contrib/hostapd/hostapd/wps_hostapd.c

   1 /*
   2  * hostapd / WPS integration
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "hostapd.h"
  18 #include "driver.h"
  19 #include "eloop.h"
  20 #include "uuid.h"
  21 #include "wpa_ctrl.h"
  22 #include "ieee802_11_defs.h"
  23 #include "sta_info.h"
  24 #include "eapol_sm.h"
  25 #include "wps/wps.h"
  26 #include "wps/wps_defs.h"
  27 #include "wps/wps_dev_attr.h"
  28 #include "wps_hostapd.h"
  29
  30
  31 #ifdef CONFIG_WPS_UPNP
  32 #include "wps/wps_upnp.h"
  33 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
  34                                  struct wps_context *wps);
  35 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd);
  36 #endif /* CONFIG_WPS_UPNP */
  37
  38
  39 static int hostapd_wps_new_psk_cb(void *ctx, const u8 *mac_addr, const u8 *psk,
  40                                   size_t psk_len)
  41 {
  42         struct hostapd_data *hapd = ctx;
  43         struct hostapd_wpa_psk *p;
  44         struct hostapd_ssid *ssid = &hapd->conf->ssid;
  45
  46         wpa_printf(MSG_DEBUG, "Received new WPA/WPA2-PSK from WPS for STA "
  47                    MACSTR, MAC2STR(mac_addr));
  48         wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
  49
  50         if (psk_len != PMK_LEN) {
  51                 wpa_printf(MSG_DEBUG, "Unexpected PSK length %lu",
  52                            (unsigned long) psk_len);
  53                 return -1;
  54         }
  55
  56         /* Add the new PSK to runtime PSK list */
  57         p = os_zalloc(sizeof(*p));
  58         if (p == NULL)
  59                 return -1;
  60         os_memcpy(p->addr, mac_addr, ETH_ALEN);
  61         os_memcpy(p->psk, psk, PMK_LEN);
  62
  63         p->next = ssid->wpa_psk;
  64         ssid->wpa_psk = p;
  65
  66         if (ssid->wpa_psk_file) {
  67                 FILE *f;
  68                 char hex[PMK_LEN * 2 + 1];
  69                 /* Add the new PSK to PSK list file */
  70                 f = fopen(ssid->wpa_psk_file, "a");
  71                 if (f == NULL) {
  72                         wpa_printf(MSG_DEBUG, "Failed to add the PSK to "
  73                                    "'%s'", ssid->wpa_psk_file);
  74                         return -1;
  75                 }
  76
  77                 wpa_snprintf_hex(hex, sizeof(hex), psk, psk_len);
  78                 fprintf(f, MACSTR " %s\n", MAC2STR(mac_addr), hex);
  79                 fclose(f);
  80         }
  81
  82         return 0;
  83 }
  84
  85
  86 static int hostapd_wps_set_ie_cb(void *ctx, const u8 *beacon_ie,
  87                                  size_t beacon_ie_len, const u8 *probe_resp_ie,
  88                                  size_t probe_resp_ie_len)
  89 {
  90         struct hostapd_data *hapd = ctx;
  91
  92         os_free(hapd->wps_beacon_ie);
  93         if (beacon_ie_len == 0) {
  94                 hapd->wps_beacon_ie = NULL;
  95                 hapd->wps_beacon_ie_len = 0;
  96         } else {
  97                 hapd->wps_beacon_ie = os_malloc(beacon_ie_len);
  98                 if (hapd->wps_beacon_ie == NULL) {
  99                         hapd->wps_beacon_ie_len = 0;
 100                         return -1;
 101                 }
 102                 os_memcpy(hapd->wps_beacon_ie, beacon_ie, beacon_ie_len);
 103                 hapd->wps_beacon_ie_len = beacon_ie_len;
 104         }
 105         hostapd_set_wps_beacon_ie(hapd, hapd->wps_beacon_ie,
 106                                   hapd->wps_beacon_ie_len);
 107
 108         os_free(hapd->wps_probe_resp_ie);
 109         if (probe_resp_ie_len == 0) {
 110                 hapd->wps_probe_resp_ie = NULL;
 111                 hapd->wps_probe_resp_ie_len = 0;
 112         } else {
 113                 hapd->wps_probe_resp_ie = os_malloc(probe_resp_ie_len);
 114                 if (hapd->wps_probe_resp_ie == NULL) {
 115                         hapd->wps_probe_resp_ie_len = 0;
 116                         return -1;
 117                 }
 118                 os_memcpy(hapd->wps_probe_resp_ie, probe_resp_ie,
 119                           probe_resp_ie_len);
 120                 hapd->wps_probe_resp_ie_len = probe_resp_ie_len;
 121         }
 122         hostapd_set_wps_probe_resp_ie(hapd, hapd->wps_probe_resp_ie,
 123                                       hapd->wps_probe_resp_ie_len);
 124
 125         return 0;
 126 }
 127
 128
 129 static void hostapd_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
 130                                       const struct wps_device_data *dev)
 131 {
 132         struct hostapd_data *hapd = ctx;
 133         char uuid[40], txt[400];
 134         int len;
 135         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 136                 return;
 137         wpa_printf(MSG_DEBUG, "WPS: PIN needed for E-UUID %s", uuid);
 138         len = os_snprintf(txt, sizeof(txt), WPS_EVENT_PIN_NEEDED
 139                           "%s " MACSTR " [%s|%s|%s|%s|%s|%d-%08X-%d]",
 140                           uuid, MAC2STR(dev->mac_addr), dev->device_name,
 141                           dev->manufacturer, dev->model_name,
 142                           dev->model_number, dev->serial_number,
 143                           dev->categ, dev->oui, dev->sub_categ);
 144         if (len > 0 && len < (int) sizeof(txt))
 145                 wpa_msg(hapd, MSG_INFO, "%s", txt);
 146
 147         if (hapd->conf->wps_pin_requests) {
 148                 FILE *f;
 149                 struct os_time t;
 150                 f = fopen(hapd->conf->wps_pin_requests, "a");
 151                 if (f == NULL)
