contrib/wpa/src/ap/wps_hostapd.c

   1 /*
   2  * hostapd / WPS integration
   3  * Copyright (c) 2008-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "utils/uuid.h"
  14 #include "common/wpa_ctrl.h"
  15 #include "common/ieee802_11_defs.h"
  16 #include "common/ieee802_11_common.h"
  17 #include "eapol_auth/eapol_auth_sm.h"
  18 #include "eapol_auth/eapol_auth_sm_i.h"
  19 #include "wps/wps.h"
  20 #include "wps/wps_defs.h"
  21 #include "wps/wps_dev_attr.h"
  22 #include "wps/wps_attr_parse.h"
  23 #include "hostapd.h"
  24 #include "ap_config.h"
  25 #include "ap_drv_ops.h"
  26 #include "beacon.h"
  27 #include "sta_info.h"
  28 #include "wps_hostapd.h"
  29
  30
  31 #ifdef CONFIG_WPS_UPNP
  32 #include "wps/wps_upnp.h"
  33 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
  34                                  struct wps_context *wps);
  35 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd);
  36 #endif /* CONFIG_WPS_UPNP */
  37
  38 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
  39                                     const u8 *bssid,
  40                                     const u8 *ie, size_t ie_len,
  41                                     int ssi_signal);
  42 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx);
  43 static void hostapd_wps_nfc_clear(struct wps_context *wps);
  44
  45
  46 struct wps_for_each_data {
  47         int (*func)(struct hostapd_data *h, void *ctx);
  48         void *ctx;
  49         struct hostapd_data *calling_hapd;
  50 };
  51
  52
  53 static int wps_for_each(struct hostapd_iface *iface, void *ctx)
  54 {
  55         struct wps_for_each_data *data = ctx;
  56         size_t j;
  57
  58         if (iface == NULL)
  59                 return 0;
  60         for (j = 0; j < iface->num_bss; j++) {
  61                 struct hostapd_data *hapd = iface->bss[j];
  62                 int ret;
  63
  64                 if (hapd != data->calling_hapd &&
  65                     (hapd->conf->wps_independent ||
  66                      data->calling_hapd->conf->wps_independent))
  67                         continue;
  68
  69                 ret = data->func(hapd, data->ctx);
  70                 if (ret)
  71                         return ret;
  72         }
  73
  74         return 0;
  75 }
  76
  77
  78 static int hostapd_wps_for_each(struct hostapd_data *hapd,
  79                                 int (*func)(struct hostapd_data *h, void *ctx),
  80                                 void *ctx)
  81 {
  82         struct hostapd_iface *iface = hapd->iface;
  83         struct wps_for_each_data data;
  84         data.func = func;
  85         data.ctx = ctx;
  86         data.calling_hapd = hapd;
  87         if (iface->interfaces == NULL ||
  88             iface->interfaces->for_each_interface == NULL)
  89                 return wps_for_each(iface, &data);
  90         return iface->interfaces->for_each_interface(iface->interfaces,
  91                                                      wps_for_each, &data);
  92 }
  93
  94
  95 static int hostapd_wps_new_psk_cb(void *ctx, const u8 *mac_addr,
  96                                   const u8 *p2p_dev_addr, const u8 *psk,
  97                                   size_t psk_len)
  98 {
  99         struct hostapd_data *hapd = ctx;
 100         struct hostapd_wpa_psk *p;
 101         struct hostapd_ssid *ssid = &hapd->conf->ssid;
 102
 103         if (is_zero_ether_addr(p2p_dev_addr)) {
 104                 wpa_printf(MSG_DEBUG,
 105                            "Received new WPA/WPA2-PSK from WPS for STA " MACSTR,
 106                            MAC2STR(mac_addr));
 107         } else {
 108                 wpa_printf(MSG_DEBUG,
 109                            "Received new WPA/WPA2-PSK from WPS for STA " MACSTR
 110                            " P2P Device Addr " MACSTR,
