1 /*
2 * Wi-Fi Protected Setup - Registrar
3 * Copyright (c) 2008-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8 #include "utils/includes.h"
9 #include "utils/list.h"
10 #include "utils/common.h"
11 #include "utils/base64.h"
12 #include "utils/uuid.h"
13 #include "utils/list.h"
14 #include "crypto/crypto.h"
15 #include "crypto/sha256.h"
16 #include "crypto/random.h"
17 #include "common/ieee802_11_defs.h"
18 #include "wps/wps_i.h"
19 #include "wps/wps_dev_attr.h"
20
21 #ifndef CONFIG_WPS_STRICT
22 #define WPS_WORKAROUNDS
23 #endif /* CONFIG_WPS_STRICT */
24
25 #ifdef CONFIG_WPS_NFC
26
27 struct wps_nfc_pw_token {
28 struct dl_list list;
29 u8 pubkey_hash[WPS_OOB_PUBKEY_HASH_LEN];
30 u16 pw_id;
31 u8 dev_pw[WPS_OOB_DEVICE_PASSWORD_LEN];
32 size_t dev_pw_len;
33 };
34
35
wps_remove_nfc_pw_token(struct wps_nfc_pw_token * token)36 static void wps_remove_nfc_pw_token(struct wps_nfc_pw_token *token)
37 {
38 dl_list_del(&token->list);
39 os_free(token);
40 }
41
42
wps_free_nfc_pw_tokens(struct dl_list * tokens,u16 pw_id)43 static void wps_free_nfc_pw_tokens(struct dl_list *tokens, u16 pw_id)
44 {
45 struct wps_nfc_pw_token *token, *prev;
46 dl_list_for_each_safe(token, prev, tokens, struct wps_nfc_pw_token,
47 list) {
48 if (pw_id == 0 || pw_id == token->pw_id)
49 wps_remove_nfc_pw_token(token);
50 }
51 }
52
53
wps_get_nfc_pw_token(struct dl_list * tokens,u16 pw_id)54 static struct wps_nfc_pw_token * wps_get_nfc_pw_token(struct dl_list *tokens,
55 u16 pw_id)
56 {
57 struct wps_nfc_pw_token *token;
58 dl_list_for_each(token, tokens, struct wps_nfc_pw_token, list) {
59 if (pw_id == token->pw_id)
60 return token;
61 }
62 return NULL;
63 }
64
65 #else /* CONFIG_WPS_NFC */
66
67 #define wps_free_nfc_pw_tokens(t, p) do { } while (0)
68
69 #endif /* CONFIG_WPS_NFC */
70
71 #ifdef CONFIG_WPS_PIN
72
73 struct wps_uuid_pin {
74 struct dl_list list;
75 u8 uuid[WPS_UUID_LEN];
76 int wildcard_uuid;
77 u8 *pin;
78 size_t pin_len;
79 #define PIN_LOCKED BIT(0)
80 #define PIN_EXPIRES BIT(1)
81 int flags;
82 struct os_time expiration;
83 u8 enrollee_addr[ETH_ALEN];
84 };
85
86
wps_free_pin(struct wps_uuid_pin * pin)87 static void wps_free_pin(struct wps_uuid_pin *pin)
88 {
89 os_free(pin->pin);
90 os_free(pin);
91 }
92
93
wps_remove_pin(struct wps_uuid_pin * pin)94 static void wps_remove_pin(struct wps_uuid_pin *pin)
95 {
96 dl_list_del(&pin->list);
97 wps_free_pin(pin);
98 }
99
100
wps_free_pins(struct dl_list * pins)101 static void wps_free_pins(struct dl_list *pins)
102 {
103 struct wps_uuid_pin *pin, *prev;
104 dl_list_for_each_safe(pin, prev, pins, struct wps_uuid_pin, list)
105 wps_remove_pin(pin);
106 }
107
108 #endif
109
110 struct wps_pbc_session {
111 struct wps_pbc_session *next;
112 u8 addr[ETH_ALEN];
113 u8 uuid_e[WPS_UUID_LEN];
114 struct os_time timestamp;
115 };
116
117
wps_free_pbc_sessions(struct wps_pbc_session * pbc)118 static void wps_free_pbc_sessions(struct wps_pbc_session *pbc)
119 {
120 struct wps_pbc_session *prev;
121
122 while (pbc) {
123 prev = pbc;
124 pbc = pbc->next;
125 os_free(prev);
126 }
127 }
128
129
130 struct wps_registrar_device {
131 struct wps_registrar_device *next;
132 struct wps_device_data dev;
133 u8 uuid[WPS_UUID_LEN];
134 };
135
136
137 struct wps_registrar {
138 struct wps_context *wps;
139
140 int pbc;
141 int selected_registrar;
142
143 int (*new_psk_cb)(void *ctx, const u8 *mac_addr, const u8 *psk,
144 size_t psk_len);
145 int (*set_ie_cb)(void *ctx, struct wpabuf *beacon_ie,
146 struct wpabuf *probe_resp_ie);
147 void (*pin_needed_cb)(void *ctx, const u8 *uuid_e,
148 const struct wps_device_data *dev);
149 void (*reg_success_cb)(void *ctx, const u8 *mac_addr,
150 const u8 *uuid_e, const u8 *dev_pw,
151 size_t dev_pw_len);
152 void (*set_sel_reg_cb)(void *ctx, int sel_reg, u16 dev_passwd_id,
153 u16 sel_reg_config_methods);
154 void (*enrollee_seen_cb)(void *ctx, const u8 *addr, const u8 *uuid_e,
155 const u8 *pri_dev_type, u16 config_methods,
156 u16 dev_password_id, u8 request_type,
157 const char *dev_name);
158 void *cb_ctx;
159
160 struct dl_list pins;
161 struct dl_list nfc_pw_tokens;
162 struct wps_pbc_session *pbc_sessions;
163
164 int skip_cred_build;
165 struct wpabuf *extra_cred;
166 int disable_auto_conf;
167 int sel_reg_union;
168 int sel_reg_dev_password_id_override;
169 int sel_reg_config_methods_override;
170 int static_wep_only;
171 int dualband;
172
173 struct wps_registrar_device *devices;
174
175 int force_pbc_overlap;
176
177 u8 authorized_macs[WPS_MAX_AUTHORIZED_MACS][ETH_ALEN];
178 u8 authorized_macs_union[WPS_MAX_AUTHORIZED_MACS][ETH_ALEN];
179
180 u8 p2p_dev_addr[ETH_ALEN];
181
182 u8 pbc_ignore_uuid[WPS_UUID_LEN];
183 struct os_time pbc_ignore_start;
184 };
185
186
187 static int wps_set_ie(struct wps_registrar *reg);
188 static void wps_registrar_pbc_timeout(void *eloop_ctx);
189
190 #ifdef CONFIG_WPS_PIN
191
192 static void wps_registrar_remove_pin(struct wps_registrar *reg,
193 struct wps_uuid_pin *pin);
194 #endif
195
wps_registrar_add_authorized_mac(struct wps_registrar * reg,const u8 * addr)196 static void wps_registrar_add_authorized_mac(struct wps_registrar *reg,
197 const u8 *addr)
198 {
199 int i;
200 wpa_printf(MSG_DEBUG, "WPS: Add authorized MAC " MACSTR,
201 MAC2STR(addr));
202 for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++)
203 if (os_memcmp(reg->authorized_macs[i], addr, ETH_ALEN) == 0) {
204 wpa_printf(MSG_DEBUG, "WPS: Authorized MAC was "
205 "already in the list");
206 return; /* already in list */
207 }
208 for (i = WPS_MAX_AUTHORIZED_MACS - 1; i > 0; i--)
209 os_memcpy(reg->authorized_macs[i], reg->authorized_macs[i - 1],
210 ETH_ALEN);
211 os_memcpy(reg->authorized_macs[0], addr, ETH_ALEN);
212 wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs",
213 (u8 *) reg->authorized_macs, sizeof(reg->authorized_macs));
214 }
215
216
wps_registrar_remove_authorized_mac(struct wps_registrar * reg,const u8 * addr)217 static void wps_registrar_remove_authorized_mac(struct wps_registrar *reg,
218 const u8 *addr)
219 {
220 int i;
221 wpa_printf(MSG_DEBUG, "WPS: Remove authorized MAC " MACSTR,
222 MAC2STR(addr));
223 for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++) {
224 if (os_memcmp(reg->authorized_macs, addr, ETH_ALEN) == 0)
225 break;
226 }
227 if (i == WPS_MAX_AUTHORIZED_MACS) {
228 wpa_printf(MSG_DEBUG, "WPS: Authorized MAC was not in the "
229 "list");
230 return; /* not in the list */
231 }
232 for (; i + 1 < WPS_MAX_AUTHORIZED_MACS; i++)
233 os_memcpy(reg->authorized_macs[i], reg->authorized_macs[i + 1],
234 ETH_ALEN);
235 os_memset(reg->authorized_macs[WPS_MAX_AUTHORIZED_MACS - 1], 0,
236 ETH_ALEN);
237 wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs",
238 (u8 *) reg->authorized_macs, sizeof(reg->authorized_macs));
239 }
240
241
wps_free_devices(struct wps_registrar_device * dev)242 static void wps_free_devices(struct wps_registrar_device *dev)
243 {
244 struct wps_registrar_device *prev;
245
246 while (dev) {
247 prev = dev;
248 dev = dev->next;
249 wps_device_data_free(&prev->dev);
250 os_free(prev);
251 }
252 }
253
254
wps_device_get(struct wps_registrar * reg,const u8 * addr)255 static struct wps_registrar_device * wps_device_get(struct wps_registrar *reg,
256 const u8 *addr)
257 {
258 struct wps_registrar_device *dev;
259
260 for (dev = reg->devices; dev; dev = dev->next) {
261 if (os_memcmp(dev->dev.mac_addr, addr, ETH_ALEN) == 0)
262 return dev;
263 }
264 return NULL;
265 }
266
267
wps_device_clone_data(struct wps_device_data * dst,struct wps_device_data * src)268 static void wps_device_clone_data(struct wps_device_data *dst,
269 struct wps_device_data *src)
270 {
271 os_memcpy(dst->mac_addr, src->mac_addr, ETH_ALEN);
272 os_memcpy(dst->pri_dev_type, src->pri_dev_type, WPS_DEV_TYPE_LEN);
273
274 #define WPS_STRDUP(n) \
275 os_free(dst->n); \
276 dst->n = src->n ? os_strdup(src->n) : NULL
277
278 WPS_STRDUP(device_name);
279 WPS_STRDUP(manufacturer);
280 WPS_STRDUP(model_name);
281 WPS_STRDUP(model_number);
282 WPS_STRDUP(serial_number);
283 #undef WPS_STRDUP
284 }
285
286
wps_device_store(struct wps_registrar * reg,struct wps_device_data * dev,const u8 * uuid)287 int wps_device_store(struct wps_registrar *reg,
288 struct wps_device_data *dev, const u8 *uuid)
289 {
290 struct wps_registrar_device *d;
291
292 d = wps_device_get(reg, dev->mac_addr);
293 if (d == NULL) {
294 d = (struct wps_registrar_device *)os_zalloc(sizeof(*d));
295 if (d == NULL)
296 return -1;
297 d->next = reg->devices;
298 reg->devices = d;
299 }
300
301 wps_device_clone_data(&d->dev, dev);
302 os_memcpy(d->uuid, uuid, WPS_UUID_LEN);
303
304 return 0;
305 }
306
307
wps_registrar_add_pbc_session(struct wps_registrar * reg,const u8 * addr,const u8 * uuid_e)308 static void wps_registrar_add_pbc_session(struct wps_registrar *reg,
309 const u8 *addr, const u8 *uuid_e)
310 {
311 struct wps_pbc_session *pbc, *prev = NULL;
312 struct os_time now;
313
314 os_get_time(&now);
315
316 pbc = reg->pbc_sessions;
317 while (pbc) {
318 if (os_memcmp(pbc->addr, addr, ETH_ALEN) == 0 &&
319 os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0) {
320 if (prev)
321 prev->next = pbc->next;
322 else
323 reg->pbc_sessions = pbc->next;
324 break;
325 }
326 prev = pbc;
327 pbc = pbc->next;
328 }
329
330 if (!pbc) {
331 pbc = (struct wps_pbc_session *)os_zalloc(sizeof(*pbc));
332 if (pbc == NULL)
333 return;
334 os_memcpy(pbc->addr, addr, ETH_ALEN);
335 if (uuid_e)
336 os_memcpy(pbc->uuid_e, uuid_e, WPS_UUID_LEN);
337 }
338
339 pbc->next = reg->pbc_sessions;
340 reg->pbc_sessions = pbc;
341 pbc->timestamp = now;
342
343 /* remove entries that have timed out */
344 prev = pbc;
345 pbc = pbc->next;
346
347 while (pbc) {
348 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
349 prev->next = NULL;
350 wps_free_pbc_sessions(pbc);
351 break;
352 }
353 prev = pbc;
354 pbc = pbc->next;
355 }
356 }
357
358
wps_registrar_remove_pbc_session(struct wps_registrar * reg,const u8 * uuid_e,const u8 * p2p_dev_addr)359 static void wps_registrar_remove_pbc_session(struct wps_registrar *reg,
360 const u8 *uuid_e,
361 const u8 *p2p_dev_addr)
362 {
363 struct wps_pbc_session *pbc, *prev = NULL, *tmp;
364
365 pbc = reg->pbc_sessions;
366 while (pbc) {
367 if (os_memcmp(pbc->uuid_e, uuid_e, WPS_UUID_LEN) == 0 ||
368 (p2p_dev_addr && !is_zero_ether_addr(reg->p2p_dev_addr) &&
369 os_memcmp(reg->p2p_dev_addr, p2p_dev_addr, ETH_ALEN) ==
370 0)) {
371 if (prev)
372 prev->next = pbc->next;
373 else
374 reg->pbc_sessions = pbc->next;
375 tmp = pbc;
376 pbc = pbc->next;
377 wpa_printf(MSG_DEBUG, "WPS: Removing PBC session for "
378 "addr=" MACSTR, MAC2STR(tmp->addr));
379 wpa_hexdump(MSG_DEBUG, "WPS: Removed UUID-E",
380 tmp->uuid_e, WPS_UUID_LEN);
381 os_free(tmp);
382 continue;
383 }
384 prev = pbc;
385 pbc = pbc->next;
386 }
387 }
388
389
wps_registrar_pbc_overlap(struct wps_registrar * reg,const u8 * addr,const u8 * uuid_e)390 int wps_registrar_pbc_overlap(struct wps_registrar *reg,
391 const u8 *addr, const u8 *uuid_e)
392 {
393 int count = 0;
394 struct wps_pbc_session *pbc;
395 struct wps_pbc_session *first = NULL;
396 struct os_time now;
397
398 os_get_time(&now);
399
400 wpa_printf(MSG_DEBUG, "WPS: Checking active PBC sessions for overlap");
401
402 if (uuid_e) {
403 wpa_printf(MSG_DEBUG, "WPS: Add one for the requested UUID");
404 wpa_hexdump(MSG_DEBUG, "WPS: Requested UUID",
405 uuid_e, WPS_UUID_LEN);
406 count++;
407 }
408
409 for (pbc = reg->pbc_sessions; pbc; pbc = pbc->next) {
410 wpa_printf(MSG_DEBUG, "WPS: Consider PBC session with " MACSTR,
411 MAC2STR(pbc->addr));
412 wpa_hexdump(MSG_DEBUG, "WPS: UUID-E",
413 pbc->uuid_e, WPS_UUID_LEN);
414 if (now.sec > pbc->timestamp.sec + WPS_PBC_WALK_TIME) {
415 wpa_printf(MSG_DEBUG, "WPS: PBC walk time has "
416 "expired");
417 break;
418 }
419 if (first &&
420 os_memcmp(pbc->uuid_e, first->uuid_e, WPS_UUID_LEN) == 0) {
421 wpa_printf(MSG_DEBUG, "WPS: Same Enrollee");
422 continue; /* same Enrollee */
423 }
424 if (uuid_e == NULL ||
425 os_memcmp(uuid_e, pbc->uuid_e, WPS_UUID_LEN)) {
426 wpa_printf(MSG_DEBUG, "WPS: New Enrollee");
427 count++;
428 }
429 if (first == NULL)
430 first = pbc;
431 }
432
433 wpa_printf(MSG_DEBUG, "WPS: %u active PBC session(s) found", count);
434
435 return count > 1 ? 1 : 0;
436 }
437
438
wps_build_wps_state(struct wps_context * wps,struct wpabuf * msg)439 static int wps_build_wps_state(struct wps_context *wps, struct wpabuf *msg)
440 {
441 wpa_printf(MSG_DEBUG, "WPS: * Wi-Fi Protected Setup State (%d)",
442 wps->wps_state);
443 wpabuf_put_be16(msg, ATTR_WPS_STATE);
444 wpabuf_put_be16(msg, 1);
445 wpabuf_put_u8(msg, wps->wps_state);
446 return 0;
447 }
448
449
450 #ifdef CONFIG_WPS_UPNP
wps_registrar_free_pending_m2(struct wps_context * wps)451 static void wps_registrar_free_pending_m2(struct wps_context *wps)
452 {
453 struct upnp_pending_message *p, *p2, *prev = NULL;
454 p = wps->upnp_msgs;
455 while (p) {
456 if (p->type == WPS_M2 || p->type == WPS_M2D) {
457 if (prev == NULL)
458 wps->upnp_msgs = p->next;
459 else
460 prev->next = p->next;
461 wpa_printf(MSG_DEBUG, "WPS UPnP: Drop pending M2/M2D");
462 p2 = p;
463 p = p->next;
464 wpabuf_free(p2->msg);
465 os_free(p2);
466 continue;
467 }
468 prev = p;
469 p = p->next;
470 }
471 }
472 #endif /* CONFIG_WPS_UPNP */
473
474
wps_build_ap_setup_locked(struct wps_context * wps,struct wpabuf * msg)475 static int wps_build_ap_setup_locked(struct wps_context *wps,
476 struct wpabuf *msg)
477 {
478 if (wps->ap_setup_locked && wps->ap_setup_locked != 2) {
479 wpa_printf(MSG_DEBUG, "WPS: * AP Setup Locked");
480 wpabuf_put_be16(msg, ATTR_AP_SETUP_LOCKED);
481 wpabuf_put_be16(msg, 1);
482 wpabuf_put_u8(msg, 1);
483 }
484 return 0;
485 }
486
487
wps_build_selected_registrar(struct wps_registrar * reg,struct wpabuf * msg)488 static int wps_build_selected_registrar(struct wps_registrar *reg,
489 struct wpabuf *msg)
490 {
491 if (!reg->sel_reg_union)
492 return 0;
493 wpa_printf(MSG_DEBUG, "WPS: * Selected Registrar");
494 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
495 wpabuf_put_be16(msg, 1);
496 wpabuf_put_u8(msg, 1);
497 return 0;
498 }
499
500
wps_build_sel_reg_dev_password_id(struct wps_registrar * reg,struct wpabuf * msg)501 static int wps_build_sel_reg_dev_password_id(struct wps_registrar *reg,
502 struct wpabuf *msg)
503 {
504 u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
505 if (!reg->sel_reg_union)
506 return 0;
507 if (reg->sel_reg_dev_password_id_override >= 0)
508 id = reg->sel_reg_dev_password_id_override;
509 wpa_printf(MSG_DEBUG, "WPS: * Device Password ID (%d)", id);
510 wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
511 wpabuf_put_be16(msg, 2);
512 wpabuf_put_be16(msg, id);
513 return 0;
514 }
515
516
wps_build_sel_pbc_reg_uuid_e(struct wps_registrar * reg,struct wpabuf * msg)517 static int wps_build_sel_pbc_reg_uuid_e(struct wps_registrar *reg,
518 struct wpabuf *msg)
519 {
520 u16 id = reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT;
521 if (!reg->sel_reg_union)
522 return 0;
523 if (reg->sel_reg_dev_password_id_override >= 0)
524 id = reg->sel_reg_dev_password_id_override;
525 if (id != DEV_PW_PUSHBUTTON || !reg->dualband)
526 return 0;
527 return wps_build_uuid_e(msg, reg->wps->uuid);
528 }
529
530
wps_set_pushbutton(u16 * methods,u16 conf_methods)531 static void wps_set_pushbutton(u16 *methods, u16 conf_methods)
532 {
533 *methods |= WPS_CONFIG_PUSHBUTTON;
534 #ifdef CONFIG_WPS2
535 if ((conf_methods & WPS_CONFIG_VIRT_PUSHBUTTON) ==
536 WPS_CONFIG_VIRT_PUSHBUTTON)
537 *methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
538 if ((conf_methods & WPS_CONFIG_PHY_PUSHBUTTON) ==
539 WPS_CONFIG_PHY_PUSHBUTTON)
540 *methods |= WPS_CONFIG_PHY_PUSHBUTTON;
541 if ((*methods & WPS_CONFIG_VIRT_PUSHBUTTON) !=
542 WPS_CONFIG_VIRT_PUSHBUTTON &&
543 (*methods & WPS_CONFIG_PHY_PUSHBUTTON) !=
544 WPS_CONFIG_PHY_PUSHBUTTON) {
545 /*
546 * Required to include virtual/physical flag, but we were not
547 * configured with push button type, so have to default to one
548 * of them.
