wpa_supplicant/wps_supplicant.c

   1 /*
   2  * wpa_supplicant / WPS integration
   3  * Copyright (c) 2008-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "eloop.h"
  13 #include "uuid.h"
  14 #include "crypto/random.h"
  15 #include "crypto/dh_group5.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "common/ieee802_11_common.h"
  18 #include "common/wpa_common.h"
  19 #include "common/wpa_ctrl.h"
  20 #include "eap_common/eap_wsc_common.h"
  21 #include "eap_peer/eap.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "rsn_supp/wpa.h"
  24 #include "wps/wps_attr_parse.h"
  25 #include "config.h"
  26 #include "wpa_supplicant_i.h"
  27 #include "driver_i.h"
  28 #include "notify.h"
  29 #include "blacklist.h"
  30 #include "bss.h"
  31 #include "scan.h"
  32 #include "ap.h"
  33 #include "p2p/p2p.h"
  34 #include "p2p_supplicant.h"
  35 #include "wps_supplicant.h"
  36
  37
  38 #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
  39 #define WPS_PIN_SCAN_IGNORE_SEL_REG 3
  40 #endif /* WPS_PIN_SCAN_IGNORE_SEL_REG */
  41
  42 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx);
  43 static void wpas_clear_wps(struct wpa_supplicant *wpa_s);
  44
  45
  46 static void wpas_wps_clear_ap_info(struct wpa_supplicant *wpa_s)
  47 {
  48         os_free(wpa_s->wps_ap);
  49         wpa_s->wps_ap = NULL;
  50         wpa_s->num_wps_ap = 0;
  51         wpa_s->wps_ap_iter = 0;
  52 }
  53
  54
  55 int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s)
  56 {
  57         if (!wpa_s->wps_success &&
  58             wpa_s->current_ssid &&
  59             eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
  60                 const u8 *bssid = wpa_s->bssid;
  61                 if (is_zero_ether_addr(bssid))
  62                         bssid = wpa_s->pending_bssid;
  63
  64                 wpa_printf(MSG_DEBUG, "WPS: PIN registration with " MACSTR
  65                            " did not succeed - continue trying to find "
  66                            "suitable AP", MAC2STR(bssid));
  67                 wpa_blacklist_add(wpa_s, bssid);
  68
  69                 wpa_supplicant_deauthenticate(wpa_s,
  70                                               WLAN_REASON_DEAUTH_LEAVING);
  71                 wpa_s->reassociate = 1;
  72                 wpa_supplicant_req_scan(wpa_s,
  73                                         wpa_s->blacklist_cleared ? 5 : 0, 0);
  74                 wpa_s->blacklist_cleared = 0;
  75                 return 1;
  76         }
  77
  78         wpas_wps_clear_ap_info(wpa_s);
  79         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
  80         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && !wpa_s->wps_success)
  81                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_FAIL);
  82
  83         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid &&
  84             !(wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
  85                 int disabled = wpa_s->current_ssid->disabled;
  86                 unsigned int freq = wpa_s->assoc_freq;
  87                 wpa_printf(MSG_DEBUG, "WPS: Network configuration replaced - "
  88                            "try to associate with the received credential "
  89                            "(freq=%u)", freq);
  90                 wpa_supplicant_deauthenticate(wpa_s,
  91                                               WLAN_REASON_DEAUTH_LEAVING);
  92                 if (disabled) {
  93                         wpa_printf(MSG_DEBUG, "WPS: Current network is "
  94                                    "disabled - wait for user to enable");
  95                         return 1;
  96                 }
  97                 wpa_s->after_wps = 5;
  98                 wpa_s->wps_freq = freq;
  99                 wpa_s->normal_scans = 0;
 100                 wpa_s->reassociate = 1;
 101                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 102                 return 1;
 103         }
 104
 105         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid) {
 106                 wpa_printf(MSG_DEBUG, "WPS: Registration completed - waiting "
 107                            "for external credential processing");
 108                 wpas_clear_wps(wpa_s);
 109                 wpa_supplicant_deauthenticate(wpa_s,
 110                                               WLAN_REASON_DEAUTH_LEAVING);
 111                 return 1;
 112         }
 113
 114         return 0;
 115 }
 116
 117
 118 static void wpas_wps_security_workaround(struct wpa_supplicant *wpa_s,
 119                                          struct wpa_ssid *ssid,
 120                                          const struct wps_credential *cred)
 121 {
 122         struct wpa_driver_capa capa;
 123         struct wpa_bss *bss;
 124         const u8 *ie;
 125         struct wpa_ie_data adv;
 126         int wpa2 = 0, ccmp = 0;
 127
 128         /*
 129          * Many existing WPS APs do not know how to negotiate WPA2 or CCMP in
 130          * case they are configured for mixed mode operation (WPA+WPA2 and
 131          * TKIP+CCMP). Try to use scan results to figure out whether the AP
 132          * actually supports stronger security and select that if the client
 133          * has support for it, too.
 134          */
 135
 136         if (wpa_drv_get_capa(wpa_s, &capa))
 137                 return; /* Unknown what driver supports */
 138
 139         if (ssid->ssid == NULL)
 140                 return;
 141         bss = wpa_bss_get(wpa_s, cred->mac_addr, ssid->ssid, ssid->ssid_len);
 142         if (bss == NULL) {
 143                 wpa_printf(MSG_DEBUG, "WPS: The AP was not found from BSS "
 144                            "table - use credential as-is");
 145                 return;
 146         }
 147
 148         wpa_printf(MSG_DEBUG, "WPS: AP found from BSS table");
 149
 150         ie = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 151         if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0) {
 152                 wpa2 = 1;
 153                 if (adv.pairwise_cipher & WPA_CIPHER_CCMP)
 154                         ccmp = 1;
 155         } else {
 156                 ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 157                 if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0 &&
 158                     adv.pairwise_cipher & WPA_CIPHER_CCMP)
 159                         ccmp = 1;
 160         }
 161
 162         if (ie == NULL && (ssid->proto & WPA_PROTO_WPA) &&
 163             (ssid->pairwise_cipher & WPA_CIPHER_TKIP)) {
 164                 /*
 165                  * TODO: This could be the initial AP configuration and the
 166                  * Beacon contents could change shortly. Should request a new
 167                  * scan and delay addition of the network until the updated
 168                  * scan results are available.
 169                  */
 170                 wpa_printf(MSG_DEBUG, "WPS: The AP did not yet advertise WPA "
 171                            "support - use credential as-is");
 172                 return;
 173         }
 174
 175         if (ccmp && !(ssid->pairwise_cipher & WPA_CIPHER_CCMP) &&
 176             (ssid->pairwise_cipher & WPA_CIPHER_TKIP) &&
 177             (capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
 178                 wpa_printf(MSG_DEBUG, "WPS: Add CCMP into the credential "
 179                            "based on scan results");
 180                 if (wpa_s->conf->ap_scan == 1)
 181                         ssid->pairwise_cipher |= WPA_CIPHER_CCMP;
 182                 else
 183                         ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 184         }
 185
 186         if (wpa2 && !(ssid->proto & WPA_PROTO_RSN) &&
 187             (ssid->proto & WPA_PROTO_WPA) &&
 188             (capa.enc & WPA_DRIVER_CAPA_ENC_CCMP)) {
 189                 wpa_printf(MSG_DEBUG, "WPS: Add WPA2 into the credential "
 190                            "based on scan results");
 191                 if (wpa_s->conf->ap_scan == 1)
 192                         ssid->proto |= WPA_PROTO_RSN;
 193                 else
 194                         ssid->proto = WPA_PROTO_RSN;
 195         }
 196 }
 197
 198
 199 static int wpa_supplicant_wps_cred(void *ctx,
 200                                    const struct wps_credential *cred)
 201 {
 202         struct wpa_supplicant *wpa_s = ctx;
 203         struct wpa_ssid *ssid = wpa_s->current_ssid;
 204         u8 key_idx = 0;
 205         u16 auth_type;
 206 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 207         int registrar = 0;
 208 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 209
 210         if ((wpa_s->conf->wps_cred_processing == 1 ||
 211              wpa_s->conf->wps_cred_processing == 2) && cred->cred_attr) {
 212                 size_t blen = cred->cred_attr_len * 2 + 1;
 213                 char *buf = os_malloc(blen);
 214                 if (buf) {
 215                         wpa_snprintf_hex(buf, blen,
 216                                          cred->cred_attr, cred->cred_attr_len);
 217                         wpa_msg(wpa_s, MSG_INFO, "%s%s",
 218                                 WPS_EVENT_CRED_RECEIVED, buf);
 219                         os_free(buf);
 220                 }
 221
 222                 wpas_notify_wps_credential(wpa_s, cred);
 223         } else
 224                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_CRED_RECEIVED);
 225
 226         wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
 227                         cred->cred_attr, cred->cred_attr_len);
 228
 229         if (wpa_s->conf->wps_cred_processing == 1)
 230                 return 0;
 231
 232         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
 233         wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
 234                    cred->auth_type);
 235         wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
 236         wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
 237         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
 238                         cred->key, cred->key_len);
 239         wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
 240                    MAC2STR(cred->mac_addr));
 241
 242         auth_type = cred->auth_type;
 243         if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 244                 wpa_printf(MSG_DEBUG, "WPS: Workaround - convert mixed-mode "
 245                            "auth_type into WPA2PSK");
 246                 auth_type = WPS_AUTH_WPA2PSK;
 247         }
 248
 249         if (auth_type != WPS_AUTH_OPEN &&
 250             auth_type != WPS_AUTH_SHARED &&
 251             auth_type != WPS_AUTH_WPAPSK &&
 252             auth_type != WPS_AUTH_WPA2PSK) {
 253                 wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for "
 254                            "unsupported authentication type 0x%x",
 255                            auth_type);
 256                 return 0;
 257         }
 258
 259         if (auth_type == WPS_AUTH_WPAPSK || auth_type == WPS_AUTH_WPA2PSK) {
 260                 if (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN) {
 261                         wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with "
 262                                    "invalid Network Key length %lu",
 263                                    (unsigned long) cred->key_len);
 264                         return -1;
 265                 }
 266         }
 267
 268         if (ssid && (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
 269                 wpa_printf(MSG_DEBUG, "WPS: Replace WPS network block based "
 270                            "on the received credential");
 271 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 272                 if (ssid->eap.identity &&
 273                     ssid->eap.identity_len == WSC_ID_REGISTRAR_LEN &&
 274                     os_memcmp(ssid->eap.identity, WSC_ID_REGISTRAR,
 275                               WSC_ID_REGISTRAR_LEN) == 0)
 276                         registrar = 1;
 277 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 278                 os_free(ssid->eap.identity);