 111                            MAC2STR(mac_addr), MAC2STR(p2p_dev_addr));
 112         }
 113         wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
 114
 115         if (psk_len != PMK_LEN) {
 116                 wpa_printf(MSG_DEBUG, "Unexpected PSK length %lu",
 117                            (unsigned long) psk_len);
 118                 return -1;
 119         }
 120
 121         /* Add the new PSK to runtime PSK list */
 122         p = os_zalloc(sizeof(*p));
 123         if (p == NULL)
 124                 return -1;
 125         os_memcpy(p->addr, mac_addr, ETH_ALEN);
 126         os_memcpy(p->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
 127         os_memcpy(p->psk, psk, PMK_LEN);
 128
 129         if (hapd->new_psk_cb) {
 130                 hapd->new_psk_cb(hapd->new_psk_cb_ctx, mac_addr, p2p_dev_addr,
 131                                  psk, psk_len);
 132         }
 133
 134         p->next = ssid->wpa_psk;
 135         ssid->wpa_psk = p;
 136
 137         if (ssid->wpa_psk_file) {
 138                 FILE *f;
 139                 char hex[PMK_LEN * 2 + 1];
 140                 /* Add the new PSK to PSK list file */
 141                 f = fopen(ssid->wpa_psk_file, "a");
 142                 if (f == NULL) {
 143                         wpa_printf(MSG_DEBUG, "Failed to add the PSK to "
 144                                    "'%s'", ssid->wpa_psk_file);
 145                         return -1;
 146                 }
 147
 148                 wpa_snprintf_hex(hex, sizeof(hex), psk, psk_len);
 149                 fprintf(f, MACSTR " %s\n", MAC2STR(mac_addr), hex);
 150                 fclose(f);
 151         }
 152
 153         return 0;
 154 }
 155
 156
 157 static int hostapd_wps_set_ie_cb(void *ctx, struct wpabuf *beacon_ie,
 158                                  struct wpabuf *probe_resp_ie)
 159 {
 160         struct hostapd_data *hapd = ctx;
 161         wpabuf_free(hapd->wps_beacon_ie);
 162         hapd->wps_beacon_ie = beacon_ie;
 163         wpabuf_free(hapd->wps_probe_resp_ie);
 164         hapd->wps_probe_resp_ie = probe_resp_ie;
 165         if (hapd->beacon_set_done)
 166                 ieee802_11_set_beacon(hapd);
 167         return hostapd_set_ap_wps_ie(hapd);
 168 }
 169
 170
 171 static void hostapd_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
 172                                       const struct wps_device_data *dev)
 173 {
 174         struct hostapd_data *hapd = ctx;
 175         char uuid[40], txt[400];
 176         int len;
 177         char devtype[WPS_DEV_TYPE_BUFSIZE];
 178         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 179                 return;
 180         wpa_printf(MSG_DEBUG, "WPS: PIN needed for E-UUID %s", uuid);
 181         len = os_snprintf(txt, sizeof(txt), WPS_EVENT_PIN_NEEDED
 182                           "%s " MACSTR " [%s|%s|%s|%s|%s|%s]",
 183                           uuid, MAC2STR(dev->mac_addr), dev->device_name,
 184                           dev->manufacturer, dev->model_name,
 185                           dev->model_number, dev->serial_number,
 186                           wps_dev_type_bin2str(dev->pri_dev_type, devtype,
 187                                                sizeof(devtype)));
 188         if (!os_snprintf_error(sizeof(txt), len))
 189                 wpa_msg(hapd->msg_ctx, MSG_INFO, "%s", txt);
 190
 191         if (hapd->conf->wps_pin_requests) {
 192                 FILE *f;
 193                 struct os_time t;
 194                 f = fopen(hapd->conf->wps_pin_requests, "a");
 195                 if (f == NULL)
 196                         return;
 197                 os_get_time(&t);
 198                 fprintf(f, "%ld\t%s\t" MACSTR "\t%s\t%s\t%s\t%s\t%s"
 199                         "\t%s\n",
 200                         t.sec, uuid, MAC2STR(dev->mac_addr), dev->device_name,
 201                         dev->manufacturer, dev->model_name, dev->model_number,
