git.maemo.org Git - wpasupplicant/blob - src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24
  25
  26 struct wps_uuid_pin {
  27         struct wps_uuid_pin *next;
  28         u8 uuid[WPS_UUID_LEN];
  29         int wildcard_uuid;
  30         u8 *pin;
  31         size_t pin_len;
  32         int locked;
  33 };
  34
  35
  36 static void wps_free_pin(struct wps_uuid_pin *pin)
  37 {
  38         os_free(pin->pin);
  39         os_free(pin);
  40 }
  41
  42
  43 static void wps_free_pins(struct wps_uuid_pin *pins)
  44 {
  45         struct wps_uuid_pin *pin, *prev;
  46
  47         pin = pins;
  48         while (pin) {
  49                 prev = pin;
  50                 pin = pin->next;
  51                 wps_free_pin(prev);
  52         }
  53 }
  54
  55
  56 struct wps_pbc_session {
  57         struct wps_pbc_session *next;
  58         u8 addr[ETH_ALEN];
  59         u8 uuid_e[WPS_UUID_LEN];
  60         struct os_time timestamp;
  61 };
  62
  63
  64 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  65 {
  66         struct wps_pbc_session *prev;
  67
  68         while (pbc) {
  69                 prev = pbc;
  70                 pbc = pbc->next;
  71                 os_free(prev);
  72         }
  73 }
  74
  75
  76 struct wps_registrar {
  77         struct wps_context *wps;
  78
  79         int pbc;
  80         int selected_registrar;
  81
  82         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  83                           size_t psk_len);
  84         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  85                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
  86         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
  87                               const struct wps_device_data *dev);
  88         void *cb_ctx;
  89
  90         struct wps_uuid_pin *pins;
  91         struct wps_pbc_session *pbc_sessions;
  92
  93         int skip_cred_build;
  94         struct wpabuf *extra_cred;
  95 };
  96
  97
  98 static int wps_set_ie(struct wps_registrar *reg);
  99 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 100
 101
 102 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
 103                                           const u8 *addr, const u8 *uuid_e)
 104 {
 105         struct wps_pbc_session *pbc, *prev = NULL;
 106         struct os_time now;
 107
 108         os_get_time(&now);
 109
 110         pbc = reg->pbc_sessions;
 111         while (pbc) {
 112                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 113                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 114                         if (prev)
 115                                 prev->next = pbc->next;
 116                         else
 117                                 reg->pbc_sessions = pbc->next;
 118                         break;
 119                 }
 120                 prev = pbc;
 121                 pbc = pbc->next;
 122         }
 123
 124         if (!pbc) {
 125                 pbc = os_zalloc(sizeof(*pbc));
 126                 if (pbc == NULL)
 127                         return;
 128                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 129                 if (uuid_e)
 130                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 131         }
 132
 133         pbc->next = reg->pbc_sessions;
 134         reg->pbc_sessions = pbc;
 135         pbc->timestamp = now;
 136
 137         /* remove entries that have timed out */
 138         prev = pbc;
 139         pbc = pbc->next;
 140
 141         while (pbc) {
 142                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 143                         prev->next = NULL;
 144                         wps_free_pbc_sessions(pbc);
 145                         break;
 146                 }
 147                 prev = pbc;
 148                 pbc = pbc->next;
 149         }
 150 }
 151
 152
 153 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 154                                              const u8 *addr, const u8 *uuid_e)
 155 {
 156         struct wps_pbc_session *pbc, *prev = NULL;
 157
 158         pbc = reg->pbc_sessions;
 159         while (pbc) {
 160                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 161                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 162                         if (prev)
 163                                 prev->next = pbc->next;
 164                         else
 165                                 reg->pbc_sessions = pbc->next;
 166                         os_free(pbc);
 167                         break;
 168                 }
 169                 prev = pbc;
 170                 pbc = pbc->next;
 171         }
 172 }
 173
 174
 175 static int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 176                                      const u8 *addr, const u8 *uuid_e)
 177 {
 178         int count = 0;
 179         struct wps_pbc_session *pbc;
 180         struct os_time now;
 181
 182         os_get_time(&now);
 183
 184         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 185                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 186                         break;
 187                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 188                     uuid_e == NULL ||
 189                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 190                         count++;
 191         }
 192
 193         if (addr || uuid_e)
 194                 count++;
 195
 196         return count > 1 ? 1 : 0;
 197 }
 198
 199
 200 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 201 {
 202         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 203                    wps->wps_state);
 204         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 205         wpabuf_put_be16(msg, 1);
 206         wpabuf_put_u8(msg, wps->wps_state);
 207         return 0;
 208 }
 209
 210
 211 static int wps_build_ap_setup_locked(struct wps_context *wps,
 212                                      struct wpabuf *msg)
 213 {
 214         if (wps->ap_setup_locked) {
 215                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 216                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 217                 wpabuf_put_be16(msg, 1);
 218                 wpabuf_put_u8(msg, 1);
 219         }
 220         return 0;
 221 }
 222
 223
 224 static int wps_build_selected_registrar(struct wps_registrar *reg,
 225                                         struct wpabuf *msg)
 226 {
 227         if (!reg->selected_registrar)
 228                 return 0;
 229         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 230         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 231         wpabuf_put_be16(msg, 1);
 232         wpabuf_put_u8(msg, 1);
 233         return 0;
 234 }
 235
 236
 237 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 238                                              struct wpabuf *msg)
 239 {
 240         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 241         if (!reg->selected_registrar)
 242                 return 0;
 243         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 244         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 245         wpabuf_put_be16(msg, 2);
 246         wpabuf_put_be16(msg, id);
 247         return 0;
 248 }
 249
 250
 251 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 252                                             struct wpabuf *msg)
 253 {
 254         u16 methods;
 255         if (!reg->selected_registrar)
 256                 return 0;
 257         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 258         if (reg->pbc)
 259                 methods |= WPS_CONFIG_PUSHBUTTON;
 260         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 261                    methods);
 262         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 263         wpabuf_put_be16(msg, 2);
 264         wpabuf_put_be16(msg, methods);
 265         return 0;
 266 }
 267
 268
 269 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 270                                           struct wpabuf *msg)
 271 {
 272         u16 methods;
 273         methods = 0;
 274         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 275         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 276         wpabuf_put_be16(msg, 2);
 277         wpabuf_put_be16(msg, methods);
 278         return 0;
 279 }
 280
 281
 282 static int wps_build_config_methods_r(struct wps_registrar *reg,
 283                                       struct wpabuf *msg)
 284 {
 285         u16 methods;
 286         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 287         if (reg->pbc)
 288                 methods |= WPS_CONFIG_PUSHBUTTON;
 289         return wps_build_config_methods(msg, methods);
 290 }
 291
 292
 293 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 294 {
 295         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 296         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 297         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 298         wpabuf_put_be16(msg, 1);
 299         wpabuf_put_u8(msg, resp);
 300         return 0;
 301 }
 302
 303
 304 /**
 305  * wps_registrar_init - Initialize WPS Registrar data
 306  * @wps: Pointer to longterm WPS context
 307  * @cfg: Registrar configuration
 308  * Returns: Pointer to allocated Registrar data or %NULL on failure
 309  *
 310  * This function is used to initialize WPS Registrar functionality. It can be
 311  * used for a single Registrar run (e.g., when run in a supplicant) or multiple
 312  * runs (e.g., when run as an internal Registrar in an AP). Caller is
 313  * responsible for freeing the returned data with wps_registrar_deinit() when
 314  * Registrar functionality is not needed anymore.