 152                         return;
 153                 os_get_time(&t);
 154                 fprintf(f, "%ld\t%s\t" MACSTR "\t%s\t%s\t%s\t%s\t%s"
 155                         "\t%d-%08X-%d\n",
 156                         t.sec, uuid, MAC2STR(dev->mac_addr), dev->device_name,
 157                         dev->manufacturer, dev->model_name, dev->model_number,
 158                         dev->serial_number,
 159                         dev->categ, dev->oui, dev->sub_categ);
 160                 fclose(f);
 161         }
 162 }
 163
 164
 165 static void hostapd_wps_reg_success_cb(void *ctx, const u8 *mac_addr,
 166                                        const u8 *uuid_e)
 167 {
 168         struct hostapd_data *hapd = ctx;
 169         char uuid[40];
 170         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 171                 return;
 172         wpa_msg(hapd, MSG_INFO, WPS_EVENT_REG_SUCCESS MACSTR " %s",
 173                 MAC2STR(mac_addr), uuid);
 174 }
 175
 176
 177 static int str_starts(const char *str, const char *start)
 178 {
 179         return os_strncmp(str, start, os_strlen(start)) == 0;
 180 }
 181
 182
 183 static void wps_reload_config(void *eloop_data, void *user_ctx)
 184 {
 185         struct hostapd_iface *iface = eloop_data;
 186
 187         wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
 188         if (hostapd_reload_config(iface) < 0) {
 189                 wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
 190                            "configuration");
 191         }
 192 }
 193
 194
 195 static int hostapd_wps_cred_cb(void *ctx, const struct wps_credential *cred)
 196 {
 197         struct hostapd_data *hapd = ctx;
 198         FILE *oconf, *nconf;
 199         size_t len, i;
 200         char *tmp_fname;
 201         char buf[1024];
 202         int multi_bss;
 203         int wpa;
 204
 205         wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
 206                         cred->cred_attr, cred->cred_attr_len);
 207
 208         wpa_printf(MSG_DEBUG, "WPS: Received new AP Settings");
 209         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
 210         wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
 211                    cred->auth_type);
 212         wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
 213         wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
 214         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
 215                         cred->key, cred->key_len);
 216         wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
 217                    MAC2STR(cred->mac_addr));
 218
 219         if ((hapd->conf->wps_cred_processing == 1 ||
 220              hapd->conf->wps_cred_processing == 2) && cred->cred_attr) {
 221                 size_t blen = cred->cred_attr_len * 2 + 1;
 222                 char *_buf = os_malloc(blen);
 223                 if (_buf) {
 224                         wpa_snprintf_hex(_buf, blen,
 225                                          cred->cred_attr, cred->cred_attr_len);
 226                         wpa_msg(hapd, MSG_INFO, "%s%s",
 227                                 WPS_EVENT_NEW_AP_SETTINGS, _buf);
 228                         os_free(_buf);
 229                 }
 230         } else
 231                 wpa_msg(hapd, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS);
 232
 233         if (hapd->conf->wps_cred_processing == 1)
 234                 return 0;
 235
 236         os_memcpy(hapd->wps->ssid, cred->ssid, cred->ssid_len);
 237         hapd->wps->ssid_len = cred->ssid_len;
 238         hapd->wps->encr_types = cred->encr_type;
 239         hapd->wps->auth_types = cred->auth_type;
 240         if (cred->key_len == 0) {
 241                 os_free(hapd->wps->network_key);
 242                 hapd->wps->network_key = NULL;
 243                 hapd->wps->network_key_len = 0;
 244         } else {
 245                 if (hapd->wps->network_key == NULL ||
 246                     hapd->wps->network_key_len < cred->key_len) {
 247                         hapd->wps->network_key_len = 0;
 248                         os_free(hapd->wps->network_key);
 249                         hapd->wps->network_key = os_malloc(cred->key_len);
 250                         if (hapd->wps->network_key == NULL)
 251                                 return -1;
 252                 }
 253                 hapd->wps->network_key_len = cred->key_len;
 254                 os_memcpy(hapd->wps->network_key, cred->key, cred->key_len);
 255         }
 256         hapd->wps->wps_state = WPS_STATE_CONFIGURED;
 257
 258         len = os_strlen(hapd->iface->config_fname) + 5;
 259         tmp_fname = os_malloc(len);
 260         if (tmp_fname == NULL)
 261                 return -1;
 262         os_snprintf(tmp_fname, len, "%s-new", hapd->iface->config_fname);
 263
 264         oconf = fopen(hapd->iface->config_fname, "r");
 265         if (oconf == NULL) {
 266                 wpa_printf(MSG_WARNING, "WPS: Could not open current "
 267                            "configuration file");
 268                 os_free(tmp_fname);
 269                 return -1;
 270         }
 271
 272         nconf = fopen(tmp_fname, "w");
 273         if (nconf == NULL) {
 274                 wpa_printf(MSG_WARNING, "WPS: Could not write updated "
 275                            "configuration file");
 276                 os_free(tmp_fname);
 277                 fclose(oconf);
 278                 return -1;
 279         }
 280
 281         fprintf(nconf, "# WPS configuration - START\n");
 282
 283         fprintf(nconf, "wps_state=2\n");
