WPS ER: Add PIN configuration and SetSelectedRegistrar call
[libeap.git] / src / wps / wps_registrar.c
index de76a00..d8053d4 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * Wi-Fi Protected Setup - Registrar
- * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
+ * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
 #include "wps_i.h"
 #include "wps_dev_attr.h"
 #include "wps_upnp.h"
+#include "crypto.h"
+#include "uuid.h"
 
+#define WPS_WORKAROUNDS
 
 struct wps_uuid_pin {
        struct wps_uuid_pin *next;
@@ -30,7 +33,10 @@ struct wps_uuid_pin {
        int wildcard_uuid;
        u8 *pin;
        size_t pin_len;
-       int locked;
+#define PIN_LOCKED BIT(0)
+#define PIN_EXPIRES BIT(1)
+       int flags;
+       struct os_time expiration;
 };
 
 
@@ -74,6 +80,13 @@ static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
 }
 
 
+struct wps_registrar_device {
+       struct wps_registrar_device *next;
+       struct wps_device_data dev;
+       u8 uuid[WPS_UUID_LEN];
+};
+
+
 struct wps_registrar {
        struct wps_context *wps;
 
@@ -88,6 +101,8 @@ struct wps_registrar {
                              const struct wps_device_data *dev);
        void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
                               const u8 *uuid_e);
+       void (*set_sel_reg_cb)(void *ctx, int sel_reg, u16 dev_passwd_id,
+                              u16 sel_reg_config_methods);
        void *cb_ctx;
 
        struct wps_uuid_pin *pins;
@@ -98,15 +113,89 @@ struct wps_registrar {
        int disable_auto_conf;
        int sel_reg_dev_password_id_override;
        int sel_reg_config_methods_override;
+       int static_wep_only;
+
+       struct wps_registrar_device *devices;
+
+       int force_pbc_overlap;
 };
 
 
 static int wps_set_ie(struct wps_registrar *reg);
+static void wps_cb_set_sel_reg(struct wps_registrar *reg);
 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
                                               void *timeout_ctx);
 
 
+static void wps_free_devices(struct wps_registrar_device *dev)
+{
+       struct wps_registrar_device *prev;
+
+       while (dev) {
+               prev = dev;
+               dev = dev->next;
+               wps_device_data_free(&prev->dev);
+               os_free(prev);
+       }
+}
+
+
+static struct wps_registrar_device * wps_device_get(struct wps_registrar *reg,
+                                                   const u8 *addr)
+{
+       struct wps_registrar_device *dev;
+
+       for (dev = reg->devices; dev; dev = dev->next) {
+               if (os_memcmp(dev->dev.mac_addr, addr, ETH_ALEN) == 0)
+                       return dev;
+       }
+       return NULL;
+}
+
+
+static void wps_device_clone_data(struct wps_device_data *dst,
+                                 struct wps_device_data *src)
+{
+       os_memcpy(dst->mac_addr, src->mac_addr, ETH_ALEN);
+       dst->categ = src->categ;
+       dst->oui = src->oui;
+       dst->sub_categ = src->sub_categ;
+
+#define WPS_STRDUP(n) \
+       os_free(dst->n); \
+       dst->n = src->n ? os_strdup(src->n) : NULL
+
+       WPS_STRDUP(device_name);
+       WPS_STRDUP(manufacturer);
+       WPS_STRDUP(model_name);
+       WPS_STRDUP(model_number);
+       WPS_STRDUP(serial_number);
+#undef WPS_STRDUP
+}
+
+
+int wps_device_store(struct wps_registrar *reg,
+                    struct wps_device_data *dev, const u8 *uuid)
+{
+       struct wps_registrar_device *d;
+
+       d = wps_device_get(reg, dev->mac_addr);
+       if (d == NULL) {
+               d = os_zalloc(sizeof(*d));
+               if (d == NULL)
+                       return -1;
+               d->next = reg->devices;
+               reg->devices = d;
+       }
+
+       wps_device_clone_data(&d->dev, dev);
+       os_memcpy(d->uuid, uuid, WPS_UUID_LEN);
+
+       return 0;
+}
+
+
 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
                                          const u8 *addr, const u8 *uuid_e)
 {
@@ -216,6 +305,31 @@ static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 }
 