549 */
550 *methods |= WPS_CONFIG_PHY_PUSHBUTTON;
551 }
552 #endif /* CONFIG_WPS2 */
553 }
554
555
wps_build_sel_reg_config_methods(struct wps_registrar * reg,struct wpabuf * msg)556 static int wps_build_sel_reg_config_methods(struct wps_registrar *reg,
557 struct wpabuf *msg)
558 {
559 u16 methods;
560 if (!reg->sel_reg_union)
561 return 0;
562 methods = reg->wps->config_methods;
563 methods &= ~WPS_CONFIG_PUSHBUTTON;
564 #ifdef CONFIG_WPS2
565 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
566 WPS_CONFIG_PHY_PUSHBUTTON);
567 #endif /* CONFIG_WPS2 */
568 if (reg->pbc)
569 wps_set_pushbutton(&methods, reg->wps->config_methods);
570 if (reg->sel_reg_config_methods_override >= 0)
571 methods = reg->sel_reg_config_methods_override;
572 wpa_printf(MSG_DEBUG, "WPS: * Selected Registrar Config Methods (%x)",
573 methods);
574 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
575 wpabuf_put_be16(msg, 2);
576 wpabuf_put_be16(msg, methods);
577 return 0;
578 }
579
580
wps_build_probe_config_methods(struct wps_registrar * reg,struct wpabuf * msg)581 static int wps_build_probe_config_methods(struct wps_registrar *reg,
582 struct wpabuf *msg)
583 {
584 u16 methods;
585 /*
586 * These are the methods that the AP supports as an Enrollee for adding
587 * external Registrars.
588 */
589 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
590 #ifdef CONFIG_WPS2
591 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
592 WPS_CONFIG_PHY_PUSHBUTTON);
593 #endif /* CONFIG_WPS2 */
594 wpa_printf(MSG_DEBUG, "WPS: * Config Methods (%x)", methods);
595 wpabuf_put_be16(msg, ATTR_CONFIG_METHODS);
596 wpabuf_put_be16(msg, 2);
597 wpabuf_put_be16(msg, methods);
598 return 0;
599 }
600
601
wps_build_config_methods_r(struct wps_registrar * reg,struct wpabuf * msg)602 static int wps_build_config_methods_r(struct wps_registrar *reg,
603 struct wpabuf *msg)
604 {
605 return wps_build_config_methods(msg, reg->wps->config_methods);
606 }
607
608
wps_authorized_macs(struct wps_registrar * reg,size_t * count)609 const u8 * wps_authorized_macs(struct wps_registrar *reg, size_t *count)
610 {
611 *count = 0;
612
613 #ifdef CONFIG_WPS2
614 while (*count < WPS_MAX_AUTHORIZED_MACS) {
615 if (is_zero_ether_addr(reg->authorized_macs_union[*count]))
616 break;
617 (*count)++;
618 }
619 #endif /* CONFIG_WPS2 */
620
621 return (const u8 *) reg->authorized_macs_union;
622 }
623
624
625 /**
626 * wps_registrar_init - Initialize WPS Registrar data
627 * @wps: Pointer to longterm WPS context
628 * @cfg: Registrar configuration
629 * Returns: Pointer to allocated Registrar data or %NULL on failure
630 *
631 * This function is used to initialize WPS Registrar functionality. It can be
632 * used for a single Registrar run (e.g., when run in a supplicant) or multiple
633 * runs (e.g., when run as an internal Registrar in an AP). Caller is
634 * responsible for freeing the returned data with wps_registrar_deinit() when
635 * Registrar functionality is not needed anymore.
636 */
wps_registrar_init(struct wps_context * wps,const struct wps_registrar_config * cfg)637 struct wps_registrar * wps_registrar_init(struct wps_context *wps,
638 const struct wps_registrar_config *cfg)
639 {
640 struct wps_registrar *reg = (struct wps_registrar *)os_zalloc(sizeof(*reg));
641 if (reg == NULL)
642 return NULL;
643 #ifdef CONFIG_WPS_PIN
644 dl_list_init(®->pins);
645 #endif
646 #ifdef CONFIG_WPS_NFC
647 dl_list_init(®->nfc_pw_tokens);
648 #endif
649 reg->wps = wps;
650 reg->new_psk_cb = cfg->new_psk_cb;
651 reg->set_ie_cb = cfg->set_ie_cb;
652 #ifdef CONFIG_WPS_PIN
653 reg->pin_needed_cb = cfg->pin_needed_cb;
654 #endif
655 reg->reg_success_cb = cfg->reg_success_cb;
656 reg->set_sel_reg_cb = cfg->set_sel_reg_cb;
657 reg->enrollee_seen_cb = cfg->enrollee_seen_cb;
658 reg->cb_ctx = cfg->cb_ctx;
659 reg->skip_cred_build = cfg->skip_cred_build;
660 if (cfg->extra_cred) {
661 reg->extra_cred = wpabuf_alloc_copy(cfg->extra_cred,
662 cfg->extra_cred_len);
663 if (reg->extra_cred == NULL) {
664 os_free(reg);
665 return NULL;
666 }
667 }
668 reg->disable_auto_conf = cfg->disable_auto_conf;
669 reg->sel_reg_dev_password_id_override = -1;
670 reg->sel_reg_config_methods_override = -1;
671 reg->static_wep_only = cfg->static_wep_only;
672 reg->dualband = cfg->dualband;
673
674 if (wps_set_ie(reg)) {
675 wps_registrar_deinit(reg);
676 return NULL;
677 }
678
679 return reg;
680 }
681
682
683 /**
684 * wps_registrar_deinit - Deinitialize WPS Registrar data
685 * @reg: Registrar data from wps_registrar_init()
686 */
wps_registrar_deinit(struct wps_registrar * reg)687 void wps_registrar_deinit(struct wps_registrar *reg)
688 {
689 if (reg == NULL)
690 return;
691
692 #ifdef CONFIG_WPS_PIN
693 wps_free_pins(®->pins);
694 #endif
695 #ifdef CONFIG_WPS_NFC
696 wps_free_nfc_pw_tokens(®->nfc_pw_tokens, 0);
697 #endif
698 wps_free_pbc_sessions(reg->pbc_sessions);
699 wpabuf_free(reg->extra_cred);
700 wps_free_devices(reg->devices);
701 os_free(reg);
702 }
703
704 #ifdef CONFIG_WPS_PIN
705
wps_registrar_invalidate_unused(struct wps_registrar * reg)706 static void wps_registrar_invalidate_unused(struct wps_registrar *reg)
707 {
708 struct wps_uuid_pin *pin;
709
710 dl_list_for_each(pin, ®->pins, struct wps_uuid_pin, list) {
711 if (pin->wildcard_uuid == 1 && !(pin->flags & PIN_LOCKED)) {
712 wpa_printf(MSG_DEBUG, "WPS: Invalidate previously "
713 "configured wildcard PIN");
714 wps_registrar_remove_pin(reg, pin);
715 break;
716 }
717 }
718 }
719
720
721 /**
722 * wps_registrar_add_pin - Configure a new PIN for Registrar
723 * @reg: Registrar data from wps_registrar_init()
724 * @addr: Enrollee MAC address or %NULL if not known
725 * @uuid: UUID-E or %NULL for wildcard (any UUID)
726 * @pin: PIN (Device Password)
727 * @pin_len: Length of pin in octets
728 * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
729 * Returns: 0 on success, -1 on failure
730 */
wps_registrar_add_pin(struct wps_registrar * reg,const u8 * addr,const u8 * uuid,const u8 * pin,size_t pin_len,int timeout)731 int wps_registrar_add_pin(struct wps_registrar *reg, const u8 *addr,
732 const u8 *uuid, const u8 *pin, size_t pin_len,
733 int timeout)
734 {
735 struct wps_uuid_pin *p;
736
737 p = (struct wps_uuid_pin *)os_zalloc(sizeof(*p));
738 if (p == NULL)
739 return -1;
740 if (addr)
741 os_memcpy(p->enrollee_addr, addr, ETH_ALEN);
742 if (uuid == NULL)
743 p->wildcard_uuid = 1;
744 else
745 os_memcpy(p->uuid, uuid, WPS_UUID_LEN);
746 p->pin = (u8 *)os_malloc(pin_len);
747 if (p->pin == NULL) {
748 os_free(p);
749 return -1;
750 }
751 os_memcpy(p->pin, pin, pin_len);
752 p->pin_len = pin_len;
753
754 if (timeout) {
755 p->flags |= PIN_EXPIRES;
756 os_get_time(&p->expiration);
757 p->expiration.sec += timeout;
758 }
759
760 if (p->wildcard_uuid)
761 wps_registrar_invalidate_unused(reg);
762
763 dl_list_add(®->pins, &p->list);
764
765 wpa_printf(MSG_DEBUG, "WPS: A new PIN configured (timeout=%d)",
766 timeout);
767 wpa_hexdump(MSG_DEBUG, "WPS: UUID", uuid, WPS_UUID_LEN);
768 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: PIN", pin, pin_len);
769 reg->selected_registrar = 1;
770 reg->pbc = 0;
771 if (addr)
772 wps_registrar_add_authorized_mac(reg, addr);
773 else
774 wps_registrar_add_authorized_mac(
775 reg, (u8 *) "\xff\xff\xff\xff\xff\xff");
776 wps_registrar_selected_registrar_changed(reg);
777
778 return 0;
779 }
780
781
wps_registrar_remove_pin(struct wps_registrar * reg,struct wps_uuid_pin * pin)782 static void wps_registrar_remove_pin(struct wps_registrar *reg,
783 struct wps_uuid_pin *pin)
784 {
785 u8 *addr;
786 u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
787
788 if (is_zero_ether_addr(pin->enrollee_addr))
789 addr = bcast;
790 else
791 addr = pin->enrollee_addr;
792 wps_registrar_remove_authorized_mac(reg, addr);
793 wps_remove_pin(pin);
794 wps_registrar_selected_registrar_changed(reg);
795 }
796
797
wps_registrar_expire_pins(struct wps_registrar * reg)798 static void wps_registrar_expire_pins(struct wps_registrar *reg)
799 {
800 struct wps_uuid_pin *pin, *prev;
801 struct os_time now;
802
803 os_get_time(&now);
804 dl_list_for_each_safe(pin, prev, ®->pins, struct wps_uuid_pin, list)
805 {
806 if ((pin->flags & PIN_EXPIRES) &&
807 os_time_before(&pin->expiration, &now)) {
808 wpa_hexdump(MSG_DEBUG, "WPS: Expired PIN for UUID",
809 pin->uuid, WPS_UUID_LEN);
810 wps_registrar_remove_pin(reg, pin);
811 }
812 }
813 }
814
815
816 /**
817 * wps_registrar_invalidate_wildcard_pin - Invalidate a wildcard PIN
818 * @reg: Registrar data from wps_registrar_init()
819 * @dev_pw: PIN to search for or %NULL to match any
820 * @dev_pw_len: Length of dev_pw in octets
821 * Returns: 0 on success, -1 if not wildcard PIN is enabled
822 */
wps_registrar_invalidate_wildcard_pin(struct wps_registrar * reg,const u8 * dev_pw,size_t dev_pw_len)823 static int wps_registrar_invalidate_wildcard_pin(struct wps_registrar *reg,
824 const u8 *dev_pw,
825 size_t dev_pw_len)
826 {
827 struct wps_uuid_pin *pin, *prev;
828
829 dl_list_for_each_safe(pin, prev, ®->pins, struct wps_uuid_pin, list)
830 {
831 if (dev_pw && pin->pin &&
832 (dev_pw_len != pin->pin_len ||
833 os_memcmp(dev_pw, pin->pin, dev_pw_len) != 0))
834 continue; /* different PIN */
835 if (pin->wildcard_uuid) {
836 wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
837 pin->uuid, WPS_UUID_LEN);
838 wps_registrar_remove_pin(reg, pin);
839 return 0;
840 }
841 }
842
843 return -1;
844 }
845
846
847 /**
848 * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
849 * @reg: Registrar data from wps_registrar_init()
850 * @uuid: UUID-E
851 * Returns: 0 on success, -1 on failure (e.g., PIN not found)
852 */
wps_registrar_invalidate_pin(struct wps_registrar * reg,const u8 * uuid)853 int wps_registrar_invalidate_pin(struct wps_registrar *reg, const u8 *uuid)
854 {
855 struct wps_uuid_pin *pin, *prev;
856
857 dl_list_for_each_safe(pin, prev, ®->pins, struct wps_uuid_pin, list)
858 {
859 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
860 wpa_hexdump(MSG_DEBUG, "WPS: Invalidated PIN for UUID",
861 pin->uuid, WPS_UUID_LEN);
862 wps_registrar_remove_pin(reg, pin);
863 return 0;
864 }
865 }
866
867 return -1;
868 }
869
870
wps_registrar_get_pin(struct wps_registrar * reg,const u8 * uuid,size_t * pin_len)871 static const u8 * wps_registrar_get_pin(struct wps_registrar *reg,
872 const u8 *uuid, size_t *pin_len)
873 {
874 struct wps_uuid_pin *pin, *found = NULL;
875
876 wps_registrar_expire_pins(reg);
877
878 dl_list_for_each(pin, ®->pins, struct wps_uuid_pin, list) {
879 if (!pin->wildcard_uuid &&
880 os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
881 found = pin;
882 break;
883 }
884 }
885
886 if (!found) {
887 /* Check for wildcard UUIDs since none of the UUID-specific
888 * PINs matched */
889 dl_list_for_each(pin, ®->pins, struct wps_uuid_pin, list) {
890 if (pin->wildcard_uuid == 1 ||
891 pin->wildcard_uuid == 2) {
892 wpa_printf(MSG_DEBUG, "WPS: Found a wildcard "
893 "PIN. Assigned it for this UUID-E");
894 pin->wildcard_uuid++;
895 os_memcpy(pin->uuid, uuid, WPS_UUID_LEN);
896 found = pin;
897 break;
898 }
899 }
900 }
901
902 if (!found)
903 return NULL;
904
905 /*
906 * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
907 * that could otherwise avoid PIN invalidations.
908 */
909 if (found->flags & PIN_LOCKED) {
910 wpa_printf(MSG_DEBUG, "WPS: Selected PIN locked - do not "
911 "allow concurrent re-use");
912 return NULL;
913 }
914 *pin_len = found->pin_len;
915 found->flags |= PIN_LOCKED;
916 return found->pin;
917 }
918
919
920 /**
921 * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
922 * @reg: Registrar data from wps_registrar_init()
923 * @uuid: UUID-E
924 * Returns: 0 on success, -1 on failure
925 *
926 * PINs are locked to enforce only one concurrent use. This function unlocks a
927 * PIN to allow it to be used again. If the specified PIN was configured using
928 * a wildcard UUID, it will be removed instead of allowing multiple uses.
