1 /*
2 * DPP over TCP
3 * Copyright (c) 2019-2020, The Linux Foundation
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10 #include <fcntl.h>
11
12 #include "utils/common.h"
13 #include "utils/ip_addr.h"
14 #include "utils/eloop.h"
15 #include "common/ieee802_11_common.h"
16 #include "common/wpa_ctrl.h"
17 #include "dpp.h"
18 #include "dpp_i.h"
19
20 #ifdef CONFIG_DPP2
21
22 struct dpp_connection {
23 struct dl_list list;
24 struct dpp_controller *ctrl;
25 struct dpp_relay_controller *relay;
26 struct dpp_global *global;
27 struct dpp_authentication *auth;
28 void *msg_ctx;
29 void *cb_ctx;
30 int (*process_conf_obj)(void *ctx, struct dpp_authentication *auth);
31 int sock;
32 u8 mac_addr[ETH_ALEN];
33 unsigned int freq;
34 u8 msg_len[4];
35 size_t msg_len_octets;
36 struct wpabuf *msg;
37 struct wpabuf *msg_out;
38 size_t msg_out_pos;
39 unsigned int read_eloop:1;
40 unsigned int write_eloop:1;
41 unsigned int on_tcp_tx_complete_gas_done:1;
42 unsigned int on_tcp_tx_complete_remove:1;
43 unsigned int on_tcp_tx_complete_auth_ok:1;
44 unsigned int gas_comeback_in_progress:1;
45 u8 gas_dialog_token;
46 char *name;
47 enum dpp_netrole netrole;
48 };
49
50 /* Remote Controller */
51 struct dpp_relay_controller {
52 struct dl_list list;
53 struct dpp_global *global;
54 u8 pkhash[SHA256_MAC_LEN];
55 struct hostapd_ip_addr ipaddr;
56 void *msg_ctx;
57 void *cb_ctx;
58 void (*tx)(void *ctx, const u8 *addr, unsigned int freq, const u8 *msg,
59 size_t len);
60 void (*gas_resp_tx)(void *ctx, const u8 *addr, u8 dialog_token,
61 int prot, struct wpabuf *buf);
62 struct dl_list conn; /* struct dpp_connection */
63 };
64
65 /* Local Controller */
66 struct dpp_controller {
67 struct dpp_global *global;
68 u8 allowed_roles;
69 int qr_mutual;
70 int sock;
71 struct dl_list conn; /* struct dpp_connection */
72 char *configurator_params;
73 enum dpp_netrole netrole;
74 void *msg_ctx;
75 void *cb_ctx;
76 int (*process_conf_obj)(void *ctx, struct dpp_authentication *auth);
77 };
78
79 static void dpp_controller_rx(int sd, void *eloop_ctx, void *sock_ctx);
80 static void dpp_conn_tx_ready(int sock, void *eloop_ctx, void *sock_ctx);
81 static void dpp_controller_auth_success(struct dpp_connection *conn,
82 int initiator);
83 static void dpp_tcp_build_csr(void *eloop_ctx, void *timeout_ctx);
84 static void dpp_tcp_gas_query_comeback(void *eloop_ctx, void *timeout_ctx);
85
86
dpp_connection_free(struct dpp_connection * conn)87 static void dpp_connection_free(struct dpp_connection *conn)
88 {
89 if (conn->sock >= 0) {
90 wpa_printf(MSG_DEBUG, "DPP: Close Controller socket %d",
91 conn->sock);
92 eloop_unregister_sock(conn->sock, EVENT_TYPE_READ);
93 eloop_unregister_sock(conn->sock, EVENT_TYPE_WRITE);
94 close(conn->sock);
95 }
96 eloop_cancel_timeout(dpp_controller_conn_status_result_wait_timeout,
97 conn, NULL);
98 eloop_cancel_timeout(dpp_tcp_build_csr, conn, NULL);
99 eloop_cancel_timeout(dpp_tcp_gas_query_comeback, conn, NULL);
100 wpabuf_free(conn->msg);
101 wpabuf_free(conn->msg_out);
102 dpp_auth_deinit(conn->auth);
103 os_free(conn->name);
104 os_free(conn);
105 }
106
107
dpp_connection_remove(struct dpp_connection * conn)108 static void dpp_connection_remove(struct dpp_connection *conn)
109 {
110 dl_list_del(&conn->list);
111 dpp_connection_free(conn);
112 }
113
114
dpp_relay_add_controller(struct dpp_global * dpp,struct dpp_relay_config * config)115 int dpp_relay_add_controller(struct dpp_global *dpp,
116 struct dpp_relay_config *config)
117 {
118 struct dpp_relay_controller *ctrl;
119
120 if (!dpp)
121 return -1;
122
123 ctrl = os_zalloc(sizeof(*ctrl));
124 if (!ctrl)
125 return -1;
126 dl_list_init(&ctrl->conn);
127 ctrl->global = dpp;
128 os_memcpy(&ctrl->ipaddr, config->ipaddr, sizeof(*config->ipaddr));
129 os_memcpy(ctrl->pkhash, config->pkhash, SHA256_MAC_LEN);
130 ctrl->msg_ctx = config->msg_ctx;
131 ctrl->cb_ctx = config->cb_ctx;
132 ctrl->tx = config->tx;
133 ctrl->gas_resp_tx = config->gas_resp_tx;
134 dl_list_add(&dpp->controllers, &ctrl->list);
135 return 0;
136 }
137
138
139 static struct dpp_relay_controller *
dpp_relay_controller_get(struct dpp_global * dpp,const u8 * pkhash)140 dpp_relay_controller_get(struct dpp_global *dpp, const u8 *pkhash)
141 {
142 struct dpp_relay_controller *ctrl;
143
144 if (!dpp)
145 return NULL;
146
147 dl_list_for_each(ctrl, &dpp->controllers, struct dpp_relay_controller,
148 list) {
149 if (os_memcmp(pkhash, ctrl->pkhash, SHA256_MAC_LEN) == 0)
150 return ctrl;
151 }
152
153 return NULL;
154 }
155
156
dpp_controller_gas_done(struct dpp_connection * conn)157 static void dpp_controller_gas_done(struct dpp_connection *conn)
158 {
159 struct dpp_authentication *auth = conn->auth;
160
161 if (auth->waiting_csr) {
162 wpa_printf(MSG_DEBUG, "DPP: Waiting for CSR");
163 conn->on_tcp_tx_complete_gas_done = 0;
164 return;
165 }
166
167 if (auth->peer_version >= 2 &&
168 auth->conf_resp_status == DPP_STATUS_OK) {
169 wpa_printf(MSG_DEBUG, "DPP: Wait for Configuration Result");
170 auth->waiting_conf_result = 1;
171 return;
172 }
173
174 wpa_msg(conn->msg_ctx, MSG_INFO, DPP_EVENT_CONF_SENT);
175 dpp_connection_remove(conn);
176 }
177
178
dpp_tcp_send(struct dpp_connection * conn)179 static int dpp_tcp_send(struct dpp_connection *conn)
180 {
181 int res;
182
183 if (!conn->msg_out) {
184 eloop_unregister_sock(conn->sock, EVENT_TYPE_WRITE);
185 conn->write_eloop = 0;
186 return -1;
187 }
188 res = send(conn->sock,
189 wpabuf_head_u8(conn->msg_out) + conn->msg_out_pos,
190 wpabuf_len(conn->msg_out) - conn->msg_out_pos, 0);
191 if (res < 0) {
192 wpa_printf(MSG_DEBUG, "DPP: Failed to send buffer: %s",
193 strerror(errno));
194 dpp_connection_remove(conn);
195 return -1;
196 }
197
198 conn->msg_out_pos += res;
199 if (wpabuf_len(conn->msg_out) > conn->msg_out_pos) {
200 wpa_printf(MSG_DEBUG,
201 "DPP: %u/%u bytes of message sent to Controller",
202 (unsigned int) conn->msg_out_pos,
203 (unsigned int) wpabuf_len(conn->msg_out));
204 if (!conn->write_eloop &&
205 eloop_register_sock(conn->sock, EVENT_TYPE_WRITE,
206 dpp_conn_tx_ready, conn, NULL) == 0)
207 conn->write_eloop = 1;
208 return 1;
209 }
210
211 wpa_printf(MSG_DEBUG, "DPP: Full message sent over TCP");
212 wpabuf_free(conn->msg_out);
213 conn->msg_out = NULL;
214 conn->msg_out_pos = 0;
215 eloop_unregister_sock(conn->sock, EVENT_TYPE_WRITE);
216 conn->write_eloop = 0;
217 if (!conn->read_eloop &&
218 eloop_register_sock(conn->sock, EVENT_TYPE_READ,
219 dpp_controller_rx, conn, NULL) == 0)
220 conn->read_eloop = 1;
221 if (conn->on_tcp_tx_complete_remove) {
222 dpp_connection_remove(conn);
223 } else if (conn->auth && (conn->ctrl || conn->auth->configurator) &&
224 conn->on_tcp_tx_complete_gas_done) {
225 dpp_controller_gas_done(conn);
226 } else if (conn->on_tcp_tx_complete_auth_ok) {
227 conn->on_tcp_tx_complete_auth_ok = 0;
228 dpp_controller_auth_success(conn, 1);
229 }
230
231 return 0;
232 }
233
234
dpp_tcp_send_msg(struct dpp_connection * conn,const struct wpabuf * msg)235 static int dpp_tcp_send_msg(struct dpp_connection *conn,
236 const struct wpabuf *msg)
237 {
238 wpabuf_free(conn->msg_out);
239 conn->msg_out_pos = 0;
