2 * Wi-Fi Protected Setup - Registrar
3 * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "utils/base64.h"
19 #include "utils/eloop.h"
20 #include "utils/uuid.h"
21 #include "utils/list.h"
22 #include "crypto/crypto.h"
23 #include "crypto/sha256.h"
24 #include "crypto/random.h"
25 #include "common/ieee802_11_defs.h"
27 #include "wps_dev_attr.h"
29 #include "wps_upnp_i.h"
31 #ifndef CONFIG_WPS_STRICT
32 #define WPS_WORKAROUNDS
33 #endif /* CONFIG_WPS_STRICT */
37 u8 uuid
[WPS_UUID_LEN
];
41 #define PIN_LOCKED BIT(0)
42 #define PIN_EXPIRES BIT(1)
44 struct os_time expiration
;
45 u8 enrollee_addr
[ETH_ALEN
];
49 static void wps_free_pin(struct wps_uuid_pin
*pin
)
56 static void wps_remove_pin(struct wps_uuid_pin
*pin
)
58 dl_list_del(&pin
->list
);
63 static void wps_free_pins(struct dl_list
*pins
)
65 struct wps_uuid_pin
*pin
, *prev
;
66 dl_list_for_each_safe(pin
, prev
, pins
, struct wps_uuid_pin
, list
)
71 struct wps_pbc_session
{
72 struct wps_pbc_session
*next
;
74 u8 uuid_e
[WPS_UUID_LEN
];
75 struct os_time timestamp
;
79 static void wps_free_pbc_sessions(struct wps_pbc_session
*pbc
)
81 struct wps_pbc_session
*prev
;
91 struct wps_registrar_device
{
92 struct wps_registrar_device
*next
;
93 struct wps_device_data dev
;
94 u8 uuid
[WPS_UUID_LEN
];
98 struct wps_registrar
{
99 struct wps_context
*wps
;
102 int selected_registrar
;
104 int (*new_psk_cb
)(void *ctx
, const u8
*mac_addr
, const u8
*psk
,
106 int (*set_ie_cb
)(void *ctx
, struct wpabuf
*beacon_ie
,
107 struct wpabuf
*probe_resp_ie
);
108 void (*pin_needed_cb
)(void *ctx
, const u8
*uuid_e
,
109 const struct wps_device_data
*dev
);
110 void (*reg_success_cb
)(void *ctx
, const u8
*mac_addr
,
112 void (*set_sel_reg_cb
)(void *ctx
, int sel_reg
, u16 dev_passwd_id
,
113 u16 sel_reg_config_methods
);
114 void (*enrollee_seen_cb
)(void *ctx
, const u8
*addr
, const u8
*uuid_e
,
115 const u8
*pri_dev_type
, u16 config_methods
,
116 u16 dev_password_id
, u8 request_type
,
117 const char *dev_name
);
121 struct wps_pbc_session
*pbc_sessions
;
124 struct wpabuf
*extra_cred
;
125 int disable_auto_conf
;
127 int sel_reg_dev_password_id_override
;
128 int sel_reg_config_methods_override
;
132 struct wps_registrar_device
*devices
;
134 int force_pbc_overlap
;
136 u8 authorized_macs
[WPS_MAX_AUTHORIZED_MACS
][ETH_ALEN
];
137 u8 authorized_macs_union
[WPS_MAX_AUTHORIZED_MACS
][ETH_ALEN
];
139 u8 p2p_dev_addr
[ETH_ALEN
];
143 static int wps_set_ie(struct wps_registrar
*reg
);
144 static void wps_registrar_pbc_timeout(void *eloop_ctx
, void *timeout_ctx
);
145 static void wps_registrar_set_selected_timeout(void *eloop_ctx
,
149 static void wps_registrar_add_authorized_mac(struct wps_registrar
*reg
,
153 wpa_printf(MSG_DEBUG
, "WPS: Add authorized MAC " MACSTR
,
155 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++)
156 if (os_memcmp(reg
->authorized_macs
[i
], addr
, ETH_ALEN
) == 0) {
157 wpa_printf(MSG_DEBUG
, "WPS: Authorized MAC was "
158 "already in the list");
159 return; /* already in list */
161 for (i
= WPS_MAX_AUTHORIZED_MACS
- 1; i
> 0; i
--)
162 os_memcpy(reg
->authorized_macs
[i
], reg
->authorized_macs
[i
- 1],
164 os_memcpy(reg
->authorized_macs
[0], addr
, ETH_ALEN
);
165 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs",
166 (u8
*) reg
->authorized_macs
, sizeof(reg
->authorized_macs
));
170 static void wps_registrar_remove_authorized_mac(struct wps_registrar
*reg
,
174 wpa_printf(MSG_DEBUG
, "WPS: Remove authorized MAC " MACSTR
,
176 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++) {
177 if (os_memcmp(reg
->authorized_macs
, addr
, ETH_ALEN
) == 0)
180 if (i
== WPS_MAX_AUTHORIZED_MACS
) {
181 wpa_printf(MSG_DEBUG
, "WPS: Authorized MAC was not in the "
183 return; /* not in the list */
185 for (; i
+ 1 < WPS_MAX_AUTHORIZED_MACS
; i
++)
186 os_memcpy(reg
->authorized_macs
[i
], reg
->authorized_macs
[i
+ 1],
188 os_memset(reg
->authorized_macs
[WPS_MAX_AUTHORIZED_MACS
- 1], 0,
190 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs",
191 (u8
*) reg
->authorized_macs
, sizeof(reg
->authorized_macs
));
195 static void wps_free_devices(struct wps_registrar_device
*dev
)
197 struct wps_registrar_device
*prev
;
202 wps_device_data_free(&prev
->dev
);
208 static struct wps_registrar_device
* wps_device_get(struct wps_registrar
*reg
,
211 struct wps_registrar_device
*dev
;
213 for (dev
= reg
->devices
; dev
; dev
= dev
->next
) {
214 if (os_memcmp(dev
->dev
.mac_addr
, addr
, ETH_ALEN
) == 0)
221 static void wps_device_clone_data(struct wps_device_data
*dst
,
222 struct wps_device_data
*src
)
224 os_memcpy(dst
->mac_addr
, src
->mac_addr
, ETH_ALEN
);
225 os_memcpy(dst
->pri_dev_type
, src
->pri_dev_type
, WPS_DEV_TYPE_LEN
);
227 #define WPS_STRDUP(n) \
229 dst->n = src->n ? os_strdup(src->n) : NULL
231 WPS_STRDUP(device_name
);
232 WPS_STRDUP(manufacturer
);
233 WPS_STRDUP(model_name
);
234 WPS_STRDUP(model_number
);
235 WPS_STRDUP(serial_number
);
240 int wps_device_store(struct wps_registrar
*reg
,
241 struct wps_device_data
*dev
, const u8
*uuid
)
243 struct wps_registrar_device
*d
;
245 d
= wps_device_get(reg
, dev
->mac_addr
);
247 d
= os_zalloc(sizeof(*d
));
250 d
->next
= reg
->devices
;
254 wps_device_clone_data(&d
->dev
, dev
);
255 os_memcpy(d
->uuid
, uuid
, WPS_UUID_LEN
);
261 static void wps_registrar_add_pbc_session(struct wps_registrar
*reg
,
262 const u8
*addr
, const u8
*uuid_e
)
264 struct wps_pbc_session
*pbc
, *prev
= NULL
;
269 pbc
= reg
->pbc_sessions
;
271 if (os_memcmp(pbc
->addr
, addr
, ETH_ALEN
) == 0 &&
272 os_memcmp(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
) == 0) {
274 prev
->next
= pbc
->next
;
276 reg
->pbc_sessions
= pbc
->next
;
284 pbc
= os_zalloc(sizeof(*pbc
));
287 os_memcpy(pbc
->addr
, addr
, ETH_ALEN
);
289 os_memcpy(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
);
292 pbc
->next
= reg
->pbc_sessions
;
293 reg
->pbc_sessions
= pbc
;
294 pbc
->timestamp
= now
;
296 /* remove entries that have timed out */
301 if (now
.sec
> pbc
->timestamp
.sec
+ WPS_PBC_WALK_TIME
) {
303 wps_free_pbc_sessions(pbc
);
312 static void wps_registrar_remove_pbc_session(struct wps_registrar
*reg
,
315 struct wps_pbc_session
*pbc
, *prev
= NULL
, *tmp
;
317 pbc
= reg
->pbc_sessions
;
319 if (os_memcmp(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
) == 0) {
321 prev
->next
= pbc
->next
;
323 reg
->pbc_sessions
= pbc
->next
;
326 wpa_printf(MSG_DEBUG
, "WPS: Removing PBC session for "
327 "addr=" MACSTR
, MAC2STR(tmp
->addr
));
328 wpa_hexdump(MSG_DEBUG
, "WPS: Removed UUID-E",
329 tmp
->uuid_e
, WPS_UUID_LEN
);
339 int wps_registrar_pbc_overlap(struct wps_registrar
*reg
,
340 const u8
*addr
, const u8
*uuid_e
)
343 struct wps_pbc_session
*pbc
;
344 struct wps_pbc_session
*first
= NULL
;
349 wpa_printf(MSG_DEBUG
, "WPS: Checking active PBC sessions for overlap");
352 wpa_printf(MSG_DEBUG
, "WPS: Add one for the requested UUID");
353 wpa_hexdump(MSG_DEBUG
, "WPS: Requested UUID",
354 uuid_e
, WPS_UUID_LEN
);
358 for (pbc
= reg
->pbc_sessions
; pbc
; pbc
= pbc
->next
) {
359 wpa_printf(MSG_DEBUG
, "WPS: Consider PBC session with " MACSTR
,
361 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E",
362 pbc
->uuid_e
, WPS_UUID_LEN
);
363 if (now
.sec
> pbc
->timestamp
.sec
+ WPS_PBC_WALK_TIME
) {
364 wpa_printf(MSG_DEBUG
, "WPS: PBC walk time has "
369 os_memcmp(pbc
->uuid_e
, first
->uuid_e
, WPS_UUID_LEN
) == 0) {
370 wpa_printf(MSG_DEBUG
, "WPS: Same Enrollee");
371 continue; /* same Enrollee */
373 if (uuid_e
== NULL
||
374 os_memcmp(uuid_e
, pbc
->uuid_e
, WPS_UUID_LEN
)) {
375 wpa_printf(MSG_DEBUG
, "WPS: New Enrollee");
382 wpa_printf(MSG_DEBUG
, "WPS: %u active PBC session(s) found", count
);
384 return count
> 1 ? 1 : 0;
388 static int wps_build_wps_state(struct wps_context
*wps
, struct wpabuf
*msg
)
390 wpa_printf(MSG_DEBUG
, "WPS: * Wi-Fi Protected Setup State (%d)",
392 wpabuf_put_be16(msg
, ATTR_WPS_STATE
);
393 wpabuf_put_be16(msg
, 1);
394 wpabuf_put_u8(msg
, wps
->wps_state
);
399 #ifdef CONFIG_WPS_UPNP
400 static void wps_registrar_free_pending_m2(struct wps_context
*wps
)
402 struct upnp_pending_message
*p
, *p2
, *prev
= NULL
;
405 if (p
->type
== WPS_M2
|| p
->type
== WPS_M2D
) {
407 wps
->upnp_msgs
= p
->next
;
409 prev
->next
= p
->next
;
410 wpa_printf(MSG_DEBUG
, "WPS UPnP: Drop pending M2/M2D");
413 wpabuf_free(p2
->msg
);
421 #endif /* CONFIG_WPS_UPNP */
424 static int wps_build_ap_setup_locked(struct wps_context
*wps
,
427 if (wps
->ap_setup_locked
&& wps
->ap_setup_locked
!= 2) {
428 wpa_printf(MSG_DEBUG
, "WPS: * AP Setup Locked");
429 wpabuf_put_be16(msg
, ATTR_AP_SETUP_LOCKED
);
430 wpabuf_put_be16(msg
, 1);
431 wpabuf_put_u8(msg
, 1);
437 static int wps_build_selected_registrar(struct wps_registrar
*reg
,
440 if (!reg
->sel_reg_union
)
442 wpa_printf(MSG_DEBUG
, "WPS: * Selected Registrar");
443 wpabuf_put_be16(msg
, ATTR_SELECTED_REGISTRAR
);
444 wpabuf_put_be16(msg
, 1);
445 wpabuf_put_u8(msg
, 1);
450 static int wps_build_sel_reg_dev_password_id(struct wps_registrar
*reg
,
453 u16 id
= reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
;
454 if (!reg
->sel_reg_union
)
456 if (reg
->sel_reg_dev_password_id_override
>= 0)
457 id
= reg
->sel_reg_dev_password_id_override
;
458 wpa_printf(MSG_DEBUG
, "WPS: * Device Password ID (%d)", id
);
459 wpabuf_put_be16(msg
, ATTR_DEV_PASSWORD_ID
);
460 wpabuf_put_be16(msg
, 2);
461 wpabuf_put_be16(msg
, id
);
466 static int wps_build_sel_pbc_reg_uuid_e(struct wps_registrar
*reg
,
469 u16 id
= reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
;
470 if (!reg
->sel_reg_union
)
472 if (reg
->sel_reg_dev_password_id_override
>= 0)
473 id
= reg
->sel_reg_dev_password_id_override
;
474 if (id
!= DEV_PW_PUSHBUTTON
|| !reg
->dualband
)
476 return wps_build_uuid_e(msg
, reg
->wps
->uuid
);
480 static void wps_set_pushbutton(u16
*methods
, u16 conf_methods
)
482 *methods
|= WPS_CONFIG_PUSHBUTTON
;
484 if (conf_methods
& WPS_CONFIG_VIRT_PUSHBUTTON
)
485 *methods
|= WPS_CONFIG_VIRT_PUSHBUTTON
;
486 if (conf_methods
& WPS_CONFIG_PHY_PUSHBUTTON
)
487 *methods
|= WPS_CONFIG_PHY_PUSHBUTTON
;
488 if (!(*methods
& (WPS_CONFIG_VIRT_PUSHBUTTON
|
489 WPS_CONFIG_PHY_PUSHBUTTON
))) {
491 * Required to include virtual/physical flag, but we were not
492 * configured with push button type, so have to default to one
495 *methods
|= WPS_CONFIG_PHY_PUSHBUTTON
;
497 #endif /* CONFIG_WPS2 */
501 static int wps_build_sel_reg_config_methods(struct wps_registrar
*reg
,
505 if (!reg
->sel_reg_union
)
507 methods
= reg
->wps
->config_methods
;
508 methods
&= ~WPS_CONFIG_PUSHBUTTON
;
510 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
511 WPS_CONFIG_PHY_PUSHBUTTON
);
512 #endif /* CONFIG_WPS2 */
514 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
515 if (reg
->sel_reg_config_methods_override
>= 0)
516 methods
= reg
->sel_reg_config_methods_override
;
517 wpa_printf(MSG_DEBUG
, "WPS: * Selected Registrar Config Methods (%x)",
519 wpabuf_put_be16(msg
, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS
);
520 wpabuf_put_be16(msg
, 2);
521 wpabuf_put_be16(msg
, methods
);
526 static int wps_build_probe_config_methods(struct wps_registrar
*reg
,
531 * These are the methods that the AP supports as an Enrollee for adding
532 * external Registrars.
