src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24
  25
  26 struct wps_uuid_pin {
  27         struct wps_uuid_pin *next;
  28         u8 uuid[WPS_UUID_LEN];
  29         u8 *pin;
  30         size_t pin_len;
  31         int locked;
  32 };
  33
  34
  35 static void wps_free_pin(struct wps_uuid_pin *pin)
  36 {
  37         os_free(pin->pin);
  38         os_free(pin);
  39 }
  40
  41
  42 static void wps_free_pins(struct wps_uuid_pin *pins)
  43 {
  44         struct wps_uuid_pin *pin, *prev;
  45
  46         pin = pins;
  47         while (pin) {
  48                 prev = pin;
  49                 pin = pin->next;
  50                 wps_free_pin(prev);
  51         }
  52 }
  53
  54
  55 struct wps_pbc_session {
  56         struct wps_pbc_session *next;
  57         u8 addr[ETH_ALEN];
  58         u8 uuid_e[WPS_UUID_LEN];
  59         struct os_time timestamp;
  60 };
  61
  62
  63 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  64 {
  65         struct wps_pbc_session *prev;
  66
  67         while (pbc) {
  68                 prev = pbc;
  69                 pbc = pbc->next;
  70                 os_free(prev);
  71         }
  72 }
  73
  74
  75 struct wps_registrar {
  76         struct wps_context *wps;
  77
  78         int pbc;
  79         int selected_registrar;
  80
  81         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  82                           size_t psk_len);
  83         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  84                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
  85         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
  86                               const struct wps_device_data *dev);
  87         void *cb_ctx;
  88
  89         struct wps_uuid_pin *pins;
  90         struct wps_pbc_session *pbc_sessions;
  91 };
  92
  93
  94 static int wps_set_ie(struct wps_registrar *reg);
  95 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
  96
  97
  98 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
  99                                           const u8 *addr, const u8 *uuid_e)
 100 {
 101         struct wps_pbc_session *pbc, *prev = NULL;
 102         struct os_time now;
 103
 104         os_get_time(&now);
 105
 106         pbc = reg->pbc_sessions;
 107         while (pbc) {
 108                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 109                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 110                         if (prev)
 111                                 prev->next = pbc->next;
 112                         else
 113                                 reg->pbc_sessions = pbc->next;
 114                         break;
 115                 }
 116                 prev = pbc;
 117                 pbc = pbc->next;
 118         }
 119
 120         if (!pbc) {
 121                 pbc = os_zalloc(sizeof(*pbc));
 122                 if (pbc == NULL)
 123                         return;
 124                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 125                 if (uuid_e)
 126                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 127         }
 128
 129         pbc->next = reg->pbc_sessions;
 130         reg->pbc_sessions = pbc;
 131         pbc->timestamp = now;
 132
 133         /* remove entries that have timed out */
 134         prev = pbc;
 135         pbc = pbc->next;
 136
 137         while (pbc) {
 138                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 139                         prev->next = NULL;
 140                         wps_free_pbc_sessions(pbc);
 141                         break;
 142                 }
 143                 prev = pbc;
 144                 pbc = pbc->next;
 145         }
 146 }
 147
 148
 149 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 150                                              const u8 *addr, const u8 *uuid_e)
 151 {
 152         struct wps_pbc_session *pbc, *prev = NULL;
 153
 154         pbc = reg->pbc_sessions;
 155         while (pbc) {
 156                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 157                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 158                         if (prev)
 159                                 prev->next = pbc->next;
 160                         else
 161                                 reg->pbc_sessions = pbc->next;
 162                         os_free(pbc);
 163                         break;
 164                 }
 165                 prev = pbc;
 166                 pbc = pbc->next;
 167         }
 168 }
 169
 170
 171 int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 172                               const u8 *addr, const u8 *uuid_e)
 173 {
 174         int count = 0;
 175         struct wps_pbc_session *pbc;
 176         struct os_time now;
 177
 178         os_get_time(&now);
 179
 180         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 181                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 182                         break;
 183                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 184                     uuid_e == NULL ||
 185                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 186                         count++;
 187         }
 188
 189         if (addr || uuid_e)
 190                 count++;
 191
 192         return count > 1 ? 1 : 0;
 193 }
 194
 195
 196 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 197 {
 198         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 199                    wps->wps_state);
 200         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 201         wpabuf_put_be16(msg, 1);
 202         wpabuf_put_u8(msg, wps->wps_state);
 203         return 0;
 204 }
 205
 206
 207 static int wps_build_ap_setup_locked(struct wps_context *wps,
 208                                      struct wpabuf *msg)
 209 {
 210         if (wps->ap_setup_locked) {
 211                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 212                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 213                 wpabuf_put_be16(msg, 1);
 214                 wpabuf_put_u8(msg, 1);
 215         }
 216         return 0;
 217 }
 218
 219
 220 static int wps_build_selected_registrar(struct wps_registrar *reg,
 221                                         struct wpabuf *msg)
 222 {
 223         if (!reg->selected_registrar)
 224                 return 0;
 225         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 226         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 227         wpabuf_put_be16(msg, 1);
 228         wpabuf_put_u8(msg, 1);
 229         return 0;
 230 }
 231
 232
 233 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 234                                              struct wpabuf *msg)
 235 {
 236         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 237         if (!reg->selected_registrar)
 238                 return 0;
 239         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 240         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 241         wpabuf_put_be16(msg, 2);
 242         wpabuf_put_be16(msg, id);
 243         return 0;
 244 }
 245
 246
 247 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 248                                             struct wpabuf *msg)
 249 {
 250         u16 methods;
 251         if (!reg->selected_registrar)
 252                 return 0;
 253         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 254         if (reg->pbc)
 255                 methods |= WPS_CONFIG_PUSHBUTTON;
 256         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 257                    methods);
 258         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 259         wpabuf_put_be16(msg, 2);
 260         wpabuf_put_be16(msg, methods);
 261         return 0;
 262 }
 263
 264
 265 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 266                                           struct wpabuf *msg)
 267 {
 268         u16 methods;
 269         methods = 0;
 270         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 271         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 272         wpabuf_put_be16(msg, 2);
 273         wpabuf_put_be16(msg, methods);
 274         return 0;
 275 }
 276
 277
 278 static int wps_build_config_methods(struct wps_registrar *reg,
 279                                     struct wpabuf *msg)
 280 {
 281         u16 methods;
 282         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 283         if (reg->pbc)
 284                 methods |= WPS_CONFIG_PUSHBUTTON;
 285         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 286         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 287         wpabuf_put_be16(msg, 2);
 288         wpabuf_put_be16(msg, methods);
 289         return 0;
 290 }
 291
 292
 293 static int wps_build_rf_bands(struct wps_registrar *reg, struct wpabuf *msg)
 294 {