240 conn->msg_out = wpabuf_alloc(4 + wpabuf_len(msg) - 1);
241 if (!conn->msg_out)
242 return -1;
243 wpabuf_put_be32(conn->msg_out, wpabuf_len(msg) - 1);
244 wpabuf_put_data(conn->msg_out, wpabuf_head_u8(msg) + 1,
245 wpabuf_len(msg) - 1);
246
247 if (dpp_tcp_send(conn) == 1) {
248 if (!conn->write_eloop) {
249 if (eloop_register_sock(conn->sock, EVENT_TYPE_WRITE,
250 dpp_conn_tx_ready,
251 conn, NULL) < 0)
252 return -1;
253 conn->write_eloop = 1;
254 }
255 }
256
257 return 0;
258 }
259
260
dpp_controller_start_gas_client(struct dpp_connection * conn)261 static void dpp_controller_start_gas_client(struct dpp_connection *conn)
262 {
263 struct dpp_authentication *auth = conn->auth;
264 struct wpabuf *buf;
265 const char *dpp_name;
266
267 dpp_name = conn->name ? conn->name : "Test";
268 buf = dpp_build_conf_req_helper(auth, dpp_name, conn->netrole, NULL,
269 NULL);
270 if (!buf) {
271 wpa_printf(MSG_DEBUG,
272 "DPP: No configuration request data available");
273 return;
274 }
275
276 dpp_tcp_send_msg(conn, buf);
277 wpabuf_free(buf);
278 }
279
280
dpp_controller_auth_success(struct dpp_connection * conn,int initiator)281 static void dpp_controller_auth_success(struct dpp_connection *conn,
282 int initiator)
283 {
284 struct dpp_authentication *auth = conn->auth;
285
286 if (!auth)
287 return;
288
289 wpa_printf(MSG_DEBUG, "DPP: Authentication succeeded");
290 wpa_msg(conn->msg_ctx, MSG_INFO,
291 DPP_EVENT_AUTH_SUCCESS "init=%d", initiator);
292 #ifdef CONFIG_TESTING_OPTIONS
293 if (dpp_test == DPP_TEST_STOP_AT_AUTH_CONF) {
294 wpa_printf(MSG_INFO,
295 "DPP: TESTING - stop at Authentication Confirm");
296 if (auth->configurator) {
297 /* Prevent GAS response */
298 auth->auth_success = 0;
299 }
300 return;
301 }
302 #endif /* CONFIG_TESTING_OPTIONS */
303
304 if (!auth->configurator)
305 dpp_controller_start_gas_client(conn);
306 }
307
308
dpp_conn_tx_ready(int sock,void * eloop_ctx,void * sock_ctx)309 static void dpp_conn_tx_ready(int sock, void *eloop_ctx, void *sock_ctx)
310 {
311 struct dpp_connection *conn = eloop_ctx;
312
313 wpa_printf(MSG_DEBUG, "DPP: TCP socket %d ready for TX", sock);
314 dpp_tcp_send(conn);
315 }
316
317
dpp_ipaddr_to_sockaddr(struct sockaddr * addr,socklen_t * addrlen,const struct hostapd_ip_addr * ipaddr,int port)318 static int dpp_ipaddr_to_sockaddr(struct sockaddr *addr, socklen_t *addrlen,
319 const struct hostapd_ip_addr *ipaddr,
320 int port)
321 {
322 struct sockaddr_in *dst;
323 #ifdef CONFIG_IPV6
324 struct sockaddr_in6 *dst6;
325 #endif /* CONFIG_IPV6 */
326
327 switch (ipaddr->af) {
328 case AF_INET:
329 dst = (struct sockaddr_in *) addr;
330 os_memset(dst, 0, sizeof(*dst));
331 dst->sin_family = AF_INET;
332 dst->sin_addr.s_addr = ipaddr->u.v4.s_addr;
333 dst->sin_port = htons(port);
334 *addrlen = sizeof(*dst);
335 break;
336 #ifdef CONFIG_IPV6
337 case AF_INET6:
338 dst6 = (struct sockaddr_in6 *) addr;
339 os_memset(dst6, 0, sizeof(*dst6));
340 dst6->sin6_family = AF_INET6;
341 os_memcpy(&dst6->sin6_addr, &ipaddr->u.v6,
342 sizeof(struct in6_addr));
343 dst6->sin6_port = htons(port);
344 *addrlen = sizeof(*dst6);
345 break;
346 #endif /* CONFIG_IPV6 */
347 default:
348 return -1;
349 }
350
351 return 0;
352 }
353
354
355 static struct dpp_connection *
dpp_relay_new_conn(struct dpp_relay_controller * ctrl,const u8 * src,unsigned int freq)356 dpp_relay_new_conn(struct dpp_relay_controller *ctrl, const u8 *src,
357 unsigned int freq)
358 {
359 struct dpp_connection *conn;
360 struct sockaddr_storage addr;
361 socklen_t addrlen;
362 char txt[100];
363
364 if (dl_list_len(&ctrl->conn) >= 15) {
365 wpa_printf(MSG_DEBUG,
366 "DPP: Too many ongoing Relay connections to the Controller - cannot start a new one");
367 return NULL;
368 }
369
370 if (dpp_ipaddr_to_sockaddr((struct sockaddr *) &addr, &addrlen,
371 &ctrl->ipaddr, DPP_TCP_PORT) < 0)
372 return NULL;
373
374 conn = os_zalloc(sizeof(*conn));
375 if (!conn)
376 return NULL;
377
378 conn->global = ctrl->global;
379 conn->relay = ctrl;
380 conn->msg_ctx = ctrl->msg_ctx;
381 conn->cb_ctx = ctrl->global->cb_ctx;
382 os_memcpy(conn->mac_addr, src, ETH_ALEN);
383 conn->freq = freq;
384
385 conn->sock = socket(AF_INET, SOCK_STREAM, 0);
386 if (conn->sock < 0)
387 goto fail;
388 wpa_printf(MSG_DEBUG, "DPP: TCP relay socket %d connection to %s",
389 conn->sock, hostapd_ip_txt(&ctrl->ipaddr, txt, sizeof(txt)));
390
391 if (fcntl(conn->sock, F_SETFL, O_NONBLOCK) != 0) {
392 wpa_printf(MSG_DEBUG, "DPP: fnctl(O_NONBLOCK) failed: %s",
393 strerror(errno));
394 goto fail;
395 }
396
397 if (connect(conn->sock, (struct sockaddr *) &addr, addrlen) < 0) {
398 if (errno != EINPROGRESS) {
399 wpa_printf(MSG_DEBUG, "DPP: Failed to connect: %s",
400 strerror(errno));
401 goto fail;
402 }
403
404 /*
405 * Continue connecting in the background; eloop will call us
406 * once the connection is ready (or failed).
407 */
408 }
409
410 if (eloop_register_sock(conn->sock, EVENT_TYPE_WRITE,
411 dpp_conn_tx_ready, conn, NULL) < 0)
412 goto fail;
413 conn->write_eloop = 1;
414
415 /* TODO: eloop timeout to clear a connection if it does not complete
416 * properly */
417
418 dl_list_add(&ctrl->conn, &conn->list);
419 return conn;
420 fail:
421 dpp_connection_free(conn);
422 return NULL;
423 }
424
425
dpp_tcp_encaps(const u8 * hdr,const u8 * buf,size_t len)426 static struct wpabuf * dpp_tcp_encaps(const u8 *hdr, const u8 *buf, size_t len)
427 {
428 struct wpabuf *msg;
429
430 msg = wpabuf_alloc(4 + 1 + DPP_HDR_LEN + len);
431 if (!msg)
432 return NULL;
433 wpabuf_put_be32(msg, 1 + DPP_HDR_LEN + len);
434 wpabuf_put_u8(msg, WLAN_PA_VENDOR_SPECIFIC);
435 wpabuf_put_data(msg, hdr, DPP_HDR_LEN);
436 wpabuf_put_data(msg, buf, len);
437 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Outgoing TCP message", msg);
438 return msg;
439 }
440
441
dpp_relay_tx(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)442 static int dpp_relay_tx(struct dpp_connection *conn, const u8 *hdr,
443 const u8 *buf, size_t len)
444 {
445 u8 type = hdr[DPP_HDR_LEN - 1];
446
447 wpa_printf(MSG_DEBUG,
448 "DPP: Continue already established Relay/Controller connection for this session");
449 wpabuf_free(conn->msg_out);
450 conn->msg_out_pos = 0;
451 conn->msg_out = dpp_tcp_encaps(hdr, buf, len);
452 if (!conn->msg_out) {
453 dpp_connection_remove(conn);
454 return -1;
455 }
456
457 /* TODO: for proto ver 1, need to do remove connection based on GAS Resp
458 * TX status */
459 if (type == DPP_PA_CONFIGURATION_RESULT)
460 conn->on_tcp_tx_complete_remove = 1;
461 dpp_tcp_send(conn);
462 return 0;
463 }
464
465
dpp_relay_rx_action(struct dpp_global * dpp,const u8 * src,const u8 * hdr,const u8 * buf,size_t len,unsigned int freq,const u8 * i_bootstrap,const u8 * r_bootstrap)466 int dpp_relay_rx_action(struct dpp_global *dpp, const u8 *src, const u8 *hdr,
467 const u8 *buf, size_t len, unsigned int freq,
468 const u8 *i_bootstrap, const u8 *r_bootstrap)
469 {
470 struct dpp_relay_controller *ctrl;
471 struct dpp_connection *conn;
472 u8 type = hdr[DPP_HDR_LEN - 1];
473
474 /* Check if there is an already started session for this peer and if so,
475 * continue that session (send this over TCP) and return 0.
