git.maemo.org Git - wpasupplicant/blob - src/wps/wps_registrar.c

   1 /*
   2  * Wi-Fi Protected Setup - Registrar
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha256.h"
  19 #include "base64.h"
  20 #include "ieee802_11_defs.h"
  21 #include "eloop.h"
  22 #include "wps_i.h"
  23 #include "wps_dev_attr.h"
  24 #include "wps_upnp.h"
  25
  26
  27 struct wps_uuid_pin {
  28         struct wps_uuid_pin *next;
  29         u8 uuid[WPS_UUID_LEN];
  30         int wildcard_uuid;
  31         u8 *pin;
  32         size_t pin_len;
  33         int locked;
  34 };
  35
  36
  37 static void wps_free_pin(struct wps_uuid_pin *pin)
  38 {
  39         os_free(pin->pin);
  40         os_free(pin);
  41 }
  42
  43
  44 static void wps_free_pins(struct wps_uuid_pin *pins)
  45 {
  46         struct wps_uuid_pin *pin, *prev;
  47
  48         pin = pins;
  49         while (pin) {
  50                 prev = pin;
  51                 pin = pin->next;
  52                 wps_free_pin(prev);
  53         }
  54 }
  55
  56
  57 struct wps_pbc_session {
  58         struct wps_pbc_session *next;
  59         u8 addr[ETH_ALEN];
  60         u8 uuid_e[WPS_UUID_LEN];
  61         struct os_time timestamp;
  62 };
  63
  64
  65 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
  66 {
  67         struct wps_pbc_session *prev;
  68
  69         while (pbc) {
  70                 prev = pbc;
  71                 pbc = pbc->next;
  72                 os_free(prev);
  73         }
  74 }
  75
  76
  77 struct wps_registrar {
  78         struct wps_context *wps;
  79
  80         int pbc;
  81         int selected_registrar;
  82
  83         int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
  84                           size_t psk_len);
  85         int (*set_ie_cb)(void *ctx, const u8 *beacon_ie, size_t beacon_ie_len,
  86                          const u8 *probe_resp_ie, size_t probe_resp_ie_len);
  87         void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
  88                               const struct wps_device_data *dev);
  89         void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
  90                                const u8 *uuid_e);
  91         void *cb_ctx;
  92
  93         struct wps_uuid_pin *pins;
  94         struct wps_pbc_session *pbc_sessions;
  95
  96         int skip_cred_build;
  97         struct wpabuf *extra_cred;
  98         int disable_auto_conf;
  99         int sel_reg_dev_password_id_override;
 100         int sel_reg_config_methods_override;
 101 };
 102
 103
 104 static int wps_set_ie(struct wps_registrar *reg);
 105 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx);
 106 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
 107                                                void *timeout_ctx);
 108
 109
 110 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
 111                                           const u8 *addr, const u8 *uuid_e)
 112 {
 113         struct wps_pbc_session *pbc, *prev = NULL;
 114         struct os_time now;
 115
 116         os_get_time(&now);
 117
 118         pbc = reg->pbc_sessions;
 119         while (pbc) {
 120                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 121                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 122                         if (prev)
 123                                 prev->next = pbc->next;
 124                         else
 125                                 reg->pbc_sessions = pbc->next;
 126                         break;
 127                 }
 128                 prev = pbc;
 129                 pbc = pbc->next;
 130         }
 131
 132         if (!pbc) {
 133                 pbc = os_zalloc(sizeof(*pbc));
 134                 if (pbc == NULL)
 135                         return;
 136                 os_memcpy(pbc->addr, addr, ETH_ALEN);
 137                 if (uuid_e)
 138                         os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
 139         }
 140
 141         pbc->next = reg->pbc_sessions;
 142         reg->pbc_sessions = pbc;
 143         pbc->timestamp = now;
 144
 145         /* remove entries that have timed out */
 146         prev = pbc;
 147         pbc = pbc->next;
 148
 149         while (pbc) {
 150                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
 151                         prev->next = NULL;
 152                         wps_free_pbc_sessions(pbc);
 153                         break;
 154                 }
 155                 prev = pbc;
 156                 pbc = pbc->next;
 157         }
 158 }
 159
 160
 161 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
 162                                              const u8 *addr, const u8 *uuid_e)
 163 {
 164         struct wps_pbc_session *pbc, *prev = NULL;
 165
 166         pbc = reg->pbc_sessions;
 167         while (pbc) {
 168                 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
 169                     os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
 170                         if (prev)
 171                                 prev->next = pbc->next;
 172                         else
 173                                 reg->pbc_sessions = pbc->next;
 174                         os_free(pbc);
 175                         break;
 176                 }
 177                 prev = pbc;
 178                 pbc = pbc->next;
 179         }
 180 }
 181
 182
 183 static int wps_registrar_pbc_overlap(struct wps_registrar *reg,
 184                                      const u8 *addr, const u8 *uuid_e)
 185 {
 186         int count = 0;
 187         struct wps_pbc_session *pbc;
 188         struct os_time now;
 189
 190         os_get_time(&now);
 191
 192         for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
 193                 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME)
 194                         break;
 195                 if (addr == NULL || os_memcmp(addr, pbc->addr, ETH_ALEN) ||
 196                     uuid_e == NULL ||
 197                     os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN))
 198                         count++;
 199         }
 200
 201         if (addr || uuid_e)
 202                 count++;
 203
 204         return count > 1 ? 1 : 0;
 205 }
 206
 207
 208 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
 209 {
 210         wpa_printf(MSG_DEBUG, "WPS:  * Wi-Fi Protected Setup State (%d)",
 211                    wps->wps_state);
 212         wpabuf_put_be16(msg, ATTR_WPS_STATE);
 213         wpabuf_put_be16(msg, 1);
 214         wpabuf_put_u8(msg, wps->wps_state);
 215         return 0;
 216 }
 217
 218
 219 static int wps_build_ap_setup_locked(struct wps_context *wps,
 220                                      struct wpabuf *msg)
 221 {
 222         if (wps->ap_setup_locked) {
 223                 wpa_printf(MSG_DEBUG, "WPS:  * AP Setup Locked");
 224                 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
 225                 wpabuf_put_be16(msg, 1);
 226                 wpabuf_put_u8(msg, 1);
 227         }
 228         return 0;
 229 }
 230
 231
 232 static int wps_build_selected_registrar(struct wps_registrar *reg,
 233                                         struct wpabuf *msg)
 234 {
 235         if (!reg->selected_registrar)
 236                 return 0;
 237         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar");
 238         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
 239         wpabuf_put_be16(msg, 1);
 240         wpabuf_put_u8(msg, 1);
 241         return 0;
 242 }
 243
 244
 245 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
 246                                              struct wpabuf *msg)
 247 {
 248         u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
 249         if (!reg->selected_registrar)
 250                 return 0;
 251         if (reg->sel_reg_dev_password_id_override >= 0)
 252                 id = reg->sel_reg_dev_password_id_override;
 253         wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
 254         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
 255         wpabuf_put_be16(msg, 2);
 256         wpabuf_put_be16(msg, id);
 257         return 0;
 258 }
 259
 260
 261 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
 262                                             struct wpabuf *msg)
 263 {
 264         u16 methods;
 265         if (!reg->selected_registrar)
 266                 return 0;
 267         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 268         if (reg->pbc)
 269                 methods |= WPS_CONFIG_PUSHBUTTON;
 270         if (reg->sel_reg_config_methods_override >= 0)
 271                 methods = reg->sel_reg_config_methods_override;
 272         wpa_printf(MSG_DEBUG, "WPS:  * Selected Registrar Config Methods (%x)",
 273                    methods);
 274         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
 275         wpabuf_put_be16(msg, 2);
 276         wpabuf_put_be16(msg, methods);
 277         return 0;
 278 }
 279
 280
 281 static int wps_build_probe_config_methods(struct wps_registrar *reg,
 282                                           struct wpabuf *msg)
 283 {
 284         u16 methods;
 285         methods = 0;
 286         wpa_printf(MSG_DEBUG, "WPS:  * Config Methods (%x)", methods);
 287         wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
 288         wpabuf_put_be16(msg, 2);
 289         wpabuf_put_be16(msg, methods);
 290         return 0;
 291 }
 292
 293
 294 static int wps_build_config_methods_r(struct wps_registrar *reg,
 295                                       struct wpabuf *msg)
 296 {
 297         u16 methods;
 298         methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
 299         if (reg->pbc)
 300                 methods |= WPS_CONFIG_PUSHBUTTON;
 301         return wps_build_config_methods(msg, methods);
 302 }
 303
 304
 305 static int wps_build_resp_type(struct wps_registrar *reg, struct wpabuf *msg)
 306 {
 307         u8 resp = reg->wps->ap ? WPS_RESP_AP : WPS_RESP_REGISTRAR;
 308         wpa_printf(MSG_DEBUG, "WPS:  * Response Type (%d)", resp);
 309         wpabuf_put_be16(msg, ATTR_RESPONSE_TYPE);
 310         wpabuf_put_be16(msg, 1);
 311         wpabuf_put_u8(msg, resp);
 312         return 0;
 313 }
 314
 315
 316 /**
 317  * wps_registrar_init - Initialize WPS Registrar data
 318  * @wps: Pointer to longterm WPS context
 319  * @cfg: Registrar configuration
 320  * Returns: Pointer to allocated Registrar data or %NULL on failure
 321  *
 322  * This function is used to initialize WPS Registrar functionality. It can be
 323  * used for a single Registrar run (e.g., when run in a supplicant) or multiple
 324  * runs (e.g., when run as an internal Registrar in an AP). Caller is
 325  * responsible for freeing the returned data with wps_registrar_deinit() when
 326  * Registrar functionality is not needed anymore.
