git.maemo.org Git - wpasupplicant/blob - src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24
  25
  26 struct wps_uuid_pin {
  27         struct wps_uuid_pin *next;
  28         u8 uuid[WPS_UUID_LEN];
  29         u8 *pin;
  30         size_t pin_len;
  31         int locked;
  32 };
  33
  34
  35 static void wps_free_pin(struct wps_uuid_pin *pin)
  36 {
  37         os_free(pin->pin);
  38         os_free(pin);
  39 }
  40
  41
  42 static void wps_free_pins(struct wps_uuid_pin *pins)
  43 {
  44         struct wps_uuid_pin *pin, *prev;
  45
  46         pin = pins;
  47         while (pin) {
  48                 prev = pin;
  49                 pin = pin->next;
  50                 wps_free_pin(prev);
  51         }
  52 }
  53
  54
  55 struct wps_pbc_session {
  56         struct wps_pbc_session *next;
  57         u8 addr[ETH_ALEN];
  58         u8 uuid_e[WPS_UUID_LEN];
  59         struct os_time timestamp;
  60 };
  61
  62
  63 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  64 {
  65         struct wps_pbc_session *prev;
  66
  67         while (pbc) {
  68                 prev = pbc;
  69                 pbc = pbc->next;
  70                 os_free(prev);
  71         }
  72 }
  73
  74
  75 struct wps_registrar {
  76         struct wps_context *wps;
  77
  78         int pbc;
  79         int selected_registrar;
  80
  81         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  82                           size_t psk_len);
  83         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  84                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
  85         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
  86                               const struct wps_device_data *dev);
  87         void *cb_ctx;
  88
  89         struct wps_uuid_pin *pins;
  90         struct wps_pbc_session *pbc_sessions;
  91 };
  92
  93
  94 static int wps_set_ie(struct wps_registrar *reg);
  95 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
  96
  97
  98 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
  99                                           const u8 *addr, const u8 *uuid_e)
 100 {
 101         struct wps_pbc_session *pbc, *prev = NULL;
 102         struct os_time now;
 103
 104         os_get_time(&now);
 105
 106         pbc = reg->pbc_sessions;
 107         while (pbc) {
 108                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 109                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 110                         if (prev)
 111                                 prev->next = pbc->next;
 112                         else
 113                                 reg->pbc_sessions = pbc->next;
 114                         break;
 115                 }
 116                 prev = pbc;
 117                 pbc = pbc->next;
 118         }
 119
 120         if (!pbc) {
 121                 pbc = os_zalloc(sizeof(*pbc));
 122                 if (pbc == NULL)
 123                         return;
 124                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 125                 if (uuid_e)
 126                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 127         }
 128
 129         pbc->next = reg->pbc_sessions;
 130         reg->pbc_sessions = pbc;
 131         pbc->timestamp = now;
 132
 133         /* remove entries that have timed out */
 134         prev = pbc;
 135         pbc = pbc->next;
 136
 137         while (pbc) {
 138                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 139                         prev->next = NULL;
 140                         wps_free_pbc_sessions(pbc);
 141                         break;
 142                 }
 143                 prev = pbc;
 144                 pbc = pbc->next;
 145         }
 146 }
 147
 148
 149 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 150                                              const u8 *addr, const u8 *uuid_e)
 151 {
 152         struct wps_pbc_session *pbc, *prev = NULL;
 153
 154         pbc = reg->pbc_sessions;
 155         while (pbc) {
 156                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 157                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 158                         if (prev)
 159                                 prev->next = pbc->next;
 160                         else
 161                                 reg->pbc_sessions = pbc->next;
 162                         os_free(pbc);
 163                         break;
 164                 }
 165                 prev = pbc;
 166                 pbc = pbc->next;
 167         }
 168 }
 169
 170
 171 int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 172                               const u8 *addr, const u8 *uuid_e)
 173 {
 174         int count = 0;
 175         struct wps_pbc_session *pbc;
 176         struct os_time now;
 177
 178         os_get_time(&now);
 179
 180         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 181                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 182                         break;
 183                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 184                     uuid_e == NULL ||
 185                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 186                         count++;
 187         }
 188
 189         if (addr || uuid_e)
 190                 count++;
 191
 192         return count > 1 ? 1 : 0;
 193 }
 194
 195
 196 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 197 {
 198         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 199                    wps->wps_state);
 200         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 201         wpabuf_put_be16(msg, 1);
 202         wpabuf_put_u8(msg, wps->wps_state);
 203         return 0;
 204 }
 205
 206
 207 static int wps_build_ap_setup_locked(struct wps_context *wps,
 208                                      struct wpabuf *msg)
 209 {
 210         if (wps->ap_setup_locked) {
 211                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 212                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 213                 wpabuf_put_be16(msg, 1);
 214                 wpabuf_put_u8(msg, 1);
 215         }
 216         return 0;
 217 }
 218
 219
 220 static int wps_build_selected_registrar(struct wps_registrar *reg,
 221                                         struct wpabuf *msg)
 222 {
 223         if (!reg->selected_registrar)
 224                 return 0;
 225         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 226         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 227         wpabuf_put_be16(msg, 1);
 228         wpabuf_put_u8(msg, 1);
 229         return 0;
 230 }
 231
 232
 233 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 234                                              struct wpabuf *msg)
 235 {
 236         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 237         if (!reg->selected_registrar)
 238                 return 0;
 239         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 240         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 241         wpabuf_put_be16(msg, 2);
 242         wpabuf_put_be16(msg, id);
 243         return 0;
 244 }
 245
 246
 247 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 248                                             struct wpabuf *msg)
 249 {
 250         u16 methods;
 251         if (!reg->selected_registrar)
 252                 return 0;
 253         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 254         if (reg->pbc)
 255                 methods |= WPS_CONFIG_PUSHBUTTON;
 256         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 257                    methods);
 258         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 259         wpabuf_put_be16(msg, 2);
 260         wpabuf_put_be16(msg, methods);
 261         return 0;
 262 }
 263
 264
 265 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 266                                           struct wpabuf *msg)
 267 {
 268         u16 methods;
 269         methods = 0;
 270         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 271         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 272         wpabuf_put_be16(msg, 2);
 273         wpabuf_put_be16(msg, methods);
 274         return 0;
 275 }
 276
 277
 278 static int wps_build_config_methods_r(struct wps_registrar *reg,
 279                                       struct wpabuf *msg)
 280 {
 281         u16 methods;
 282         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 283         if (reg->pbc)
 284                 methods |= WPS_CONFIG_PUSHBUTTON;
 285         return wps_build_config_methods(msg, methods);
 286 }
 287
 288
 289 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 290 {