534 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
536 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
537 WPS_CONFIG_PHY_PUSHBUTTON
);
538 #endif /* CONFIG_WPS2 */
539 wpa_printf(MSG_DEBUG
, "WPS: * Config Methods (%x)", methods
);
540 wpabuf_put_be16(msg
, ATTR_CONFIG_METHODS
);
541 wpabuf_put_be16(msg
, 2);
542 wpabuf_put_be16(msg
, methods
);
547 static int wps_build_config_methods_r(struct wps_registrar
*reg
,
551 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
553 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
554 WPS_CONFIG_PHY_PUSHBUTTON
);
555 #endif /* CONFIG_WPS2 */
557 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
558 return wps_build_config_methods(msg
, methods
);
562 const u8
* wps_authorized_macs(struct wps_registrar
*reg
, size_t *count
)
567 while (*count
< WPS_MAX_AUTHORIZED_MACS
) {
568 if (is_zero_ether_addr(reg
->authorized_macs_union
[*count
]))
572 #endif /* CONFIG_WPS2 */
574 return (const u8
*) reg
->authorized_macs_union
;
579 * wps_registrar_init - Initialize WPS Registrar data
580 * @wps: Pointer to longterm WPS context
581 * @cfg: Registrar configuration
582 * Returns: Pointer to allocated Registrar data or %NULL on failure
584 * This function is used to initialize WPS Registrar functionality. It can be
585 * used for a single Registrar run (e.g., when run in a supplicant) or multiple
586 * runs (e.g., when run as an internal Registrar in an AP). Caller is
587 * responsible for freeing the returned data with wps_registrar_deinit() when
588 * Registrar functionality is not needed anymore.
590 struct wps_registrar
*
591 wps_registrar_init(struct wps_context
*wps
,
592 const struct wps_registrar_config
*cfg
)
594 struct wps_registrar
*reg
= os_zalloc(sizeof(*reg
));
598 dl_list_init(®
->pins
);
600 reg
->new_psk_cb
= cfg
->new_psk_cb
;
601 reg
->set_ie_cb
= cfg
->set_ie_cb
;
602 reg
->pin_needed_cb
= cfg
->pin_needed_cb
;
603 reg
->reg_success_cb
= cfg
->reg_success_cb
;
604 reg
->set_sel_reg_cb
= cfg
->set_sel_reg_cb
;
605 reg
->enrollee_seen_cb
= cfg
->enrollee_seen_cb
;
606 reg
->cb_ctx
= cfg
->cb_ctx
;
607 reg
->skip_cred_build
= cfg
->skip_cred_build
;
608 if (cfg
->extra_cred
) {
609 reg
->extra_cred
= wpabuf_alloc_copy(cfg
->extra_cred
,
610 cfg
->extra_cred_len
);
611 if (reg
->extra_cred
== NULL
) {
616 reg
->disable_auto_conf
= cfg
->disable_auto_conf
;
617 reg
->sel_reg_dev_password_id_override
= -1;
618 reg
->sel_reg_config_methods_override
= -1;
619 reg
->static_wep_only
= cfg
->static_wep_only
;
620 reg
->dualband
= cfg
->dualband
;
622 if (wps_set_ie(reg
)) {
623 wps_registrar_deinit(reg
);
632 * wps_registrar_deinit - Deinitialize WPS Registrar data
633 * @reg: Registrar data from wps_registrar_init()
635 void wps_registrar_deinit(struct wps_registrar
*reg
)
639 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
640 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
641 wps_free_pins(®
->pins
);
642 wps_free_pbc_sessions(reg
->pbc_sessions
);
643 wpabuf_free(reg
->extra_cred
);
644 wps_free_devices(reg
->devices
);
650 * wps_registrar_add_pin - Configure a new PIN for Registrar
651 * @reg: Registrar data from wps_registrar_init()
652 * @addr: Enrollee MAC address or %NULL if not known
653 * @uuid: UUID-E or %NULL for wildcard (any UUID)
654 * @pin: PIN (Device Password)
655 * @pin_len: Length of pin in octets
656 * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
657 * Returns: 0 on success, -1 on failure
659 int wps_registrar_add_pin(struct wps_registrar
*reg
, const u8
*addr
,
660 const u8
*uuid
, const u8
*pin
, size_t pin_len
,
663 struct wps_uuid_pin
*p
;
665 p
= os_zalloc(sizeof(*p
));
669 os_memcpy(p
->enrollee_addr
, addr
, ETH_ALEN
);
671 p
->wildcard_uuid
= 1;
673 os_memcpy(p
->uuid
, uuid
, WPS_UUID_LEN
);
674 p
->pin
= os_malloc(pin_len
);
675 if (p
->pin
== NULL
) {
679 os_memcpy(p
->pin
, pin
, pin_len
);
680 p
->pin_len
= pin_len
;
683 p
->flags
|= PIN_EXPIRES
;
684 os_get_time(&p
->expiration
);
685 p
->expiration
.sec
+= timeout
;
688 dl_list_add(®
->pins
, &p
->list
);
690 wpa_printf(MSG_DEBUG
, "WPS: A new PIN configured (timeout=%d)",
692 wpa_hexdump(MSG_DEBUG
, "WPS: UUID", uuid
, WPS_UUID_LEN
);
693 wpa_hexdump_ascii_key(MSG_DEBUG
, "WPS: PIN", pin
, pin_len
);
694 reg
->selected_registrar
= 1;
697 wps_registrar_add_authorized_mac(reg
, addr
);
699 wps_registrar_add_authorized_mac(
700 reg
, (u8
*) "\xff\xff\xff\xff\xff\xff");
701 wps_registrar_selected_registrar_changed(reg
);
702 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
703 eloop_register_timeout(WPS_PBC_WALK_TIME
, 0,
704 wps_registrar_set_selected_timeout
,
711 static void wps_registrar_remove_pin(struct wps_registrar
*reg
,
712 struct wps_uuid_pin
*pin
)
715 u8 bcast
[ETH_ALEN
] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
717 if (is_zero_ether_addr(pin
->enrollee_addr
))
720 addr
= pin
->enrollee_addr
;
721 wps_registrar_remove_authorized_mac(reg
, addr
);
723 wps_registrar_selected_registrar_changed(reg
);
727 static void wps_registrar_expire_pins(struct wps_registrar
*reg
)
729 struct wps_uuid_pin
*pin
, *prev
;
733 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
735 if ((pin
->flags
& PIN_EXPIRES
) &&
736 os_time_before(&pin
->expiration
, &now
)) {
737 wpa_hexdump(MSG_DEBUG
, "WPS: Expired PIN for UUID",
738 pin
->uuid
, WPS_UUID_LEN
);
739 wps_registrar_remove_pin(reg
, pin
);
746 * wps_registrar_invalidate_wildcard_pin - Invalidate a wildcard PIN
747 * @reg: Registrar data from wps_registrar_init()
748 * Returns: 0 on success, -1 if not wildcard PIN is enabled
750 static int wps_registrar_invalidate_wildcard_pin(struct wps_registrar
*reg
)
752 struct wps_uuid_pin
*pin
, *prev
;
754 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
756 if (pin
->wildcard_uuid
) {
757 wpa_hexdump(MSG_DEBUG
, "WPS: Invalidated PIN for UUID",
758 pin
->uuid
, WPS_UUID_LEN
);
759 wps_registrar_remove_pin(reg
, pin
);
769 * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
770 * @reg: Registrar data from wps_registrar_init()
772 * Returns: 0 on success, -1 on failure (e.g., PIN not found)
774 int wps_registrar_invalidate_pin(struct wps_registrar
*reg
, const u8
*uuid
)
776 struct wps_uuid_pin
*pin
, *prev
;
778 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
780 if (os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
781 wpa_hexdump(MSG_DEBUG
, "WPS: Invalidated PIN for UUID",
782 pin
->uuid
, WPS_UUID_LEN
);
783 wps_registrar_remove_pin(reg
, pin
);
792 static const u8
* wps_registrar_get_pin(struct wps_registrar
*reg
,
793 const u8
*uuid
, size_t *pin_len
)
795 struct wps_uuid_pin
*pin
, *found
= NULL
;
797 wps_registrar_expire_pins(reg
);
799 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
800 if (!pin
->wildcard_uuid
&&
801 os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
808 /* Check for wildcard UUIDs since none of the UUID-specific
810 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
811 if (pin
->wildcard_uuid
== 1) {
812 wpa_printf(MSG_DEBUG
, "WPS: Found a wildcard "
813 "PIN. Assigned it for this UUID-E");
814 pin
->wildcard_uuid
= 2;
815 os_memcpy(pin
->uuid
, uuid
, WPS_UUID_LEN
);
826 * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
827 * that could otherwise avoid PIN invalidations.
829 if (found
->flags
& PIN_LOCKED
) {
830 wpa_printf(MSG_DEBUG
, "WPS: Selected PIN locked - do not "
831 "allow concurrent re-use");
834 *pin_len
= found
->pin_len
;
835 found
->flags
|= PIN_LOCKED
;
841 * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
842 * @reg: Registrar data from wps_registrar_init()
844 * Returns: 0 on success, -1 on failure
846 * PINs are locked to enforce only one concurrent use. This function unlocks a
847 * PIN to allow it to be used again. If the specified PIN was configured using
848 * a wildcard UUID, it will be removed instead of allowing multiple uses.
850 int wps_registrar_unlock_pin(struct wps_registrar
*reg
, const u8
*uuid
)
852 struct wps_uuid_pin
*pin
;
854 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
855 if (os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
856 if (pin
->wildcard_uuid
== 2) {
857 wpa_printf(MSG_DEBUG
, "WPS: Invalidating used "
859 return wps_registrar_invalidate_pin(reg
, uuid
);
861 pin
->flags
&= ~PIN_LOCKED
;
870 static void wps_registrar_stop_pbc(struct wps_registrar
*reg
)
872 reg
->selected_registrar
= 0;
874 os_memset(reg
->p2p_dev_addr
, 0, ETH_ALEN
);
875 wps_registrar_remove_authorized_mac(reg
,
876 (u8
*) "\xff\xff\xff\xff\xff\xff");
877 wps_registrar_selected_registrar_changed(reg
);
881 static void wps_registrar_pbc_timeout(void *eloop_ctx
, void *timeout_ctx
)
883 struct wps_registrar
*reg
= eloop_ctx
;
885 wpa_printf(MSG_DEBUG
, "WPS: PBC timed out - disable PBC mode");
886 wps_pbc_timeout_event(reg
->wps
);
887 wps_registrar_stop_pbc(reg
);
892 * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
893 * @reg: Registrar data from wps_registrar_init()
894 * @p2p_dev_addr: Limit allowed PBC devices to the specified P2P device, %NULL
895 * indicates no such filtering
896 * Returns: 0 on success, -1 on failure, -2 on session overlap
898 * This function is called on an AP when a push button is pushed to activate
899 * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
900 * or when a PBC registration is completed. If more than one Enrollee in active
901 * PBC mode has been detected during the monitor time (previous 2 minutes), the
902 * PBC mode is not actived and -2 is returned to indicate session overlap. This
903 * is skipped if a specific Enrollee is selected.