 202                         dev->serial_number,
 203                         wps_dev_type_bin2str(dev->pri_dev_type, devtype,
 204                                              sizeof(devtype)));
 205                 fclose(f);
 206         }
 207 }
 208
 209
 210 struct wps_stop_reg_data {
 211         struct hostapd_data *current_hapd;
 212         const u8 *uuid_e;
 213         const u8 *dev_pw;
 214         size_t dev_pw_len;
 215 };
 216
 217 static int wps_stop_registrar(struct hostapd_data *hapd, void *ctx)
 218 {
 219         struct wps_stop_reg_data *data = ctx;
 220         if (hapd != data->current_hapd && hapd->wps != NULL)
 221                 wps_registrar_complete(hapd->wps->registrar, data->uuid_e,
 222                                        data->dev_pw, data->dev_pw_len);
 223         return 0;
 224 }
 225
 226
 227 static void hostapd_wps_reg_success_cb(void *ctx, const u8 *mac_addr,
 228                                        const u8 *uuid_e, const u8 *dev_pw,
 229                                        size_t dev_pw_len)
 230 {
 231         struct hostapd_data *hapd = ctx;
 232         char uuid[40];
 233         struct wps_stop_reg_data data;
 234         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 235                 return;
 236         wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_REG_SUCCESS MACSTR " %s",
 237                 MAC2STR(mac_addr), uuid);
 238         if (hapd->wps_reg_success_cb)
 239                 hapd->wps_reg_success_cb(hapd->wps_reg_success_cb_ctx,
 240                                          mac_addr, uuid_e);
 241         data.current_hapd = hapd;
 242         data.uuid_e = uuid_e;
 243         data.dev_pw = dev_pw;
 244         data.dev_pw_len = dev_pw_len;
 245         hostapd_wps_for_each(hapd, wps_stop_registrar, &data);
 246 }
 247
 248
 249 static void hostapd_wps_enrollee_seen_cb(void *ctx, const u8 *addr,
 250                                          const u8 *uuid_e,
 251                                          const u8 *pri_dev_type,
 252                                          u16 config_methods,
 253                                          u16 dev_password_id, u8 request_type,
 254                                          const char *dev_name)
 255 {
 256         struct hostapd_data *hapd = ctx;
 257         char uuid[40];
 258         char devtype[WPS_DEV_TYPE_BUFSIZE];
 259         if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
 260                 return;
 261         if (dev_name == NULL)
 262                 dev_name = "";
 263         wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ENROLLEE_SEEN MACSTR
 264                      " %s %s 0x%x %u %u [%s]",
 265                      MAC2STR(addr), uuid,
 266                      wps_dev_type_bin2str(pri_dev_type, devtype,
 267                                           sizeof(devtype)),
 268                      config_methods, dev_password_id, request_type, dev_name);
 269 }
 270
 271
 272 static void wps_reload_config(void *eloop_data, void *user_ctx)
 273 {
 274         struct hostapd_iface *iface = eloop_data;
 275
 276         wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
 277         if (iface->interfaces == NULL ||
 278             iface->interfaces->reload_config(iface) < 0) {
 279                 wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
 280                            "configuration");
 281         }
 282 }
 283
 284
 285 void hostapd_wps_eap_completed(struct hostapd_data *hapd)
 286 {
 287         /*
 288          * Reduce race condition of the station trying to reconnect immediately
 289          * after AP reconfiguration through WPS by rescheduling the reload
 290          * timeout to happen after EAP completion rather than the originally
 291          * scheduled 100 ms after new configuration became known.
