/*

 * DPP authentication exchange

 * Copyright (c) 2017, Qualcomm Atheros, Inc.

 * Copyright (c) 2018-2020, The Linux Foundation

 *

 * This software may be distributed under the terms of the BSD license.

 * See README for more details.

 */

#include "utils/includes.h"

#include "utils/common.h"

#include "common/ieee802_11_common.h"

#include "common/wpa_ctrl.h"

#include "crypto/aes.h"

#include "crypto/aes_siv.h"

#include "crypto/random.h"

#include "dpp.h"

#include "dpp_i.h"

#ifdef CONFIG_TESTING_OPTIONS

u8 dpp_protocol_key_override[600];

size_t dpp_protocol_key_override_len = 0;

u8 dpp_nonce_override[DPP_MAX_NONCE_LEN];

size_t dpp_nonce_override_len = 0;

#endif /* CONFIG_TESTING_OPTIONS */

static void dpp_build_attr_i_bootstrap_key_hash(struct wpabuf *msg,

            const u8 *hash)

{

  if (hash) {

    wpa_printf(MSG_DEBUG, "DPP: I-Bootstrap Key Hash");

    wpabuf_put_le16(msg, DPP_ATTR_I_BOOTSTRAP_KEY_HASH);

    wpabuf_put_le16(msg, SHA256_MAC_LEN);

    wpabuf_put_data(msg, hash, SHA256_MAC_LEN);

  }

}

static void dpp_auth_success(struct dpp_authentication *auth)

{

  wpa_printf(MSG_DEBUG,

       "DPP: Authentication success - clear temporary keys");

  os_memset(auth->Mx, 0, sizeof(auth->Mx));

  auth->Mx_len = 0;

  os_memset(auth->Nx, 0, sizeof(auth->Nx));

  auth->Nx_len = 0;

  os_memset(auth->Lx, 0, sizeof(auth->Lx));

  auth->Lx_len = 0;

  os_memset(auth->k1, 0, sizeof(auth->k1));

  os_memset(auth->k2, 0, sizeof(auth->k2));

  auth->auth_success = 1;

}

static struct wpabuf * dpp_auth_build_req(struct dpp_authentication *auth,

            const struct wpabuf *pi,

            size_t nonce_len,

            const u8 *r_pubkey_hash,

            const u8 *i_pubkey_hash,

            unsigned int neg_freq)

{

  struct wpabuf *msg;

  u8 clear[4 + DPP_MAX_NONCE_LEN + 4 + 1];

  u8 wrapped_data[4 + DPP_MAX_NONCE_LEN + 4 + 1 + AES_BLOCK_SIZE];

  u8 *pos;

  const u8 *addr[2];

  size_t len[2], siv_len, attr_len;

  u8 *attr_start, *attr_end;

  /* Build DPP Authentication Request frame attributes */

  attr_len = 2 * (4 + SHA256_MAC_LEN) + 4 + (pi ? wpabuf_len(pi) : 0) +

    4 + sizeof(wrapped_data);

  if (neg_freq > 0)

    attr_len += 4 + 2;

#ifdef CONFIG_DPP2

  attr_len += 5;

#endif /* CONFIG_DPP2 */

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ)

    attr_len += 5;

#endif /* CONFIG_TESTING_OPTIONS */

  msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_REQ, attr_len);

  if (!msg)

    return NULL;

  attr_start = wpabuf_put(msg, 0);

  /* Responder Bootstrapping Key Hash */

  dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash);

  /* Initiator Bootstrapping Key Hash */

  dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash);

  /* Initiator Protocol Key */

  if (pi) {

    wpabuf_put_le16(msg, DPP_ATTR_I_PROTOCOL_KEY);

    wpabuf_put_le16(msg, wpabuf_len(pi));

    wpabuf_put_buf(msg, pi);

  }

  /* Channel */

  if (neg_freq > 0) {

    u8 op_class, channel;

    if (ieee80211_freq_to_channel_ext(neg_freq, 0, 0, &op_class,

              &channel) ==

        NUM_HOSTAPD_MODES) {

      wpa_printf(MSG_INFO,

           "DPP: Unsupported negotiation frequency request: %d",

           neg_freq);

      wpabuf_free(msg);

      return NULL;

