contrib/wpa_supplicant/wpa_supplicant/wps_supplicant.c

   1 /*
   2  * wpa_supplicant / WPS integration
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "ieee802_11_defs.h"
  19 #include "wpa_common.h"
  20 #include "config.h"
  21 #include "eap_peer/eap.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "eloop.h"
  24 #include "uuid.h"
  25 #include "wpa_ctrl.h"
  26 #include "ctrl_iface_dbus.h"
  27 #include "eap_common/eap_wsc_common.h"
  28 #include "blacklist.h"
  29 #include "wpa.h"
  30 #include "wps_supplicant.h"
  31
  32
  33 #define WPS_PIN_SCAN_IGNORE_SEL_REG 3
  34
  35 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx);
  36 static void wpas_clear_wps(struct wpa_supplicant *wpa_s);
  37
  38
  39 int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s)
  40 {
  41         if (!wpa_s->wps_success &&
  42             wpa_s->current_ssid &&
  43             eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
  44                 const u8 *bssid = wpa_s->bssid;
  45                 if (is_zero_ether_addr(bssid))
  46                         bssid = wpa_s->pending_bssid;
  47
  48                 wpa_printf(MSG_DEBUG, "WPS: PIN registration with " MACSTR
  49                            " did not succeed - continue trying to find "
  50                            "suitable AP", MAC2STR(bssid));
  51                 wpa_blacklist_add(wpa_s, bssid);
  52
  53                 wpa_supplicant_deauthenticate(wpa_s,
  54                                               WLAN_REASON_DEAUTH_LEAVING);
  55                 wpa_s->reassociate = 1;
  56                 wpa_supplicant_req_scan(wpa_s,
  57                                         wpa_s->blacklist_cleared ? 5 : 0, 0);
  58                 wpa_s->blacklist_cleared = 0;
  59                 return 1;
  60         }
  61
  62         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
  63
  64         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid &&
  65             !(wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
  66                 wpa_printf(MSG_DEBUG, "WPS: Network configuration replaced - "
  67                            "try to associate with the received credential");
  68                 wpa_supplicant_deauthenticate(wpa_s,
  69                                               WLAN_REASON_DEAUTH_LEAVING);
  70                 wpa_s->reassociate = 1;
  71                 wpa_supplicant_req_scan(wpa_s, 0, 0);
  72                 return 1;
  73         }
  74
  75         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS && wpa_s->current_ssid) {
  76                 wpa_printf(MSG_DEBUG, "WPS: Registration completed - waiting "
  77                            "for external credential processing");
  78                 wpas_clear_wps(wpa_s);
  79                 wpa_supplicant_deauthenticate(wpa_s,
  80                                               WLAN_REASON_DEAUTH_LEAVING);
  81                 return 1;
  82         }
  83
  84         return 0;
  85 }
  86
  87
  88 static void wpas_wps_security_workaround(struct wpa_supplicant *wpa_s,
  89                                          struct wpa_ssid *ssid,
  90                                          const struct wps_credential *cred)
  91 {
  92         struct wpa_driver_capa capa;
  93         size_t i;
  94         struct wpa_scan_res *bss;
  95         const u8 *ie;
  96         struct wpa_ie_data adv;
  97         int wpa2 = 0, ccmp = 0;
  98
  99         /*
 100          * Many existing WPS APs do not know how to negotiate WPA2 or CCMP in
 101          * case they are configured for mixed mode operation (WPA+WPA2 and
 102          * TKIP+CCMP). Try to use scan results to figure out whether the AP
 103          * actually supports stronger security and select that if the client
 104          * has support for it, too.
