DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

DPP: Mandate mutual auth with NFC negotiated connection handover

Browse source 
Mark own bootstrap information as having been used in NFC negotiated
connection handover and do not accept non-mutual authentication when
processing Authentication Response from the peer when such bootstrapping
information is used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-04-03 15:47:18 +03:00 committed by Jouni Malinen
parent 4b9a1ba0ad
commit 512b6c02e0
3 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/common/dpp.c
View file

@ -3952,6 +3952,14 @@ dpp_auth_resp_rx(struct dpp_authentication *auth, const u8 *hdr,
dpp_auth_fail(auth, dpp_auth_fail(auth,
"Missing Initiator Bootstrapping Key Hash attribute"); "Missing Initiator Bootstrapping Key Hash attribute");
return NULL; return NULL;
} else if (auth->own_bi &&
auth->own_bi->type == DPP_BOOTSTRAP_NFC_URI &&
auth->own_bi->nfc_negotiated) {
/* NFC negotiated connection handover bootstrapping mandates
* use of mutual authentication */
dpp_auth_fail(auth,
"Missing Initiator Bootstrapping Key Hash attribute");
return NULL;
} }
auth->peer_version = 1; /* default to the first version */ auth->peer_version = 1; /* default to the first version */

2
src/common/dpp.h
View file

@ -138,6 +138,8 @@ struct dpp_bootstrap_info {
const struct dpp_curve_params *curve; const struct dpp_curve_params *curve;
unsigned int pkex_t; /* number of failures before dpp_pkex unsigned int pkex_t; /* number of failures before dpp_pkex
* instantiation */ * instantiation */
int nfc_negotiated; /* whether this has been used in NFC negotiated
* connection handover */
char *configurator_params; char *configurator_params;
}; };

2
wpa_supplicant/dpp_supplicant.c
View file

@ -118,6 +118,7 @@ int wpas_dpp_nfc_handover_req(struct wpa_supplicant *wpa_s, const char *cmd)
own_bi = dpp_bootstrap_get_id(wpa_s->dpp, atoi(pos)); own_bi = dpp_bootstrap_get_id(wpa_s->dpp, atoi(pos));
if (!own_bi) if (!own_bi)
return -1; return -1;
own_bi->nfc_negotiated = 1;
pos = os_strstr(cmd, " uri="); pos = os_strstr(cmd, " uri=");
if (!pos) if (!pos)
@ -149,6 +150,7 @@ int wpas_dpp_nfc_handover_sel(struct wpa_supplicant *wpa_s, const char *cmd)
own_bi = dpp_bootstrap_get_id(wpa_s->dpp, atoi(pos)); own_bi = dpp_bootstrap_get_id(wpa_s->dpp, atoi(pos));
if (!own_bi) if (!own_bi)
return -1; return -1;
own_bi->nfc_negotiated = 1;
pos = os_strstr(cmd, " uri="); pos = os_strstr(cmd, " uri=");
if (!pos) if (!pos)