wpa_supplicant/wps_supplicant.c

   1 /*
   2  * wpa_supplicant / WPS integration
   3  * Copyright (c) 2008-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "eloop.h"
  13 #include "uuid.h"
  14 #include "crypto/random.h"
  15 #include "crypto/dh_group5.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "common/ieee802_11_common.h"
  18 #include "common/wpa_common.h"
  19 #include "common/wpa_ctrl.h"
  20 #include "eap_common/eap_wsc_common.h"
  21 #include "eap_peer/eap.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "rsn_supp/wpa.h"
  24 #include "wps/wps_attr_parse.h"
  25 #include "config.h"
  26 #include "wpa_supplicant_i.h"
  27 #include "driver_i.h"
  28 #include "notify.h"
  29 #include "blacklist.h"
  30 #include "bss.h"
  31 #include "scan.h"
  32 #include "ap.h"
  33 #include "p2p/p2p.h"
  34 #include "p2p_supplicant.h"
  35 #include "wps_supplicant.h"
  36
  37
  38 #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
  39 #define WPS_PIN_SCAN_IGNORE_SEL_REG 3
  40 #endif /* WPS_PIN_SCAN_IGNORE_SEL_REG */
  41
  42 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx);
  43 static void wpas_clear_wps(struct wpa_supplicant *wpa_s);
  44
  45
  46 static void wpas_wps_clear_ap_info(struct wpa_supplicant *wpa_s)
  47 {
  48         os_free(wpa_s->wps_ap);
  49         wpa_s->wps_ap = NULL;
  50         wpa_s->num_wps_ap = 0;
  51         wpa_s->wps_ap_iter = 0;
  52 }
  53
  54
  55 static void wpas_wps_assoc_with_cred(void *eloop_ctx, void *timeout_ctx)
  56 {
  57         struct wpa_supplicant *wpa_s = eloop_ctx;
  58         int use_fast_assoc = timeout_ctx != NULL;
  59
  60         wpa_printf(MSG_DEBUG, "WPS: Continuing association after eapol_cb");
  61         if (!use_fast_assoc ||
  62             wpa_supplicant_fast_associate(wpa_s) != 1)
  63                 wpa_supplicant_req_scan(wpa_s, 0, 0);
  64 }
  65
  66
  67 static void wpas_wps_assoc_with_cred_cancel(struct wpa_supplicant *wpa_s)
  68 {
  69         eloop_cancel_timeout(wpas_wps_assoc_with_cred, wpa_s, (void *) 0);
  70         eloop_cancel_timeout(wpas_wps_assoc_with_cred, wpa_s, (void *) 1);
  71 }
  72
  73
  74 int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s)
  75 {
  76 #ifdef CONFIG_P2P
  77         if (wpas_p2p_wps_eapol_cb(wpa_s) > 0)
  78                 return 1;
  79 #endif /* CONFIG_P2P */
  80
  81         if (!wpa_s->wps_success &&
  82             wpa_s->current_ssid &&
  83             eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
  84                 const u8 *bssid = wpa_s->bssid;
  85                 if (is_zero_ether_addr(bssid))
  86                         bssid = wpa_s->pending_bssid;
  87
  88                 wpa_printf(MSG_DEBUG, "WPS: PIN registration with " MACSTR
  89                            " did not succeed - continue trying to find "
  90                            "suitable AP", MAC2STR(bssid));
  91                 wpa_blacklist_add(wpa_s, bssid);
  92
  93                 wpa_supplicant_deauthenticate(wpa_s,
  94                                               WLAN_REASON_DEAUTH_LEAVING);
  95                 wpa_s->reassociate = 1;
  96                 wpa_supplicant_req_scan(wpa_s,
  97                                         wpa_s->blacklist_cleared ? 5 : 0, 0);
  98                 wpa_s->blacklist_cleared = 0;
  99                 return 1;
 100         }
 101
 102         wpas_wps_clear_ap_info(wpa_s);
 103         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
 104         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && !wpa_s->wps_success)
 105                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_FAIL);
 106
 107         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid &&
 108             !(wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
 109                 int disabled = wpa_s->current_ssid->disabled;
 110                 unsigned int freq = wpa_s->assoc_freq;
 111                 struct wpa_bss *bss;
 112                 struct wpa_ssid *ssid = NULL;
 113                 int use_fast_assoc = 0;
 114
 115                 wpa_printf(MSG_DEBUG, "WPS: Network configuration replaced - "
 116                            "try to associate with the received credential "
 117                            "(freq=%u)", freq);
 118                 wpa_supplicant_deauthenticate(wpa_s,
 119                                               WLAN_REASON_DEAUTH_LEAVING);
 120                 if (disabled) {
 121                         wpa_printf(MSG_DEBUG, "WPS: Current network is "
 122                                    "disabled - wait for user to enable");
 123                         return 1;
 124                 }
 125                 wpa_s->after_wps = 5;
 126                 wpa_s->wps_freq = freq;
 127                 wpa_s->normal_scans = 0;
 128                 wpa_s->reassociate = 1;
 129
 130                 wpa_printf(MSG_DEBUG, "WPS: Checking whether fast association "
 131                            "without a new scan can be used");
 132                 bss = wpa_supplicant_pick_network(wpa_s, &ssid);
 133                 if (bss) {
 134                         struct wpabuf *wps;
 135                         struct wps_parse_attr attr;
 136
 137                         wps = wpa_bss_get_vendor_ie_multi(bss,
 138                                                           WPS_IE_VENDOR_TYPE);
 139                         if (wps && wps_parse_msg(wps, &attr) == 0 &&
 140                             attr.wps_state &&
 141                             *attr.wps_state == WPS_STATE_CONFIGURED)
 142                                 use_fast_assoc = 1;
 143                         wpabuf_free(wps);
 144                 }
 145
 146                 /*
 147                  * Complete the next step from an eloop timeout to allow pending
 148                  * driver events related to the disconnection to be processed
 149                  * first. This makes it less likely for disconnection event to
 150                  * cause problems with the following connection.
 151                  */
 152                 wpa_printf(MSG_DEBUG, "WPS: Continue association from timeout");
 153                 wpas_wps_assoc_with_cred_cancel(wpa_s);
 154                 eloop_register_timeout(0, 10000,
 155                                        wpas_wps_assoc_with_cred, wpa_s,
 156                                        use_fast_assoc ? (void *) 1 :
 157                                        (void *) 0);
 158                 return 1;
 159         }
 160
 161         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid) {
 162                 wpa_printf(MSG_DEBUG, "WPS: Registration completed - waiting "
 163                            "for external credential processing");
 164                 wpas_clear_wps(wpa_s);
 165                 wpa_supplicant_deauthenticate(wpa_s,
 166                                               WLAN_REASON_DEAUTH_LEAVING);
 167                 return 1;
 168         }
 169
 170         return 0;
 171 }
 172
 173
 174 static void wpas_wps_security_workaround(struct wpa_supplicant *wpa_s,
 175                                          struct wpa_ssid *ssid,
 176                                          const struct wps_credential *cred)
 177 {
 178         struct wpa_driver_capa capa;
 179         struct wpa_bss *bss;
 180         const u8 *ie;
 181         struct wpa_ie_data adv;
 182         int wpa2 = 0, ccmp = 0;
 183
 184         /*
 185          * Many existing WPS APs do not know how to negotiate WPA2 or CCMP in
 186          * case they are configured for mixed mode operation (WPA+WPA2 and
 187          * TKIP+CCMP). Try to use scan results to figure out whether the AP
 188          * actually supports stronger security and select that if the client
 189          * has support for it, too.
 190          */
 191
 192         if (wpa_drv_get_capa(wpa_s, &capa))
 193                 return; /* Unknown what driver supports */
 194
 195         if (ssid->ssid == NULL)
 196                 return;
 197         bss = wpa_bss_get(wpa_s, cred->mac_addr, ssid->ssid, ssid->ssid_len);
 198         if (bss == NULL) {
 199                 wpa_printf(MSG_DEBUG, "WPS: The AP was not found from BSS "
 200                            "table - use credential as-is");
 201                 return;
 202         }
 203
 204         wpa_printf(MSG_DEBUG, "WPS: AP found from BSS table");
 205
 206         ie = wpa_bss_get_ie(bss, WLAN_EID_RSN);
 207         if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0) {
 208                 wpa2 = 1;
 209                 if (adv.pairwise_cipher & WPA_CIPHER_CCMP)
 210                         ccmp = 1;
 211         } else {
 212                 ie = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 213                 if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0 &&
 214                     adv.pairwise_cipher & WPA_CIPHER_CCMP)
 215                         ccmp = 1;
 216         }
 217
 218         if (ie == NULL && (ssid->proto & WPA_PROTO_WPA) &&
 219             (ssid->pairwise_cipher & WPA_CIPHER_TKIP)) {
 220                 /*
 221                  * TODO: This could be the initial AP configuration and the
 222                  * Beacon contents could change shortly. Should request a new
 223                  * scan and delay addition of the network until the updated
 224                  * scan results are available.
 225                  */
 226                 wpa_printf(MSG_DEBUG, "WPS: The AP did not yet advertise WPA "
 227                            "support - use credential as-is");
 228                 return;
 229         }
 230
 231         if (ccmp && !(ssid->pairwise_cipher & WPA_CIPHER_CCMP) &&
 232             (ssid->pairwise_cipher & WPA_CIPHER_TKIP) &&
 233             (capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
 234                 wpa_printf(MSG_DEBUG, "WPS: Add CCMP into the credential "
 235                            "based on scan results");
 236                 if (wpa_s->conf->ap_scan == 1)
 237                         ssid->pairwise_cipher |= WPA_CIPHER_CCMP;
 238                 else
 239                         ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 240         }
 241
 242         if (wpa2 && !(ssid->proto & WPA_PROTO_RSN) &&
 243             (ssid->proto & WPA_PROTO_WPA) &&
 244             (capa.enc & WPA_DRIVER_CAPA_ENC_CCMP)) {
 245                 wpa_printf(MSG_DEBUG, "WPS: Add WPA2 into the credential "
 246                            "based on scan results");
 247                 if (wpa_s->conf->ap_scan == 1)
 248                         ssid->proto |= WPA_PROTO_RSN;
 249                 else
 250                         ssid->proto = WPA_PROTO_RSN;
 251         }
 252 }
 253
 254
 255 static void wpas_wps_remove_dup_network(struct wpa_supplicant *wpa_s,
 256                                         struct wpa_ssid *new_ssid)
 257 {
 258         struct wpa_ssid *ssid, *next;
 259
 260         for (ssid = wpa_s->conf->ssid, next = ssid ? ssid->next : NULL; ssid;
 261              ssid = next, next = ssid ? ssid->next : NULL) {
 262                 /*
 263                  * new_ssid has already been added to the list in
 264                  * wpas_wps_add_network(), so skip it.
 265                  */
 266                 if (ssid == new_ssid)
 267                         continue;
 268
 269                 if (ssid->bssid_set || new_ssid->bssid_set) {
 270                         if (ssid->bssid_set != new_ssid->bssid_set)
 271                                 continue;
 272                         if (os_memcmp(ssid->bssid, new_ssid->bssid, ETH_ALEN) !=
 273                             0)
 274                                 continue;
 275                 }
 276
 277                 /* compare SSID */
 278                 if (ssid->ssid_len == 0 || ssid->ssid_len != new_ssid->ssid_len)
 279                         continue;
 280
 281                 if (ssid->ssid && new_ssid->ssid) {
 282                         if (os_memcmp(ssid->ssid, new_ssid->ssid,
 283                                       ssid->ssid_len) != 0)
 284                                 continue;
 285                 } else if (ssid->ssid || new_ssid->ssid)
 286                         continue;
 287
 288                 /* compare security parameters */
 289                 if (ssid->auth_alg != new_ssid->auth_alg ||
 290                     ssid->key_mgmt != new_ssid->key_mgmt ||
 291                     ssid->proto != new_ssid->proto ||
 292                     ssid->pairwise_cipher != new_ssid->pairwise_cipher ||
 293                     ssid->group_cipher != new_ssid->group_cipher)
 294                         continue;
 295
 296                 /* Remove the duplicated older network entry. */
 297                 wpa_printf(MSG_DEBUG, "Remove duplicate network %d", ssid->id);
 298                 wpas_notify_network_removed(wpa_s, ssid);
 299                 wpa_config_remove_network(wpa_s->conf, ssid->id);
 300         }
 301 }
 302
 303
 304 static int wpa_supplicant_wps_cred(void *ctx,
 305                                    const struct wps_credential *cred)
 306 {
 307         struct wpa_supplicant *wpa_s = ctx;
 308         struct wpa_ssid *ssid = wpa_s->current_ssid;
 309         u16 auth_type;
 310 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 311         int registrar = 0;
 312 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 313
 314         if ((wpa_s->conf->wps_cred_processing == 1 ||
 315              wpa_s->conf->wps_cred_processing == 2) && cred->cred_attr) {
 316                 size_t blen = cred->cred_attr_len * 2 + 1;
 317                 char *buf = os_malloc(blen);
 318                 if (buf) {
 319                         wpa_snprintf_hex(buf, blen,
 320                                          cred->cred_attr, cred->cred_attr_len);
 321                         wpa_msg(wpa_s, MSG_INFO, "%s%s",
 322                                 WPS_EVENT_CRED_RECEIVED, buf);
 323                         os_free(buf);
 324                 }
 325
 326                 wpas_notify_wps_credential(wpa_s, cred);
 327         } else
 328                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_CRED_RECEIVED);
 329
 330         wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
 331                         cred->cred_attr, cred->cred_attr_len);
 332
 333         if (wpa_s->conf->wps_cred_processing == 1)
 334                 return 0;
 335
 336         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
 337         wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
 338                    cred->auth_type);
 339         wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
 340         wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
 341         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
 342                         cred->key, cred->key_len);
 343         wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
 344                    MAC2STR(cred->mac_addr));
 345
 346         auth_type = cred->auth_type;
 347         if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 348                 wpa_printf(MSG_DEBUG, "WPS: Workaround - convert mixed-mode "
 349                            "auth_type into WPA2PSK");
 350                 auth_type = WPS_AUTH_WPA2PSK;
 351         }
 352
 353         if (auth_type != WPS_AUTH_OPEN &&
 354             auth_type != WPS_AUTH_WPAPSK &&
 355             auth_type != WPS_AUTH_WPA2PSK) {
 356                 wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for "
 357                            "unsupported authentication type 0x%x",
 358                            auth_type);
 359                 return 0;
 360         }
 361
 362         if (auth_type == WPS_AUTH_WPAPSK || auth_type == WPS_AUTH_WPA2PSK) {
 363                 if (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN) {
 364                         wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with "
 365                                    "invalid Network Key length %lu",
 366                                    (unsigned long) cred->key_len);
 367                         return -1;
 368                 }
 369         }
 370
 371         if (ssid && (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
 372                 wpa_printf(MSG_DEBUG, "WPS: Replace WPS network block based "
 373                            "on the received credential");
 374 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 375                 if (ssid->eap.identity &&
 376                     ssid->eap.identity_len == WSC_ID_REGISTRAR_LEN &&
 377                     os_memcmp(ssid->eap.identity, WSC_ID_REGISTRAR,
 378                               WSC_ID_REGISTRAR_LEN) == 0)
 379                         registrar = 1;
 380 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 381                 os_free(ssid->eap.identity);
 382                 ssid->eap.identity = NULL;
 383                 ssid->eap.identity_len = 0;
 384                 os_free(ssid->eap.phase1);
 385                 ssid->eap.phase1 = NULL;
 386                 os_free(ssid->eap.eap_methods);
 387                 ssid->eap.eap_methods = NULL;
 388                 if (!ssid->p2p_group) {
 389                         ssid->temporary = 0;
 390                         ssid->bssid_set = 0;
 391                 }
 392                 ssid->disabled_until.sec = 0;
 393                 ssid->disabled_until.usec = 0;
 394                 ssid->auth_failures = 0;
 395         } else {
 396                 wpa_printf(MSG_DEBUG, "WPS: Create a new network based on the "
 397                            "received credential");
 398                 ssid = wpa_config_add_network(wpa_s->conf);
 399                 if (ssid == NULL)
 400                         return -1;
 401                 if (wpa_s->current_ssid) {
 402                         /*
 403                          * Should the GO issue multiple credentials for some
 404                          * reason, each credential should be marked as a
 405                          * temporary P2P group similarly to the one that gets
 406                          * marked as such based on the pre-configured values
 407                          * used for the WPS network block.