    }

    wpabuf_put_le16(msg, DPP_ATTR_CHANNEL);

    wpabuf_put_le16(msg, 2);

    wpabuf_put_u8(msg, op_class);

    wpabuf_put_u8(msg, channel);

  }

#ifdef CONFIG_DPP2

  /* Protocol Version */

  if (DPP_VERSION > 1) {

    wpabuf_put_le16(msg, DPP_ATTR_PROTOCOL_VERSION);

    wpabuf_put_le16(msg, 1);

    wpabuf_put_u8(msg, DPP_VERSION);

  }

#endif /* CONFIG_DPP2 */

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_REQ) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data");

    goto skip_wrapped_data;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  /* Wrapped data ({I-nonce, I-capabilities}k1) */

  pos = clear;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_REQ) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce");

    goto skip_i_nonce;

  }

  if (dpp_test == DPP_TEST_INVALID_I_NONCE_AUTH_REQ) {

    wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-nonce");

    WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE);

    pos += 2;

    WPA_PUT_LE16(pos, nonce_len - 1);

    pos += 2;

    os_memcpy(pos, auth->i_nonce, nonce_len - 1);

    pos += nonce_len - 1;

    goto skip_i_nonce;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  /* I-nonce */

  WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE);

  pos += 2;

  WPA_PUT_LE16(pos, nonce_len);

  pos += 2;

  os_memcpy(pos, auth->i_nonce, nonce_len);

  pos += nonce_len;

#ifdef CONFIG_TESTING_OPTIONS

skip_i_nonce:

  if (dpp_test == DPP_TEST_NO_I_CAPAB_AUTH_REQ) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-capab");

    goto skip_i_capab;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  /* I-capabilities */

  WPA_PUT_LE16(pos, DPP_ATTR_I_CAPABILITIES);

  pos += 2;

  WPA_PUT_LE16(pos, 1);

  pos += 2;

  auth->i_capab = auth->allowed_roles;

  *pos++ = auth->i_capab;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_ZERO_I_CAPAB) {

    wpa_printf(MSG_INFO, "DPP: TESTING - zero I-capabilities");

    pos[-1] = 0;

  }

skip_i_capab:

#endif /* CONFIG_TESTING_OPTIONS */

  attr_end = wpabuf_put(msg, 0);

  /* OUI, OUI type, Crypto Suite, DPP frame type */

  addr[0] = wpabuf_head_u8(msg) + 2;

  len[0] = 3 + 1 + 1 + 1;

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);

  /* Attributes before Wrapped Data */

  addr[1] = attr_start;

  len[1] = attr_end - attr_start;

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);

  siv_len = pos - clear;

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len);

  if (aes_siv_encrypt(auth->k1, auth->curve->hash_len, clear, siv_len,

          2, addr, len, wrapped_data) < 0) {

    wpabuf_free(msg);

    return NULL;

  }

  siv_len += AES_BLOCK_SIZE;

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",

        wrapped_data, siv_len);

  wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);

  wpabuf_put_le16(msg, siv_len);

  wpabuf_put_data(msg, wrapped_data, siv_len);

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ) {

    wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data");

    dpp_build_attr_status(msg, DPP_STATUS_OK);

  }

skip_wrapped_data:

#endif /* CONFIG_TESTING_OPTIONS */

  wpa_hexdump_buf(MSG_DEBUG,

      "DPP: Authentication Request frame attributes", msg);

  return msg;

}

static struct wpabuf * dpp_auth_build_resp(struct dpp_authentication *auth,

             enum dpp_status_error status,

             const struct wpabuf *pr,

             size_t nonce_len,

             const u8 *r_pubkey_hash,

             const u8 *i_pubkey_hash,

             const u8 *r_nonce, const u8 *i_nonce,

             const u8 *wrapped_r_auth,

             size_t wrapped_r_auth_len,

             const u8 *siv_key)