 291         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 292         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 293         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 294         wpabuf_put_be16(msg, 1);
 295         wpabuf_put_u8(msg, resp);
 296         return 0;
 297 }
 298
 299
 300 struct wps_registrar *
 301 wps_registrar_init(struct wps_context *wps,
 302                    const struct wps_registrar_config *cfg)
 303 {
 304         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 305         if (reg == NULL)
 306                 return NULL;
 307
 308         reg->wps = wps;
 309         reg->new_psk_cb = cfg->new_psk_cb;
 310         reg->set_ie_cb = cfg->set_ie_cb;
 311         reg->pin_needed_cb = cfg->pin_needed_cb;
 312         reg->cb_ctx = cfg->cb_ctx;
 313
 314         if (wps_set_ie(reg)) {
 315                 wps_registrar_deinit(reg);
 316                 return NULL;
 317         }
 318
 319         return reg;
 320 }
 321
 322
 323 void wps_registrar_deinit(struct wps_registrar *reg)
 324 {
 325         if (reg == NULL)
 326                 return;
 327         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 328         wps_free_pins(reg->pins);
 329         wps_free_pbc_sessions(reg->pbc_sessions);
 330         os_free(reg);
 331 }
 332
 333
 334 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 335                           const u8 *pin, size_t pin_len)
 336 {
 337         struct wps_uuid_pin *p;
 338
 339         p = os_zalloc(sizeof(*p));
 340         if (p == NULL)
 341                 return -1;
 342         os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 343         p->pin = os_malloc(pin_len);
 344         if (p->pin == NULL) {
 345                 os_free(p);
 346                 return -1;
 347         }
 348         os_memcpy(p->pin, pin, pin_len);
 349         p->pin_len = pin_len;
 350
 351         p->next = reg->pins;
 352         reg->pins = p;
 353
 354         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
 355         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 356         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 357         reg->selected_registrar = 1;
 358         reg->pbc = 0;
 359         wps_set_ie(reg);
 360
 361         return 0;
 362 }
 363
 364
 365 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 366 {
 367         struct wps_uuid_pin *pin, *prev;
 368
 369         prev = NULL;
 370         pin = reg->pins;
 371         while (pin) {
 372                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 373                         if (prev == NULL)
 374                                 reg->pins = pin->next;
 375                         else
 376                                 prev->next = pin->next;
 377                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 378                                     pin->uuid, WPS_UUID_LEN);
 379                         wps_free_pin(pin);
 380                         return 0;
 381                 }
 382                 prev = pin;
 383                 pin = pin->next;
 384         }
 385
 386         return -1;
 387 }
 388
 389
 390 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 391                                         const u8 *uuid, size_t *pin_len)
 392 {
 393         struct wps_uuid_pin *pin;
 394
 395         pin = reg->pins;
 396         while (pin) {
 397                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 398                         /*
 399                          * Lock the PIN to avoid attacks based on concurrent
 400                          * re-use of the PIN that could otherwise avoid PIN
 401                          * invalidations.
 402                          */
 403                         if (pin->locked) {
 404                                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN "
 405                                            "locked - do not allow concurrent "
 406                                            "re-use");
 407                                 return NULL;
 408                         }
 409                         *pin_len = pin->pin_len;
 410                         pin->locked = 1;
 411                         return pin->pin;
 412                 }
 413                 pin = pin->next;
 414         }
 415
 416         return NULL;
 417 }
 418
 419
 420 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 421 {
 422         struct wps_uuid_pin *pin;
 423
 424         pin = reg->pins;
 425         while (pin) {
 426                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 427                         pin->locked = 0;
 428                         return 0;
 429                 }
 430                 pin = pin->next;
 431         }
 432
 433         return -1;
 434 }
 435
 436
 437 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 438 {
 439         struct wps_registrar *reg = eloop_ctx;
 440
 441         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 442         reg->selected_registrar = 0;
 443         reg->pbc = 0;
 444         wps_set_ie(reg);
 445 }
 446
 447
 448 int wps_registrar_button_pushed(struct wps_registrar *reg)
 449 {
 450         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 451                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 452                            "mode");
 453                 return -1;
 454         }
 455         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 456         reg->selected_registrar = 1;
 457         reg->pbc = 1;
 458         wps_set_ie(reg);
 459
 460         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 461         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 462                                reg, NULL);
 463         return 0;
 464 }
 465
 466
 467 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 468 {
 469         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 470         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 471         reg->selected_registrar = 0;
 472         reg->pbc = 0;
 473         wps_set_ie(reg);
 474 }
 475
 476
 477 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 478                                 const struct wpabuf *wps_data)
 479 {
 480         struct wps_parse_attr attr;
 481         u16 methods;
 482
 483         wpa_hexdump_buf(MSG_MSGDUMP,
 484                         "WPS: Probe Request with WPS data received",
 485                         wps_data);
 486
 487         if (wps_parse_msg(wps_data, &attr) < 0 ||
 488             attr.version == NULL || *attr.version != WPS_VERSION) {
 489                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 490                            "version 0x%x", attr.version ? *attr.version : 0);
 491                 return;
 492         }
 493
 494         if (attr.config_methods == NULL) {
 495                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 496                            "Probe Request");
 497                 return;
 498         }
 499
 500         methods = WPA_GET_BE16(attr.config_methods);
 501         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 502                 return; /* Not PBC */
 503
 504         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 505                    MACSTR, MAC2STR(addr));
 506
 507         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 508 }
 509
 510
 511 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 512                           const u8 *psk, size_t psk_len)
 513 {
 514         if (reg->new_psk_cb == NULL)
 515                 return 0;
 516
 517         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 518 }
 519
 520
 521 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 522                               const struct wps_device_data *dev)
 523 {
 524         if (reg->pin_needed_cb == NULL)
 525                 return;
 526
 527         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 528 }
 529
 530
 531 static int wps_cb_set_ie(struct wps_registrar *reg,
 532                          const struct wpabuf *beacon_ie,
 533                          const struct wpabuf *probe_resp_ie)
 534 {
 535         if (reg->set_ie_cb == NULL)
 536                 return 0;
 537
 538         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 539                               wpabuf_len(beacon_ie),
 540                               wpabuf_head(probe_resp_ie),
 541                               wpabuf_len(probe_resp_ie));
 542 }
 543
 544
 545 static int wps_set_ie(struct wps_registrar *reg)
 546 {
 547         struct wpabuf *beacon;
 548         struct wpabuf *probe;
 549         int ret;
 550         u8 *blen, *plen;
 551
 552         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 553
 554         beacon = wpabuf_alloc(300);
 555         if (beacon == NULL)
