1 /* 2 * Wi-Fi Protected Setup - attribute processing 3 * Copyright (c) 2008, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/sha256.h" 13 #include "wps_i.h" 14 15 16 int wps_process_authenticator(struct wps_data *wps, const u8 *authenticator, 17 const struct wpabuf *msg) 18 { 19 u8 hash[SHA256_MAC_LEN]; 20 const u8 *addr[2]; 21 size_t len[2]; 22 23 if (authenticator == NULL) { 24 wpa_printf(MSG_DEBUG, "WPS: No Authenticator attribute " 25 "included"); 26 return -1; 27 } 28 29 if (wps->last_msg == NULL) { 30 wpa_printf(MSG_DEBUG, "WPS: Last message not available for " 31 "validating authenticator"); 32 return -1; 33 } 34 35 /* Authenticator = HMAC-SHA256_AuthKey(M_prev || M_curr*) 36 * (M_curr* is M_curr without the Authenticator attribute) 37 */ 38 addr[0] = wpabuf_head(wps->last_msg); 39 len[0] = wpabuf_len(wps->last_msg); 40 addr[1] = wpabuf_head(msg); 41 len[1] = wpabuf_len(msg) - 4 - WPS_AUTHENTICATOR_LEN; 42 hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 2, addr, len, hash); 43 44 if (os_memcmp(hash, authenticator, WPS_AUTHENTICATOR_LEN) != 0) { 45 wpa_printf(MSG_DEBUG, "WPS: Incorrect Authenticator"); 46 return -1; 47 } 48 49 return 0; 50 } 51 52 53 int wps_process_key_wrap_auth(struct wps_data *wps, struct wpabuf *msg, 54 const u8 *key_wrap_auth) 55 { 56 u8 hash[SHA256_MAC_LEN]; 57 const u8 *head; 58 size_t len; 59 60 if (key_wrap_auth == NULL) { 61 wpa_printf(MSG_DEBUG, "WPS: No KWA in decrypted attribute"); 62 return -1; 63 } 64 65 head = wpabuf_head(msg); 66 len = wpabuf_len(msg) - 4 - WPS_KWA_LEN; 67 if (head + len != key_wrap_auth - 4) { 68 wpa_printf(MSG_DEBUG, "WPS: KWA not in the end of the " 69 "decrypted attribute"); 70 return -1; 71 } 72 73 hmac_sha256(wps->authkey, WPS_AUTHKEY_LEN, head, len, hash); 74 if (os_memcmp(hash, key_wrap_auth, WPS_KWA_LEN) != 0) { 75 wpa_printf(MSG_DEBUG, "WPS: Invalid KWA"); 76 return -1; 77 } 78 79 return 0; 80 } 81 82 83 static int wps_process_cred_network_idx(struct wps_credential *cred, 84 const u8 *idx) 85 { 86 if (idx == NULL) { 87 wpa_printf(MSG_DEBUG, "WPS: Credential did not include " 88 "Network Index"); 89 return -1; 90 } 91 92 wpa_printf(MSG_DEBUG, "WPS: Network Index: %d", *idx); 93 94 return 0; 95 } 96 97 98 static int wps_process_cred_ssid(struct wps_credential *cred, const u8 *ssid, 99 size_t ssid_len) 100 { 101 if (ssid == NULL) { 102 wpa_printf(MSG_DEBUG, "WPS: Credential did not include SSID"); 103 return -1; 104 } 105 106 /* Remove zero-padding since some Registrar implementations seem to use 107 * hardcoded 32-octet length for this attribute */ 108 while (ssid_len > 0 && ssid[ssid_len - 1] == 0) 109 ssid_len--; 110 111 wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", ssid, ssid_len); 112 if (ssid_len <= sizeof(cred->ssid)) { 113 os_memcpy(cred->ssid, ssid, ssid_len); 114 cred->ssid_len = ssid_len; 115 } 116 117 return 0; 118 } 119 120 121 static int wps_process_cred_auth_type(struct wps_credential *cred, 122 const u8 *auth_type) 123 { 124 if (auth_type == NULL) { 125 wpa_printf(MSG_DEBUG, "WPS: Credential did not include " 126 "Authentication