 327  */
 328 struct wps_registrar *
 329 wps_registrar_init(struct wps_context *wps,
 330                    const struct wps_registrar_config *cfg)
 331 {
 332         struct wps_registrar *reg = os_zalloc(sizeof(*reg));
 333         if (reg == NULL)
 334                 return NULL;
 335
 336         reg->wps = wps;
 337         reg->new_psk_cb = cfg->new_psk_cb;
 338         reg->set_ie_cb = cfg->set_ie_cb;
 339         reg->pin_needed_cb = cfg->pin_needed_cb;
 340         reg->reg_success_cb = cfg->reg_success_cb;
 341         reg->cb_ctx = cfg->cb_ctx;
 342         reg->skip_cred_build = cfg->skip_cred_build;
 343         if (cfg->extra_cred) {
 344                 reg->extra_cred = wpabuf_alloc_copy(cfg->extra_cred,
 345                                                     cfg->extra_cred_len);
 346                 if (reg->extra_cred == NULL) {
 347                         os_free(reg);
 348                         return NULL;
 349                 }
 350         }
 351         reg->disable_auto_conf = cfg->disable_auto_conf;
 352         reg->sel_reg_dev_password_id_override = -1;
 353
 354         if (wps_set_ie(reg)) {
 355                 wps_registrar_deinit(reg);
 356                 return NULL;
 357         }
 358
 359         return reg;
 360 }
 361
 362
 363 /**
 364  * wps_registrar_deinit - Deinitialize WPS Registrar data
 365  * @reg: Registrar data from wps_registrar_init()
 366  */
 367 void wps_registrar_deinit(struct wps_registrar *reg)
 368 {
 369         if (reg == NULL)
 370                 return;
 371         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 372         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
 373         wps_free_pins(reg->pins);
 374         wps_free_pbc_sessions(reg->pbc_sessions);
 375         wpabuf_free(reg->extra_cred);
 376         os_free(reg);
 377 }
 378
 379
 380 /**
 381  * wps_registrar_add_pin - Configure a new PIN for Registrar
 382  * @reg: Registrar data from wps_registrar_init()
 383  * @uuid: UUID-E or %NULL for wildcard (any UUID)
 384  * @pin: PIN (Device Password)
 385  * @pin_len: Length of pin in octets
 386  * Returns: 0 on success, -1 on failure
 387  */
 388 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *uuid,
 389                           const u8 *pin, size_t pin_len)
 390 {
 391         struct wps_uuid_pin *p;
 392
 393         p = os_zalloc(sizeof(*p));
 394         if (p == NULL)
 395                 return -1;
 396         if (uuid == NULL)
 397                 p->wildcard_uuid = 1;
 398         else
 399                 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
 400         p->pin = os_malloc(pin_len);
 401         if (p->pin == NULL) {
 402                 os_free(p);
 403                 return -1;
 404         }
 405         os_memcpy(p->pin, pin, pin_len);
 406         p->pin_len = pin_len;
 407
 408         p->next = reg->pins;
 409         reg->pins = p;
 410
 411         wpa_printf(MSG_DEBUG, "WPS: A new PIN configured");
 412         wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
 413         wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
 414         reg->selected_registrar = 1;
 415         reg->pbc = 0;
 416         wps_set_ie(reg);
 417
 418         return 0;
 419 }
 420
 421
 422 /**
 423  * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
 424  * @reg: Registrar data from wps_registrar_init()
 425  * @uuid: UUID-E
 426  * Returns: 0 on success, -1 on failure (e.g., PIN not found)
 427  */
 428 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
 429 {
 430         struct wps_uuid_pin *pin, *prev;
 431
 432         prev = NULL;
 433         pin = reg->pins;
 434         while (pin) {
 435                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 436                         if (prev == NULL)
 437                                 reg->pins = pin->next;
 438                         else
 439                                 prev->next = pin->next;
 440                         wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
 441                                     pin->uuid, WPS_UUID_LEN);
 442                         wps_free_pin(pin);
 443                         return 0;
 444                 }
 445                 prev = pin;
 446                 pin = pin->next;
 447         }
 448
 449         return -1;
 450 }
 451
 452
 453 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
 454                                         const u8 *uuid, size_t *pin_len)
 455 {
 456         struct wps_uuid_pin *pin;
 457
 458         pin = reg->pins;
 459         while (pin) {
 460                 if (!pin->wildcard_uuid &&
 461                     os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0)
 462                         break;
 463                 pin = pin->next;
 464         }
 465
 466         if (!pin) {
 467                 /* Check for wildcard UUIDs since none of the UUID-specific
 468                  * PINs matched */
 469                 pin = reg->pins;
 470                 while (pin) {
 471                         if (pin->wildcard_uuid == 1) {
 472                                 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
 473                                            "PIN. Assigned it for this UUID-E");
 474                                 pin->wildcard_uuid = 2;
 475                                 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
 476                                 break;
 477                         }
 478                         pin = pin->next;
 479                 }
 480         }
 481
 482         if (!pin)
 483                 return NULL;
 484
 485         /*
 486          * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
 487          * that could otherwise avoid PIN invalidations.
 488          */
 489         if (pin->locked) {
 490                 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
 491                            "allow concurrent re-use");
 492                 return NULL;
 493         }
 494         *pin_len = pin->pin_len;
 495         pin->locked = 1;
 496         return pin->pin;
 497 }
 498
 499
 500 /**
 501  * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
 502  * @reg: Registrar data from wps_registrar_init()
 503  * @uuid: UUID-E
 504  * Returns: 0 on success, -1 on failure
 505  *
 506  * PINs are locked to enforce only one concurrent use. This function unlocks a
 507  * PIN to allow it to be used again. If the specified PIN was configured using
 508  * a wildcard UUID, it will be removed instead of allowing multiple uses.
 509  */
 510 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
 511 {
 512         struct wps_uuid_pin *pin;
 513
 514         pin = reg->pins;
 515         while (pin) {
 516                 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
 517                         if (pin->wildcard_uuid == 2) {
 518                                 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
 519                                            "wildcard PIN");
 520                                 return wps_registrar_invalidate_pin(reg, uuid);
 521                         }
 522                         pin->locked = 0;
 523                         return 0;
 524                 }
 525                 pin = pin->next;
 526         }
 527
 528         return -1;
 529 }
 530
 531
 532 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
 533 {
 534         reg->selected_registrar = 0;
 535         reg->pbc = 0;
 536         wps_set_ie(reg);
 537 }
 538
 539
 540 static void wps_registrar_pbc_timeout(void *eloop_ctx, void *timeout_ctx)
 541 {
 542         struct wps_registrar *reg = eloop_ctx;
 543
 544         wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
 545         wps_registrar_stop_pbc(reg);
 546 }
 547
 548
 549 /**
 550  * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
 551  * @reg: Registrar data from wps_registrar_init()
 552  * Returns: 0 on success, -1 on failure
 553  *
 554  * This function is called on an AP when a push button is pushed to activate
 555  * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
 556  * or when a PBC registration is completed.
 557  */
 558 int wps_registrar_button_pushed(struct wps_registrar *reg)
 559 {
 560         if (wps_registrar_pbc_overlap(reg, NULL, NULL)) {
 561                 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
 562                            "mode");
 563                 return -1;
 564         }
 565         wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
 566         reg->selected_registrar = 1;
 567         reg->pbc = 1;
 568         wps_set_ie(reg);
 569
 570         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 571         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wps_registrar_pbc_timeout,
 572                                reg, NULL);
 573         return 0;
 574 }
 575
 576
 577 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
 578 {
 579         wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
 580         eloop_cancel_timeout(wps_registrar_pbc_timeout, reg, NULL);
 581         wps_registrar_stop_pbc(reg);
 582 }
 583
 584
 585 /**
 586  * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
 587  * @reg: Registrar data from wps_registrar_init()
 588  * @addr: MAC address of the Probe Request sender
 589  * @wps_data: WPS IE contents
 590  *
 591  * This function is called on an AP when a Probe Request with WPS IE is
 592  * received. This is used to track PBC mode use and to detect possible overlap
 593  * situation with other WPS APs.