 284
 285         fprintf(nconf, "ssid=");
 286         for (i = 0; i < cred->ssid_len; i++)
 287                 fputc(cred->ssid[i], nconf);
 288         fprintf(nconf, "\n");
 289
 290         if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
 291             (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
 292                 wpa = 3;
 293         else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
 294                 wpa = 2;
 295         else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
 296                 wpa = 1;
 297         else
 298                 wpa = 0;
 299
 300         if (wpa) {
 301                 char *prefix;
 302                 fprintf(nconf, "wpa=%d\n", wpa);
 303
 304                 fprintf(nconf, "wpa_key_mgmt=");
 305                 prefix = "";
 306                 if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) {
 307                         fprintf(nconf, "WPA-EAP");
 308                         prefix = " ";
 309                 }
 310                 if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK))
 311                         fprintf(nconf, "%sWPA-PSK", prefix);
 312                 fprintf(nconf, "\n");
 313
 314                 fprintf(nconf, "wpa_pairwise=");
 315                 prefix = "";
 316                 if (cred->encr_type & WPS_ENCR_AES) {
 317                         fprintf(nconf, "CCMP");
 318                         prefix = " ";
 319                 }
 320                 if (cred->encr_type & WPS_ENCR_TKIP) {
 321                         fprintf(nconf, "%sTKIP", prefix);
 322                 }
 323                 fprintf(nconf, "\n");
 324
 325                 if (cred->key_len >= 8 && cred->key_len < 64) {
 326                         fprintf(nconf, "wpa_passphrase=");
 327                         for (i = 0; i < cred->key_len; i++)
 328                                 fputc(cred->key[i], nconf);
 329                         fprintf(nconf, "\n");
 330                 } else if (cred->key_len == 64) {
 331                         fprintf(nconf, "wpa_psk=");
 332                         for (i = 0; i < cred->key_len; i++)
 333                                 fputc(cred->key[i], nconf);
 334                         fprintf(nconf, "\n");
 335                 } else {
 336                         wpa_printf(MSG_WARNING, "WPS: Invalid key length %lu "
 337                                    "for WPA/WPA2",
 338                                    (unsigned long) cred->key_len);
 339                 }
 340
 341                 fprintf(nconf, "auth_algs=1\n");
 342         } else {
 343                 if ((cred->auth_type & WPS_AUTH_OPEN) &&
 344                     (cred->auth_type & WPS_AUTH_SHARED))
 345                         fprintf(nconf, "auth_algs=3\n");
 346                 else if (cred->auth_type & WPS_AUTH_SHARED)
 347                         fprintf(nconf, "auth_algs=2\n");
 348                 else
 349                         fprintf(nconf, "auth_algs=1\n");
 350
 351                 if (cred->encr_type & WPS_ENCR_WEP && cred->key_idx <= 4) {
 352                         int key_idx = cred->key_idx;
 353                         if (key_idx)
 354                                 key_idx--;
 355                         fprintf(nconf, "wep_default_key=%d\n", key_idx);
 356                         fprintf(nconf, "wep_key%d=", key_idx);
 357                         if (cred->key_len == 10 || cred->key_len == 26) {
 358                                 /* WEP key as a hex string */
 359                                 for (i = 0; i < cred->key_len; i++)
 360                                         fputc(cred->key[i], nconf);
 361                         } else {
 362                                 /* Raw WEP key; convert to hex */
 363                                 for (i = 0; i < cred->key_len; i++)
 364                                         fprintf(nconf, "%02x", cred->key[i]);
 365                         }
 366                         fprintf(nconf, "\n");
 367                 }
 368         }
 369
 370         fprintf(nconf, "# WPS configuration - END\n");
 371
 372         multi_bss = 0;
 373         while (fgets(buf, sizeof(buf), oconf)) {
 374                 if (os_strncmp(buf, "bss=", 4) == 0)
 375                         multi_bss = 1;
 376                 if (!multi_bss &&
 377                     (str_starts(buf, "ssid=") ||
 378                      str_starts(buf, "auth_algs=") ||
 379                      str_starts(buf, "wps_state=") ||
 380                      str_starts(buf, "wpa=") ||
 381                      str_starts(buf, "wpa_psk=") ||
 382                      str_starts(buf, "wpa_pairwise=") ||
 383                      str_starts(buf, "rsn_pairwise=") ||
 384                      str_starts(buf, "wpa_key_mgmt=") ||
 385                      str_starts(buf, "wpa_passphrase="))) {
 386                         fprintf(nconf, "#WPS# %s", buf);
 387                 } else
 388                         fprintf(nconf, "%s", buf);
 389         }
 390
 391         fclose(nconf);
 392         fclose(oconf);
 393
 394         if (rename(tmp_fname, hapd->iface->config_fname) < 0) {
 395                 wpa_printf(MSG_WARNING, "WPS: Failed to rename the updated "
 396                            "configuration file: %s", strerror(errno));
 397                 os_free(tmp_fname);
 398                 return -1;
 399         }
 400
 401         os_free(tmp_fname);
 402
 403         /* Schedule configuration reload after short period of time to allow
 404          * EAP-WSC to be finished.
