2 * Wi-Fi Protected Setup - Registrar
3 * Copyright (c) 2008-2009, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "utils/base64.h"
13 #include "utils/eloop.h"
14 #include "utils/uuid.h"
15 #include "utils/list.h"
16 #include "crypto/crypto.h"
17 #include "crypto/sha256.h"
18 #include "crypto/random.h"
19 #include "common/ieee802_11_defs.h"
21 #include "wps_dev_attr.h"
23 #include "wps_upnp_i.h"
25 #ifndef CONFIG_WPS_STRICT
26 #define WPS_WORKAROUNDS
27 #endif /* CONFIG_WPS_STRICT */
31 u8 uuid
[WPS_UUID_LEN
];
35 #define PIN_LOCKED BIT(0)
36 #define PIN_EXPIRES BIT(1)
38 struct os_time expiration
;
39 u8 enrollee_addr
[ETH_ALEN
];
43 static void wps_free_pin(struct wps_uuid_pin
*pin
)
50 static void wps_remove_pin(struct wps_uuid_pin
*pin
)
52 dl_list_del(&pin
->list
);
57 static void wps_free_pins(struct dl_list
*pins
)
59 struct wps_uuid_pin
*pin
, *prev
;
60 dl_list_for_each_safe(pin
, prev
, pins
, struct wps_uuid_pin
, list
)
65 struct wps_pbc_session
{
66 struct wps_pbc_session
*next
;
68 u8 uuid_e
[WPS_UUID_LEN
];
69 struct os_time timestamp
;
73 static void wps_free_pbc_sessions(struct wps_pbc_session
*pbc
)
75 struct wps_pbc_session
*prev
;
85 struct wps_registrar_device
{
86 struct wps_registrar_device
*next
;
87 struct wps_device_data dev
;
88 u8 uuid
[WPS_UUID_LEN
];
92 struct wps_registrar
{
93 struct wps_context
*wps
;
96 int selected_registrar
;
98 int (*new_psk_cb
)(void *ctx
, const u8
*mac_addr
, const u8
*psk
,
100 int (*set_ie_cb
)(void *ctx
, struct wpabuf
*beacon_ie
,
101 struct wpabuf
*probe_resp_ie
);
102 void (*pin_needed_cb
)(void *ctx
, const u8
*uuid_e
,
103 const struct wps_device_data
*dev
);
104 void (*reg_success_cb
)(void *ctx
, const u8
*mac_addr
,
106 void (*set_sel_reg_cb
)(void *ctx
, int sel_reg
, u16 dev_passwd_id
,
107 u16 sel_reg_config_methods
);
108 void (*enrollee_seen_cb
)(void *ctx
, const u8
*addr
, const u8
*uuid_e
,
109 const u8
*pri_dev_type
, u16 config_methods
,
110 u16 dev_password_id
, u8 request_type
,
111 const char *dev_name
);
115 struct wps_pbc_session
*pbc_sessions
;
118 struct wpabuf
*extra_cred
;
119 int disable_auto_conf
;
121 int sel_reg_dev_password_id_override
;
122 int sel_reg_config_methods_override
;
126 struct wps_registrar_device
*devices
;
128 int force_pbc_overlap
;
130 u8 authorized_macs
[WPS_MAX_AUTHORIZED_MACS
][ETH_ALEN
];
131 u8 authorized_macs_union
[WPS_MAX_AUTHORIZED_MACS
][ETH_ALEN
];
133 u8 p2p_dev_addr
[ETH_ALEN
];
137 static int wps_set_ie(struct wps_registrar
*reg
);
138 static void wps_registrar_pbc_timeout(void *eloop_ctx
, void *timeout_ctx
);
139 static void wps_registrar_set_selected_timeout(void *eloop_ctx
,
143 static void wps_registrar_add_authorized_mac(struct wps_registrar
*reg
,
147 wpa_printf(MSG_DEBUG
, "WPS: Add authorized MAC " MACSTR
,
149 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++)
150 if (os_memcmp(reg
->authorized_macs
[i
], addr
, ETH_ALEN
) == 0) {
151 wpa_printf(MSG_DEBUG
, "WPS: Authorized MAC was "
152 "already in the list");
153 return; /* already in list */
155 for (i
= WPS_MAX_AUTHORIZED_MACS
- 1; i
> 0; i
--)
156 os_memcpy(reg
->authorized_macs
[i
], reg
->authorized_macs
[i
- 1],
158 os_memcpy(reg
->authorized_macs
[0], addr
, ETH_ALEN
);
159 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs",
160 (u8
*) reg
->authorized_macs
, sizeof(reg
->authorized_macs
));
164 static void wps_registrar_remove_authorized_mac(struct wps_registrar
*reg
,
168 wpa_printf(MSG_DEBUG
, "WPS: Remove authorized MAC " MACSTR
,
170 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++) {
171 if (os_memcmp(reg
->authorized_macs
, addr
, ETH_ALEN
) == 0)
174 if (i
== WPS_MAX_AUTHORIZED_MACS
) {
175 wpa_printf(MSG_DEBUG
, "WPS: Authorized MAC was not in the "
177 return; /* not in the list */
179 for (; i
+ 1 < WPS_MAX_AUTHORIZED_MACS
; i
++)
180 os_memcpy(reg
->authorized_macs
[i
], reg
->authorized_macs
[i
+ 1],
182 os_memset(reg
->authorized_macs
[WPS_MAX_AUTHORIZED_MACS
- 1], 0,
184 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs",
185 (u8
*) reg
->authorized_macs
, sizeof(reg
->authorized_macs
));
189 static void wps_free_devices(struct wps_registrar_device
*dev
)
191 struct wps_registrar_device
*prev
;
196 wps_device_data_free(&prev
->dev
);
202 static struct wps_registrar_device
* wps_device_get(struct wps_registrar
*reg
,
205 struct wps_registrar_device
*dev
;
207 for (dev
= reg
->devices
; dev
; dev
= dev
->next
) {
208 if (os_memcmp(dev
->dev
.mac_addr
, addr
, ETH_ALEN
) == 0)
215 static void wps_device_clone_data(struct wps_device_data
*dst
,
216 struct wps_device_data
*src
)
218 os_memcpy(dst
->mac_addr
, src
->mac_addr
, ETH_ALEN
);
219 os_memcpy(dst
->pri_dev_type
, src
->pri_dev_type
, WPS_DEV_TYPE_LEN
);
221 #define WPS_STRDUP(n) \
223 dst->n = src->n ? os_strdup(src->n) : NULL
225 WPS_STRDUP(device_name
);
226 WPS_STRDUP(manufacturer
);
227 WPS_STRDUP(model_name
);
228 WPS_STRDUP(model_number
);
229 WPS_STRDUP(serial_number
);
234 int wps_device_store(struct wps_registrar
*reg
,
235 struct wps_device_data
*dev
, const u8
*uuid
)
237 struct wps_registrar_device
*d
;
239 d
= wps_device_get(reg
, dev
->mac_addr
);
241 d
= os_zalloc(sizeof(*d
));
244 d
->next
= reg
->devices
;
248 wps_device_clone_data(&d
->dev
, dev
);
249 os_memcpy(d
->uuid
, uuid
, WPS_UUID_LEN
);
255 static void wps_registrar_add_pbc_session(struct wps_registrar
*reg
,
256 const u8
*addr
, const u8
*uuid_e
)
258 struct wps_pbc_session
*pbc
, *prev
= NULL
;
263 pbc
= reg
->pbc_sessions
;
265 if (os_memcmp(pbc
->addr
, addr
, ETH_ALEN
) == 0 &&
266 os_memcmp(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
) == 0) {
268 prev
->next
= pbc
->next
;
270 reg
->pbc_sessions
= pbc
->next
;
278 pbc
= os_zalloc(sizeof(*pbc
));
281 os_memcpy(pbc
->addr
, addr
, ETH_ALEN
);
283 os_memcpy(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
);
286 pbc
->next
= reg
->pbc_sessions
;
287 reg
->pbc_sessions
= pbc
;
288 pbc
->timestamp
= now
;
290 /* remove entries that have timed out */
295 if (now
.sec
> pbc
->timestamp
.sec
+ WPS_PBC_WALK_TIME
) {
297 wps_free_pbc_sessions(pbc
);
306 static void wps_registrar_remove_pbc_session(struct wps_registrar
*reg
,
308 const u8
*p2p_dev_addr
)
310 struct wps_pbc_session
*pbc
, *prev
= NULL
, *tmp
;
312 pbc
= reg
->pbc_sessions
;
314 if (os_memcmp(pbc
->uuid_e
, uuid_e
, WPS_UUID_LEN
) == 0 ||
315 (p2p_dev_addr
&& !is_zero_ether_addr(reg
->p2p_dev_addr
) &&
316 os_memcmp(reg
->p2p_dev_addr
, p2p_dev_addr
, ETH_ALEN
) ==
319 prev
->next
= pbc
->next
;
321 reg
->pbc_sessions
= pbc
->next
;
324 wpa_printf(MSG_DEBUG
, "WPS: Removing PBC session for "
325 "addr=" MACSTR
, MAC2STR(tmp
->addr
));
326 wpa_hexdump(MSG_DEBUG
, "WPS: Removed UUID-E",
327 tmp
->uuid_e
, WPS_UUID_LEN
);
337 int wps_registrar_pbc_overlap(struct wps_registrar
*reg
,
338 const u8
*addr
, const u8
*uuid_e
)
341 struct wps_pbc_session
*pbc
;
342 struct wps_pbc_session
*first
= NULL
;
347 wpa_printf(MSG_DEBUG
, "WPS: Checking active PBC sessions for overlap");
350 wpa_printf(MSG_DEBUG
, "WPS: Add one for the requested UUID");
351 wpa_hexdump(MSG_DEBUG
, "WPS: Requested UUID",
352 uuid_e
, WPS_UUID_LEN
);
356 for (pbc
= reg
->pbc_sessions
; pbc
; pbc
= pbc
->next
) {
357 wpa_printf(MSG_DEBUG
, "WPS: Consider PBC session with " MACSTR
,
359 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E",
360 pbc
->uuid_e
, WPS_UUID_LEN
);
361 if (now
.sec
> pbc
->timestamp
.sec
+ WPS_PBC_WALK_TIME
) {
362 wpa_printf(MSG_DEBUG
, "WPS: PBC walk time has "
367 os_memcmp(pbc
->uuid_e
, first
->uuid_e
, WPS_UUID_LEN
) == 0) {
368 wpa_printf(MSG_DEBUG
, "WPS: Same Enrollee");
369 continue; /* same Enrollee */
371 if (uuid_e
== NULL
||
372 os_memcmp(uuid_e
, pbc
->uuid_e
, WPS_UUID_LEN
)) {
373 wpa_printf(MSG_DEBUG
, "WPS: New Enrollee");
380 wpa_printf(MSG_DEBUG
, "WPS: %u active PBC session(s) found", count
);
382 return count
> 1 ? 1 : 0;
386 static int wps_build_wps_state(struct wps_context
*wps
, struct wpabuf
*msg
)
388 wpa_printf(MSG_DEBUG
, "WPS: * Wi-Fi Protected Setup State (%d)",
390 wpabuf_put_be16(msg
, ATTR_WPS_STATE
);
391 wpabuf_put_be16(msg
, 1);
392 wpabuf_put_u8(msg
, wps
->wps_state
);
397 #ifdef CONFIG_WPS_UPNP
398 static void wps_registrar_free_pending_m2(struct wps_context
*wps
)
400 struct upnp_pending_message
*p
, *p2
, *prev
= NULL
;
403 if (p
->type
== WPS_M2
|| p
->type
== WPS_M2D
) {
405 wps
->upnp_msgs
= p
->next
;
407 prev
->next
= p
->next
;
408 wpa_printf(MSG_DEBUG
, "WPS UPnP: Drop pending M2/M2D");
411 wpabuf_free(p2
->msg
);
419 #endif /* CONFIG_WPS_UPNP */
422 static int wps_build_ap_setup_locked(struct wps_context
*wps
,
425 if (wps
->ap_setup_locked
&& wps
->ap_setup_locked
!= 2) {
426 wpa_printf(MSG_DEBUG
, "WPS: * AP Setup Locked");
427 wpabuf_put_be16(msg
, ATTR_AP_SETUP_LOCKED
);
428 wpabuf_put_be16(msg
, 1);
429 wpabuf_put_u8(msg
, 1);
435 static int wps_build_selected_registrar(struct wps_registrar
*reg
,
438 if (!reg
->sel_reg_union
)
440 wpa_printf(MSG_DEBUG
, "WPS: * Selected Registrar");
441 wpabuf_put_be16(msg
, ATTR_SELECTED_REGISTRAR
);
442 wpabuf_put_be16(msg
, 1);
443 wpabuf_put_u8(msg
, 1);
448 static int wps_build_sel_reg_dev_password_id(struct wps_registrar
*reg
,
451 u16 id
= reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
;
452 if (!reg
->sel_reg_union
)
454 if (reg
->sel_reg_dev_password_id_override
>= 0)
455 id
= reg
->sel_reg_dev_password_id_override
;
456 wpa_printf(MSG_DEBUG
, "WPS: * Device Password ID (%d)", id
);
457 wpabuf_put_be16(msg
, ATTR_DEV_PASSWORD_ID
);
458 wpabuf_put_be16(msg
, 2);
459 wpabuf_put_be16(msg
, id
);
464 static int wps_build_sel_pbc_reg_uuid_e(struct wps_registrar
*reg
,
467 u16 id
= reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
;
468 if (!reg
->sel_reg_union
)
470 if (reg
->sel_reg_dev_password_id_override
>= 0)
471 id
= reg
->sel_reg_dev_password_id_override
;
472 if (id
!= DEV_PW_PUSHBUTTON
|| !reg
->dualband
)
474 return wps_build_uuid_e(msg
, reg
->wps
->uuid
);
478 static void wps_set_pushbutton(u16
*methods
, u16 conf_methods
)
480 *methods
|= WPS_CONFIG_PUSHBUTTON
;
482 if (conf_methods
& WPS_CONFIG_VIRT_PUSHBUTTON
)
483 *methods
|= WPS_CONFIG_VIRT_PUSHBUTTON
;
484 if (conf_methods
& WPS_CONFIG_PHY_PUSHBUTTON
)
485 *methods
|= WPS_CONFIG_PHY_PUSHBUTTON
;
486 if (!(*methods
& (WPS_CONFIG_VIRT_PUSHBUTTON
|
487 WPS_CONFIG_PHY_PUSHBUTTON
))) {
489 * Required to include virtual/physical flag, but we were not
490 * configured with push button type, so have to default to one
493 *methods
|= WPS_CONFIG_PHY_PUSHBUTTON
;
495 #endif /* CONFIG_WPS2 */
499 static int wps_build_sel_reg_config_methods(struct wps_registrar
*reg
,
503 if (!reg
->sel_reg_union
)
505 methods
= reg
->wps
->config_methods
;
506 methods
&= ~WPS_CONFIG_PUSHBUTTON
;
508 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
509 WPS_CONFIG_PHY_PUSHBUTTON
);
510 #endif /* CONFIG_WPS2 */
512 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
513 if (reg
->sel_reg_config_methods_override
>= 0)
514 methods
= reg
->sel_reg_config_methods_override
;
515 wpa_printf(MSG_DEBUG
, "WPS: * Selected Registrar Config Methods (%x)",
517 wpabuf_put_be16(msg
, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS
);
518 wpabuf_put_be16(msg
, 2);
519 wpabuf_put_be16(msg
, methods
);
524 static int wps_build_probe_config_methods(struct wps_registrar
*reg
,
529 * These are the methods that the AP supports as an Enrollee for adding
530 * external Registrars.