 279                 ssid->eap.identity = NULL;
 280                 ssid->eap.identity_len = 0;
 281                 os_free(ssid->eap.phase1);
 282                 ssid->eap.phase1 = NULL;
 283                 os_free(ssid->eap.eap_methods);
 284                 ssid->eap.eap_methods = NULL;
 285                 if (!ssid->p2p_group) {
 286                         ssid->temporary = 0;
 287                         ssid->bssid_set = 0;
 288                 }
 289                 ssid->disabled_until.sec = 0;
 290                 ssid->disabled_until.usec = 0;
 291                 ssid->auth_failures = 0;
 292         } else {
 293                 wpa_printf(MSG_DEBUG, "WPS: Create a new network based on the "
 294                            "received credential");
 295                 ssid = wpa_config_add_network(wpa_s->conf);
 296                 if (ssid == NULL)
 297                         return -1;
 298                 wpas_notify_network_added(wpa_s, ssid);
 299         }
 300
 301         wpa_config_set_network_defaults(ssid);
 302
 303         os_free(ssid->ssid);
 304         ssid->ssid = os_malloc(cred->ssid_len);
 305         if (ssid->ssid) {
 306                 os_memcpy(ssid->ssid, cred->ssid, cred->ssid_len);
 307                 ssid->ssid_len = cred->ssid_len;
 308         }
 309
 310         switch (cred->encr_type) {
 311         case WPS_ENCR_NONE:
 312                 break;
 313         case WPS_ENCR_WEP:
 314                 if (cred->key_len <= 0)
 315                         break;
 316                 if (cred->key_len != 5 && cred->key_len != 13 &&
 317                     cred->key_len != 10 && cred->key_len != 26) {
 318                         wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key length "
 319                                    "%lu", (unsigned long) cred->key_len);
 320                         return -1;
 321                 }
 322                 if (cred->key_idx > NUM_WEP_KEYS) {
 323                         wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key index %d",
 324                                    cred->key_idx);
 325                         return -1;
 326                 }
 327                 if (cred->key_idx)
 328                         key_idx = cred->key_idx - 1;
 329                 if (cred->key_len == 10 || cred->key_len == 26) {
 330                         if (hexstr2bin((char *) cred->key,
 331                                        ssid->wep_key[key_idx],
 332                                        cred->key_len / 2) < 0) {
 333                                 wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key "
 334                                            "%d", key_idx);
 335                                 return -1;
 336                         }
 337                         ssid->wep_key_len[key_idx] = cred->key_len / 2;
 338                 } else {
 339                         os_memcpy(ssid->wep_key[key_idx], cred->key,
 340                                   cred->key_len);
 341                         ssid->wep_key_len[key_idx] = cred->key_len;
 342                 }
 343                 ssid->wep_tx_keyidx = key_idx;
 344                 break;
 345         case WPS_ENCR_TKIP:
 346                 ssid->pairwise_cipher = WPA_CIPHER_TKIP;
 347                 break;
 348         case WPS_ENCR_AES:
 349                 ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 350                 break;
 351         }
 352
 353         switch (auth_type) {
 354         case WPS_AUTH_OPEN:
 355                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 356                 ssid->key_mgmt = WPA_KEY_MGMT_NONE;
 357                 ssid->proto = 0;
 358 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 359                 if (registrar) {
 360                         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_OPEN_NETWORK
 361                                 "id=%d - Credentials for an open "
 362                                 "network disabled by default - use "
 363                                 "'select_network %d' to enable",
 364                                 ssid->id, ssid->id);
 365                         ssid->disabled = 1;
 366                 }
 367 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 368                 break;
 369         case WPS_AUTH_SHARED:
 370                 ssid->auth_alg = WPA_AUTH_ALG_SHARED;
 371                 ssid->key_mgmt = WPA_KEY_MGMT_NONE;
 372                 ssid->proto = 0;
 373                 break;
 374         case WPS_AUTH_WPAPSK:
 375                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 376                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 377                 ssid->proto = WPA_PROTO_WPA;
 378                 break;
 379         case WPS_AUTH_WPA2PSK:
 380                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 381                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 382                 ssid->proto = WPA_PROTO_RSN;
 383                 break;
 384         }
 385
 386         if (ssid->key_mgmt == WPA_KEY_MGMT_PSK) {
 387                 if (cred->key_len == 2 * PMK_LEN) {
 388                         if (hexstr2bin((const char *) cred->key, ssid->psk,
 389                                        PMK_LEN)) {
 390                                 wpa_printf(MSG_ERROR, "WPS: Invalid Network "
 391                                            "Key");
 392                                 return -1;
 393                         }
 394                         ssid->psk_set = 1;
 395                         ssid->export_keys = 1;
 396                 } else if (cred->key_len >= 8 && cred->key_len < 2 * PMK_LEN) {
 397                         os_free(ssid->passphrase);
 398                         ssid->passphrase = os_malloc(cred->key_len + 1);
 399                         if (ssid->passphrase == NULL)
 400                                 return -1;
 401                         os_memcpy(ssid->passphrase, cred->key, cred->key_len);
 402                         ssid->passphrase[cred->key_len] = '\0';
 403                         wpa_config_update_psk(ssid);
 404                         ssid->export_keys = 1;
 405                 } else {
 406                         wpa_printf(MSG_ERROR, "WPS: Invalid Network Key "
 407                                    "length %lu",
 408                                    (unsigned long) cred->key_len);
 409                         return -1;
 410                 }
 411         }
 412
 413         wpas_wps_security_workaround(wpa_s, ssid, cred);
 414
 415         if (cred->ap_channel)
 416                 wpa_s->wps_ap_channel = cred->ap_channel;
 417
 418 #ifndef CONFIG_NO_CONFIG_WRITE
 419         if (wpa_s->conf->update_config &&
 420             wpa_config_write(wpa_s->confname, wpa_s->conf)) {
 421                 wpa_printf(MSG_DEBUG, "WPS: Failed to update configuration");
 422                 return -1;
 423         }
 424 #endif /* CONFIG_NO_CONFIG_WRITE */
 425
 426         /*
 427          * Optimize the post-WPS scan based on the channel used during
 428          * the provisioning in case EAP-Failure is not received.
 429          */
 430         wpa_s->after_wps = 5;
 431         wpa_s->wps_freq = wpa_s->assoc_freq;
 432
 433         return 0;
 434 }
 435
 436
 437 #ifdef CONFIG_P2P
 438 static void wpas_wps_pbc_overlap_cb(void *eloop_ctx, void *timeout_ctx)
 439 {
 440         struct wpa_supplicant *wpa_s = eloop_ctx;
 441         wpas_p2p_notif_pbc_overlap(wpa_s);
 442 }
 443 #endif /* CONFIG_P2P */
 444
 445
 446 static void wpa_supplicant_wps_event_m2d(struct wpa_supplicant *wpa_s,
 447                                          struct wps_event_m2d *m2d)
 448 {
 449         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_M2D
 450                 "dev_password_id=%d config_error=%d",
 451                 m2d->dev_password_id, m2d->config_error);
 452         wpas_notify_wps_event_m2d(wpa_s, m2d);
 453 #ifdef CONFIG_P2P
 454         if (wpa_s->parent && wpa_s->parent != wpa_s) {
 455                 wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_M2D
 456                         "dev_password_id=%d config_error=%d",
 457                         m2d->dev_password_id, m2d->config_error);
 458         }
 459         if (m2d->config_error == WPS_CFG_MULTIPLE_PBC_DETECTED) {
 460                 /*
 461                  * Notify P2P from eloop timeout to avoid issues with the
 462                  * interface getting removed while processing a message.
 463                  */
 464                 eloop_register_timeout(0, 0, wpas_wps_pbc_overlap_cb, wpa_s,
 465                                        NULL);
 466         }
 467 #endif /* CONFIG_P2P */
 468 }
 469
 470
 471 static const char * wps_event_fail_reason[NUM_WPS_EI_VALUES] = {
 472         "No Error", /* WPS_EI_NO_ERROR */
 473         "TKIP Only Prohibited", /* WPS_EI_SECURITY_TKIP_ONLY_PROHIBITED */
 474         "WEP Prohibited" /* WPS_EI_SECURITY_WEP_PROHIBITED */
 475 };
 476
 477 static void wpa_supplicant_wps_event_fail(struct wpa_supplicant *wpa_s,
 478                                           struct wps_event_fail *fail)
 479 {
 480         if (fail->error_indication > 0 &&
 481             fail->error_indication < NUM_WPS_EI_VALUES) {
 482                 wpa_msg(wpa_s, MSG_INFO,
 483                         WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)",
 484                         fail->msg, fail->config_error, fail->error_indication,
 485                         wps_event_fail_reason[fail->error_indication]);
 486                 if (wpa_s->parent && wpa_s->parent != wpa_s)
 487                         wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_FAIL
 488                                 "msg=%d config_error=%d reason=%d (%s)",
 489                                 fail->msg, fail->config_error,
 490                                 fail->error_indication,
 491                                 wps_event_fail_reason[fail->error_indication]);
 492         } else {
 493                 wpa_msg(wpa_s, MSG_INFO,
 494                         WPS_EVENT_FAIL "msg=%d config_error=%d",
 495                         fail->msg, fail->config_error);
 496                 if (wpa_s->parent && wpa_s->parent != wpa_s)
 497                         wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_FAIL
 498                                 "msg=%d config_error=%d",
 499                                 fail->msg, fail->config_error);
 500         }
 501         wpas_clear_wps(wpa_s);
 502         wpas_notify_wps_event_fail(wpa_s, fail);
 503 #ifdef CONFIG_P2P
 504         wpas_p2p_wps_failed(wpa_s, fail);
 505 #endif /* CONFIG_P2P */
 506 }
 507
 508
 509 static void wpas_wps_reenable_networks_cb(void *eloop_ctx, void *timeout_ctx);
 510
 511 static void wpas_wps_reenable_networks(struct wpa_supplicant *wpa_s)
 512 {
 513         struct wpa_ssid *ssid;
 514
 515         eloop_cancel_timeout(wpas_wps_reenable_networks_cb, wpa_s, NULL);
 516
 517         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 518                 if (ssid->disabled_for_connect && ssid->disabled) {
 519                         ssid->disabled_for_connect = 0;
 520                         ssid->disabled = 0;
 521                         wpas_notify_network_enabled_changed(wpa_s, ssid);
 522                 }
 523         }
 524 }
 525
 526
 527 static void wpas_wps_reenable_networks_cb(void *eloop_ctx, void *timeout_ctx)
 528 {
 529         struct wpa_supplicant *wpa_s = eloop_ctx;
 530         /* Enable the networks disabled during wpas_wps_reassoc */
 531         wpas_wps_reenable_networks(wpa_s);
 532 }
 533
 534
 535 static void wpa_supplicant_wps_event_success(struct wpa_supplicant *wpa_s)
 536 {
 537         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_SUCCESS);
 538         wpa_s->wps_success = 1;
 539         wpas_notify_wps_event_success(wpa_s);
 540
 541         /*
 542          * Enable the networks disabled during wpas_wps_reassoc after 10
 543          * seconds. The 10 seconds timer is to allow the data connection to be
 544          * formed before allowing other networks to be selected.