 
+#ifdef CONFIG_WPS_UPNP
+static void wps_registrar_free_pending_m2(struct wps_context *wps)
+{
+       struct upnp_pending_message *p, *p2, *prev = NULL;
+       p = wps->upnp_msgs;
+       while (p) {
+               if (p->type == WPS_M2 || p->type == WPS_M2D) {
+                       if (prev == NULL)
+                               wps->upnp_msgs = p->next;
+                       else
+                               prev->next = p->next;
+                       wpa_printf(MSG_DEBUG, "WPS UPnP: Drop pending M2/M2D");
+                       p2 = p;
+                       p = p->next;
+                       wpabuf_free(p2->msg);
+                       os_free(p2);
+                       continue;
+               }
+               prev = p;
+               p = p->next;
+       }
+}
+#endif /* CONFIG_WPS_UPNP */
+
+
 static int wps_build_ap_setup_locked(struct wps_context *wps,
                                     struct wpabuf *msg)
 {
@@ -338,6 +452,7 @@ wps_registrar_init(struct wps_context *wps,
        reg->set_ie_cb = cfg->set_ie_cb;
        reg->pin_needed_cb = cfg->pin_needed_cb;
        reg->reg_success_cb = cfg->reg_success_cb;
+       reg->set_sel_reg_cb = cfg->set_sel_reg_cb;
        reg->cb_ctx = cfg->cb_ctx;
        reg->skip_cred_build = cfg->skip_cred_build;
        if (cfg->extra_cred) {
@@ -350,6 +465,8 @@ wps_registrar_init(struct wps_context *wps,
        }
        reg->disable_auto_conf = cfg->disable_auto_conf;
        reg->sel_reg_dev_password_id_override = -1;
+       reg->sel_reg_config_methods_override = -1;
+       reg->static_wep_only = cfg->static_wep_only;
 
        if (wps_set_ie(reg)) {
                wps_registrar_deinit(reg);
@@ -373,6 +490,7 @@ void wps_registrar_deinit(struct wps_registrar *reg)
        wps_free_pins(reg->pins);
        wps_free_pbc_sessions(reg->pbc_sessions);
        wpabuf_free(reg->extra_cred);
+       wps_free_devices(reg->devices);
        os_free(reg);
 }
 
@@ -383,10 +501,11 @@ void wps_registrar_deinit(struct wps_registrar *reg)
  * @uuid: UUID-E or %NULL for wildcard (any UUID)
  * @pin: PIN (Device Password)
  * @pin_len: Length of pin in octets
+ * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
  * Returns: 0 on success, -1 on failure
  */
 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
-                         const u8 *pin, size_t pin_len)
+                         const u8 *pin, size_t pin_len, int timeout)
 {
        struct wps_uuid_pin *p;
 
@@ -405,20 +524,60 @@ int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
        os_memcpy(p->pin, pin, pin_len);
        p->pin_len = pin_len;
 
+       if (timeout) {
+               p->flags |= PIN_EXPIRES;
+               os_get_time(&p->expiration);
+               p->expiration.sec += timeout;
+       }
+
        p->next = reg->pins;
        reg->pins = p;
 
-       wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
+       wpa_printf(MSG_DEBUG, "WPS: A new PIN configured (timeout=%d)",
+                  timeout);
        wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
        wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
        reg->selected_registrar = 1;
        reg->pbc = 0;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
+       eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
+       eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
+                              wps_registrar_set_selected_timeout,
+                              reg, NULL);
 
        return 0;
 }
 
 
+static void wps_registrar_expire_pins(struct wps_registrar *reg)
+{
+       struct wps_uuid_pin *pin, *prev, *del;
+       struct os_time now;
+
+       os_get_time(&now);
+       prev = NULL;
+       pin = reg->pins;
+       while (pin) {
+               if ((pin->flags & PIN_EXPIRES) &&
+                   os_time_before(&pin->expiration, &now)) {
+                       if (prev == NULL)
+                               reg->pins = pin->next;
+                       else
+                               prev->next = pin->next;
+                       del = pin;
+                       pin = pin->next;
+                       wpa_hexdump(MSG_DEBUG, "WPS: Expired PIN for UUID",
+                                   del->uuid, WPS_UUID_LEN);
+                       wps_free_pin(del);
+                       continue;
+               }
+               prev = pin;
+               pin = pin->next;
+       }
+}
+
+
 /**
  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
  * @reg: Registrar data from wps_registrar_init()
@@ -455,6 +614,8 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 {
        struct wps_uuid_pin *pin;
 