 295         u8 bands = WPS_RF_24GHZ /* TODO: | WPS_RF_50GHZ */;
 296         wpa_printf(MSG_DEBUG, "WPS:  * RF Bands (%x)", bands);
 297         wpabuf_put_be16(msg, ATTR_RF_BANDS);
 298         wpabuf_put_be16(msg, 1);
 299         wpabuf_put_u8(msg, bands);
 300         return 0;
 301 }
 302
 303
 304 static int wps_build_uuid_e(struct wps_registrar *reg, struct wpabuf *msg)
 305 {
 306         wpa_printf(MSG_DEBUG, "WPS:  * UUID-E");
 307         wpabuf_put_be16(msg, ATTR_UUID_E);
 308         wpabuf_put_be16(msg, WPS_UUID_LEN);
 309         wpabuf_put_data(msg, reg->wps->uuid, WPS_UUID_LEN);
 310         return 0;
 311 }
 312
 313
 314 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 315 {
 316         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 317         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 318         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 319         wpabuf_put_be16(msg, 1);
 320         wpabuf_put_u8(msg, resp);
 321         return 0;
 322 }
 323
 324
 325 struct wps_registrar *
 326 wps_registrar_init(struct wps_context *wps,
 327                    const struct wps_registrar_config *cfg)
 328 {
 329         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 330         if (reg == NULL)
 331                 return NULL;
 332
 333         reg->wps = wps;
 334         reg->new_psk_cb = cfg->new_psk_cb;
 335         reg->set_ie_cb = cfg->set_ie_cb;
 336         reg->pin_needed_cb = cfg->pin_needed_cb;
 337         reg->cb_ctx = cfg->cb_ctx;
 338
 339         if (wps_set_ie(reg)) {
 340                 wps_registrar_deinit(reg);
 341                 return NULL;
 342         }
 343
 344         return reg;
 345 }
 346
 347
 348 void wps_registrar_deinit(struct wps_registrar *reg)
 349 {
 350         if (reg == NULL)
 351                 return;
 352         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 353         wps_free_pins(reg->pins);
 354         wps_free_pbc_sessions(reg->pbc_sessions);
 355         os_free(reg);
 356 }
 357
 358
 359 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 360                           const u8 *pin, size_t pin_len)
 361 {
 362         struct wps_uuid_pin *p;
 363
 364         p = os_zalloc(sizeof(*p));
 365         if (p == NULL)
 366                 return -1;
 367         os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 368         p->pin = os_malloc(pin_len);
 369         if (p->pin == NULL) {
 370                 os_free(p);
 371                 return -1;
 372         }
 373         os_memcpy(p->pin, pin, pin_len);
 374         p->pin_len = pin_len;
 375
 376         p->next = reg->pins;
 377         reg->pins = p;
 378
 379         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
 380         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 381         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 382         reg->selected_registrar = 1;
 383         reg->pbc = 0;
 384         wps_set_ie(reg);
 385
 386         return 0;
 387 }
 388
 389
 390 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 391 {
 392         struct wps_uuid_pin *pin, *prev;
 393
 394         prev = NULL;
 395         pin = reg->pins;
 396         while (pin) {
 397                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 398                         if (prev == NULL)
 399                                 reg->pins = pin->next;
 400                         else
 401                                 prev->next = pin->next;
 402                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 403                                     pin->uuid, WPS_UUID_LEN);
 404                         wps_free_pin(pin);
 405                         return 0;
 406                 }
 407                 prev = pin;
 408                 pin = pin->next;
 409         }
 410
 411         return -1;
 412 }
 413
 414
 415 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 416                                         const u8 *uuid, size_t *pin_len)
 417 {
 418         struct wps_uuid_pin *pin;
 419
 420         pin = reg->pins;
 421         while (pin) {
 422                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 423                         /*
 424                          * Lock the PIN to avoid attacks based on concurrent
 425                          * re-use of the PIN that could otherwise avoid PIN
 426                          * invalidations.
 427                          */
 428                         if (pin->locked) {
 429                                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN "
 430                                            "locked - do not allow concurrent "
 431                                            "re-use");
 432                                 return NULL;
 433                         }
 434                         *pin_len = pin->pin_len;
 435                         pin->locked = 1;
 436                         return pin->pin;
 437                 }
 438                 pin = pin->next;
 439         }
 440
 441         return NULL;
 442 }
 443
 444
 445 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 446 {
 447         struct wps_uuid_pin *pin;
 448
 449         pin = reg->pins;
 450         while (pin) {
 451                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 452                         pin->locked = 0;
 453                         return 0;
 454                 }
 455                 pin = pin->next;
 456         }
 457
 458         return -1;
 459 }
 460
 461
 462 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 463 {
 464         struct wps_registrar *reg = eloop_ctx;
 465
 466         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 467         reg->selected_registrar = 0;
 468         reg->pbc = 0;
 469         wps_set_ie(reg);
 470 }
 471
 472
 473 int wps_registrar_button_pushed(struct wps_registrar *reg)
 474 {
 475         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 476                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 477                            "mode");
 478                 return -1;
 479         }
 480         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 481         reg->selected_registrar = 1;
 482         reg->pbc = 1;
 483         wps_set_ie(reg);
 484
 485         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 486         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 487                                reg, NULL);
 488         return 0;
 489 }
 490
 491
 492 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 493 {
 494         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 495         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 496         reg->selected_registrar = 0;
 497         reg->pbc = 0;
 498         wps_set_ie(reg);
 499 }
 500
 501
 502 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 503                                 const struct wpabuf *wps_data)
 504 {
 505         struct wps_parse_attr attr;
 506         u16 methods;
 507
 508         wpa_hexdump_buf(MSG_MSGDUMP,
 509                         "WPS: Probe Request with WPS data received",
 510                         wps_data);
 511
 512         if (wps_parse_msg(wps_data, &attr) < 0 ||
 513             attr.version == NULL || *attr.version != WPS_VERSION) {
 514                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 515                            "version 0x%x", attr.version ? *attr.version : 0);
 516                 return;
 517         }
 518
 519         if (attr.config_methods == NULL) {
 520                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 521                            "Probe Request");
 522                 return;
 523         }
 524
 525         methods = WPA_GET_BE16(attr.config_methods);
 526         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 527                 return; /* Not PBC */
 528
 529         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 530                    MACSTR, MAC2STR(addr));
 531
 532         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 533 }
 534
 535
 536 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 537                           const u8 *psk, size_t psk_len)
 538 {
 539         if (reg->new_psk_cb == NULL)
 540                 return 0;
 541
 542         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 543 }
 544
 545
 546 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 547                               const struct wps_device_data *dev)
 548 {
 549         if (reg->pin_needed_cb == NULL)
 550                 return;
 551
 552         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 553 }
 554
 555
 556 static int wps_cb_set_ie(struct wps_registrar *reg,
 557                          const struct wpabuf *beacon_ie,
 558                          const struct wpabuf *probe_resp_ie)
 559 {
 560         if (reg->set_ie_cb == NULL)
 561                 return 0;
 562