 408                          */
 409                         ssid->p2p_group = wpa_s->current_ssid->p2p_group;
 410                         ssid->temporary = wpa_s->current_ssid->temporary;
 411                 }
 412                 wpas_notify_network_added(wpa_s, ssid);
 413         }
 414
 415         wpa_config_set_network_defaults(ssid);
 416
 417         os_free(ssid->ssid);
 418         ssid->ssid = os_malloc(cred->ssid_len);
 419         if (ssid->ssid) {
 420                 os_memcpy(ssid->ssid, cred->ssid, cred->ssid_len);
 421                 ssid->ssid_len = cred->ssid_len;
 422         }
 423
 424         switch (cred->encr_type) {
 425         case WPS_ENCR_NONE:
 426                 break;
 427         case WPS_ENCR_TKIP:
 428                 ssid->pairwise_cipher = WPA_CIPHER_TKIP;
 429                 break;
 430         case WPS_ENCR_AES:
 431                 ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 432                 break;
 433         }
 434
 435         switch (auth_type) {
 436         case WPS_AUTH_OPEN:
 437                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 438                 ssid->key_mgmt = WPA_KEY_MGMT_NONE;
 439                 ssid->proto = 0;
 440 #ifdef CONFIG_WPS_REG_DISABLE_OPEN
 441                 if (registrar) {
 442                         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_OPEN_NETWORK
 443                                 "id=%d - Credentials for an open "
 444                                 "network disabled by default - use "
 445                                 "'select_network %d' to enable",
 446                                 ssid->id, ssid->id);
 447                         ssid->disabled = 1;
 448                 }
 449 #endif /* CONFIG_WPS_REG_DISABLE_OPEN */
 450                 break;
 451         case WPS_AUTH_WPAPSK:
 452                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 453                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 454                 ssid->proto = WPA_PROTO_WPA;
 455                 break;
 456         case WPS_AUTH_WPA2PSK:
 457                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 458                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 459                 ssid->proto = WPA_PROTO_RSN;
 460                 break;
 461         }
 462
 463         if (ssid->key_mgmt == WPA_KEY_MGMT_PSK) {
 464                 if (cred->key_len == 2 * PMK_LEN) {
 465                         if (hexstr2bin((const char *) cred->key, ssid->psk,
 466                                        PMK_LEN)) {
 467                                 wpa_printf(MSG_ERROR, "WPS: Invalid Network "
 468                                            "Key");
 469                                 return -1;
 470                         }
 471                         ssid->psk_set = 1;
 472                         ssid->export_keys = 1;
 473                 } else if (cred->key_len >= 8 && cred->key_len < 2 * PMK_LEN) {
 474                         os_free(ssid->passphrase);
 475                         ssid->passphrase = os_malloc(cred->key_len + 1);
 476                         if (ssid->passphrase == NULL)
 477                                 return -1;
 478                         os_memcpy(ssid->passphrase, cred->key, cred->key_len);
 479                         ssid->passphrase[cred->key_len] = '\0';
 480                         wpa_config_update_psk(ssid);
 481                         ssid->export_keys = 1;
 482                 } else {
 483                         wpa_printf(MSG_ERROR, "WPS: Invalid Network Key "
 484                                    "length %lu",
 485                                    (unsigned long) cred->key_len);
 486                         return -1;
 487                 }
 488         }
 489
 490         wpas_wps_security_workaround(wpa_s, ssid, cred);
 491
 492         wpas_wps_remove_dup_network(wpa_s, ssid);
 493
 494 #ifndef CONFIG_NO_CONFIG_WRITE
 495         if (wpa_s->conf->update_config &&
 496             wpa_config_write(wpa_s->confname, wpa_s->conf)) {
 497                 wpa_printf(MSG_DEBUG, "WPS: Failed to update configuration");
 498                 return -1;
 499         }
 500 #endif /* CONFIG_NO_CONFIG_WRITE */
 501
 502         /*
 503          * Optimize the post-WPS scan based on the channel used during
 504          * the provisioning in case EAP-Failure is not received.
 505          */
 506         wpa_s->after_wps = 5;
 507         wpa_s->wps_freq = wpa_s->assoc_freq;
 508
 509         return 0;
 510 }
 511
 512
 513 static void wpa_supplicant_wps_event_m2d(struct wpa_supplicant *wpa_s,
 514                                          struct wps_event_m2d *m2d)
 515 {
 516         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_M2D
 517                 "dev_password_id=%d config_error=%d",
 518                 m2d->dev_password_id, m2d->config_error);
 519         wpas_notify_wps_event_m2d(wpa_s, m2d);
 520 #ifdef CONFIG_P2P
 521         if (wpa_s->parent && wpa_s->parent != wpa_s) {
 522                 wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_M2D
 523                         "dev_password_id=%d config_error=%d",
 524                         m2d->dev_password_id, m2d->config_error);
 525         }
 526         if (m2d->config_error == WPS_CFG_MULTIPLE_PBC_DETECTED) {
 527                 /*
 528                  * Notify P2P from eloop timeout to avoid issues with the
 529                  * interface getting removed while processing a message.
 530                  */
 531                 eloop_register_timeout(0, 0, wpas_p2p_pbc_overlap_cb, wpa_s,
 532                                        NULL);
 533         }
 534 #endif /* CONFIG_P2P */
 535 }
 536
 537
 538 static void wpas_wps_clear_timeout(void *eloop_ctx, void *timeout_ctx)
 539 {
 540         struct wpa_supplicant *wpa_s = eloop_ctx;
 541         wpa_printf(MSG_DEBUG, "WPS: Clear WPS network from timeout");
 542         wpas_clear_wps(wpa_s);
 543 }
 544
 545
 546 static void wpa_supplicant_wps_event_fail(struct wpa_supplicant *wpa_s,
 547                                           struct wps_event_fail *fail)
 548 {
 549         if (fail->error_indication > 0 &&
 550             fail->error_indication < NUM_WPS_EI_VALUES) {
 551                 wpa_msg(wpa_s, MSG_INFO,
 552                         WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)",
 553                         fail->msg, fail->config_error, fail->error_indication,
 554                         wps_ei_str(fail->error_indication));
 555                 if (wpa_s->parent && wpa_s->parent != wpa_s)
 556                         wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_FAIL
 557                                 "msg=%d config_error=%d reason=%d (%s)",
 558                                 fail->msg, fail->config_error,
 559                                 fail->error_indication,
 560                                 wps_ei_str(fail->error_indication));
 561         } else {
 562                 wpa_msg(wpa_s, MSG_INFO,
 563                         WPS_EVENT_FAIL "msg=%d config_error=%d",
 564                         fail->msg, fail->config_error);
 565                 if (wpa_s->parent && wpa_s->parent != wpa_s)
 566                         wpa_msg(wpa_s->parent, MSG_INFO, WPS_EVENT_FAIL
 567                                 "msg=%d config_error=%d",
 568                                 fail->msg, fail->config_error);
 569         }
 570
 571         /*
 572          * Need to allow WPS processing to complete, e.g., by sending WSC_NACK.
 573          */
 574         wpa_printf(MSG_DEBUG, "WPS: Register timeout to clear WPS network");
 575         eloop_cancel_timeout(wpas_wps_clear_timeout, wpa_s, NULL);
 576         eloop_register_timeout(0, 100000, wpas_wps_clear_timeout, wpa_s, NULL);
 577
 578         wpas_notify_wps_event_fail(wpa_s, fail);
 579 #ifdef CONFIG_P2P
 580         wpas_p2p_wps_failed(wpa_s, fail);
 581 #endif /* CONFIG_P2P */
 582 }
 583
 584
 585 static void wpas_wps_reenable_networks_cb(void *eloop_ctx, void *timeout_ctx);
 586
 587 static void wpas_wps_reenable_networks(struct wpa_supplicant *wpa_s)
 588 {
 589         struct wpa_ssid *ssid;
 590         int changed = 0;
 591
 592         eloop_cancel_timeout(wpas_wps_reenable_networks_cb, wpa_s, NULL);
 593
 594         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 595                 if (ssid->disabled_for_connect && ssid->disabled) {
 596                         ssid->disabled_for_connect = 0;
 597                         ssid->disabled = 0;
 598                         wpas_notify_network_enabled_changed(wpa_s, ssid);
 599                         changed++;
 600                 }
 601         }
 602
 603         if (changed) {
 604 #ifndef CONFIG_NO_CONFIG_WRITE
 605                 if (wpa_s->conf->update_config &&
 606                     wpa_config_write(wpa_s->confname, wpa_s->conf)) {
 607                         wpa_printf(MSG_DEBUG, "WPS: Failed to update "
 608                                    "configuration");
 609                 }
 610 #endif /* CONFIG_NO_CONFIG_WRITE */
 611         }
 612 }
 613
 614
 615 static void wpas_wps_reenable_networks_cb(void *eloop_ctx, void *timeout_ctx)
 616 {
 617         struct wpa_supplicant *wpa_s = eloop_ctx;
 618         /* Enable the networks disabled during wpas_wps_reassoc */
 619         wpas_wps_reenable_networks(wpa_s);
 620 }
 621
 622
 623 static void wpa_supplicant_wps_event_success(struct wpa_supplicant *wpa_s)
 624 {
 625         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_SUCCESS);
 626         wpa_s->wps_success = 1;
 627         wpas_notify_wps_event_success(wpa_s);
 628         if (wpa_s->current_ssid)
 629                 wpas_clear_temp_disabled(wpa_s, wpa_s->current_ssid, 1);
 630         wpa_s->extra_blacklist_count = 0;
 631
 632         /*
 633          * Enable the networks disabled during wpas_wps_reassoc after 10
 634          * seconds. The 10 seconds timer is to allow the data connection to be
 635          * formed before allowing other networks to be selected.