+       wps_registrar_expire_pins(reg);
+
        pin = reg->pins;
        while (pin) {
                if (!pin->wildcard_uuid &&
@@ -486,13 +647,13 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
         * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
         * that could otherwise avoid PIN invalidations.
         */
-       if (pin->locked) {
+       if (pin->flags & PIN_LOCKED) {
                wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
                           "allow concurrent re-use");
                return NULL;
        }
        *pin_len = pin->pin_len;
-       pin->locked = 1;
+       pin->flags |= PIN_LOCKED;
        return pin->pin;
 }
 
@@ -519,7 +680,7 @@ int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
                                           "wildcard PIN");
                                return wps_registrar_invalidate_pin(reg, uuid);
                        }
-                       pin->locked = 0;
+                       pin->flags &= ~PIN_LOCKED;
                        return 0;
                }
                pin = pin->next;
@@ -534,6 +695,7 @@ static void wps_registrar_stop_pbc(struct wps_registrar *reg)
        reg->selected_registrar = 0;
        reg->pbc = 0;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 }
 
 
@@ -542,6 +704,7 @@ static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
        struct wps_registrar *reg = eloop_ctx;
 
        wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
+       wps_pbc_timeout_event(reg->wps);
        wps_registrar_stop_pbc(reg);
 }
 
@@ -560,12 +723,15 @@ int wps_registrar_button_pushed(struct wps_registrar *reg)
        if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
                wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
                           "mode");
+               wps_pbc_overlap_event(reg->wps);
                return -1;
        }
        wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
+       reg->force_pbc_overlap = 0;
        reg->selected_registrar = 1;
        reg->pbc = 1;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 
        eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
        eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
@@ -581,6 +747,15 @@ static void wps_registrar_pbc_completed(struct wps_registrar *reg)
        wps_registrar_stop_pbc(reg);
 }
 
+static void wps_registrar_pin_completed(struct wps_registrar *reg)
+{
+       wpa_printf(MSG_DEBUG, "WPS: PIN completed using internal Registrar");
+       eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
+       reg->selected_registrar = 0;
+       wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
+}
+
 
 /**
  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
@@ -624,6 +799,11 @@ void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
                   MACSTR, MAC2STR(addr));
 
        wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
+       if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {
+               wpa_printf(MSG_DEBUG, "WPS: PBC session overlap detected");
+               reg->force_pbc_overlap = 1;
+               wps_pbc_overlap_event(reg->wps);
+       }
 }
 
 
@@ -671,6 +851,24 @@ static int wps_cb_set_ie(struct wps_registrar *reg,
 }
 
 
+static void wps_cb_set_sel_reg(struct wps_registrar *reg)
+{
+       u16 methods = 0;
+       if (reg->set_sel_reg_cb == NULL)
+               return;
+
+       if (reg->selected_registrar) {
+               methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
+               if (reg->pbc)
+                       methods |= WPS_CONFIG_PUSHBUTTON;
+       }
+
+       reg->set_sel_reg_cb(reg->cb_ctx, reg->selected_registrar,
+                           reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT,
+                           methods);
+}
+
+
 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 {
@@ -751,6 +949,28 @@ static int wps_set_ie(struct wps_registrar *reg)
                return -1;
        }
 
