From 7efb64132db95ef787481026a22d5b8244627a04 Mon Sep 17 00:00:00 2001 From: Subv Date: Tue, 13 Jun 2017 16:30:17 -0500 Subject: [PATCH] UDS: Stub SendTo to generate the unencrypted data frame with the right headers. --- src/core/CMakeLists.txt | 2 + src/core/hle/service/nwm/nwm_uds.cpp | 68 +++++++++++++++- src/core/hle/service/nwm/uds_data.cpp | 112 ++++++++++++++++++++++++++ src/core/hle/service/nwm/uds_data.h | 80 ++++++++++++++++++ 4 files changed, 261 insertions(+), 1 deletion(-) create mode 100644 src/core/hle/service/nwm/uds_data.cpp create mode 100644 src/core/hle/service/nwm/uds_data.h diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt index b16a89990..ea09819e5 100644 --- a/src/core/CMakeLists.txt +++ b/src/core/CMakeLists.txt @@ -144,6 +144,7 @@ set(SRCS hle/service/nwm/nwm_tst.cpp hle/service/nwm/nwm_uds.cpp hle/service/nwm/uds_beacon.cpp + hle/service/nwm/uds_data.cpp hle/service/pm_app.cpp hle/service/ptm/ptm.cpp hle/service/ptm/ptm_gets.cpp @@ -341,6 +342,7 @@ set(HEADERS hle/service/nwm/nwm_tst.h hle/service/nwm/nwm_uds.h hle/service/nwm/uds_beacon.h + hle/service/nwm/uds_data.h hle/service/pm_app.h hle/service/ptm/ptm.h hle/service/ptm/ptm_gets.h diff --git a/src/core/hle/service/nwm/nwm_uds.cpp b/src/core/hle/service/nwm/nwm_uds.cpp index e92900d48..f6125825f 100644 --- a/src/core/hle/service/nwm/nwm_uds.cpp +++ b/src/core/hle/service/nwm/nwm_uds.cpp @@ -15,6 +15,7 @@ #include "core/hle/result.h" #include "core/hle/service/nwm/nwm_uds.h" #include "core/hle/service/nwm/uds_beacon.h" +#include "core/hle/service/nwm/uds_data.h" #include "core/memory.h" namespace Service { @@ -372,6 +373,71 @@ static void DestroyNetwork(Interface* self) { LOG_WARNING(Service_NWM, "called"); } +/** + * NWM_UDS::SendTo service function. + * Sends a data frame to the UDS network we're connected to. + * Inputs: + * 0 : Command header. + * 1 : Unknown. + * 2 : u16 Destination network node id. + * 3 : u8 Data channel. + * 4 : Buffer size >> 2 + * 5 : Data size + * 6 : Flags + * 7 : Input buffer descriptor + * 8 : Input buffer address + * Outputs: + * 0 : Return header + * 1 : Result of function, 0 on success, otherwise error code + */ +static void SendTo(Interface* self) { + IPC::RequestParser rp(Kernel::GetCommandBuffer(), 0x17, 6, 2); + + rp.Skip(1, false); + u16 dest_node_id = rp.Pop(); + u8 data_channel = rp.Pop(); + rp.Skip(1, false); + u32 data_size = rp.Pop(); + u32 flags = rp.Pop(); + + size_t desc_size; + const VAddr input_address = rp.PopStaticBuffer(&desc_size, false); + ASSERT(desc_size == data_size); + + // TODO(Subv): Figure out the error if this is called while not connected to a network. + if (connection_status.status == static_cast(NetworkStatus::ConnectedAsClient) || + connection_status.status == static_cast(NetworkStatus::ConnectedAsHost)) { + ASSERT_MSG(false, "Not connected to a network (unimplemented)"); + } + + // TODO(Subv): Do something with the flags. + + IPC::RequestBuilder rb = rp.MakeBuilder(1, 0); + + constexpr size_t MaxSize = 0x5C6; + if (data_size > MaxSize) { + rb.Push(ResultCode(ErrorDescription::TooLarge, ErrorModule::UDS, + ErrorSummary::WrongArgument, ErrorLevel::Usage)); + return; + } + + std::vector data(data_size); + Memory::ReadBlock(input_address, data.data(), data.size()); + + // TODO(Subv): Increment the sequence number after each sent packet. + u16 sequence_number = 0; + std::vector data_frame = GenerateDataFrame(data, data_channel, dest_node_id, + connection_status.network_node_id, + sequence_number); + + // TODO(Subv): Send the frame. + + rb.Push(RESULT_SUCCESS); + + LOG_WARNING(Service_NWM, "(STUB) called