 105          */
 106
 107         if (wpa_drv_get_capa(wpa_s, &capa))
 108                 return; /* Unknown what driver supports */
 109
 110         if (wpa_supplicant_get_scan_results(wpa_s) || wpa_s->scan_res == NULL)
 111                 return; /* Could not get scan results for checking advertised
 112                          * parameters */
 113
 114         for (i = 0; i < wpa_s->scan_res->num; i++) {
 115                 bss = wpa_s->scan_res->res[i];
 116                 if (os_memcmp(bss->bssid, cred->mac_addr, ETH_ALEN) != 0)
 117                         continue;
 118                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 119                 if (ie == NULL)
 120                         continue;
 121                 if (ie[1] != ssid->ssid_len || ssid->ssid == NULL ||
 122                     os_memcmp(ie + 2, ssid->ssid, ssid->ssid_len) != 0)
 123                         continue;
 124
 125                 wpa_printf(MSG_DEBUG, "WPS: AP found from scan results");
 126                 break;
 127         }
 128
 129         if (i == wpa_s->scan_res->num) {
 130                 wpa_printf(MSG_DEBUG, "WPS: The AP was not found from scan "
 131                            "results - use credential as-is");
 132                 return;
 133         }
 134
 135         ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 136         if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0) {
 137                 wpa2 = 1;
 138                 if (adv.pairwise_cipher & WPA_CIPHER_CCMP)
 139                         ccmp = 1;
 140         } else {
 141                 ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 142                 if (ie && wpa_parse_wpa_ie(ie, 2 + ie[1], &adv) == 0 &&
 143                     adv.pairwise_cipher & WPA_CIPHER_CCMP)
 144                         ccmp = 1;
 145         }
 146
 147         if (ie == NULL && (ssid->proto & WPA_PROTO_WPA) &&
 148             (ssid->pairwise_cipher & WPA_CIPHER_TKIP)) {
 149                 /*
 150                  * TODO: This could be the initial AP configuration and the
 151                  * Beacon contents could change shortly. Should request a new
 152                  * scan and delay addition of the network until the updated
 153                  * scan results are available.
 154                  */
 155                 wpa_printf(MSG_DEBUG, "WPS: The AP did not yet advertise WPA "
 156                            "support - use credential as-is");
 157                 return;
 158         }
 159
 160         if (ccmp && !(ssid->pairwise_cipher & WPA_CIPHER_CCMP) &&
 161             (ssid->pairwise_cipher & WPA_CIPHER_TKIP) &&
 162             (capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK)) {
 163                 wpa_printf(MSG_DEBUG, "WPS: Add CCMP into the credential "
 164                            "based on scan results");
 165                 if (wpa_s->conf->ap_scan == 1)
 166                         ssid->pairwise_cipher |= WPA_CIPHER_CCMP;
 167                 else
 168                         ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 169         }
 170
 171         if (wpa2 && !(ssid->proto & WPA_PROTO_RSN) &&
 172             (ssid->proto & WPA_PROTO_WPA) &&
 173             (capa.enc & WPA_DRIVER_CAPA_ENC_CCMP)) {
 174                 wpa_printf(MSG_DEBUG, "WPS: Add WPA2 into the credential "
 175                            "based on scan results");
 176                 if (wpa_s->conf->ap_scan == 1)
 177                         ssid->proto |= WPA_PROTO_RSN;
 178                 else
 179                         ssid->proto = WPA_PROTO_RSN;
 180         }
 181 }
 182
 183
 184 static int wpa_supplicant_wps_cred(void *ctx,
 185                                    const struct wps_credential *cred)
 186 {
 187         struct wpa_supplicant *wpa_s = ctx;
 188         struct wpa_ssid *ssid = wpa_s->current_ssid;
 189         u8 key_idx = 0;
 190         u16 auth_type;
 191
 192         if ((wpa_s->conf->wps_cred_processing == 1 ||
 193              wpa_s->conf->wps_cred_processing == 2) && cred->cred_attr) {
 194                 size_t blen = cred->cred_attr_len * 2 + 1;
 195                 char *buf = os_malloc(blen);
 196                 if (buf) {
 197                         wpa_snprintf_hex(buf, blen,
 198                                          cred->cred_attr, cred->cred_attr_len);
 199                         wpa_msg(wpa_s, MSG_INFO, "%s%s",
 200                                 WPS_EVENT_CRED_RECEIVED, buf);
 201                         os_free(buf);
 202                 }
 203                 wpa_supplicant_dbus_notify_wps_cred(wpa_s, cred);
 204         } else
 205                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_CRED_RECEIVED);
 206
 207         wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
 208                         cred->cred_attr, cred->cred_attr_len);
 209
 210         if (wpa_s->conf->wps_cred_processing == 1)
 211                 return 0;
 212
 213         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
 214         wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
 215                    cred->auth_type);
 216         wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
 217         wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
 218         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
 219                         cred->key, cred->key_len);
 220         wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
 221                    MAC2STR(cred->mac_addr));
 222
