src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "common/ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24 #include "wps_upnp.h"
  25 #include "crypto.h"
  26 #include "uuid.h"
  27
  28 #define WPS_WORKAROUNDS
  29
  30 struct wps_uuid_pin {
  31         struct wps_uuid_pin *next;
  32         u8 uuid[WPS_UUID_LEN];
  33         int wildcard_uuid;
  34         u8 *pin;
  35         size_t pin_len;
  36 #define PIN_LOCKED BIT(0)
  37 #define PIN_EXPIRES BIT(1)
  38         int flags;
  39         struct os_time expiration;
  40 };
  41
  42
  43 static void wps_free_pin(struct wps_uuid_pin *pin)
  44 {
  45         os_free(pin->pin);
  46         os_free(pin);
  47 }
  48
  49
  50 static void wps_free_pins(struct wps_uuid_pin *pins)
  51 {
  52         struct wps_uuid_pin *pin, *prev;
  53
  54         pin = pins;
  55         while (pin) {
  56                 prev = pin;
  57                 pin = pin->next;
  58                 wps_free_pin(prev);
  59         }
  60 }
  61
  62
  63 struct wps_pbc_session {
  64         struct wps_pbc_session *next;
  65         u8 addr[ETH_ALEN];
  66         u8 uuid_e[WPS_UUID_LEN];
  67         struct os_time timestamp;
  68 };
  69
  70
  71 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  72 {
  73         struct wps_pbc_session *prev;
  74
  75         while (pbc) {
  76                 prev = pbc;
  77                 pbc = pbc->next;
  78                 os_free(prev);
  79         }
  80 }
  81
  82
  83 struct wps_registrar_device {
  84         struct wps_registrar_device *next;
  85         struct wps_device_data dev;
  86         u8 uuid[WPS_UUID_LEN];
  87 };
  88
  89
  90 struct wps_registrar {
  91         struct wps_context *wps;
  92
  93         int pbc;
  94         int selected_registrar;
  95
  96         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  97                           size_t psk_len);
  98         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  99                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
 100         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
 101                               const struct wps_device_data *dev);
 102         void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
 103                                const u8 *uuid_e);
 104         void (*set_sel_reg_cb)(void *ctx, int sel_reg, u16 dev_passwd_id,
 105                                u16 sel_reg_config_methods);
 106         void *cb_ctx;
 107
 108         struct wps_uuid_pin *pins;
 109         struct wps_pbc_session *pbc_sessions;
 110
 111         int skip_cred_build;
 112         struct wpabuf *extra_cred;
 113         int disable_auto_conf;
 114         int sel_reg_dev_password_id_override;
 115         int sel_reg_config_methods_override;
 116         int static_wep_only;
 117
 118         struct wps_registrar_device *devices;
 119
 120         int force_pbc_overlap;
 121 };
 122
 123
 124 static int wps_set_ie(struct wps_registrar *reg);
 125 static void wps_cb_set_sel_reg(struct wps_registrar *reg);
 126 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 127 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
 128                                                void *timeout_ctx);
 129
 130
 131 static void wps_free_devices(struct wps_registrar_device *dev)
 132 {
 133         struct wps_registrar_device *prev;
 134
 135         while (dev) {
 136                 prev = dev;
 137                 dev = dev->next;
 138                 wps_device_data_free(&prev->dev);
 139                 os_free(prev);
 140         }
 141 }
 142
 143
 144 static struct wps_registrar_device * wps_device_get(struct wps_registrar *reg,
 145                                                     const u8 *addr)
 146 {
 147         struct wps_registrar_device *dev;
 148
 149         for (dev = reg->devices; dev; dev = dev->next) {
 150                 if (os_memcmp(dev->dev.mac_addr, addr, ETH_ALEN) == 0)
 151                         return dev;
 152         }
 153         return NULL;
 154 }
 155
 156
 157 static void wps_device_clone_data(struct wps_device_data *dst,
 158                                   struct wps_device_data *src)
 159 {
 160         os_memcpy(dst->mac_addr, src->mac_addr, ETH_ALEN);
 161         os_memcpy(dst->pri_dev_type, src->pri_dev_type, WPS_DEV_TYPE_LEN);
 162
 163 #define WPS_STRDUP(n) \
 164         os_free(dst->n); \
 165         dst->n = src->n ? os_strdup(src->n) : NULL
 166
 167         WPS_STRDUP(device_name);
 168         WPS_STRDUP(manufacturer);
 169         WPS_STRDUP(model_name);
 170         WPS_STRDUP(model_number);
 171         WPS_STRDUP(serial_number);
 172 #undef WPS_STRDUP
 173 }
 174
 175
 176 int wps_device_store(struct wps_registrar *reg,
 177                      struct wps_device_data *dev, const u8 *uuid)
 178 {
 179         struct wps_registrar_device *d;
 180
 181         d = wps_device_get(reg, dev->mac_addr);
 182         if (d == NULL) {
 183                 d = os_zalloc(sizeof(*d));
 184                 if (d == NULL)
 185                         return -1;
 186                 d->next = reg->devices;
 187                 reg->devices = d;
 188         }
 189
 190         wps_device_clone_data(&d->dev, dev);
 191         os_memcpy(d->uuid, uuid, WPS_UUID_LEN);
 192
 193         return 0;
 194 }
 195
 196
 197 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
 198                                           const u8 *addr, const u8 *uuid_e)
 199 {
 200         struct wps_pbc_session *pbc, *prev = NULL;
 201         struct os_time now;
 202
 203         os_get_time(&now);
 204
 205         pbc = reg->pbc_sessions;
 206         while (pbc) {
 207                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 208                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 209                         if (prev)
 210                                 prev->next = pbc->next;
 211                         else
 212                                 reg->pbc_sessions = pbc->next;
 213                         break;
 214                 }
 215                 prev = pbc;
 216                 pbc = pbc->next;
 217         }
 218
 219         if (!pbc) {
 220                 pbc = os_zalloc(sizeof(*pbc));
 221                 if (pbc == NULL)
 222                         return;
 223                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 224                 if (uuid_e)
 225                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 226         }
 227
 228         pbc->next = reg->pbc_sessions;
 229         reg->pbc_sessions = pbc;
 230         pbc->timestamp = now;
 231
 232         /* remove entries that have timed out */
 233         prev = pbc;
 234         pbc = pbc->next;
 235
 236         while (pbc) {
 237                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 238                         prev->next = NULL;
 239                         wps_free_pbc_sessions(pbc);
 240                         break;
 241                 }
 242                 prev = pbc;
 243                 pbc = pbc->next;
 244         }
 245 }
 246
 247
 248 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 249                                              const u8 *addr, const u8 *uuid_e)
 250 {
 251         struct wps_pbc_session *pbc, *prev = NULL;
 252
 253         pbc = reg->pbc_sessions;
 254         while (pbc) {
 255                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 256                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 257                         if (prev)
 258                                 prev->next = pbc->next;
 259                         else
 260                                 reg->pbc_sessions = pbc->next;
 261                         os_free(pbc);
 262                         break;
 263                 }
 264                 prev = pbc;
 265                 pbc = pbc->next;
 266         }
 267 }
 268
 269
 270 static int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 271                                      const u8 *addr, const u8 *uuid_e)
 272 {
 273         int count = 0;
 274         struct wps_pbc_session *pbc;
 275         struct os_time now;
 276
 277         os_get_time(&now);
 278
 279         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 280                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 281                         break;
 282                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 283                     uuid_e == NULL ||
 284                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 285                         count++;
 286         }
 287
 288         if (addr || uuid_e)
 289                 count++;
 290
 291         return count > 1 ? 1 : 0;
 292 }
 293
 294
 295 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 296 {
 297         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 298                    wps->wps_state);
 299         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 300         wpabuf_put_be16(msg, 1);
 301         wpabuf_put_u8(msg, wps->wps_state);
 302         return 0;
 303 }
 304
 305
 306 #ifdef CONFIG_WPS_UPNP
 307 static void wps_registrar_free_pending_m2(struct wps_context *wps)
 308 {
 309         struct upnp_pending_message *p, *p2, *prev = NULL;
 310         p = wps->upnp_msgs;
 311         while (p) {
 312                 if (p->type == WPS_M2 || p->type == WPS_M2D) {
 313                         if (prev == NULL)
 314                                 wps->upnp_msgs = p->next;
 315                         else
 316                                 prev->next = p->next;
 317                         wpa_printf(MSG_DEBUG, "WPS UPnP: Drop pending M2/M2D");
 318                         p2 = p;
 319                         p = p->next;
 320                         wpabuf_free(p2->msg);
 321                         os_free(p2);
 322                         continue;
 323                 }
 324                 prev = p;
 325                 p = p->next;
 326         }
 327 }
 328 #endif /* CONFIG_WPS_UPNP */
 329
 330
 331 static int wps_build_ap_setup_locked(struct wps_context *wps,
 332                                      struct wpabuf *msg)
 333 {
 334         if (wps->ap_setup_locked) {
 335                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 336                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 337                 wpabuf_put_be16(msg, 1);
 338                 wpabuf_put_u8(msg, 1);
 339         }
 340         return 0;
 341 }
 342
 343
 344 static int wps_build_selected_registrar(struct wps_registrar *reg,
 345                                         struct wpabuf *msg)
 346 {
 347         if (!reg->selected_registrar)
 348                 return 0;
 349         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 350         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 351         wpabuf_put_be16(msg, 1);
 352         wpabuf_put_u8(msg, 1);
 353         return 0;
 354 }
 355
 356
 357 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 358                                              struct wpabuf *msg)
 359 {
 360         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 361         if (!reg->selected_registrar)
 362                 return 0;
 363         if (reg->sel_reg_dev_password_id_override >= 0)
 364                 id = reg->sel_reg_dev_password_id_override;
 365         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 366         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 367         wpabuf_put_be16(msg, 2);
 368         wpabuf_put_be16(msg, id);
 369         return 0;
 370 }
 371
 372
 373 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 374                                             struct wpabuf *msg)
 375 {
 376         u16 methods;
 377         if (!reg->selected_registrar)
 378                 return 0;
 379         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 380         if (reg->pbc)
 381                 methods |= WPS_CONFIG_PUSHBUTTON;
 382         if (reg->sel_reg_config_methods_override >= 0)
 383                 methods = reg->sel_reg_config_methods_override;
 384         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 385                    methods);
 386         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 387         wpabuf_put_be16(msg, 2);
 388         wpabuf_put_be16(msg, methods);
 389         return 0;
 390 }
 391
 392
 393 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 394                                           struct wpabuf *msg)
 395 {
 396         u16 methods;
 397         methods = 0;
 398         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 399         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 400         wpabuf_put_be16(msg, 2);
 401         wpabuf_put_be16(msg, methods);
 402         return 0;
 403 }
 404
 405
 406 static int wps_build_config_methods_r(struct wps_registrar *reg,
 407                                       struct wpabuf *msg)
 408 {
 409         u16 methods;
 410         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 411         if (reg->pbc)
 412                 methods |= WPS_CONFIG_PUSHBUTTON;
 413         return wps_build_config_methods(msg, methods);
 414 }
 415
 416
 417 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 418 {
 419         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 420         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 421         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 422         wpabuf_put_be16(msg, 1);
 423         wpabuf_put_u8(msg, resp);
 424         return 0;
 425 }
 426
 427
 428 /**
 429  * wps_registrar_init - Initialize WPS Registrar data
 430  * @wps: Pointer to longterm WPS context
 431  * @cfg: Registrar configuration
 432  * Returns: Pointer to allocated Registrar data or %NULL on failure
 433  *
 434  * This function is used to initialize WPS Registrar functionality. It can be
 435  * used for a single Registrar run (e.g., when run in a supplicant) or multiple
 436  * runs (e.g., when run as an internal Registrar in an AP). Caller is
 437  * responsible for freeing the returned data with wps_registrar_deinit() when
 438  * Registrar functionality is not needed anymore.