+       if (reg->static_wep_only) {
+               /*
+                * Windows XP and Vista clients can get confused about
+                * EAP-Identity/Request when they probe the network with
+                * EAPOL-Start. In such a case, they may assume the network is
+                * using IEEE 802.1X and prompt user for a certificate while
+                * the correct (non-WPS) behavior would be to ask for the
+                * static WEP key. As a workaround, use Microsoft Provisioning
+                * IE to advertise that legacy 802.1X is not supported.
+                */
+               const u8 ms_wps[7] = {
+                       WLAN_EID_VENDOR_SPECIFIC, 5,
+                       /* Microsoft Provisioning IE (00:50:f2:5) */
+                       0x00, 0x50, 0xf2, 5,
+                       0x00 /* no legacy 802.1X or MS WPS */
+               };
+               wpa_printf(MSG_DEBUG, "WPS: Add Microsoft Provisioning IE "
+                          "into Beacon/Probe Response frames");
+               wpabuf_put_data(beacon, ms_wps, sizeof(ms_wps));
+               wpabuf_put_data(probe, ms_wps, sizeof(ms_wps));
+       }
+
        ret = wps_cb_set_ie(reg, beacon, probe);
        wpabuf_free(beacon);
        wpabuf_free(probe);
@@ -955,7 +1175,7 @@ static int wps_build_credential(struct wpabuf *msg,
 }
 
 
-static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
+int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 {
        struct wpabuf *cred;
 
@@ -1133,14 +1353,15 @@ static struct wpabuf * wps_build_m2(struct wps_data *wps)
 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
 {
        struct wpabuf *msg;
-       u16 err = WPS_CFG_NO_ERROR;
+       u16 err = wps->config_error;
 
        wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
        msg = wpabuf_alloc(1000);
        if (msg == NULL)
                return NULL;
 
-       if (wps->wps->ap && wps->wps->ap_setup_locked)
+       if (wps->wps->ap && wps->wps->ap_setup_locked &&
+           err == WPS_CFG_NO_ERROR)
                err = WPS_CFG_SETUP_LOCKED;
 
        if (wps_build_version(msg) ||
@@ -1324,13 +1545,30 @@ struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
        struct wpabuf *msg;
 
 #ifdef CONFIG_WPS_UPNP
-       if (wps->wps->wps_upnp && wps->wps->upnp_msg) {
-               wpa_printf(MSG_DEBUG, "WPS: Use pending message from UPnP");
-               msg = wps->wps->upnp_msg;
-               wps->wps->upnp_msg = NULL;
-               *op_code = WSC_MSG; /* FIX: ack/nack */
-               wps->ext_reg = 1;
-               return msg;
+       if (wps->wps->wps_upnp) {
+               struct upnp_pending_message *p, *prev = NULL;
+               if (wps->ext_reg > 1)
+                       wps_registrar_free_pending_m2(wps->wps);
+               p = wps->wps->upnp_msgs;
+               /* TODO: check pending message MAC address */
+               while (p && p->next) {
+                       prev = p;
+                       p = p->next;
+               }
+               if (p) {
+                       wpa_printf(MSG_DEBUG, "WPS: Use pending message from "
+                                  "UPnP");
+                       if (prev)
+                               prev->next = NULL;
+                       else
+                               wps->wps->upnp_msgs = NULL;
+                       msg = p->msg;
+                       os_free(p);
+                       *op_code = WSC_MSG;
+                       if (wps->ext_reg == 0)
+                               wps->ext_reg = 1;
+                       return msg;
+               }
        }
        if (wps->ext_reg) {
                wpa_printf(MSG_DEBUG, "WPS: Using external Registrar, but no "
@@ -1583,6 +1821,22 @@ static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
                return -1;
        }
 
+#ifdef CONFIG_WPS_OOB
+       if (wps->wps->oob_conf.pubkey_hash != NULL) {
+               const u8 *addr[1];
+               u8 hash[WPS_HASH_LEN];
+
+               addr[0] = pk;
+               sha256_vector(1, addr, &pk_len, hash);
+               if (os_memcmp(hash,
+                             wpabuf_head(wps->wps->oob_conf.pubkey_hash),
+                             WPS_OOB_PUBKEY_HASH_LEN) != 0) {
+                       wpa_printf(MSG_ERROR, "WPS: Public Key hash error");
+                       return -1;
+               }
+       }
+#endif /* CONFIG_WPS_OOB */
+
        wpabuf_free(wps->dh_pubkey_e);
        wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
        if (wps->dh_pubkey_e == NULL)
@@ -1611,7 +1865,21 @@ static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
                wpa_printf(MSG_DEBUG, "WPS: No match in supported "
                           "authentication types (own 0x%x Enrollee 0x%x)",
                           wps->wps->auth_types, auth_types);
+#ifdef WPS_WORKAROUNDS
+               /*
+                * Some deployed implementations seem to advertise incorrect
+                * information in this attribute. For example, Linksys WRT350N
+                * seems to have a byteorder bug that breaks this negotiation.
+                * In order to interoperate with existing implementations,
+                * assume that the Enrollee supports everything we do.
+                */
+               wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
+                          "does not advertise supported authentication types "
+                          "correctly");
+               wps->auth_type = wps->wps->auth_types;
+#else /* WPS_WORKAROUNDS */
                return -1;
+#endif /* WPS_WORKAROUNDS */
        }
 
