src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24
  25
  26 struct wps_uuid_pin {
  27         struct wps_uuid_pin *next;
  28         u8 uuid[WPS_UUID_LEN];
  29         int wildcard_uuid;
  30         u8 *pin;
  31         size_t pin_len;
  32         int locked;
  33 };
  34
  35
  36 static void wps_free_pin(struct wps_uuid_pin *pin)
  37 {
  38         os_free(pin->pin);
  39         os_free(pin);
  40 }
  41
  42
  43 static void wps_free_pins(struct wps_uuid_pin *pins)
  44 {
  45         struct wps_uuid_pin *pin, *prev;
  46
  47         pin = pins;
  48         while (pin) {
  49                 prev = pin;
  50                 pin = pin->next;
  51                 wps_free_pin(prev);
  52         }
  53 }
  54
  55
  56 struct wps_pbc_session {
  57         struct wps_pbc_session *next;
  58         u8 addr[ETH_ALEN];
  59         u8 uuid_e[WPS_UUID_LEN];
  60         struct os_time timestamp;
  61 };
  62
  63
  64 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  65 {
  66         struct wps_pbc_session *prev;
  67
  68         while (pbc) {
  69                 prev = pbc;
  70                 pbc = pbc->next;
  71                 os_free(prev);
  72         }
  73 }
  74
  75
  76 struct wps_registrar {
  77         struct wps_context *wps;
  78
  79         int pbc;
  80         int selected_registrar;
  81
  82         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  83                           size_t psk_len);
  84         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  85                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
  86         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
  87                               const struct wps_device_data *dev);
  88         void *cb_ctx;
  89
  90         struct wps_uuid_pin *pins;
  91         struct wps_pbc_session *pbc_sessions;
  92 };
  93
  94
  95 static int wps_set_ie(struct wps_registrar *reg);
  96 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
  97
  98
  99 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
 100                                           const u8 *addr, const u8 *uuid_e)
 101 {
 102         struct wps_pbc_session *pbc, *prev = NULL;
 103         struct os_time now;
 104
 105         os_get_time(&now);
 106
 107         pbc = reg->pbc_sessions;
 108         while (pbc) {
 109                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 110                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 111                         if (prev)
 112                                 prev->next = pbc->next;
 113                         else
 114                                 reg->pbc_sessions = pbc->next;
 115                         break;
 116                 }
 117                 prev = pbc;
 118                 pbc = pbc->next;
 119         }
 120
 121         if (!pbc) {
 122                 pbc = os_zalloc(sizeof(*pbc));
 123                 if (pbc == NULL)
 124                         return;
 125                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 126                 if (uuid_e)
 127                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 128         }
 129
 130         pbc->next = reg->pbc_sessions;
 131         reg->pbc_sessions = pbc;
 132         pbc->timestamp = now;
 133
 134         /* remove entries that have timed out */
 135         prev = pbc;
 136         pbc = pbc->next;
 137
 138         while (pbc) {
 139                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 140                         prev->next = NULL;
 141                         wps_free_pbc_sessions(pbc);
 142                         break;
 143                 }
 144                 prev = pbc;
 145                 pbc = pbc->next;
 146         }
 147 }
 148
 149
 150 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 151                                              const u8 *addr, const u8 *uuid_e)
 152 {
 153         struct wps_pbc_session *pbc, *prev = NULL;
 154
 155         pbc = reg->pbc_sessions;
 156         while (pbc) {
 157                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 158                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 159                         if (prev)
 160                                 prev->next = pbc->next;
 161                         else
 162                                 reg->pbc_sessions = pbc->next;
 163                         os_free(pbc);
 164                         break;
 165                 }
 166                 prev = pbc;
 167                 pbc = pbc->next;
 168         }
 169 }
 170
 171
 172 static int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 173                                      const u8 *addr, const u8 *uuid_e)
 174 {
 175         int count = 0;
 176         struct wps_pbc_session *pbc;
 177         struct os_time now;
 178
 179         os_get_time(&now);
 180
 181         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 182                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 183                         break;
 184                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 185                     uuid_e == NULL ||
 186                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 187                         count++;
 188         }
 189
 190         if (addr || uuid_e)
 191                 count++;
 192
 193         return count > 1 ? 1 : 0;
 194 }
 195
 196
 197 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 198 {
 199         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 200                    wps->wps_state);
 201         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 202         wpabuf_put_be16(msg, 1);
 203         wpabuf_put_u8(msg, wps->wps_state);
 204         return 0;
 205 }
 206
 207
 208 static int wps_build_ap_setup_locked(struct wps_context *wps,
 209                                      struct wpabuf *msg)
 210 {
 211         if (wps->ap_setup_locked) {
 212                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 213                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 214                 wpabuf_put_be16(msg, 1);
 215                 wpabuf_put_u8(msg, 1);
 216         }
 217         return 0;
 218 }
 219
 220
 221 static int wps_build_selected_registrar(struct wps_registrar *reg,
 222                                         struct wpabuf *msg)
 223 {
 224         if (!reg->selected_registrar)
 225                 return 0;
 226         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 227         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 228         wpabuf_put_be16(msg, 1);
 229         wpabuf_put_u8(msg, 1);
 230         return 0;
 231 }
 232
 233
 234 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 235                                              struct wpabuf *msg)
 236 {
 237         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 238         if (!reg->selected_registrar)
 239                 return 0;
 240         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 241         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 242         wpabuf_put_be16(msg, 2);
 243         wpabuf_put_be16(msg, id);
 244         return 0;
 245 }
 246
 247
 248 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 249                                             struct wpabuf *msg)
 250 {
 251         u16 methods;
 252         if (!reg->selected_registrar)
 253                 return 0;
 254         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 255         if (reg->pbc)
 256                 methods |= WPS_CONFIG_PUSHBUTTON;
 257         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 258                    methods);
 259         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 260         wpabuf_put_be16(msg, 2);
 261         wpabuf_put_be16(msg, methods);
 262         return 0;
 263 }
 264
 265
 266 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 267                                           struct wpabuf *msg)
 268 {
 269         u16 methods;
 270         methods = 0;
 271         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 272         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 273         wpabuf_put_be16(msg, 2);
 274         wpabuf_put_be16(msg, methods);
 275         return 0;
 276 }
 277
 278
 279 static int wps_build_config_methods_r(struct wps_registrar *reg,
 280                                       struct wpabuf *msg)
 281 {
 282         u16 methods;
 283         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 284         if (reg->pbc)
 285                 methods |= WPS_CONFIG_PUSHBUTTON;
 286         return wps_build_config_methods(msg, methods);
 287 }
 288
 289
 290 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 291 {
 292         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 293         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 294         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 295         wpabuf_put_be16(msg, 1);
 296         wpabuf_put_u8(msg, resp);
 297         return 0;
 298 }
 299
 300
 301 /**
 302  * wps_registrar_init - Initialize WPS Registrar data
 303  * @wps: Pointer to longterm WPS context
 304  * @cfg: Registrar configuration
 305  * Returns: Pointer to allocated Registrar data or %NULL on failure
 306  *
 307  * This function is used to initialize WPS Registrar functionality. It can be
 308  * used for a single Registrar run (e.g., when run in a supplicant) or multiple
 309  * runs (e.g., when run as an internal Registrar in an AP). Caller is
 310  * responsible for freeing the returned data with wps_registrar_deinit() when
 311  * Registrar functionality is not needed anymore.