532 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
534 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
535 WPS_CONFIG_PHY_PUSHBUTTON
);
536 #endif /* CONFIG_WPS2 */
537 wpa_printf(MSG_DEBUG
, "WPS: * Config Methods (%x)", methods
);
538 wpabuf_put_be16(msg
, ATTR_CONFIG_METHODS
);
539 wpabuf_put_be16(msg
, 2);
540 wpabuf_put_be16(msg
, methods
);
545 static int wps_build_config_methods_r(struct wps_registrar
*reg
,
548 return wps_build_config_methods(msg
, reg
->wps
->config_methods
);
552 const u8
* wps_authorized_macs(struct wps_registrar
*reg
, size_t *count
)
557 while (*count
< WPS_MAX_AUTHORIZED_MACS
) {
558 if (is_zero_ether_addr(reg
->authorized_macs_union
[*count
]))
562 #endif /* CONFIG_WPS2 */
564 return (const u8
*) reg
->authorized_macs_union
;
569 * wps_registrar_init - Initialize WPS Registrar data
570 * @wps: Pointer to longterm WPS context
571 * @cfg: Registrar configuration
572 * Returns: Pointer to allocated Registrar data or %NULL on failure
574 * This function is used to initialize WPS Registrar functionality. It can be
575 * used for a single Registrar run (e.g., when run in a supplicant) or multiple
576 * runs (e.g., when run as an internal Registrar in an AP). Caller is
577 * responsible for freeing the returned data with wps_registrar_deinit() when
578 * Registrar functionality is not needed anymore.
580 struct wps_registrar
*
581 wps_registrar_init(struct wps_context
*wps
,
582 const struct wps_registrar_config
*cfg
)
584 struct wps_registrar
*reg
= os_zalloc(sizeof(*reg
));
588 dl_list_init(®
->pins
);
590 reg
->new_psk_cb
= cfg
->new_psk_cb
;
591 reg
->set_ie_cb
= cfg
->set_ie_cb
;
592 reg
->pin_needed_cb
= cfg
->pin_needed_cb
;
593 reg
->reg_success_cb
= cfg
->reg_success_cb
;
594 reg
->set_sel_reg_cb
= cfg
->set_sel_reg_cb
;
595 reg
->enrollee_seen_cb
= cfg
->enrollee_seen_cb
;
596 reg
->cb_ctx
= cfg
->cb_ctx
;
597 reg
->skip_cred_build
= cfg
->skip_cred_build
;
598 if (cfg
->extra_cred
) {
599 reg
->extra_cred
= wpabuf_alloc_copy(cfg
->extra_cred
,
600 cfg
->extra_cred_len
);
601 if (reg
->extra_cred
== NULL
) {
606 reg
->disable_auto_conf
= cfg
->disable_auto_conf
;
607 reg
->sel_reg_dev_password_id_override
= -1;
608 reg
->sel_reg_config_methods_override
= -1;
609 reg
->static_wep_only
= cfg
->static_wep_only
;
610 reg
->dualband
= cfg
->dualband
;
612 if (wps_set_ie(reg
)) {
613 wps_registrar_deinit(reg
);
622 * wps_registrar_deinit - Deinitialize WPS Registrar data
623 * @reg: Registrar data from wps_registrar_init()
625 void wps_registrar_deinit(struct wps_registrar
*reg
)
629 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
630 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
631 wps_free_pins(®
->pins
);
632 wps_free_pbc_sessions(reg
->pbc_sessions
);
633 wpabuf_free(reg
->extra_cred
);
634 wps_free_devices(reg
->devices
);
640 * wps_registrar_add_pin - Configure a new PIN for Registrar
641 * @reg: Registrar data from wps_registrar_init()
642 * @addr: Enrollee MAC address or %NULL if not known
643 * @uuid: UUID-E or %NULL for wildcard (any UUID)
644 * @pin: PIN (Device Password)
645 * @pin_len: Length of pin in octets
646 * @timeout: Time (in seconds) when the PIN will be invalidated; 0 = no timeout
647 * Returns: 0 on success, -1 on failure
649 int wps_registrar_add_pin(struct wps_registrar
*reg
, const u8
*addr
,
650 const u8
*uuid
, const u8
*pin
, size_t pin_len
,
653 struct wps_uuid_pin
*p
;
655 p
= os_zalloc(sizeof(*p
));
659 os_memcpy(p
->enrollee_addr
, addr
, ETH_ALEN
);
661 p
->wildcard_uuid
= 1;
663 os_memcpy(p
->uuid
, uuid
, WPS_UUID_LEN
);
664 p
->pin
= os_malloc(pin_len
);
665 if (p
->pin
== NULL
) {
669 os_memcpy(p
->pin
, pin
, pin_len
);
670 p
->pin_len
= pin_len
;
673 p
->flags
|= PIN_EXPIRES
;
674 os_get_time(&p
->expiration
);
675 p
->expiration
.sec
+= timeout
;
678 dl_list_add(®
->pins
, &p
->list
);
680 wpa_printf(MSG_DEBUG
, "WPS: A new PIN configured (timeout=%d)",
682 wpa_hexdump(MSG_DEBUG
, "WPS: UUID", uuid
, WPS_UUID_LEN
);
683 wpa_hexdump_ascii_key(MSG_DEBUG
, "WPS: PIN", pin
, pin_len
);
684 reg
->selected_registrar
= 1;
687 wps_registrar_add_authorized_mac(reg
, addr
);
689 wps_registrar_add_authorized_mac(
690 reg
, (u8
*) "\xff\xff\xff\xff\xff\xff");
691 wps_registrar_selected_registrar_changed(reg
);
692 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
693 eloop_register_timeout(WPS_PBC_WALK_TIME
, 0,
694 wps_registrar_set_selected_timeout
,
701 static void wps_registrar_remove_pin(struct wps_registrar
*reg
,
702 struct wps_uuid_pin
*pin
)
705 u8 bcast
[ETH_ALEN
] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
707 if (is_zero_ether_addr(pin
->enrollee_addr
))
710 addr
= pin
->enrollee_addr
;
711 wps_registrar_remove_authorized_mac(reg
, addr
);
713 wps_registrar_selected_registrar_changed(reg
);
717 static void wps_registrar_expire_pins(struct wps_registrar
*reg
)
719 struct wps_uuid_pin
*pin
, *prev
;
723 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
725 if ((pin
->flags
& PIN_EXPIRES
) &&
726 os_time_before(&pin
->expiration
, &now
)) {
727 wpa_hexdump(MSG_DEBUG
, "WPS: Expired PIN for UUID",
728 pin
->uuid
, WPS_UUID_LEN
);
729 wps_registrar_remove_pin(reg
, pin
);
736 * wps_registrar_invalidate_wildcard_pin - Invalidate a wildcard PIN
737 * @reg: Registrar data from wps_registrar_init()
738 * Returns: 0 on success, -1 if not wildcard PIN is enabled
740 static int wps_registrar_invalidate_wildcard_pin(struct wps_registrar
*reg
)
742 struct wps_uuid_pin
*pin
, *prev
;
744 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
746 if (pin
->wildcard_uuid
) {
747 wpa_hexdump(MSG_DEBUG
, "WPS: Invalidated PIN for UUID",
748 pin
->uuid
, WPS_UUID_LEN
);
749 wps_registrar_remove_pin(reg
, pin
);
759 * wps_registrar_invalidate_pin - Invalidate a PIN for a specific UUID-E
760 * @reg: Registrar data from wps_registrar_init()
762 * Returns: 0 on success, -1 on failure (e.g., PIN not found)
764 int wps_registrar_invalidate_pin(struct wps_registrar
*reg
, const u8
*uuid
)
766 struct wps_uuid_pin
*pin
, *prev
;
768 dl_list_for_each_safe(pin
, prev
, ®
->pins
, struct wps_uuid_pin
, list
)
770 if (os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
771 wpa_hexdump(MSG_DEBUG
, "WPS: Invalidated PIN for UUID",
772 pin
->uuid
, WPS_UUID_LEN
);
773 wps_registrar_remove_pin(reg
, pin
);
782 static const u8
* wps_registrar_get_pin(struct wps_registrar
*reg
,
783 const u8
*uuid
, size_t *pin_len
)
785 struct wps_uuid_pin
*pin
, *found
= NULL
;
787 wps_registrar_expire_pins(reg
);
789 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
790 if (!pin
->wildcard_uuid
&&
791 os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
798 /* Check for wildcard UUIDs since none of the UUID-specific
800 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
801 if (pin
->wildcard_uuid
== 1 ||
802 pin
->wildcard_uuid
== 2) {
803 wpa_printf(MSG_DEBUG
, "WPS: Found a wildcard "
804 "PIN. Assigned it for this UUID-E");
805 pin
->wildcard_uuid
++;
806 os_memcpy(pin
->uuid
, uuid
, WPS_UUID_LEN
);
817 * Lock the PIN to avoid attacks based on concurrent re-use of the PIN
818 * that could otherwise avoid PIN invalidations.
820 if (found
->flags
& PIN_LOCKED
) {
821 wpa_printf(MSG_DEBUG
, "WPS: Selected PIN locked - do not "
822 "allow concurrent re-use");
825 *pin_len
= found
->pin_len
;
826 found
->flags
|= PIN_LOCKED
;
832 * wps_registrar_unlock_pin - Unlock a PIN for a specific UUID-E
833 * @reg: Registrar data from wps_registrar_init()
835 * Returns: 0 on success, -1 on failure
837 * PINs are locked to enforce only one concurrent use. This function unlocks a
838 * PIN to allow it to be used again. If the specified PIN was configured using
839 * a wildcard UUID, it will be removed instead of allowing multiple uses.
841 int wps_registrar_unlock_pin(struct wps_registrar
*reg
, const u8
*uuid
)
843 struct wps_uuid_pin
*pin
;
845 dl_list_for_each(pin
, ®
->pins
, struct wps_uuid_pin
, list
) {
846 if (os_memcmp(pin
->uuid
, uuid
, WPS_UUID_LEN
) == 0) {
847 if (pin
->wildcard_uuid
== 3) {
848 wpa_printf(MSG_DEBUG
, "WPS: Invalidating used "
850 return wps_registrar_invalidate_pin(reg
, uuid
);
852 pin
->flags
&= ~PIN_LOCKED
;
861 static void wps_registrar_stop_pbc(struct wps_registrar
*reg
)
863 reg
->selected_registrar
= 0;
865 os_memset(reg
->p2p_dev_addr
, 0, ETH_ALEN
);
866 wps_registrar_remove_authorized_mac(reg
,
867 (u8
*) "\xff\xff\xff\xff\xff\xff");
868 wps_registrar_selected_registrar_changed(reg
);
872 static void wps_registrar_pbc_timeout(void *eloop_ctx
, void *timeout_ctx
)
874 struct wps_registrar
*reg
= eloop_ctx
;
876 wpa_printf(MSG_DEBUG
, "WPS: PBC timed out - disable PBC mode");
877 wps_pbc_timeout_event(reg
->wps
);
878 wps_registrar_stop_pbc(reg
);
883 * wps_registrar_button_pushed - Notify Registrar that AP button was pushed
884 * @reg: Registrar data from wps_registrar_init()
885 * @p2p_dev_addr: Limit allowed PBC devices to the specified P2P device, %NULL
886 * indicates no such filtering
887 * Returns: 0 on success, -1 on failure, -2 on session overlap
889 * This function is called on an AP when a push button is pushed to activate
890 * PBC mode. The PBC mode will be stopped after walk time (2 minutes) timeout
891 * or when a PBC registration is completed. If more than one Enrollee in active
892 * PBC mode has been detected during the monitor time (previous 2 minutes), the
893 * PBC mode is not activated and -2 is returned to indicate session overlap.
894 * This is skipped if a specific Enrollee is selected.