 556                 return -1;
 557         probe = wpabuf_alloc(300);
 558         if (probe == NULL) {
 559                 wpabuf_free(beacon);
 560                 return -1;
 561         }
 562
 563         wpabuf_put_u8(beacon, WLAN_EID_VENDOR_SPECIFIC);
 564         blen = wpabuf_put(beacon, 1);
 565         wpabuf_put_be32(beacon, WPS_DEV_OUI_WFA);
 566
 567         wpabuf_put_u8(probe, WLAN_EID_VENDOR_SPECIFIC);
 568         plen = wpabuf_put(probe, 1);
 569         wpabuf_put_be32(probe, WPS_DEV_OUI_WFA);
 570
 571         if (wps_build_version(beacon) ||
 572             wps_build_wps_state(reg->wps, beacon) ||
 573             wps_build_ap_setup_locked(reg->wps, beacon) ||
 574             wps_build_selected_registrar(reg, beacon) ||
 575             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 576             wps_build_sel_reg_config_methods(reg, beacon) ||
 577             wps_build_version(probe) ||
 578             wps_build_wps_state(reg->wps, probe) ||
 579             wps_build_ap_setup_locked(reg->wps, probe) ||
 580             wps_build_selected_registrar(reg, probe) ||
 581             wps_build_sel_reg_dev_password_id(reg, probe) ||
 582             wps_build_sel_reg_config_methods(reg, probe) ||
 583             wps_build_resp_type(reg, probe) ||
 584             wps_build_uuid_e(probe, reg->wps->uuid) ||
 585             wps_build_device_attrs(&reg->wps->dev, probe) ||
 586             wps_build_probe_config_methods(reg, probe) ||
 587             wps_build_rf_bands(&reg->wps->dev, probe)) {
 588                 wpabuf_free(beacon);
 589                 wpabuf_free(probe);
 590                 return -1;
 591         }
 592
 593         *blen = wpabuf_len(beacon) - 2;
 594         *plen = wpabuf_len(probe) - 2;
 595
 596         ret = wps_cb_set_ie(reg, beacon, probe);
 597         wpabuf_free(beacon);
 598         wpabuf_free(probe);
 599
 600         return ret;
 601 }
 602
 603
 604 static int wps_get_dev_password(struct wps_data *wps)
 605 {
 606         const u8 *pin;
 607         size_t pin_len;
 608
 609         os_free(wps->dev_password);
 610         wps->dev_password = NULL;
 611
 612         if (wps->pbc) {
 613                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 614                 pin = (const u8 *) "00000000";
 615                 pin_len = 8;
 616         } else {
 617                 pin = wps_registrar_get_pin(wps->registrar, wps->uuid_e,
 618                                             &pin_len);
 619         }
 620         if (pin == NULL) {
 621                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 622                            "the Enrollee");
 623                 wps_cb_pin_needed(wps->registrar, wps->uuid_e, &wps->peer_dev);
 624                 return -1;
 625         }
 626
 627         wps->dev_password = os_malloc(pin_len);
 628         if (wps->dev_password == NULL)
 629                 return -1;
 630         os_memcpy(wps->dev_password, pin, pin_len);
 631         wps->dev_password_len = pin_len;
 632
 633         return 0;
 634 }
 635
 636
 637 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
 638 {
 639         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
 640         wpabuf_put_be16(msg, ATTR_UUID_R);
 641         wpabuf_put_be16(msg, WPS_UUID_LEN);
 642         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
 643         return 0;
 644 }
 645
 646
 647 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
 648 {
 649         u8 *hash;
 650         const u8 *addr[4];
 651         size_t len[4];
 652
 653         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
 654                 return -1;
 655         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
 656         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
 657                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
 658
 659         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
 660                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
 661                            "R-Hash derivation");
 662                 return -1;
 663         }
 664
 665         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
 666         wpabuf_put_be16(msg, ATTR_R_HASH1);
 667         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 668         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 669         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
 670         addr[0] = wps->snonce;
 671         len[0] = WPS_SECRET_NONCE_LEN;
 672         addr[1] = wps->psk1;
 673         len[1] = WPS_PSK_LEN;
 674         addr[2] = wpabuf_head(wps->dh_pubkey_e);
 675         len[2] = wpabuf_len(wps->dh_pubkey_e);
 676         addr[3] = wpabuf_head(wps->dh_pubkey_r);
 677         len[3] = wpabuf_len(wps->dh_pubkey_r);
 678         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 679         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
 680
 681         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
 682         wpabuf_put_be16(msg, ATTR_R_HASH2);
 683         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 684         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 685         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
 686         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
 687         addr[1] = wps->psk2;
 688         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 689         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
 690
 691         return 0;
 692 }
 693
 694
 695 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
 696 {
 697         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
 698         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
 699         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 700         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
 701         return 0;
 702 }
 703
 704
 705 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 706 {
 707         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
 708         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
 709         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 710         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
 711                         WPS_SECRET_NONCE_LEN);
 712         return 0;
 713 }
 714
 715
 716 static int wps_build_cred_network_idx(struct wpabuf *msg,
 717                                       struct wps_credential *cred)
 718 {
 719         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
 720         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
 721         wpabuf_put_be16(msg, 1);
 722         wpabuf_put_u8(msg, 0);
 723         return 0;
 724 }
 725
 726
 727 static int wps_build_cred_ssid(struct wpabuf *msg,
 728                                struct wps_credential *cred)
 729 {
 730         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
 731         wpabuf_put_be16(msg, ATTR_SSID);
 732         wpabuf_put_be16(msg, cred->ssid_len);
 733         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
 734         return 0;
 735 }
 736
 737
 738 static int wps_build_cred_auth_type(struct wpabuf *msg,
 739                                     struct wps_credential *cred)
 740 {
 741         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
 742                    cred->auth_type);
 743         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
 744         wpabuf_put_be16(msg, 2);
 745         wpabuf_put_be16(msg, cred->auth_type);
 746         return 0;
 747 }
 748
 749
 750 static int wps_build_cred_encr_type(struct wpabuf *msg,
 751                                     struct wps_credential *cred)
 752 {
 753         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
 754                    cred->encr_type);
 755         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
 756         wpabuf_put_be16(msg, 2);
 757         wpabuf_put_be16(msg, cred->encr_type);
 758         return 0;
 759 }
 760
 761
 762 static int wps_build_cred_network_key(struct wpabuf *msg,
 763                                       struct wps_credential *cred)
 764 {
 765         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
 766         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
 767         wpabuf_put_be16(msg, cred->key_len);
 768         wpabuf_put_data(msg, cred->key, cred->key_len);
 769         return 0;
 770 }
 771
 772
 773 static int wps_build_cred_mac_addr(struct wpabuf *msg,
 774                                    struct wps_credential *cred)
 775 {
 776         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address");
 777         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
 778         wpabuf_put_be16(msg, ETH_ALEN);
 779         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
 780         return 0;