 545          */
 546         eloop_register_timeout(10, 0, wpas_wps_reenable_networks_cb, wpa_s,
 547                                NULL);
 548
 549 #ifdef CONFIG_P2P
 550         wpas_p2p_wps_success(wpa_s, wpa_s->bssid, 0);
 551 #endif /* CONFIG_P2P */
 552 }
 553
 554
 555 static void wpa_supplicant_wps_event_er_ap_add(struct wpa_supplicant *wpa_s,
 556                                                struct wps_event_er_ap *ap)
 557 {
 558         char uuid_str[100];
 559         char dev_type[WPS_DEV_TYPE_BUFSIZE];
 560
 561         uuid_bin2str(ap->uuid, uuid_str, sizeof(uuid_str));
 562         if (ap->pri_dev_type)
 563                 wps_dev_type_bin2str(ap->pri_dev_type, dev_type,
 564                                      sizeof(dev_type));
 565         else
 566                 dev_type[0] = '\0';
 567
 568         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_ADD "%s " MACSTR
 569                 " pri_dev_type=%s wps_state=%d |%s|%s|%s|%s|%s|%s|",
 570                 uuid_str, MAC2STR(ap->mac_addr), dev_type, ap->wps_state,
 571                 ap->friendly_name ? ap->friendly_name : "",
 572                 ap->manufacturer ? ap->manufacturer : "",
 573                 ap->model_description ? ap->model_description : "",
 574                 ap->model_name ? ap->model_name : "",
 575                 ap->manufacturer_url ? ap->manufacturer_url : "",
 576                 ap->model_url ? ap->model_url : "");
 577 }
 578
 579
 580 static void wpa_supplicant_wps_event_er_ap_remove(struct wpa_supplicant *wpa_s,
 581                                                   struct wps_event_er_ap *ap)
 582 {
 583         char uuid_str[100];
 584         uuid_bin2str(ap->uuid, uuid_str, sizeof(uuid_str));
 585         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_REMOVE "%s", uuid_str);
 586 }
 587
 588
 589 static void wpa_supplicant_wps_event_er_enrollee_add(
 590         struct wpa_supplicant *wpa_s, struct wps_event_er_enrollee *enrollee)
 591 {
 592         char uuid_str[100];
 593         char dev_type[WPS_DEV_TYPE_BUFSIZE];
 594
 595         uuid_bin2str(enrollee->uuid, uuid_str, sizeof(uuid_str));
 596         if (enrollee->pri_dev_type)
 597                 wps_dev_type_bin2str(enrollee->pri_dev_type, dev_type,
 598                                      sizeof(dev_type));
 599         else
 600                 dev_type[0] = '\0';
 601
 602         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_ENROLLEE_ADD "%s " MACSTR
 603                 " M1=%d config_methods=0x%x dev_passwd_id=%d pri_dev_type=%s "
 604                 "|%s|%s|%s|%s|%s|",
 605                 uuid_str, MAC2STR(enrollee->mac_addr), enrollee->m1_received,
 606                 enrollee->config_methods, enrollee->dev_passwd_id, dev_type,
 607                 enrollee->dev_name ? enrollee->dev_name : "",
 608                 enrollee->manufacturer ? enrollee->manufacturer : "",
 609                 enrollee->model_name ? enrollee->model_name : "",
 610                 enrollee->model_number ? enrollee->model_number : "",
 611                 enrollee->serial_number ? enrollee->serial_number : "");
 612 }
 613
 614
 615 static void wpa_supplicant_wps_event_er_enrollee_remove(
 616         struct wpa_supplicant *wpa_s, struct wps_event_er_enrollee *enrollee)
 617 {
 618         char uuid_str[100];
 619         uuid_bin2str(enrollee->uuid, uuid_str, sizeof(uuid_str));
 620         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_ENROLLEE_REMOVE "%s " MACSTR,
 621                 uuid_str, MAC2STR(enrollee->mac_addr));
 622 }
 623
 624
 625 static void wpa_supplicant_wps_event_er_ap_settings(
 626         struct wpa_supplicant *wpa_s,
 627         struct wps_event_er_ap_settings *ap_settings)
 628 {
 629         char uuid_str[100];
 630         char key_str[65];
 631         const struct wps_credential *cred = ap_settings->cred;
 632
 633         key_str[0] = '\0';
 634         if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 635                 if (cred->key_len >= 8 && cred->key_len <= 64) {
 636                         os_memcpy(key_str, cred->key, cred->key_len);
 637                         key_str[cred->key_len] = '\0';
 638                 }
 639         }
 640
 641         uuid_bin2str(ap_settings->uuid, uuid_str, sizeof(uuid_str));
 642         /* Use wpa_msg_ctrl to avoid showing the key in debug log */
 643         wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_SETTINGS
 644                      "uuid=%s ssid=%s auth_type=0x%04x encr_type=0x%04x "
 645                      "key=%s",
 646                      uuid_str, wpa_ssid_txt(cred->ssid, cred->ssid_len),
 647                      cred->auth_type, cred->encr_type, key_str);
 648 }
 649
 650
 651 static void wpa_supplicant_wps_event_er_set_sel_reg(
 652         struct wpa_supplicant *wpa_s,
 653         struct wps_event_er_set_selected_registrar *ev)
 654 {
 655         char uuid_str[100];
 656
 657         uuid_bin2str(ev->uuid, uuid_str, sizeof(uuid_str));
 658         switch (ev->state) {
 659         case WPS_ER_SET_SEL_REG_START:
 660                 wpa_msg(wpa_s, MSG_DEBUG, WPS_EVENT_ER_SET_SEL_REG
 661                         "uuid=%s state=START sel_reg=%d dev_passwd_id=%u "
 662                         "sel_reg_config_methods=0x%x",
 663                         uuid_str, ev->sel_reg, ev->dev_passwd_id,
 664                         ev->sel_reg_config_methods);
 665                 break;
 666         case WPS_ER_SET_SEL_REG_DONE:
 667                 wpa_msg(wpa_s, MSG_DEBUG, WPS_EVENT_ER_SET_SEL_REG
 668                         "uuid=%s state=DONE", uuid_str);
 669                 break;
 670         case WPS_ER_SET_SEL_REG_FAILED:
 671                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_SET_SEL_REG
 672                         "uuid=%s state=FAILED", uuid_str);
 673                 break;
 674         }
 675 }
 676
 677
 678 static void wpa_supplicant_wps_event(void *ctx, enum wps_event event,
 679                                      union wps_event_data *data)
 680 {
 681         struct wpa_supplicant *wpa_s = ctx;
 682         switch (event) {
 683         case WPS_EV_M2D:
 684                 wpa_supplicant_wps_event_m2d(wpa_s, &data->m2d);
 685                 break;
 686         case WPS_EV_FAIL:
 687                 wpa_supplicant_wps_event_fail(wpa_s, &data->fail);
 688                 break;
 689         case WPS_EV_SUCCESS:
 690                 wpa_supplicant_wps_event_success(wpa_s);
 691                 break;
 692         case WPS_EV_PWD_AUTH_FAIL:
 693 #ifdef CONFIG_AP
 694                 if (wpa_s->ap_iface && data->pwd_auth_fail.enrollee)
 695                         wpa_supplicant_ap_pwd_auth_fail(wpa_s);
 696 #endif /* CONFIG_AP */
 697                 break;
 698         case WPS_EV_PBC_OVERLAP:
 699                 break;
 700         case WPS_EV_PBC_TIMEOUT:
 701                 break;
 702         case WPS_EV_ER_AP_ADD:
 703                 wpa_supplicant_wps_event_er_ap_add(wpa_s, &data->ap);
 704                 break;
 705         case WPS_EV_ER_AP_REMOVE:
 706                 wpa_supplicant_wps_event_er_ap_remove(wpa_s, &data->ap);
 707                 break;
 708         case WPS_EV_ER_ENROLLEE_ADD:
 709                 wpa_supplicant_wps_event_er_enrollee_add(wpa_s,
 710                                                          &data->enrollee);
 711                 break;
 712         case WPS_EV_ER_ENROLLEE_REMOVE:
 713                 wpa_supplicant_wps_event_er_enrollee_remove(wpa_s,
 714                                                             &data->enrollee);
 715                 break;
 716         case WPS_EV_ER_AP_SETTINGS:
 717                 wpa_supplicant_wps_event_er_ap_settings(wpa_s,
 718                                                         &data->ap_settings);
 719                 break;
 720         case WPS_EV_ER_SET_SELECTED_REGISTRAR:
 721                 wpa_supplicant_wps_event_er_set_sel_reg(wpa_s,
 722                                                         &data->set_sel_reg);
 723                 break;
 724         case WPS_EV_AP_PIN_SUCCESS:
 725                 break;
 726         }
 727 }
 728
 729
 730 enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid)
 731 {
 732         if (eap_is_wps_pbc_enrollee(&ssid->eap) ||
 733             eap_is_wps_pin_enrollee(&ssid->eap))
 734                 return WPS_REQ_ENROLLEE;
 735         else
 736                 return WPS_REQ_REGISTRAR;
 737 }
 738
 739
 740 static void wpas_clear_wps(struct wpa_supplicant *wpa_s)
 741 {
 742         int id;
 743         struct wpa_ssid *ssid, *remove_ssid = NULL, *prev_current;
 744
 745         prev_current = wpa_s->current_ssid;
 746
 747         /* Enable the networks disabled during wpas_wps_reassoc */
 748         wpas_wps_reenable_networks(wpa_s);
 749
 750         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
 751
 752         /* Remove any existing WPS network from configuration */
 753         ssid = wpa_s->conf->ssid;
 754         while (ssid) {
 755                 if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 756                         if (ssid == wpa_s->current_ssid) {
 757                                 wpa_s->current_ssid = NULL;
 758                                 if (ssid != NULL)
 759                                         wpas_notify_network_changed(wpa_s);
 760                         }
 761                         id = ssid->id;
 762                         remove_ssid = ssid;
 763                 } else
 764                         id = -1;
 765                 ssid = ssid->next;
 766                 if (id >= 0) {
 767                         if (prev_current == remove_ssid) {
 768                                 wpa_sm_set_config(wpa_s->wpa, NULL);
 769                                 eapol_sm_notify_config(wpa_s->eapol, NULL,
 770                                                        NULL);
 771                         }
 772                         wpas_notify_network_removed(wpa_s, remove_ssid);
 773                         wpa_config_remove_network(wpa_s->conf, id);
 774                 }
 775         }
 776
 777         wpas_wps_clear_ap_info(wpa_s);
 778 }
 779
 780
 781 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx)
 782 {
 783         struct wpa_supplicant *wpa_s = eloop_ctx;
 784         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_TIMEOUT "Requested operation timed "
 785                 "out");
 786         wpas_clear_wps(wpa_s);
 787 }
 788
 789
 790 static struct wpa_ssid * wpas_wps_add_network(struct wpa_supplicant *wpa_s,
 791                                               int registrar, const u8 *bssid)
 792 {
 793         struct wpa_ssid *ssid;
 794
 795         ssid = wpa_config_add_network(wpa_s->conf);
 796         if (ssid == NULL)
 797                 return NULL;
 798         wpas_notify_network_added(wpa_s, ssid);
 799         wpa_config_set_network_defaults(ssid);
 800         ssid->temporary = 1;
 801         if (wpa_config_set(ssid, "key_mgmt", "WPS", 0) < 0 ||
 802             wpa_config_set(ssid, "eap", "WSC", 0) < 0 ||
 803             wpa_config_set(ssid, "identity", registrar ?