Type"); 127 return -1; 128 } 129 130 cred->auth_type = WPA_GET_BE16(auth_type); 131 wpa_printf(MSG_DEBUG, "WPS: Authentication Type: 0x%x", 132 cred->auth_type); 133 134 return 0; 135 } 136 137 138 static int wps_process_cred_encr_type(struct wps_credential *cred, 139 const u8 *encr_type) 140 { 141 if (encr_type == NULL) { 142 wpa_printf(MSG_DEBUG, "WPS: Credential did not include " 143 "Encryption Type"); 144 return -1; 145 } 146 147 cred->encr_type = WPA_GET_BE16(encr_type); 148 wpa_printf(MSG_DEBUG, "WPS: Encryption Type: 0x%x", 149 cred->encr_type); 150 151 return 0; 152 } 153 154 155 static int wps_process_cred_network_key_idx(struct wps_credential *cred, 156 const u8 *key_idx) 157 { 158 if (key_idx == NULL) 159 return 0; /* optional attribute */ 160 161 wpa_printf(MSG_DEBUG, "WPS: Network Key Index: %d", *key_idx); 162 cred->key_idx = *key_idx; 163 164 return 0; 165 } 166 167 168 static int wps_process_cred_network_key(struct wps_credential *cred, 169 const u8 *key, size_t key_len) 170 { 171 if (key == NULL) { 172 wpa_printf(MSG_DEBUG, "WPS: Credential did not include " 173 "Network Key"); 174 if (cred->auth_type == WPS_AUTH_OPEN && 175 cred->encr_type == WPS_ENCR_NONE) { 176 wpa_printf(MSG_DEBUG, "WPS: Workaround - Allow " 177 "missing mandatory Network Key attribute " 178 "for open network"); 179 return 0; 180 } 181 return -1; 182 } 183 184 wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key", key, key_len); 185 if (key_len <= sizeof(cred->key)) { 186 os_memcpy(cred->key, key, key_len); 187 cred->key_len = key_len; 188 } 189 190 return 0; 191 } 192 193 194 static int wps_process_cred_mac_addr(struct wps_credential *cred, 195 const u8 *mac_addr) 196 { 197 if (mac_addr == NULL) { 198 wpa_printf(MSG_DEBUG, "WPS: Credential did not include " 199 "MAC Address"); 200 return -1; 201 } 202 203 wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR, MAC2STR(mac_addr)); 204 os_memcpy(cred->mac_addr, mac_addr, ETH_ALEN); 205 206 return 0; 207 } 208 209 210 static int wps_process_cred_eap_type(struct wps_credential *cred, 211 const u8 *eap_type, size_t eap_type_len) 212 { 213 if (eap_type == NULL) 214 return 0; /* optional attribute */ 215 216 wpa_hexdump(MSG_DEBUG, "WPS: EAP Type", eap_type, eap_type_len); 217 218 return 0; 219 } 220 221 222 static int wps_process_cred_eap_identity(struct wps_credential *cred, 223 const u8 *identity, 224 size_t identity_len) 225 { 226 if (identity == NULL) 227 return 0; /* optional attribute */ 228 229 wpa_hexdump_ascii(MSG_DEBUG, "WPS: EAP Identity", 230 identity, identity_len); 231 232 return 0; 233 } 234 235 236 static int wps_process_cred_key_prov_auto(struct wps_credential *cred, 237 const u8 *key_prov_auto) 238 { 239 if (key_prov_auto == NULL) 240 return 0; /* optional attribute */ 241 242 wpa_printf(MSG_DEBUG, "WPS: Key Provided Automatically: %d", 243 *key_prov_auto); 244 245 return 0; 246 } 247 248 249 static int wps_process_cred_802_1x_enabled(struct wps_credential *cred, 250 const u8 *dot1x_enabled) 251 { 252 if (dot1x_enabled == NULL) 253 return 0; /* optional attribute */ 254 255 