 405          */
 406         eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
 407                                NULL);
 408
 409         /* TODO: dualband AP may need to update multiple configuration files */
 410
 411         wpa_printf(MSG_DEBUG, "WPS: AP configuration updated");
 412
 413         return 0;
 414 }
 415
 416
 417 static void hostapd_pwd_auth_fail(struct hostapd_data *hapd,
 418                                   struct wps_event_pwd_auth_fail *data)
 419 {
 420         FILE *f;
 421
 422         if (!data->enrollee)
 423                 return;
 424
 425         /*
 426          * Registrar failed to prove its knowledge of the AP PIN. Lock AP setup
 427          * if this happens multiple times.
 428          */
 429         hapd->ap_pin_failures++;
 430         if (hapd->ap_pin_failures < 4)
 431                 return;
 432
 433         wpa_msg(hapd, MSG_INFO, WPS_EVENT_AP_SETUP_LOCKED);
 434         hapd->wps->ap_setup_locked = 1;
 435
 436         wps_registrar_update_ie(hapd->wps->registrar);
 437
 438         if (hapd->conf->wps_cred_processing == 1)
 439                 return;
 440
 441         f = fopen(hapd->iface->config_fname, "a");
 442         if (f == NULL) {
 443                 wpa_printf(MSG_WARNING, "WPS: Could not append to the current "
 444                            "configuration file");
 445                 return;
 446         }
 447
 448         fprintf(f, "# WPS AP Setup Locked based on possible attack\n");
 449         fprintf(f, "ap_setup_locked=1\n");
 450         fclose(f);
 451
 452         /* TODO: dualband AP may need to update multiple configuration files */
 453
 454         wpa_printf(MSG_DEBUG, "WPS: AP configuration updated");
 455 }
 456
 457
 458 static void hostapd_wps_event_cb(void *ctx, enum wps_event event,
 459                                  union wps_event_data *data)
 460 {
 461         struct hostapd_data *hapd = ctx;
 462
 463         if (event == WPS_EV_PWD_AUTH_FAIL)
 464                 hostapd_pwd_auth_fail(hapd, &data->pwd_auth_fail);
 465 }
 466
 467
 468 static void hostapd_wps_clear_ies(struct hostapd_data *hapd)
 469 {
 470         os_free(hapd->wps_beacon_ie);
 471         hapd->wps_beacon_ie = NULL;
 472         hapd->wps_beacon_ie_len = 0;
 473         hostapd_set_wps_beacon_ie(hapd, NULL, 0);
 474
 475         os_free(hapd->wps_probe_resp_ie);
 476         hapd->wps_probe_resp_ie = NULL;
 477         hapd->wps_probe_resp_ie_len = 0;
 478         hostapd_set_wps_probe_resp_ie(hapd, NULL, 0);
 479 }
 480
 481
 482 int hostapd_init_wps(struct hostapd_data *hapd,
 483                      struct hostapd_bss_config *conf)
 484 {
 485         struct wps_context *wps;
 486         struct wps_registrar_config cfg;
 487
 488         if (conf->wps_state == 0) {
 489                 hostapd_wps_clear_ies(hapd);
 490                 return 0;
 491         }
 492
 493         wps = os_zalloc(sizeof(*wps));
 494         if (wps == NULL)
 495                 return -1;
 496
 497         wps->cred_cb = hostapd_wps_cred_cb;
 498         wps->event_cb = hostapd_wps_event_cb;
 499         wps->cb_ctx = hapd;
 500
 501         os_memset(&cfg, 0, sizeof(cfg));
 502         wps->wps_state = hapd->conf->wps_state;
 503         wps->ap_setup_locked = hapd->conf->ap_setup_locked;
 504         if (is_nil_uuid(hapd->conf->uuid)) {
 505                 uuid_gen_mac_addr(hapd->own_addr, wps->uuid);
 506                 wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC address",
 507                             wps->uuid, UUID_LEN);
 508         } else
 509                 os_memcpy(wps->uuid, hapd->conf->uuid, UUID_LEN);
 510         wps->ssid_len = hapd->conf->ssid.ssid_len;
 511         os_memcpy(wps->ssid, hapd->conf->ssid.ssid, wps->ssid_len);
 512         wps->ap = 1;
 513         os_memcpy(wps->dev.mac_addr, hapd->own_addr, ETH_ALEN);
 514         wps->dev.device_name = hapd->conf->device_name ?