 439  */
 440 struct wps_registrar *
 441 wps_registrar_init(struct wps_context *wps,
 442                    const struct wps_registrar_config *cfg)
 443 {
 444         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 445         if (reg == NULL)
 446                 return NULL;
 447
 448         reg->wps = wps;
 449         reg->new_psk_cb = cfg->new_psk_cb;
 450         reg->set_ie_cb = cfg->set_ie_cb;
 451         reg->pin_needed_cb = cfg->pin_needed_cb;
 452         reg->reg_success_cb = cfg->reg_success_cb;
 453         reg->set_sel_reg_cb = cfg->set_sel_reg_cb;
 454         reg->cb_ctx = cfg->cb_ctx;
 455         reg->skip_cred_build = cfg->skip_cred_build;
 456         if (cfg->extra_cred) {
 457                 reg->extra_cred = wpabuf_alloc_copy(cfg->extra_cred,
 458                                                     cfg->extra_cred_len);
 459                 if (reg->extra_cred == NULL) {
 460                         os_free(reg);
 461                         return NULL;
 462                 }
 463         }
 464         reg->disable_auto_conf = cfg->disable_auto_conf;
 465         reg->sel_reg_dev_password_id_override = -1;
 466         reg->sel_reg_config_methods_override = -1;
 467         reg->static_wep_only = cfg->static_wep_only;
 468
 469         if (wps_set_ie(reg)) {
 470                 wps_registrar_deinit(reg);
 471                 return NULL;
 472         }
 473
 474         return reg;
 475 }
 476
 477
 478 /**
 479  * wps_registrar_deinit - Deinitialize WPS Registrar data
 480  * @reg: Registrar data from wps_registrar_init()
 481  */
 482 void wps_registrar_deinit(struct wps_registrar *reg)
 483 {
 484         if (reg == NULL)
 485                 return;
 486         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 487         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 488         wps_free_pins(reg->pins);
 489         wps_free_pbc_sessions(reg->pbc_sessions);
 490         wpabuf_free(reg->extra_cred);
 491         wps_free_devices(reg->devices);
 492         os_free(reg);
 493 }
 494
 495
 496 /**
 497  * wps_registrar_add_pin - Configure a new PIN for Registrar
 498  * @reg: Registrar data from wps_registrar_init()
 499  * @uuid: UUID-E or %NULL for wildcard (any UUID)
 500  * @pin: PIN (Device Password)
 501  * @pin_len: Length of pin in octets
 502  * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
 503  * Returns: 0 on success, -1 on failure
 504  */
 505 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 506                           const u8 *pin, size_t pin_len, int timeout)
 507 {
 508         struct wps_uuid_pin *p;
 509
 510         p = os_zalloc(sizeof(*p));
 511         if (p == NULL)
 512                 return -1;
 513         if (uuid == NULL)
 514                 p->wildcard_uuid = 1;
 515         else
 516                 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 517         p->pin = os_malloc(pin_len);
 518         if (p->pin == NULL) {
 519                 os_free(p);
 520                 return -1;
 521         }
 522         os_memcpy(p->pin, pin, pin_len);
 523         p->pin_len = pin_len;
 524
 525         if (timeout) {
 526                 p->flags |= PIN_EXPIRES;
 527                 os_get_time(&p->expiration);
 528                 p->expiration.sec += timeout;
 529         }
 530
 531         p->next = reg->pins;
 532         reg->pins = p;
 533
 534         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured (timeout=%d)",
 535                    timeout);
 536         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 537         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 538         reg->selected_registrar = 1;
 539         reg->pbc = 0;
 540         wps_set_ie(reg);
 541         wps_cb_set_sel_reg(reg);
 542         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 543         eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
 544                                wps_registrar_set_selected_timeout,
 545                                reg, NULL);
 546
 547         return 0;
 548 }
 549
 550
 551 static void wps_registrar_expire_pins(struct wps_registrar *reg)
 552 {
 553         struct wps_uuid_pin *pin, *prev, *del;
 554         struct os_time now;
 555
 556         os_get_time(&now);
 557         prev = NULL;
 558         pin = reg->pins;
 559         while (pin) {
 560                 if ((pin->flags & PIN_EXPIRES) &&
 561                     os_time_before(&pin->expiration, &now)) {
 562                         if (prev == NULL)
 563                                 reg->pins = pin->next;
 564                         else
 565                                 prev->next = pin->next;
 566                         del = pin;
 567                         pin = pin->next;
 568                         wpa_hexdump(MSG_DEBUG, "WPS: Expired PIN for UUID",
 569                                     del->uuid, WPS_UUID_LEN);
 570                         wps_free_pin(del);
 571                         continue;
 572                 }
 573                 prev = pin;
 574                 pin = pin->next;
 575         }
 576 }
 577
 578
 579 /**
 580  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
 581  * @reg: Registrar data from wps_registrar_init()
 582  * @uuid: UUID-E
 583  * Returns: 0 on success, -1 on failure (e.g., PIN not found)
 584  */
 585 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 586 {
 587         struct wps_uuid_pin *pin, *prev;
 588
 589         prev = NULL;
 590         pin = reg->pins;
 591         while (pin) {
 592                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 593                         if (prev == NULL)
 594                                 reg->pins = pin->next;
 595                         else
 596                                 prev->next = pin->next;
 597                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 598                                     pin->uuid, WPS_UUID_LEN);
 599                         wps_free_pin(pin);
 600                         return 0;
 601                 }
 602                 prev = pin;
 603                 pin = pin->next;
 604         }
 605
 606         return -1;
 607 }
 608
 609
 610 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 611                                         const u8 *uuid, size_t *pin_len)
 612 {
 613         struct wps_uuid_pin *pin;
 614
 615         wps_registrar_expire_pins(reg);
 616
 617         pin = reg->pins;
 618         while (pin) {
 619                 if (!pin->wildcard_uuid &&
 620                     os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0)
 621                         break;
 622                 pin = pin->next;
 623         }
 624
 625         if (!pin) {
 626                 /* Check for wildcard UUIDs since none of the UUID-specific
 627                  * PINs matched */
 628                 pin = reg->pins;
 629                 while (pin) {
 630                         if (pin->wildcard_uuid == 1) {
 631                                 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
 632                                            "PIN. Assigned it for this UUID-E");
 633                                 pin->wildcard_uuid = 2;
 634                                 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
 635                                 break;
 636                         }
 637                         pin = pin->next;
 638                 }
 639         }
 640
 641         if (!pin)
 642                 return NULL;
 643
 644         /*
 645          * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
 646          * that could otherwise avoid PIN invalidations.
 647          */
 648         if (pin->flags & PIN_LOCKED) {
 649                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
 650                            "allow concurrent re-use");
 651                 return NULL;
 652         }
 653         *pin_len = pin->pin_len;
 654         pin->flags |= PIN_LOCKED;
 655         return pin->pin;
 656 }
 657
 658
 659 /**
 660  * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
 661  * @reg: Registrar data from wps_registrar_init()
 662  * @uuid: UUID-E
 663  * Returns: 0 on success, -1 on failure
 664  *
 665  * PINs are locked to enforce only one concurrent use. This function unlocks a
 666  * PIN to allow it to be used again. If the specified PIN was configured using
 667  * a wildcard UUID, it will be removed instead of allowing multiple uses.
 668  */
 669 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 670 {
 671         struct wps_uuid_pin *pin;
 672
 673         pin = reg->pins;
 674         while (pin) {
 675                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 676                         if (pin->wildcard_uuid == 2) {
 677                                 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
 678                                            "wildcard PIN");
 679                                 return wps_registrar_invalidate_pin(reg, uuid);
 680                         }
 681                         pin->flags &= ~PIN_LOCKED;
 682                         return 0;
 683                 }
 684                 pin = pin->next;
 685         }
 686
 687         return -1;
 688 }
 689
 690
 691 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
 692 {
 693         reg->selected_registrar = 0;
 694         reg->pbc = 0;
 695         wps_set_ie(reg);
 696         wps_cb_set_sel_reg(reg);
 697 }
 698
 699
 700 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 701 {
 702         struct wps_registrar *reg = eloop_ctx;
 703
 704         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 705         wps_pbc_timeout_event(reg->wps);
 706         wps_registrar_stop_pbc(reg);
 707 }
 708
 709
 710 /**
 711  * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
 712  * @reg: Registrar data from wps_registrar_init()
 713  * Returns: 0 on success, -1 on failure
 714  *
 715  * This function is called on an AP when a push button is pushed to activate
 716  * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
 717  * or when a PBC registration is completed.
 718  */
 719 int wps_registrar_button_pushed(struct wps_registrar *reg)
 720 {
 721         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 722                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 723                            "mode");
 724                 wps_pbc_overlap_event(reg->wps);
 725                 return -1;
 726         }
 727         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 728         reg->force_pbc_overlap = 0;
 729         reg->selected_registrar = 1;
 730         reg->pbc = 1;
 731         wps_set_ie(reg);
 732         wps_cb_set_sel_reg(reg);
 733
 734         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 735         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 736                                reg, NULL);
 737         return 0;
 738 }
 739
 740
 741 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 742 {
 743         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 744         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 745         wps_registrar_stop_pbc(reg);
 746 }
 747
 748 static void wps_registrar_pin_completed(struct wps_registrar *reg)
 749 {
 750         wpa_printf(MSG_DEBUG, "WPS: PIN completed using internal Registrar");
 751         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 752         reg->selected_registrar = 0;
 753         wps_set_ie(reg);
 754         wps_cb_set_sel_reg(reg);
 755 }
 756
 757
 758 /**
 759  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
 760  * @reg: Registrar data from wps_registrar_init()
 761  * @addr: MAC address of the Probe Request sender
 762  * @wps_data: WPS IE contents
 763  *
 764  * This function is called on an AP when a Probe Request with WPS IE is
 765  * received. This is used to track PBC mode use and to detect possible overlap
 766  * situation with other WPS APs.
