www.project-moonshot.org Git - mech_eap.orig/blob - libeap/src/eap_server/eap_server_wsc.c

   1 /*
   2  * EAP-WSC server for Wi-Fi Protected Setup
   3  * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eloop.h"
  19 #include "eap_i.h"
  20 #include "eap_common/eap_wsc_common.h"
  21 #include "wps/wps.h"
  22
  23
  24 struct eap_wsc_data {
  25         enum { START, MESG, FRAG_ACK, WAIT_FRAG_ACK, DONE, FAIL } state;
  26         int registrar;
  27         struct wpabuf *in_buf;
  28         struct wpabuf *out_buf;
  29         enum wsc_op_code in_op_code, out_op_code;
  30         size_t out_used;
  31         size_t fragment_size;
  32         struct wps_data *wps;
  33         int ext_reg_timeout;
  34 };
  35
  36
  37 #ifndef CONFIG_NO_STDOUT_DEBUG
  38 static const char * eap_wsc_state_txt(int state)
  39 {
  40         switch (state) {
  41         case START:
  42                 return "START";
  43         case MESG:
  44                 return "MESG";
  45         case FRAG_ACK:
  46                 return "FRAG_ACK";
  47         case WAIT_FRAG_ACK:
  48                 return "WAIT_FRAG_ACK";
  49         case DONE:
  50                 return "DONE";
  51         case FAIL:
  52                 return "FAIL";
  53         default:
  54                 return "?";
  55         }
  56 }
  57 #endif /* CONFIG_NO_STDOUT_DEBUG */
  58
  59
  60 static void eap_wsc_state(struct eap_wsc_data *data, int state)
  61 {
  62         wpa_printf(MSG_DEBUG, "EAP-WSC: %s -> %s",
  63                    eap_wsc_state_txt(data->state),
  64                    eap_wsc_state_txt(state));
  65         data->state = state;
  66 }
  67
  68
  69 static void eap_wsc_ext_reg_timeout(void *eloop_ctx, void *timeout_ctx)
  70 {
  71         struct eap_sm *sm = eloop_ctx;
  72         struct eap_wsc_data *data = timeout_ctx;
  73
  74         if (sm->method_pending != METHOD_PENDING_WAIT)
  75                 return;
  76
  77         wpa_printf(MSG_DEBUG, "EAP-WSC: Timeout while waiting for an External "
  78                    "Registrar");
  79         data->ext_reg_timeout = 1;
  80         eap_sm_pending_cb(sm);
  81 }
  82
  83
  84 static void * eap_wsc_init(struct eap_sm *sm)
  85 {
  86         struct eap_wsc_data *data;
  87         int registrar;
  88         struct wps_config cfg;
  89
  90         if (sm->identity && sm->identity_len == WSC_ID_REGISTRAR_LEN &&
  91             os_memcmp(sm->identity, WSC_ID_REGISTRAR, WSC_ID_REGISTRAR_LEN) ==
  92             0)
  93                 registrar = 0; /* Supplicant is Registrar */
  94         else if (sm->identity && sm->identity_len == WSC_ID_ENROLLEE_LEN &&
  95                  os_memcmp(sm->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN)
  96                  == 0)
  97                 registrar = 1; /* Supplicant is Enrollee */
  98         else {
  99                 wpa_hexdump_ascii(MSG_INFO, "EAP-WSC: Unexpected identity",
 100                                   sm->identity, sm->identity_len);
 101                 return NULL;
 102         }
 103
 104         data = os_zalloc(sizeof(*data));
 105         if (data == NULL)
 106                 return NULL;
 107         data->state = registrar ? START : MESG;
 108         data->registrar = registrar;
 109
 110         os_memset(&cfg, 0, sizeof(cfg));
 111         cfg.wps = sm->wps;
 112         cfg.registrar = registrar;
 113         if (registrar) {
 114                 if (sm->wps == NULL || sm->wps->registrar == NULL) {
 115                         wpa_printf(MSG_INFO, "EAP-WSC: WPS Registrar not "
 116                                    "initialized");
 117                         os_free(data);
 118                         return NULL;
 119                 }
 120         } else {
 121                 if (sm->user == NULL || sm->user->password == NULL) {
 122                         /*
 123                          * In theory, this should not really be needed, but
 124                          * Windows 7 uses Registrar mode to probe AP's WPS
 125                          * capabilities before trying to use Enrollee and fails
 126                          * if the AP does not allow that probing to happen..