 315  */
 316 struct wps_registrar *
 317 wps_registrar_init(struct wps_context *wps,
 318                    const struct wps_registrar_config *cfg)
 319 {
 320         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 321         if (reg == NULL)
 322                 return NULL;
 323
 324         reg->wps = wps;
 325         reg->new_psk_cb = cfg->new_psk_cb;
 326         reg->set_ie_cb = cfg->set_ie_cb;
 327         reg->pin_needed_cb = cfg->pin_needed_cb;
 328         reg->cb_ctx = cfg->cb_ctx;
 329         reg->skip_cred_build = cfg->skip_cred_build;
 330         if (cfg->extra_cred) {
 331                 reg->extra_cred = wpabuf_alloc_copy(cfg->extra_cred,
 332                                                     cfg->extra_cred_len);
 333                 if (reg->extra_cred == NULL) {
 334                         os_free(reg);
 335                         return NULL;
 336                 }
 337         }
 338
 339         if (wps_set_ie(reg)) {
 340                 wps_registrar_deinit(reg);
 341                 return NULL;
 342         }
 343
 344         return reg;
 345 }
 346
 347
 348 /**
 349  * wps_registrar_deinit - Deinitialize WPS Registrar data
 350  * @reg: Registrar data from wps_registrar_init()
 351  */
 352 void wps_registrar_deinit(struct wps_registrar *reg)
 353 {
 354         if (reg == NULL)
 355                 return;
 356         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 357         wps_free_pins(reg->pins);
 358         wps_free_pbc_sessions(reg->pbc_sessions);
 359         wpabuf_free(reg->extra_cred);
 360         os_free(reg);
 361 }
 362
 363
 364 /**
 365  * wps_registrar_add_pin - Configure a new PIN for Registrar
 366  * @reg: Registrar data from wps_registrar_init()
 367  * @uuid: UUID-E or %NULL for wildcard (any UUID)
 368  * @pin: PIN (Device Password)
 369  * @pin_len: Length of pin in octets
 370  * Returns: 0 on success, -1 on failure
 371  */
 372 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 373                           const u8 *pin, size_t pin_len)
 374 {
 375         struct wps_uuid_pin *p;
 376
 377         p = os_zalloc(sizeof(*p));
 378         if (p == NULL)
 379                 return -1;
 380         if (uuid == NULL)
 381                 p->wildcard_uuid = 1;
 382         else
 383                 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 384         p->pin = os_malloc(pin_len);
 385         if (p->pin == NULL) {
 386                 os_free(p);
 387                 return -1;
 388         }
 389         os_memcpy(p->pin, pin, pin_len);
 390         p->pin_len = pin_len;
 391
 392         p->next = reg->pins;
 393         reg->pins = p;
 394
 395         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
 396         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 397         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 398         reg->selected_registrar = 1;
 399         reg->pbc = 0;
 400         wps_set_ie(reg);
 401
 402         return 0;
 403 }
 404
 405
 406 /**
 407  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
 408  * @reg: Registrar data from wps_registrar_init()
 409  * @uuid: UUID-E
 410  * Returns: 0 on success, -1 on failure (e.g., PIN not found)
 411  */
 412 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 413 {
 414         struct wps_uuid_pin *pin, *prev;
 415
 416         prev = NULL;
 417         pin = reg->pins;
 418         while (pin) {
 419                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 420                         if (prev == NULL)
 421                                 reg->pins = pin->next;
 422                         else
 423                                 prev->next = pin->next;
 424                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 425                                     pin->uuid, WPS_UUID_LEN);
 426                         wps_free_pin(pin);
 427                         return 0;
 428                 }
 429                 prev = pin;
 430                 pin = pin->next;
 431         }
 432
 433         return -1;
 434 }
 435
 436
 437 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 438                                         const u8 *uuid, size_t *pin_len)
 439 {
 440         struct wps_uuid_pin *pin;
 441
 442         pin = reg->pins;
 443         while (pin) {
 444                 if (!pin->wildcard_uuid &&
 445                     os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0)
 446                         break;
 447                 pin = pin->next;
 448         }
 449
 450         if (!pin) {
 451                 /* Check for wildcard UUIDs since none of the UUID-specific
 452                  * PINs matched */
 453                 pin = reg->pins;
 454                 while (pin) {
 455                         if (pin->wildcard_uuid == 1) {
 456                                 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
 457                                            "PIN. Assigned it for this UUID-E");
 458                                 pin->wildcard_uuid = 2;
 459                                 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
 460                                 break;
 461                         }
 462                         pin = pin->next;
 463                 }
 464         }
 465
 466         if (!pin)
 467                 return NULL;
 468
 469         /*
 470          * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
 471          * that could otherwise avoid PIN invalidations.
 472          */
 473         if (pin->locked) {
 474                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
 475                            "allow concurrent re-use");
 476                 return NULL;
 477         }
 478         *pin_len = pin->pin_len;
 479         pin->locked = 1;
 480         return pin->pin;
 481 }
 482
 483
 484 /**
 485  * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
 486  * @reg: Registrar data from wps_registrar_init()
 487  * @uuid: UUID-E
 488  * Returns: 0 on success, -1 on failure
 489  *
 490  * PINs are locked to enforce only one concurrent use. This function unlocks a
 491  * PIN to allow it to be used again. If the specified PIN was configured using
 492  * a wildcard UUID, it will be removed instead of allowing multiple uses.
 493  */
 494 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 495 {
 496         struct wps_uuid_pin *pin;
 497
 498         pin = reg->pins;
 499         while (pin) {
 500                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 501                         if (pin->wildcard_uuid == 2) {
 502                                 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
 503                                            "wildcard PIN");
 504                                 return wps_registrar_invalidate_pin(reg, uuid);
 505                         }
 506                         pin->locked = 0;
 507                         return 0;
 508                 }
 509                 pin = pin->next;
 510         }
 511
 512         return -1;
 513 }
 514
 515
 516 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
 517 {
 518         reg->selected_registrar = 0;
 519         reg->pbc = 0;
 520         wps_set_ie(reg);
 521 }
 522
 523
 524 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 525 {
 526         struct wps_registrar *reg = eloop_ctx;
 527
 528         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 529         wps_registrar_stop_pbc(reg);
 530 }
 531
 532
 533 /**
 534  * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
 535  * @reg: Registrar data from wps_registrar_init()
 536  * Returns: 0 on success, -1 on failure
 537  *
 538  * This function is called on an AP when a push button is pushed to activate
 539  * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
 540  * or when a PBC registration is completed.
 541  */
 542 int wps_registrar_button_pushed(struct wps_registrar *reg)
 543 {
 544         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 545                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 546                            "mode");
 547                 return -1;
 548         }
 549         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 550         reg->selected_registrar = 1;
 551         reg->pbc = 1;
 552         wps_set_ie(reg);
 553
 554         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 555         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 556                                reg, NULL);
 557         return 0;
 558 }
 559
 560
 561 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 562 {
 563         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 564         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 565         wps_registrar_stop_pbc(reg);
 566 }
 567
 568
 569 /**
 570  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
 571  * @reg: Registrar data from wps_registrar_init()
 572  * @addr: MAC address of the Probe Request sender
 573  * @wps_data: WPS IE contents
 574  *
 575  * This function is called on an AP when a Probe Request with WPS IE is
 576  * received. This is used to track PBC mode use and to detect possible overlap
 577  * situation with other WPS APs.