896 int wps_registrar_button_pushed(struct wps_registrar
*reg
,
897 const u8
*p2p_dev_addr
)
899 if (p2p_dev_addr
== NULL
&&
900 wps_registrar_pbc_overlap(reg
, NULL
, NULL
)) {
901 wpa_printf(MSG_DEBUG
, "WPS: PBC overlap - do not start PBC "
903 wps_pbc_overlap_event(reg
->wps
);
906 wpa_printf(MSG_DEBUG
, "WPS: Button pushed - PBC mode started");
907 reg
->force_pbc_overlap
= 0;
908 reg
->selected_registrar
= 1;
911 os_memcpy(reg
->p2p_dev_addr
, p2p_dev_addr
, ETH_ALEN
);
913 os_memset(reg
->p2p_dev_addr
, 0, ETH_ALEN
);
914 wps_registrar_add_authorized_mac(reg
,
915 (u8
*) "\xff\xff\xff\xff\xff\xff");
916 wps_registrar_selected_registrar_changed(reg
);
918 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
919 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
920 eloop_register_timeout(WPS_PBC_WALK_TIME
, 0, wps_registrar_pbc_timeout
,
926 static void wps_registrar_pbc_completed(struct wps_registrar
*reg
)
928 wpa_printf(MSG_DEBUG
, "WPS: PBC completed - stopping PBC mode");
929 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
930 wps_registrar_stop_pbc(reg
);
934 static void wps_registrar_pin_completed(struct wps_registrar
*reg
)
936 wpa_printf(MSG_DEBUG
, "WPS: PIN completed using internal Registrar");
937 eloop_cancel_timeout(wps_registrar_set_selected_timeout
, reg
, NULL
);
938 reg
->selected_registrar
= 0;
939 wps_registrar_selected_registrar_changed(reg
);
943 void wps_registrar_complete(struct wps_registrar
*registrar
, const u8
*uuid_e
)
945 if (registrar
->pbc
) {
946 wps_registrar_remove_pbc_session(registrar
,
948 wps_registrar_pbc_completed(registrar
);
950 wps_registrar_pin_completed(registrar
);
955 int wps_registrar_wps_cancel(struct wps_registrar
*reg
)
958 wpa_printf(MSG_DEBUG
, "WPS: PBC is set - cancelling it");
959 wps_registrar_pbc_timeout(reg
, NULL
);
960 eloop_cancel_timeout(wps_registrar_pbc_timeout
, reg
, NULL
);
962 } else if (reg
->selected_registrar
) {
964 wpa_printf(MSG_DEBUG
, "WPS: PIN is set - cancelling it");
965 wps_registrar_pin_completed(reg
);
966 wps_registrar_invalidate_wildcard_pin(reg
);
974 * wps_registrar_probe_req_rx - Notify Registrar of Probe Request
975 * @reg: Registrar data from wps_registrar_init()
976 * @addr: MAC address of the Probe Request sender
977 * @wps_data: WPS IE contents
979 * This function is called on an AP when a Probe Request with WPS IE is
980 * received. This is used to track PBC mode use and to detect possible overlap
981 * situation with other WPS APs.
983 void wps_registrar_probe_req_rx(struct wps_registrar
*reg
, const u8
*addr
,
984 const struct wpabuf
*wps_data
,
987 struct wps_parse_attr attr
;
989 wpa_hexdump_buf(MSG_MSGDUMP
,
990 "WPS: Probe Request with WPS data received",
993 if (wps_parse_msg(wps_data
, &attr
) < 0)
996 if (attr
.config_methods
== NULL
) {
997 wpa_printf(MSG_DEBUG
, "WPS: No Config Methods attribute in "
1002 if (attr
.dev_password_id
== NULL
) {
1003 wpa_printf(MSG_DEBUG
, "WPS: No Device Password Id attribute "
1004 "in Probe Request");
1008 if (reg
->enrollee_seen_cb
&& attr
.uuid_e
&&
1009 attr
.primary_dev_type
&& attr
.request_type
&& !p2p_wildcard
) {
1010 char *dev_name
= NULL
;
1011 if (attr
.dev_name
) {
1012 dev_name
= os_zalloc(attr
.dev_name_len
+ 1);
1014 os_memcpy(dev_name
, attr
.dev_name
,
1018 reg
->enrollee_seen_cb(reg
->cb_ctx
, addr
, attr
.uuid_e
,
1019 attr
.primary_dev_type
,
1020 WPA_GET_BE16(attr
.config_methods
),
1021 WPA_GET_BE16(attr
.dev_password_id
),
1022 *attr
.request_type
, dev_name
);
1026 if (WPA_GET_BE16(attr
.dev_password_id
) != DEV_PW_PUSHBUTTON
)
1027 return; /* Not PBC */
1029 wpa_printf(MSG_DEBUG
, "WPS: Probe Request for PBC received from "
1030 MACSTR
, MAC2STR(addr
));
1031 if (attr
.uuid_e
== NULL
) {
1032 wpa_printf(MSG_DEBUG
, "WPS: Invalid Probe Request WPS IE: No "
1036 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E from Probe Request", attr
.uuid_e
,
1039 wps_registrar_add_pbc_session(reg
, addr
, attr
.uuid_e
);
1040 if (wps_registrar_pbc_overlap(reg
, addr
, attr
.uuid_e
)) {
1041 wpa_printf(MSG_DEBUG
, "WPS: PBC session overlap detected");
1042 reg
->force_pbc_overlap
= 1;
1043 wps_pbc_overlap_event(reg
->wps
);
1048 static int wps_cb_new_psk(struct wps_registrar
*reg
, const u8
*mac_addr
,
1049 const u8
*psk
, size_t psk_len
)
1051 if (reg
->new_psk_cb
== NULL
)
1054 return reg
->new_psk_cb(reg
->cb_ctx
, mac_addr
, psk
, psk_len
);
1058 static void wps_cb_pin_needed(struct wps_registrar
*reg
, const u8
*uuid_e
,
1059 const struct wps_device_data
*dev
)
1061 if (reg
->pin_needed_cb
== NULL
)
1064 reg
->pin_needed_cb(reg
->cb_ctx
, uuid_e
, dev
);
1068 static void wps_cb_reg_success(struct wps_registrar
*reg
, const u8
*mac_addr
,
1071 if (reg
->reg_success_cb
== NULL
)
1074 reg
->reg_success_cb(reg
->cb_ctx
, mac_addr
, uuid_e
);
1078 static int wps_cb_set_ie(struct wps_registrar
*reg
, struct wpabuf
*beacon_ie
,
1079 struct wpabuf
*probe_resp_ie
)
1081 return reg
->set_ie_cb(reg
->cb_ctx
, beacon_ie
, probe_resp_ie
);
1085 static void wps_cb_set_sel_reg(struct wps_registrar
*reg
)
1088 if (reg
->set_sel_reg_cb
== NULL
)
1091 if (reg
->selected_registrar
) {
1092 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
1094 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
1095 WPS_CONFIG_PHY_PUSHBUTTON
);
1096 #endif /* CONFIG_WPS2 */
1098 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
1101 wpa_printf(MSG_DEBUG
, "WPS: wps_cb_set_sel_reg: sel_reg=%d "
1102 "config_methods=0x%x pbc=%d methods=0x%x",
1103 reg
->selected_registrar
, reg
->wps
->config_methods
,
1106 reg
->set_sel_reg_cb(reg
->cb_ctx
, reg
->selected_registrar
,
1107 reg
->pbc
? DEV_PW_PUSHBUTTON
: DEV_PW_DEFAULT
,
1112 static int wps_set_ie(struct wps_registrar
*reg
)
1114 struct wpabuf
*beacon
;
1115 struct wpabuf
*probe
;
1116 const u8
*auth_macs
;
1118 size_t vendor_len
= 0;
1121 if (reg
->set_ie_cb
== NULL
)
1124 for (i
= 0; i
< MAX_WPS_VENDOR_EXTENSIONS
; i
++) {
1125 if (reg
->wps
->dev
.vendor_ext
[i
]) {
1126 vendor_len
+= 2 + 2;
1127 vendor_len
+= wpabuf_len(reg
->wps
->dev
.vendor_ext
[i
]);
1131 beacon
= wpabuf_alloc(400 + vendor_len
);
1134 probe
= wpabuf_alloc(500 + vendor_len
);
1135 if (probe
== NULL
) {
1136 wpabuf_free(beacon
);
1140 auth_macs
= wps_authorized_macs(reg
, &count
);
1142 wpa_printf(MSG_DEBUG
, "WPS: Build Beacon IEs");
1144 if (wps_build_version(beacon
) ||
1145 wps_build_wps_state(reg
->wps
, beacon
) ||
1146 wps_build_ap_setup_locked(reg
->wps
, beacon
) ||
1147 wps_build_selected_registrar(reg
, beacon
) ||
1148 wps_build_sel_reg_dev_password_id(reg
, beacon
) ||
1149 wps_build_sel_reg_config_methods(reg
, beacon
) ||
1150 wps_build_sel_pbc_reg_uuid_e(reg
, beacon
) ||
1151 (reg
->dualband
&& wps_build_rf_bands(®
->wps
->dev
, beacon
)) ||
1152 wps_build_wfa_ext(beacon
, 0, auth_macs
, count
) ||
1153 wps_build_vendor_ext(®
->wps
->dev
, beacon
)) {
1154 wpabuf_free(beacon
);
1160 if (wps_build_dev_name(®
->wps
->dev
, beacon
) ||
1161 wps_build_primary_dev_type(®
->wps
->dev
, beacon
)) {
1162 wpabuf_free(beacon
);
1166 #endif /* CONFIG_P2P */
1168 wpa_printf(MSG_DEBUG
, "WPS: Build Probe Response IEs");
1170 if (wps_build_version(probe
) ||
1171 wps_build_wps_state(reg
->wps
, probe
) ||
1172 wps_build_ap_setup_locked(reg
->wps
, probe
) ||
1173 wps_build_selected_registrar(reg
, probe
) ||
1174 wps_build_sel_reg_dev_password_id(reg
, probe
) ||
1175 wps_build_sel_reg_config_methods(reg
, probe
) ||
1176 wps_build_resp_type(probe
, reg
->wps
->ap
? WPS_RESP_AP
:
1177 WPS_RESP_REGISTRAR
) ||
1178 wps_build_uuid_e(probe
, reg
->wps
->uuid
) ||
1179 wps_build_device_attrs(®
->wps
->dev
, probe
) ||
1180 wps_build_probe_config_methods(reg
, probe
) ||
1181 wps_build_rf_bands(®
->wps
->dev
, probe
) ||
1182 wps_build_wfa_ext(probe
, 0, auth_macs
, count
) ||
1183 wps_build_vendor_ext(®
->wps
->dev
, probe
)) {
1184 wpabuf_free(beacon
);
1189 beacon
= wps_ie_encapsulate(beacon
);
1190 probe
= wps_ie_encapsulate(probe
);
1192 if (!beacon
|| !probe
) {
1193 wpabuf_free(beacon
);
1198 if (reg
->static_wep_only
) {
1200 * Windows XP and Vista clients can get confused about
1201 * EAP-Identity/Request when they probe the network with
1202 * EAPOL-Start. In such a case, they may assume the network is
1203 * using IEEE 802.1X and prompt user for a certificate while
1204 * the correct (non-WPS) behavior would be to ask for the
1205 * static WEP key. As a workaround, use Microsoft Provisioning
1206 * IE to advertise that legacy 802.1X is not supported.
1208 const u8 ms_wps
[7] = {
1209 WLAN_EID_VENDOR_SPECIFIC
, 5,
1210 /* Microsoft Provisioning IE (00:50:f2:5) */
1211 0x00, 0x50, 0xf2, 5,
1212 0x00 /* no legacy 802.1X or MS WPS */
1214 wpa_printf(MSG_DEBUG
, "WPS: Add Microsoft Provisioning IE "
1215 "into Beacon/Probe Response frames");
1216 wpabuf_put_data(beacon
, ms_wps
, sizeof(ms_wps
));
1217 wpabuf_put_data(probe
, ms_wps
, sizeof(ms_wps
));
1220 return wps_cb_set_ie(reg
, beacon
, probe
);
1224 static int wps_get_dev_password(struct wps_data
*wps
)
1229 os_free(wps
->dev_password
);
1230 wps
->dev_password
= NULL
;
1233 wpa_printf(MSG_DEBUG
, "WPS: Use default PIN for PBC");
1234 pin
= (const u8
*) "00000000";
1237 pin
= wps_registrar_get_pin(wps
->wps
->registrar
, wps
->uuid_e
,
1241 wpa_printf(MSG_DEBUG
, "WPS: No Device Password available for "
1243 wps_cb_pin_needed(wps
->wps
->registrar
, wps
->uuid_e
,
1248 wps
->dev_password
= os_malloc(pin_len
);
1249 if (wps
->dev_password
== NULL
)
1251 os_memcpy(wps
->dev_password
, pin
, pin_len
);
1252 wps
->dev_password_len
= pin_len
;
1258 static int wps_build_uuid_r(struct wps_data
*wps
, struct wpabuf
*msg
)
1260 wpa_printf(MSG_DEBUG
, "WPS: * UUID-R");
1261 wpabuf_put_be16(msg
, ATTR_UUID_R
);
1262 wpabuf_put_be16(msg
, WPS_UUID_LEN
);
1263 wpabuf_put_data(msg
, wps
->uuid_r
, WPS_UUID_LEN
);
1268 static int wps_build_r_hash(struct wps_data
*wps
, struct wpabuf
*msg
)
1274 if (random_get_bytes(wps
->snonce
, 2 * WPS_SECRET_NONCE_LEN
) < 0)
1276 wpa_hexdump(MSG_DEBUG
, "WPS: R-S1", wps
->snonce
, WPS_SECRET_NONCE_LEN
);
1277 wpa_hexdump(MSG_DEBUG
, "WPS: R-S2",
1278 wps
->snonce
+ WPS_SECRET_NONCE_LEN
, WPS_SECRET_NONCE_LEN
);
1280 if (wps
->dh_pubkey_e
== NULL
|| wps