 781 }
 782
 783
 784 static int wps_build_credential(struct wpabuf *msg,
 785                                 struct wps_credential *cred)
 786 {
 787         if (wps_build_cred_network_idx(msg, cred) ||
 788             wps_build_cred_ssid(msg, cred) ||
 789             wps_build_cred_auth_type(msg, cred) ||
 790             wps_build_cred_encr_type(msg, cred) ||
 791             wps_build_cred_network_key(msg, cred) ||
 792             wps_build_cred_mac_addr(msg, cred))
 793                 return -1;
 794         return 0;
 795 }
 796
 797
 798 static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 799 {
 800         struct wpabuf *cred;
 801
 802         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
 803         os_memset(&wps->cred, 0, sizeof(wps->cred));
 804
 805         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
 806         wps->cred.ssid_len = wps->wps->ssid_len;
 807
 808         /* Select the best authentication and encryption type */
 809         if (wps->auth_type & WPS_AUTH_WPA2PSK)
 810                 wps->auth_type = WPS_AUTH_WPA2PSK;
 811         else if (wps->auth_type & WPS_AUTH_WPAPSK)
 812                 wps->auth_type = WPS_AUTH_WPAPSK;
 813         else if (wps->auth_type & WPS_AUTH_OPEN)
 814                 wps->auth_type = WPS_AUTH_OPEN;
 815         else if (wps->auth_type & WPS_AUTH_SHARED)
 816                 wps->auth_type = WPS_AUTH_SHARED;
 817         else {
 818                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
 819                            wps->auth_type);
 820                 return -1;
 821         }
 822         wps->cred.auth_type = wps->auth_type;
 823
 824         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
 825             wps->auth_type == WPS_AUTH_WPAPSK) {
 826                 if (wps->encr_type & WPS_ENCR_AES)
 827                         wps->encr_type = WPS_ENCR_AES;
 828                 else if (wps->encr_type & WPS_ENCR_TKIP)
 829                         wps->encr_type = WPS_ENCR_TKIP;
 830                 else {
 831                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 832                                    "type for WPA/WPA2");
 833                         return -1;
 834                 }
 835         } else {
 836                 if (wps->encr_type & WPS_ENCR_WEP)
 837                         wps->encr_type = WPS_ENCR_WEP;
 838                 else if (wps->encr_type & WPS_ENCR_NONE)
 839                         wps->encr_type = WPS_ENCR_NONE;
 840                 else {
 841                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 842                                    "type for non-WPA/WPA2 mode");
 843                         return -1;
 844                 }
 845         }
 846         wps->cred.encr_type = wps->encr_type;
 847         os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
 848
 849         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap) {
 850                 u8 r[16];
 851                 /* Generate a random passphrase */
 852                 if (os_get_random(r, sizeof(r)) < 0)
 853                         return -1;
 854                 os_free(wps->new_psk);
 855                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
 856                 if (wps->new_psk == NULL)
 857                         return -1;
 858                 wps->new_psk_len--; /* remove newline */
 859                 while (wps->new_psk_len &&
 860                        wps->new_psk[wps->new_psk_len - 1] == '=')
 861                         wps->new_psk_len--;
 862                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
 863                                       wps->new_psk, wps->new_psk_len);
 864                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
 865                 wps->cred.key_len = wps->new_psk_len;
 866         } else if (wps->wps->network_key) {
 867                 os_memcpy(wps->cred.key, wps->wps->network_key,
 868                           wps->wps->network_key_len);
 869                 wps->cred.key_len = wps->wps->network_key_len;
 870         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 871                 char hex[65];
 872                 /* Generate a random per-device PSK */
 873                 os_free(wps->new_psk);
 874                 wps->new_psk_len = 32;
 875                 wps->new_psk = os_malloc(wps->new_psk_len);
 876                 if (wps->new_psk == NULL)
 877                         return -1;
 878                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
 879                         os_free(wps->new_psk);
 880                         wps->new_psk = NULL;
 881                         return -1;
 882                 }
 883                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
 884                                 wps->new_psk, wps->new_psk_len);
 885                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
 886                                  wps->new_psk_len);
 887                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
 888                 wps->cred.key_len = wps->new_psk_len * 2;
 889         }
 890
 891         cred = wpabuf_alloc(200);
 892         if (cred == NULL)
 893                 return -1;
 894
 895         if (wps_build_credential(cred, &wps->cred)) {
 896                 wpabuf_free(cred);
 897                 return -1;
 898         }
 899
 900         wpabuf_put_be16(msg, ATTR_CRED);
 901         wpabuf_put_be16(msg, wpabuf_len(cred));
 902         wpabuf_put_buf(msg, cred);
 903         wpabuf_free(cred);
 904
 905         return 0;
 906 }
 907
 908
 909 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
 910 {
 911         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
 912
 913         if (wps_build_credential(msg, &wps->cred))
 914                 return -1;
 915
 916         return 0;
 917 }
 918
 919
 920 static struct wpabuf * wps_build_m2(struct wps_data *wps)
 921 {
 922         struct wpabuf *msg;
 923
 924         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
 925                 return NULL;
 926         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
 927                     wps->nonce_r, WPS_NONCE_LEN);
 928         os_memcpy(wps->uuid_r, wps->wps->uuid, WPS_UUID_LEN);
 929         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
 930
 931         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
 932         msg = wpabuf_alloc(1000);
 933         if (msg == NULL)
 934                 return NULL;
 935
 936         if (wps_build_version(msg) ||
 937             wps_build_msg_type(msg, WPS_M2) ||
 938             wps_build_enrollee_nonce(wps, msg) ||
 939             wps_build_registrar_nonce(wps, msg) ||
 940             wps_build_uuid_r(wps, msg) ||
 941             wps_build_public_key(wps, msg) ||
 942             wps_derive_keys(wps) ||
 943             wps_build_auth_type_flags(wps, msg) ||
 944             wps_build_encr_type_flags(wps, msg) ||
 945             wps_build_conn_type_flags(wps, msg) ||
 946             wps_build_config_methods_r(wps->registrar, msg) ||
 947             wps_build_device_attrs(&wps->wps->dev, msg) ||
 948             wps_build_rf_bands(&wps->wps->dev, msg) ||
 949             wps_build_assoc_state(wps, msg) ||
 950             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
 951             wps_build_dev_password_id(msg, DEV_PW_DEFAULT) ||
 952             wps_build_os_version(&wps->wps->dev, msg) ||
 953             wps_build_authenticator(wps, msg)) {
 954                 wpabuf_free(msg);
 955                 return NULL;
 956         }
 957
 958         wps->state = RECV_M3;
 959         return msg;
 960 }
 961
 962
 963 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
 964 {
 965         struct wpabuf *msg;
 966         u16 err = WPS_CFG_NO_ERROR;
 967
 968         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
 969         msg = wpabuf_alloc(1000);
 970         if (msg == NULL)
 971                 return NULL;
 972
 973         if (wps->authenticator && wps->wps->ap_setup_locked)
 974                 err = WPS_CFG_SETUP_LOCKED;
 975
 976         if (wps_build_version(msg) ||
 977             wps_build_msg_type(msg, WPS_M2D) ||
 978             wps_build_enrollee_nonce(wps, msg) ||
 979             wps_build_registrar_nonce(wps, msg) ||
 980             wps_build_uuid_r(wps, msg) ||
 981             wps_build_auth_type_flags(wps, msg) ||
 982             wps_build_encr_type_flags(wps, msg) ||
 983             wps_build_conn_type_flags(wps, msg) ||
 984             wps_build_config_methods_r(wps->registrar, msg) ||
 985             wps_build_device_attrs(&wps->wps->dev, msg) ||
 986             wps_build_rf_bands(&wps->wps->dev, msg) ||
 987             wps_build_assoc_state(wps, msg) ||
