Remove src/crypto from default include path
[libeap.git] / src / wps / wps_registrar.c
index dff635d..2da674b 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * Wi-Fi Protected Setup - Registrar
- * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
+ * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
 #include "includes.h"
 
 #include "common.h"
-#include "sha256.h"
 #include "base64.h"
-#include "ieee802_11_defs.h"
 #include "eloop.h"
+#include "crypto/crypto.h"
+#include "crypto/sha256.h"
+#include "common/ieee802_11_defs.h"
 #include "wps_i.h"
 #include "wps_dev_attr.h"
 #include "wps_upnp.h"
-#include "crypto.h"
+#include "uuid.h"
 
+#define WPS_WORKAROUNDS
 
 struct wps_uuid_pin {
        struct wps_uuid_pin *next;
@@ -31,7 +33,10 @@ struct wps_uuid_pin {
        int wildcard_uuid;
        u8 *pin;
        size_t pin_len;
-       int locked;
+#define PIN_LOCKED BIT(0)
+#define PIN_EXPIRES BIT(1)
+       int flags;
+       struct os_time expiration;
 };
 
 
@@ -75,6 +80,13 @@ static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
 }
 
 
+struct wps_registrar_device {
+       struct wps_registrar_device *next;
+       struct wps_device_data dev;
+       u8 uuid[WPS_UUID_LEN];
+};
+
+
 struct wps_registrar {
        struct wps_context *wps;
 
@@ -89,6 +101,8 @@ struct wps_registrar {
                              const struct wps_device_data *dev);
        void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
                               const u8 *uuid_e);
+       void (*set_sel_reg_cb)(void *ctx, int sel_reg, u16 dev_passwd_id,
+                              u16 sel_reg_config_methods);
        void *cb_ctx;
 
        struct wps_uuid_pin *pins;
@@ -99,15 +113,87 @@ struct wps_registrar {
        int disable_auto_conf;
        int sel_reg_dev_password_id_override;
        int sel_reg_config_methods_override;
+       int static_wep_only;
+
+       struct wps_registrar_device *devices;
+
+       int force_pbc_overlap;
 };
 
 
 static int wps_set_ie(struct wps_registrar *reg);
+static void wps_cb_set_sel_reg(struct wps_registrar *reg);
 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
                                               void *timeout_ctx);
 
 
+static void wps_free_devices(struct wps_registrar_device *dev)
+{
+       struct wps_registrar_device *prev;
+
+       while (dev) {
+               prev = dev;
+               dev = dev->next;
+               wps_device_data_free(&prev->dev);
+               os_free(prev);
+       }
+}
+
+
+static struct wps_registrar_device * wps_device_get(struct wps_registrar *reg,
+                                                   const u8 *addr)
+{
+       struct wps_registrar_device *dev;
+
+       for (dev = reg->devices; dev; dev = dev->next) {
+               if (os_memcmp(dev->dev.mac_addr, addr, ETH_ALEN) == 0)
+                       return dev;
+       }
+       return NULL;
+}
+
+
+static void wps_device_clone_data(struct wps_device_data *dst,
+                                 struct wps_device_data *src)
+{
+       os_memcpy(dst->mac_addr, src->mac_addr, ETH_ALEN);
+       os_memcpy(dst->pri_dev_type, src->pri_dev_type, WPS_DEV_TYPE_LEN);
+
+#define WPS_STRDUP(n) \
+       os_free(dst->n); \
+       dst->n = src->n ? os_strdup(src->n) : NULL
+
+       WPS_STRDUP(device_name);
+       WPS_STRDUP(manufacturer);
+       WPS_STRDUP(model_name);
+       WPS_STRDUP(model_number);
+       WPS_STRDUP(serial_number);
+#undef WPS_STRDUP
+}
+
+
+int wps_device_store(struct wps_registrar *reg,
+                    struct wps_device_data *dev, const u8 *uuid)
+{
+       struct wps_registrar_device *d;
+
+       d = wps_device_get(reg, dev->mac_addr);
+       if (d == NULL) {
+               d = os_zalloc(sizeof(*d));
+               if (d == NULL)
+                       return -1;
+               d->next = reg->devices;
+               reg->devices = d;
+       }
+
+       wps_device_clone_data(&d->dev, dev);
+       os_memcpy(d->uuid, uuid, WPS_UUID_LEN);
+
+       return 0;
+}
+
+
 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
                                          const u8 *addr, const u8 *uuid_e)
 {
@@ -364,6 +450,7 @@ wps_registrar_init(struct wps_context *wps,
        reg->set_ie_cb = cfg->set_ie_cb;
        reg->pin_needed_cb = cfg->pin_needed_cb;
        reg->reg_success_cb = cfg->reg_success_cb;
+       reg->set_sel_reg_cb = cfg->set_sel_reg_cb;
        reg->cb_ctx = cfg->cb_ctx;
        reg->skip_cred_build = cfg->skip_cred_build;
        if (cfg->extra_cred) {
@@ -377,6 +464,7 @@ wps_registrar_init(struct wps_context *wps,
        reg->disable_auto_conf = cfg->disable_auto_conf;
        reg->sel_reg_dev_password_id_override = -1;
        reg->sel_reg_config_methods_override = -1;
+       reg->static_wep_only = cfg->static_wep_only;
 