 312  */
 313 struct wps_registrar *
 314 wps_registrar_init(struct wps_context *wps,
 315                    const struct wps_registrar_config *cfg)
 316 {
 317         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 318         if (reg == NULL)
 319                 return NULL;
 320
 321         reg->wps = wps;
 322         reg->new_psk_cb = cfg->new_psk_cb;
 323         reg->set_ie_cb = cfg->set_ie_cb;
 324         reg->pin_needed_cb = cfg->pin_needed_cb;
 325         reg->cb_ctx = cfg->cb_ctx;
 326
 327         if (wps_set_ie(reg)) {
 328                 wps_registrar_deinit(reg);
 329                 return NULL;
 330         }
 331
 332         return reg;
 333 }
 334
 335
 336 /**
 337  * wps_registrar_deinit - Deinitialize WPS Registrar data
 338  * @reg: Registrar data from wps_registrar_init()
 339  */
 340 void wps_registrar_deinit(struct wps_registrar *reg)
 341 {
 342         if (reg == NULL)
 343                 return;
 344         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 345         wps_free_pins(reg->pins);
 346         wps_free_pbc_sessions(reg->pbc_sessions);
 347         os_free(reg);
 348 }
 349
 350
 351 /**
 352  * wps_registrar_add_pin - Configure a new PIN for Registrar
 353  * @reg: Registrar data from wps_registrar_init()
 354  * @uuid: UUID-E or %NULL for wildcard (any UUID)
 355  * @pin: PIN (Device Password)
 356  * @pin_len: Length of pin in octets
 357  * Returns: 0 on success, -1 on failure
 358  */
 359 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 360                           const u8 *pin, size_t pin_len)
 361 {
 362         struct wps_uuid_pin *p;
 363
 364         p = os_zalloc(sizeof(*p));
 365         if (p == NULL)
 366                 return -1;
 367         if (uuid == NULL)
 368                 p->wildcard_uuid = 1;
 369         else
 370                 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 371         p->pin = os_malloc(pin_len);
 372         if (p->pin == NULL) {
 373                 os_free(p);
 374                 return -1;
 375         }
 376         os_memcpy(p->pin, pin, pin_len);
 377         p->pin_len = pin_len;
 378
 379         p->next = reg->pins;
 380         reg->pins = p;
 381
 382         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
 383         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 384         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 385         reg->selected_registrar = 1;
 386         reg->pbc = 0;
 387         wps_set_ie(reg);
 388
 389         return 0;
 390 }
 391
 392
 393 /**
 394  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
 395  * @reg: Registrar data from wps_registrar_init()
 396  * @uuid: UUID-E
 397  * Returns: 0 on success, -1 on failure (e.g., PIN not found)
 398  */
 399 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 400 {
 401         struct wps_uuid_pin *pin, *prev;
 402
 403         prev = NULL;
 404         pin = reg->pins;
 405         while (pin) {
 406                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 407                         if (prev == NULL)
 408                                 reg->pins = pin->next;
 409                         else
 410                                 prev->next = pin->next;
 411                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 412                                     pin->uuid, WPS_UUID_LEN);
 413                         wps_free_pin(pin);
 414                         return 0;
 415                 }
 416                 prev = pin;
 417                 pin = pin->next;
 418         }
 419
 420         return -1;
 421 }
 422
 423
 424 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 425                                         const u8 *uuid, size_t *pin_len)
 426 {
 427         struct wps_uuid_pin *pin;
 428
 429         pin = reg->pins;
 430         while (pin) {
 431                 if (!pin->wildcard_uuid &&
 432                     os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0)
 433                         break;
 434                 pin = pin->next;
 435         }
 436
 437         if (!pin) {
 438                 /* Check for wildcard UUIDs since none of the UUID-specific
 439                  * PINs matched */
 440                 pin = reg->pins;
 441                 while (pin) {
 442                         if (pin->wildcard_uuid == 1) {
 443                                 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
 444                                            "PIN. Assigned it for this UUID-E");
 445                                 pin->wildcard_uuid = 2;
 446                                 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
 447                                 break;
 448                         }
 449                         pin = pin->next;
 450                 }
 451         }
 452
 453         if (!pin)
 454                 return NULL;
 455
 456         /*
 457          * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
 458          * that could otherwise avoid PIN invalidations.
 459          */
 460         if (pin->locked) {
 461                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
 462                            "allow concurrent re-use");
 463                 return NULL;
 464         }
 465         *pin_len = pin->pin_len;
 466         pin->locked = 1;
 467         return pin->pin;
 468 }
 469
 470
 471 /**
 472  * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
 473  * @reg: Registrar data from wps_registrar_init()
 474  * @uuid: UUID-E
 475  * Returns: 0 on success, -1 on failure
 476  *
 477  * PINs are locked to enforce only one concurrent use. This function unlocks a
 478  * PIN to allow it to be used again. If the specified PIN was configured using
 479  * a wildcard UUID, it will be removed instead of allowing multiple uses.
 480  */
 481 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 482 {
 483         struct wps_uuid_pin *pin;
 484
 485         pin = reg->pins;
 486         while (pin) {
 487                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 488                         if (pin->wildcard_uuid == 2) {
 489                                 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
 490                                            "wildcard PIN");
 491                                 return wps_registrar_invalidate_pin(reg, uuid);
 492                         }
 493                         pin->locked = 0;
 494                         return 0;
 495                 }
 496                 pin = pin->next;
 497         }
 498
 499         return -1;
 500 }
 501
 502
 503 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
 504 {
 505         reg->selected_registrar = 0;
 506         reg->pbc = 0;
 507         wps_set_ie(reg);
 508 }
 509
 510
 511 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 512 {
 513         struct wps_registrar *reg = eloop_ctx;
 514
 515         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 516         wps_registrar_stop_pbc(reg);
 517 }
 518
 519
 520 /**
 521  * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
 522  * @reg: Registrar data from wps_registrar_init()
 523  * Returns: 0 on success, -1 on failure
 524  *
 525  * This function is called on an AP when a push button is pushed to activate
 526  * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
 527  * or when a PBC registration is completed.
 528  */
 529 int wps_registrar_button_pushed(struct wps_registrar *reg)
 530 {
 531         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 532                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 533                            "mode");
 534                 return -1;
 535         }
 536         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 537         reg->selected_registrar = 1;
 538         reg->pbc = 1;
 539         wps_set_ie(reg);
 540
 541         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 542         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 543                                reg, NULL);
 544         return 0;
 545 }
 546
 547
 548 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 549 {
 550         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 551         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 552         wps_registrar_stop_pbc(reg);
 553 }
 554
 555
 556 /**
 557  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
 558  * @reg: Registrar data from wps_registrar_init()
 559  * @addr: MAC address of the Probe Request sender
 560  * @wps_data: WPS IE contents
 561  *
 562  * This function is called on an AP when a Probe Request with WPS IE is
 563  * received. This is used to track PBC mode use and to detect possible overlap
 564  * situation with other WPS APs.