{

  struct wpabuf *msg;

#define DPP_AUTH_RESP_CLEAR_LEN 2 * (4 + DPP_MAX_NONCE_LEN) + 4 + 1 + \

    4 + 4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE

  u8 clear[DPP_AUTH_RESP_CLEAR_LEN];

  u8 wrapped_data[DPP_AUTH_RESP_CLEAR_LEN + AES_BLOCK_SIZE];

  const u8 *addr[2];

  size_t len[2], siv_len, attr_len;

  u8 *attr_start, *attr_end, *pos;

  auth->waiting_auth_conf = 1;

  auth->auth_resp_status = status;

  auth->auth_resp_tries = 0;

  /* Build DPP Authentication Response frame attributes */

  attr_len = 4 + 1 + 2 * (4 + SHA256_MAC_LEN) +

    4 + (pr ? wpabuf_len(pr) : 0) + 4 + sizeof(wrapped_data);

#ifdef CONFIG_DPP2

  attr_len += 5;

#endif /* CONFIG_DPP2 */

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP)

    attr_len += 5;

#endif /* CONFIG_TESTING_OPTIONS */

  msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_RESP, attr_len);

  if (!msg)

    return NULL;

  attr_start = wpabuf_put(msg, 0);

  /* DPP Status */

  if (status != 255)

    dpp_build_attr_status(msg, status);

  /* Responder Bootstrapping Key Hash */

  dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash);

  /* Initiator Bootstrapping Key Hash (mutual authentication) */

  dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash);

  /* Responder Protocol Key */

  if (pr) {

    wpabuf_put_le16(msg, DPP_ATTR_R_PROTOCOL_KEY);

    wpabuf_put_le16(msg, wpabuf_len(pr));

    wpabuf_put_buf(msg, pr);

  }

#ifdef CONFIG_DPP2

  /* Protocol Version */

  if (auth->peer_version >= 2) {

    wpabuf_put_le16(msg, DPP_ATTR_PROTOCOL_VERSION);

    wpabuf_put_le16(msg, 1);

    wpabuf_put_u8(msg, DPP_VERSION);

  }

#endif /* CONFIG_DPP2 */

  attr_end = wpabuf_put(msg, 0);

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data");

    goto skip_wrapped_data;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  /* Wrapped data ({R-nonce, I-nonce, R-capabilities, {R-auth}ke}k2) */

  pos = clear;

  if (r_nonce) {

    /* R-nonce */

    WPA_PUT_LE16(pos, DPP_ATTR_R_NONCE);

    pos += 2;

    WPA_PUT_LE16(pos, nonce_len);

    pos += 2;

    os_memcpy(pos, r_nonce, nonce_len);

    pos += nonce_len;

  }

  if (i_nonce) {

    /* I-nonce */

    WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE);

    pos += 2;

    WPA_PUT_LE16(pos, nonce_len);

    pos += 2;

    os_memcpy(pos, i_nonce, nonce_len);

#ifdef CONFIG_TESTING_OPTIONS

    if (dpp_test == DPP_TEST_I_NONCE_MISMATCH_AUTH_RESP) {

      wpa_printf(MSG_INFO, "DPP: TESTING - I-nonce mismatch");

      pos[nonce_len / 2] ^= 0x01;

    }

#endif /* CONFIG_TESTING_OPTIONS */

    pos += nonce_len;

  }

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_R_CAPAB_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-capab");

    goto skip_r_capab;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  /* R-capabilities */

  WPA_PUT_LE16(pos, DPP_ATTR_R_CAPABILITIES);

  pos += 2;

  WPA_PUT_LE16(pos, 1);

  pos += 2;

  auth->r_capab = auth->configurator ? DPP_CAPAB_CONFIGURATOR :

    DPP_CAPAB_ENROLLEE;

  *pos++ = auth->r_capab;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_ZERO_R_CAPAB) {

    wpa_printf(MSG_INFO, "DPP: TESTING - zero R-capabilities");

    pos[-1] = 0;