        if (wps_set_ie(reg)) {
                wps_registrar_deinit(reg);
@@ -400,6 +488,7 @@ void wps_registrar_deinit(struct wps_registrar *reg)
        wps_free_pins(reg->pins);
        wps_free_pbc_sessions(reg->pbc_sessions);
        wpabuf_free(reg->extra_cred);
+       wps_free_devices(reg->devices);
        os_free(reg);
 }
 
@@ -410,10 +499,11 @@ void wps_registrar_deinit(struct wps_registrar *reg)
  * @uuid: UUID-E or %NULL for wildcard (any UUID)
  * @pin: PIN (Device Password)
  * @pin_len: Length of pin in octets
+ * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
  * Returns: 0 on success, -1 on failure
  */
 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
-                         const u8 *pin, size_t pin_len)
+                         const u8 *pin, size_t pin_len, int timeout)
 {
        struct wps_uuid_pin *p;
 
@@ -432,20 +522,60 @@ int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
        os_memcpy(p->pin, pin, pin_len);
        p->pin_len = pin_len;
 
+       if (timeout) {
+               p->flags |= PIN_EXPIRES;
+               os_get_time(&p->expiration);
+               p->expiration.sec += timeout;
+       }
+
        p->next = reg->pins;
        reg->pins = p;
 
-       wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
+       wpa_printf(MSG_DEBUG, "WPS: A new PIN configured (timeout=%d)",
+                  timeout);
        wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
        wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
        reg->selected_registrar = 1;
        reg->pbc = 0;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
+       eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
+       eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
+                              wps_registrar_set_selected_timeout,
+                              reg, NULL);
 
        return 0;
 }
 
 
+static void wps_registrar_expire_pins(struct wps_registrar *reg)
+{
+       struct wps_uuid_pin *pin, *prev, *del;
+       struct os_time now;
+
+       os_get_time(&now);
+       prev = NULL;
+       pin = reg->pins;
+       while (pin) {
+               if ((pin->flags & PIN_EXPIRES) &&
+                   os_time_before(&pin->expiration, &now)) {
+                       if (prev == NULL)
+                               reg->pins = pin->next;
+                       else
+                               prev->next = pin->next;
+                       del = pin;
+                       pin = pin->next;
+                       wpa_hexdump(MSG_DEBUG, "WPS: Expired PIN for UUID",
+                                   del->uuid, WPS_UUID_LEN);
+                       wps_free_pin(del);
+                       continue;
+               }
+               prev = pin;
+               pin = pin->next;
+       }
+}
+
+
 /**
  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
  * @reg: Registrar data from wps_registrar_init()
@@ -482,6 +612,8 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 {
        struct wps_uuid_pin *pin;
 