 223         auth_type = cred->auth_type;
 224         if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) {
 225                 wpa_printf(MSG_DEBUG, "WPS: Workaround - convert mixed-mode "
 226                            "auth_type into WPA2PSK");
 227                 auth_type = WPS_AUTH_WPA2PSK;
 228         }
 229
 230         if (auth_type != WPS_AUTH_OPEN &&
 231             auth_type != WPS_AUTH_SHARED &&
 232             auth_type != WPS_AUTH_WPAPSK &&
 233             auth_type != WPS_AUTH_WPA2PSK) {
 234                 wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for "
 235                            "unsupported authentication type 0x%x",
 236                            auth_type);
 237                 return 0;
 238         }
 239
 240         if (ssid && (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
 241                 wpa_printf(MSG_DEBUG, "WPS: Replace WPS network block based "
 242                            "on the received credential");
 243                 os_free(ssid->eap.identity);
 244                 ssid->eap.identity = NULL;
 245                 ssid->eap.identity_len = 0;
 246                 os_free(ssid->eap.phase1);
 247                 ssid->eap.phase1 = NULL;
 248                 os_free(ssid->eap.eap_methods);
 249                 ssid->eap.eap_methods = NULL;
 250         } else {
 251                 wpa_printf(MSG_DEBUG, "WPS: Create a new network based on the "
 252                            "received credential");
 253                 ssid = wpa_config_add_network(wpa_s->conf);
 254                 if (ssid == NULL)
 255                         return -1;
 256         }
 257
 258         wpa_config_set_network_defaults(ssid);
 259
 260         os_free(ssid->ssid);
 261         ssid->ssid = os_malloc(cred->ssid_len);
 262         if (ssid->ssid) {
 263                 os_memcpy(ssid->ssid, cred->ssid, cred->ssid_len);
 264                 ssid->ssid_len = cred->ssid_len;
 265         }
 266
 267         switch (cred->encr_type) {
 268         case WPS_ENCR_NONE:
 269                 break;
 270         case WPS_ENCR_WEP:
 271                 if (cred->key_len <= 0)
 272                         break;
 273                 if (cred->key_len != 5 && cred->key_len != 13 &&
 274                     cred->key_len != 10 && cred->key_len != 26) {
 275                         wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key length "
 276                                    "%lu", (unsigned long) cred->key_len);
 277                         return -1;
 278                 }
 279                 if (cred->key_idx > NUM_WEP_KEYS) {
 280                         wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key index %d",
 281                                    cred->key_idx);
 282                         return -1;
 283                 }
 284                 if (cred->key_idx)
 285                         key_idx = cred->key_idx - 1;
 286                 if (cred->key_len == 10 || cred->key_len == 26) {
 287                         if (hexstr2bin((char *) cred->key,
 288                                        ssid->wep_key[key_idx],
 289                                        cred->key_len / 2) < 0) {
 290                                 wpa_printf(MSG_ERROR, "WPS: Invalid WEP Key "
 291                                            "%d", key_idx);
 292                                 return -1;
 293                         }
 294                         ssid->wep_key_len[key_idx] = cred->key_len / 2;
 295                 } else {
 296                         os_memcpy(ssid->wep_key[key_idx], cred->key,
 297                                   cred->key_len);
 298                         ssid->wep_key_len[key_idx] = cred->key_len;
 299                 }
 300                 ssid->wep_tx_keyidx = key_idx;
 301                 break;
 302         case WPS_ENCR_TKIP:
 303                 ssid->pairwise_cipher = WPA_CIPHER_TKIP;
 304                 break;
 305         case WPS_ENCR_AES:
 306                 ssid->pairwise_cipher = WPA_CIPHER_CCMP;
 307                 break;
 308         }
 309
 310         switch (auth_type) {
 311         case WPS_AUTH_OPEN:
 312                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 313                 ssid->key_mgmt = WPA_KEY_MGMT_NONE;
 314                 ssid->proto = 0;
 315                 break;
 316         case WPS_AUTH_SHARED:
 317                 ssid->auth_alg = WPA_AUTH_ALG_SHARED;
 318                 ssid->key_mgmt = WPA_KEY_MGMT_NONE;
 319                 ssid->proto = 0;
 320                 break;
 321         case WPS_AUTH_WPAPSK:
 322                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 323                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 324                 ssid->proto = WPA_PROTO_WPA;
 325                 break;
 326         case WPS_AUTH_WPA:
 327                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 328                 ssid->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 329                 ssid->proto = WPA_PROTO_WPA;
 330                 break;
 331         case WPS_AUTH_WPA2:
 332                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 333                 ssid->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 334                 ssid->proto = WPA_PROTO_RSN;
 335                 break;
 336         case WPS_AUTH_WPA2PSK:
 337                 ssid->auth_alg = WPA_AUTH_ALG_OPEN;
 338                 ssid->key_mgmt = WPA_KEY_MGMT_PSK;
 339                 ssid->proto = WPA_PROTO_RSN;