  } else if (dpp_test == DPP_TEST_INCOMPATIBLE_R_CAPAB_AUTH_RESP) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - incompatible R-capabilities");

    if ((auth->i_capab & DPP_CAPAB_ROLE_MASK) ==

        (DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE))

      pos[-1] = 0;

    else

      pos[-1] = auth->configurator ? DPP_CAPAB_ENROLLEE :

        DPP_CAPAB_CONFIGURATOR;

  }

skip_r_capab:

#endif /* CONFIG_TESTING_OPTIONS */

  if (wrapped_r_auth) {

    /* {R-auth}ke */

    WPA_PUT_LE16(pos, DPP_ATTR_WRAPPED_DATA);

    pos += 2;

    WPA_PUT_LE16(pos, wrapped_r_auth_len);

    pos += 2;

    os_memcpy(pos, wrapped_r_auth, wrapped_r_auth_len);

    pos += wrapped_r_auth_len;

  }

  /* OUI, OUI type, Crypto Suite, DPP frame type */

  addr[0] = wpabuf_head_u8(msg) + 2;

  len[0] = 3 + 1 + 1 + 1;

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);

  /* Attributes before Wrapped Data */

  addr[1] = attr_start;

  len[1] = attr_end - attr_start;

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);

  siv_len = pos - clear;

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len);

  if (aes_siv_encrypt(siv_key, auth->curve->hash_len, clear, siv_len,

          2, addr, len, wrapped_data) < 0) {

    wpabuf_free(msg);

    return NULL;

  }

  siv_len += AES_BLOCK_SIZE;

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",

        wrapped_data, siv_len);

  wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA);

  wpabuf_put_le16(msg, siv_len);

  wpabuf_put_data(msg, wrapped_data, siv_len);

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data");

    dpp_build_attr_status(msg, DPP_STATUS_OK);

  }

skip_wrapped_data:

#endif /* CONFIG_TESTING_OPTIONS */

  wpa_hexdump_buf(MSG_DEBUG,

      "DPP: Authentication Response frame attributes", msg);

  return msg;

}

static int dpp_auth_build_resp_ok(struct dpp_authentication *auth)

{

  size_t nonce_len;

  size_t secret_len;

  struct wpabuf *msg, *pr = NULL;

  u8 r_auth[4 + DPP_MAX_HASH_LEN];

  u8 wrapped_r_auth[4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE], *w_r_auth;

  size_t wrapped_r_auth_len;

  int ret = -1;

  const u8 *r_pubkey_hash, *i_pubkey_hash, *r_nonce, *i_nonce;

  enum dpp_status_error status = DPP_STATUS_OK;

#ifdef CONFIG_TESTING_OPTIONS

  u8 test_hash[SHA256_MAC_LEN];

#endif /* CONFIG_TESTING_OPTIONS */

  wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response");

  if (!auth->own_bi)

    return -1;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_nonce_override_len > 0) {

    wpa_printf(MSG_INFO, "DPP: TESTING - override R-nonce");

    nonce_len = dpp_nonce_override_len;

    os_memcpy(auth->r_nonce, dpp_nonce_override, nonce_len);

  } else {

    nonce_len = auth->curve->nonce_len;

    if (random_get_bytes(auth->r_nonce, nonce_len)) {

      wpa_printf(MSG_ERROR,

           "DPP: Failed to generate R-nonce");

      goto fail;

    }

  }

#else /* CONFIG_TESTING_OPTIONS */

  nonce_len = auth->curve->nonce_len;

  if (random_get_bytes(auth->r_nonce, nonce_len)) {

    wpa_printf(MSG_ERROR, "DPP: Failed to generate R-nonce");

    goto fail;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  wpa_hexdump(MSG_DEBUG, "DPP: R-nonce", auth->r_nonce, nonce_len);

  crypto_ec_key_deinit(auth->own_protocol_key);

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_protocol_key_override_len) {

    const struct dpp_curve_params *tmp_curve;

    wpa_printf(MSG_INFO,

         "DPP: TESTING - override protocol key");

    auth->own_protocol_key = dpp_set_keypair(

      &tmp_curve, dpp_protocol_key_override,

      dpp_protocol_key_override_len);