+       wps_registrar_expire_pins(reg);
+
        pin = reg->pins;
        while (pin) {
                if (!pin->wildcard_uuid &&
@@ -513,13 +645,13 @@ static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
         * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
         * that could otherwise avoid PIN invalidations.
         */
-       if (pin->locked) {
+       if (pin->flags & PIN_LOCKED) {
                wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
                           "allow concurrent re-use");
                return NULL;
        }
        *pin_len = pin->pin_len;
-       pin->locked = 1;
+       pin->flags |= PIN_LOCKED;
        return pin->pin;
 }
 
@@ -546,7 +678,7 @@ int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
                                           "wildcard PIN");
                                return wps_registrar_invalidate_pin(reg, uuid);
                        }
-                       pin->locked = 0;
+                       pin->flags &= ~PIN_LOCKED;
                        return 0;
                }
                pin = pin->next;
@@ -561,6 +693,7 @@ static void wps_registrar_stop_pbc(struct wps_registrar *reg)
        reg->selected_registrar = 0;
        reg->pbc = 0;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 }
 
 
@@ -569,6 +702,7 @@ static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
        struct wps_registrar *reg = eloop_ctx;
 
        wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
+       wps_pbc_timeout_event(reg->wps);
        wps_registrar_stop_pbc(reg);
 }
 
@@ -587,12 +721,15 @@ int wps_registrar_button_pushed(struct wps_registrar *reg)
        if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
                wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
                           "mode");
+               wps_pbc_overlap_event(reg->wps);
                return -1;
        }
        wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
+       reg->force_pbc_overlap = 0;
        reg->selected_registrar = 1;
        reg->pbc = 1;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 
        eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
        eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
@@ -608,6 +745,15 @@ static void wps_registrar_pbc_completed(struct wps_registrar *reg)
        wps_registrar_stop_pbc(reg);
 }
 
+static void wps_registrar_pin_completed(struct wps_registrar *reg)
+{
+       wpa_printf(MSG_DEBUG, "WPS: PIN completed using internal Registrar");
+       eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
+       reg->selected_registrar = 0;
+       wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
+}
+
 
 /**
  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
@@ -651,6 +797,11 @@ void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
                   MACSTR, MAC2STR(addr));
 
        wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
+       if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {
+               wpa_printf(MSG_DEBUG, "WPS: PBC session overlap detected");
+               reg->force_pbc_overlap = 1;
+               wps_pbc_overlap_event(reg->wps);
+       }
 }
 
 
@@ -698,6 +849,24 @@ static int wps_cb_set_ie(struct wps_registrar *reg,
 }
 
 
+static void wps_cb_set_sel_reg(struct wps_registrar *reg)
+{
+       u16 methods = 0;
+       if (reg->set_sel_reg_cb == NULL)
+               return;
+
+       if (reg->selected_registrar) {
+               methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
+               if (reg->pbc)
+                       methods |= WPS_CONFIG_PUSHBUTTON;
+       }
+
+       reg->set_sel_reg_cb(reg->cb_ctx, reg->selected_registrar,
+                           reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT,
+                           methods);
+}
+
+
 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 {
@@ -778,6 +947,28 @@ static int wps_set_ie(struct wps_registrar *reg)
                return -1;
        }
 
+       if (reg->static_wep_only) {
+               /*
+                * Windows XP and Vista clients can get confused about
+                * EAP-Identity/Request when they probe the network with
+                * EAPOL-Start. In such a case, they may assume the network is
+                * using IEEE 802.1X and prompt user for a certificate while
+                * the correct (non-WPS) behavior would be to ask for the
+                * static WEP key. As a workaround, use Microsoft Provisioning
+                * IE to advertise that legacy 802.1X is not supported.
+                */
+               const u8 ms_wps[7] = {
+                       WLAN_EID_VENDOR_SPECIFIC, 5,
+                       /* Microsoft Provisioning IE (00:50:f2:5) */
+                       0x00, 0x50, 0xf2, 5,
+                       0x00 /* no legacy 802.1X or MS WPS */
+               };
+               wpa_printf(MSG_DEBUG, "WPS: Add Microsoft Provisioning IE "
+                          "into Beacon/Probe Response frames");
+               wpabuf_put_data(beacon, ms_wps, sizeof(ms_wps));
+               wpabuf_put_data(probe, ms_wps, sizeof(ms_wps));
+       }
+
        ret = wps_cb_set_ie(reg, beacon, probe);
        wpabuf_free(beacon);
        wpabuf_free(probe);
@@ -900,7 +1091,7 @@ static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 
 