476 */
477 if (type != DPP_PA_PEER_DISCOVERY_REQ &&
478 type != DPP_PA_PEER_DISCOVERY_RESP &&
479 type != DPP_PA_PRESENCE_ANNOUNCEMENT &&
480 type != DPP_PA_RECONFIG_ANNOUNCEMENT) {
481 dl_list_for_each(ctrl, &dpp->controllers,
482 struct dpp_relay_controller, list) {
483 dl_list_for_each(conn, &ctrl->conn,
484 struct dpp_connection, list) {
485 if (os_memcmp(src, conn->mac_addr,
486 ETH_ALEN) == 0)
487 return dpp_relay_tx(conn, hdr, buf, len);
488 }
489 }
490 }
491
492 if (type == DPP_PA_PRESENCE_ANNOUNCEMENT ||
493 type == DPP_PA_RECONFIG_ANNOUNCEMENT) {
494 /* TODO: Could send this to all configured Controllers. For now,
495 * only the first Controller is supported. */
496 ctrl = dl_list_first(&dpp->controllers,
497 struct dpp_relay_controller, list);
498 } else {
499 if (!r_bootstrap)
500 return -1;
501 ctrl = dpp_relay_controller_get(dpp, r_bootstrap);
502 }
503 if (!ctrl)
504 return -1;
505
506 wpa_printf(MSG_DEBUG,
507 "DPP: Authentication Request for a configured Controller");
508 conn = dpp_relay_new_conn(ctrl, src, freq);
509 if (!conn)
510 return -1;
511
512 conn->msg_out = dpp_tcp_encaps(hdr, buf, len);
513 if (!conn->msg_out) {
514 dpp_connection_remove(conn);
515 return -1;
516 }
517 /* Message will be sent in dpp_conn_tx_ready() */
518
519 return 0;
520 }
521
522
dpp_relay_rx_gas_req(struct dpp_global * dpp,const u8 * src,const u8 * data,size_t data_len)523 int dpp_relay_rx_gas_req(struct dpp_global *dpp, const u8 *src, const u8 *data,
524 size_t data_len)
525 {
526 struct dpp_relay_controller *ctrl;
527 struct dpp_connection *conn, *found = NULL;
528 struct wpabuf *msg;
529
530 /* Check if there is a successfully completed authentication for this
531 * and if so, continue that session (send this over TCP) and return 0.
532 */
533 dl_list_for_each(ctrl, &dpp->controllers,
534 struct dpp_relay_controller, list) {
535 if (found)
536 break;
537 dl_list_for_each(conn, &ctrl->conn,
538 struct dpp_connection, list) {
539 if (os_memcmp(src, conn->mac_addr,
540 ETH_ALEN) == 0) {
541 found = conn;
542 break;
543 }
544 }
545 }
546
547 if (!found)
548 return -1;
549
550 msg = wpabuf_alloc(4 + 1 + data_len);
551 if (!msg)
552 return -1;
553 wpabuf_put_be32(msg, 1 + data_len);
554 wpabuf_put_u8(msg, WLAN_PA_GAS_INITIAL_REQ);
555 wpabuf_put_data(msg, data, data_len);
556 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Outgoing TCP message", msg);
557
558 wpabuf_free(conn->msg_out);
559 conn->msg_out_pos = 0;
560 conn->msg_out = msg;
561 dpp_tcp_send(conn);
562 return 0;
563 }
564
565
dpp_controller_free(struct dpp_controller * ctrl)566 static void dpp_controller_free(struct dpp_controller *ctrl)
567 {
568 struct dpp_connection *conn, *tmp;
569
570 if (!ctrl)
571 return;
572
573 dl_list_for_each_safe(conn, tmp, &ctrl->conn, struct dpp_connection,
574 list)
575 dpp_connection_remove(conn);
576
577 if (ctrl->sock >= 0) {
578 close(ctrl->sock);
579 eloop_unregister_sock(ctrl->sock, EVENT_TYPE_READ);
580 }
581 os_free(ctrl->configurator_params);
582 os_free(ctrl);
583 }
584
585
dpp_controller_rx_auth_req(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)586 static int dpp_controller_rx_auth_req(struct dpp_connection *conn,
587 const u8 *hdr, const u8 *buf, size_t len)
588 {
589 const u8 *r_bootstrap, *i_bootstrap;
590 u16 r_bootstrap_len, i_bootstrap_len;
591 struct dpp_bootstrap_info *own_bi = NULL, *peer_bi = NULL;
592
593 if (!conn->ctrl)
594 return 0;
595
596 wpa_printf(MSG_DEBUG, "DPP: Authentication Request");
597
598 r_bootstrap = dpp_get_attr(buf, len, DPP_ATTR_R_BOOTSTRAP_KEY_HASH,
599 &r_bootstrap_len);
600 if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) {
601 wpa_printf(MSG_INFO,
602 "Missing or invalid required Responder Bootstrapping Key Hash attribute");
603 return -1;
604 }
605 wpa_hexdump(MSG_MSGDUMP, "DPP: Responder Bootstrapping Key Hash",
606 r_bootstrap, r_bootstrap_len);
607
608 i_bootstrap = dpp_get_attr(buf, len, DPP_ATTR_I_BOOTSTRAP_KEY_HASH,
609 &i_bootstrap_len);
610 if (!i_bootstrap || i_bootstrap_len != SHA256_MAC_LEN) {
611 wpa_printf(MSG_INFO,
612 "Missing or invalid required Initiator Bootstrapping Key Hash attribute");
613 return -1;
614 }
615 wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Bootstrapping Key Hash",
616 i_bootstrap, i_bootstrap_len);
617
618 /* Try to find own and peer bootstrapping key matches based on the
619 * received hash values */
620 dpp_bootstrap_find_pair(conn->ctrl->global, i_bootstrap, r_bootstrap,
621 &own_bi, &peer_bi);
622 if (!own_bi) {
623 wpa_printf(MSG_INFO,
624 "No matching own bootstrapping key found - ignore message");
625 return -1;
626 }
627
628 if (conn->auth) {
629 wpa_printf(MSG_INFO,
630 "Already in DPP authentication exchange - ignore new one");
631 return 0;
632 }
633
634 conn->auth = dpp_auth_req_rx(conn->ctrl->global, conn->msg_ctx,
635 conn->ctrl->allowed_roles,
636 conn->ctrl->qr_mutual,
637 peer_bi, own_bi, -1, hdr, buf, len);
638 if (!conn->auth) {
639 wpa_printf(MSG_DEBUG, "DPP: No response generated");
640 return -1;
641 }
642
643 if (dpp_set_configurator(conn->auth,
644 conn->ctrl->configurator_params) < 0) {
645 dpp_connection_remove(conn);
646 return -1;
647 }
648
649 return dpp_tcp_send_msg(conn, conn->auth->resp_msg);
650 }
651
652
dpp_controller_rx_auth_resp(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)653 static int dpp_controller_rx_auth_resp(struct dpp_connection *conn,
654 const u8 *hdr, const u8 *buf, size_t len)
655 {
656 struct dpp_authentication *auth = conn->auth;
657 struct wpabuf *msg;
658 int res;
659
660 if (!auth)
661 return -1;
662
663 wpa_printf(MSG_DEBUG, "DPP: Authentication Response");
664
665 msg = dpp_auth_resp_rx(auth, hdr, buf, len);
666 if (!msg) {
667 if (auth->auth_resp_status == DPP_STATUS_RESPONSE_PENDING) {
668 wpa_printf(MSG_DEBUG,
669 "DPP: Start wait for full response");
670 return 0;
671 }
672 wpa_printf(MSG_DEBUG, "DPP: No confirm generated");
673 dpp_connection_remove(conn);
674 return -1;
675 }
676
677 conn->on_tcp_tx_complete_auth_ok = 1;
678 res = dpp_tcp_send_msg(conn, msg);
679 wpabuf_free(msg);
680 return res;
681 }
682
683
dpp_controller_rx_auth_conf(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)684 static int dpp_controller_rx_auth_conf(struct dpp_connection *conn,
685 const u8 *hdr, const u8 *buf, size_t len)
686 {
687 struct dpp_authentication *auth = conn->auth;
688
689 wpa_printf(MSG_DEBUG, "DPP: Authentication Confirmation");
690
691 if (!auth) {
692 wpa_printf(MSG_DEBUG,
693 "DPP: No DPP Authentication in progress - drop");
694 return -1;
695 }
696
697 if (dpp_auth_conf_rx(auth, hdr, buf, len) < 0) {
698 wpa_printf(MSG_DEBUG, "DPP: Authentication failed");
699 return -1;
700 }
701
702 dpp_controller_auth_success(conn, 0);
703 return 0;
704 }
705
706
dpp_controller_conn_status_result_wait_timeout(void * eloop_ctx,void * timeout_ctx)707 void dpp_controller_conn_status_result_wait_timeout(void *eloop_ctx,