 988             wps_build_config_error(msg, err) ||
 989             wps_build_os_version(&wps->wps->dev, msg)) {
 990                 wpabuf_free(msg);
 991                 return NULL;
 992         }
 993
 994         wps->state = RECV_M2D_ACK;
 995         return msg;
 996 }
 997
 998
 999 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1000 {
1001         struct wpabuf *msg, *plain;
1002
1003         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1004
1005         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1006
1007         plain = wpabuf_alloc(200);
1008         if (plain == NULL)
1009                 return NULL;
1010
1011         msg = wpabuf_alloc(1000);
1012         if (msg == NULL) {
1013                 wpabuf_free(plain);
1014                 return NULL;
1015         }
1016
1017         if (wps_build_version(msg) ||
1018             wps_build_msg_type(msg, WPS_M4) ||
1019             wps_build_enrollee_nonce(wps, msg) ||
1020             wps_build_r_hash(wps, msg) ||
1021             wps_build_r_snonce1(wps, plain) ||
1022             wps_build_key_wrap_auth(wps, plain) ||
1023             wps_build_encr_settings(wps, msg, plain) ||
1024             wps_build_authenticator(wps, msg)) {
1025                 wpabuf_free(plain);
1026                 wpabuf_free(msg);
1027                 return NULL;
1028         }
1029         wpabuf_free(plain);
1030
1031         wps->state = RECV_M5;
1032         return msg;
1033 }
1034
1035
1036 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1037 {
1038         struct wpabuf *msg, *plain;
1039
1040         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1041
1042         plain = wpabuf_alloc(200);
1043         if (plain == NULL)
1044                 return NULL;
1045
1046         msg = wpabuf_alloc(1000);
1047         if (msg == NULL) {
1048                 wpabuf_free(plain);
1049                 return NULL;
1050         }
1051
1052         if (wps_build_version(msg) ||
1053             wps_build_msg_type(msg, WPS_M6) ||
1054             wps_build_enrollee_nonce(wps, msg) ||
1055             wps_build_r_snonce2(wps, plain) ||
1056             wps_build_key_wrap_auth(wps, plain) ||
1057             wps_build_encr_settings(wps, msg, plain) ||
1058             wps_build_authenticator(wps, msg)) {
1059                 wpabuf_free(plain);
1060                 wpabuf_free(msg);
1061                 return NULL;
1062         }
1063         wpabuf_free(plain);
1064
1065         wps->wps_pin_revealed = 1;
1066         wps->state = RECV_M7;
1067         return msg;
1068 }
1069
1070
1071 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1072 {
1073         struct wpabuf *msg, *plain;
1074
1075         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1076
1077         plain = wpabuf_alloc(500);
1078         if (plain == NULL)
1079                 return NULL;
1080
1081         msg = wpabuf_alloc(1000);
1082         if (msg == NULL) {
1083                 wpabuf_free(plain);
1084                 return NULL;
1085         }
1086
1087         if (wps_build_version(msg) ||
1088             wps_build_msg_type(msg, WPS_M8) ||
1089             wps_build_enrollee_nonce(wps, msg) ||
1090             (wps->wps->ap && wps_build_cred(wps, plain)) ||
1091             (!wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
1092             wps_build_key_wrap_auth(wps, plain) ||
1093             wps_build_encr_settings(wps, msg, plain) ||
1094             wps_build_authenticator(wps, msg)) {
1095                 wpabuf_free(plain);
1096                 wpabuf_free(msg);
1097                 return NULL;
1098         }
1099         wpabuf_free(plain);
1100
1101         wps->state = RECV_DONE;
1102         return msg;
1103 }
1104
1105
1106 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1107 {
1108         struct wpabuf *msg;
1109
1110         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1111
1112         msg = wpabuf_alloc(1000);
1113         if (msg == NULL)
1114                 return NULL;
1115
1116         if (wps_build_version(msg) ||
1117             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1118             wps_build_enrollee_nonce(wps, msg) ||
1119             wps_build_registrar_nonce(wps, msg)) {
1120                 wpabuf_free(msg);
1121                 return NULL;
1122         }
1123
1124         return msg;
1125 }
1126
1127
1128 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps, u8 *op_code)
1129 {
1130         struct wpabuf *msg;
1131
1132         switch (wps->state) {
1133         case SEND_M2:
1134                 if (wps_get_dev_password(wps) < 0)
1135                         msg = wps_build_m2d(wps);
1136                 else
1137                         msg = wps_build_m2(wps);
1138                 *op_code = WSC_MSG;
1139                 break;
1140         case SEND_M2D:
1141                 msg = wps_build_m2d(wps);
1142                 *op_code = WSC_MSG;
1143                 break;
1144         case SEND_M4:
1145                 msg = wps_build_m4(wps);
1146                 *op_code = WSC_MSG;
1147                 break;
1148         case SEND_M6:
1149                 msg = wps_build_m6(wps);
1150                 *op_code = WSC_MSG;
1151                 break;
1152         case SEND_M8:
1153                 msg = wps_build_m8(wps);
1154                 *op_code = WSC_MSG;
1155                 break;
1156         case RECV_DONE:
1157                 msg = wps_build_wsc_ack(wps);
1158                 *op_code = WSC_ACK;
1159                 break;
1160         default:
1161                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1162                            "a message", wps->state);
1163                 msg = NULL;
1164                 break;
1165         }
1166
1167         if (*op_code == WSC_MSG && msg) {
1168                 /* Save a copy of the last message for Authenticator derivation
1169                  */
1170                 wpabuf_free(wps->last_msg);
1171                 wps->last_msg = wpabuf_dup(msg);
1172         }
1173
1174         return msg;
1175 }
1176
1177
1178 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1179 {
1180         if (e_nonce == NULL) {
1181                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1182                 return -1;
1183         }
1184
1185         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1186         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1187                     wps->nonce_e, WPS_NONCE_LEN);
1188
1189         return 0;
1190 }
1191
1192
1193 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1194 {
1195         if (r_nonce == NULL) {
1196                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1197                 return -1;
1198         }
1199
1200         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1201                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1202                 return -1;
1203         }
1204
1205         return 0;
1206 }
1207
1208
1209 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1210 {
1211         if (uuid_e == NULL) {
1212                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1213                 return -1;
1214         }
1215
1216         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1217         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1218
1219         return 0;
1220 }
1221
1222
1223 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1224 {
1225         if (pw_id == NULL) {
1226                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1227                 return -1;
1228         }
1229
1230         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1231         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1232
1233         return 0;
1234 }
1235
1236
1237 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1238 {
1239         if (e_hash1 == NULL) {
1240                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1241                 return -1;
1242         }
1243
1244         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1245         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1246
1247         return 0;
1248 }
1249
1250
1251 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1252 {
1253         if (e_hash2 == NULL) {
1254                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1255                 return -1;
1256         }
1257
1258         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1259         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1260
1261         return 0;
1262 }
1263
1264
1265 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1266 {
1267         u8 hash[SHA256_MAC_LEN];
1268         const u8 *addr[4];
1269         size_t len[4];
1270
1271         if (e_snonce1 == NULL) {