 804                            "\"" WSC_ID_REGISTRAR "\"" :
 805                            "\"" WSC_ID_ENROLLEE "\"", 0) < 0) {
 806                 wpas_notify_network_removed(wpa_s, ssid);
 807                 wpa_config_remove_network(wpa_s->conf, ssid->id);
 808                 return NULL;
 809         }
 810
 811         if (bssid) {
 812 #ifndef CONFIG_P2P
 813                 struct wpa_bss *bss;
 814                 int count = 0;
 815 #endif /* CONFIG_P2P */
 816
 817                 os_memcpy(ssid->bssid, bssid, ETH_ALEN);
 818                 ssid->bssid_set = 1;
 819
 820                 /*
 821                  * Note: With P2P, the SSID may change at the time the WPS
 822                  * provisioning is started, so better not filter the AP based
 823                  * on the current SSID in the scan results.
 824                  */
 825 #ifndef CONFIG_P2P
 826                 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
 827                         if (os_memcmp(bssid, bss->bssid, ETH_ALEN) != 0)
 828                                 continue;
 829
 830                         os_free(ssid->ssid);
 831                         ssid->ssid = os_malloc(bss->ssid_len);
 832                         if (ssid->ssid == NULL)
 833                                 break;
 834                         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
 835                         ssid->ssid_len = bss->ssid_len;
 836                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Picked SSID from "
 837                                           "scan results",
 838                                           ssid->ssid, ssid->ssid_len);
 839                         count++;
 840                 }
 841
 842                 if (count > 1) {
 843                         wpa_printf(MSG_DEBUG, "WPS: More than one SSID found "
 844                                    "for the AP; use wildcard");
 845                         os_free(ssid->ssid);
 846                         ssid->ssid = NULL;
 847                         ssid->ssid_len = 0;
 848                 }
 849 #endif /* CONFIG_P2P */
 850         }
 851
 852         return ssid;
 853 }
 854
 855
 856 static void wpas_wps_reassoc(struct wpa_supplicant *wpa_s,
 857                              struct wpa_ssid *selected, const u8 *bssid)
 858 {
 859         struct wpa_ssid *ssid;
 860         struct wpa_bss *bss;
 861
 862         wpa_s->known_wps_freq = 0;
 863         if (bssid) {
 864                 bss = wpa_bss_get_bssid(wpa_s, bssid);
 865                 if (bss && bss->freq > 0) {
 866                         wpa_s->known_wps_freq = 1;
 867                         wpa_s->wps_freq = bss->freq;
 868                 }
 869         }
 870
 871         if (wpa_s->current_ssid)
 872                 wpa_supplicant_deauthenticate(
 873                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 874
 875         /* Mark all other networks disabled and trigger reassociation */
 876         ssid = wpa_s->conf->ssid;
 877         while (ssid) {
 878                 int was_disabled = ssid->disabled;
 879                 ssid->disabled_for_connect = 0;
 880                 /*
 881                  * In case the network object corresponds to a persistent group
 882                  * then do not send out network disabled signal. In addition,
 883                  * do not change disabled status of persistent network objects
 884                  * from 2 to 1 should we connect to another network.
 885                  */
 886                 if (was_disabled != 2) {
 887                         ssid->disabled = ssid != selected;
 888                         if (was_disabled != ssid->disabled) {
 889                                 if (ssid->disabled)
 890                                         ssid->disabled_for_connect = 1;
 891                                 wpas_notify_network_enabled_changed(wpa_s,
 892                                                                     ssid);
 893                         }
 894                 }
 895                 ssid = ssid->next;
 896         }
 897         wpa_s->disconnected = 0;
 898         wpa_s->reassociate = 1;
 899         wpa_s->scan_runs = 0;
 900         wpa_s->normal_scans = 0;
 901         wpa_s->wps_success = 0;
 902         wpa_s->blacklist_cleared = 0;
 903         wpa_supplicant_req_scan(wpa_s, 0, 0);
 904 }
 905
 906
 907 int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid,
 908                        int p2p_group)
 909 {
 910         struct wpa_ssid *ssid;
 911         wpas_clear_wps(wpa_s);
 912         ssid = wpas_wps_add_network(wpa_s, 0, bssid);
 913         if (ssid == NULL)
 914                 return -1;
 915         ssid->temporary = 1;
 916         ssid->p2p_group = p2p_group;
 917 #ifdef CONFIG_P2P
 918         if (p2p_group && wpa_s->go_params && wpa_s->go_params->ssid_len) {
 919                 ssid->ssid = os_zalloc(wpa_s->go_params->ssid_len + 1);
 920                 if (ssid->ssid) {
 921                         ssid->ssid_len = wpa_s->go_params->ssid_len;
 922                         os_memcpy(ssid->ssid, wpa_s->go_params->ssid,
 923                                   ssid->ssid_len);
 924                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Use specific AP "
 925                                           "SSID", ssid->ssid, ssid->ssid_len);
 926                 }
 927         }
 928 #endif /* CONFIG_P2P */
 929         wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0);
 930         if (wpa_s->wps_fragment_size)
 931                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
 932         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
 933                                wpa_s, NULL);
 934         wpas_wps_reassoc(wpa_s, ssid, bssid);
 935         return 0;
 936 }
 937
 938
 939 int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid,
 940                        const char *pin, int p2p_group, u16 dev_pw_id)
 941 {
 942         struct wpa_ssid *ssid;
 943         char val[128];
 944         unsigned int rpin = 0;
 945
 946         wpas_clear_wps(wpa_s);
 947         ssid = wpas_wps_add_network(wpa_s, 0, bssid);
 948         if (ssid == NULL)
 949                 return -1;
 950         ssid->temporary = 1;
 951         ssid->p2p_group = p2p_group;
 952 #ifdef CONFIG_P2P
 953         if (p2p_group && wpa_s->go_params && wpa_s->go_params->ssid_len) {
 954                 ssid->ssid = os_zalloc(wpa_s->go_params->ssid_len + 1);
 955                 if (ssid->ssid) {
 956                         ssid->ssid_len = wpa_s->go_params->ssid_len;
 957                         os_memcpy(ssid->ssid, wpa_s->go_params->ssid,
 958                                   ssid->ssid_len);
 959                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Use specific AP "
 960                                           "SSID", ssid->ssid, ssid->ssid_len);
 961                 }
 962         }
 963 #endif /* CONFIG_P2P */
 964         if (pin)
 965                 os_snprintf(val, sizeof(val), "\"pin=%s dev_pw_id=%u\"",
 966                             pin, dev_pw_id);
 967         else {
 968                 rpin = wps_generate_pin();
 969                 os_snprintf(val, sizeof(val), "\"pin=%08d dev_pw_id=%u\"",
 970                             rpin, dev_pw_id);
 971         }
 972         wpa_config_set(ssid, "phase1", val, 0);
 973         if (wpa_s->wps_fragment_size)
 974                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
 975         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
 976                                wpa_s, NULL);
 977         wpa_s->wps_ap_iter = 1;
 978         wpas_wps_reassoc(wpa_s, ssid, bssid);
 979         return rpin;
 980 }
 981
 982
 983 /* Cancel the wps pbc/pin requests */
 984 int wpas_wps_cancel(struct wpa_supplicant *wpa_s)
 985 {
 986 #ifdef CONFIG_AP
 987         if (wpa_s->ap_iface) {
 988                 wpa_printf(MSG_DEBUG, "WPS: Cancelling in AP mode");
 989                 return wpa_supplicant_ap_wps_cancel(wpa_s);
 990         }
 991 #endif /* CONFIG_AP */
 992
 993         if (wpa_s->wpa_state == WPA_SCANNING ||
 994             wpa_s->wpa_state == WPA_DISCONNECTED) {
 995                 wpa_printf(MSG_DEBUG, "WPS: Cancel operation - cancel scan");
 996                 wpa_supplicant_cancel_scan(wpa_s);
 997                 wpas_clear_wps(wpa_s);
 998         } else if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
 999                 wpa_printf(MSG_DEBUG, "WPS: Cancel operation - "
1000                            "deauthenticate");
1001                 wpa_supplicant_deauthenticate(wpa_s,
1002                                               WLAN_REASON_DEAUTH_LEAVING);
1003                 wpas_clear_wps(wpa_s);
1004         } else {
1005                 wpas_wps_reenable_networks(wpa_s);
1006                 wpas_wps_clear_ap_info(wpa_s);
1007         }
1008
1009         return 0;
1010 }
1011
1012
1013 int wpas_wps_start_reg(struct wpa_supplicant *wpa_s, const u8 *bssid,
1014                        const char *pin, struct wps_new_ap_settings *settings)
1015 {
1016         struct wpa_ssid *ssid;
1017         char val[200];
1018         char *pos, *end;
1019         int res;
1020
1021         if (!pin)
1022                 return -1;
1023         wpas_clear_wps(wpa_s);
1024         ssid = wpas_wps_add_network(wpa_s, 1, bssid);
1025         if (ssid == NULL)
1026                 return -1;
1027         ssid->temporary = 1;
1028         pos = val;
1029         end = pos + sizeof(val);
1030         res = os_snprintf(pos, end - pos, "\"pin=%s", pin);
1031         if (res < 0 || res >= end - pos)
1032                 return -1;
1033         pos += res;
1034         if (settings) {
1035                 res = os_snprintf(pos, end - pos, " new_ssid=%s new_auth=%s "
1036                                   "new_encr=%s new_key=%s",
1037                                   settings->ssid_hex, settings->auth,
1038                                   settings->encr, settings->key_hex);
1039                 if (res < 0 || res >= end - pos)
1040                         return -1;
1041                 pos += res;
1042         }
1043         res = os_snprintf(pos, end - pos, "\"");
1044         if (res < 0 || res >= end - pos)
1045                 return -1;
1046         wpa_config_set(ssid, "phase1", val, 0);
1047         if (wpa_s->wps_fragment_size)
1048                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
1049         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
1050                                wpa_s, NULL);
1051         wpas_wps_reassoc(wpa_s, ssid, bssid);
1052         return 0;
1053 }
1054
1055
1056 static int wpas_wps_new_psk_cb(void *ctx, const u8 *mac_addr, const u8 *psk,
1057                                size_t psk_len)
1058 {
1059         wpa_printf(MSG_DEBUG, "WPS: Received new WPA/WPA2-PSK from WPS for "
1060                    "STA " MACSTR, MAC2STR(mac_addr));
1061         wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
1062
1063         /* TODO */
1064
1065         return 0;
1066 }
1067
1068
1069 static void wpas_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