->dh_pubkey_r
== NULL
) {
1281 wpa_printf(MSG_DEBUG
, "WPS: DH public keys not available for "
1282 "R-Hash derivation");
1286 wpa_printf(MSG_DEBUG
, "WPS: * R-Hash1");
1287 wpabuf_put_be16(msg
, ATTR_R_HASH1
);
1288 wpabuf_put_be16(msg
, SHA256_MAC_LEN
);
1289 hash
= wpabuf_put(msg
, SHA256_MAC_LEN
);
1290 /* R-Hash1 = HMAC_AuthKey(R-S1 || PSK1 || PK_E || PK_R) */
1291 addr
[0] = wps
->snonce
;
1292 len
[0] = WPS_SECRET_NONCE_LEN
;
1293 addr
[1] = wps
->psk1
;
1294 len
[1] = WPS_PSK_LEN
;
1295 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
1296 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
1297 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
1298 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
1299 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
1300 wpa_hexdump(MSG_DEBUG
, "WPS: R-Hash1", hash
, SHA256_MAC_LEN
);
1302 wpa_printf(MSG_DEBUG
, "WPS: * R-Hash2");
1303 wpabuf_put_be16(msg
, ATTR_R_HASH2
);
1304 wpabuf_put_be16(msg
, SHA256_MAC_LEN
);
1305 hash
= wpabuf_put(msg
, SHA256_MAC_LEN
);
1306 /* R-Hash2 = HMAC_AuthKey(R-S2 || PSK2 || PK_E || PK_R) */
1307 addr
[0] = wps
->snonce
+ WPS_SECRET_NONCE_LEN
;
1308 addr
[1] = wps
->psk2
;
1309 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
1310 wpa_hexdump(MSG_DEBUG
, "WPS: R-Hash2", hash
, SHA256_MAC_LEN
);
1316 static int wps_build_r_snonce1(struct wps_data
*wps
, struct wpabuf
*msg
)
1318 wpa_printf(MSG_DEBUG
, "WPS: * R-SNonce1");
1319 wpabuf_put_be16(msg
, ATTR_R_SNONCE1
);
1320 wpabuf_put_be16(msg
, WPS_SECRET_NONCE_LEN
);
1321 wpabuf_put_data(msg
, wps
->snonce
, WPS_SECRET_NONCE_LEN
);
1326 static int wps_build_r_snonce2(struct wps_data
*wps
, struct wpabuf
*msg
)
1328 wpa_printf(MSG_DEBUG
, "WPS: * R-SNonce2");
1329 wpabuf_put_be16(msg
, ATTR_R_SNONCE2
);
1330 wpabuf_put_be16(msg
, WPS_SECRET_NONCE_LEN
);
1331 wpabuf_put_data(msg
, wps
->snonce
+ WPS_SECRET_NONCE_LEN
,
1332 WPS_SECRET_NONCE_LEN
);
1337 static int wps_build_cred_network_idx(struct wpabuf
*msg
,
1338 const struct wps_credential
*cred
)
1340 wpa_printf(MSG_DEBUG
, "WPS: * Network Index (1)");
1341 wpabuf_put_be16(msg
, ATTR_NETWORK_INDEX
);
1342 wpabuf_put_be16(msg
, 1);
1343 wpabuf_put_u8(msg
, 1);
1348 static int wps_build_cred_ssid(struct wpabuf
*msg
,
1349 const struct wps_credential
*cred
)
1351 wpa_printf(MSG_DEBUG
, "WPS: * SSID");
1352 wpa_hexdump_ascii(MSG_DEBUG
, "WPS: SSID for Credential",
1353 cred
->ssid
, cred
->ssid_len
);
1354 wpabuf_put_be16(msg
, ATTR_SSID
);
1355 wpabuf_put_be16(msg
, cred
->ssid_len
);
1356 wpabuf_put_data(msg
, cred
->ssid
, cred
->ssid_len
);
1361 static int wps_build_cred_auth_type(struct wpabuf
*msg
,
1362 const struct wps_credential
*cred
)
1364 wpa_printf(MSG_DEBUG
, "WPS: * Authentication Type (0x%x)",
1366 wpabuf_put_be16(msg
, ATTR_AUTH_TYPE
);
1367 wpabuf_put_be16(msg
, 2);
1368 wpabuf_put_be16(msg
, cred
->auth_type
);
1373 static int wps_build_cred_encr_type(struct wpabuf
*msg
,
1374 const struct wps_credential
*cred
)
1376 wpa_printf(MSG_DEBUG
, "WPS: * Encryption Type (0x%x)",
1378 wpabuf_put_be16(msg
, ATTR_ENCR_TYPE
);
1379 wpabuf_put_be16(msg
, 2);
1380 wpabuf_put_be16(msg
, cred
->encr_type
);
1385 static int wps_build_cred_network_key(struct wpabuf
*msg
,
1386 const struct wps_credential
*cred
)
1388 wpa_printf(MSG_DEBUG
, "WPS: * Network Key (len=%d)",
1389 (int) cred
->key_len
);
1390 wpa_hexdump_key(MSG_DEBUG
, "WPS: Network Key",
1391 cred
->key
, cred
->key_len
);
1392 wpabuf_put_be16(msg
, ATTR_NETWORK_KEY
);
1393 wpabuf_put_be16(msg
, cred
->key_len
);
1394 wpabuf_put_data(msg
, cred
->key
, cred
->key_len
);
1399 static int wps_build_cred_mac_addr(struct wpabuf
*msg
,
1400 const struct wps_credential
*cred
)
1402 wpa_printf(MSG_DEBUG
, "WPS: * MAC Address (" MACSTR
")",
1403 MAC2STR(cred
->mac_addr
));
1404 wpabuf_put_be16(msg
, ATTR_MAC_ADDR
);
1405 wpabuf_put_be16(msg
, ETH_ALEN
);
1406 wpabuf_put_data(msg
, cred
->mac_addr
, ETH_ALEN
);
1411 static int wps_build_credential(struct wpabuf
*msg
,
1412 const struct wps_credential
*cred
)
1414 if (wps_build_cred_network_idx(msg
, cred
) ||
1415 wps_build_cred_ssid(msg
, cred
) ||
1416 wps_build_cred_auth_type(msg
, cred
) ||
1417 wps_build_cred_encr_type(msg
, cred
) ||
1418 wps_build_cred_network_key(msg
, cred
) ||
1419 wps_build_cred_mac_addr(msg
, cred
))
1425 int wps_build_credential_wrap(struct wpabuf
*msg
,
1426 const struct wps_credential
*cred
)
1428 struct wpabuf
*wbuf
;
1429 wbuf
= wpabuf_alloc(200);
1432 if (wps_build_credential(wbuf
, cred
)) {
1436 wpabuf_put_be16(msg
, ATTR_CRED
);
1437 wpabuf_put_be16(msg
, wpabuf_len(wbuf
));
1438 wpabuf_put_buf(msg
, wbuf
);
1444 int wps_build_cred(struct wps_data
*wps
, struct wpabuf
*msg
)
1446 struct wpabuf
*cred
;
1448 if (wps
->wps
->registrar
->skip_cred_build
)
1449 goto skip_cred_build
;
1451 wpa_printf(MSG_DEBUG
, "WPS: * Credential");
1452 if (wps
->use_cred
) {
1453 os_memcpy(&wps
->cred
, wps
->use_cred
, sizeof(wps
->cred
));
1456 os_memset(&wps
->cred
, 0, sizeof(wps
->cred
));
1458 os_memcpy(wps
->cred
.ssid
, wps
->wps
->ssid
, wps
->wps
->ssid_len
);
1459 wps
->cred
.ssid_len
= wps
->wps
->ssid_len
;
1461 /* Select the best authentication and encryption type */
1462 if (wps
->auth_type
& WPS_AUTH_WPA2PSK
)
1463 wps
->auth_type
= WPS_AUTH_WPA2PSK
;
1464 else if (wps
->auth_type
& WPS_AUTH_WPAPSK
)
1465 wps
->auth_type
= WPS_AUTH_WPAPSK
;
1466 else if (wps
->auth_type
& WPS_AUTH_OPEN
)
1467 wps
->auth_type
= WPS_AUTH_OPEN
;
1468 else if (wps
->auth_type
& WPS_AUTH_SHARED
)
1469 wps
->auth_type
= WPS_AUTH_SHARED
;
1471 wpa_printf(MSG_DEBUG
, "WPS: Unsupported auth_type 0x%x",
1475 wps
->cred
.auth_type
= wps
->auth_type
;
1477 if (wps
->auth_type
== WPS_AUTH_WPA2PSK
||
1478 wps
->auth_type
== WPS_AUTH_WPAPSK
) {
1479 if (wps
->encr_type
& WPS_ENCR_AES
)
1480 wps
->encr_type
= WPS_ENCR_AES
;
1481 else if (wps
->encr_type
& WPS_ENCR_TKIP
)
1482 wps
->encr_type
= WPS_ENCR_TKIP
;
1484 wpa_printf(MSG_DEBUG
, "WPS: No suitable encryption "
1485 "type for WPA/WPA2");
1489 if (wps
->encr_type
& WPS_ENCR_WEP
)
1490 wps
->encr_type
= WPS_ENCR_WEP
;
1491 else if (wps
->encr_type
& WPS_ENCR_NONE
)
1492 wps
->encr_type
= WPS_ENCR_NONE
;
1494 wpa_printf(MSG_DEBUG
, "WPS: No suitable encryption "
1495 "type for non-WPA/WPA2 mode");
1499 wps
->cred
.encr_type
= wps
->encr_type
;
1501 * Set MAC address in the Credential to be the Enrollee's MAC address
1503 os_memcpy(wps
->cred
.mac_addr
, wps
->mac_addr_e
, ETH_ALEN
);
1505 if (wps
->wps
->wps_state
== WPS_STATE_NOT_CONFIGURED
&& wps
->wps
->ap
&&
1506 !wps
->wps
->registrar
->disable_auto_conf
) {
1508 /* Generate a random passphrase */
1509 if (random_get_bytes(r
, sizeof(r
)) < 0)
1511 os_free(wps
->new_psk
);
1512 wps
->new_psk
= base64_encode(r
, sizeof(r
), &wps
->new_psk_len
);
1513 if (wps
->new_psk
== NULL
)
1515 wps
->new_psk_len
--; /* remove newline */
1516 while (wps
->new_psk_len
&&
1517 wps
->new_psk
[wps
->new_psk_len
- 1] == '=')
1519 wpa_hexdump_ascii_key(MSG_DEBUG
, "WPS: Generated passphrase",
1520 wps
->new_psk
, wps
->new_psk_len
);
1521 os_memcpy(wps
->cred
.key
, wps
->new_psk
, wps
->new_psk_len
);
1522 wps
->cred
.key_len
= wps
->new_psk_len
;
1523 } else if (wps
->use_psk_key
&& wps
->wps
->psk_set
) {
1525 wpa_printf(MSG_DEBUG
, "WPS: Use PSK format for Network Key");
1526 wpa_snprintf_hex(hex
, sizeof(hex
), wps
->wps
->psk
, 32);
1527 os_memcpy(wps
->cred
.key
, hex
, 32 * 2);
1528 wps
->cred
.key_len
= 32 * 2;
1529 } else if (wps
->wps
->network_key
) {
1530 os_memcpy(wps
->cred
.key
, wps
->wps
->network_key
,
1531 wps
->wps
->network_key_len
);
1532 wps
->cred
.key_len
= wps
->wps
->network_key_len
;
1533 } else if (wps
->auth_type
& (WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
)) {
1535 /* Generate a random per-device PSK */
1536 os_free(wps
->new_psk
);
1537 wps
->new_psk_len
= 32;
1538 wps
->new_psk
= os_malloc(wps
->new_psk_len
);
1539 if (wps
->new_psk
== NULL
)
1541 if (random_get_bytes(wps
->new_psk
, wps
->new_psk_len
) < 0) {
1542 os_free(wps
->new_psk
);
1543 wps
->new_psk
= NULL
;
1546 wpa_hexdump_key(MSG_DEBUG
, "WPS: Generated per-device PSK",
1547 wps
->new_psk
, wps
->new_psk_len
);
1548 wpa_snprintf_hex(hex
, sizeof(hex
), wps
->new_psk
,
1550 os_memcpy(wps
->cred
.key
, hex
, wps
->new_psk_len
* 2);
1551 wps
->cred
.key_len
= wps
->new_psk_len
* 2;
1555 #ifdef CONFIG_WPS_TESTING
1556 if (wps_testing_dummy_cred
)
1557 cred
= wpabuf_alloc(200);
1561 struct wps_credential dummy
;
1562 wpa_printf(MSG_DEBUG
, "WPS: Add dummy credential");
1563 os_memset(&dummy
, 0, sizeof(dummy
));
1564 os_memcpy(dummy
.ssid
, "dummy", 5);
1566 dummy
.auth_type
= WPS_AUTH_WPA2PSK
;
1567 dummy
.encr_type
= WPS_ENCR_AES
;
1568 os_memcpy(dummy
.key
, "dummy psk", 9);
1570 os_memcpy(dummy
.mac_addr
, wps
->mac_addr_e
, ETH_ALEN
);
1571 wps_build_credential(cred
, &dummy
);
1572 wpa_hexdump_buf(MSG_DEBUG
, "WPS: Dummy Credential", cred
);
1574 wpabuf_put_be16(msg
, ATTR_CRED
);
1575 wpabuf_put_be16(msg
, wpabuf_len(cred
));
1576 wpabuf_put_buf(msg
, cred
);
1580 #endif /* CONFIG_WPS_TESTING */
1582 cred
= wpabuf_alloc(200);
1586 if (wps_build_credential(cred
, &wps
->cred
)) {
1591 wpabuf_put_be16(msg
, ATTR_CRED
);
1592 wpabuf_put_be16(msg
, wpabuf_len(cred
));
1593 wpabuf_put_buf(msg
, cred
);
1597 if (wps
->wps
->registrar
->extra_cred
) {
1598 wpa_printf(MSG_DEBUG
, "WPS: * Credential (pre-configured)");
1599 wpabuf_put_buf(msg
, wps
->wps
->registrar
->extra_cred
);
1606 static int wps_build_ap_settings(struct wps_data
*wps
, struct wpabuf
*msg
)
1608 wpa_printf(MSG_DEBUG
, "WPS: * AP Settings");
1610 if (wps_build_credential(msg
, &wps
->cred
))
1617 static struct wpabuf
* wps_build_ap_cred(struct wps_data
*wps
)
1619 struct wpabuf
*msg
, *plain
;
1621 msg
= wpabuf_alloc(1000);
1625 plain
= wpabuf_alloc(200);
1626 if (plain
== NULL
) {
1631 if (wps_build_ap_settings(wps
, plain
)) {
1637 wpabuf_put_be16(msg
, ATTR_CRED
);
1638 wpabuf_put_be16(msg
, wpabuf_len(plain
));
1639 wpabuf_put_buf(msg
, plain
);
1646 static struct wpabuf
* wps_build_m2(struct wps_data
*wps
)
1650 if (random_get_bytes(wps
->nonce_r
, WPS_NONCE_LEN
) < 0)
1652 wpa_hexdump(MSG_DEBUG
, "WPS: Registrar Nonce",
1653 wps