 340                 break;
 341         }
 342
 343         if (ssid->key_mgmt == WPA_KEY_MGMT_PSK) {
 344                 if (cred->key_len == 2 * PMK_LEN) {
 345                         if (hexstr2bin((const char *) cred->key, ssid->psk,
 346                                        PMK_LEN)) {
 347                                 wpa_printf(MSG_ERROR, "WPS: Invalid Network "
 348                                            "Key");
 349                                 return -1;
 350                         }
 351                         ssid->psk_set = 1;
 352                 } else if (cred->key_len >= 8 && cred->key_len < 2 * PMK_LEN) {
 353                         os_free(ssid->passphrase);
 354                         ssid->passphrase = os_malloc(cred->key_len + 1);
 355                         if (ssid->passphrase == NULL)
 356                                 return -1;
 357                         os_memcpy(ssid->passphrase, cred->key, cred->key_len);
 358                         ssid->passphrase[cred->key_len] = '\0';
 359                         wpa_config_update_psk(ssid);
 360                 } else {
 361                         wpa_printf(MSG_ERROR, "WPS: Invalid Network Key "
 362                                    "length %lu",
 363                                    (unsigned long) cred->key_len);
 364                         return -1;
 365                 }
 366         }
 367
 368         wpas_wps_security_workaround(wpa_s, ssid, cred);
 369
 370 #ifndef CONFIG_NO_CONFIG_WRITE
 371         if (wpa_s->conf->update_config &&
 372             wpa_config_write(wpa_s->confname, wpa_s->conf)) {
 373                 wpa_printf(MSG_DEBUG, "WPS: Failed to update configuration");
 374                 return -1;
 375         }
 376 #endif /* CONFIG_NO_CONFIG_WRITE */
 377
 378         return 0;
 379 }
 380
 381
 382 static void wpa_supplicant_wps_event_m2d(struct wpa_supplicant *wpa_s,
 383                                          struct wps_event_m2d *m2d)
 384 {
 385         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_M2D
 386                 "dev_password_id=%d config_error=%d",
 387                 m2d->dev_password_id, m2d->config_error);
 388 }
 389
 390
 391 static void wpa_supplicant_wps_event_fail(struct wpa_supplicant *wpa_s,
 392                                           struct wps_event_fail *fail)
 393 {
 394         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_FAIL "msg=%d", fail->msg);
 395         wpas_clear_wps(wpa_s);
 396 }
 397
 398
 399 static void wpa_supplicant_wps_event_success(struct wpa_supplicant *wpa_s)
 400 {
 401         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_SUCCESS);
 402         wpa_s->wps_success = 1;
 403 }
 404
 405
 406 static void wpa_supplicant_wps_event(void *ctx, enum wps_event event,
 407                                      union wps_event_data *data)
 408 {
 409         struct wpa_supplicant *wpa_s = ctx;
 410         switch (event) {
 411         case WPS_EV_M2D:
 412                 wpa_supplicant_wps_event_m2d(wpa_s, &data->m2d);
 413                 break;
 414         case WPS_EV_FAIL:
 415                 wpa_supplicant_wps_event_fail(wpa_s, &data->fail);
 416                 break;
 417         case WPS_EV_SUCCESS:
 418                 wpa_supplicant_wps_event_success(wpa_s);
 419                 break;
 420         case WPS_EV_PWD_AUTH_FAIL:
 421                 break;
 422         case WPS_EV_PBC_OVERLAP:
 423                 break;
 424         case WPS_EV_PBC_TIMEOUT:
 425                 break;
 426         }
 427 }
 428
 429
 430 enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid)
 431 {
 432         if (eap_is_wps_pbc_enrollee(&ssid->eap) ||
 433             eap_is_wps_pin_enrollee(&ssid->eap))
 434                 return WPS_REQ_ENROLLEE;
 435         else
 436                 return WPS_REQ_REGISTRAR;
 437 }
 438
 439
 440 static void wpas_clear_wps(struct wpa_supplicant *wpa_s)
 441 {
 442         int id;
 443         struct wpa_ssid *ssid;
 444
 445         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
 446
 447         /* Remove any existing WPS network from configuration */
 448         ssid = wpa_s->conf->ssid;
 449         while (ssid) {
 450                 if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 451                         if (ssid == wpa_s->current_ssid)
 452                                 wpa_s->current_ssid = NULL;
 453                         id = ssid->id;
 454                 } else
 455                         id = -1;
 456                 ssid = ssid->next;
 457                 if (id >= 0)
 458                         wpa_config_remove_network(wpa_s->conf, id);
 459         }
 460 }
 461
 462
 463 static void wpas_wps_timeout(void *eloop_ctx, void *timeout_ctx)
 464 {
 465         struct wpa_supplicant *wpa_s = eloop_ctx;
 466         wpa_printf(MSG_INFO, WPS_EVENT_TIMEOUT "Requested operation timed "
 467                    "out");
 468         wpas_clear_wps(wpa_s);
 469 }
 470
 471
 472 static struct wpa_ssid * wpas_wps_add_network(struct wpa_supplicant *wpa_s,
 473                                               int registrar, const u8 *bssid)
 474 {
 475         struct wpa_ssid *ssid;
 476
 477         ssid = wpa_config_add_network(wpa_s->conf);
 478         if (ssid == NULL)
 479                 return NULL;
 480         wpa_config_set_network_defaults(ssid);
 481         if (wpa_config_set(ssid, "key_mgmt", "WPS", 0) < 0 ||
 482             wpa_config_set(ssid, "eap", "WSC", 0) < 0 ||
 483             wpa_config_set(ssid, "identity", registrar ?