 767  */
 768 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 769                                 const struct wpabuf *wps_data)
 770 {
 771         struct wps_parse_attr attr;
 772         u16 methods;
 773
 774         wpa_hexdump_buf(MSG_MSGDUMP,
 775                         "WPS: Probe Request with WPS data received",
 776                         wps_data);
 777
 778         if (wps_parse_msg(wps_data, &attr) < 0)
 779                 return;
 780         if (!wps_version_supported(attr.version)) {
 781                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 782                            "version 0x%x", attr.version ? *attr.version : 0);
 783                 return;
 784         }
 785
 786         if (attr.config_methods == NULL) {
 787                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 788                            "Probe Request");
 789                 return;
 790         }
 791
 792         methods = WPA_GET_BE16(attr.config_methods);
 793         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 794                 return; /* Not PBC */
 795
 796         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 797                    MACSTR, MAC2STR(addr));
 798
 799         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 800         if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {
 801                 wpa_printf(MSG_DEBUG, "WPS: PBC session overlap detected");
 802                 reg->force_pbc_overlap = 1;
 803                 wps_pbc_overlap_event(reg->wps);
 804         }
 805 }
 806
 807
 808 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 809                           const u8 *psk, size_t psk_len)
 810 {
 811         if (reg->new_psk_cb == NULL)
 812                 return 0;
 813
 814         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 815 }
 816
 817
 818 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 819                               const struct wps_device_data *dev)
 820 {
 821         if (reg->pin_needed_cb == NULL)
 822                 return;
 823
 824         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 825 }
 826
 827
 828 static void wps_cb_reg_success(struct wps_registrar *reg, const u8 *mac_addr,
 829                                const u8 *uuid_e)
 830 {
 831         if (reg->reg_success_cb == NULL)
 832                 return;
 833
 834         reg->reg_success_cb(reg->cb_ctx, mac_addr, uuid_e);
 835 }
 836
 837
 838 static int wps_cb_set_ie(struct wps_registrar *reg,
 839                          const struct wpabuf *beacon_ie,
 840                          const struct wpabuf *probe_resp_ie)
 841 {
 842         if (reg->set_ie_cb == NULL)
 843                 return 0;
 844
 845         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 846                               wpabuf_len(beacon_ie),
 847                               wpabuf_head(probe_resp_ie),
 848                               wpabuf_len(probe_resp_ie));
 849 }
 850
 851
 852 static void wps_cb_set_sel_reg(struct wps_registrar *reg)
 853 {
 854         u16 methods = 0;
 855         if (reg->set_sel_reg_cb == NULL)
 856                 return;
 857
 858         if (reg->selected_registrar) {
 859                 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 860                 if (reg->pbc)
 861                         methods |= WPS_CONFIG_PUSHBUTTON;
 862         }
 863
 864         reg->set_sel_reg_cb(reg->cb_ctx, reg->selected_registrar,
 865                             reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT,
 866                             methods);
 867 }
 868
 869
 870 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 871 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 872 {
 873         struct wpabuf *ie;
 874         const u8 *pos, *end;
 875
 876         ie = wpabuf_alloc(wpabuf_len(data) + 100);
 877         if (ie == NULL) {
 878                 wpabuf_free(data);
 879                 return NULL;
 880         }
 881
 882         pos = wpabuf_head(data);
 883         end = pos + wpabuf_len(data);
 884
 885         while (end > pos) {
 886                 size_t frag_len = end - pos;
 887                 if (frag_len > 251)
 888                         frag_len = 251;
 889                 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 890                 wpabuf_put_u8(ie, 4 + frag_len);
 891                 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
 892                 wpabuf_put_data(ie, pos, frag_len);
 893                 pos += frag_len;
 894         }
 895
 896         wpabuf_free(data);
 897
 898         return ie;
 899 }
 900
 901
 902 static int wps_set_ie(struct wps_registrar *reg)
 903 {
 904         struct wpabuf *beacon;
 905         struct wpabuf *probe;
 906         int ret;
 907
 908         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 909
 910         beacon = wpabuf_alloc(300);
 911         if (beacon == NULL)
 912                 return -1;
 913         probe = wpabuf_alloc(400);
 914         if (probe == NULL) {
 915                 wpabuf_free(beacon);
 916                 return -1;
 917         }
 918
 919         if (wps_build_version(beacon) ||
 920             wps_build_wps_state(reg->wps, beacon) ||
 921             wps_build_ap_setup_locked(reg->wps, beacon) ||
 922             wps_build_selected_registrar(reg, beacon) ||
 923             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 924             wps_build_sel_reg_config_methods(reg, beacon) ||
 925             wps_build_version(probe) ||
 926             wps_build_wps_state(reg->wps, probe) ||
 927             wps_build_ap_setup_locked(reg->wps, probe) ||
 928             wps_build_selected_registrar(reg, probe) ||
 929             wps_build_sel_reg_dev_password_id(reg, probe) ||
 930             wps_build_sel_reg_config_methods(reg, probe) ||
 931             wps_build_resp_type(reg, probe) ||
 932             wps_build_uuid_e(probe, reg->wps->uuid) ||
 933             wps_build_device_attrs(&reg->wps->dev, probe) ||
 934             wps_build_probe_config_methods(reg, probe) ||
 935             wps_build_rf_bands(&reg->wps->dev, probe)) {
 936                 wpabuf_free(beacon);
 937                 wpabuf_free(probe);
 938                 return -1;
 939         }
 940
 941         beacon = wps_ie_encapsulate(beacon);
 942         probe = wps_ie_encapsulate(probe);
 943
 944         if (!beacon || !probe) {
 945                 wpabuf_free(beacon);
 946                 wpabuf_free(probe);
 947                 return -1;
 948         }
 949
 950         if (reg->static_wep_only) {
 951                 /*
 952                  * Windows XP and Vista clients can get confused about
 953                  * EAP-Identity/Request when they probe the network with
 954                  * EAPOL-Start. In such a case, they may assume the network is
 955                  * using IEEE 802.1X and prompt user for a certificate while
 956                  * the correct (non-WPS) behavior would be to ask for the
 957                  * static WEP key. As a workaround, use Microsoft Provisioning
 958                  * IE to advertise that legacy 802.1X is not supported.
 959                  */
 960                 const u8 ms_wps[7] = {
 961                         WLAN_EID_VENDOR_SPECIFIC, 5,
 962                         /* Microsoft Provisioning IE (00:50:f2:5) */
 963                         0x00, 0x50, 0xf2, 5,
 964                         0x00 /* no legacy 802.1X or MS WPS */
 965                 };
 966                 wpa_printf(MSG_DEBUG, "WPS: Add Microsoft Provisioning IE "
 967                            "into Beacon/Probe Response frames");
 968                 wpabuf_put_data(beacon, ms_wps, sizeof(ms_wps));
 969                 wpabuf_put_data(probe, ms_wps, sizeof(ms_wps));
 970         }
 971
 972         ret = wps_cb_set_ie(reg, beacon, probe);
 973         wpabuf_free(beacon);
 974         wpabuf_free(probe);
 975
 976         return ret;
 977 }
 978
 979
 980 static int wps_get_dev_password(struct wps_data *wps)
 981 {
 982         const u8 *pin;
 983         size_t pin_len = 0;
 984
 985         os_free(wps->dev_password);
 986         wps->dev_password = NULL;
 987
 988         if (wps->pbc) {
 989                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 990                 pin = (const u8 *) "00000000";
 991                 pin_len = 8;
 992         } else {
 993                 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
 994                                             &pin_len);
 995         }
 996         if (pin == NULL) {
 997                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 998                            "the Enrollee");
 999                 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
1000                                   &wps->peer_dev);
1001                 return -1;
1002         }
1003
1004         wps->dev_password = os_malloc(pin_len);
1005         if (wps->dev_password == NULL)
1006                 return -1;
1007         os_memcpy(wps->dev_password, pin, pin_len);
1008         wps->dev_password_len = pin_len;
1009
1010         return 0;
1011 }
1012
1013
1014 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
1015 {
1016         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
1017         wpabuf_put_be16(msg, ATTR_UUID_R);
1018         wpabuf_put_be16(msg, WPS_UUID_LEN);
1019         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
1020         return 0;
1021 }
1022
1023
1024 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
1025 {
1026         u8 *hash;
1027         const u8 *addr[4];
1028         size_t len[4];
1029
1030         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
1031                 return -1;
1032         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
1033         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
1034                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
1035
1036         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
1037                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
1038                            "R-Hash derivation");
1039                 return -1;
1040         }
1041
1042         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
1043         wpabuf_put_be16(msg, ATTR_R_HASH1);
1044         wpabuf_put_be16(msg, SHA256_MAC_LEN);
1045         hash = wpabuf_put(msg, SHA256_MAC_LEN);
1046         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
1047         addr[0] = wps->snonce;
1048         len[0] = WPS_SECRET_NONCE_LEN;
1049         addr[1] = wps->psk1;
1050         len[1] = WPS_PSK_LEN;
1051         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1052         len[2] = wpabuf_len(wps->dh_pubkey_e);
1053         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1054         len[3] = wpabuf_len(wps->dh_pubkey_r);
1055         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1056         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
1057
1058         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
1059         wpabuf_put_be16(msg, ATTR_R_HASH2);
1060         wpabuf_put_be16(msg, SHA256_MAC_LEN);
1061         hash = wpabuf_put(msg, SHA256_MAC_LEN);
1062         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
1063         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
1064         addr[1] = wps->psk2;
1065         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1066         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
1067
1068         return 0;
1069 }
1070
1071
1072 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
1073 {
1074         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
1075         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
1076         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1077         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
1078         return 0;
1079 }
1080
1081
1082 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
1083 {
1084         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
1085         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
1086         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1087         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
1088                         WPS_SECRET_NONCE_LEN);
1089         return 0;
1090 }
1091
1092
1093 static int wps_build_cred_network_idx(struct wpabuf *msg,
1094                                       const struct wps_credential *cred)
1095 {
1096         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
1097         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
1098         wpabuf_put_be16(msg, 1);
1099         wpabuf_put_u8(msg, 1);
1100         return 0;
1101 }
1102
1103
1104 static int wps_build_cred_ssid(struct wpabuf *msg,
1105                                const struct wps_credential *cred)
1106 {
1107         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
1108         wpabuf_put_be16(msg, ATTR_SSID);
1109         wpabuf_put_be16(msg, cred->ssid_len);
1110         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
1111         return 0;
1112 }
1113
1114
1115 static int wps_build_cred_auth_type(struct wpabuf *msg,
1116                                     const struct wps_credential *cred)
1117 {
1118         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
1119                    cred->auth_type);
1120         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
1121         wpabuf_put_be16(msg, 2);
1122         wpabuf_put_be16(msg, cred->auth_type);
1123         return 0;
1124 }
1125
1126
1127 static int wps_build_cred_encr_type(struct wpabuf *msg,
1128                                     const struct wps_credential *cred)
1129 {
1130         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
1131                    cred->encr_type);
1132         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
