSG_DEBUG, "WPS: Credential did not include "
143			   "Encryption Type");
144		return -1;
145	}
146
147	cred->encr_type = WPA_GET_BE16(encr_type);
148	wpa_printf(MSG_DEBUG, "WPS: Encryption Type: 0x%x",
149		   cred->encr_type);
150
151	return 0;
152}
153
154
155static int wps_process_cred_network_key_idx(struct wps_credential *cred,
156					    const u8 *key_idx)
157{
158	if (key_idx == NULL)
159		return 0; /* optional attribute */
160
161	wpa_printf(MSG_DEBUG, "WPS: Network Key Index: %d", *key_idx);
162	cred->key_idx = *key_idx;
163
164	return 0;
165}
166
167
168static int wps_process_cred_network_key(struct wps_credential *cred,
169					const u8 *key, size_t key_len)
170{
171	if (key == NULL) {
172		wpa_printf(MSG_DEBUG, "WPS: Credential did not include "
173			   "Network Key");
174		if (cred->auth_type == WPS_AUTH_OPEN &&
175		    cred->encr_type == WPS_ENCR_NONE) {
176			wpa_printf(MSG_DEBUG, "WPS: Workaround - Allow "
177				   "missing mandatory Network Key attribute "
178				   "for open network");
179			return 0;
180		}
181		return -1;
182	}
183
184	wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key", key, key_len);
185	if (key_len <= sizeof(cred->key)) {
186		os_memcpy(cred->key, key, key_len);
187		cred->key_len = key_len;
188	}
189
190	return 0;
191}
192
193
194static int wps_process_cred_mac_addr(struct wps_credential *cred,
195				     const u8 *mac_addr)
196{
197	if (mac_addr == NULL) {
198		wpa_printf(MSG_DEBUG, "WPS: Credential did not include "
199			   "MAC Address");
200		return -1;
201	}
202
203	wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR, MAC2STR(mac_addr));
204	os_memcpy(cred->mac_addr, mac_addr, ETH_ALEN);
205
206	return 0;
207}
208
209
210static int wps_process_cred_eap_type(struct wps_credential *cred,
211				     const u8 *eap_type, size_t eap_type_len)
212{
213	if (eap_type == NULL)
214		return 0; /* optional attribute */
215
216	wpa_hexdump(MSG_DEBUG, "WPS: EAP Type", eap_type, eap_type_len);
217
218	return 0;
219}
220
221
222static int wps_process_cred_eap_identity(struct wps_credential *cred,
223					 const u8 *identity,
224					 size_t identity_len)
225{
226	if (identity == NULL)
227		return 0; /* optional attribute */
228
229	wpa_hexdump_ascii(MSG_DEBUG, "WPS: EAP Identity",
230			  identity, identity_len);
231
232	return 0;
233}
234
235
236static int wps_process_cred_key_prov_auto(struct wps_credential *cred,
237					  const u8 *key_prov_auto)
238{
239	if (key_prov_auto == NULL)
240		return 0; /* optional attribute */
241
242	wpa_printf(MSG_DEBUG, "WPS: Key Provided Automatically: %d",
243		   *key_prov_auto);
244
245	return 0;
246}
247
248
249static int wps_process_cred_802_1x_enabled(struct wps_credential *cred,
250					   const u8 *dot1x_enabled)
251{
252	if (dot1x_enabled == NULL)
253		return 0; /* optional attribute */
254
255	wpa_printf(MSG_DEBUG, "WPS: 802.1X Enabled: %d", *dot1x_enabled);
256
257	return 0;
258}
259
260
261static int wps_workaround_cred_key(struct wps_credential *cred)
262{
263	if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) &&
264	    cred->key_len > 8 && cred->key_len < 64 &&
265	    cred->key[cred->key_len - 1] == 0) {
266#ifdef CONFIG_WPS_STRICT
267		wpa_printf(MSG_INFO, "WPS: WPA/WPA2-Personal passphrase uses "
268			   "forbidden NULL termination");
269		wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key",
270				      cred->key, cred->key_len);
271		return -1;
272#else /* CONFIG_WPS_STRICT */
273		/*
274		 * A deployed external registrar is known to encode ASCII
275		 * passphrases incorrectly. Remove the extra NULL termination
276		 * to fix the encoding.
277		 */
278		wpa_printf(MSG_DEBUG, "WPS: Workaround - remove NULL "
279			   "termination from ASCII passphrase");
280		cred->key_len--;
281#endif /* CONFIG_WPS_STRICT */
282	}
283	return 0;
284}
285
286
287int wps_process_cred(struct wps_parse_attr *attr,
288		     struct wps_credential *cred)
289{
290	wpa_printf(MSG_DEBUG, "WPS: Process Credential");
291
292	/* TODO: support multiple Network Keys */
293	if (wps_process_cred_network_idx(cred, attr->network_idx) ||
294	    wps_process_cred_ssid(cred, attr->ssid, attr->ssid_len) ||
295	    wps_process_cred_auth_type(cred, attr->auth_type) ||
296	    wps_process_cred_encr_type(cred, attr->encr_type) ||
297	    wps_process_cred_network_key_idx(cred, attr->network_key_idx) ||
298	    wps_process_cred_network_key(cred, attr->network_key,
299					 attr->network_key_len) ||
300	    wps_process_cred_mac_addr(cred, attr->mac_addr) ||
301	    wps_process_cred_eap_type(cred, attr->eap_type,
302				      attr->eap_type_len) ||
303	    wps_process_cred_eap_identity(cred, attr->eap_identity,
304					  attr->eap_identity_len) ||
305	    wps_process_cred_key_prov_auto(cred, attr->key_prov_auto) ||
306	    wps_process_cred_802_1x_enabled(cred, attr->dot1x_enabled))
307		return -1;
308
309	return wps_workaround_cred_key(cred);
310}
311
312
313int wps_process_ap_settings(struct wps_parse_attr *attr,
314			    struct wps_credential *cred)
315{
316	wpa_printf(MSG_DEBUG, "WPS: Processing AP Settings");
317	os_memset(cred, 0, sizeof(*cred));
318	/* TODO: optional attributes New Password and Device Password ID */
319	if (wps_process_cred_ssid(cred, attr->ssid, attr->ssid_len) ||
320	    wps_process_cred_auth_type(cred, attr->auth_type) ||
321	    wps_process_cred_encr_type(cred, attr->encr_type) ||
322	    wps_process_cred_network_key_idx(cred, attr->network_key_idx) ||
323	    wps_process_cred_network_key(cred, attr->network_key,
324					 attr->network_key_len) ||
325	    wps_process_cred_mac_addr(cred, attr->mac_addr))
326		return -1;
327
328	return wps_workaround_cred_key(cred);
329}
330