 563         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 564                               wpabuf_len(beacon_ie),
 565                               wpabuf_head(probe_resp_ie),
 566                               wpabuf_len(probe_resp_ie));
 567 }
 568
 569
 570 static int wps_set_ie(struct wps_registrar *reg)
 571 {
 572         struct wpabuf *beacon;
 573         struct wpabuf *probe;
 574         int ret;
 575         u8 *blen, *plen;
 576
 577         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 578
 579         beacon = wpabuf_alloc(300);
 580         if (beacon == NULL)
 581                 return -1;
 582         probe = wpabuf_alloc(300);
 583         if (probe == NULL) {
 584                 wpabuf_free(beacon);
 585                 return -1;
 586         }
 587
 588         wpabuf_put_u8(beacon, WLAN_EID_VENDOR_SPECIFIC);
 589         blen = wpabuf_put(beacon, 1);
 590         wpabuf_put_be32(beacon, WPS_DEV_OUI_WFA);
 591
 592         wpabuf_put_u8(probe, WLAN_EID_VENDOR_SPECIFIC);
 593         plen = wpabuf_put(probe, 1);
 594         wpabuf_put_be32(probe, WPS_DEV_OUI_WFA);
 595
 596         if (wps_build_version(beacon) ||
 597             wps_build_wps_state(reg->wps, beacon) ||
 598             wps_build_ap_setup_locked(reg->wps, beacon) ||
 599             wps_build_selected_registrar(reg, beacon) ||
 600             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 601             wps_build_sel_reg_config_methods(reg, beacon) ||
 602             wps_build_version(probe) ||
 603             wps_build_wps_state(reg->wps, probe) ||
 604             wps_build_ap_setup_locked(reg->wps, probe) ||
 605             wps_build_selected_registrar(reg, probe) ||
 606             wps_build_sel_reg_dev_password_id(reg, probe) ||
 607             wps_build_sel_reg_config_methods(reg, probe) ||
 608             wps_build_resp_type(reg, probe) ||
 609             wps_build_uuid_e(reg, probe) ||
 610             wps_build_device_attrs(&reg->wps->dev, probe) ||
 611             wps_build_probe_config_methods(reg, probe) ||
 612             wps_build_rf_bands(reg, probe)) {
 613                 wpabuf_free(beacon);
 614                 wpabuf_free(probe);
 615                 return -1;
 616         }
 617
 618         *blen = wpabuf_len(beacon) - 2;
 619         *plen = wpabuf_len(probe) - 2;
 620
 621         ret = wps_cb_set_ie(reg, beacon, probe);
 622         wpabuf_free(beacon);
 623         wpabuf_free(probe);
 624
 625         return ret;
 626 }
 627
 628
 629 static int wps_get_dev_password(struct wps_data *wps)
 630 {
 631         const u8 *pin;
 632         size_t pin_len;
 633
 634         os_free(wps->dev_password);
 635         wps->dev_password = NULL;
 636
 637         if (wps->pbc) {
 638                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 639                 pin = (const u8 *) "00000000";
 640                 pin_len = 8;
 641         } else {
 642                 pin = wps_registrar_get_pin(wps->registrar, wps->uuid_e,
 643                                             &pin_len);
 644         }
 645         if (pin == NULL) {
 646                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 647                            "the Enrollee");
 648                 wps_cb_pin_needed(wps->registrar, wps->uuid_e, &wps->peer_dev);
 649                 return -1;
 650         }
 651
 652         wps->dev_password = os_malloc(pin_len);
 653         if (wps->dev_password == NULL)
 654                 return -1;
 655         os_memcpy(wps->dev_password, pin, pin_len);
 656         wps->dev_password_len = pin_len;
 657
 658         return 0;
 659 }
 660
 661
 662 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
 663 {
 664         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
 665         wpabuf_put_be16(msg, ATTR_UUID_R);
 666         wpabuf_put_be16(msg, WPS_UUID_LEN);
 667         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
 668         return 0;
 669 }
 670
 671
 672 static int wps_build_dev_password_id(struct wps_data *wps, struct wpabuf *msg)
 673 {
 674         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID");
 675         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 676         wpabuf_put_be16(msg, 2);
 677         wpabuf_put_be16(msg, DEV_PW_DEFAULT);
 678         return 0;
 679 }
 680
 681
 682 static int wps_build_config_error(struct wps_data *wps, struct wpabuf *msg)
 683 {
 684         wpa_printf(MSG_DEBUG, "WPS:  * Configuration Error");
 685         wpabuf_put_be16(msg, ATTR_CONFIG_ERROR);
 686         wpabuf_put_be16(msg, 2);
 687         wpabuf_put_be16(msg, WPS_CFG_NO_ERROR);
 688         return 0;
 689 }
 690
 691
 692 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
 693 {
 694         u8 *hash;
 695         const u8 *addr[4];
 696         size_t len[4];
 697
 698         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
 699                 return -1;
 700         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
 701         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
 702                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
 703
 704         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
 705                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
 706                            "R-Hash derivation");
 707                 return -1;
 708         }
 709
 710         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
 711         wpabuf_put_be16(msg, ATTR_R_HASH1);
 712         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 713         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 714         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
 715         addr[0] = wps->snonce;
 716         len[0] = WPS_SECRET_NONCE_LEN;
 717         addr[1] = wps->psk1;
 718         len[1] = WPS_PSK_LEN;
 719         addr[2] = wpabuf_head(wps->dh_pubkey_e);
 720         len[2] = wpabuf_len(wps->dh_pubkey_e);
 721         addr[3] = wpabuf_head(wps->dh_pubkey_r);
 722         len[3] = wpabuf_len(wps->dh_pubkey_r);
 723         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 724         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
 725
 726         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
 727         wpabuf_put_be16(msg, ATTR_R_HASH2);
 728         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 729         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 730         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
 731         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
 732         addr[1] = wps->psk2;
 733         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 734         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
 735
 736         return 0;
 737 }
 738
 739
 740 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
 741 {
 742         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
 743         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
 744         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 745         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
 746         return 0;
 747 }
 748
 749
 750 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 751 {
 752         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
 753         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
 754         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 755         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
 756                         WPS_SECRET_NONCE_LEN);
 757         return 0;
 758 }
 759
 760
 761 static int wps_build_cred_network_idx(struct wps_data *wps, struct wpabuf *msg)
 762 {
 763         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
 764         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
 765         wpabuf_put_be16(msg, 1);
 766         wpabuf_put_u8(msg, 0);
 767         return 0;
 768 }
 769
 770
 771 static int wps_build_cred_ssid(struct wps_data *wps, struct wpabuf *msg)
 772 {
 773         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
 774         wpabuf_put_be16(msg, ATTR_SSID);
 775         wpabuf_put_be16(msg, wps->wps->ssid_len);
 776         wpabuf_put_data(msg, wps->wps->ssid, wps->wps->ssid_len);
 777         return 0;
 778 }
 779
 780
 781 static int wps_build_cred_auth_type(struct wps_data *wps, struct wpabuf *msg)
 782 {
 783         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
 784                    wps->auth_type);
 785         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
 786         wpabuf_put_be16(msg, 2);
 787         wpabuf_put_be16(msg, wps->auth_type);
 788         return 0;
 789 }
 790
 791
 792 static int wps_build_cred_encr_type(struct wps_data *wps, struct wpabuf *msg)
 793 {
 794         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
 795                    wps->encr_type);
 796         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
 797         wpabuf_put_be16(msg, 2);