 578  */
 579 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 580                                 const struct wpabuf *wps_data)
 581 {
 582         struct wps_parse_attr attr;
 583         u16 methods;
 584
 585         wpa_hexdump_buf(MSG_MSGDUMP,
 586                         "WPS: Probe Request with WPS data received",
 587                         wps_data);
 588
 589         if (wps_parse_msg(wps_data, &attr) < 0 ||
 590             attr.version == NULL || *attr.version != WPS_VERSION) {
 591                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 592                            "version 0x%x", attr.version ? *attr.version : 0);
 593                 return;
 594         }
 595
 596         if (attr.config_methods == NULL) {
 597                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 598                            "Probe Request");
 599                 return;
 600         }
 601
 602         methods = WPA_GET_BE16(attr.config_methods);
 603         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 604                 return; /* Not PBC */
 605
 606         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 607                    MACSTR, MAC2STR(addr));
 608
 609         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 610 }
 611
 612
 613 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 614                           const u8 *psk, size_t psk_len)
 615 {
 616         if (reg->new_psk_cb == NULL)
 617                 return 0;
 618
 619         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 620 }
 621
 622
 623 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 624                               const struct wps_device_data *dev)
 625 {
 626         if (reg->pin_needed_cb == NULL)
 627                 return;
 628
 629         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 630 }
 631
 632
 633 static int wps_cb_set_ie(struct wps_registrar *reg,
 634                          const struct wpabuf *beacon_ie,
 635                          const struct wpabuf *probe_resp_ie)
 636 {
 637         if (reg->set_ie_cb == NULL)
 638                 return 0;
 639
 640         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 641                               wpabuf_len(beacon_ie),
 642                               wpabuf_head(probe_resp_ie),
 643                               wpabuf_len(probe_resp_ie));
 644 }
 645
 646
 647 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 648 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 649 {
 650         struct wpabuf *ie;
 651         const u8 *pos, *end;
 652
 653         ie = wpabuf_alloc(wpabuf_len(data) + 100);
 654         if (ie == NULL) {
 655                 wpabuf_free(data);
 656                 return NULL;
 657         }
 658
 659         pos = wpabuf_head(data);
 660         end = pos + wpabuf_len(data);
 661
 662         while (end > pos) {
 663                 size_t frag_len = end - pos;
 664                 if (frag_len > 251)
 665                         frag_len = 251;
 666                 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 667                 wpabuf_put_u8(ie, 4 + frag_len);
 668                 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
 669                 wpabuf_put_data(ie, pos, frag_len);
 670                 pos += frag_len;
 671         }
 672
 673         wpabuf_free(data);
 674
 675         return ie;
 676 }
 677
 678
 679 static int wps_set_ie(struct wps_registrar *reg)
 680 {
 681         struct wpabuf *beacon;
 682         struct wpabuf *probe;
 683         int ret;
 684
 685         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 686
 687         beacon = wpabuf_alloc(300);
 688         if (beacon == NULL)
 689                 return -1;
 690         probe = wpabuf_alloc(400);
 691         if (probe == NULL) {
 692                 wpabuf_free(beacon);
 693                 return -1;
 694         }
 695
 696         if (wps_build_version(beacon) ||
 697             wps_build_wps_state(reg->wps, beacon) ||
 698             wps_build_ap_setup_locked(reg->wps, beacon) ||
 699             wps_build_selected_registrar(reg, beacon) ||
 700             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 701             wps_build_sel_reg_config_methods(reg, beacon) ||
 702             wps_build_version(probe) ||
 703             wps_build_wps_state(reg->wps, probe) ||
 704             wps_build_ap_setup_locked(reg->wps, probe) ||
 705             wps_build_selected_registrar(reg, probe) ||
 706             wps_build_sel_reg_dev_password_id(reg, probe) ||
 707             wps_build_sel_reg_config_methods(reg, probe) ||
 708             wps_build_resp_type(reg, probe) ||
 709             wps_build_uuid_e(probe, reg->wps->uuid) ||
 710             wps_build_device_attrs(&reg->wps->dev, probe) ||
 711             wps_build_probe_config_methods(reg, probe) ||
 712             wps_build_rf_bands(&reg->wps->dev, probe)) {
 713                 wpabuf_free(beacon);
 714                 wpabuf_free(probe);
 715                 return -1;
 716         }
 717
 718         beacon = wps_ie_encapsulate(beacon);
 719         probe = wps_ie_encapsulate(probe);
 720
 721         if (!beacon || !probe) {
 722                 wpabuf_free(beacon);
 723                 wpabuf_free(probe);
 724                 return -1;
 725         }
 726
 727         ret = wps_cb_set_ie(reg, beacon, probe);
 728         wpabuf_free(beacon);
 729         wpabuf_free(probe);
 730
 731         return ret;
 732 }
 733
 734
 735 static int wps_get_dev_password(struct wps_data *wps)
 736 {
 737         const u8 *pin;
 738         size_t pin_len = 0;
 739
 740         os_free(wps->dev_password);
 741         wps->dev_password = NULL;
 742
 743         if (wps->pbc) {
 744                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 745                 pin = (const u8 *) "00000000";
 746                 pin_len = 8;
 747         } else {
 748                 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
 749                                             &pin_len);
 750         }
 751         if (pin == NULL) {
 752                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 753                            "the Enrollee");
 754                 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
 755                                   &wps->peer_dev);
 756                 return -1;
 757         }
 758
 759         wps->dev_password = os_malloc(pin_len);
 760         if (wps->dev_password == NULL)
 761                 return -1;
 762         os_memcpy(wps->dev_password, pin, pin_len);
 763         wps->dev_password_len = pin_len;
 764
 765         return 0;
 766 }
 767
 768
 769 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
 770 {
 771         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
 772         wpabuf_put_be16(msg, ATTR_UUID_R);
 773         wpabuf_put_be16(msg, WPS_UUID_LEN);
 774         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
 775         return 0;
 776 }
 777
 778
 779 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
 780 {
 781         u8 *hash;
 782         const u8 *addr[4];
 783         size_t len[4];
 784
 785         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
 786                 return -1;
 787         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
 788         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
 789                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
 790
 791         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
 792                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
 793                            "R-Hash derivation");
 794                 return -1;
 795         }
 796
 797         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
 798         wpabuf_put_be16(msg, ATTR_R_HASH1);
 799         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 800         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 801         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
 802         addr[0] = wps->snonce;
 803         len[0] = WPS_SECRET_NONCE_LEN;
 804         addr[1] = wps->psk1;
 805         len[1] = WPS_PSK_LEN;
 806         addr[2] = wpabuf_head(wps->dh_pubkey_e);
 807         len[2] = wpabuf_len(wps->dh_pubkey_e);
 808         addr[3] = wpabuf_head(wps->dh_pubkey_r);
 809         len[3] = wpabuf_len(wps->dh_pubkey_r);
 810         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 811         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
 812
 813         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
 814         wpabuf_put_be16(msg, ATTR_R_HASH2);
 815         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 816         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 817         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
 818         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
 819         addr[1] = wps->psk2;
 820         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 821         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
 822
 823         return 0;
 824 }
 825
 826
 827 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
 828 {
 829         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
 830         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
 831         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 832         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
 833         return 0;
 834 }
 835
 836
 837 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 838 {
 839         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
 840         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
 841         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 842         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
 843                         WPS_SECRET_NONCE_LEN);
 844         return 0;
 845 }
 846
 847
 848 static int wps_build_cred_network_idx(struct wpabuf *msg,