905 int wps_registrar_button_pushed(struct wps_registrar
*reg
,
906 const u8
*p2p_dev_addr
)
908 if (p2p_dev_addr
== NULL
&&
909 wps_registrar_pbc_overlap(reg
, NULL
, NULL
)) {
910 wpa_printf(MSG_DEBUG
, "WPS: PBC overlap - do not start PBC "
912 wps_pbc_overlap_event(reg
->wps
);
915 wpa_printf(MSG_DEBUG
, "WPS: Button pushed - PBC mode started");
916 reg
->force_pbc_overlap
= 0;
917 reg
->selected_registrar
= 1;
920 os_memcpy(reg
->p2p_dev_addr
, p2p_dev_addr
, ETH_ALEN
);
922 os_memset(reg
->p2p_dev_addr
, 0, ETH_ALEN
);
923 wps_registrar_add_authorized_mac(reg
,
924 (u8
*) "\xff\xff\xff\xff\xff\xff");
925 wps_registrar_selected_registrar_changed(reg
);
927 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
928 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
929 eloop_register_timeout(WPS_PBC_WALK_TIME
, 0, wps_registrar_pbc_timeout
,
935 static void wps_registrar_pbc_completed(struct wps_registrar
*reg
)
937 wpa_printf(MSG_DEBUG
, "WPS: PBC completed - stopping PBC mode");
938 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
939 wps_registrar_stop_pbc(reg
);
943 static void wps_registrar_pin_completed(struct wps_registrar
*reg
)
945 wpa_printf(MSG_DEBUG
, "WPS: PIN completed using internal Registrar");
946 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
947 reg
->selected_registrar
= 0;
948 wps_registrar_selected_registrar_changed(reg
);
952 int wps_registrar_wps_cancel(struct wps_registrar
*reg
)
955 wpa_printf(MSG_DEBUG
, "WPS: PBC is set - cancelling it");
956 wps_registrar_pbc_timeout(reg
, NULL
);
958 } else if (reg
->selected_registrar
) {
960 wpa_printf(MSG_DEBUG
, "WPS: PIN is set - cancelling it");
961 wps_registrar_pin_completed(reg
);
962 wps_registrar_invalidate_wildcard_pin(reg
);
970 * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
971 * @reg: Registrar data from wps_registrar_init()
972 * @addr: MAC address of the Probe Request sender
973 * @wps_data: WPS IE contents
975 * This function is called on an AP when a Probe Request with WPS IE is
976 * received. This is used to track PBC mode use and to detect possible overlap
977 * situation with other WPS APs.
979 void wps_registrar_probe_req_rx(struct wps_registrar
*reg
, const u8
*addr
,
980 const struct wpabuf
*wps_data
,
983 struct wps_parse_attr attr
;
985 wpa_hexdump_buf(MSG_MSGDUMP
,
986 "WPS: Probe Request with WPS data received",
989 if (wps_parse_msg(wps_data
, &attr
) < 0)
992 if (attr
.config_methods
== NULL
) {
993 wpa_printf(MSG_DEBUG
, "WPS: No Config Methods attribute in "
998 if (attr
.dev_password_id
== NULL
) {
999 wpa_printf(MSG_DEBUG
, "WPS: No Device Password Id attribute "
1000 "in Probe Request");
1004 if (reg
->enrollee_seen_cb
&& attr
.uuid_e
&&
1005 attr
.primary_dev_type
&& attr
.request_type
&& !p2p_wildcard
) {
1006 char *dev_name
= NULL
;
1007 if (attr
.dev_name
) {
1008 dev_name
= os_zalloc(attr
.dev_name_len
+ 1);
1010 os_memcpy(dev_name
, attr
.dev_name
,
1014 reg
->enrollee_seen_cb(reg
->cb_ctx
, addr
, attr
.uuid_e
,
1015 attr
.primary_dev_type
,
1016 WPA_GET_BE16(attr
.config_methods
),
1017 WPA_GET_BE16(attr
.dev_password_id
),
1018 *attr
.request_type
, dev_name
);
1022 if (WPA_GET_BE16(attr
.dev_password_id
) != DEV_PW_PUSHBUTTON
)
1023 return; /* Not PBC */
1025 wpa_printf(MSG_DEBUG
, "WPS: Probe Request for PBC received from "
1026 MACSTR
, MAC2STR(addr
));
1027 if (attr
.uuid_e
== NULL
) {
1028 wpa_printf(MSG_DEBUG
, "WPS: Invalid Probe Request WPS IE: No "
1032 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E from Probe Request", attr
.uuid_e
,
1035 wps_registrar_add_pbc_session(reg
, addr
, attr
.uuid_e
);
1036 if (wps_registrar_pbc_overlap(reg
, addr
, attr
.uuid_e
)) {
1037 wpa_printf(MSG_DEBUG
, "WPS: PBC session overlap detected");
1038 reg
->force_pbc_overlap
= 1;
1039 wps_pbc_overlap_event(reg
->wps
);
1044 static int wps_cb_new_psk(struct wps_registrar
*reg
, const u8
*mac_addr
,
1045 const u8
*psk
, size_t psk_len
)
1047 if (reg
->new_psk_cb
== NULL
)
1050 return reg
->new_psk_cb(reg
->cb_ctx
, mac_addr
, psk
, psk_len
);
1054 static void wps_cb_pin_needed(struct wps_registrar
*reg
, const u8
*uuid_e
,
1055 const struct wps_device_data
*dev
)
1057 if (reg
->pin_needed_cb
== NULL
)
1060 reg
->pin_needed_cb(reg
->cb_ctx
, uuid_e
, dev
);
1064 static void wps_cb_reg_success(struct wps_registrar
*reg
, const u8
*mac_addr
,
1067 if (reg
->reg_success_cb
== NULL
)
1070 reg
->reg_success_cb(reg
->cb_ctx
, mac_addr
, uuid_e
);
1074 static int wps_cb_set_ie(struct wps_registrar
*reg
, struct wpabuf
*beacon_ie
,
1075 struct wpabuf
*probe_resp_ie
)
1077 return reg
->set_ie_cb(reg
->cb_ctx
, beacon_ie
, probe_resp_ie
);
1081 static void wps_cb_set_sel_reg(struct wps_registrar
*reg
)
1084 if (reg
->set_sel_reg_cb
== NULL
)
1087 if (reg
->selected_registrar
) {
1088 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
1090 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
1091 WPS_CONFIG_PHY_PUSHBUTTON
);
1092 #endif /* CONFIG_WPS2 */
1094 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
1097 wpa_printf(MSG_DEBUG
, "WPS: wps_cb_set_sel_reg: sel_reg=%d "
1098 "config_methods=0x%x pbc=%d methods=0x%x",
1099 reg
->selected_registrar
, reg
->wps
->config_methods
,
1102 reg
->set_sel_reg_cb(reg
->cb_ctx
, reg
->selected_registrar
,
1103 reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
,
1108 static int wps_set_ie(struct wps_registrar
*reg
)
1110 struct wpabuf
*beacon
;
1111 struct wpabuf
*probe
;
1112 const u8
*auth_macs
;
1114 size_t vendor_len
= 0;
1117 if (reg
->set_ie_cb
== NULL
)
1120 for (i
= 0; i
< MAX_WPS_VENDOR_EXTENSIONS
; i
++) {
1121 if (reg
->wps
->dev
.vendor_ext
[i
]) {
1122 vendor_len
+= 2 + 2;
1123 vendor_len
+= wpabuf_len(reg
->wps
->dev
.vendor_ext
[i
]);
1127 beacon
= wpabuf_alloc(400 + vendor_len
);
1130 probe
= wpabuf_alloc(500 + vendor_len
);
1131 if (probe
== NULL
) {
1132 wpabuf_free(beacon
);
1136 auth_macs
= wps_authorized_macs(reg
, &count
);
1138 wpa_printf(MSG_DEBUG
, "WPS: Build Beacon IEs");
1140 if (wps_build_version(beacon
) ||
1141 wps_build_wps_state(reg
->wps
, beacon
) ||
1142 wps_build_ap_setup_locked(reg
->wps
, beacon
) ||
1143 wps_build_selected_registrar(reg
, beacon
) ||
1144 wps_build_sel_reg_dev_password_id(reg
, beacon
) ||
1145 wps_build_sel_reg_config_methods(reg
, beacon
) ||
1146 wps_build_sel_pbc_reg_uuid_e(reg
, beacon
) ||
1147 (reg
->dualband
&& wps_build_rf_bands(®
->wps
->dev
, beacon
)) ||
1148 wps_build_wfa_ext(beacon
, 0, auth_macs
, count
) ||
1149 wps_build_vendor_ext(®
->wps
->dev
, beacon
)) {
1150 wpabuf_free(beacon
);
1156 if (wps_build_dev_name(®
->wps
->dev
, beacon
) ||
1157 wps_build_primary_dev_type(®
->wps
->dev
, beacon
)) {
1158 wpabuf_free(beacon
);
1162 #endif /* CONFIG_P2P */
1164 wpa_printf(MSG_DEBUG
, "WPS: Build Probe Response IEs");
1166 if (wps_build_version(probe
) ||
1167 wps_build_wps_state(reg
->wps
, probe
) ||
1168 wps_build_ap_setup_locked(reg
->wps
, probe
) ||
1169 wps_build_selected_registrar(reg
, probe
) ||
1170 wps_build_sel_reg_dev_password_id(reg
, probe
) ||
1171 wps_build_sel_reg_config_methods(reg
, probe
) ||
1172 wps_build_resp_type(probe
, reg
->wps
->ap
? WPS_RESP_AP
:
1173 WPS_RESP_REGISTRAR
) ||
1174 wps_build_uuid_e(probe
, reg
->wps
->uuid
) ||
1175 wps_build_device_attrs(®
->wps
->dev
, probe
) ||
1176 wps_build_probe_config_methods(reg
, probe
) ||
1177 wps_build_rf_bands(®
->wps
->dev
, probe
) ||
1178 wps_build_wfa_ext(probe
, 0, auth_macs
, count
) ||
1179 wps_build_vendor_ext(®
->wps
->dev
, probe
)) {
1180 wpabuf_free(beacon
);
1185 beacon
= wps_ie_encapsulate(beacon
);
1186 probe
= wps_ie_encapsulate(probe
);
1188 if (!beacon
|| !probe
) {
1189 wpabuf_free(beacon
);
1194 if (reg
->static_wep_only
) {
1196 * Windows XP and Vista clients can get confused about
1197 * EAP-Identity/Request when they probe the network with
1198 * EAPOL-Start. In such a case, they may assume the network is
1199 * using IEEE 802.1X and prompt user for a certificate while
1200 * the correct (non-WPS) behavior would be to ask for the
1201 * static WEP key. As a workaround, use Microsoft Provisioning
1202 * IE to advertise that legacy 802.1X is not supported.