 static int wps_build_cred_network_idx(struct wpabuf *msg,
-                                     struct wps_credential *cred)
+                                     const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
        wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
@@ -911,7 +1102,7 @@ static int wps_build_cred_network_idx(struct wpabuf *msg,
 
 
 static int wps_build_cred_ssid(struct wpabuf *msg,
-                              struct wps_credential *cred)
+                              const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * SSID");
        wpabuf_put_be16(msg, ATTR_SSID);
@@ -922,7 +1113,7 @@ static int wps_build_cred_ssid(struct wpabuf *msg,
 
 
 static int wps_build_cred_auth_type(struct wpabuf *msg,
-                                   struct wps_credential *cred)
+                                   const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
                   cred->auth_type);
@@ -934,7 +1125,7 @@ static int wps_build_cred_auth_type(struct wpabuf *msg,
 
 
 static int wps_build_cred_encr_type(struct wpabuf *msg,
-                                   struct wps_credential *cred)
+                                   const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
                   cred->encr_type);
@@ -946,7 +1137,7 @@ static int wps_build_cred_encr_type(struct wpabuf *msg,
 
 
 static int wps_build_cred_network_key(struct wpabuf *msg,
-                                     struct wps_credential *cred)
+                                     const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
        wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
@@ -957,7 +1148,7 @@ static int wps_build_cred_network_key(struct wpabuf *msg,
 
 
 static int wps_build_cred_mac_addr(struct wpabuf *msg,
-                                  struct wps_credential *cred)
+                                  const struct wps_credential *cred)
 {
        wpa_printf(MSG_DEBUG, "WPS:  * MAC Address (" MACSTR ")",
                   MAC2STR(cred->mac_addr));
@@ -969,7 +1160,7 @@ static int wps_build_cred_mac_addr(struct wpabuf *msg,
 
 
 static int wps_build_credential(struct wpabuf *msg,
-                               struct wps_credential *cred)
+                               const struct wps_credential *cred)
 {
        if (wps_build_cred_network_idx(msg, cred) ||
            wps_build_cred_ssid(msg, cred) ||
@@ -990,6 +1181,10 @@ int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
                goto skip_cred_build;
 
        wpa_printf(MSG_DEBUG, "WPS:  * Credential");
+       if (wps->use_cred) {
+               os_memcpy(&wps->cred, wps->use_cred, sizeof(wps->cred));
+               goto use_provided;
+       }
        os_memset(&wps->cred, 0, sizeof(wps->cred));
 
        os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
@@ -1034,8 +1229,10 @@ int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
                }
        }
        wps->cred.encr_type = wps->encr_type;
-       /* Set MAC address in the Credential to be the AP's address (BSSID) */
-       os_memcpy(wps->cred.mac_addr, wps->wps->dev.mac_addr, ETH_ALEN);
+       /*
+        * Set MAC address in the Credential to be the Enrollee's MAC address
+        */
+       os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
 
        if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap &&
            !wps->wps->registrar->disable_auto_conf) {
@@ -1080,6 +1277,7 @@ int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
                wps->cred.key_len = wps->new_psk_len * 2;
        }
 
+use_provided:
        cred = wpabuf_alloc(200);
        if (cred == NULL)
                return -1;
@@ -1160,14 +1358,15 @@ static struct wpabuf * wps_build_m2(struct wps_data *wps)
 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
 {
        struct wpabuf *msg;
-       u16 err = WPS_CFG_NO_ERROR;
+       u16 err = wps->config_error;
 
        wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
        msg = wpabuf_alloc(1000);
        if (msg == NULL)
                return NULL;
 