  } else {

    auth->own_protocol_key = dpp_gen_keypair(auth->curve);

  }

#else /* CONFIG_TESTING_OPTIONS */

  auth->own_protocol_key = dpp_gen_keypair(auth->curve);

#endif /* CONFIG_TESTING_OPTIONS */

  if (!auth->own_protocol_key)

    goto fail;

  pr = crypto_ec_key_get_pubkey_point(auth->own_protocol_key, 0);

  if (!pr)

    goto fail;

  /* ECDH: N = pR * PI */

  if (dpp_ecdh(auth->own_protocol_key, auth->peer_protocol_key,

         auth->Nx, &secret_len) < 0)

    goto fail;

  wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)",

      auth->Nx, auth->secret_len);

  auth->Nx_len = auth->secret_len;

  if (dpp_derive_k2(auth->Nx, auth->secret_len, auth->k2,

        auth->curve->hash_len) < 0)

    goto fail;

  if (auth->own_bi && auth->peer_bi) {

    /* Mutual authentication */

    if (dpp_auth_derive_l_responder(auth) < 0)

      goto fail;

  }

  if (dpp_derive_bk_ke(auth) < 0)

    goto fail;

  /* R-auth = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */

  WPA_PUT_LE16(r_auth, DPP_ATTR_R_AUTH_TAG);

  WPA_PUT_LE16(&r_auth[2], auth->curve->hash_len);

  if (dpp_gen_r_auth(auth, r_auth + 4) < 0)

    goto fail;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_R_AUTH_MISMATCH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - R-auth mismatch");

    r_auth[4 + auth->curve->hash_len / 2] ^= 0x01;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  if (aes_siv_encrypt(auth->ke, auth->curve->hash_len,

          r_auth, 4 + auth->curve->hash_len,

          0, NULL, NULL, wrapped_r_auth) < 0)

    goto fail;

  wrapped_r_auth_len = 4 + auth->curve->hash_len + AES_BLOCK_SIZE;

  wpa_hexdump(MSG_DEBUG, "DPP: {R-auth}ke",

        wrapped_r_auth, wrapped_r_auth_len);

  w_r_auth = wrapped_r_auth;

  r_pubkey_hash = auth->own_bi->pubkey_hash;

  if (auth->peer_bi)

    i_pubkey_hash = auth->peer_bi->pubkey_hash;

  else

    i_pubkey_hash = NULL;

  i_nonce = auth->i_nonce;

  r_nonce = auth->r_nonce;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash");

    r_pubkey_hash = NULL;

  } else if (dpp_test ==

       DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - invalid R-Bootstrap Key Hash");

    os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN);

    test_hash[SHA256_MAC_LEN - 1] ^= 0x01;

    r_pubkey_hash = test_hash;

  } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash");

    i_pubkey_hash = NULL;

  } else if (dpp_test ==

       DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - invalid I-Bootstrap Key Hash");

    if (i_pubkey_hash)

      os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN);

    else

      os_memset(test_hash, 0, SHA256_MAC_LEN);

    test_hash[SHA256_MAC_LEN - 1] ^= 0x01;

    i_pubkey_hash = test_hash;

  } else if (dpp_test == DPP_TEST_NO_R_PROTO_KEY_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-Proto Key");

    wpabuf_free(pr);

    pr = NULL;

  } else if (dpp_test == DPP_TEST_INVALID_R_PROTO_KEY_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Proto Key");

    wpabuf_free(pr);

    pr = wpabuf_alloc(2 * auth->curve->prime_len);

    if (!pr || dpp_test_gen_invalid_key(pr, auth->curve) < 0)

      goto fail;

  } else if (dpp_test == DPP_TEST_NO_R_AUTH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-Auth");

    w_r_auth = NULL;

    wrapped_r_auth_len = 0;

  } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no Status");

    status = 255;

  } else if (dpp_test == DPP_TEST_INVALID_STATUS_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status");

    status = 254;