1204 const u8 ms_wps
[7] = {
1205 WLAN_EID_VENDOR_SPECIFIC
, 5,
1206 /* Microsoft Provisioning IE (00:50:f2:5) */
1207 0x00, 0x50, 0xf2, 5,
1208 0x00 /* no legacy 802.1X or MS WPS */
1210 wpa_printf(MSG_DEBUG
, "WPS: Add Microsoft Provisioning IE "
1211 "into Beacon/Probe Response frames");
1212 wpabuf_put_data(beacon
, ms_wps
, sizeof(ms_wps
));
1213 wpabuf_put_data(probe
, ms_wps
, sizeof(ms_wps
));
1216 return wps_cb_set_ie(reg
, beacon
, probe
);
1220 static int wps_get_dev_password(struct wps_data
*wps
)
1225 os_free(wps
->dev_password
);
1226 wps
->dev_password
= NULL
;
1229 wpa_printf(MSG_DEBUG
, "WPS: Use default PIN for PBC");
1230 pin
= (const u8
*) "00000000";
1233 pin
= wps_registrar_get_pin(wps
->wps
->registrar
, wps
->uuid_e
,
1237 wpa_printf(MSG_DEBUG
, "WPS: No Device Password available for "
1239 wps_cb_pin_needed(wps
->wps
->registrar
, wps
->uuid_e
,
1244 wps
->dev_password
= os_malloc(pin_len
);
1245 if (wps
->dev_password
== NULL
)
1247 os_memcpy(wps
->dev_password
, pin
, pin_len
);
1248 wps
->dev_password_len
= pin_len
;
1254 static int wps_build_uuid_r(struct wps_data
*wps
, struct wpabuf
*msg
)
1256 wpa_printf(MSG_DEBUG
, "WPS: * UUID-R");
1257 wpabuf_put_be16(msg
, ATTR_UUID_R
);
1258 wpabuf_put_be16(msg
, WPS_UUID_LEN
);
1259 wpabuf_put_data(msg
, wps
->uuid_r
, WPS_UUID_LEN
);
1264 static int wps_build_r_hash(struct wps_data
*wps
, struct wpabuf
*msg
)
1270 if (random_get_bytes(wps
->snonce
, 2 * WPS_SECRET_NONCE_LEN
) < 0)
1272 wpa_hexdump(MSG_DEBUG
, "WPS: R-S1", wps
->snonce
, WPS_SECRET_NONCE_LEN
);
1273 wpa_hexdump(MSG_DEBUG
, "WPS: R-S2",
1274 wps
->snonce
+ WPS_SECRET_NONCE_LEN
, WPS_SECRET_NONCE_LEN
);
1276 if (wps
->dh_pubkey_e
== NULL
|| wps
->dh_pubkey_r
== NULL
) {
1277 wpa_printf(MSG_DEBUG
, "WPS: DH public keys not available for "
1278 "R-Hash derivation");
1282 wpa_printf(MSG_DEBUG
, "WPS: * R-Hash1");
1283 wpabuf_put_be16(msg
, ATTR_R_HASH1
);
1284 wpabuf_put_be16(msg
, SHA256_MAC_LEN
);
1285 hash
= wpabuf_put(msg
, SHA256_MAC_LEN
);
1286 /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
1287 addr
[0] = wps
->snonce
;
1288 len
[0] = WPS_SECRET_NONCE_LEN
;
1289 addr
[1] = wps
->psk1
;
1290 len
[1] = WPS_PSK_LEN
;
1291 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
1292 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
1293 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
1294 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
1295 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
1296 wpa_hexdump(MSG_DEBUG
, "WPS: R-Hash1", hash
, SHA256_MAC_LEN
);
1298 wpa_printf(MSG_DEBUG
, "WPS: * R-Hash2");
1299 wpabuf_put_be16(msg
, ATTR_R_HASH2
);
1300 wpabuf_put_be16(msg
, SHA256_MAC_LEN
);
1301 hash
= wpabuf_put(msg
, SHA256_MAC_LEN
);
1302 /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
1303 addr
[0] = wps
->snonce
+ WPS_SECRET_NONCE_LEN
;
1304 addr
[1] = wps
->psk2
;
1305 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
1306 wpa_hexdump(MSG_DEBUG
, "WPS: R-Hash2", hash
, SHA256_MAC_LEN
);
1312 static int wps_build_r_snonce1(struct wps_data
*wps
, struct wpabuf
*msg
)
1314 wpa_printf(MSG_DEBUG
, "WPS: * R-SNonce1");
1315 wpabuf_put_be16(msg
, ATTR_R_SNONCE1
);
1316 wpabuf_put_be16(msg
, WPS_SECRET_NONCE_LEN
);
1317 wpabuf_put_data(msg
, wps
->snonce
, WPS_SECRET_NONCE_LEN
);
1322 static int wps_build_r_snonce2(struct wps_data
*wps
, struct wpabuf
*msg
)
1324 wpa_printf(MSG_DEBUG
, "WPS: * R-SNonce2");
1325 wpabuf_put_be16(msg
, ATTR_R_SNONCE2
);
1326 wpabuf_put_be16(msg
, WPS_SECRET_NONCE_LEN
);
1327 wpabuf_put_data(msg
, wps
->snonce
+ WPS_SECRET_NONCE_LEN
,
1328 WPS_SECRET_NONCE_LEN
);
1333 static int wps_build_cred_network_idx(struct wpabuf
*msg
,
1334 const struct wps_credential
*cred
)
1336 wpa_printf(MSG_DEBUG
, "WPS: * Network Index (1)");
1337 wpabuf_put_be16(msg
, ATTR_NETWORK_INDEX
);
1338 wpabuf_put_be16(msg
, 1);
1339 wpabuf_put_u8(msg
, 1);
1344 static int wps_build_cred_ssid(struct wpabuf
*msg
,
1345 const struct wps_credential
*cred
)
1347 wpa_printf(MSG_DEBUG
, "WPS: * SSID");
1348 wpa_hexdump_ascii(MSG_DEBUG
, "WPS: SSID for Credential",
1349 cred
->ssid
, cred
->ssid_len
);
1350 wpabuf_put_be16(msg
, ATTR_SSID
);
1351 wpabuf_put_be16(msg
, cred
->ssid_len
);
1352 wpabuf_put_data(msg
, cred
->ssid
, cred
->ssid_len
);
1357 static int wps_build_cred_auth_type(struct wpabuf
*msg
,
1358 const struct wps_credential
*cred
)
1360 wpa_printf(MSG_DEBUG
, "WPS: * Authentication Type (0x%x)",
1362 wpabuf_put_be16(msg
, ATTR_AUTH_TYPE
);
1363 wpabuf_put_be16(msg
, 2);
1364 wpabuf_put_be16(msg
, cred
->auth_type
);
1369 static int wps_build_cred_encr_type(struct wpabuf
*msg
,
1370 const struct wps_credential
*cred
)
1372 wpa_printf(MSG_DEBUG
, "WPS: * Encryption Type (0x%x)",
1374 wpabuf_put_be16(msg
, ATTR_ENCR_TYPE
);
1375 wpabuf_put_be16(msg
, 2);
1376 wpabuf_put_be16(msg
, cred
->encr_type
);
1381 static int wps_build_cred_network_key(struct wpabuf
*msg
,
1382 const struct wps_credential
*cred
)
1384 wpa_printf(MSG_DEBUG
, "WPS: * Network Key (len=%d)",
1385 (int) cred
->key_len
);
1386 wpa_hexdump_key(MSG_DEBUG
, "WPS: Network Key",
1387 cred
->key
, cred
->key_len
);
1388 wpabuf_put_be16(msg
, ATTR_NETWORK_KEY
);
1389 wpabuf_put_be16(msg
, cred
->key_len
);
1390 wpabuf_put_data(msg
, cred
->key
, cred
->key_len
);
1395 static int wps_build_cred_mac_addr(struct wpabuf
*msg
,
1396 const struct wps_credential
*cred
)
1398 wpa_printf(MSG_DEBUG
, "WPS: * MAC Address (" MACSTR
")",
1399 MAC2STR(cred
->mac_addr
));
1400 wpabuf_put_be16(msg
, ATTR_MAC_ADDR
);
1401 wpabuf_put_be16(msg
, ETH_ALEN
);
1402 wpabuf_put_data(msg
, cred
->mac_addr
, ETH_ALEN
);
1407 static int wps_build_credential(struct wpabuf
*msg
,
1408 const struct wps_credential
*cred
)
1410 if (wps_build_cred_network_idx(msg
, cred
) ||
1411 wps_build_cred_ssid(msg
, cred
) ||
1412 wps_build_cred_auth_type(msg
, cred
) ||
1413 wps_build_cred_encr_type(msg
, cred
) ||
1414 wps_build_cred_network_key(msg
, cred
) ||
1415 wps_build_cred_mac_addr(msg
, cred
))
1421 int wps_build_cred(struct wps_data
*wps
, struct wpabuf
*msg
)
1423 struct wpabuf
*cred
;
1425 if (wps
->wps
->registrar
->skip_cred_build
)
1426 goto skip_cred_build
;
1428 wpa_printf(MSG_DEBUG
, "WPS: * Credential");
1429 if (wps
->use_cred
) {
1430 os_memcpy(&wps
->cred
, wps
->use_cred
, sizeof(wps
->cred
));
1433 os_memset(&wps
->cred
, 0, sizeof(wps
->cred
));
1435 os_memcpy(wps
->cred
.ssid
, wps
->wps
->ssid
, wps
->wps
->ssid_len
);
1436 wps
->cred
.ssid_len
= wps
->wps
->ssid_len
;
1438 /* Select the best authentication and encryption type */
1439 if (wps
->auth_type
& WPS_AUTH_WPA2PSK
)
1440 wps
->auth_type
= WPS_AUTH_WPA2PSK
;
1441 else if (wps
->auth_type
& WPS_AUTH_WPAPSK
)
1442 wps
->auth_type
= WPS_AUTH_WPAPSK
;
1443 else if (wps
->auth_type
& WPS_AUTH_OPEN
)
1444 wps
->auth_type
= WPS_AUTH_OPEN
;
1445 else if (wps
->auth_type
& WPS_AUTH_SHARED
)
1446 wps
->auth_type
= WPS_AUTH_SHARED
;
1448 wpa_printf(MSG_DEBUG
, "WPS: Unsupported auth_type 0x%x",
1452 wps
->cred
.auth_type
= wps
->auth_type
;
1454 if (wps
->auth_type
== WPS_AUTH_WPA2PSK
||
1455 wps
->auth_type
== WPS_AUTH_WPAPSK
) {
1456 if (wps
->encr_type
& WPS_ENCR_AES
)
1457 wps
->encr_type
= WPS_ENCR_AES
;
1458 else if (wps
->encr_type
& WPS_ENCR_TKIP
)
1459 wps
->encr_type
= WPS_ENCR_TKIP
;
1461 wpa_printf(MSG_DEBUG
, "WPS: No suitable encryption "
1462 "type for WPA/WPA2");
1466 if (wps
->encr_type
& WPS_ENCR_WEP
)
1467 wps
->encr_type
= WPS_ENCR_WEP
;
1468 else if (wps
->encr_type
& WPS_ENCR_NONE
)
1469 wps
->encr_type
= WPS_ENCR_NONE
;
1471 wpa_printf(MSG_DEBUG
, "WPS: No suitable encryption "
1472 "type for non-WPA/WPA2 mode");
1476 wps
->cred
.encr_type
= wps
->encr_type
;
1478 * Set MAC address in the Credential to be the Enrollee's MAC address
1480 os_memcpy(wps
->cred
.mac_addr
, wps
->mac_addr_e
, ETH_ALEN
);
1482 if (wps
->wps
->wps_state
== WPS_STATE_NOT_CONFIGURED
&& wps
->wps
->ap
&&
1483 !wps
->wps
->registrar
->disable_auto_conf
) {
1485 /* Generate a random passphrase */
1486 if (random_get_bytes(r
, sizeof(r
)) < 0)
1488 os_free(wps
->new_psk
);
1489 wps
->new_psk
= base64_encode(r
, sizeof(r
), &wps
->new_psk_len
);
1490 if (wps
->new_psk
== NULL
)
1492 wps
->new_psk_len
--; /* remove newline */
1493 while (wps
->new_psk_len
&&
1494 wps
->new_psk
[wps
->new_psk_len
- 1] == '=')
1496 wpa_hexdump_ascii_key(MSG_DEBUG
, "WPS: Generated passphrase",
1497 wps
->new_psk
, wps
->new_psk_len
);
1498 os_memcpy(wps
->cred
.key
, wps
->new_psk
, wps
->new_psk_len
);
1499 wps
->cred
.key_len
= wps
->new_psk_len
;
1500 } else if (wps
->use_psk_key
&& wps
->wps
->psk_set
) {
1502 wpa_printf(MSG_DEBUG
, "WPS: Use PSK format for Network Key");
1503 wpa_snprintf_hex(hex
, sizeof(hex
), wps
->wps
->psk
, 32);
1504 os_memcpy(wps
->cred
.key
, hex
, 32 * 2);
1505 wps
->cred
.key_len
= 32 * 2;
1506 } else if (wps
->wps
->network_key
) {
1507 os_memcpy(wps
->cred
.key
, wps
->wps
->network_key
,
1508 wps
->wps
->network_key_len
);
1509 wps
->cred
.key_len
= wps
->wps
->network_key_len
;
1510 } else if (wps
->auth_type
& (WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
)) {
1512 /* Generate a random per-device PSK */
1513 os_free(wps
->new_psk
);
1514 wps
->new_psk_len
= 32;
1515 wps
->new_psk
= os_malloc(wps
->new_psk_len
);
1516 if (wps
->new_psk
== NULL
)
1518 if (random_get_bytes(wps
->new_psk
, wps
->new_psk_len
) < 0) {
1519 os_free(wps
->new_psk
);
1520 wps
->new_psk
= NULL
;
1523 wpa_hexdump_key(MSG_DEBUG
, "WPS: Generated per-device PSK",
1524 wps
->new_psk
, wps
->new_psk_len
);
1525 wpa_snprintf_hex(hex
, sizeof(hex
), wps
->new_psk
,
1527 os_memcpy(wps
->cred
.key
, hex
, wps
->new_psk_len
* 2);
1528 wps
->cred
.key_len
= wps
->new_psk_len
* 2;
1532 #ifdef CONFIG_WPS_TESTING
1533 if (wps_testing_dummy_cred
)
1534 cred
= wpabuf_alloc(200);
1538 struct wps_credential dummy
;
1539 wpa_printf(MSG_DEBUG
, "WPS: Add dummy credential");
1540 os_memset(&dummy
, 0, sizeof(dummy
));
1541 os_memcpy(dummy
.ssid
, "dummy", 5);
1543 dummy
.auth_type
= WPS_AUTH_WPA2PSK
;
1544 dummy
.encr_type
= WPS_ENCR_AES
;
1545 os_memcpy(dummy
.key
, "dummy psk", 9);
1547 os_memcpy(dummy
.mac_addr
, wps
->mac_addr_e
, ETH_ALEN
);
1548 wps_build_credential(cred
, &dummy
);
1549 wpa_hexdump_buf(MSG_DEBUG
, "WPS: Dummy Credential", cred
);
1551 wpabuf_put_be16(msg
, ATTR_CRED
);
1552 wpabuf_put_be16(msg
, wpabuf_len(cred
));
1553 wpabuf_put_buf(msg
, cred
);
1557 #endif /* CONFIG_WPS_TESTING */
1559 cred
= wpabuf_alloc(200);
1563 if (wps_build_credential(cred
, &wps
->cred
)) {
1568 wpabuf_put_be16(msg
, ATTR_CRED
);
1569 wpabuf_put_be16(msg
, wpabuf_len(cred
));
1570 wpabuf_put_buf(msg
, cred
);
1574 if (wps
->wps
->registrar
->extra_cred
) {
1575 wpa_printf(MSG_DEBUG
, "WPS: * Credential (pre-configured)");
1576 wpabuf_put_buf(msg
, wps
->wps
->registrar
->extra_cred
);
1583 static int wps_build_ap_settings(struct wps_data
*wps
, struct wpabuf
*msg
)
1585 wpa_printf(MSG_DEBUG
, "WPS: * AP Settings");
1587 if (wps_build_credential(msg
, &wps
->cred
))
1594 static struct wpabuf
* wps_build_m2(struct wps_data
*wps
)
1598 if (random_get_bytes(wps
->nonce_r
, WPS_NONCE_LEN
) < 0)
1600 wpa_hexdump(MSG_DEBUG
, "WPS: Registrar Nonce",
1601 wps
->nonce_r
, WPS_NONCE_LEN
);
1602 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-R", wps
->uuid_r
, WPS_UUID_LEN
);
1604 wpa_printf(MSG_DEBUG
, "WPS: Building Message M2");
1605 msg
= wpabuf_alloc(1000);
1609 if (wps_build_version(msg
) ||
1610 wps_build_msg_type(msg
, WPS_M2
) ||
