src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "utils/includes.h"
  16
  17 #include "utils/common.h"
  18 #include "utils/base64.h"
  19 #include "utils/eloop.h"
  20 #include "utils/uuid.h"
  21 #include "utils/list.h"
  22 #include "crypto/crypto.h"
  23 #include "crypto/sha256.h"
  24 #include "crypto/random.h"
  25 #include "common/ieee802_11_defs.h"
  26 #include "wps_i.h"
  27 #include "wps_dev_attr.h"
  28 #include "wps_upnp.h"
  29 #include "wps_upnp_i.h"
  30
  31 #ifndef CONFIG_WPS_STRICT
  32 #define WPS_WORKAROUNDS
  33 #endif /* CONFIG_WPS_STRICT */
  34
  35 struct wps_uuid_pin {
  36         struct dl_list list;
  37         u8 uuid[WPS_UUID_LEN];
  38         int wildcard_uuid;
  39         u8 *pin;
  40         size_t pin_len;
  41 #define PIN_LOCKED BIT(0)
  42 #define PIN_EXPIRES BIT(1)
  43         int flags;
  44         struct os_time expiration;
  45         u8 enrollee_addr[ETH_ALEN];
  46 };
  47
  48
  49 static void wps_free_pin(struct wps_uuid_pin *pin)
  50 {
  51         os_free(pin->pin);
  52         os_free(pin);
  53 }
  54
  55
  56 static void wps_remove_pin(struct wps_uuid_pin *pin)
  57 {
  58         dl_list_del(&pin->list);
  59         wps_free_pin(pin);
  60 }
  61
  62
  63 static void wps_free_pins(struct dl_list *pins)
  64 {
  65         struct wps_uuid_pin *pin, *prev;
  66         dl_list_for_each_safe(pin, prev, pins, struct wps_uuid_pin, list)
  67                 wps_remove_pin(pin);
  68 }
  69
  70
  71 struct wps_pbc_session {
  72         struct wps_pbc_session *next;
  73         u8 addr[ETH_ALEN];
  74         u8 uuid_e[WPS_UUID_LEN];
  75         struct os_time timestamp;
  76 };
  77
  78
  79 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  80 {
  81         struct wps_pbc_session *prev;
  82
  83         while (pbc) {
  84                 prev = pbc;
  85                 pbc = pbc->next;
  86                 os_free(prev);
  87         }
  88 }
  89
  90
  91 struct wps_registrar_device {
  92         struct wps_registrar_device *next;
  93         struct wps_device_data dev;
  94         u8 uuid[WPS_UUID_LEN];
  95 };
  96
  97
  98 struct wps_registrar {
  99         struct wps_context *wps;
 100
 101         int pbc;
 102         int selected_registrar;
 103
 104         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
 105                           size_t psk_len);
 106         int (*set_ie_cb)(void *ctx, struct wpabuf *beacon_ie,
 107                          struct wpabuf *probe_resp_ie);
 108         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
 109                               const struct wps_device_data *dev);
 110         void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
 111                                const u8 *uuid_e);
 112         void (*set_sel_reg_cb)(void *ctx, int sel_reg, u16 dev_passwd_id,
 113                                u16 sel_reg_config_methods);
 114         void (*enrollee_seen_cb)(void *ctx, const u8 *addr, const u8 *uuid_e,
 115                                  const u8 *pri_dev_type, u16 config_methods,
 116                                  u16 dev_password_id, u8 request_type,
 117                                  const char *dev_name);
 118         void *cb_ctx;
 119
 120         struct dl_list pins;
 121         struct wps_pbc_session *pbc_sessions;
 122
 123         int skip_cred_build;
 124         struct wpabuf *extra_cred;
 125         int disable_auto_conf;
 126         int sel_reg_union;
 127         int sel_reg_dev_password_id_override;
 128         int sel_reg_config_methods_override;
 129         int static_wep_only;
 130         int dualband;
 131
 132         struct wps_registrar_device *devices;
 133
 134         int force_pbc_overlap;
 135
 136         u8 authorized_macs[WPS_MAX_AUTHORIZED_MACS][ETH_ALEN];
 137         u8 authorized_macs_union[WPS_MAX_AUTHORIZED_MACS][ETH_ALEN];
 138
 139         u8 p2p_dev_addr[ETH_ALEN];
 140 };
 141
 142
 143 static int wps_set_ie(struct wps_registrar *reg);
 144 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 145 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
 146                                                void *timeout_ctx);
 147
 148
 149 static void wps_registrar_add_authorized_mac(struct wps_registrar *reg,
 150                                              const u8 *addr)
 151 {
 152         int i;
 153         wpa_printf(MSG_DEBUG, "WPS: Add authorized MAC " MACSTR,
 154                    MAC2STR(addr));
 155         for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++)
 156                 if (os_memcmp(reg->authorized_macs[i], addr, ETH_ALEN) == 0) {
 157                         wpa_printf(MSG_DEBUG, "WPS: Authorized MAC was "
 158                                    "already in the list");
 159                         return; /* already in list */
 160                 }
 161         for (i = WPS_MAX_AUTHORIZED_MACS - 1; i > 0; i--)
 162                 os_memcpy(reg->authorized_macs[i], reg->authorized_macs[i - 1],
 163                           ETH_ALEN);
 164         os_memcpy(reg->authorized_macs[0], addr, ETH_ALEN);
 165         wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs",
 166                     (u8 *) reg->authorized_macs, sizeof(reg->authorized_macs));
 167 }
 168
 169
 170 static void wps_registrar_remove_authorized_mac(struct wps_registrar *reg,
 171                                                 const u8 *addr)
 172 {
 173         int i;
 174         wpa_printf(MSG_DEBUG, "WPS: Remove authorized MAC " MACSTR,
 175                    MAC2STR(addr));
 176         for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++) {
 177                 if (os_memcmp(reg->authorized_macs, addr, ETH_ALEN) == 0)
 178                         break;
 179         }
 180         if (i == WPS_MAX_AUTHORIZED_MACS) {
 181                 wpa_printf(MSG_DEBUG, "WPS: Authorized MAC was not in the "
 182                            "list");
 183                 return; /* not in the list */
 184         }
 185         for (; i + 1 < WPS_MAX_AUTHORIZED_MACS; i++)
 186                 os_memcpy(reg->authorized_macs[i], reg->authorized_macs[i + 1],
 187                           ETH_ALEN);
 188         os_memset(reg->authorized_macs[WPS_MAX_AUTHORIZED_MACS - 1], 0,
 189                   ETH_ALEN);
 190         wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs",
 191                     (u8 *) reg->authorized_macs, sizeof(reg->authorized_macs));
 192 }
 193
 194
 195 static void wps_free_devices(struct wps_registrar_device *dev)
 196 {
 197         struct wps_registrar_device *prev;
 198
 199         while (dev) {
 200                 prev = dev;
 201                 dev = dev->next;
 202                 wps_device_data_free(&prev->dev);
 203                 os_free(prev);
 204         }
 205 }
 206
 207
 208 static struct wps_registrar_device * wps_device_get(struct wps_registrar *reg,
 209                                                     const u8 *addr)
 210 {
 211         struct wps_registrar_device *dev;
 212
 213         for (dev = reg->devices; dev; dev = dev->next) {
 214                 if (os_memcmp(dev->dev.mac_addr, addr, ETH_ALEN) == 0)
 215                         return dev;
 216         }
 217         return NULL;
 218 }
 219
 220
 221 static void wps_device_clone_data(struct wps_device_data *dst,
 222                                   struct wps_device_data *src)
 223 {
 224         os_memcpy(dst->mac_addr, src->mac_addr, ETH_ALEN);
 225         os_memcpy(dst->pri_dev_type, src->pri_dev_type, WPS_DEV_TYPE_LEN);
 226
 227 #define WPS_STRDUP(n) \
 228         os_free(dst->n); \
 229         dst->n = src->n ? os_strdup(src->n) : NULL
 230
 231         WPS_STRDUP(device_name);
 232         WPS_STRDUP(manufacturer);
 233         WPS_STRDUP(model_name);
 234         WPS_STRDUP(model_number);
 235         WPS_STRDUP(serial_number);
 236 #undef WPS_STRDUP
 237 }
 238
 239
 240 int wps_device_store(struct wps_registrar *reg,
 241                      struct wps_device_data *dev, const u8 *uuid)
 242 {
 243         struct wps_registrar_device *d;
 244
 245         d = wps_device_get(reg, dev->mac_addr);
 246         if (d == NULL) {
 247                 d = os_zalloc(sizeof(*d));
 248                 if (d == NULL)
 249                         return -1;
 250                 d->next = reg->devices;
 251                 reg->devices = d;
 252         }
 253
 254         wps_device_clone_data(&d->dev, dev);
 255         os_memcpy(d->uuid, uuid, WPS_UUID_LEN);
 256
 257         return 0;
 258 }
 259
 260
 261 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
 262                                           const u8 *addr, const u8 *uuid_e)
 263 {
 264         struct wps_pbc_session *pbc, *prev = NULL;
 265         struct os_time now;
 266
 267         os_get_time(&now);
 268
 269         pbc = reg->pbc_sessions;
 270         while (pbc) {
 271                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 272                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 273                         if (prev)
 274                                 prev->next = pbc->next;
 275                         else
 276                                 reg->pbc_sessions = pbc->next;
 277                         break;
 278                 }
 279                 prev = pbc;
 280                 pbc = pbc->next;
 281         }
 282
 283         if (!pbc) {
 284                 pbc = os_zalloc(sizeof(*pbc));
 285                 if (pbc == NULL)
 286                         return;
 287                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 288                 if (uuid_e)
 289                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 290         }
 291
 292         pbc->next = reg->pbc_sessions;
 293         reg->pbc_sessions = pbc;
 294         pbc->timestamp = now;
 295
 296         /* remove entries that have timed out */
 297         prev = pbc;
 298         pbc = pbc->next;
 299
 300         while (pbc) {
 301                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 302                         prev->next = NULL;
 303                         wps_free_pbc_sessions(pbc);
 304                         break;
 305                 }
 306                 prev = pbc;
 307                 pbc = pbc->next;
 308         }
 309 }
 310
 311
 312 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 313                                              const u8 *addr, const u8 *uuid_e)
 314 {
 315         struct wps_pbc_session *pbc, *prev = NULL;
 316
 317         pbc = reg->pbc_sessions;
 318         while (pbc) {
 319                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 320                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 321                         if (prev)
 322                                 prev->next = pbc->next;
 323                         else
 324                                 reg->pbc_sessions = pbc->next;
 325                         os_free(pbc);
 326                         break;
 327                 }
 328                 prev = pbc;
 329                 pbc = pbc->next;
 330         }
 331 }
 332
 333
 334 int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 335                               const u8 *addr, const u8 *uuid_e)
 336 {
 337         int count = 0;
 338         struct wps_pbc_session *pbc;
 339         struct os_time now;
 340
 341         os_get_time(&now);
 342
 343         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 344                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 345                         break;
 346                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 347                     uuid_e == NULL ||
 348                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 349                         count++;
 350         }
 351
 352         if (addr || uuid_e)
 353                 count++;
 354
 355         return count > 1 ? 1 : 0;
 356 }
 357
 358
 359 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 360 {
 361         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 362                    wps->wps_state);
 363         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 364         wpabuf_put_be16(msg, 1);
 365         wpabuf_put_u8(msg, wps->wps_state);
 366         return 0;
 367 }
 368
 369
 370 #ifdef CONFIG_WPS_UPNP
 371 static void wps_registrar_free_pending_m2(struct wps_context *wps)
 372 {
 373         struct upnp_pending_message *p, *p2, *prev = NULL;
 374         p = wps->upnp_msgs;
 375         while (p) {
 376                 if (p->type == WPS_M2 || p->type == WPS_M2D) {
 377                         if (prev == NULL)
 378                                 wps->upnp_msgs = p->next;
 379                         else
 380                                 prev->next = p->next;
 381                         wpa_printf(MSG_DEBUG, "WPS UPnP: Drop pending M2/M2D");
 382                         p2 = p;
 383                         p = p->next;
 384                         wpabuf_free(p2->msg);
 385                         os_free(p2);
 386                         continue;
 387                 }
 388                 prev = p;
 389                 p = p->next;
 390         }
 391 }
 392 #endif /* CONFIG_WPS_UPNP */
 393
 394
 395 static int wps_build_ap_setup_locked(struct wps_context *wps,
 396                                      struct wpabuf *msg)
 397 {
 398         if (wps->ap_setup_locked && wps->ap_setup_locked != 2) {
 399                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 400                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 401                 wpabuf_put_be16(msg, 1);
 402                 wpabuf_put_u8(msg, 1);
 403         }
 404         return 0;
 405 }
 406
 407
 408 static int wps_build_selected_registrar(struct wps_registrar *reg,
 409                                         struct wpabuf *msg)
 410 {
 411         if (!reg->sel_reg_union)
 412                 return 0;
 413         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 414         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 415         wpabuf_put_be16(msg, 1);
 416         wpabuf_put_u8(msg, 1);
 417         return 0;
 418 }
 419
 420
 421 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 422                                              struct wpabuf *msg)
 423 {
 424         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 425         if (!reg->sel_reg_union)
 426                 return 0;
 427         if (reg->sel_reg_dev_password_id_override >= 0)
 428                 id = reg->sel_reg_dev_password_id_override;
 429         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 430         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 431         wpabuf_put_be16(msg, 2);
 432         wpabuf_put_be16(msg, id);
 433         return 0;
 434 }
 435
 436
 437 static int wps_build_sel_pbc_reg_uuid_e(struct wps_registrar *reg,
 438                                         struct wpabuf *msg)
 439 {
 440         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 441         if (!reg->sel_reg_union)
 442                 return 0;
 443         if (reg->sel_reg_dev_password_id_override >= 0)
 444                 id = reg->sel_reg_dev_password_id_override;
 445         if (id != DEV_PW_PUSHBUTTON || !reg->dualband)
 446                 return 0;
 447         return wps_build_uuid_e(msg, reg->wps->uuid);
 448 }
 449
 450
 451 static void wps_set_pushbutton(u16 *methods, u16 conf_methods)
 452 {
 453         *methods |= WPS_CONFIG_PUSHBUTTON;
 454 #ifdef CONFIG_WPS2
 455         if (conf_methods & WPS_CONFIG_VIRT_PUSHBUTTON)
 456                 *methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
 457         if (conf_methods & WPS_CONFIG_PHY_PUSHBUTTON)
 458                 *methods |= WPS_CONFIG_PHY_PUSHBUTTON;
 459         if ((*methods & WPS_CONFIG_VIRT_PUSHBUTTON) !=
 460             WPS_CONFIG_VIRT_PUSHBUTTON ||
 461             (*methods & WPS_CONFIG_PHY_PUSHBUTTON) !=
 462             WPS_CONFIG_PHY_PUSHBUTTON) {
 463                 /*
 464                  * Required to include virtual/physical flag, but we were not
 465                  * configured with push button type, so have to default to one
 466                  * of them.