dest_node_id=%u size=%u flags=%u channel=%u", + static_cast(dest_node_id), data_size, flags, static_cast(data_channel)); +} + /** * NWM_UDS::GetChannel service function. * Returns the WiFi channel in which the network we're connected to is transmitting. @@ -564,7 +630,7 @@ const Interface::FunctionInfo FunctionTable[] = { {0x00130040, nullptr, "Unbind"}, {0x001400C0, nullptr, "PullPacket"}, {0x00150080, nullptr, "SetMaxSendDelay"}, - {0x00170182, nullptr, "SendTo"}, + {0x00170182, SendTo, "SendTo"}, {0x001A0000, GetChannel, "GetChannel"}, {0x001B0302, InitializeWithVersion, "InitializeWithVersion"}, {0x001D0044, BeginHostingNetwork, "BeginHostingNetwork"}, diff --git a/src/core/hle/service/nwm/uds_data.cpp b/src/core/hle/service/nwm/uds_data.cpp new file mode 100644 index 000000000..7e4aec624 --- /dev/null +++ b/src/core/hle/service/nwm/uds_data.cpp @@ -0,0 +1,112 @@ +// Copyright 2017 Citra Emulator Project +// Licensed under GPLv2 or any later version +// Refer to the license.txt file included. + +#include + +#include "core/hle/service/nwm/nwm_uds.h" +#include "core/hle/service/nwm/uds_data.h" +#include "core/hw/aes/key.h" + +#include +#include +#include + +namespace Service { +namespace NWM { + +// AES Keyslot used to generate the UDS data frame CCMP key. +constexpr size_t UDSDataCryptoAESKeySlot = 0x2D; + +/* + * Generates a SNAP-enabled 802.2 LLC header for the specified protocol. + * @returns a buffer with the bytes of the generated header. + */ +static std::vector GenerateLLCHeader(EtherType protocol) { + LLCHeader header{}; + header.protocol = static_cast(protocol); + + std::vector buffer(sizeof(header)); + memcpy(buffer.data(), &header, sizeof(header)); + + return buffer; +} + +/* + * Generates a Nintendo UDS SecureData header with the specified parameters. + * @returns a buffer with the bytes of the generated header. + */ +static std::vector GenerateSecureDataHeader(u16 data_size, u8 channel, u16 dest_node_id, + u16 src_node_id, u16 sequence_number) { + SecureDataHeader header{}; + header.protocol_size = data_size + sizeof(SecureDataHeader); + // TODO(Subv): It is likely that the first 4 bytes of this header are actually a decorator for another protocol. + header.securedata_size = data_size + sizeof(SecureDataHeader) - 4; + header.is_management = 0; // Frames sent by the emulated application are never UDS management frames + header.data_channel = channel; + header.sequence_number = sequence_number; + header.dest_node_id = dest_node_id; + header.src_node_id = src_node_id; + + std::vector buffer(sizeof(header)); + memcpy(buffer.data(), &header, sizeof(header)); + + return buffer; +} + +/* + * Calculates the CTR used for the AES-CTR process that calculates + * the CCMP crypto key for data frames. + * @returns The CTR used for data frames crypto key generation. + */ +static std::array GetDataCryptoCTR(const NetworkInfo& network_info) { + DataFrameCryptoCTR data{}; + + data.host_mac = network_info.host_mac_address; + data.wlan_comm_id = network_info.wlan_comm_id; + data.id = network_info.id; + data.network_id = network_info.network_id; + + std::array hash; + CryptoPP::MD5().CalculateDigest(hash.data(), reinterpret_cast(&data), sizeof(data)); + + return hash; +} + +/* + * Generates the key used for encrypting the 802.11 data frames generated by UDS. + * @returns The key used for data frames crypto. + */ +static std::array GenerateDataCCMPKey(const std::vector& passphrase, + const NetworkInfo& network_info) { + // Calculate the MD5 hash of the input passphrase. + std::array