        return 0;
@@ -1635,8 +1903,23 @@ static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
        wps->encr_type = wps->wps->encr_types & encr_types;
        if (wps->encr_type == 0) {
                wpa_printf(MSG_DEBUG, "WPS: No match in supported "
-                          "encryption types");
+                          "encryption types (own 0x%x Enrollee 0x%x)",
+                          wps->wps->encr_types, encr_types);
+#ifdef WPS_WORKAROUNDS
+               /*
+                * Some deployed implementations seem to advertise incorrect
+                * information in this attribute. For example, Linksys WRT350N
+                * seems to have a byteorder bug that breaks this negotiation.
+                * In order to interoperate with existing implementations,
+                * assume that the Enrollee supports everything we do.
+                */
+               wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
+                          "does not advertise supported encryption types "
+                          "correctly");
+               wps->encr_type = wps->wps->encr_types;
+#else /* WPS_WORKAROUNDS */
                return -1;
+#endif /* WPS_WORKAROUNDS */
        }
 
        return 0;
@@ -1750,7 +2033,8 @@ static enum wps_process_res wps_process_m1(struct wps_data *wps,
            wps_process_os_version(&wps->peer_dev, attr->os_version))
                return WPS_FAILURE;
 
-       if (wps->dev_pw_id != DEV_PW_DEFAULT &&
+       if (wps->dev_pw_id < 0x10 &&
+           wps->dev_pw_id != DEV_PW_DEFAULT &&
            wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
            wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
            wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
@@ -1762,12 +2046,26 @@ static enum wps_process_res wps_process_m1(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+#ifdef CONFIG_WPS_OOB
+       if (wps->dev_pw_id >= 0x10 &&
+           wps->dev_pw_id != wps->wps->oob_dev_pw_id) {
+               wpa_printf(MSG_DEBUG, "WPS: OOB Device Password ID "
+                          "%d mismatch", wps->dev_pw_id);
+               wps->state = SEND_M2D;
+               return WPS_CONTINUE;
+       }
+#endif /* CONFIG_WPS_OOB */
+
        if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
-               if (wps_registrar_pbc_overlap(wps->wps->registrar,
+               if (wps->wps->registrar->force_pbc_overlap ||
+                   wps_registrar_pbc_overlap(wps->wps->registrar,
                                              wps->mac_addr_e, wps->uuid_e)) {
                        wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
                                   "negotiation");
                        wps->state = SEND_M2D;
+                       wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+                       wps_pbc_overlap_event(wps->wps);
+                       wps->wps->registrar->force_pbc_overlap = 1;
                        return WPS_CONTINUE;
                }
                wps_registrar_add_pbc_session(wps->wps->registrar,
@@ -1793,6 +2091,14 @@ static enum wps_process_res wps_process_m3(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg) ||
            wps_process_e_hash1(wps, attr->e_hash1) ||
@@ -1822,6 +2128,14 @@ static enum wps_process_res wps_process_m5(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg)) {
                wps->state = SEND_WSC_NACK;
@@ -1853,6 +2167,41 @@ static enum wps_process_res wps_process_m5(struct wps_data *wps,
 }
 