->nonce_r
, WPS_NONCE_LEN
);
1654 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-R", wps
->uuid_r
, WPS_UUID_LEN
);
1656 wpa_printf(MSG_DEBUG
, "WPS: Building Message M2");
1657 msg
= wpabuf_alloc(1000);
1661 if (wps_build_version(msg
) ||
1662 wps_build_msg_type(msg
, WPS_M2
) ||
1663 wps_build_enrollee_nonce(wps
, msg
) ||
1664 wps_build_registrar_nonce(wps
, msg
) ||
1665 wps_build_uuid_r(wps
, msg
) ||
1666 wps_build_public_key(wps
, msg
) ||
1667 wps_derive_keys(wps
) ||
1668 wps_build_auth_type_flags(wps
, msg
) ||
1669 wps_build_encr_type_flags(wps
, msg
) ||
1670 wps_build_conn_type_flags(wps
, msg
) ||
1671 wps_build_config_methods_r(wps
->wps
->registrar
, msg
) ||
1672 wps_build_device_attrs(&wps
->wps
->dev
, msg
) ||
1673 wps_build_rf_bands(&wps
->wps
->dev
, msg
) ||
1674 wps_build_assoc_state(wps
, msg
) ||
1675 wps_build_config_error(msg
, WPS_CFG_NO_ERROR
) ||
1676 wps_build_dev_password_id(msg
, wps
->dev_pw_id
) ||
1677 wps_build_os_version(&wps
->wps
->dev
, msg
) ||
1678 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1679 wps_build_authenticator(wps
, msg
)) {
1685 wps
->state
= RECV_M3
;
1690 static struct wpabuf
* wps_build_m2d(struct wps_data
*wps
)
1693 u16 err
= wps
->config_error
;
1695 wpa_printf(MSG_DEBUG
, "WPS: Building Message M2D");
1696 msg
= wpabuf_alloc(1000);
1700 if (wps
->wps
->ap
&& wps
->wps
->ap_setup_locked
&&
1701 err
== WPS_CFG_NO_ERROR
)
1702 err
= WPS_CFG_SETUP_LOCKED
;
1704 if (wps_build_version(msg
) ||
1705 wps_build_msg_type(msg
, WPS_M2D
) ||
1706 wps_build_enrollee_nonce(wps
, msg
) ||
1707 wps_build_registrar_nonce(wps
, msg
) ||
1708 wps_build_uuid_r(wps
, msg
) ||
1709 wps_build_auth_type_flags(wps
, msg
) ||
1710 wps_build_encr_type_flags(wps
, msg
) ||
1711 wps_build_conn_type_flags(wps
, msg
) ||
1712 wps_build_config_methods_r(wps
->wps
->registrar
, msg
) ||
1713 wps_build_device_attrs(&wps
->wps
->dev
, msg
) ||
1714 wps_build_rf_bands(&wps
->wps
->dev
, msg
) ||
1715 wps_build_assoc_state(wps
, msg
) ||
1716 wps_build_config_error(msg
, err
) ||
1717 wps_build_os_version(&wps
->wps
->dev
, msg
) ||
1718 wps_build_wfa_ext(msg
, 0, NULL
, 0)) {
1723 wps
->state
= RECV_M2D_ACK
;
1728 static struct wpabuf
* wps_build_m4(struct wps_data
*wps
)
1730 struct wpabuf
*msg
, *plain
;
1732 wpa_printf(MSG_DEBUG
, "WPS: Building Message M4");
1734 wps_derive_psk(wps
, wps
->dev_password
, wps
->dev_password_len
);
1736 plain
= wpabuf_alloc(200);
1740 msg
= wpabuf_alloc(1000);
1746 if (wps_build_version(msg
) ||
1747 wps_build_msg_type(msg
, WPS_M4
) ||
1748 wps_build_enrollee_nonce(wps
, msg
) ||
1749 wps_build_r_hash(wps
, msg
) ||
1750 wps_build_r_snonce1(wps
, plain
) ||
1751 wps_build_key_wrap_auth(wps
, plain
) ||
1752 wps_build_encr_settings(wps
, msg
, plain
) ||
1753 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1754 wps_build_authenticator(wps
, msg
)) {
1761 wps
->state
= RECV_M5
;
1766 static struct wpabuf
* wps_build_m6(struct wps_data
*wps
)
1768 struct wpabuf
*msg
, *plain
;
1770 wpa_printf(MSG_DEBUG
, "WPS: Building Message M6");
1772 plain
= wpabuf_alloc(200);
1776 msg
= wpabuf_alloc(1000);
1782 if (wps_build_version(msg
) ||
1783 wps_build_msg_type(msg
, WPS_M6
) ||
1784 wps_build_enrollee_nonce(wps
, msg
) ||
1785 wps_build_r_snonce2(wps
, plain
) ||
1786 wps_build_key_wrap_auth(wps
, plain
) ||
1787 wps_build_encr_settings(wps
, msg
, plain
) ||
1788 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1789 wps_build_authenticator(wps
, msg
)) {
1796 wps
->wps_pin_revealed
= 1;
1797 wps
->state
= RECV_M7
;
1802 static struct wpabuf
* wps_build_m8(struct wps_data
*wps
)
1804 struct wpabuf
*msg
, *plain
;
1806 wpa_printf(MSG_DEBUG
, "WPS: Building Message M8");
1808 plain
= wpabuf_alloc(500);
1812 msg
= wpabuf_alloc(1000);
1818 if (wps_build_version(msg
) ||
1819 wps_build_msg_type(msg
, WPS_M8
) ||
1820 wps_build_enrollee_nonce(wps
, msg
) ||
1821 ((wps
->wps
->ap
|| wps
->er
) && wps_build_cred(wps
, plain
)) ||
1822 (!wps
->wps
->ap
&& !wps
->er
&& wps_build_ap_settings(wps
, plain
)) ||
1823 wps_build_key_wrap_auth(wps
, plain
) ||
1824 wps_build_encr_settings(wps
, msg
, plain
) ||
1825 wps_build_wfa_ext(msg
, 0, NULL
, 0) ||
1826 wps_build_authenticator(wps
, msg
)) {
1833 wps
->state
= RECV_DONE
;
1838 struct wpabuf
* wps_registrar_get_msg(struct wps_data
*wps
,
1839 enum wsc_op_code
*op_code
)
1843 #ifdef CONFIG_WPS_UPNP
1844 if (!wps
->int_reg
&& wps
->wps
->wps_upnp
) {
1845 struct upnp_pending_message
*p
, *prev
= NULL
;
1846 if (wps
->ext_reg
> 1)
1847 wps_registrar_free_pending_m2(wps
->wps
);
1848 p
= wps
->wps
->upnp_msgs
;
1849 /* TODO: check pending message MAC address */
1850 while (p
&& p
->next
) {
1855 wpa_printf(MSG_DEBUG
, "WPS: Use pending message from "
1860 wps
->wps
->upnp_msgs
= NULL
;
1867 *op_code
= WSC_NACK
;
1874 if (wps
->ext_reg
== 0)
1880 wpa_printf(MSG_DEBUG
, "WPS: Using external Registrar, but no "
1881 "pending message available");
1884 #endif /* CONFIG_WPS_UPNP */
1886 switch (wps
->state
) {
1888 if (wps_get_dev_password(wps
) < 0)
1889 msg
= wps_build_m2d(wps
);
1891 msg
= wps_build_m2(wps
);
1895 msg
= wps_build_m2d(wps
);
1899 msg
= wps_build_m4(wps
);
1903 msg
= wps_build_m6(wps
);
1907 msg
= wps_build_m8(wps
);
1911 msg
= wps_build_wsc_ack(wps
);
1915 msg
= wps_build_wsc_nack(wps
);
1916 *op_code
= WSC_NACK
;
1919 wpa_printf(MSG_DEBUG
, "WPS: Unsupported state %d for building "
1920 "a message", wps
->state
);
1925 if (*op_code
== WSC_MSG
&& msg
) {
1926 /* Save a copy of the last message for Authenticator derivation
1928 wpabuf_free(wps
->last_msg
);
1929 wps
->last_msg
= wpabuf_dup(msg
);
1936 static int wps_process_enrollee_nonce(struct wps_data
*wps
, const u8
*e_nonce
)
1938 if (e_nonce
== NULL
) {
1939 wpa_printf(MSG_DEBUG
, "WPS: No Enrollee Nonce received");
1943 os_memcpy(wps
->nonce_e
, e_nonce
, WPS_NONCE_LEN
);
1944 wpa_hexdump(MSG_DEBUG
, "WPS: Enrollee Nonce",
1945 wps
->nonce_e
, WPS_NONCE_LEN
);
1951 static int wps_process_registrar_nonce(struct wps_data
*wps
, const u8
*r_nonce
)
1953 if (r_nonce
== NULL
) {
1954 wpa_printf(MSG_DEBUG
, "WPS: No Registrar Nonce received");
1958 if (os_memcmp(wps
->nonce_r
, r_nonce
, WPS_NONCE_LEN
) != 0) {
1959 wpa_printf(MSG_DEBUG
, "WPS: Invalid Registrar Nonce received");
1967 static int wps_process_uuid_e(struct wps_data
*wps
, const u8
*uuid_e
)
1969 if (uuid_e
== NULL
) {
1970 wpa_printf(MSG_DEBUG
, "WPS: No UUID-E received");
1974 os_memcpy(wps
->uuid_e
, uuid_e
, WPS_UUID_LEN
);
1975 wpa_hexdump(MSG_DEBUG
, "WPS: UUID-E", wps
->uuid_e
, WPS_UUID_LEN
);
1981 static int wps_process_dev_password_id(struct wps_data
*wps
, const u8
*pw_id
)
1983 if (pw_id
== NULL
) {
1984 wpa_printf(MSG_DEBUG
, "WPS: No Device Password ID received");
1988 wps
->dev_pw_id
= WPA_GET_BE16(pw_id
);
1989 wpa_printf(MSG_DEBUG
, "WPS: Device Password ID %d", wps
->dev_pw_id
);
1995 static int wps_process_e_hash1(struct wps_data
*wps
, const u8
*e_hash1
)
1997 if (e_hash1
== NULL
) {
1998 wpa_printf(MSG_DEBUG
, "WPS: No E-Hash1 received");
2002 os_memcpy(wps
->peer_hash1
, e_hash1
, WPS_HASH_LEN
);
2003 wpa_hexdump(MSG_DEBUG
, "WPS: E-Hash1", wps
->peer_hash1
, WPS_HASH_LEN
);
2009 static int wps_process_e_hash2(struct wps_data
*wps
, const u8
*e_hash2
)
2011 if (e_hash2
== NULL
) {
2012 wpa_printf(MSG_DEBUG
, "WPS: No E-Hash2 received");
2016 os_memcpy(wps
->peer_hash2
, e_hash2
, WPS_HASH_LEN
);
2017 wpa_hexdump(MSG_DEBUG
, "WPS: E-Hash2", wps
->peer_hash2
, WPS_HASH_LEN
);
2023 static int wps_process_e_snonce1(struct wps_data
*wps
, const u8
*e_snonce1
)
2025 u8 hash
[SHA256_MAC_LEN
];
2029 if (e_snonce1
== NULL
) {
2030 wpa_printf(MSG_DEBUG
, "WPS: No E-SNonce1 received");
2034 wpa_hexdump_key(MSG_DEBUG
, "WPS: E-SNonce1", e_snonce1
,
2035 WPS_SECRET_NONCE_LEN
);
2037 /* E-Hash1 = HMAC_AuthKey(E-S1 || PSK1 || PK_E || PK_R) */
2038 addr
[0] = e_snonce1
;
2039 len
[0] = WPS_SECRET_NONCE_LEN
;
2040 addr
[1] = wps
->psk1
;
2041 len
[1] = WPS_PSK_LEN
;
2042 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
2043 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
2044 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
2045 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
2046 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
2048 if (os_memcmp(wps
->peer_hash1
, hash
, WPS_HASH_LEN
) != 0) {
2049 wpa_printf(MSG_DEBUG
, "WPS: E-Hash1 derived from E-S1 does "
2050 "not match with the pre-committed value");
2051 wps
->config_error
= WPS_CFG_DEV_PASSWORD_AUTH_FAILURE
;
2052 wps_pwd_auth_fail_event(wps
->wps
, 0, 1);
2056 wpa_printf(MSG_DEBUG
, "WPS: Enrollee proved knowledge of the first "
2057 "half of the device password");
2063 static int wps_process_e_snonce2(struct wps_data
*wps
, const u8
*e_snonce2
)
2065 u8 hash
[SHA256_MAC_LEN
];
2069 if (e_snonce2
== NULL
) {
2070 wpa_printf(MSG_DEBUG
, "WPS: No E-SNonce2 received");
2074 wpa_hexdump_key(MSG_DEBUG
, "WPS: E-SNonce2", e_snonce2
,
2075 WPS_SECRET_NONCE_LEN
);
2077 /* E-Hash2 = HMAC_AuthKey(E-S2 || PSK2 || PK_E || PK_R) */
2078 addr
[0] = e_snonce2
;
2079 len
[0] = WPS_SECRET_NONCE_LEN
;
2080 addr
[1] = wps
->psk2
;
2081 len
[1] = WPS_PSK_LEN
;
2082 addr
[2] = wpabuf_head(wps
->dh_pubkey_e
);
2083 len
[2] = wpabuf_len(wps
->dh_pubkey_e
);
2084 addr
[3] = wpabuf_head(wps
->dh_pubkey_r
);
2085 len
[3] = wpabuf_len(wps
->dh_pubkey_r
);
2086 hmac_sha256_vector(wps
->authkey
, WPS_AUTHKEY_LEN
, 4, addr
, len
, hash
);
2088 if (os_memcmp(wps
->peer_hash2
, hash
, WPS_HASH_LEN
) != 0) {
2089 wpa_printf(MSG_DEBUG
, "WPS: E-Hash2 derived from E-S2 does "
2090 "not match with the pre-committed value");
2091 wps_registrar_invalidate_pin(wps
->wps
->registrar
, wps
->uuid_e
);
2092 wps
->config_error
= WPS_CFG_DEV_PASSWORD_AUTH_FAILURE
;
2093 wps_pwd_auth_fail_event(wps
->wps
, 0, 2);
2097 wpa_printf(MSG_DEBUG
, "WPS: Enrollee proved knowledge of the second "
2098 "half of the device password");
2099 wps
->wps_pin_revealed
= 0;
2100 wps_registrar_unlock_pin(wps
->wps
->registrar
, wps
->uuid_e
);
2103 * In case wildcard PIN is used and WPS handshake succeeds in the first
2104 * attempt, wps_registrar_unlock_pin() would not free the PIN, so make
2105 * sure the PIN gets invalidated here.