1611 wps_build_enrollee_nonce(wps
, msg
) ||
1612 wps_build_registrar_nonce(wps
, msg
) ||
1613 wps_build_uuid_r(wps
, msg
) ||
1614 wps_build_public_key(wps
, msg
) ||
1615 wps_derive_keys(wps
) ||
1616 wps_build_auth_type_flags(wps
, msg
) ||
1617 wps_build_encr_type_flags(wps
, msg
) ||
1618 wps_build_conn_type_flags(wps
, msg
) ||
1619 wps_build_config_methods_r(wps
->wps
->registrar
, msg
) ||
1620 wps_build_device_attrs(&wps
->wps
->dev
, msg
) ||
1621 wps_build_rf_bands(&wps
->wps
->dev
, msg
) ||
1622 wps_build_assoc_state(wps
, msg
) ||
1623 wps_build_config_error(msg
, WPS_CFG_NO_ERROR
) ||
1624 wps_build_dev_password_id(msg
, wps
->dev_pw_id
) ||
1625 wps_build_os_version(&wps
->wps
->dev
, msg
) ||
1626 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1627 wps_build_authenticator(wps
, msg
)) {
1633 wps
->state
= RECV_M3
;
1638 static struct wpabuf
* wps_build_m2d(struct wps_data
*wps
)
1641 u16 err
= wps
->config_error
;
1643 wpa_printf(MSG_DEBUG
, "WPS: Building Message M2D");
1644 msg
= wpabuf_alloc(1000);
1648 if (wps
->wps
->ap
&& wps
->wps
->ap_setup_locked
&&
1649 err
== WPS_CFG_NO_ERROR
)
1650 err
= WPS_CFG_SETUP_LOCKED
;
1652 if (wps_build_version(msg
) ||
1653 wps_build_msg_type(msg
, WPS_M2D
) ||
1654 wps_build_enrollee_nonce(wps
, msg
) ||
1655 wps_build_registrar_nonce(wps
, msg
) ||
1656 wps_build_uuid_r(wps
, msg
) ||
1657 wps_build_auth_type_flags(wps
, msg
) ||
1658 wps_build_encr_type_flags(wps
, msg
) ||
1659 wps_build_conn_type_flags(wps
, msg
) ||
1660 wps_build_config_methods_r(wps
->wps
->registrar
, msg
) ||
1661 wps_build_device_attrs(&wps
->wps
->dev
, msg
) ||
1662 wps_build_rf_bands(&wps
->wps
->dev
, msg
) ||
1663 wps_build_assoc_state(wps
, msg
) ||
1664 wps_build_config_error(msg
, err
) ||
1665 wps_build_os_version(&wps
->wps
->dev
, msg
) ||
1666 wps_build_wfa_ext(msg
, 0, NULL
, 0)) {
1671 wps
->state
= RECV_M2D_ACK
;
1676 static struct wpabuf
* wps_build_m4(struct wps_data
*wps
)
1678 struct wpabuf
*msg
, *plain
;
1680 wpa_printf(MSG_DEBUG
, "WPS: Building Message M4");
1682 wps_derive_psk(wps
, wps
->dev_password
, wps
->dev_password_len
);
1684 plain
= wpabuf_alloc(200);
1688 msg
= wpabuf_alloc(1000);
1694 if (wps_build_version(msg
) ||
1695 wps_build_msg_type(msg
, WPS_M4
) ||
1696 wps_build_enrollee_nonce(wps
, msg
) ||
1697 wps_build_r_hash(wps
, msg
) ||
1698 wps_build_r_snonce1(wps
, plain
) ||
1699 wps_build_key_wrap_auth(wps
, plain
) ||
1700 wps_build_encr_settings(wps
, msg
, plain
) ||
1701 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1702 wps_build_authenticator(wps
, msg
)) {
1709 wps
->state
= RECV_M5
;
1714 static struct wpabuf
* wps_build_m6(struct wps_data
*wps
)
1716 struct wpabuf
*msg
, *plain
;
1718 wpa_printf(MSG_DEBUG
, "WPS: Building Message M6");
1720 plain
= wpabuf_alloc(200);
1724 msg
= wpabuf_alloc(1000);
1730 if (wps_build_version(msg
) ||
1731 wps_build_msg_type(msg
, WPS_M6
) ||
1732 wps_build_enrollee_nonce(wps
, msg
) ||
1733 wps_build_r_snonce2(wps
, plain
) ||
1734 wps_build_key_wrap_auth(wps
, plain
) ||
1735 wps_build_encr_settings(wps
, msg
, plain
) ||
1736 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1737 wps_build_authenticator(wps
, msg
)) {
1744 wps
->wps_pin_revealed
= 1;
1745 wps
->state
= RECV_M7
;
1750 static struct wpabuf
* wps_build_m8(struct wps_data
*wps
)
1752 struct wpabuf
*msg
, *plain
;
1754 wpa_printf(MSG_DEBUG
, "WPS: Building Message M8");
1756 plain
= wpabuf_alloc(500);
1760 msg
= wpabuf_alloc(1000);
1766 if (wps_build_version(msg
) ||
1767 wps_build_msg_type(msg
, WPS_M8
) ||
1768 wps_build_enrollee_nonce(wps
, msg
) ||
1769 ((wps
->wps
->ap
|| wps
->er
) && wps_build_cred(wps
, plain
)) ||
1770 (!wps
->wps
->ap
&& !wps
->er
&& wps_build_ap_settings(wps
, plain
)) ||
1771 wps_build_key_wrap_auth(wps
, plain
) ||
1772 wps_build_encr_settings(wps
, msg
, plain
) ||
1773 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1774 wps_build_authenticator(wps
, msg
)) {
1781 wps
->state
= RECV_DONE
;
1786 struct wpabuf
* wps_registrar_get_msg(struct wps_data
*wps
,
1787 enum wsc_op_code
*op_code
)
1791 #ifdef CONFIG_WPS_UPNP
1792 if (!wps
->int_reg
&& wps
->wps
->wps_upnp
) {
1793 struct upnp_pending_message
*p
, *prev
= NULL
;
1794 if (wps
->ext_reg
> 1)
1795 wps_registrar_free_pending_m2(wps
->wps
);
1796 p
= wps
->wps
->upnp_msgs
;
1797 /* TODO: check pending message MAC address */
1798 while (p
&& p
->next
) {
1803 wpa_printf(MSG_DEBUG
, "WPS: Use pending message from "
1808 wps
->wps
->upnp_msgs
= NULL
;
1815 *op_code
= WSC_NACK
;
1822 if (wps
->ext_reg
== 0)
1828 wpa_printf(MSG_DEBUG
, "WPS: Using external Registrar, but no "
1829 "pending message available");
1832 #endif /* CONFIG_WPS_UPNP */
1834 switch (wps
->state
) {
1836 if (wps_get_dev_password(wps
) < 0)
1837 msg
= wps_build_m2d(wps
);
1839 msg
= wps_build_m2(wps
);
1843 msg
= wps_build_m2d(wps
);
1847 msg
= wps_build_m4(wps
);
1851 msg
= wps_build_m6(wps
);
1855 msg
= wps_build_m8(wps
);
1859 msg
= wps_build_wsc_ack(wps
);
1863 msg
= wps_build_wsc_nack(wps
);
1864 *op_code
= WSC_NACK
;
1867 wpa_printf(MSG_DEBUG
, "WPS: Unsupported state %d for building "
1868 "a message", wps
->state
);
1873 if (*op_code
== WSC_MSG
&& msg
) {
1874 /* Save a copy of the last message for Authenticator derivation
1876 wpabuf_free(wps
->last_msg
);
1877 wps
->last_msg
= wpabuf_dup(msg
);
1884 static int wps_process_enrollee_nonce(struct wps_data
*wps
, const u8
*e_nonce
)
1886 if (e_nonce
== NULL
) {
1887 wpa_printf(MSG_DEBUG
, "WPS: No Enrollee Nonce received");
1891 os_memcpy(wps
->nonce_e
, e_nonce
, WPS_NONCE_LEN
);
1892 wpa_hexdump(MSG_DEBUG
, "WPS: Enrollee Nonce",
1893 wps
->nonce_e
, WPS_NONCE_LEN
);
1899 static int wps_process_registrar_nonce(struct wps_data
*wps
, const u8
*r_nonce
)
1901 if (r_nonce
== NULL
) {
1902 wpa_printf(MSG_DEBUG
, "WPS: No Registrar Nonce received");
1906 if (os_memcmp(wps
->nonce_r
, r_nonce
, WPS_NONCE_LEN
) != 0) {
1907 wpa_printf(MSG_DEBUG
, "WPS: Invalid Registrar Nonce received");
1915 static int wps_process_uuid_e(struct wps_data
*wps
, const u8
*uuid_e
)
1917 if (uuid_e
== NULL
) {
1918 wpa_printf(MSG_DEBUG
, "WPS: No UUID-E received");
1922 os_memcpy(wps
->uuid_e
, uuid_e
, WPS_UUID_LEN
);
1923 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E", wps
->uuid_e
, WPS_UUID_LEN
);
1929 static int wps_process_dev_password_id(struct wps_data
*wps
, const u8
*pw_id
)
1931 if (pw_id
== NULL
) {
1932 wpa_printf(MSG_DEBUG
, "WPS: No Device Password ID received");
1936 wps
->dev_pw_id
= WPA_GET_BE16(pw_id
);
1937 wpa_printf(MSG_DEBUG
, "WPS: Device Password ID %d", wps
->dev_pw_id
);
1943 static int wps_process_e_hash1(struct wps_data
*wps
, const u8
*e_hash1
)
1945 if (e_hash1
== NULL
) {
1946 wpa_printf(MSG_DEBUG
, "WPS: No E-Hash1 received");
1950 os_memcpy(wps
->peer_hash1
, e_hash1
, WPS_HASH_LEN
);
1951 wpa_hexdump(MSG_DEBUG
, "WPS: E-Hash1", wps
->peer_hash1
, WPS_HASH_LEN
);
1957 static int wps_process_e_hash2(struct wps_data
*wps
, const u8
*e_hash2
)
1959 if (e_hash2
== NULL
) {
1960 wpa_printf(MSG_DEBUG
, "WPS: No E-Hash2 received");
1964 os_memcpy(wps
->peer_hash2
, e_hash2
, WPS_HASH_LEN
);
1965 wpa_hexdump(MSG_DEBUG
, "WPS: E-Hash2", wps
->peer_hash2
, WPS_HASH_LEN
);
1971 static int wps_process_e_snonce1(struct wps_data
*wps
, const u8
*e_snonce1
)
1973 u8 hash
[SHA256_MAC_LEN
];
1977 if (e_snonce1
== NULL
) {
1978 wpa_printf(MSG_DEBUG
, "WPS: No E-SNonce1 received");
1982 wpa_hexdump_key(MSG_DEBUG
, "WPS: E-SNonce1", e_snonce1
,
1983 WPS_SECRET_NONCE_LEN
);
1985 /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
1986 addr
[0] = e_snonce1
;
1987 len
[0] = WPS_SECRET_NONCE_LEN
;
1988 addr
[1] = wps
->psk1
;
1989 len
[1] = WPS_PSK_LEN
;
1990 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
1991 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
1992 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
1993 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
1994 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
1996 if (os_memcmp(wps
->peer_hash1
, hash
, WPS_HASH_LEN
) != 0) {
1997 wpa_printf(MSG_DEBUG
, "WPS: E-Hash1 derived from E-S1 does "
1998 "not match with the pre-committed value");
1999 wps
->config_error
= WPS_CFG_DEV_PASSWORD_AUTH_FAILURE
;
2000 wps_pwd_auth_fail_event(wps
->wps
, 0, 1);
2004 wpa_printf(MSG_DEBUG
, "WPS: Enrollee proved knowledge of the first "
2005 "half of the device password");
2011 static int wps_process_e_snonce2(struct wps_data
*wps
, const u8
*e_snonce2
)
2013 u8 hash
[SHA256_MAC_LEN
];
2017 if (e_snonce2
== NULL
) {
2018 wpa_printf(MSG_DEBUG
, "WPS: No E-SNonce2 received");
2022 wpa_hexdump_key(MSG_DEBUG
, "WPS: E-SNonce2", e_snonce2
,
2023 WPS_SECRET_NONCE_LEN
);
2025 /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
2026 addr
[0] = e_snonce2
;
2027 len
[0] = WPS_SECRET_NONCE_LEN
;
2028 addr
[1] = wps
->psk2
;
2029 len
[1] = WPS_PSK_LEN
;
2030 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
2031 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
2032 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
2033 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
2034 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
2036 if (os_memcmp(wps
->peer_hash2
, hash
, WPS_HASH_LEN
) != 0) {
2037 wpa_printf(MSG_DEBUG
, "WPS: E-Hash2 derived from E-S2 does "
2038 "not match with the pre-committed value");
2039 wps_registrar_invalidate_pin(wps
->wps
->registrar
, wps
->uuid_e
);
2040 wps
->config_error
= WPS_CFG_DEV_PASSWORD_AUTH_FAILURE
;
2041 wps_pwd_auth_fail_event(wps
->wps
, 0, 2);
2045 wpa_printf(MSG_DEBUG
, "WPS: Enrollee proved knowledge of the second "
2046 "half of the device password");
2047 wps
->wps_pin_revealed
= 0;
2048 wps_registrar_unlock_pin(wps
->wps
->registrar
, wps
->uuid_e
);
2054 static int wps_process_mac_addr(struct wps_data
*wps
, const u8
*mac_addr
)
2056 if (mac_addr
== NULL
) {
2057 wpa_printf(MSG_DEBUG
, "WPS: No MAC Address received");
2061 wpa_printf(MSG_DEBUG
, "WPS: Enrollee MAC Address " MACSTR
,
2063 os_memcpy(wps
->mac_addr_e
, mac_addr
, ETH_ALEN
);
2064 os_memcpy(wps
->peer_dev
.mac_addr
, mac_addr
, ETH_ALEN
);
2070 static int wps_process_pubkey(struct wps_data
*wps
, const u8
*pk
,
2073 if (pk
== NULL
|| pk_len
== 0) {
2074 wpa_printf(MSG_DEBUG
, "WPS: No Public Key received");
2078 #ifdef CONFIG_WPS_OOB
2079 if (wps
->wps
->oob_conf
.pubkey_hash
!= NULL
) {
2081 u8 hash
[WPS_HASH_LEN
];
2084 sha256_vector(1, addr
, &pk_len
, hash
);
2086 wpabuf_head(wps
->wps
->oob_conf
.pubkey_hash
),
2087 WPS_OOB_PUBKEY_HASH_LEN
) != 0) {
2088 wpa_printf(MSG_ERROR
, "WPS: Public Key hash error");
2092 #endif /* CONFIG_WPS_OOB */
2094 wpabuf_free(wps
->dh_pubkey_e
);
2095 wps
->dh_pubkey_e
= wpabuf_alloc_copy(pk
, pk_len
);
2096 if (wps
->dh_pubkey_e
== NULL
)
2103 static int wps_process_auth_type_flags(struct wps_data
*wps
, const u8
*auth
)
2108 wpa_printf(MSG_DEBUG
, "WPS: No Authentication Type flags "
2113 auth_types
= WPA_GET_BE16(auth
);
2115 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Authentication Type flags 0x%x",
2117 wps
->auth_type
= wps
->wps
->auth_types
& auth_types
;
2118 if (wps
->auth_type
== 0) {
2119 wpa_printf(MSG_DEBUG
, "WPS: No match in supported "
2120 "authentication types (own 0x%x Enrollee 0x%x)",
2121 wps
->wps
->auth_types
, auth_types
);
2122 #ifdef WPS_WORKAROUNDS
2124 * Some deployed implementations seem to advertise incorrect
2125 * information in this attribute. For example, Linksys WRT350N
2126 * seems to have a byteorder bug that breaks this negotiation.