1070                                    const struct wps_device_data *dev)
1071 {
1072         char uuid[40], txt[400];
1073         int len;
1074         char devtype[WPS_DEV_TYPE_BUFSIZE];
1075         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
1076                 return;
1077         wpa_printf(MSG_DEBUG, "WPS: PIN needed for UUID-E %s", uuid);
1078         len = os_snprintf(txt, sizeof(txt), "WPS-EVENT-PIN-NEEDED %s " MACSTR
1079                           " [%s|%s|%s|%s|%s|%s]",
1080                           uuid, MAC2STR(dev->mac_addr), dev->device_name,
1081                           dev->manufacturer, dev->model_name,
1082                           dev->model_number, dev->serial_number,
1083                           wps_dev_type_bin2str(dev->pri_dev_type, devtype,
1084                                                sizeof(devtype)));
1085         if (len > 0 && len < (int) sizeof(txt))
1086                 wpa_printf(MSG_INFO, "%s", txt);
1087 }
1088
1089
1090 static void wpas_wps_set_sel_reg_cb(void *ctx, int sel_reg, u16 dev_passwd_id,
1091                                     u16 sel_reg_config_methods)
1092 {
1093 #ifdef CONFIG_WPS_ER
1094         struct wpa_supplicant *wpa_s = ctx;
1095
1096         if (wpa_s->wps_er == NULL)
1097                 return;
1098         wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar - sel_reg=%d "
1099                    "dev_password_id=%u sel_reg_config_methods=0x%x",
1100                    sel_reg, dev_passwd_id, sel_reg_config_methods);
1101         wps_er_set_sel_reg(wpa_s->wps_er, sel_reg, dev_passwd_id,
1102                            sel_reg_config_methods);
1103 #endif /* CONFIG_WPS_ER */
1104 }
1105
1106
1107 static u16 wps_fix_config_methods(u16 config_methods)
1108 {
1109 #ifdef CONFIG_WPS2
1110         if ((config_methods &
1111              (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY |
1112               WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) {
1113                 wpa_printf(MSG_INFO, "WPS: Converting display to "
1114                            "virtual_display for WPS 2.0 compliance");
1115                 config_methods |= WPS_CONFIG_VIRT_DISPLAY;
1116         }
1117         if ((config_methods &
1118              (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON |
1119               WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) {
1120                 wpa_printf(MSG_INFO, "WPS: Converting push_button to "
1121                            "virtual_push_button for WPS 2.0 compliance");
1122                 config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
1123         }
1124 #endif /* CONFIG_WPS2 */
1125
1126         return config_methods;
1127 }
1128
1129
1130 static void wpas_wps_set_uuid(struct wpa_supplicant *wpa_s,
1131                               struct wps_context *wps)
1132 {
1133         wpa_printf(MSG_DEBUG, "WPS: Set UUID for interface %s", wpa_s->ifname);
1134         if (is_nil_uuid(wpa_s->conf->uuid)) {
1135                 struct wpa_supplicant *first;
1136                 first = wpa_s->global->ifaces;
1137                 while (first && first->next)
1138                         first = first->next;
1139                 if (first && first != wpa_s) {
1140                         if (wps != wpa_s->global->ifaces->wps)
1141                                 os_memcpy(wps->uuid,
1142                                           wpa_s->global->ifaces->wps->uuid,
1143                                           WPS_UUID_LEN);
1144                         wpa_hexdump(MSG_DEBUG, "WPS: UUID from the first "
1145                                     "interface", wps->uuid, WPS_UUID_LEN);
1146                 } else {
1147                         uuid_gen_mac_addr(wpa_s->own_addr, wps->uuid);
1148                         wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC "
1149                                     "address", wps->uuid, WPS_UUID_LEN);
1150                 }
1151         } else {
1152                 os_memcpy(wps->uuid, wpa_s->conf->uuid, WPS_UUID_LEN);
1153                 wpa_hexdump(MSG_DEBUG, "WPS: UUID based on configuration",
1154                             wps->uuid, WPS_UUID_LEN);
1155         }
1156 }
1157
1158
1159 static void wpas_wps_set_vendor_ext_m1(struct wpa_supplicant *wpa_s,
1160                                        struct wps_context *wps)
1161 {
1162         wpabuf_free(wps->dev.vendor_ext_m1);
1163         wps->dev.vendor_ext_m1 = NULL;
1164
1165         if (wpa_s->conf->wps_vendor_ext_m1) {
1166                 wps->dev.vendor_ext_m1 =
1167                         wpabuf_dup(wpa_s->conf->wps_vendor_ext_m1);
1168                 if (!wps->dev.vendor_ext_m1) {
1169                         wpa_printf(MSG_ERROR, "WPS: Cannot "
1170                                    "allocate memory for vendor_ext_m1");
1171                 }
1172         }
1173 }
1174
1175
1176 int wpas_wps_init(struct wpa_supplicant *wpa_s)
1177 {
1178         struct wps_context *wps;
1179         struct wps_registrar_config rcfg;
1180         struct hostapd_hw_modes *modes;
1181         u16 m;
1182
1183         wps = os_zalloc(sizeof(*wps));
1184         if (wps == NULL)
1185                 return -1;
1186
1187         wps->cred_cb = wpa_supplicant_wps_cred;
1188         wps->event_cb = wpa_supplicant_wps_event;
1189         wps->cb_ctx = wpa_s;
1190
1191         wps->dev.device_name = wpa_s->conf->device_name;
1192         wps->dev.manufacturer = wpa_s->conf->manufacturer;
1193         wps->dev.model_name = wpa_s->conf->model_name;
1194         wps->dev.model_number = wpa_s->conf->model_number;
1195         wps->dev.serial_number = wpa_s->conf->serial_number;
1196         wps->config_methods =
1197                 wps_config_methods_str2bin(wpa_s->conf->config_methods);
1198         if ((wps->config_methods & (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) ==
1199             (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) {
1200                 wpa_printf(MSG_ERROR, "WPS: Both Label and Display config "
1201                            "methods are not allowed at the same time");
1202                 os_free(wps);
1203                 return -1;
1204         }
1205         wps->config_methods = wps_fix_config_methods(wps->config_methods);
1206         wps->dev.config_methods = wps->config_methods;
1207         os_memcpy(wps->dev.pri_dev_type, wpa_s->conf->device_type,
1208                   WPS_DEV_TYPE_LEN);
1209
1210         wps->dev.num_sec_dev_types = wpa_s->conf->num_sec_device_types;
1211         os_memcpy(wps->dev.sec_dev_type, wpa_s->conf->sec_device_type,
1212                   WPS_DEV_TYPE_LEN * wps->dev.num_sec_dev_types);
1213
1214         wpas_wps_set_vendor_ext_m1(wpa_s, wps);
1215
1216         wps->dev.os_version = WPA_GET_BE32(wpa_s->conf->os_version);
1217         modes = wpa_s->hw.modes;
1218         if (modes) {
1219                 for (m = 0; m < wpa_s->hw.num_modes; m++) {
1220                         if (modes[m].mode == HOSTAPD_MODE_IEEE80211B ||
1221                             modes[m].mode == HOSTAPD_MODE_IEEE80211G)
1222                                 wps->dev.rf_bands |= WPS_RF_24GHZ;
1223                         else if (modes[m].mode == HOSTAPD_MODE_IEEE80211A)
1224                                 wps->dev.rf_bands |= WPS_RF_50GHZ;
1225                 }
1226         }
1227         if (wps->dev.rf_bands == 0) {
1228                 /*
1229                  * Default to claiming support for both bands if the driver
1230                  * does not provide support for fetching supported bands.
1231                  */
1232                 wps->dev.rf_bands = WPS_RF_24GHZ | WPS_RF_50GHZ;
1233         }
1234         os_memcpy(wps->dev.mac_addr, wpa_s->own_addr, ETH_ALEN);
1235         wpas_wps_set_uuid(wpa_s, wps);
1236
1237         wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
1238         wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
1239
1240         os_memset(&rcfg, 0, sizeof(rcfg));
1241         rcfg.new_psk_cb = wpas_wps_new_psk_cb;
1242         rcfg.pin_needed_cb = wpas_wps_pin_needed_cb;
1243         rcfg.set_sel_reg_cb = wpas_wps_set_sel_reg_cb;
1244         rcfg.cb_ctx = wpa_s;
1245
1246         wps->registrar = wps_registrar_init(wps, &rcfg);
1247         if (wps->registrar == NULL) {
1248                 wpa_printf(MSG_DEBUG, "Failed to initialize WPS Registrar");
1249                 os_free(wps);
1250                 return -1;
1251         }
1252
1253         wpa_s->wps = wps;
1254
1255         return 0;
1256 }
1257
1258
1259 void wpas_wps_deinit(struct wpa_supplicant *wpa_s)
1260 {
1261         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
1262         eloop_cancel_timeout(wpas_wps_reenable_networks_cb, wpa_s, NULL);
1263         wpas_wps_clear_ap_info(wpa_s);
1264
1265         if (wpa_s->wps == NULL)
1266                 return;
1267
1268 #ifdef CONFIG_WPS_ER
1269         wps_er_deinit(wpa_s->wps_er, NULL, NULL);
1270         wpa_s->wps_er = NULL;
1271 #endif /* CONFIG_WPS_ER */
1272
1273         wps_registrar_deinit(wpa_s->wps->registrar);
1274         wpabuf_free(wpa_s->wps->dh_pubkey);
1275         wpabuf_free(wpa_s->wps->dh_privkey);
1276         wpabuf_free(wpa_s->wps->dev.vendor_ext_m1);
1277         os_free(wpa_s->wps->network_key);
1278         os_free(wpa_s->wps);
1279         wpa_s->wps = NULL;
1280 }
1281
1282
1283 int wpas_wps_ssid_bss_match(struct wpa_supplicant *wpa_s,
1284                             struct wpa_ssid *ssid, struct wpa_bss *bss)
1285 {
1286         struct wpabuf *wps_ie;
1287
1288         if (!(ssid->key_mgmt & WPA_KEY_MGMT_WPS))
1289                 return -1;
1290
1291         wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1292         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
1293                 if (!wps_ie) {
1294                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
1295                         return 0;
1296                 }
1297
1298                 if (!wps_is_selected_pbc_registrar(wps_ie)) {
1299                         wpa_printf(MSG_DEBUG, "   skip - WPS AP "
1300                                    "without active PBC Registrar");
1301                         wpabuf_free(wps_ie);
1302                         return 0;
1303                 }
1304
1305                 /* TODO: overlap detection */
1306                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
1307                            "(Active PBC)");
1308                 wpabuf_free(wps_ie);
1309                 return 1;
1310         }
1311
1312         if (eap_is_wps_pin_enrollee(&ssid->eap)) {
1313                 if (!wps_ie) {
1314                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
1315                         return 0;
1316                 }
1317
1318                 /*
1319                  * Start with WPS APs that advertise our address as an
1320                  * authorized MAC (v2.0) or active PIN Registrar (v1.0) and
1321                  * allow any WPS AP after couple of scans since some APs do not
1322                  * set Selected Registrar attribute properly when using
1323                  * external Registrar.