wpa_printf(MSG_DEBUG, "WPS: 802.1X Enabled: %d", *dot1x_enabled); 256 257 return 0; 258 } 259 260 261 static int wps_process_cred_ap_channel(struct wps_credential *cred, 262 const u8 *ap_channel) 263 { 264 if (ap_channel == NULL) 265 return 0; /* optional attribute */ 266 267 cred->ap_channel = WPA_GET_BE16(ap_channel); 268 wpa_printf(MSG_DEBUG, "WPS: AP Channel: %u", cred->ap_channel); 269 270 return 0; 271 } 272 273 274 static int wps_workaround_cred_key(struct wps_credential *cred) 275 { 276 if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK) && 277 cred->key_len > 8 && cred->key_len < 64 && 278 cred->key[cred->key_len - 1] == 0) { 279 #ifdef CONFIG_WPS_STRICT 280 wpa_printf(MSG_INFO, "WPS: WPA/WPA2-Personal passphrase uses " 281 "forbidden NULL termination"); 282 wpa_hexdump_ascii_key(MSG_INFO, "WPS: Network Key", 283 cred->key, cred->key_len); 284 return -1; 285 #else /* CONFIG_WPS_STRICT */ 286 /* 287 * A deployed external registrar is known to encode ASCII 288 * passphrases incorrectly. Remove the extra NULL termination 289 * to fix the encoding. 290 */ 291 wpa_printf(MSG_DEBUG, "WPS: Workaround - remove NULL " 292 "termination from ASCII passphrase"); 293 cred->key_len--; 294 #endif /* CONFIG_WPS_STRICT */ 295 } 296 return 0; 297 } 298 299 300 int wps_process_cred(struct wps_parse_attr *attr, 301 struct wps_credential *cred) 302 { 303 wpa_printf(MSG_DEBUG, "WPS: Process Credential"); 304 305 /* TODO: support multiple Network Keys */ 306 if (wps_process_cred_network_idx(cred, attr->network_idx) || 307 wps_process_cred_ssid(cred, attr->ssid, attr->ssid_len) || 308 wps_process_cred_auth_type(cred, attr->auth_type) || 309 wps_process_cred_encr_type(cred, attr->encr_type) || 310 wps_process_cred_network_key_idx(cred, attr->network_key_idx) || 311 wps_process_cred_network_key(cred, attr->network_key, 312 attr->network_key_len) || 313 wps_process_cred_mac_addr(cred, attr->mac_addr) || 314 wps_process_cred_eap_type(cred, attr->eap_type, 315 attr->eap_type_len) || 316 wps_process_cred_eap_identity(cred, attr->eap_identity, 317 attr->eap_identity_len) || 318 wps_process_cred_key_prov_auto(cred, attr->key_prov_auto) || 319 wps_process_cred_802_1x_enabled(cred, attr->dot1x_enabled) || 320 wps_process_cred_ap_channel(cred, attr->ap_channel)) 321 return -1; 322 323 return wps_workaround_cred_key(cred); 324 } 325 326 327 int wps_process_ap_settings(struct wps_parse_attr *attr, 328 struct wps_credential *cred) 329 { 330 wpa_printf(MSG_DEBUG, "WPS: Processing AP Settings"); 331 os_memset(cred, 0, sizeof(*cred)); 332 /* TODO: optional attributes New Password and Device Password ID */ 333 if (wps_process_cred_ssid(cred, attr->ssid, attr->ssid_len) || 334 wps_process_cred_auth_type(cred, attr->auth_type) || 335 wps_process_cred_encr_type(cred, attr->encr_type) || 336 wps_process_cred_network_key_idx(cred, attr->network_key_idx) || 337 wps_process_cred_network_key(cred, attr->network_key, 338 attr->network_key_len) || 339 wps_process_cred_mac_addr(cred, attr->mac_addr)) 340 return -1; 341 342 return wps_workaround_cred_key(cred); 343 } 344