-       if (wps->wps->ap && wps->wps->ap_setup_locked)
+       if (wps->wps->ap && wps->wps->ap_setup_locked &&
+           err == WPS_CFG_NO_ERROR)
                err = WPS_CFG_SETUP_LOCKED;
 
        if (wps_build_version(msg) ||
@@ -1284,8 +1483,8 @@ static struct wpabuf * wps_build_m8(struct wps_data *wps)
        if (wps_build_version(msg) ||
            wps_build_msg_type(msg, WPS_M8) ||
            wps_build_enrollee_nonce(wps, msg) ||
-           (wps->wps->ap && wps_build_cred(wps, plain)) ||
-           (!wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
+           ((wps->wps->ap || wps->er) && wps_build_cred(wps, plain)) ||
+           (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) ||
            wps_build_key_wrap_auth(wps, plain) ||
            wps_build_encr_settings(wps, msg, plain) ||
            wps_build_authenticator(wps, msg)) {
@@ -1369,8 +1568,18 @@ struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
                        else
                                wps->wps->upnp_msgs = NULL;
                        msg = p->msg;
+                       switch (p->type) {
+                       case WPS_WSC_ACK:
+                               *op_code = WSC_ACK;
+                               break;
+                       case WPS_WSC_NACK:
+                               *op_code = WSC_NACK;
+                               break;
+                       default:
+                               *op_code = WSC_MSG;
+                               break;
+                       }
                        os_free(p);
-                       *op_code = WSC_MSG;
                        if (wps->ext_reg == 0)
                                wps->ext_reg = 1;
                        return msg;
@@ -1671,7 +1880,21 @@ static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
                wpa_printf(MSG_DEBUG, "WPS: No match in supported "
                           "authentication types (own 0x%x Enrollee 0x%x)",
                           wps->wps->auth_types, auth_types);
+#ifdef WPS_WORKAROUNDS
+               /*
+                * Some deployed implementations seem to advertise incorrect
+                * information in this attribute. For example, Linksys WRT350N
+                * seems to have a byteorder bug that breaks this negotiation.
+                * In order to interoperate with existing implementations,
+                * assume that the Enrollee supports everything we do.
+                */
+               wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
+                          "does not advertise supported authentication types "
+                          "correctly");
+               wps->auth_type = wps->wps->auth_types;
+#else /* WPS_WORKAROUNDS */
                return -1;
+#endif /* WPS_WORKAROUNDS */
        }
 
        return 0;
@@ -1695,8 +1918,23 @@ static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
        wps->encr_type = wps->wps->encr_types & encr_types;
        if (wps->encr_type == 0) {
                wpa_printf(MSG_DEBUG, "WPS: No match in supported "
-                          "encryption types");
+                          "encryption types (own 0x%x Enrollee 0x%x)",
+                          wps->wps->encr_types, encr_types);
+#ifdef WPS_WORKAROUNDS
+               /*
+                * Some deployed implementations seem to advertise incorrect
+                * information in this attribute. For example, Linksys WRT350N
+                * seems to have a byteorder bug that breaks this negotiation.
+                * In order to interoperate with existing implementations,
+                * assume that the Enrollee supports everything we do.
+                */
+               wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
+                          "does not advertise supported encryption types "
+                          "correctly");
+               wps->encr_type = wps->wps->encr_types;
+#else /* WPS_WORKAROUNDS */
                return -1;
+#endif /* WPS_WORKAROUNDS */
        }
 
        return 0;
@@ -1834,11 +2072,15 @@ static enum wps_process_res wps_process_m1(struct wps_data *wps,
 #endif /* CONFIG_WPS_OOB */
 
        if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
-               if (wps_registrar_pbc_overlap(wps->wps->registrar,
+               if (wps->wps->registrar->force_pbc_overlap ||
+                   wps_registrar_pbc_overlap(wps->wps->registrar,
                                              wps->mac_addr_e, wps->uuid_e)) {
                        wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
                                   "negotiation");
                        wps->state = SEND_M2D;
+                       wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+                       wps_pbc_overlap_event(wps->wps);
+                       wps->wps->registrar->force_pbc_overlap = 1;
                        return WPS_CONTINUE;
                }
                wps_registrar_add_pbc_session(wps->wps->registrar,
@@ -1864,6 +2106,14 @@ static enum wps_process_res wps_process_m3(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg) ||
            wps_process_e_hash1(wps, attr->e_hash1) ||
@@ -1893,6 +2143,14 @@ static enum wps_process_res wps_process_m5(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg)) {
                wps->state = SEND_WSC_NACK;
@@ -1924,10 +2182,45 @@ static enum wps_process_res wps_process_m5(struct wps_data *wps,
 }
 