 565  */
 566 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 567                                 const struct wpabuf *wps_data)
 568 {
 569         struct wps_parse_attr attr;
 570         u16 methods;
 571
 572         wpa_hexdump_buf(MSG_MSGDUMP,
 573                         "WPS: Probe Request with WPS data received",
 574                         wps_data);
 575
 576         if (wps_parse_msg(wps_data, &attr) < 0 ||
 577             attr.version == NULL || *attr.version != WPS_VERSION) {
 578                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 579                            "version 0x%x", attr.version ? *attr.version : 0);
 580                 return;
 581         }
 582
 583         if (attr.config_methods == NULL) {
 584                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 585                            "Probe Request");
 586                 return;
 587         }
 588
 589         methods = WPA_GET_BE16(attr.config_methods);
 590         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 591                 return; /* Not PBC */
 592
 593         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 594                    MACSTR, MAC2STR(addr));
 595
 596         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 597 }
 598
 599
 600 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 601                           const u8 *psk, size_t psk_len)
 602 {
 603         if (reg->new_psk_cb == NULL)
 604                 return 0;
 605
 606         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 607 }
 608
 609
 610 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 611                               const struct wps_device_data *dev)
 612 {
 613         if (reg->pin_needed_cb == NULL)
 614                 return;
 615
 616         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 617 }
 618
 619
 620 static int wps_cb_set_ie(struct wps_registrar *reg,
 621                          const struct wpabuf *beacon_ie,
 622                          const struct wpabuf *probe_resp_ie)
 623 {
 624         if (reg->set_ie_cb == NULL)
 625                 return 0;
 626
 627         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 628                               wpabuf_len(beacon_ie),
 629                               wpabuf_head(probe_resp_ie),
 630                               wpabuf_len(probe_resp_ie));
 631 }
 632
 633
 634 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 635 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 636 {
 637         struct wpabuf *ie;
 638         const u8 *pos, *end;
 639
 640         ie = wpabuf_alloc(wpabuf_len(data) + 100);
 641         if (ie == NULL) {
 642                 wpabuf_free(data);
 643                 return NULL;
 644         }
 645
 646         pos = wpabuf_head(data);
 647         end = pos + wpabuf_len(data);
 648
 649         while (end > pos) {
 650                 size_t frag_len = end - pos;
 651                 if (frag_len > 251)
 652                         frag_len = 251;
 653                 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 654                 wpabuf_put_u8(ie, 4 + frag_len);
 655                 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
 656                 wpabuf_put_data(ie, pos, frag_len);
 657                 pos += frag_len;
 658         }
 659
 660         wpabuf_free(data);
 661
 662         return ie;
 663 }
 664
 665
 666 static int wps_set_ie(struct wps_registrar *reg)
 667 {
 668         struct wpabuf *beacon;
 669         struct wpabuf *probe;
 670         int ret;
 671
 672         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 673
 674         beacon = wpabuf_alloc(300);
 675         if (beacon == NULL)
 676                 return -1;
 677         probe = wpabuf_alloc(400);
 678         if (probe == NULL) {
 679                 wpabuf_free(beacon);
 680                 return -1;
 681         }
 682
 683         if (wps_build_version(beacon) ||
 684             wps_build_wps_state(reg->wps, beacon) ||
 685             wps_build_ap_setup_locked(reg->wps, beacon) ||
 686             wps_build_selected_registrar(reg, beacon) ||
 687             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 688             wps_build_sel_reg_config_methods(reg, beacon) ||
 689             wps_build_version(probe) ||
 690             wps_build_wps_state(reg->wps, probe) ||
 691             wps_build_ap_setup_locked(reg->wps, probe) ||
 692             wps_build_selected_registrar(reg, probe) ||
 693             wps_build_sel_reg_dev_password_id(reg, probe) ||
 694             wps_build_sel_reg_config_methods(reg, probe) ||
 695             wps_build_resp_type(reg, probe) ||
 696             wps_build_uuid_e(probe, reg->wps->uuid) ||
 697             wps_build_device_attrs(&reg->wps->dev, probe) ||
 698             wps_build_probe_config_methods(reg, probe) ||
 699             wps_build_rf_bands(&reg->wps->dev, probe)) {
 700                 wpabuf_free(beacon);
 701                 wpabuf_free(probe);
 702                 return -1;
 703         }
 704
 705         beacon = wps_ie_encapsulate(beacon);
 706         probe = wps_ie_encapsulate(probe);
 707
 708         if (!beacon || !probe) {
 709                 wpabuf_free(beacon);
 710                 wpabuf_free(probe);
 711                 return -1;
 712         }
 713
 714         ret = wps_cb_set_ie(reg, beacon, probe);
 715         wpabuf_free(beacon);
 716         wpabuf_free(probe);
 717
 718         return ret;
 719 }
 720
 721
 722 static int wps_get_dev_password(struct wps_data *wps)
 723 {
 724         const u8 *pin;
 725         size_t pin_len = 0;
 726
 727         os_free(wps->dev_password);
 728         wps->dev_password = NULL;
 729
 730         if (wps->pbc) {
 731                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 732                 pin = (const u8 *) "00000000";
 733                 pin_len = 8;
 734         } else {
 735                 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
 736                                             &pin_len);
 737         }
 738         if (pin == NULL) {
 739                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 740                            "the Enrollee");
 741                 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
 742                                   &wps->peer_dev);
 743                 return -1;
 744         }
 745
 746         wps->dev_password = os_malloc(pin_len);
 747         if (wps->dev_password == NULL)
 748                 return -1;
 749         os_memcpy(wps->dev_password, pin, pin_len);
 750         wps->dev_password_len = pin_len;
 751
 752         return 0;
 753 }
 754
 755
 756 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
 757 {
 758         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
 759         wpabuf_put_be16(msg, ATTR_UUID_R);
 760         wpabuf_put_be16(msg, WPS_UUID_LEN);
 761         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
 762         return 0;
 763 }
 764
 765
 766 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
 767 {
 768         u8 *hash;
 769         const u8 *addr[4];
 770         size_t len[4];
 771
 772         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
 773                 return -1;
 774         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
 775         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
 776                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
 777
 778         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
 779                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
 780                            "R-Hash derivation");
 781                 return -1;
 782         }
 783
 784         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
 785         wpabuf_put_be16(msg, ATTR_R_HASH1);
 786         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 787         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 788         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
 789         addr[0] = wps->snonce;
 790         len[0] = WPS_SECRET_NONCE_LEN;
 791         addr[1] = wps->psk1;
 792         len[1] = WPS_PSK_LEN;
 793         addr[2] = wpabuf_head(wps->dh_pubkey_e);
 794         len[2] = wpabuf_len(wps->dh_pubkey_e);
 795         addr[3] = wpabuf_head(wps->dh_pubkey_r);
 796         len[3] = wpabuf_len(wps->dh_pubkey_r);
 797         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 798         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
 799
 800         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
 801         wpabuf_put_be16(msg, ATTR_R_HASH2);
 802         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 803         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 804         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
 805         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
 806         addr[1] = wps->psk2;
 807         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 808         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
 809
 810         return 0;
 811 }
 812
 813
 814 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
 815 {
 816         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
 817         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
 818         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 819         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
 820         return 0;
 821 }
 822
 823
 824 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 825 {
 826         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
 827         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
 828         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 829         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
 830                         WPS_SECRET_NONCE_LEN);
 831         return 0;
 832 }
 833