2107 wps_registrar_invalidate_pin(wps
->wps
->registrar
, wps
->uuid_e
);
2113 static int wps_process_mac_addr(struct wps_data
*wps
, const u8
*mac_addr
)
2115 if (mac_addr
== NULL
) {
2116 wpa_printf(MSG_DEBUG
, "WPS: No MAC Address received");
2120 wpa_printf(MSG_DEBUG
, "WPS: Enrollee MAC Address " MACSTR
,
2122 os_memcpy(wps
->mac_addr_e
, mac_addr
, ETH_ALEN
);
2123 os_memcpy(wps
->peer_dev
.mac_addr
, mac_addr
, ETH_ALEN
);
2129 static int wps_process_pubkey(struct wps_data
*wps
, const u8
*pk
,
2132 if (pk
== NULL
|| pk_len
== 0) {
2133 wpa_printf(MSG_DEBUG
, "WPS: No Public Key received");
2137 #ifdef CONFIG_WPS_OOB
2138 if (wps
->wps
->oob_conf
.pubkey_hash
!= NULL
) {
2140 u8 hash
[WPS_HASH_LEN
];
2143 sha256_vector(1, addr
, &pk_len
, hash
);
2145 wpabuf_head(wps
->wps
->oob_conf
.pubkey_hash
),
2146 WPS_OOB_PUBKEY_HASH_LEN
) != 0) {
2147 wpa_printf(MSG_ERROR
, "WPS: Public Key hash error");
2151 #endif /* CONFIG_WPS_OOB */
2153 wpabuf_free(wps
->dh_pubkey_e
);
2154 wps
->dh_pubkey_e
= wpabuf_alloc_copy(pk
, pk_len
);
2155 if (wps
->dh_pubkey_e
== NULL
)
2162 static int wps_process_auth_type_flags(struct wps_data
*wps
, const u8
*auth
)
2167 wpa_printf(MSG_DEBUG
, "WPS: No Authentication Type flags "
2172 auth_types
= WPA_GET_BE16(auth
);
2174 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Authentication Type flags 0x%x",
2176 wps
->auth_type
= wps
->wps
->auth_types
& auth_types
;
2177 if (wps
->auth_type
== 0) {
2178 wpa_printf(MSG_DEBUG
, "WPS: No match in supported "
2179 "authentication types (own 0x%x Enrollee 0x%x)",
2180 wps
->wps
->auth_types
, auth_types
);
2181 #ifdef WPS_WORKAROUNDS
2183 * Some deployed implementations seem to advertise incorrect
2184 * information in this attribute. For example, Linksys WRT350N
2185 * seems to have a byteorder bug that breaks this negotiation.
2186 * In order to interoperate with existing implementations,
2187 * assume that the Enrollee supports everything we do.
2189 wpa_printf(MSG_DEBUG
, "WPS: Workaround - assume Enrollee "
2190 "does not advertise supported authentication types "
2192 wps
->auth_type
= wps
->wps
->auth_types
;
2193 #else /* WPS_WORKAROUNDS */
2195 #endif /* WPS_WORKAROUNDS */
2202 static int wps_process_encr_type_flags(struct wps_data
*wps
, const u8
*encr
)
2207 wpa_printf(MSG_DEBUG
, "WPS: No Encryption Type flags "
2212 encr_types
= WPA_GET_BE16(encr
);
2214 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Encryption Type flags 0x%x",
2216 wps
->encr_type
= wps
->wps
->encr_types
& encr_types
;
2217 if (wps
->encr_type
== 0) {
2218 wpa_printf(MSG_DEBUG
, "WPS: No match in supported "
2219 "encryption types (own 0x%x Enrollee 0x%x)",
2220 wps
->wps
->encr_types
, encr_types
);
2221 #ifdef WPS_WORKAROUNDS
2223 * Some deployed implementations seem to advertise incorrect
2224 * information in this attribute. For example, Linksys WRT350N
2225 * seems to have a byteorder bug that breaks this negotiation.
2226 * In order to interoperate with existing implementations,
2227 * assume that the Enrollee supports everything we do.
2229 wpa_printf(MSG_DEBUG
, "WPS: Workaround - assume Enrollee "
2230 "does not advertise supported encryption types "
2232 wps
->encr_type
= wps
->wps
->encr_types
;
2233 #else /* WPS_WORKAROUNDS */
2235 #endif /* WPS_WORKAROUNDS */
2242 static int wps_process_conn_type_flags(struct wps_data
*wps
, const u8
*conn
)
2245 wpa_printf(MSG_DEBUG
, "WPS: No Connection Type flags "
2250 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Connection Type flags 0x%x",
2257 static int wps_process_config_methods(struct wps_data
*wps
, const u8
*methods
)
2261 if (methods
== NULL
) {
2262 wpa_printf(MSG_DEBUG
, "WPS: No Config Methods received");
2266 m
= WPA_GET_BE16(methods
);
2268 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Config Methods 0x%x"
2269 "%s%s%s%s%s%s%s%s%s", m
,
2270 m
& WPS_CONFIG_USBA
? " [USBA]" : "",
2271 m
& WPS_CONFIG_ETHERNET
? " [Ethernet]" : "",
2272 m
& WPS_CONFIG_LABEL
? " [Label]" : "",
2273 m
& WPS_CONFIG_DISPLAY
? " [Display]" : "",
2274 m
& WPS_CONFIG_EXT_NFC_TOKEN
? " [Ext NFC Token]" : "",
2275 m
& WPS_CONFIG_INT_NFC_TOKEN
? " [Int NFC Token]" : "",
2276 m
& WPS_CONFIG_NFC_INTERFACE
? " [NFC]" : "",
2277 m
& WPS_CONFIG_PUSHBUTTON
? " [PBC]" : "",
2278 m
& WPS_CONFIG_KEYPAD
? " [Keypad]" : "");
2280 if (!(m
& WPS_CONFIG_DISPLAY
) && !wps
->use_psk_key
) {
2282 * The Enrollee does not have a display so it is unlikely to be
2283 * able to show the passphrase to a user and as such, could
2284 * benefit from receiving PSK to reduce key derivation time.
2286 wpa_printf(MSG_DEBUG
, "WPS: Prefer PSK format key due to "
2287 "Enrollee not supporting display");
2288 wps
->use_psk_key
= 1;
2295 static int wps_process_wps_state(struct wps_data
*wps
, const u8
*state
)
2297 if (state
== NULL
) {
2298 wpa_printf(MSG_DEBUG
, "WPS: No Wi-Fi Protected Setup State "
2303 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Wi-Fi Protected Setup State %d",
2310 static int wps_process_assoc_state(struct wps_data
*wps
, const u8
*assoc
)
2314 if (assoc
== NULL
) {
2315 wpa_printf(MSG_DEBUG
, "WPS: No Association State received");
2319 a
= WPA_GET_BE16(assoc
);
2320 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Association State %d", a
);
2326 static int wps_process_config_error(struct wps_data
*wps
, const u8
*err
)
2331 wpa_printf(MSG_DEBUG
, "WPS: No Configuration Error received");
2335 e
= WPA_GET_BE16(err
);
2336 wpa_printf(MSG_DEBUG
, "WPS: Enrollee Configuration Error %d", e
);
2342 static int wps_registrar_p2p_dev_addr_match(struct wps_data
*wps
)
2345 struct wps_registrar
*reg
= wps
->wps
->registrar
;
2347 if (is_zero_ether_addr(reg
->p2p_dev_addr
))
2348 return 1; /* no filtering in use */
2350 if (os_memcmp(reg
->p2p_dev_addr
, wps
->p2p_dev_addr
, ETH_ALEN
) != 0) {
2351 wpa_printf(MSG_DEBUG
, "WPS: No match on P2P Device Address "
2352 "filtering for PBC: expected " MACSTR
" was "
2353 MACSTR
" - indicate PBC session overlap",
2354 MAC2STR(reg
->p2p_dev_addr
),
2355 MAC2STR(wps
->p2p_dev_addr
));
2358 #endif /* CONFIG_P2P */
2363 static int wps_registrar_skip_overlap(struct wps_data
*wps
)
2366 struct wps_registrar
*reg
= wps
->wps
->registrar
;
2368 if (is_zero_ether_addr(reg
->p2p_dev_addr
))
2369 return 0; /* no specific Enrollee selected */
2371 if (os_memcmp(reg
->p2p_dev_addr
, wps
->p2p_dev_addr
, ETH_ALEN
) == 0) {
2372 wpa_printf(MSG_DEBUG
, "WPS: Skip PBC overlap due to selected "
2376 #endif /* CONFIG_P2P */
2381 static enum wps_process_res
wps_process_m1(struct wps_data
*wps
,
2382 struct wps_parse_attr
*attr
)
2384 wpa_printf(MSG_DEBUG
, "WPS: Received M1");
2386 if (wps
->state
!= RECV_M1
) {
2387 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2388 "receiving M1", wps
->state
);
2392 if (wps_process_uuid_e(wps
, attr
->uuid_e
) ||
2393 wps_process_mac_addr(wps
, attr
->mac_addr
) ||
2394 wps_process_enrollee_nonce(wps
, attr
->enrollee_nonce
) ||
2395 wps_process_pubkey(wps
, attr
->public_key
, attr
->public_key_len
) ||
2396 wps_process_auth_type_flags(wps
, attr
->auth_type_flags
) ||
2397 wps_process_encr_type_flags(wps
, attr
->encr_type_flags
) ||
2398 wps_process_conn_type_flags(wps
, attr
->conn_type_flags
) ||
2399 wps_process_config_methods(wps
, attr
->config_methods
) ||
2400 wps_process_wps_state(wps
, attr
->wps_state
) ||
2401 wps_process_device_attrs(&wps
->peer_dev
, attr
) ||
2402 wps_process_rf_bands(&wps
->peer_dev
, attr
->rf_bands
) ||
2403 wps_process_assoc_state(wps
, attr
->assoc_state
) ||
2404 wps_process_dev_password_id(wps
, attr
->dev_password_id
) ||
2405 wps_process_config_error(wps
, attr
->config_error
) ||
2406 wps_process_os_version(&wps
->peer_dev
, attr
->os_version
))
2409 if (wps
->dev_pw_id
< 0x10 &&
2410 wps
->dev_pw_id
!= DEV_PW_DEFAULT
&&
2411 wps
->dev_pw_id
!= DEV_PW_USER_SPECIFIED
&&
2412 wps
->dev_pw_id
!= DEV_PW_MACHINE_SPECIFIED
&&
2413 wps
->dev_pw_id
!= DEV_PW_REGISTRAR_SPECIFIED
&&
2414 (wps
->dev_pw_id
!= DEV_PW_PUSHBUTTON
||
2415 !wps
->wps
->registrar
->pbc
)) {
2416 wpa_printf(MSG_DEBUG
, "WPS: Unsupported Device Password ID %d",
2418 wps
->state
= SEND_M2D
;
2419 return WPS_CONTINUE
;
2422 #ifdef CONFIG_WPS_OOB
2423 if (wps
->dev_pw_id
>= 0x10 &&
2424 wps
->dev_pw_id
!= wps
->wps
->oob_dev_pw_id
) {
2425 wpa_printf(MSG_DEBUG
, "WPS: OOB Device Password ID "
2426 "%d mismatch", wps
->dev_pw_id
);
2427 wps
->state
= SEND_M2D
;
2428 return WPS_CONTINUE
;
2430 #endif /* CONFIG_WPS_OOB */
2432 if (wps
->dev_pw_id
== DEV_PW_PUSHBUTTON
) {
2433 if ((wps
->wps
->registrar
->force_pbc_overlap
||
2434 wps_registrar_pbc_overlap(wps
->wps
->registrar
,
2435 wps
->mac_addr_e
, wps
->uuid_e
) ||
2436 !wps_registrar_p2p_dev_addr_match(wps
)) &&
2437 !wps_registrar_skip_overlap(wps
)) {
2438 wpa_printf(MSG_DEBUG
, "WPS: PBC overlap - deny PBC "
2440 wps
->state
= SEND_M2D
;
2441 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2442 wps_pbc_overlap_event(wps
->wps
);
2443 wps_fail_event(wps
->wps
, WPS_M1
,
2444 WPS_CFG_MULTIPLE_PBC_DETECTED
,
2446 wps
->wps
->registrar
->force_pbc_overlap
= 1;
2447 return WPS_CONTINUE
;
2449 wps_registrar_add_pbc_session(wps
->wps
->registrar
,
2450 wps
->mac_addr_e
, wps
->uuid_e
);
2454 #ifdef WPS_WORKAROUNDS
2456 * It looks like Mac OS X 10.6.3 and 10.6.4 do not like Network Key in
2457 * passphrase format. To avoid interop issues, force PSK format to be
2460 if (!wps
->use_psk_key
&&
2461 wps
->peer_dev
.manufacturer
&&
2462 os_strncmp(wps
->peer_dev
.manufacturer
, "Apple ", 6) == 0 &&
2463 wps
->peer_dev
.model_name
&&
2464 os_strcmp(wps
->peer_dev
.model_name
, "AirPort") == 0) {
2465 wpa_printf(MSG_DEBUG
, "WPS: Workaround - Force Network Key in "
2467 wps
->use_psk_key
= 1;
2469 #endif /* WPS_WORKAROUNDS */
2471 wps
->state
= SEND_M2
;
2472 return WPS_CONTINUE
;
2476 static enum wps_process_res
wps_process_m3(struct wps_data
*wps
,
2477 const struct wpabuf
*msg
,
2478 struct wps_parse_attr
*attr
)
2480 wpa_printf(MSG_DEBUG
, "WPS: Received M3");
2482 if (wps
->state
!= RECV_M3
) {
2483 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2484 "receiving M3", wps
->state
);
2485 wps
->state
= SEND_WSC_NACK
;
2486 return WPS_CONTINUE
;
2489 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2490 !wps_registrar_skip_overlap(wps
)) {
2491 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2493 wps
->state
= SEND_WSC_NACK
;
2494 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2495 return WPS_CONTINUE
;
2498 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2499 wps_process_authenticator(wps
, attr
->authenticator
, msg
) ||
2500 wps_process_e_hash1(wps
, attr
->e_hash1
) ||
2501 wps_process_e_hash2(wps
, attr
->e_hash2
)) {
2502 wps
->state
= SEND_WSC_NACK
;
2503 return WPS_CONTINUE
;
2506 wps
->state
= SEND_M4
;
2507 return WPS_CONTINUE
;
2511 static enum wps_process_res
wps_process_m5(struct wps_data
*wps
,
2512 const struct wpabuf
*msg
,
2513 struct wps_parse_attr
*attr
)
2515 struct wpabuf
*decrypted
;
2516 struct wps_parse_attr eattr
;
2518 wpa_printf(MSG_DEBUG
, "WPS: Received M5");
2520 if (wps
->state
!= RECV_M5
) {
2521 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2522 "receiving M5", wps
->state
);
2523 wps
->state
= SEND_WSC_NACK
;
2524 return WPS_CONTINUE
;
2527 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2528 !wps_registrar_skip_overlap(wps
)) {
2529 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2531 wps
->state
= SEND_WSC_NACK
;
2532 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2533 return WPS_CONTINUE
;
2536 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2537 wps_process_authenticator(wps
, attr
->authenticator
, msg
)) {
2538 wps
->state
= SEND_WSC_NACK
;
2539 return WPS_CONTINUE
;
2542 decrypted
= wps_decrypt_encr_settings(wps
, attr
->encr_settings
,
2543 attr
->encr_settings_len
);
2544 if (decrypted
== NULL
) {
2545 wpa_printf(MSG_DEBUG
, "WPS: Failed to decrypted Encrypted "
2546 "Settings attribute");
2547 wps
->state
= SEND_WSC_NACK
;
2548 return WPS_CONTINUE
;
2551 if (wps_validate_m5_encr(decrypted
, attr
->version2
!= NULL
) < 0) {
2552 wpabuf_free(decrypted
);
2553 wps
->state
= SEND_WSC_NACK
;
2554 return WPS_CONTINUE
;
2557 wpa_printf(MSG_DEBUG
, "WPS: Processing decrypted Encrypted Settings "
2559 if (wps_parse_msg(decrypted
, &eattr
) < 0 ||
2560 wps_process_key_wrap_auth(wps
, decrypted
, eattr
.key_wrap_auth
) ||
2561 wps_process_e_snonce1(wps
, eattr
.e_snonce1
)) {
2562 wpabuf_free(decrypted
);
2563 wps
->state
= SEND_WSC_NACK
;
2564 return WPS_CONTINUE
;
2566 wpabuf_free(decrypted
);
2568 wps
->state
= SEND_M6
;
2569 return WPS_CONTINUE
;
2573 static void wps_sta_cred_cb(struct wps_data
*wps
)
2576 * Update credential to only include a single authentication and
2577 * encryption type in case the AP configuration includes more than one
2580 if (wps
->cred
.auth_type
& WPS_AUTH_WPA2PSK
)
2581 wps
->cred
.auth_type
= WPS_AUTH_WPA2PSK
;
2582 else if (wps
->cred
.auth_type
& WPS_AUTH_WPAPSK
)
2583 wps
->cred
.auth_type
= WPS_AUTH_WPAPSK
;
2584 if (wps
->cred
.encr_type
& WPS_ENCR_AES
)
2585 wps
->cred
.encr_type
= WPS_ENCR_AES
;
2586 else if (wps
->cred
.encr_type
& WPS_ENCR_TKIP
)
2587 wps
->cred
.encr_type
= WPS_ENCR_TKIP
;
2588 wpa_printf(MSG_DEBUG
, "WPS: Update local configuration based on the "
2589 "AP configuration");
2590 if (wps
->wps
->cred_cb
)
2591 wps
->wps
->cred_cb(wps
->wps
->cb_ctx
, &wps
->cred
);
2595 static void wps_cred_update(struct wps_credential
*dst
,
2596 struct wps_credential
*src
)
2598 os_memcpy(dst
->ssid
, src
->ssid
, sizeof(dst
->ssid
));
2599 dst
->ssid_len
= src
->ssid_len
;
2600 dst
->auth_type
= src
->auth_type
;
2601 dst
->encr_type
= src
->encr_type
;
2602 dst
->key_idx
= src
->key_idx
;
2603 os_memcpy(dst
->key
, src
->key
, sizeof(dst
->key
));
2604 dst
->key_len
= src
->key_len
;
2608 static int wps_process_ap_settings_r(struct wps_data
*wps
,
2609 struct wps_parse_attr
*attr
)
2613 if (wps
->wps
->ap
|| wps
->er
)
2616 /* AP Settings Attributes in M7 when Enrollee is an AP */
2617 if (wps_process_ap_settings(attr
, &wps
->cred
) < 0)
2620 wpa_printf(MSG_INFO
, "WPS: Received old AP configuration from AP");
2622 if (wps
->new_ap_settings
) {
2623 wpa_printf(MSG_INFO
, "WPS: Update AP configuration based on "
2625 wps_cred_update(&wps
->cred
, wps
->new_ap_settings
);
2629 * Use the AP PIN only to receive the current AP settings, not
2630 * to reconfigure the AP.