2127 * In order to interoperate with existing implementations,
2128 * assume that the Enrollee supports everything we do.
2130 wpa_printf(MSG_DEBUG
, "WPS: Workaround - assume Enrollee "
2131 "does not advertise supported authentication types "
2133 wps
->auth_type
= wps
->wps
->auth_types
;
2134 #else /* WPS_WORKAROUNDS */
2136 #endif /* WPS_WORKAROUNDS */
2143 static int wps_process_encr_type_flags(struct wps_data
*wps
, const u8
*encr
)
2148 wpa_printf(MSG_DEBUG
, "WPS: No Encryption Type flags "
2153 encr_types
= WPA_GET_BE16(encr
);
2155 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Encryption Type flags 0x%x",
2157 wps
->encr_type
= wps
->wps
->encr_types
& encr_types
;
2158 if (wps
->encr_type
== 0) {
2159 wpa_printf(MSG_DEBUG
, "WPS: No match in supported "
2160 "encryption types (own 0x%x Enrollee 0x%x)",
2161 wps
->wps
->encr_types
, encr_types
);
2162 #ifdef WPS_WORKAROUNDS
2164 * Some deployed implementations seem to advertise incorrect
2165 * information in this attribute. For example, Linksys WRT350N
2166 * seems to have a byteorder bug that breaks this negotiation.
2167 * In order to interoperate with existing implementations,
2168 * assume that the Enrollee supports everything we do.
2170 wpa_printf(MSG_DEBUG
, "WPS: Workaround - assume Enrollee "
2171 "does not advertise supported encryption types "
2173 wps
->encr_type
= wps
->wps
->encr_types
;
2174 #else /* WPS_WORKAROUNDS */
2176 #endif /* WPS_WORKAROUNDS */
2183 static int wps_process_conn_type_flags(struct wps_data
*wps
, const u8
*conn
)
2186 wpa_printf(MSG_DEBUG
, "WPS: No Connection Type flags "
2191 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Connection Type flags 0x%x",
2198 static int wps_process_config_methods(struct wps_data
*wps
, const u8
*methods
)
2202 if (methods
== NULL
) {
2203 wpa_printf(MSG_DEBUG
, "WPS: No Config Methods received");
2207 m
= WPA_GET_BE16(methods
);
2209 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Config Methods 0x%x"
2210 "%s%s%s%s%s%s%s%s%s", m
,
2211 m
& WPS_CONFIG_USBA
? " [USBA]" : "",
2212 m
& WPS_CONFIG_ETHERNET
? " [Ethernet]" : "",
2213 m
& WPS_CONFIG_LABEL
? " [Label]" : "",
2214 m
& WPS_CONFIG_DISPLAY
? " [Display]" : "",
2215 m
& WPS_CONFIG_EXT_NFC_TOKEN
? " [Ext NFC Token]" : "",
2216 m
& WPS_CONFIG_INT_NFC_TOKEN
? " [Int NFC Token]" : "",
2217 m
& WPS_CONFIG_NFC_INTERFACE
? " [NFC]" : "",
2218 m
& WPS_CONFIG_PUSHBUTTON
? " [PBC]" : "",
2219 m
& WPS_CONFIG_KEYPAD
? " [Keypad]" : "");
2221 if (!(m
& WPS_CONFIG_DISPLAY
) && !wps
->use_psk_key
) {
2223 * The Enrollee does not have a display so it is unlikely to be
2224 * able to show the passphrase to a user and as such, could
2225 * benefit from receiving PSK to reduce key derivation time.
2227 wpa_printf(MSG_DEBUG
, "WPS: Prefer PSK format key due to "
2228 "Enrollee not supporting display");
2229 wps
->use_psk_key
= 1;
2236 static int wps_process_wps_state(struct wps_data
*wps
, const u8
*state
)
2238 if (state
== NULL
) {
2239 wpa_printf(MSG_DEBUG
, "WPS: No Wi-Fi Protected Setup State "
2244 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Wi-Fi Protected Setup State %d",
2251 static int wps_process_assoc_state(struct wps_data
*wps
, const u8
*assoc
)
2255 if (assoc
== NULL
) {
2256 wpa_printf(MSG_DEBUG
, "WPS: No Association State received");
2260 a
= WPA_GET_BE16(assoc
);
2261 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Association State %d", a
);
2267 static int wps_process_config_error(struct wps_data
*wps
, const u8
*err
)
2272 wpa_printf(MSG_DEBUG
, "WPS: No Configuration Error received");
2276 e
= WPA_GET_BE16(err
);
2277 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Configuration Error %d", e
);
2283 static int wps_registrar_p2p_dev_addr_match(struct wps_data
*wps
)
2286 struct wps_registrar
*reg
= wps
->wps
->registrar
;
2288 if (is_zero_ether_addr(reg
->p2p_dev_addr
))
2289 return 1; /* no filtering in use */
2291 if (os_memcmp(reg
->p2p_dev_addr
, wps
->p2p_dev_addr
, ETH_ALEN
) != 0) {
2292 wpa_printf(MSG_DEBUG
, "WPS: No match on P2P Device Address "
2293 "filtering for PBC: expected " MACSTR
" was "
2294 MACSTR
" - indicate PBC session overlap",
2295 MAC2STR(reg
->p2p_dev_addr
),
2296 MAC2STR(wps
->p2p_dev_addr
));
2299 #endif /* CONFIG_P2P */
2304 static int wps_registrar_skip_overlap(struct wps_data
*wps
)
2307 struct wps_registrar
*reg
= wps
->wps
->registrar
;
2309 if (is_zero_ether_addr(reg
->p2p_dev_addr
))
2310 return 0; /* no specific Enrollee selected */
2312 if (os_memcmp(reg
->p2p_dev_addr
, wps
->p2p_dev_addr
, ETH_ALEN
) == 0) {
2313 wpa_printf(MSG_DEBUG
, "WPS: Skip PBC overlap due to selected "
2317 #endif /* CONFIG_P2P */
2322 static enum wps_process_res
wps_process_m1(struct wps_data
*wps
,
2323 struct wps_parse_attr
*attr
)
2325 wpa_printf(MSG_DEBUG
, "WPS: Received M1");
2327 if (wps
->state
!= RECV_M1
) {
2328 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2329 "receiving M1", wps
->state
);
2333 if (wps_process_uuid_e(wps
, attr
->uuid_e
) ||
2334 wps_process_mac_addr(wps
, attr
->mac_addr
) ||
2335 wps_process_enrollee_nonce(wps
, attr
->enrollee_nonce
) ||
2336 wps_process_pubkey(wps
, attr
->public_key
, attr
->public_key_len
) ||
2337 wps_process_auth_type_flags(wps
, attr
->auth_type_flags
) ||
2338 wps_process_encr_type_flags(wps
, attr
->encr_type_flags
) ||
2339 wps_process_conn_type_flags(wps
, attr
->conn_type_flags
) ||
2340 wps_process_config_methods(wps
, attr
->config_methods
) ||
2341 wps_process_wps_state(wps
, attr
->wps_state
) ||
2342 wps_process_device_attrs(&wps
->peer_dev
, attr
) ||
2343 wps_process_rf_bands(&wps
->peer_dev
, attr
->rf_bands
) ||
2344 wps_process_assoc_state(wps
, attr
->assoc_state
) ||
2345 wps_process_dev_password_id(wps
, attr
->dev_password_id
) ||
2346 wps_process_config_error(wps
, attr
->config_error
) ||
2347 wps_process_os_version(&wps
->peer_dev
, attr
->os_version
))
2350 if (wps
->dev_pw_id
< 0x10 &&
2351 wps
->dev_pw_id
!= DEV_PW_DEFAULT
&&
2352 wps
->dev_pw_id
!= DEV_PW_USER_SPECIFIED
&&
2353 wps
->dev_pw_id
!= DEV_PW_MACHINE_SPECIFIED
&&
2354 wps
->dev_pw_id
!= DEV_PW_REGISTRAR_SPECIFIED
&&
2355 (wps
->dev_pw_id
!= DEV_PW_PUSHBUTTON
||
2356 !wps
->wps
->registrar
->pbc
)) {
2357 wpa_printf(MSG_DEBUG
, "WPS: Unsupported Device Password ID %d",
2359 wps
->state
= SEND_M2D
;
2360 return WPS_CONTINUE
;
2363 #ifdef CONFIG_WPS_OOB
2364 if (wps
->dev_pw_id
>= 0x10 &&
2365 wps
->dev_pw_id
!= wps
->wps
->oob_dev_pw_id
) {
2366 wpa_printf(MSG_DEBUG
, "WPS: OOB Device Password ID "
2367 "%d mismatch", wps
->dev_pw_id
);
2368 wps
->state
= SEND_M2D
;
2369 return WPS_CONTINUE
;
2371 #endif /* CONFIG_WPS_OOB */
2373 if (wps
->dev_pw_id
== DEV_PW_PUSHBUTTON
) {
2374 if ((wps
->wps
->registrar
->force_pbc_overlap
||
2375 wps_registrar_pbc_overlap(wps
->wps
->registrar
,
2376 wps
->mac_addr_e
, wps
->uuid_e
) ||
2377 !wps_registrar_p2p_dev_addr_match(wps
)) &&
2378 !wps_registrar_skip_overlap(wps
)) {
2379 wpa_printf(MSG_DEBUG
, "WPS: PBC overlap - deny PBC "
2381 wps
->state
= SEND_M2D
;
2382 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2383 wps_pbc_overlap_event(wps
->wps
);
2384 wps_fail_event(wps
->wps
, WPS_M1
,
2385 WPS_CFG_MULTIPLE_PBC_DETECTED
,
2387 wps
->wps
->registrar
->force_pbc_overlap
= 1;
2388 return WPS_CONTINUE
;
2390 wps_registrar_add_pbc_session(wps
->wps
->registrar
,
2391 wps
->mac_addr_e
, wps
->uuid_e
);
2395 #ifdef WPS_WORKAROUNDS
2397 * It looks like Mac OS X 10.6.3 and 10.6.4 do not like Network Key in
2398 * passphrase format. To avoid interop issues, force PSK format to be
2401 if (!wps
->use_psk_key
&&
2402 wps
->peer_dev
.manufacturer
&&
2403 os_strncmp(wps
->peer_dev
.manufacturer
, "Apple ", 6) == 0 &&
2404 wps
->peer_dev
.model_name
&&
2405 os_strcmp(wps
->peer_dev
.model_name
, "AirPort") == 0) {
2406 wpa_printf(MSG_DEBUG
, "WPS: Workaround - Force Network Key in "
2408 wps
->use_psk_key
= 1;
2410 #endif /* WPS_WORKAROUNDS */
2412 wps
->state
= SEND_M2
;
2413 return WPS_CONTINUE
;
2417 static enum wps_process_res
wps_process_m3(struct wps_data
*wps
,
2418 const struct wpabuf
*msg
,
2419 struct wps_parse_attr
*attr
)
2421 wpa_printf(MSG_DEBUG
, "WPS: Received M3");
2423 if (wps
->state
!= RECV_M3
) {
2424 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2425 "receiving M3", wps
->state
);
2426 wps
->state
= SEND_WSC_NACK
;
2427 return WPS_CONTINUE
;
2430 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2431 !wps_registrar_skip_overlap(wps
)) {
2432 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2434 wps
->state
= SEND_WSC_NACK
;
2435 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2436 return WPS_CONTINUE
;
2439 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2440 wps_process_authenticator(wps
, attr
->authenticator
, msg
) ||
2441 wps_process_e_hash1(wps
, attr
->e_hash1
) ||
2442 wps_process_e_hash2(wps
, attr
->e_hash2
)) {
2443 wps
->state
= SEND_WSC_NACK
;
2444 return WPS_CONTINUE
;
2447 wps
->state
= SEND_M4
;
2448 return WPS_CONTINUE
;
2452 static enum wps_process_res
wps_process_m5(struct wps_data
*wps
,
2453 const struct wpabuf
*msg
,
2454 struct wps_parse_attr
*attr
)
2456 struct wpabuf
*decrypted
;
2457 struct wps_parse_attr eattr
;
2459 wpa_printf(MSG_DEBUG
, "WPS: Received M5");
2461 if (wps
->state
!= RECV_M5
) {
2462 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2463 "receiving M5", wps
->state
);
2464 wps
->state
= SEND_WSC_NACK
;
2465 return WPS_CONTINUE
;
2468 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2469 !wps_registrar_skip_overlap(wps
)) {
2470 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2472 wps
->state
= SEND_WSC_NACK
;
2473 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2474 return WPS_CONTINUE
;
2477 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2478 wps_process_authenticator(wps
, attr
->authenticator
, msg
)) {
2479 wps
->state
= SEND_WSC_NACK
;
2480 return WPS_CONTINUE
;
2483 decrypted
= wps_decrypt_encr_settings(wps
, attr
->encr_settings
,
2484 attr
->encr_settings_len
);
2485 if (decrypted
== NULL
) {
2486 wpa_printf(MSG_DEBUG
, "WPS: Failed to decrypted Encrypted "
2487 "Settings attribute");
2488 wps
->state
= SEND_WSC_NACK
;
2489 return WPS_CONTINUE
;
2492 if (wps_validate_m5_encr(decrypted
, attr
->version2
!= NULL
) < 0) {
2493 wpabuf_free(decrypted
);
2494 wps
->state
= SEND_WSC_NACK
;