 834
 835 static int wps_build_cred_network_idx(struct wpabuf *msg,
 836                                       struct wps_credential *cred)
 837 {
 838         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
 839         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
 840         wpabuf_put_be16(msg, 1);
 841         wpabuf_put_u8(msg, 0);
 842         return 0;
 843 }
 844
 845
 846 static int wps_build_cred_ssid(struct wpabuf *msg,
 847                                struct wps_credential *cred)
 848 {
 849         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
 850         wpabuf_put_be16(msg, ATTR_SSID);
 851         wpabuf_put_be16(msg, cred->ssid_len);
 852         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
 853         return 0;
 854 }
 855
 856
 857 static int wps_build_cred_auth_type(struct wpabuf *msg,
 858                                     struct wps_credential *cred)
 859 {
 860         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
 861                    cred->auth_type);
 862         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
 863         wpabuf_put_be16(msg, 2);
 864         wpabuf_put_be16(msg, cred->auth_type);
 865         return 0;
 866 }
 867
 868
 869 static int wps_build_cred_encr_type(struct wpabuf *msg,
 870                                     struct wps_credential *cred)
 871 {
 872         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
 873                    cred->encr_type);
 874         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
 875         wpabuf_put_be16(msg, 2);
 876         wpabuf_put_be16(msg, cred->encr_type);
 877         return 0;
 878 }
 879
 880
 881 static int wps_build_cred_network_key(struct wpabuf *msg,
 882                                       struct wps_credential *cred)
 883 {
 884         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
 885         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
 886         wpabuf_put_be16(msg, cred->key_len);
 887         wpabuf_put_data(msg, cred->key, cred->key_len);
 888         return 0;
 889 }
 890
 891
 892 static int wps_build_cred_mac_addr(struct wpabuf *msg,
 893                                    struct wps_credential *cred)
 894 {
 895         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address");
 896         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
 897         wpabuf_put_be16(msg, ETH_ALEN);
 898         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
 899         return 0;
 900 }
 901
 902
 903 static int wps_build_credential(struct wpabuf *msg,
 904                                 struct wps_credential *cred)
 905 {
 906         if (wps_build_cred_network_idx(msg, cred) ||
 907             wps_build_cred_ssid(msg, cred) ||
 908             wps_build_cred_auth_type(msg, cred) ||
 909             wps_build_cred_encr_type(msg, cred) ||
 910             wps_build_cred_network_key(msg, cred) ||
 911             wps_build_cred_mac_addr(msg, cred))
 912                 return -1;
 913         return 0;
 914 }
 915
 916
 917 static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 918 {
 919         struct wpabuf *cred;
 920
 921         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
 922         os_memset(&wps->cred, 0, sizeof(wps->cred));
 923
 924         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
 925         wps->cred.ssid_len = wps->wps->ssid_len;
 926
 927         /* Select the best authentication and encryption type */
 928         if (wps->auth_type & WPS_AUTH_WPA2PSK)
 929                 wps->auth_type = WPS_AUTH_WPA2PSK;
 930         else if (wps->auth_type & WPS_AUTH_WPAPSK)
 931                 wps->auth_type = WPS_AUTH_WPAPSK;
 932         else if (wps->auth_type & WPS_AUTH_OPEN)
 933                 wps->auth_type = WPS_AUTH_OPEN;
 934         else if (wps->auth_type & WPS_AUTH_SHARED)
 935                 wps->auth_type = WPS_AUTH_SHARED;
 936         else {
 937                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
 938                            wps->auth_type);
 939                 return -1;
 940         }
 941         wps->cred.auth_type = wps->auth_type;
 942
 943         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
 944             wps->auth_type == WPS_AUTH_WPAPSK) {
 945                 if (wps->encr_type & WPS_ENCR_AES)
 946                         wps->encr_type = WPS_ENCR_AES;
 947                 else if (wps->encr_type & WPS_ENCR_TKIP)
 948                         wps->encr_type = WPS_ENCR_TKIP;
 949                 else {
 950                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 951                                    "type for WPA/WPA2");
 952                         return -1;
 953                 }
 954         } else {
 955                 if (wps->encr_type & WPS_ENCR_WEP)
 956                         wps->encr_type = WPS_ENCR_WEP;
 957                 else if (wps->encr_type & WPS_ENCR_NONE)
 958                         wps->encr_type = WPS_ENCR_NONE;
 959                 else {
 960                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 961                                    "type for non-WPA/WPA2 mode");
 962                         return -1;
 963                 }
 964         }
 965         wps->cred.encr_type = wps->encr_type;
 966         os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
 967
 968         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap) {
 969                 u8 r[16];
 970                 /* Generate a random passphrase */
 971                 if (os_get_random(r, sizeof(r)) < 0)
 972                         return -1;
 973                 os_free(wps->new_psk);
 974                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
 975                 if (wps->new_psk == NULL)
 976                         return -1;
 977                 wps->new_psk_len--; /* remove newline */
 978                 while (wps->new_psk_len &&
 979                        wps->new_psk[wps->new_psk_len - 1] == '=')
 980                         wps->new_psk_len--;
 981                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
 982                                       wps->new_psk, wps->new_psk_len);
 983                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
 984                 wps->cred.key_len = wps->new_psk_len;
 985         } else if (wps->wps->network_key) {
 986                 os_memcpy(wps->cred.key, wps->wps->network_key,
 987                           wps->wps->network_key_len);
 988                 wps->cred.key_len = wps->wps->network_key_len;
 989         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 990                 char hex[65];
 991                 /* Generate a random per-device PSK */
 992                 os_free(wps->new_psk);
 993                 wps->new_psk_len = 32;
 994                 wps->new_psk = os_malloc(wps->new_psk_len);
 995                 if (wps->new_psk == NULL)
 996                         return -1;
 997                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
 998                         os_free(wps->new_psk);
 999                         wps->new_psk = NULL;
1000                         return -1;
1001                 }
1002                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1003                                 wps->new_psk, wps->new_psk_len);
1004                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
1005                                  wps->new_psk_len);
1006                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1007                 wps->cred.key_len = wps->new_psk_len * 2;
1008         }
1009
1010         cred = wpabuf_alloc(200);
1011         if (cred == NULL)
1012                 return -1;
1013
1014         if (wps_build_credential(cred, &wps->cred)) {
1015                 wpabuf_free(cred);
1016                 return -1;
1017         }
1018
1019         wpabuf_put_be16(msg, ATTR_CRED);
1020         wpabuf_put_be16(msg, wpabuf_len(cred));
1021         wpabuf_put_buf(msg, cred);
1022         wpabuf_free(cred);
1023
1024         return 0;
1025 }
1026
1027
1028 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1029 {
1030         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
1031
1032         if (wps_build_credential(msg, &wps->cred))
1033                 return -1;
1034
1035         return 0;
1036 }
1037
1038
1039 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1040 {
1041         struct wpabuf *msg;
1042
1043         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
1044                 return NULL;
1045         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1046                     wps->nonce_r, WPS_NONCE_LEN);
1047         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1048
1049         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1050         msg = wpabuf_alloc(1000);
1051         if (msg == NULL)
1052                 return NULL;
1053
1054         if (wps_build_version(msg) ||
1055             wps_build_msg_type(msg, WPS_M2) ||
1056             wps_build_enrollee_nonce(wps, msg) ||
1057             wps_build_registrar_nonce(wps, msg) ||
1058             wps_build_uuid_r(wps, msg) ||
1059             wps_build_public_key(wps, msg) ||
1060             wps_derive_keys(wps) ||
1061             wps_build_auth_type_flags(wps, msg) ||
1062             wps_build_encr_type_flags(wps, msg) ||
1063             wps_build_conn_type_flags(wps, msg) ||
1064             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1065             wps_build_device_attrs(&wps->wps->dev, msg) ||
1066             wps_build_rf_bands(&wps->wps->dev, msg) ||
1067             wps_build_assoc_state(wps, msg) ||
1068             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1069             wps_build_dev_password_id(msg, DEV_PW_DEFAULT) ||
1070             wps_build_os_version(&wps->wps->dev, msg) ||