 515                 os_strdup(hapd->conf->device_name) : NULL;
 516         wps->dev.manufacturer = hapd->conf->manufacturer ?
 517                 os_strdup(hapd->conf->manufacturer) : NULL;
 518         wps->dev.model_name = hapd->conf->model_name ?
 519                 os_strdup(hapd->conf->model_name) : NULL;
 520         wps->dev.model_number = hapd->conf->model_number ?
 521                 os_strdup(hapd->conf->model_number) : NULL;
 522         wps->dev.serial_number = hapd->conf->serial_number ?
 523                 os_strdup(hapd->conf->serial_number) : NULL;
 524         if (hapd->conf->config_methods) {
 525                 char *m = hapd->conf->config_methods;
 526                 if (os_strstr(m, "label"))
 527                         wps->config_methods |= WPS_CONFIG_LABEL;
 528                 if (os_strstr(m, "display"))
 529                         wps->config_methods |= WPS_CONFIG_DISPLAY;
 530                 if (os_strstr(m, "push_button"))
 531                         wps->config_methods |= WPS_CONFIG_PUSHBUTTON;
 532                 if (os_strstr(m, "keypad"))
 533                         wps->config_methods |= WPS_CONFIG_KEYPAD;
 534         }
 535         if (hapd->conf->device_type) {
 536                 char *pos;
 537                 u8 oui[4];
 538                 /* <categ>-<OUI>-<subcateg> */
 539                 wps->dev.categ = atoi(hapd->conf->device_type);
 540                 pos = os_strchr(hapd->conf->device_type, '-');
 541                 if (pos == NULL) {
 542                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type");
 543                         os_free(wps);
 544                         return -1;
 545                 }
 546                 pos++;
 547                 if (hexstr2bin(pos, oui, 4)) {
 548                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type OUI");
 549                         os_free(wps);
 550                         return -1;
 551                 }
 552                 wps->dev.oui = WPA_GET_BE32(oui);
 553                 pos = os_strchr(pos, '-');
 554                 if (pos == NULL) {
 555                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type");
 556                         os_free(wps);
 557                         return -1;
 558                 }
 559                 pos++;
 560                 wps->dev.sub_categ = atoi(pos);
 561         }
 562         wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
 563         wps->dev.rf_bands = hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
 564                 WPS_RF_50GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
 565
 566         if (conf->wpa & WPA_PROTO_RSN) {
 567                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
 568                         wps->auth_types |= WPS_AUTH_WPA2PSK;
 569                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 570                         wps->auth_types |= WPS_AUTH_WPA2;
 571
 572                 if (conf->rsn_pairwise & WPA_CIPHER_CCMP)
 573                         wps->encr_types |= WPS_ENCR_AES;
 574                 if (conf->rsn_pairwise & WPA_CIPHER_TKIP)
 575                         wps->encr_types |= WPS_ENCR_TKIP;
 576         }
 577
 578         if (conf->wpa & WPA_PROTO_WPA) {
 579                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
 580                         wps->auth_types |= WPS_AUTH_WPAPSK;
 581                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
 582                         wps->auth_types |= WPS_AUTH_WPA;
 583
 584                 if (conf->wpa_pairwise & WPA_CIPHER_CCMP)
 585                         wps->encr_types |= WPS_ENCR_AES;
 586                 if (conf->wpa_pairwise & WPA_CIPHER_TKIP)
 587                         wps->encr_types |= WPS_ENCR_TKIP;
 588         }
 589
 590         if (conf->ssid.security_policy == SECURITY_PLAINTEXT) {
 591                 wps->encr_types |= WPS_ENCR_NONE;
 592                 wps->auth_types |= WPS_AUTH_OPEN;
 593         } else if (conf->ssid.security_policy == SECURITY_STATIC_WEP) {
 594                 wps->encr_types |= WPS_ENCR_WEP;
 595                 if (conf->auth_algs & WPA_AUTH_ALG_OPEN)
 596                         wps->auth_types |= WPS_AUTH_OPEN;
 597                 if (conf->auth_algs & WPA_AUTH_ALG_SHARED)
 598                         wps->auth_types |= WPS_AUTH_SHARED;
 599         } else if (conf->ssid.security_policy == SECURITY_IEEE_802_1X) {
 600                 wps->auth_types |= WPS_AUTH_OPEN;
 601                 if (conf->default_wep_key_len)
 602                         wps->encr_types |= WPS_ENCR_WEP;
 603                 else
 604                         wps->encr_types |= WPS_ENCR_NONE;
 605         }
 606
 607         if (conf->ssid.wpa_psk_file) {
 608                 /* Use per-device PSKs */
 609         } else if (conf->ssid.wpa_passphrase) {
 610                 wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase);
 611                 wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase);
 612         } else if (conf->ssid.wpa_psk) {
 613                 wps->network_key = os_malloc(2 * PMK_LEN + 1);
 614                 if (wps->network_key == NULL) {
 615                         os_free(wps);
 616                         return -1;
 617                 }
 618                 wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1,
 619                                  conf->ssid.wpa_psk->psk, PMK_LEN);
 620                 wps->network_key_len = 2 * PMK_LEN;
 621         } else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) {
 622                 wps->network_key = os_malloc(conf->ssid.wep.len[0]);
 623                 if (wps->network_key == NULL) {