2495 return WPS_CONTINUE
;
2498 wpa_printf(MSG_DEBUG
, "WPS: Processing decrypted Encrypted Settings "
2500 if (wps_parse_msg(decrypted
, &eattr
) < 0 ||
2501 wps_process_key_wrap_auth(wps
, decrypted
, eattr
.key_wrap_auth
) ||
2502 wps_process_e_snonce1(wps
, eattr
.e_snonce1
)) {
2503 wpabuf_free(decrypted
);
2504 wps
->state
= SEND_WSC_NACK
;
2505 return WPS_CONTINUE
;
2507 wpabuf_free(decrypted
);
2509 wps
->state
= SEND_M6
;
2510 return WPS_CONTINUE
;
2514 static void wps_sta_cred_cb(struct wps_data
*wps
)
2517 * Update credential to only include a single authentication and
2518 * encryption type in case the AP configuration includes more than one
2521 if (wps
->cred
.auth_type
& WPS_AUTH_WPA2PSK
)
2522 wps
->cred
.auth_type
= WPS_AUTH_WPA2PSK
;
2523 else if (wps
->cred
.auth_type
& WPS_AUTH_WPAPSK
)
2524 wps
->cred
.auth_type
= WPS_AUTH_WPAPSK
;
2525 if (wps
->cred
.encr_type
& WPS_ENCR_AES
)
2526 wps
->cred
.encr_type
= WPS_ENCR_AES
;
2527 else if (wps
->cred
.encr_type
& WPS_ENCR_TKIP
)
2528 wps
->cred
.encr_type
= WPS_ENCR_TKIP
;
2529 wpa_printf(MSG_DEBUG
, "WPS: Update local configuration based on the "
2530 "AP configuration");
2531 if (wps
->wps
->cred_cb
)
2532 wps
->wps
->cred_cb(wps
->wps
->cb_ctx
, &wps
->cred
);
2536 static void wps_cred_update(struct wps_credential
*dst
,
2537 struct wps_credential
*src
)
2539 os_memcpy(dst
->ssid
, src
->ssid
, sizeof(dst
->ssid
));
2540 dst
->ssid_len
= src
->ssid_len
;
2541 dst
->auth_type
= src
->auth_type
;
2542 dst
->encr_type
= src
->encr_type
;
2543 dst
->key_idx
= src
->key_idx
;
2544 os_memcpy(dst
->key
, src
->key
, sizeof(dst
->key
));
2545 dst
->key_len
= src
->key_len
;
2549 static int wps_process_ap_settings_r(struct wps_data
*wps
,
2550 struct wps_parse_attr
*attr
)
2552 if (wps
->wps
->ap
|| wps
->er
)
2555 /* AP Settings Attributes in M7 when Enrollee is an AP */
2556 if (wps_process_ap_settings(attr
, &wps
->cred
) < 0)
2559 wpa_printf(MSG_INFO
, "WPS: Received old AP configuration from AP");
2561 if (wps
->new_ap_settings
) {
2562 wpa_printf(MSG_INFO
, "WPS: Update AP configuration based on "
2564 wps_cred_update(&wps
->cred
, wps
->new_ap_settings
);
2568 * Use the AP PIN only to receive the current AP settings, not
2569 * to reconfigure the AP.
2573 * Clear selected registrar here since we do not get to
2574 * WSC_Done in this protocol run.
2576 wps_registrar_pin_completed(wps
->wps
->registrar
);
2578 if (wps
->ap_settings_cb
) {
2579 wps
->ap_settings_cb(wps
->ap_settings_cb_ctx
,
2583 wps_sta_cred_cb(wps
);
2589 static enum wps_process_res
wps_process_m7(struct wps_data
*wps
,
2590 const struct wpabuf
*msg
,
2591 struct wps_parse_attr
*attr
)
2593 struct wpabuf
*decrypted
;
2594 struct wps_parse_attr eattr
;
2596 wpa_printf(MSG_DEBUG
, "WPS: Received M7");
2598 if (wps
->state
!= RECV_M7
) {
2599 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2600 "receiving M7", wps
->state
);
2601 wps
->state
= SEND_WSC_NACK
;
2602 return WPS_CONTINUE
;
2605 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2606 !wps_registrar_skip_overlap(wps
)) {
2607 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2609 wps
->state
= SEND_WSC_NACK
;
2610 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2611 return WPS_CONTINUE
;
2614 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2615 wps_process_authenticator(wps
, attr
->authenticator
, msg
)) {
2616 wps
->state
= SEND_WSC_NACK
;
2617 return WPS_CONTINUE
;
2620 decrypted
= wps_decrypt_encr_settings(wps
, attr
->encr_settings
,
2621 attr
->encr_settings_len
);
2622 if (decrypted
== NULL
) {
2623 wpa_printf(MSG_DEBUG
, "WPS: Failed to decrypt Encrypted "
2624 "Settings attribute");
2625 wps
->state
= SEND_WSC_NACK
;
2626 return WPS_CONTINUE
;
2629 if (wps_validate_m7_encr(decrypted
, wps
->wps
->ap
|| wps
->er
,
2630 attr
->version2
!= NULL
) < 0) {
2631 wpabuf_free(decrypted
);
2632 wps
->state
= SEND_WSC_NACK
;
2633 return WPS_CONTINUE
;
2636 wpa_printf(MSG_DEBUG
, "WPS: Processing decrypted Encrypted Settings "
2638 if (wps_parse_msg(decrypted
, &eattr
) < 0 ||
2639 wps_process_key_wrap_auth(wps
, decrypted
, eattr
.key_wrap_auth
) ||
2640 wps_process_e_snonce2(wps
, eattr
.e_snonce2
) ||
2641 wps_process_ap_settings_r(wps
, &eattr
)) {
2642 wpabuf_free(decrypted
);
2643 wps
->state
= SEND_WSC_NACK
;
2644 return WPS_CONTINUE
;
2647 wpabuf_free(decrypted
);
2649 wps
->state
= SEND_M8
;
2650 return WPS_CONTINUE
;
2654 static enum wps_process_res
wps_process_wsc_msg(struct wps_data
*wps
,
2655 const struct wpabuf
*msg
)
2657 struct wps_parse_attr attr
;
2658 enum wps_process_res ret
= WPS_CONTINUE
;
2660 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_MSG");
2662 if (wps_parse_msg(msg
, &attr
) < 0)
2665 if (attr
.msg_type
== NULL
) {
2666 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2667 wps
->state
= SEND_WSC_NACK
;
2668 return WPS_CONTINUE
;
2671 if (*attr
.msg_type
!= WPS_M1
&&
2672 (attr
.registrar_nonce
== NULL
||
2673 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
,
2674 WPS_NONCE_LEN
!= 0))) {
2675 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2679 switch (*attr
.msg_type
) {
2681 if (wps_validate_m1(msg
) < 0)
2683 #ifdef CONFIG_WPS_UPNP
2684 if (wps
->wps
->wps_upnp
&& attr
.mac_addr
) {
2685 /* Remove old pending messages when starting new run */
2686 wps_free_pending_msgs(wps
->wps
->upnp_msgs
);
2687 wps
->wps
->upnp_msgs
= NULL
;
2689 upnp_wps_device_send_wlan_event(
2690 wps
->wps
->wps_upnp
, attr
.mac_addr
,
2691 UPNP_WPS_WLANEVENT_TYPE_EAP
, msg
);
2693 #endif /* CONFIG_WPS_UPNP */
2694 ret
= wps_process_m1(wps
, &attr
);
2697 if (wps_validate_m3(msg
) < 0)
2699 ret
= wps_process_m3(wps
, msg
, &attr
);
2700 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2701 wps_fail_event(wps
->wps
, WPS_M3
, wps
->config_error
,
2702 wps
->error_indication
);
2705 if (wps_validate_m5(msg
) < 0)
2707 ret
= wps_process_m5(wps
, msg
, &attr
);
2708 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2709 wps_fail_event(wps
->wps
, WPS_M5
, wps
->config_error
,
2710 wps
->error_indication
);
2713 if (wps_validate_m7(msg
) < 0)
2715 ret
= wps_process_m7(wps
, msg
, &attr
);
2716 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2717 wps_fail_event(wps
->wps
, WPS_M7
, wps
->config_error
,
2718 wps
->error_indication
);
2721 wpa_printf(MSG_DEBUG
, "WPS: Unsupported Message Type %d",
2726 if (ret
== WPS_CONTINUE
) {
2727 /* Save a copy of the last message for Authenticator derivation
2729 wpabuf_free(wps
->last_msg
);
2730 wps
->last_msg
= wpabuf_dup(msg
);
2737 static enum wps_process_res
wps_process_wsc_ack(struct wps_data
*wps
,
2738 const struct wpabuf
*msg
)
2740 struct wps_parse_attr attr
;
2742 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_ACK");
2744 if (wps_parse_msg(msg
, &attr
) < 0)
2747 if (attr
.msg_type
== NULL
) {
2748 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2752 if (*attr
.msg_type
!= WPS_WSC_ACK
) {
2753 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2758 #ifdef CONFIG_WPS_UPNP
2759 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&& wps
->state
== RECV_M2D_ACK
&&
2760 upnp_wps_subscribers(wps
->wps
->wps_upnp
)) {
2761 if (wps
->wps
->upnp_msgs
)
2762 return WPS_CONTINUE
;
2763 wpa_printf(MSG_DEBUG
, "WPS: Wait for response from an "
2764 "external Registrar");
2767 #endif /* CONFIG_WPS_UPNP */
2769 if (attr
.registrar_nonce
== NULL
||
2770 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
2772 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2776 if (attr
.enrollee_nonce
== NULL
||
2777 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
2778 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
2782 if (wps
->state
== RECV_M2D_ACK
) {
2783 #ifdef CONFIG_WPS_UPNP
2784 if (wps
->wps
->wps_upnp
&&
2785 upnp_wps_subscribers(wps
->wps
->wps_upnp
)) {
2786 if (wps
->wps
->upnp_msgs
)
2787 return WPS_CONTINUE
;
2788 if (wps
->ext_reg
== 0)
2790 wpa_printf(MSG_DEBUG
, "WPS: Wait for response from an "
2791 "external Registrar");
2794 #endif /* CONFIG_WPS_UPNP */
2796 wpa_printf(MSG_DEBUG
, "WPS: No more registrars available - "
2797 "terminate negotiation");
2804 static enum wps_process_res
wps_process_wsc_nack(struct wps_data
*wps
,
2805 const struct wpabuf
*msg
)
2807 struct wps_parse_attr attr
;
2811 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_NACK");
2813 old_state
= wps
->state
;
2814 wps
->state
= SEND_WSC_NACK
;
2816 if (wps_parse_msg(msg
, &attr
) < 0)
2819 if (attr
.msg_type
== NULL
) {
2820 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2824 if (*attr
.msg_type
!= WPS_WSC_NACK
) {
2825 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2830 #ifdef CONFIG_WPS_UPNP
2831 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
) {
2832 wpa_printf(MSG_DEBUG
, "WPS: Negotiation using external "
2833 "Registrar terminated by the Enrollee");
2836 #endif /* CONFIG_WPS_UPNP */
2838 if (attr
.registrar_nonce
== NULL
||
2839 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
2841 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2845 if (attr
.enrollee_nonce
== NULL
||
2846 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
2847 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
2851 if (attr
.config_error
== NULL
) {
2852 wpa_printf(MSG_DEBUG
, "WPS: No Configuration Error attribute "
2857 config_error
= WPA_GET_BE16(attr
.config_error
);
2858 wpa_printf(MSG_DEBUG
, "WPS: Enrollee terminated negotiation with "
2859 "Configuration Error %d", config_error
);
2861 switch (old_state
) {
2863 wps_fail_event(wps
->wps
, WPS_M2
, config_error
,
2864 wps
->error_indication
);
2867 wps_fail_event(wps
->wps
, WPS_M4
, config_error
,
2868 wps
->error_indication
);
2871 wps_fail_event(wps
->wps
, WPS_M6
, config_error
,
2872 wps
->error_indication
);
2875 wps_fail_event(wps
->wps
, WPS_M8
, config_error
,
2876 wps
->error_indication
);
2886 static enum wps_process_res
wps_process_wsc_done(struct wps_data
*wps
,
2887 const struct wpabuf
*msg
)
2889 struct wps_parse_attr attr
;
2891 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_Done");
2893 if (wps
->state
!= RECV_DONE
&&
2894 (!wps
->wps
->wps_upnp
|| !wps
->ext_reg
)) {
2895 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2896 "receiving WSC_Done", wps
->state
);
2900 if (wps_parse_msg(msg
, &attr
) < 0)
2903 if (attr
.msg_type
== NULL