1071             wps_build_authenticator(wps, msg)) {
1072                 wpabuf_free(msg);
1073                 return NULL;
1074         }
1075
1076         wps->state = RECV_M3;
1077         return msg;
1078 }
1079
1080
1081 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1082 {
1083         struct wpabuf *msg;
1084         u16 err = WPS_CFG_NO_ERROR;
1085
1086         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1087         msg = wpabuf_alloc(1000);
1088         if (msg == NULL)
1089                 return NULL;
1090
1091         if (wps->wps->ap && wps->wps->ap_setup_locked)
1092                 err = WPS_CFG_SETUP_LOCKED;
1093
1094         if (wps_build_version(msg) ||
1095             wps_build_msg_type(msg, WPS_M2D) ||
1096             wps_build_enrollee_nonce(wps, msg) ||
1097             wps_build_registrar_nonce(wps, msg) ||
1098             wps_build_uuid_r(wps, msg) ||
1099             wps_build_auth_type_flags(wps, msg) ||
1100             wps_build_encr_type_flags(wps, msg) ||
1101             wps_build_conn_type_flags(wps, msg) ||
1102             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1103             wps_build_device_attrs(&wps->wps->dev, msg) ||
1104             wps_build_rf_bands(&wps->wps->dev, msg) ||
1105             wps_build_assoc_state(wps, msg) ||
1106             wps_build_config_error(msg, err) ||
1107             wps_build_os_version(&wps->wps->dev, msg)) {
1108                 wpabuf_free(msg);
1109                 return NULL;
1110         }
1111
1112         wps->state = RECV_M2D_ACK;
1113         return msg;
1114 }
1115
1116
1117 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1118 {
1119         struct wpabuf *msg, *plain;
1120
1121         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1122
1123         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1124
1125         plain = wpabuf_alloc(200);
1126         if (plain == NULL)
1127                 return NULL;
1128
1129         msg = wpabuf_alloc(1000);
1130         if (msg == NULL) {
1131                 wpabuf_free(plain);
1132                 return NULL;
1133         }
1134
1135         if (wps_build_version(msg) ||
1136             wps_build_msg_type(msg, WPS_M4) ||
1137             wps_build_enrollee_nonce(wps, msg) ||
1138             wps_build_r_hash(wps, msg) ||
1139             wps_build_r_snonce1(wps, plain) ||
1140             wps_build_key_wrap_auth(wps, plain) ||
1141             wps_build_encr_settings(wps, msg, plain) ||
1142             wps_build_authenticator(wps, msg)) {
1143                 wpabuf_free(plain);
1144                 wpabuf_free(msg);
1145                 return NULL;
1146         }
1147         wpabuf_free(plain);
1148
1149         wps->state = RECV_M5;
1150         return msg;
1151 }
1152
1153
1154 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1155 {
1156         struct wpabuf *msg, *plain;
1157
1158         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1159
1160         plain = wpabuf_alloc(200);
1161         if (plain == NULL)
1162                 return NULL;
1163
1164         msg = wpabuf_alloc(1000);
1165         if (msg == NULL) {
1166                 wpabuf_free(plain);
1167                 return NULL;
1168         }
1169
1170         if (wps_build_version(msg) ||
1171             wps_build_msg_type(msg, WPS_M6) ||
1172             wps_build_enrollee_nonce(wps, msg) ||
1173             wps_build_r_snonce2(wps, plain) ||
1174             wps_build_key_wrap_auth(wps, plain) ||
1175             wps_build_encr_settings(wps, msg, plain) ||
1176             wps_build_authenticator(wps, msg)) {
1177                 wpabuf_free(plain);
1178                 wpabuf_free(msg);
1179                 return NULL;
1180         }
1181         wpabuf_free(plain);
1182
1183         wps->wps_pin_revealed = 1;
1184         wps->state = RECV_M7;
1185         return msg;
1186 }
1187
1188
1189 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1190 {
1191         struct wpabuf *msg, *plain;
1192
1193         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1194
1195         plain = wpabuf_alloc(500);
1196         if (plain == NULL)
1197                 return NULL;
1198
1199         msg = wpabuf_alloc(1000);
1200         if (msg == NULL) {
1201                 wpabuf_free(plain);
1202                 return NULL;
1203         }
1204
1205         if (wps_build_version(msg) ||
1206             wps_build_msg_type(msg, WPS_M8) ||
1207             wps_build_enrollee_nonce(wps, msg) ||
1208             (wps->wps->ap && wps_build_cred(wps, plain)) ||
1209             (!wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
1210             wps_build_key_wrap_auth(wps, plain) ||
1211             wps_build_encr_settings(wps, msg, plain) ||
1212             wps_build_authenticator(wps, msg)) {
1213                 wpabuf_free(plain);
1214                 wpabuf_free(msg);
1215                 return NULL;
1216         }
1217         wpabuf_free(plain);
1218
1219         wps->state = RECV_DONE;
1220         return msg;
1221 }
1222
1223
1224 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1225 {
1226         struct wpabuf *msg;
1227
1228         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1229
1230         msg = wpabuf_alloc(1000);
1231         if (msg == NULL)
1232                 return NULL;
1233
1234         if (wps_build_version(msg) ||
1235             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1236             wps_build_enrollee_nonce(wps, msg) ||
1237             wps_build_registrar_nonce(wps, msg)) {
1238                 wpabuf_free(msg);
1239                 return NULL;
1240         }
1241
1242         return msg;
1243 }
1244
1245
1246 static struct wpabuf * wps_build_wsc_nack(struct wps_data *wps)
1247 {
1248         struct wpabuf *msg;
1249
1250         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_NACK");
1251
1252         msg = wpabuf_alloc(1000);
1253         if (msg == NULL)
1254                 return NULL;
1255
1256         if (wps_build_version(msg) ||
1257             wps_build_msg_type(msg, WPS_WSC_NACK) ||
1258             wps_build_enrollee_nonce(wps, msg) ||
1259             wps_build_registrar_nonce(wps, msg) ||
1260             wps_build_config_error(msg, wps->config_error)) {
1261                 wpabuf_free(msg);
1262                 return NULL;
1263         }
1264
1265         return msg;
1266 }
1267
1268
1269 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1270                                       enum wsc_op_code *op_code)
1271 {
1272         struct wpabuf *msg;
1273
1274         switch (wps->state) {
1275         case SEND_M2:
1276                 if (wps_get_dev_password(wps) < 0)
1277                         msg = wps_build_m2d(wps);
1278                 else
1279                         msg = wps_build_m2(wps);
1280                 *op_code = WSC_MSG;
1281                 break;
1282         case SEND_M2D:
1283                 msg = wps_build_m2d(wps);
1284                 *op_code = WSC_MSG;
1285                 break;
1286         case SEND_M4:
1287                 msg = wps_build_m4(wps);
1288                 *op_code = WSC_MSG;
1289                 break;
1290         case SEND_M6:
1291                 msg = wps_build_m6(wps);
1292                 *op_code = WSC_MSG;
1293                 break;
1294         case SEND_M8:
1295                 msg = wps_build_m8(wps);
1296                 *op_code = WSC_MSG;
1297                 break;
1298         case RECV_DONE:
1299                 msg = wps_build_wsc_ack(wps);
1300                 *op_code = WSC_ACK;
1301                 break;
1302         case SEND_WSC_NACK:
1303                 msg = wps_build_wsc_nack(wps);
1304                 *op_code = WSC_NACK;
1305                 break;
1306         default:
1307                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1308                            "a message", wps->state);
1309                 msg = NULL;
1310                 break;
1311         }
1312
1313         if (*op_code == WSC_MSG && msg) {
1314                 /* Save a copy of the last message for Authenticator derivation
1315                  */
1316                 wpabuf_free(wps->last_msg);
1317                 wps->last_msg = wpabuf_dup(msg);
1318         }
1319
1320         return msg;
1321 }
1322
1323
1324 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1325 {
1326         if (e_nonce == NULL) {
1327                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1328                 return -1;
1329         }
1330
1331         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1332         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1333                     wps->nonce_e, WPS_NONCE_LEN);
1334
1335         return 0;
1336 }
1337
1338
1339 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1340 {
1341         if (r_nonce == NULL) {
1342                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1343                 return -1;
1344         }
1345
1346         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1347                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1348                 return -1;
1349         }
1350
1351         return 0;
1352 }
1353
1354
1355 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1356 {
1357         if (uuid_e == NULL) {
1358                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1359                 return -1;
1360         }
1361
1362         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1363         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1364
1365         return 0;
1366 }
1367
1368
1369 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1370 {
1371         if (pw_id == NULL) {
1372                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1373                 return -1;
1374         }
1375
1376         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1377         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1378