  } else if (dpp_test == DPP_TEST_NO_R_NONCE_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-nonce");

    r_nonce = NULL;

  } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce");

    i_nonce = NULL;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  msg = dpp_auth_build_resp(auth, status, pr, nonce_len,

          r_pubkey_hash, i_pubkey_hash,

          r_nonce, i_nonce,

          w_r_auth, wrapped_r_auth_len,

          auth->k2);

  if (!msg)

    goto fail;

  wpabuf_free(auth->resp_msg);

  auth->resp_msg = msg;

  ret = 0;

fail:

  wpabuf_free(pr);

  return ret;

}

static int dpp_auth_build_resp_status(struct dpp_authentication *auth,

              enum dpp_status_error status)

{

  struct wpabuf *msg;

  const u8 *r_pubkey_hash, *i_pubkey_hash, *i_nonce;

#ifdef CONFIG_TESTING_OPTIONS

  u8 test_hash[SHA256_MAC_LEN];

#endif /* CONFIG_TESTING_OPTIONS */

  if (!auth->own_bi)

    return -1;

  wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response");

  r_pubkey_hash = auth->own_bi->pubkey_hash;

  if (auth->peer_bi)

    i_pubkey_hash = auth->peer_bi->pubkey_hash;

  else

    i_pubkey_hash = NULL;

  i_nonce = auth->i_nonce;

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash");

    r_pubkey_hash = NULL;

  } else if (dpp_test ==

       DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - invalid R-Bootstrap Key Hash");

    os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN);

    test_hash[SHA256_MAC_LEN - 1] ^= 0x01;

    r_pubkey_hash = test_hash;

  } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash");

    i_pubkey_hash = NULL;

  } else if (dpp_test ==

       DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - invalid I-Bootstrap Key Hash");

    if (i_pubkey_hash)

      os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN);

    else

      os_memset(test_hash, 0, SHA256_MAC_LEN);

    test_hash[SHA256_MAC_LEN - 1] ^= 0x01;

    i_pubkey_hash = test_hash;

  } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no Status");

    status = 255;

  } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) {

    wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce");

    i_nonce = NULL;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  msg = dpp_auth_build_resp(auth, status, NULL, auth->curve->nonce_len,

          r_pubkey_hash, i_pubkey_hash,

          NULL, i_nonce, NULL, 0, auth->k1);

  if (!msg)

    return -1;

  wpabuf_free(auth->resp_msg);

  auth->resp_msg = msg;

  return 0;

}

struct dpp_authentication *

dpp_auth_req_rx(struct dpp_global *dpp, void *msg_ctx, u8 dpp_allowed_roles,

    int qr_mutual, struct dpp_bootstrap_info *peer_bi,

    struct dpp_bootstrap_info *own_bi,

    unsigned int freq, const u8 *hdr, const u8 *attr_start,

    size_t attr_len)

{

  struct crypto_ec_key *pi = NULL;

  size_t secret_len;

  const u8 *addr[2];

  size_t len[2];

  u8 *unwrapped = NULL;

  size_t unwrapped_len = 0;

  const u8 *wrapped_data, *i_proto, *i_nonce, *i_capab, *i_bootstrap,

    *channel;

  u16 wrapped_data_len, i_proto_len, i_nonce_len, i_capab_len,

    i_bootstrap_len, channel_len;

  struct dpp_authentication *auth = NULL;

#ifdef CONFIG_DPP2

  const u8 *version;

  u16 version_len;

#endif /* CONFIG_DPP2 */

#ifdef CONFIG_TESTING_OPTIONS

  if (dpp_test == DPP_TEST_STOP_AT_AUTH_REQ) {

    wpa_printf(MSG_INFO,

         "DPP: TESTING - stop at Authentication Request");

    return NULL;

  }

#endif /* CONFIG_TESTING_OPTIONS */

  wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA,

            &wrapped_data_len);

  if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) {

    wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL

      "Missing or invalid required Wrapped Data attribute");

    return NULL;