 849                                       struct wps_credential *cred)
 850 {
 851         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
 852         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
 853         wpabuf_put_be16(msg, 1);
 854         wpabuf_put_u8(msg, 1);
 855         return 0;
 856 }
 857
 858
 859 static int wps_build_cred_ssid(struct wpabuf *msg,
 860                                struct wps_credential *cred)
 861 {
 862         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
 863         wpabuf_put_be16(msg, ATTR_SSID);
 864         wpabuf_put_be16(msg, cred->ssid_len);
 865         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
 866         return 0;
 867 }
 868
 869
 870 static int wps_build_cred_auth_type(struct wpabuf *msg,
 871                                     struct wps_credential *cred)
 872 {
 873         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
 874                    cred->auth_type);
 875         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
 876         wpabuf_put_be16(msg, 2);
 877         wpabuf_put_be16(msg, cred->auth_type);
 878         return 0;
 879 }
 880
 881
 882 static int wps_build_cred_encr_type(struct wpabuf *msg,
 883                                     struct wps_credential *cred)
 884 {
 885         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
 886                    cred->encr_type);
 887         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
 888         wpabuf_put_be16(msg, 2);
 889         wpabuf_put_be16(msg, cred->encr_type);
 890         return 0;
 891 }
 892
 893
 894 static int wps_build_cred_network_key(struct wpabuf *msg,
 895                                       struct wps_credential *cred)
 896 {
 897         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
 898         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
 899         wpabuf_put_be16(msg, cred->key_len);
 900         wpabuf_put_data(msg, cred->key, cred->key_len);
 901         return 0;
 902 }
 903
 904
 905 static int wps_build_cred_mac_addr(struct wpabuf *msg,
 906                                    struct wps_credential *cred)
 907 {
 908         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address (" MACSTR ")",
 909                    MAC2STR(cred->mac_addr));
 910         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
 911         wpabuf_put_be16(msg, ETH_ALEN);
 912         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
 913         return 0;
 914 }
 915
 916
 917 static int wps_build_credential(struct wpabuf *msg,
 918                                 struct wps_credential *cred)
 919 {
 920         if (wps_build_cred_network_idx(msg, cred) ||
 921             wps_build_cred_ssid(msg, cred) ||
 922             wps_build_cred_auth_type(msg, cred) ||
 923             wps_build_cred_encr_type(msg, cred) ||
 924             wps_build_cred_network_key(msg, cred) ||
 925             wps_build_cred_mac_addr(msg, cred))
 926                 return -1;
 927         return 0;
 928 }
 929
 930
 931 static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 932 {
 933         struct wpabuf *cred;
 934
 935         if (wps->wps->registrar->skip_cred_build)
 936                 goto skip_cred_build;
 937
 938         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
 939         os_memset(&wps->cred, 0, sizeof(wps->cred));
 940
 941         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
 942         wps->cred.ssid_len = wps->wps->ssid_len;
 943
 944         /* Select the best authentication and encryption type */
 945         if (wps->auth_type & WPS_AUTH_WPA2PSK)
 946                 wps->auth_type = WPS_AUTH_WPA2PSK;
 947         else if (wps->auth_type & WPS_AUTH_WPAPSK)
 948                 wps->auth_type = WPS_AUTH_WPAPSK;
 949         else if (wps->auth_type & WPS_AUTH_OPEN)
 950                 wps->auth_type = WPS_AUTH_OPEN;
 951         else if (wps->auth_type & WPS_AUTH_SHARED)
 952                 wps->auth_type = WPS_AUTH_SHARED;
 953         else {
 954                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
 955                            wps->auth_type);
 956                 return -1;
 957         }
 958         wps->cred.auth_type = wps->auth_type;
 959
 960         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
 961             wps->auth_type == WPS_AUTH_WPAPSK) {
 962                 if (wps->encr_type & WPS_ENCR_AES)
 963                         wps->encr_type = WPS_ENCR_AES;
 964                 else if (wps->encr_type & WPS_ENCR_TKIP)
 965                         wps->encr_type = WPS_ENCR_TKIP;
 966                 else {
 967                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 968                                    "type for WPA/WPA2");
 969                         return -1;
 970                 }
 971         } else {
 972                 if (wps->encr_type & WPS_ENCR_WEP)
 973                         wps->encr_type = WPS_ENCR_WEP;
 974                 else if (wps->encr_type & WPS_ENCR_NONE)
 975                         wps->encr_type = WPS_ENCR_NONE;
 976                 else {
 977                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 978                                    "type for non-WPA/WPA2 mode");
 979                         return -1;
 980                 }
 981         }
 982         wps->cred.encr_type = wps->encr_type;
 983         /* Set MAC address in the Credential to be the AP's address (BSSID) */
 984         os_memcpy(wps->cred.mac_addr, wps->wps->dev.mac_addr, ETH_ALEN);
 985
 986         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap) {
 987                 u8 r[16];
 988                 /* Generate a random passphrase */
 989                 if (os_get_random(r, sizeof(r)) < 0)
 990                         return -1;
 991                 os_free(wps->new_psk);
 992                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
 993                 if (wps->new_psk == NULL)
 994                         return -1;
 995                 wps->new_psk_len--; /* remove newline */
 996                 while (wps->new_psk_len &&
 997                        wps->new_psk[wps->new_psk_len - 1] == '=')
 998                         wps->new_psk_len--;
 999                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
1000                                       wps->new_psk, wps->new_psk_len);
1001                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
1002                 wps->cred.key_len = wps->new_psk_len;
1003         } else if (wps->wps->network_key) {
1004                 os_memcpy(wps->cred.key, wps->wps->network_key,
1005                           wps->wps->network_key_len);
1006                 wps->cred.key_len = wps->wps->network_key_len;
1007         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
1008                 char hex[65];
1009                 /* Generate a random per-device PSK */
1010                 os_free(wps->new_psk);
1011                 wps->new_psk_len = 32;
1012                 wps->new_psk = os_malloc(wps->new_psk_len);
1013                 if (wps->new_psk == NULL)
1014                         return -1;
1015                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
1016                         os_free(wps->new_psk);
1017                         wps->new_psk = NULL;
1018                         return -1;
1019                 }
1020                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1021                                 wps->new_psk, wps->new_psk_len);
1022                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
1023                                  wps->new_psk_len);
1024                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1025                 wps->cred.key_len = wps->new_psk_len * 2;
1026         }
1027
1028         cred = wpabuf_alloc(200);
1029         if (cred == NULL)
1030                 return -1;
1031
1032         if (wps_build_credential(cred, &wps->cred)) {
1033                 wpabuf_free(cred);
1034                 return -1;
1035         }
1036
1037         wpabuf_put_be16(msg, ATTR_CRED);
1038         wpabuf_put_be16(msg, wpabuf_len(cred));
1039         wpabuf_put_buf(msg, cred);
1040         wpabuf_free(cred);
1041
1042 skip_cred_build:
1043         if (wps->wps->registrar->extra_cred) {
1044                 wpa_printf(MSG_DEBUG, "WPS:  * Credential (pre-configured)");
1045                 wpabuf_put_buf(msg, wps->wps->registrar->extra_cred);
1046         }
1047
1048         return 0;
1049 }
1050
1051
1052 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1053 {
1054         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
1055
1056         if (wps_build_credential(msg, &wps->cred))
1057                 return -1;
1058
1059         return 0;
1060 }
1061
1062
1063 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1064 {
1065         struct wpabuf *msg;
1066
1067         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
1068                 return NULL;
1069         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1070                     wps->nonce_r, WPS_NONCE_LEN);
1071         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1072
1073         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1074         msg = wpabuf_alloc(1000);
1075         if (msg == NULL)
1076                 return NULL;
1077
1078         if (wps_build_version(msg) ||
1079             wps_build_msg_type(msg, WPS_M2) ||
1080             wps_build_enrollee_nonce(wps, msg) ||
1081             wps_build_registrar_nonce(wps, msg) ||
1082             wps_build_uuid_r(wps, msg) ||
1083             wps_build_public_key(wps, msg) ||
1084             wps_derive_keys(wps) ||
1085             wps_build_auth_type_flags(wps, msg) ||
1086             wps_build_encr_type_flags(wps, msg) ||
1087             wps_build_conn_type_flags(wps, msg) ||
1088             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1089             wps_build_device_attrs(&wps->wps->dev, msg) ||