 467                  */
 468                 *methods |= WPS_CONFIG_PHY_PUSHBUTTON;
 469         }
 470 #endif /* CONFIG_WPS2 */
 471 }
 472
 473
 474 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 475                                             struct wpabuf *msg)
 476 {
 477         u16 methods;
 478         if (!reg->sel_reg_union)
 479                 return 0;
 480         methods = reg->wps->config_methods;
 481         methods &= ~WPS_CONFIG_PUSHBUTTON;
 482 #ifdef CONFIG_WPS2
 483         methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
 484                      WPS_CONFIG_PHY_PUSHBUTTON);
 485 #endif /* CONFIG_WPS2 */
 486         if (reg->pbc)
 487                 wps_set_pushbutton(&methods, reg->wps->config_methods);
 488         if (reg->sel_reg_config_methods_override >= 0)
 489                 methods = reg->sel_reg_config_methods_override;
 490         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 491                    methods);
 492         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 493         wpabuf_put_be16(msg, 2);
 494         wpabuf_put_be16(msg, methods);
 495         return 0;
 496 }
 497
 498
 499 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 500                                           struct wpabuf *msg)
 501 {
 502         u16 methods;
 503         /*
 504          * These are the methods that the AP supports as an Enrollee for adding
 505          * external Registrars.
 506          */
 507         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 508 #ifdef CONFIG_WPS2
 509         methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
 510                      WPS_CONFIG_PHY_PUSHBUTTON);
 511 #endif /* CONFIG_WPS2 */
 512         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 513         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 514         wpabuf_put_be16(msg, 2);
 515         wpabuf_put_be16(msg, methods);
 516         return 0;
 517 }
 518
 519
 520 static int wps_build_config_methods_r(struct wps_registrar *reg,
 521                                       struct wpabuf *msg)
 522 {
 523         u16 methods;
 524         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 525 #ifdef CONFIG_WPS2
 526         methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
 527                      WPS_CONFIG_PHY_PUSHBUTTON);
 528 #endif /* CONFIG_WPS2 */
 529         if (reg->pbc)
 530                 wps_set_pushbutton(&methods, reg->wps->config_methods);
 531         return wps_build_config_methods(msg, methods);
 532 }
 533
 534
 535 const u8 * wps_authorized_macs(struct wps_registrar *reg, size_t *count)
 536 {
 537         *count = 0;
 538
 539 #ifdef CONFIG_WPS2
 540         while (*count < WPS_MAX_AUTHORIZED_MACS) {
 541                 if (is_zero_ether_addr(reg->authorized_macs_union[*count]))
 542                         break;
 543                 (*count)++;
 544         }
 545 #endif /* CONFIG_WPS2 */
 546
 547         return (const u8 *) reg->authorized_macs_union;
 548 }
 549
 550
 551 /**
 552  * wps_registrar_init - Initialize WPS Registrar data
 553  * @wps: Pointer to longterm WPS context
 554  * @cfg: Registrar configuration
 555  * Returns: Pointer to allocated Registrar data or %NULL on failure
 556  *
 557  * This function is used to initialize WPS Registrar functionality. It can be
 558  * used for a single Registrar run (e.g., when run in a supplicant) or multiple
 559  * runs (e.g., when run as an internal Registrar in an AP). Caller is
 560  * responsible for freeing the returned data with wps_registrar_deinit() when
 561  * Registrar functionality is not needed anymore.
 562  */
 563 struct wps_registrar *
 564 wps_registrar_init(struct wps_context *wps,
 565                    const struct wps_registrar_config *cfg)
 566 {
 567         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 568         if (reg == NULL)
 569                 return NULL;
 570
 571         dl_list_init(&reg->pins);
 572         reg->wps = wps;
 573         reg->new_psk_cb = cfg->new_psk_cb;
 574         reg->set_ie_cb = cfg->set_ie_cb;
 575         reg->pin_needed_cb = cfg->pin_needed_cb;
 576         reg->reg_success_cb = cfg->reg_success_cb;
 577         reg->set_sel_reg_cb = cfg->set_sel_reg_cb;
 578         reg->enrollee_seen_cb = cfg->enrollee_seen_cb;
 579         reg->cb_ctx = cfg->cb_ctx;
 580         reg->skip_cred_build = cfg->skip_cred_build;
 581         if (cfg->extra_cred) {
 582                 reg->extra_cred = wpabuf_alloc_copy(cfg->extra_cred,
 583                                                     cfg->extra_cred_len);
 584                 if (reg->extra_cred == NULL) {
 585                         os_free(reg);
 586                         return NULL;
 587                 }
 588         }
 589         reg->disable_auto_conf = cfg->disable_auto_conf;
 590         reg->sel_reg_dev_password_id_override = -1;
 591         reg->sel_reg_config_methods_override = -1;
 592         reg->static_wep_only = cfg->static_wep_only;
 593         reg->dualband = cfg->dualband;
 594
 595         if (wps_set_ie(reg)) {
 596                 wps_registrar_deinit(reg);
 597                 return NULL;
 598         }
 599
 600         return reg;
 601 }
 602
 603
 604 /**
 605  * wps_registrar_deinit - Deinitialize WPS Registrar data
 606  * @reg: Registrar data from wps_registrar_init()
 607  */
 608 void wps_registrar_deinit(struct wps_registrar *reg)
 609 {
 610         if (reg == NULL)
 611                 return;
 612         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 613         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 614         wps_free_pins(&reg->pins);
 615         wps_free_pbc_sessions(reg->pbc_sessions);
 616         wpabuf_free(reg->extra_cred);
 617         wps_free_devices(reg->devices);
 618         os_free(reg);
 619 }
 620
 621
 622 /**
 623  * wps_registrar_add_pin - Configure a new PIN for Registrar
 624  * @reg: Registrar data from wps_registrar_init()
 625  * @addr: Enrollee MAC address or %NULL if not known
 626  * @uuid: UUID-E or %NULL for wildcard (any UUID)
 627  * @pin: PIN (Device Password)
 628  * @pin_len: Length of pin in octets
 629  * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
 630  * Returns: 0 on success, -1 on failure
 631  */
 632 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *addr,
 633                           const u8 *uuid, const u8 *pin, size_t pin_len,
 634                           int timeout)
 635 {
 636         struct wps_uuid_pin *p;
 637
 638         p = os_zalloc(sizeof(*p));
 639         if (p == NULL)
 640                 return -1;
 641         if (addr)
 642                 os_memcpy(p->enrollee_addr, addr, ETH_ALEN);
 643         if (uuid == NULL)
 644                 p->wildcard_uuid = 1;
 645         else
 646                 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 647         p->pin = os_malloc(pin_len);
 648         if (p->pin == NULL) {
 649                 os_free(p);
 650                 return -1;
 651         }
 652         os_memcpy(p->pin, pin, pin_len);
 653         p->pin_len = pin_len;
 654
 655         if (timeout) {
 656                 p->flags |= PIN_EXPIRES;
 657                 os_get_time(&p->expiration);
 658                 p->expiration.sec += timeout;
 659         }
 660
 661         dl_list_add(&reg->pins, &p->list);
 662
 663         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured (timeout=%d)",
 664                    timeout);
 665         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 666         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 667         reg->selected_registrar = 1;
 668         reg->pbc = 0;
 669         if (addr)
 670                 wps_registrar_add_authorized_mac(reg, addr);
 671         else
 672                 wps_registrar_add_authorized_mac(
 673                         reg, (u8 *) "\xff\xff\xff\xff\xff\xff");
 674         wps_registrar_selected_registrar_changed(reg);
 675         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 676         eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
 677                                wps_registrar_set_selected_timeout,
 678                                reg, NULL);
 679
 680         return 0;
 681 }
 682
 683
 684 static void wps_registrar_remove_pin(struct wps_registrar *reg,
 685                                      struct wps_uuid_pin *pin)
 686 {
 687         u8 *addr;
 688         u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 689
 690         if (is_zero_ether_addr(pin->enrollee_addr))
 691                 addr = bcast;
 692         else
 693                 addr = pin->enrollee_addr;
 694         wps_registrar_remove_authorized_mac(reg, addr);
 695         wps_remove_pin(pin);
 696         wps_registrar_selected_registrar_changed(reg);
 697 }
 698
 699
 700 static void wps_registrar_expire_pins(struct wps_registrar *reg)
 701 {
 702         struct wps_uuid_pin *pin, *prev;
 703         struct os_time now;
 704
 705         os_get_time(&now);
 706         dl_list_for_each_safe(pin, prev, &reg->pins, struct wps_uuid_pin, list)
 707         {
 708                 if ((pin->flags & PIN_EXPIRES) &&
 709                     os_time_before(&pin->expiration, &now)) {
 710                         wpa_hexdump(MSG_DEBUG, "WPS: Expired PIN for UUID",
 711                                     pin->uuid, WPS_UUID_LEN);
 712                         wps_registrar_remove_pin(reg, pin);
 713                 }
 714         }
 715 }
 716
 717
 718 /**
 719  * wps_registrar_invalidate_wildcard_pin - Invalidate a wildcard PIN
 720  * @reg: Registrar data from wps_registrar_init()
 721  * Returns: 0 on success, -1 if not wildcard PIN is enabled
 722  */
 723 static int wps_registrar_invalidate_wildcard_pin(struct wps_registrar *reg)
 724 {
 725         struct wps_uuid_pin *pin, *prev;
 726
 727         dl_list_for_each_safe(pin, prev, &reg->pins, struct wps_uuid_pin, list)
 728         {
 729                 if (pin->wildcard_uuid) {
 730                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 731                                     pin->uuid, WPS_UUID_LEN);
 732                         wps_registrar_remove_pin(reg, pin);
 733                         return 0;
 734                 }
 735         }
 736
 737         return -1;
 738 }
 739
 740
 741 /**
 742  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
 743  * @reg: Registrar data from wps_registrar_init()
 744  * @uuid: UUID-E
 745  * Returns: 0 on success, -1 on failure (e.g., PIN not found)
 746  */
 747 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 748 {
 749         struct wps_uuid_pin *pin, *prev;
 750
 751         dl_list_for_each_safe(pin, prev, &reg->pins, struct wps_uuid_pin, list)
 752         {
 753                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 754                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 755                                     pin->uuid, WPS_UUID_LEN);
 756                         wps_registrar_remove_pin(reg, pin);
 757                         return 0;
 758                 }
 759         }
 760
 761         return -1;
 762 }
 763
 764
 765 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 766                                         const u8 *uuid, size_t *pin_len)
 767 {
 768         struct wps_uuid_pin *pin, *found = NULL;
 769
 770         wps_registrar_expire_pins(reg);
 771
 772         dl_list_for_each(pin, &reg->pins, struct wps_uuid_pin, list) {
 773                 if (!pin->wildcard_uuid &&
 774                     os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 775                         found = pin;
 776                         break;
 777                 }
 778         }
 779
 780         if (!found) {
 781                 /* Check for wildcard UUIDs since none of the UUID-specific
 782                  * PINs matched */
 783                 dl_list_for_each(pin, &reg->pins, struct wps_uuid_pin, list) {
 784                         if (pin->wildcard_uuid == 1) {
 785                                 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
 786                                            "PIN. Assigned it for this UUID-E");
 787                                 pin->wildcard_uuid = 2;
 788                                 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
 789                                 found = pin;
 790                                 break;
 791                         }
 792                 }
 793         }
 794
 795         if (!found)
 796                 return NULL;
 797
 798         /*
 799          * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
 800          * that could otherwise avoid PIN invalidations.
 801          */
 802         if (found->flags & PIN_LOCKED) {
 803                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
 804                            "allow concurrent re-use");
 805                 return NULL;
 806         }
 807         *pin_len = found->pin_len;
 808         found->flags |= PIN_LOCKED;
 809         return found->pin;
 810 }
 811
 812
 813 /**
 814  * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
 815  * @reg: Registrar data from wps_registrar_init()
 816  * @uuid: UUID-E
 817  * Returns: 0 on success, -1 on failure
 818  *
 819  * PINs are locked to enforce only one concurrent use. This function unlocks a
 820  * PIN to allow it to be used again. If the specified PIN was configured using
 821  * a wildcard UUID, it will be removed instead of allowing multiple uses.