708 void *timeout_ctx)
709 {
710 struct dpp_connection *conn = eloop_ctx;
711
712 if (!conn->auth->waiting_conf_result)
713 return;
714
715 wpa_printf(MSG_DEBUG,
716 "DPP: Timeout while waiting for Connection Status Result");
717 wpa_msg(conn->msg_ctx, MSG_INFO,
718 DPP_EVENT_CONN_STATUS_RESULT "timeout");
719 dpp_connection_remove(conn);
720 }
721
722
dpp_controller_rx_conf_result(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)723 static int dpp_controller_rx_conf_result(struct dpp_connection *conn,
724 const u8 *hdr, const u8 *buf,
725 size_t len)
726 {
727 struct dpp_authentication *auth = conn->auth;
728 enum dpp_status_error status;
729 void *msg_ctx = conn->msg_ctx;
730
731 if (!conn->ctrl && (!auth || !auth->configurator))
732 return 0;
733
734 wpa_printf(MSG_DEBUG, "DPP: Configuration Result");
735
736 if (!auth || !auth->waiting_conf_result) {
737 wpa_printf(MSG_DEBUG,
738 "DPP: No DPP Configuration waiting for result - drop");
739 return -1;
740 }
741
742 status = dpp_conf_result_rx(auth, hdr, buf, len);
743 if (status == DPP_STATUS_OK && auth->send_conn_status) {
744 wpa_msg(msg_ctx, MSG_INFO,
745 DPP_EVENT_CONF_SENT "wait_conn_status=1");
746 wpa_printf(MSG_DEBUG, "DPP: Wait for Connection Status Result");
747 eloop_cancel_timeout(
748 dpp_controller_conn_status_result_wait_timeout,
749 conn, NULL);
750 eloop_register_timeout(
751 16, 0, dpp_controller_conn_status_result_wait_timeout,
752 conn, NULL);
753 return 0;
754 }
755 if (status == DPP_STATUS_OK)
756 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_CONF_SENT);
757 else
758 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_CONF_FAILED);
759 return -1; /* to remove the completed connection */
760 }
761
762
dpp_controller_rx_conn_status_result(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)763 static int dpp_controller_rx_conn_status_result(struct dpp_connection *conn,
764 const u8 *hdr, const u8 *buf,
765 size_t len)
766 {
767 struct dpp_authentication *auth = conn->auth;
768 enum dpp_status_error status;
769 u8 ssid[SSID_MAX_LEN];
770 size_t ssid_len = 0;
771 char *channel_list = NULL;
772
773 if (!conn->ctrl)
774 return 0;
775
776 wpa_printf(MSG_DEBUG, "DPP: Connection Status Result");
777
778 if (!auth || !auth->waiting_conn_status_result) {
779 wpa_printf(MSG_DEBUG,
780 "DPP: No DPP Configuration waiting for connection status result - drop");
781 return -1;
782 }
783
784 status = dpp_conn_status_result_rx(auth, hdr, buf, len,
785 ssid, &ssid_len, &channel_list);
786 wpa_msg(conn->msg_ctx, MSG_INFO, DPP_EVENT_CONN_STATUS_RESULT
787 "result=%d ssid=%s channel_list=%s",
788 status, wpa_ssid_txt(ssid, ssid_len),
789 channel_list ? channel_list : "N/A");
790 os_free(channel_list);
791 return -1; /* to remove the completed connection */
792 }
793
794
dpp_controller_rx_presence_announcement(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)795 static int dpp_controller_rx_presence_announcement(struct dpp_connection *conn,
796 const u8 *hdr, const u8 *buf,
797 size_t len)
798 {
799 const u8 *r_bootstrap;
800 u16 r_bootstrap_len;
801 struct dpp_bootstrap_info *peer_bi;
802 struct dpp_authentication *auth;
803 struct dpp_global *dpp = conn->ctrl->global;
804
805 if (conn->auth) {
806 wpa_printf(MSG_DEBUG,
807 "DPP: Ignore Presence Announcement during ongoing Authentication");
808 return -1;
809 }
810
811 wpa_printf(MSG_DEBUG, "DPP: Presence Announcement");
812
813 r_bootstrap = dpp_get_attr(buf, len, DPP_ATTR_R_BOOTSTRAP_KEY_HASH,
814 &r_bootstrap_len);
815 if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) {
816 wpa_msg(conn->msg_ctx, MSG_INFO, DPP_EVENT_FAIL
817 "Missing or invalid required Responder Bootstrapping Key Hash attribute");
818 return -1;
819 }
820 wpa_hexdump(MSG_MSGDUMP, "DPP: Responder Bootstrapping Key Hash",
821 r_bootstrap, r_bootstrap_len);
822 peer_bi = dpp_bootstrap_find_chirp(dpp, r_bootstrap);
823 if (!peer_bi) {
824 wpa_printf(MSG_DEBUG,
825 "DPP: No matching bootstrapping information found");
826 return -1;
827 }
828
829 auth = dpp_auth_init(dpp, conn->msg_ctx, peer_bi, NULL,
830 DPP_CAPAB_CONFIGURATOR, -1, NULL, 0);
831 if (!auth)
832 return -1;
833 if (dpp_set_configurator(auth, conn->ctrl->configurator_params) < 0) {
834 dpp_auth_deinit(auth);
835 dpp_connection_remove(conn);
836 return -1;
837 }
838
839 conn->auth = auth;
840 return dpp_tcp_send_msg(conn, conn->auth->req_msg);
841 }
842
843
dpp_controller_rx_reconfig_announcement(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)844 static int dpp_controller_rx_reconfig_announcement(struct dpp_connection *conn,
845 const u8 *hdr, const u8 *buf,
846 size_t len)
847 {
848 const u8 *csign_hash, *fcgroup, *a_nonce, *e_id;
849 u16 csign_hash_len, fcgroup_len, a_nonce_len, e_id_len;
850 struct dpp_configurator *conf;
851 struct dpp_global *dpp = conn->ctrl->global;
852 struct dpp_authentication *auth;
853 u16 group;
854
855 if (conn->auth) {
856 wpa_printf(MSG_DEBUG,
857 "DPP: Ignore Reconfig Announcement during ongoing Authentication");
858 return -1;
859 }
860
861 wpa_printf(MSG_DEBUG, "DPP: Reconfig Announcement");
862
863 csign_hash = dpp_get_attr(buf, len, DPP_ATTR_C_SIGN_KEY_HASH,
864 &csign_hash_len);
865 if (!csign_hash || csign_hash_len != SHA256_MAC_LEN) {
866 wpa_msg(conn->msg_ctx, MSG_INFO, DPP_EVENT_FAIL
867 "Missing or invalid required Configurator C-sign key Hash attribute");
868 return -1;
869 }
870 wpa_hexdump(MSG_MSGDUMP, "DPP: Configurator C-sign key Hash (kid)",
871 csign_hash, csign_hash_len);
872 conf = dpp_configurator_find_kid(dpp, csign_hash);
873 if (!conf) {
874 wpa_printf(MSG_DEBUG,
875 "DPP: No matching Configurator information found");
876 return -1;
877 }
878
879 fcgroup = dpp_get_attr(buf, len, DPP_ATTR_FINITE_CYCLIC_GROUP,
880 &fcgroup_len);
881 if (!fcgroup || fcgroup_len != 2) {
882 wpa_msg(conn->msg_ctx, MSG_INFO, DPP_EVENT_FAIL
883 "Missing or invalid required Finite Cyclic Group attribute");
884 return -1;
885 }
886 group = WPA_GET_LE16(fcgroup);
887 wpa_printf(MSG_DEBUG, "DPP: Enrollee finite cyclic group: %u", group);
888
889 a_nonce = dpp_get_attr(buf, len, DPP_ATTR_A_NONCE, &a_nonce_len);
890 e_id = dpp_get_attr(buf, len, DPP_ATTR_E_PRIME_ID, &e_id_len);
891
892 auth = dpp_reconfig_init(dpp, conn->msg_ctx, conf, 0, group,
893 a_nonce, a_nonce_len, e_id, e_id_len);
894 if (!auth)
895 return -1;
896 if (dpp_set_configurator(auth, conn->ctrl->configurator_params) < 0) {
897 dpp_auth_deinit(auth);
898 return -1;
899 }
900
901 conn->auth = auth;
902 return dpp_tcp_send_msg(conn, auth->reconfig_req_msg);
903 }
904
905
dpp_controller_rx_reconfig_auth_resp(struct dpp_connection * conn,const u8 * hdr,const u8 * buf,size_t len)906 static int dpp_controller_rx_reconfig_auth_resp(struct dpp_connection *conn,