 484                            "\"" WSC_ID_REGISTRAR "\"" :
 485                            "\"" WSC_ID_ENROLLEE "\"", 0) < 0) {
 486                 wpa_config_remove_network(wpa_s->conf, ssid->id);
 487                 return NULL;
 488         }
 489
 490         if (bssid) {
 491                 size_t i;
 492                 int count = 0;
 493
 494                 os_memcpy(ssid->bssid, bssid, ETH_ALEN);
 495                 ssid->bssid_set = 1;
 496
 497                 /* Try to get SSID from scan results */
 498                 if (wpa_s->scan_res == NULL &&
 499                     wpa_supplicant_get_scan_results(wpa_s) < 0)
 500                         return ssid; /* Could not find any scan results */
 501
 502                 for (i = 0; i < wpa_s->scan_res->num; i++) {
 503                         const u8 *ie;
 504                         struct wpa_scan_res *res;
 505
 506                         res = wpa_s->scan_res->res[i];
 507                         if (os_memcmp(bssid, res->bssid, ETH_ALEN) != 0)
 508                                 continue;
 509
 510                         ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
 511                         if (ie == NULL)
 512                                 break;
 513                         os_free(ssid->ssid);
 514                         ssid->ssid = os_malloc(ie[1]);
 515                         if (ssid->ssid == NULL)
 516                                 break;
 517                         os_memcpy(ssid->ssid, ie + 2, ie[1]);
 518                         ssid->ssid_len = ie[1];
 519                         wpa_hexdump_ascii(MSG_DEBUG, "WPS: Picked SSID from "
 520                                           "scan results",
 521                                           ssid->ssid, ssid->ssid_len);
 522                         count++;
 523                 }
 524
 525                 if (count > 1) {
 526                         wpa_printf(MSG_DEBUG, "WPS: More than one SSID found "
 527                                    "for the AP; use wildcard");
 528                         os_free(ssid->ssid);
 529                         ssid->ssid = NULL;
 530                         ssid->ssid_len = 0;
 531                 }
 532         }
 533
 534         return ssid;
 535 }
 536
 537
 538 static void wpas_wps_reassoc(struct wpa_supplicant *wpa_s,
 539                              struct wpa_ssid *selected)
 540 {
 541         struct wpa_ssid *ssid;
 542
 543         /* Mark all other networks disabled and trigger reassociation */
 544         ssid = wpa_s->conf->ssid;
 545         while (ssid) {
 546                 ssid->disabled = ssid != selected;
 547                 ssid = ssid->next;
 548         }
 549         wpa_s->disconnected = 0;
 550         wpa_s->reassociate = 1;
 551         wpa_s->scan_runs = 0;
 552         wpa_s->wps_success = 0;
 553         wpa_s->blacklist_cleared = 0;
 554         wpa_supplicant_req_scan(wpa_s, 0, 0);
 555 }
 556
 557
 558 int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid)
 559 {
 560         struct wpa_ssid *ssid;
 561         wpas_clear_wps(wpa_s);
 562         ssid = wpas_wps_add_network(wpa_s, 0, bssid);
 563         if (ssid == NULL)
 564                 return -1;
 565         wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0);
 566         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
 567                                wpa_s, NULL);
 568         wpas_wps_reassoc(wpa_s, ssid);
 569         return 0;
 570 }
 571
 572
 573 int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid,
 574                        const char *pin)
 575 {
 576         struct wpa_ssid *ssid;
 577         char val[30];
 578         unsigned int rpin = 0;
 579
 580         wpas_clear_wps(wpa_s);
 581         ssid = wpas_wps_add_network(wpa_s, 0, bssid);
 582         if (ssid == NULL)
 583                 return -1;
 584         if (pin)