 822  */
 823 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 824 {
 825         struct wps_uuid_pin *pin;
 826
 827         dl_list_for_each(pin, &reg->pins, struct wps_uuid_pin, list) {
 828                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 829                         if (pin->wildcard_uuid == 2) {
 830                                 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
 831                                            "wildcard PIN");
 832                                 return wps_registrar_invalidate_pin(reg, uuid);
 833                         }
 834                         pin->flags &= ~PIN_LOCKED;
 835                         return 0;
 836                 }
 837         }
 838
 839         return -1;
 840 }
 841
 842
 843 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
 844 {
 845         reg->selected_registrar = 0;
 846         reg->pbc = 0;
 847         os_memset(reg->p2p_dev_addr, 0, ETH_ALEN);
 848         wps_registrar_remove_authorized_mac(reg,
 849                                             (u8 *) "\xff\xff\xff\xff\xff\xff");
 850         wps_registrar_selected_registrar_changed(reg);
 851 }
 852
 853
 854 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 855 {
 856         struct wps_registrar *reg = eloop_ctx;
 857
 858         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 859         wps_pbc_timeout_event(reg->wps);
 860         wps_registrar_stop_pbc(reg);
 861 }
 862
 863
 864 /**
 865  * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
 866  * @reg: Registrar data from wps_registrar_init()
 867  * @p2p_dev_addr: Limit allowed PBC devices to the specified P2P device, %NULL
 868  *      indicates no such filtering
 869  * Returns: 0 on success, -1 on failure
 870  *
 871  * This function is called on an AP when a push button is pushed to activate
 872  * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
 873  * or when a PBC registration is completed.
 874  */
 875 int wps_registrar_button_pushed(struct wps_registrar *reg,
 876                                 const u8 *p2p_dev_addr)
 877 {
 878         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 879                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 880                            "mode");
 881                 wps_pbc_overlap_event(reg->wps);
 882                 return -1;
 883         }
 884         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 885         reg->force_pbc_overlap = 0;
 886         reg->selected_registrar = 1;
 887         reg->pbc = 1;
 888         if (p2p_dev_addr)
 889                 os_memcpy(reg->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
 890         else
 891                 os_memset(reg->p2p_dev_addr, 0, ETH_ALEN);
 892         wps_registrar_add_authorized_mac(reg,
 893                                          (u8 *) "\xff\xff\xff\xff\xff\xff");
 894         wps_registrar_selected_registrar_changed(reg);
 895
 896         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 897         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 898         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 899                                reg, NULL);
 900         return 0;
 901 }
 902
 903
 904 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 905 {
 906         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 907         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 908         wps_registrar_stop_pbc(reg);
 909 }
 910
 911
 912 static void wps_registrar_pin_completed(struct wps_registrar *reg)
 913 {
 914         wpa_printf(MSG_DEBUG, "WPS: PIN completed using internal Registrar");
 915         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 916         reg->selected_registrar = 0;
 917         wps_registrar_selected_registrar_changed(reg);
 918 }
 919
 920
 921 int wps_registrar_wps_cancel(struct wps_registrar *reg)
 922 {
 923         if (reg->pbc) {
 924                 wpa_printf(MSG_DEBUG, "WPS: PBC is set - cancelling it");
 925                 wps_registrar_pbc_timeout(reg, NULL);
 926                 return 1;
 927         } else if (reg->selected_registrar) {
 928                 /* PIN Method */
 929                 wpa_printf(MSG_DEBUG, "WPS: PIN is set - cancelling it");
 930                 wps_registrar_pin_completed(reg);
 931                 wps_registrar_invalidate_wildcard_pin(reg);
 932                 return 1;
 933         }
 934         return 0;
 935 }
 936
 937
 938 /**
 939  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
 940  * @reg: Registrar data from wps_registrar_init()
 941  * @addr: MAC address of the Probe Request sender
 942  * @wps_data: WPS IE contents
 943  *
 944  * This function is called on an AP when a Probe Request with WPS IE is
 945  * received. This is used to track PBC mode use and to detect possible overlap
 946  * situation with other WPS APs.
 947  */
 948 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 949                                 const struct wpabuf *wps_data,
 950                                 int p2p_wildcard)
 951 {
 952         struct wps_parse_attr attr;
 953
 954         wpa_hexdump_buf(MSG_MSGDUMP,
 955                         "WPS: Probe Request with WPS data received",
 956                         wps_data);
 957
 958         if (wps_parse_msg(wps_data, &attr) < 0)
 959                 return;
 960
 961         if (attr.config_methods == NULL) {
 962                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 963                            "Probe Request");
 964                 return;
 965         }
 966
 967         if (attr.dev_password_id == NULL) {
 968                 wpa_printf(MSG_DEBUG, "WPS: No Device Password Id attribute "
 969                            "in Probe Request");
 970                 return;
 971         }
 972
 973         if (reg->enrollee_seen_cb && attr.uuid_e &&
 974             attr.primary_dev_type && attr.request_type && !p2p_wildcard) {
 975                 char *dev_name = NULL;
 976                 if (attr.dev_name) {
 977                         dev_name = os_zalloc(attr.dev_name_len + 1);
 978                         if (dev_name) {
 979                                 os_memcpy(dev_name, attr.dev_name,
 980                                           attr.dev_name_len);
 981                         }
 982                 }
 983                 reg->enrollee_seen_cb(reg->cb_ctx, addr, attr.uuid_e,
 984                                       attr.primary_dev_type,
 985                                       WPA_GET_BE16(attr.config_methods),
 986                                       WPA_GET_BE16(attr.dev_password_id),
 987                                       *attr.request_type, dev_name);
 988                 os_free(dev_name);
 989         }
 990
 991         if (WPA_GET_BE16(attr.dev_password_id) != DEV_PW_PUSHBUTTON)
 992                 return; /* Not PBC */
 993
 994         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 995                    MACSTR, MAC2STR(addr));
 996         if (attr.uuid_e == NULL) {
 997                 wpa_printf(MSG_DEBUG, "WPS: Invalid Probe Request WPS IE: No "
 998                            "UUID-E included");
 999                 return;
1000         }
1001
1002         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
1003         if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {
1004                 wpa_printf(MSG_DEBUG, "WPS: PBC session overlap detected");
1005                 reg->force_pbc_overlap = 1;
1006                 wps_pbc_overlap_event(reg->wps);
1007         }
1008 }
1009
1010
1011 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
1012                           const u8 *psk, size_t psk_len)
1013 {
1014         if (reg->new_psk_cb == NULL)
1015                 return 0;
1016
1017         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
1018 }
1019
1020
1021 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
1022                               const struct wps_device_data *dev)
1023 {
1024         if (reg->pin_needed_cb == NULL)
1025                 return;
1026
1027         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
1028 }
1029
1030
1031 static void wps_cb_reg_success(struct wps_registrar *reg, const u8 *mac_addr,
1032                                const u8 *uuid_e)
1033 {
1034         if (reg->reg_success_cb == NULL)
1035                 return;
1036
1037         reg->reg_success_cb(reg->cb_ctx, mac_addr, uuid_e);
1038 }
1039
1040
1041 static int wps_cb_set_ie(struct wps_registrar *reg, struct wpabuf *beacon_ie,
1042                          struct wpabuf *probe_resp_ie)
1043 {
1044         return reg->set_ie_cb(reg->cb_ctx, beacon_ie, probe_resp_ie);
1045 }
1046
1047
1048 static void wps_cb_set_sel_reg(struct wps_registrar *reg)
1049 {
1050         u16 methods = 0;
1051         if (reg->set_sel_reg_cb == NULL)
1052                 return;
1053
1054         if (reg->selected_registrar) {
1055                 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
1056 #ifdef CONFIG_WPS2
1057                 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
1058                              WPS_CONFIG_PHY_PUSHBUTTON);
1059 #endif /* CONFIG_WPS2 */
1060                 if (reg->pbc)
1061                         wps_set_pushbutton(&methods, reg->wps->config_methods);
1062         }
1063
1064         wpa_printf(MSG_DEBUG, "WPS: wps_cb_set_sel_reg: sel_reg=%d "
1065                    "config_methods=0x%x pbc=%d methods=0x%x",
1066                    reg->selected_registrar, reg->wps->config_methods,
1067                    reg->pbc, methods);
1068
1069         reg->set_sel_reg_cb(reg->cb_ctx, reg->selected_registrar,
1070                             reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT,
1071                             methods);
1072 }
1073
1074
1075 static int wps_set_ie(struct wps_registrar *reg)
1076 {
1077         struct wpabuf *beacon;
1078         struct wpabuf *probe;
1079         const u8 *auth_macs;
1080         size_t count;
1081
1082         if (reg->set_ie_cb == NULL)
1083                 return 0;
1084
1085         beacon = wpabuf_alloc(400);
1086         if (beacon == NULL)
1087                 return -1;
1088         probe = wpabuf_alloc(500);
1089         if (probe == NULL) {
1090                 wpabuf_free(beacon);
1091                 return -1;
1092         }
1093
1094         auth_macs = wps_authorized_macs(reg, &count);
1095
1096         wpa_printf(MSG_DEBUG, "WPS: Build Beacon IEs");
1097
1098         if (wps_build_version(beacon) ||
1099             wps_build_wps_state(reg->wps, beacon) ||
1100             wps_build_ap_setup_locked(reg->wps, beacon) ||
1101             wps_build_selected_registrar(reg, beacon) ||
1102             wps_build_sel_reg_dev_password_id(reg, beacon) ||
1103             wps_build_sel_reg_config_methods(reg, beacon) ||
1104             wps_build_sel_pbc_reg_uuid_e(reg, beacon) ||
1105             (reg->dualband && wps_build_rf_bands(&reg->wps->dev, beacon)) ||
1106             wps_build_wfa_ext(beacon, 0, auth_macs, count)) {
1107                 wpabuf_free(beacon);
1108                 wpabuf_free(probe);
1109                 return -1;
1110         }
1111
1112         wpa_printf(MSG_DEBUG, "WPS: Build Probe Response IEs");
1113
1114         if (wps_build_version(probe) ||
1115             wps_build_wps_state(reg->wps, probe) ||
1116             wps_build_ap_setup_locked(reg->wps, probe) ||
1117             wps_build_selected_registrar(reg, probe) ||
1118             wps_build_sel_reg_dev_password_id(reg, probe) ||
1119             wps_build_sel_reg_config_methods(reg, probe) ||
1120             wps_build_resp_type(probe, reg->wps->ap ? WPS_RESP_AP :
1121                                 WPS_RESP_REGISTRAR) ||
1122             wps_build_uuid_e(probe, reg->wps->uuid) ||
1123             wps_build_device_attrs(&reg->wps->dev, probe) ||
1124             wps_build_probe_config_methods(reg, probe) ||
1125             wps_build_rf_bands(&reg->wps->dev, probe) ||
1126             wps_build_wfa_ext(probe, 0, auth_macs, count)) {
1127                 wpabuf_free(beacon);
1128                 wpabuf_free(probe);
1129                 return -1;
1130         }
1131
1132 #ifdef CONFIG_P2P
1133         if (wps_build_dev_name(&reg->wps->dev, beacon) ||
1134             wps_build_primary_dev_type(&reg->wps->dev, beacon)) {
1135                 wpabuf_free(beacon);
1136                 wpabuf_free(probe);
1137                 return -1;
1138         }
1139 #endif /* CONFIG_P2P */
1140
1141         beacon = wps_ie_encapsulate(beacon);
1142         probe = wps_ie_encapsulate(probe);
1143
1144         if (!beacon || !probe) {
1145                 wpabuf_free(beacon);
1146                 wpabuf_free(probe);
1147                 return -1;
1148         }
1149
1150         if (reg->static_wep_only) {
1151                 /*
1152                  * Windows XP and Vista clients can get confused about
1153                  * EAP-Identity/Request when they probe the network with
1154                  * EAPOL-Start. In such a case, they may assume the network is
1155                  * using IEEE 802.1X and prompt user for a certificate while
1156                  * the correct (non-WPS) behavior would be to ask for the
1157                  * static WEP key. As a workaround, use Microsoft Provisioning
1158                  * IE to advertise that legacy 802.1X is not supported.