  }

  wpa_hexdump(MSG_MSGDUMP, "DPP: Wrapped Data",

        wrapped_data, wrapped_data_len);

  attr_len = wrapped_data - 4 - attr_start;

  auth = dpp_alloc_auth(dpp, msg_ctx);

  if (!auth)

    goto fail;

  if (peer_bi && peer_bi->configurator_params &&

      dpp_set_configurator(auth, peer_bi->configurator_params) < 0)

    goto fail;

  auth->peer_bi = peer_bi;

  auth->own_bi = own_bi;

  auth->curve = own_bi->curve;

  auth->curr_freq = freq;

  auth->peer_version = 1; /* default to the first version */

#ifdef CONFIG_DPP2

  version = dpp_get_attr(attr_start, attr_len, DPP_ATTR_PROTOCOL_VERSION,

             &version_len);

  if (version && DPP_VERSION > 1) {

    if (version_len < 1 || version[0] == 0) {

      dpp_auth_fail(auth,

              "Invalid Protocol Version attribute");

      goto fail;

    }

    auth->peer_version = version[0];

    wpa_printf(MSG_DEBUG, "DPP: Peer protocol version %u",

         auth->peer_version);

  }

#endif /* CONFIG_DPP2 */

  channel = dpp_get_attr(attr_start, attr_len, DPP_ATTR_CHANNEL,

             &channel_len);

  if (channel) {

    int neg_freq;

    if (channel_len < 2) {

      dpp_auth_fail(auth, "Too short Channel attribute");

      goto fail;

    }

    neg_freq = ieee80211_chan_to_freq(NULL, channel[0], channel[1]);

    wpa_printf(MSG_DEBUG,

         "DPP: Initiator requested different channel for negotiation: op_class=%u channel=%u --> freq=%d",

         channel[0], channel[1], neg_freq);

    if (neg_freq < 0) {

      dpp_auth_fail(auth,

              "Unsupported Channel attribute value");

      goto fail;

    }

    if (auth->curr_freq != (unsigned int) neg_freq) {

      wpa_printf(MSG_DEBUG,

           "DPP: Changing negotiation channel from %u MHz to %u MHz",

           freq, neg_freq);

      auth->curr_freq = neg_freq;

    }

  }

  i_proto = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_PROTOCOL_KEY,

             &i_proto_len);

  if (!i_proto) {

    dpp_auth_fail(auth,

            "Missing required Initiator Protocol Key attribute");

    goto fail;

  }

  wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Protocol Key",

        i_proto, i_proto_len);

  /* M = bR * PI */

  pi = dpp_set_pubkey_point(own_bi->pubkey, i_proto, i_proto_len);

  if (!pi) {

    dpp_auth_fail(auth, "Invalid Initiator Protocol Key");

    goto fail;

  }

  dpp_debug_print_key("Peer (Initiator) Protocol Key", pi);

  if (dpp_ecdh(own_bi->pubkey, pi, auth->Mx, &secret_len) < 0)

    goto fail;

  auth->secret_len = secret_len;

  wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (M.x)",

      auth->Mx, auth->secret_len);

  auth->Mx_len = auth->secret_len;

  if (dpp_derive_k1(auth->Mx, auth->secret_len, auth->k1,

        auth->curve->hash_len) < 0)

    goto fail;

  addr[0] = hdr;

  len[0] = DPP_HDR_LEN;

  addr[1] = attr_start;

  len[1] = attr_len;

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]);

  wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]);

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext",

        wrapped_data, wrapped_data_len);

  unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE;

  unwrapped = os_malloc(unwrapped_len);

  if (!unwrapped)

    goto fail;

  if (aes_siv_decrypt(auth->k1, auth->curve->hash_len,

          wrapped_data, wrapped_data_len,

          2, addr, len, unwrapped) < 0) {

    dpp_auth_fail(auth, "AES-SIV decryption failed");

    goto fail;

  }

  wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext",

        unwrapped, unwrapped_len);

  if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) {

    dpp_auth_fail(auth, "Invalid attribute in unwrapped data");

    goto fail;