 127                          */
 128                         wpa_printf(MSG_DEBUG, "EAP-WSC: No AP PIN (password) "
 129                                    "configured for Enrollee functionality - "
 130                                    "allow for probing capabilities (M1)");
 131                 } else {
 132                         cfg.pin = sm->user->password;
 133                         cfg.pin_len = sm->user->password_len;
 134                 }
 135         }
 136         cfg.assoc_wps_ie = sm->assoc_wps_ie;
 137         cfg.peer_addr = sm->peer_addr;
 138         if (sm->assoc_p2p_ie) {
 139                 wpa_printf(MSG_DEBUG, "EAP-WSC: Prefer PSK format for P2P "
 140                            "client");
 141                 cfg.use_psk_key = 1;
 142         }
 143         data->wps = wps_init(&cfg);
 144         if (data->wps == NULL) {
 145                 os_free(data);
 146                 return NULL;
 147         }
 148         data->fragment_size = sm->fragment_size > 0 ? sm->fragment_size :
 149                 WSC_FRAGMENT_SIZE;
 150
 151         return data;
 152 }
 153
 154
 155 static void eap_wsc_reset(struct eap_sm *sm, void *priv)
 156 {
 157         struct eap_wsc_data *data = priv;
 158         eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data);
 159         wpabuf_free(data->in_buf);
 160         wpabuf_free(data->out_buf);
 161         wps_deinit(data->wps);
 162         os_free(data);
 163 }
 164
 165
 166 static struct wpabuf * eap_wsc_build_start(struct eap_sm *sm,
 167                                            struct eap_wsc_data *data, u8 id)
 168 {
 169         struct wpabuf *req;
 170
 171         req = eap_msg_alloc(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, 2,
 172                             EAP_CODE_REQUEST, id);
 173         if (req == NULL) {
 174                 wpa_printf(MSG_ERROR, "EAP-WSC: Failed to allocate memory for "
 175                            "request");
 176                 return NULL;
 177         }
 178
 179         wpa_printf(MSG_DEBUG, "EAP-WSC: Send WSC/Start");
 180         wpabuf_put_u8(req, WSC_Start); /* Op-Code */
 181         wpabuf_put_u8(req, 0); /* Flags */
 182
 183         return req;
 184 }
 185
 186
 187 static struct wpabuf * eap_wsc_build_msg(struct eap_wsc_data *data, u8 id)
 188 {
 189         struct wpabuf *req;
 190         u8 flags;
 191         size_t send_len, plen;
 192
 193         flags = 0;
 194         send_len = wpabuf_len(data->out_buf) - data->out_used;
 195         if (2 + send_len > data->fragment_size) {
 196                 send_len = data->fragment_size - 2;
 197                 flags |= WSC_FLAGS_MF;
 198                 if (data->out_used == 0) {
 199                         flags |= WSC_FLAGS_LF;
 200                         send_len -= 2;
 201                 }
 202         }
 203         plen = 2 + send_len;
 204         if (flags & WSC_FLAGS_LF)
 205                 plen += 2;
 206         req = eap_msg_alloc(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, plen,
 207                             EAP_CODE_REQUEST, id);
 208         if (req == NULL) {
 209                 wpa_printf(MSG_ERROR, "EAP-WSC: Failed to allocate memory for "
 210                            "request");
 211                 return NULL;
 212         }
 213
 214         wpabuf_put_u8(req, data->out_op_code); /* Op-Code */
 215         wpabuf_put_u8(req, flags); /* Flags */
 216         if (flags & WSC_FLAGS_LF)
 217                 wpabuf_put_be16(req, wpabuf_len(data->out_buf));
 218
 219         wpabuf_put_data(req, wpabuf_head_u8(data->out_buf) + data->out_used,
 220                         send_len);
 221         data->out_used += send_len;
 222
 223         if (data->out_used == wpabuf_len(data->out_buf)) {
 224                 wpa_printf(MSG_DEBUG, "EAP-WSC: Sending out %lu bytes "
 225                            "(message sent completely)",
 226                            (unsigned long) send_len);
 227                 wpabuf_free(data->out_buf);
 228                 data->out_buf = NULL;
 229                 data->out_used = 0;
 230                 eap_wsc_state(data, MESG);
 231         } else {
 232                 wpa_printf(MSG_DEBUG, "EAP-WSC: Sending out %lu bytes "
 233                            "(%lu more to send)", (unsigned long) send_len,
 234                            (unsigned long) wpabuf_len(data->out_buf) -
 235                            data->out_used);
 236                 eap_wsc_state(data, WAIT_FRAG_ACK);
 237         }
 238
 239         return req;
 240 }
 241
 242
 243 static struct wpabuf * eap_wsc_buildReq(struct eap_sm *sm, void *priv, u8 id)
 244 {
 245         struct eap_wsc_data *data = priv;
 246
 247         switch (data->state) {
 248         case START:
 249                 return eap_wsc_build_start(sm, data, id);
 250         case MESG:
 251                 if (data->out_buf == NULL) {
 252                         data->out_buf = wps_get_msg(data->wps,
 253                                                     &data->out_op_code);