929 */
wps_registrar_unlock_pin(struct wps_registrar * reg,const u8 * uuid)930 int wps_registrar_unlock_pin(struct wps_registrar *reg, const u8 *uuid)
931 {
932 struct wps_uuid_pin *pin;
933
934 dl_list_for_each(pin, ®->pins, struct wps_uuid_pin, list) {
935 if (os_memcmp(pin->uuid, uuid, WPS_UUID_LEN) == 0) {
936 if (pin->wildcard_uuid == 3) {
937 wpa_printf(MSG_DEBUG, "WPS: Invalidating used "
938 "wildcard PIN");
939 return wps_registrar_invalidate_pin(reg, uuid);
940 }
941 pin->flags &= ~PIN_LOCKED;
942 return 0;
943 }
944 }
945
946 return -1;
947 }
948 #endif
949
wps_registrar_stop_pbc(struct wps_registrar * reg)950 static void wps_registrar_stop_pbc(struct wps_registrar *reg)
951 {
952 reg->selected_registrar = 0;
953 reg->pbc = 0;
954 os_memset(reg->p2p_dev_addr, 0, ETH_ALEN);
955 wps_registrar_remove_authorized_mac(reg,
956 (u8 *) "\xff\xff\xff\xff\xff\xff");
957 wps_registrar_selected_registrar_changed(reg);
958 }
959
960
wps_registrar_pbc_timeout(void * eloop_ctx)961 static void wps_registrar_pbc_timeout(void *eloop_ctx)
962 {
963 struct wps_registrar *reg = eloop_ctx;
964
965 wpa_printf(MSG_DEBUG, "WPS: PBC timed out - disable PBC mode");
966 wps_pbc_timeout_event(reg->wps);
967 wps_registrar_stop_pbc(reg);
968 }
969
970
971 /**
972 * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
973 * @reg: Registrar data from wps_registrar_init()
974 * @p2p_dev_addr: Limit allowed PBC devices to the specified P2P device, %NULL
975 * indicates no such filtering
976 * Returns: 0 on success, -1 on failure, -2 on session overlap
977 *
978 * This function is called on an AP when a push button is pushed to activate
979 * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
980 * or when a PBC registration is completed. If more than one Enrollee in active
981 * PBC mode has been detected during the monitor time (previous 2 minutes), the
982 * PBC mode is not activated and -2 is returned to indicate session overlap.
983 * This is skipped if a specific Enrollee is selected.
984 */
wps_registrar_button_pushed(struct wps_registrar * reg,const u8 * p2p_dev_addr)985 int wps_registrar_button_pushed(struct wps_registrar *reg,
986 const u8 *p2p_dev_addr)
987 {
988 if (p2p_dev_addr == NULL &&
989 wps_registrar_pbc_overlap(reg, NULL, NULL)) {
990 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - do not start PBC "
991 "mode");
992 wps_pbc_overlap_event(reg->wps);
993 return -2;
994 }
995 wpa_printf(MSG_DEBUG, "WPS: Button pushed - PBC mode started");
996 reg->force_pbc_overlap = 0;
997 reg->selected_registrar = 1;
998 reg->pbc = 1;
999 if (p2p_dev_addr)
1000 os_memcpy(reg->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
1001 else
1002 os_memset(reg->p2p_dev_addr, 0, ETH_ALEN);
1003 wps_registrar_add_authorized_mac(reg,
1004 (u8 *) "\xff\xff\xff\xff\xff\xff");
1005 wps_registrar_selected_registrar_changed(reg);
1006
1007 return 0;
1008 }
1009
1010
wps_registrar_pbc_completed(struct wps_registrar * reg)1011 static void wps_registrar_pbc_completed(struct wps_registrar *reg)
1012 {
1013 wpa_printf(MSG_DEBUG, "WPS: PBC completed - stopping PBC mode");
1014
1015 wps_registrar_stop_pbc(reg);
1016 }
1017
1018 #ifdef CONFIG_WPS_PIN
1019
wps_registrar_pin_completed(struct wps_registrar * reg)1020 static void wps_registrar_pin_completed(struct wps_registrar *reg)
1021 {
1022 wpa_printf(MSG_DEBUG, "WPS: PIN completed using internal Registrar");
1023 reg->selected_registrar = 0;
1024 wps_registrar_selected_registrar_changed(reg);
1025 }
1026 #endif
1027
wps_registrar_complete(struct wps_registrar * registrar,const u8 * uuid_e,const u8 * dev_pw,size_t dev_pw_len)1028 void wps_registrar_complete(struct wps_registrar *registrar, const u8 *uuid_e,
1029 const u8 *dev_pw, size_t dev_pw_len)
1030 {
1031 if (registrar->pbc) {
1032 wps_registrar_remove_pbc_session(registrar,
1033 uuid_e, NULL);
1034 wps_registrar_pbc_completed(registrar);
1035 os_get_time(®istrar->pbc_ignore_start);
1036 os_memcpy(registrar->pbc_ignore_uuid, uuid_e, WPS_UUID_LEN);
1037 } else {
1038 #ifdef CONFIG_WPS_PIN
1039 wps_registrar_pin_completed(registrar);
1040 #endif
1041 }
1042 #ifdef CONFIG_WPS_PIN
1043 if (dev_pw &&
1044 wps_registrar_invalidate_wildcard_pin(registrar, dev_pw,
1045 dev_pw_len) == 0) {
1046 wpa_hexdump_key(MSG_DEBUG, "WPS: Invalidated wildcard PIN",
1047 dev_pw, dev_pw_len);
1048 }
1049 #endif
1050 }
1051
1052
wps_registrar_wps_cancel(struct wps_registrar * reg)1053 int wps_registrar_wps_cancel(struct wps_registrar *reg)
1054 {
1055 if (reg->pbc) {
1056 wpa_printf(MSG_DEBUG, "WPS: PBC is set - cancelling it");
1057 wps_registrar_pbc_timeout(reg);
1058
1059 return 1;
1060 } else if (reg->selected_registrar) {
1061 #ifdef CONFIG_WPS_PIN
1062
1063 /* PIN Method */
1064 wpa_printf(MSG_DEBUG, "WPS: PIN is set - cancelling it");
1065 wps_registrar_pin_completed(reg);
1066 wps_registrar_invalidate_wildcard_pin(reg, NULL, 0);
1067 return 1;
1068 #endif
1069 }
1070 return 0;
1071 }
1072
1073
1074 /**
1075 * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
1076 * @reg: Registrar data from wps_registrar_init()
1077 * @addr: MAC address of the Probe Request sender
1078 * @wps_data: WPS IE contents
1079 *
1080 * This function is called on an AP when a Probe Request with WPS IE is
1081 * received. This is used to track PBC mode use and to detect possible overlap
1082 * situation with other WPS APs.
1083 */
wps_registrar_probe_req_rx(struct wps_registrar * reg,const u8 * addr,const struct wpabuf * wps_data,int p2p_wildcard)1084 void wps_registrar_probe_req_rx(struct wps_registrar *reg, const u8 *addr,
1085 const struct wpabuf *wps_data,
1086 int p2p_wildcard)
1087 {
1088 struct wps_parse_attr attr;
1089 int skip_add = 0;
1090
1091 wpa_hexdump_buf(MSG_MSGDUMP,
1092 "WPS: Probe Request with WPS data received",
1093 wps_data);
1094
1095 if (wps_parse_msg(wps_data, &attr) < 0)
1096 return;
1097
1098 if (attr.config_methods == NULL) {
1099 wpa_printf(MSG_DEBUG, "WPS: No Config Methods attribute in "
1100 "Probe Request");
1101 return;
1102 }
1103
1104 if (attr.dev_password_id == NULL) {
1105 wpa_printf(MSG_DEBUG, "WPS: No Device Password Id attribute "
1106 "in Probe Request");
1107 return;
1108 }
1109
1110 if (reg->enrollee_seen_cb && attr.uuid_e &&
1111 attr.primary_dev_type && attr.request_type && !p2p_wildcard) {
1112 char *dev_name = NULL;
1113 if (attr.dev_name) {
1114 dev_name = (char *)os_zalloc(attr.dev_name_len + 1);
1115 if (dev_name) {
1116 os_memcpy(dev_name, attr.dev_name,
1117 attr.dev_name_len);
1118 }
1119 }
1120 reg->enrollee_seen_cb(reg->cb_ctx, addr, attr.uuid_e,
1121 attr.primary_dev_type,
1122 WPA_GET_BE16(attr.config_methods),
1123 WPA_GET_BE16(attr.dev_password_id),
1124 *attr.request_type, dev_name);
1125 os_free(dev_name);
1126 }
1127
1128 if (WPA_GET_BE16(attr.dev_password_id) != DEV_PW_PUSHBUTTON)
1129 return; /* Not PBC */
1130
1131 wpa_printf(MSG_DEBUG, "WPS: Probe Request for PBC received from "
1132 MACSTR, MAC2STR(addr));
1133 if (attr.uuid_e == NULL) {
1134 wpa_printf(MSG_DEBUG, "WPS: Invalid Probe Request WPS IE: No "
1135 "UUID-E included");
1136 return;
1137 }
1138 wpa_hexdump(MSG_DEBUG, "WPS: UUID-E from Probe Request", attr.uuid_e,
1139 WPS_UUID_LEN);
1140
1141 #ifdef WPS_WORKAROUNDS
1142 if (reg->pbc_ignore_start.sec &&
1143 os_memcmp(attr.uuid_e, reg->pbc_ignore_uuid, WPS_UUID_LEN) == 0) {
1144 struct os_time now, dur;
1145 os_get_time(&now);
1146 os_time_sub(&now, ®->pbc_ignore_start, &dur);
1147 if (dur.sec >= 0 && dur.sec < 5) {
1148 wpa_printf(MSG_DEBUG, "WPS: Ignore PBC activation "
1149 "based on Probe Request from the Enrollee "
1150 "that just completed PBC provisioning");
1151 skip_add = 1;
1152 } else
1153 reg->pbc_ignore_start.sec = 0;
1154 }
1155 #endif /* WPS_WORKAROUNDS */
1156
1157 if (!skip_add)
1158 wps_registrar_add_pbc_session(reg, addr, attr.uuid_e);
1159 if (wps_registrar_pbc_overlap(reg, addr, attr.uuid_e)) {
1160 wpa_printf(MSG_DEBUG, "WPS: PBC session overlap detected");
1161 reg->force_pbc_overlap = 1;
1162 wps_pbc_overlap_event(reg->wps);
1163 }
1164 }
1165
1166
wps_cb_new_psk(struct wps_registrar * reg,const u8 * mac_addr,const u8 * psk,size_t psk_len)1167 static int wps_cb_new_psk(struct wps_registrar *reg, const u8 *mac_addr,
1168 const u8 *psk, size_t psk_len)
1169 {
1170 if (reg->new_psk_cb == NULL)
1171 return 0;
1172
1173 return reg->new_psk_cb(reg->cb_ctx, mac_addr, psk, psk_len);
1174 }
1175
1176 #ifdef CONFIG_WPS_PIN
1177
wps_cb_pin_needed(struct wps_registrar * reg,const u8 * uuid_e,const struct wps_device_data * dev)1178 static void wps_cb_pin_needed(struct wps_registrar *reg, const u8 *uuid_e,
1179 const struct wps_device_data *dev)
1180 {
1181 if (reg->pin_needed_cb == NULL)
1182 return;
1183
1184 reg->pin_needed_cb(reg->cb_ctx, uuid_e, dev);
1185 }
1186 #endif
1187
wps_cb_reg_success(struct wps_registrar * reg,const u8 * mac_addr,const u8 * uuid_e,const u8 * dev_pw,size_t dev_pw_len)1188 static void wps_cb_reg_success(struct wps_registrar *reg, const u8 *mac_addr,
1189 const u8 *uuid_e, const u8 *dev_pw,
1190 size_t dev_pw_len)
1191 {
1192 if (reg->reg_success_cb == NULL)
1193 return;
1194
1195 reg->reg_success_cb(reg->cb_ctx, mac_addr, uuid_e, dev_pw, dev_pw_len);
1196 }
1197
1198
wps_cb_set_ie(struct wps_registrar * reg,struct wpabuf * beacon_ie,struct wpabuf * probe_resp_ie)1199 static int wps_cb_set_ie(struct wps_registrar *reg, struct wpabuf *beacon_ie,
1200 struct wpabuf *probe_resp_ie)
1201 {
1202 return reg->set_ie_cb(reg->cb_ctx, beacon_ie, probe_resp_ie);
1203 }
1204
1205
wps_cb_set_sel_reg(struct wps_registrar * reg)1206 static void wps_cb_set_sel_reg(struct wps_registrar *reg)
1207 {
1208 u16 methods = 0;
1209 if (reg->set_sel_reg_cb == NULL)
1210 return;
1211
1212 if (reg->selected_registrar) {
1213 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
1214 #ifdef CONFIG_WPS2
1215 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
1216 WPS_CONFIG_PHY_PUSHBUTTON);
1217 #endif /* CONFIG_WPS2 */
1218 if (reg->pbc)
1219 wps_set_pushbutton(&methods, reg->wps->config_methods);
1220 }
1221
1222 wpa_printf(MSG_DEBUG, "WPS: wps_cb_set_sel_reg: sel_reg=%d "
1223 "config_methods=0x%x pbc=%d methods=0x%x",
1224 reg->selected_registrar, reg->wps->config_methods,
1225 reg->pbc, methods);
1226
1227 reg->set_sel_reg_cb(reg->cb_ctx, reg->selected_registrar,
1228 reg->pbc ? DEV_PW_PUSHBUTTON : DEV_PW_DEFAULT,
1229 methods);
1230 }
1231
1232
wps_set_ie(struct wps_registrar * reg)1233 static int wps_set_ie(struct wps_registrar *reg)
1234 {
1235 struct wpabuf *beacon;
1236 struct wpabuf *probe;
1237 const u8 *auth_macs;
1238 size_t count;
1239 size_t vendor_len = 0;
1240 int i;
1241
1242 if (reg->set_ie_cb == NULL)
1243 return 0;
1244
1245 for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) {
1246 if (reg->wps->dev.vendor_ext[i]) {
1247 vendor_len += 2 + 2;
1248 vendor_len += wpabuf_len(reg->wps->dev.vendor_ext[i]);
1249 }
1250 }
1251
1252 beacon = wpabuf_alloc(400 + vendor_len);
1253 if (beacon == NULL)
1254 return -1;
1255 probe = wpabuf_alloc(500 + vendor_len);
1256 if (probe == NULL) {
1257 wpabuf_free(beacon);
1258 return -1;
1259 }
1260
1261 auth_macs = wps_authorized_macs(reg, &count);
1262
1263 wpa_printf(MSG_DEBUG, "WPS: Build Beacon IEs");
1264
1265 if (wps_build_version(beacon) ||
1266 wps_build_wps_state(reg->wps, beacon) ||
1267 wps_build_ap_setup_locked(reg->wps, beacon) ||
1268 wps_build_selected_registrar(reg, beacon) ||
1269 wps_build_sel_reg_dev_password_id(reg, beacon) ||
1270 wps_build_sel_reg_config_methods(reg, beacon) ||
1271 wps_build_sel_pbc_reg_uuid_e(reg, beacon) ||
1272 (reg->dualband && wps_build_rf_bands(®->wps->dev, beacon)) ||
1273 wps_build_wfa_ext(beacon, 0, auth_macs, count) ||
1274 wps_build_vendor_ext(®->wps->dev, beacon)) {
1275 wpabuf_free(beacon);
1276 wpabuf_free(probe);
1277 return -1;
1278 }
1279
1280 #ifdef CONFIG_P2P
1281 if (wps_build_dev_name(®->wps->dev, beacon) ||
1282 wps_build_primary_dev_type(®->wps->dev, beacon)) {
1283 wpabuf_free(beacon);
1284 wpabuf_free(probe);
1285 return -1;
1286 }
1287 #endif /* CONFIG_P2P */
1288
1289 wpa_printf(MSG_DEBUG, "WPS: Build Probe Response IEs");
1290
1291 if (wps_build_version(probe) ||
1292 wps_build_wps_state(reg->wps, probe) ||
1293 wps_build_ap_setup_locked(reg->wps, probe) ||
1294 wps_build_selected_registrar(reg, probe) ||
1295 wps_build_sel_reg_dev_password_id(reg, probe) ||
1296 wps_build_sel_reg_config_methods(reg, probe) ||
1297 wps_build_resp_type(probe, reg->wps->ap ? WPS_RESP_AP :
1298 WPS_RESP_REGISTRAR) ||
1299 wps_build_uuid_e(probe, reg->wps->uuid) ||
1300 wps_build_device_attrs(®->wps->dev, probe) ||
1301 wps_build_probe_config_methods(reg, probe) ||
1302 (reg->dualband && wps_build_rf_bands(®->wps->dev, probe)) ||
1303 wps_build_wfa_ext(probe, 0, auth_macs, count) ||
1304 wps_build_vendor_ext(®->wps->dev, probe)) {
1305 wpabuf_free(beacon);
1306 wpabuf_free(probe);
1307 return -1;
1308 }
1309
1310 beacon = wps_ie_encapsulate(beacon);
1311 probe = wps_ie_encapsulate(probe);
1312
1313 if (!beacon || !probe) {
1314 wpabuf_free(beacon);
1315 wpabuf_free(probe);
1316 return -1;
1317 }
1318
1319 if (reg->static_wep_only) {
1320 /*
1321 * Windows XP and Vista clients can get confused about
1322 * EAP-Identity/Request when they probe the network with
1323 * EAPOL-Start. In such a case, they may assume the network is
1324 * using IEEE 802.1X and prompt user for a certificate while
1325 * the correct (non-WPS) behavior would be to ask for the
1326 * static WEP key. As a workaround, use Microsoft Provisioning
1327 * IE to advertise that legacy 802.1X is not supported.