 585                 os_snprintf(val, sizeof(val), "\"pin=%s\"", pin);
 586         else {
 587                 rpin = wps_generate_pin();
 588                 os_snprintf(val, sizeof(val), "\"pin=%08d\"", rpin);
 589         }
 590         wpa_config_set(ssid, "phase1", val, 0);
 591         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
 592                                wpa_s, NULL);
 593         wpas_wps_reassoc(wpa_s, ssid);
 594         return rpin;
 595 }
 596
 597
 598 int wpas_wps_start_reg(struct wpa_supplicant *wpa_s, const u8 *bssid,
 599                        const char *pin)
 600 {
 601         struct wpa_ssid *ssid;
 602         char val[30];
 603
 604         if (!pin)
 605                 return -1;
 606         wpas_clear_wps(wpa_s);
 607         ssid = wpas_wps_add_network(wpa_s, 1, bssid);
 608         if (ssid == NULL)
 609                 return -1;
 610         os_snprintf(val, sizeof(val), "\"pin=%s\"", pin);
 611         wpa_config_set(ssid, "phase1", val, 0);
 612         eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout,
 613                                wpa_s, NULL);
 614         wpas_wps_reassoc(wpa_s, ssid);
 615         return 0;
 616 }
 617
 618
 619 static int wpas_wps_new_psk_cb(void *ctx, const u8 *mac_addr, const u8 *psk,
 620                                size_t psk_len)
 621 {
 622         wpa_printf(MSG_DEBUG, "WPS: Received new WPA/WPA2-PSK from WPS for "
 623                    "STA " MACSTR, MAC2STR(mac_addr));
 624         wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
 625
 626         /* TODO */
 627
 628         return 0;
 629 }
 630
 631
 632 static void wpas_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
 633                                    const struct wps_device_data *dev)
 634 {
 635         char uuid[40], txt[400];
 636         int len;
 637         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 638                 return;
 639         wpa_printf(MSG_DEBUG, "WPS: PIN needed for UUID-E %s", uuid);
 640         len = os_snprintf(txt, sizeof(txt), "WPS-EVENT-PIN-NEEDED %s " MACSTR
 641                           " [%s|%s|%s|%s|%s|%d-%08X-%d]",
 642                           uuid, MAC2STR(dev->mac_addr), dev->device_name,
 643                           dev->manufacturer, dev->model_name,
 644                           dev->model_number, dev->serial_number,
 645                           dev->categ, dev->oui, dev->sub_categ);
 646         if (len > 0 && len < (int) sizeof(txt))
 647                 wpa_printf(MSG_INFO, "%s", txt);
 648 }
 649
 650
 651 int wpas_wps_init(struct wpa_supplicant *wpa_s)
 652 {
 653         struct wps_context *wps;
 654         struct wps_registrar_config rcfg;
 655
 656         wps = os_zalloc(sizeof(*wps));
 657         if (wps == NULL)
 658                 return -1;
 659
 660         wps->cred_cb = wpa_supplicant_wps_cred;
 661         wps->event_cb = wpa_supplicant_wps_event;
 662         wps->cb_ctx = wpa_s;
 663
 664         wps->dev.device_name = wpa_s->conf->device_name;
 665         wps->dev.manufacturer = wpa_s->conf->manufacturer;
 666         wps->dev.model_name = wpa_s->conf->model_name;
 667         wps->dev.model_number = wpa_s->conf->model_number;
 668         wps->dev.serial_number = wpa_s->conf->serial_number;
 669         if (wpa_s->conf->device_type) {
 670                 char *pos;
 671                 u8 oui[4];
 672                 /* <categ>-<OUI>-<subcateg> */
 673                 wps->dev.categ = atoi(wpa_s->conf->device_type);
 674                 pos = os_strchr(wpa_s->conf->device_type, '-');
 675                 if (pos == NULL) {
 676                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type");
 677                         os_free(wps);
 678                         return -1;
 679                 }
 680                 pos++;
 681                 if (hexstr2bin(pos, oui, 4)) {
 682                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type OUI");