 636          */
 637         eloop_register_timeout(10, 0, wpas_wps_reenable_networks_cb, wpa_s,
 638                                NULL);
 639
 640 #ifdef CONFIG_P2P
 641         wpas_p2p_wps_success(wpa_s, wpa_s->bssid, 0);
 642 #endif /* CONFIG_P2P */
 643 }
 644
 645
 646 static void wpa_supplicant_wps_event_er_ap_add(struct wpa_supplicant *wpa_s,
 647                                                struct wps_event_er_ap *ap)
 648 {
 649         char uuid_str[100];
 650         char dev_type[WPS_DEV_TYPE_BUFSIZE];
 651
 652         uuid_bin2str(ap->uuid, uuid_str, sizeof(uuid_str));
 653         if (ap->pri_dev_type)
 654                 wps_dev_type_bin2str(ap->pri_dev_type, dev_type,
 655                                      sizeof(dev_type));
 656         else
 657                 dev_type[0] = '\0';
 658
 659         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_ADD "%s " MACSTR
 660                 " pri_dev_type=%s wps_state=%d |%s|%s|%s|%s|%s|%s|",
 661                 uuid_str, MAC2STR(ap->mac_addr), dev_type, ap->wps_state,
 662                 ap->friendly_name ? ap->friendly_name : "",
 663                 ap->manufacturer ? ap->manufacturer : "",
 664                 ap->model_description ? ap->model_description : "",
 665                 ap->model_name ? ap->model_name : "",
 666                 ap->manufacturer_url ? ap->manufacturer_url : "",
 667                 ap->model_url ? ap->model_url : "");
 668 }
 669
 670
 671 static void wpa_supplicant_wps_event_er_ap_remove(struct wpa_supplicant *wpa_s,
 672                                                   struct wps_event_er_ap *ap)
 673 {
 674         char uuid_str[100];
 675         uuid_bin2str(ap->uuid, uuid_str, sizeof(uuid_str));
 676         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_REMOVE "%s", uuid_str);
 677 }
 678
 679
 680 static void wpa_supplicant_wps_event_er_enrollee_add(
 681         struct wpa_supplicant *wpa_s, struct wps_event_er_enrollee *enrollee)
 682 {
 683         char uuid_str[100];
 684         char dev_type[WPS_DEV_TYPE_BUFSIZE];
 685
 686         uuid_bin2str(enrollee->uuid, uuid_str, sizeof(uuid_str));
 687         if (enrollee->pri_dev_type)
 688                 wps_dev_type_bin2str(enrollee->pri_dev_type, dev_type,
 689                                      sizeof(dev_type));
 690         else
 691                 dev_type[0] = '\0';
 692
 693         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_ENROLLEE_ADD "%s " MACSTR
 694                 " M1=%d config_methods=0x%x dev_passwd_id=%d pri_dev_type=%s "
 695                 "|%s|%s|%s|%s|%s|",
 696                 uuid_str, MAC2STR(enrollee->mac_addr), enrollee->m1_received,
 697                 enrollee->config_methods, enrollee->dev_passwd_id, dev_type,
 698                 enrollee->dev_name ? enrollee->dev_name : "",
 699                 enrollee->manufacturer ? enrollee->manufacturer : "",
 700                 enrollee->model_name ? enrollee->model_name : "",
 701                 enrollee->model_number ? enrollee->model_number : "",
 702                 enrollee->serial_number ? enrollee->serial_number : "");
 703 }
 704
 705
 706 static void wpa_supplicant_wps_event_er_enrollee_remove(
 707         struct wpa_supplicant *wpa_s, struct wps_event_er_enrollee *enrollee)
 708 {
 709         char uuid_str[100];
 710         uuid_bin2str(enrollee->uuid, uuid_str, sizeof(uuid_str));
 711         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_ENROLLEE_REMOVE "%s " MACSTR,
 712                 uuid_str, MAC2STR(enrollee->mac_addr));
 713 }
 714
 715
 716 static void wpa_supplicant_wps_event_er_ap_settings(
 717         struct wpa_supplicant *wpa_s,
 718         struct wps_event_er_ap_settings *ap_settings)
 719 {
 720         char uuid_str[100];
 721         char key_str[65];
 722         const struct wps_credential *cred = ap_settings->cred;
 723
 724         key_str[0] = '\0';
 725         if (cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 726                 if (cred->key_len >= 8 && cred->key_len <= 64) {
 727                         os_memcpy(key_str, cred->key, cred->key_len);
 728                         key_str[cred->key_len] = '\0';
 729                 }
 730         }
 731
 732         uuid_bin2str(ap_settings->uuid, uuid_str, sizeof(uuid_str));
 733         /* Use wpa_msg_ctrl to avoid showing the key in debug log */
 734         wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_ER_AP_SETTINGS
 735                      "uuid=%s ssid=%s auth_type=0x%04x encr_type=0x%04x "
 736                      "key=%s",
 737                      uuid_str, wpa_ssid_txt(cred->ssid, cred->ssid_len),
 738                      cred->auth_type, cred->encr_type, key_str);
 739 }
 740
 741
 742 static void wpa_supplicant_wps_event_er_set_sel_reg(
 743         struct wpa_supplicant *wpa_s,
 744         struct wps_event_er_set_selected_registrar *ev)
 745 {
 746         char uuid_str[100];
 747
 748         uuid_bin2str(ev->uuid, uuid_str, sizeof(uuid_str));
 749         switch (ev->state) {
 750         case WPS_ER_SET_SEL_REG_START:
 751                 wpa_msg(wpa_s, MSG_DEBUG, WPS_EVENT_ER_SET_SEL_REG
 752                         "uuid=%s state=START sel_reg=%d dev_passwd_id=%u "
 753                         "sel_reg_config_methods=0x%x",
 754                         uuid_str, ev->sel_reg, ev->dev_passwd_id,
 755                         ev->sel_reg_config_methods);
 756                 break;
 757         case WPS_ER_SET_SEL_REG_DONE:
 758                 wpa_msg(wpa_s, MSG_DEBUG, WPS_EVENT_ER_SET_SEL_REG
 759                         "uuid=%s state=DONE", uuid_str);
 760                 break;
 761         case WPS_ER_SET_SEL_REG_FAILED:
 762                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ER_SET_SEL_REG
 763                         "uuid=%s state=FAILED", uuid_str);
 764                 break;
 765         }
 766 }
 767
 768
 769 static void wpa_supplicant_wps_event(void *ctx, enum wps_event event,
 770                                      union wps_event_data *data)
 771 {
 772         struct wpa_supplicant *wpa_s = ctx;
 773         switch (event) {
 774         case WPS_EV_M2D:
 775                 wpa_supplicant_wps_event_m2d(wpa_s, &data->m2d);
 776                 break;
 777         case WPS_EV_FAIL:
 778                 wpa_supplicant_wps_event_fail(wpa_s, &data->fail);
 779                 break;
 780         case WPS_EV_SUCCESS:
 781                 wpa_supplicant_wps_event_success(wpa_s);
 782                 break;
 783         case WPS_EV_PWD_AUTH_FAIL:
 784 #ifdef CONFIG_AP
 785                 if (wpa_s->ap_iface && data->pwd_auth_fail.enrollee)
 786                         wpa_supplicant_ap_pwd_auth_fail(wpa_s);
 787 #endif /* CONFIG_AP */
 788                 break;
 789         case WPS_EV_PBC_OVERLAP:
 790                 break;
 791         case WPS_EV_PBC_TIMEOUT:
 792                 break;
 793         case WPS_EV_PBC_ACTIVE:
 794                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_ACTIVE);
 795                 break;
 796         case WPS_EV_PBC_DISABLE:
 797                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_DISABLE);
 798                 break;
 799         case WPS_EV_ER_AP_ADD:
 800                 wpa_supplicant_wps_event_er_ap_add(wpa_s, &data->ap);
 801                 break;
 802         case WPS_EV_ER_AP_REMOVE:
 803                 wpa_supplicant_wps_event_er_ap_remove(wpa_s, &data->ap);
 804                 break;
 805         case WPS_EV_ER_ENROLLEE_ADD:
 806                 wpa_supplicant_wps_event_er_enrollee_add(wpa_s,
 807                                                          &data->enrollee);
 808                 break;
 809         case WPS_EV_ER_ENROLLEE_REMOVE:
 810                 wpa_supplicant_wps_event_er_enrollee_remove(wpa_s,
 811                                                             &data->enrollee);
 812                 break;
 813         case WPS_EV_ER_AP_SETTINGS:
 814                 wpa_supplicant_wps_event_er_ap_settings(wpa_s,
 815                                                         &data->ap_settings);
 816                 break;
 817         case WPS_EV_ER_SET_SELECTED_REGISTRAR:
 818                 wpa_supplicant_wps_event_er_set_sel_reg(wpa_s,
 819                                                         &data->set_sel_reg);
 820                 break;
 821         case WPS_EV_AP_PIN_SUCCESS:
 822                 break;
 823         }
 824 }
 825
 826
 827 static int wpa_supplicant_wps_rf_band(void *ctx)
 828 {
 829         struct wpa_supplicant *wpa_s = ctx;
 830
 831         if (!wpa_s->current_ssid || !wpa_s->assoc_freq)
 832                 return 0;
 833
 834         return (wpa_s->assoc_freq > 2484) ? WPS_RF_50GHZ : WPS_RF_24GHZ;
 835 }
 836
 837
 838 enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid)
 839 {
 840         if (eap_is_wps_pbc_enrollee(&ssid->eap) ||
 841             eap_is_wps_pin_enrollee(&ssid->eap))
 842                 return WPS_REQ_ENROLLEE;
 843         else
 844                 return WPS_REQ_REGISTRAR;
 845 }
 846
 847
 848 static void wpas_clear_wps(struct wpa_supplicant *wpa_s)
 849 {
 850         int id;
 851         struct wpa_ssid *ssid, *remove_ssid = NULL, *prev_current;
 852
 853         wpa_s->after_wps = 0;
 854         wpa_s->known_wps_freq = 0;
 855
 856         prev_current = wpa_s->current_ssid;
 857
 858         /* Enable the networks disabled during wpas_wps_reassoc */
 859         wpas_wps_reenable_networks(wpa_s);
 860
 861         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
 862         eloop_cancel_timeout(wpas_wps_clear_timeout, wpa_s, NULL);
 863
 864         /* Remove any existing WPS network from configuration */
 865         ssid = wpa_s->conf->ssid;
 866         while (ssid) {
 867                 if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 868                         if (ssid == wpa_s->current_ssid) {
 869                                 wpa_supplicant_deauthenticate(
 870                                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 871                         }
 872                         id = ssid->id;
 873                         remove_ssid = ssid;
 874                 } else
 875                         id = -1;
 876                 ssid = ssid->next;
 877                 if (id >= 0) {
 878                         if (prev_current == remove_ssid) {
 879                                 wpa_sm_set_config(wpa_s->wpa, NULL);
 880                                 eapol_sm_notify_config(wpa_s->eapol, NULL,
 881                                                        NULL);
 882                         }
 883                         wpas_notify_network_removed(wpa_s, remove_ssid);
 884                         wpa_config_remove_network(wpa_s->conf, id);
 885                 }
 886         }
 887
 888         wpas_wps_clear_ap_info(wpa_s);
 889 }
 890
 891
 892 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx)
 893 {
 894         struct wpa_supplicant *wpa_s = eloop_ctx;
 895         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_TIMEOUT "Requested operation timed "
 896                 "out");
 897         wpas_clear_wps(wpa_s);
 898 }
 899
 900
 901 static struct wpa_ssid * wpas_wps_add_network(struct wpa_supplicant *wpa_s,
 902                                               int registrar, const u8 *dev_addr,
 903                                               const u8 *bssid)
 904 {
 905         struct wpa_ssid *ssid;
 906
 907         ssid = wpa_config_add_network(wpa_s->conf);
 908         if (ssid == NULL)
 909                 return NULL;
 910         wpas_notify_network_added(wpa_s, ssid);
 911         wpa_config_set_network_defaults(ssid);
 912         ssid->temporary = 1;
 913         if (wpa_config_set(ssid, "key_mgmt", "WPS", 0) < 0 ||
 914             wpa_config_set(ssid, "eap", "WSC", 0) < 0 ||
 915             wpa_config_set(ssid, "identity", registrar ?
 916                            "\"" WSC_ID_REGISTRAR "\"" :
 917                            "\"" WSC_ID_ENROLLEE "\"", 0) < 0) {
 918                 wpas_notify_network_removed(wpa_s, ssid);
 919                 wpa_config_remove_network(wpa_s->conf, ssid->id);
 920                 return NULL;
 921         }
 922
 923 #ifdef CONFIG_P2P
 924         if (dev_addr)
 925                 os_memcpy(ssid->go_p2p_dev_addr, dev_addr, ETH_ALEN);
 926 #endif /* CONFIG_P2P */
 927
 928         if (bssid) {
 929 #ifndef CONFIG_P2P
 930                 struct wpa_bss *bss;
 931                 int count = 0;
 932 #endif /* CONFIG_P2P */
 933
 934                 os_memcpy(ssid->bssid, bssid, ETH_ALEN);
 935                 ssid->bssid_set = 1;
 936
 937                 /*
 938                  * Note: With P2P, the SSID may change at the time the WPS
 939                  * provisioning is started, so better not filter the AP based
 940                  * on the current SSID in the scan results.
 941                  */
 942 #ifndef CONFIG_P2P
 943                 dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
 944                         if (os_memcmp(bssid, bss->bssid, ETH_ALEN) != 0)
 945                                 continue;
 946
 947                         os_free(ssid->ssid);
 948                         ssid->ssid = os_malloc(bss->ssid_len);
 949                         if (ssid->ssid == NULL)
 950                                 break;
 951                         os_memcpy(ssid->ssid, bss->ssid, bss->ssid_len);
 952                         ssid->ssid_len = bss->ssid_len;
 953                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Picked SSID from "
 954                                           "scan results",
 955                                           ssid->ssid, ssid->ssid_len);
 956                         count++;
 957                 }
 958
 959                 if (count > 1) {
 960                         wpa_printf(MSG_DEBUG, "WPS: More than one SSID found "
 961                                    "for the AP; use wildcard");
 962                         os_free(ssid->ssid);
 963                         ssid->ssid = NULL;
 964                         ssid->ssid_len = 0;
 965                 }
 966 #endif /* CONFIG_P2P */
 967         }
 968
 969         return ssid;
 970 }
 971
 972
 973 static void wpas_wps_temp_disable(struct wpa_supplicant *wpa_s,
 974                                   struct wpa_ssid *selected)
 975 {
 976         struct wpa_ssid *ssid;
 977
 978         if (wpa_s->current_ssid)
 979                 wpa_supplicant_deauthenticate(
 980                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 981
 982         /* Mark all other networks disabled and trigger reassociation */
 983         ssid = wpa_s->conf->ssid;
 984         while (ssid) {
 985                 int was_disabled = ssid->disabled;
 986                 ssid->disabled_for_connect = 0;
 987                 /*
 988                  * In case the network object corresponds to a persistent group
 989                  * then do not send out network disabled signal. In addition,
 990                  * do not change disabled status of persistent network objects
 991                  * from 2 to 1 should we connect to another network.