1133         wpabuf_put_be16(msg, 2);
1134         wpabuf_put_be16(msg, cred->encr_type);
1135         return 0;
1136 }
1137
1138
1139 static int wps_build_cred_network_key(struct wpabuf *msg,
1140                                       const struct wps_credential *cred)
1141 {
1142         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
1143         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
1144         wpabuf_put_be16(msg, cred->key_len);
1145         wpabuf_put_data(msg, cred->key, cred->key_len);
1146         return 0;
1147 }
1148
1149
1150 static int wps_build_cred_mac_addr(struct wpabuf *msg,
1151                                    const struct wps_credential *cred)
1152 {
1153         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address (" MACSTR ")",
1154                    MAC2STR(cred->mac_addr));
1155         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
1156         wpabuf_put_be16(msg, ETH_ALEN);
1157         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
1158         return 0;
1159 }
1160
1161
1162 static int wps_build_credential(struct wpabuf *msg,
1163                                 const struct wps_credential *cred)
1164 {
1165         if (wps_build_cred_network_idx(msg, cred) ||
1166             wps_build_cred_ssid(msg, cred) ||
1167             wps_build_cred_auth_type(msg, cred) ||
1168             wps_build_cred_encr_type(msg, cred) ||
1169             wps_build_cred_network_key(msg, cred) ||
1170             wps_build_cred_mac_addr(msg, cred))
1171                 return -1;
1172         return 0;
1173 }
1174
1175
1176 int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
1177 {
1178         struct wpabuf *cred;
1179
1180         if (wps->wps->registrar->skip_cred_build)
1181                 goto skip_cred_build;
1182
1183         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
1184         if (wps->use_cred) {
1185                 os_memcpy(&wps->cred, wps->use_cred, sizeof(wps->cred));
1186                 goto use_provided;
1187         }
1188         os_memset(&wps->cred, 0, sizeof(wps->cred));
1189
1190         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
1191         wps->cred.ssid_len = wps->wps->ssid_len;
1192
1193         /* Select the best authentication and encryption type */
1194         if (wps->auth_type & WPS_AUTH_WPA2PSK)
1195                 wps->auth_type = WPS_AUTH_WPA2PSK;
1196         else if (wps->auth_type & WPS_AUTH_WPAPSK)
1197                 wps->auth_type = WPS_AUTH_WPAPSK;
1198         else if (wps->auth_type & WPS_AUTH_OPEN)
1199                 wps->auth_type = WPS_AUTH_OPEN;
1200         else if (wps->auth_type & WPS_AUTH_SHARED)
1201                 wps->auth_type = WPS_AUTH_SHARED;
1202         else {
1203                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
1204                            wps->auth_type);
1205                 return -1;
1206         }
1207         wps->cred.auth_type = wps->auth_type;
1208
1209         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
1210             wps->auth_type == WPS_AUTH_WPAPSK) {
1211                 if (wps->encr_type & WPS_ENCR_AES)
1212                         wps->encr_type = WPS_ENCR_AES;
1213                 else if (wps->encr_type & WPS_ENCR_TKIP)
1214                         wps->encr_type = WPS_ENCR_TKIP;
1215                 else {
1216                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1217                                    "type for WPA/WPA2");
1218                         return -1;
1219                 }
1220         } else {
1221                 if (wps->encr_type & WPS_ENCR_WEP)
1222                         wps->encr_type = WPS_ENCR_WEP;
1223                 else if (wps->encr_type & WPS_ENCR_NONE)
1224                         wps->encr_type = WPS_ENCR_NONE;
1225                 else {
1226                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1227                                    "type for non-WPA/WPA2 mode");
1228                         return -1;
1229                 }
1230         }
1231         wps->cred.encr_type = wps->encr_type;
1232         /*
1233          * Set MAC address in the Credential to be the Enrollee's MAC address
1234          */
1235         os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
1236
1237         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap &&
1238             !wps->wps->registrar->disable_auto_conf) {
1239                 u8 r[16];
1240                 /* Generate a random passphrase */
1241                 if (os_get_random(r, sizeof(r)) < 0)
1242                         return -1;
1243                 os_free(wps->new_psk);
1244                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
1245                 if (wps->new_psk == NULL)
1246                         return -1;
1247                 wps->new_psk_len--; /* remove newline */
1248                 while (wps->new_psk_len &&
1249                        wps->new_psk[wps->new_psk_len - 1] == '=')
1250                         wps->new_psk_len--;
1251                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
1252                                       wps->new_psk, wps->new_psk_len);
1253                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
1254                 wps->cred.key_len = wps->new_psk_len;
1255         } else if (wps->wps->network_key) {
1256                 os_memcpy(wps->cred.key, wps->wps->network_key,
1257                           wps->wps->network_key_len);
1258                 wps->cred.key_len = wps->wps->network_key_len;
1259         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
1260                 char hex[65];
1261                 /* Generate a random per-device PSK */
1262                 os_free(wps->new_psk);
1263                 wps->new_psk_len = 32;
1264                 wps->new_psk = os_malloc(wps->new_psk_len);
1265                 if (wps->new_psk == NULL)
1266                         return -1;
1267                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
1268                         os_free(wps->new_psk);
1269                         wps->new_psk = NULL;
1270                         return -1;
1271                 }
1272                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1273                                 wps->new_psk, wps->new_psk_len);
1274                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
1275                                  wps->new_psk_len);
1276                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1277                 wps->cred.key_len = wps->new_psk_len * 2;
1278         }
1279
1280 use_provided:
1281         cred = wpabuf_alloc(200);
1282         if (cred == NULL)
1283                 return -1;
1284
1285         if (wps_build_credential(cred, &wps->cred)) {
1286                 wpabuf_free(cred);
1287                 return -1;
1288         }
1289
1290         wpabuf_put_be16(msg, ATTR_CRED);
1291         wpabuf_put_be16(msg, wpabuf_len(cred));
1292         wpabuf_put_buf(msg, cred);
1293         wpabuf_free(cred);
1294
1295 skip_cred_build:
1296         if (wps->wps->registrar->extra_cred) {
1297                 wpa_printf(MSG_DEBUG, "WPS:  * Credential (pre-configured)");
1298                 wpabuf_put_buf(msg, wps->wps->registrar->extra_cred);
1299         }
1300
1301         return 0;
1302 }
1303
1304
1305 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1306 {
1307         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
1308
1309         if (wps_build_credential(msg, &wps->cred))
1310                 return -1;
1311
1312         return 0;
1313 }
1314
1315
1316 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1317 {
1318         struct wpabuf *msg;
1319
1320         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
1321                 return NULL;
1322         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1323                     wps->nonce_r, WPS_NONCE_LEN);
1324         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1325
1326         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1327         msg = wpabuf_alloc(1000);
1328         if (msg == NULL)
1329                 return NULL;
1330
1331         if (wps_build_version(msg) ||
1332             wps_build_msg_type(msg, WPS_M2) ||
1333             wps_build_enrollee_nonce(wps, msg) ||
1334             wps_build_registrar_nonce(wps, msg) ||
1335             wps_build_uuid_r(wps, msg) ||
1336             wps_build_public_key(wps, msg) ||
1337             wps_derive_keys(wps) ||
1338             wps_build_auth_type_flags(wps, msg) ||
1339             wps_build_encr_type_flags(wps, msg) ||
1340             wps_build_conn_type_flags(wps, msg) ||
1341             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1342             wps_build_device_attrs(&wps->wps->dev, msg) ||
1343             wps_build_rf_bands(&wps->wps->dev, msg) ||
1344             wps_build_assoc_state(wps, msg) ||
1345             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1346             wps_build_dev_password_id(msg, wps->dev_pw_id) ||
1347             wps_build_os_version(&wps->wps->dev, msg) ||
1348             wps_build_authenticator(wps, msg)) {
1349                 wpabuf_free(msg);
1350                 return NULL;
1351         }
1352
1353         wps->state = RECV_M3;
1354         return msg;
1355 }
1356
1357
1358 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1359 {
1360         struct wpabuf *msg;
1361         u16 err = wps->config_error;
1362
1363         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1364         msg = wpabuf_alloc(1000);
1365         if (msg == NULL)
1366                 return NULL;
1367
1368         if (wps->wps->ap && wps->wps->ap_setup_locked &&
1369             err == WPS_CFG_NO_ERROR)
1370                 err = WPS_CFG_SETUP_LOCKED;
1371
1372         if (wps_build_version(msg) ||
1373             wps_build_msg_type(msg, WPS_M2D) ||
1374             wps_build_enrollee_nonce(wps, msg) ||
1375             wps_build_registrar_nonce(wps, msg) ||
1376             wps_build_uuid_r(wps, msg) ||
1377             wps_build_auth_type_flags(wps, msg) ||
1378             wps_build_encr_type_flags(wps, msg) ||
1379             wps_build_conn_type_flags(wps, msg) ||
1380             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1381             wps_build_device_attrs(&wps->wps->dev, msg) ||
1382             wps_build_rf_bands(&wps->wps->dev, msg) ||
1383             wps_build_assoc_state(wps, msg) ||
1384             wps_build_config_error(msg, err) ||
1385             wps_build_os_version(&wps->wps->dev, msg)) {
1386                 wpabuf_free(msg);
1387                 return NULL;
1388         }
1389
1390         wps->state = RECV_M2D_ACK;
1391         return msg;
1392 }
1393
1394
1395 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1396 {
1397         struct wpabuf *msg, *plain;
1398
1399         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1400
1401         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1402
1403         plain = wpabuf_alloc(200);
1404         if (plain == NULL)
1405                 return NULL;
1406
1407         msg = wpabuf_alloc(1000);
1408         if (msg == NULL) {
1409                 wpabuf_free(plain);
1410                 return NULL;
1411         }
1412
1413         if (wps_build_version(msg) ||
1414             wps_build_msg_type(msg, WPS_M4) ||
1415             wps_build_enrollee_nonce(wps, msg) ||
1416             wps_build_r_hash(wps, msg) ||
1417             wps_build_r_snonce1(wps, plain) ||
1418             wps_build_key_wrap_auth(wps, plain) ||
1419             wps_build_encr_settings(wps, msg, plain) ||
1420             wps_build_authenticator(wps, msg)) {
1421                 wpabuf_free(plain);
1422                 wpabuf_free(msg);
1423                 return NULL;
1424         }
1425         wpabuf_free(plain);
1426
1427         wps->state = RECV_M5;
1428         return msg;
1429 }
1430
1431
1432 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1433 {
1434         struct wpabuf *msg, *plain;
1435
1436         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1437
1438         plain = wpabuf_alloc(200);
1439         if (plain == NULL)
1440                 return NULL;
1441
1442         msg = wpabuf_alloc(1000);
1443         if (msg == NULL) {
1444                 wpabuf_free(plain);
1445                 return NULL;
1446         }
1447
1448         if (wps_build_version(msg) ||
1449             wps_build_msg_type(msg, WPS_M6) ||
1450             wps_build_enrollee_nonce(wps, msg) ||
1451             wps_build_r_snonce2(wps, plain) ||
1452             wps_build_key_wrap_auth(wps, plain) ||
1453             wps_build_encr_settings(wps, msg, plain) ||
1454             wps_build_authenticator(wps, msg)) {
1455                 wpabuf_free(plain);
1456                 wpabuf_free(msg);
1457                 return NULL;
1458         }
1459         wpabuf_free(plain);
1460
1461         wps->wps_pin_revealed = 1;
1462         wps->state = RECV_M7;
1463         return msg;
1464 }
1465
1466
1467 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1468 {
1469         struct wpabuf *msg, *plain;
1470
1471         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1472
1473         plain = wpabuf_alloc(500);
1474         if (plain == NULL)
1475                 return NULL;
1476
1477         msg = wpabuf_alloc(1000);
1478         if (msg == NULL) {
1479                 wpabuf_free(plain);
1480                 return NULL;
1481         }
1482
1483         if (wps_build_version(msg) ||
1484             wps_build_msg_type(msg, WPS_M8) ||
1485             wps_build_enrollee_nonce(wps, msg) ||
1486             ((wps->wps->ap || wps->er) && wps_build_cred(wps, plain)) ||
1487             (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) ||
1488             wps_build_key_wrap_auth(wps, plain) ||
1489             wps_build_encr_settings(wps, msg, plain) ||