1379         return 0;
1380 }
1381
1382
1383 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1384 {
1385         if (e_hash1 == NULL) {
1386                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1387                 return -1;
1388         }
1389
1390         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1391         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1392
1393         return 0;
1394 }
1395
1396
1397 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1398 {
1399         if (e_hash2 == NULL) {
1400                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1401                 return -1;
1402         }
1403
1404         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1405         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1406
1407         return 0;
1408 }
1409
1410
1411 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1412 {
1413         u8 hash[SHA256_MAC_LEN];
1414         const u8 *addr[4];
1415         size_t len[4];
1416
1417         if (e_snonce1 == NULL) {
1418                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1419                 return -1;
1420         }
1421
1422         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1423                         WPS_SECRET_NONCE_LEN);
1424
1425         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1426         addr[0] = e_snonce1;
1427         len[0] = WPS_SECRET_NONCE_LEN;
1428         addr[1] = wps->psk1;
1429         len[1] = WPS_PSK_LEN;
1430         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1431         len[2] = wpabuf_len(wps->dh_pubkey_e);
1432         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1433         len[3] = wpabuf_len(wps->dh_pubkey_r);
1434         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1435
1436         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1437                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1438                            "not match with the pre-committed value");
1439                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1440                 return -1;
1441         }
1442
1443         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1444                    "half of the device password");
1445
1446         return 0;
1447 }
1448
1449
1450 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1451 {
1452         u8 hash[SHA256_MAC_LEN];
1453         const u8 *addr[4];
1454         size_t len[4];
1455
1456         if (e_snonce2 == NULL) {
1457                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1458                 return -1;
1459         }
1460
1461         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1462                         WPS_SECRET_NONCE_LEN);
1463
1464         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1465         addr[0] = e_snonce2;
1466         len[0] = WPS_SECRET_NONCE_LEN;
1467         addr[1] = wps->psk2;
1468         len[1] = WPS_PSK_LEN;
1469         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1470         len[2] = wpabuf_len(wps->dh_pubkey_e);
1471         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1472         len[3] = wpabuf_len(wps->dh_pubkey_r);
1473         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1474
1475         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1476                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1477                            "not match with the pre-committed value");
1478                 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
1479                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1480                 return -1;
1481         }
1482
1483         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1484                    "half of the device password");
1485         wps->wps_pin_revealed = 0;
1486         wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
1487
1488         return 0;
1489 }
1490
1491
1492 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1493 {
1494         if (mac_addr == NULL) {
1495                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1496                 return -1;
1497         }
1498
1499         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1500                    MAC2STR(mac_addr));
1501         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1502         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1503
1504         return 0;
1505 }
1506
1507
1508 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1509                               size_t pk_len)
1510 {
1511         if (pk == NULL || pk_len == 0) {
1512                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1513                 return -1;
1514         }
1515
1516         wpabuf_free(wps->dh_pubkey_e);
1517         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1518         if (wps->dh_pubkey_e == NULL)
1519                 return -1;
1520
1521         return 0;
1522 }
1523
1524
1525 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1526 {
1527         u16 auth_types;
1528
1529         if (auth == NULL) {
1530                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1531                            "received");
1532                 return -1;
1533         }
1534
1535         auth_types = WPA_GET_BE16(auth);
1536
1537         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1538                    auth_types);
1539         wps->auth_type = wps->wps->auth_types & auth_types;
1540         if (wps->auth_type == 0) {
1541                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1542                            "authentication types (own 0x%x Enrollee 0x%x)",
1543                            wps->wps->auth_types, auth_types);
1544                 return -1;
1545         }
1546
1547         return 0;
1548 }
1549
1550
1551 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1552 {
1553         u16 encr_types;
1554
1555         if (encr == NULL) {
1556                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1557                            "received");
1558                 return -1;
1559         }
1560
1561         encr_types = WPA_GET_BE16(encr);
1562
1563         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1564                    encr_types);
1565         wps->encr_type = wps->wps->encr_types & encr_types;
1566         if (wps->encr_type == 0) {
1567                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1568                            "encryption types");
1569                 return -1;
1570         }
1571
1572         return 0;
1573 }
1574
1575
1576 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1577 {
1578         if (conn == NULL) {
1579                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1580                            "received");
1581                 return -1;
1582         }
1583
1584         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1585                    *conn);
1586
1587         return 0;
1588 }
1589
1590
1591 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1592 {
1593         u16 m;
1594
1595         if (methods == NULL) {
1596                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1597                 return -1;
1598         }
1599
1600         m = WPA_GET_BE16(methods);
1601
1602         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1603
1604         return 0;
1605 }
1606
1607
1608 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1609 {
1610         if (state == NULL) {
1611                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1612                            "received");
1613                 return -1;
1614         }
1615
1616         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1617                    *state);
1618
1619         return 0;
1620 }
1621
1622
1623 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1624 {
1625         u16 a;
1626
1627         if (assoc == NULL) {
1628                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1629                 return -1;
1630         }
1631
1632         a = WPA_GET_BE16(assoc);
1633         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
1634
1635         return 0;
1636 }
1637
1638
1639 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
1640 {
1641         u16 e;
1642
1643         if (err == NULL) {
1644                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
1645                 return -1;
1646         }
1647
1648         e = WPA_GET_BE16(err);
1649         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
1650
1651         return 0;
1652 }
1653
1654
1655 static enum wps_process_res wps_process_m1(struct wps_data *wps,
1656                                            struct wps_parse_attr *attr)
1657 {
1658         wpa_printf(MSG_DEBUG, "WPS: Received M1");
1659
1660         if (wps->state != RECV_M1) {
1661                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1662                            "receiving M1", wps->state);
1663                 return WPS_FAILURE;
1664         }
1665
1666         if (wps_process_uuid_e(wps, attr->uuid_e) ||
1667             wps_process_mac_addr(wps, attr->mac_addr) ||
1668             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
1669             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
1670             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
1671             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
1672             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
1673             wps_process_config_methods(wps, attr->config_methods) ||
1674             wps_process_wps_state(wps, attr->wps_state) ||
1675             wps_process_device_attrs(&wps->peer_dev, attr) ||
1676             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
1677             wps_process_assoc_state(wps, attr->assoc_state) ||