1324                  */
1325                 if (!wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1)) {
1326                         if (wpa_s->scan_runs < WPS_PIN_SCAN_IGNORE_SEL_REG) {
1327                                 wpa_printf(MSG_DEBUG, "   skip - WPS AP "
1328                                            "without active PIN Registrar");
1329                                 wpabuf_free(wps_ie);
1330                                 return 0;
1331                         }
1332                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
1333                 } else {
1334                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
1335                                    "(Authorized MAC or Active PIN)");
1336                 }
1337                 wpabuf_free(wps_ie);
1338                 return 1;
1339         }
1340
1341         if (wps_ie) {
1342                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
1343                 wpabuf_free(wps_ie);
1344                 return 1;
1345         }
1346
1347         return -1;
1348 }
1349
1350
1351 int wpas_wps_ssid_wildcard_ok(struct wpa_supplicant *wpa_s,
1352                               struct wpa_ssid *ssid,
1353                               struct wpa_bss *bss)
1354 {
1355         struct wpabuf *wps_ie = NULL;
1356         int ret = 0;
1357
1358         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
1359                 wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1360                 if (wps_ie && wps_is_selected_pbc_registrar(wps_ie)) {
1361                         /* allow wildcard SSID for WPS PBC */
1362                         ret = 1;
1363                 }
1364         } else if (eap_is_wps_pin_enrollee(&ssid->eap)) {
1365                 wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1366                 if (wps_ie &&
1367                     (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1) ||
1368                      wpa_s->scan_runs >= WPS_PIN_SCAN_IGNORE_SEL_REG)) {
1369                         /* allow wildcard SSID for WPS PIN */
1370                         ret = 1;
1371                 }
1372         }
1373
1374         if (!ret && ssid->bssid_set &&
1375             os_memcmp(ssid->bssid, bss->bssid, ETH_ALEN) == 0) {
1376                 /* allow wildcard SSID due to hardcoded BSSID match */
1377                 ret = 1;
1378         }
1379
1380 #ifdef CONFIG_WPS_STRICT
1381         if (wps_ie) {
1382                 if (wps_validate_beacon_probe_resp(wps_ie, bss->beacon_ie_len >
1383                                                    0, bss->bssid) < 0)
1384                         ret = 0;
1385                 if (bss->beacon_ie_len) {
1386                         struct wpabuf *bcn_wps;
1387                         bcn_wps = wpa_bss_get_vendor_ie_multi_beacon(
1388                                 bss, WPS_IE_VENDOR_TYPE);
1389                         if (bcn_wps == NULL) {
1390                                 wpa_printf(MSG_DEBUG, "WPS: Mandatory WPS IE "
1391                                            "missing from AP Beacon");
1392                                 ret = 0;
1393                         } else {
1394                                 if (wps_validate_beacon(wps_ie) < 0)
1395                                         ret = 0;
1396                                 wpabuf_free(bcn_wps);
1397                         }
1398                 }
1399         }
1400 #endif /* CONFIG_WPS_STRICT */
1401
1402         wpabuf_free(wps_ie);
1403
1404         return ret;
1405 }
1406
1407
1408 int wpas_wps_scan_pbc_overlap(struct wpa_supplicant *wpa_s,
1409                               struct wpa_bss *selected, struct wpa_ssid *ssid)
1410 {
1411         const u8 *sel_uuid, *uuid;
1412         struct wpabuf *wps_ie;
1413         int ret = 0;
1414         struct wpa_bss *bss;
1415
1416         if (!eap_is_wps_pbc_enrollee(&ssid->eap))
1417                 return 0;
1418
1419         wpa_printf(MSG_DEBUG, "WPS: Check whether PBC session overlap is "
1420                    "present in scan results; selected BSSID " MACSTR,
1421                    MAC2STR(selected->bssid));
1422
1423         /* Make sure that only one AP is in active PBC mode */
1424         wps_ie = wpa_bss_get_vendor_ie_multi(selected, WPS_IE_VENDOR_TYPE);
1425         if (wps_ie) {
1426                 sel_uuid = wps_get_uuid_e(wps_ie);
1427                 wpa_hexdump(MSG_DEBUG, "WPS: UUID of the selected BSS",
1428                             sel_uuid, UUID_LEN);
1429         } else {
1430                 wpa_printf(MSG_DEBUG, "WPS: Selected BSS does not include "
1431                            "WPS IE?!");
1432                 sel_uuid = NULL;
1433         }
1434
1435         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1436                 struct wpabuf *ie;
1437                 if (bss == selected)
1438                         continue;
1439                 ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1440                 if (!ie)
1441                         continue;
1442                 if (!wps_is_selected_pbc_registrar(ie)) {
1443                         wpabuf_free(ie);
1444                         continue;
1445                 }
1446                 wpa_printf(MSG_DEBUG, "WPS: Another BSS in active PBC mode: "
1447                            MACSTR, MAC2STR(bss->bssid));
1448                 uuid = wps_get_uuid_e(ie);
1449                 wpa_hexdump(MSG_DEBUG, "WPS: UUID of the other BSS",
1450                             uuid, UUID_LEN);
1451                 if (sel_uuid == NULL || uuid == NULL ||
1452                     os_memcmp(sel_uuid, uuid, UUID_LEN) != 0) {
1453                         ret = 1; /* PBC overlap */
1454                         wpa_msg(wpa_s, MSG_INFO, "WPS: PBC overlap detected: "
1455                                 MACSTR " and " MACSTR,
1456                                 MAC2STR(selected->bssid),
1457                                 MAC2STR(bss->bssid));
1458                         wpabuf_free(ie);
1459                         break;
1460                 }
1461
1462                 /* TODO: verify that this is reasonable dual-band situation */
1463
1464                 wpabuf_free(ie);
1465         }
1466
1467         wpabuf_free(wps_ie);
1468
1469         return ret;
1470 }
1471
1472
1473 void wpas_wps_notify_scan_results(struct wpa_supplicant *wpa_s)
1474 {
1475         struct wpa_bss *bss;
1476         unsigned int pbc = 0, auth = 0, pin = 0, wps = 0;
1477
1478         if (wpa_s->disconnected || wpa_s->wpa_state >= WPA_ASSOCIATED)
1479                 return;
1480
1481         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1482                 struct wpabuf *ie;
1483                 ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1484                 if (!ie)
1485                         continue;
1486                 if (wps_is_selected_pbc_registrar(ie))
1487                         pbc++;
1488                 else if (wps_is_addr_authorized(ie, wpa_s->own_addr, 0))
1489                         auth++;
1490                 else if (wps_is_selected_pin_registrar(ie))
1491                         pin++;
1492                 else
1493                         wps++;
1494                 wpabuf_free(ie);
1495         }
1496
1497         if (pbc)
1498                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PBC);
1499         else if (auth)
1500                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_AUTH);
1501         else if (pin)
1502                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PIN);
1503         else if (wps)
1504                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE);
1505 }
1506
1507
1508 int wpas_wps_searching(struct wpa_supplicant *wpa_s)
1509 {
1510         struct wpa_ssid *ssid;
1511
1512         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1513                 if ((ssid->key_mgmt & WPA_KEY_MGMT_WPS) && !ssid->disabled)
1514                         return 1;
1515         }
1516
1517         return 0;
1518 }
1519
1520
1521 int wpas_wps_scan_result_text(const u8 *ies, size_t ies_len, char *buf,
1522                               char *end)
1523 {
1524         struct wpabuf *wps_ie;
1525         int ret;
1526
1527         wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len, WPS_DEV_OUI_WFA);
1528         if (wps_ie == NULL)
1529                 return 0;
1530
1531         ret = wps_attr_text(wps_ie, buf, end);
1532         wpabuf_free(wps_ie);
1533         return ret;
1534 }
1535
1536
1537 int wpas_wps_er_start(struct wpa_supplicant *wpa_s, const char *filter)
1538 {
1539 #ifdef CONFIG_WPS_ER
1540         if (wpa_s->wps_er) {
1541                 wps_er_refresh(wpa_s->wps_er);
1542                 return 0;
1543         }
1544         wpa_s->wps_er = wps_er_init(wpa_s->wps, wpa_s->ifname, filter);
1545         if (wpa_s->wps_er == NULL)
1546                 return -1;
1547         return 0;
1548 #else /* CONFIG_WPS_ER */
1549         return 0;
1550 #endif /* CONFIG_WPS_ER */
1551 }
1552
1553
1554 int wpas_wps_er_stop(struct wpa_supplicant *wpa_s)
1555 {
1556 #ifdef CONFIG_WPS_ER
1557         wps_er_deinit(wpa_s->wps_er, NULL, NULL);
1558         wpa_s->wps_er = NULL;
1559 #endif /* CONFIG_WPS_ER */
1560         return 0;
1561 }
1562
1563
1564 #ifdef CONFIG_WPS_ER
1565 int wpas_wps_er_add_pin(struct wpa_supplicant *wpa_s, const u8 *addr,
1566                         const char *uuid, const char *pin)
1567 {
1568         u8 u[UUID_LEN];
1569         int any = 0;
1570
1571         if (os_strcmp(uuid, "any") == 0)
1572                 any = 1;
1573         else if (uuid_str2bin(uuid, u))
1574                 return -1;
1575         return wps_registrar_add_pin(wpa_s->wps->registrar, addr,
1576                                      any ? NULL : u,
1577                                      (const u8 *) pin, os_strlen(pin), 300);
1578 }
1579
1580
1581 int wpas_wps_er_pbc(struct wpa_supplicant *wpa_s, const char *uuid)
1582 {
1583         u8 u[UUID_LEN];
1584
1585         if (uuid_str2bin(uuid, u))
1586                 return -1;
1587         return wps_er_pbc(wpa_s->wps_er, u);
1588 }
1589
1590
1591 int wpas_wps_er_learn(struct wpa_supplicant *wpa_s, const char *uuid,
1592                       const char *pin)
1593 {
1594         u8 u[UUID_LEN];
1595
1596         if (uuid_str2bin(uuid, u))
1597                 return -1;
1598         return wps_er_learn(wpa_s->wps_er, u, (const u8 *) pin,
1599                             os_strlen(pin));
1600 }
1601
1602
1603 int wpas_wps_er_set_config(struct wpa_supplicant *wpa_s, const char *uuid,
1604                            int id)
1605 {
1606         u8 u[UUID_LEN];
1607         struct wpa_ssid *ssid;
1608         struct wps_credential cred;
1609
1610         if (uuid_str2bin(uuid, u))
1611                 return -1;
1612         ssid = wpa_config_get_network(wpa_s->conf, id);
1613         if (ssid == NULL || ssid->ssid == NULL)
1614                 return -1;
1615
1616         os_memset(&cred, 0, sizeof(cred));
1617         if (ssid->ssid_len > 32)
1618                 return -1;
1619         os_memcpy(cred.ssid, ssid->ssid, ssid->ssid_len);
1620         cred.ssid_len = ssid->ssid_len;
1621         if (ssid->key_mgmt & WPA_KEY_MGMT_PSK) {
1622                 cred.auth_type = (ssid->proto & WPA_PROTO_RSN) ?