1272                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1273                 return -1;
1274         }
1275
1276         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1277                         WPS_SECRET_NONCE_LEN);
1278
1279         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1280         addr[0] = e_snonce1;
1281         len[0] = WPS_SECRET_NONCE_LEN;
1282         addr[1] = wps->psk1;
1283         len[1] = WPS_PSK_LEN;
1284         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1285         len[2] = wpabuf_len(wps->dh_pubkey_e);
1286         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1287         len[3] = wpabuf_len(wps->dh_pubkey_r);
1288         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1289
1290         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1291                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1292                            "not match with the pre-committed value");
1293                 return -1;
1294         }
1295
1296         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1297                    "half of the device password");
1298
1299         return 0;
1300 }
1301
1302
1303 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1304 {
1305         u8 hash[SHA256_MAC_LEN];
1306         const u8 *addr[4];
1307         size_t len[4];
1308
1309         if (e_snonce2 == NULL) {
1310                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1311                 return -1;
1312         }
1313
1314         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1315                         WPS_SECRET_NONCE_LEN);
1316
1317         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1318         addr[0] = e_snonce2;
1319         len[0] = WPS_SECRET_NONCE_LEN;
1320         addr[1] = wps->psk2;
1321         len[1] = WPS_PSK_LEN;
1322         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1323         len[2] = wpabuf_len(wps->dh_pubkey_e);
1324         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1325         len[3] = wpabuf_len(wps->dh_pubkey_r);
1326         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1327
1328         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1329                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1330                            "not match with the pre-committed value");
1331                 wps_registrar_invalidate_pin(wps->registrar, wps->uuid_e);
1332                 return -1;
1333         }
1334
1335         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1336                    "half of the device password");
1337         wps->wps_pin_revealed = 0;
1338         wps_registrar_unlock_pin(wps->registrar, wps->uuid_e);
1339
1340         return 0;
1341 }
1342
1343
1344 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1345 {
1346         if (mac_addr == NULL) {
1347                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1348                 return -1;
1349         }
1350
1351         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1352                    MAC2STR(mac_addr));
1353         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1354         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1355
1356         return 0;
1357 }
1358
1359
1360 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1361                               size_t pk_len)
1362 {
1363         if (pk == NULL || pk_len == 0) {
1364                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1365                 return -1;
1366         }
1367
1368         wpabuf_free(wps->dh_pubkey_e);
1369         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1370         if (wps->dh_pubkey_e == NULL)
1371                 return -1;
1372
1373         return 0;
1374 }
1375
1376
1377 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1378 {
1379         u16 auth_types;
1380
1381         if (auth == NULL) {
1382                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1383                            "received");
1384                 return -1;
1385         }
1386
1387         auth_types = WPA_GET_BE16(auth);
1388
1389         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1390                    auth_types);
1391         wps->auth_type = wps->wps->auth_types & auth_types;
1392         if (wps->auth_type == 0) {
1393                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1394                            "authentication types");
1395                 return -1;
1396         }
1397
1398         return 0;
1399 }
1400
1401
1402 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1403 {
1404         u16 encr_types;
1405
1406         if (encr == NULL) {
1407                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1408                            "received");
1409                 return -1;
1410         }
1411
1412         encr_types = WPA_GET_BE16(encr);
1413
1414         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1415                    encr_types);
1416         wps->encr_type = wps->wps->encr_types & encr_types;
1417         if (wps->encr_type == 0) {
1418                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1419                            "encryption types");
1420                 return -1;
1421         }
1422
1423         return 0;
1424 }
1425
1426
1427 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1428 {
1429         if (conn == NULL) {
1430                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1431                            "received");
1432                 return -1;
1433         }
1434
1435         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1436                    *conn);
1437
1438         return 0;
1439 }
1440
1441
1442 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1443 {
1444         u16 m;
1445
1446         if (methods == NULL) {
1447                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1448                 return -1;
1449         }
1450
1451         m = WPA_GET_BE16(methods);
1452
1453         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1454
1455         return 0;
1456 }
1457
1458
1459 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1460 {
1461         if (state == NULL) {
1462                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1463                            "received");
1464                 return -1;
1465         }
1466
1467         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1468                    *state);
1469
1470         return 0;
1471 }
1472
1473
1474 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1475 {
1476         u16 a;
1477
1478         if (assoc == NULL) {
1479                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1480                 return -1;
1481         }
1482
1483         a = WPA_GET_BE16(assoc);
1484         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
1485
1486         return 0;
1487 }
1488
1489
1490 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
1491 {
1492         u16 e;
1493
1494         if (err == NULL) {
1495                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
1496                 return -1;
1497         }
1498
1499         e = WPA_GET_BE16(err);
1500         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
1501
1502         return 0;
1503 }
1504
1505
1506 static enum wps_process_res wps_process_m1(struct wps_data *wps,
1507                                            struct wps_parse_attr *attr)
1508 {
1509         wpa_printf(MSG_DEBUG, "WPS: Received M1");
1510
1511         if (wps->state != RECV_M1) {
1512                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1513                            "receiving M1", wps->state);
1514                 return WPS_FAILURE;
1515         }
1516
1517         if (wps_process_uuid_e(wps, attr->uuid_e) ||
1518             wps_process_mac_addr(wps, attr->mac_addr) ||
1519             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
1520             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
1521             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
1522             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
1523             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
1524             wps_process_config_methods(wps, attr->config_methods) ||
1525             wps_process_wps_state(wps, attr->wps_state) ||
1526             wps_process_device_attrs(&wps->peer_dev, attr) ||
1527             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
1528             wps_process_assoc_state(wps, attr->assoc_state) ||
1529             wps_process_dev_password_id(wps, attr->dev_password_id) ||
1530             wps_process_config_error(wps, attr->config_error) ||
1531             wps_process_os_version(&wps->peer_dev, attr->os_version))