907 const u8 *hdr, const u8 *buf,
908 size_t len)
909 {
910 struct dpp_authentication *auth = conn->auth;
911 struct wpabuf *conf;
912 int res;
913
914 wpa_printf(MSG_DEBUG, "DPP: Reconfig Authentication Response");
915
916 if (!auth || !auth->reconfig || !auth->configurator) {
917 wpa_printf(MSG_DEBUG,
918 "DPP: No DPP Reconfig Authentication in progress - drop");
919 return -1;
920 }
921
922 conf = dpp_reconfig_auth_resp_rx(auth, hdr, buf, len);
923 if (!conf)
924 return -1;
925
926 res = dpp_tcp_send_msg(conn, conf);
927 wpabuf_free(conf);
928 return res;
929 }
930
931
dpp_controller_rx_action(struct dpp_connection * conn,const u8 * msg,size_t len)932 static int dpp_controller_rx_action(struct dpp_connection *conn, const u8 *msg,
933 size_t len)
934 {
935 const u8 *pos, *end;
936 u8 type;
937
938 wpa_printf(MSG_DEBUG, "DPP: Received DPP Action frame over TCP");
939 pos = msg;
940 end = msg + len;
941
942 if (end - pos < DPP_HDR_LEN ||
943 WPA_GET_BE24(pos) != OUI_WFA ||
944 pos[3] != DPP_OUI_TYPE) {
945 wpa_printf(MSG_DEBUG, "DPP: Unrecognized header");
946 return -1;
947 }
948
949 if (pos[4] != 1) {
950 wpa_printf(MSG_DEBUG, "DPP: Unsupported Crypto Suite %u",
951 pos[4]);
952 return -1;
953 }
954 type = pos[5];
955 wpa_printf(MSG_DEBUG, "DPP: Received message type %u", type);
956 pos += DPP_HDR_LEN;
957
958 wpa_hexdump(MSG_MSGDUMP, "DPP: Received message attributes",
959 pos, end - pos);
960 if (dpp_check_attrs(pos, end - pos) < 0)
961 return -1;
962
963 if (conn->relay) {
964 wpa_printf(MSG_DEBUG, "DPP: Relay - send over WLAN");
965 conn->relay->tx(conn->relay->cb_ctx, conn->mac_addr,
966 conn->freq, msg, len);
967 return 0;
968 }
969
970 switch (type) {
971 case DPP_PA_AUTHENTICATION_REQ:
972 return dpp_controller_rx_auth_req(conn, msg, pos, end - pos);
973 case DPP_PA_AUTHENTICATION_RESP:
974 return dpp_controller_rx_auth_resp(conn, msg, pos, end - pos);
975 case DPP_PA_AUTHENTICATION_CONF:
976 return dpp_controller_rx_auth_conf(conn, msg, pos, end - pos);
977 case DPP_PA_CONFIGURATION_RESULT:
978 return dpp_controller_rx_conf_result(conn, msg, pos, end - pos);
979 case DPP_PA_CONNECTION_STATUS_RESULT:
980 return dpp_controller_rx_conn_status_result(conn, msg, pos,
981 end - pos);
982 case DPP_PA_PRESENCE_ANNOUNCEMENT:
983 return dpp_controller_rx_presence_announcement(conn, msg, pos,
984 end - pos);
985 case DPP_PA_RECONFIG_ANNOUNCEMENT:
986 return dpp_controller_rx_reconfig_announcement(conn, msg, pos,
987 end - pos);
988 case DPP_PA_RECONFIG_AUTH_RESP:
989 return dpp_controller_rx_reconfig_auth_resp(conn, msg, pos,
990 end - pos);
991 default:
992 /* TODO: missing messages types */
993 wpa_printf(MSG_DEBUG,
994 "DPP: Unsupported frame subtype %d", type);
995 return -1;
996 }
997 }
998
999
dpp_tcp_send_comeback_delay(struct dpp_connection * conn,u8 action)1000 static int dpp_tcp_send_comeback_delay(struct dpp_connection *conn, u8 action)
1001 {
1002 struct wpabuf *buf;
1003 size_t len = 18;
1004
1005 if (action == WLAN_PA_GAS_COMEBACK_RESP)
1006 len++;
1007
1008 buf = wpabuf_alloc(4 + len);
1009 if (!buf)
1010 return -1;
1011
1012 wpabuf_put_be32(buf, len);
1013
1014 wpabuf_put_u8(buf, action);
1015 wpabuf_put_u8(buf, conn->gas_dialog_token);
1016 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
1017 if (action == WLAN_PA_GAS_COMEBACK_RESP)
1018 wpabuf_put_u8(buf, 0);
1019 wpabuf_put_le16(buf, 500); /* GAS Comeback Delay */
1020
1021 dpp_write_adv_proto(buf);
1022 wpabuf_put_le16(buf, 0); /* Query Response Length */
1023
1024 /* Send Config Response over TCP */
1025 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Outgoing TCP message", buf);
1026 wpabuf_free(conn->msg_out);
1027 conn->msg_out_pos = 0;
1028 conn->msg_out = buf;
1029 dpp_tcp_send(conn);
1030 return 0;
1031 }
1032
1033
dpp_tcp_send_gas_resp(struct dpp_connection * conn,u8 action,struct wpabuf * resp)1034 static int dpp_tcp_send_gas_resp(struct dpp_connection *conn, u8 action,
1035 struct wpabuf *resp)
1036 {
1037 struct wpabuf *buf;
1038 size_t len;
1039
1040 if (!resp)
1041 return -1;
1042
1043 len = 18 + wpabuf_len(resp);
1044 if (action == WLAN_PA_GAS_COMEBACK_RESP)
1045 len++;
1046
1047 buf = wpabuf_alloc(4 + len);
1048 if (!buf) {
1049 wpabuf_free(resp);
1050 return -1;
1051 }
1052
1053 wpabuf_put_be32(buf, len);
1054
1055 wpabuf_put_u8(buf, action);
1056 wpabuf_put_u8(buf, conn->gas_dialog_token);
1057 wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
1058 if (action == WLAN_PA_GAS_COMEBACK_RESP)
1059 wpabuf_put_u8(buf, 0);
1060 wpabuf_put_le16(buf, 0); /* GAS Comeback Delay */
1061
1062 dpp_write_adv_proto(buf);
1063 dpp_write_gas_query(buf, resp);
1064 wpabuf_free(resp);
1065
1066 /* Send Config Response over TCP; GAS fragmentation is taken care of by
1067 * the Relay */
1068 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Outgoing TCP message", buf);
1069 wpabuf_free(conn->msg_out);
1070 conn->msg_out_pos = 0;
1071 conn->msg_out = buf;
1072 conn->on_tcp_tx_complete_gas_done = 1;
1073 dpp_tcp_send(conn);
1074 return 0;
1075 }
1076
1077
dpp_controller_rx_gas_req(struct dpp_connection * conn,const u8 * msg,size_t len)1078 static int dpp_controller_rx_gas_req(struct dpp_connection *conn, const u8 *msg,
1079 size_t len)
1080 {
1081 const u8 *pos, *end, *next;
1082 const u8 *adv_proto;
1083 u16 slen;
1084 struct wpabuf *resp;
1085 struct dpp_authentication *auth = conn->auth;
1086
1087 if (len < 1 + 2)
1088 return -1;
1089
1090 wpa_printf(MSG_DEBUG,
1091 "DPP: Received DPP Configuration Request over TCP");
1092
1093 if (!auth || (!conn->ctrl && !auth->configurator) ||
1094 (!auth->auth_success && !auth->reconfig_success)) {
1095 wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress");
1096 return -1;
1097 }
1098
1099 pos = msg;
1100 end = msg + len;
1101
1102 conn->gas_dialog_token = *pos++;
1103 adv_proto = pos++;
1104 slen = *pos++;
1105 if (*adv_proto != WLAN_EID_ADV_PROTO ||
1106 slen > end - pos || slen < 2)
1107 return -1;
1108
1109 next = pos + slen;
1110 pos++; /* skip QueryRespLenLimit and PAME-BI */
1111
1112 if (slen != 8 || *pos != WLAN_EID_VENDOR_SPECIFIC ||
1113 pos[1] != 5 || WPA_GET_BE24(&pos[2]) != OUI_WFA ||
1114 pos[5] != DPP_OUI_TYPE || pos[6] != 0x01)
1115 return -1;
1116
1117 pos = next;
1118 /* Query Request */
1119 if (end - pos < 2)
1120 return -1;
1121 slen = WPA_GET_LE16(pos);
1122 pos += 2;
1123 if (slen > end - pos)
1124 return -1;
1125
1126 resp = dpp_conf_req_rx(auth, pos, slen);
1127 if (!resp && auth->waiting_cert) {
1128 wpa_printf(MSG_DEBUG, "DPP: Certificate not yet ready");
1129 conn->gas_comeback_in_progress = 1;
1130 return dpp_tcp_send_comeback_delay(conn,
1131 WLAN_PA_GAS_INITIAL_RESP);
1132 }
1133
1134 return dpp_tcp_send_gas_resp(conn, WLAN_PA_GAS_INITIAL_RESP, resp);
1135 }
1136
1137
dpp_controller_rx_gas_comeback_req(struct dpp_connection * conn,const u8 * msg,size_t len)1138 static int dpp_controller_rx_gas_comeback_req(struct dpp_connection *conn,