 624                         os_free(wps);
 625                         return -1;
 626                 }
 627                 os_memcpy(wps->network_key, conf->ssid.wep.key[0],
 628                           conf->ssid.wep.len[0]);
 629                 wps->network_key_len = conf->ssid.wep.len[0];
 630         }
 631
 632         if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) {
 633                 /* Override parameters to enable security by default */
 634                 wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
 635                 wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
 636         }
 637
 638         wps->ap_settings = conf->ap_settings;
 639         wps->ap_settings_len = conf->ap_settings_len;
 640
 641         cfg.new_psk_cb = hostapd_wps_new_psk_cb;
 642         cfg.set_ie_cb = hostapd_wps_set_ie_cb;
 643         cfg.pin_needed_cb = hostapd_wps_pin_needed_cb;
 644         cfg.reg_success_cb = hostapd_wps_reg_success_cb;
 645         cfg.cb_ctx = hapd;
 646         cfg.skip_cred_build = conf->skip_cred_build;
 647         cfg.extra_cred = conf->extra_cred;
 648         cfg.extra_cred_len = conf->extra_cred_len;
 649         cfg.disable_auto_conf = (hapd->conf->wps_cred_processing == 1) &&
 650                 conf->skip_cred_build;
 651         if (conf->ssid.security_policy == SECURITY_STATIC_WEP)
 652                 cfg.static_wep_only = 1;
 653
 654         wps->registrar = wps_registrar_init(wps, &cfg);
 655         if (wps->registrar == NULL) {
 656                 printf("Failed to initialize WPS Registrar\n");
 657                 os_free(wps->network_key);
 658                 os_free(wps);
 659                 return -1;
 660         }
 661
 662 #ifdef CONFIG_WPS_UPNP
 663         wps->friendly_name = hapd->conf->friendly_name;
 664         wps->manufacturer_url = hapd->conf->manufacturer_url;
 665         wps->model_description = hapd->conf->model_description;
 666         wps->model_url = hapd->conf->model_url;
 667         wps->upc = hapd->conf->upc;
 668
 669         if (hostapd_wps_upnp_init(hapd, wps) < 0) {
 670                 wpa_printf(MSG_ERROR, "Failed to initialize WPS UPnP");
 671                 wps_registrar_deinit(wps->registrar);
 672                 os_free(wps->network_key);
 673                 os_free(wps);
 674                 return -1;
 675         }
 676 #endif /* CONFIG_WPS_UPNP */
 677
 678         hapd->wps = wps;
 679
 680         return 0;
 681 }
 682
 683
 684 void hostapd_deinit_wps(struct hostapd_data *hapd)
 685 {
 686         if (hapd->wps == NULL)
 687                 return;
 688 #ifdef CONFIG_WPS_UPNP
 689         hostapd_wps_upnp_deinit(hapd);
 690 #endif /* CONFIG_WPS_UPNP */
 691         wps_registrar_deinit(hapd->wps->registrar);
 692         os_free(hapd->wps->network_key);
 693         wps_device_data_free(&hapd->wps->dev);
 694         wps_free_pending_msgs(hapd->wps->upnp_msgs);
 695         os_free(hapd->wps);
 696         hapd->wps = NULL;
 697         hostapd_wps_clear_ies(hapd);
 698 }
 699
 700
 701 int hostapd_wps_add_pin(struct hostapd_data *hapd, const char *uuid,
 702                         const char *pin, int timeout)
 703 {
 704         u8 u[UUID_LEN];
 705         int any = 0;
 706
 707         if (hapd->wps == NULL)
 708                 return -1;
 709         if (os_strcmp(uuid, "any") == 0)
 710                 any = 1;
 711         else if (uuid_str2bin(uuid, u))
 712                 return -1;
 713         return wps_registrar_add_pin(hapd->wps->registrar, any ? NULL : u,
 714                                      (const u8 *) pin, os_strlen(pin),
 715                                      timeout);
 716 }
 717
 718
 719 int hostapd_wps_button_pushed(struct hostapd_data *hapd)
 720 {
 721         if (hapd->wps == NULL)
 722                 return -1;
 723         return wps_registrar_button_pushed(hapd->wps->registrar);
 724 }
 725
 726
 727 void hostapd_wps_probe_req_rx(struct hostapd_data *hapd, const u8 *addr,
 728                               const u8 *ie, size_t ie_len)
 729 {
 730         struct wpabuf *wps_ie;
 731         const u8 *end, *pos, *wps;
 732
 733         if (hapd->wps == NULL)
 734                 return;
 735
 736         pos = ie;
 737         end = ie + ie_len;
 738         wps = NULL;
 739
 740         while (pos + 1 < end) {
 741                 if (pos + 2 + pos[1] > end)
 742                         return;
 743                 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
 744                     WPA_GET_BE32(&pos[2]) == WPS_DEV_OUI_WFA) {
 745                         wps = pos;
 746                         break;
 747                 }
 748                 pos += 2 + pos[1];
 749         }
 750
 751         if (wps == NULL)
 752                 return; /* No WPS IE in Probe Request */
 753
 754         wps_ie = wpabuf_alloc(ie_len);
 755         if (wps_ie == NULL)
 756                 return;
 757
 758         /* There may be multiple WPS IEs in the message, so need to concatenate
 759          * their WPS Data fields */
 760         while (pos + 1 < end) {
 761                 if (pos + 2 + pos[1] > end)
 762                         break;
 763                 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
 764                     WPA_GET_BE32(&pos[2]) == WPS_DEV_OUI_WFA)
 765                         wpabuf_put_data(wps_ie, pos + 6, pos[1] - 4);
 766                 pos += 2 + pos[1];
 767         }
 768
 769         if (wpabuf_len(wps_ie) > 0) {
 770                 wps_registrar_probe_req_rx(hapd->wps->registrar, addr, wps_ie);
 771 #ifdef CONFIG_WPS_UPNP
 772                 /* FIX: what exactly should be included in the WLANEvent?