 798         wpabuf_put_be16(msg, wps->encr_type);
 799         return 0;
 800 }
 801
 802
 803 static int wps_build_cred_network_key(struct wps_data *wps, struct wpabuf *msg)
 804 {
 805         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
 806         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
 807         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap) {
 808                 u8 r[16];
 809                 /* Generate a random passphrase */
 810                 if (os_get_random(r, sizeof(r)) < 0)
 811                         return -1;
 812                 os_free(wps->new_psk);
 813                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
 814                 if (wps->new_psk == NULL)
 815                         return -1;
 816                 wps->new_psk_len--; /* remove newline */
 817                 while (wps->new_psk_len &&
 818                        wps->new_psk[wps->new_psk_len - 1] == '=')
 819                         wps->new_psk_len--;
 820                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
 821                                       wps->new_psk, wps->new_psk_len);
 822                 wpabuf_put_be16(msg, wps->new_psk_len);
 823                 wpabuf_put_data(msg, wps->new_psk, wps->new_psk_len);
 824         } else if (wps->wps->network_key) {
 825                 wpabuf_put_be16(msg, wps->wps->network_key_len);
 826                 wpabuf_put_data(msg, wps->wps->network_key,
 827                                 wps->wps->network_key_len);
 828         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 829                 char hex[65];
 830                 /* Generate a random per-device PSK */
 831                 os_free(wps->new_psk);
 832                 wps->new_psk_len = 32;
 833                 wps->new_psk = os_malloc(wps->new_psk_len);
 834                 if (wps->new_psk == NULL)
 835                         return -1;
 836                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
 837                         os_free(wps->new_psk);
 838                         wps->new_psk = NULL;
 839                         return -1;
 840                 }
 841                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
 842                                 wps->new_psk, wps->new_psk_len);
 843                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
 844                                  wps->new_psk_len);
 845                 wpabuf_put_be16(msg, wps->new_psk_len * 2);
 846                 wpabuf_put_data(msg, hex, wps->new_psk_len * 2);
 847         } else {
 848                 /* No Network Key */
 849                 wpabuf_put_be16(msg, 0);
 850         }
 851         return 0;
 852 }
 853
 854
 855 static int wps_build_cred_mac_addr(struct wps_data *wps, struct wpabuf *msg)
 856 {
 857         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address");
 858         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
 859         wpabuf_put_be16(msg, ETH_ALEN);
 860         wpabuf_put_data(msg, wps->mac_addr_e, ETH_ALEN);
 861         return 0;
 862 }
 863
 864
 865 static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 866 {
 867         struct wpabuf *cred;
 868         int ap_settings;
 869
 870         ap_settings = !wps->wps->ap;
 871
 872         if (ap_settings)
 873                 wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
 874         else
 875                 wpa_printf(MSG_DEBUG, "WPS:  * Credential");
 876
 877         /* Select the best authentication and encryption type */
 878         if (wps->auth_type & WPS_AUTH_WPA2PSK)
 879                 wps->auth_type = WPS_AUTH_WPA2PSK;
 880         else if (wps->auth_type & WPS_AUTH_WPAPSK)
 881                 wps->auth_type = WPS_AUTH_WPAPSK;
 882         else if (wps->auth_type & WPS_AUTH_OPEN)
 883                 wps->auth_type = WPS_AUTH_OPEN;
 884         else if (wps->auth_type & WPS_AUTH_SHARED)
 885                 wps->auth_type = WPS_AUTH_SHARED;
 886         else {
 887                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
 888                            wps->auth_type);
 889                 return -1;
 890         }
 891
 892         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
 893             wps->auth_type == WPS_AUTH_WPAPSK) {
 894                 if (wps->encr_type & WPS_ENCR_AES)
 895                         wps->encr_type = WPS_ENCR_AES;
 896                 else if (wps->encr_type & WPS_ENCR_TKIP)
 897                         wps->encr_type = WPS_ENCR_TKIP;
 898                 else {
 899                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 900                                    "type for WPA/WPA2");
 901                         return -1;
 902                 }
 903         } else {
 904                 if (wps->encr_type & WPS_ENCR_WEP)
 905                         wps->encr_type = WPS_ENCR_WEP;
 906                 else if (wps->encr_type & WPS_ENCR_NONE)
 907                         wps->encr_type = WPS_ENCR_NONE;
 908                 else {
 909                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 910                                    "type for non-WPA/WPA2 mode");
 911                         return -1;
 912                 }
 913         }
 914
 915         cred = wpabuf_alloc(200);
 916         if (cred == NULL)
 917                 return -1;
 918
 919         if (wps_build_cred_network_idx(wps, cred) ||
 920             wps_build_cred_ssid(wps, cred) ||
 921             wps_build_cred_auth_type(wps, cred) ||
 922             wps_build_cred_encr_type(wps, cred) ||
 923             wps_build_cred_network_key(wps, cred) ||
 924             wps_build_cred_mac_addr(wps, cred)) {
 925                 wpabuf_free(cred);
 926                 return -1;
 927         }
 928
 929         if (ap_settings) {
 930                 wpabuf_put_buf(msg, cred);
 931                 wpabuf_free(cred);
 932         } else {
 933                 wpabuf_put_be16(msg, ATTR_CRED);
 934                 wpabuf_put_be16(msg, wpabuf_len(cred));
 935                 wpabuf_put_buf(msg, cred);
 936                 wpabuf_free(cred);
 937         }
 938
 939         return 0;
 940 }
 941
 942
 943 static struct wpabuf * wps_build_m2(struct wps_data *wps)
 944 {
 945         struct wpabuf *msg;
 946
 947         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
 948                 return NULL;
 949         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
 950                     wps->nonce_r, WPS_NONCE_LEN);
 951         os_memcpy(wps->uuid_r, wps->wps->uuid, WPS_UUID_LEN);
 952         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
 953
 954         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
 955         msg = wpabuf_alloc(1000);
 956         if (msg == NULL)
 957                 return NULL;
 958
 959         if (wps_build_version(msg) ||
 960             wps_build_msg_type(msg, WPS_M2) ||
 961             wps_build_enrollee_nonce(wps, msg) ||
 962             wps_build_registrar_nonce(wps, msg) ||
 963             wps_build_uuid_r(wps, msg) ||
 964             wps_build_public_key(wps, msg) ||
 965             wps_derive_keys(wps) ||
 966             wps_build_auth_type_flags(wps, msg) ||
 967             wps_build_encr_type_flags(wps, msg) ||
 968             wps_build_conn_type_flags(wps, msg) ||
 969             wps_build_config_methods(wps->registrar, msg) ||
 970             wps_build_device_attrs(&wps->wps->dev, msg) ||
 971             wps_build_rf_bands(wps->registrar, msg) ||
 972             wps_build_assoc_state(wps, msg) ||
 973             wps_build_config_error(wps, msg) ||
 974             wps_build_dev_password_id(wps, msg) ||
 975             wps_build_os_version(&wps->wps->dev, msg) ||
 976             wps_build_authenticator(wps, msg)) {
 977                 wpabuf_free(msg);
 978                 return NULL;
 979         }
 980
 981         wps->state = RECV_M3;
 982         return msg;
 983 }
 984
 985
 986 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
 987 {
 988         struct wpabuf *msg;
 989
 990         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
 991         msg = wpabuf_alloc(1000);
 992         if (msg == NULL)
 993                 return NULL;
 994
 995         if (wps_build_version(msg) ||
 996             wps_build_msg_type(msg, WPS_M2D) ||
 997             wps_build_enrollee_nonce(wps, msg) ||
 998             wps_build_registrar_nonce(wps, msg) ||
 999             wps_build_uuid_r(wps, msg) ||
1000             wps_build_auth_type_flags(wps, msg) ||
1001             wps_build_encr_type_flags(wps, msg) ||
1002             wps_build_conn_type_flags(wps, msg) ||
1003             wps_build_config_methods(wps->registrar, msg) ||
1004             wps_build_device_attrs(&wps->wps->dev, msg) ||
1005             wps_build_rf_bands(wps->registrar, msg) ||
1006             wps_build_assoc_state(wps, msg) ||