 254                         if (data->out_buf == NULL) {
 255                                 wpa_printf(MSG_DEBUG, "EAP-WSC: Failed to "
 256                                            "receive message from WPS");
 257                                 return NULL;
 258                         }
 259                         data->out_used = 0;
 260                 }
 261                 /* pass through */
 262         case WAIT_FRAG_ACK:
 263                 return eap_wsc_build_msg(data, id);
 264         case FRAG_ACK:
 265                 return eap_wsc_build_frag_ack(id, EAP_CODE_REQUEST);
 266         default:
 267                 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected state %d in "
 268                            "buildReq", data->state);
 269                 return NULL;
 270         }
 271 }
 272
 273
 274 static Boolean eap_wsc_check(struct eap_sm *sm, void *priv,
 275                              struct wpabuf *respData)
 276 {
 277         const u8 *pos;
 278         size_t len;
 279
 280         pos = eap_hdr_validate(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC,
 281                                respData, &len);
 282         if (pos == NULL || len < 2) {
 283                 wpa_printf(MSG_INFO, "EAP-WSC: Invalid frame");
 284                 return TRUE;
 285         }
 286
 287         return FALSE;
 288 }
 289
 290
 291 static int eap_wsc_process_cont(struct eap_wsc_data *data,
 292                                 const u8 *buf, size_t len, u8 op_code)
 293 {
 294         /* Process continuation of a pending message */
 295         if (op_code != data->in_op_code) {
 296                 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d in "
 297                            "fragment (expected %d)",
 298                            op_code, data->in_op_code);
 299                 eap_wsc_state(data, FAIL);
 300                 return -1;
 301         }
 302
 303         if (len > wpabuf_tailroom(data->in_buf)) {
 304                 wpa_printf(MSG_DEBUG, "EAP-WSC: Fragment overflow");
 305                 eap_wsc_state(data, FAIL);
 306                 return -1;
 307         }
 308
 309         wpabuf_put_data(data->in_buf, buf, len);
 310         wpa_printf(MSG_DEBUG, "EAP-WSC: Received %lu bytes, waiting for %lu "
 311                    "bytes more", (unsigned long) len,
 312                    (unsigned long) wpabuf_tailroom(data->in_buf));
 313
 314         return 0;
 315 }
 316
 317
 318 static int eap_wsc_process_fragment(struct eap_wsc_data *data,
 319                                     u8 flags, u8 op_code, u16 message_length,
 320                                     const u8 *buf, size_t len)
 321 {
 322         /* Process a fragment that is not the last one of the message */
 323         if (data->in_buf == NULL && !(flags & WSC_FLAGS_LF)) {
 324                 wpa_printf(MSG_DEBUG, "EAP-WSC: No Message Length "
 325                            "field in a fragmented packet");
 326                 return -1;
 327         }
 328
 329         if (data->in_buf == NULL) {
 330                 /* First fragment of the message */
 331                 data->in_buf = wpabuf_alloc(message_length);
 332                 if (data->in_buf == NULL) {
 333                         wpa_printf(MSG_DEBUG, "EAP-WSC: No memory for "
 334                                    "message");
 335                         return -1;
 336                 }
 337                 data->in_op_code = op_code;
 338                 wpabuf_put_data(data->in_buf, buf, len);
 339                 wpa_printf(MSG_DEBUG, "EAP-WSC: Received %lu bytes in "
 340                            "first fragment, waiting for %lu bytes more",
 341                            (unsigned long) len,
 342                            (unsigned long) wpabuf_tailroom(data->in_buf));
 343         }
 344
 345         return 0;
 346 }
 347
 348
 349 static void eap_wsc_process(struct eap_sm *sm, void *priv,
 350                             struct wpabuf *respData)
 351 {
 352         struct eap_wsc_data *data = priv;
 353         const u8 *start, *pos, *end;
 354         size_t len;
 355         u8 op_code, flags;
 356         u16 message_length = 0;
 357         enum wps_process_res res;
 358         struct wpabuf tmpbuf;
 359
 360         eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data);
 361         if (data->ext_reg_timeout) {
 362                 eap_wsc_state(data, FAIL);
 363                 return;
 364         }
 365
 366         pos = eap_hdr_validate(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC,
 367                                respData, &len);
 368         if (pos == NULL || len < 2)
 369                 return; /* Should not happen; message already verified */
 370
 371         start = pos;
 372         end = start + len;
 373
 374         op_code = *pos++;
 375         flags = *pos++;
 376         if (flags & WSC_FLAGS_LF) {
 377                 if (end - pos < 2) {
 378                         wpa_printf(MSG_DEBUG, "EAP-WSC: Message underflow");
 379                         return;
 380                 }