1159                  */
1160                 const u8 ms_wps[7] = {
1161                         WLAN_EID_VENDOR_SPECIFIC, 5,
1162                         /* Microsoft Provisioning IE (00:50:f2:5) */
1163                         0x00, 0x50, 0xf2, 5,
1164                         0x00 /* no legacy 802.1X or MS WPS */
1165                 };
1166                 wpa_printf(MSG_DEBUG, "WPS: Add Microsoft Provisioning IE "
1167                            "into Beacon/Probe Response frames");
1168                 wpabuf_put_data(beacon, ms_wps, sizeof(ms_wps));
1169                 wpabuf_put_data(probe, ms_wps, sizeof(ms_wps));
1170         }
1171
1172         return wps_cb_set_ie(reg, beacon, probe);
1173 }
1174
1175
1176 static int wps_get_dev_password(struct wps_data *wps)
1177 {
1178         const u8 *pin;
1179         size_t pin_len = 0;
1180
1181         os_free(wps->dev_password);
1182         wps->dev_password = NULL;
1183
1184         if (wps->pbc) {
1185                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
1186                 pin = (const u8 *) "00000000";
1187                 pin_len = 8;
1188         } else {
1189                 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
1190                                             &pin_len);
1191         }
1192         if (pin == NULL) {
1193                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
1194                            "the Enrollee");
1195                 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
1196                                   &wps->peer_dev);
1197                 return -1;
1198         }
1199
1200         wps->dev_password = os_malloc(pin_len);
1201         if (wps->dev_password == NULL)
1202                 return -1;
1203         os_memcpy(wps->dev_password, pin, pin_len);
1204         wps->dev_password_len = pin_len;
1205
1206         return 0;
1207 }
1208
1209
1210 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
1211 {
1212         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
1213         wpabuf_put_be16(msg, ATTR_UUID_R);
1214         wpabuf_put_be16(msg, WPS_UUID_LEN);
1215         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
1216         return 0;
1217 }
1218
1219
1220 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
1221 {
1222         u8 *hash;
1223         const u8 *addr[4];
1224         size_t len[4];
1225
1226         if (random_get_bytes(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
1227                 return -1;
1228         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
1229         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
1230                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
1231
1232         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
1233                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
1234                            "R-Hash derivation");
1235                 return -1;
1236         }
1237
1238         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
1239         wpabuf_put_be16(msg, ATTR_R_HASH1);
1240         wpabuf_put_be16(msg, SHA256_MAC_LEN);
1241         hash = wpabuf_put(msg, SHA256_MAC_LEN);
1242         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
1243         addr[0] = wps->snonce;
1244         len[0] = WPS_SECRET_NONCE_LEN;
1245         addr[1] = wps->psk1;
1246         len[1] = WPS_PSK_LEN;
1247         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1248         len[2] = wpabuf_len(wps->dh_pubkey_e);
1249         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1250         len[3] = wpabuf_len(wps->dh_pubkey_r);
1251         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1252         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
1253
1254         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
1255         wpabuf_put_be16(msg, ATTR_R_HASH2);
1256         wpabuf_put_be16(msg, SHA256_MAC_LEN);
1257         hash = wpabuf_put(msg, SHA256_MAC_LEN);
1258         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
1259         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
1260         addr[1] = wps->psk2;
1261         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1262         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
1263
1264         return 0;
1265 }
1266
1267
1268 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
1269 {
1270         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
1271         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
1272         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1273         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
1274         return 0;
1275 }
1276
1277
1278 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
1279 {
1280         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
1281         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
1282         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1283         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
1284                         WPS_SECRET_NONCE_LEN);
1285         return 0;
1286 }
1287
1288
1289 static int wps_build_cred_network_idx(struct wpabuf *msg,
1290                                       const struct wps_credential *cred)
1291 {
1292         wpa_printf(MSG_DEBUG, "WPS:  * Network Index (1)");
1293         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
1294         wpabuf_put_be16(msg, 1);
1295         wpabuf_put_u8(msg, 1);
1296         return 0;
1297 }
1298
1299
1300 static int wps_build_cred_ssid(struct wpabuf *msg,
1301                                const struct wps_credential *cred)
1302 {
1303         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
1304         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID for Credential",
1305                           cred->ssid, cred->ssid_len);
1306         wpabuf_put_be16(msg, ATTR_SSID);
1307         wpabuf_put_be16(msg, cred->ssid_len);
1308         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
1309         return 0;
1310 }
1311
1312
1313 static int wps_build_cred_auth_type(struct wpabuf *msg,
1314                                     const struct wps_credential *cred)
1315 {
1316         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
1317                    cred->auth_type);
1318         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
1319         wpabuf_put_be16(msg, 2);
1320         wpabuf_put_be16(msg, cred->auth_type);
1321         return 0;
1322 }
1323
1324
1325 static int wps_build_cred_encr_type(struct wpabuf *msg,
1326                                     const struct wps_credential *cred)
1327 {
1328         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
1329                    cred->encr_type);
1330         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
1331         wpabuf_put_be16(msg, 2);
1332         wpabuf_put_be16(msg, cred->encr_type);
1333         return 0;
1334 }
1335
1336
1337 static int wps_build_cred_network_key(struct wpabuf *msg,
1338                                       const struct wps_credential *cred)
1339 {
1340         wpa_printf(MSG_DEBUG, "WPS:  * Network Key (len=%d)",
1341                    (int) cred->key_len);
1342         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
1343                         cred->key, cred->key_len);
1344         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
1345         wpabuf_put_be16(msg, cred->key_len);
1346         wpabuf_put_data(msg, cred->key, cred->key_len);
1347         return 0;
1348 }
1349
1350
1351 static int wps_build_cred_mac_addr(struct wpabuf *msg,
1352                                    const struct wps_credential *cred)
1353 {
1354         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address (" MACSTR ")",
1355                    MAC2STR(cred->mac_addr));
1356         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
1357         wpabuf_put_be16(msg, ETH_ALEN);
1358         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
1359         return 0;
1360 }
1361
1362
1363 static int wps_build_credential(struct wpabuf *msg,
1364                                 const struct wps_credential *cred)
1365 {
1366         if (wps_build_cred_network_idx(msg, cred) ||
1367             wps_build_cred_ssid(msg, cred) ||
1368             wps_build_cred_auth_type(msg, cred) ||
1369             wps_build_cred_encr_type(msg, cred) ||
1370             wps_build_cred_network_key(msg, cred) ||
1371             wps_build_cred_mac_addr(msg, cred))
1372                 return -1;
1373         return 0;
1374 }
1375
1376
1377 int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
1378 {
1379         struct wpabuf *cred;
1380
1381         if (wps->wps->registrar->skip_cred_build)
1382                 goto skip_cred_build;
1383
1384         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
1385         if (wps->use_cred) {
1386                 os_memcpy(&wps->cred, wps->use_cred, sizeof(wps->cred));
1387                 goto use_provided;
1388         }
1389         os_memset(&wps->cred, 0, sizeof(wps->cred));
1390
1391         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
1392         wps->cred.ssid_len = wps->wps->ssid_len;
1393
1394         /* Select the best authentication and encryption type */
1395         if (wps->auth_type & WPS_AUTH_WPA2PSK)
1396                 wps->auth_type = WPS_AUTH_WPA2PSK;
1397         else if (wps->auth_type & WPS_AUTH_WPAPSK)
1398                 wps->auth_type = WPS_AUTH_WPAPSK;
1399         else if (wps->auth_type & WPS_AUTH_OPEN)
1400                 wps->auth_type = WPS_AUTH_OPEN;
1401         else if (wps->auth_type & WPS_AUTH_SHARED)
1402                 wps->auth_type = WPS_AUTH_SHARED;
1403         else {
1404                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
1405                            wps->auth_type);
1406                 return -1;
1407         }
1408         wps->cred.auth_type = wps->auth_type;
1409
1410         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
1411             wps->auth_type == WPS_AUTH_WPAPSK) {
1412                 if (wps->encr_type & WPS_ENCR_AES)
1413                         wps->encr_type = WPS_ENCR_AES;
1414                 else if (wps->encr_type & WPS_ENCR_TKIP)
1415                         wps->encr_type = WPS_ENCR_TKIP;
1416                 else {
1417                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1418                                    "type for WPA/WPA2");
1419                         return -1;
1420                 }
1421         } else {
1422                 if (wps->encr_type & WPS_ENCR_WEP)
1423                         wps->encr_type = WPS_ENCR_WEP;
1424                 else if (wps->encr_type & WPS_ENCR_NONE)
1425                         wps->encr_type = WPS_ENCR_NONE;
1426                 else {
1427                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1428                                    "type for non-WPA/WPA2 mode");
1429                         return -1;
1430                 }
1431         }
1432         wps->cred.encr_type = wps->encr_type;
1433         /*
1434          * Set MAC address in the Credential to be the Enrollee's MAC address
1435          */
1436         os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
1437
1438         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap &&
1439             !wps->wps->registrar->disable_auto_conf) {
1440                 u8 r[16];
1441                 /* Generate a random passphrase */
1442                 if (random_get_bytes(r, sizeof(r)) < 0)
1443                         return -1;
1444                 os_free(wps->new_psk);
1445                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
1446                 if (wps->new_psk == NULL)
1447                         return -1;
1448                 wps->new_psk_len--; /* remove newline */
1449                 while (wps->new_psk_len &&
1450                        wps->new_psk[wps->new_psk_len - 1] == '=')
1451                         wps->new_psk_len--;
1452                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
1453                                       wps->new_psk, wps->new_psk_len);
1454                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
1455                 wps->cred.key_len = wps->new_psk_len;
1456         } else if (wps->use_psk_key && wps->wps->psk_set) {
1457                 char hex[65];
1458                 wpa_printf(MSG_DEBUG, "WPS: Use PSK format for Network Key");
1459                 wpa_snprintf_hex(hex, sizeof(hex), wps->wps->psk, 32);
1460                 os_memcpy(wps->cred.key, hex, 32 * 2);
1461                 wps->cred.key_len = 32 * 2;
1462         } else if (wps->wps->network_key) {
1463                 os_memcpy(wps->cred.key, wps->wps->network_key,
1464                           wps->wps->network_key_len);
1465                 wps->cred.key_len = wps->wps->network_key_len;
1466         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
1467                 char hex[65];
1468                 /* Generate a random per-device PSK */
1469                 os_free(wps->new_psk);
1470                 wps->new_psk_len = 32;
1471                 wps->new_psk = os_malloc(wps->new_psk_len);
1472                 if (wps->new_psk == NULL)
1473                         return -1;
1474                 if (random_get_bytes(wps->new_psk, wps->new_psk_len) < 0) {
1475                         os_free(wps->new_psk);
1476                         wps->new_psk = NULL;
1477                         return -1;
1478                 }
1479                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1480                                 wps->new_psk, wps->new_psk_len);
1481                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
1482                                  wps->new_psk_len);
1483                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1484                 wps->cred.key_len = wps->new_psk_len * 2;
1485         }
1486
1487 use_provided:
1488 #ifdef CONFIG_WPS_TESTING
1489         if (wps_testing_dummy_cred)
1490                 cred = wpabuf_alloc(200);
1491         else
1492                 cred = NULL;
1493         if (cred) {
1494                 struct wps_credential dummy;
1495                 wpa_printf(MSG_DEBUG, "WPS: Add dummy credential");
1496                 os_memset(&dummy, 0, sizeof(dummy));
1497                 os_memcpy(dummy.ssid, "dummy", 5);
1498                 dummy.ssid_len = 5;
1499                 dummy.auth_type = WPS_AUTH_WPA2PSK;
1500                 dummy.encr_type = WPS_ENCR_AES;
1501                 os_memcpy(dummy.key, "dummy psk", 9);
1502                 dummy.key_len = 9;
1503                 os_memcpy(dummy.mac_addr, wps->mac_addr_e, ETH_ALEN);
1504                 wps_build_credential(cred, &dummy);
1505                 wpa_hexdump_buf(MSG_DEBUG, "WPS: Dummy Credential", cred);
1506
1507                 wpabuf_put_be16(msg, ATTR_CRED);
1508                 wpabuf_put_be16(msg, wpabuf_len(cred));
1509                 wpabuf_put_buf(msg, cred);
1510
1511                 wpabuf_free(cred);
1512         }
1513 #endif /* CONFIG_WPS_TESTING */
1514
1515         cred = wpabuf_alloc(200);
1516         if (cred == NULL)
1517                 return -1;
1518
1519         if (wps_build_credential(cred, &wps->cred)) {
1520                 wpabuf_free(cred);
1521                 return -1;
1522         }
1523
1524         wpabuf_put_be16(msg, ATTR_CRED);
1525         wpabuf_put_be16(msg, wpabuf_len(cred));
1526         wpabuf_put_buf(msg, cred);
1527         wpabuf_free(cred);
1528
1529 skip_cred_build:
1530         if (wps->wps->registrar->extra_cred) {
1531                 wpa_printf(MSG_DEBUG, "WPS:  * Credential (pre-configured)");
1532                 wpabuf_put_buf(msg, wps->wps->registrar->extra_cred);
1533         }
1534
1535         return 0;
1536 }
1537
1538
1539 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1540 {
1541         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
1542
1543         if (wps_build_credential(msg, &wps->cred))
1544                 return -1;
1545
1546         return 0;
1547 }
1548
1549
1550 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1551 {
1552         struct wpabuf *msg;
1553
1554         if (random_get_bytes(wps->nonce_r, WPS_NONCE_LEN) < 0)
1555                 return NULL;
1556         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1557                     wps->nonce_r, WPS_NONCE_LEN);
1558         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1559
1560         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1561         msg = wpabuf_alloc(1000);
1562         if (msg == NULL)
1563                 return NULL;
1564
1565         if (wps_build_version(msg) ||
1566             wps_build_msg_type(msg, WPS_M2) ||
1567             wps_build_enrollee_nonce(wps, msg) ||
1568             wps_build_registrar_nonce(wps, msg) ||
1569             wps_build_uuid_r(wps, msg) ||
1570             wps_build_public_key(wps, msg) ||
1571             wps_derive_keys(wps) ||
1572             wps_build_auth_type_flags(wps, msg) ||
1573             wps_build_encr_type_flags(wps, msg) ||
1574             wps_build_conn_type_flags(wps, msg) ||
1575             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1576             wps_build_device_attrs(&wps->wps->dev, msg) ||
1577             wps_build_rf_bands(&wps->wps->dev, msg) ||
1578             wps_build_assoc_state(wps, msg) ||
1579             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1580             wps_build_dev_password_id(msg, wps->dev_pw_id) ||
1581             wps_build_os_version(&wps->wps->dev, msg) ||
1582             wps_build_wfa_ext(msg, 0, NULL, 0) ||