 992                  */
 993                 if (was_disabled != 2) {
 994                         ssid->disabled = ssid != selected;
 995                         if (was_disabled != ssid->disabled) {
 996                                 if (ssid->disabled)
 997                                         ssid->disabled_for_connect = 1;
 998                                 wpas_notify_network_enabled_changed(wpa_s,
 999                                                                     ssid);
1000                         }
1001                 }
1002                 ssid = ssid->next;
1003         }
1004 }
1005
1006
1007 static void wpas_wps_reassoc(struct wpa_supplicant *wpa_s,
1008                              struct wpa_ssid *selected, const u8 *bssid,
1009                              int freq)
1010 {
1011         struct wpa_bss *bss;
1012
1013         wpa_s->after_wps = 0;
1014         wpa_s->known_wps_freq = 0;
1015         if (freq) {
1016                 wpa_s->after_wps = 5;
1017                 wpa_s->wps_freq = freq;
1018         } else if (bssid) {
1019                 bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
1020                 if (bss && bss->freq > 0) {
1021                         wpa_s->known_wps_freq = 1;
1022                         wpa_s->wps_freq = bss->freq;
1023                 }
1024         }
1025
1026         wpas_wps_temp_disable(wpa_s, selected);
1027
1028         wpa_s->disconnected = 0;
1029         wpa_s->reassociate = 1;
1030         wpa_s->scan_runs = 0;
1031         wpa_s->normal_scans = 0;
1032         wpa_s->wps_success = 0;
1033         wpa_s->blacklist_cleared = 0;
1034
1035         wpa_supplicant_cancel_sched_scan(wpa_s);
1036         wpa_supplicant_req_scan(wpa_s, 0, 0);
1037 }
1038
1039
1040 int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid,
1041                        int p2p_group)
1042 {
1043         struct wpa_ssid *ssid;
1044         wpas_clear_wps(wpa_s);
1045         ssid = wpas_wps_add_network(wpa_s, 0, NULL, bssid);
1046         if (ssid == NULL)
1047                 return -1;
1048         ssid->temporary = 1;
1049         ssid->p2p_group = p2p_group;
1050 #ifdef CONFIG_P2P
1051         if (p2p_group && wpa_s->go_params && wpa_s->go_params->ssid_len) {
1052                 ssid->ssid = os_zalloc(wpa_s->go_params->ssid_len + 1);
1053                 if (ssid->ssid) {
1054                         ssid->ssid_len = wpa_s->go_params->ssid_len;
1055                         os_memcpy(ssid->ssid, wpa_s->go_params->ssid,
1056                                   ssid->ssid_len);
1057                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Use specific AP "
1058                                           "SSID", ssid->ssid, ssid->ssid_len);
1059                 }
1060         }
1061 #endif /* CONFIG_P2P */
1062         if (wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0) < 0)
1063                 return -1;
1064         if (wpa_s->wps_fragment_size)
1065                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
1066         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
1067                                wpa_s, NULL);
1068         wpas_wps_reassoc(wpa_s, ssid, bssid, 0);
1069         return 0;
1070 }
1071
1072
1073 static int wpas_wps_start_dev_pw(struct wpa_supplicant *wpa_s,
1074                                  const u8 *dev_addr, const u8 *bssid,
1075                                  const char *pin, int p2p_group, u16 dev_pw_id,
1076                                  const u8 *peer_pubkey_hash,
1077                                  const u8 *ssid_val, size_t ssid_len, int freq)
1078 {
1079         struct wpa_ssid *ssid;
1080         char val[128 + 2 * WPS_OOB_PUBKEY_HASH_LEN];
1081         unsigned int rpin = 0;
1082         char hash[2 * WPS_OOB_PUBKEY_HASH_LEN + 10];
1083
1084         wpas_clear_wps(wpa_s);
1085         if (bssid && is_zero_ether_addr(bssid))
1086                 bssid = NULL;
1087         ssid = wpas_wps_add_network(wpa_s, 0, dev_addr, bssid);
1088         if (ssid == NULL) {
1089                 wpa_printf(MSG_DEBUG, "WPS: Could not add network");
1090                 return -1;
1091         }
1092         ssid->temporary = 1;
1093         ssid->p2p_group = p2p_group;
1094         if (ssid_val) {
1095                 ssid->ssid = os_malloc(ssid_len);
1096                 if (ssid->ssid) {
1097                         os_memcpy(ssid->ssid, ssid_val, ssid_len);
1098                         ssid->ssid_len = ssid_len;
1099                 }
1100         }
1101         if (peer_pubkey_hash) {
1102                 os_memcpy(hash, " pkhash=", 8);
1103                 wpa_snprintf_hex_uppercase(hash + 8, sizeof(hash) - 8,
1104                                            peer_pubkey_hash,
1105                                            WPS_OOB_PUBKEY_HASH_LEN);
1106         } else {
1107                 hash[0] = '\0';
1108         }
1109 #ifdef CONFIG_P2P
1110         if (p2p_group && wpa_s->go_params && wpa_s->go_params->ssid_len) {
1111                 ssid->ssid = os_zalloc(wpa_s->go_params->ssid_len + 1);
1112                 if (ssid->ssid) {
1113                         ssid->ssid_len = wpa_s->go_params->ssid_len;
1114                         os_memcpy(ssid->ssid, wpa_s->go_params->ssid,
1115                                   ssid->ssid_len);
1116                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Use specific AP "
1117                                           "SSID", ssid->ssid, ssid->ssid_len);
1118                 }
1119         }
1120 #endif /* CONFIG_P2P */
1121         if (pin)
1122                 os_snprintf(val, sizeof(val), "\"pin=%s dev_pw_id=%u%s\"",
1123                             pin, dev_pw_id, hash);
1124         else if (pin == NULL && dev_pw_id == DEV_PW_NFC_CONNECTION_HANDOVER) {
1125                 os_snprintf(val, sizeof(val), "\"dev_pw_id=%u%s\"",
1126                             dev_pw_id, hash);
1127         } else {
1128                 rpin = wps_generate_pin();
1129                 os_snprintf(val, sizeof(val), "\"pin=%08d dev_pw_id=%u%s\"",
1130                             rpin, dev_pw_id, hash);
1131         }
1132         if (wpa_config_set(ssid, "phase1", val, 0) < 0) {
1133                 wpa_printf(MSG_DEBUG, "WPS: Failed to set phase1 '%s'", val);
1134                 return -1;
1135         }
1136         if (wpa_s->wps_fragment_size)
1137                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
1138         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
1139                                wpa_s, NULL);
1140         wpa_s->wps_ap_iter = 1;
1141         wpas_wps_reassoc(wpa_s, ssid, bssid, freq);
1142         return rpin;
1143 }
1144
1145
1146 int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid,
1147                        const char *pin, int p2p_group, u16 dev_pw_id)
1148 {
1149         return wpas_wps_start_dev_pw(wpa_s, NULL, bssid, pin, p2p_group,
1150                                      dev_pw_id, NULL, NULL, 0, 0);
1151 }
1152
1153
1154 /* Cancel the wps pbc/pin requests */
1155 int wpas_wps_cancel(struct wpa_supplicant *wpa_s)
1156 {
1157 #ifdef CONFIG_AP
1158         if (wpa_s->ap_iface) {
1159                 wpa_printf(MSG_DEBUG, "WPS: Cancelling in AP mode");
1160                 return wpa_supplicant_ap_wps_cancel(wpa_s);
1161         }
1162 #endif /* CONFIG_AP */
1163
1164         if (wpa_s->wpa_state == WPA_SCANNING ||
1165             wpa_s->wpa_state == WPA_DISCONNECTED) {
1166                 wpa_printf(MSG_DEBUG, "WPS: Cancel operation - cancel scan");
1167                 wpa_supplicant_cancel_scan(wpa_s);
1168                 wpas_clear_wps(wpa_s);
1169         } else if (wpa_s->wpa_state >= WPA_ASSOCIATED) {
1170                 wpa_printf(MSG_DEBUG, "WPS: Cancel operation - "
1171                            "deauthenticate");
1172                 wpa_supplicant_deauthenticate(wpa_s,
1173                                               WLAN_REASON_DEAUTH_LEAVING);
1174                 wpas_clear_wps(wpa_s);
1175         } else {
1176                 wpas_wps_reenable_networks(wpa_s);
1177                 wpas_wps_clear_ap_info(wpa_s);
1178                 if (eloop_cancel_timeout(wpas_wps_clear_timeout, wpa_s, NULL) >
1179                     0)
1180                         wpas_clear_wps(wpa_s);
1181         }
1182
1183         wpa_s->after_wps = 0;
1184
1185         return 0;
1186 }
1187
1188
1189 int wpas_wps_start_reg(struct wpa_supplicant *wpa_s, const u8 *bssid,
1190                        const char *pin, struct wps_new_ap_settings *settings)
1191 {
1192         struct wpa_ssid *ssid;
1193         char val[200];
1194         char *pos, *end;
1195         int res;
1196
1197         if (!pin)
1198                 return -1;
1199         wpas_clear_wps(wpa_s);
1200         ssid = wpas_wps_add_network(wpa_s, 1, NULL, bssid);
1201         if (ssid == NULL)
1202                 return -1;
1203         ssid->temporary = 1;
1204         pos = val;
1205         end = pos + sizeof(val);
1206         res = os_snprintf(pos, end - pos, "\"pin=%s", pin);
1207         if (res < 0 || res >= end - pos)
1208                 return -1;
1209         pos += res;
1210         if (settings) {
1211                 res = os_snprintf(pos, end - pos, " new_ssid=%s new_auth=%s "
1212                                   "new_encr=%s new_key=%s",
1213                                   settings->ssid_hex, settings->auth,
1214                                   settings->encr, settings->key_hex);
1215                 if (res < 0 || res >= end - pos)
1216                         return -1;
1217                 pos += res;
1218         }
1219         res = os_snprintf(pos, end - pos, "\"");
1220         if (res < 0 || res >= end - pos)
1221                 return -1;
1222         if (wpa_config_set(ssid, "phase1", val, 0) < 0)
1223                 return -1;
1224         if (wpa_s->wps_fragment_size)
1225                 ssid->eap.fragment_size = wpa_s->wps_fragment_size;
1226         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
1227                                wpa_s, NULL);
1228         wpas_wps_reassoc(wpa_s, ssid, bssid, 0);
1229         return 0;
1230 }
1231
1232
1233 static int wpas_wps_new_psk_cb(void *ctx, const u8 *mac_addr,
1234                                const u8 *p2p_dev_addr, const u8 *psk,
1235                                size_t psk_len)
1236 {
1237         if (is_zero_ether_addr(p2p_dev_addr)) {
1238                 wpa_printf(MSG_DEBUG,
1239                            "Received new WPA/WPA2-PSK from WPS for STA " MACSTR,
1240                            MAC2STR(mac_addr));
1241         } else {
1242                 wpa_printf(MSG_DEBUG,
1243                            "Received new WPA/WPA2-PSK from WPS for STA " MACSTR
1244                            " P2P Device Addr " MACSTR,
1245                            MAC2STR(mac_addr), MAC2STR(p2p_dev_addr));
1246         }
1247         wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
1248
1249         /* TODO */
1250
1251         return 0;
1252 }
1253
1254
1255 static void wpas_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
1256                                    const struct wps_device_data *dev)
1257 {
1258         char uuid[40], txt[400];
1259         int len;
1260         char devtype[WPS_DEV_TYPE_BUFSIZE];
1261         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
1262                 return;
1263         wpa_printf(MSG_DEBUG, "WPS: PIN needed for UUID-E %s", uuid);
1264         len = os_snprintf(txt, sizeof(txt), "WPS-EVENT-PIN-NEEDED %s " MACSTR
1265                           " [%s|%s|%s|%s|%s|%s]",
1266                           uuid, MAC2STR(dev->mac_addr), dev->device_name,
1267                           dev->manufacturer, dev->model_name,
1268                           dev->model_number, dev->serial_number,
1269                           wps_dev_type_bin2str(dev->pri_dev_type, devtype,
1270                                                sizeof(devtype)));
1271         if (len > 0 && len < (int) sizeof(txt))
1272                 wpa_printf(MSG_INFO, "%s", txt);
1273 }
1274
1275
1276 static void wpas_wps_set_sel_reg_cb(void *ctx, int sel_reg, u16 dev_passwd_id,
1277                                     u16 sel_reg_config_methods)
1278 {
1279 #ifdef CONFIG_WPS_ER
1280         struct wpa_supplicant *wpa_s = ctx;
1281
1282         if (wpa_s->wps_er == NULL)
1283                 return;
1284         wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar - sel_reg=%d "
1285                    "dev_password_id=%u sel_reg_config_methods=0x%x",
1286                    sel_reg, dev_passwd_id, sel_reg_config_methods);
1287         wps_er_set_sel_reg(wpa_s->wps_er, sel_reg, dev_passwd_id,
1288                            sel_reg_config_methods);
1289 #endif /* CONFIG_WPS_ER */
1290 }
1291
1292
1293 static u16 wps_fix_config_methods(u16 config_methods)
1294 {
1295         if ((config_methods &
1296              (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY |
1297               WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) {
1298                 wpa_printf(MSG_INFO, "WPS: Converting display to "
1299                            "virtual_display for WPS 2.0 compliance");
1300                 config_methods |= WPS_CONFIG_VIRT_DISPLAY;
1301         }
1302         if ((config_methods &
1303              (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON |
1304               WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) {
1305                 wpa_printf(MSG_INFO, "WPS: Converting push_button to "
1306                            "virtual_push_button for WPS 2.0 compliance");
1307                 config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
1308         }
1309
1310         return config_methods;
1311 }
1312
1313
1314 static void wpas_wps_set_uuid(struct wpa_supplicant *wpa_s,
1315                               struct wps_context *wps)
1316 {
1317         char buf[50];
1318         const char *src;
1319
1320         if (is_nil_uuid(wpa_s->conf->uuid)) {
1321                 struct wpa_supplicant *first;
1322                 first = wpa_s->global->ifaces;
1323                 while (first && first->next)
1324                         first = first->next;
1325                 if (first && first != wpa_s) {
1326                         if (wps != wpa_s->global->ifaces->wps)
1327                                 os_memcpy(wps->uuid,
1328                                           wpa_s->global->ifaces->wps->uuid,
1329                                           WPS_UUID_LEN);
1330                         src = "from the first interface";
1331                 } else {
1332                         uuid_gen_mac_addr(wpa_s->own_addr, wps->uuid);
1333                         src = "based on MAC address";
1334                 }
1335         } else {
1336                 os_memcpy(wps->uuid, wpa_s->conf->uuid, WPS_UUID_LEN);
1337                 src = "based on configuration";
1338         }
1339
1340         uuid_bin2str(wps->uuid, buf, sizeof(buf));
1341         wpa_dbg(wpa_s, MSG_DEBUG, "WPS: UUID %s: %s", src, buf);
1342 }
1343
1344
1345 static void wpas_wps_set_vendor_ext_m1(struct wpa_supplicant *wpa_s,
1346                                        struct wps_context *wps)
1347 {
1348         wpabuf_free(wps->dev.vendor_ext_m1);
1349         wps->dev.vendor_ext_m1 = NULL;
1350
1351         if (wpa_s->conf->wps_vendor_ext_m1) {
1352                 wps->dev.vendor_ext_m1 =
1353                         wpabuf_dup(wpa_s->conf->wps_vendor_ext_m1);
1354                 if (!wps->dev.vendor_ext_m1) {
1355                         wpa_printf(MSG_ERROR, "WPS: Cannot "
1356                                    "allocate memory for vendor_ext_m1");
1357                 }
1358         }
1359 }
1360
1361
1362 int wpas_wps_init(struct wpa_supplicant *wpa_s)
1363 {
1364         struct wps_context *wps;
1365         struct wps_registrar_config rcfg;
1366         struct hostapd_hw_modes *modes;
1367         u16 m;
1368
1369         wps = os_zalloc(sizeof(*wps));
1370         if (wps == NULL)
1371                 return -1;
1372
1373         wps->cred_cb = wpa_supplicant_wps_cred;
1374         wps->event_cb = wpa_supplicant_wps_event;
1375         wps->rf_band_cb = wpa_supplicant_wps_rf_band;
1376         wps->cb_ctx = wpa_s;
1377
1378         wps->dev.device_name = wpa_s->conf->device_name;
1379         wps->dev.manufacturer = wpa_s->conf->manufacturer;
1380         wps->dev.model_name = wpa_s->conf->model_name;
1381         wps->dev.model_number = wpa_s->conf->model_number;
1382         wps->dev.serial_number = wpa_s->conf->serial_number;
1383         wps->config_methods =
1384                 wps_config_methods_str2bin(wpa_s->conf->config_methods);
1385         if ((wps->config_methods & (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) ==
1386             (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) {
1387                 wpa_printf(MSG_ERROR, "WPS: Both Label and Display config "
1388                            "methods are not allowed at the same time");
1389                 os_free(wps);
1390                 return -1;
1391         }
1392         wps->config_methods = wps_fix_config_methods(wps->config_methods);
1393         wps->dev.config_methods = wps->config_methods;
1394         os_memcpy(wps->dev.pri_dev_type, wpa_s->conf->device_type,
1395                   WPS_DEV_TYPE_LEN);
1396
1397         wps->dev.num_sec_dev_types = wpa_s->conf->num_sec_device_types;
1398         os_memcpy(wps->dev.sec_dev_type, wpa_s->conf->sec_device_type,
1399                   WPS_DEV_TYPE_LEN * wps->dev.num_sec_dev_types);
1400
1401         wpas_wps_set_vendor_ext_m1(wpa_s, wps);
1402
1403         wps->dev.os_version = WPA_GET_BE32(wpa_s->conf->os_version);
1404         modes = wpa_s->hw.modes;
1405         if (modes) {
1406                 for (m = 0; m < wpa_s->hw.num_modes; m++) {
1407                         if (modes[m].mode == HOSTAPD_MODE_IEEE80211B ||
1408                             modes[m].mode == HOSTAPD_MODE_IEEE80211G)
1409                                 wps->dev.rf_bands |= WPS_RF_24GHZ;
1410                         else if (modes[m].mode == HOSTAPD_MODE_IEEE80211A)
1411                                 wps->dev.rf_bands |= WPS_RF_50GHZ;
1412                 }
1413         }
1414         if (wps->dev.rf_bands == 0) {
1415                 /*
1416                  * Default to claiming support for both bands if the driver
1417                  * does not provide support for fetching supported bands.