 
+static void wps_sta_cred_cb(struct wps_data *wps)
+{
+       /*
+        * Update credential to only include a single authentication and
+        * encryption type in case the AP configuration includes more than one
+        * option.
+        */
+       if (wps->cred.auth_type & WPS_AUTH_WPA2PSK)
+               wps->cred.auth_type = WPS_AUTH_WPA2PSK;
+       else if (wps->cred.auth_type & WPS_AUTH_WPAPSK)
+               wps->cred.auth_type = WPS_AUTH_WPAPSK;
+       if (wps->cred.encr_type & WPS_ENCR_AES)
+               wps->cred.encr_type = WPS_ENCR_AES;
+       else if (wps->cred.encr_type & WPS_ENCR_TKIP)
+               wps->cred.encr_type = WPS_ENCR_TKIP;
+       wpa_printf(MSG_DEBUG, "WPS: Update local configuration based on the "
+                  "AP configuration");
+       if (wps->wps->cred_cb)
+               wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
+}
+
+
+static void wps_cred_update(struct wps_credential *dst,
+                           struct wps_credential *src)
+{
+       os_memcpy(dst->ssid, src->ssid, sizeof(dst->ssid));
+       dst->ssid_len = src->ssid_len;
+       dst->auth_type = src->auth_type;
+       dst->encr_type = src->encr_type;
+       dst->key_idx = src->key_idx;
+       os_memcpy(dst->key, src->key, sizeof(dst->key));
+       dst->key_len = src->key_len;
+}
+
+
 static int wps_process_ap_settings_r(struct wps_data *wps,
                                     struct wps_parse_attr *attr)
 {
@@ -1865,12 +2214,19 @@ static int wps_process_ap_settings_r(struct wps_data *wps,
 
        wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
 
-       /*
-        * TODO: Provide access to AP settings and allow changes before sending
-        * out M8. For now, just copy the settings unchanged into M8.
-        */
-
-       return 0;
+       if (wps->new_ap_settings) {
+               wpa_printf(MSG_INFO, "WPS: Update AP configuration based on "
+                          "new settings");
+               wps_cred_update(&wps->cred, wps->new_ap_settings);
+               return 0;
+       } else {
+               /*
+                * Use the AP PIN only to receive the current AP settings, not
+                * to reconfigure the AP.
+                */
+               wps_sta_cred_cb(wps);
+               return 1;
+       }
 }
 
 
@@ -1890,6 +2246,14 @@ static enum wps_process_res wps_process_m7(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg)) {
                wps->state = SEND_WSC_NACK;
@@ -1958,8 +2322,8 @@ static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
 #ifdef CONFIG_WPS_UPNP
                if (wps->wps->wps_upnp && attr.mac_addr) {
                        /* Remove old pending messages when starting new run */
-                       wpabuf_free(wps->wps->upnp_msg);
-                       wps->wps->upnp_msg = NULL;
+                       wps_free_pending_msgs(wps->wps->upnp_msgs);
+                       wps->wps->upnp_msgs = NULL;
 
                        upnp_wps_device_send_wlan_event(
                                wps->wps->wps_upnp, attr.mac_addr,
@@ -2030,7 +2394,7 @@ static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
 #ifdef CONFIG_WPS_UPNP
        if (wps->wps->wps_upnp && wps->ext_reg && wps->state == RECV_M2D_ACK &&
            upnp_wps_subscribers(wps->wps->wps_upnp)) {
-               if (wps->wps->upnp_msg)
+               if (wps->wps->upnp_msgs)
                        return WPS_CONTINUE;
                wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
                           "external Registrar");
@@ -2055,8 +2419,10 @@ static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
 #ifdef CONFIG_WPS_UPNP
                if (wps->wps->wps_upnp &&
                    upnp_wps_subscribers(wps->wps->wps_upnp)) {
-                       if (wps->wps->upnp_msg)
+                       if (wps->wps->upnp_msgs)
                                return WPS_CONTINUE;
+                       if (wps->ext_reg == 0)
+                               wps->ext_reg = 1;
                        wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
                                   "external Registrar");
                        return WPS_PENDING;
@@ -2191,6 +2557,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
        if (wps->wps->wps_upnp && wps->ext_reg) {
                wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
                           "Registrar completed successfully");
+               wps_device_store(wps->wps->registrar, &wps->peer_dev,
+                                wps->uuid_e);
                return WPS_DONE;
        }
 #endif /* CONFIG_WPS_UPNP */
@@ -2209,6 +2577,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
        }
 
        wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
+       wps_device_store(wps->wps->registrar, &wps->peer_dev,
+                        wps->uuid_e);
 
        if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
            wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
@@ -2236,12 +2606,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
                wps->new_psk = NULL;
        }
 