 683                         os_free(wps);
 684                         return -1;
 685                 }
 686                 wps->dev.oui = WPA_GET_BE32(oui);
 687                 pos = os_strchr(pos, '-');
 688                 if (pos == NULL) {
 689                         wpa_printf(MSG_ERROR, "WPS: Invalid device_type");
 690                         os_free(wps);
 691                         return -1;
 692                 }
 693                 pos++;
 694                 wps->dev.sub_categ = atoi(pos);
 695         }
 696         wps->dev.os_version = WPA_GET_BE32(wpa_s->conf->os_version);
 697         wps->dev.rf_bands = WPS_RF_24GHZ | WPS_RF_50GHZ; /* TODO: config */
 698         os_memcpy(wps->dev.mac_addr, wpa_s->own_addr, ETH_ALEN);
 699         if (is_nil_uuid(wpa_s->conf->uuid)) {
 700                 uuid_gen_mac_addr(wpa_s->own_addr, wps->uuid);
 701                 wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC address",
 702                             wps->uuid, WPS_UUID_LEN);
 703         } else
 704                 os_memcpy(wps->uuid, wpa_s->conf->uuid, WPS_UUID_LEN);
 705
 706         wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
 707         wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
 708
 709         os_memset(&rcfg, 0, sizeof(rcfg));
 710         rcfg.new_psk_cb = wpas_wps_new_psk_cb;
 711         rcfg.pin_needed_cb = wpas_wps_pin_needed_cb;
 712         rcfg.cb_ctx = wpa_s;
 713
 714         wps->registrar = wps_registrar_init(wps, &rcfg);
 715         if (wps->registrar == NULL) {
 716                 wpa_printf(MSG_DEBUG, "Failed to initialize WPS Registrar");
 717                 os_free(wps);
 718                 return -1;
 719         }
 720
 721         wpa_s->wps = wps;
 722
 723         return 0;
 724 }
 725
 726
 727 void wpas_wps_deinit(struct wpa_supplicant *wpa_s)
 728 {
 729         eloop_cancel_timeout(wpas_wps_timeout, wpa_s, NULL);
 730
 731         if (wpa_s->wps == NULL)
 732                 return;
 733
 734         wps_registrar_deinit(wpa_s->wps->registrar);
 735         os_free(wpa_s->wps->network_key);
 736         os_free(wpa_s->wps);
 737         wpa_s->wps = NULL;
 738 }
 739
 740
 741 int wpas_wps_ssid_bss_match(struct wpa_supplicant *wpa_s,
 742                             struct wpa_ssid *ssid, struct wpa_scan_res *bss)
 743 {
 744         struct wpabuf *wps_ie;
 745
 746         if (!(ssid->key_mgmt & WPA_KEY_MGMT_WPS))
 747                 return -1;
 748
 749         wps_ie = wpa_scan_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
 750         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
 751                 if (!wps_ie) {
 752                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
 753                         return 0;
 754                 }
 755
 756                 if (!wps_is_selected_pbc_registrar(wps_ie)) {
 757                         wpa_printf(MSG_DEBUG, "   skip - WPS AP "
 758                                    "without active PBC Registrar");
 759                         wpabuf_free(wps_ie);
 760                         return 0;
 761                 }
 762
 763                 /* TODO: overlap detection */
 764                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
 765                            "(Active PBC)");
 766                 wpabuf_free(wps_ie);
 767                 return 1;
 768         }
 769
 770         if (eap_is_wps_pin_enrollee(&ssid->eap)) {
 771                 if (!wps_ie) {
 772                         wpa_printf(MSG_DEBUG, "   skip - non-WPS AP");
 773                         return 0;
 774                 }
 775
 776                 /*
 777                  * Start with WPS APs that advertise active PIN Registrar and
 778                  * allow any WPS AP after third scan since some APs do not set
 779                  * Selected Registrar attribute properly when using external
 780                  * Registrar.