1418                  */
1419                 wps->dev.rf_bands = WPS_RF_24GHZ | WPS_RF_50GHZ;
1420         }
1421         os_memcpy(wps->dev.mac_addr, wpa_s->own_addr, ETH_ALEN);
1422         wpas_wps_set_uuid(wpa_s, wps);
1423
1424         wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
1425         wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
1426
1427         os_memset(&rcfg, 0, sizeof(rcfg));
1428         rcfg.new_psk_cb = wpas_wps_new_psk_cb;
1429         rcfg.pin_needed_cb = wpas_wps_pin_needed_cb;
1430         rcfg.set_sel_reg_cb = wpas_wps_set_sel_reg_cb;
1431         rcfg.cb_ctx = wpa_s;
1432
1433         wps->registrar = wps_registrar_init(wps, &rcfg);
1434         if (wps->registrar == NULL) {
1435                 wpa_printf(MSG_DEBUG, "Failed to initialize WPS Registrar");
1436                 os_free(wps);
1437                 return -1;
1438         }
1439
1440         wpa_s->wps = wps;
1441
1442         return 0;
1443 }
1444
1445
1446 #ifdef CONFIG_WPS_ER
1447 static void wpas_wps_nfc_clear(struct wps_context *wps)
1448 {
1449         wps->ap_nfc_dev_pw_id = 0;
1450         wpabuf_free(wps->ap_nfc_dh_pubkey);
1451         wps->ap_nfc_dh_pubkey = NULL;
1452         wpabuf_free(wps->ap_nfc_dh_privkey);
1453         wps->ap_nfc_dh_privkey = NULL;
1454         wpabuf_free(wps->ap_nfc_dev_pw);
1455         wps->ap_nfc_dev_pw = NULL;
1456 }
1457 #endif /* CONFIG_WPS_ER */
1458
1459
1460 void wpas_wps_deinit(struct wpa_supplicant *wpa_s)
1461 {
1462         wpas_wps_assoc_with_cred_cancel(wpa_s);
1463         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
1464         eloop_cancel_timeout(wpas_wps_clear_timeout, wpa_s, NULL);
1465         eloop_cancel_timeout(wpas_wps_reenable_networks_cb, wpa_s, NULL);
1466         wpas_wps_clear_ap_info(wpa_s);
1467
1468         if (wpa_s->wps == NULL)
1469                 return;
1470
1471 #ifdef CONFIG_WPS_ER
1472         wps_er_deinit(wpa_s->wps_er, NULL, NULL);
1473         wpa_s->wps_er = NULL;
1474         wpas_wps_nfc_clear(wpa_s->wps);
1475 #endif /* CONFIG_WPS_ER */
1476
1477         wps_registrar_deinit(wpa_s->wps->registrar);
1478         wpabuf_free(wpa_s->wps->dh_pubkey);
1479         wpabuf_free(wpa_s->wps->dh_privkey);
1480         wpabuf_free(wpa_s->wps->dev.vendor_ext_m1);
1481         os_free(wpa_s->wps->network_key);
1482         os_free(wpa_s->wps);
1483         wpa_s->wps = NULL;
1484 }
1485
1486
1487 int wpas_wps_ssid_bss_match(struct wpa_supplicant *wpa_s,
1488                             struct wpa_ssid *ssid, struct wpa_bss *bss)
1489 {
1490         struct wpabuf *wps_ie;
1491
1492         if (!(ssid->key_mgmt & WPA_KEY_MGMT_WPS))
1493                 return -1;
1494
1495         wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1496         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
1497                 if (!wps_ie) {
1498                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
1499                         return 0;
1500                 }
1501
1502                 if (!wps_is_selected_pbc_registrar(wps_ie)) {
1503                         wpa_printf(MSG_DEBUG, "   skip - WPS AP "
1504                                    "without active PBC Registrar");
1505                         wpabuf_free(wps_ie);
1506                         return 0;
1507                 }
1508
1509                 /* TODO: overlap detection */
1510                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
1511                            "(Active PBC)");
1512                 wpabuf_free(wps_ie);
1513                 return 1;
1514         }
1515
1516         if (eap_is_wps_pin_enrollee(&ssid->eap)) {
1517                 if (!wps_ie) {
1518                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
1519                         return 0;
1520                 }
1521
1522                 /*
1523                  * Start with WPS APs that advertise our address as an
1524                  * authorized MAC (v2.0) or active PIN Registrar (v1.0) and
1525                  * allow any WPS AP after couple of scans since some APs do not
1526                  * set Selected Registrar attribute properly when using
1527                  * external Registrar.
1528                  */
1529                 if (!wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1)) {
1530                         if (wpa_s->scan_runs < WPS_PIN_SCAN_IGNORE_SEL_REG) {
1531                                 wpa_printf(MSG_DEBUG, "   skip - WPS AP "
1532                                            "without active PIN Registrar");
1533                                 wpabuf_free(wps_ie);
1534                                 return 0;
1535                         }
1536                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
1537                 } else {
1538                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
1539                                    "(Authorized MAC or Active PIN)");
1540                 }
1541                 wpabuf_free(wps_ie);
1542                 return 1;
1543         }
1544
1545         if (wps_ie) {
1546                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
1547                 wpabuf_free(wps_ie);
1548                 return 1;
1549         }
1550
1551         return -1;
1552 }
1553
1554
1555 int wpas_wps_ssid_wildcard_ok(struct wpa_supplicant *wpa_s,
1556                               struct wpa_ssid *ssid,
1557                               struct wpa_bss *bss)
1558 {
1559         struct wpabuf *wps_ie = NULL;
1560         int ret = 0;
1561
1562         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
1563                 wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1564                 if (wps_ie && wps_is_selected_pbc_registrar(wps_ie)) {
1565                         /* allow wildcard SSID for WPS PBC */
1566                         ret = 1;
1567                 }
1568         } else if (eap_is_wps_pin_enrollee(&ssid->eap)) {
1569                 wps_ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1570                 if (wps_ie &&
1571                     (wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1) ||
1572                      wpa_s->scan_runs >= WPS_PIN_SCAN_IGNORE_SEL_REG)) {
1573                         /* allow wildcard SSID for WPS PIN */
1574                         ret = 1;
1575                 }
1576         }
1577
1578         if (!ret && ssid->bssid_set &&
1579             os_memcmp(ssid->bssid, bss->bssid, ETH_ALEN) == 0) {
1580                 /* allow wildcard SSID due to hardcoded BSSID match */
1581                 ret = 1;
1582         }
1583
1584 #ifdef CONFIG_WPS_STRICT
1585         if (wps_ie) {
1586                 if (wps_validate_beacon_probe_resp(wps_ie, bss->beacon_ie_len >
1587                                                    0, bss->bssid) < 0)
1588                         ret = 0;
1589                 if (bss->beacon_ie_len) {
1590                         struct wpabuf *bcn_wps;
1591                         bcn_wps = wpa_bss_get_vendor_ie_multi_beacon(
1592                                 bss, WPS_IE_VENDOR_TYPE);
1593                         if (bcn_wps == NULL) {
1594                                 wpa_printf(MSG_DEBUG, "WPS: Mandatory WPS IE "
1595                                            "missing from AP Beacon");
1596                                 ret = 0;
1597                         } else {
1598                                 if (wps_validate_beacon(wps_ie) < 0)
1599                                         ret = 0;
1600                                 wpabuf_free(bcn_wps);
1601                         }
1602                 }
1603         }
1604 #endif /* CONFIG_WPS_STRICT */
1605
1606         wpabuf_free(wps_ie);
1607
1608         return ret;
1609 }
1610
1611
1612 int wpas_wps_scan_pbc_overlap(struct wpa_supplicant *wpa_s,
1613                               struct wpa_bss *selected, struct wpa_ssid *ssid)
1614 {
1615         const u8 *sel_uuid, *uuid;
1616         struct wpabuf *wps_ie;
1617         int ret = 0;
1618         struct wpa_bss *bss;
1619
1620         if (!eap_is_wps_pbc_enrollee(&ssid->eap))
1621                 return 0;
1622
1623         wpa_printf(MSG_DEBUG, "WPS: Check whether PBC session overlap is "
1624                    "present in scan results; selected BSSID " MACSTR,
1625                    MAC2STR(selected->bssid));
1626
1627         /* Make sure that only one AP is in active PBC mode */
1628         wps_ie = wpa_bss_get_vendor_ie_multi(selected, WPS_IE_VENDOR_TYPE);
1629         if (wps_ie) {
1630                 sel_uuid = wps_get_uuid_e(wps_ie);
1631                 wpa_hexdump(MSG_DEBUG, "WPS: UUID of the selected BSS",
1632                             sel_uuid, UUID_LEN);
1633         } else {
1634                 wpa_printf(MSG_DEBUG, "WPS: Selected BSS does not include "
1635                            "WPS IE?!");
1636                 sel_uuid = NULL;
1637         }
1638
1639         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1640                 struct wpabuf *ie;
1641                 if (bss == selected)
1642                         continue;
1643                 ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1644                 if (!ie)
1645                         continue;
1646                 if (!wps_is_selected_pbc_registrar(ie)) {
1647                         wpabuf_free(ie);
1648                         continue;
1649                 }
1650                 wpa_printf(MSG_DEBUG, "WPS: Another BSS in active PBC mode: "
1651                            MACSTR, MAC2STR(bss->bssid));
1652                 uuid = wps_get_uuid_e(ie);
1653                 wpa_hexdump(MSG_DEBUG, "WPS: UUID of the other BSS",
1654                             uuid, UUID_LEN);
1655                 if (sel_uuid == NULL || uuid == NULL ||
1656                     os_memcmp(sel_uuid, uuid, UUID_LEN) != 0) {
1657                         ret = 1; /* PBC overlap */
1658                         wpa_msg(wpa_s, MSG_INFO, "WPS: PBC overlap detected: "
1659                                 MACSTR " and " MACSTR,
1660                                 MAC2STR(selected->bssid),
1661                                 MAC2STR(bss->bssid));
1662                         wpabuf_free(ie);
1663                         break;
1664                 }
1665
1666                 /* TODO: verify that this is reasonable dual-band situation */
1667
1668                 wpabuf_free(ie);
1669         }
1670
1671         wpabuf_free(wps_ie);
1672
1673         return ret;
1674 }
1675
1676
1677 void wpas_wps_notify_scan_results(struct wpa_supplicant *wpa_s)
1678 {
1679         struct wpa_bss *bss;
1680         unsigned int pbc = 0, auth = 0, pin = 0, wps = 0;
1681
1682         if (wpa_s->disconnected || wpa_s->wpa_state >= WPA_ASSOCIATED)
1683                 return;
1684
1685         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1686                 struct wpabuf *ie;
1687                 ie = wpa_bss_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
1688                 if (!ie)
1689                         continue;
1690                 if (wps_is_selected_pbc_registrar(ie))
1691                         pbc++;
1692                 else if (wps_is_addr_authorized(ie, wpa_s->own_addr, 0))
1693                         auth++;
1694                 else if (wps_is_selected_pin_registrar(ie))
1695                         pin++;
1696                 else
1697                         wps++;
1698                 wpabuf_free(ie);
1699         }
1700
1701         if (pbc)
1702                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PBC);
1703         else if (auth)
1704                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_AUTH);
1705         else if (pin)
1706                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PIN);
1707         else if (wps)
1708                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE);
1709 }
1710
1711
1712 int wpas_wps_searching(struct wpa_supplicant *wpa_s)
1713 {
1714         struct wpa_ssid *ssid;
1715
1716         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1717                 if ((ssid->key_mgmt & WPA_KEY_MGMT_WPS) && !ssid->disabled)
1718                         return 1;
1719         }
1720
1721         return 0;
1722 }
1723
1724
1725 int wpas_wps_scan_result_text(const u8 *ies, size_t ies_len, char *buf,
1726                               char *end)
1727 {
1728         struct wpabuf *wps_ie;
1729         int ret;
1730
1731         wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len, WPS_DEV_OUI_WFA);
1732         if (wps_ie == NULL)
1733                 return 0;
1734
1735         ret = wps_attr_text(wps_ie, buf, end);
1736         wpabuf_free(wps_ie);
1737         return ret;
1738 }
1739
1740
1741 int wpas_wps_er_start(struct wpa_supplicant *wpa_s, const char *filter)
1742 {
1743 #ifdef CONFIG_WPS_ER
1744         if (wpa_s->wps_er) {
1745                 wps_er_refresh(wpa_s->wps_er);
1746                 return 0;
1747         }
1748         wpa_s->wps_er = wps_er_init(wpa_s->wps, wpa_s->ifname, filter);
1749         if (wpa_s->wps_er == NULL)