-       if (!wps->wps->ap) {
-               wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
-                          "on the modified AP configuration");
-               if (wps->wps->cred_cb)
-                       wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
-       }
+       if (!wps->wps->ap)
+               wps_sta_cred_cb(wps);
 
        if (wps->new_psk) {
                if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
@@ -2259,6 +2625,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
                wps_registrar_remove_pbc_session(wps->wps->registrar,
                                                 wps->mac_addr_e, wps->uuid_e);
                wps_registrar_pbc_completed(wps->wps->registrar);
+       } else {
+               wps_registrar_pin_completed(wps->wps->registrar);
        }
 
        wps_success_event(wps->wps);
@@ -2278,7 +2646,16 @@ enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
                   (unsigned long) wpabuf_len(msg), op_code);
 
 #ifdef CONFIG_WPS_UPNP
-       if (wps->wps->wps_upnp && wps->ext_reg && wps->wps->upnp_msg == NULL &&
+       if (wps->wps->wps_upnp && op_code == WSC_MSG && wps->ext_reg == 1) {
+               struct wps_parse_attr attr;
+               if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type &&
+                   *attr.msg_type == WPS_M3)
+                       wps->ext_reg = 2; /* past M2/M2D phase */
+       }
+       if (wps->ext_reg > 1)
+               wps_registrar_free_pending_m2(wps->wps);
+       if (wps->wps->wps_upnp && wps->ext_reg &&
+           wps->wps->upnp_msgs == NULL &&
            (op_code == WSC_MSG || op_code == WSC_Done)) {
                struct wps_parse_attr attr;
                int type;
@@ -2340,6 +2717,7 @@ static void wps_registrar_set_selected_timeout(void *eloop_ctx,
        reg->sel_reg_dev_password_id_override = -1;
        reg->sel_reg_config_methods_override = -1;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 }
 
 
@@ -2347,7 +2725,6 @@ static void wps_registrar_set_selected_timeout(void *eloop_ctx,
  * wps_registrar_set_selected_registrar - Notification of SetSelectedRegistrar
  * @reg: Registrar data from wps_registrar_init()
  * @msg: Received message from SetSelectedRegistrar
- * @msg_len: Length of msg in octets
  * Returns: 0 on success, -1 on failure
  *
  * This function is called when an AP receives a SetSelectedRegistrar UPnP
@@ -2392,3 +2769,39 @@ int wps_registrar_set_selected_registrar(struct wps_registrar *reg,
                               reg, NULL);
        return 0;
 }
+
+
+int wps_registrar_get_info(struct wps_registrar *reg, const u8 *addr,
+                          char *buf, size_t buflen)
+{
+       struct wps_registrar_device *d;
+       int len = 0, ret;
+       char uuid[40];
+
+       d = wps_device_get(reg, addr);
+       if (d == NULL)
+               return 0;
+       if (uuid_bin2str(d->uuid, uuid, sizeof(uuid)))
+               return 0;
+
+       ret = os_snprintf(buf + len, buflen - len,
+                         "wpsUuid=%s\n"
+                         "wpsPrimaryDeviceType=%u-%08X-%u\n"
+                         "wpsDeviceName=%s\n"
+                         "wpsManufacturer=%s\n"
+                         "wpsModelName=%s\n"
+                         "wpsModelNumber=%s\n"
+                         "wpsSerialNumber=%s\n",
+                         uuid,
+                         d->dev.categ, d->dev.oui, d->dev.sub_categ,
+                         d->dev.device_name ? d->dev.device_name : "",
+                         d->dev.manufacturer ? d->dev.manufacturer : "",
+                         d->dev.model_name ? d->dev.model_name : "",
+                         d->dev.model_number ? d->dev.model_number : "",
+                         d->dev.serial_number ? d->dev.serial_number : "");
+       if (ret < 0 || (size_t) ret >= buflen - len)
+               return len;
+       len += ret;
+
+       return len;
+}