1490             wps_build_authenticator(wps, msg)) {
1491                 wpabuf_free(plain);
1492                 wpabuf_free(msg);
1493                 return NULL;
1494         }
1495         wpabuf_free(plain);
1496
1497         wps->state = RECV_DONE;
1498         return msg;
1499 }
1500
1501
1502 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1503 {
1504         struct wpabuf *msg;
1505
1506         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1507
1508         msg = wpabuf_alloc(1000);
1509         if (msg == NULL)
1510                 return NULL;
1511
1512         if (wps_build_version(msg) ||
1513             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1514             wps_build_enrollee_nonce(wps, msg) ||
1515             wps_build_registrar_nonce(wps, msg)) {
1516                 wpabuf_free(msg);
1517                 return NULL;
1518         }
1519
1520         return msg;
1521 }
1522
1523
1524 static struct wpabuf * wps_build_wsc_nack(struct wps_data *wps)
1525 {
1526         struct wpabuf *msg;
1527
1528         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_NACK");
1529
1530         msg = wpabuf_alloc(1000);
1531         if (msg == NULL)
1532                 return NULL;
1533
1534         if (wps_build_version(msg) ||
1535             wps_build_msg_type(msg, WPS_WSC_NACK) ||
1536             wps_build_enrollee_nonce(wps, msg) ||
1537             wps_build_registrar_nonce(wps, msg) ||
1538             wps_build_config_error(msg, wps->config_error)) {
1539                 wpabuf_free(msg);
1540                 return NULL;
1541         }
1542
1543         return msg;
1544 }
1545
1546
1547 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1548                                       enum wsc_op_code *op_code)
1549 {
1550         struct wpabuf *msg;
1551
1552 #ifdef CONFIG_WPS_UPNP
1553         if (wps->wps->wps_upnp) {
1554                 struct upnp_pending_message *p, *prev = NULL;
1555                 if (wps->ext_reg > 1)
1556                         wps_registrar_free_pending_m2(wps->wps);
1557                 p = wps->wps->upnp_msgs;
1558                 /* TODO: check pending message MAC address */
1559                 while (p && p->next) {
1560                         prev = p;
1561                         p = p->next;
1562                 }
1563                 if (p) {
1564                         wpa_printf(MSG_DEBUG, "WPS: Use pending message from "
1565                                    "UPnP");
1566                         if (prev)
1567                                 prev->next = NULL;
1568                         else
1569                                 wps->wps->upnp_msgs = NULL;
1570                         msg = p->msg;
1571                         switch (p->type) {
1572                         case WPS_WSC_ACK:
1573                                 *op_code = WSC_ACK;
1574                                 break;
1575                         case WPS_WSC_NACK:
1576                                 *op_code = WSC_NACK;
1577                                 break;
1578                         default:
1579                                 *op_code = WSC_MSG;
1580                                 break;
1581                         }
1582                         os_free(p);
1583                         if (wps->ext_reg == 0)
1584                                 wps->ext_reg = 1;
1585                         return msg;
1586                 }
1587         }
1588         if (wps->ext_reg) {
1589                 wpa_printf(MSG_DEBUG, "WPS: Using external Registrar, but no "
1590                            "pending message available");
1591                 return NULL;
1592         }
1593 #endif /* CONFIG_WPS_UPNP */
1594
1595         switch (wps->state) {
1596         case SEND_M2:
1597                 if (wps_get_dev_password(wps) < 0)
1598                         msg = wps_build_m2d(wps);
1599                 else
1600                         msg = wps_build_m2(wps);
1601                 *op_code = WSC_MSG;
1602                 break;
1603         case SEND_M2D:
1604                 msg = wps_build_m2d(wps);
1605                 *op_code = WSC_MSG;
1606                 break;
1607         case SEND_M4:
1608                 msg = wps_build_m4(wps);
1609                 *op_code = WSC_MSG;
1610                 break;
1611         case SEND_M6:
1612                 msg = wps_build_m6(wps);
1613                 *op_code = WSC_MSG;
1614                 break;
1615         case SEND_M8:
1616                 msg = wps_build_m8(wps);
1617                 *op_code = WSC_MSG;
1618                 break;
1619         case RECV_DONE:
1620                 msg = wps_build_wsc_ack(wps);
1621                 *op_code = WSC_ACK;
1622                 break;
1623         case SEND_WSC_NACK:
1624                 msg = wps_build_wsc_nack(wps);
1625                 *op_code = WSC_NACK;
1626                 break;
1627         default:
1628                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1629                            "a message", wps->state);
1630                 msg = NULL;
1631                 break;
1632         }
1633
1634         if (*op_code == WSC_MSG && msg) {
1635                 /* Save a copy of the last message for Authenticator derivation
1636                  */
1637                 wpabuf_free(wps->last_msg);
1638                 wps->last_msg = wpabuf_dup(msg);
1639         }
1640
1641         return msg;
1642 }
1643
1644
1645 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1646 {
1647         if (e_nonce == NULL) {
1648                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1649                 return -1;
1650         }
1651
1652         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1653         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1654                     wps->nonce_e, WPS_NONCE_LEN);
1655
1656         return 0;
1657 }
1658
1659
1660 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1661 {
1662         if (r_nonce == NULL) {
1663                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1664                 return -1;
1665         }
1666
1667         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1668                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1669                 return -1;
1670         }
1671
1672         return 0;
1673 }
1674
1675
1676 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1677 {
1678         if (uuid_e == NULL) {
1679                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1680                 return -1;
1681         }
1682
1683         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1684         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1685
1686         return 0;
1687 }
1688
1689
1690 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1691 {
1692         if (pw_id == NULL) {
1693                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1694                 return -1;
1695         }
1696
1697         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1698         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1699
1700         return 0;
1701 }
1702
1703
1704 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1705 {
1706         if (e_hash1 == NULL) {
1707                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1708                 return -1;
1709         }
1710
1711         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1712         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1713
1714         return 0;
1715 }
1716
1717
1718 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1719 {
1720         if (e_hash2 == NULL) {
1721                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1722                 return -1;
1723         }
1724
1725         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1726         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1727
1728         return 0;
1729 }
1730
1731
1732 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1733 {
1734         u8 hash[SHA256_MAC_LEN];
1735         const u8 *addr[4];
1736         size_t len[4];
1737
1738         if (e_snonce1 == NULL) {
1739                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1740                 return -1;
1741         }
1742
1743         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1744                         WPS_SECRET_NONCE_LEN);
1745
1746         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1747         addr[0] = e_snonce1;
1748         len[0] = WPS_SECRET_NONCE_LEN;
1749         addr[1] = wps->psk1;
1750         len[1] = WPS_PSK_LEN;
1751         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1752         len[2] = wpabuf_len(wps->dh_pubkey_e);
1753         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1754         len[3] = wpabuf_len(wps->dh_pubkey_r);
1755         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1756
1757         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1758                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1759                            "not match with the pre-committed value");
1760                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1761                 wps_pwd_auth_fail_event(wps->wps, 0, 1);
1762                 return -1;
1763         }
1764
1765         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1766                    "half of the device password");
1767
1768         return 0;
1769 }
1770
1771
1772 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1773 {
1774         u8 hash[SHA256_MAC_LEN];
1775         const u8 *addr[4];
1776         size_t len[4];
1777
1778         if (e_snonce2 == NULL) {
1779                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1780                 return -1;
1781         }
1782
1783         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1784                         WPS_SECRET_NONCE_LEN);
1785
1786         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1787         addr[0] = e_snonce2;
1788         len[0] = WPS_SECRET_NONCE_LEN;
1789         addr[1] = wps->psk2;
1790         len[1] = WPS_PSK_LEN;
1791         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1792         len[2] = wpabuf_len(wps->dh_pubkey_e);
1793         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1794         len[3] = wpabuf_len(wps->dh_pubkey_r);
1795         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1796
1797         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1798                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1799                            "not match with the pre-committed value");
1800                 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
1801                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1802                 wps_pwd_auth_fail_event(wps->wps, 0, 2);
1803                 return -1;
1804         }
1805
1806         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1807                    "half of the device password");
1808         wps->wps_pin_revealed = 0;
1809         wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
1810
1811         return 0;
1812 }
1813
1814
1815 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1816 {
1817         if (mac_addr == NULL) {
1818                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1819                 return -1;
1820         }
1821
1822         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1823                    MAC2STR(mac_addr));
1824         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1825         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1826
1827         return 0;
1828 }
1829
1830
1831 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1832                               size_t pk_len)
1833 {
1834         if (pk == NULL || pk_len == 0) {
1835                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1836                 return -1;
1837         }
1838
1839 #ifdef CONFIG_WPS_OOB
1840         if (wps->wps->oob_conf.pubkey_hash != NULL) {
1841                 const u8 *addr[1];
1842                 u8 hash[WPS_HASH_LEN];
1843
1844                 addr[0] = pk;
1845                 sha256_vector(1, addr, &pk_len, hash);
1846                 if (os_memcmp(hash,
1847                               wpabuf_head(wps->wps->oob_conf.pubkey_hash),
1848                               WPS_OOB_PUBKEY_HASH_LEN) != 0) {
1849                         wpa_printf(MSG_ERROR, "WPS: Public Key hash error");
1850                         return -1;
1851                 }
1852         }
1853 #endif /* CONFIG_WPS_OOB */
1854
1855         wpabuf_free(wps->dh_pubkey_e);
1856         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1857         if (wps->dh_pubkey_e == NULL)
1858                 return -1;
1859
1860         return 0;
1861 }
1862
1863
1864 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1865 {
1866         u16 auth_types;
1867
1868         if (auth == NULL) {
1869                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1870                            "received");
1871                 return -1;
1872         }
1873
1874         auth_types = WPA_GET_BE16(auth);
1875
1876         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1877                    auth_types);
1878         wps->auth_type = wps->wps->auth_types & auth_types;
1879         if (wps->auth_type == 0) {
1880                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1881                            "authentication types (own 0x%x Enrollee 0x%x)",
1882                            wps->wps->auth_types, auth_types);
1883 #ifdef WPS_WORKAROUNDS
1884                 /*
1885                  * Some deployed implementations seem to advertise incorrect
1886                  * information in this attribute. For example, Linksys WRT350N
1887                  * seems to have a byteorder bug that breaks this negotiation.