1007             wps_build_config_error(wps, msg) ||
1008             wps_build_os_version(&wps->wps->dev, msg)) {
1009                 wpabuf_free(msg);
1010                 return NULL;
1011         }
1012
1013         wps->state = RECV_M2D_ACK;
1014         return msg;
1015 }
1016
1017
1018 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1019 {
1020         struct wpabuf *msg, *plain;
1021
1022         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1023
1024         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1025
1026         plain = wpabuf_alloc(200);
1027         if (plain == NULL)
1028                 return NULL;
1029
1030         msg = wpabuf_alloc(1000);
1031         if (msg == NULL) {
1032                 wpabuf_free(plain);
1033                 return NULL;
1034         }
1035
1036         if (wps_build_version(msg) ||
1037             wps_build_msg_type(msg, WPS_M4) ||
1038             wps_build_enrollee_nonce(wps, msg) ||
1039             wps_build_r_hash(wps, msg) ||
1040             wps_build_r_snonce1(wps, plain) ||
1041             wps_build_key_wrap_auth(wps, plain) ||
1042             wps_build_encr_settings(wps, msg, plain) ||
1043             wps_build_authenticator(wps, msg)) {
1044                 wpabuf_free(plain);
1045                 wpabuf_free(msg);
1046                 return NULL;
1047         }
1048         wpabuf_free(plain);
1049
1050         wps->state = RECV_M5;
1051         return msg;
1052 }
1053
1054
1055 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1056 {
1057         struct wpabuf *msg, *plain;
1058
1059         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1060
1061         plain = wpabuf_alloc(200);
1062         if (plain == NULL)
1063                 return NULL;
1064
1065         msg = wpabuf_alloc(1000);
1066         if (msg == NULL) {
1067                 wpabuf_free(plain);
1068                 return NULL;
1069         }
1070
1071         if (wps_build_version(msg) ||
1072             wps_build_msg_type(msg, WPS_M6) ||
1073             wps_build_enrollee_nonce(wps, msg) ||
1074             wps_build_r_snonce2(wps, plain) ||
1075             wps_build_key_wrap_auth(wps, plain) ||
1076             wps_build_encr_settings(wps, msg, plain) ||
1077             wps_build_authenticator(wps, msg)) {
1078                 wpabuf_free(plain);
1079                 wpabuf_free(msg);
1080                 return NULL;
1081         }
1082         wpabuf_free(plain);
1083
1084         wps->wps_pin_revealed = 1;
1085         wps->state = RECV_M7;
1086         return msg;
1087 }
1088
1089
1090 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1091 {
1092         struct wpabuf *msg, *plain;
1093
1094         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1095
1096         plain = wpabuf_alloc(500);
1097         if (plain == NULL)
1098                 return NULL;
1099
1100         msg = wpabuf_alloc(1000);
1101         if (msg == NULL) {
1102                 wpabuf_free(plain);
1103                 return NULL;
1104         }
1105
1106         if (wps_build_version(msg) ||
1107             wps_build_msg_type(msg, WPS_M8) ||
1108             wps_build_enrollee_nonce(wps, msg) ||
1109             wps_build_cred(wps, plain) ||
1110             wps_build_key_wrap_auth(wps, plain) ||
1111             wps_build_encr_settings(wps, msg, plain) ||
1112             wps_build_authenticator(wps, msg)) {
1113                 wpabuf_free(plain);
1114                 wpabuf_free(msg);
1115                 return NULL;
1116         }
1117         wpabuf_free(plain);
1118
1119         wps->state = RECV_DONE;
1120         return msg;
1121 }
1122
1123
1124 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1125 {
1126         struct wpabuf *msg;
1127
1128         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1129
1130         msg = wpabuf_alloc(1000);
1131         if (msg == NULL)
1132                 return NULL;
1133
1134         if (wps_build_version(msg) ||
1135             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1136             wps_build_enrollee_nonce(wps, msg) ||
1137             wps_build_registrar_nonce(wps, msg)) {
1138                 wpabuf_free(msg);
1139                 return NULL;
1140         }
1141
1142         return msg;
1143 }
1144
1145
1146 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps, u8 *op_code)
1147 {
1148         struct wpabuf *msg;
1149
1150         switch (wps->state) {
1151         case SEND_M2:
1152                 if (wps_get_dev_password(wps) < 0)
1153                         msg = wps_build_m2d(wps);
1154                 else
1155                         msg = wps_build_m2(wps);
1156                 *op_code = WSC_MSG;
1157                 break;
1158         case SEND_M2D:
1159                 msg = wps_build_m2d(wps);
1160                 *op_code = WSC_MSG;
1161                 break;
1162         case SEND_M4:
1163                 msg = wps_build_m4(wps);
1164                 *op_code = WSC_MSG;
1165                 break;
1166         case SEND_M6:
1167                 msg = wps_build_m6(wps);
1168                 *op_code = WSC_MSG;
1169                 break;
1170         case SEND_M8:
1171                 msg = wps_build_m8(wps);
1172                 *op_code = WSC_MSG;
1173                 break;
1174         case RECV_DONE:
1175                 msg = wps_build_wsc_ack(wps);
1176                 *op_code = WSC_ACK;
1177                 break;
1178         default:
1179                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1180                            "a message", wps->state);
1181                 msg = NULL;
1182                 break;
1183         }
1184
1185         if (*op_code == WSC_MSG && msg) {
1186                 /* Save a copy of the last message for Authenticator derivation
1187                  */
1188                 wpabuf_free(wps->last_msg);
1189                 wps->last_msg = wpabuf_dup(msg);
1190         }
1191
1192         return msg;
1193 }
1194
1195
1196 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1197 {
1198         if (e_nonce == NULL) {
1199                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1200                 return -1;
1201         }
1202
1203         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1204         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1205                     wps->nonce_e, WPS_NONCE_LEN);
1206
1207         return 0;
1208 }
1209
1210
1211 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1212 {
1213         if (r_nonce == NULL) {
1214                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1215                 return -1;
1216         }
1217
1218         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1219                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1220                 return -1;
1221         }
1222
1223         return 0;
1224 }
1225
1226
1227 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1228 {
1229         if (uuid_e == NULL) {
1230                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1231                 return -1;
1232         }
1233
1234         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1235         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1236
1237         return 0;
1238 }
1239
1240
1241 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1242 {
1243         if (pw_id == NULL) {
1244                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1245                 return -1;
1246         }
1247
1248         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1249         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1250
1251         return 0;
1252 }
1253
1254
1255 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1256 {
1257         if (e_hash1 == NULL) {
1258                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1259                 return -1;
1260         }
1261
1262         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1263         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1264
1265         return 0;
1266 }
1267
1268
1269 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1270 {
1271         if (e_hash2 == NULL) {
1272                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1273                 return -1;
1274         }
1275
1276         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1277         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1278
1279         return 0;
1280 }
1281
1282
1283 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1284 {
1285         u8 hash[SHA256_MAC_LEN];
1286         const u8 *addr[4];
1287         size_t len[4];
1288
1289         if (e_snonce1 == NULL) {
1290                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1291                 return -1;
1292         }
1293
1294         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1295                         WPS_SECRET_NONCE_LEN);
1296