 781                  */
 782                 if (!wps_is_selected_pin_registrar(wps_ie)) {
 783                         if (wpa_s->scan_runs < WPS_PIN_SCAN_IGNORE_SEL_REG) {
 784                                 wpa_printf(MSG_DEBUG, "   skip - WPS AP "
 785                                            "without active PIN Registrar");
 786                                 wpabuf_free(wps_ie);
 787                                 return 0;
 788                         }
 789                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
 790                 } else {
 791                         wpa_printf(MSG_DEBUG, "   selected based on WPS IE "
 792                                    "(Active PIN)");
 793                 }
 794                 wpabuf_free(wps_ie);
 795                 return 1;
 796         }
 797
 798         if (wps_ie) {
 799                 wpa_printf(MSG_DEBUG, "   selected based on WPS IE");
 800                 wpabuf_free(wps_ie);
 801                 return 1;
 802         }
 803
 804         return -1;
 805 }
 806
 807
 808 int wpas_wps_ssid_wildcard_ok(struct wpa_supplicant *wpa_s,
 809                               struct wpa_ssid *ssid,
 810                               struct wpa_scan_res *bss)
 811 {
 812         struct wpabuf *wps_ie = NULL;
 813         int ret = 0;
 814
 815         if (eap_is_wps_pbc_enrollee(&ssid->eap)) {
 816                 wps_ie = wpa_scan_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
 817                 if (wps_ie && wps_is_selected_pbc_registrar(wps_ie)) {
 818                         /* allow wildcard SSID for WPS PBC */
 819                         ret = 1;
 820                 }
 821         } else if (eap_is_wps_pin_enrollee(&ssid->eap)) {
 822                 wps_ie = wpa_scan_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
 823                 if (wps_ie &&
 824                     (wps_is_selected_pin_registrar(wps_ie) ||
 825                      wpa_s->scan_runs >= WPS_PIN_SCAN_IGNORE_SEL_REG)) {
 826                         /* allow wildcard SSID for WPS PIN */
 827                         ret = 1;
 828                 }
 829         }
 830
 831         if (!ret && ssid->bssid_set &&
 832             os_memcmp(ssid->bssid, bss->bssid, ETH_ALEN) == 0) {
 833                 /* allow wildcard SSID due to hardcoded BSSID match */
 834                 ret = 1;
 835         }
 836
 837         wpabuf_free(wps_ie);
 838
 839         return ret;
 840 }
 841
 842
 843 int wpas_wps_scan_pbc_overlap(struct wpa_supplicant *wpa_s,
 844                               struct wpa_scan_res *selected,
 845                               struct wpa_ssid *ssid)
 846 {
 847         const u8 *sel_uuid, *uuid;
 848         size_t i;
 849         struct wpabuf *wps_ie;
 850         int ret = 0;
 851
 852         if (!eap_is_wps_pbc_enrollee(&ssid->eap))
 853                 return 0;
 854
 855         /* Make sure that only one AP is in active PBC mode */
 856         wps_ie = wpa_scan_get_vendor_ie_multi(selected, WPS_IE_VENDOR_TYPE);
 857         if (wps_ie)
 858                 sel_uuid = wps_get_uuid_e(wps_ie);
 859         else
 860                 sel_uuid = NULL;
 861
 862         for (i = 0; i < wpa_s->scan_res->num; i++) {
 863                 struct wpa_scan_res *bss = wpa_s->scan_res->res[i];
 864                 struct wpabuf *ie;
 865                 if (bss == selected)
 866                         continue;
 867                 ie = wpa_scan_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
 868                 if (!ie)
 869                         continue;
 870                 if (!wps_is_selected_pbc_registrar(ie)) {
 871                         wpabuf_free(ie);
 872                         continue;
 873                 }
 874                 uuid = wps_get_uuid_e(ie);
 875                 if (sel_uuid == NULL || uuid == NULL ||
 876                     os_memcmp(sel_uuid, uuid, 16) != 0) {
 877                         ret = 1; /* PBC overlap */
 878                         wpabuf_free(ie);
 879                         break;
 880                 }
 881
 882                 /* TODO: verify that this is reasonable dual-band situation */
 883
 884                 wpabuf_free(ie);
 885         }
 886
 887         wpabuf_free(wps_ie);
 888
 889         return ret;
 890 }
 891
 892
 893 void wpas_wps_notify_scan_results(struct wpa_supplicant *wpa_s)
 894 {
 895         size_t i;
 896
 897         if (wpa_s->disconnected || wpa_s->wpa_state >= WPA_ASSOCIATED)
 898                 return;
 899
 900         for (i = 0; i < wpa_s->scan_res->num; i++) {
 901                 struct wpa_scan_res *bss = wpa_s->scan_res->res[i];
 902                 struct wpabuf *ie;
 903                 ie = wpa_scan_get_vendor_ie_multi(bss, WPS_IE_VENDOR_TYPE);
 904                 if (!ie)
 905                         continue;
 906                 if (wps_is_selected_pbc_registrar(ie))
 907                         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PBC);
 908                 else if (wps_is_selected_pin_registrar(ie))
 909                         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE_PIN);
 910                 else
 911                         wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_AP_AVAILABLE);
 912                 wpabuf_free(ie);
 913                 break;
 914         }
 915 }
 916
 917
 918 int wpas_wps_searching(struct wpa_supplicant *wpa_s)
 919 {
 920         struct wpa_ssid *ssid;
 921
 922         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 923                 if ((ssid->key_mgmt & WPA_KEY_MGMT_WPS) && !ssid->disabled)
 924                         return 1;
 925         }
 926
 927         return 0;
 928 }