1583             wps_build_authenticator(wps, msg)) {
1584                 wpabuf_free(msg);
1585                 return NULL;
1586         }
1587
1588         wps->int_reg = 1;
1589         wps->state = RECV_M3;
1590         return msg;
1591 }
1592
1593
1594 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1595 {
1596         struct wpabuf *msg;
1597         u16 err = wps->config_error;
1598
1599         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1600         msg = wpabuf_alloc(1000);
1601         if (msg == NULL)
1602                 return NULL;
1603
1604         if (wps->wps->ap && wps->wps->ap_setup_locked &&
1605             err == WPS_CFG_NO_ERROR)
1606                 err = WPS_CFG_SETUP_LOCKED;
1607
1608         if (wps_build_version(msg) ||
1609             wps_build_msg_type(msg, WPS_M2D) ||
1610             wps_build_enrollee_nonce(wps, msg) ||
1611             wps_build_registrar_nonce(wps, msg) ||
1612             wps_build_uuid_r(wps, msg) ||
1613             wps_build_auth_type_flags(wps, msg) ||
1614             wps_build_encr_type_flags(wps, msg) ||
1615             wps_build_conn_type_flags(wps, msg) ||
1616             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1617             wps_build_device_attrs(&wps->wps->dev, msg) ||
1618             wps_build_rf_bands(&wps->wps->dev, msg) ||
1619             wps_build_assoc_state(wps, msg) ||
1620             wps_build_config_error(msg, err) ||
1621             wps_build_os_version(&wps->wps->dev, msg) ||
1622             wps_build_wfa_ext(msg, 0, NULL, 0)) {
1623                 wpabuf_free(msg);
1624                 return NULL;
1625         }
1626
1627         wps->state = RECV_M2D_ACK;
1628         return msg;
1629 }
1630
1631
1632 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1633 {
1634         struct wpabuf *msg, *plain;
1635
1636         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1637
1638         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1639
1640         plain = wpabuf_alloc(200);
1641         if (plain == NULL)
1642                 return NULL;
1643
1644         msg = wpabuf_alloc(1000);
1645         if (msg == NULL) {
1646                 wpabuf_free(plain);
1647                 return NULL;
1648         }
1649
1650         if (wps_build_version(msg) ||
1651             wps_build_msg_type(msg, WPS_M4) ||
1652             wps_build_enrollee_nonce(wps, msg) ||
1653             wps_build_r_hash(wps, msg) ||
1654             wps_build_r_snonce1(wps, plain) ||
1655             wps_build_key_wrap_auth(wps, plain) ||
1656             wps_build_encr_settings(wps, msg, plain) ||
1657             wps_build_wfa_ext(msg, 0, NULL, 0) ||
1658             wps_build_authenticator(wps, msg)) {
1659                 wpabuf_free(plain);
1660                 wpabuf_free(msg);
1661                 return NULL;
1662         }
1663         wpabuf_free(plain);
1664
1665         wps->state = RECV_M5;
1666         return msg;
1667 }
1668
1669
1670 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1671 {
1672         struct wpabuf *msg, *plain;
1673
1674         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1675
1676         plain = wpabuf_alloc(200);
1677         if (plain == NULL)
1678                 return NULL;
1679
1680         msg = wpabuf_alloc(1000);
1681         if (msg == NULL) {
1682                 wpabuf_free(plain);
1683                 return NULL;
1684         }
1685
1686         if (wps_build_version(msg) ||
1687             wps_build_msg_type(msg, WPS_M6) ||
1688             wps_build_enrollee_nonce(wps, msg) ||
1689             wps_build_r_snonce2(wps, plain) ||
1690             wps_build_key_wrap_auth(wps, plain) ||
1691             wps_build_encr_settings(wps, msg, plain) ||
1692             wps_build_wfa_ext(msg, 0, NULL, 0) ||
1693             wps_build_authenticator(wps, msg)) {
1694                 wpabuf_free(plain);
1695                 wpabuf_free(msg);
1696                 return NULL;
1697         }
1698         wpabuf_free(plain);
1699
1700         wps->wps_pin_revealed = 1;
1701         wps->state = RECV_M7;
1702         return msg;
1703 }
1704
1705
1706 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1707 {
1708         struct wpabuf *msg, *plain;
1709
1710         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1711
1712         plain = wpabuf_alloc(500);
1713         if (plain == NULL)
1714                 return NULL;
1715
1716         msg = wpabuf_alloc(1000);
1717         if (msg == NULL) {
1718                 wpabuf_free(plain);
1719                 return NULL;
1720         }
1721
1722         if (wps_build_version(msg) ||
1723             wps_build_msg_type(msg, WPS_M8) ||
1724             wps_build_enrollee_nonce(wps, msg) ||
1725             ((wps->wps->ap || wps->er) && wps_build_cred(wps, plain)) ||
1726             (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) ||
1727             wps_build_key_wrap_auth(wps, plain) ||
1728             wps_build_encr_settings(wps, msg, plain) ||
1729             wps_build_wfa_ext(msg, 0, NULL, 0) ||
1730             wps_build_authenticator(wps, msg)) {
1731                 wpabuf_free(plain);
1732                 wpabuf_free(msg);
1733                 return NULL;
1734         }
1735         wpabuf_free(plain);
1736
1737         wps->state = RECV_DONE;
1738         return msg;
1739 }
1740
1741
1742 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1743                                       enum wsc_op_code *op_code)
1744 {
1745         struct wpabuf *msg;
1746
1747 #ifdef CONFIG_WPS_UPNP
1748         if (!wps->int_reg && wps->wps->wps_upnp) {
1749                 struct upnp_pending_message *p, *prev = NULL;
1750                 if (wps->ext_reg > 1)
1751                         wps_registrar_free_pending_m2(wps->wps);
1752                 p = wps->wps->upnp_msgs;
1753                 /* TODO: check pending message MAC address */
1754                 while (p && p->next) {
1755                         prev = p;
1756                         p = p->next;
1757                 }
1758                 if (p) {
1759                         wpa_printf(MSG_DEBUG, "WPS: Use pending message from "
1760                                    "UPnP");
1761                         if (prev)
1762                                 prev->next = NULL;
1763                         else
1764                                 wps->wps->upnp_msgs = NULL;
1765                         msg = p->msg;
1766                         switch (p->type) {
1767                         case WPS_WSC_ACK:
1768                                 *op_code = WSC_ACK;
1769                                 break;
1770                         case WPS_WSC_NACK:
1771                                 *op_code = WSC_NACK;
1772                                 break;
1773                         default:
1774                                 *op_code = WSC_MSG;
1775                                 break;
1776                         }
1777                         os_free(p);
1778                         if (wps->ext_reg == 0)
1779                                 wps->ext_reg = 1;
1780                         return msg;
1781                 }
1782         }
1783         if (wps->ext_reg) {
1784                 wpa_printf(MSG_DEBUG, "WPS: Using external Registrar, but no "
1785                            "pending message available");
1786                 return NULL;
1787         }
1788 #endif /* CONFIG_WPS_UPNP */
1789
1790         switch (wps->state) {
1791         case SEND_M2:
1792                 if (wps_get_dev_password(wps) < 0)
1793                         msg = wps_build_m2d(wps);
1794                 else
1795                         msg = wps_build_m2(wps);
1796                 *op_code = WSC_MSG;
1797                 break;
1798         case SEND_M2D:
1799                 msg = wps_build_m2d(wps);
1800                 *op_code = WSC_MSG;
1801                 break;
1802         case SEND_M4:
1803                 msg = wps_build_m4(wps);
1804                 *op_code = WSC_MSG;
1805                 break;
1806         case SEND_M6:
1807                 msg = wps_build_m6(wps);
1808                 *op_code = WSC_MSG;
1809                 break;
1810         case SEND_M8:
1811                 msg = wps_build_m8(wps);
1812                 *op_code = WSC_MSG;
1813                 break;
1814         case RECV_DONE:
1815                 msg = wps_build_wsc_ack(wps);
1816                 *op_code = WSC_ACK;
1817                 break;
1818         case SEND_WSC_NACK:
1819                 msg = wps_build_wsc_nack(wps);
1820                 *op_code = WSC_NACK;
1821                 break;
1822         default:
1823                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1824                            "a message", wps->state);
1825                 msg = NULL;
1826                 break;
1827         }
1828
1829         if (*op_code == WSC_MSG && msg) {
1830                 /* Save a copy of the last message for Authenticator derivation
1831                  */
1832                 wpabuf_free(wps->last_msg);
1833                 wps->last_msg = wpabuf_dup(msg);
1834         }
1835
1836         return msg;
1837 }
1838
1839
1840 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1841 {
1842         if (e_nonce == NULL) {
1843                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1844                 return -1;
1845         }
1846
1847         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1848         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1849                     wps->nonce_e, WPS_NONCE_LEN);
1850
1851         return 0;
1852 }
1853
1854
1855 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1856 {
1857         if (r_nonce == NULL) {
1858                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1859                 return -1;
1860         }
1861
1862         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1863                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1864                 return -1;
1865         }
1866
1867         return 0;
1868 }
1869
1870
1871 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1872 {
1873         if (uuid_e == NULL) {
1874                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1875                 return -1;
1876         }
1877
1878         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1879         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1880
1881         return 0;
1882 }
1883
1884
1885 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1886 {
1887         if (pw_id == NULL) {
1888                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1889                 return -1;
1890         }
1891
1892         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1893         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1894
1895         return 0;
1896 }
1897
1898
1899 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1900 {
1901         if (e_hash1 == NULL) {
1902                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1903                 return -1;
1904         }
1905
1906         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1907         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1908
1909         return 0;
1910 }
1911
1912
1913 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1914 {
1915         if (e_hash2 == NULL) {
1916                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1917                 return -1;
1918         }
1919
1920         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1921         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1922
1923         return 0;
1924 }
1925
1926
1927 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1928 {
1929         u8 hash[SHA256_MAC_LEN];
1930         const u8 *addr[4];
1931         size_t len[4];
1932
1933         if (e_snonce1 == NULL) {
1934                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1935                 return -1;
1936         }
1937
1938         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1939                         WPS_SECRET_NONCE_LEN);
1940
1941         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1942         addr[0] = e_snonce1;
1943         len[0] = WPS_SECRET_NONCE_LEN;
1944         addr[1] = wps->psk1;
1945         len[1] = WPS_PSK_LEN;
1946         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1947         len[2] = wpabuf_len(wps->dh_pubkey_e);
1948         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1949         len[3] = wpabuf_len(wps->dh_pubkey_r);
1950         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1951
1952         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1953                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1954                            "not match with the pre-committed value");
1955                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1956                 wps_pwd_auth_fail_event(wps->wps, 0, 1);
1957                 return -1;
1958         }
1959
1960         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1961                    "half of the device password");
1962
1963         return 0;
1964 }
1965
1966
1967 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1968 {
1969         u8 hash[SHA256_MAC_LEN];
1970         const u8 *addr[4];
1971         size_t len[4];
1972
1973         if (e_snonce2 == NULL) {
1974                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1975                 return -1;
1976         }
1977
1978         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1979                         WPS_SECRET_NONCE_LEN);
1980
1981         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1982         addr[0] = e_snonce2;
1983         len[0] = WPS_SECRET_NONCE_LEN;
1984         addr[1] = wps->psk2;
1985         len[1] = WPS_PSK_LEN;
1986         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1987         len[2] = wpabuf_len(wps->dh_pubkey_e);
1988         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1989         len[3] = wpabuf_len(wps->dh_pubkey_r);
1990         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1991
1992         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1993                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1994                            "not match with the pre-committed value");
1995                 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
1996                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1997                 wps_pwd_auth_fail_event(wps->wps, 0, 2);
1998                 return -1;
1999         }
2000
2001         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
2002                    "half of the device password");
2003         wps->wps_pin_revealed = 0;
2004         wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
2005
2006         return 0;
2007 }
2008
2009
2010 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
2011 {
2012         if (mac_addr == NULL) {
2013                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
2014                 return -1;
2015         }
2016
2017         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
2018                    MAC2STR(mac_addr));
2019         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
2020         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
2021
2022         return 0;
2023 }
2024
2025
2026 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
2027                               size_t pk_len)
2028 {
2029         if (pk == NULL || pk_len == 0) {
2030                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
2031                 return -1;
2032         }
2033
2034 #ifdef CONFIG_WPS_OOB
2035         if (wps->wps->oob_conf.pubkey_hash != NULL) {
2036                 const u8 *addr[1];
2037                 u8 hash[WPS_HASH_LEN];
2038
2039                 addr[0] = pk;
2040                 sha256_vector(1, addr, &pk_len, hash);
2041                 if (os_memcmp(hash,
2042                               wpabuf_head(wps->wps->oob_conf.pubkey_hash),
2043                               WPS_OOB_PUBKEY_HASH_LEN) != 0) {
2044                         wpa_printf(MSG_ERROR, "WPS: Public Key hash error");
2045                         return -1;
2046                 }
2047         }
2048 #endif /* CONFIG_WPS_OOB */
2049
2050         wpabuf_free(wps->dh_pubkey_e);
2051         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
2052         if (wps->dh_pubkey_e == NULL)
2053                 return -1;
2054
2055         return 0;
2056 }
2057
2058
2059 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
2060 {
2061         u16 auth_types;
2062
2063         if (auth == NULL) {
2064                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
2065                            "received");
2066                 return -1;
2067         }
2068
2069         auth_types = WPA_GET_BE16(auth);
2070
2071         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
2072                    auth_types);
2073         wps->auth_type = wps->wps->auth_types & auth_types;
2074         if (wps->auth_type == 0) {
2075                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
2076                            "authentication types (own 0x%x Enrollee 0x%x)",
2077                            wps->wps->auth_types, auth_types);
2078 #ifdef WPS_WORKAROUNDS
2079                 /*
2080                  * Some deployed implementations seem to advertise incorrect
2081                  * information in this attribute. For example, Linksys WRT350N
2082                  * seems to have a byteorder bug that breaks this negotiation.