1297         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1298         addr[0] = e_snonce1;
1299         len[0] = WPS_SECRET_NONCE_LEN;
1300         addr[1] = wps->psk1;
1301         len[1] = WPS_PSK_LEN;
1302         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1303         len[2] = wpabuf_len(wps->dh_pubkey_e);
1304         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1305         len[3] = wpabuf_len(wps->dh_pubkey_r);
1306         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1307
1308         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1309                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1310                            "not match with the pre-committed value");
1311                 return -1;
1312         }
1313
1314         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1315                    "half of the device password");
1316
1317         return 0;
1318 }
1319
1320
1321 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1322 {
1323         u8 hash[SHA256_MAC_LEN];
1324         const u8 *addr[4];
1325         size_t len[4];
1326
1327         if (e_snonce2 == NULL) {
1328                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1329                 return -1;
1330         }
1331
1332         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1333                         WPS_SECRET_NONCE_LEN);
1334
1335         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1336         addr[0] = e_snonce2;
1337         len[0] = WPS_SECRET_NONCE_LEN;
1338         addr[1] = wps->psk2;
1339         len[1] = WPS_PSK_LEN;
1340         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1341         len[2] = wpabuf_len(wps->dh_pubkey_e);
1342         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1343         len[3] = wpabuf_len(wps->dh_pubkey_r);
1344         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1345
1346         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1347                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1348                            "not match with the pre-committed value");
1349                 wps_registrar_invalidate_pin(wps->registrar, wps->uuid_e);
1350                 return -1;
1351         }
1352
1353         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1354                    "half of the device password");
1355         wps->wps_pin_revealed = 0;
1356         wps_registrar_unlock_pin(wps->registrar, wps->uuid_e);
1357
1358         return 0;
1359 }
1360
1361
1362 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1363 {
1364         if (mac_addr == NULL) {
1365                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1366                 return -1;
1367         }
1368
1369         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1370                    MAC2STR(mac_addr));
1371         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1372         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1373
1374         return 0;
1375 }
1376
1377
1378 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1379                               size_t pk_len)
1380 {
1381         if (pk == NULL || pk_len == 0) {
1382                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1383                 return -1;
1384         }
1385
1386         wpabuf_free(wps->dh_pubkey_e);
1387         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1388         if (wps->dh_pubkey_e == NULL)
1389                 return -1;
1390
1391         return 0;
1392 }
1393
1394
1395 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1396 {
1397         u16 auth_types;
1398
1399         if (auth == NULL) {
1400                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1401                            "received");
1402                 return -1;
1403         }
1404
1405         auth_types = WPA_GET_BE16(auth);
1406
1407         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1408                    auth_types);
1409         wps->auth_type = wps->wps->auth_types & auth_types;
1410         if (wps->auth_type == 0) {
1411                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1412                            "authentication types");
1413                 return -1;
1414         }
1415
1416         return 0;
1417 }
1418
1419
1420 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1421 {
1422         u16 encr_types;
1423
1424         if (encr == NULL) {
1425                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1426                            "received");
1427                 return -1;
1428         }
1429
1430         encr_types = WPA_GET_BE16(encr);
1431
1432         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1433                    encr_types);
1434         wps->encr_type = wps->wps->encr_types & encr_types;
1435         if (wps->encr_type == 0) {
1436                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1437                            "encryption types");
1438                 return -1;
1439         }
1440
1441         return 0;
1442 }
1443
1444
1445 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1446 {
1447         if (conn == NULL) {
1448                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1449                            "received");
1450                 return -1;
1451         }
1452
1453         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1454                    *conn);
1455
1456         return 0;
1457 }
1458
1459
1460 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1461 {
1462         u16 m;
1463
1464         if (methods == NULL) {
1465                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1466                 return -1;
1467         }
1468
1469         m = WPA_GET_BE16(methods);
1470
1471         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1472
1473         return 0;
1474 }
1475
1476
1477 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1478 {
1479         if (state == NULL) {
1480                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1481                            "received");
1482                 return -1;
1483         }
1484
1485         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1486                    *state);
1487
1488         return 0;
1489 }
1490
1491
1492 static int wps_process_rf_bands(struct wps_data *wps, const u8 *bands)
1493 {
1494         if (bands == NULL) {
1495                 wpa_printf(MSG_DEBUG, "WPS: No RF Bands received");
1496                 return -1;
1497         }
1498
1499         wpa_printf(MSG_DEBUG, "WPS: Enrollee RF Bands 0x%x", *bands);
1500
1501         return 0;
1502 }
1503
1504
1505 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1506 {
1507         u16 a;
1508
1509         if (assoc == NULL) {
1510                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1511                 return -1;
1512         }
1513
1514         a = WPA_GET_BE16(assoc);
1515         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
1516
1517         return 0;
1518 }
1519
1520
1521 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
1522 {
1523         u16 e;
1524
1525         if (err == NULL) {
1526                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
1527                 return -1;
1528         }
1529
1530         e = WPA_GET_BE16(err);
1531         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
1532
1533         return 0;
1534 }
1535
1536
1537 static enum wps_process_res wps_process_m1(struct wps_data *wps,
1538                                            struct wps_parse_attr *attr)
1539 {
1540         wpa_printf(MSG_DEBUG, "WPS: Received M1");
1541
1542         if (wps->state != RECV_M1) {
1543                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1544                            "receiving M1", wps->state);
1545                 return WPS_FAILURE;
1546         }
1547
1548         if (wps_process_uuid_e(wps, attr->uuid_e) ||
1549             wps_process_mac_addr(wps, attr->mac_addr) ||
1550             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
1551             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
1552             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
1553             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
1554             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
1555             wps_process_config_methods(wps, attr->config_methods) ||
1556             wps_process_wps_state(wps, attr->wps_state) ||
1557             wps_process_device_attrs(&wps->peer_dev, attr) ||
1558             wps_process_rf_bands(wps, attr->rf_bands) ||
1559             wps_process_assoc_state(wps, attr->assoc_state) ||
1560             wps_process_dev_password_id(wps, attr->dev_password_id) ||
1561             wps_process_config_error(wps, attr->config_error) ||
1562             wps_process_os_version(&wps->peer_dev, attr->os_version))
1563                 return WPS_FAILURE;