1139 const u8 *msg, size_t len)
1140 {
1141 u8 dialog_token;
1142 struct dpp_authentication *auth = conn->auth;
1143 struct wpabuf *resp;
1144
1145 if (len < 1)
1146 return -1;
1147
1148 wpa_printf(MSG_DEBUG,
1149 "DPP: Received DPP Configuration Request over TCP (comeback)");
1150
1151 if (!auth || (!conn->ctrl && !auth->configurator) ||
1152 (!auth->auth_success && !auth->reconfig_success) ||
1153 !conn->gas_comeback_in_progress) {
1154 wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress");
1155 return -1;
1156 }
1157
1158 dialog_token = msg[0];
1159 if (dialog_token != conn->gas_dialog_token) {
1160 wpa_printf(MSG_DEBUG, "DPP: Dialog token mismatch (%u != %u)",
1161 dialog_token, conn->gas_dialog_token);
1162 return -1;
1163 }
1164
1165 if (!auth->conf_resp_tcp) {
1166 wpa_printf(MSG_DEBUG, "DPP: Certificate not yet ready");
1167 return dpp_tcp_send_comeback_delay(conn,
1168 WLAN_PA_GAS_COMEBACK_RESP);
1169 }
1170
1171 wpa_printf(MSG_DEBUG,
1172 "DPP: Configuration response is ready to be sent out");
1173 resp = auth->conf_resp_tcp;
1174 auth->conf_resp_tcp = NULL;
1175 return dpp_tcp_send_gas_resp(conn, WLAN_PA_GAS_COMEBACK_RESP, resp);
1176 }
1177
1178
dpp_tcp_build_csr(void * eloop_ctx,void * timeout_ctx)1179 static void dpp_tcp_build_csr(void *eloop_ctx, void *timeout_ctx)
1180 {
1181 struct dpp_connection *conn = eloop_ctx;
1182 struct dpp_authentication *auth = conn->auth;
1183
1184 if (!auth || !auth->csrattrs)
1185 return;
1186
1187 wpa_printf(MSG_DEBUG, "DPP: Build CSR");
1188 wpabuf_free(auth->csr);
1189 /* TODO: Additional information needed for CSR based on csrAttrs */
1190 auth->csr = dpp_build_csr(auth, conn->name ? conn->name : "Test");
1191 if (!auth->csr) {
1192 dpp_connection_remove(conn);
1193 return;
1194 }
1195
1196 dpp_controller_start_gas_client(conn);
1197 }
1198
1199
dpp_tcp_rx_gas_resp(struct dpp_connection * conn,struct wpabuf * resp)1200 static int dpp_tcp_rx_gas_resp(struct dpp_connection *conn, struct wpabuf *resp)
1201 {
1202 struct dpp_authentication *auth = conn->auth;
1203 int res;
1204 struct wpabuf *msg;
1205 enum dpp_status_error status;
1206
1207 wpa_printf(MSG_DEBUG,
1208 "DPP: Configuration Response for local stack from TCP");
1209
1210 if (auth)
1211 res = dpp_conf_resp_rx(auth, resp);
1212 else
1213 res = -1;
1214 wpabuf_free(resp);
1215 if (res == -2) {
1216 wpa_printf(MSG_DEBUG, "DPP: CSR needed");
1217 eloop_register_timeout(0, 0, dpp_tcp_build_csr, conn, NULL);
1218 return 0;
1219 }
1220 if (res < 0) {
1221 wpa_printf(MSG_DEBUG, "DPP: Configuration attempt failed");
1222 return -1;
1223 }
1224
1225 if (conn->process_conf_obj)
1226 res = conn->process_conf_obj(conn->cb_ctx, auth);
1227 else
1228 res = 0;
1229
1230 if (auth->peer_version < 2 || auth->conf_resp_status != DPP_STATUS_OK)
1231 return -1;
1232
1233 wpa_printf(MSG_DEBUG, "DPP: Send DPP Configuration Result");
1234 status = res < 0 ? DPP_STATUS_CONFIG_REJECTED : DPP_STATUS_OK;
1235 msg = dpp_build_conf_result(auth, status);
1236 if (!msg)
1237 return -1;
1238
1239 conn->on_tcp_tx_complete_remove = 1;
1240 res = dpp_tcp_send_msg(conn, msg);
1241 wpabuf_free(msg);
1242
1243 /* This exchange will be terminated in the TX status handler */
1244
1245 return res;
1246 }
1247
1248
dpp_tcp_gas_query_comeback(void * eloop_ctx,void * timeout_ctx)1249 static void dpp_tcp_gas_query_comeback(void *eloop_ctx, void *timeout_ctx)
1250 {
1251 struct dpp_connection *conn = eloop_ctx;
1252 struct dpp_authentication *auth = conn->auth;
1253 struct wpabuf *msg;
1254
1255 if (!auth)
1256 return;
1257
1258 wpa_printf(MSG_DEBUG, "DPP: Send GAS Comeback Request");
1259 msg = wpabuf_alloc(4 + 2);
1260 if (!msg)
1261 return;
1262 wpabuf_put_be32(msg, 2);
1263 wpabuf_put_u8(msg, WLAN_PA_GAS_COMEBACK_REQ);
1264 wpabuf_put_u8(msg, conn->gas_dialog_token);
1265 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: Outgoing TCP message", msg);
1266
1267 wpabuf_free(conn->msg_out);
1268 conn->msg_out_pos = 0;
1269 conn->msg_out = msg;
1270 dpp_tcp_send(conn);
1271 }
1272
1273
dpp_rx_gas_resp(struct dpp_connection * conn,const u8 * msg,size_t len,bool comeback)1274 static int dpp_rx_gas_resp(struct dpp_connection *conn, const u8 *msg,
1275 size_t len, bool comeback)
1276 {
1277 struct wpabuf *buf;
1278 u8 dialog_token;
1279 const u8 *pos, *end, *next, *adv_proto;
1280 u16 status, slen, comeback_delay;
1281
1282 if (len < (size_t) (5 + 2 + (comeback ? 1 : 0)))
1283 return -1;
1284
1285 wpa_printf(MSG_DEBUG,
1286 "DPP: Received DPP Configuration Response over TCP");
1287
1288 pos = msg;
1289 end = msg + len;
1290
1291 dialog_token = *pos++;
1292 status = WPA_GET_LE16(pos);
1293 if (status != WLAN_STATUS_SUCCESS) {
1294 wpa_printf(MSG_DEBUG, "DPP: Unexpected Status Code %u", status);
1295 return -1;
1296 }
1297 pos += 2;
1298 if (comeback)
1299 pos++; /* ignore Fragment ID */
1300 comeback_delay = WPA_GET_LE16(pos);
1301 pos += 2;
1302
1303 adv_proto = pos++;
1304 slen = *pos++;
1305 if (*adv_proto != WLAN_EID_ADV_PROTO ||
1306 slen > end - pos || slen < 2)
1307 return -1;
1308
1309 next = pos + slen;
1310 pos++; /* skip QueryRespLenLimit and PAME-BI */
1311
1312 if (slen != 8 || *pos != WLAN_EID_VENDOR_SPECIFIC ||
1313 pos[1] != 5 || WPA_GET_BE24(&pos[2]) != OUI_WFA ||
1314 pos[5] != DPP_OUI_TYPE || pos[6] != 0x01)
1315 return -1;
1316
1317 pos = next;
1318 /* Query Response */
1319 if (end - pos < 2)
1320 return -1;
1321 slen = WPA_GET_LE16(pos);
1322 pos += 2;
1323 if (slen > end - pos)
1324 return -1;
1325
1326 if (comeback_delay) {
1327 unsigned int secs, usecs;
1328
1329 conn->gas_dialog_token = dialog_token;
1330 secs = (comeback_delay * 1024) / 1000000;
1331 usecs = comeback_delay * 1024 - secs * 1000000;
1332 wpa_printf(MSG_DEBUG, "DPP: Comeback delay: %u",
1333 comeback_delay);
1334 eloop_cancel_timeout(dpp_tcp_gas_query_comeback, conn, NULL);
1335 eloop_register_timeout(secs, usecs, dpp_tcp_gas_query_comeback,
1336 conn, NULL);
1337 return 0;
1338 }
1339
1340 buf = wpabuf_alloc(slen);
1341 if (!buf)
1342 return -1;
1343 wpabuf_put_data(buf, pos, slen);
1344
1345 if (!conn->relay &&
1346 (!conn->ctrl || (conn->ctrl->allowed_roles & DPP_CAPAB_ENROLLEE)))
1347 return dpp_tcp_rx_gas_resp(conn, buf);
1348
1349 if (!conn->relay) {
1350 wpa_printf(MSG_DEBUG, "DPP: No matching exchange in progress");
1351 wpabuf_free(buf);
1352 return -1;
1353 }
1354 wpa_printf(MSG_DEBUG, "DPP: Relay - send over WLAN");
1355 conn->relay->gas_resp_tx(conn->relay->cb_ctx, conn->mac_addr,
1356 dialog_token, 0, buf);
1357
1358 return 0;
1359 }
1360
1361
dpp_controller_rx(int sd,void * eloop_ctx,void * sock_ctx)1362 static void dpp_controller_rx(int sd, void *eloop_ctx, void *sock_ctx)
1363 {
1364 struct dpp_connection *conn = eloop_ctx;
1365 int res;
1366 const u8 *pos;