1678             wps_process_dev_password_id(wps, attr->dev_password_id) ||
1679             wps_process_config_error(wps, attr->config_error) ||
1680             wps_process_os_version(&wps->peer_dev, attr->os_version))
1681                 return WPS_FAILURE;
1682
1683         if (wps->dev_pw_id != DEV_PW_DEFAULT &&
1684             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
1685             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
1686             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
1687             (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
1688              !wps->wps->registrar->pbc)) {
1689                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
1690                            wps->dev_pw_id);
1691                 wps->state = SEND_M2D;
1692                 return WPS_CONTINUE;
1693         }
1694
1695         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
1696                 if (wps_registrar_pbc_overlap(wps->wps->registrar,
1697                                               wps->mac_addr_e, wps->uuid_e)) {
1698                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
1699                                    "negotiation");
1700                         wps->state = SEND_M2D;
1701                         return WPS_CONTINUE;
1702                 }
1703                 wps_registrar_add_pbc_session(wps->wps->registrar,
1704                                               wps->mac_addr_e, wps->uuid_e);
1705                 wps->pbc = 1;
1706         }
1707
1708         wps->state = SEND_M2;
1709         return WPS_CONTINUE;
1710 }
1711
1712
1713 static enum wps_process_res wps_process_m3(struct wps_data *wps,
1714                                            const struct wpabuf *msg,
1715                                            struct wps_parse_attr *attr)
1716 {
1717         wpa_printf(MSG_DEBUG, "WPS: Received M3");
1718
1719         if (wps->state != RECV_M3) {
1720                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1721                            "receiving M3", wps->state);
1722                 wps->state = SEND_WSC_NACK;
1723                 return WPS_CONTINUE;
1724         }
1725
1726         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1727             wps_process_authenticator(wps, attr->authenticator, msg) ||
1728             wps_process_e_hash1(wps, attr->e_hash1) ||
1729             wps_process_e_hash2(wps, attr->e_hash2)) {
1730                 wps->state = SEND_WSC_NACK;
1731                 return WPS_CONTINUE;
1732         }
1733
1734         wps->state = SEND_M4;
1735         return WPS_CONTINUE;
1736 }
1737
1738
1739 static enum wps_process_res wps_process_m5(struct wps_data *wps,
1740                                            const struct wpabuf *msg,
1741                                            struct wps_parse_attr *attr)
1742 {
1743         struct wpabuf *decrypted;
1744         struct wps_parse_attr eattr;
1745
1746         wpa_printf(MSG_DEBUG, "WPS: Received M5");
1747
1748         if (wps->state != RECV_M5) {
1749                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1750                            "receiving M5", wps->state);
1751                 wps->state = SEND_WSC_NACK;
1752                 return WPS_CONTINUE;
1753         }
1754
1755         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1756             wps_process_authenticator(wps, attr->authenticator, msg)) {
1757                 wps->state = SEND_WSC_NACK;
1758                 return WPS_CONTINUE;
1759         }
1760
1761         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1762                                               attr->encr_settings_len);
1763         if (decrypted == NULL) {
1764                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1765                            "Settings attribute");
1766                 wps->state = SEND_WSC_NACK;
1767                 return WPS_CONTINUE;
1768         }
1769
1770         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1771                    "attribute");
1772         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1773             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1774             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
1775                 wpabuf_free(decrypted);
1776                 wps->state = SEND_WSC_NACK;
1777                 return WPS_CONTINUE;
1778         }
1779         wpabuf_free(decrypted);
1780
1781         wps->state = SEND_M6;
1782         return WPS_CONTINUE;
1783 }
1784
1785
1786 static int wps_process_ap_settings_r(struct wps_data *wps,
1787                                      struct wps_parse_attr *attr)
1788 {
1789         if (wps->wps->ap)
1790                 return 0;
1791
1792         /* AP Settings Attributes in M7 when Enrollee is an AP */
1793         if (wps_process_ap_settings(attr, &wps->cred) < 0)
1794                 return -1;
1795
1796         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
1797
1798         /*
1799          * TODO: Provide access to AP settings and allow changes before sending
1800          * out M8. For now, just copy the settings unchanged into M8.
1801          */
1802
1803         return 0;
1804 }
1805
1806
1807 static enum wps_process_res wps_process_m7(struct wps_data *wps,
1808                                            const struct wpabuf *msg,
1809                                            struct wps_parse_attr *attr)
1810 {
1811         struct wpabuf *decrypted;
1812         struct wps_parse_attr eattr;
1813
1814         wpa_printf(MSG_DEBUG, "WPS: Received M7");
1815
1816         if (wps->state != RECV_M7) {
1817                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1818                            "receiving M7", wps->state);
1819                 wps->state = SEND_WSC_NACK;
1820                 return WPS_CONTINUE;
1821         }
1822
1823         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1824             wps_process_authenticator(wps, attr->authenticator, msg)) {
1825                 wps->state = SEND_WSC_NACK;
1826                 return WPS_CONTINUE;
1827         }
1828
1829         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1830                                               attr->encr_settings_len);
1831         if (decrypted == NULL) {
1832                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1833                            "Settings attribute");
1834                 wps->state = SEND_WSC_NACK;
1835                 return WPS_CONTINUE;
1836         }
1837
1838         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1839                    "attribute");
1840         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1841             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1842             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
1843             wps_process_ap_settings_r(wps, &eattr)) {
1844                 wpabuf_free(decrypted);
1845                 wps->state = SEND_WSC_NACK;
1846                 return WPS_CONTINUE;
1847         }
1848
1849         wpabuf_free(decrypted);
1850
1851         wps->state = SEND_M8;
1852         return WPS_CONTINUE;
1853 }
1854
1855
1856 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
1857                                                 const struct wpabuf *msg)
1858 {
1859         struct wps_parse_attr attr;
1860         enum wps_process_res ret = WPS_CONTINUE;
1861
1862         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
1863
1864         if (wps_parse_msg(msg, &attr) < 0)
1865                 return WPS_FAILURE;
1866
1867         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1868                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1869                            attr.version ? *attr.version : 0);
1870                 return WPS_FAILURE;
1871         }
1872
1873         if (attr.msg_type == NULL) {
1874                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1875                 return WPS_FAILURE;
1876         }
1877
1878         if (*attr.msg_type != WPS_M1 &&
1879             (attr.registrar_nonce == NULL ||
1880              os_memcmp(wps->nonce_r, attr.registrar_nonce,
1881                        WPS_NONCE_LEN != 0))) {
1882                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1883                 return WPS_FAILURE;
1884         }
1885
1886         switch (*attr.msg_type) {
1887         case WPS_M1:
1888                 ret = wps_process_m1(wps, &attr);
1889                 break;
1890         case WPS_M3:
1891                 ret = wps_process_m3(wps, msg, &attr);
1892                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1893                         wps_fail_event(wps->wps, WPS_M3);
1894                 break;
1895         case WPS_M5:
1896                 ret = wps_process_m5(wps, msg, &attr);
1897                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1898                         wps_fail_event(wps->wps, WPS_M5);
1899                 break;
1900         case WPS_M7:
1901                 ret = wps_process_m7(wps, msg, &attr);
1902                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1903                         wps_fail_event(wps->wps, WPS_M7);
1904                 break;
1905         default:
1906                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
1907                            *attr.msg_type);
1908                 return WPS_FAILURE;
1909         }
1910
1911         if (ret == WPS_CONTINUE) {
1912                 /* Save a copy of the last message for Authenticator derivation
1913                  */
1914                 wpabuf_free(wps->last_msg);
1915                 wps->last_msg = wpabuf_dup(msg);
1916         }
1917
1918         return ret;
1919 }
1920
1921
1922 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