1750                 return -1;
1751         return 0;
1752 #else /* CONFIG_WPS_ER */
1753         return 0;
1754 #endif /* CONFIG_WPS_ER */
1755 }
1756
1757
1758 int wpas_wps_er_stop(struct wpa_supplicant *wpa_s)
1759 {
1760 #ifdef CONFIG_WPS_ER
1761         wps_er_deinit(wpa_s->wps_er, NULL, NULL);
1762         wpa_s->wps_er = NULL;
1763 #endif /* CONFIG_WPS_ER */
1764         return 0;
1765 }
1766
1767
1768 #ifdef CONFIG_WPS_ER
1769 int wpas_wps_er_add_pin(struct wpa_supplicant *wpa_s, const u8 *addr,
1770                         const char *uuid, const char *pin)
1771 {
1772         u8 u[UUID_LEN];
1773         const u8 *use_uuid = NULL;
1774         u8 addr_buf[ETH_ALEN];
1775
1776         if (os_strcmp(uuid, "any") == 0) {
1777         } else if (uuid_str2bin(uuid, u) == 0) {
1778                 use_uuid = u;
1779         } else if (hwaddr_aton(uuid, addr_buf) == 0) {
1780                 use_uuid = wps_er_get_sta_uuid(wpa_s->wps_er, addr_buf);
1781                 if (use_uuid == NULL)
1782                         return -1;
1783         } else
1784                 return -1;
1785         return wps_registrar_add_pin(wpa_s->wps->registrar, addr,
1786                                      use_uuid,
1787                                      (const u8 *) pin, os_strlen(pin), 300);
1788 }
1789
1790
1791 int wpas_wps_er_pbc(struct wpa_supplicant *wpa_s, const char *uuid)
1792 {
1793         u8 u[UUID_LEN], *use_uuid = NULL;
1794         u8 addr[ETH_ALEN], *use_addr = NULL;
1795
1796         if (uuid_str2bin(uuid, u) == 0)
1797                 use_uuid = u;
1798         else if (hwaddr_aton(uuid, addr) == 0)
1799                 use_addr = addr;
1800         else
1801                 return -1;
1802         return wps_er_pbc(wpa_s->wps_er, use_uuid, use_addr);
1803 }
1804
1805
1806 int wpas_wps_er_learn(struct wpa_supplicant *wpa_s, const char *uuid,
1807                       const char *pin)
1808 {
1809         u8 u[UUID_LEN], *use_uuid = NULL;
1810         u8 addr[ETH_ALEN], *use_addr = NULL;
1811
1812         if (uuid_str2bin(uuid, u) == 0)
1813                 use_uuid = u;
1814         else if (hwaddr_aton(uuid, addr) == 0)
1815                 use_addr = addr;
1816         else
1817                 return -1;
1818
1819         return wps_er_learn(wpa_s->wps_er, use_uuid, use_addr, (const u8 *) pin,
1820                             os_strlen(pin));
1821 }
1822
1823
1824 static int wpas_wps_network_to_cred(struct wpa_ssid *ssid,
1825                                     struct wps_credential *cred)
1826 {
1827         os_memset(cred, 0, sizeof(*cred));
1828         if (ssid->ssid_len > 32)
1829                 return -1;
1830         os_memcpy(cred->ssid, ssid->ssid, ssid->ssid_len);
1831         cred->ssid_len = ssid->ssid_len;
1832         if (ssid->key_mgmt & WPA_KEY_MGMT_PSK) {
1833                 cred->auth_type = (ssid->proto & WPA_PROTO_RSN) ?
1834                         WPS_AUTH_WPA2PSK : WPS_AUTH_WPAPSK;
1835                 if (ssid->pairwise_cipher & WPA_CIPHER_CCMP)
1836                         cred->encr_type = WPS_ENCR_AES;
1837                 else
1838                         cred->encr_type = WPS_ENCR_TKIP;
1839                 if (ssid->passphrase) {
1840                         cred->key_len = os_strlen(ssid->passphrase);
1841                         if (cred->key_len >= 64)
1842                                 return -1;
1843                         os_memcpy(cred->key, ssid->passphrase, cred->key_len);
1844                 } else if (ssid->psk_set) {
1845                         cred->key_len = 32;
1846                         os_memcpy(cred->key, ssid->psk, 32);
1847                 } else
1848                         return -1;
1849         } else {
1850                 cred->auth_type = WPS_AUTH_OPEN;
1851                 cred->encr_type = WPS_ENCR_NONE;
1852         }
1853
1854         return 0;
1855 }
1856
1857
1858 int wpas_wps_er_set_config(struct wpa_supplicant *wpa_s, const char *uuid,
1859                            int id)
1860 {
1861         u8 u[UUID_LEN], *use_uuid = NULL;
1862         u8 addr[ETH_ALEN], *use_addr = NULL;
1863         struct wpa_ssid *ssid;
1864         struct wps_credential cred;
1865
1866         if (uuid_str2bin(uuid, u) == 0)
1867                 use_uuid = u;
1868         else if (hwaddr_aton(uuid, addr) == 0)
1869                 use_addr = addr;
1870         else
1871                 return -1;
1872         ssid = wpa_config_get_network(wpa_s->conf, id);
1873         if (ssid == NULL || ssid->ssid == NULL)
1874                 return -1;
1875
1876         if (wpas_wps_network_to_cred(ssid, &cred) < 0)
1877                 return -1;
1878         return wps_er_set_config(wpa_s->wps_er, use_uuid, use_addr, &cred);
1879 }
1880
1881
1882 int wpas_wps_er_config(struct wpa_supplicant *wpa_s, const char *uuid,
1883                        const char *pin, struct wps_new_ap_settings *settings)
1884 {
1885         u8 u[UUID_LEN], *use_uuid = NULL;
1886         u8 addr[ETH_ALEN], *use_addr = NULL;
1887         struct wps_credential cred;
1888         size_t len;
1889
1890         if (uuid_str2bin(uuid, u) == 0)
1891                 use_uuid = u;
1892         else if (hwaddr_aton(uuid, addr) == 0)
1893                 use_addr = addr;
1894         else
1895                 return -1;
1896         if (settings->ssid_hex == NULL || settings->auth == NULL ||
1897             settings->encr == NULL || settings->key_hex == NULL)
1898                 return -1;
1899
1900         os_memset(&cred, 0, sizeof(cred));
1901         len = os_strlen(settings->ssid_hex);
1902         if ((len & 1) || len > 2 * sizeof(cred.ssid) ||
1903             hexstr2bin(settings->ssid_hex, cred.ssid, len / 2))
1904                 return -1;
1905         cred.ssid_len = len / 2;
1906
1907         len = os_strlen(settings->key_hex);
1908         if ((len & 1) || len > 2 * sizeof(cred.key) ||
1909             hexstr2bin(settings->key_hex, cred.key, len / 2))
1910                 return -1;
1911         cred.key_len = len / 2;
1912
1913         if (os_strcmp(settings->auth, "OPEN") == 0)
1914                 cred.auth_type = WPS_AUTH_OPEN;
1915         else if (os_strcmp(settings->auth, "WPAPSK") == 0)
1916                 cred.auth_type = WPS_AUTH_WPAPSK;
1917         else if (os_strcmp(settings->auth, "WPA2PSK") == 0)
1918                 cred.auth_type = WPS_AUTH_WPA2PSK;
1919         else
1920                 return -1;
1921
1922         if (os_strcmp(settings->encr, "NONE") == 0)
1923                 cred.encr_type = WPS_ENCR_NONE;
1924 #ifdef CONFIG_TESTING_OPTIONS
1925         else if (os_strcmp(settings->encr, "WEP") == 0)
1926                 cred.encr_type = WPS_ENCR_WEP;
1927 #endif /* CONFIG_TESTING_OPTIONS */
1928         else if (os_strcmp(settings->encr, "TKIP") == 0)
1929                 cred.encr_type = WPS_ENCR_TKIP;
1930         else if (os_strcmp(settings->encr, "CCMP") == 0)
1931                 cred.encr_type = WPS_ENCR_AES;
1932         else
1933                 return -1;
1934
1935         return wps_er_config(wpa_s->wps_er, use_uuid, use_addr,
1936                              (const u8 *) pin, os_strlen(pin), &cred);
1937 }
1938
1939
1940 #ifdef CONFIG_WPS_NFC
1941 struct wpabuf * wpas_wps_er_nfc_config_token(struct wpa_supplicant *wpa_s,
1942                                              int ndef, const char *uuid)
1943 {
1944         struct wpabuf *ret;
1945         u8 u[UUID_LEN], *use_uuid = NULL;
1946         u8 addr[ETH_ALEN], *use_addr = NULL;
1947
1948         if (!wpa_s->wps_er)
1949                 return NULL;
1950
1951         if (uuid_str2bin(uuid, u) == 0)
1952                 use_uuid = u;
1953         else if (hwaddr_aton(uuid, addr) == 0)
1954                 use_addr = addr;
1955         else
1956                 return NULL;
1957
1958         ret = wps_er_nfc_config_token(wpa_s->wps_er, use_uuid, use_addr);
1959         if (ndef && ret) {
1960                 struct wpabuf *tmp;
1961                 tmp = ndef_build_wifi(ret);
1962                 wpabuf_free(ret);
1963                 if (tmp == NULL)
1964                         return NULL;
1965                 ret = tmp;
1966         }
1967
1968         return ret;
1969 }
1970 #endif /* CONFIG_WPS_NFC */
1971
1972
1973 static int callbacks_pending = 0;
1974
1975 static void wpas_wps_terminate_cb(void *ctx)
1976 {
1977         wpa_printf(MSG_DEBUG, "WPS ER: Terminated");
1978         if (--callbacks_pending <= 0)
1979                 eloop_terminate();
1980 }
1981 #endif /* CONFIG_WPS_ER */
1982
1983
1984 int wpas_wps_terminate_pending(struct wpa_supplicant *wpa_s)
1985 {
1986 #ifdef CONFIG_WPS_ER
1987         if (wpa_s->wps_er) {
1988                 callbacks_pending++;
1989                 wps_er_deinit(wpa_s->wps_er, wpas_wps_terminate_cb, wpa_s);
1990                 wpa_s->wps_er = NULL;
1991                 return 1;
1992         }
1993 #endif /* CONFIG_WPS_ER */
1994         return 0;
1995 }
1996
1997
1998 void wpas_wps_update_config(struct wpa_supplicant *wpa_s)
1999 {
2000         struct wps_context *wps = wpa_s->wps;
2001
2002         if (wps == NULL)
2003                 return;
2004
2005         if (wpa_s->conf->changed_parameters & CFG_CHANGED_CONFIG_METHODS) {
2006                 wps->config_methods = wps_config_methods_str2bin(
2007                         wpa_s->conf->config_methods);
2008                 if ((wps->config_methods &
2009                      (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) ==
2010                     (WPS_CONFIG_DISPLAY | WPS_CONFIG_LABEL)) {
2011                         wpa_printf(MSG_ERROR, "WPS: Both Label and Display "
2012                                    "config methods are not allowed at the "
2013                                    "same time");
2014                         wps->config_methods &= ~WPS_CONFIG_LABEL;
2015                 }
2016         }
2017         wps->config_methods = wps_fix_config_methods(wps->config_methods);
2018         wps->dev.config_methods = wps->config_methods;
2019
2020         if (wpa_s->conf->changed_parameters & CFG_CHANGED_DEVICE_TYPE)
2021                 os_memcpy(wps->dev.pri_dev_type, wpa_s->conf->device_type,
2022                           WPS_DEV_TYPE_LEN);
2023
2024         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SEC_DEVICE_TYPE) {
2025                 wps->dev.num_sec_dev_types = wpa_s->conf->num_sec_device_types;
2026                 os_memcpy(wps->dev.sec_dev_type, wpa_s->conf->sec_device_type,
2027                           wps->dev.num_sec_dev_types * WPS_DEV_TYPE_LEN);
2028         }
2029
2030         if (wpa_s->conf->changed_parameters & CFG_CHANGED_VENDOR_EXTENSION)
2031                 wpas_wps_set_vendor_ext_m1(wpa_s, wps);
2032
2033         if (wpa_s->conf->changed_parameters & CFG_CHANGED_OS_VERSION)
2034                 wps->dev.os_version = WPA_GET_BE32(wpa_s->conf->os_version);
2035
2036         if (wpa_s->conf->changed_parameters & CFG_CHANGED_UUID)
2037                 wpas_wps_set_uuid(wpa_s, wps);
2038
2039         if (wpa_s->conf->changed_parameters &
2040             (CFG_CHANGED_DEVICE_NAME | CFG_CHANGED_WPS_STRING)) {
2041                 /* Update pointers to make sure they refer current values */
2042                 wps->dev.device_name = wpa_s->conf->device_name;
2043                 wps->dev.manufacturer = wpa_s->conf->manufacturer;
2044                 wps->dev.model_name = wpa_s->conf->model_name;
2045                 wps->dev.model_number = wpa_s->conf->model_number;
2046                 wps->dev.serial_number = wpa_s->conf->serial_number;
2047         }
2048 }
2049
2050
2051 #ifdef CONFIG_WPS_NFC
2052
2053 #ifdef CONFIG_WPS_ER
2054 static struct wpabuf *
2055 wpas_wps_network_config_token(struct wpa_supplicant *wpa_s, int ndef,
2056                               struct wpa_ssid *ssid)
2057 {
2058         struct wpabuf *ret;
2059         struct wps_credential cred;
2060
2061         if (wpas_wps_network_to_cred(ssid, &cred) < 0)
2062                 return NULL;
2063
2064         ret = wps_er_config_token_from_cred(wpa_s->wps, &cred);
2065
2066         if (ndef && ret) {
2067                 struct wpabuf *tmp;
2068                 tmp = ndef_build_wifi(ret);
2069                 wpabuf_free(ret);
2070                 if (tmp == NULL)
2071                         return NULL;
2072                 ret = tmp;
2073         }
2074
2075         return ret;
2076 }
2077 #endif /* CONFIG_WPS_ER */
2078
2079
2080 struct wpabuf * wpas_wps_nfc_config_token(struct wpa_supplicant *wpa_s,
2081                                           int ndef, const char *id_str)
2082 {
2083 #ifdef CONFIG_WPS_ER
2084         if (id_str) {
2085                 int id;
2086                 char *end = NULL;
2087                 struct wpa_ssid *ssid;
2088
2089                 id = strtol(id_str, &end, 10);
2090                 if (end && *end)
2091                         return NULL;
2092
2093                 ssid = wpa_config_get_network(wpa_s->conf, id);
2094                 if (ssid == NULL)
2095                         return NULL;
2096                 return wpas_wps_network_config_token(wpa_s, ndef, ssid);
2097         }