1367
1368 wpa_printf(MSG_DEBUG, "DPP: TCP data available for reading (sock %d)",
1369 sd);
1370
1371 if (conn->msg_len_octets < 4) {
1372 u32 msglen;
1373
1374 res = recv(sd, &conn->msg_len[conn->msg_len_octets],
1375 4 - conn->msg_len_octets, 0);
1376 if (res < 0) {
1377 wpa_printf(MSG_DEBUG, "DPP: recv failed: %s",
1378 strerror(errno));
1379 dpp_connection_remove(conn);
1380 return;
1381 }
1382 if (res == 0) {
1383 wpa_printf(MSG_DEBUG,
1384 "DPP: No more data available over TCP");
1385 dpp_connection_remove(conn);
1386 return;
1387 }
1388 wpa_printf(MSG_DEBUG,
1389 "DPP: Received %d/%d octet(s) of message length field",
1390 res, (int) (4 - conn->msg_len_octets));
1391 conn->msg_len_octets += res;
1392
1393 if (conn->msg_len_octets < 4) {
1394 wpa_printf(MSG_DEBUG,
1395 "DPP: Need %d more octets of message length field",
1396 (int) (4 - conn->msg_len_octets));
1397 return;
1398 }
1399
1400 msglen = WPA_GET_BE32(conn->msg_len);
1401 wpa_printf(MSG_DEBUG, "DPP: Message length: %u", msglen);
1402 if (msglen > 65535) {
1403 wpa_printf(MSG_INFO, "DPP: Unexpectedly long message");
1404 dpp_connection_remove(conn);
1405 return;
1406 }
1407
1408 wpabuf_free(conn->msg);
1409 conn->msg = wpabuf_alloc(msglen);
1410 }
1411
1412 if (!conn->msg) {
1413 wpa_printf(MSG_DEBUG,
1414 "DPP: No buffer available for receiving the message");
1415 dpp_connection_remove(conn);
1416 return;
1417 }
1418
1419 wpa_printf(MSG_DEBUG, "DPP: Need %u more octets of message payload",
1420 (unsigned int) wpabuf_tailroom(conn->msg));
1421
1422 res = recv(sd, wpabuf_put(conn->msg, 0), wpabuf_tailroom(conn->msg), 0);
1423 if (res < 0) {
1424 wpa_printf(MSG_DEBUG, "DPP: recv failed: %s", strerror(errno));
1425 dpp_connection_remove(conn);
1426 return;
1427 }
1428 if (res == 0) {
1429 wpa_printf(MSG_DEBUG, "DPP: No more data available over TCP");
1430 dpp_connection_remove(conn);
1431 return;
1432 }
1433 wpa_printf(MSG_DEBUG, "DPP: Received %d octets", res);
1434 wpabuf_put(conn->msg, res);
1435
1436 if (wpabuf_tailroom(conn->msg) > 0) {
1437 wpa_printf(MSG_DEBUG,
1438 "DPP: Need %u more octets of message payload",
1439 (unsigned int) wpabuf_tailroom(conn->msg));
1440 return;
1441 }
1442
1443 conn->msg_len_octets = 0;
1444 wpa_hexdump_buf(MSG_DEBUG, "DPP: Received TCP message", conn->msg);
1445 if (wpabuf_len(conn->msg) < 1) {
1446 dpp_connection_remove(conn);
1447 return;
1448 }
1449
1450 pos = wpabuf_head(conn->msg);
1451 switch (*pos) {
1452 case WLAN_PA_VENDOR_SPECIFIC:
1453 if (dpp_controller_rx_action(conn, pos + 1,
1454 wpabuf_len(conn->msg) - 1) < 0)
1455 dpp_connection_remove(conn);
1456 break;
1457 case WLAN_PA_GAS_INITIAL_REQ:
1458 if (dpp_controller_rx_gas_req(conn, pos + 1,
1459 wpabuf_len(conn->msg) - 1) < 0)
1460 dpp_connection_remove(conn);
1461 break;
1462 case WLAN_PA_GAS_INITIAL_RESP:
1463 case WLAN_PA_GAS_COMEBACK_RESP:
1464 if (dpp_rx_gas_resp(conn, pos + 1,
1465 wpabuf_len(conn->msg) - 1,
1466 *pos == WLAN_PA_GAS_COMEBACK_RESP) < 0)
1467 dpp_connection_remove(conn);
1468 break;
1469 case WLAN_PA_GAS_COMEBACK_REQ:
1470 if (dpp_controller_rx_gas_comeback_req(
1471 conn, pos + 1, wpabuf_len(conn->msg) - 1) < 0)
1472 dpp_connection_remove(conn);
1473 break;
1474 default:
1475 wpa_printf(MSG_DEBUG, "DPP: Ignore unsupported message type %u",
1476 *pos);
1477 break;
1478 }
1479 }
1480
1481
dpp_controller_tcp_cb(int sd,void * eloop_ctx,void * sock_ctx)1482 static void dpp_controller_tcp_cb(int sd, void *eloop_ctx, void *sock_ctx)
1483 {
1484 struct dpp_controller *ctrl = eloop_ctx;
1485 struct sockaddr_in addr;
1486 socklen_t addr_len = sizeof(addr);
1487 int fd;
1488 struct dpp_connection *conn;
1489
1490 wpa_printf(MSG_DEBUG, "DPP: New TCP connection");
1491
1492 fd = accept(ctrl->sock, (struct sockaddr *) &addr, &addr_len);
1493 if (fd < 0) {
1494 wpa_printf(MSG_DEBUG,
1495 "DPP: Failed to accept new connection: %s",
1496 strerror(errno));
1497 return;
1498 }
1499 wpa_printf(MSG_DEBUG, "DPP: Connection from %s:%d",
1500 inet_ntoa(addr.sin_addr), ntohs(addr.sin_port));
1501
1502 conn = os_zalloc(sizeof(*conn));
1503 if (!conn)
1504 goto fail;
1505
1506 conn->global = ctrl->global;
1507 conn->ctrl = ctrl;
1508 conn->msg_ctx = ctrl->msg_ctx;
1509 conn->cb_ctx = ctrl->cb_ctx;
1510 conn->process_conf_obj = ctrl->process_conf_obj;
1511 conn->sock = fd;
1512 conn->netrole = ctrl->netrole;
1513
1514 if (fcntl(conn->sock, F_SETFL, O_NONBLOCK) != 0) {
1515 wpa_printf(MSG_DEBUG, "DPP: fnctl(O_NONBLOCK) failed: %s",
1516 strerror(errno));
1517 goto fail;
1518 }
1519
1520 if (eloop_register_sock(conn->sock, EVENT_TYPE_READ,
1521 dpp_controller_rx, conn, NULL) < 0)
1522 goto fail;
1523 conn->read_eloop = 1;
1524
1525 /* TODO: eloop timeout to expire connections that do not complete in
1526 * reasonable time */
1527 dl_list_add(&ctrl->conn, &conn->list);
1528 return;
1529
1530 fail:
1531 close(fd);
1532 os_free(conn);
1533 }
1534
1535
dpp_tcp_init(struct dpp_global * dpp,struct dpp_authentication * auth,const struct hostapd_ip_addr * addr,int port,const char * name,enum dpp_netrole netrole,void * msg_ctx,void * cb_ctx,int (* process_conf_obj)(void * ctx,struct dpp_authentication * auth))1536 int dpp_tcp_init(struct dpp_global *dpp, struct dpp_authentication *auth,
1537 const struct hostapd_ip_addr *addr, int port, const char *name,
1538 enum dpp_netrole netrole, void *msg_ctx, void *cb_ctx,
1539 int (*process_conf_obj)(void *ctx,
1540 struct dpp_authentication *auth))
1541 {
1542 struct dpp_connection *conn;
1543 struct sockaddr_storage saddr;
1544 socklen_t addrlen;
1545 const u8 *hdr, *pos, *end;
1546 char txt[100];
1547
1548 wpa_printf(MSG_DEBUG, "DPP: Initialize TCP connection to %s port %d",
1549 hostapd_ip_txt(addr, txt, sizeof(txt)), port);
1550 if (dpp_ipaddr_to_sockaddr((struct sockaddr *) &saddr, &addrlen,
1551 addr, port) < 0) {
1552 dpp_auth_deinit(auth);
1553 return -1;
1554 }
1555
1556 conn = os_zalloc(sizeof(*conn));
1557 if (!conn) {
1558 dpp_auth_deinit(auth);
1559 return -1;
1560 }
1561
1562 conn->msg_ctx = msg_ctx;
1563 conn->cb_ctx = cb_ctx;
1564 conn->process_conf_obj = process_conf_obj;
1565 conn->name = os_strdup(name ? name : "Test");
1566 conn->netrole = netrole;
1567 conn->global = dpp;
1568 conn->auth = auth;
1569 conn->sock = socket(AF_INET, SOCK_STREAM, 0);
1570 if (conn->sock < 0)
1571 goto fail;
1572
1573 if (fcntl(conn->sock, F_SETFL, O_NONBLOCK) != 0) {
1574 wpa_printf(MSG_DEBUG, "DPP: fnctl(O_NONBLOCK) failed: %s",
1575 strerror(errno));
1576 goto fail;
1577 }
1578
1579 if (connect(conn->sock, (struct sockaddr *) &saddr, addrlen) < 0) {
1580 if (errno != EINPROGRESS) {
1581 wpa_printf(MSG_DEBUG, "DPP: Failed to connect: %s",
1582 strerror(errno));
1583 goto fail;
1584 }
1585
1586 /*
1587 * Continue connecting in the background; eloop will call us
1588 * once the connection is ready (or failed).