 292          */
 293         if (eloop_deplete_timeout(0, 0, wps_reload_config, hapd->iface, NULL) ==
 294             1)
 295                 wpa_printf(MSG_DEBUG, "WPS: Reschedule immediate configuration reload");
 296 }
 297
 298
 299 static void hapd_new_ap_event(struct hostapd_data *hapd, const u8 *attr,
 300                               size_t attr_len)
 301 {
 302         size_t blen = attr_len * 2 + 1;
 303         char *buf = os_malloc(blen);
 304         if (buf) {
 305                 wpa_snprintf_hex(buf, blen, attr, attr_len);
 306                 wpa_msg(hapd->msg_ctx, MSG_INFO,
 307                         WPS_EVENT_NEW_AP_SETTINGS "%s", buf);
 308                 os_free(buf);
 309         }
 310 }
 311
 312
 313 static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
 314                                        const struct wps_credential *cred)
 315 {
 316         struct hostapd_bss_config *bss = hapd->conf;
 317
 318         wpa_printf(MSG_DEBUG, "WPS: Updating in-memory configuration");
 319
 320         bss->wps_state = 2;
 321         if (cred->ssid_len <= SSID_MAX_LEN) {
 322                 os_memcpy(bss->ssid.ssid, cred->ssid, cred->ssid_len);
 323                 bss->ssid.ssid_len = cred->ssid_len;
 324                 bss->ssid.ssid_set = 1;
 325         }
 326
 327         if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
 328             (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
 329                 bss->wpa = 3;
 330         else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
 331                 bss->wpa = 2;
 332         else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
 333                 bss->wpa = 1;
 334         else
 335                 bss->wpa = 0;
 336
 337         if (bss->wpa) {
 338                 if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA))
 339                         bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
 340                 if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK))
 341                         bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
 342
 343                 bss->wpa_pairwise = 0;
 344                 if (cred->encr_type & WPS_ENCR_AES) {
 345                         if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
 346                                 bss->wpa_pairwise |= WPA_CIPHER_GCMP;
 347                         else
 348                                 bss->wpa_pairwise |= WPA_CIPHER_CCMP;
 349                 }
 350                 if (cred->encr_type & WPS_ENCR_TKIP)
 351                         bss->wpa_pairwise |= WPA_CIPHER_TKIP;
 352                 bss->rsn_pairwise = bss->wpa_pairwise;
 353                 bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa,
 354                                                             bss->wpa_pairwise,
 355                                                             bss->rsn_pairwise);
 356
 357                 if (hapd->conf->wps_cred_add_sae &&
 358                     (cred->auth_type & WPS_AUTH_WPA2PSK) &&
 359                     cred->key_len != 2 * PMK_LEN) {
 360                         bss->wpa_key_mgmt |= WPA_KEY_MGMT_SAE;
 361 #ifdef CONFIG_IEEE80211W
 362                         if (bss->ieee80211w == NO_MGMT_FRAME_PROTECTION)
 363                                 bss->ieee80211w =
 364                                         MGMT_FRAME_PROTECTION_OPTIONAL;
 365                         bss->sae_require_mfp = 1;
 366 #endif /* CONFIG_IEEE80211W */
 367                 }
 368
 369                 if (cred->key_len >= 8 && cred->key_len < 64) {
 370                         os_free(bss->ssid.wpa_passphrase);
 371                         bss->ssid.wpa_passphrase = os_zalloc(cred->key_len + 1);
 372                         if (bss->ssid.wpa_passphrase)
 373                                 os_memcpy(bss->ssid.wpa_passphrase, cred->key,
 374                                           cred->key_len);
 375                         hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
 376                 } else if (cred->key_len == 64) {
 377                         hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
 378                         bss->ssid.wpa_psk =
 379                                 os_zalloc(sizeof(struct hostapd_wpa_psk));
 380                         if (bss->ssid.wpa_psk &&
 381                             hexstr2bin((const char *) cred->key,
 382                                        bss->ssid.wpa_psk->psk, PMK_LEN) == 0) {
 383                                 bss->ssid.wpa_psk->group = 1;
 384                                 os_free(bss->ssid.wpa_passphrase);
 385                                 bss->ssid.wpa_passphrase = NULL;
 386                         }
 387                 }
 388                 bss->auth_algs = 1;
 389         } else {
 390                 /*
 391                  * WPS 2.0 does not allow WEP to be configured, so no need to
 392                  * process that option here either.
 393                  */
 394                 bss->auth_algs = 1;
 395         }
 396
 397         /* Schedule configuration reload after short period of time to allow
 398          * EAP-WSC to be finished.