1623                         WPS_AUTH_WPA2PSK : WPS_AUTH_WPAPSK;
1624                 if (ssid->pairwise_cipher & WPA_CIPHER_CCMP)
1625                         cred.encr_type = WPS_ENCR_AES;
1626                 else
1627                         cred.encr_type = WPS_ENCR_TKIP;
1628                 if (ssid->passphrase) {
1629                         cred.key_len = os_strlen(ssid->passphrase);
1630                         if (cred.key_len >= 64)
1631                                 return -1;
1632                         os_memcpy(cred.key, ssid->passphrase, cred.key_len);
1633                 } else if (ssid->psk_set) {
1634                         cred.key_len = 32;
1635                         os_memcpy(cred.key, ssid->psk, 32);
1636                 } else
1637                         return -1;
1638         } else {
1639                 cred.auth_type = WPS_AUTH_OPEN;
1640                 cred.encr_type = WPS_ENCR_NONE;
1641         }
1642         return wps_er_set_config(wpa_s->wps_er, u, &cred);
1643 }
1644
1645
1646 int wpas_wps_er_config(struct wpa_supplicant *wpa_s, const char *uuid,
1647                        const char *pin, struct wps_new_ap_settings *settings)
1648 {
1649         u8 u[UUID_LEN];
1650         struct wps_credential cred;
1651         size_t len;
1652
1653         if (uuid_str2bin(uuid, u))
1654                 return -1;
1655         if (settings->ssid_hex == NULL || settings->auth == NULL ||
1656             settings->encr == NULL || settings->key_hex == NULL)
1657                 return -1;
1658
1659         os_memset(&cred, 0, sizeof(cred));
1660         len = os_strlen(settings->ssid_hex);
1661         if ((len & 1) || len > 2 * sizeof(cred.ssid) ||
1662             hexstr2bin(settings->ssid_hex, cred.ssid, len / 2))
1663                 return -1;
1664         cred.ssid_len = len / 2;
1665
1666         len = os_strlen(settings->key_hex);
1667         if ((len & 1) || len > 2 * sizeof(cred.key) ||
1668             hexstr2bin(settings->key_hex, cred.key, len / 2))
1669                 return -1;
1670         cred.key_len = len / 2;
1671
1672         if (os_strcmp(settings->auth, "OPEN") == 0)
1673                 cred.auth_type = WPS_AUTH_OPEN;
1674         else if (os_strcmp(settings->auth, "WPAPSK") == 0)
1675                 cred.auth_type = WPS_AUTH_WPAPSK;
1676         else if (os_strcmp(settings->auth, "WPA2PSK") == 0)
1677                 cred.auth_type = WPS_AUTH_WPA2PSK;
1678         else
1679                 return -1;
1680
1681         if (os_strcmp(settings->encr, "NONE") == 0)
1682                 cred.encr_type = WPS_ENCR_NONE;
1683         else if (os_strcmp(settings->encr, "WEP") == 0)
1684                 cred.encr_type = WPS_ENCR_WEP;
1685         else if (os_strcmp(settings->encr, "TKIP") == 0)
1686                 cred.encr_type = WPS_ENCR_TKIP;
1687         else if (os_strcmp(settings->encr, "CCMP") == 0)
1688                 cred.encr_type = WPS_ENCR_AES;
1689         else
1690                 return -1;
1691
1692         return wps_er_config(wpa_s->wps_er, u, (const u8 *) pin,
1693                              os_strlen(pin), &cred);
1694 }
1695
1696
1697 #ifdef CONFIG_WPS_NFC
1698 struct wpabuf * wpas_wps_er_nfc_config_token(struct wpa_supplicant *wpa_s,
1699                                              int ndef, const char *uuid)
1700 {
1701         struct wpabuf *ret;
1702         u8 u[UUID_LEN];
1703
1704         if (!wpa_s->wps_er)
1705                 return NULL;
1706
1707         if (uuid_str2bin(uuid, u))
1708                 return NULL;
1709
1710         ret = wps_er_nfc_config_token(wpa_s->wps_er, u);
1711         if (ndef && ret) {
1712                 struct wpabuf *tmp;
1713                 tmp = ndef_build_wifi(ret);
1714                 wpabuf_free(ret);
1715                 if (tmp == NULL)
1716                         return NULL;
1717                 ret = tmp;
1718         }
1719
1720         return ret;
1721 }
1722 #endif /* CONFIG_WPS_NFC */
1723
1724
1725 static int callbacks_pending = 0;
1726
1727 static void wpas_wps_terminate_cb(void *ctx)
1728 {
1729         wpa_printf(MSG_DEBUG, "WPS ER: Terminated");
1730         if (--callbacks_pending <= 0)
1731                 eloop_terminate();
1732 }
1733 #endif /* CONFIG_WPS_ER */
1734
1735
1736 int wpas_wps_terminate_pending(struct wpa_supplicant *wpa_s)
1737 {
1738 #ifdef CONFIG_WPS_ER
1739         if (wpa_s->wps_er) {
1740                 callbacks_pending++;
1741                 wps_er_deinit(wpa_s->wps_er, wpas_wps_terminate_cb, wpa_s);
1742                 wpa_s->wps_er = NULL;
1743                 return 1;
1744         }
1745 #endif /* CONFIG_WPS_ER */
1746         return 0;
1747 }
1748
1749
1750 int wpas_wps_in_progress(struct wpa_supplicant *wpa_s)
1751 {
1752         struct wpa_ssid *ssid;
1753
1754         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1755                 if (!ssid->disabled && ssid->key_mgmt == WPA_KEY_MGMT_WPS)
1756                         return 1;
1757         }
1758
1759         return 0;
1760 }
1761
1762
1763 void wpas_wps_update_config(struct wpa_supplicant *wpa_s)
1764 {
1765         struct wps_context *wps = wpa_s->wps;
1766
1767         if (wps == NULL)
1768                 return;
1769
1770         if (wpa_s->conf->changed_parameters & CFG_CHANGED_CONFIG_METHODS) {
1771                 wps->config_methods = wps_config_methods_str2bin(
1772                         wpa_s->conf->config_methods);
1773                 if ((wps->config_methods &
1774                      (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) ==
1775                     (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) {
1776                         wpa_printf(MSG_ERROR, "WPS: Both Label and Display "
1777                                    "config methods are not allowed at the "
1778                                    "same time");
1779                         wps->config_methods &= ~WPS_CONFIG_LABEL;
1780                 }
1781         }
1782         wps->config_methods = wps_fix_config_methods(wps->config_methods);
1783         wps->dev.config_methods = wps->config_methods;
1784
1785         if (wpa_s->conf->changed_parameters & CFG_CHANGED_DEVICE_TYPE)
1786                 os_memcpy(wps->dev.pri_dev_type, wpa_s->conf->device_type,
1787                           WPS_DEV_TYPE_LEN);
1788
1789         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SEC_DEVICE_TYPE) {
1790                 wps->dev.num_sec_dev_types = wpa_s->conf->num_sec_device_types;
1791                 os_memcpy(wps->dev.sec_dev_type, wpa_s->conf->sec_device_type,
1792                           wps->dev.num_sec_dev_types * WPS_DEV_TYPE_LEN);
1793         }
1794
1795         if (wpa_s->conf->changed_parameters & CFG_CHANGED_VENDOR_EXTENSION)
1796                 wpas_wps_set_vendor_ext_m1(wpa_s, wps);
1797
1798         if (wpa_s->conf->changed_parameters & CFG_CHANGED_OS_VERSION)
1799                 wps->dev.os_version = WPA_GET_BE32(wpa_s->conf->os_version);
1800
1801         if (wpa_s->conf->changed_parameters & CFG_CHANGED_UUID)
1802                 wpas_wps_set_uuid(wpa_s, wps);
1803
1804         if (wpa_s->conf->changed_parameters &
1805             (CFG_CHANGED_DEVICE_NAME | CFG_CHANGED_WPS_STRING)) {
1806                 /* Update pointers to make sure they refer current values */
1807                 wps->dev.device_name = wpa_s->conf->device_name;
1808                 wps->dev.manufacturer = wpa_s->conf->manufacturer;
1809                 wps->dev.model_name = wpa_s->conf->model_name;
1810                 wps->dev.model_number = wpa_s->conf->model_number;
1811                 wps->dev.serial_number = wpa_s->conf->serial_number;
1812         }
1813 }
1814
1815
1816 #ifdef CONFIG_WPS_NFC
1817
1818 struct wpabuf * wpas_wps_nfc_token(struct wpa_supplicant *wpa_s, int ndef)
1819 {
1820         return wps_nfc_token_gen(ndef, &wpa_s->conf->wps_nfc_dev_pw_id,
1821                                  &wpa_s->conf->wps_nfc_dh_pubkey,
1822                                  &wpa_s->conf->wps_nfc_dh_privkey,
1823                                  &wpa_s->conf->wps_nfc_dev_pw);
1824 }
1825
1826
1827 int wpas_wps_start_nfc(struct wpa_supplicant *wpa_s, const u8 *bssid)
1828 {
1829         struct wps_context *wps = wpa_s->wps;
1830         char pw[32 * 2 + 1];
1831
1832         if (wpa_s->conf->wps_nfc_dh_pubkey == NULL ||
1833             wpa_s->conf->wps_nfc_dh_privkey == NULL ||
1834             wpa_s->conf->wps_nfc_dev_pw == NULL)
1835                 return -1;
1836
1837         dh5_free(wps->dh_ctx);
1838         wpabuf_free(wps->dh_pubkey);
1839         wpabuf_free(wps->dh_privkey);
1840         wps->dh_privkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_privkey);
1841         wps->dh_pubkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_pubkey);
1842         if (wps->dh_privkey == NULL || wps->dh_pubkey == NULL) {
1843                 wps->dh_ctx = NULL;
1844                 wpabuf_free(wps->dh_pubkey);
1845                 wps->dh_pubkey = NULL;
1846                 wpabuf_free(wps->dh_privkey);
1847                 wps->dh_privkey = NULL;
1848                 return -1;
1849         }
1850         wps->dh_ctx = dh5_init_fixed(wps->dh_privkey, wps->dh_pubkey);
1851         if (wps->dh_ctx == NULL)
1852                 return -1;
1853
1854         wpa_snprintf_hex_uppercase(pw, sizeof(pw),
1855                                    wpabuf_head(wpa_s->conf->wps_nfc_dev_pw),