  }

  i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE,

             &i_nonce_len);

  if (!i_nonce || i_nonce_len != auth->curve->nonce_len) {

    dpp_auth_fail(auth, "Missing or invalid I-nonce");

    goto fail;

  }

  wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len);

  os_memcpy(auth->i_nonce, i_nonce, i_nonce_len);

  i_capab = dpp_get_attr(unwrapped, unwrapped_len,

             DPP_ATTR_I_CAPABILITIES,

             &i_capab_len);

  if (!i_capab || i_capab_len < 1) {

    dpp_auth_fail(auth, "Missing or invalid I-capabilities");

    goto fail;

  }

  auth->i_capab = i_capab[0];

  wpa_printf(MSG_DEBUG, "DPP: I-capabilities: 0x%02x", auth->i_capab);

  bin_clear_free(unwrapped, unwrapped_len);

  unwrapped = NULL;

  switch (auth->i_capab & DPP_CAPAB_ROLE_MASK) {

  case DPP_CAPAB_ENROLLEE:

    if (!(dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR)) {

      wpa_printf(MSG_DEBUG,

           "DPP: Local policy does not allow Configurator role");

      goto not_compatible;

    }

    wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator");

    auth->configurator = 1;

    break;

  case DPP_CAPAB_CONFIGURATOR:

    if (!(dpp_allowed_roles & DPP_CAPAB_ENROLLEE)) {

      wpa_printf(MSG_DEBUG,

           "DPP: Local policy does not allow Enrollee role");

      goto not_compatible;

    }

    wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee");

    auth->configurator = 0;

    break;

  case DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE:

    if (dpp_allowed_roles & DPP_CAPAB_ENROLLEE) {

      wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee");

      auth->configurator = 0;

    } else if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR) {

      wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator");

      auth->configurator = 1;

    } else {

      wpa_printf(MSG_DEBUG,

           "DPP: Local policy does not allow Configurator/Enrollee role");

      goto not_compatible;

    }

    break;

  default:

    wpa_printf(MSG_DEBUG, "DPP: Unexpected role in I-capabilities");

    wpa_msg(auth->msg_ctx, MSG_INFO,

      DPP_EVENT_FAIL "Invalid role in I-capabilities 0x%02x",

      auth->i_capab & DPP_CAPAB_ROLE_MASK);

    goto fail;

  }

  auth->peer_protocol_key = pi;

  pi = NULL;

  if (qr_mutual && !peer_bi && own_bi->type == DPP_BOOTSTRAP_QR_CODE) {

    char hex[SHA256_MAC_LEN * 2 + 1];

    wpa_printf(MSG_DEBUG,

         "DPP: Mutual authentication required with QR Codes, but peer info is not yet available - request more time");

    if (dpp_auth_build_resp_status(auth,

                 DPP_STATUS_RESPONSE_PENDING) < 0)

      goto fail;

    i_bootstrap = dpp_get_attr(attr_start, attr_len,

             DPP_ATTR_I_BOOTSTRAP_KEY_HASH,

             &i_bootstrap_len);

    if (i_bootstrap && i_bootstrap_len == SHA256_MAC_LEN) {

      auth->response_pending = 1;

      os_memcpy(auth->waiting_pubkey_hash,

          i_bootstrap, i_bootstrap_len);

      wpa_snprintf_hex(hex, sizeof(hex), i_bootstrap,

           i_bootstrap_len);

    } else {

      hex[0] = '\0';

    }

    wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_SCAN_PEER_QR_CODE

      "%s", hex);

    return auth;

  }

  if (dpp_auth_build_resp_ok(auth) < 0)

    goto fail;

  return auth;

not_compatible:

  wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_NOT_COMPATIBLE

    "i-capab=0x%02x", auth->i_capab);

  if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR)

    auth->configurator = 1;

  else

    auth->configurator = 0;

  auth->peer_protocol_key = pi;

  pi = NULL;

  if (dpp_auth_build_resp_status(auth, DPP_STATUS_NOT_COMPATIBLE) < 0)

    goto fail;

  auth->remove_on_tx_status = 1;

  return auth;