1328 */
1329 const u8 ms_wps[7] = {
1330 WLAN_EID_VENDOR_SPECIFIC, 5,
1331 /* Microsoft Provisioning IE (00:50:f2:5) */
1332 0x00, 0x50, 0xf2, 5,
1333 0x00 /* no legacy 802.1X or MS WPS */
1334 };
1335 wpa_printf(MSG_DEBUG, "WPS: Add Microsoft Provisioning IE "
1336 "into Beacon/Probe Response frames");
1337 wpabuf_put_data(beacon, ms_wps, sizeof(ms_wps));
1338 wpabuf_put_data(probe, ms_wps, sizeof(ms_wps));
1339 }
1340
1341 return wps_cb_set_ie(reg, beacon, probe);
1342 }
1343
1344
wps_get_dev_password(struct wps_data * wps)1345 static int wps_get_dev_password(struct wps_data *wps)
1346 {
1347 const u8 *pin;
1348 size_t pin_len = 0;
1349
1350 os_free(wps->dev_password);
1351 wps->dev_password = NULL;
1352
1353 if (wps->pbc) {
1354 wpa_printf(MSG_DEBUG, "WPS: Use default PIN for PBC");
1355 pin = (const u8 *) "00000000";
1356 pin_len = 8;
1357 #ifdef CONFIG_WPS_NFC
1358 } else if (wps->nfc_pw_token) {
1359 wpa_printf(MSG_DEBUG, "WPS: Use OOB Device Password from NFC "
1360 "Password Token");
1361 pin = wps->nfc_pw_token->dev_pw;
1362 pin_len = wps->nfc_pw_token->dev_pw_len;
1363 #endif /* CONFIG_WPS_NFC */
1364 } else {
1365 #ifdef CONFIG_WPS_PIN
1366
1367 pin = wps_registrar_get_pin(wps->wps->registrar, wps->uuid_e,
1368 &pin_len);
1369 }
1370 if (pin == NULL) {
1371 wpa_printf(MSG_DEBUG, "WPS: No Device Password available for "
1372 "the Enrollee");
1373 wps_cb_pin_needed(wps->wps->registrar, wps->uuid_e,
1374 &wps->peer_dev);
1375 return -1;
1376 #endif
1377 }
1378
1379 wps->dev_password = (u8 *)os_malloc(pin_len);
1380 if (wps->dev_password == NULL)
1381 return -1;
1382 os_memcpy(wps->dev_password, pin, pin_len);
1383 wps->dev_password_len = pin_len;
1384
1385 return 0;
1386 }
1387
1388
wps_build_uuid_r(struct wps_data * wps,struct wpabuf * msg)1389 static int wps_build_uuid_r(struct wps_data *wps, struct wpabuf *msg)
1390 {
1391 wpa_printf(MSG_DEBUG, "WPS: * UUID-R");
1392 wpabuf_put_be16(msg, ATTR_UUID_R);
1393 wpabuf_put_be16(msg, WPS_UUID_LEN);
1394 wpabuf_put_data(msg, wps->uuid_r, WPS_UUID_LEN);
1395 return 0;
1396 }
1397
1398
wps_build_r_hash(struct wps_data * wps,struct wpabuf * msg)1399 static int wps_build_r_hash(struct wps_data *wps, struct wpabuf *msg)
1400 {
1401 u8 *hash;
1402 const u8 *addr[4];
1403 size_t len[4];
1404
1405 if (random_get_bytes(wps->snonce, 2 * WPS_SECRET_NONCE_LEN) < 0)
1406 return -1;
1407 wpa_hexdump(MSG_DEBUG, "WPS: R-S1", wps->snonce, WPS_SECRET_NONCE_LEN);
1408 wpa_hexdump(MSG_DEBUG, "WPS: R-S2",
1409 wps->snonce + WPS_SECRET_NONCE_LEN, WPS_SECRET_NONCE_LEN);
1410
1411 if (wps->dh_pubkey_e == NULL || wps->dh_pubkey_r == NULL) {
1412 wpa_printf(MSG_DEBUG, "WPS: DH public keys not available for "
1413 "R-Hash derivation");
1414 return -1;
1415 }
1416
1417 wpa_printf(MSG_DEBUG, "WPS: * R-Hash1");
1418 wpabuf_put_be16(msg, ATTR_R_HASH1);
1419 wpabuf_put_be16(msg, SHA256_MAC_LEN);
1420 hash = wpabuf_put(msg, SHA256_MAC_LEN);
1421 /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
1422 addr[0] = wps->snonce;
1423 len[0] = WPS_SECRET_NONCE_LEN;
1424 addr[1] = wps->psk1;
1425 len[1] = WPS_PSK_LEN;
1426 addr[2] = wpabuf_head(wps->dh_pubkey_e);
1427 len[2] = wpabuf_len(wps->dh_pubkey_e);
1428 addr[3] = wpabuf_head(wps->dh_pubkey_r);
1429 len[3] = wpabuf_len(wps->dh_pubkey_r);
1430 hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1431 wpa_hexdump(MSG_DEBUG, "WPS: R-Hash1", hash, SHA256_MAC_LEN);
1432
1433 wpa_printf(MSG_DEBUG, "WPS: * R-Hash2");
1434 wpabuf_put_be16(msg, ATTR_R_HASH2);
1435 wpabuf_put_be16(msg, SHA256_MAC_LEN);
1436 hash = wpabuf_put(msg, SHA256_MAC_LEN);
1437 /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
1438 addr[0] = wps->snonce + WPS_SECRET_NONCE_LEN;
1439 addr[1] = wps->psk2;
1440 hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
1441 wpa_hexdump(MSG_DEBUG, "WPS: R-Hash2", hash, SHA256_MAC_LEN);
1442
1443 return 0;
1444 }
1445
1446
wps_build_r_snonce1(struct wps_data * wps,struct wpabuf * msg)1447 static int wps_build_r_snonce1(struct wps_data *wps, struct wpabuf *msg)
1448 {
1449 wpa_printf(MSG_DEBUG, "WPS: * R-SNonce1");
1450 wpabuf_put_be16(msg, ATTR_R_SNONCE1);
1451 wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1452 wpabuf_put_data(msg, wps->snonce, WPS_SECRET_NONCE_LEN);
1453 return 0;
1454 }
1455
1456
wps_build_r_snonce2(struct wps_data * wps,struct wpabuf * msg)1457 static int wps_build_r_snonce2(struct wps_data *wps, struct wpabuf *msg)
1458 {
1459 wpa_printf(MSG_DEBUG, "WPS: * R-SNonce2");
1460 wpabuf_put_be16(msg, ATTR_R_SNONCE2);
1461 wpabuf_put_be16(msg, WPS_SECRET_NONCE_LEN);
1462 wpabuf_put_data(msg, wps->snonce + WPS_SECRET_NONCE_LEN,
1463 WPS_SECRET_NONCE_LEN);
1464 return 0;
1465 }
1466
1467
wps_build_cred_network_idx(struct wpabuf * msg,const struct wps_credential * cred)1468 static int wps_build_cred_network_idx(struct wpabuf *msg,
1469 const struct wps_credential *cred)
1470 {
1471 wpa_printf(MSG_DEBUG, "WPS: * Network Index (1)");
1472 wpabuf_put_be16(msg, ATTR_NETWORK_INDEX);
1473 wpabuf_put_be16(msg, 1);
1474 wpabuf_put_u8(msg, 1);
1475 return 0;
1476 }
1477
1478
wps_build_cred_ssid(struct wpabuf * msg,const struct wps_credential * cred)1479 static int wps_build_cred_ssid(struct wpabuf *msg,
1480 const struct wps_credential *cred)
1481 {
1482 wpa_printf(MSG_DEBUG, "WPS: * SSID");
1483 wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID for Credential",
1484 cred->ssid, cred->ssid_len);
1485 wpabuf_put_be16(msg, ATTR_SSID);
1486 wpabuf_put_be16(msg, cred->ssid_len);
1487 wpabuf_put_data(msg, cred->ssid, cred->ssid_len);
1488 return 0;
1489 }
1490
1491
wps_build_cred_auth_type(struct wpabuf * msg,const struct wps_credential * cred)1492 static int wps_build_cred_auth_type(struct wpabuf *msg,
1493 const struct wps_credential *cred)
1494 {
1495 wpa_printf(MSG_DEBUG, "WPS: * Authentication Type (0x%x)",
1496 cred->auth_type);
1497 wpabuf_put_be16(msg, ATTR_AUTH_TYPE);
1498 wpabuf_put_be16(msg, 2);
1499 wpabuf_put_be16(msg, cred->auth_type);
1500 return 0;
1501 }
1502
1503
wps_build_cred_encr_type(struct wpabuf * msg,const struct wps_credential * cred)1504 static int wps_build_cred_encr_type(struct wpabuf *msg,
1505 const struct wps_credential *cred)
1506 {
1507 wpa_printf(MSG_DEBUG, "WPS: * Encryption Type (0x%x)",
1508 cred->encr_type);
1509 wpabuf_put_be16(msg, ATTR_ENCR_TYPE);
1510 wpabuf_put_be16(msg, 2);
1511 wpabuf_put_be16(msg, cred->encr_type);
1512 return 0;
1513 }
1514
1515
wps_build_cred_network_key(struct wpabuf * msg,const struct wps_credential * cred)1516 static int wps_build_cred_network_key(struct wpabuf *msg,
1517 const struct wps_credential *cred)
1518 {
1519 wpa_printf(MSG_DEBUG, "WPS: * Network Key (len=%d)",
1520 (int) cred->key_len);
1521 wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
1522 cred->key, cred->key_len);
1523 wpabuf_put_be16(msg, ATTR_NETWORK_KEY);
1524 wpabuf_put_be16(msg, cred->key_len);
1525 wpabuf_put_data(msg, cred->key, cred->key_len);
1526 return 0;
1527 }
1528
1529
wps_build_cred_mac_addr(struct wpabuf * msg,const struct wps_credential * cred)1530 static int wps_build_cred_mac_addr(struct wpabuf *msg,
1531 const struct wps_credential *cred)
1532 {
1533 wpa_printf(MSG_DEBUG, "WPS: * MAC Address (" MACSTR ")",
1534 MAC2STR(cred->mac_addr));
1535 wpabuf_put_be16(msg, ATTR_MAC_ADDR);
1536 wpabuf_put_be16(msg, ETH_ALEN);
1537 wpabuf_put_data(msg, cred->mac_addr, ETH_ALEN);
1538 return 0;
1539 }
1540
1541
wps_build_credential(struct wpabuf * msg,const struct wps_credential * cred)1542 static int wps_build_credential(struct wpabuf *msg,
1543 const struct wps_credential *cred)
1544 {
1545 if (wps_build_cred_network_idx(msg, cred) ||
1546 wps_build_cred_ssid(msg, cred) ||
1547 wps_build_cred_auth_type(msg, cred) ||
1548 wps_build_cred_encr_type(msg, cred) ||
1549 wps_build_cred_network_key(msg, cred) ||
1550 wps_build_cred_mac_addr(msg, cred))
1551 return -1;
1552 return 0;
1553 }
1554
1555
wps_build_credential_wrap(struct wpabuf * msg,const struct wps_credential * cred)1556 int wps_build_credential_wrap(struct wpabuf *msg,
1557 const struct wps_credential *cred)
1558 {
1559 struct wpabuf *wbuf;
1560 wbuf = wpabuf_alloc(200);
1561 if (wbuf == NULL)
1562 return -1;
1563 if (wps_build_credential(wbuf, cred)) {
1564 wpabuf_free(wbuf);
1565 return -1;
1566 }
1567 wpabuf_put_be16(msg, ATTR_CRED);
1568 wpabuf_put_be16(msg, wpabuf_len(wbuf));
1569 wpabuf_put_buf(msg, wbuf);
1570 wpabuf_free(wbuf);
1571 return 0;
1572 }
1573
1574
wps_build_cred(struct wps_data * wps,struct wpabuf * msg)1575 int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
1576 {
1577 struct wpabuf *cred;
1578
1579 if (wps->wps->registrar->skip_cred_build)
1580 goto skip_cred_build;
1581
1582 wpa_printf(MSG_DEBUG, "WPS: * Credential");
1583 if (wps->use_cred) {
1584 os_memcpy(&wps->cred, wps->use_cred, sizeof(wps->cred));
1585 goto use_provided;
1586 }
1587 os_memset(&wps->cred, 0, sizeof(wps->cred));
1588
1589 os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
1590 wps->cred.ssid_len = wps->wps->ssid_len;
1591
1592 /* Select the best authentication and encryption type */
1593 if (wps->auth_type & WPS_AUTH_WPA2PSK)
1594 wps->auth_type = WPS_AUTH_WPA2PSK;
1595 else if (wps->auth_type & WPS_AUTH_WPAPSK)
1596 wps->auth_type = WPS_AUTH_WPAPSK;
1597 else if (wps->auth_type & WPS_WIFI_AUTH_OPEN)
1598 wps->auth_type = WPS_WIFI_AUTH_OPEN;
1599 else if (wps->auth_type & WPS_AUTH_SHARED)
1600 wps->auth_type = WPS_AUTH_SHARED;
1601 else {
1602 wpa_printf(MSG_DEBUG, "WPS: Unsupported auth_type 0x%x",
1603 wps->auth_type);
1604 return -1;
1605 }
1606 wps->cred.auth_type = wps->auth_type;
1607
1608 if (wps->auth_type == WPS_AUTH_WPA2PSK ||
1609 wps->auth_type == WPS_AUTH_WPAPSK) {
1610 if (wps->encr_type & WPS_ENCR_AES)
1611 wps->encr_type = WPS_ENCR_AES;
1612 else if (wps->encr_type & WPS_ENCR_TKIP)
1613 wps->encr_type = WPS_ENCR_TKIP;
1614 else {
1615 wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1616 "type for WPA/WPA2");
1617 return -1;
1618 }
1619 } else {
1620 if (wps->encr_type & WPS_ENCR_WEP)
1621 wps->encr_type = WPS_ENCR_WEP;
1622 else if (wps->encr_type & WPS_ENCR_NONE)
1623 wps->encr_type = WPS_ENCR_NONE;
1624 else {
1625 wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
1626 "type for non-WPA/WPA2 mode");
1627 return -1;
1628 }
1629 }
1630 wps->cred.encr_type = wps->encr_type;
1631 /*
1632 * Set MAC address in the Credential to be the Enrollee's MAC address
1633 */
1634 os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN);
1635
1636 if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->wps->ap &&
1637 !wps->wps->registrar->disable_auto_conf) {
1638 u8 r[16];
1639 /* Generate a random passphrase */
1640 if (random_get_bytes(r, sizeof(r)) < 0)
1641 return -1;
1642 os_free(wps->new_psk);
1643 wps->new_psk = (u8 *)base64_encode(r, sizeof(r), &wps->new_psk_len);
1644 if (wps->new_psk == NULL)
1645 return -1;
1646 wps->new_psk_len--; /* remove newline */
1647 while (wps->new_psk_len &&
1648 wps->new_psk[wps->new_psk_len - 1] == '=') // NOLINT(clang-analyzer-unix.Malloc)
1649 wps->new_psk_len--;
1650 wpa_hexdump_ascii_key(MSG_DEBUG, "WPS: Generated passphrase",
1651 wps->new_psk, wps->new_psk_len);
1652 os_memcpy(wps->cred.key, wps->new_psk, wps->new_psk_len); // NOLINT(clang-analyzer-unix.Malloc)
1653 wps->cred.key_len = wps->new_psk_len;
1654 } else if (wps->use_psk_key && wps->wps->psk_set) {
1655 char hex[65] = {0};
1656 wpa_printf(MSG_DEBUG, "WPS: Use PSK format for Network Key");
1657 os_memcpy(wps->cred.key, hex, 32 * 2);
1658 wps->cred.key_len = 32 * 2;
1659 } else if (wps->wps->network_key) {
1660 os_memcpy(wps->cred.key, wps->wps->network_key,
1661 wps->wps->network_key_len);
1662 wps->cred.key_len = wps->wps->network_key_len;
1663 } else if (wps->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
1664 char hex[65];
1665 /* Generate a random per-device PSK */
1666 os_free(wps->new_psk);
1667 wps->new_psk_len = 32;
1668 wps->new_psk = (u8 *)os_malloc(wps->new_psk_len);
1669 if (wps->new_psk == NULL)
1670 return -1;
1671 if (random_get_bytes(wps->new_psk, wps->new_psk_len) < 0) {
1672 os_free(wps->new_psk);
1673 wps->new_psk = NULL;
1674 return -1;
1675 }
1676 wpa_hexdump_key(MSG_DEBUG, "WPS: Generated per-device PSK",
1677 wps->new_psk, wps->new_psk_len);
1678 os_memcpy(wps->cred.key, hex, wps->new_psk_len * 2);
1679 wps->cred.key_len = wps->new_psk_len * 2;
1680 }
1681
1682 use_provided:
1683 #ifdef CONFIG_WPS_TESTING
1684 if (wps_testing_dummy_cred)
1685 cred = wpabuf_alloc(200);
1686 else
1687 cred = NULL;
1688 if (cred) {
1689 struct wps_credential dummy;
1690 wpa_printf(MSG_DEBUG, "WPS: Add dummy credential");
1691 os_memset(&dummy, 0, sizeof(dummy));
1692 os_memcpy(dummy.ssid, "dummy", 5);
1693 dummy.ssid_len = 5;
1694 dummy.auth_type = WPS_AUTH_WPA2PSK;
1695 dummy.encr_type = WPS_ENCR_AES;
1696 os_memcpy(dummy.key, "dummy psk", 9);
1697 dummy.key_len = 9;
1698 os_memcpy(dummy.mac_addr, wps->mac_addr_e, ETH_ALEN);
1699 wps_build_credential(cred, &dummy);
1700 wpa_hexdump_buf(MSG_DEBUG, "WPS: Dummy Credential", cred);
1701
1702 wpabuf_put_be16(msg, ATTR_CRED);
1703 wpabuf_put_be16(msg, wpabuf_len(cred));
1704 wpabuf_put_buf(msg, cred);
1705
1706 wpabuf_free(cred);
1707 }
1708 #endif /* CONFIG_WPS_TESTING */
1709
1710 cred = wpabuf_alloc(200);
1711 if (cred == NULL)
1712 return -1;
1713
1714 if (wps_build_credential(cred, &wps->cred)) {
1715 wpabuf_free(cred);
1716 return -1;
1717 }
1718
1719 wpabuf_put_be16(msg, ATTR_CRED);
1720 wpabuf_put_be16(msg, wpabuf_len(cred));
1721 wpabuf_put_buf(msg, cred);
1722 wpabuf_free(cred);
1723
1724 skip_cred_build:
1725 if (wps->wps->registrar->extra_cred) {
1726 wpa_printf(MSG_DEBUG, "WPS: * Credential (pre-configured)");
1727 wpabuf_put_buf(msg, wps->wps->registrar->extra_cred);
1728 }
1729
1730 return 0;
1731 }
1732
1733
wps_build_ap_settings(struct wps_data * wps,struct wpabuf * msg)1734 static int wps_build_ap_settings(struct wps_data *wps, struct wpabuf *msg)
1735 {
1736 wpa_printf(MSG_DEBUG, "WPS: * AP Settings");
1737
1738 if (wps_build_credential(msg, &wps->cred))
1739 return -1;
1740
1741 return 0;
1742 }
1743
1744
wps_build_ap_cred(struct wps_data * wps)1745 static struct wpabuf * wps_build_ap_cred(struct wps_data *wps)
1746 {
1747 struct wpabuf *msg, *plain;