1090             wps_build_rf_bands(&wps->wps->dev, msg) ||
1091             wps_build_assoc_state(wps, msg) ||
1092             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1093             wps_build_dev_password_id(msg, DEV_PW_DEFAULT) ||
1094             wps_build_os_version(&wps->wps->dev, msg) ||
1095             wps_build_authenticator(wps, msg)) {
1096                 wpabuf_free(msg);
1097                 return NULL;
1098         }
1099
1100         wps->state = RECV_M3;
1101         return msg;
1102 }
1103
1104
1105 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1106 {
1107         struct wpabuf *msg;
1108         u16 err = WPS_CFG_NO_ERROR;
1109
1110         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1111         msg = wpabuf_alloc(1000);
1112         if (msg == NULL)
1113                 return NULL;
1114
1115         if (wps->wps->ap && wps->wps->ap_setup_locked)
1116                 err = WPS_CFG_SETUP_LOCKED;
1117
1118         if (wps_build_version(msg) ||
1119             wps_build_msg_type(msg, WPS_M2D) ||
1120             wps_build_enrollee_nonce(wps, msg) ||
1121             wps_build_registrar_nonce(wps, msg) ||
1122             wps_build_uuid_r(wps, msg) ||
1123             wps_build_auth_type_flags(wps, msg) ||
1124             wps_build_encr_type_flags(wps, msg) ||
1125             wps_build_conn_type_flags(wps, msg) ||
1126             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1127             wps_build_device_attrs(&wps->wps->dev, msg) ||
1128             wps_build_rf_bands(&wps->wps->dev, msg) ||
1129             wps_build_assoc_state(wps, msg) ||
1130             wps_build_config_error(msg, err) ||
1131             wps_build_os_version(&wps->wps->dev, msg)) {
1132                 wpabuf_free(msg);
1133                 return NULL;
1134         }
1135
1136         wps->state = RECV_M2D_ACK;
1137         return msg;
1138 }
1139
1140
1141 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1142 {
1143         struct wpabuf *msg, *plain;
1144
1145         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1146
1147         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1148
1149         plain = wpabuf_alloc(200);
1150         if (plain == NULL)
1151                 return NULL;
1152
1153         msg = wpabuf_alloc(1000);
1154         if (msg == NULL) {
1155                 wpabuf_free(plain);
1156                 return NULL;
1157         }
1158
1159         if (wps_build_version(msg) ||
1160             wps_build_msg_type(msg, WPS_M4) ||
1161             wps_build_enrollee_nonce(wps, msg) ||
1162             wps_build_r_hash(wps, msg) ||
1163             wps_build_r_snonce1(wps, plain) ||
1164             wps_build_key_wrap_auth(wps, plain) ||
1165             wps_build_encr_settings(wps, msg, plain) ||
1166             wps_build_authenticator(wps, msg)) {
1167                 wpabuf_free(plain);
1168                 wpabuf_free(msg);
1169                 return NULL;
1170         }
1171         wpabuf_free(plain);
1172
1173         wps->state = RECV_M5;
1174         return msg;
1175 }
1176
1177
1178 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1179 {
1180         struct wpabuf *msg, *plain;
1181
1182         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1183
1184         plain = wpabuf_alloc(200);
1185         if (plain == NULL)
1186                 return NULL;
1187
1188         msg = wpabuf_alloc(1000);
1189         if (msg == NULL) {
1190                 wpabuf_free(plain);
1191                 return NULL;
1192         }
1193
1194         if (wps_build_version(msg) ||
1195             wps_build_msg_type(msg, WPS_M6) ||
1196             wps_build_enrollee_nonce(wps, msg) ||
1197             wps_build_r_snonce2(wps, plain) ||
1198             wps_build_key_wrap_auth(wps, plain) ||
1199             wps_build_encr_settings(wps, msg, plain) ||
1200             wps_build_authenticator(wps, msg)) {
1201                 wpabuf_free(plain);
1202                 wpabuf_free(msg);
1203                 return NULL;
1204         }
1205         wpabuf_free(plain);
1206
1207         wps->wps_pin_revealed = 1;
1208         wps->state = RECV_M7;
1209         return msg;
1210 }
1211
1212
1213 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1214 {
1215         struct wpabuf *msg, *plain;
1216
1217         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1218
1219         plain = wpabuf_alloc(500);
1220         if (plain == NULL)
1221                 return NULL;
1222
1223         msg = wpabuf_alloc(1000);
1224         if (msg == NULL) {
1225                 wpabuf_free(plain);
1226                 return NULL;
1227         }
1228
1229         if (wps_build_version(msg) ||
1230             wps_build_msg_type(msg, WPS_M8) ||
1231             wps_build_enrollee_nonce(wps, msg) ||
1232             (wps->wps->ap && wps_build_cred(wps, plain)) ||
1233             (!wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
1234             wps_build_key_wrap_auth(wps, plain) ||
1235             wps_build_encr_settings(wps, msg, plain) ||
1236             wps_build_authenticator(wps, msg)) {
1237                 wpabuf_free(plain);
1238                 wpabuf_free(msg);
1239                 return NULL;
1240         }
1241         wpabuf_free(plain);
1242
1243         wps->state = RECV_DONE;
1244         return msg;
1245 }
1246
1247
1248 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1249 {
1250         struct wpabuf *msg;
1251
1252         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1253
1254         msg = wpabuf_alloc(1000);
1255         if (msg == NULL)
1256                 return NULL;
1257
1258         if (wps_build_version(msg) ||
1259             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1260             wps_build_enrollee_nonce(wps, msg) ||
1261             wps_build_registrar_nonce(wps, msg)) {
1262                 wpabuf_free(msg);
1263                 return NULL;
1264         }
1265
1266         return msg;
1267 }
1268
1269
1270 static struct wpabuf * wps_build_wsc_nack(struct wps_data *wps)
1271 {
1272         struct wpabuf *msg;
1273
1274         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_NACK");
1275
1276         msg = wpabuf_alloc(1000);
1277         if (msg == NULL)
1278                 return NULL;
1279
1280         if (wps_build_version(msg) ||
1281             wps_build_msg_type(msg, WPS_WSC_NACK) ||
1282             wps_build_enrollee_nonce(wps, msg) ||
1283             wps_build_registrar_nonce(wps, msg) ||
1284             wps_build_config_error(msg, wps->config_error)) {
1285                 wpabuf_free(msg);
1286                 return NULL;
1287         }
1288
1289         return msg;
1290 }
1291
1292
1293 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1294                                       enum wsc_op_code *op_code)
1295 {
1296         struct wpabuf *msg;
1297
1298         switch (wps->state) {
1299         case SEND_M2:
1300                 if (wps_get_dev_password(wps) < 0)
1301                         msg = wps_build_m2d(wps);
1302                 else
1303                         msg = wps_build_m2(wps);
1304                 *op_code = WSC_MSG;
1305                 break;
1306         case SEND_M2D:
1307                 msg = wps_build_m2d(wps);
1308                 *op_code = WSC_MSG;
1309                 break;
1310         case SEND_M4:
1311                 msg = wps_build_m4(wps);
1312                 *op_code = WSC_MSG;
1313                 break;
1314         case SEND_M6:
1315                 msg = wps_build_m6(wps);
1316                 *op_code = WSC_MSG;
1317                 break;
1318         case SEND_M8:
1319                 msg = wps_build_m8(wps);
1320                 *op_code = WSC_MSG;
1321                 break;
1322         case RECV_DONE:
1323                 msg = wps_build_wsc_ack(wps);
1324                 *op_code = WSC_ACK;
1325                 break;
1326         case SEND_WSC_NACK:
1327                 msg = wps_build_wsc_nack(wps);
1328                 *op_code = WSC_NACK;
1329                 break;
1330         default:
1331                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1332                            "a message", wps->state);
1333                 msg = NULL;
1334                 break;
1335         }
1336
1337         if (*op_code == WSC_MSG && msg) {
1338                 /* Save a copy of the last message for Authenticator derivation
1339                  */
1340                 wpabuf_free(wps->last_msg);
1341                 wps->last_msg = wpabuf_dup(msg);
1342         }
1343
1344         return msg;
1345 }
1346
1347
1348 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1349 {
1350         if (e_nonce == NULL) {
1351                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1352                 return -1;
1353         }
1354
1355         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1356         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1357                     wps->nonce_e, WPS_NONCE_LEN);
1358
1359         return 0;
1360 }
1361
1362
1363 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1364 {
1365         if (r_nonce == NULL) {
1366                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1367                 return -1;
1368         }
1369
1370         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1371                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1372                 return -1;
1373         }
1374
1375         return 0;
1376 }
1377
1378
1379 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1380 {
1381         if (uuid_e == NULL) {
1382                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1383                 return -1;
1384         }
1385
1386         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1387         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1388
1389         return 0;
1390 }
1391
1392
1393 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1394 {