 594  */
 595 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
 596                                 const struct wpabuf *wps_data)
 597 {
 598         struct wps_parse_attr attr;
 599         u16 methods;
 600
 601         wpa_hexdump_buf(MSG_MSGDUMP,
 602                         "WPS: Probe Request with WPS data received",
 603                         wps_data);
 604
 605         if (wps_parse_msg(wps_data, &attr) < 0 ||
 606             attr.version == NULL || *attr.version != WPS_VERSION) {
 607                 wpa_printf(MSG_DEBUG, "WPS: Unsupported ProbeReq WPS IE "
 608                            "version 0x%x", attr.version ? *attr.version : 0);
 609                 return;
 610         }
 611
 612         if (attr.config_methods == NULL) {
 613                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
 614                            "Probe Request");
 615                 return;
 616         }
 617
 618         methods = WPA_GET_BE16(attr.config_methods);
 619         if (!(methods & WPS_CONFIG_PUSHBUTTON))
 620                 return; /* Not PBC */
 621
 622         wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
 623                    MACSTR, MAC2STR(addr));
 624
 625         wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
 626 }
 627
 628
 629 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
 630                           const u8 *psk, size_t psk_len)
 631 {
 632         if (reg->new_psk_cb == NULL)
 633                 return 0;
 634
 635         return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
 636 }
 637
 638
 639 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
 640                               const struct wps_device_data *dev)
 641 {
 642         if (reg->pin_needed_cb == NULL)
 643                 return;
 644
 645         reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
 646 }
 647
 648
 649 static void wps_cb_reg_success(struct wps_registrar *reg, const u8 *mac_addr,
 650                                const u8 *uuid_e)
 651 {
 652         if (reg->reg_success_cb == NULL)
 653                 return;
 654
 655         reg->reg_success_cb(reg->cb_ctx, mac_addr, uuid_e);
 656 }
 657
 658
 659 static int wps_cb_set_ie(struct wps_registrar *reg,
 660                          const struct wpabuf *beacon_ie,
 661                          const struct wpabuf *probe_resp_ie)
 662 {
 663         if (reg->set_ie_cb == NULL)
 664                 return 0;
 665
 666         return reg->set_ie_cb(reg->cb_ctx, wpabuf_head(beacon_ie),
 667                               wpabuf_len(beacon_ie),
 668                               wpabuf_head(probe_resp_ie),
 669                               wpabuf_len(probe_resp_ie));
 670 }
 671
 672
 673 /* Encapsulate WPS IE data with one (or more, if needed) IE headers */
 674 static struct wpabuf * wps_ie_encapsulate(struct wpabuf *data)
 675 {
 676         struct wpabuf *ie;
 677         const u8 *pos, *end;
 678
 679         ie = wpabuf_alloc(wpabuf_len(data) + 100);
 680         if (ie == NULL) {
 681                 wpabuf_free(data);
 682                 return NULL;
 683         }
 684
 685         pos = wpabuf_head(data);
 686         end = pos + wpabuf_len(data);
 687
 688         while (end > pos) {
 689                 size_t frag_len = end - pos;
 690                 if (frag_len > 251)
 691                         frag_len = 251;
 692                 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 693                 wpabuf_put_u8(ie, 4 + frag_len);
 694                 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
 695                 wpabuf_put_data(ie, pos, frag_len);
 696                 pos += frag_len;
 697         }
 698
 699         wpabuf_free(data);
 700
 701         return ie;
 702 }
 703
 704
 705 static int wps_set_ie(struct wps_registrar *reg)
 706 {
 707         struct wpabuf *beacon;
 708         struct wpabuf *probe;
 709         int ret;
 710
 711         wpa_printf(MSG_DEBUG, "WPS: Build Beacon and Probe Response IEs");
 712
 713         beacon = wpabuf_alloc(300);
 714         if (beacon == NULL)
 715                 return -1;
 716         probe = wpabuf_alloc(400);
 717         if (probe == NULL) {
 718                 wpabuf_free(beacon);
 719                 return -1;
 720         }
 721
 722         if (wps_build_version(beacon) ||
 723             wps_build_wps_state(reg->wps, beacon) ||
 724             wps_build_ap_setup_locked(reg->wps, beacon) ||
 725             wps_build_selected_registrar(reg, beacon) ||
 726             wps_build_sel_reg_dev_password_id(reg, beacon) ||
 727             wps_build_sel_reg_config_methods(reg, beacon) ||
 728             wps_build_version(probe) ||
 729             wps_build_wps_state(reg->wps, probe) ||
 730             wps_build_ap_setup_locked(reg->wps, probe) ||
 731             wps_build_selected_registrar(reg, probe) ||
 732             wps_build_sel_reg_dev_password_id(reg, probe) ||
 733             wps_build_sel_reg_config_methods(reg, probe) ||
 734             wps_build_resp_type(reg, probe) ||
 735             wps_build_uuid_e(probe, reg->wps->uuid) ||
 736             wps_build_device_attrs(&reg->wps->dev, probe) ||
 737             wps_build_probe_config_methods(reg, probe) ||
 738             wps_build_rf_bands(&reg->wps->dev, probe)) {
 739                 wpabuf_free(beacon);
 740                 wpabuf_free(probe);
 741                 return -1;
 742         }
 743
 744         beacon = wps_ie_encapsulate(beacon);
 745         probe = wps_ie_encapsulate(probe);
 746
 747         if (!beacon || !probe) {
 748                 wpabuf_free(beacon);
 749                 wpabuf_free(probe);
 750                 return -1;
 751         }
 752
 753         ret = wps_cb_set_ie(reg, beacon, probe);
 754         wpabuf_free(beacon);
 755         wpabuf_free(probe);
 756
 757         return ret;
 758 }
 759
 760
 761 static int wps_get_dev_password(struct wps_data *wps)
 762 {
 763         const u8 *pin;
 764         size_t pin_len = 0;
 765
 766         os_free(wps->dev_password);
 767         wps->dev_password = NULL;
 768
 769         if (wps->pbc) {
 770                 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
 771                 pin = (const u8 *) "00000000";
 772                 pin_len = 8;
 773         } else {
 774                 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
 775                                             &pin_len);
 776         }
 777         if (pin == NULL) {
 778                 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
 779                            "the Enrollee");
 780                 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
 781                                   &wps->peer_dev);
 782                 return -1;
 783         }
 784
 785         wps->dev_password = os_malloc(pin_len);
 786         if (wps->dev_password == NULL)
 787                 return -1;
 788         os_memcpy(wps->dev_password, pin, pin_len);
 789         wps->dev_password_len = pin_len;
 790
 791         return 0;
 792 }
 793
 794
 795 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
 796 {
 797         wpa_printf(MSG_DEBUG, "WPS:  * UUID-R");
 798         wpabuf_put_be16(msg, ATTR_UUID_R);
 799         wpabuf_put_be16(msg, WPS_UUID_LEN);
 800         wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
 801         return 0;
 802 }
 803
 804
 805 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
 806 {
 807         u8 *hash;
 808         const u8 *addr[4];
 809         size_t len[4];
 810
 811         if (os_get_random(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
 812                 return -1;
 813         wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
 814         wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
 815                     wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
 816
 817         if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
 818                 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
 819                            "R-Hash derivation");
 820                 return -1;
 821         }
 822
 823         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash1");
 824         wpabuf_put_be16(msg, ATTR_R_HASH1);
 825         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 826         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 827         /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
 828         addr[0] = wps->snonce;
 829         len[0] = WPS_SECRET_NONCE_LEN;
 830         addr[1] = wps->psk1;
 831         len[1] = WPS_PSK_LEN;
 832         addr[2] = wpabuf_head(wps->dh_pubkey_e);
 833         len[2] = wpabuf_len(wps->dh_pubkey_e);
 834         addr[3] = wpabuf_head(wps->dh_pubkey_r);
 835         len[3] = wpabuf_len(wps->dh_pubkey_r);
 836         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 837         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
 838
 839         wpa_printf(MSG_DEBUG, "WPS:  * R-Hash2");
 840         wpabuf_put_be16(msg, ATTR_R_HASH2);
 841         wpabuf_put_be16(msg, SHA256_MAC_LEN);
 842         hash = wpabuf_put(msg, SHA256_MAC_LEN);
 843         /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
 844         addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
 845         addr[1] = wps->psk2;
 846         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
 847         wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
 848
 849         return 0;
 850 }
 851
 852
 853 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
 854 {
 855         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce1");
 856         wpabuf_put_be16(msg, ATTR_R_SNONCE1);
 857         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 858         wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
 859         return 0;
 860 }
 861
 862
 863 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
 864 {
 865         wpa_printf(MSG_DEBUG, "WPS:  * R-SNonce2");
 866         wpabuf_put_be16(msg, ATTR_R_SNONCE2);
 867         wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
 868         wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
 869                         WPS_SECRET_NONCE_LEN);
 870         return 0;
 871 }
 872
 873
 874 static int wps_build_cred_network_idx(struct wpabuf *msg,
 875                                       struct wps_credential *cred)
 876 {
 877         wpa_printf(MSG_DEBUG, "WPS:  * Network Index");
 878         wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
 879         wpabuf_put_be16(msg, 1);
 880         wpabuf_put_u8(msg, 1);
 881         return 0;
 882 }
 883
 884
 885 static int wps_build_cred_ssid(struct wpabuf *msg,
 886                                struct wps_credential *cred)
 887 {
 888         wpa_printf(MSG_DEBUG, "WPS:  * SSID");
 889         wpabuf_put_be16(msg, ATTR_SSID);
 890         wpabuf_put_be16(msg, cred->ssid_len);
 891         wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
 892         return 0;
 893 }
 894
 895
 896 static int wps_build_cred_auth_type(struct wpabuf *msg,
 897                                     struct wps_credential *cred)
 898 {
 899         wpa_printf(MSG_DEBUG, "WPS:  * Authentication Type (0x%x)",
 900                    cred->auth_type);
 901         wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
 902         wpabuf_put_be16(msg, 2);
 903         wpabuf_put_be16(msg, cred->auth_type);
 904         return 0;
 905 }
 906
 907
 908 static int wps_build_cred_encr_type(struct wpabuf *msg,
 909                                     struct wps_credential *cred)
 910 {
 911         wpa_printf(MSG_DEBUG, "WPS:  * Encryption Type (0x%x)",