 381                 message_length = WPA_GET_BE16(pos);
 382                 pos += 2;
 383
 384                 if (message_length < end - pos) {
 385                         wpa_printf(MSG_DEBUG, "EAP-WSC: Invalid Message "
 386                                    "Length");
 387                         return;
 388                 }
 389         }
 390
 391         wpa_printf(MSG_DEBUG, "EAP-WSC: Received packet: Op-Code %d "
 392                    "Flags 0x%x Message Length %d",
 393                    op_code, flags, message_length);
 394
 395         if (data->state == WAIT_FRAG_ACK) {
 396                 if (op_code != WSC_FRAG_ACK) {
 397                         wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d "
 398                                    "in WAIT_FRAG_ACK state", op_code);
 399                         eap_wsc_state(data, FAIL);
 400                         return;
 401                 }
 402                 wpa_printf(MSG_DEBUG, "EAP-WSC: Fragment acknowledged");
 403                 eap_wsc_state(data, MESG);
 404                 return;
 405         }
 406
 407         if (op_code != WSC_ACK && op_code != WSC_NACK && op_code != WSC_MSG &&
 408             op_code != WSC_Done) {
 409                 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d",
 410                            op_code);
 411                 eap_wsc_state(data, FAIL);
 412                 return;
 413         }
 414
 415         if (data->in_buf &&
 416             eap_wsc_process_cont(data, pos, end - pos, op_code) < 0) {
 417                 eap_wsc_state(data, FAIL);
 418                 return;
 419         }
 420
 421         if (flags & WSC_FLAGS_MF) {
 422                 if (eap_wsc_process_fragment(data, flags, op_code,
 423                                              message_length, pos, end - pos) <
 424                     0)
 425                         eap_wsc_state(data, FAIL);
 426                 else
 427                         eap_wsc_state(data, FRAG_ACK);
 428                 return;
 429         }
 430
 431         if (data->in_buf == NULL) {
 432                 /* Wrap unfragmented messages as wpabuf without extra copy */
 433                 wpabuf_set(&tmpbuf, pos, end - pos);
 434                 data->in_buf = &tmpbuf;
 435         }
 436
 437         res = wps_process_msg(data->wps, op_code, data->in_buf);
 438         switch (res) {
 439         case WPS_DONE:
 440                 wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing completed "
 441                            "successfully - report EAP failure");
 442                 eap_wsc_state(data, FAIL);
 443                 break;
 444         case WPS_CONTINUE:
 445                 eap_wsc_state(data, MESG);
 446                 break;
 447         case WPS_FAILURE:
 448                 wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing failed");
 449                 eap_wsc_state(data, FAIL);
 450                 break;
 451         case WPS_PENDING:
 452                 eap_wsc_state(data, MESG);
 453                 sm->method_pending = METHOD_PENDING_WAIT;
 454                 eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data);
 455                 eloop_register_timeout(5, 0, eap_wsc_ext_reg_timeout,
 456                                        sm, data);
 457                 break;
 458         }
 459
 460         if (data->in_buf != &tmpbuf)
 461                 wpabuf_free(data->in_buf);
 462         data->in_buf = NULL;
 463 }
 464
 465
 466 static Boolean eap_wsc_isDone(struct eap_sm *sm, void *priv)
 467 {
 468         struct eap_wsc_data *data = priv;
 469         return data->state == FAIL;
 470 }
 471
 472
 473 static Boolean eap_wsc_isSuccess(struct eap_sm *sm, void *priv)
 474 {
 475         /* EAP-WSC will always result in EAP-Failure */
 476         return FALSE;
 477 }
 478
 479
 480 static int eap_wsc_getTimeout(struct eap_sm *sm, void *priv)
 481 {
 482         /* Recommended retransmit times: retransmit timeout 5 seconds,
 483          * per-message timeout 15 seconds, i.e., 3 tries. */
 484         sm->MaxRetrans = 2; /* total 3 attempts */
 485         return 5;
 486 }
 487
 488
 489 int eap_server_wsc_register(void)
 490 {
 491         struct eap_method *eap;
 492         int ret;
 493
 494         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 495                                       EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC,
 496                                       "WSC");
 497         if (eap == NULL)
 498                 return -1;
 499
 500         eap->init = eap_wsc_init;
 501         eap->reset = eap_wsc_reset;
 502         eap->buildReq = eap_wsc_buildReq;
 503         eap->check = eap_wsc_check;
 504         eap->process = eap_wsc_process;
 505         eap->isDone = eap_wsc_isDone;
 506         eap->isSuccess = eap_wsc_isSuccess;
 507         eap->getTimeout = eap_wsc_getTimeout;
 508
 509         ret = eap_server_method_register(eap);
 510         if (ret)
 511                 eap_server_method_free(eap);
 512         return ret;
 513 }