1923                                                 const struct wpabuf *msg)
1924 {
1925         struct wps_parse_attr attr;
1926
1927         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
1928
1929         if (wps_parse_msg(msg, &attr) < 0)
1930                 return WPS_FAILURE;
1931
1932         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1933                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1934                            attr.version ? *attr.version : 0);
1935                 return WPS_FAILURE;
1936         }
1937
1938         if (attr.msg_type == NULL) {
1939                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1940                 return WPS_FAILURE;
1941         }
1942
1943         if (*attr.msg_type != WPS_WSC_ACK) {
1944                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1945                            *attr.msg_type);
1946                 return WPS_FAILURE;
1947         }
1948
1949         if (attr.registrar_nonce == NULL ||
1950             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1951         {
1952                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1953                 return WPS_FAILURE;
1954         }
1955
1956         if (attr.enrollee_nonce == NULL ||
1957             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1958                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1959                 return WPS_FAILURE;
1960         }
1961
1962         if (wps->state == RECV_M2D_ACK) {
1963                 /* TODO: support for multiple registrars and sending of
1964                  * multiple M2/M2D messages */
1965
1966                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
1967                            "terminate negotiation");
1968         }
1969
1970         return WPS_FAILURE;
1971 }
1972
1973
1974 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
1975                                                  const struct wpabuf *msg)
1976 {
1977         struct wps_parse_attr attr;
1978         int old_state;
1979
1980         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
1981
1982         old_state = wps->state;
1983         wps->state = SEND_WSC_NACK;
1984
1985         if (wps_parse_msg(msg, &attr) < 0)
1986                 return WPS_FAILURE;
1987
1988         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1989                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1990                            attr.version ? *attr.version : 0);
1991                 return WPS_FAILURE;
1992         }
1993
1994         if (attr.msg_type == NULL) {
1995                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1996                 return WPS_FAILURE;
1997         }
1998
1999         if (*attr.msg_type != WPS_WSC_NACK) {
2000                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2001                            *attr.msg_type);
2002                 return WPS_FAILURE;
2003         }
2004
2005         if (attr.registrar_nonce == NULL ||
2006             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2007         {
2008                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2009                 return WPS_FAILURE;
2010         }
2011
2012         if (attr.enrollee_nonce == NULL ||
2013             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2014                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2015                 return WPS_FAILURE;
2016         }
2017
2018         if (attr.config_error == NULL) {
2019                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
2020                            "in WSC_NACK");
2021                 return WPS_FAILURE;
2022         }
2023
2024         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
2025                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
2026
2027         switch (old_state) {
2028         case RECV_M3:
2029                 wps_fail_event(wps->wps, WPS_M2);
2030                 break;
2031         case RECV_M5:
2032                 wps_fail_event(wps->wps, WPS_M4);
2033                 break;
2034         case RECV_M7:
2035                 wps_fail_event(wps->wps, WPS_M6);
2036                 break;
2037         case RECV_DONE:
2038                 wps_fail_event(wps->wps, WPS_M8);
2039                 break;
2040         default:
2041                 break;
2042         }
2043
2044         return WPS_FAILURE;
2045 }
2046
2047
2048 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
2049                                                  const struct wpabuf *msg)
2050 {
2051         struct wps_parse_attr attr;
2052
2053         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
2054
2055         if (wps->state != RECV_DONE) {
2056                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2057                            "receiving WSC_Done", wps->state);
2058                 return WPS_FAILURE;
2059         }
2060
2061         if (wps_parse_msg(msg, &attr) < 0)
2062                 return WPS_FAILURE;
2063
2064         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2065                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2066                            attr.version ? *attr.version : 0);
2067                 return WPS_FAILURE;
2068         }
2069
2070         if (attr.msg_type == NULL) {
2071                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2072                 return WPS_FAILURE;
2073         }
2074
2075         if (*attr.msg_type != WPS_WSC_DONE) {
2076                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2077                            *attr.msg_type);
2078                 return WPS_FAILURE;
2079         }
2080
2081         if (attr.registrar_nonce == NULL ||
2082             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2083         {
2084                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2085                 return WPS_FAILURE;
2086         }
2087
2088         if (attr.enrollee_nonce == NULL ||
2089             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2090                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2091                 return WPS_FAILURE;
2092         }
2093
2094         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
2095
2096         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
2097             wps->wps->ap) {
2098                 struct wps_credential cred;
2099
2100                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
2101                            "on first Enrollee connection");
2102
2103                 os_memset(&cred, 0, sizeof(cred));
2104                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
2105                 cred.ssid_len = wps->wps->ssid_len;
2106                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
2107                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
2108                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
2109                 cred.key_len = wps->new_psk_len;
2110
2111                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
2112                 wpa_hexdump_ascii_key(MSG_DEBUG,
2113                                       "WPS: Generated random passphrase",
2114                                       wps->new_psk, wps->new_psk_len);
2115                 if (wps->wps->cred_cb)
2116                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
2117
2118                 os_free(wps->new_psk);
2119                 wps->new_psk = NULL;
2120         }
2121
2122         if (!wps->wps->ap) {
2123                 wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
2124                            "on the modified AP configuration");
2125                 if (wps->wps->cred_cb)
2126                         wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2127         }
2128
2129         if (wps->new_psk) {
2130                 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
2131                                    wps->new_psk, wps->new_psk_len)) {
2132                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
2133                                    "new PSK");
2134                 }
2135                 os_free(wps->new_psk);
2136                 wps->new_psk = NULL;
2137         }
2138
2139         if (wps->pbc) {
2140                 wps_registrar_remove_pbc_session(wps->wps->registrar,
2141                                                  wps->mac_addr_e, wps->uuid_e);
2142                 wps_registrar_pbc_completed(wps->wps->registrar);
2143         }
2144
2145         wps_success_event(wps->wps);
2146
2147         return WPS_DONE;
2148 }
2149
2150
2151 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
2152                                                enum wsc_op_code op_code,
2153                                                const struct wpabuf *msg)
2154 {
2155         enum wps_process_res ret;
2156
2157         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2158                    "op_code=%d)",
2159                    (unsigned long) wpabuf_len(msg), op_code);
2160
2161         switch (op_code) {
2162         case WSC_MSG:
2163                 return wps_process_wsc_msg(wps, msg);
2164         case WSC_ACK:
2165                 return wps_process_wsc_ack(wps, msg);
2166         case WSC_NACK:
2167                 return wps_process_wsc_nack(wps, msg);
2168         case WSC_Done:
2169                 ret = wps_process_wsc_done(wps, msg);
2170                 if (ret == WPS_FAILURE) {
2171                         wps->state = SEND_WSC_NACK;
2172                         wps_fail_event(wps->wps, WPS_WSC_DONE);
2173                 }
2174                 return ret;
2175         default:
2176                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
2177                 return WPS_FAILURE;
2178         }
2179 }