2098 #endif /* CONFIG_WPS_ER */
2099 #ifdef CONFIG_AP
2100         if (wpa_s->ap_iface)
2101                 return wpas_ap_wps_nfc_config_token(wpa_s, ndef);
2102 #endif /* CONFIG_AP */
2103         return NULL;
2104 }
2105
2106
2107 struct wpabuf * wpas_wps_nfc_token(struct wpa_supplicant *wpa_s, int ndef)
2108 {
2109         if (wpa_s->conf->wps_nfc_pw_from_config) {
2110                 return wps_nfc_token_build(ndef,
2111                                            wpa_s->conf->wps_nfc_dev_pw_id,
2112                                            wpa_s->conf->wps_nfc_dh_pubkey,
2113                                            wpa_s->conf->wps_nfc_dev_pw);
2114         }
2115
2116         return wps_nfc_token_gen(ndef, &wpa_s->conf->wps_nfc_dev_pw_id,
2117                                  &wpa_s->conf->wps_nfc_dh_pubkey,
2118                                  &wpa_s->conf->wps_nfc_dh_privkey,
2119                                  &wpa_s->conf->wps_nfc_dev_pw);
2120 }
2121
2122
2123 int wpas_wps_start_nfc(struct wpa_supplicant *wpa_s, const u8 *go_dev_addr,
2124                        const u8 *bssid,
2125                        const struct wpabuf *dev_pw, u16 dev_pw_id,
2126                        int p2p_group, const u8 *peer_pubkey_hash,
2127                        const u8 *ssid, size_t ssid_len, int freq)
2128 {
2129         struct wps_context *wps = wpa_s->wps;
2130         char pw[32 * 2 + 1];
2131
2132         if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER && dev_pw == NULL) {
2133                 dev_pw = wpa_s->conf->wps_nfc_dev_pw;
2134                 dev_pw_id = wpa_s->conf->wps_nfc_dev_pw_id;
2135         }
2136
2137         if (wpa_s->conf->wps_nfc_dh_pubkey == NULL ||
2138             wpa_s->conf->wps_nfc_dh_privkey == NULL) {
2139                 wpa_printf(MSG_DEBUG, "WPS: Missing DH params - "
2140                            "cannot start NFC-triggered connection");
2141                 return -1;
2142         }
2143
2144         if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER && dev_pw == NULL) {
2145                 wpa_printf(MSG_DEBUG, "WPS: Missing Device Password (id=%u) - "
2146                            "cannot start NFC-triggered connection", dev_pw_id);
2147                 return -1;
2148         }
2149
2150         dh5_free(wps->dh_ctx);
2151         wpabuf_free(wps->dh_pubkey);
2152         wpabuf_free(wps->dh_privkey);
2153         wps->dh_privkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_privkey);
2154         wps->dh_pubkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_pubkey);
2155         if (wps->dh_privkey == NULL || wps->dh_pubkey == NULL) {
2156                 wps->dh_ctx = NULL;
2157                 wpabuf_free(wps->dh_pubkey);
2158                 wps->dh_pubkey = NULL;
2159                 wpabuf_free(wps->dh_privkey);
2160                 wps->dh_privkey = NULL;
2161                 wpa_printf(MSG_DEBUG, "WPS: Failed to get DH priv/pub key");
2162                 return -1;
2163         }
2164         wps->dh_ctx = dh5_init_fixed(wps->dh_privkey, wps->dh_pubkey);
2165         if (wps->dh_ctx == NULL) {
2166                 wpabuf_free(wps->dh_pubkey);
2167                 wps->dh_pubkey = NULL;
2168                 wpabuf_free(wps->dh_privkey);
2169                 wps->dh_privkey = NULL;
2170                 wpa_printf(MSG_DEBUG, "WPS: Failed to initialize DH context");
2171                 return -1;
2172         }
2173
2174         if (dev_pw) {
2175                 wpa_snprintf_hex_uppercase(pw, sizeof(pw),
2176                                            wpabuf_head(dev_pw),
2177                                            wpabuf_len(dev_pw));
2178         }
2179         return wpas_wps_start_dev_pw(wpa_s, go_dev_addr, bssid,
2180                                      dev_pw ? pw : NULL,
2181                                      p2p_group, dev_pw_id, peer_pubkey_hash,
2182                                      ssid, ssid_len, freq);
2183 }
2184
2185
2186 static int wpas_wps_use_cred(struct wpa_supplicant *wpa_s,
2187                              struct wps_parse_attr *attr)
2188 {
2189         /*
2190          * Disable existing networks temporarily to allow the newly learned
2191          * credential to be preferred. Enable the temporarily disabled networks
2192          * after 10 seconds.
2193          */
2194         wpas_wps_temp_disable(wpa_s, NULL);
2195         eloop_register_timeout(10, 0, wpas_wps_reenable_networks_cb, wpa_s,
2196                                NULL);
2197
2198         if (wps_oob_use_cred(wpa_s->wps, attr) < 0)
2199                 return -1;
2200
2201         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
2202                 return 0;
2203
2204         if (attr->ap_channel) {
2205                 u16 chan = WPA_GET_BE16(attr->ap_channel);
2206                 int freq = 0;
2207
2208                 if (chan >= 1 && chan <= 13)
2209                         freq = 2407 + 5 * chan;
2210                 else if (chan == 14)
2211                         freq = 2484;
2212                 else if (chan >= 30)
2213                         freq = 5000 + 5 * chan;
2214
2215                 if (freq) {
2216                         wpa_printf(MSG_DEBUG, "WPS: Credential container indicated AP channel %u -> %u MHz",
2217                                    chan, freq);
2218                         wpa_s->after_wps = 5;
2219                         wpa_s->wps_freq = freq;
2220                 }
2221         }
2222
2223         wpa_printf(MSG_DEBUG, "WPS: Request reconnection with new network "
2224                    "based on the received credential added");
2225         wpa_s->normal_scans = 0;
2226         wpa_supplicant_reinit_autoscan(wpa_s);
2227         wpa_s->disconnected = 0;
2228         wpa_s->reassociate = 1;
2229
2230         wpa_supplicant_cancel_sched_scan(wpa_s);
2231         wpa_supplicant_req_scan(wpa_s, 0, 0);
2232
2233         return 0;
2234 }
2235
2236
2237 #ifdef CONFIG_WPS_ER
2238 static int wpas_wps_add_nfc_password_token(struct wpa_supplicant *wpa_s,
2239                                            struct wps_parse_attr *attr)
2240 {
2241         return wps_registrar_add_nfc_password_token(
2242                 wpa_s->wps->registrar, attr->oob_dev_password,
2243                 attr->oob_dev_password_len);
2244 }
2245 #endif /* CONFIG_WPS_ER */
2246
2247
2248 static int wpas_wps_nfc_tag_process(struct wpa_supplicant *wpa_s,
2249                                     const struct wpabuf *wps)
2250 {
2251         struct wps_parse_attr attr;
2252
2253         wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps);
2254
2255         if (wps_parse_msg(wps, &attr)) {
2256                 wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag");
2257                 return -1;
2258         }
2259
2260         if (attr.num_cred)
2261                 return wpas_wps_use_cred(wpa_s, &attr);
2262
2263 #ifdef CONFIG_WPS_ER
2264         if (attr.oob_dev_password)
2265                 return wpas_wps_add_nfc_password_token(wpa_s, &attr);
2266 #endif /* CONFIG_WPS_ER */
2267
2268         wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag");
2269         return -1;
2270 }
2271
2272
2273 int wpas_wps_nfc_tag_read(struct wpa_supplicant *wpa_s,
2274                           const struct wpabuf *data, int forced_freq)
2275 {
2276         const struct wpabuf *wps = data;
2277         struct wpabuf *tmp = NULL;
2278         int ret;
2279
2280         if (wpabuf_len(data) < 4)
2281                 return -1;
2282
2283         if (*wpabuf_head_u8(data) != 0x10) {
2284                 /* Assume this contains full NDEF record */
2285                 tmp = ndef_parse_wifi(data);
2286                 if (tmp == NULL) {
2287 #ifdef CONFIG_P2P
2288                         tmp = ndef_parse_p2p(data);
2289                         if (tmp) {
2290                                 ret = wpas_p2p_nfc_tag_process(wpa_s, tmp,
2291                                                                forced_freq);
2292                                 wpabuf_free(tmp);
2293                                 return ret;
2294                         }
2295 #endif /* CONFIG_P2P */
2296                         wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF");
2297                         return -1;
2298                 }
2299                 wps = tmp;
2300         }
2301
2302         ret = wpas_wps_nfc_tag_process(wpa_s, wps);
2303         wpabuf_free(tmp);
2304         return ret;
2305 }
2306
2307
2308 struct wpabuf * wpas_wps_nfc_handover_req(struct wpa_supplicant *wpa_s,
2309                                           int ndef)
2310 {
2311         struct wpabuf *ret;
2312
2313         if (wpa_s->conf->wps_nfc_dh_pubkey == NULL &&
2314             wps_nfc_gen_dh(&wpa_s->conf->wps_nfc_dh_pubkey,
2315                            &wpa_s->conf->wps_nfc_dh_privkey) < 0)
2316                 return NULL;
2317
2318         ret = wps_build_nfc_handover_req(wpa_s->wps,
2319                                          wpa_s->conf->wps_nfc_dh_pubkey);
2320
2321         if (ndef && ret) {
2322                 struct wpabuf *tmp;
2323                 tmp = ndef_build_wifi(ret);
2324                 wpabuf_free(ret);
2325                 if (tmp == NULL)
2326                         return NULL;
2327                 ret = tmp;
2328         }
2329
2330         return ret;
2331 }
2332
2333
2334 #ifdef CONFIG_WPS_NFC
2335
2336 static struct wpabuf *
2337 wpas_wps_er_nfc_handover_sel(struct wpa_supplicant *wpa_s, int ndef,
2338                              const char *uuid)
2339 {
2340 #ifdef CONFIG_WPS_ER
2341         struct wpabuf *ret;
2342         u8 u[UUID_LEN], *use_uuid = NULL;
2343         u8 addr[ETH_ALEN], *use_addr = NULL;
2344         struct wps_context *wps = wpa_s->wps;
2345
2346         if (wps == NULL)
2347                 return NULL;
2348
2349         if (uuid == NULL)
2350                 return NULL;
2351         if (uuid_str2bin(uuid, u) == 0)
2352                 use_uuid = u;
2353         else if (hwaddr_aton(uuid, addr) == 0)
2354                 use_addr = addr;
2355         else
2356                 return NULL;
2357
2358         if (wpa_s->conf->wps_nfc_dh_pubkey == NULL) {
2359                 if (wps_nfc_gen_dh(&wpa_s->conf->wps_nfc_dh_pubkey,
2360                                    &wpa_s->conf->wps_nfc_dh_privkey) < 0)
2361                         return NULL;
2362         }
2363
2364         wpas_wps_nfc_clear(wps);
2365         wps->ap_nfc_dev_pw_id = DEV_PW_NFC_CONNECTION_HANDOVER;
2366         wps->ap_nfc_dh_pubkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_pubkey);
2367         wps->ap_nfc_dh_privkey = wpabuf_dup(wpa_s->conf->wps_nfc_dh_privkey);
2368         if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey) {
2369                 wpas_wps_nfc_clear(wps);
2370                 return NULL;
2371         }
2372
2373         ret = wps_er_nfc_handover_sel(wpa_s->wps_er, wpa_s->wps, use_uuid,
2374                                       use_addr, wpa_s->conf->wps_nfc_dh_pubkey);
2375         if (ndef && ret) {
2376                 struct wpabuf *tmp;
2377                 tmp = ndef_build_wifi(ret);
2378                 wpabuf_free(ret);
2379                 if (tmp == NULL)
2380                         return NULL;
2381                 ret = tmp;
2382         }
2383
2384         return ret;
2385 #else /* CONFIG_WPS_ER */
2386         return NULL;
2387 #endif /* CONFIG_WPS_ER */
2388 }
2389 #endif /* CONFIG_WPS_NFC */
2390
2391
2392 struct wpabuf * wpas_wps_nfc_handover_sel(struct wpa_supplicant *wpa_s,
2393                                           int ndef, int cr, const char *uuid)
2394 {
2395         struct wpabuf *ret;
2396         if (!cr)
2397                 return NULL;
2398         ret = wpas_ap_wps_nfc_handover_sel(wpa_s, ndef);
2399         if (ret)
2400                 return ret;
2401         return wpas_wps_er_nfc_handover_sel(wpa_s, ndef, uuid);
2402 }
2403
2404
2405 static int wpas_wps_nfc_rx_handover_sel(struct wpa_supplicant *wpa_s,
2406                                         const struct wpabuf *data)
2407 {
2408         struct wpabuf *wps;
2409         int ret = -1;
2410         u16 wsc_len;
2411         const u8 *pos;
2412         struct wpabuf msg;
2413         struct wps_parse_attr attr;
2414         u16 dev_pw_id;
2415         const u8 *bssid = NULL;
2416         int freq = 0;
2417
2418         wps = ndef_parse_wifi(data);
2419         if (wps == NULL)
2420                 return -1;
2421         wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
2422                    "payload from NFC connection handover");
2423         wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps);
2424         if (wpabuf_len(wps) < 2) {
2425                 wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Select "
2426                            "Message");
2427                 goto out;
2428         }
2429         pos = wpabuf_head(wps);
2430         wsc_len = WPA_GET_BE16(pos);
2431         if (wsc_len > wpabuf_len(wps) - 2) {
2432                 wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) "