1888                  * In order to interoperate with existing implementations,
1889                  * assume that the Enrollee supports everything we do.
1890                  */
1891                 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
1892                            "does not advertise supported authentication types "
1893                            "correctly");
1894                 wps->auth_type = wps->wps->auth_types;
1895 #else /* WPS_WORKAROUNDS */
1896                 return -1;
1897 #endif /* WPS_WORKAROUNDS */
1898         }
1899
1900         return 0;
1901 }
1902
1903
1904 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1905 {
1906         u16 encr_types;
1907
1908         if (encr == NULL) {
1909                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1910                            "received");
1911                 return -1;
1912         }
1913
1914         encr_types = WPA_GET_BE16(encr);
1915
1916         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1917                    encr_types);
1918         wps->encr_type = wps->wps->encr_types & encr_types;
1919         if (wps->encr_type == 0) {
1920                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1921                            "encryption types (own 0x%x Enrollee 0x%x)",
1922                            wps->wps->encr_types, encr_types);
1923 #ifdef WPS_WORKAROUNDS
1924                 /*
1925                  * Some deployed implementations seem to advertise incorrect
1926                  * information in this attribute. For example, Linksys WRT350N
1927                  * seems to have a byteorder bug that breaks this negotiation.
1928                  * In order to interoperate with existing implementations,
1929                  * assume that the Enrollee supports everything we do.
1930                  */
1931                 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
1932                            "does not advertise supported encryption types "
1933                            "correctly");
1934                 wps->encr_type = wps->wps->encr_types;
1935 #else /* WPS_WORKAROUNDS */
1936                 return -1;
1937 #endif /* WPS_WORKAROUNDS */
1938         }
1939
1940         return 0;
1941 }
1942
1943
1944 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1945 {
1946         if (conn == NULL) {
1947                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1948                            "received");
1949                 return -1;
1950         }
1951
1952         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1953                    *conn);
1954
1955         return 0;
1956 }
1957
1958
1959 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1960 {
1961         u16 m;
1962
1963         if (methods == NULL) {
1964                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1965                 return -1;
1966         }
1967
1968         m = WPA_GET_BE16(methods);
1969
1970         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1971
1972         return 0;
1973 }
1974
1975
1976 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1977 {
1978         if (state == NULL) {
1979                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1980                            "received");
1981                 return -1;
1982         }
1983
1984         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1985                    *state);
1986
1987         return 0;
1988 }
1989
1990
1991 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1992 {
1993         u16 a;
1994
1995         if (assoc == NULL) {
1996                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1997                 return -1;
1998         }
1999
2000         a = WPA_GET_BE16(assoc);
2001         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
2002
2003         return 0;
2004 }
2005
2006
2007 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
2008 {
2009         u16 e;
2010
2011         if (err == NULL) {
2012                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
2013                 return -1;
2014         }
2015
2016         e = WPA_GET_BE16(err);
2017         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
2018
2019         return 0;
2020 }
2021
2022
2023 static enum wps_process_res wps_process_m1(struct wps_data *wps,
2024                                            struct wps_parse_attr *attr)
2025 {
2026         wpa_printf(MSG_DEBUG, "WPS: Received M1");
2027
2028         if (wps->state != RECV_M1) {
2029                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2030                            "receiving M1", wps->state);
2031                 return WPS_FAILURE;
2032         }
2033
2034         if (wps_process_uuid_e(wps, attr->uuid_e) ||
2035             wps_process_mac_addr(wps, attr->mac_addr) ||
2036             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
2037             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
2038             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
2039             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
2040             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
2041             wps_process_config_methods(wps, attr->config_methods) ||
2042             wps_process_wps_state(wps, attr->wps_state) ||
2043             wps_process_device_attrs(&wps->peer_dev, attr) ||
2044             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
2045             wps_process_assoc_state(wps, attr->assoc_state) ||
2046             wps_process_dev_password_id(wps, attr->dev_password_id) ||
2047             wps_process_config_error(wps, attr->config_error) ||
2048             wps_process_os_version(&wps->peer_dev, attr->os_version))
2049                 return WPS_FAILURE;
2050
2051         if (wps->dev_pw_id < 0x10 &&
2052             wps->dev_pw_id != DEV_PW_DEFAULT &&
2053             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
2054             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
2055             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
2056             (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
2057              !wps->wps->registrar->pbc)) {
2058                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
2059                            wps->dev_pw_id);
2060                 wps->state = SEND_M2D;
2061                 return WPS_CONTINUE;
2062         }
2063
2064 #ifdef CONFIG_WPS_OOB
2065         if (wps->dev_pw_id >= 0x10 &&
2066             wps->dev_pw_id != wps->wps->oob_dev_pw_id) {
2067                 wpa_printf(MSG_DEBUG, "WPS: OOB Device Password ID "
2068                            "%d mismatch", wps->dev_pw_id);
2069                 wps->state = SEND_M2D;
2070                 return WPS_CONTINUE;
2071         }
2072 #endif /* CONFIG_WPS_OOB */
2073
2074         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
2075                 if (wps->wps->registrar->force_pbc_overlap ||
2076                     wps_registrar_pbc_overlap(wps->wps->registrar,
2077                                               wps->mac_addr_e, wps->uuid_e)) {
2078                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
2079                                    "negotiation");
2080                         wps->state = SEND_M2D;
2081                         wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2082                         wps_pbc_overlap_event(wps->wps);
2083                         wps->wps->registrar->force_pbc_overlap = 1;
2084                         return WPS_CONTINUE;
2085                 }
2086                 wps_registrar_add_pbc_session(wps->wps->registrar,
2087                                               wps->mac_addr_e, wps->uuid_e);
2088                 wps->pbc = 1;
2089         }
2090
2091         wps->state = SEND_M2;
2092         return WPS_CONTINUE;
2093 }
2094
2095
2096 static enum wps_process_res wps_process_m3(struct wps_data *wps,
2097                                            const struct wpabuf *msg,
2098                                            struct wps_parse_attr *attr)
2099 {
2100         wpa_printf(MSG_DEBUG, "WPS: Received M3");
2101
2102         if (wps->state != RECV_M3) {
2103                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2104                            "receiving M3", wps->state);
2105                 wps->state = SEND_WSC_NACK;
2106                 return WPS_CONTINUE;
2107         }
2108
2109         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2110                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2111                            "session overlap");
2112                 wps->state = SEND_WSC_NACK;
2113                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2114                 return WPS_CONTINUE;
2115         }
2116
2117         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2118             wps_process_authenticator(wps, attr->authenticator, msg) ||
2119             wps_process_e_hash1(wps, attr->e_hash1) ||
2120             wps_process_e_hash2(wps, attr->e_hash2)) {
2121                 wps->state = SEND_WSC_NACK;
2122                 return WPS_CONTINUE;
2123         }
2124
2125         wps->state = SEND_M4;
2126         return WPS_CONTINUE;
2127 }
2128
2129
2130 static enum wps_process_res wps_process_m5(struct wps_data *wps,
2131                                            const struct wpabuf *msg,
2132                                            struct wps_parse_attr *attr)
2133 {
2134         struct wpabuf *decrypted;
2135         struct wps_parse_attr eattr;
2136
2137         wpa_printf(MSG_DEBUG, "WPS: Received M5");
2138
2139         if (wps->state != RECV_M5) {
2140                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2141                            "receiving M5", wps->state);
2142                 wps->state = SEND_WSC_NACK;
2143                 return WPS_CONTINUE;
2144         }
2145
2146         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2147                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2148                            "session overlap");
2149                 wps->state = SEND_WSC_NACK;
2150                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2151                 return WPS_CONTINUE;
2152         }
2153
2154         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2155             wps_process_authenticator(wps, attr->authenticator, msg)) {
2156                 wps->state = SEND_WSC_NACK;
2157                 return WPS_CONTINUE;
2158         }
2159
2160         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2161                                               attr->encr_settings_len);
2162         if (decrypted == NULL) {
2163                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
2164                            "Settings attribute");
2165                 wps->state = SEND_WSC_NACK;
2166                 return WPS_CONTINUE;
2167         }
2168
2169         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2170                    "attribute");
2171         if (wps_parse_msg(decrypted, &eattr) < 0 ||
2172             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2173             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
2174                 wpabuf_free(decrypted);
2175                 wps->state = SEND_WSC_NACK;
2176                 return WPS_CONTINUE;
2177         }
2178         wpabuf_free(decrypted);
2179
2180         wps->state = SEND_M6;
2181         return WPS_CONTINUE;
2182 }
2183
2184
2185 static void wps_sta_cred_cb(struct wps_data *wps)
2186 {
2187         /*
2188          * Update credential to only include a single authentication and
2189          * encryption type in case the AP configuration includes more than one
2190          * option.