1532                 return WPS_FAILURE;
1533
1534         if (wps->dev_pw_id != DEV_PW_DEFAULT &&
1535             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
1536             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
1537             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
1538             (wps->dev_pw_id != DEV_PW_PUSHBUTTON || !wps->registrar->pbc)) {
1539                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
1540                            wps->dev_pw_id);
1541                 wps->state = SEND_M2D;
1542                 return WPS_CONTINUE;
1543         }
1544
1545         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
1546                 if (wps_registrar_pbc_overlap(wps->registrar, wps->mac_addr_e,
1547                                               wps->uuid_e)) {
1548                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
1549                                    "negotiation");
1550                         wps->state = SEND_M2D;
1551                         return WPS_CONTINUE;
1552                 }
1553                 wps_registrar_add_pbc_session(wps->registrar, wps->mac_addr_e,
1554                                               wps->uuid_e);
1555                 wps->pbc = 1;
1556         }
1557
1558         wps->state = SEND_M2;
1559         return WPS_CONTINUE;
1560 }
1561
1562
1563 static enum wps_process_res wps_process_m3(struct wps_data *wps,
1564                                            const struct wpabuf *msg,
1565                                            struct wps_parse_attr *attr)
1566 {
1567         wpa_printf(MSG_DEBUG, "WPS: Received M3");
1568
1569         if (wps->state != RECV_M3) {
1570                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1571                            "receiving M3", wps->state);
1572                 return WPS_FAILURE;
1573         }
1574
1575         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1576             wps_process_authenticator(wps, attr->authenticator, msg) ||
1577             wps_process_e_hash1(wps, attr->e_hash1) ||
1578             wps_process_e_hash2(wps, attr->e_hash2))
1579                 return WPS_FAILURE;
1580
1581         wps->state = SEND_M4;
1582         return WPS_CONTINUE;
1583 }
1584
1585
1586 static enum wps_process_res wps_process_m5(struct wps_data *wps,
1587                                            const struct wpabuf *msg,
1588                                            struct wps_parse_attr *attr)
1589 {
1590         struct wpabuf *decrypted;
1591         struct wps_parse_attr eattr;
1592
1593         wpa_printf(MSG_DEBUG, "WPS: Received M5");
1594
1595         if (wps->state != RECV_M5) {
1596                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1597                            "receiving M5", wps->state);
1598                 return WPS_FAILURE;
1599         }
1600
1601         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1602             wps_process_authenticator(wps, attr->authenticator, msg))
1603                 return WPS_FAILURE;
1604
1605         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1606                                               attr->encr_settings_len);
1607         if (decrypted == NULL) {
1608                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1609                            "Settings attribute");
1610                 return WPS_FAILURE;
1611         }
1612
1613         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1614                    "attribute");
1615         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1616             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1617             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
1618                 wpabuf_free(decrypted);
1619                 return WPS_FAILURE;
1620         }
1621         wpabuf_free(decrypted);
1622
1623         wps->state = SEND_M6;
1624         return WPS_CONTINUE;
1625 }
1626
1627
1628 static int wps_process_ap_settings_r(struct wps_data *wps,
1629                                      struct wps_parse_attr *attr)
1630 {
1631         if (wps->wps->ap)
1632                 return 0;
1633
1634         /* AP Settings Attributes in M7 when Enrollee is an AP */
1635         if (wps_process_ap_settings(attr, &wps->cred) < 0)
1636                 return -1;
1637
1638         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
1639
1640         /*
1641          * TODO: Provide access to AP settings and allow changes before sending
1642          * out M8. For now, just copy the settings unchanged into M8.
1643          */
1644
1645         return 0;
1646 }
1647
1648
1649 static enum wps_process_res wps_process_m7(struct wps_data *wps,
1650                                            const struct wpabuf *msg,
1651                                            struct wps_parse_attr *attr)
1652 {
1653         struct wpabuf *decrypted;
1654         struct wps_parse_attr eattr;
1655
1656         wpa_printf(MSG_DEBUG, "WPS: Received M7");
1657
1658         if (wps->state != RECV_M7) {
1659                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1660                            "receiving M7", wps->state);
1661                 return WPS_FAILURE;
1662         }
1663
1664         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1665             wps_process_authenticator(wps, attr->authenticator, msg))
1666                 return WPS_FAILURE;
1667
1668         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1669                                               attr->encr_settings_len);
1670         if (decrypted == NULL) {
1671                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1672                            "Settings attribute");
1673                 return WPS_FAILURE;
1674         }
1675
1676         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1677                    "attribute");
1678         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1679             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1680             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
1681             wps_process_ap_settings_r(wps, &eattr)) {
1682                 wpabuf_free(decrypted);
1683                 return WPS_FAILURE;
1684         }
1685
1686         wpabuf_free(decrypted);
1687
1688         wps->state = SEND_M8;
1689         return WPS_CONTINUE;
1690 }
1691
1692
1693 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
1694                                                 const struct wpabuf *msg)
1695 {
1696         struct wps_parse_attr attr;
1697         enum wps_process_res ret = WPS_CONTINUE;
1698
1699         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
1700
1701         if (wps_parse_msg(msg, &attr) < 0)
1702                 return WPS_FAILURE;
1703
1704         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1705                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1706                            attr.version ? *attr.version : 0);
1707                 return WPS_FAILURE;
1708         }
1709
1710         if (attr.msg_type == NULL) {
1711                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1712                 return WPS_FAILURE;
1713         }
1714
1715         if (*attr.msg_type != WPS_M1 &&
1716             (attr.registrar_nonce == NULL ||
1717              os_memcmp(wps->nonce_r, attr.registrar_nonce,
1718                        WPS_NONCE_LEN != 0))) {
1719                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1720                 return WPS_FAILURE;
1721         }
1722
1723         switch (*attr.msg_type) {
1724         case WPS_M1:
1725                 ret = wps_process_m1(wps, &attr);
1726                 break;
1727         case WPS_M3:
1728                 ret = wps_process_m3(wps, msg, &attr);
1729                 break;
1730         case WPS_M5:
1731                 ret = wps_process_m5(wps, msg, &attr);
1732                 break;
1733         case WPS_M7:
1734                 ret = wps_process_m7(wps, msg, &attr);
1735                 break;
1736         default:
1737                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
1738                            *attr.msg_type);
1739                 return WPS_FAILURE;
1740         }
1741
1742         if (ret == WPS_CONTINUE) {
1743                 /* Save a copy of the last message for Authenticator derivation
1744                  */
1745                 wpabuf_free(wps->last_msg);
1746                 wps->last_msg = wpabuf_dup(msg);
1747         }
1748
1749         return ret;
1750 }
1751
1752
1753 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
1754                                                 const struct wpabuf *msg)
1755 {
1756         struct wps_parse_attr attr;
1757