1395         if (pw_id == NULL) {
1396                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1397                 return -1;
1398         }
1399
1400         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1401         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1402
1403         return 0;
1404 }
1405
1406
1407 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1408 {
1409         if (e_hash1 == NULL) {
1410                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1411                 return -1;
1412         }
1413
1414         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1415         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1416
1417         return 0;
1418 }
1419
1420
1421 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1422 {
1423         if (e_hash2 == NULL) {
1424                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1425                 return -1;
1426         }
1427
1428         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1429         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1430
1431         return 0;
1432 }
1433
1434
1435 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1436 {
1437         u8 hash[SHA256_MAC_LEN];
1438         const u8 *addr[4];
1439         size_t len[4];
1440
1441         if (e_snonce1 == NULL) {
1442                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1443                 return -1;
1444         }
1445
1446         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1447                         WPS_SECRET_NONCE_LEN);
1448
1449         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1450         addr[0] = e_snonce1;
1451         len[0] = WPS_SECRET_NONCE_LEN;
1452         addr[1] = wps->psk1;
1453         len[1] = WPS_PSK_LEN;
1454         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1455         len[2] = wpabuf_len(wps->dh_pubkey_e);
1456         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1457         len[3] = wpabuf_len(wps->dh_pubkey_r);
1458         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1459
1460         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1461                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1462                            "not match with the pre-committed value");
1463                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1464                 return -1;
1465         }
1466
1467         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1468                    "half of the device password");
1469
1470         return 0;
1471 }
1472
1473
1474 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1475 {
1476         u8 hash[SHA256_MAC_LEN];
1477         const u8 *addr[4];
1478         size_t len[4];
1479
1480         if (e_snonce2 == NULL) {
1481                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1482                 return -1;
1483         }
1484
1485         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1486                         WPS_SECRET_NONCE_LEN);
1487
1488         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1489         addr[0] = e_snonce2;
1490         len[0] = WPS_SECRET_NONCE_LEN;
1491         addr[1] = wps->psk2;
1492         len[1] = WPS_PSK_LEN;
1493         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1494         len[2] = wpabuf_len(wps->dh_pubkey_e);
1495         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1496         len[3] = wpabuf_len(wps->dh_pubkey_r);
1497         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1498
1499         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1500                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1501                            "not match with the pre-committed value");
1502                 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
1503                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1504                 return -1;
1505         }
1506
1507         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1508                    "half of the device password");
1509         wps->wps_pin_revealed = 0;
1510         wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
1511
1512         return 0;
1513 }
1514
1515
1516 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1517 {
1518         if (mac_addr == NULL) {
1519                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1520                 return -1;
1521         }
1522
1523         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1524                    MAC2STR(mac_addr));
1525         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1526         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1527
1528         return 0;
1529 }
1530
1531
1532 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1533                               size_t pk_len)
1534 {
1535         if (pk == NULL || pk_len == 0) {
1536                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1537                 return -1;
1538         }
1539
1540         wpabuf_free(wps->dh_pubkey_e);
1541         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1542         if (wps->dh_pubkey_e == NULL)
1543                 return -1;
1544
1545         return 0;
1546 }
1547
1548
1549 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1550 {
1551         u16 auth_types;
1552
1553         if (auth == NULL) {
1554                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1555                            "received");
1556                 return -1;
1557         }
1558
1559         auth_types = WPA_GET_BE16(auth);
1560
1561         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1562                    auth_types);
1563         wps->auth_type = wps->wps->auth_types & auth_types;
1564         if (wps->auth_type == 0) {
1565                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1566                            "authentication types (own 0x%x Enrollee 0x%x)",
1567                            wps->wps->auth_types, auth_types);
1568                 return -1;
1569         }
1570
1571         return 0;
1572 }
1573
1574
1575 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1576 {
1577         u16 encr_types;
1578
1579         if (encr == NULL) {
1580                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1581                            "received");
1582                 return -1;
1583         }
1584
1585         encr_types = WPA_GET_BE16(encr);
1586
1587         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1588                    encr_types);
1589         wps->encr_type = wps->wps->encr_types & encr_types;
1590         if (wps->encr_type == 0) {
1591                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1592                            "encryption types");
1593                 return -1;
1594         }
1595
1596         return 0;
1597 }
1598
1599
1600 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1601 {
1602         if (conn == NULL) {
1603                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1604                            "received");
1605                 return -1;
1606         }
1607
1608         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1609                    *conn);
1610
1611         return 0;
1612 }
1613
1614
1615 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1616 {
1617         u16 m;
1618
1619         if (methods == NULL) {
1620                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1621                 return -1;
1622         }
1623
1624         m = WPA_GET_BE16(methods);
1625
1626         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1627
1628         return 0;
1629 }
1630
1631
1632 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1633 {
1634         if (state == NULL) {
1635                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1636                            "received");
1637                 return -1;
1638         }
1639
1640         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1641                    *state);
1642
1643         return 0;
1644 }
1645
1646
1647 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1648 {
1649         u16 a;
1650
1651         if (assoc == NULL) {
1652                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1653                 return -1;
1654         }
1655
1656         a = WPA_GET_BE16(assoc);
1657         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
1658
1659         return 0;
1660 }
1661
1662
1663 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
1664 {
1665         u16 e;
1666
1667         if (err == NULL) {
1668                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
1669                 return -1;
1670         }
1671
1672         e = WPA_GET_BE16(err);
1673         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
1674
1675         return 0;
1676 }
1677
1678
1679 static enum wps_process_res wps_process_m1(struct wps_data *wps,
1680                                            struct wps_parse_attr *attr)
1681 {
1682         wpa_printf(MSG_DEBUG, "WPS: Received M1");
1683
1684         if (wps->state != RECV_M1) {
1685                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1686                            "receiving M1", wps->state);
1687                 return WPS_FAILURE;
1688         }
1689
1690         if (wps_process_uuid_e(wps, attr->uuid_e) ||
1691             wps_process_mac_addr(wps, attr->mac_addr) ||
1692             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
1693             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
1694             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
1695             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
1696             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
1697             wps_process_config_methods(wps, attr->config_methods) ||
1698             wps_process_wps_state(wps, attr->wps_state) ||