1564
1565         if (wps->dev_pw_id != DEV_PW_DEFAULT &&
1566             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
1567             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
1568             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
1569             (wps->dev_pw_id != DEV_PW_PUSHBUTTON || !wps->registrar->pbc)) {
1570                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
1571                            wps->dev_pw_id);
1572                 wps->state = SEND_M2D;
1573                 return WPS_CONTINUE;
1574         }
1575
1576         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
1577                 if (wps_registrar_pbc_overlap(wps->registrar, wps->mac_addr_e,
1578                                               wps->uuid_e)) {
1579                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
1580                                    "negotiation");
1581                         wps->state = SEND_M2D;
1582                         return WPS_CONTINUE;
1583                 }
1584                 wps_registrar_add_pbc_session(wps->registrar, wps->mac_addr_e,
1585                                               wps->uuid_e);
1586                 wps->pbc = 1;
1587         }
1588
1589         wps->state = SEND_M2;
1590         return WPS_CONTINUE;
1591 }
1592
1593
1594 static enum wps_process_res wps_process_m3(struct wps_data *wps,
1595                                            const struct wpabuf *msg,
1596                                            struct wps_parse_attr *attr)
1597 {
1598         wpa_printf(MSG_DEBUG, "WPS: Received M3");
1599
1600         if (wps->state != RECV_M3) {
1601                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1602                            "receiving M3", wps->state);
1603                 return WPS_FAILURE;
1604         }
1605
1606         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1607             wps_process_authenticator(wps, attr->authenticator, msg) ||
1608             wps_process_e_hash1(wps, attr->e_hash1) ||
1609             wps_process_e_hash2(wps, attr->e_hash2))
1610                 return WPS_FAILURE;
1611
1612         wps->state = SEND_M4;
1613         return WPS_CONTINUE;
1614 }
1615
1616
1617 static enum wps_process_res wps_process_m5(struct wps_data *wps,
1618                                            const struct wpabuf *msg,
1619                                            struct wps_parse_attr *attr)
1620 {
1621         struct wpabuf *decrypted;
1622         struct wps_parse_attr eattr;
1623
1624         wpa_printf(MSG_DEBUG, "WPS: Received M5");
1625
1626         if (wps->state != RECV_M5) {
1627                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1628                            "receiving M5", wps->state);
1629                 return WPS_FAILURE;
1630         }
1631
1632         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1633             wps_process_authenticator(wps, attr->authenticator, msg))
1634                 return WPS_FAILURE;
1635
1636         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1637                                               attr->encr_settings_len);
1638         if (decrypted == NULL) {
1639                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1640                            "Settings attribute");
1641                 return WPS_FAILURE;
1642         }
1643
1644         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1645                    "attribute");
1646         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1647             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1648             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
1649                 wpabuf_free(decrypted);
1650                 return WPS_FAILURE;
1651         }
1652         wpabuf_free(decrypted);
1653
1654         wps->state = SEND_M6;
1655         return WPS_CONTINUE;
1656 }
1657
1658
1659 static int wps_process_ap_settings_r(struct wps_data *wps,
1660                                      struct wps_parse_attr *attr)
1661 {
1662         struct wps_credential cred;
1663
1664         if (wps->wps->ap)
1665                 return 0;
1666
1667         /* AP Settings Attributes in M7 when Enrollee is an AP */
1668         if (wps_process_ap_settings(attr, &cred) < 0)
1669                 return -1;
1670
1671         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
1672
1673         /*
1674          * TODO: Provide access to AP settings and allow changes before sending
1675          * out M8. For now, just copy the settings unchanged into M8.
1676          */
1677         wps->auth_type = cred.auth_type;
1678         wps->encr_type = cred.encr_type;
1679         os_memcpy(wps->wps->ssid, cred.ssid, cred.ssid_len);
1680         wps->wps->ssid_len = cred.ssid_len;
1681         os_memcpy(wps->mac_addr_e, cred.mac_addr, ETH_ALEN);
1682         os_free(wps->wps->network_key);
1683         wps->wps->network_key = os_malloc(cred.key_len);
1684         if (wps->wps->network_key) {
1685                 os_memcpy(wps->wps->network_key, cred.key, cred.key_len);
1686                 wps->wps->network_key_len = cred.key_len;
1687         }
1688
1689         return 0;
1690 }
1691
1692
1693 static enum wps_process_res wps_process_m7(struct wps_data *wps,
1694                                            const struct wpabuf *msg,
1695                                            struct wps_parse_attr *attr)
1696 {
1697         struct wpabuf *decrypted;
1698         struct wps_parse_attr eattr;
1699
1700         wpa_printf(MSG_DEBUG, "WPS: Received M7");
1701
1702         if (wps->state != RECV_M7) {
1703                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1704                            "receiving M7", wps->state);
1705                 return WPS_FAILURE;
1706         }
1707
1708         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1709             wps_process_authenticator(wps, attr->authenticator, msg))
1710                 return WPS_FAILURE;
1711
1712         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1713                                               attr->encr_settings_len);
1714         if (decrypted == NULL) {
1715                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1716                            "Settings attribute");
1717                 return WPS_FAILURE;
1718         }
1719
1720         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1721                    "attribute");
1722         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1723             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1724             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
1725             wps_process_ap_settings_r(wps, &eattr)) {
1726                 wpabuf_free(decrypted);
1727                 return WPS_FAILURE;
1728         }
1729
1730         wpabuf_free(decrypted);
1731
1732         wps->state = SEND_M8;
1733         return WPS_CONTINUE;
1734 }
1735
1736
1737 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
1738                                                 const struct wpabuf *msg)
1739 {
1740         struct wps_parse_attr attr;
1741         enum wps_process_res ret = WPS_CONTINUE;
1742
1743         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
1744
1745         if (wps_parse_msg(msg, &attr) < 0)
1746                 return WPS_FAILURE;
1747
1748         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1749                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1750                            attr.version ? *attr.version : 0);
1751                 return WPS_FAILURE;
1752         }
1753
1754         if (attr.msg_type == NULL) {
1755                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1756                 return WPS_FAILURE;
1757         }
1758
1759         if (*attr.msg_type != WPS_M1 &&
1760             (attr.registrar_nonce == NULL ||
1761              os_memcmp(wps->nonce_r, attr.registrar_nonce,
1762                        WPS_NONCE_LEN != 0))) {
1763                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1764                 return WPS_FAILURE;
1765         }
1766
1767         switch (*attr.msg_type) {
1768         case WPS_M1:
1769                 ret = wps_process_m1(wps, &attr);
1770                 break;
1771         case WPS_M3:
1772                 ret = wps_process_m3(wps, msg, &attr);
1773                 break;
1774         case WPS_M5:
1775                 ret = wps_process_m5(wps, msg, &attr);
1776                 break;
1777         case WPS_M7:
1778                 ret = wps_process_m7(wps, msg, &attr);
1779                 break;
1780         default:
1781                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
1782                            *attr.msg_type);
1783                 return WPS_FAILURE;
1784         }
1785
1786         if (ret == WPS_CONTINUE) {