2191          */
2192         if (wps->cred.auth_type & WPS_AUTH_WPA2PSK)
2193                 wps->cred.auth_type = WPS_AUTH_WPA2PSK;
2194         else if (wps->cred.auth_type & WPS_AUTH_WPAPSK)
2195                 wps->cred.auth_type = WPS_AUTH_WPAPSK;
2196         if (wps->cred.encr_type & WPS_ENCR_AES)
2197                 wps->cred.encr_type = WPS_ENCR_AES;
2198         else if (wps->cred.encr_type & WPS_ENCR_TKIP)
2199                 wps->cred.encr_type = WPS_ENCR_TKIP;
2200         wpa_printf(MSG_DEBUG, "WPS: Update local configuration based on the "
2201                    "AP configuration");
2202         if (wps->wps->cred_cb)
2203                 wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2204 }
2205
2206
2207 static void wps_cred_update(struct wps_credential *dst,
2208                             struct wps_credential *src)
2209 {
2210         os_memcpy(dst->ssid, src->ssid, sizeof(dst->ssid));
2211         dst->ssid_len = src->ssid_len;
2212         dst->auth_type = src->auth_type;
2213         dst->encr_type = src->encr_type;
2214         dst->key_idx = src->key_idx;
2215         os_memcpy(dst->key, src->key, sizeof(dst->key));
2216         dst->key_len = src->key_len;
2217 }
2218
2219
2220 static int wps_process_ap_settings_r(struct wps_data *wps,
2221                                      struct wps_parse_attr *attr)
2222 {
2223         if (wps->wps->ap || wps->er)
2224                 return 0;
2225
2226         /* AP Settings Attributes in M7 when Enrollee is an AP */
2227         if (wps_process_ap_settings(attr, &wps->cred) < 0)
2228                 return -1;
2229
2230         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
2231
2232         if (wps->new_ap_settings) {
2233                 wpa_printf(MSG_INFO, "WPS: Update AP configuration based on "
2234                            "new settings");
2235                 wps_cred_update(&wps->cred, wps->new_ap_settings);
2236                 return 0;
2237         } else {
2238                 /*
2239                  * Use the AP PIN only to receive the current AP settings, not
2240                  * to reconfigure the AP.
2241                  */
2242                 if (wps->ap_settings_cb) {
2243                         wps->ap_settings_cb(wps->ap_settings_cb_ctx,
2244                                             &wps->cred);
2245                         return 1;
2246                 }
2247                 wps_sta_cred_cb(wps);
2248                 return 1;
2249         }
2250 }
2251
2252
2253 static enum wps_process_res wps_process_m7(struct wps_data *wps,
2254                                            const struct wpabuf *msg,
2255                                            struct wps_parse_attr *attr)
2256 {
2257         struct wpabuf *decrypted;
2258         struct wps_parse_attr eattr;
2259
2260         wpa_printf(MSG_DEBUG, "WPS: Received M7");
2261
2262         if (wps->state != RECV_M7) {
2263                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2264                            "receiving M7", wps->state);
2265                 wps->state = SEND_WSC_NACK;
2266                 return WPS_CONTINUE;
2267         }
2268
2269         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2270                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2271                            "session overlap");
2272                 wps->state = SEND_WSC_NACK;
2273                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2274                 return WPS_CONTINUE;
2275         }
2276
2277         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2278             wps_process_authenticator(wps, attr->authenticator, msg)) {
2279                 wps->state = SEND_WSC_NACK;
2280                 return WPS_CONTINUE;
2281         }
2282
2283         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2284                                               attr->encr_settings_len);
2285         if (decrypted == NULL) {
2286                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypt Encrypted "
2287                            "Settings attribute");
2288                 wps->state = SEND_WSC_NACK;
2289                 return WPS_CONTINUE;
2290         }
2291
2292         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2293                    "attribute");
2294         if (wps_parse_msg(decrypted, &eattr) < 0 ||
2295             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2296             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
2297             wps_process_ap_settings_r(wps, &eattr)) {
2298                 wpabuf_free(decrypted);
2299                 wps->state = SEND_WSC_NACK;
2300                 return WPS_CONTINUE;
2301         }
2302
2303         wpabuf_free(decrypted);
2304
2305         wps->state = SEND_M8;
2306         return WPS_CONTINUE;
2307 }
2308
2309
2310 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
2311                                                 const struct wpabuf *msg)
2312 {
2313         struct wps_parse_attr attr;
2314         enum wps_process_res ret = WPS_CONTINUE;
2315
2316         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
2317
2318         if (wps_parse_msg(msg, &attr) < 0)
2319                 return WPS_FAILURE;
2320
2321         if (!wps_version_supported(attr.version)) {
2322                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2323                            attr.version ? *attr.version : 0);
2324                 return WPS_FAILURE;
2325         }
2326
2327         if (attr.msg_type == NULL) {
2328                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2329                 return WPS_FAILURE;
2330         }
2331
2332         if (*attr.msg_type != WPS_M1 &&
2333             (attr.registrar_nonce == NULL ||
2334              os_memcmp(wps->nonce_r, attr.registrar_nonce,
2335                        WPS_NONCE_LEN != 0))) {
2336                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2337                 return WPS_FAILURE;
2338         }
2339
2340         switch (*attr.msg_type) {
2341         case WPS_M1:
2342 #ifdef CONFIG_WPS_UPNP
2343                 if (wps->wps->wps_upnp && attr.mac_addr) {
2344                         /* Remove old pending messages when starting new run */
2345                         wps_free_pending_msgs(wps->wps->upnp_msgs);
2346                         wps->wps->upnp_msgs = NULL;
2347
2348                         upnp_wps_device_send_wlan_event(
2349                                 wps->wps->wps_upnp, attr.mac_addr,
2350                                 UPNP_WPS_WLANEVENT_TYPE_EAP, msg);
2351                 }
2352 #endif /* CONFIG_WPS_UPNP */
2353                 ret = wps_process_m1(wps, &attr);
2354                 break;
2355         case WPS_M3:
2356                 ret = wps_process_m3(wps, msg, &attr);
2357                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2358                         wps_fail_event(wps->wps, WPS_M3);
2359                 break;
2360         case WPS_M5:
2361                 ret = wps_process_m5(wps, msg, &attr);
2362                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2363                         wps_fail_event(wps->wps, WPS_M5);
2364                 break;
2365         case WPS_M7:
2366                 ret = wps_process_m7(wps, msg, &attr);
2367                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2368                         wps_fail_event(wps->wps, WPS_M7);
2369                 break;
2370         default:
2371                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
2372                            *attr.msg_type);
2373                 return WPS_FAILURE;
2374         }
2375
2376         if (ret == WPS_CONTINUE) {
2377                 /* Save a copy of the last message for Authenticator derivation
2378                  */
2379                 wpabuf_free(wps->last_msg);
2380                 wps->last_msg = wpabuf_dup(msg);
2381         }
2382
2383         return ret;
2384 }
2385
2386
2387 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
2388                                                 const struct wpabuf *msg)
2389 {
2390         struct wps_parse_attr attr;
2391
2392         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
2393
2394         if (wps_parse_msg(msg, &attr) < 0)
2395                 return WPS_FAILURE;
2396
2397         if (!wps_version_supported(attr.version)) {
2398                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2399                            attr.version ? *attr.version : 0);
2400                 return WPS_FAILURE;
2401         }
2402
2403         if (attr.msg_type == NULL) {
2404                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2405                 return WPS_FAILURE;
2406         }
2407
2408         if (*attr.msg_type != WPS_WSC_ACK) {
2409                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2410                            *attr.msg_type);
2411                 return WPS_FAILURE;
2412         }
2413
2414 #ifdef CONFIG_WPS_UPNP
2415         if (wps->wps->wps_upnp && wps->ext_reg && wps->state == RECV_M2D_ACK &&
2416             upnp_wps_subscribers(wps->wps->wps_upnp)) {
2417                 if (wps->wps->upnp_msgs)
2418                         return WPS_CONTINUE;
2419                 wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2420                            "external Registrar");
2421                 return WPS_PENDING;
2422         }
2423 #endif /* CONFIG_WPS_UPNP */
2424
2425         if (attr.registrar_nonce == NULL ||
2426             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2427         {
2428                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2429                 return WPS_FAILURE;
2430         }
2431
2432         if (attr.enrollee_nonce == NULL ||
2433             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2434                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2435                 return WPS_FAILURE;
2436         }
2437
2438         if (wps->state == RECV_M2D_ACK) {
2439 #ifdef CONFIG_WPS_UPNP
2440                 if (wps->wps->wps_upnp &&
2441                     upnp_wps_subscribers(wps->wps->wps_upnp)) {
2442                         if (wps->wps->upnp_msgs)
2443                                 return WPS_CONTINUE;
2444                         if (wps->ext_reg == 0)
2445                                 wps->ext_reg = 1;
2446                         wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2447                                    "external Registrar");
2448                         return WPS_PENDING;
2449                 }
2450 #endif /* CONFIG_WPS_UPNP */
2451
2452                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
2453                            "terminate negotiation");
2454         }
2455
2456         return WPS_FAILURE;
2457 }
2458
2459
2460 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
2461                                                  const struct wpabuf *msg)
2462 {
2463         struct wps_parse_attr attr;
2464         int old_state;
2465
2466         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
2467
2468         old_state = wps->state;
2469         wps->state = SEND_WSC_NACK;
2470
2471         if (wps_parse_msg(msg, &attr) < 0)
2472                 return WPS_FAILURE;
2473
2474         if (!wps_version_supported(attr.version)) {
2475                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2476                            attr.version ? *attr.version : 0);
2477                 return WPS_FAILURE;
2478         }
2479
2480         if (attr.msg_type == NULL) {
2481                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2482                 return WPS_FAILURE;
2483         }
2484
2485         if (*attr.msg_type != WPS_WSC_NACK) {
2486                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2487                            *attr.msg_type);
2488                 return WPS_FAILURE;
2489         }
2490
2491 #ifdef CONFIG_WPS_UPNP
2492         if (wps->wps->wps_upnp && wps->ext_reg) {
2493                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2494                            "Registrar terminated by the Enrollee");
2495                 return WPS_FAILURE;
2496         }
2497 #endif /* CONFIG_WPS_UPNP */
2498
2499         if (attr.registrar_nonce == NULL ||
2500             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2501         {
2502                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2503                 return WPS_FAILURE;
2504         }
2505
2506         if (attr.enrollee_nonce == NULL ||
2507             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2508                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2509                 return WPS_FAILURE;
2510         }
2511
2512         if (attr.config_error == NULL) {
2513                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
2514                            "in WSC_NACK");
2515                 return WPS_FAILURE;
2516         }
2517