1748
1749 msg = wpabuf_alloc(1000);
1750 if (msg == NULL)
1751 return NULL;
1752
1753 plain = wpabuf_alloc(200);
1754 if (plain == NULL) {
1755 wpabuf_free(msg);
1756 return NULL;
1757 }
1758
1759 if (wps_build_ap_settings(wps, plain)) {
1760 wpabuf_free(plain);
1761 wpabuf_free(msg);
1762 return NULL;
1763 }
1764
1765 wpabuf_put_be16(msg, ATTR_CRED);
1766 wpabuf_put_be16(msg, wpabuf_len(plain));
1767 wpabuf_put_buf(msg, plain);
1768 wpabuf_free(plain);
1769
1770 return msg;
1771 }
1772
1773
wps_build_m2(struct wps_data * wps)1774 static struct wpabuf * wps_build_m2(struct wps_data *wps)
1775 {
1776 struct wpabuf *msg;
1777
1778 if (random_get_bytes(wps->nonce_r, WPS_NONCE_LEN) < 0)
1779 return NULL;
1780 wpa_hexdump(MSG_DEBUG, "WPS: Registrar Nonce",
1781 wps->nonce_r, WPS_NONCE_LEN);
1782 wpa_hexdump(MSG_DEBUG, "WPS: UUID-R", wps->uuid_r, WPS_UUID_LEN);
1783
1784 wpa_printf(MSG_DEBUG, "WPS: Building Message M2");
1785 msg = wpabuf_alloc(1000);
1786 if (msg == NULL)
1787 return NULL;
1788
1789 if (wps_build_version(msg) ||
1790 wps_build_msg_type(msg, WPS_M2) ||
1791 wps_build_enrollee_nonce(wps, msg) ||
1792 wps_build_registrar_nonce(wps, msg) ||
1793 wps_build_uuid_r(wps, msg) ||
1794 wps_build_public_key(wps, msg, WPS_CALC_KEY_NORMAL) ||
1795 wps_derive_keys(wps) ||
1796 wps_build_auth_type_flags(wps, msg) ||
1797 wps_build_encr_type_flags(wps, msg) ||
1798 wps_build_conn_type_flags(wps, msg) ||
1799 wps_build_config_methods_r(wps->wps->registrar, msg) ||
1800 wps_build_device_attrs(&wps->wps->dev, msg) ||
1801 wps_build_rf_bands(&wps->wps->dev, msg) ||
1802 wps_build_assoc_state(wps, msg) ||
1803 wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
1804 wps_build_dev_password_id(msg, wps->dev_pw_id) ||
1805 wps_build_os_version(&wps->wps->dev, msg) ||
1806 wps_build_wfa_ext(msg, 0, NULL, 0) ||
1807 wps_build_authenticator(wps, msg)) {
1808 wpabuf_free(msg);
1809 return NULL;
1810 }
1811
1812 wps->int_reg = 1;
1813 wps->state = RECV_M3;
1814 return msg;
1815 }
1816
1817
wps_build_m2d(struct wps_data * wps)1818 static struct wpabuf * wps_build_m2d(struct wps_data *wps)
1819 {
1820 struct wpabuf *msg;
1821 u16 err = wps->config_error;
1822
1823 wpa_printf(MSG_DEBUG, "WPS: Building Message M2D");
1824 msg = wpabuf_alloc(1000);
1825 if (msg == NULL)
1826 return NULL;
1827
1828 if (wps->wps->ap && wps->wps->ap_setup_locked &&
1829 err == WPS_CFG_NO_ERROR)
1830 err = WPS_CFG_SETUP_LOCKED;
1831
1832 if (wps_build_version(msg) ||
1833 wps_build_msg_type(msg, WPS_M2D) ||
1834 wps_build_enrollee_nonce(wps, msg) ||
1835 wps_build_registrar_nonce(wps, msg) ||
1836 wps_build_uuid_r(wps, msg) ||
1837 wps_build_auth_type_flags(wps, msg) ||
1838 wps_build_encr_type_flags(wps, msg) ||
1839 wps_build_conn_type_flags(wps, msg) ||
1840 wps_build_config_methods_r(wps->wps->registrar, msg) ||
1841 wps_build_device_attrs(&wps->wps->dev, msg) ||
1842 wps_build_rf_bands(&wps->wps->dev, msg) ||
1843 wps_build_assoc_state(wps, msg) ||
1844 wps_build_config_error(msg, err) ||
1845 wps_build_os_version(&wps->wps->dev, msg) ||
1846 wps_build_wfa_ext(msg, 0, NULL, 0)) {
1847 wpabuf_free(msg);
1848 return NULL;
1849 }
1850
1851 wps->state = RECV_M2D_ACK;
1852 return msg;
1853 }
1854
1855
wps_build_m4(struct wps_data * wps)1856 static struct wpabuf * wps_build_m4(struct wps_data *wps)
1857 {
1858 struct wpabuf *msg, *plain;
1859
1860 wpa_printf(MSG_DEBUG, "WPS: Building Message M4");
1861
1862 wps_derive_psk(wps, wps->dev_password, wps->dev_password_len);
1863
1864 plain = wpabuf_alloc(200);
1865 if (plain == NULL)
1866 return NULL;
1867
1868 msg = wpabuf_alloc(1000);
1869 if (msg == NULL) {
1870 wpabuf_free(plain);
1871 return NULL;
1872 }
1873
1874 if (wps_build_version(msg) ||
1875 wps_build_msg_type(msg, WPS_M4) ||
1876 wps_build_enrollee_nonce(wps, msg) ||
1877 wps_build_r_hash(wps, msg) ||
1878 wps_build_r_snonce1(wps, plain) ||
1879 wps_build_key_wrap_auth(wps, plain) ||
1880 wps_build_encr_settings(wps, msg, plain) ||
1881 wps_build_wfa_ext(msg, 0, NULL, 0) ||
1882 wps_build_authenticator(wps, msg)) {
1883 wpabuf_free(plain);
1884 wpabuf_free(msg);
1885 return NULL;
1886 }
1887 wpabuf_free(plain);
1888
1889 wps->state = RECV_M5;
1890 return msg;
1891 }
1892
1893
wps_build_m6(struct wps_data * wps)1894 static struct wpabuf * wps_build_m6(struct wps_data *wps)
1895 {
1896 struct wpabuf *msg, *plain;
1897
1898 wpa_printf(MSG_DEBUG, "WPS: Building Message M6");
1899
1900 plain = wpabuf_alloc(200);
1901 if (plain == NULL)
1902 return NULL;
1903
1904 msg = wpabuf_alloc(1000);
1905 if (msg == NULL) {
1906 wpabuf_free(plain);
1907 return NULL;
1908 }
1909
1910 if (wps_build_version(msg) ||
1911 wps_build_msg_type(msg, WPS_M6) ||
1912 wps_build_enrollee_nonce(wps, msg) ||
1913 wps_build_r_snonce2(wps, plain) ||
1914 wps_build_key_wrap_auth(wps, plain) ||
1915 wps_build_encr_settings(wps, msg, plain) ||
1916 wps_build_wfa_ext(msg, 0, NULL, 0) ||
1917 wps_build_authenticator(wps, msg)) {
1918 wpabuf_free(plain);
1919 wpabuf_free(msg);
1920 return NULL;
1921 }
1922 wpabuf_free(plain);
1923
1924 wps->wps_pin_revealed = 1;
1925 wps->state = RECV_M7;
1926 return msg;
1927 }
1928
1929
wps_build_m8(struct wps_data * wps)1930 static struct wpabuf * wps_build_m8(struct wps_data *wps)
1931 {
1932 struct wpabuf *msg, *plain;
1933
1934 wpa_printf(MSG_DEBUG, "WPS: Building Message M8");
1935
1936 plain = wpabuf_alloc(500);
1937 if (plain == NULL)
1938 return NULL;
1939
1940 msg = wpabuf_alloc(1000);
1941 if (msg == NULL) {
1942 wpabuf_free(plain);
1943 return NULL;
1944 }
1945
1946 if (wps_build_version(msg) ||
1947 wps_build_msg_type(msg, WPS_M8) ||
1948 wps_build_enrollee_nonce(wps, msg) ||
1949 ((wps->wps->ap || wps->er) && wps_build_cred(wps, plain)) ||
1950 (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) ||
1951 wps_build_key_wrap_auth(wps, plain) ||
1952 wps_build_encr_settings(wps, msg, plain) ||
1953 wps_build_wfa_ext(msg, 0, NULL, 0) ||
1954 wps_build_authenticator(wps, msg)) {
1955 wpabuf_free(plain);
1956 wpabuf_free(msg);
1957 return NULL;
1958 }
1959 wpabuf_free(plain);
1960
1961 wps->state = RECV_DONE;
1962 return msg;
1963 }
1964
1965
wps_registrar_get_msg(struct wps_data * wps,enum wsc_op_code * op_code)1966 struct wpabuf * wps_registrar_get_msg(struct wps_data *wps,
1967 enum wsc_op_code *op_code)
1968 {
1969 struct wpabuf *msg;
1970
1971 #ifdef CONFIG_WPS_UPNP
1972 if (!wps->int_reg && wps->wps->wps_upnp) {
1973 struct upnp_pending_message *p, *prev = NULL;
1974 if (wps->ext_reg > 1)
1975 wps_registrar_free_pending_m2(wps->wps);
1976 p = wps->wps->upnp_msgs;
1977 /* TODO: check pending message MAC address */
1978 while (p && p->next) {
1979 prev = p;
1980 p = p->next;
1981 }
1982 if (p) {
1983 wpa_printf(MSG_DEBUG, "WPS: Use pending message from "
1984 "UPnP");
1985 if (prev)
1986 prev->next = NULL;
1987 else
1988 wps->wps->upnp_msgs = NULL;
1989 msg = p->msg;
1990 switch (p->type) {
1991 case WPS_WSC_ACK:
1992 *op_code = WSC_ACK;
1993 break;
1994 case WPS_WSC_NACK:
1995 *op_code = WSC_NACK;
1996 break;
1997 default:
1998 *op_code = WSC_MSG;
1999 break;
2000 }
2001 os_free(p);
2002 if (wps->ext_reg == 0)
2003 wps->ext_reg = 1;
2004 return msg;
2005 }
2006 }
2007 if (wps->ext_reg) {
2008 wpa_printf(MSG_DEBUG, "WPS: Using external Registrar, but no "
2009 "pending message available");
2010 return NULL;
2011 }
2012 #endif /* CONFIG_WPS_UPNP */
2013
2014 switch (wps->state) {
2015 case SEND_M2:
2016 if (wps_get_dev_password(wps) < 0)
2017 msg = wps_build_m2d(wps);
2018 else
2019 msg = wps_build_m2(wps);
2020 *op_code = WSC_MSG;
2021 break;
2022 case SEND_M2D:
2023 msg = wps_build_m2d(wps);
2024 *op_code = WSC_MSG;
2025 break;
2026 case SEND_M4:
2027 msg = wps_build_m4(wps);
2028 *op_code = WSC_MSG;
2029 break;
2030 case SEND_M6:
2031 msg = wps_build_m6(wps);
2032 *op_code = WSC_MSG;
2033 break;
2034 case SEND_M8:
2035 msg = wps_build_m8(wps);
2036 *op_code = WSC_MSG;
2037 break;
2038 case RECV_DONE:
2039 msg = wps_build_wsc_ack(wps);
2040 *op_code = WSC_ACK;
2041 break;
2042 case SEND_WSC_NACK:
2043 msg = wps_build_wsc_nack(wps);
2044 *op_code = WSC_NACK;
2045 break;
2046 default:
2047 wpa_printf(MSG_DEBUG, "WPS: Unsupported state %d for building "
2048 "a message", wps->state);
2049 msg = NULL;
2050 break;
2051 }
2052
2053 if (*op_code == WSC_MSG && msg) {
2054 /* Save a copy of the last message for Authenticator derivation
2055 */
2056 wpabuf_free(wps->last_msg);
2057 wps->last_msg = wpabuf_dup(msg);
2058 }
2059
2060 return msg;
2061 }
2062
2063
wps_process_enrollee_nonce(struct wps_data * wps,const u8 * e_nonce)2064 static int wps_process_enrollee_nonce(struct wps_data *wps, const u8 *e_nonce)
2065 {
2066 if (e_nonce == NULL) {
2067 wpa_printf(MSG_DEBUG, "WPS: No Enrollee Nonce received");
2068 return -1;
2069 }
2070
2071 os_memcpy(wps->nonce_e, e_nonce, WPS_NONCE_LEN);
2072 wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Nonce",
2073 wps->nonce_e, WPS_NONCE_LEN);
2074
2075 return 0;
2076 }
2077
2078
wps_process_registrar_nonce(struct wps_data * wps,const u8 * r_nonce)2079 static int wps_process_registrar_nonce(struct wps_data *wps, const u8 *r_nonce)
2080 {
2081 if (r_nonce == NULL) {
2082 wpa_printf(MSG_DEBUG, "WPS: No Registrar Nonce received");
2083 return -1;
2084 }
2085
2086 if (os_memcmp(wps->nonce_r, r_nonce, WPS_NONCE_LEN) != 0) {
2087 wpa_printf(MSG_DEBUG, "WPS: Invalid Registrar Nonce received");
2088 return -1;
2089 }
2090
2091 return 0;
2092 }
2093
2094
wps_process_uuid_e(struct wps_data * wps,const u8 * uuid_e)2095 static int wps_process_uuid_e(struct wps_data *wps, const u8 *uuid_e)
2096 {
2097 if (uuid_e == NULL) {
2098 wpa_printf(MSG_DEBUG, "WPS: No UUID-E received");
2099 return -1;
2100 }
2101
2102 os_memcpy(wps->uuid_e, uuid_e, WPS_UUID_LEN);
2103 wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", wps->uuid_e, WPS_UUID_LEN);
2104
2105 return 0;
2106 }
2107
2108
wps_process_dev_password_id(struct wps_data * wps,const u8 * pw_id)2109 static int wps_process_dev_password_id(struct wps_data *wps, const u8 *pw_id)
2110 {
2111 if (pw_id == NULL) {
2112 wpa_printf(MSG_DEBUG, "WPS: No Device Password ID received");
2113 return -1;
2114 }
2115
2116 wps->dev_pw_id = WPA_GET_BE16(pw_id);
2117 wpa_printf(MSG_DEBUG, "WPS: Device Password ID %d", wps->dev_pw_id);
2118
2119 return 0;
2120 }
2121
2122
wps_process_e_hash1(struct wps_data * wps,const u8 * e_hash1)2123 static int wps_process_e_hash1(struct wps_data *wps, const u8 *e_hash1)
2124 {
2125 if (e_hash1 == NULL) {
2126 wpa_printf(MSG_DEBUG, "WPS: No E-Hash1 received");
2127 return -1;
2128 }
2129
2130 os_memcpy(wps->peer_hash1, e_hash1, WPS_HASH_LEN);
2131 wpa_hexdump(MSG_DEBUG, "WPS: E-Hash1", wps->peer_hash1, WPS_HASH_LEN);
2132
2133 return 0;
2134 }
2135
2136
wps_process_e_hash2(struct wps_data * wps,const u8 * e_hash2)2137 static int wps_process_e_hash2(struct wps_data *wps, const u8 *e_hash2)
2138 {
2139 if (e_hash2 == NULL) {
2140 wpa_printf(MSG_DEBUG, "WPS: No E-Hash2 received");
2141 return -1;
2142 }
2143
2144 os_memcpy(wps->peer_hash2, e_hash2, WPS_HASH_LEN);
2145 wpa_hexdump(MSG_DEBUG, "WPS: E-Hash2", wps->peer_hash2, WPS_HASH_LEN);
2146
2147 return 0;
2148 }
2149
2150
wps_process_e_snonce1(struct wps_data * wps,const u8 * e_snonce1)2151 static int wps_process_e_snonce1(struct wps_data *wps, const u8 *e_snonce1)
2152 {
2153 u8 hash[SHA256_MAC_LEN];
2154 const u8 *addr[4];
2155 size_t len[4];
2156
2157 if (e_snonce1 == NULL) {
2158 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce1 received");
2159 return -1;
2160 }
2161
2162 wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce1", e_snonce1,
2163 WPS_SECRET_NONCE_LEN);
2164
2165 /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
2166 addr[0] = e_snonce1;
2167 len[0] = WPS_SECRET_NONCE_LEN;
2168 addr[1] = wps->psk1;
2169 len[1] = WPS_PSK_LEN;
2170 addr[2] = wpabuf_head(wps->dh_pubkey_e);
2171 len[2] = wpabuf_len(wps->dh_pubkey_e);
2172 addr[3] = wpabuf_head(wps->dh_pubkey_r);
2173 len[3] = wpabuf_len(wps->dh_pubkey_r);
2174 hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
2175 if (os_memcmp(wps->peer_hash1, hash, WPS_HASH_LEN) != 0) {
2176 wpa_printf(MSG_DEBUG, "WPS: E-Hash1 derived from E-S1 does "
2177 "not match with the pre-committed value");
2178 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
2179 wps_pwd_auth_fail_event(wps->wps, 0, 1);
2180 return -1;
2181 }
2182
2183 wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the first "
2184 "half of the device password");
2185
2186 return 0;
2187 }
2188
2189
wps_process_e_snonce2(struct wps_data * wps,const u8 * e_snonce2)2190 static int wps_process_e_snonce2(struct wps_data *wps, const u8 *e_snonce2)
2191 {
2192 u8 hash[SHA256_MAC_LEN];
2193 const u8 *addr[4];
2194 size_t len[4];
2195
2196 if (e_snonce2 == NULL) {
2197 wpa_printf(MSG_DEBUG, "WPS: No E-SNonce2 received");
2198 return -1;
2199 }
2200
2201 wpa_hexdump_key(MSG_DEBUG, "WPS: E-SNonce2", e_snonce2,
2202 WPS_SECRET_NONCE_LEN);
2203
2204 /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
2205 addr[0] = e_snonce2;
2206 len[0] = WPS_SECRET_NONCE_LEN;
2207 addr[1] = wps->psk2;
2208 len[1] = WPS_PSK_LEN;
2209 addr[2] = wpabuf_head(wps->dh_pubkey_e);
2210 len[2] = wpabuf_len(wps->dh_pubkey_e);
2211 addr[3] = wpabuf_head(wps->dh_pubkey_r);
2212 len[3] = wpabuf_len(wps->dh_pubkey_r);
2213
2214 hmac_sha256_vector(wps->authkey, WPS_AUTHKEY_LEN, 4, addr, len, hash);
2215 if (os_memcmp(wps->peer_hash2, hash, WPS_HASH_LEN) != 0) {
2216 wpa_printf(MSG_DEBUG, "WPS: E-Hash2 derived from E-S2 does "
2217 "not match with the pre-committed value");
2218 #ifdef CONFIG_WPS_PIN
2219 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
2220 #endif
2221 wps->config_error = WPS_CFG_DEV_PASSWORD_AUTH_FAILURE;
2222 wps_pwd_auth_fail_event(wps->wps, 0, 2);
2223 return -1;
2224 }
2225
2226 wpa_printf(MSG_DEBUG, "WPS: Enrollee proved knowledge of the second "
2227 "half of the device password");
2228 wps->wps_pin_revealed = 0;
2229 #ifdef CONFIG_WPS_PIN
2230 wps_registrar_unlock_pin(wps->wps->registrar, wps->uuid_e);
2231
2232 /*
2233 * In case wildcard PIN is used and WPS handshake succeeds in the first
2234 * attempt, wps_registrar_unlock_pin() would not free the PIN, so make
2235 * sure the PIN gets invalidated here.