1787                 /* Save a copy of the last message for Authenticator derivation
1788                  */
1789                 wpabuf_free(wps->last_msg);
1790                 wps->last_msg = wpabuf_dup(msg);
1791         }
1792
1793         return ret;
1794 }
1795
1796
1797 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
1798                                                 const struct wpabuf *msg)
1799 {
1800         struct wps_parse_attr attr;
1801
1802         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
1803
1804         if (wps_parse_msg(msg, &attr) < 0)
1805                 return WPS_FAILURE;
1806
1807         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1808                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1809                            attr.version ? *attr.version : 0);
1810                 return WPS_FAILURE;
1811         }
1812
1813         if (attr.msg_type == NULL) {
1814                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1815                 return WPS_FAILURE;
1816         }
1817
1818         if (*attr.msg_type != WPS_WSC_ACK) {
1819                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1820                            *attr.msg_type);
1821                 return WPS_FAILURE;
1822         }
1823
1824         if (attr.registrar_nonce == NULL ||
1825             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1826         {
1827                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1828                 return WPS_FAILURE;
1829         }
1830
1831         if (attr.enrollee_nonce == NULL ||
1832             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1833                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1834                 return WPS_FAILURE;
1835         }
1836
1837         if (wps->state == RECV_M2D_ACK) {
1838                 /* TODO: support for multiple registrars and sending of
1839                  * multiple M2/M2D messages */
1840
1841                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
1842                            "terminate negotiation");
1843         }
1844
1845         return WPS_FAILURE;
1846 }
1847
1848
1849 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
1850                                                  const struct wpabuf *msg)
1851 {
1852         struct wps_parse_attr attr;
1853
1854         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
1855
1856         if (wps_parse_msg(msg, &attr) < 0)
1857                 return WPS_FAILURE;
1858
1859         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1860                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1861                            attr.version ? *attr.version : 0);
1862                 return WPS_FAILURE;
1863         }
1864
1865         if (attr.msg_type == NULL) {
1866                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1867                 return WPS_FAILURE;
1868         }
1869
1870         if (*attr.msg_type != WPS_WSC_NACK) {
1871                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1872                            *attr.msg_type);
1873                 return WPS_FAILURE;
1874         }
1875
1876         if (attr.registrar_nonce == NULL ||
1877             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1878         {
1879                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1880                 return WPS_FAILURE;
1881         }
1882
1883         if (attr.enrollee_nonce == NULL ||
1884             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1885                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1886                 return WPS_FAILURE;
1887         }
1888
1889         if (attr.config_error == NULL) {
1890                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
1891                            "in WSC_NACK");
1892                 return WPS_FAILURE;
1893         }
1894
1895         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
1896                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
1897
1898         return WPS_FAILURE;
1899 }
1900
1901
1902 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
1903                                                  const struct wpabuf *msg)
1904 {
1905         struct wps_parse_attr attr;
1906
1907         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
1908
1909         if (wps->state != RECV_DONE) {
1910                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1911                            "receiving WSC_Done", wps->state);
1912                 return WPS_FAILURE;
1913         }
1914
1915         if (wps_parse_msg(msg, &attr) < 0)
1916                 return WPS_FAILURE;
1917
1918         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1919                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1920                            attr.version ? *attr.version : 0);
1921                 return WPS_FAILURE;
1922         }
1923
1924         if (attr.msg_type == NULL) {
1925                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1926                 return WPS_FAILURE;
1927         }
1928
1929         if (*attr.msg_type != WPS_WSC_DONE) {
1930                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1931                            *attr.msg_type);
1932                 return WPS_FAILURE;
1933         }
1934
1935         if (attr.registrar_nonce == NULL ||
1936             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1937         {
1938                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1939                 return WPS_FAILURE;
1940         }
1941
1942         if (attr.enrollee_nonce == NULL ||
1943             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1944                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1945                 return WPS_FAILURE;
1946         }
1947
1948         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
1949
1950         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
1951             wps->wps->ap) {
1952                 struct wps_credential cred;
1953
1954                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
1955                            "on first Enrollee connection");
1956
1957                 os_memset(&cred, 0, sizeof(cred));
1958                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
1959                 cred.ssid_len = wps->wps->ssid_len;
1960                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
1961                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
1962                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
1963                 cred.key_len = wps->new_psk_len;
1964
1965                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
1966                 wpa_hexdump_ascii_key(MSG_DEBUG,
1967                                       "WPS: Generated random passphrase",
1968                                       wps->new_psk, wps->new_psk_len);
1969                 if (wps->wps->cred_cb)
1970                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
1971
1972                 os_free(wps->new_psk);
1973                 wps->new_psk = NULL;
1974         }
1975
1976         if (wps->new_psk) {
1977                 if (wps_cb_new_psk(wps->registrar, wps->mac_addr_e,
1978                                    wps->new_psk, wps->new_psk_len)) {
1979                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
1980                                    "new PSK");
1981                 }
1982                 os_free(wps->new_psk);
1983                 wps->new_psk = NULL;
1984         }
1985
1986         if (wps->pbc) {
1987                 wps_registrar_remove_pbc_session(wps->registrar,
1988                                                  wps->mac_addr_e, wps->uuid_e);
1989                 wps_registrar_pbc_completed(wps->registrar);
1990         }
1991
1992         return WPS_DONE;
1993 }
1994
1995
1996 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
1997                                                u8 op_code,
1998                                                const struct wpabuf *msg)
1999 {
2000
2001         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2002                    "op_code=%d)",
2003                    (unsigned long) wpabuf_len(msg), op_code);
2004
2005         switch (op_code) {
2006         case WSC_MSG:
2007                 return wps_process_wsc_msg(wps, msg);
2008         case WSC_ACK:
2009                 return wps_process_wsc_ack(wps, msg);
2010         case WSC_NACK:
2011                 return wps_process_wsc_nack(wps, msg);
2012         case WSC_Done:
2013                 return wps_process_wsc_done(wps, msg);
2014         default:
2015                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
2016                 return WPS_FAILURE;
2017         }
2018 }