2433                            "in Wi-Fi Handover Select Message", wsc_len);
2434                 goto out;
2435         }
2436         pos += 2;
2437
2438         wpa_hexdump(MSG_DEBUG,
2439                     "WPS: WSC attributes in Wi-Fi Handover Select Message",
2440                     pos, wsc_len);
2441         if (wsc_len < wpabuf_len(wps) - 2) {
2442                 wpa_hexdump(MSG_DEBUG,
2443                             "WPS: Ignore extra data after WSC attributes",
2444                             pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len);
2445         }
2446
2447         wpabuf_set(&msg, pos, wsc_len);
2448         ret = wps_parse_msg(&msg, &attr);
2449         if (ret < 0) {
2450                 wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in "
2451                            "Wi-Fi Handover Select Message");
2452                 goto out;
2453         }
2454
2455         if (attr.oob_dev_password == NULL ||
2456             attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) {
2457                 wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password "
2458                            "included in Wi-Fi Handover Select Message");
2459                 ret = -1;
2460                 goto out;
2461         }
2462
2463         if (attr.ssid == NULL) {
2464                 wpa_printf(MSG_DEBUG, "WPS: No SSID included in Wi-Fi Handover "
2465                            "Select Message");
2466                 ret = -1;
2467                 goto out;
2468         }
2469
2470         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", attr.ssid, attr.ssid_len);
2471
2472         if (attr.mac_addr) {
2473                 bssid = attr.mac_addr;
2474                 wpa_printf(MSG_DEBUG, "WPS: MAC Address (BSSID): " MACSTR,
2475                            MAC2STR(bssid));
2476         }
2477
2478         if (attr.rf_bands)
2479                 wpa_printf(MSG_DEBUG, "WPS: RF Bands: %d", *attr.rf_bands);
2480
2481         if (attr.ap_channel) {
2482                 u16 chan = WPA_GET_BE16(attr.ap_channel);
2483
2484                 wpa_printf(MSG_DEBUG, "WPS: AP Channel: %d", chan);
2485
2486                 if (chan >= 1 && chan <= 13 &&
2487                     (attr.rf_bands == NULL || *attr.rf_bands & WPS_RF_24GHZ))
2488                         freq = 2407 + 5 * chan;
2489                 else if (chan == 14 &&
2490                          (attr.rf_bands == NULL ||
2491                           *attr.rf_bands & WPS_RF_24GHZ))
2492                         freq = 2484;
2493                 else if (chan >= 30 &&
2494                          (attr.rf_bands == NULL ||
2495                           *attr.rf_bands & WPS_RF_50GHZ))
2496                         freq = 5000 + 5 * chan;
2497
2498                 if (freq) {
2499                         wpa_printf(MSG_DEBUG,
2500                                    "WPS: AP indicated channel %u -> %u MHz",
2501                                    chan, freq);
2502                 }
2503         }
2504
2505         wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password",
2506                     attr.oob_dev_password, attr.oob_dev_password_len);
2507         dev_pw_id = WPA_GET_BE16(attr.oob_dev_password +
2508                                  WPS_OOB_PUBKEY_HASH_LEN);
2509         if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) {
2510                 wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID "
2511                            "%u in Wi-Fi Handover Select Message", dev_pw_id);
2512                 ret = -1;
2513                 goto out;
2514         }
2515         wpa_hexdump(MSG_DEBUG, "WPS: AP Public Key hash",
2516                     attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN);
2517
2518         ret = wpas_wps_start_nfc(wpa_s, NULL, bssid, NULL, dev_pw_id, 0,
2519                                  attr.oob_dev_password,
2520                                  attr.ssid, attr.ssid_len, freq);
2521
2522 out:
2523         wpabuf_free(wps);
2524         return ret;
2525 }
2526
2527
2528 int wpas_wps_nfc_report_handover(struct wpa_supplicant *wpa_s,
2529                                  const struct wpabuf *req,
2530                                  const struct wpabuf *sel)
2531 {
2532         wpa_printf(MSG_DEBUG, "NFC: WPS connection handover reported");
2533         wpa_hexdump_buf_key(MSG_DEBUG, "WPS: Carrier record in request", req);
2534         wpa_hexdump_buf_key(MSG_DEBUG, "WPS: Carrier record in select", sel);
2535         return wpas_wps_nfc_rx_handover_sel(wpa_s, sel);
2536 }
2537
2538
2539 int wpas_er_wps_nfc_report_handover(struct wpa_supplicant *wpa_s,
2540                                     const struct wpabuf *req,
2541                                     const struct wpabuf *sel)
2542 {
2543         struct wpabuf *wps;
2544         int ret = -1;
2545         u16 wsc_len;
2546         const u8 *pos;
2547         struct wpabuf msg;
2548         struct wps_parse_attr attr;
2549         u16 dev_pw_id;
2550
2551         /*
2552          * Enrollee/station is always initiator of the NFC connection handover,
2553          * so use the request message here to find Enrollee public key hash.
2554          */
2555         wps = ndef_parse_wifi(req);
2556         if (wps == NULL)
2557                 return -1;
2558         wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
2559                    "payload from NFC connection handover");
2560         wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps);
2561         if (wpabuf_len(wps) < 2) {
2562                 wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Request "
2563                            "Message");
2564                 goto out;
2565         }
2566         pos = wpabuf_head(wps);
2567         wsc_len = WPA_GET_BE16(pos);
2568         if (wsc_len > wpabuf_len(wps) - 2) {
2569                 wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) "
2570                            "in rt Wi-Fi Handover Request Message", wsc_len);
2571                 goto out;
2572         }
2573         pos += 2;
2574
2575         wpa_hexdump(MSG_DEBUG,
2576                     "WPS: WSC attributes in Wi-Fi Handover Request Message",
2577                     pos, wsc_len);
2578         if (wsc_len < wpabuf_len(wps) - 2) {
2579                 wpa_hexdump(MSG_DEBUG,
2580                             "WPS: Ignore extra data after WSC attributes",
2581                             pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len);
2582         }
2583
2584         wpabuf_set(&msg, pos, wsc_len);
2585         ret = wps_parse_msg(&msg, &attr);
2586         if (ret < 0) {
2587                 wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in "
2588                            "Wi-Fi Handover Request Message");
2589                 goto out;
2590         }
2591
2592         if (attr.oob_dev_password == NULL ||
2593             attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) {
2594                 wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password "
2595                            "included in Wi-Fi Handover Request Message");
2596                 ret = -1;
2597                 goto out;
2598         }
2599
2600         if (attr.uuid_e == NULL) {
2601                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E included in Wi-Fi "
2602                            "Handover Request Message");
2603                 ret = -1;
2604                 goto out;
2605         }
2606
2607         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", attr.uuid_e, WPS_UUID_LEN);
2608
2609         wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password",
2610                     attr.oob_dev_password, attr.oob_dev_password_len);
2611         dev_pw_id = WPA_GET_BE16(attr.oob_dev_password +
2612                                  WPS_OOB_PUBKEY_HASH_LEN);
2613         if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) {
2614                 wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID "
2615                            "%u in Wi-Fi Handover Request Message", dev_pw_id);
2616                 ret = -1;
2617                 goto out;
2618         }
2619         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Public Key hash",
2620                     attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN);
2621
2622         ret = wps_registrar_add_nfc_pw_token(wpa_s->wps->registrar,
2623                                              attr.oob_dev_password,
2624                                              DEV_PW_NFC_CONNECTION_HANDOVER,
2625                                              NULL, 0, 1);
2626
2627 out:
2628         wpabuf_free(wps);
2629         return ret;
2630 }
2631
2632 #endif /* CONFIG_WPS_NFC */
2633
2634
2635 static void wpas_wps_dump_ap_info(struct wpa_supplicant *wpa_s)
2636 {
2637         size_t i;
2638         struct os_reltime now;
2639
2640         if (wpa_debug_level > MSG_DEBUG)
2641                 return;
2642
2643         if (wpa_s->wps_ap == NULL)
2644                 return;
2645
2646         os_get_reltime(&now);
2647
2648         for (i = 0; i < wpa_s->num_wps_ap; i++) {
2649                 struct wps_ap_info *ap = &wpa_s->wps_ap[i];
2650                 struct wpa_blacklist *e = wpa_blacklist_get(wpa_s, ap->bssid);
2651
2652                 wpa_printf(MSG_DEBUG, "WPS: AP[%d] " MACSTR " type=%d "
2653                            "tries=%d last_attempt=%d sec ago blacklist=%d",
2654                            (int) i, MAC2STR(ap->bssid), ap->type, ap->tries,
2655                            ap->last_attempt.sec > 0 ?
2656                            (int) now.sec - (int) ap->last_attempt.sec : -1,
2657                            e ? e->count : 0);
2658         }
2659 }
2660
2661
2662 static struct wps_ap_info * wpas_wps_get_ap_info(struct wpa_supplicant *wpa_s,
2663                                                  const u8 *bssid)
2664 {
2665         size_t i;
2666
2667         if (wpa_s->wps_ap == NULL)
2668                 return NULL;
2669
2670         for (i = 0; i < wpa_s->num_wps_ap; i++) {
2671                 struct wps_ap_info *ap = &wpa_s->wps_ap[i];
2672                 if (os_memcmp(ap->bssid, bssid, ETH_ALEN) == 0)
2673                         return ap;
2674         }
2675
2676         return NULL;
2677 }
2678
2679
2680 static void wpas_wps_update_ap_info_bss(struct wpa_supplicant *wpa_s,
2681                                         struct wpa_scan_res *res)
2682 {
2683         struct wpabuf *wps;
2684         enum wps_ap_info_type type;
2685         struct wps_ap_info *ap;
2686         int r;
2687
2688         if (wpa_scan_get_vendor_ie(res, WPS_IE_VENDOR_TYPE) == NULL)
2689                 return;
2690
2691         wps = wpa_scan_get_vendor_ie_multi(res, WPS_IE_VENDOR_TYPE);
2692         if (wps == NULL)
2693                 return;
2694
2695         r = wps_is_addr_authorized(wps, wpa_s->own_addr, 1);
2696         if (r == 2)
2697                 type = WPS_AP_SEL_REG_OUR;
2698         else if (r == 1)
2699                 type = WPS_AP_SEL_REG;
2700         else
2701                 type = WPS_AP_NOT_SEL_REG;
2702
2703         wpabuf_free(wps);
2704
2705         ap = wpas_wps_get_ap_info(wpa_s, res->bssid);
2706         if (ap) {
2707                 if (ap->type != type) {
2708                         wpa_printf(MSG_DEBUG, "WPS: AP " MACSTR
2709                                    " changed type %d -> %d",
2710                                    MAC2STR(res->bssid), ap->type, type);
2711                         ap->type = type;
2712                         if (type != WPS_AP_NOT_SEL_REG)
2713                                 wpa_blacklist_del(wpa_s, ap->bssid);
2714                 }
2715                 return;
2716         }
2717
2718         ap = os_realloc_array(wpa_s->wps_ap, wpa_s->num_wps_ap + 1,
2719                               sizeof(struct wps_ap_info));
2720         if (ap == NULL)
2721                 return;
2722
2723         wpa_s->wps_ap = ap;
2724         ap = &wpa_s->wps_ap[wpa_s->num_wps_ap];
2725         wpa_s->num_wps_ap++;
2726
2727         os_memset(ap, 0, sizeof(*ap));
2728         os_memcpy(ap->bssid, res->bssid, ETH_ALEN);
2729         ap->type = type;
2730         wpa_printf(MSG_DEBUG, "WPS: AP " MACSTR " type %d added",
2731                    MAC2STR(ap->bssid), ap->type);
2732 }
2733
2734
2735 void wpas_wps_update_ap_info(struct wpa_supplicant *wpa_s,
2736                              struct wpa_scan_results *scan_res)
2737 {
2738         size_t i;
2739
2740         for (i = 0; i < scan_res->num; i++)
2741                 wpas_wps_update_ap_info_bss(wpa_s, scan_res->res[i]);
2742
2743         wpas_wps_dump_ap_info(wpa_s);
2744 }
2745
2746
2747 void wpas_wps_notify_assoc(struct wpa_supplicant *wpa_s, const u8 *bssid)
2748 {
2749         struct wps_ap_info *ap;
2750
2751         wpa_s->after_wps = 0;
2752
2753         if (!wpa_s->wps_ap_iter)
2754                 return;
2755         ap = wpas_wps_get_ap_info(wpa_s, bssid);
2756         if (ap == NULL)
2757                 return;
2758         ap->tries++;
2759         os_get_reltime(&ap->last_attempt);
2760 }