1589 */
1590 }
1591
1592 if (eloop_register_sock(conn->sock, EVENT_TYPE_WRITE,
1593 dpp_conn_tx_ready, conn, NULL) < 0)
1594 goto fail;
1595 conn->write_eloop = 1;
1596
1597 hdr = wpabuf_head(auth->req_msg);
1598 end = hdr + wpabuf_len(auth->req_msg);
1599 hdr += 2; /* skip Category and Actiom */
1600 pos = hdr + DPP_HDR_LEN;
1601 conn->msg_out = dpp_tcp_encaps(hdr, pos, end - pos);
1602 if (!conn->msg_out)
1603 goto fail;
1604 /* Message will be sent in dpp_conn_tx_ready() */
1605
1606 /* TODO: eloop timeout to clear a connection if it does not complete
1607 * properly */
1608 dl_list_add(&dpp->tcp_init, &conn->list);
1609 return 0;
1610 fail:
1611 dpp_connection_free(conn);
1612 return -1;
1613 }
1614
1615
dpp_controller_start(struct dpp_global * dpp,struct dpp_controller_config * config)1616 int dpp_controller_start(struct dpp_global *dpp,
1617 struct dpp_controller_config *config)
1618 {
1619 struct dpp_controller *ctrl;
1620 int on = 1;
1621 struct sockaddr_in sin;
1622 int port;
1623
1624 if (!dpp || dpp->controller)
1625 return -1;
1626
1627 ctrl = os_zalloc(sizeof(*ctrl));
1628 if (!ctrl)
1629 return -1;
1630 ctrl->global = dpp;
1631 if (config->configurator_params)
1632 ctrl->configurator_params =
1633 os_strdup(config->configurator_params);
1634 dl_list_init(&ctrl->conn);
1635 ctrl->allowed_roles = config->allowed_roles;
1636 ctrl->qr_mutual = config->qr_mutual;
1637 ctrl->netrole = config->netrole;
1638 ctrl->msg_ctx = config->msg_ctx;
1639 ctrl->cb_ctx = config->cb_ctx;
1640 ctrl->process_conf_obj = config->process_conf_obj;
1641
1642 ctrl->sock = socket(AF_INET, SOCK_STREAM, 0);
1643 if (ctrl->sock < 0)
1644 goto fail;
1645
1646 if (setsockopt(ctrl->sock, SOL_SOCKET, SO_REUSEADDR,
1647 &on, sizeof(on)) < 0) {
1648 wpa_printf(MSG_DEBUG,
1649 "DPP: setsockopt(SO_REUSEADDR) failed: %s",
1650 strerror(errno));
1651 /* try to continue anyway */
1652 }
1653
1654 if (fcntl(ctrl->sock, F_SETFL, O_NONBLOCK) < 0) {
1655 wpa_printf(MSG_INFO, "DPP: fnctl(O_NONBLOCK) failed: %s",
1656 strerror(errno));
1657 goto fail;
1658 }
1659
1660 /* TODO: IPv6 */
1661 os_memset(&sin, 0, sizeof(sin));
1662 sin.sin_family = AF_INET;
1663 sin.sin_addr.s_addr = INADDR_ANY;
1664 port = config->tcp_port ? config->tcp_port : DPP_TCP_PORT;
1665 sin.sin_port = htons(port);
1666 if (bind(ctrl->sock, (struct sockaddr *) &sin, sizeof(sin)) < 0) {
1667 wpa_printf(MSG_INFO,
1668 "DPP: Failed to bind Controller TCP port: %s",
1669 strerror(errno));
1670 goto fail;
1671 }
1672 if (listen(ctrl->sock, 10 /* max backlog */) < 0 ||
1673 fcntl(ctrl->sock, F_SETFL, O_NONBLOCK) < 0 ||
1674 eloop_register_sock(ctrl->sock, EVENT_TYPE_READ,
1675 dpp_controller_tcp_cb, ctrl, NULL))
1676 goto fail;
1677
1678 dpp->controller = ctrl;
1679 wpa_printf(MSG_DEBUG, "DPP: Controller started on TCP port %d", port);
1680 return 0;
1681 fail:
1682 dpp_controller_free(ctrl);
1683 return -1;
1684 }
1685
1686
dpp_controller_stop(struct dpp_global * dpp)1687 void dpp_controller_stop(struct dpp_global *dpp)
1688 {
1689 if (dpp) {
1690 dpp_controller_free(dpp->controller);
1691 dpp->controller = NULL;
1692 }
1693 }
1694
1695
dpp_tcp_peer_id_match(struct dpp_authentication * auth,unsigned int id)1696 static bool dpp_tcp_peer_id_match(struct dpp_authentication *auth,
1697 unsigned int id)
1698 {
1699 return auth &&
1700 ((auth->peer_bi && auth->peer_bi->id == id) ||
1701 (auth->tmp_peer_bi && auth->tmp_peer_bi->id == id));
1702 }
1703
1704
dpp_tcp_get_auth(struct dpp_global * dpp,unsigned int id)1705 static struct dpp_authentication * dpp_tcp_get_auth(struct dpp_global *dpp,
1706 unsigned int id)
1707 {
1708 struct dpp_connection *conn;
1709
1710 dl_list_for_each(conn, &dpp->tcp_init, struct dpp_connection, list) {
1711 if (dpp_tcp_peer_id_match(conn->auth, id))
1712 return conn->auth;
1713 }
1714
1715 return NULL;
1716 }
1717
1718
dpp_controller_get_auth(struct dpp_global * dpp,unsigned int id)1719 struct dpp_authentication * dpp_controller_get_auth(struct dpp_global *dpp,
1720 unsigned int id)
1721 {
1722 struct dpp_controller *ctrl = dpp->controller;
1723 struct dpp_connection *conn;
1724
1725 if (!ctrl)
1726 return dpp_tcp_get_auth(dpp, id);
1727
1728 dl_list_for_each(conn, &ctrl->conn, struct dpp_connection, list) {
1729 if (dpp_tcp_peer_id_match(conn->auth, id))
1730 return conn->auth;
1731 }
1732
1733 return dpp_tcp_get_auth(dpp, id);
1734 }
1735
1736
dpp_controller_new_qr_code(struct dpp_global * dpp,struct dpp_bootstrap_info * bi)1737 void dpp_controller_new_qr_code(struct dpp_global *dpp,
1738 struct dpp_bootstrap_info *bi)
1739 {
1740 struct dpp_controller *ctrl = dpp->controller;
1741 struct dpp_connection *conn;
1742
1743 if (!ctrl)
1744 return;
1745
1746 dl_list_for_each(conn, &ctrl->conn, struct dpp_connection, list) {
1747 struct dpp_authentication *auth = conn->auth;
1748
1749 if (!auth->response_pending ||
1750 dpp_notify_new_qr_code(auth, bi) != 1)
1751 continue;
1752 wpa_printf(MSG_DEBUG,
1753 "DPP: Sending out pending authentication response");
1754 dpp_tcp_send_msg(conn, conn->auth->resp_msg);
1755 }
1756 }
1757
1758
dpp_tcp_init_flush(struct dpp_global * dpp)1759 void dpp_tcp_init_flush(struct dpp_global *dpp)
1760 {
1761 struct dpp_connection *conn, *tmp;
1762
1763 dl_list_for_each_safe(conn, tmp, &dpp->tcp_init, struct dpp_connection,
1764 list)
1765 dpp_connection_remove(conn);
1766 }
1767
1768
dpp_relay_controller_free(struct dpp_relay_controller * ctrl)1769 static void dpp_relay_controller_free(struct dpp_relay_controller *ctrl)
1770 {
1771 struct dpp_connection *conn, *tmp;
1772
1773 dl_list_for_each_safe(conn, tmp, &ctrl->conn, struct dpp_connection,
1774 list)
1775 dpp_connection_remove(conn);
1776 os_free(ctrl);
1777 }
1778
1779
dpp_relay_flush_controllers(struct dpp_global * dpp)1780 void dpp_relay_flush_controllers(struct dpp_global *dpp)
1781 {
1782 struct dpp_relay_controller *ctrl, *tmp;
1783
1784 if (!dpp)
1785 return;
1786
1787 dl_list_for_each_safe(ctrl, tmp, &dpp->controllers,
1788 struct dpp_relay_controller, list) {
1789 dl_list_del(&ctrl->list);
1790 dpp_relay_controller_free(ctrl);
1791 }
1792 }
1793
1794 #endif /* CONFIG_DPP2 */
1795