2236 */
2237 wps_registrar_invalidate_pin(wps->wps->registrar, wps->uuid_e);
2238 #endif
2239 return 0;
2240 }
2241
2242
wps_process_mac_addr(struct wps_data * wps,const u8 * mac_addr)2243 static int wps_process_mac_addr(struct wps_data *wps, const u8 *mac_addr)
2244 {
2245 if (mac_addr == NULL) {
2246 wpa_printf(MSG_DEBUG, "WPS: No MAC Address received");
2247 return -1;
2248 }
2249
2250 wpa_printf(MSG_DEBUG, "WPS: Enrollee MAC Address " MACSTR,
2251 MAC2STR(mac_addr));
2252 os_memcpy(wps->mac_addr_e, mac_addr, ETH_ALEN);
2253 os_memcpy(wps->peer_dev.mac_addr, mac_addr, ETH_ALEN);
2254
2255 return 0;
2256 }
2257
2258
wps_process_pubkey(struct wps_data * wps,const u8 * pk,size_t pk_len)2259 static int wps_process_pubkey(struct wps_data *wps, const u8 *pk,
2260 size_t pk_len)
2261 {
2262 if (pk == NULL || pk_len == 0) {
2263 wpa_printf(MSG_DEBUG, "WPS: No Public Key received");
2264 return -1;
2265 }
2266
2267 wpabuf_free(wps->dh_pubkey_e);
2268 wps->dh_pubkey_e = wpabuf_alloc_copy(pk, pk_len);
2269 if (wps->dh_pubkey_e == NULL)
2270 return -1;
2271
2272 return 0;
2273 }
2274
2275
wps_process_auth_type_flags(struct wps_data * wps,const u8 * auth)2276 static int wps_process_auth_type_flags(struct wps_data *wps, const u8 *auth)
2277 {
2278 u16 auth_types;
2279
2280 if (auth == NULL) {
2281 wpa_printf(MSG_DEBUG, "WPS: No Authentication Type flags "
2282 "received");
2283 return -1;
2284 }
2285
2286 auth_types = WPA_GET_BE16(auth);
2287
2288 wpa_printf(MSG_DEBUG, "WPS: Enrollee Authentication Type flags 0x%x",
2289 auth_types);
2290 wps->auth_type = wps->wps->auth_types & auth_types;
2291 if (wps->auth_type == 0) {
2292 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
2293 "authentication types (own 0x%x Enrollee 0x%x)",
2294 wps->wps->auth_types, auth_types);
2295 #ifdef WPS_WORKAROUNDS
2296 /*
2297 * Some deployed implementations seem to advertise incorrect
2298 * information in this attribute. For example, Linksys WRT350N
2299 * seems to have a byteorder bug that breaks this negotiation.
2300 * In order to interoperate with existing implementations,
2301 * assume that the Enrollee supports everything we do.
2302 */
2303 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
2304 "does not advertise supported authentication types "
2305 "correctly");
2306 wps->auth_type = wps->wps->auth_types;
2307 #else /* WPS_WORKAROUNDS */
2308 return -1;
2309 #endif /* WPS_WORKAROUNDS */
2310 }
2311
2312 return 0;
2313 }
2314
2315
wps_process_encr_type_flags(struct wps_data * wps,const u8 * encr)2316 static int wps_process_encr_type_flags(struct wps_data *wps, const u8 *encr)
2317 {
2318 u16 encr_types;
2319
2320 if (encr == NULL) {
2321 wpa_printf(MSG_DEBUG, "WPS: No Encryption Type flags "
2322 "received");
2323 return -1;
2324 }
2325
2326 encr_types = WPA_GET_BE16(encr);
2327
2328 wpa_printf(MSG_DEBUG, "WPS: Enrollee Encryption Type flags 0x%x",
2329 encr_types);
2330 wps->encr_type = wps->wps->encr_types & encr_types;
2331 if (wps->encr_type == 0) {
2332 wpa_printf(MSG_DEBUG, "WPS: No match in supported "
2333 "encryption types (own 0x%x Enrollee 0x%x)",
2334 wps->wps->encr_types, encr_types);
2335 #ifdef WPS_WORKAROUNDS
2336 /*
2337 * Some deployed implementations seem to advertise incorrect
2338 * information in this attribute. For example, Linksys WRT350N
2339 * seems to have a byteorder bug that breaks this negotiation.
2340 * In order to interoperate with existing implementations,
2341 * assume that the Enrollee supports everything we do.
2342 */
2343 wpa_printf(MSG_DEBUG, "WPS: Workaround - assume Enrollee "
2344 "does not advertise supported encryption types "
2345 "correctly");
2346 wps->encr_type = wps->wps->encr_types;
2347 #else /* WPS_WORKAROUNDS */
2348 return -1;
2349 #endif /* WPS_WORKAROUNDS */
2350 }
2351
2352 return 0;
2353 }
2354
2355
wps_process_conn_type_flags(struct wps_data * wps,const u8 * conn)2356 static int wps_process_conn_type_flags(struct wps_data *wps, const u8 *conn)
2357 {
2358 if (conn == NULL) {
2359 wpa_printf(MSG_DEBUG, "WPS: No Connection Type flags "
2360 "received");
2361 return -1;
2362 }
2363
2364 wpa_printf(MSG_DEBUG, "WPS: Enrollee Connection Type flags 0x%x",
2365 *conn);
2366
2367 return 0;
2368 }
2369
2370
wps_process_config_methods(struct wps_data * wps,const u8 * methods)2371 static int wps_process_config_methods(struct wps_data *wps, const u8 *methods)
2372 {
2373 u16 m;
2374
2375 if (methods == NULL) {
2376 wpa_printf(MSG_DEBUG, "WPS: No Config Methods received");
2377 return -1;
2378 }
2379
2380 m = WPA_GET_BE16(methods);
2381
2382 wpa_printf(MSG_DEBUG, "WPS: Enrollee Config Methods 0x%x"
2383 "%s%s%s%s%s%s%s%s%s", m,
2384 m & WPS_CONFIG_USBA ? " [USBA]" : "",
2385 m & WPS_CONFIG_ETHERNET ? " [Ethernet]" : "",
2386 m & WPS_CONFIG_LABEL ? " [Label]" : "",
2387 m & WPS_CONFIG_DISPLAY ? " [Display]" : "",
2388 m & WPS_CONFIG_EXT_NFC_TOKEN ? " [Ext NFC Token]" : "",
2389 m & WPS_CONFIG_INT_NFC_TOKEN ? " [Int NFC Token]" : "",
2390 m & WPS_CONFIG_NFC_INTERFACE ? " [NFC]" : "",
2391 m & WPS_CONFIG_PUSHBUTTON ? " [PBC]" : "",
2392 m & WPS_CONFIG_KEYPAD ? " [Keypad]" : "");
2393
2394 if (!(m & WPS_CONFIG_DISPLAY) && !wps->use_psk_key) {
2395 /*
2396 * The Enrollee does not have a display so it is unlikely to be
2397 * able to show the passphrase to a user and as such, could
2398 * benefit from receiving PSK to reduce key derivation time.
2399 */
2400 wpa_printf(MSG_DEBUG, "WPS: Prefer PSK format key due to "
2401 "Enrollee not supporting display");
2402 wps->use_psk_key = 1;
2403 }
2404
2405 return 0;
2406 }
2407
2408
wps_process_wps_state(struct wps_data * wps,const u8 * state)2409 static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
2410 {
2411 if (state == NULL) {
2412 wpa_printf(MSG_DEBUG, "WPS: No Wi-Fi Protected Setup State "
2413 "received");
2414 return -1;
2415 }
2416
2417 wpa_printf(MSG_DEBUG, "WPS: Enrollee Wi-Fi Protected Setup State %d",
2418 *state);
2419
2420 return 0;
2421 }
2422
2423
wps_process_assoc_state(struct wps_data * wps,const u8 * assoc)2424 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
2425 {
2426 #ifdef DEBUG_PRINT
2427 u16 a;
2428 #endif
2429
2430 if (assoc == NULL) {
2431 wpa_printf(MSG_DEBUG, "WPS: No Association State received");
2432 return -1;
2433 }
2434
2435 #ifdef DEBUG_PRINT
2436 a = WPA_GET_BE16(assoc);
2437 #endif
2438 wpa_printf(MSG_DEBUG, "WPS: Enrollee Association State %d", a);
2439
2440 return 0;
2441 }
2442
2443
wps_process_config_error(struct wps_data * wps,const u8 * err)2444 static int wps_process_config_error(struct wps_data *wps, const u8 *err)
2445 {
2446 #ifdef DEBUG_PRINT
2447 u16 e;
2448 #endif
2449
2450 if (err == NULL) {
2451 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error received");
2452 return -1;
2453 }
2454
2455 #ifdef DEBUG_PRINT
2456 e = WPA_GET_BE16(err);
2457 #endif
2458 wpa_printf(MSG_DEBUG, "WPS: Enrollee Configuration Error %d", e);
2459
2460 return 0;
2461 }
2462
2463
wps_registrar_p2p_dev_addr_match(struct wps_data * wps)2464 static int wps_registrar_p2p_dev_addr_match(struct wps_data *wps)
2465 {
2466 #ifdef CONFIG_P2P
2467 struct wps_registrar *reg = wps->wps->registrar;
2468
2469 if (is_zero_ether_addr(reg->p2p_dev_addr))
2470 return 1; /* no filtering in use */
2471
2472 if (os_memcmp(reg->p2p_dev_addr, wps->p2p_dev_addr, ETH_ALEN) != 0) {
2473 wpa_printf(MSG_DEBUG, "WPS: No match on P2P Device Address "
2474 "filtering for PBC: expected " MACSTR " was "
2475 MACSTR " - indicate PBC session overlap",
2476 MAC2STR(reg->p2p_dev_addr),
2477 MAC2STR(wps->p2p_dev_addr));
2478 return 0;
2479 }
2480 #endif /* CONFIG_P2P */
2481 return 1;
2482 }
2483
2484
wps_registrar_skip_overlap(struct wps_data * wps)2485 static int wps_registrar_skip_overlap(struct wps_data *wps)
2486 {
2487 #ifdef CONFIG_P2P
2488 struct wps_registrar *reg = wps->wps->registrar;
2489
2490 if (is_zero_ether_addr(reg->p2p_dev_addr))
2491 return 0; /* no specific Enrollee selected */
2492
2493 if (os_memcmp(reg->p2p_dev_addr, wps->p2p_dev_addr, ETH_ALEN) == 0) {
2494 wpa_printf(MSG_DEBUG, "WPS: Skip PBC overlap due to selected "
2495 "Enrollee match");
2496 return 1;
2497 }
2498 #endif /* CONFIG_P2P */
2499 return 0;
2500 }
2501
2502
wps_process_m1(struct wps_data * wps,struct wps_parse_attr * attr)2503 static enum wps_process_res wps_process_m1(struct wps_data *wps,
2504 struct wps_parse_attr *attr)
2505 {
2506 wpa_printf(MSG_DEBUG, "WPS: Received M1");
2507
2508 if (wps->state != RECV_M1) {
2509 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2510 "receiving M1", wps->state);
2511 return WPS_FAILURE;
2512 }
2513
2514 if (wps_process_uuid_e(wps, attr->uuid_e) ||
2515 wps_process_mac_addr(wps, attr->mac_addr) ||
2516 wps_process_enrollee_nonce(wps, attr->enrollee_nonce) ||
2517 wps_process_pubkey(wps, attr->public_key, attr->public_key_len) ||
2518 wps_process_auth_type_flags(wps, attr->auth_type_flags) ||
2519 wps_process_encr_type_flags(wps, attr->encr_type_flags) ||
2520 wps_process_conn_type_flags(wps, attr->conn_type_flags) ||
2521 wps_process_config_methods(wps, attr->config_methods) ||
2522 wps_process_wps_state(wps, attr->wps_state) ||
2523 wps_process_device_attrs(&wps->peer_dev, attr) ||
2524 wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
2525 wps_process_assoc_state(wps, attr->assoc_state) ||
2526 wps_process_dev_password_id(wps, attr->dev_password_id) ||
2527 wps_process_config_error(wps, attr->config_error) ||
2528 wps_process_os_version(&wps->peer_dev, attr->os_version))
2529 return WPS_FAILURE;
2530
2531 if (wps->dev_pw_id < 0x10 &&
2532 wps->dev_pw_id != DEV_PW_DEFAULT &&
2533 wps->dev_pw_id != DEV_PW_USER_SPECIFIED &&
2534 wps->dev_pw_id != DEV_PW_MACHINE_SPECIFIED &&
2535 wps->dev_pw_id != DEV_PW_REGISTRAR_SPECIFIED &&
2536 (wps->dev_pw_id != DEV_PW_PUSHBUTTON ||
2537 !wps->wps->registrar->pbc)) {
2538 wpa_printf(MSG_DEBUG, "WPS: Unsupported Device Password ID %d",
2539 wps->dev_pw_id);
2540 wps->state = SEND_M2D;
2541 return WPS_CONTINUE;
2542 }
2543
2544 #ifdef CONFIG_WPS_NFC
2545 if (wps->dev_pw_id >= 0x10) {
2546 struct wps_nfc_pw_token *token;
2547 const u8 *addr[1];
2548 u8 hash[WPS_HASH_LEN];
2549
2550 token = wps_get_nfc_pw_token(
2551 &wps->wps->registrar->nfc_pw_tokens, wps->dev_pw_id);
2552 if (token) {
2553 wpa_printf(MSG_DEBUG, "WPS: Found matching NFC "
2554 "Password Token");
2555 dl_list_del(&token->list);
2556 wps->nfc_pw_token = token;
2557
2558 addr[0] = attr->public_key;
2559 sha256_vector(1, addr, &attr->public_key_len, hash);
2560 if (os_memcmp(hash, wps->nfc_pw_token->pubkey_hash,
2561 WPS_OOB_PUBKEY_HASH_LEN) != 0) {
2562 wpa_printf(MSG_ERROR, "WPS: Public Key hash "
2563 "mismatch");
2564 return WPS_FAILURE;
2565 }
2566 }
2567 }
2568 #endif /* CONFIG_WPS_NFC */
2569
2570 if (wps->dev_pw_id == DEV_PW_PUSHBUTTON) {
2571 if ((wps->wps->registrar->force_pbc_overlap ||
2572 wps_registrar_pbc_overlap(wps->wps->registrar,
2573 wps->mac_addr_e, wps->uuid_e) ||
2574 !wps_registrar_p2p_dev_addr_match(wps)) &&
2575 !wps_registrar_skip_overlap(wps)) {
2576 wpa_printf(MSG_DEBUG, "WPS: PBC overlap - deny PBC "
2577 "negotiation");
2578 wps->state = SEND_M2D;
2579 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2580 wps_pbc_overlap_event(wps->wps);
2581 wps_fail_event(wps->wps, WPS_M1,
2582 WPS_CFG_MULTIPLE_PBC_DETECTED,
2583 WPS_EI_NO_ERROR);
2584 wps->wps->registrar->force_pbc_overlap = 1;
2585 return WPS_CONTINUE;
2586 }
2587 wps_registrar_add_pbc_session(wps->wps->registrar,
2588 wps->mac_addr_e, wps->uuid_e);
2589 wps->pbc = 1;
2590 }
2591
2592 #ifdef WPS_WORKAROUNDS
2593 /*
2594 * It looks like Mac OS X 10.6.3 and 10.6.4 do not like Network Key in
2595 * passphrase format. To avoid interop issues, force PSK format to be
2596 * used.
2597 */
2598 if (!wps->use_psk_key &&
2599 wps->peer_dev.manufacturer &&
2600 os_strncmp(wps->peer_dev.manufacturer, "Apple ", 6) == 0 &&
2601 wps->peer_dev.model_name &&
2602 os_strcmp(wps->peer_dev.model_name, "AirPort") == 0) {
2603 wpa_printf(MSG_DEBUG, "WPS: Workaround - Force Network Key in "
2604 "PSK format");
2605 wps->use_psk_key = 1;
2606 }
2607 #endif /* WPS_WORKAROUNDS */
2608
2609 wps->state = SEND_M2;
2610 return WPS_CONTINUE;
2611 }
2612
2613
wps_process_m3(struct wps_data * wps,const struct wpabuf * msg,struct wps_parse_attr * attr)2614 static enum wps_process_res wps_process_m3(struct wps_data *wps,
2615 const struct wpabuf *msg,
2616 struct wps_parse_attr *attr)
2617 {
2618 wpa_printf(MSG_DEBUG, "WPS: Received M3");
2619
2620 if (wps->state != RECV_M3) {
2621 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2622 "receiving M3", wps->state);
2623 wps->state = SEND_WSC_NACK;
2624 return WPS_CONTINUE;
2625 }
2626
2627 if (wps->pbc && wps->wps->registrar->force_pbc_overlap &&
2628 !wps_registrar_skip_overlap(wps)) {
2629 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2630 "session overlap");
2631 wps->state = SEND_WSC_NACK;
2632 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2633 return WPS_CONTINUE;
2634 }
2635
2636 if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2637 wps_process_authenticator(wps, attr->authenticator, msg) ||
2638 wps_process_e_hash1(wps, attr->e_hash1) ||
2639 wps_process_e_hash2(wps, attr->e_hash2)) {
2640 wps->state = SEND_WSC_NACK;
2641 return WPS_CONTINUE;
2642 }
2643
2644 wps->state = SEND_M4;
2645 return WPS_CONTINUE;
2646 }
2647
2648
wps_process_m5(struct wps_data * wps,const struct wpabuf * msg,struct wps_parse_attr * attr)2649 static enum wps_process_res wps_process_m5(struct wps_data *wps,
2650 const struct wpabuf *msg,
2651 struct wps_parse_attr *attr)
2652 {
2653 struct wpabuf *decrypted;
2654 struct wps_parse_attr eattr;
2655
2656 wpa_printf(MSG_DEBUG, "WPS: Received M5");
2657
2658 if (wps->state != RECV_M5) {
2659 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2660 "receiving M5", wps->state);
2661 wps->state = SEND_WSC_NACK;
2662 return WPS_CONTINUE;
2663 }
2664
2665 if (wps->pbc && wps->wps->registrar->force_pbc_overlap &&
2666 !wps_registrar_skip_overlap(wps)) {
2667 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2668 "session overlap");
2669 wps->state = SEND_WSC_NACK;
2670 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2671 return WPS_CONTINUE;
2672 }
2673
2674 if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2675 wps_process_authenticator(wps, attr->authenticator, msg)) {
2676 wps->state = SEND_WSC_NACK;
2677 return WPS_CONTINUE;
2678 }
2679
2680 decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2681 attr->encr_settings_len);
2682 if (decrypted == NULL) {
2683 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypted Encrypted "
2684 "Settings attribute");
2685 wps->state = SEND_WSC_NACK;
2686 return WPS_CONTINUE;
2687 }
2688
2689 if (wps_validate_m5_encr(decrypted, attr->version2 != NULL) < 0) {
2690 wpabuf_free(decrypted);
2691 wps->state = SEND_WSC_NACK;
2692 return WPS_CONTINUE;
2693 }
2694
2695 wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2696 "attribute");
2697 if (wps_parse_msg(decrypted, &eattr) < 0 ||
2698 wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2699 wps_process_e_snonce1(wps, eattr.e_snonce1)) {
2700 wpabuf_free(decrypted);
2701 wps->state = SEND_WSC_NACK;
2702 return WPS_CONTINUE;
2703 }
2704 wpabuf_free(decrypted);
2705
2706 wps->state = SEND_M6;
2707 return WPS_CONTINUE;
2708 }
2709
2710
wps_sta_cred_cb(struct wps_data * wps)2711 static void wps_sta_cred_cb(struct wps_data *wps)
2712 {
2713 /*
2714 * Update credential to only include a single authentication and
2715 * encryption type in case the AP configuration includes more than one
2716 * option.