 399          */
 400         eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
 401                                NULL);
 402
 403         return 0;
 404 }
 405
 406
 407 static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
 408 {
 409         const struct wps_credential *cred = ctx;
 410         FILE *oconf, *nconf;
 411         size_t len, i;
 412         char *tmp_fname;
 413         char buf[1024];
 414         int multi_bss;
 415         int wpa;
 416         int pmf_changed = 0;
 417
 418         if (hapd->wps == NULL)
 419                 return 0;
 420
 421         wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
 422                         cred->cred_attr, cred->cred_attr_len);
 423
 424         wpa_printf(MSG_DEBUG, "WPS: Received new AP Settings");
 425         wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
 426         wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
 427                    cred->auth_type);
 428         wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
 429         wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
 430         wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
 431                         cred->key, cred->key_len);
 432         wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
 433                    MAC2STR(cred->mac_addr));
 434
 435         if ((hapd->conf->wps_cred_processing == 1 ||
 436              hapd->conf->wps_cred_processing == 2) && cred->cred_attr) {
 437                 hapd_new_ap_event(hapd, cred->cred_attr, cred->cred_attr_len);
 438         } else if (hapd->conf->wps_cred_processing == 1 ||
 439                    hapd->conf->wps_cred_processing == 2) {
 440                 struct wpabuf *attr;
 441                 attr = wpabuf_alloc(200);
 442                 if (attr && wps_build_credential_wrap(attr, cred) == 0)
 443                         hapd_new_ap_event(hapd, wpabuf_head_u8(attr),
 444                                           wpabuf_len(attr));
 445                 wpabuf_free(attr);
 446         } else
 447                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS);
 448
 449         if (hapd->conf->wps_cred_processing == 1)
 450                 return 0;
 451
 452         os_memcpy(hapd->wps->ssid, cred->ssid, cred->ssid_len);
 453         hapd->wps->ssid_len = cred->ssid_len;
 454         hapd->wps->encr_types = cred->encr_type;
 455         hapd->wps->encr_types_rsn = cred->encr_type;
 456         hapd->wps->encr_types_wpa = cred->encr_type;
 457         hapd->wps->auth_types = cred->auth_type;
 458         hapd->wps->ap_encr_type = cred->encr_type;
 459         hapd->wps->ap_auth_type = cred->auth_type;
 460         if (cred->key_len == 0) {
 461                 os_free(hapd->wps->network_key);
 462                 hapd->wps->network_key = NULL;
 463                 hapd->wps->network_key_len = 0;
 464         } else if ((cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) &&
 465                    (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN)) {
 466                 wpa_printf(MSG_INFO, "WPS: Invalid key length %lu for WPA/WPA2",
 467                            (unsigned long) cred->key_len);
 468                 return -1;
 469         } else {
 470                 if (hapd->wps->network_key == NULL ||
 471                     hapd->wps->network_key_len < cred->key_len) {
 472                         hapd->wps->network_key_len = 0;
 473                         os_free(hapd->wps->network_key);
 474                         hapd->wps->network_key = os_malloc(cred->key_len);
 475                         if (hapd->wps->network_key == NULL)
 476                                 return -1;
 477                 }
 478                 hapd->wps->network_key_len = cred->key_len;
 479                 os_memcpy(hapd->wps->network_key, cred->key, cred->key_len);
 480         }
 481         hapd->wps->wps_state = WPS_STATE_CONFIGURED;
 482
 483         if (hapd->iface->config_fname == NULL)
 484                 return hapd_wps_reconfig_in_memory(hapd, cred);
 485         len = os_strlen(hapd->iface->config_fname) + 5;
 486         tmp_fname = os_malloc(len);
 487         if (tmp_fname == NULL)
 488                 return -1;
 489         os_snprintf(tmp_fname, len, "%s-new", hapd->iface->config_fname);
 490
 491         oconf = fopen(hapd->iface->config_fname, "r");
 492         if (oconf == NULL) {
 493                 wpa_printf(MSG_WARNING, "WPS: Could not open current "
 494                            "configuration file");
 495                 os_free(tmp_fname);
 496                 return -1;
 497         }
 498
 499         nconf = fopen(tmp_fname, "w");
 500         if (nconf == NULL) {
 501                 wpa_printf(MSG_WARNING, "WPS: Could not write updated "
 502                            "configuration file");
 503                 os_free(tmp_fname);
 504                 fclose(oconf);
 505                 return -1;
 506         }
 507
 508         fprintf(nconf, "# WPS configuration - START\n");
 509
 510         fprintf(nconf, "wps_state=2\n");
 511
 512         if (is_hex(cred->ssid, cred->ssid_len)) {
 513                 fprintf(nconf, "ssid2=");
 514                 for (i = 0; i < cred->ssid_len; i++)
 515                         fprintf(nconf, "%02x", cred->ssid[i]);
 516                 fprintf(nconf, "\n");
 517         } else {
 518                 fprintf(nconf, "ssid=");
 519                 for (i = 0; i < cred->ssid_len; i++)
 520                         fputc(cred->ssid[i], nconf);
 521                 fprintf(nconf, "\n");
 522         }
 523