 912                    cred->encr_type);
 913         wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
 914         wpabuf_put_be16(msg, 2);
 915         wpabuf_put_be16(msg, cred->encr_type);
 916         return 0;
 917 }
 918
 919
 920 static int wps_build_cred_network_key(struct wpabuf *msg,
 921                                       struct wps_credential *cred)
 922 {
 923         wpa_printf(MSG_DEBUG, "WPS:  * Network Key");
 924         wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
 925         wpabuf_put_be16(msg, cred->key_len);
 926         wpabuf_put_data(msg, cred->key, cred->key_len);
 927         return 0;
 928 }
 929
 930
 931 static int wps_build_cred_mac_addr(struct wpabuf *msg,
 932                                    struct wps_credential *cred)
 933 {
 934         wpa_printf(MSG_DEBUG, "WPS:  * MAC Address (" MACSTR ")",
 935                    MAC2STR(cred->mac_addr));
 936         wpabuf_put_be16(msg, ATTR_MAC_ADDR);
 937         wpabuf_put_be16(msg, ETH_ALEN);
 938         wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
 939         return 0;
 940 }
 941
 942
 943 static int wps_build_credential(struct wpabuf *msg,
 944                                 struct wps_credential *cred)
 945 {
 946         if (wps_build_cred_network_idx(msg, cred) ||
 947             wps_build_cred_ssid(msg, cred) ||
 948             wps_build_cred_auth_type(msg, cred) ||
 949             wps_build_cred_encr_type(msg, cred) ||
 950             wps_build_cred_network_key(msg, cred) ||
 951             wps_build_cred_mac_addr(msg, cred))
 952                 return -1;
 953         return 0;
 954 }
 955
 956
 957 static int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
 958 {
 959         struct wpabuf *cred;
 960
 961         if (wps->wps->registrar->skip_cred_build)
 962                 goto skip_cred_build;
 963
 964         wpa_printf(MSG_DEBUG, "WPS:  * Credential");
 965         os_memset(&wps->cred, 0, sizeof(wps->cred));
 966
 967         os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
 968         wps->cred.ssid_len = wps->wps->ssid_len;
 969
 970         /* Select the best authentication and encryption type */
 971         if (wps->auth_type & WPS_AUTH_WPA2PSK)
 972                 wps->auth_type = WPS_AUTH_WPA2PSK;
 973         else if (wps->auth_type & WPS_AUTH_WPAPSK)
 974                 wps->auth_type = WPS_AUTH_WPAPSK;
 975         else if (wps->auth_type & WPS_AUTH_OPEN)
 976                 wps->auth_type = WPS_AUTH_OPEN;
 977         else if (wps->auth_type & WPS_AUTH_SHARED)
 978                 wps->auth_type = WPS_AUTH_SHARED;
 979         else {
 980                 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
 981                            wps->auth_type);
 982                 return -1;
 983         }
 984         wps->cred.auth_type = wps->auth_type;
 985
 986         if (wps->auth_type == WPS_AUTH_WPA2PSK ||
 987             wps->auth_type == WPS_AUTH_WPAPSK) {
 988                 if (wps->encr_type & WPS_ENCR_AES)
 989                         wps->encr_type = WPS_ENCR_AES;
 990                 else if (wps->encr_type & WPS_ENCR_TKIP)
 991                         wps->encr_type = WPS_ENCR_TKIP;
 992                 else {
 993                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
 994                                    "type for WPA/WPA2");
 995                         return -1;
 996                 }
 997         } else {
 998                 if (wps->encr_type & WPS_ENCR_WEP)
 999                         wps->encr_type = WPS_ENCR_WEP;
1000                 else if (wps->encr_type & WPS_ENCR_NONE)
1001                         wps->encr_type = WPS_ENCR_NONE;
1002                 else {
1003                         wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1004                                    "type for non-WPA/WPA2 mode");
1005                         return -1;
1006                 }
1007         }
1008         wps->cred.encr_type = wps->encr_type;
1009         /* Set MAC address in the Credential to be the AP's address (BSSID) */
1010         os_memcpy(wps->cred.mac_addr, wps->wps->dev.mac_addr, ETH_ALEN);
1011
1012         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap &&
1013             !wps->wps->registrar->disable_auto_conf) {
1014                 u8 r[16];
1015                 /* Generate a random passphrase */
1016                 if (os_get_random(r, sizeof(r)) < 0)
1017                         return -1;
1018                 os_free(wps->new_psk);
1019                 wps->new_psk = base64_encode(r, sizeof(r), &wps->new_psk_len);
1020                 if (wps->new_psk == NULL)
1021                         return -1;
1022                 wps->new_psk_len--; /* remove newline */
1023                 while (wps->new_psk_len &&
1024                        wps->new_psk[wps->new_psk_len - 1] == '=')
1025                         wps->new_psk_len--;
1026                 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
1027                                       wps->new_psk, wps->new_psk_len);
1028                 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len);
1029                 wps->cred.key_len = wps->new_psk_len;
1030         } else if (wps->wps->network_key) {
1031                 os_memcpy(wps->cred.key, wps->wps->network_key,
1032                           wps->wps->network_key_len);
1033                 wps->cred.key_len = wps->wps->network_key_len;
1034         } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
1035                 char hex[65];
1036                 /* Generate a random per-device PSK */
1037                 os_free(wps->new_psk);
1038                 wps->new_psk_len = 32;
1039                 wps->new_psk = os_malloc(wps->new_psk_len);
1040                 if (wps->new_psk == NULL)
1041                         return -1;
1042                 if (os_get_random(wps->new_psk, wps->new_psk_len) < 0) {
1043                         os_free(wps->new_psk);
1044                         wps->new_psk = NULL;
1045                         return -1;
1046                 }
1047                 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1048                                 wps->new_psk, wps->new_psk_len);
1049                 wpa_snprintf_hex(hex, sizeof(hex), wps->new_psk,
1050                                  wps->new_psk_len);
1051                 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1052                 wps->cred.key_len = wps->new_psk_len * 2;
1053         }
1054
1055         cred = wpabuf_alloc(200);
1056         if (cred == NULL)
1057                 return -1;
1058
1059         if (wps_build_credential(cred, &wps->cred)) {
1060                 wpabuf_free(cred);
1061                 return -1;
1062         }
1063
1064         wpabuf_put_be16(msg, ATTR_CRED);
1065         wpabuf_put_be16(msg, wpabuf_len(cred));
1066         wpabuf_put_buf(msg, cred);
1067         wpabuf_free(cred);
1068
1069 skip_cred_build:
1070         if (wps->wps->registrar->extra_cred) {
1071                 wpa_printf(MSG_DEBUG, "WPS:  * Credential (pre-configured)");
1072                 wpabuf_put_buf(msg, wps->wps->registrar->extra_cred);
1073         }
1074
1075         return 0;
1076 }
1077
1078
1079 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1080 {
1081         wpa_printf(MSG_DEBUG, "WPS:  * AP Settings");
1082
1083         if (wps_build_credential(msg, &wps->cred))
1084                 return -1;
1085
1086         return 0;
1087 }
1088
1089
1090 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1091 {
1092         struct wpabuf *msg;
1093
1094         if (os_get_random(wps->nonce_r, WPS_NONCE_LEN) < 0)
1095                 return NULL;
1096         wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1097                     wps->nonce_r, WPS_NONCE_LEN);
1098         wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1099
1100         wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1101         msg = wpabuf_alloc(1000);
1102         if (msg == NULL)
1103                 return NULL;
1104
1105         if (wps_build_version(msg) ||
1106             wps_build_msg_type(msg, WPS_M2) ||
1107             wps_build_enrollee_nonce(wps, msg) ||
1108             wps_build_registrar_nonce(wps, msg) ||
1109             wps_build_uuid_r(wps, msg) ||
1110             wps_build_public_key(wps, msg) ||
1111             wps_derive_keys(wps) ||
1112             wps_build_auth_type_flags(wps, msg) ||
1113             wps_build_encr_type_flags(wps, msg) ||
1114             wps_build_conn_type_flags(wps, msg) ||
1115             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1116             wps_build_device_attrs(&wps->wps->dev, msg) ||
1117             wps_build_rf_bands(&wps->wps->dev, msg) ||
1118             wps_build_assoc_state(wps, msg) ||
1119             wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1120             wps_build_dev_password_id(msg, DEV_PW_DEFAULT) ||
1121             wps_build_os_version(&wps->wps->dev, msg) ||
1122             wps_build_authenticator(wps, msg)) {
1123                 wpabuf_free(msg);
1124                 return NULL;
1125         }
1126
1127         wps->state = RECV_M3;
1128         return msg;
1129 }
1130
1131
1132 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1133 {
1134         struct wpabuf *msg;
1135         u16 err = WPS_CFG_NO_ERROR;
1136
1137         wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1138         msg = wpabuf_alloc(1000);
1139         if (msg == NULL)
1140                 return NULL;
1141
1142         if (wps->wps->ap && wps->wps->ap_setup_locked)
1143                 err = WPS_CFG_SETUP_LOCKED;
1144
1145         if (wps_build_version(msg) ||
1146             wps_build_msg_type(msg, WPS_M2D) ||
1147             wps_build_enrollee_nonce(wps, msg) ||
1148             wps_build_registrar_nonce(wps, msg) ||
1149             wps_build_uuid_r(wps, msg) ||
1150             wps_build_auth_type_flags(wps, msg) ||
1151             wps_build_encr_type_flags(wps, msg) ||
1152             wps_build_conn_type_flags(wps, msg) ||
1153             wps_build_config_methods_r(wps->wps->registrar, msg) ||
1154             wps_build_device_attrs(&wps->wps->dev, msg) ||
1155             wps_build_rf_bands(&wps->wps->dev, msg) ||
1156             wps_build_assoc_state(wps, msg) ||
1157             wps_build_config_error(msg, err) ||
1158             wps_build_os_version(&wps->wps->dev, msg)) {
1159                 wpabuf_free(msg);
1160                 return NULL;
1161         }
1162
1163         wps->state = RECV_M2D_ACK;
1164         return msg;
1165 }
1166
1167
1168 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1169 {
1170         struct wpabuf *msg, *plain;
1171
1172         wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1173
1174         wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1175
1176         plain = wpabuf_alloc(200);
1177         if (plain == NULL)
1178                 return NULL;
1179
1180         msg = wpabuf_alloc(1000);
1181         if (msg == NULL) {
1182                 wpabuf_free(plain);
1183                 return NULL;
1184         }
1185
1186         if (wps_build_version(msg) ||
1187             wps_build_msg_type(msg, WPS_M4) ||
1188             wps_build_enrollee_nonce(wps, msg) ||
1189             wps_build_r_hash(wps, msg) ||
1190             wps_build_r_snonce1(wps, plain) ||
1191             wps_build_key_wrap_auth(wps, plain) ||
1192             wps_build_encr_settings(wps, msg, plain) ||
1193             wps_build_authenticator(wps, msg)) {
1194                 wpabuf_free(plain);
1195                 wpabuf_free(msg);
1196                 return NULL;