2083                  * In order to interoperate with existing implementations,
2084                  * assume that the Enrollee supports everything we do.
2085                  */
2086                 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
2087                            "does not advertise supported authentication types "
2088                            "correctly");
2089                 wps->auth_type = wps->wps->auth_types;
2090 #else /* WPS_WORKAROUNDS */
2091                 return -1;
2092 #endif /* WPS_WORKAROUNDS */
2093         }
2094
2095         return 0;
2096 }
2097
2098
2099 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
2100 {
2101         u16 encr_types;
2102
2103         if (encr == NULL) {
2104                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
2105                            "received");
2106                 return -1;
2107         }
2108
2109         encr_types = WPA_GET_BE16(encr);
2110
2111         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
2112                    encr_types);
2113         wps->encr_type = wps->wps->encr_types & encr_types;
2114         if (wps->encr_type == 0) {
2115                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
2116                            "encryption types (own 0x%x Enrollee 0x%x)",
2117                            wps->wps->encr_types, encr_types);
2118 #ifdef WPS_WORKAROUNDS
2119                 /*
2120                  * Some deployed implementations seem to advertise incorrect
2121                  * information in this attribute. For example, Linksys WRT350N
2122                  * seems to have a byteorder bug that breaks this negotiation.
2123                  * In order to interoperate with existing implementations,
2124                  * assume that the Enrollee supports everything we do.
2125                  */
2126                 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
2127                            "does not advertise supported encryption types "
2128                            "correctly");
2129                 wps->encr_type = wps->wps->encr_types;
2130 #else /* WPS_WORKAROUNDS */
2131                 return -1;
2132 #endif /* WPS_WORKAROUNDS */
2133         }
2134
2135         return 0;
2136 }
2137
2138
2139 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
2140 {
2141         if (conn == NULL) {
2142                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
2143                            "received");
2144                 return -1;
2145         }
2146
2147         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
2148                    *conn);
2149
2150         return 0;
2151 }
2152
2153
2154 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
2155 {
2156         u16 m;
2157
2158         if (methods == NULL) {
2159                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
2160                 return -1;
2161         }
2162
2163         m = WPA_GET_BE16(methods);
2164
2165         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x"
2166                    "%s%s%s%s%s%s%s%s%s", m,
2167                    m & WPS_CONFIG_USBA ? " [USBA]" : "",
2168                    m & WPS_CONFIG_ETHERNET ? " [Ethernet]" : "",
2169                    m & WPS_CONFIG_LABEL ? " [Label]" : "",
2170                    m & WPS_CONFIG_DISPLAY ? " [Display]" : "",
2171                    m & WPS_CONFIG_EXT_NFC_TOKEN ? " [Ext NFC Token]" : "",
2172                    m & WPS_CONFIG_INT_NFC_TOKEN ? " [Int NFC Token]" : "",
2173                    m & WPS_CONFIG_NFC_INTERFACE ? " [NFC]" : "",
2174                    m & WPS_CONFIG_PUSHBUTTON ? " [PBC]" : "",
2175                    m & WPS_CONFIG_KEYPAD ? " [Keypad]" : "");
2176
2177         if (!(m & WPS_CONFIG_DISPLAY) && !wps->use_psk_key) {
2178                 /*
2179                  * The Enrollee does not have a display so it is unlikely to be
2180                  * able to show the passphrase to a user and as such, could
2181                  * benefit from receiving PSK to reduce key derivation time.
2182                  */
2183                 wpa_printf(MSG_DEBUG, "WPS: Prefer PSK format key due to "
2184                            "Enrollee not supporting display");
2185                 wps->use_psk_key = 1;
2186         }
2187
2188         return 0;
2189 }
2190
2191
2192 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
2193 {
2194         if (state == NULL) {
2195                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
2196                            "received");
2197                 return -1;
2198         }
2199
2200         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
2201                    *state);
2202
2203         return 0;
2204 }
2205
2206
2207 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
2208 {
2209         u16 a;
2210
2211         if (assoc == NULL) {
2212                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
2213                 return -1;
2214         }
2215
2216         a = WPA_GET_BE16(assoc);
2217         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
2218
2219         return 0;
2220 }
2221
2222
2223 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
2224 {
2225         u16 e;
2226
2227         if (err == NULL) {
2228                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
2229                 return -1;
2230         }
2231
2232         e = WPA_GET_BE16(err);
2233         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
2234
2235         return 0;
2236 }
2237
2238
2239 static int wps_registrar_p2p_dev_addr_match(struct wps_data *wps)
2240 {
2241 #ifdef CONFIG_P2P
2242         struct wps_registrar *reg = wps->wps->registrar;
2243
2244         if (is_zero_ether_addr(reg->p2p_dev_addr))
2245                 return 1; /* no filtering in use */
2246
2247         if (os_memcmp(reg->p2p_dev_addr, wps->p2p_dev_addr, ETH_ALEN) != 0) {
2248                 wpa_printf(MSG_DEBUG, "WPS: No match on P2P Device Address "
2249                            "filtering for PBC: expected " MACSTR " was "
2250                            MACSTR " - indicate PBC session overlap",
2251                            MAC2STR(reg->p2p_dev_addr),
2252                            MAC2STR(wps->p2p_dev_addr));
2253                 return 0;
2254         }
2255 #endif /* CONFIG_P2P */
2256         return 1;
2257 }
2258
2259
2260 static enum wps_process_res wps_process_m1(struct wps_data *wps,
2261                                            struct wps_parse_attr *attr)
2262 {
2263         wpa_printf(MSG_DEBUG, "WPS: Received M1");
2264
2265         if (wps->state != RECV_M1) {
2266                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2267                            "receiving M1", wps->state);
2268                 return WPS_FAILURE;
2269         }
2270
2271         if (wps_process_uuid_e(wps, attr->uuid_e) ||
2272             wps_process_mac_addr(wps, attr->mac_addr) ||
2273             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
2274             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
2275             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
2276             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
2277             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
2278             wps_process_config_methods(wps, attr->config_methods) ||
2279             wps_process_wps_state(wps, attr->wps_state) ||
2280             wps_process_device_attrs(&wps->peer_dev, attr) ||
2281             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
2282             wps_process_assoc_state(wps, attr->assoc_state) ||
2283             wps_process_dev_password_id(wps, attr->dev_password_id) ||
2284             wps_process_config_error(wps, attr->config_error) ||
2285             wps_process_os_version(&wps->peer_dev, attr->os_version))
2286                 return WPS_FAILURE;
2287
2288         if (wps->dev_pw_id < 0x10 &&
2289             wps->dev_pw_id != DEV_PW_DEFAULT &&
2290             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
2291             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
2292             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
2293             (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
2294              !wps->wps->registrar->pbc)) {
2295                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
2296                            wps->dev_pw_id);
2297                 wps->state = SEND_M2D;
2298                 return WPS_CONTINUE;
2299         }
2300
2301 #ifdef CONFIG_WPS_OOB
2302         if (wps->dev_pw_id >= 0x10 &&
2303             wps->dev_pw_id != wps->wps->oob_dev_pw_id) {
2304                 wpa_printf(MSG_DEBUG, "WPS: OOB Device Password ID "
2305                            "%d mismatch", wps->dev_pw_id);
2306                 wps->state = SEND_M2D;
2307                 return WPS_CONTINUE;
2308         }
2309 #endif /* CONFIG_WPS_OOB */
2310
2311         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
2312                 if (wps->wps->registrar->force_pbc_overlap ||
2313                     wps_registrar_pbc_overlap(wps->wps->registrar,
2314                                               wps->mac_addr_e, wps->uuid_e) ||
2315                     !wps_registrar_p2p_dev_addr_match(wps)) {
2316                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
2317                                    "negotiation");
2318                         wps->state = SEND_M2D;
2319                         wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2320                         wps_pbc_overlap_event(wps->wps);
2321                         wps_fail_event(wps->wps, WPS_M1,
2322                                        WPS_CFG_MULTIPLE_PBC_DETECTED,
2323                                        WPS_EI_NO_ERROR);
2324                         wps->wps->registrar->force_pbc_overlap = 1;
2325                         return WPS_CONTINUE;
2326                 }
2327                 wps_registrar_add_pbc_session(wps->wps->registrar,
2328                                               wps->mac_addr_e, wps->uuid_e);
2329                 wps->pbc = 1;
2330         }
2331
2332 #ifdef WPS_WORKAROUNDS
2333         /*
2334          * It looks like Mac OS X 10.6.3 and 10.6.4 do not like Network Key in
2335          * passphrase format. To avoid interop issues, force PSK format to be
2336          * used.
2337          */
2338         if (!wps->use_psk_key &&
2339             wps->peer_dev.manufacturer &&
2340             os_strncmp(wps->peer_dev.manufacturer, "Apple ", 6) == 0 &&
2341             wps->peer_dev.model_name &&
2342             os_strcmp(wps->peer_dev.model_name, "AirPort") == 0) {
2343                 wpa_printf(MSG_DEBUG, "WPS: Workaround - Force Network Key in "
2344                            "PSK format");
2345                 wps->use_psk_key = 1;
2346         }
2347 #endif /* WPS_WORKAROUNDS */
2348
2349         wps->state = SEND_M2;
2350         return WPS_CONTINUE;
2351 }
2352
2353
2354 static enum wps_process_res wps_process_m3(struct wps_data *wps,
2355                                            const struct wpabuf *msg,
2356                                            struct wps_parse_attr *attr)
2357 {
2358         wpa_printf(MSG_DEBUG, "WPS: Received M3");
2359
2360         if (wps->state != RECV_M3) {
2361                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2362                            "receiving M3", wps->state);
2363                 wps->state = SEND_WSC_NACK;
2364                 return WPS_CONTINUE;
2365         }
2366
2367         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2368                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2369                            "session overlap");
2370                 wps->state = SEND_WSC_NACK;
2371                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2372                 return WPS_CONTINUE;
2373         }
2374
2375         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2376             wps_process_authenticator(wps, attr->authenticator, msg) ||
2377             wps_process_e_hash1(wps, attr->e_hash1) ||
2378             wps_process_e_hash2(wps, attr->e_hash2)) {
2379                 wps->state = SEND_WSC_NACK;
2380                 return WPS_CONTINUE;
2381         }
2382
2383         wps->state = SEND_M4;
2384         return WPS_CONTINUE;
2385 }
2386
2387
2388 static enum wps_process_res wps_process_m5(struct wps_data *wps,
2389                                            const struct wpabuf *msg,
2390                                            struct wps_parse_attr *attr)
2391 {
2392         struct wpabuf *decrypted;
2393         struct wps_parse_attr eattr;
2394
2395         wpa_printf(MSG_DEBUG, "WPS: Received M5");
2396
2397         if (wps->state != RECV_M5) {
2398                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2399                            "receiving M5", wps->state);
2400                 wps->state = SEND_WSC_NACK;
2401                 return WPS_CONTINUE;
2402         }
2403
2404         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2405                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2406                            "session overlap");
2407                 wps->state = SEND_WSC_NACK;
2408                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2409                 return WPS_CONTINUE;
2410         }
2411
2412         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2413             wps_process_authenticator(wps, attr->authenticator, msg)) {
2414                 wps->state = SEND_WSC_NACK;
2415                 return WPS_CONTINUE;
2416         }
2417
2418         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2419                                               attr->encr_settings_len);
2420         if (decrypted == NULL) {
2421                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
2422                            "Settings attribute");
2423                 wps->state = SEND_WSC_NACK;
2424                 return WPS_CONTINUE;
2425         }
2426
2427         if (wps_validate_m5_encr(decrypted, attr->version2 != NULL) < 0) {
2428                 wpabuf_free(decrypted);
2429                 wps->state = SEND_WSC_NACK;
2430                 return WPS_CONTINUE;
2431         }
2432
2433         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2434                    "attribute");
2435         if (wps_parse_msg(decrypted, &eattr) < 0 ||
2436             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2437             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
2438                 wpabuf_free(decrypted);
2439                 wps->state = SEND_WSC_NACK;
2440                 return WPS_CONTINUE;
2441         }
2442         wpabuf_free(decrypted);
2443
2444         wps->state = SEND_M6;
2445         return WPS_CONTINUE;
2446 }
2447
2448
2449 static void wps_sta_cred_cb(struct wps_data *wps)
2450 {
2451         /*
2452          * Update credential to only include a single authentication and
2453          * encryption type in case the AP configuration includes more than one
2454          * option.