1758         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
1759
1760         if (wps_parse_msg(msg, &attr) < 0)
1761                 return WPS_FAILURE;
1762
1763         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1764                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1765                            attr.version ? *attr.version : 0);
1766                 return WPS_FAILURE;
1767         }
1768
1769         if (attr.msg_type == NULL) {
1770                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1771                 return WPS_FAILURE;
1772         }
1773
1774         if (*attr.msg_type != WPS_WSC_ACK) {
1775                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1776                            *attr.msg_type);
1777                 return WPS_FAILURE;
1778         }
1779
1780         if (attr.registrar_nonce == NULL ||
1781             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1782         {
1783                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1784                 return WPS_FAILURE;
1785         }
1786
1787         if (attr.enrollee_nonce == NULL ||
1788             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1789                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1790                 return WPS_FAILURE;
1791         }
1792
1793         if (wps->state == RECV_M2D_ACK) {
1794                 /* TODO: support for multiple registrars and sending of
1795                  * multiple M2/M2D messages */
1796
1797                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
1798                            "terminate negotiation");
1799         }
1800
1801         return WPS_FAILURE;
1802 }
1803
1804
1805 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
1806                                                  const struct wpabuf *msg)
1807 {
1808         struct wps_parse_attr attr;
1809
1810         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
1811
1812         if (wps_parse_msg(msg, &attr) < 0)
1813                 return WPS_FAILURE;
1814
1815         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1816                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1817                            attr.version ? *attr.version : 0);
1818                 return WPS_FAILURE;
1819         }
1820
1821         if (attr.msg_type == NULL) {
1822                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1823                 return WPS_FAILURE;
1824         }
1825
1826         if (*attr.msg_type != WPS_WSC_NACK) {
1827                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1828                            *attr.msg_type);
1829                 return WPS_FAILURE;
1830         }
1831
1832         if (attr.registrar_nonce == NULL ||
1833             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1834         {
1835                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1836                 return WPS_FAILURE;
1837         }
1838
1839         if (attr.enrollee_nonce == NULL ||
1840             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1841                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1842                 return WPS_FAILURE;
1843         }
1844
1845         if (attr.config_error == NULL) {
1846                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
1847                            "in WSC_NACK");
1848                 return WPS_FAILURE;
1849         }
1850
1851         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
1852                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
1853
1854         return WPS_FAILURE;
1855 }
1856
1857
1858 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
1859                                                  const struct wpabuf *msg)
1860 {
1861         struct wps_parse_attr attr;
1862
1863         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
1864
1865         if (wps->state != RECV_DONE) {
1866                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1867                            "receiving WSC_Done", wps->state);
1868                 return WPS_FAILURE;
1869         }
1870
1871         if (wps_parse_msg(msg, &attr) < 0)
1872                 return WPS_FAILURE;
1873
1874         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1875                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1876                            attr.version ? *attr.version : 0);
1877                 return WPS_FAILURE;
1878         }
1879
1880         if (attr.msg_type == NULL) {
1881                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1882                 return WPS_FAILURE;
1883         }
1884
1885         if (*attr.msg_type != WPS_WSC_DONE) {
1886                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
1887                            *attr.msg_type);
1888                 return WPS_FAILURE;
1889         }
1890
1891         if (attr.registrar_nonce == NULL ||
1892             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
1893         {
1894                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1895                 return WPS_FAILURE;
1896         }
1897
1898         if (attr.enrollee_nonce == NULL ||
1899             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
1900                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
1901                 return WPS_FAILURE;
1902         }
1903
1904         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
1905
1906         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
1907             wps->wps->ap) {
1908                 struct wps_credential cred;
1909
1910                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
1911                            "on first Enrollee connection");
1912
1913                 os_memset(&cred, 0, sizeof(cred));
1914                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
1915                 cred.ssid_len = wps->wps->ssid_len;
1916                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
1917                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
1918                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
1919                 cred.key_len = wps->new_psk_len;
1920
1921                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
1922                 wpa_hexdump_ascii_key(MSG_DEBUG,
1923                                       "WPS: Generated random passphrase",
1924                                       wps->new_psk, wps->new_psk_len);
1925                 if (wps->wps->cred_cb)
1926                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
1927
1928                 os_free(wps->new_psk);
1929                 wps->new_psk = NULL;
1930         }
1931
1932         if (!wps->wps->ap) {
1933                 wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
1934                            "on the modified AP configuration");
1935                 if (wps->wps->cred_cb)
1936                         wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
1937         }
1938
1939         if (wps->new_psk) {
1940                 if (wps_cb_new_psk(wps->registrar, wps->mac_addr_e,
1941                                    wps->new_psk, wps->new_psk_len)) {
1942                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
1943                                    "new PSK");
1944                 }
1945                 os_free(wps->new_psk);
1946                 wps->new_psk = NULL;
1947         }
1948
1949         if (wps->pbc) {
1950                 wps_registrar_remove_pbc_session(wps->registrar,
1951                                                  wps->mac_addr_e, wps->uuid_e);
1952                 wps_registrar_pbc_completed(wps->registrar);
1953         }
1954
1955         return WPS_DONE;
1956 }
1957
1958
1959 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
1960                                                u8 op_code,
1961                                                const struct wpabuf *msg)
1962 {
1963
1964         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
1965                    "op_code=%d)",
1966                    (unsigned long) wpabuf_len(msg), op_code);
1967
1968         switch (op_code) {
1969         case WSC_MSG:
1970                 return wps_process_wsc_msg(wps, msg);
1971         case WSC_ACK:
1972                 return wps_process_wsc_ack(wps, msg);
1973         case WSC_NACK:
1974                 return wps_process_wsc_nack(wps, msg);
1975         case WSC_Done:
1976                 return wps_process_wsc_done(wps, msg);
1977         default:
1978                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
1979                 return WPS_FAILURE;
1980         }
1981 }