1197         }
1198         wpabuf_free(plain);
1199
1200         wps->state = RECV_M5;
1201         return msg;
1202 }
1203
1204
1205 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1206 {
1207         struct wpabuf *msg, *plain;
1208
1209         wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1210
1211         plain = wpabuf_alloc(200);
1212         if (plain == NULL)
1213                 return NULL;
1214
1215         msg = wpabuf_alloc(1000);
1216         if (msg == NULL) {
1217                 wpabuf_free(plain);
1218                 return NULL;
1219         }
1220
1221         if (wps_build_version(msg) ||
1222             wps_build_msg_type(msg, WPS_M6) ||
1223             wps_build_enrollee_nonce(wps, msg) ||
1224             wps_build_r_snonce2(wps, plain) ||
1225             wps_build_key_wrap_auth(wps, plain) ||
1226             wps_build_encr_settings(wps, msg, plain) ||
1227             wps_build_authenticator(wps, msg)) {
1228                 wpabuf_free(plain);
1229                 wpabuf_free(msg);
1230                 return NULL;
1231         }
1232         wpabuf_free(plain);
1233
1234         wps->wps_pin_revealed = 1;
1235         wps->state = RECV_M7;
1236         return msg;
1237 }
1238
1239
1240 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1241 {
1242         struct wpabuf *msg, *plain;
1243
1244         wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1245
1246         plain = wpabuf_alloc(500);
1247         if (plain == NULL)
1248                 return NULL;
1249
1250         msg = wpabuf_alloc(1000);
1251         if (msg == NULL) {
1252                 wpabuf_free(plain);
1253                 return NULL;
1254         }
1255
1256         if (wps_build_version(msg) ||
1257             wps_build_msg_type(msg, WPS_M8) ||
1258             wps_build_enrollee_nonce(wps, msg) ||
1259             (wps->wps->ap && wps_build_cred(wps, plain)) ||
1260             (!wps->wps->ap && wps_build_ap_settings(wps, plain)) ||
1261             wps_build_key_wrap_auth(wps, plain) ||
1262             wps_build_encr_settings(wps, msg, plain) ||
1263             wps_build_authenticator(wps, msg)) {
1264                 wpabuf_free(plain);
1265                 wpabuf_free(msg);
1266                 return NULL;
1267         }
1268         wpabuf_free(plain);
1269
1270         wps->state = RECV_DONE;
1271         return msg;
1272 }
1273
1274
1275 static struct wpabuf * wps_build_wsc_ack(struct wps_data *wps)
1276 {
1277         struct wpabuf *msg;
1278
1279         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_ACK");
1280
1281         msg = wpabuf_alloc(1000);
1282         if (msg == NULL)
1283                 return NULL;
1284
1285         if (wps_build_version(msg) ||
1286             wps_build_msg_type(msg, WPS_WSC_ACK) ||
1287             wps_build_enrollee_nonce(wps, msg) ||
1288             wps_build_registrar_nonce(wps, msg)) {
1289                 wpabuf_free(msg);
1290                 return NULL;
1291         }
1292
1293         return msg;
1294 }
1295
1296
1297 static struct wpabuf * wps_build_wsc_nack(struct wps_data *wps)
1298 {
1299         struct wpabuf *msg;
1300
1301         wpa_printf(MSG_DEBUG, "WPS: Building Message WSC_NACK");
1302
1303         msg = wpabuf_alloc(1000);
1304         if (msg == NULL)
1305                 return NULL;
1306
1307         if (wps_build_version(msg) ||
1308             wps_build_msg_type(msg, WPS_WSC_NACK) ||
1309             wps_build_enrollee_nonce(wps, msg) ||
1310             wps_build_registrar_nonce(wps, msg) ||
1311             wps_build_config_error(msg, wps->config_error)) {
1312                 wpabuf_free(msg);
1313                 return NULL;
1314         }
1315
1316         return msg;
1317 }
1318
1319
1320 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1321                                       enum wsc_op_code *op_code)
1322 {
1323         struct wpabuf *msg;
1324
1325 #ifdef CONFIG_WPS_UPNP
1326         if (wps->wps->wps_upnp && wps->wps->upnp_msg) {
1327                 wpa_printf(MSG_DEBUG, "WPS: Use pending message from UPnP");
1328                 msg = wps->wps->upnp_msg;
1329                 wps->wps->upnp_msg = NULL;
1330                 *op_code = WSC_MSG; /* FIX: ack/nack */
1331                 wps->ext_reg = 1;
1332                 return msg;
1333         }
1334         if (wps->ext_reg) {
1335                 wpa_printf(MSG_DEBUG, "WPS: Using external Registrar, but no "
1336                            "pending message available");
1337                 return NULL;
1338         }
1339 #endif /* CONFIG_WPS_UPNP */
1340
1341         switch (wps->state) {
1342         case SEND_M2:
1343                 if (wps_get_dev_password(wps) < 0)
1344                         msg = wps_build_m2d(wps);
1345                 else
1346                         msg = wps_build_m2(wps);
1347                 *op_code = WSC_MSG;
1348                 break;
1349         case SEND_M2D:
1350                 msg = wps_build_m2d(wps);
1351                 *op_code = WSC_MSG;
1352                 break;
1353         case SEND_M4:
1354                 msg = wps_build_m4(wps);
1355                 *op_code = WSC_MSG;
1356                 break;
1357         case SEND_M6:
1358                 msg = wps_build_m6(wps);
1359                 *op_code = WSC_MSG;
1360                 break;
1361         case SEND_M8:
1362                 msg = wps_build_m8(wps);
1363                 *op_code = WSC_MSG;
1364                 break;
1365         case RECV_DONE:
1366                 msg = wps_build_wsc_ack(wps);
1367                 *op_code = WSC_ACK;
1368                 break;
1369         case SEND_WSC_NACK:
1370                 msg = wps_build_wsc_nack(wps);
1371                 *op_code = WSC_NACK;
1372                 break;
1373         default:
1374                 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
1375                            "a message", wps->state);
1376                 msg = NULL;
1377                 break;
1378         }
1379
1380         if (*op_code == WSC_MSG && msg) {
1381                 /* Save a copy of the last message for Authenticator derivation
1382                  */
1383                 wpabuf_free(wps->last_msg);
1384                 wps->last_msg = wpabuf_dup(msg);
1385         }
1386
1387         return msg;
1388 }
1389
1390
1391 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
1392 {
1393         if (e_nonce == NULL) {
1394                 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
1395                 return -1;
1396         }
1397
1398         os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
1399         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
1400                     wps->nonce_e, WPS_NONCE_LEN);
1401
1402         return 0;
1403 }
1404
1405
1406 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
1407 {
1408         if (r_nonce == NULL) {
1409                 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
1410                 return -1;
1411         }
1412
1413         if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
1414                 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
1415                 return -1;
1416         }
1417
1418         return 0;
1419 }
1420
1421
1422 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
1423 {
1424         if (uuid_e == NULL) {
1425                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
1426                 return -1;
1427         }
1428
1429         os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
1430         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
1431
1432         return 0;
1433 }
1434
1435
1436 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
1437 {
1438         if (pw_id == NULL) {
1439                 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
1440                 return -1;
1441         }
1442
1443         wps->dev_pw_id = WPA_GET_BE16(pw_id);
1444         wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
1445
1446         return 0;
1447 }
1448
1449
1450 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
1451 {
1452         if (e_hash1 == NULL) {
1453                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
1454                 return -1;
1455         }
1456
1457         os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
1458         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
1459
1460         return 0;
1461 }
1462
1463
1464 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
1465 {
1466         if (e_hash2 == NULL) {
1467                 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
1468                 return -1;
1469         }
1470
1471         os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
1472         wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
1473
1474         return 0;
1475 }
1476
1477
1478 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
1479 {
1480         u8 hash[SHA256_MAC_LEN];
1481         const u8 *addr[4];
1482         size_t len[4];
1483
1484         if (e_snonce1 == NULL) {
1485                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
1486                 return -1;
1487         }
1488
1489         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
1490                         WPS_SECRET_NONCE_LEN);
1491
1492         /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1493         addr[0] = e_snonce1;
1494         len[0] = WPS_SECRET_NONCE_LEN;
1495         addr[1] = wps->psk1;
1496         len[1] = WPS_PSK_LEN;
1497         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1498         len[2] = wpabuf_len(wps->dh_pubkey_e);
1499         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1500         len[3] = wpabuf_len(wps->dh_pubkey_r);
1501         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1502
1503         if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
1504                 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
1505                            "not match with the pre-committed value");
1506                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1507                 wps_pwd_auth_fail_event(wps->wps, 0, 1);
1508                 return -1;
1509         }
1510
1511         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
1512                    "half of the device password");
1513
1514         return 0;
1515 }
1516
1517
1518 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
1519 {
1520         u8 hash[SHA256_MAC_LEN];
1521         const u8 *addr[4];
1522         size_t len[4];
1523
1524         if (e_snonce2 == NULL) {
1525                 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
1526                 return -1;
1527         }
1528
1529         wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
1530                         WPS_SECRET_NONCE_LEN);
1531
1532         /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
1533         addr[0] = e_snonce2;
1534         len[0] = WPS_SECRET_NONCE_LEN;
1535         addr[1] = wps->psk2;
1536         len[1] = WPS_PSK_LEN;
1537         addr[2] = wpabuf_head(wps->dh_pubkey_e);
1538         len[2] = wpabuf_len(wps->dh_pubkey_e);
1539         addr[3] = wpabuf_head(wps->dh_pubkey_r);
1540         len[3] = wpabuf_len(wps->dh_pubkey_r);
1541         hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1542
1543         if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
1544                 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
1545                            "not match with the pre-committed value");
1546                 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