2634 * Clear selected registrar here since we do not get to
2635 * WSC_Done in this protocol run.
2637 wps_registrar_pin_completed(wps
->wps
->registrar
);
2639 msg
= wps_build_ap_cred(wps
);
2642 wps
->cred
.cred_attr
= wpabuf_head(msg
);
2643 wps
->cred
.cred_attr_len
= wpabuf_len(msg
);
2645 if (wps
->ap_settings_cb
) {
2646 wps
->ap_settings_cb(wps
->ap_settings_cb_ctx
,
2651 wps_sta_cred_cb(wps
);
2653 wps
->cred
.cred_attr
= NULL
;
2654 wps
->cred
.cred_attr_len
= 0;
2662 static enum wps_process_res
wps_process_m7(struct wps_data
*wps
,
2663 const struct wpabuf
*msg
,
2664 struct wps_parse_attr
*attr
)
2666 struct wpabuf
*decrypted
;
2667 struct wps_parse_attr eattr
;
2669 wpa_printf(MSG_DEBUG
, "WPS: Received M7");
2671 if (wps
->state
!= RECV_M7
) {
2672 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2673 "receiving M7", wps
->state
);
2674 wps
->state
= SEND_WSC_NACK
;
2675 return WPS_CONTINUE
;
2678 if (wps
->pbc
&& wps
->wps
->registrar
->force_pbc_overlap
&&
2679 !wps_registrar_skip_overlap(wps
)) {
2680 wpa_printf(MSG_DEBUG
, "WPS: Reject negotiation due to PBC "
2682 wps
->state
= SEND_WSC_NACK
;
2683 wps
->config_error
= WPS_CFG_MULTIPLE_PBC_DETECTED
;
2684 return WPS_CONTINUE
;
2687 if (wps_process_registrar_nonce(wps
, attr
->registrar_nonce
) ||
2688 wps_process_authenticator(wps
, attr
->authenticator
, msg
)) {
2689 wps
->state
= SEND_WSC_NACK
;
2690 return WPS_CONTINUE
;
2693 decrypted
= wps_decrypt_encr_settings(wps
, attr
->encr_settings
,
2694 attr
->encr_settings_len
);
2695 if (decrypted
== NULL
) {
2696 wpa_printf(MSG_DEBUG
, "WPS: Failed to decrypt Encrypted "
2697 "Settings attribute");
2698 wps
->state
= SEND_WSC_NACK
;
2699 return WPS_CONTINUE
;
2702 if (wps_validate_m7_encr(decrypted
, wps
->wps
->ap
|| wps
->er
,
2703 attr
->version2
!= NULL
) < 0) {
2704 wpabuf_free(decrypted
);
2705 wps
->state
= SEND_WSC_NACK
;
2706 return WPS_CONTINUE
;
2709 wpa_printf(MSG_DEBUG
, "WPS: Processing decrypted Encrypted Settings "
2711 if (wps_parse_msg(decrypted
, &eattr
) < 0 ||
2712 wps_process_key_wrap_auth(wps
, decrypted
, eattr
.key_wrap_auth
) ||
2713 wps_process_e_snonce2(wps
, eattr
.e_snonce2
) ||
2714 wps_process_ap_settings_r(wps
, &eattr
)) {
2715 wpabuf_free(decrypted
);
2716 wps
->state
= SEND_WSC_NACK
;
2717 return WPS_CONTINUE
;
2720 wpabuf_free(decrypted
);
2722 wps
->state
= SEND_M8
;
2723 return WPS_CONTINUE
;
2727 static enum wps_process_res
wps_process_wsc_msg(struct wps_data
*wps
,
2728 const struct wpabuf
*msg
)
2730 struct wps_parse_attr attr
;
2731 enum wps_process_res ret
= WPS_CONTINUE
;
2733 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_MSG");
2735 if (wps_parse_msg(msg
, &attr
) < 0)
2738 if (attr
.msg_type
== NULL
) {
2739 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2740 wps
->state
= SEND_WSC_NACK
;
2741 return WPS_CONTINUE
;
2744 if (*attr
.msg_type
!= WPS_M1
&&
2745 (attr
.registrar_nonce
== NULL
||
2746 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
,
2747 WPS_NONCE_LEN
!= 0))) {
2748 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2752 switch (*attr
.msg_type
) {
2754 if (wps_validate_m1(msg
) < 0)
2756 #ifdef CONFIG_WPS_UPNP
2757 if (wps
->wps
->wps_upnp
&& attr
.mac_addr
) {
2758 /* Remove old pending messages when starting new run */
2759 wps_free_pending_msgs(wps
->wps
->upnp_msgs
);
2760 wps
->wps
->upnp_msgs
= NULL
;
2762 upnp_wps_device_send_wlan_event(
2763 wps
->wps
->wps_upnp
, attr
.mac_addr
,
2764 UPNP_WPS_WLANEVENT_TYPE_EAP
, msg
);
2766 #endif /* CONFIG_WPS_UPNP */
2767 ret
= wps_process_m1(wps
, &attr
);
2770 if (wps_validate_m3(msg
) < 0)
2772 ret
= wps_process_m3(wps
, msg
, &attr
);
2773 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2774 wps_fail_event(wps
->wps
, WPS_M3
, wps
->config_error
,
2775 wps
->error_indication
);
2778 if (wps_validate_m5(msg
) < 0)
2780 ret
= wps_process_m5(wps
, msg
, &attr
);
2781 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2782 wps_fail_event(wps
->wps
, WPS_M5
, wps
->config_error
,
2783 wps
->error_indication
);
2786 if (wps_validate_m7(msg
) < 0)
2788 ret
= wps_process_m7(wps
, msg
, &attr
);
2789 if (ret
== WPS_FAILURE
|| wps
->state
== SEND_WSC_NACK
)
2790 wps_fail_event(wps
->wps
, WPS_M7
, wps
->config_error
,
2791 wps
->error_indication
);
2794 wpa_printf(MSG_DEBUG
, "WPS: Unsupported Message Type %d",
2799 if (ret
== WPS_CONTINUE
) {
2800 /* Save a copy of the last message for Authenticator derivation
2802 wpabuf_free(wps
->last_msg
);
2803 wps
->last_msg
= wpabuf_dup(msg
);
2810 static enum wps_process_res
wps_process_wsc_ack(struct wps_data
*wps
,
2811 const struct wpabuf
*msg
)
2813 struct wps_parse_attr attr
;
2815 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_ACK");
2817 if (wps_parse_msg(msg
, &attr
) < 0)
2820 if (attr
.msg_type
== NULL
) {
2821 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2825 if (*attr
.msg_type
!= WPS_WSC_ACK
) {
2826 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2831 #ifdef CONFIG_WPS_UPNP
2832 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&& wps
->state
== RECV_M2D_ACK
&&
2833 upnp_wps_subscribers(wps
->wps
->wps_upnp
)) {
2834 if (wps
->wps
->upnp_msgs
)
2835 return WPS_CONTINUE
;
2836 wpa_printf(MSG_DEBUG
, "WPS: Wait for response from an "
2837 "external Registrar");
2840 #endif /* CONFIG_WPS_UPNP */
2842 if (attr
.registrar_nonce
== NULL
||
2843 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
2845 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2849 if (attr
.enrollee_nonce
== NULL
||
2850 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
2851 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
2855 if (wps
->state
== RECV_M2D_ACK
) {
2856 #ifdef CONFIG_WPS_UPNP
2857 if (wps
->wps
->wps_upnp
&&
2858 upnp_wps_subscribers(wps
->wps
->wps_upnp
)) {
2859 if (wps
->wps
->upnp_msgs
)
2860 return WPS_CONTINUE
;
2861 if (wps
->ext_reg
== 0)
2863 wpa_printf(MSG_DEBUG
, "WPS: Wait for response from an "
2864 "external Registrar");
2867 #endif /* CONFIG_WPS_UPNP */
2869 wpa_printf(MSG_DEBUG
, "WPS: No more registrars available - "
2870 "terminate negotiation");
2877 static enum wps_process_res
wps_process_wsc_nack(struct wps_data
*wps
,
2878 const struct wpabuf
*msg
)
2880 struct wps_parse_attr attr
;
2884 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_NACK");
2886 old_state
= wps
->state
;
2887 wps
->state
= SEND_WSC_NACK
;
2889 if (wps_parse_msg(msg
, &attr
) < 0)
2892 if (attr
.msg_type
== NULL
) {
2893 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2897 if (*attr
.msg_type
!= WPS_WSC_NACK
) {
2898 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2903 #ifdef CONFIG_WPS_UPNP
2904 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
) {
2905 wpa_printf(MSG_DEBUG
, "WPS: Negotiation using external "
2906 "Registrar terminated by the Enrollee");
2909 #endif /* CONFIG_WPS_UPNP */
2911 if (attr
.registrar_nonce
== NULL
||
2912 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
2914 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
2918 if (attr
.enrollee_nonce
== NULL
||
2919 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
2920 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
2924 if (attr
.config_error
== NULL
) {
2925 wpa_printf(MSG_DEBUG
, "WPS: No Configuration Error attribute "
2930 config_error
= WPA_GET_BE16(attr
.config_error
);
2931 wpa_printf(MSG_DEBUG
, "WPS: Enrollee terminated negotiation with "
2932 "Configuration Error %d", config_error
);
2934 switch (old_state
) {
2936 wps_fail_event(wps
->wps
, WPS_M2
, config_error
,
2937 wps
->error_indication
);
2940 wps_fail_event(wps
->wps
, WPS_M4
, config_error
,
2941 wps
->error_indication
);
2944 wps_fail_event(wps
->wps
, WPS_M6
, config_error
,
2945 wps
->error_indication
);
2948 wps_fail_event(wps
->wps
, WPS_M8
, config_error
,
2949 wps
->error_indication
);
2959 static enum wps_process_res
wps_process_wsc_done(struct wps_data
*wps
,
2960 const struct wpabuf
*msg
)
2962 struct wps_parse_attr attr
;
2964 wpa_printf(MSG_DEBUG
, "WPS: Received WSC_Done");
2966 if (wps
->state
!= RECV_DONE
&&
2967 (!wps
->wps
->wps_upnp
|| !wps
->ext_reg
)) {
2968 wpa_printf(MSG_DEBUG
, "WPS: Unexpected state (%d) for "
2969 "receiving WSC_Done", wps
->state
);
2973 if (wps_parse_msg(msg
, &attr
) < 0)
2976 if (attr
.msg_type
== NULL
) {
2977 wpa_printf(MSG_DEBUG
, "WPS: No Message Type attribute");
2981 if (*attr
.msg_type
!= WPS_WSC_DONE
) {
2982 wpa_printf(MSG_DEBUG
, "WPS: Invalid Message Type %d",
2987 #ifdef CONFIG_WPS_UPNP
2988 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
) {
2989 wpa_printf(MSG_DEBUG
, "WPS: Negotiation using external "
2990 "Registrar completed successfully");
2991 wps_device_store(wps
->wps
->registrar
, &wps
->peer_dev
,
2995 #endif /* CONFIG_WPS_UPNP */
2997 if (attr
.registrar_nonce
== NULL
||
2998 os_memcmp(wps
->nonce_r
, attr
.registrar_nonce
, WPS_NONCE_LEN
!= 0))
3000 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in registrar nonce");
3004 if (attr
.enrollee_nonce
== NULL
||
3005 os_memcmp(wps
->nonce_e
, attr
.enrollee_nonce
, WPS_NONCE_LEN
!= 0)) {
3006 wpa_printf(MSG_DEBUG
, "WPS: Mismatch in enrollee nonce");
3010 wpa_printf(MSG_DEBUG
, "WPS: Negotiation completed successfully");
3011 wps_device_store(wps
->wps
->registrar
, &wps
->peer_dev
,
3014 if (wps