1699             wps_process_device_attrs(&wps->peer_dev, attr) ||
1700             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
1701             wps_process_assoc_state(wps, attr->assoc_state) ||
1702             wps_process_dev_password_id(wps, attr->dev_password_id) ||
1703             wps_process_config_error(wps, attr->config_error) ||
1704             wps_process_os_version(&wps->peer_dev, attr->os_version))
1705                 return WPS_FAILURE;
1706
1707         if (wps->dev_pw_id != DEV_PW_DEFAULT &&
1708             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
1709             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
1710             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
1711             (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
1712              !wps->wps->registrar->pbc)) {
1713                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
1714                            wps->dev_pw_id);
1715                 wps->state = SEND_M2D;
1716                 return WPS_CONTINUE;
1717         }
1718
1719         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
1720                 if (wps_registrar_pbc_overlap(wps->wps->registrar,
1721                                               wps->mac_addr_e, wps->uuid_e)) {
1722                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
1723                                    "negotiation");
1724                         wps->state = SEND_M2D;
1725                         return WPS_CONTINUE;
1726                 }
1727                 wps_registrar_add_pbc_session(wps->wps->registrar,
1728                                               wps->mac_addr_e, wps->uuid_e);
1729                 wps->pbc = 1;
1730         }
1731
1732         wps->state = SEND_M2;
1733         return WPS_CONTINUE;
1734 }
1735
1736
1737 static enum wps_process_res wps_process_m3(struct wps_data *wps,
1738                                            const struct wpabuf *msg,
1739                                            struct wps_parse_attr *attr)
1740 {
1741         wpa_printf(MSG_DEBUG, "WPS: Received M3");
1742
1743         if (wps->state != RECV_M3) {
1744                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1745                            "receiving M3", wps->state);
1746                 wps->state = SEND_WSC_NACK;
1747                 return WPS_CONTINUE;
1748         }
1749
1750         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1751             wps_process_authenticator(wps, attr->authenticator, msg) ||
1752             wps_process_e_hash1(wps, attr->e_hash1) ||
1753             wps_process_e_hash2(wps, attr->e_hash2)) {
1754                 wps->state = SEND_WSC_NACK;
1755                 return WPS_CONTINUE;
1756         }
1757
1758         wps->state = SEND_M4;
1759         return WPS_CONTINUE;
1760 }
1761
1762
1763 static enum wps_process_res wps_process_m5(struct wps_data *wps,
1764                                            const struct wpabuf *msg,
1765                                            struct wps_parse_attr *attr)
1766 {
1767         struct wpabuf *decrypted;
1768         struct wps_parse_attr eattr;
1769
1770         wpa_printf(MSG_DEBUG, "WPS: Received M5");
1771
1772         if (wps->state != RECV_M5) {
1773                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1774                            "receiving M5", wps->state);
1775                 wps->state = SEND_WSC_NACK;
1776                 return WPS_CONTINUE;
1777         }
1778
1779         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1780             wps_process_authenticator(wps, attr->authenticator, msg)) {
1781                 wps->state = SEND_WSC_NACK;
1782                 return WPS_CONTINUE;
1783         }
1784
1785         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1786                                               attr->encr_settings_len);
1787         if (decrypted == NULL) {
1788                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1789                            "Settings attribute");
1790                 wps->state = SEND_WSC_NACK;
1791                 return WPS_CONTINUE;
1792         }
1793
1794         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1795                    "attribute");
1796         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1797             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1798             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
1799                 wpabuf_free(decrypted);
1800                 wps->state = SEND_WSC_NACK;
1801                 return WPS_CONTINUE;
1802         }
1803         wpabuf_free(decrypted);
1804
1805         wps->state = SEND_M6;
1806         return WPS_CONTINUE;
1807 }
1808
1809
1810 static int wps_process_ap_settings_r(struct wps_data *wps,
1811                                      struct wps_parse_attr *attr)
1812 {
1813         if (wps->wps->ap)
1814                 return 0;
1815
1816         /* AP Settings Attributes in M7 when Enrollee is an AP */
1817         if (wps_process_ap_settings(attr, &wps->cred) < 0)
1818                 return -1;
1819
1820         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
1821
1822         /*
1823          * TODO: Provide access to AP settings and allow changes before sending
1824          * out M8. For now, just copy the settings unchanged into M8.
1825          */
1826
1827         return 0;
1828 }
1829
1830
1831 static enum wps_process_res wps_process_m7(struct wps_data *wps,
1832                                            const struct wpabuf *msg,
1833                                            struct wps_parse_attr *attr)
1834 {
1835         struct wpabuf *decrypted;
1836         struct wps_parse_attr eattr;
1837
1838         wpa_printf(MSG_DEBUG, "WPS: Received M7");
1839
1840         if (wps->state != RECV_M7) {
1841                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1842                            "receiving M7", wps->state);
1843                 wps->state = SEND_WSC_NACK;
1844                 return WPS_CONTINUE;
1845         }
1846
1847         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1848             wps_process_authenticator(wps, attr->authenticator, msg)) {
1849                 wps->state = SEND_WSC_NACK;
1850                 return WPS_CONTINUE;
1851         }
1852
1853         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1854                                               attr->encr_settings_len);
1855         if (decrypted == NULL) {
1856                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1857                            "Settings attribute");
1858                 wps->state = SEND_WSC_NACK;
1859                 return WPS_CONTINUE;
1860         }
1861
1862         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1863                    "attribute");
1864         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1865             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1866             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
1867             wps_process_ap_settings_r(wps, &eattr)) {
1868                 wpabuf_free(decrypted);
1869                 wps->state = SEND_WSC_NACK;
1870                 return WPS_CONTINUE;
1871         }
1872
1873         wpabuf_free(decrypted);
1874
1875         wps->state = SEND_M8;
1876         return WPS_CONTINUE;
1877 }
1878
1879
1880 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
1881                                                 const struct wpabuf *msg)
1882 {
1883         struct wps_parse_attr attr;
1884         enum wps_process_res ret = WPS_CONTINUE;
1885
1886         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
1887
1888         if (wps_parse_msg(msg, &attr) < 0)
1889                 return WPS_FAILURE;
1890
1891         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1892                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1893                            attr.version ? *attr.version : 0);
1894                 return WPS_FAILURE;
1895         }
1896
1897         if (attr.msg_type == NULL) {
1898                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1899                 return WPS_FAILURE;
1900         }
1901
1902         if (*attr.msg_type != WPS_M1 &&
1903             (attr.registrar_nonce == NULL ||
1904              os_memcmp(wps->nonce_r, attr.registrar_nonce,
1905                        WPS_NONCE_LEN != 0))) {
1906                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1907                 return WPS_FAILURE;
1908         }
1909
1910         switch (*attr.msg_type) {
1911         case WPS_M1:
1912                 ret = wps_process_m1(wps, &attr);
1913                 break;
1914         case WPS_M3:
1915                 ret = wps_process_m3(wps, msg, &attr);
1916                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1917                         wps_fail_event(wps->wps, WPS_M3);
1918                 break;
1919         case WPS_M5:
1920                 ret = wps_process_m5(wps, msg, &attr);
1921                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1922                         wps_fail_event(wps->wps, WPS_M5);
1923                 break;
1924         case WPS_M7:
1925                 ret = wps_process_m7(wps, msg, &attr);
1926                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1927                         wps_fail_event(wps->wps, WPS_M7);
1928                 break;
1929         default:
1930                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
1931                            *attr.msg_type);
1932                 return WPS_FAILURE;
1933         }
1934
1935         if (ret == WPS_CONTINUE) {
1936                 /* Save a copy of the last message for Authenticator derivation
1937                  */
1938                 wpabuf_free(wps->last_msg);
1939                 wps->last_msg = wpabuf_dup(msg);
1940         }
1941
1942         return ret;
1943 }