passphrase_hash; + CryptoPP::MD5().CalculateDigest(passphrase_hash.data(), passphrase.data(), passphrase.size()); + + std::array ccmp_key; + + // The CCMP key is the result of encrypting the MD5 hash of the passphrase with AES-CTR using keyslot 0x2D. + using CryptoPP::AES; + std::array counter = GetDataCryptoCTR(network_info); + std::array key = HW::AES::GetNormalKey(UDSDataCryptoAESKeySlot); + CryptoPP::CTR_Mode::Encryption aes; + aes.SetKeyWithIV(key.data(), AES::BLOCKSIZE, counter.data()); + aes.ProcessData(ccmp_key.data(), passphrase_hash.data(), passphrase_hash.size()); + + return ccmp_key; +} + +std::vector GenerateDataFrame(const std::vector& data, u8 channel, u16 dest_node, u16 src_node, u16 sequence_number) { + std::vector buffer = GenerateLLCHeader(EtherType::SecureData); + std::vector securedata_header = GenerateSecureDataHeader(data.size(), channel, dest_node, src_node, sequence_number); + + buffer.insert(buffer.end(), securedata_header.begin(), securedata_header.end()); + buffer.insert(buffer.end(), data.begin(), data.end()); + // TODO(Subv): Encrypt the frame. + // TODO(Subv): Prepend CCMP initialization vector (sequence_number). + // TODO(Subv): Encapsulate the frame in an 802.11 data frame. + return buffer; +} + +} // namespace NWM +} // namespace Service diff --git a/src/core/hle/service/nwm/uds_data.h b/src/core/hle/service/nwm/uds_data.h new file mode 100644 index 000000000..0dd46bcb1 --- /dev/null +++ b/src/core/hle/service/nwm/uds_data.h @@ -0,0 +1,80 @@ +// Copyright 2017 Citra Emulator Project +// Licensed under GPLv2 or any later version +// Refer to the license.txt file included. + +#pragma once + +#include "common/common_types.h" +#include "common/swap.h" +#include "core/hle/service/service.h" + +namespace Service { +namespace NWM { + +enum class SAP : u8 { + SNAPExtensionUsed = 0xAA +}; + +enum class PDUControl : u8 { + UnnumberedInformation = 3 +}; + +enum class EtherType : u16 { + SecureData = 0x876D, + EAPoL = 0x888E +}; + +/* + * 802.2 header, UDS packets always use SNAP for these headers, + * which means the dsap and ssap are always SNAPExtensionUsed (0xAA) + * and the OUI is always 0. + */ +struct LLCHeader { + u8 dsap = static_cast(SAP::SNAPExtensionUsed); + u8 ssap = static_cast(SAP::SNAPExtensionUsed); + u8 control = static_cast(PDUControl::UnnumberedInformation); + std::array OUI = {}; + u16_be protocol; +}; + +static_assert(sizeof(LLCHeader) == 8, "LLCHeader has the wrong size"); + +/* + * Nintendo SecureData header, every UDS packet contains one, + * it is used to store metadata about the transmission such as + * the source and destination network node ids. + */ +struct SecureDataHeader { + u16_be protocol_size; + INSERT_PADDING_BYTES(2); + u16_be securedata_size; + u8 is_management; + u8 data_channel; + u16_be sequence_number; + u16_be dest_node_id; + u16_be src_node_id; +}; + +static_assert(sizeof(SecureDataHeader) == 14, "SecureDataHeader has the wrong size"); + +/* + * The raw bytes of this structure are the CTR used in the encryption (AES-CTR) + * process used to generate the CCMP key for data frame encryption. + */ +struct DataFrameCryptoCTR { + u32_le wlan_comm_id; + u32_le network_id; + std::array host_mac; + u16_le id; +}; + +static_assert(sizeof(DataFrameCryptoCTR) == 16, "DataFrameCryptoCTR has the wrong size"); + +/** + * Generates an encrypted 802.11 data frame starting at the CCMP IV. + * @returns The generated frame. + */ +std::vector GenerateDataFrame(const std::vector& data, u8 channel, u16 dest_node, u16 src_node, u16 sequence_number); + +} // namespace NWM +} // namespace Service