2455          */
2456         if (wps->cred.auth_type & WPS_AUTH_WPA2PSK)
2457                 wps->cred.auth_type = WPS_AUTH_WPA2PSK;
2458         else if (wps->cred.auth_type & WPS_AUTH_WPAPSK)
2459                 wps->cred.auth_type = WPS_AUTH_WPAPSK;
2460         if (wps->cred.encr_type & WPS_ENCR_AES)
2461                 wps->cred.encr_type = WPS_ENCR_AES;
2462         else if (wps->cred.encr_type & WPS_ENCR_TKIP)
2463                 wps->cred.encr_type = WPS_ENCR_TKIP;
2464         wpa_printf(MSG_DEBUG, "WPS: Update local configuration based on the "
2465                    "AP configuration");
2466         if (wps->wps->cred_cb)
2467                 wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2468 }
2469
2470
2471 static void wps_cred_update(struct wps_credential *dst,
2472                             struct wps_credential *src)
2473 {
2474         os_memcpy(dst->ssid, src->ssid, sizeof(dst->ssid));
2475         dst->ssid_len = src->ssid_len;
2476         dst->auth_type = src->auth_type;
2477         dst->encr_type = src->encr_type;
2478         dst->key_idx = src->key_idx;
2479         os_memcpy(dst->key, src->key, sizeof(dst->key));
2480         dst->key_len = src->key_len;
2481 }
2482
2483
2484 static int wps_process_ap_settings_r(struct wps_data *wps,
2485                                      struct wps_parse_attr *attr)
2486 {
2487         if (wps->wps->ap || wps->er)
2488                 return 0;
2489
2490         /* AP Settings Attributes in M7 when Enrollee is an AP */
2491         if (wps_process_ap_settings(attr, &wps->cred) < 0)
2492                 return -1;
2493
2494         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
2495
2496         if (wps->new_ap_settings) {
2497                 wpa_printf(MSG_INFO, "WPS: Update AP configuration based on "
2498                            "new settings");
2499                 wps_cred_update(&wps->cred, wps->new_ap_settings);
2500                 return 0;
2501         } else {
2502                 /*
2503                  * Use the AP PIN only to receive the current AP settings, not
2504                  * to reconfigure the AP.
2505                  */
2506
2507                 /*
2508                  * Clear selected registrar here since we do not get to
2509                  * WSC_Done in this protocol run.
2510                  */
2511                 wps_registrar_pin_completed(wps->wps->registrar);
2512
2513                 if (wps->ap_settings_cb) {
2514                         wps->ap_settings_cb(wps->ap_settings_cb_ctx,
2515                                             &wps->cred);
2516                         return 1;
2517                 }
2518                 wps_sta_cred_cb(wps);
2519                 return 1;
2520         }
2521 }
2522
2523
2524 static enum wps_process_res wps_process_m7(struct wps_data *wps,
2525                                            const struct wpabuf *msg,
2526                                            struct wps_parse_attr *attr)
2527 {
2528         struct wpabuf *decrypted;
2529         struct wps_parse_attr eattr;
2530
2531         wpa_printf(MSG_DEBUG, "WPS: Received M7");
2532
2533         if (wps->state != RECV_M7) {
2534                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2535                            "receiving M7", wps->state);
2536                 wps->state = SEND_WSC_NACK;
2537                 return WPS_CONTINUE;
2538         }
2539
2540         if (wps->pbc && wps->wps->registrar->force_pbc_overlap) {
2541                 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2542                            "session overlap");
2543                 wps->state = SEND_WSC_NACK;
2544                 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2545                 return WPS_CONTINUE;
2546         }
2547
2548         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2549             wps_process_authenticator(wps, attr->authenticator, msg)) {
2550                 wps->state = SEND_WSC_NACK;
2551                 return WPS_CONTINUE;
2552         }
2553
2554         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2555                                               attr->encr_settings_len);
2556         if (decrypted == NULL) {
2557                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypt Encrypted "
2558                            "Settings attribute");
2559                 wps->state = SEND_WSC_NACK;
2560                 return WPS_CONTINUE;
2561         }
2562
2563         if (wps_validate_m7_encr(decrypted, wps->wps->ap || wps->er,
2564                                  attr->version2 != NULL) < 0) {
2565                 wpabuf_free(decrypted);
2566                 wps->state = SEND_WSC_NACK;
2567                 return WPS_CONTINUE;
2568         }
2569
2570         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2571                    "attribute");
2572         if (wps_parse_msg(decrypted, &eattr) < 0 ||
2573             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2574             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
2575             wps_process_ap_settings_r(wps, &eattr)) {
2576                 wpabuf_free(decrypted);
2577                 wps->state = SEND_WSC_NACK;
2578                 return WPS_CONTINUE;
2579         }
2580
2581         wpabuf_free(decrypted);
2582
2583         wps->state = SEND_M8;
2584         return WPS_CONTINUE;
2585 }
2586
2587
2588 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
2589                                                 const struct wpabuf *msg)
2590 {
2591         struct wps_parse_attr attr;
2592         enum wps_process_res ret = WPS_CONTINUE;
2593
2594         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
2595
2596         if (wps_parse_msg(msg, &attr) < 0)
2597                 return WPS_FAILURE;
2598
2599         if (attr.msg_type == NULL) {
2600                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2601                 wps->state = SEND_WSC_NACK;
2602                 return WPS_CONTINUE;
2603         }
2604
2605         if (*attr.msg_type != WPS_M1 &&
2606             (attr.registrar_nonce == NULL ||
2607              os_memcmp(wps->nonce_r, attr.registrar_nonce,
2608                        WPS_NONCE_LEN != 0))) {
2609                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2610                 return WPS_FAILURE;
2611         }
2612
2613         switch (*attr.msg_type) {
2614         case WPS_M1:
2615                 if (wps_validate_m1(msg) < 0)
2616                         return WPS_FAILURE;
2617 #ifdef CONFIG_WPS_UPNP
2618                 if (wps->wps->wps_upnp && attr.mac_addr) {
2619                         /* Remove old pending messages when starting new run */
2620                         wps_free_pending_msgs(wps->wps->upnp_msgs);
2621                         wps->wps->upnp_msgs = NULL;
2622
2623                         upnp_wps_device_send_wlan_event(
2624                                 wps->wps->wps_upnp, attr.mac_addr,
2625                                 UPNP_WPS_WLANEVENT_TYPE_EAP, msg);
2626                 }
2627 #endif /* CONFIG_WPS_UPNP */
2628                 ret = wps_process_m1(wps, &attr);
2629                 break;
2630         case WPS_M3:
2631                 if (wps_validate_m3(msg) < 0)
2632                         return WPS_FAILURE;
2633                 ret = wps_process_m3(wps, msg, &attr);
2634                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2635                         wps_fail_event(wps->wps, WPS_M3, wps->config_error,
2636                                        wps->error_indication);
2637                 break;
2638         case WPS_M5:
2639                 if (wps_validate_m5(msg) < 0)
2640                         return WPS_FAILURE;
2641                 ret = wps_process_m5(wps, msg, &attr);
2642                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2643                         wps_fail_event(wps->wps, WPS_M5, wps->config_error,
2644                                        wps->error_indication);
2645                 break;
2646         case WPS_M7:
2647                 if (wps_validate_m7(msg) < 0)
2648                         return WPS_FAILURE;
2649                 ret = wps_process_m7(wps, msg, &attr);
2650                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2651                         wps_fail_event(wps->wps, WPS_M7, wps->config_error,
2652                                        wps->error_indication);
2653                 break;
2654         default:
2655                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
2656                            *attr.msg_type);
2657                 return WPS_FAILURE;
2658         }
2659
2660         if (ret == WPS_CONTINUE) {
2661                 /* Save a copy of the last message for Authenticator derivation
2662                  */
2663                 wpabuf_free(wps->last_msg);
2664                 wps->last_msg = wpabuf_dup(msg);
2665         }
2666
2667         return ret;
2668 }
2669
2670
2671 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
2672                                                 const struct wpabuf *msg)
2673 {
2674         struct wps_parse_attr attr;
2675
2676         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
2677
2678         if (wps_parse_msg(msg, &attr) < 0)
2679                 return WPS_FAILURE;
2680
2681         if (attr.msg_type == NULL) {
2682                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2683                 return WPS_FAILURE;
2684         }
2685
2686         if (*attr.msg_type != WPS_WSC_ACK) {
2687                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2688                            *attr.msg_type);
2689                 return WPS_FAILURE;
2690         }
2691
2692 #ifdef CONFIG_WPS_UPNP
2693         if (wps->wps->wps_upnp && wps->ext_reg && wps->state == RECV_M2D_ACK &&
2694             upnp_wps_subscribers(wps->wps->wps_upnp)) {
2695                 if (wps->wps->upnp_msgs)
2696                         return WPS_CONTINUE;
2697                 wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2698                            "external Registrar");
2699                 return WPS_PENDING;
2700         }
2701 #endif /* CONFIG_WPS_UPNP */
2702
2703         if (attr.registrar_nonce == NULL ||
2704             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2705         {
2706                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2707                 return WPS_FAILURE;
2708         }
2709
2710         if (attr.enrollee_nonce == NULL ||
2711             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2712                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2713                 return WPS_FAILURE;
2714         }
2715
2716         if (wps->state == RECV_M2D_ACK) {
2717 #ifdef CONFIG_WPS_UPNP
2718                 if (wps->wps->wps_upnp &&
2719                     upnp_wps_subscribers(wps->wps->wps_upnp)) {
2720                         if (wps->wps->upnp_msgs)
2721                                 return WPS_CONTINUE;
2722                         if (wps->ext_reg == 0)
2723                                 wps->ext_reg = 1;
2724                         wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2725                                    "external Registrar");
2726                         return WPS_PENDING;
2727                 }
2728 #endif /* CONFIG_WPS_UPNP */
2729
2730                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
2731                            "terminate negotiation");
2732         }
2733
2734         return WPS_FAILURE;
2735 }
2736
2737
2738 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
2739                                                  const struct wpabuf *msg)
2740 {
2741         struct wps_parse_attr attr;
2742         int old_state;
2743         u16 config_error;
2744
2745         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
2746
2747         old_state = wps->state;
2748         wps->state = SEND_WSC_NACK;
2749
2750         if (wps_parse_msg(msg, &attr) < 0)
2751                 return WPS_FAILURE;
2752
2753         if (attr.msg_type == NULL) {
2754                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2755                 return WPS_FAILURE;
2756         }
2757
2758         if (*attr.msg_type != WPS_WSC_NACK) {
2759                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2760                            *attr.msg_type);
2761                 return WPS_FAILURE;
2762         }
2763
2764 #ifdef CONFIG_WPS_UPNP
2765         if (wps->wps->wps_upnp && wps->ext_reg) {
2766                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2767                            "Registrar terminated by the Enrollee");
2768                 return WPS_FAILURE;
2769         }
2770 #endif /* CONFIG_WPS_UPNP */
2771
2772         if (attr.registrar_nonce == NULL ||
2773             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2774         {
2775                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2776                 return WPS_FAILURE;
2777         }
2778
2779         if (attr.enrollee_nonce == NULL ||
2780             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2781                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2782                 return WPS_FAILURE;
2783         }
2784
2785         if (attr.config_error == NULL) {
2786                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
2787                            "in WSC_NACK");
2788                 return WPS_FAILURE;
2789         }
2790
2791         config_error = WPA_GET_BE16(attr.config_error);
2792         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
2793                    "Configuration Error %d", config_error);
2794
2795         switch (old_state) {
2796         case RECV_M3:
2797                 wps_fail_event(wps->wps, WPS_M2, config_error,
2798                                wps->error_indication);
2799                 break;
2800         case RECV_M5:
2801                 wps_fail_event(wps->wps, WPS_M4, config_error,
2802                                wps->error_indication);
2803                 break;
2804         case RECV_M7:
2805                 wps_fail_event(wps->wps, WPS_M6, config_error,
2806                                wps->error_indication);
2807                 break;
2808         case RECV_DONE:
2809                 wps_fail_event(wps->wps, WPS_M8, config_error,
2810                                wps->error_indication);
2811                 break;
2812         default:
2813                 break;
2814         }
2815
2816         return WPS_FAILURE;
2817 }
2818
2819
2820 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
2821                                                  const struct wpabuf *msg)
2822 {
2823         struct wps_parse_attr attr;
2824
2825         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
2826
2827         if (wps->state != RECV_DONE &&
2828             (!wps->wps->wps_upnp || !wps->ext_reg)) {
2829                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2830                            "receiving WSC_Done", wps->state);
2831                 return WPS_FAILURE;
2832         }
2833
2834         if (wps_parse_msg(msg, &attr) < 0)
2835                 return WPS_FAILURE;
2836
2837         if (attr.msg_type == NULL) {
2838                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2839                 return WPS_FAILURE;
2840         }
2841
2842         if (*attr.msg_type != WPS_WSC_DONE) {
2843                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2844                            *attr.msg_type);
2845                 return WPS_FAILURE;
2846         }
2847
2848 #ifdef CONFIG_WPS_UPNP