1944
1945
1946 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
1947                                                 const struct wpabuf *msg)
1948 {
1949         struct wps_parse_attr attr;
1950
1951         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
1952
1953         if (wps_parse_msg(msg, &attr) < 0)
1954                 return WPS_FAILURE;
1955
1956         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1957                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1958                            attr.version ? *attr.version : 0);
1959                 return WPS_FAILURE;
1960         }
1961
1962         if (attr.msg_type == NULL) {
1963                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1964                 return WPS_FAILURE;
1965         }
1966
1967         if (*attr.msg_type != WPS_WSC_ACK) {
1968                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1969                            *attr.msg_type);
1970                 return WPS_FAILURE;
1971         }
1972
1973         if (attr.registrar_nonce == NULL ||
1974             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1975         {
1976                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1977                 return WPS_FAILURE;
1978         }
1979
1980         if (attr.enrollee_nonce == NULL ||
1981             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1982                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1983                 return WPS_FAILURE;
1984         }
1985
1986         if (wps->state == RECV_M2D_ACK) {
1987                 /* TODO: support for multiple registrars and sending of
1988                  * multiple M2/M2D messages */
1989
1990                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
1991                            "terminate negotiation");
1992         }
1993
1994         return WPS_FAILURE;
1995 }
1996
1997
1998 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
1999                                                  const struct wpabuf *msg)
2000 {
2001         struct wps_parse_attr attr;
2002         int old_state;
2003
2004         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
2005
2006         old_state = wps->state;
2007         wps->state = SEND_WSC_NACK;
2008
2009         if (wps_parse_msg(msg, &attr) < 0)
2010                 return WPS_FAILURE;
2011
2012         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2013                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2014                            attr.version ? *attr.version : 0);
2015                 return WPS_FAILURE;
2016         }
2017
2018         if (attr.msg_type == NULL) {
2019                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2020                 return WPS_FAILURE;
2021         }
2022
2023         if (*attr.msg_type != WPS_WSC_NACK) {
2024                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2025                            *attr.msg_type);
2026                 return WPS_FAILURE;
2027         }
2028
2029         if (attr.registrar_nonce == NULL ||
2030             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2031         {
2032                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2033                 return WPS_FAILURE;
2034         }
2035
2036         if (attr.enrollee_nonce == NULL ||
2037             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2038                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2039                 return WPS_FAILURE;
2040         }
2041
2042         if (attr.config_error == NULL) {
2043                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
2044                            "in WSC_NACK");
2045                 return WPS_FAILURE;
2046         }
2047
2048         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
2049                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
2050
2051         switch (old_state) {
2052         case RECV_M3:
2053                 wps_fail_event(wps->wps, WPS_M2);
2054                 break;
2055         case RECV_M5:
2056                 wps_fail_event(wps->wps, WPS_M4);
2057                 break;
2058         case RECV_M7:
2059                 wps_fail_event(wps->wps, WPS_M6);
2060                 break;
2061         case RECV_DONE:
2062                 wps_fail_event(wps->wps, WPS_M8);
2063                 break;
2064         default:
2065                 break;
2066         }
2067
2068         return WPS_FAILURE;
2069 }
2070
2071
2072 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
2073                                                  const struct wpabuf *msg)
2074 {
2075         struct wps_parse_attr attr;
2076
2077         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
2078
2079         if (wps->state != RECV_DONE) {
2080                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2081                            "receiving WSC_Done", wps->state);
2082                 return WPS_FAILURE;
2083         }
2084
2085         if (wps_parse_msg(msg, &attr) < 0)
2086                 return WPS_FAILURE;
2087
2088         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2089                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2090                            attr.version ? *attr.version : 0);
2091                 return WPS_FAILURE;
2092         }
2093
2094         if (attr.msg_type == NULL) {
2095                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2096                 return WPS_FAILURE;
2097         }
2098
2099         if (*attr.msg_type != WPS_WSC_DONE) {
2100                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2101                            *attr.msg_type);
2102                 return WPS_FAILURE;
2103         }
2104
2105         if (attr.registrar_nonce == NULL ||
2106             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2107         {
2108                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2109                 return WPS_FAILURE;
2110         }
2111
2112         if (attr.enrollee_nonce == NULL ||
2113             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2114                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2115                 return WPS_FAILURE;
2116         }
2117
2118         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
2119
2120         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
2121             wps->wps->ap) {
2122                 struct wps_credential cred;
2123
2124                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
2125                            "on first Enrollee connection");
2126
2127                 os_memset(&cred, 0, sizeof(cred));
2128                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
2129                 cred.ssid_len = wps->wps->ssid_len;
2130                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
2131                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
2132                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
2133                 cred.key_len = wps->new_psk_len;
2134
2135                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
2136                 wpa_hexdump_ascii_key(MSG_DEBUG,
2137                                       "WPS: Generated random passphrase",
2138                                       wps->new_psk, wps->new_psk_len);
2139                 if (wps->wps->cred_cb)
2140                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
2141
2142                 os_free(wps->new_psk);
2143                 wps->new_psk = NULL;
2144         }
2145
2146         if (!wps->wps->ap) {
2147                 wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
2148                            "on the modified AP configuration");
2149                 if (wps->wps->cred_cb)
2150                         wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2151         }
2152
2153         if (wps->new_psk) {
2154                 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
2155                                    wps->new_psk, wps->new_psk_len)) {
2156                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
2157                                    "new PSK");
2158                 }
2159                 os_free(wps->new_psk);
2160                 wps->new_psk = NULL;
2161         }
2162
2163         if (wps->pbc) {
2164                 wps_registrar_remove_pbc_session(wps->wps->registrar,
2165                                                  wps->mac_addr_e, wps->uuid_e);
2166                 wps_registrar_pbc_completed(wps->wps->registrar);
2167         }
2168
2169         wps_success_event(wps->wps);
2170
2171         return WPS_DONE;
2172 }
2173
2174
2175 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
2176                                                enum wsc_op_code op_code,
2177                                                const struct wpabuf *msg)
2178 {
2179         enum wps_process_res ret;
2180
2181         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2182                    "op_code=%d)",
2183                    (unsigned long) wpabuf_len(msg), op_code);
2184
2185         switch (op_code) {
2186         case WSC_MSG:
2187                 return wps_process_wsc_msg(wps, msg);
2188         case WSC_ACK:
2189                 return wps_process_wsc_ack(wps, msg);
2190         case WSC_NACK:
2191                 return wps_process_wsc_nack(wps, msg);
2192         case WSC_Done:
2193                 ret = wps_process_wsc_done(wps, msg);
2194                 if (ret == WPS_FAILURE) {
2195                         wps->state = SEND_WSC_NACK;
2196                         wps_fail_event(wps->wps, WPS_WSC_DONE);
2197                 }
2198                 return ret;
2199         default:
2200                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
2201                 return WPS_FAILURE;
2202         }
2203 }