 773                  * WPS attributes? Full ProbeReq frame? */
 774                 upnp_wps_device_send_wlan_event(hapd->wps_upnp, addr,
 775                                                 UPNP_WPS_WLANEVENT_TYPE_PROBE,
 776                                                 wps_ie);
 777 #endif /* CONFIG_WPS_UPNP */
 778         }
 779
 780         wpabuf_free(wps_ie);
 781 }
 782
 783
 784 #ifdef CONFIG_WPS_UPNP
 785
 786 static struct wpabuf *
 787 hostapd_rx_req_get_device_info(void *priv, struct upnp_wps_peer *peer)
 788 {
 789         struct hostapd_data *hapd = priv;
 790         struct wps_config cfg;
 791         struct wps_data *wps;
 792         enum wsc_op_code op_code;
 793         struct wpabuf *m1;
 794
 795         /*
 796          * Request for DeviceInfo, i.e., M1 TLVs. This is a start of WPS
 797          * registration over UPnP with the AP acting as an Enrollee. It should
 798          * be noted that this is frequently used just to get the device data,
 799          * i.e., there may not be any intent to actually complete the
 800          * registration.
 801          */
 802
 803         if (peer->wps)
 804                 wps_deinit(peer->wps);
 805
 806         os_memset(&cfg, 0, sizeof(cfg));
 807         cfg.wps = hapd->wps;
 808         cfg.pin = (u8 *) hapd->conf->ap_pin;
 809         cfg.pin_len = os_strlen(hapd->conf->ap_pin);
 810         wps = wps_init(&cfg);
 811         if (wps == NULL)
 812                 return NULL;
 813
 814         m1 = wps_get_msg(wps, &op_code);
 815         if (m1 == NULL) {
 816                 wps_deinit(wps);
 817                 return NULL;
 818         }
 819
 820         peer->wps = wps;
 821
 822         return m1;
 823 }
 824
 825
 826 static struct wpabuf *
 827 hostapd_rx_req_put_message(void *priv, struct upnp_wps_peer *peer,
 828                            const struct wpabuf *msg)
 829 {
 830         enum wps_process_res res;
 831         enum wsc_op_code op_code;
 832
 833         /* PutMessage: msg = InMessage, return OutMessage */
 834         res = wps_process_msg(peer->wps, WSC_UPnP, msg);
 835         if (res == WPS_FAILURE)
 836                 return NULL;
 837         return wps_get_msg(peer->wps, &op_code);
 838 }
 839
 840
 841 static struct wpabuf *
 842 hostapd_rx_req_get_ap_settings(void *priv, const struct wpabuf *msg)
 843 {
 844         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 845         return NULL;
 846 }
 847
 848
 849 static int hostapd_rx_req_set_ap_settings(void *priv, const struct wpabuf *msg)
 850 {
 851         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 852         return -1;
 853 }
 854
 855
 856 static int hostapd_rx_req_del_ap_settings(void *priv, const struct wpabuf *msg)
 857 {
 858         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 859         return -1;
 860 }
 861
 862
 863 static struct wpabuf *
 864 hostapd_rx_req_get_sta_settings(void *priv, const struct wpabuf *msg)
 865 {
 866         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 867         return NULL;
 868 }
 869
 870
 871 static int hostapd_rx_req_set_sta_settings(void *priv,
 872                                            const struct wpabuf *msg)
 873 {
 874         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 875         return -1;
 876 }
 877
 878
 879 static int hostapd_rx_req_del_sta_settings(void *priv,
 880                                            const struct wpabuf *msg)
 881 {
 882         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 883         return -1;
 884 }
 885
 886
 887 static int hostapd_rx_req_put_wlan_response(
 888         void *priv, enum upnp_wps_wlanevent_type ev_type,
 889         const u8 *mac_addr, const struct wpabuf *msg,
 890         enum wps_msg_type msg_type)
 891 {
 892         struct hostapd_data *hapd = priv;
 893         struct sta_info *sta;
 894         struct upnp_pending_message *p;
 895
 896         wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse ev_type=%d mac_addr="
 897                    MACSTR, ev_type, MAC2STR(mac_addr));
 898         wpa_hexdump(MSG_MSGDUMP, "WPS UPnP: PutWLANResponse NewMessage",
 899                     wpabuf_head(msg), wpabuf_len(msg));
 900         if (ev_type != UPNP_WPS_WLANEVENT_TYPE_EAP) {
 901                 wpa_printf(MSG_DEBUG, "WPS UPnP: Ignored unexpected "
 902                            "PutWLANResponse WLANEventType %d", ev_type);
 903                 return -1;
 904         }
 905
 906         /*
 907          * EAP response to ongoing to WPS Registration. Send it to EAP-WSC
 908          * server implementation for delivery to the peer.