 
+static void wps_sta_cred_cb(struct wps_data *wps)
+{
+       /*
+        * Update credential to only include a single authentication and
+        * encryption type in case the AP configuration includes more than one
+        * option.
+        */
+       if (wps->cred.auth_type & WPS_AUTH_WPA2PSK)
+               wps->cred.auth_type = WPS_AUTH_WPA2PSK;
+       else if (wps->cred.auth_type & WPS_AUTH_WPAPSK)
+               wps->cred.auth_type = WPS_AUTH_WPAPSK;
+       if (wps->cred.encr_type & WPS_ENCR_AES)
+               wps->cred.encr_type = WPS_ENCR_AES;
+       else if (wps->cred.encr_type & WPS_ENCR_TKIP)
+               wps->cred.encr_type = WPS_ENCR_TKIP;
+       wpa_printf(MSG_DEBUG, "WPS: Update local configuration based on the "
+                  "AP configuration");
+       if (wps->wps->cred_cb)
+               wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
+}
+
+
+static void wps_cred_update(struct wps_credential *dst,
+                           struct wps_credential *src)
+{
+       os_memcpy(dst->ssid, src->ssid, sizeof(dst->ssid));
+       dst->ssid_len = src->ssid_len;
+       dst->auth_type = src->auth_type;
+       dst->encr_type = src->encr_type;
+       dst->key_idx = src->key_idx;
+       os_memcpy(dst->key, src->key, sizeof(dst->key));
+       dst->key_len = src->key_len;
+}
+
+
 static int wps_process_ap_settings_r(struct wps_data *wps,
                                     struct wps_parse_attr *attr)
 {
-       if (wps->wps->ap)
+       if (wps->wps->ap || wps->er)
                return 0;
 
        /* AP Settings Attributes in M7 when Enrollee is an AP */
@@ -1936,12 +2229,24 @@ static int wps_process_ap_settings_r(struct wps_data *wps,
 
        wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
 
-       /*
-        * TODO: Provide access to AP settings and allow changes before sending
-        * out M8. For now, just copy the settings unchanged into M8.
-        */
-
-       return 0;
+       if (wps->new_ap_settings) {
+               wpa_printf(MSG_INFO, "WPS: Update AP configuration based on "
+                          "new settings");
+               wps_cred_update(&wps->cred, wps->new_ap_settings);
+               return 0;
+       } else {
+               /*
+                * Use the AP PIN only to receive the current AP settings, not
+                * to reconfigure the AP.
+                */
+               if (wps->ap_settings_cb) {
+                       wps->ap_settings_cb(wps->ap_settings_cb_ctx,
+                                           &wps->cred);
+                       return 1;
+               }
+               wps_sta_cred_cb(wps);
+               return 1;
+       }
 }
 
 
@@ -1961,6 +2266,14 @@ static enum wps_process_res wps_process_m7(struct wps_data *wps,
                return WPS_CONTINUE;
        }
 
+       if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
+               wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
+                          "session overlap");
+               wps->state = SEND_WSC_NACK;
+               wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
+               return WPS_CONTINUE;
+       }
+
        if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
            wps_process_authenticator(wps, attr->authenticator, msg)) {
                wps->state = SEND_WSC_NACK;
@@ -1970,7 +2283,7 @@ static enum wps_process_res wps_process_m7(struct wps_data *wps,
        decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
                                              attr->encr_settings_len);
        if (decrypted == NULL) {
-               wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
+               wpa_printf(MSG_DEBUG, "WPS: Failed to decrypt Encrypted "
                           "Settings attribute");
                wps->state = SEND_WSC_NACK;
                return WPS_CONTINUE;
@@ -2264,6 +2577,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
        if (wps->wps->wps_upnp && wps->ext_reg) {
                wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
                           "Registrar completed successfully");
+               wps_device_store(wps->wps->registrar, &wps->peer_dev,
+                                wps->uuid_e);
                return WPS_DONE;
        }
 #endif /* CONFIG_WPS_UPNP */
@@ -2282,6 +2597,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
        }
 
        wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
+       wps_device_store(wps->wps->registrar, &wps->peer_dev,
+                        wps->uuid_e);
 
        if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
            wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
@@ -2309,12 +2626,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
                wps->new_psk = NULL;
        }
 