2849         if (wps->wps->wps_upnp && wps->ext_reg) {
2850                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2851                            "Registrar completed successfully");
2852                 wps_device_store(wps->wps->registrar, &wps->peer_dev,
2853                                  wps->uuid_e);
2854                 return WPS_DONE;
2855         }
2856 #endif /* CONFIG_WPS_UPNP */
2857
2858         if (attr.registrar_nonce == NULL ||
2859             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2860         {
2861                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2862                 return WPS_FAILURE;
2863         }
2864
2865         if (attr.enrollee_nonce == NULL ||
2866             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2867                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2868                 return WPS_FAILURE;
2869         }
2870
2871         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
2872         wps_device_store(wps->wps->registrar, &wps->peer_dev,
2873                          wps->uuid_e);
2874
2875         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
2876             wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
2877                 struct wps_credential cred;
2878
2879                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
2880                            "on first Enrollee connection");
2881
2882                 os_memset(&cred, 0, sizeof(cred));
2883                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
2884                 cred.ssid_len = wps->wps->ssid_len;
2885                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
2886                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
2887                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
2888                 cred.key_len = wps->new_psk_len;
2889
2890                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
2891                 wpa_hexdump_ascii_key(MSG_DEBUG,
2892                                       "WPS: Generated random passphrase",
2893                                       wps->new_psk, wps->new_psk_len);
2894                 if (wps->wps->cred_cb)
2895                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
2896
2897                 os_free(wps->new_psk);
2898                 wps->new_psk = NULL;
2899         }
2900
2901         if (!wps->wps->ap && !wps->er)
2902                 wps_sta_cred_cb(wps);
2903
2904         if (wps->new_psk) {
2905                 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
2906                                    wps->new_psk, wps->new_psk_len)) {
2907                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
2908                                    "new PSK");
2909                 }
2910                 os_free(wps->new_psk);
2911                 wps->new_psk = NULL;
2912         }
2913
2914         wps_cb_reg_success(wps->wps->registrar, wps->mac_addr_e, wps->uuid_e);
2915
2916         if (wps->pbc) {
2917                 wps_registrar_remove_pbc_session(wps->wps->registrar,
2918                                                  wps->mac_addr_e, wps->uuid_e);
2919                 wps_registrar_pbc_completed(wps->wps->registrar);
2920         } else {
2921                 wps_registrar_pin_completed(wps->wps->registrar);
2922         }
2923         /* TODO: maintain AuthorizedMACs somewhere separately for each ER and
2924          * merge them into APs own list.. */
2925
2926         wps_success_event(wps->wps);
2927
2928         return WPS_DONE;
2929 }
2930
2931
2932 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
2933                                                enum wsc_op_code op_code,
2934                                                const struct wpabuf *msg)
2935 {
2936         enum wps_process_res ret;
2937
2938         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2939                    "op_code=%d)",
2940                    (unsigned long) wpabuf_len(msg), op_code);
2941
2942 #ifdef CONFIG_WPS_UPNP
2943         if (wps->wps->wps_upnp && op_code == WSC_MSG && wps->ext_reg == 1) {
2944                 struct wps_parse_attr attr;
2945                 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type &&
2946                     *attr.msg_type == WPS_M3)
2947                         wps->ext_reg = 2; /* past M2/M2D phase */
2948         }
2949         if (wps->ext_reg > 1)
2950                 wps_registrar_free_pending_m2(wps->wps);
2951         if (wps->wps->wps_upnp && wps->ext_reg &&
2952             wps->wps->upnp_msgs == NULL &&
2953             (op_code == WSC_MSG || op_code == WSC_Done || op_code == WSC_NACK))
2954         {
2955                 struct wps_parse_attr attr;
2956                 int type;
2957                 if (wps_parse_msg(msg, &attr) < 0 || attr.msg_type == NULL)
2958                         type = -1;
2959                 else
2960                         type = *attr.msg_type;
2961                 wpa_printf(MSG_DEBUG, "WPS: Sending received message (type %d)"
2962                            " to external Registrar for processing", type);
2963                 upnp_wps_device_send_wlan_event(wps->wps->wps_upnp,
2964                                                 wps->mac_addr_e,
2965                                                 UPNP_WPS_WLANEVENT_TYPE_EAP,
2966                                                 msg);
2967                 if (op_code == WSC_MSG)
2968                         return WPS_PENDING;
2969         } else if (wps->wps->wps_upnp && wps->ext_reg && op_code == WSC_MSG) {
2970                 wpa_printf(MSG_DEBUG, "WPS: Skip internal processing - using "
2971                            "external Registrar");
2972                 return WPS_CONTINUE;
2973         }
2974 #endif /* CONFIG_WPS_UPNP */
2975
2976         switch (op_code) {
2977         case WSC_MSG:
2978                 return wps_process_wsc_msg(wps, msg);
2979         case WSC_ACK:
2980                 if (wps_validate_wsc_ack(msg) < 0)
2981                         return WPS_FAILURE;
2982                 return wps_process_wsc_ack(wps, msg);
2983         case WSC_NACK:
2984                 if (wps_validate_wsc_nack(msg) < 0)
2985                         return WPS_FAILURE;
2986                 return wps_process_wsc_nack(wps, msg);
2987         case WSC_Done:
2988                 if (wps_validate_wsc_done(msg) < 0)
2989                         return WPS_FAILURE;
2990                 ret = wps_process_wsc_done(wps, msg);
2991                 if (ret == WPS_FAILURE) {
2992                         wps->state = SEND_WSC_NACK;
2993                         wps_fail_event(wps->wps, WPS_WSC_DONE,
2994                                        wps->config_error,
2995                                        wps->error_indication);
2996                 }
2997                 return ret;
2998         default:
2999                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
3000                 return WPS_FAILURE;
3001         }
3002 }
3003
3004
3005 int wps_registrar_update_ie(struct wps_registrar *reg)
3006 {
3007         return wps_set_ie(reg);
3008 }
3009
3010
3011 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
3012                                                void *timeout_ctx)
3013 {
3014         struct wps_registrar *reg = eloop_ctx;
3015
3016         wpa_printf(MSG_DEBUG, "WPS: Selected Registrar timeout - "
3017                    "unselect internal Registrar");
3018         reg->selected_registrar = 0;
3019         reg->pbc = 0;
3020         wps_registrar_selected_registrar_changed(reg);
3021 }
3022
3023
3024 #ifdef CONFIG_WPS_UPNP
3025 static void wps_registrar_sel_reg_add(struct wps_registrar *reg,
3026                                       struct subscription *s)
3027 {
3028         int i, j;
3029         wpa_printf(MSG_DEBUG, "WPS: External Registrar selected (dev_pw_id=%d "
3030                    "config_methods=0x%x)",
3031                    s->dev_password_id, s->config_methods);
3032         reg->sel_reg_union = 1;
3033         if (reg->sel_reg_dev_password_id_override != DEV_PW_PUSHBUTTON)
3034                 reg->sel_reg_dev_password_id_override = s->dev_password_id;
3035         if (reg->sel_reg_config_methods_override == -1)
3036                 reg->sel_reg_config_methods_override = 0;
3037         reg->sel_reg_config_methods_override |= s->config_methods;
3038         for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++)
3039                 if (is_zero_ether_addr(reg->authorized_macs_union[i]))
3040                         break;
3041         for (j = 0; i < WPS_MAX_AUTHORIZED_MACS && j < WPS_MAX_AUTHORIZED_MACS;
3042              j++) {
3043                 if (is_zero_ether_addr(s->authorized_macs[j]))
3044                         break;
3045                 wpa_printf(MSG_DEBUG, "WPS: Add authorized MAC into union: "
3046                            MACSTR, MAC2STR(s->authorized_macs[j]));
3047                 os_memcpy(reg->authorized_macs_union[i],
3048                           s->authorized_macs[j], ETH_ALEN);
3049                 i++;
3050         }
3051         wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs union",
3052                     (u8 *) reg->authorized_macs_union,
3053                     sizeof(reg->authorized_macs_union));
3054 }
3055 #endif /* CONFIG_WPS_UPNP */
3056
3057
3058 static void wps_registrar_sel_reg_union(struct wps_registrar *reg)
3059 {
3060 #ifdef CONFIG_WPS_UPNP
3061         struct subscription *s;
3062
3063         if (reg->wps->wps_upnp == NULL)
3064                 return;
3065
3066         dl_list_for_each(s, &reg->wps->wps_upnp->subscriptions,
3067                          struct subscription, list) {
3068                 struct subscr_addr *sa;
3069                 sa = dl_list_first(&s->addr_list, struct subscr_addr, list);
3070                 if (sa) {
3071                         wpa_printf(MSG_DEBUG, "WPS: External Registrar %s:%d",
3072                                    inet_ntoa(sa->saddr.sin_addr),
3073                                    ntohs(sa->saddr.sin_port));
3074                 }
3075                 if (s->selected_registrar)
3076                         wps_registrar_sel_reg_add(reg, s);
3077                 else
3078                         wpa_printf(MSG_DEBUG, "WPS: External Registrar not "
3079                                    "selected");
3080         }
3081 #endif /* CONFIG_WPS_UPNP */
3082 }
3083
3084
3085 /**
3086  * wps_registrar_selected_registrar_changed - SetSelectedRegistrar change
3087  * @reg: Registrar data from wps_registrar_init()
3088  *
3089  * This function is called when selected registrar state changes, e.g., when an
3090  * AP receives a SetSelectedRegistrar UPnP message.
3091  */
3092 void wps_registrar_selected_registrar_changed(struct wps_registrar *reg)
3093 {
3094         wpa_printf(MSG_DEBUG, "WPS: Selected registrar information changed");
3095
3096         reg->sel_reg_union = reg->selected_registrar;
3097         reg->sel_reg_dev_password_id_override = -1;
3098         reg->sel_reg_config_methods_override = -1;
3099         os_memcpy(reg->authorized_macs_union, reg->authorized_macs,
3100                   WPS_MAX_AUTHORIZED_MACS * ETH_ALEN);
3101         wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs union (start with own)",
3102                     (u8 *) reg->authorized_macs_union,
3103                     sizeof(reg->authorized_macs_union));
3104         if (reg->selected_registrar) {
3105                 u16 methods;
3106
3107                 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
3108 #ifdef CONFIG_WPS2
3109                 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
3110                              WPS_CONFIG_PHY_PUSHBUTTON);
3111 #endif /* CONFIG_WPS2 */
3112                 if (reg->pbc) {
3113                         reg->sel_reg_dev_password_id_override =
3114                                 DEV_PW_PUSHBUTTON;
3115                         wps_set_pushbutton(&methods, reg->wps->config_methods);
3116                 }
3117                 wpa_printf(MSG_DEBUG, "WPS: Internal Registrar selected "
3118                            "(pbc=%d)", reg->pbc);
3119                 reg->sel_reg_config_methods_override = methods;
3120         } else
3121                 wpa_printf(MSG_DEBUG, "WPS: Internal Registrar not selected");
3122
3123         wps_registrar_sel_reg_union(reg);
3124
3125         wps_set_ie(reg);
3126         wps_cb_set_sel_reg(reg);
3127 }
3128
3129
3130 int wps_registrar_get_info(struct wps_registrar *reg, const u8 *addr,
3131                            char *buf, size_t buflen)
3132 {
3133         struct wps_registrar_device *d;
3134         int len = 0, ret;
3135         char uuid[40];
3136         char devtype[WPS_DEV_TYPE_BUFSIZE];
3137
3138         d = wps_device_get(reg, addr);
3139         if (d == NULL)
3140                 return 0;
3141         if (uuid_bin2str(d->uuid, uuid, sizeof(uuid)))
3142                 return 0;
3143
3144         ret = os_snprintf(buf + len, buflen - len,
3145                           "wpsUuid=%s\n"
3146                           "wpsPrimaryDeviceType=%s\n"
3147                           "wpsDeviceName=%s\n"
3148                           "wpsManufacturer=%s\n"
3149                           "wpsModelName=%s\n"
3150                           "wpsModelNumber=%s\n"
3151                           "wpsSerialNumber=%s\n",
3152                           uuid,
3153                           wps_dev_type_bin2str(d->dev.pri_dev_type, devtype,
3154                                                sizeof(devtype)),
3155                           d->dev.device_name ? d->dev.device_name : "",
3156                           d->dev.manufacturer ? d->dev.manufacturer : "",
3157                           d->dev.model_name ? d->dev.model_name : "",
3158                           d->dev.model_number ? d->dev.model_number : "",
3159                           d->dev.serial_number ? d->dev.serial_number : "");
3160         if (ret < 0 || (size_t) ret >= buflen - len)
3161                 return len;
3162         len += ret;
3163
3164         return len;
3165 }
3166
3167
3168 int wps_registrar_config_ap(struct wps_registrar *reg,
3169                             struct wps_credential *cred)
3170 {
3171 #ifdef CONFIG_WPS2
3172         printf("encr_type=0x%x\n", cred->encr_type);
3173         if (!(cred->encr_type & (WPS_ENCR_NONE | WPS_ENCR_TKIP |
3174                                  WPS_ENCR_AES))) {
3175                 if (cred->encr_type & WPS_ENCR_WEP) {
3176                         wpa_printf(MSG_INFO, "WPS: Reject new AP settings "
3177                                    "due to WEP configuration");
3178                         return -1;
3179                 }
3180
3181                 wpa_printf(MSG_INFO, "WPS: Reject new AP settings due to "
3182                            "invalid encr_type 0x%x", cred->encr_type);
3183                 return -1;
3184         }
3185
3186         if ((cred->encr_type & (WPS_ENCR_TKIP | WPS_ENCR_AES)) ==
3187             WPS_ENCR_TKIP) {
3188                 wpa_printf(MSG_DEBUG, "WPS: Upgrade encr_type TKIP -> "
3189                            "TKIP+AES");
3190                 cred->encr_type |= WPS_ENCR_AES;
3191         }
3192
3193         if ((cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) ==
3194             WPS_AUTH_WPAPSK) {
3195                 wpa_printf(MSG_DEBUG, "WPS: Upgrade auth_type WPAPSK -> "
3196                            "WPAPSK+WPA2PSK");
3197                 cred->auth_type |= WPS_AUTH_WPA2PSK;
3198         }
3199 #endif /* CONFIG_WPS2 */
3200
3201         if (reg->wps->cred_cb)
3202                 return reg->wps->cred_cb(reg->wps->cb_ctx, cred);
3203
3204         return -1;
3205 }