2717 */
2718 if (wps->cred.auth_type & WPS_AUTH_WPA2PSK)
2719 wps->cred.auth_type = WPS_AUTH_WPA2PSK;
2720 else if (wps->cred.auth_type & WPS_AUTH_WPAPSK)
2721 wps->cred.auth_type = WPS_AUTH_WPAPSK;
2722 if (wps->cred.encr_type & WPS_ENCR_AES)
2723 wps->cred.encr_type = WPS_ENCR_AES;
2724 else if (wps->cred.encr_type & WPS_ENCR_TKIP)
2725 wps->cred.encr_type = WPS_ENCR_TKIP;
2726 wpa_printf(MSG_DEBUG, "WPS: Update local configuration based on the "
2727 "AP configuration");
2728 if (wps->wps->cred_cb)
2729 wps->wps->cred_cb(wps->wps->cb_ctx, &wps->cred);
2730 }
2731
2732
wps_cred_update(struct wps_credential * dst,struct wps_credential * src)2733 static void wps_cred_update(struct wps_credential *dst,
2734 struct wps_credential *src)
2735 {
2736 os_memcpy(dst->ssid, src->ssid, sizeof(dst->ssid));
2737 dst->ssid_len = src->ssid_len;
2738 dst->auth_type = src->auth_type;
2739 dst->encr_type = src->encr_type;
2740 dst->key_idx = src->key_idx;
2741 os_memcpy(dst->key, src->key, sizeof(dst->key));
2742 dst->key_len = src->key_len;
2743 }
2744
2745
wps_process_ap_settings_r(struct wps_data * wps,struct wps_parse_attr * attr)2746 static int wps_process_ap_settings_r(struct wps_data *wps,
2747 struct wps_parse_attr *attr)
2748 {
2749 struct wpabuf *msg;
2750
2751 if (wps->wps->ap || wps->er)
2752 return 0;
2753
2754 /* AP Settings Attributes in M7 when Enrollee is an AP */
2755 if (wps_process_ap_settings(attr, &wps->cred) < 0)
2756 return -1;
2757
2758 wpa_printf(MSG_INFO, "WPS: Received old AP configuration from AP");
2759
2760 if (wps->new_ap_settings) {
2761 wpa_printf(MSG_INFO, "WPS: Update AP configuration based on "
2762 "new settings");
2763 wps_cred_update(&wps->cred, wps->new_ap_settings);
2764 return 0;
2765 } else {
2766 #ifdef CONFIG_WPS_PIN
2767 /*
2768 * Use the AP PIN only to receive the current AP settings, not
2769 * to reconfigure the AP.
2770 */
2771
2772 /*
2773 * Clear selected registrar here since we do not get to
2774 * WSC_Done in this protocol run.
2775 */
2776 wps_registrar_pin_completed(wps->wps->registrar);
2777 #endif
2778 msg = wps_build_ap_cred(wps);
2779 if (msg == NULL)
2780 return -1;
2781 wps->cred.cred_attr = wpabuf_head(msg);
2782 wps->cred.cred_attr_len = wpabuf_len(msg);
2783
2784 if (wps->ap_settings_cb) {
2785 wps->ap_settings_cb(wps->ap_settings_cb_ctx,
2786 &wps->cred);
2787 wpabuf_free(msg);
2788 return 1;
2789 }
2790 wps_sta_cred_cb(wps);
2791
2792 wps->cred.cred_attr = NULL;
2793 wps->cred.cred_attr_len = 0;
2794 wpabuf_free(msg);
2795
2796 return 1;
2797 }
2798 }
2799
2800
wps_process_m7(struct wps_data * wps,const struct wpabuf * msg,struct wps_parse_attr * attr)2801 static enum wps_process_res wps_process_m7(struct wps_data *wps,
2802 const struct wpabuf *msg,
2803 struct wps_parse_attr *attr)
2804 {
2805 struct wpabuf *decrypted;
2806 struct wps_parse_attr eattr;
2807
2808 wpa_printf(MSG_DEBUG, "WPS: Received M7");
2809
2810 if (wps->state != RECV_M7) {
2811 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
2812 "receiving M7", wps->state);
2813 wps->state = SEND_WSC_NACK;
2814 return WPS_CONTINUE;
2815 }
2816
2817 if (wps->pbc && wps->wps->registrar->force_pbc_overlap &&
2818 !wps_registrar_skip_overlap(wps)) {
2819 wpa_printf(MSG_DEBUG, "WPS: Reject negotiation due to PBC "
2820 "session overlap");
2821 wps->state = SEND_WSC_NACK;
2822 wps->config_error = WPS_CFG_MULTIPLE_PBC_DETECTED;
2823 return WPS_CONTINUE;
2824 }
2825
2826 if (wps_process_registrar_nonce(wps, attr->registrar_nonce) ||
2827 wps_process_authenticator(wps, attr->authenticator, msg)) {
2828 wps->state = SEND_WSC_NACK;
2829 return WPS_CONTINUE;
2830 }
2831
2832 decrypted = wps_decrypt_encr_settings(wps, attr->encr_settings,
2833 attr->encr_settings_len);
2834 if (decrypted == NULL) {
2835 wpa_printf(MSG_DEBUG, "WPS: Failed to decrypt Encrypted "
2836 "Settings attribute");
2837 wps->state = SEND_WSC_NACK;
2838 return WPS_CONTINUE;
2839 }
2840
2841 if (wps_validate_m7_encr(decrypted, wps->wps->ap || wps->er,
2842 attr->version2 != NULL) < 0) {
2843 wpabuf_free(decrypted);
2844 wps->state = SEND_WSC_NACK;
2845 return WPS_CONTINUE;
2846 }
2847
2848 wpa_printf(MSG_DEBUG, "WPS: Processing decrypted Encrypted Settings "
2849 "attribute");
2850 if (wps_parse_msg(decrypted, &eattr) < 0 ||
2851 wps_process_key_wrap_auth(wps, decrypted, eattr.key_wrap_auth) ||
2852 wps_process_e_snonce2(wps, eattr.e_snonce2) ||
2853 wps_process_ap_settings_r(wps, &eattr)) {
2854 wpabuf_free(decrypted);
2855 wps->state = SEND_WSC_NACK;
2856 return WPS_CONTINUE;
2857 }
2858
2859 wpabuf_free(decrypted);
2860
2861 wps->state = SEND_M8;
2862 return WPS_CONTINUE;
2863 }
2864
2865
wps_process_wsc_msg(struct wps_data * wps,const struct wpabuf * msg)2866 static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,
2867 const struct wpabuf *msg)
2868 {
2869 struct wps_parse_attr attr;
2870 enum wps_process_res ret = WPS_CONTINUE;
2871
2872 wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");
2873
2874 if (wps_parse_msg(msg, &attr) < 0)
2875 return WPS_FAILURE;
2876
2877 if (attr.msg_type == NULL) {
2878 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2879 wps->state = SEND_WSC_NACK;
2880 return WPS_CONTINUE;
2881 }
2882
2883 if (*attr.msg_type != WPS_M1 &&
2884 (attr.registrar_nonce == NULL ||
2885 os_memcmp(wps->nonce_r, attr.registrar_nonce,
2886 WPS_NONCE_LEN) != 0)) {
2887 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2888 return WPS_FAILURE;
2889 }
2890
2891 switch (*attr.msg_type) {
2892 case WPS_M1:
2893 if (wps_validate_m1(msg) < 0)
2894 return WPS_FAILURE;
2895 #ifdef CONFIG_WPS_UPNP
2896 if (wps->wps->wps_upnp && attr.mac_addr) {
2897 /* Remove old pending messages when starting new run */
2898 wps_free_pending_msgs(wps->wps->upnp_msgs);
2899 wps->wps->upnp_msgs = NULL;
2900
2901 upnp_wps_device_send_wlan_event(
2902 wps->wps->wps_upnp, attr.mac_addr,
2903 UPNP_WPS_WLANEVENT_TYPE_EAP, msg);
2904 }
2905 #endif /* CONFIG_WPS_UPNP */
2906 ret = wps_process_m1(wps, &attr);
2907 break;
2908 case WPS_M3:
2909 if (wps_validate_m3(msg) < 0)
2910 return WPS_FAILURE;
2911 ret = wps_process_m3(wps, msg, &attr);
2912 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2913 wps_fail_event(wps->wps, WPS_M3, wps->config_error,
2914 wps->error_indication);
2915 break;
2916 case WPS_M5:
2917 if (wps_validate_m5(msg) < 0)
2918 return WPS_FAILURE;
2919 ret = wps_process_m5(wps, msg, &attr);
2920 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2921 wps_fail_event(wps->wps, WPS_M5, wps->config_error,
2922 wps->error_indication);
2923 break;
2924 case WPS_M7:
2925 if (wps_validate_m7(msg) < 0)
2926 return WPS_FAILURE;
2927 ret = wps_process_m7(wps, msg, &attr);
2928 if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)
2929 wps_fail_event(wps->wps, WPS_M7, wps->config_error,
2930 wps->error_indication);
2931 break;
2932 default:
2933 wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",
2934 *attr.msg_type);
2935 return WPS_FAILURE;
2936 }
2937
2938 if (ret == WPS_CONTINUE) {
2939 /* Save a copy of the last message for Authenticator derivation
2940 */
2941 wpabuf_free(wps->last_msg);
2942 wps->last_msg = wpabuf_dup(msg);
2943 }
2944
2945 return ret;
2946 }
2947
2948
wps_process_wsc_ack(struct wps_data * wps,const struct wpabuf * msg)2949 static enum wps_process_res wps_process_wsc_ack(struct wps_data *wps,
2950 const struct wpabuf *msg)
2951 {
2952 struct wps_parse_attr attr;
2953
2954 wpa_printf(MSG_DEBUG, "WPS: Received WSC_ACK");
2955
2956 if (wps_parse_msg(msg, &attr) < 0)
2957 return WPS_FAILURE;
2958
2959 if (attr.msg_type == NULL) {
2960 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
2961 return WPS_FAILURE;
2962 }
2963
2964 if (*attr.msg_type != WPS_WSC_ACK) {
2965 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
2966 *attr.msg_type);
2967 return WPS_FAILURE;
2968 }
2969
2970 #ifdef CONFIG_WPS_UPNP
2971 if (wps->wps->wps_upnp && wps->ext_reg && wps->state == RECV_M2D_ACK &&
2972 upnp_wps_subscribers(wps->wps->wps_upnp)) {
2973 if (wps->wps->upnp_msgs)
2974 return WPS_CONTINUE;
2975 wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
2976 "external Registrar");
2977 return WPS_PENDING;
2978 }
2979 #endif /* CONFIG_WPS_UPNP */
2980
2981 if (attr.registrar_nonce == NULL ||
2982 os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN) != 0)
2983 {
2984 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
2985 return WPS_FAILURE;
2986 }
2987
2988 if (attr.enrollee_nonce == NULL ||
2989 os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN) != 0) {
2990 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
2991 return WPS_FAILURE;
2992 }
2993
2994 if (wps->state == RECV_M2D_ACK) {
2995 #ifdef CONFIG_WPS_UPNP
2996 if (wps->wps->wps_upnp &&
2997 upnp_wps_subscribers(wps->wps->wps_upnp)) {
2998 if (wps->wps->upnp_msgs)
2999 return WPS_CONTINUE;
3000 if (wps->ext_reg == 0)
3001 wps->ext_reg = 1;
3002 wpa_printf(MSG_DEBUG, "WPS: Wait for response from an "
3003 "external Registrar");
3004 return WPS_PENDING;
3005 }
3006 #endif /* CONFIG_WPS_UPNP */
3007
3008 wpa_printf(MSG_DEBUG, "WPS: No more registrars available - "
3009 "terminate negotiation");
3010 }
3011
3012 return WPS_FAILURE;
3013 }
3014
3015
wps_process_wsc_nack(struct wps_data * wps,const struct wpabuf * msg)3016 static enum wps_process_res wps_process_wsc_nack(struct wps_data *wps,
3017 const struct wpabuf *msg)
3018 {
3019 struct wps_parse_attr attr;
3020 int old_state;
3021 u16 config_error;
3022
3023 wpa_printf(MSG_DEBUG, "WPS: Received WSC_NACK");
3024
3025 old_state = wps->state;
3026 wps->state = SEND_WSC_NACK;
3027
3028 if (wps_parse_msg(msg, &attr) < 0)
3029 return WPS_FAILURE;
3030
3031 if (attr.msg_type == NULL) {
3032 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
3033 return WPS_FAILURE;
3034 }
3035
3036 if (*attr.msg_type != WPS_WSC_NACK) {
3037 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
3038 *attr.msg_type);
3039 return WPS_FAILURE;
3040 }
3041
3042 #ifdef CONFIG_WPS_UPNP
3043 if (wps->wps->wps_upnp && wps->ext_reg) {
3044 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
3045 "Registrar terminated by the Enrollee");
3046 return WPS_FAILURE;
3047 }
3048 #endif /* CONFIG_WPS_UPNP */
3049
3050 if (attr.registrar_nonce == NULL ||
3051 os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN) != 0)
3052 {
3053 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
3054 return WPS_FAILURE;
3055 }
3056
3057 if (attr.enrollee_nonce == NULL ||
3058 os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN) != 0) {
3059 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
3060 return WPS_FAILURE;
3061 }
3062
3063 if (attr.config_error == NULL) {
3064 wpa_printf(MSG_DEBUG, "WPS: No Configuration Error attribute "
3065 "in WSC_NACK");
3066 return WPS_FAILURE;
3067 }
3068
3069 config_error = WPA_GET_BE16(attr.config_error);
3070 wpa_printf(MSG_DEBUG, "WPS: Enrollee terminated negotiation with "
3071 "Configuration Error %d", config_error);
3072
3073 switch (old_state) {
3074 case RECV_M3:
3075 wps_fail_event(wps->wps, WPS_M2, config_error,
3076 wps->error_indication);
3077 break;
3078 case RECV_M5:
3079 wps_fail_event(wps->wps, WPS_M4, config_error,
3080 wps->error_indication);
3081 break;
3082 case RECV_M7:
3083 wps_fail_event(wps->wps, WPS_M6, config_error,
3084 wps->error_indication);
3085 break;
3086 case RECV_DONE:
3087 wps_fail_event(wps->wps, WPS_M8, config_error,
3088 wps->error_indication);
3089 break;
3090 default:
3091 break;
3092 }
3093
3094 return WPS_FAILURE;
3095 }
3096
3097
wps_process_wsc_done(struct wps_data * wps,const struct wpabuf * msg)3098 static enum wps_process_res wps_process_wsc_done(struct wps_data *wps,
3099 const struct wpabuf *msg)
3100 {
3101 struct wps_parse_attr attr;
3102
3103 wpa_printf(MSG_DEBUG, "WPS: Received WSC_Done");
3104
3105 if (wps->state != RECV_DONE && (!wps->ext_reg)){
3106 wpa_printf(MSG_DEBUG, "WPS: Unexpected state (%d) for "
3107 "receiving WSC_Done", wps->state);
3108 return WPS_FAILURE;
3109 }
3110
3111 if (wps_parse_msg(msg, &attr) < 0)
3112 return WPS_FAILURE;
3113
3114 if (attr.msg_type == NULL) {
3115 wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");
3116 return WPS_FAILURE;
3117 }
3118
3119 if (*attr.msg_type != WPS_WSC_DONE) {
3120 wpa_printf(MSG_DEBUG, "WPS: Invalid Message Type %d",
3121 *attr.msg_type);
3122 return WPS_FAILURE;
3123 }
3124
3125 #ifdef CONFIG_WPS_UPNP
3126 if (wps->wps->wps_upnp && wps->ext_reg) {
3127 wpa_printf(MSG_DEBUG, "WPS: Negotiation using external "
3128 "Registrar completed successfully");
3129 wps_device_store(wps->wps->registrar, &wps->peer_dev,
3130 wps->uuid_e);
3131 return WPS_DONE;
3132 }
3133 #endif /* CONFIG_WPS_UPNP */
3134
3135 if (attr.registrar_nonce == NULL ||
3136 os_memcmp(wps->nonce_r, attr.registrar_nonce, WPS_NONCE_LEN) != 0)
3137 {
3138 wpa_printf(MSG_DEBUG, "WPS: Mismatch in registrar nonce");
3139 return WPS_FAILURE;
3140 }
3141
3142 if (attr.enrollee_nonce == NULL ||
3143 os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN) != 0) {
3144 wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");
3145 return WPS_FAILURE;
3146 }
3147
3148 wpa_printf(MSG_DEBUG, "WPS: Negotiation completed successfully");
3149 wps_device_store(wps->wps->registrar, &wps->peer_dev,
3150 wps->uuid_e);
3151
3152 if (wps->wps->wps_state == WPS_STATE_NOT_CONFIGURED && wps->new_psk &&
3153 wps->wps->ap && !wps->wps->registrar->disable_auto_conf) {