1547                 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
1548                 wps_pwd_auth_fail_event(wps->wps, 0, 2);
1549                 return -1;
1550         }
1551
1552         wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
1553                    "half of the device password");
1554         wps->wps_pin_revealed = 0;
1555         wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
1556
1557         return 0;
1558 }
1559
1560
1561 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
1562 {
1563         if (mac_addr == NULL) {
1564                 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
1565                 return -1;
1566         }
1567
1568         wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
1569                    MAC2STR(mac_addr));
1570         os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
1571         os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
1572
1573         return 0;
1574 }
1575
1576
1577 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
1578                               size_t pk_len)
1579 {
1580         if (pk == NULL || pk_len == 0) {
1581                 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
1582                 return -1;
1583         }
1584
1585         wpabuf_free(wps->dh_pubkey_e);
1586         wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
1587         if (wps->dh_pubkey_e == NULL)
1588                 return -1;
1589
1590         return 0;
1591 }
1592
1593
1594 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
1595 {
1596         u16 auth_types;
1597
1598         if (auth == NULL) {
1599                 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
1600                            "received");
1601                 return -1;
1602         }
1603
1604         auth_types = WPA_GET_BE16(auth);
1605
1606         wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
1607                    auth_types);
1608         wps->auth_type = wps->wps->auth_types & auth_types;
1609         if (wps->auth_type == 0) {
1610                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1611                            "authentication types (own 0x%x Enrollee 0x%x)",
1612                            wps->wps->auth_types, auth_types);
1613                 return -1;
1614         }
1615
1616         return 0;
1617 }
1618
1619
1620 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
1621 {
1622         u16 encr_types;
1623
1624         if (encr == NULL) {
1625                 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
1626                            "received");
1627                 return -1;
1628         }
1629
1630         encr_types = WPA_GET_BE16(encr);
1631
1632         wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
1633                    encr_types);
1634         wps->encr_type = wps->wps->encr_types & encr_types;
1635         if (wps->encr_type == 0) {
1636                 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
1637                            "encryption types");
1638                 return -1;
1639         }
1640
1641         return 0;
1642 }
1643
1644
1645 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
1646 {
1647         if (conn == NULL) {
1648                 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
1649                            "received");
1650                 return -1;
1651         }
1652
1653         wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
1654                    *conn);
1655
1656         return 0;
1657 }
1658
1659
1660 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
1661 {
1662         u16 m;
1663
1664         if (methods == NULL) {
1665                 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
1666                 return -1;
1667         }
1668
1669         m = WPA_GET_BE16(methods);
1670
1671         wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x", m);
1672
1673         return 0;
1674 }
1675
1676
1677 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
1678 {
1679         if (state == NULL) {
1680                 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
1681                            "received");
1682                 return -1;
1683         }
1684
1685         wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
1686                    *state);
1687
1688         return 0;
1689 }
1690
1691
1692 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
1693 {
1694         u16 a;
1695
1696         if (assoc == NULL) {
1697                 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
1698                 return -1;
1699         }
1700
1701         a = WPA_GET_BE16(assoc);
1702         wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
1703
1704         return 0;
1705 }
1706
1707
1708 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
1709 {
1710         u16 e;
1711
1712         if (err == NULL) {
1713                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
1714                 return -1;
1715         }
1716
1717         e = WPA_GET_BE16(err);
1718         wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
1719
1720         return 0;
1721 }
1722
1723
1724 static enum wps_process_res wps_process_m1(struct wps_data *wps,
1725                                            struct wps_parse_attr *attr)
1726 {
1727         wpa_printf(MSG_DEBUG, "WPS: Received M1");
1728
1729         if (wps->state != RECV_M1) {
1730                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1731                            "receiving M1", wps->state);
1732                 return WPS_FAILURE;
1733         }
1734
1735         if (wps_process_uuid_e(wps, attr->uuid_e) ||
1736             wps_process_mac_addr(wps, attr->mac_addr) ||
1737             wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
1738             wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
1739             wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
1740             wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
1741             wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
1742             wps_process_config_methods(wps, attr->config_methods) ||
1743             wps_process_wps_state(wps, attr->wps_state) ||
1744             wps_process_device_attrs(&wps->peer_dev, attr) ||
1745             wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
1746             wps_process_assoc_state(wps, attr->assoc_state) ||
1747             wps_process_dev_password_id(wps, attr->dev_password_id) ||
1748             wps_process_config_error(wps, attr->config_error) ||
1749             wps_process_os_version(&wps->peer_dev, attr->os_version))
1750                 return WPS_FAILURE;
1751
1752         if (wps->dev_pw_id != DEV_PW_DEFAULT &&
1753             wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
1754             wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
1755             wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
1756             (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
1757              !wps->wps->registrar->pbc)) {
1758                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
1759                            wps->dev_pw_id);
1760                 wps->state = SEND_M2D;
1761                 return WPS_CONTINUE;
1762         }
1763
1764         if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
1765                 if (wps_registrar_pbc_overlap(wps->wps->registrar,
1766                                               wps->mac_addr_e, wps->uuid_e)) {
1767                         wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
1768                                    "negotiation");
1769                         wps->state = SEND_M2D;
1770                         return WPS_CONTINUE;
1771                 }
1772                 wps_registrar_add_pbc_session(wps->wps->registrar,
1773                                               wps->mac_addr_e, wps->uuid_e);
1774                 wps->pbc = 1;
1775         }
1776
1777         wps->state = SEND_M2;
1778         return WPS_CONTINUE;
1779 }
1780
1781
1782 static enum wps_process_res wps_process_m3(struct wps_data *wps,
1783                                            const struct wpabuf *msg,
1784                                            struct wps_parse_attr *attr)
1785 {
1786         wpa_printf(MSG_DEBUG, "WPS: Received M3");
1787
1788         if (wps->state != RECV_M3) {
1789                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1790                            "receiving M3", wps->state);
1791                 wps->state = SEND_WSC_NACK;
1792                 return WPS_CONTINUE;
1793         }
1794
1795         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1796             wps_process_authenticator(wps, attr->authenticator, msg) ||
1797             wps_process_e_hash1(wps, attr->e_hash1) ||
1798             wps_process_e_hash2(wps, attr->e_hash2)) {
1799                 wps->state = SEND_WSC_NACK;
1800                 return WPS_CONTINUE;
1801         }
1802
1803         wps->state = SEND_M4;
1804         return WPS_CONTINUE;
1805 }
1806
1807
1808 static enum wps_process_res wps_process_m5(struct wps_data *wps,
1809                                            const struct wpabuf *msg,
1810                                            struct wps_parse_attr *attr)
1811 {
1812         struct wpabuf *decrypted;
1813         struct wps_parse_attr eattr;
1814
1815         wpa_printf(MSG_DEBUG, "WPS: Received M5");
1816
1817         if (wps->state != RECV_M5) {
1818                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1819                            "receiving M5", wps->state);
1820                 wps->state = SEND_WSC_NACK;
1821                 return WPS_CONTINUE;
1822         }
1823
1824         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1825             wps_process_authenticator(wps, attr->authenticator, msg)) {
1826                 wps->state = SEND_WSC_NACK;
1827                 return WPS_CONTINUE;
1828         }
1829
1830         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1831                                               attr->encr_settings_len);
1832         if (decrypted == NULL) {
1833                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1834                            "Settings attribute");
1835                 wps->state = SEND_WSC_NACK;
1836                 return WPS_CONTINUE;
1837         }
1838
1839         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1840                    "attribute");
1841         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1842             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1843             wps_process_e_snonce1(wps, eattr.e_snonce1)) {
1844                 wpabuf_free(decrypted);
1845                 wps->state = SEND_WSC_NACK;
1846                 return WPS_CONTINUE;
1847         }
1848         wpabuf_free(decrypted);
1849
1850         wps->state = SEND_M6;
1851         return WPS_CONTINUE;
1852 }
1853
1854
1855 static int wps_process_ap_settings_r(struct wps_data *wps,
1856                                      struct wps_parse_attr *attr)
1857 {
1858         if (wps->wps->ap)
1859                 return 0;
1860
1861         /* AP Settings Attributes in M7 when Enrollee is an AP */
1862         if (wps_process_ap_settings(attr, &wps->cred) < 0)
1863                 return -1;
1864
1865         wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
1866
1867         /*
1868          * TODO: Provide access to AP settings and allow changes before sending
1869          * out M8. For now, just copy the settings unchanged into M8.