2518         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
2519                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
2520
2521         switch (old_state) {
2522         case RECV_M3:
2523                 wps_fail_event(wps->wps, WPS_M2);
2524                 break;
2525         case RECV_M5:
2526                 wps_fail_event(wps->wps, WPS_M4);
2527                 break;
2528         case RECV_M7:
2529                 wps_fail_event(wps->wps, WPS_M6);
2530                 break;
2531         case RECV_DONE:
2532                 wps_fail_event(wps->wps, WPS_M8);
2533                 break;
2534         default:
2535                 break;
2536         }
2537
2538         return WPS_FAILURE;
2539 }
2540
2541
2542 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
2543                                                  const struct wpabuf *msg)
2544 {
2545         struct wps_parse_attr attr;
2546
2547         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
2548
2549         if (wps->state != RECV_DONE &&
2550             (!wps->wps->wps_upnp || !wps->ext_reg)) {
2551                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2552                            "receiving WSC_Done", wps->state);
2553                 return WPS_FAILURE;
2554         }
2555
2556         if (wps_parse_msg(msg, &attr) < 0)
2557                 return WPS_FAILURE;
2558
2559         if (!wps_version_supported(attr.version)) {
2560                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2561                            attr.version ? *attr.version : 0);
2562                 return WPS_FAILURE;
2563         }
2564
2565         if (attr.msg_type == NULL) {
2566                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2567                 return WPS_FAILURE;
2568         }
2569
2570         if (*attr.msg_type != WPS_WSC_DONE) {
2571                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2572                            *attr.msg_type);
2573                 return WPS_FAILURE;
2574         }
2575
2576 #ifdef CONFIG_WPS_UPNP
2577         if (wps->wps->wps_upnp && wps->ext_reg) {
2578                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2579                            "Registrar completed successfully");
2580                 wps_device_store(wps->wps->registrar, &wps->peer_dev,
2581                                  wps->uuid_e);
2582                 return WPS_DONE;
2583         }
2584 #endif /* CONFIG_WPS_UPNP */
2585
2586         if (attr.registrar_nonce == NULL ||
2587             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2588         {
2589                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2590                 return WPS_FAILURE;
2591         }
2592
2593         if (attr.enrollee_nonce == NULL ||
2594             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2595                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2596                 return WPS_FAILURE;
2597         }
2598
2599         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
2600         wps_device_store(wps->wps->registrar, &wps->peer_dev,
2601                          wps->uuid_e);
2602
2603         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
2604             wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
2605                 struct wps_credential cred;
2606
2607                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
2608                            "on first Enrollee connection");
2609
2610                 os_memset(&cred, 0, sizeof(cred));
2611                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
2612                 cred.ssid_len = wps->wps->ssid_len;
2613                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
2614                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
2615                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
2616                 cred.key_len = wps->new_psk_len;
2617
2618                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
2619                 wpa_hexdump_ascii_key(MSG_DEBUG,
2620                                       "WPS: Generated random passphrase",
2621                                       wps->new_psk, wps->new_psk_len);
2622                 if (wps->wps->cred_cb)
2623                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
2624
2625                 os_free(wps->new_psk);
2626                 wps->new_psk = NULL;
2627         }
2628
2629         if (!wps->wps->ap && !wps->er)
2630                 wps_sta_cred_cb(wps);
2631
2632         if (wps->new_psk) {
2633                 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
2634                                    wps->new_psk, wps->new_psk_len)) {
2635                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
2636                                    "new PSK");
2637                 }
2638                 os_free(wps->new_psk);
2639                 wps->new_psk = NULL;
2640         }
2641
2642         wps_cb_reg_success(wps->wps->registrar, wps->mac_addr_e, wps->uuid_e);
2643
2644         if (wps->pbc) {
2645                 wps_registrar_remove_pbc_session(wps->wps->registrar,
2646                                                  wps->mac_addr_e, wps->uuid_e);
2647                 wps_registrar_pbc_completed(wps->wps->registrar);
2648         } else {
2649                 wps_registrar_pin_completed(wps->wps->registrar);
2650         }
2651
2652         wps_success_event(wps->wps);
2653
2654         return WPS_DONE;
2655 }
2656
2657
2658 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
2659                                                enum wsc_op_code op_code,
2660                                                const struct wpabuf *msg)
2661 {
2662         enum wps_process_res ret;
2663
2664         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2665                    "op_code=%d)",
2666                    (unsigned long) wpabuf_len(msg), op_code);
2667
2668 #ifdef CONFIG_WPS_UPNP
2669         if (wps->wps->wps_upnp && op_code == WSC_MSG && wps->ext_reg == 1) {
2670                 struct wps_parse_attr attr;
2671                 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type &&
2672                     *attr.msg_type == WPS_M3)
2673                         wps->ext_reg = 2; /* past M2/M2D phase */
2674         }
2675         if (wps->ext_reg > 1)
2676                 wps_registrar_free_pending_m2(wps->wps);
2677         if (wps->wps->wps_upnp && wps->ext_reg &&
2678             wps->wps->upnp_msgs == NULL &&
2679             (op_code == WSC_MSG || op_code == WSC_Done || op_code == WSC_NACK))
2680         {
2681                 struct wps_parse_attr attr;
2682                 int type;
2683                 if (wps_parse_msg(msg, &attr) < 0 || attr.msg_type == NULL)
2684                         type = -1;
2685                 else
2686                         type = *attr.msg_type;
2687                 wpa_printf(MSG_DEBUG, "WPS: Sending received message (type %d)"
2688                            " to external Registrar for processing", type);
2689                 upnp_wps_device_send_wlan_event(wps->wps->wps_upnp,
2690                                                 wps->mac_addr_e,
2691                                                 UPNP_WPS_WLANEVENT_TYPE_EAP,
2692                                                 msg);
2693                 if (op_code == WSC_MSG)
2694                         return WPS_PENDING;
2695         } else if (wps->wps->wps_upnp && wps->ext_reg && op_code == WSC_MSG) {
2696                 wpa_printf(MSG_DEBUG, "WPS: Skip internal processing - using "
2697                            "external Registrar");
2698                 return WPS_CONTINUE;
2699         }
2700 #endif /* CONFIG_WPS_UPNP */
2701
2702         switch (op_code) {
2703         case WSC_MSG:
2704                 return wps_process_wsc_msg(wps, msg);
2705         case WSC_ACK:
2706                 return wps_process_wsc_ack(wps, msg);
2707         case WSC_NACK:
2708                 return wps_process_wsc_nack(wps, msg);
2709         case WSC_Done:
2710                 ret = wps_process_wsc_done(wps, msg);
2711                 if (ret == WPS_FAILURE) {
2712                         wps->state = SEND_WSC_NACK;
2713                         wps_fail_event(wps->wps, WPS_WSC_DONE);
2714                 }
2715                 return ret;
2716         default:
2717                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
2718                 return WPS_FAILURE;
2719         }
2720 }
2721
2722
2723 int wps_registrar_update_ie(struct wps_registrar *reg)
2724 {
2725         return wps_set_ie(reg);
2726 }
2727
2728
2729 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
2730                                                void *timeout_ctx)
2731 {
2732         struct wps_registrar *reg = eloop_ctx;
2733
2734         wpa_printf(MSG_DEBUG, "WPS: SetSelectedRegistrar timed out - "
2735                    "unselect Registrar");
2736         reg->selected_registrar = 0;
2737         reg->pbc = 0;
2738         reg->sel_reg_dev_password_id_override = -1;
2739         reg->sel_reg_config_methods_override = -1;
2740         wps_set_ie(reg);
2741         wps_cb_set_sel_reg(reg);
2742 }
2743
2744
2745 /**
2746  * wps_registrar_set_selected_registrar - Notification of SetSelectedRegistrar
2747  * @reg: Registrar data from wps_registrar_init()
2748  * @msg: Received message from SetSelectedRegistrar
2749  * Returns: 0 on success, -1 on failure
2750  *
2751  * This function is called when an AP receives a SetSelectedRegistrar UPnP
2752  * message.
2753  */
2754 int wps_registrar_set_selected_registrar(struct wps_registrar *reg,
2755                                          const struct wpabuf *msg)
2756 {
2757         struct wps_parse_attr attr;
2758
2759         wpa_hexdump_buf(MSG_MSGDUMP, "WPS: SetSelectedRegistrar attributes",
2760                         msg);
2761
2762         if (wps_parse_msg(msg, &attr) < 0)
2763                 return -1;
2764         if (!wps_version_supported(attr.version)) {
2765                 wpa_printf(MSG_DEBUG, "WPS: Unsupported SetSelectedRegistrar "
2766                            "version 0x%x", attr.version ? *attr.version : 0);
2767                 return -1;
2768         }
2769
2770         if (attr.selected_registrar == NULL ||
2771             *attr.selected_registrar == 0) {
2772                 wpa_printf(MSG_DEBUG, "WPS: SetSelectedRegistrar: Disable "
2773                            "Selected Registrar");
2774                 eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg,
2775                                      NULL);
2776                 wps_registrar_set_selected_timeout(reg, NULL);
2777                 return 0;
2778         }
2779
2780         reg->selected_registrar = 1;
2781         reg->sel_reg_dev_password_id_override = attr.dev_password_id ?
2782                 WPA_GET_BE16(attr.dev_password_id) : DEV_PW_DEFAULT;
2783         reg->sel_reg_config_methods_override = attr.sel_reg_config_methods ?
2784                 WPA_GET_BE16(attr.sel_reg_config_methods) : -1;
2785         wps_set_ie(reg);
2786
2787         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
2788         eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
2789                                wps_registrar_set_selected_timeout,
2790                                reg, NULL);
2791         return 0;
2792 }
2793
2794
2795 int wps_registrar_get_info(struct wps_registrar *reg, const u8 *addr,
2796                            char *buf, size_t buflen)
2797 {
2798         struct wps_registrar_device *d;
2799         int len = 0, ret;
2800         char uuid[40];
2801         char devtype[WPS_DEV_TYPE_BUFSIZE];
2802
2803         d = wps_device_get(reg, addr);
2804         if (d == NULL)
2805                 return 0;
2806         if (uuid_bin2str(d->uuid, uuid, sizeof(uuid)))
2807                 return 0;
2808
2809         ret = os_snprintf(buf + len, buflen - len,
2810                           "wpsUuid=%s\n"
2811                           "wpsPrimaryDeviceType=%s\n"
2812                           "wpsDeviceName=%s\n"
2813                           "wpsManufacturer=%s\n"
2814                           "wpsModelName=%s\n"
2815                           "wpsModelNumber=%s\n"
2816                           "wpsSerialNumber=%s\n",
2817                           uuid,
2818                           wps_dev_type_bin2str(d->dev.pri_dev_type, devtype,
2819                                                sizeof(devtype)),
2820                           d->dev.device_name ? d->dev.device_name : "",
2821                           d->dev.manufacturer ? d->dev.manufacturer : "",
2822                           d->dev.model_name ? d->dev.model_name : "",
2823                           d->dev.model_number ? d->dev.model_number : "",
2824                           d->dev.serial_number ? d->dev.serial_number : "");
2825         if (ret < 0 || (size_t) ret >= buflen - len)
2826                 return len;
2827         len += ret;
2828
2829         return len;
2830 }