) {
2904 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2908 if (*attr
.msg_type
!= WPS_WSC_DONE
) {
2909 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2914 #ifdef CONFIG_WPS_UPNP
2915 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
) {
2916 wpa_printf(MSG_DEBUG
, "WPS: Negotiation using external "
2917 "Registrar completed successfully");
2918 wps_device_store(wps
->wps
->registrar
, &wps
->peer_dev
,
2922 #endif /* CONFIG_WPS_UPNP */
2924 if (attr
.registrar_nonce
== NULL
||
2925 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
2927 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2931 if (attr
.enrollee_nonce
== NULL
||
2932 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
2933 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
2937 wpa_printf(MSG_DEBUG
, "WPS: Negotiation completed successfully");
2938 wps_device_store(wps
->wps
->registrar
, &wps
->peer_dev
,
2941 if (wps
->wps
->wps_state
== WPS_STATE_NOT_CONFIGURED
&& wps
->new_psk
&&
2942 wps
->wps
->ap
&& !wps
->wps
->registrar
->disable_auto_conf
) {
2943 struct wps_credential cred
;
2945 wpa_printf(MSG_DEBUG
, "WPS: Moving to Configured state based "
2946 "on first Enrollee connection");
2948 os_memset(&cred
, 0, sizeof(cred
));
2949 os_memcpy(cred
.ssid
, wps
->wps
->ssid
, wps
->wps
->ssid_len
);
2950 cred
.ssid_len
= wps
->wps
->ssid_len
;
2951 cred
.auth_type
= WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
;
2952 cred
.encr_type
= WPS_ENCR_TKIP
| WPS_ENCR_AES
;
2953 os_memcpy(cred
.key
, wps
->new_psk
, wps
->new_psk_len
);
2954 cred
.key_len
= wps
->new_psk_len
;
2956 wps
->wps
->wps_state
= WPS_STATE_CONFIGURED
;
2957 wpa_hexdump_ascii_key(MSG_DEBUG
,
2958 "WPS: Generated random passphrase",
2959 wps
->new_psk
, wps
->new_psk_len
);
2960 if (wps
->wps
->cred_cb
)
2961 wps
->wps
->cred_cb(wps
->wps
->cb_ctx
, &cred
);
2963 os_free(wps
->new_psk
);
2964 wps
->new_psk
= NULL
;
2967 if (!wps
->wps
->ap
&& !wps
->er
)
2968 wps_sta_cred_cb(wps
);
2971 if (wps_cb_new_psk(wps
->wps
->registrar
, wps
->mac_addr_e
,
2972 wps
->new_psk
, wps
->new_psk_len
)) {
2973 wpa_printf(MSG_DEBUG
, "WPS: Failed to configure the "
2976 os_free(wps
->new_psk
);
2977 wps
->new_psk
= NULL
;
2980 wps_cb_reg_success(wps
->wps
->registrar
, wps
->mac_addr_e
, wps
->uuid_e
);
2983 wps_registrar_remove_pbc_session(wps
->wps
->registrar
,
2985 wps_registrar_pbc_completed(wps
->wps
->registrar
);
2987 wps_registrar_pin_completed(wps
->wps
->registrar
);
2989 /* TODO: maintain AuthorizedMACs somewhere separately for each ER and
2990 * merge them into APs own list.. */
2992 wps_success_event(wps
->wps
);
2998 enum wps_process_res
wps_registrar_process_msg(struct wps_data
*wps
,
2999 enum wsc_op_code op_code
,
3000 const struct wpabuf
*msg
)
3002 enum wps_process_res ret
;
3004 wpa_printf(MSG_DEBUG
, "WPS: Processing received message (len=%lu "
3006 (unsigned long) wpabuf_len(msg
), op_code
);
3008 #ifdef CONFIG_WPS_UPNP
3009 if (wps
->wps
->wps_upnp
&& op_code
== WSC_MSG
&& wps
->ext_reg
== 1) {
3010 struct wps_parse_attr attr
;
3011 if (wps_parse_msg(msg
, &attr
) == 0 && attr
.msg_type
&&
3012 *attr
.msg_type
== WPS_M3
)
3013 wps
->ext_reg
= 2; /* past M2/M2D phase */
3015 if (wps
->ext_reg
> 1)
3016 wps_registrar_free_pending_m2(wps
->wps
);
3017 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&&
3018 wps
->wps
->upnp_msgs
== NULL
&&
3019 (op_code
== WSC_MSG
|| op_code
== WSC_Done
|| op_code
== WSC_NACK
))
3021 struct wps_parse_attr attr
;
3023 if (wps_parse_msg(msg
, &attr
) < 0 || attr
.msg_type
== NULL
)
3026 type
= *attr
.msg_type
;
3027 wpa_printf(MSG_DEBUG
, "WPS: Sending received message (type %d)"
3028 " to external Registrar for processing", type
);
3029 upnp_wps_device_send_wlan_event(wps
->wps
->wps_upnp
,
3031 UPNP_WPS_WLANEVENT_TYPE_EAP
,
3033 if (op_code
== WSC_MSG
)
3035 } else if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&& op_code
== WSC_MSG
) {
3036 wpa_printf(MSG_DEBUG
, "WPS: Skip internal processing - using "
3037 "external Registrar");
3038 return WPS_CONTINUE
;
3040 #endif /* CONFIG_WPS_UPNP */
3044 return wps_process_wsc_msg(wps
, msg
);
3046 if (wps_validate_wsc_ack(msg
) < 0)
3048 return wps_process_wsc_ack(wps
, msg
);
3050 if (wps_validate_wsc_nack(msg
) < 0)
3052 return wps_process_wsc_nack(wps
, msg
);
3054 if (wps_validate_wsc_done(msg
) < 0)
3056 ret
= wps_process_wsc_done(wps
, msg
);
3057 if (ret
== WPS_FAILURE
) {
3058 wps
->state
= SEND_WSC_NACK
;
3059 wps_fail_event(wps
->wps
, WPS_WSC_DONE
,
3061 wps
->error_indication
);
3065 wpa_printf(MSG_DEBUG
, "WPS: Unsupported op_code %d", op_code
);
3071 int wps_registrar_update_ie(struct wps_registrar
*reg
)
3073 return wps_set_ie(reg
);
3077 static void wps_registrar_set_selected_timeout(void *eloop_ctx
,
3080 struct wps_registrar
*reg
= eloop_ctx
;
3082 wpa_printf(MSG_DEBUG
, "WPS: Selected Registrar timeout - "
3083 "unselect internal Registrar");
3084 reg
->selected_registrar
= 0;
3086 wps_registrar_sel_registrar_changed_event(reg
->wps
);
3087 wps_registrar_selected_registrar_changed(reg
);
3091 #ifdef CONFIG_WPS_UPNP
3092 static void wps_registrar_sel_reg_add(struct wps_registrar
*reg
,
3093 struct subscription
*s
)
3096 wpa_printf(MSG_DEBUG
, "WPS: External Registrar selected (dev_pw_id=%d "
3097 "config_methods=0x%x)",
3098 s
->dev_password_id
, s
->config_methods
);
3099 reg
->sel_reg_union
= 1;
3100 if (reg
->sel_reg_dev_password_id_override
!= DEV_PW_PUSHBUTTON
)
3101 reg
->sel_reg_dev_password_id_override
= s
->dev_password_id
;
3102 if (reg
->sel_reg_config_methods_override
== -1)
3103 reg
->sel_reg_config_methods_override
= 0;
3104 reg
->sel_reg_config_methods_override
|= s
->config_methods
;
3105 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++)
3106 if (is_zero_ether_addr(reg
->authorized_macs_union
[i
]))
3108 for (j
= 0; i
< WPS_MAX_AUTHORIZED_MACS
&& j
< WPS_MAX_AUTHORIZED_MACS
;
3110 if (is_zero_ether_addr(s
->authorized_macs
[j
]))
3112 wpa_printf(MSG_DEBUG
, "WPS: Add authorized MAC into union: "
3113 MACSTR
, MAC2STR(s
->authorized_macs
[j
]));
3114 os_memcpy(reg
->authorized_macs_union
[i
],
3115 s
->authorized_macs
[j
], ETH_ALEN
);
3118 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs union",
3119 (u8
*) reg
->authorized_macs_union
,
3120 sizeof(reg
->authorized_macs_union
));
3122 #endif /* CONFIG_WPS_UPNP */
3125 static void wps_registrar_sel_reg_union(struct wps_registrar
*reg
)
3127 #ifdef CONFIG_WPS_UPNP
3128 struct subscription
*s
;
3130 if (reg
->wps
->wps_upnp
== NULL
)
3133 dl_list_for_each(s
, ®
->wps
->wps_upnp
->subscriptions
,
3134 struct subscription
, list
) {
3135 struct subscr_addr
*sa
;
3136 sa
= dl_list_first(&s
->addr_list
, struct subscr_addr
, list
);
3138 wpa_printf(MSG_DEBUG
, "WPS: External Registrar %s:%d",
3139 inet_ntoa(sa
->saddr
.sin_addr
),
3140 ntohs(sa
->saddr
.sin_port
));
3142 if (s
->selected_registrar
)
3143 wps_registrar_sel_reg_add(reg
, s
);
3145 wpa_printf(MSG_DEBUG
, "WPS: External Registrar not "
3148 #endif /* CONFIG_WPS_UPNP */
3153 * wps_registrar_selected_registrar_changed - SetSelectedRegistrar change
3154 * @reg: Registrar data from wps_registrar_init()
3156 * This function is called when selected registrar state changes, e.g., when an
3157 * AP receives a SetSelectedRegistrar UPnP message.
3159 void wps_registrar_selected_registrar_changed(struct wps_registrar
*reg
)
3161 wpa_printf(MSG_DEBUG
, "WPS: Selected registrar information changed");
3163 reg
->sel_reg_union
= reg
->selected_registrar
;
3164 reg
->sel_reg_dev_password_id_override
= -1;
3165 reg
->sel_reg_config_methods_override
= -1;
3166 os_memcpy(reg
->authorized_macs_union
, reg
->authorized_macs
,
3167 WPS_MAX_AUTHORIZED_MACS
* ETH_ALEN
);
3168 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs union (start with own)",
3169 (u8
*) reg
->authorized_macs_union
,
3170 sizeof(reg
->authorized_macs_union
));
3171 if (reg
->selected_registrar
) {
3174 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
3176 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
3177 WPS_CONFIG_PHY_PUSHBUTTON
);
3178 #endif /* CONFIG_WPS2 */
3180 reg
->sel_reg_dev_password_id_override
=
3182 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
3184 wpa_printf(MSG_DEBUG
, "WPS: Internal Registrar selected "
3185 "(pbc=%d)", reg
->pbc
);
3186 reg
->sel_reg_config_methods_override
= methods
;
3188 wpa_printf(MSG_DEBUG
, "WPS: Internal Registrar not selected");
3190 wps_registrar_sel_reg_union(reg
);
3193 wps_cb_set_sel_reg(reg
);
3197 int wps_registrar_get_info(struct wps_registrar
*reg
, const u8
*addr
,
3198 char *buf
, size_t buflen
)
3200 struct wps_registrar_device
*d
;
3203 char devtype
[WPS_DEV_TYPE_BUFSIZE
];
3205 d
= wps_device_get(reg
, addr
);
3208 if (uuid_bin2str(d
->uuid
, uuid
, sizeof(uuid
)))
3211 ret
= os_snprintf(buf
+ len
, buflen
- len
,
3213 "wpsPrimaryDeviceType=%s\n"
3214 "wpsDeviceName=%s\n"
3215 "wpsManufacturer=%s\n"
3217 "wpsModelNumber=%s\n"
3218 "wpsSerialNumber=%s\n",
3220 wps_dev_type_bin2str(d
->dev
.pri_dev_type
, devtype
,
3222 d
->dev
.device_name
? d
->dev
.device_name
: "",
3223 d
->dev
.manufacturer
? d
->dev
.manufacturer
: "",
3224 d
->dev
.model_name
? d
->dev
.model_name
: "",
3225 d
->dev
.model_number
? d
->dev
.model_number
: "",
3226 d
->dev
.serial_number
? d
->dev
.serial_number
: "");
3227 if (ret
< 0 || (size_t) ret
>= buflen
- len
)
3235 int wps_registrar_config_ap(struct wps_registrar
*reg
,
3236 struct wps_credential
*cred
)
3239 printf("encr_type=0x%x\n", cred
->encr_type
);
3240 if (!(cred
->encr_type
& (WPS_ENCR_NONE
| WPS_ENCR_TKIP
|
3242 if (cred
->encr_type
& WPS_ENCR_WEP
) {
3243 wpa_printf(MSG_INFO
, "WPS: Reject new AP settings "
3244 "due to WEP configuration");
3248 wpa_printf(MSG_INFO
, "WPS: Reject new AP settings due to "
3249 "invalid encr_type 0x%x", cred
->encr_type
);
3253 if ((cred
->encr_type
& (WPS_ENCR_TKIP
| WPS_ENCR_AES
)) ==
3255 wpa_printf(MSG_DEBUG
, "WPS: Upgrade encr_type TKIP -> "
3257 cred
->encr_type
|= WPS_ENCR_AES
;
3260 if ((cred
->auth_type
& (WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
)) ==
3262 wpa_printf(MSG_DEBUG
, "WPS: Upgrade auth_type WPAPSK -> "
3264 cred
->auth_type
|= WPS_AUTH_WPA2PSK
;
3266 #endif /* CONFIG_WPS2 */
3268 if (reg
->wps
->cred_cb
)
3269 return reg
->wps
->cred_cb(reg
->wps
->cb_ctx
, cred
);