->wps
->wps_state
== WPS_STATE_NOT_CONFIGURED
&& wps
->new_psk
&&
3015 wps
->wps
->ap
&& !wps
->wps
->registrar
->disable_auto_conf
) {
3016 struct wps_credential cred
;
3018 wpa_printf(MSG_DEBUG
, "WPS: Moving to Configured state based "
3019 "on first Enrollee connection");
3021 os_memset(&cred
, 0, sizeof(cred
));
3022 os_memcpy(cred
.ssid
, wps
->wps
->ssid
, wps
->wps
->ssid_len
);
3023 cred
.ssid_len
= wps
->wps
->ssid_len
;
3024 cred
.auth_type
= WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
;
3025 cred
.encr_type
= WPS_ENCR_TKIP
| WPS_ENCR_AES
;
3026 os_memcpy(cred
.key
, wps
->new_psk
, wps
->new_psk_len
);
3027 cred
.key_len
= wps
->new_psk_len
;
3029 wps
->wps
->wps_state
= WPS_STATE_CONFIGURED
;
3030 wpa_hexdump_ascii_key(MSG_DEBUG
,
3031 "WPS: Generated random passphrase",
3032 wps
->new_psk
, wps
->new_psk_len
);
3033 if (wps
->wps
->cred_cb
)
3034 wps
->wps
->cred_cb(wps
->wps
->cb_ctx
, &cred
);
3036 os_free(wps
->new_psk
);
3037 wps
->new_psk
= NULL
;
3040 if (!wps
->wps
->ap
&& !wps
->er
)
3041 wps_sta_cred_cb(wps
);
3044 if (wps_cb_new_psk(wps
->wps
->registrar
, wps
->mac_addr_e
,
3045 wps
->new_psk
, wps
->new_psk_len
)) {
3046 wpa_printf(MSG_DEBUG
, "WPS: Failed to configure the "
3049 os_free(wps
->new_psk
);
3050 wps
->new_psk
= NULL
;
3053 wps_cb_reg_success(wps
->wps
->registrar
, wps
->mac_addr_e
, wps
->uuid_e
);
3056 wps_registrar_remove_pbc_session(wps
->wps
->registrar
,
3059 wps_registrar_pbc_completed(wps
->wps
->registrar
);
3061 wps_registrar_pin_completed(wps
->wps
->registrar
);
3063 /* TODO: maintain AuthorizedMACs somewhere separately for each ER and
3064 * merge them into APs own list.. */
3066 wps_success_event(wps
->wps
);
3072 enum wps_process_res
wps_registrar_process_msg(struct wps_data
*wps
,
3073 enum wsc_op_code op_code
,
3074 const struct wpabuf
*msg
)
3076 enum wps_process_res ret
;
3078 wpa_printf(MSG_DEBUG
, "WPS: Processing received message (len=%lu "
3080 (unsigned long) wpabuf_len(msg
), op_code
);
3082 #ifdef CONFIG_WPS_UPNP
3083 if (wps
->wps
->wps_upnp
&& op_code
== WSC_MSG
&& wps
->ext_reg
== 1) {
3084 struct wps_parse_attr attr
;
3085 if (wps_parse_msg(msg
, &attr
) == 0 && attr
.msg_type
&&
3086 *attr
.msg_type
== WPS_M3
)
3087 wps
->ext_reg
= 2; /* past M2/M2D phase */
3089 if (wps
->ext_reg
> 1)
3090 wps_registrar_free_pending_m2(wps
->wps
);
3091 if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&&
3092 wps
->wps
->upnp_msgs
== NULL
&&
3093 (op_code
== WSC_MSG
|| op_code
== WSC_Done
|| op_code
== WSC_NACK
))
3095 struct wps_parse_attr attr
;
3097 if (wps_parse_msg(msg
, &attr
) < 0 || attr
.msg_type
== NULL
)
3100 type
= *attr
.msg_type
;
3101 wpa_printf(MSG_DEBUG
, "WPS: Sending received message (type %d)"
3102 " to external Registrar for processing", type
);
3103 upnp_wps_device_send_wlan_event(wps
->wps
->wps_upnp
,
3105 UPNP_WPS_WLANEVENT_TYPE_EAP
,
3107 if (op_code
== WSC_MSG
)
3109 } else if (wps
->wps
->wps_upnp
&& wps
->ext_reg
&& op_code
== WSC_MSG
) {
3110 wpa_printf(MSG_DEBUG
, "WPS: Skip internal processing - using "
3111 "external Registrar");
3112 return WPS_CONTINUE
;
3114 #endif /* CONFIG_WPS_UPNP */
3118 return wps_process_wsc_msg(wps
, msg
);
3120 if (wps_validate_wsc_ack(msg
) < 0)
3122 return wps_process_wsc_ack(wps
, msg
);
3124 if (wps_validate_wsc_nack(msg
) < 0)
3126 return wps_process_wsc_nack(wps
, msg
);
3128 if (wps_validate_wsc_done(msg
) < 0)
3130 ret
= wps_process_wsc_done(wps
, msg
);
3131 if (ret
== WPS_FAILURE
) {
3132 wps
->state
= SEND_WSC_NACK
;
3133 wps_fail_event(wps
->wps
, WPS_WSC_DONE
,
3135 wps
->error_indication
);
3139 wpa_printf(MSG_DEBUG
, "WPS: Unsupported op_code %d", op_code
);
3145 int wps_registrar_update_ie(struct wps_registrar
*reg
)
3147 return wps_set_ie(reg
);
3151 static void wps_registrar_set_selected_timeout(void *eloop_ctx
,
3154 struct wps_registrar
*reg
= eloop_ctx
;
3156 wpa_printf(MSG_DEBUG
, "WPS: Selected Registrar timeout - "
3157 "unselect internal Registrar");
3158 reg
->selected_registrar
= 0;
3160 wps_registrar_selected_registrar_changed(reg
);
3164 #ifdef CONFIG_WPS_UPNP
3165 static void wps_registrar_sel_reg_add(struct wps_registrar
*reg
,
3166 struct subscription
*s
)
3169 wpa_printf(MSG_DEBUG
, "WPS: External Registrar selected (dev_pw_id=%d "
3170 "config_methods=0x%x)",
3171 s
->dev_password_id
, s
->config_methods
);
3172 reg
->sel_reg_union
= 1;
3173 if (reg
->sel_reg_dev_password_id_override
!= DEV_PW_PUSHBUTTON
)
3174 reg
->sel_reg_dev_password_id_override
= s
->dev_password_id
;
3175 if (reg
->sel_reg_config_methods_override
== -1)
3176 reg
->sel_reg_config_methods_override
= 0;
3177 reg
->sel_reg_config_methods_override
|= s
->config_methods
;
3178 for (i
= 0; i
< WPS_MAX_AUTHORIZED_MACS
; i
++)
3179 if (is_zero_ether_addr(reg
->authorized_macs_union
[i
]))
3181 for (j
= 0; i
< WPS_MAX_AUTHORIZED_MACS
&& j
< WPS_MAX_AUTHORIZED_MACS
;
3183 if (is_zero_ether_addr(s
->authorized_macs
[j
]))
3185 wpa_printf(MSG_DEBUG
, "WPS: Add authorized MAC into union: "
3186 MACSTR
, MAC2STR(s
->authorized_macs
[j
]));
3187 os_memcpy(reg
->authorized_macs_union
[i
],
3188 s
->authorized_macs
[j
], ETH_ALEN
);
3191 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs union",
3192 (u8
*) reg
->authorized_macs_union
,
3193 sizeof(reg
->authorized_macs_union
));
3195 #endif /* CONFIG_WPS_UPNP */
3198 static void wps_registrar_sel_reg_union(struct wps_registrar
*reg
)
3200 #ifdef CONFIG_WPS_UPNP
3201 struct subscription
*s
;
3203 if (reg
->wps
->wps_upnp
== NULL
)
3206 dl_list_for_each(s
, ®
->wps
->wps_upnp
->subscriptions
,
3207 struct subscription
, list
) {
3208 struct subscr_addr
*sa
;
3209 sa
= dl_list_first(&s
->addr_list
, struct subscr_addr
, list
);
3211 wpa_printf(MSG_DEBUG
, "WPS: External Registrar %s:%d",
3212 inet_ntoa(sa
->saddr
.sin_addr
),
3213 ntohs(sa
->saddr
.sin_port
));
3215 if (s
->selected_registrar
)
3216 wps_registrar_sel_reg_add(reg
, s
);
3218 wpa_printf(MSG_DEBUG
, "WPS: External Registrar not "
3221 #endif /* CONFIG_WPS_UPNP */
3226 * wps_registrar_selected_registrar_changed - SetSelectedRegistrar change
3227 * @reg: Registrar data from wps_registrar_init()
3229 * This function is called when selected registrar state changes, e.g., when an
3230 * AP receives a SetSelectedRegistrar UPnP message.
3232 void wps_registrar_selected_registrar_changed(struct wps_registrar
*reg
)
3234 wpa_printf(MSG_DEBUG
, "WPS: Selected registrar information changed");
3236 reg
->sel_reg_union
= reg
->selected_registrar
;
3237 reg
->sel_reg_dev_password_id_override
= -1;
3238 reg
->sel_reg_config_methods_override
= -1;
3239 os_memcpy(reg
->authorized_macs_union
, reg
->authorized_macs
,
3240 WPS_MAX_AUTHORIZED_MACS
* ETH_ALEN
);
3241 wpa_hexdump(MSG_DEBUG
, "WPS: Authorized MACs union (start with own)",
3242 (u8
*) reg
->authorized_macs_union
,
3243 sizeof(reg
->authorized_macs_union
));
3244 if (reg
->selected_registrar
) {
3247 methods
= reg
->wps
->config_methods
& ~WPS_CONFIG_PUSHBUTTON
;
3249 methods
&= ~(WPS_CONFIG_VIRT_PUSHBUTTON
|
3250 WPS_CONFIG_PHY_PUSHBUTTON
);
3251 #endif /* CONFIG_WPS2 */
3253 reg
->sel_reg_dev_password_id_override
=
3255 wps_set_pushbutton(&methods
, reg
->wps
->config_methods
);
3257 wpa_printf(MSG_DEBUG
, "WPS: Internal Registrar selected "
3258 "(pbc=%d)", reg
->pbc
);
3259 reg
->sel_reg_config_methods_override
= methods
;
3261 wpa_printf(MSG_DEBUG
, "WPS: Internal Registrar not selected");
3263 wps_registrar_sel_reg_union(reg
);
3266 wps_cb_set_sel_reg(reg
);
3270 int wps_registrar_get_info(struct wps_registrar
*reg
, const u8
*addr
,
3271 char *buf
, size_t buflen
)
3273 struct wps_registrar_device
*d
;
3276 char devtype
[WPS_DEV_TYPE_BUFSIZE
];
3278 d
= wps_device_get(reg
, addr
);
3281 if (uuid_bin2str(d
->uuid
, uuid
, sizeof(uuid
)))
3284 ret
= os_snprintf(buf
+ len
, buflen
- len
,
3286 "wpsPrimaryDeviceType=%s\n"
3287 "wpsDeviceName=%s\n"
3288 "wpsManufacturer=%s\n"
3290 "wpsModelNumber=%s\n"
3291 "wpsSerialNumber=%s\n",
3293 wps_dev_type_bin2str(d
->dev
.pri_dev_type
, devtype
,
3295 d
->dev
.device_name
? d
->dev
.device_name
: "",
3296 d
->dev
.manufacturer
? d
->dev
.manufacturer
: "",
3297 d
->dev
.model_name
? d
->dev
.model_name
: "",
3298 d
->dev
.model_number
? d
->dev
.model_number
: "",
3299 d
->dev
.serial_number
? d
->dev
.serial_number
: "");
3300 if (ret
< 0 || (size_t) ret
>= buflen
- len
)
3308 int wps_registrar_config_ap(struct wps_registrar
*reg
,
3309 struct wps_credential
*cred
)
3312 printf("encr_type=0x%x\n", cred
->encr_type
);
3313 if (!(cred
->encr_type
& (WPS_ENCR_NONE
| WPS_ENCR_TKIP
|
3315 if (cred
->encr_type
& WPS_ENCR_WEP
) {
3316 wpa_printf(MSG_INFO
, "WPS: Reject new AP settings "
3317 "due to WEP configuration");
3321 wpa_printf(MSG_INFO
, "WPS: Reject new AP settings due to "
3322 "invalid encr_type 0x%x", cred
->encr_type
);
3326 if ((cred
->encr_type
& (WPS_ENCR_TKIP
| WPS_ENCR_AES
)) ==
3328 wpa_printf(MSG_DEBUG
, "WPS: Upgrade encr_type TKIP -> "
3330 cred
->encr_type
|= WPS_ENCR_AES
;
3333 if ((cred
->auth_type
& (WPS_AUTH_WPAPSK
| WPS_AUTH_WPA2PSK
)) ==
3335 wpa_printf(MSG_DEBUG
, "WPS: Upgrade auth_type WPAPSK -> "
3337 cred
->auth_type
|= WPS_AUTH_WPA2PSK
;
3339 #endif /* CONFIG_WPS2 */
3341 if (reg
->wps
->cred_cb
)
3342 return reg
->wps
->cred_cb(reg
->wps
->cb_ctx
, cred
);