1870          */
1871
1872         return 0;
1873 }
1874
1875
1876 static enum wps_process_res wps_process_m7(struct wps_data *wps,
1877                                            const struct wpabuf *msg,
1878                                            struct wps_parse_attr *attr)
1879 {
1880         struct wpabuf *decrypted;
1881         struct wps_parse_attr eattr;
1882
1883         wpa_printf(MSG_DEBUG, "WPS: Received M7");
1884
1885         if (wps->state != RECV_M7) {
1886                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
1887                            "receiving M7", wps->state);
1888                 wps->state = SEND_WSC_NACK;
1889                 return WPS_CONTINUE;
1890         }
1891
1892         if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
1893             wps_process_authenticator(wps, attr->authenticator, msg)) {
1894                 wps->state = SEND_WSC_NACK;
1895                 return WPS_CONTINUE;
1896         }
1897
1898         decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
1899                                               attr->encr_settings_len);
1900         if (decrypted == NULL) {
1901                 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
1902                            "Settings attribute");
1903                 wps->state = SEND_WSC_NACK;
1904                 return WPS_CONTINUE;
1905         }
1906
1907         wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
1908                    "attribute");
1909         if (wps_parse_msg(decrypted, &eattr) < 0 ||
1910             wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
1911             wps_process_e_snonce2(wps, eattr.e_snonce2) ||
1912             wps_process_ap_settings_r(wps, &eattr)) {
1913                 wpabuf_free(decrypted);
1914                 wps->state = SEND_WSC_NACK;
1915                 return WPS_CONTINUE;
1916         }
1917
1918         wpabuf_free(decrypted);
1919
1920         wps->state = SEND_M8;
1921         return WPS_CONTINUE;
1922 }
1923
1924
1925 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
1926                                                 const struct wpabuf *msg)
1927 {
1928         struct wps_parse_attr attr;
1929         enum wps_process_res ret = WPS_CONTINUE;
1930
1931         wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
1932
1933         if (wps_parse_msg(msg, &attr) < 0)
1934                 return WPS_FAILURE;
1935
1936         if (attr.version == NULL || *attr.version != WPS_VERSION) {
1937                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
1938                            attr.version ? *attr.version : 0);
1939                 return WPS_FAILURE;
1940         }
1941
1942         if (attr.msg_type == NULL) {
1943                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
1944                 return WPS_FAILURE;
1945         }
1946
1947         if (*attr.msg_type != WPS_M1 &&
1948             (attr.registrar_nonce == NULL ||
1949              os_memcmp(wps->nonce_r, attr.registrar_nonce,
1950                        WPS_NONCE_LEN != 0))) {
1951                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
1952                 return WPS_FAILURE;
1953         }
1954
1955         switch (*attr.msg_type) {
1956         case WPS_M1:
1957 #ifdef CONFIG_WPS_UPNP
1958                 if (wps->wps->wps_upnp && attr.mac_addr) {
1959                         /* Remove old pending messages when starting new run */
1960                         wpabuf_free(wps->wps->upnp_msg);
1961                         wps->wps->upnp_msg = NULL;
1962
1963                         upnp_wps_device_send_wlan_event(
1964                                 wps->wps->wps_upnp, attr.mac_addr,
1965                                 UPNP_WPS_WLANEVENT_TYPE_EAP, msg);
1966                 }
1967 #endif /* CONFIG_WPS_UPNP */
1968                 ret = wps_process_m1(wps, &attr);
1969                 break;
1970         case WPS_M3:
1971                 ret = wps_process_m3(wps, msg, &attr);
1972                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1973                         wps_fail_event(wps->wps, WPS_M3);
1974                 break;
1975         case WPS_M5:
1976                 ret = wps_process_m5(wps, msg, &attr);
1977                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1978                         wps_fail_event(wps->wps, WPS_M5);
1979                 break;
1980         case WPS_M7:
1981                 ret = wps_process_m7(wps, msg, &attr);
1982                 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
1983                         wps_fail_event(wps->wps, WPS_M7);
1984                 break;
1985         default:
1986                 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
1987                            *attr.msg_type);
1988                 return WPS_FAILURE;
1989         }
1990
1991         if (ret == WPS_CONTINUE) {
1992                 /* Save a copy of the last message for Authenticator derivation
1993                  */
1994                 wpabuf_free(wps->last_msg);
1995                 wps->last_msg = wpabuf_dup(msg);
1996         }
1997
1998         return ret;
1999 }
2000
2001
2002 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
2003                                                 const struct wpabuf *msg)
2004 {
2005         struct wps_parse_attr attr;
2006
2007         wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
2008
2009         if (wps_parse_msg(msg, &attr) < 0)
2010                 return WPS_FAILURE;
2011
2012         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2013                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2014                            attr.version ? *attr.version : 0);
2015                 return WPS_FAILURE;
2016         }
2017
2018         if (attr.msg_type == NULL) {
2019                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2020                 return WPS_FAILURE;
2021         }
2022
2023         if (*attr.msg_type != WPS_WSC_ACK) {
2024                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2025                            *attr.msg_type);
2026                 return WPS_FAILURE;
2027         }
2028
2029 #ifdef CONFIG_WPS_UPNP
2030         if (wps->wps->wps_upnp && wps->ext_reg && wps->state == RECV_M2D_ACK &&
2031             upnp_wps_subscribers(wps->wps->wps_upnp)) {
2032                 if (wps->wps->upnp_msg)
2033                         return WPS_CONTINUE;
2034                 wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2035                            "external Registrar");
2036                 return WPS_PENDING;
2037         }
2038 #endif /* CONFIG_WPS_UPNP */
2039
2040         if (attr.registrar_nonce == NULL ||
2041             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2042         {
2043                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2044                 return WPS_FAILURE;
2045         }
2046
2047         if (attr.enrollee_nonce == NULL ||
2048             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2049                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2050                 return WPS_FAILURE;
2051         }
2052
2053         if (wps->state == RECV_M2D_ACK) {
2054 #ifdef CONFIG_WPS_UPNP
2055                 if (wps->wps->wps_upnp &&
2056                     upnp_wps_subscribers(wps->wps->wps_upnp)) {
2057                         if (wps->wps->upnp_msg)
2058                                 return WPS_CONTINUE;
2059                         wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2060                                    "external Registrar");
2061                         return WPS_PENDING;
2062                 }
2063 #endif /* CONFIG_WPS_UPNP */
2064
2065                 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
2066                            "terminate negotiation");
2067         }
2068
2069         return WPS_FAILURE;
2070 }
2071
2072
2073 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
2074                                                  const struct wpabuf *msg)
2075 {
2076         struct wps_parse_attr attr;
2077         int old_state;
2078
2079         wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
2080
2081         old_state = wps->state;
2082         wps->state = SEND_WSC_NACK;
2083
2084         if (wps_parse_msg(msg, &attr) < 0)
2085                 return WPS_FAILURE;
2086
2087         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2088                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2089                            attr.version ? *attr.version : 0);
2090                 return WPS_FAILURE;
2091         }
2092
2093         if (attr.msg_type == NULL) {
2094                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2095                 return WPS_FAILURE;
2096         }
2097
2098         if (*attr.msg_type != WPS_WSC_NACK) {
2099                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2100                            *attr.msg_type);
2101                 return WPS_FAILURE;
2102         }
2103
2104 #ifdef CONFIG_WPS_UPNP
2105         if (wps->wps->wps_upnp && wps->ext_reg) {
2106                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2107                            "Registrar terminated by the Enrollee");
2108                 return WPS_FAILURE;
2109         }
2110 #endif /* CONFIG_WPS_UPNP */
2111
2112         if (attr.registrar_nonce == NULL ||
2113             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2114         {
2115                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2116                 return WPS_FAILURE;
2117         }
2118
2119         if (attr.enrollee_nonce == NULL ||
2120             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2121                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2122                 return WPS_FAILURE;
2123         }
2124
2125         if (attr.config_error == NULL) {
2126                 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
2127                            "in WSC_NACK");
2128                 return WPS_FAILURE;
2129         }
2130
2131         wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
2132                    "Configuration Error %d", WPA_GET_BE16(attr.config_error));
2133
2134         switch (old_state) {
2135         case RECV_M3:
2136                 wps_fail_event(wps->wps, WPS_M2);
2137                 break;
2138         case RECV_M5:
2139                 wps_fail_event(wps->wps, WPS_M4);