1856                                    wpabuf_len(wpa_s->conf->wps_nfc_dev_pw));
1857         return wpas_wps_start_pin(wpa_s, bssid, pw, 0,
1858                                   wpa_s->conf->wps_nfc_dev_pw_id);
1859 }
1860
1861
1862 static int wpas_wps_use_cred(struct wpa_supplicant *wpa_s,
1863                              struct wps_parse_attr *attr)
1864 {
1865         wpa_s->wps_ap_channel = 0;
1866
1867         if (wps_oob_use_cred(wpa_s->wps, attr) < 0)
1868                 return -1;
1869
1870         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
1871                 return 0;
1872
1873         wpa_printf(MSG_DEBUG, "WPS: Request reconnection with new network "
1874                    "based on the received credential added");
1875         wpa_s->normal_scans = 0;
1876         wpa_supplicant_reinit_autoscan(wpa_s);
1877         if (wpa_s->wps_ap_channel) {
1878                 u16 chan = wpa_s->wps_ap_channel;
1879                 int freq = 0;
1880
1881                 if (chan >= 1 && chan <= 13)
1882                         freq = 2407 + 5 * chan;
1883                 else if (chan == 14)
1884                         freq = 2484;
1885                 else if (chan >= 30)
1886                         freq = 5000 + 5 * chan;
1887
1888                 if (freq) {
1889                         wpa_printf(MSG_DEBUG, "WPS: Credential indicated "
1890                                    "AP channel %u -> %u MHz", chan, freq);
1891                         wpa_s->after_wps = 5;
1892                         wpa_s->wps_freq = freq;
1893                 }
1894         }
1895         wpa_s->disconnected = 0;
1896         wpa_s->reassociate = 1;
1897         wpa_supplicant_req_scan(wpa_s, 0, 0);
1898
1899         return 0;
1900 }
1901
1902
1903 #ifdef CONFIG_WPS_ER
1904 static int wpas_wps_add_nfc_password_token(struct wpa_supplicant *wpa_s,
1905                                            struct wps_parse_attr *attr)
1906 {
1907         return wps_registrar_add_nfc_password_token(
1908                 wpa_s->wps->registrar, attr->oob_dev_password,
1909                 attr->oob_dev_password_len);
1910 }
1911 #endif /* CONFIG_WPS_ER */
1912
1913
1914 static int wpas_wps_nfc_tag_process(struct wpa_supplicant *wpa_s,
1915                                     const struct wpabuf *wps)
1916 {
1917         struct wps_parse_attr attr;
1918
1919         wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps);
1920
1921         if (wps_parse_msg(wps, &attr)) {
1922                 wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag");
1923                 return -1;
1924         }
1925
1926         if (attr.num_cred)
1927                 return wpas_wps_use_cred(wpa_s, &attr);
1928
1929 #ifdef CONFIG_WPS_ER
1930         if (attr.oob_dev_password)
1931                 return wpas_wps_add_nfc_password_token(wpa_s, &attr);
1932 #endif /* CONFIG_WPS_ER */
1933
1934         wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag");
1935         return -1;
1936 }
1937
1938
1939 int wpas_wps_nfc_tag_read(struct wpa_supplicant *wpa_s,
1940                           const struct wpabuf *data)
1941 {
1942         const struct wpabuf *wps = data;
1943         struct wpabuf *tmp = NULL;
1944         int ret;
1945
1946         if (wpabuf_len(data) < 4)
1947                 return -1;
1948
1949         if (*wpabuf_head_u8(data) != 0x10) {
1950                 /* Assume this contains full NDEF record */
1951                 tmp = ndef_parse_wifi(data);
1952                 if (tmp == NULL) {
1953                         wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF");
1954                         return -1;
1955                 }
1956                 wps = tmp;
1957         }
1958
1959         ret = wpas_wps_nfc_tag_process(wpa_s, wps);
1960         wpabuf_free(tmp);
1961         return ret;
1962 }
1963
1964
1965 struct wpabuf * wpas_wps_nfc_handover_req(struct wpa_supplicant *wpa_s)
1966 {
1967         return ndef_build_wifi_hr();
1968 }
1969
1970
1971 struct wpabuf * wpas_wps_nfc_handover_sel(struct wpa_supplicant *wpa_s)
1972 {
1973         return NULL;
1974 }
1975
1976
1977 int wpas_wps_nfc_rx_handover_req(struct wpa_supplicant *wpa_s,
1978                                  const struct wpabuf *data)
1979 {
1980         /* TODO */
1981         return -1;
1982 }
1983
1984
1985 int wpas_wps_nfc_rx_handover_sel(struct wpa_supplicant *wpa_s,
1986                                  const struct wpabuf *data)
1987 {
1988         struct wpabuf *wps;
1989         int ret;
1990
1991         wps = ndef_parse_wifi(data);
1992         if (wps == NULL)
1993                 return -1;
1994         wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
1995                    "payload from NFC connection handover");
1996         wpa_hexdump_buf_key(MSG_DEBUG, "WPS: NFC payload", wps);
1997         ret = wpas_wps_nfc_tag_process(wpa_s, wps);
1998         wpabuf_free(wps);
1999
2000         return ret;
2001 }
2002
2003 #endif /* CONFIG_WPS_NFC */
2004
2005
2006 extern int wpa_debug_level;
2007
2008 static void wpas_wps_dump_ap_info(struct wpa_supplicant *wpa_s)
2009 {
2010         size_t i;
2011         struct os_time now;
2012
2013         if (wpa_debug_level > MSG_DEBUG)
2014                 return;
2015
2016         if (wpa_s->wps_ap == NULL)
2017                 return;
2018
2019         os_get_time(&now);
2020
2021         for (i = 0; i < wpa_s->num_wps_ap; i++) {
2022                 struct wps_ap_info *ap = &wpa_s->wps_ap[i];
2023                 struct wpa_blacklist *e = wpa_blacklist_get(wpa_s, ap->bssid);
2024
2025                 wpa_printf(MSG_DEBUG, "WPS: AP[%d] " MACSTR " type=%d "
2026                            "tries=%d last_attempt=%d sec ago blacklist=%d",
2027                            (int) i, MAC2STR(ap->bssid), ap->type, ap->tries,
2028                            ap->last_attempt.sec > 0 ?
2029                            (int) now.sec - (int) ap->last_attempt.sec : -1,
2030                            e ? e->count : 0);
2031         }
2032 }
2033
2034
2035 static struct wps_ap_info * wpas_wps_get_ap_info(struct wpa_supplicant *wpa_s,
2036                                                  const u8 *bssid)
2037 {
2038         size_t i;
2039
2040         if (wpa_s->wps_ap == NULL)
2041                 return NULL;
2042
2043         for (i = 0; i < wpa_s->num_wps_ap; i++) {
2044                 struct wps_ap_info *ap = &wpa_s->wps_ap[i];
2045                 if (os_memcmp(ap->bssid, bssid, ETH_ALEN) == 0)
2046                         return ap;
2047         }
2048
2049         return NULL;
2050 }
2051
2052
2053 static void wpas_wps_update_ap_info_bss(struct wpa_supplicant *wpa_s,
2054                                         struct wpa_scan_res *res)
2055 {
2056         struct wpabuf *wps;
2057         enum wps_ap_info_type type;
2058         struct wps_ap_info *ap;
2059         int r;
2060
2061         if (wpa_scan_get_vendor_ie(res, WPS_IE_VENDOR_TYPE) == NULL)
2062                 return;
2063
2064         wps = wpa_scan_get_vendor_ie_multi(res, WPS_IE_VENDOR_TYPE);
2065         if (wps == NULL)
2066                 return;
2067
2068         r = wps_is_addr_authorized(wps, wpa_s->own_addr, 1);
2069         if (r == 2)
2070                 type = WPS_AP_SEL_REG_OUR;
2071         else if (r == 1)
2072                 type = WPS_AP_SEL_REG;
2073         else
2074                 type = WPS_AP_NOT_SEL_REG;
2075
2076         wpabuf_free(wps);
2077
2078         ap = wpas_wps_get_ap_info(wpa_s, res->bssid);
2079         if (ap) {
2080                 if (ap->type != type) {
2081                         wpa_printf(MSG_DEBUG, "WPS: AP " MACSTR
2082                                    " changed type %d -> %d",
2083                                    MAC2STR(res->bssid), ap->type, type);
2084                         ap->type = type;
2085                         if (type != WPS_AP_NOT_SEL_REG)
2086                                 wpa_blacklist_del(wpa_s, ap->bssid);
2087                 }
2088                 return;
2089         }
2090
2091         ap = os_realloc_array(wpa_s->wps_ap, wpa_s->num_wps_ap + 1,
2092                               sizeof(struct wps_ap_info));
2093         if (ap == NULL)
2094                 return;
2095
2096         wpa_s->wps_ap = ap;
2097         ap = &wpa_s->wps_ap[wpa_s->num_wps_ap];
2098         wpa_s->num_wps_ap++;
2099
2100         os_memset(ap, 0, sizeof(*ap));
2101         os_memcpy(ap->bssid, res->bssid, ETH_ALEN);
2102         ap->type = type;
2103         wpa_printf(MSG_DEBUG, "WPS: AP " MACSTR " type %d added",
2104                    MAC2STR(ap->bssid), ap->type);
2105 }
2106
2107
2108 void wpas_wps_update_ap_info(struct wpa_supplicant *wpa_s,
2109                              struct wpa_scan_results *scan_res)
2110 {
2111         size_t i;
2112
2113         for (i = 0; i < scan_res->num; i++)
2114                 wpas_wps_update_ap_info_bss(wpa_s, scan_res->res[i]);
2115
2116         wpas_wps_dump_ap_info(wpa_s);
2117 }
2118
2119
2120 void wpas_wps_notify_assoc(struct wpa_supplicant *wpa_s, const u8 *bssid)
2121 {
2122         struct wps_ap_info *ap;
2123         if (!wpa_s->wps_ap_iter)
2124                 return;
2125         ap = wpas_wps_get_ap_info(wpa_s, bssid);
2126         if (ap == NULL)
2127                 return;
2128         ap->tries++;
2129         os_get_time(&ap->last_attempt);
2130 }