 524         if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
 525             (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
 526                 wpa = 3;
 527         else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
 528                 wpa = 2;
 529         else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
 530                 wpa = 1;
 531         else
 532                 wpa = 0;
 533
 534         if (wpa) {
 535                 char *prefix;
 536 #ifdef CONFIG_IEEE80211W
 537                 int sae = 0;
 538 #endif /* CONFIG_IEEE80211W */
 539
 540                 fprintf(nconf, "wpa=%d\n", wpa);
 541
 542                 fprintf(nconf, "wpa_key_mgmt=");
 543                 prefix = "";
 544                 if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) {
 545                         fprintf(nconf, "WPA-EAP");
 546                         prefix = " ";
 547                 }
 548                 if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) {
 549                         fprintf(nconf, "%sWPA-PSK", prefix);
 550                         prefix = " ";
 551                 }
 552                 if (hapd->conf->wps_cred_add_sae &&
 553                     (cred->auth_type & WPS_AUTH_WPA2PSK) &&
 554                     cred->key_len != 2 * PMK_LEN) {
 555                         fprintf(nconf, "%sSAE", prefix);
 556 #ifdef CONFIG_IEEE80211W
 557                         sae = 1;
 558 #endif /* CONFIG_IEEE80211W */
 559                 }
 560                 fprintf(nconf, "\n");
 561
 562 #ifdef CONFIG_IEEE80211W
 563                 if (sae && hapd->conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
 564                         fprintf(nconf, "ieee80211w=%d\n",
 565                                 MGMT_FRAME_PROTECTION_OPTIONAL);
 566                         pmf_changed = 1;
 567                 }
 568                 if (sae)
 569                         fprintf(nconf, "sae_require_mfp=1\n");
 570 #endif /* CONFIG_IEEE80211W */
 571
 572                 fprintf(nconf, "wpa_pairwise=");
 573                 prefix = "";
 574                 if (cred->encr_type & WPS_ENCR_AES) {
 575                         if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
 576                                 fprintf(nconf, "GCMP");
 577                         else
 578                                 fprintf(nconf, "CCMP");
 579
 580                         prefix = " ";
 581                 }
 582                 if (cred->encr_type & WPS_ENCR_TKIP) {
 583                         fprintf(nconf, "%sTKIP", prefix);
 584                 }
 585                 fprintf(nconf, "\n");
 586
 587                 if (cred->key_len >= 8 && cred->key_len < 64) {
 588                         fprintf(nconf, "wpa_passphrase=");
 589                         for (i = 0; i < cred->key_len; i++)
 590                                 fputc(cred->key[i], nconf);
 591                         fprintf(nconf, "\n");
 592                 } else if (cred->key_len == 64) {
 593                         fprintf(nconf, "wpa_psk=");
 594                         for (i = 0; i < cred->key_len; i++)
 595                                 fputc(cred->key[i], nconf);
 596                         fprintf(nconf, "\n");
 597                 } else {
 598                         wpa_printf(MSG_WARNING, "WPS: Invalid key length %lu "
 599                                    "for WPA/WPA2",
 600                                    (unsigned long) cred->key_len);
 601                 }
 602
 603                 fprintf(nconf, "auth_algs=1\n");
 604         } else {
 605                 /*
 606                  * WPS 2.0 does not allow WEP to be configured, so no need to
 607                  * process that option here either.
 608                  */
 609                 fprintf(nconf, "auth_algs=1\n");
 610         }
 611
 612         fprintf(nconf, "# WPS configuration - END\n");
 613
 614         multi_bss = 0;
 615         while (fgets(buf, sizeof(buf), oconf)) {
 616                 if (os_strncmp(buf, "bss=", 4) == 0)
 617                         multi_bss = 1;
 618                 if (!multi_bss &&
 619                     (str_starts(buf, "ssid=") ||
 620                      str_starts(buf, "ssid2=") ||
 621                      str_starts(buf, "auth_algs=") ||
 622                      str_starts(buf, "wep_default_key=") ||
 623                      str_starts(buf, "wep_key") ||
 624                      str_starts(buf, "wps_state=") ||
 625                      (pmf_changed && str_starts(buf, "ieee80211w=")) ||
 626                      str_starts(buf, "wpa=") ||
 627                      str_starts(buf, "wpa_psk=") ||
 628                      str_starts(buf, "wpa_pairwise=") ||
 629                      str_starts(buf, "rsn_pairwise=") ||
 630                      str_starts(buf, "wpa_key_mgmt=") ||
 631                      str_starts(buf, "wpa_passphrase="))) {
 632                         fprintf(nconf, "#WPS# %s", buf);
 633                 } else
 634                         fprintf(nconf, "%s", buf);
 635         }
 636
 637         fclose(nconf);
 638         fclose(oconf);
 639
 640         if (rename(tmp_fname, hapd->iface->config_fname) < 0) {
 641                 wpa_printf(MSG_WARNING, "WPS: Failed to rename the updated "
 642                            "configuration file: %s", strerror(errno));
 643                 os_free(tmp_fname);
 644                 return -1;
 645         }
 646
 647         os_free(tmp_fname);
 648
 649         /* Schedule configuration reload after short period of time to allow
 650          * EAP-WSC to be finished.