2140                 break;
2141         case RECV_M7:
2142                 wps_fail_event(wps->wps, WPS_M6);
2143                 break;
2144         case RECV_DONE:
2145                 wps_fail_event(wps->wps, WPS_M8);
2146                 break;
2147         default:
2148                 break;
2149         }
2150
2151         return WPS_FAILURE;
2152 }
2153
2154
2155 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
2156                                                  const struct wpabuf *msg)
2157 {
2158         struct wps_parse_attr attr;
2159
2160         wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
2161
2162         if (wps->state != RECV_DONE &&
2163             (!wps->wps->wps_upnp || !wps->ext_reg)) {
2164                 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2165                            "receiving WSC_Done", wps->state);
2166                 return WPS_FAILURE;
2167         }
2168
2169         if (wps_parse_msg(msg, &attr) < 0)
2170                 return WPS_FAILURE;
2171
2172         if (attr.version == NULL || *attr.version != WPS_VERSION) {
2173                 wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",
2174                            attr.version ? *attr.version : 0);
2175                 return WPS_FAILURE;
2176         }
2177
2178         if (attr.msg_type == NULL) {
2179                 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2180                 return WPS_FAILURE;
2181         }
2182
2183         if (*attr.msg_type != WPS_WSC_DONE) {
2184                 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2185                            *attr.msg_type);
2186                 return WPS_FAILURE;
2187         }
2188
2189 #ifdef CONFIG_WPS_UPNP
2190         if (wps->wps->wps_upnp && wps->ext_reg) {
2191                 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
2192                            "Registrar completed successfully");
2193                 return WPS_DONE;
2194         }
2195 #endif /* CONFIG_WPS_UPNP */
2196
2197         if (attr.registrar_nonce == NULL ||
2198             os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN != 0))
2199         {
2200                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2201                 return WPS_FAILURE;
2202         }
2203
2204         if (attr.enrollee_nonce == NULL ||
2205             os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {
2206                 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2207                 return WPS_FAILURE;
2208         }
2209
2210         wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
2211
2212         if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
2213             wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
2214                 struct wps_credential cred;
2215
2216                 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
2217                            "on first Enrollee connection");
2218
2219                 os_memset(&cred, 0, sizeof(cred));
2220                 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
2221                 cred.ssid_len = wps->wps->ssid_len;
2222                 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
2223                 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
2224                 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
2225                 cred.key_len = wps->new_psk_len;
2226
2227                 wps->wps->wps_state = WPS_STATE_CONFIGURED;
2228                 wpa_hexdump_ascii_key(MSG_DEBUG,
2229                                       "WPS: Generated random passphrase",
2230                                       wps->new_psk, wps->new_psk_len);
2231                 if (wps->wps->cred_cb)
2232                         wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
2233
2234                 os_free(wps->new_psk);
2235                 wps->new_psk = NULL;
2236         }
2237
2238         if (!wps->wps->ap) {
2239                 wpa_printf(MSG_DEBUG, "WPS: Update local configuration based "
2240                            "on the modified AP configuration");
2241                 if (wps->wps->cred_cb)
2242                         wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2243         }
2244
2245         if (wps->new_psk) {
2246                 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
2247                                    wps->new_psk, wps->new_psk_len)) {
2248                         wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
2249                                    "new PSK");
2250                 }
2251                 os_free(wps->new_psk);
2252                 wps->new_psk = NULL;
2253         }
2254
2255         wps_cb_reg_success(wps->wps->registrar, wps->mac_addr_e, wps->uuid_e);
2256
2257         if (wps->pbc) {
2258                 wps_registrar_remove_pbc_session(wps->wps->registrar,
2259                                                  wps->mac_addr_e, wps->uuid_e);
2260                 wps_registrar_pbc_completed(wps->wps->registrar);
2261         }
2262
2263         wps_success_event(wps->wps);
2264
2265         return WPS_DONE;
2266 }
2267
2268
2269 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
2270                                                enum wsc_op_code op_code,
2271                                                const struct wpabuf *msg)
2272 {
2273         enum wps_process_res ret;
2274
2275         wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
2276                    "op_code=%d)",
2277                    (unsigned long) wpabuf_len(msg), op_code);
2278
2279 #ifdef CONFIG_WPS_UPNP
2280         if (wps->wps->wps_upnp && wps->ext_reg && wps->wps->upnp_msg == NULL &&
2281             (op_code == WSC_MSG || op_code == WSC_Done)) {
2282                 struct wps_parse_attr attr;
2283                 int type;
2284                 if (wps_parse_msg(msg, &attr) < 0 || attr.msg_type == NULL)
2285                         type = -1;
2286                 else
2287                         type = *attr.msg_type;
2288                 wpa_printf(MSG_DEBUG, "WPS: Sending received message (type %d)"
2289                            " to external Registrar for processing", type);
2290                 upnp_wps_device_send_wlan_event(wps->wps->wps_upnp,
2291                                                 wps->mac_addr_e,
2292                                                 UPNP_WPS_WLANEVENT_TYPE_EAP,
2293                                                 msg);
2294                 if (op_code == WSC_MSG)
2295                         return WPS_PENDING;
2296         } else if (wps->wps->wps_upnp && wps->ext_reg && op_code == WSC_MSG) {
2297                 wpa_printf(MSG_DEBUG, "WPS: Skip internal processing - using "
2298                            "external Registrar");
2299                 return WPS_CONTINUE;
2300         }
2301 #endif /* CONFIG_WPS_UPNP */
2302
2303         switch (op_code) {
2304         case WSC_MSG:
2305                 return wps_process_wsc_msg(wps, msg);
2306         case WSC_ACK:
2307                 return wps_process_wsc_ack(wps, msg);
2308         case WSC_NACK:
2309                 return wps_process_wsc_nack(wps, msg);
2310         case WSC_Done:
2311                 ret = wps_process_wsc_done(wps, msg);
2312                 if (ret == WPS_FAILURE) {
2313                         wps->state = SEND_WSC_NACK;
2314                         wps_fail_event(wps->wps, WPS_WSC_DONE);
2315                 }
2316                 return ret;
2317         default:
2318                 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
2319                 return WPS_FAILURE;
2320         }
2321 }
2322
2323
2324 int wps_registrar_update_ie(struct wps_registrar *reg)
2325 {
2326         return wps_set_ie(reg);
2327 }
2328
2329
2330 static void wps_registrar_set_selected_timeout(void *eloop_ctx,
2331                                                void *timeout_ctx)
2332 {
2333         struct wps_registrar *reg = eloop_ctx;
2334
2335         wpa_printf(MSG_DEBUG, "WPS: SetSelectedRegistrar timed out - "
2336                    "unselect Registrar");
2337         reg->selected_registrar = 0;
2338         reg->pbc = 0;
2339         reg->sel_reg_dev_password_id_override = -1;
2340         reg->sel_reg_config_methods_override = -1;
2341         wps_set_ie(reg);
2342 }
2343
2344
2345 /**
2346  * wps_registrar_set_selected_registrar - Notification of SetSelectedRegistrar
2347  * @reg: Registrar data from wps_registrar_init()
2348  * @msg: Received message from SetSelectedRegistrar
2349  * @msg_len: Length of msg in octets
2350  * Returns: 0 on success, -1 on failure
2351  *
2352  * This function is called when an AP receives a SetSelectedRegistrar UPnP
2353  * message.
2354  */
2355 int wps_registrar_set_selected_registrar(struct wps_registrar *reg,
2356                                          const struct wpabuf *msg)
2357 {
2358         struct wps_parse_attr attr;
2359
2360         wpa_hexdump_buf(MSG_MSGDUMP, "WPS: SetSelectedRegistrar attributes",
2361                         msg);
2362
2363         if (wps_parse_msg(msg, &attr) < 0 ||
2364             attr.version == NULL || *attr.version != WPS_VERSION) {
2365                 wpa_printf(MSG_DEBUG, "WPS: Unsupported SetSelectedRegistrar "
2366                            "version 0x%x", attr.version ? *attr.version : 0);
2367                 return -1;
2368         }
2369
2370         if (attr.selected_registrar == NULL ||
2371             *attr.selected_registrar == 0) {
2372                 wpa_printf(MSG_DEBUG, "WPS: SetSelectedRegistrar: Disable "
2373                            "Selected Registrar");
2374                 eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg,
2375                                      NULL);
2376                 wps_registrar_set_selected_timeout(reg, NULL);
2377                 return 0;
2378         }
2379
2380         reg->selected_registrar = 1;
2381         reg->sel_reg_dev_password_id_override = attr.dev_password_id ?
2382                 WPA_GET_BE16(attr.dev_password_id) : DEV_PW_DEFAULT;
2383         reg->sel_reg_config_methods_override = attr.sel_reg_config_methods ?
2384                 WPA_GET_BE16(attr.sel_reg_config_methods) : -1;
2385         wps_set_ie(reg);
2386
2387         eloop_cancel_timeout(wps_registrar_set_selected_timeout, reg, NULL);
2388         eloop_register_timeout(WPS_PBC_WALK_TIME, 0,
2389                                wps_registrar_set_selected_timeout,
2390                                reg, NULL);
2391         return 0;
2392 }