 909          */
 910
 911         sta = ap_get_sta(hapd, mac_addr);
 912         if (!sta) {
 913                 /*
 914                  * Workaround - Intel wsccmd uses bogus NewWLANEventMAC:
 915                  * Pick STA that is in an ongoing WPS registration without
 916                  * checking the MAC address.
 917                  */
 918                 wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based "
 919                            "on NewWLANEventMAC; try wildcard match");
 920                 for (sta = hapd->sta_list; sta; sta = sta->next) {
 921                         if (sta->eapol_sm && (sta->flags & WLAN_STA_WPS))
 922                                 break;
 923                 }
 924         }
 925
 926         if (!sta) {
 927                 wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found");
 928                 return 0;
 929         }
 930
 931         p = os_zalloc(sizeof(*p));
 932         if (p == NULL)
 933                 return -1;
 934         os_memcpy(p->addr, sta->addr, ETH_ALEN);
 935         p->msg = wpabuf_dup(msg);
 936         p->type = msg_type;
 937         p->next = hapd->wps->upnp_msgs;
 938         hapd->wps->upnp_msgs = p;
 939
 940         return eapol_auth_eap_pending_cb(sta->eapol_sm, sta->eapol_sm->eap);
 941 }
 942
 943
 944 static int hostapd_rx_req_set_selected_registrar(void *priv,
 945                                                  const struct wpabuf *msg)
 946 {
 947         struct hostapd_data *hapd = priv;
 948         return wps_registrar_set_selected_registrar(hapd->wps->registrar, msg);
 949 }
 950
 951
 952 static int hostapd_rx_req_reboot_ap(void *priv, const struct wpabuf *msg)
 953 {
 954         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 955         return -1;
 956 }
 957
 958
 959 static int hostapd_rx_req_reset_ap(void *priv, const struct wpabuf *msg)
 960 {
 961         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 962         return -1;
 963 }
 964
 965
 966 static int hostapd_rx_req_reboot_sta(void *priv, const struct wpabuf *msg)
 967 {
 968         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 969         return -1;
 970 }
 971
 972
 973 static int hostapd_rx_req_reset_sta(void *priv, const struct wpabuf *msg)
 974 {
 975         wpa_printf(MSG_DEBUG, "WPS UPnP: TODO %s", __func__);
 976         return -1;
 977 }
 978
 979
 980 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
 981                                  struct wps_context *wps)
 982 {
 983         struct upnp_wps_device_ctx *ctx;
 984
 985         if (!hapd->conf->upnp_iface)
 986                 return 0;
 987         ctx = os_zalloc(sizeof(*ctx));
 988         if (ctx == NULL)
 989                 return -1;
 990
 991         ctx->rx_req_get_device_info = hostapd_rx_req_get_device_info;
 992         ctx->rx_req_put_message = hostapd_rx_req_put_message;
 993         ctx->rx_req_get_ap_settings = hostapd_rx_req_get_ap_settings;
 994         ctx->rx_req_set_ap_settings = hostapd_rx_req_set_ap_settings;
 995         ctx->rx_req_del_ap_settings = hostapd_rx_req_del_ap_settings;
 996         ctx->rx_req_get_sta_settings = hostapd_rx_req_get_sta_settings;
 997         ctx->rx_req_set_sta_settings = hostapd_rx_req_set_sta_settings;
 998         ctx->rx_req_del_sta_settings = hostapd_rx_req_del_sta_settings;
 999         ctx->rx_req_put_wlan_response = hostapd_rx_req_put_wlan_response;
1000         ctx->rx_req_set_selected_registrar =
1001                 hostapd_rx_req_set_selected_registrar;
1002         ctx->rx_req_reboot_ap = hostapd_rx_req_reboot_ap;
1003         ctx->rx_req_reset_ap = hostapd_rx_req_reset_ap;
1004         ctx->rx_req_reboot_sta = hostapd_rx_req_reboot_sta;
1005         ctx->rx_req_reset_sta = hostapd_rx_req_reset_sta;
1006
1007         hapd->wps_upnp = upnp_wps_device_init(ctx, wps, hapd);
1008         if (hapd->wps_upnp == NULL) {
1009                 os_free(ctx);
1010                 return -1;
1011         }
1012         wps->wps_upnp = hapd->wps_upnp;
1013
1014         if (upnp_wps_device_start(hapd->wps_upnp, hapd->conf->upnp_iface)) {
1015                 upnp_wps_device_deinit(hapd->wps_upnp);
1016                 hapd->wps_upnp = NULL;
1017                 return -1;
1018         }
1019
1020         return 0;
1021 }
1022
1023
1024 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd)
1025 {
1026         upnp_wps_device_deinit(hapd->wps_upnp);
1027 }
1028
1029 #endif /* CONFIG_WPS_UPNP */