-       if (!wps->wps->ap) {
-               wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
-                          "on the modified AP configuration");
-               if (wps->wps->cred_cb)
-                       wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
-       }
+       if (!wps->wps->ap && !wps->er)
+               wps_sta_cred_cb(wps);
 
        if (wps->new_psk) {
                if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
@@ -2332,6 +2645,8 @@ static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
                wps_registrar_remove_pbc_session(wps->wps->registrar,
                                                 wps->mac_addr_e, wps->uuid_e);
                wps_registrar_pbc_completed(wps->wps->registrar);
+       } else {
+               wps_registrar_pin_completed(wps->wps->registrar);
        }
 
        wps_success_event(wps->wps);
@@ -2361,7 +2676,8 @@ enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
                wps_registrar_free_pending_m2(wps->wps);
        if (wps->wps->wps_upnp && wps->ext_reg &&
            wps->wps->upnp_msgs == NULL &&
-           (op_code == WSC_MSG || op_code == WSC_Done)) {
+           (op_code == WSC_MSG || op_code == WSC_Done || op_code == WSC_NACK))
+       {
                struct wps_parse_attr attr;
                int type;
                if (wps_parse_msg(msg, &attr) < 0 || attr.msg_type == NULL)
@@ -2422,6 +2738,7 @@ static void wps_registrar_set_selected_timeout(void *eloop_ctx,
        reg->sel_reg_dev_password_id_override = -1;
        reg->sel_reg_config_methods_override = -1;
        wps_set_ie(reg);
+       wps_cb_set_sel_reg(reg);
 }
 
 
@@ -2429,7 +2746,6 @@ static void wps_registrar_set_selected_timeout(void *eloop_ctx,
  * wps_registrar_set_selected_registrar - Notification of SetSelectedRegistrar
  * @reg: Registrar data from wps_registrar_init()
  * @msg: Received message from SetSelectedRegistrar
- * @msg_len: Length of msg in octets
  * Returns: 0 on success, -1 on failure
  *
  * This function is called when an AP receives a SetSelectedRegistrar UPnP
@@ -2474,3 +2790,41 @@ int wps_registrar_set_selected_registrar(struct wps_registrar *reg,
                               reg, NULL);
        return 0;
 }
+
+
+int wps_registrar_get_info(struct wps_registrar *reg, const u8 *addr,
+                          char *buf, size_t buflen)
+{
+       struct wps_registrar_device *d;
+       int len = 0, ret;
+       char uuid[40];
+       char devtype[WPS_DEV_TYPE_BUFSIZE];
+
+       d = wps_device_get(reg, addr);
+       if (d == NULL)
+               return 0;
+       if (uuid_bin2str(d->uuid, uuid, sizeof(uuid)))
+               return 0;
+
+       ret = os_snprintf(buf + len, buflen - len,
+                         "wpsUuid=%s\n"
+                         "wpsPrimaryDeviceType=%s\n"
+                         "wpsDeviceName=%s\n"
+                         "wpsManufacturer=%s\n"
+                         "wpsModelName=%s\n"
+                         "wpsModelNumber=%s\n"
+                         "wpsSerialNumber=%s\n",
+                         uuid,
+                         wps_dev_type_bin2str(d->dev.pri_dev_type, devtype,
+                                              sizeof(devtype)),
+                         d->dev.device_name ? d->dev.device_name : "",
+                         d->dev.manufacturer ? d->dev.manufacturer : "",
+                         d->dev.model_name ? d->dev.model_name : "",
+                         d->dev.model_number ? d->dev.model_number : "",
+                         d->dev.serial_number ? d->dev.serial_number : "");
+       if (ret < 0 || (size_t) ret >= buflen - len)
+               return len;
+       len += ret;
+
+       return len;
+}