3154 struct wps_credential cred;
3155
3156 wpa_printf(MSG_DEBUG, "WPS: Moving to Configured state based "
3157 "on first Enrollee connection");
3158
3159 os_memset(&cred, 0, sizeof(cred));
3160 os_memcpy(cred.ssid, wps->wps->ssid, wps->wps->ssid_len);
3161 cred.ssid_len = wps->wps->ssid_len;
3162 cred.auth_type = WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK;
3163 cred.encr_type = WPS_ENCR_TKIP | WPS_ENCR_AES;
3164 os_memcpy(cred.key, wps->new_psk, wps->new_psk_len);
3165 cred.key_len = wps->new_psk_len;
3166
3167 wps->wps->wps_state = WPS_STATE_CONFIGURED;
3168 wpa_hexdump_ascii_key(MSG_DEBUG,
3169 "WPS: Generated random passphrase",
3170 wps->new_psk, wps->new_psk_len);
3171 if (wps->wps->cred_cb)
3172 wps->wps->cred_cb(wps->wps->cb_ctx, &cred);
3173
3174 os_free(wps->new_psk);
3175 wps->new_psk = NULL;
3176 }
3177
3178 if (!wps->wps->ap && !wps->er)
3179 wps_sta_cred_cb(wps);
3180
3181 if (wps->new_psk) {
3182 if (wps_cb_new_psk(wps->wps->registrar, wps->mac_addr_e,
3183 wps->new_psk, wps->new_psk_len)) {
3184 wpa_printf(MSG_DEBUG, "WPS: Failed to configure the "
3185 "new PSK");
3186 }
3187 os_free(wps->new_psk);
3188 wps->new_psk = NULL;
3189 }
3190
3191 wps_cb_reg_success(wps->wps->registrar, wps->mac_addr_e, wps->uuid_e,
3192 wps->dev_password, wps->dev_password_len);
3193
3194 if (wps->pbc) {
3195 wps_registrar_remove_pbc_session(wps->wps->registrar,
3196 wps->uuid_e,
3197 wps->p2p_dev_addr);
3198 wps_registrar_pbc_completed(wps->wps->registrar);
3199 os_get_time(&wps->wps->registrar->pbc_ignore_start);
3200 os_memcpy(wps->wps->registrar->pbc_ignore_uuid, wps->uuid_e,
3201 WPS_UUID_LEN);
3202 } else {
3203 #ifdef CONFIG_WPS_PIN
3204 wps_registrar_pin_completed(wps->wps->registrar);
3205 #endif
3206 }
3207 /* TODO: maintain AuthorizedMACs somewhere separately for each ER and
3208 * merge them into APs own list.. */
3209
3210 wps_success_event(wps->wps);
3211
3212 return WPS_DONE;
3213 }
3214
3215
wps_registrar_process_msg(struct wps_data * wps,enum wsc_op_code op_code,const struct wpabuf * msg)3216 enum wps_process_res wps_registrar_process_msg(struct wps_data *wps,
3217 enum wsc_op_code op_code,
3218 const struct wpabuf *msg)
3219 {
3220 enum wps_process_res ret;
3221
3222 wpa_printf(MSG_DEBUG, "WPS: Processing received message (len=%lu "
3223 "op_code=%d)",
3224 (unsigned long) wpabuf_len(msg), op_code);
3225
3226 #ifdef CONFIG_WPS_UPNP
3227 if (wps->wps->wps_upnp && op_code == WSC_MSG && wps->ext_reg == 1) {
3228 struct wps_parse_attr attr;
3229 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type &&
3230 *attr.msg_type == WPS_M3)
3231 wps->ext_reg = 2; /* past M2/M2D phase */
3232 }
3233 if (wps->ext_reg > 1)
3234 wps_registrar_free_pending_m2(wps->wps);
3235 if (wps->wps->wps_upnp && wps->ext_reg &&
3236 wps->wps->upnp_msgs == NULL &&
3237 (op_code == WSC_MSG || op_code == WSC_Done || op_code == WSC_NACK))
3238 {
3239 struct wps_parse_attr attr;
3240 int type;
3241 if (wps_parse_msg(msg, &attr) < 0 || attr.msg_type == NULL)
3242 type = -1;
3243 else
3244 type = *attr.msg_type;
3245 wpa_printf(MSG_DEBUG, "WPS: Sending received message (type %d)"
3246 " to external Registrar for processing", type);
3247 upnp_wps_device_send_wlan_event(wps->wps->wps_upnp,
3248 wps->mac_addr_e,
3249 UPNP_WPS_WLANEVENT_TYPE_EAP,
3250 msg);
3251 if (op_code == WSC_MSG)
3252 return WPS_PENDING;
3253 } else if (wps->wps->wps_upnp && wps->ext_reg && op_code == WSC_MSG) {
3254 wpa_printf(MSG_DEBUG, "WPS: Skip internal processing - using "
3255 "external Registrar");
3256 return WPS_CONTINUE;
3257 }
3258 #endif /* CONFIG_WPS_UPNP */
3259
3260 switch (op_code) {
3261 case WSC_MSG:
3262 return wps_process_wsc_msg(wps, msg);
3263 case WSC_ACK:
3264 if (wps_validate_wsc_ack(msg) < 0)
3265 return WPS_FAILURE;
3266 return wps_process_wsc_ack(wps, msg);
3267 case WSC_NACK:
3268 if (wps_validate_wsc_nack(msg) < 0)
3269 return WPS_FAILURE;
3270 return wps_process_wsc_nack(wps, msg);
3271 case WSC_Done:
3272 if (wps_validate_wsc_done(msg) < 0)
3273 return WPS_FAILURE;
3274 ret = wps_process_wsc_done(wps, msg);
3275 if (ret == WPS_FAILURE) {
3276 wps->state = SEND_WSC_NACK;
3277 wps_fail_event(wps->wps, WPS_WSC_DONE,
3278 wps->config_error,
3279 wps->error_indication);
3280 }
3281 return ret;
3282 default:
3283 wpa_printf(MSG_DEBUG, "WPS: Unsupported op_code %d", op_code);
3284 return WPS_FAILURE;
3285 }
3286 }
3287
3288
wps_registrar_update_ie(struct wps_registrar * reg)3289 int wps_registrar_update_ie(struct wps_registrar *reg)
3290 {
3291 return wps_set_ie(reg);
3292 }
3293
3294
3295 #ifdef CONFIG_WPS_UPNP
wps_registrar_sel_reg_add(struct wps_registrar * reg,struct subscription * s)3296 static void wps_registrar_sel_reg_add(struct wps_registrar *reg,
3297 struct subscription *s)
3298 {
3299 int i, j;
3300 wpa_printf(MSG_DEBUG, "WPS: External Registrar selected (dev_pw_id=%d "
3301 "config_methods=0x%x)",
3302 s->dev_password_id, s->config_methods);
3303 reg->sel_reg_union = 1;
3304 if (reg->sel_reg_dev_password_id_override != DEV_PW_PUSHBUTTON)
3305 reg->sel_reg_dev_password_id_override = s->dev_password_id;
3306 if (reg->sel_reg_config_methods_override == -1)
3307 reg->sel_reg_config_methods_override = 0;
3308 reg->sel_reg_config_methods_override |= s->config_methods;
3309 for (i = 0; i < WPS_MAX_AUTHORIZED_MACS; i++)
3310 if (is_zero_ether_addr(reg->authorized_macs_union[i]))
3311 break;
3312 for (j = 0; i < WPS_MAX_AUTHORIZED_MACS && j < WPS_MAX_AUTHORIZED_MACS;
3313 j++) {
3314 if (is_zero_ether_addr(s->authorized_macs[j]))
3315 break;
3316 wpa_printf(MSG_DEBUG, "WPS: Add authorized MAC into union: "
3317 MACSTR, MAC2STR(s->authorized_macs[j]));
3318 os_memcpy(reg->authorized_macs_union[i],
3319 s->authorized_macs[j], ETH_ALEN);
3320 i++;
3321 }
3322 wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs union",
3323 (u8 *) reg->authorized_macs_union,
3324 sizeof(reg->authorized_macs_union));
3325 }
3326 #endif /* CONFIG_WPS_UPNP */
3327
3328
wps_registrar_sel_reg_union(struct wps_registrar * reg)3329 static void wps_registrar_sel_reg_union(struct wps_registrar *reg)
3330 {
3331 #ifdef CONFIG_WPS_UPNP
3332 struct subscription *s;
3333
3334 if (reg->wps->wps_upnp == NULL)
3335 return;
3336
3337 dl_list_for_each(s, ®->wps->wps_upnp->subscriptions,
3338 struct subscription, list) {
3339 struct subscr_addr *sa;
3340 sa = dl_list_first(&s->addr_list, struct subscr_addr, list);
3341 if (sa) {
3342 wpa_printf(MSG_DEBUG, "WPS: External Registrar %s:%d",
3343 inet_ntoa(sa->saddr.sin_addr),
3344 ntohs(sa->saddr.sin_port));
3345 }
3346 if (s->selected_registrar)
3347 wps_registrar_sel_reg_add(reg, s);
3348 else
3349 wpa_printf(MSG_DEBUG, "WPS: External Registrar not "
3350 "selected");
3351 }
3352 #endif /* CONFIG_WPS_UPNP */
3353 }
3354
3355
3356 /**
3357 * wps_registrar_selected_registrar_changed - SetSelectedRegistrar change
3358 * @reg: Registrar data from wps_registrar_init()
3359 *
3360 * This function is called when selected registrar state changes, e.g., when an
3361 * AP receives a SetSelectedRegistrar UPnP message.
3362 */
wps_registrar_selected_registrar_changed(struct wps_registrar * reg)3363 void wps_registrar_selected_registrar_changed(struct wps_registrar *reg)
3364 {
3365 wpa_printf(MSG_DEBUG, "WPS: Selected registrar information changed");
3366
3367 reg->sel_reg_union = reg->selected_registrar;
3368 reg->sel_reg_dev_password_id_override = -1;
3369 reg->sel_reg_config_methods_override = -1;
3370 os_memcpy(reg->authorized_macs_union, reg->authorized_macs,
3371 WPS_MAX_AUTHORIZED_MACS * ETH_ALEN);
3372 wpa_hexdump(MSG_DEBUG, "WPS: Authorized MACs union (start with own)",
3373 (u8 *) reg->authorized_macs_union,
3374 sizeof(reg->authorized_macs_union));
3375 if (reg->selected_registrar) {
3376 u16 methods;
3377
3378 methods = reg->wps->config_methods & ~WPS_CONFIG_PUSHBUTTON;
3379 #ifdef CONFIG_WPS2
3380 methods &= ~(WPS_CONFIG_VIRT_PUSHBUTTON |
3381 WPS_CONFIG_PHY_PUSHBUTTON);
3382 #endif /* CONFIG_WPS2 */
3383 if (reg->pbc) {
3384 reg->sel_reg_dev_password_id_override =
3385 DEV_PW_PUSHBUTTON;
3386 wps_set_pushbutton(&methods, reg->wps->config_methods);
3387 }
3388 wpa_printf(MSG_DEBUG, "WPS: Internal Registrar selected "
3389 "(pbc=%d)", reg->pbc);
3390 reg->sel_reg_config_methods_override = methods;
3391 } else {
3392 wpa_printf(MSG_DEBUG, "WPS: Internal Registrar not selected");
3393 return;
3394 }
3395
3396 wps_registrar_sel_reg_union(reg);
3397
3398 wps_set_ie(reg);
3399 wps_cb_set_sel_reg(reg);
3400 }
3401
3402
wps_registrar_get_info(struct wps_registrar * reg,const u8 * addr,char * buf,size_t buflen)3403 int wps_registrar_get_info(struct wps_registrar *reg, const u8 *addr,
3404 char *buf, size_t buflen)
3405 {
3406 struct wps_registrar_device *d;
3407 int len = 0, ret;
3408 char uuid[40];
3409 char devtype[WPS_DEV_TYPE_BUFSIZE];
3410
3411 d = wps_device_get(reg, addr);
3412 if (d == NULL)
3413 return 0;
3414 if (uuid_bin2str(d->uuid, uuid, sizeof(uuid)))
3415 return 0;
3416
3417 ret = snprintf(buf + len, buflen - len,
3418 "wpsUuid=%s\n"
3419 "wpsPrimaryDeviceType=%s\n"
3420 "wpsDeviceName=%s\n"
3421 "wpsManufacturer=%s\n"
3422 "wpsModelName=%s\n"
3423 "wpsModelNumber=%s\n"
3424 "wpsSerialNumber=%s\n",
3425 uuid,
3426 wps_dev_type_bin2str(d->dev.pri_dev_type, devtype,
3427 sizeof(devtype)),
3428 d->dev.device_name ? d->dev.device_name : "",
3429 d->dev.manufacturer ? d->dev.manufacturer : "",
3430 d->dev.model_name ? d->dev.model_name : "",
3431 d->dev.model_number ? d->dev.model_number : "",
3432 d->dev.serial_number ? d->dev.serial_number : "");
3433 if (ret < 0 || (size_t) ret >= buflen - len)
3434 return len;
3435 len += ret;
3436
3437 return len;
3438 }
3439
3440
wps_registrar_config_ap(struct wps_registrar * reg,struct wps_credential * cred)3441 int wps_registrar_config_ap(struct wps_registrar *reg,
3442 struct wps_credential *cred)
3443 {
3444 #ifdef CONFIG_WPS2
3445 if (!(cred->encr_type & (WPS_ENCR_NONE | WPS_ENCR_TKIP |
3446 WPS_ENCR_AES))) {
3447 if (cred->encr_type & WPS_ENCR_WEP) {
3448 wpa_printf(MSG_INFO, "WPS: Reject new AP settings "
3449 "due to WEP configuration");
3450 return -1;
3451 }
3452
3453 wpa_printf(MSG_INFO, "WPS: Reject new AP settings due to "
3454 "invalid encr_type 0x%x", cred->encr_type);
3455 return -1;
3456 }
3457
3458 if ((cred->encr_type & (WPS_ENCR_TKIP | WPS_ENCR_AES)) ==
3459 WPS_ENCR_TKIP) {
3460 wpa_printf(MSG_DEBUG, "WPS: Upgrade encr_type TKIP -> "
3461 "TKIP+AES");
3462 cred->encr_type |= WPS_ENCR_AES;
3463 }
3464
3465 if ((cred->auth_type & (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) ==
3466 WPS_AUTH_WPAPSK) {
3467 wpa_printf(MSG_DEBUG, "WPS: Upgrade auth_type WPAPSK -> "
3468 "WPAPSK+WPA2PSK");
3469 cred->auth_type |= WPS_AUTH_WPA2PSK;
3470 }
3471 #endif /* CONFIG_WPS2 */
3472
3473 if (reg->wps->cred_cb)
3474 return reg->wps->cred_cb(reg->wps->cb_ctx, cred);
3475
3476 return -1;
3477 }
3478
3479
3480 #ifdef CONFIG_WPS_NFC
3481
wps_registrar_add_nfc_pw_token(struct wps_registrar * reg,const u8 * pubkey_hash,u16 pw_id,const u8 * dev_pw,size_t dev_pw_len)3482 int wps_registrar_add_nfc_pw_token(struct wps_registrar *reg,
3483 const u8 *pubkey_hash, u16 pw_id,
3484 const u8 *dev_pw, size_t dev_pw_len)
3485 {
3486 struct wps_nfc_pw_token *token;
3487
3488 if (dev_pw_len > WPS_OOB_DEVICE_PASSWORD_LEN)
3489 return -1;
3490
3491 wps_free_nfc_pw_tokens(®->nfc_pw_tokens, pw_id);
3492
3493 token = os_zalloc(sizeof(*token));
3494 if (token == NULL)
3495 return -1;
3496
3497 os_memcpy(token->pubkey_hash, pubkey_hash, WPS_OOB_PUBKEY_HASH_LEN);
3498 token->pw_id = pw_id;
3499 os_memcpy(token->dev_pw, dev_pw, dev_pw_len);
3500 token->dev_pw_len = dev_pw_len;
3501
3502 dl_list_add(®->nfc_pw_tokens, &token->list);
3503
3504 reg->selected_registrar = 1;
3505 reg->pbc = 0;
3506 wps_registrar_add_authorized_mac(reg,
3507 (u8 *) "\xff\xff\xff\xff\xff\xff");
3508 wps_registrar_selected_registrar_changed(reg);
3509 return 0;
3510 }
3511
3512
wps_registrar_add_nfc_password_token(struct wps_registrar * reg,const u8 * oob_dev_pw,size_t oob_dev_pw_len)3513 int wps_registrar_add_nfc_password_token(struct wps_registrar *reg,
3514 const u8 *oob_dev_pw,
3515 size_t oob_dev_pw_len)
3516 {
3517 const u8 *pos, *hash, *dev_pw;
3518 u16 id;
3519 size_t dev_pw_len;
3520
3521 if (oob_dev_pw_len < WPS_OOB_PUBKEY_HASH_LEN + 2 +
3522 WPS_OOB_DEVICE_PASSWORD_MIN_LEN ||
3523 oob_dev_pw_len > WPS_OOB_PUBKEY_HASH_LEN + 2 +
3524 WPS_OOB_DEVICE_PASSWORD_LEN)
3525 return -1;
3526
3527 hash = oob_dev_pw;
3528 pos = oob_dev_pw + WPS_OOB_PUBKEY_HASH_LEN;
3529 id = WPA_GET_BE16(pos);
3530 dev_pw = pos + 2;
3531 dev_pw_len = oob_dev_pw + oob_dev_pw_len - dev_pw;
3532
3533 wpa_printf(MSG_DEBUG, "WPS: Add NFC Password Token for Password ID %u",
3534 id);
3535
3536 wpa_hexdump(MSG_DEBUG, "WPS: Public Key Hash",
3537 hash, WPS_OOB_PUBKEY_HASH_LEN);
3538 wpa_hexdump_key(MSG_DEBUG, "WPS: Device Password", dev_pw, dev_pw_len);
3539
3540 return wps_registrar_add_nfc_pw_token(reg, hash, id, dev_pw,
3541 dev_pw_len);
3542 }
3543
3544
wps_registrar_remove_nfc_pw_token(struct wps_registrar * reg,struct wps_nfc_pw_token * token)3545 void wps_registrar_remove_nfc_pw_token(struct wps_registrar *reg,
3546 struct wps_nfc_pw_token *token)
3547 {
3548 wps_registrar_remove_authorized_mac(reg,
3549 (u8 *) "\xff\xff\xff\xff\xff\xff");
3550 wps_registrar_selected_registrar_changed(reg);
3551 }
3552
3553 #endif /* CONFIG_WPS_NFC */
3554