 651          */
 652         eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
 653                                NULL);
 654
 655         wpa_printf(MSG_DEBUG, "WPS: AP configuration updated");
 656
 657         return 0;
 658 }
 659
 660
 661 static int hostapd_wps_cred_cb(void *ctx, const struct wps_credential *cred)
 662 {
 663         struct hostapd_data *hapd = ctx;
 664         return hostapd_wps_for_each(hapd, hapd_wps_cred_cb, (void *) cred);
 665 }
 666
 667
 668 static void hostapd_wps_reenable_ap_pin(void *eloop_data, void *user_ctx)
 669 {
 670         struct hostapd_data *hapd = eloop_data;
 671
 672         if (hapd->conf->ap_setup_locked)
 673                 return;
 674         if (hapd->ap_pin_failures_consecutive >= 10)
 675                 return;
 676
 677         wpa_printf(MSG_DEBUG, "WPS: Re-enable AP PIN");
 678         wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
 679         hapd->wps->ap_setup_locked = 0;
 680         wps_registrar_update_ie(hapd->wps->registrar);
 681 }
 682
 683
 684 static int wps_pwd_auth_fail(struct hostapd_data *hapd, void *ctx)
 685 {
 686         struct wps_event_pwd_auth_fail *data = ctx;
 687
 688         if (!data->enrollee || hapd->conf->ap_pin == NULL || hapd->wps == NULL)
 689                 return 0;
 690
 691         /*
 692          * Registrar failed to prove its knowledge of the AP PIN. Lock AP setup
 693          * for some time if this happens multiple times to slow down brute
 694          * force attacks.
 695          */
 696         hapd->ap_pin_failures++;
 697         hapd->ap_pin_failures_consecutive++;
 698         wpa_printf(MSG_DEBUG, "WPS: AP PIN authentication failure number %u "
 699                    "(%u consecutive)",
 700                    hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
 701         if (hapd->ap_pin_failures < 3)
 702                 return 0;
 703
 704         wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_LOCKED);
 705         hapd->wps->ap_setup_locked = 1;
 706
 707         wps_registrar_update_ie(hapd->wps->registrar);
 708
 709         if (!hapd->conf->ap_setup_locked &&
 710             hapd->ap_pin_failures_consecutive >= 10) {
 711                 /*
 712                  * In indefinite lockdown - disable automatic AP PIN
 713                  * reenablement.
 714                  */
 715                 eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
 716                 wpa_printf(MSG_DEBUG, "WPS: AP PIN disabled indefinitely");
 717         } else if (!hapd->conf->ap_setup_locked) {
 718                 if (hapd->ap_pin_lockout_time == 0)
 719                         hapd->ap_pin_lockout_time = 60;
 720                 else if (hapd->ap_pin_lockout_time < 365 * 24 * 60 * 60 &&
 721                          (hapd->ap_pin_failures % 3) == 0)
 722                         hapd->ap_pin_lockout_time *= 2;
 723
 724                 wpa_printf(MSG_DEBUG, "WPS: Disable AP PIN for %u seconds",
 725                            hapd->ap_pin_lockout_time);
 726                 eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
 727                 eloop_register_timeout(hapd->ap_pin_lockout_time, 0,
 728                                        hostapd_wps_reenable_ap_pin, hapd,
 729                                        NULL);
 730         }
 731
 732         return 0;
 733 }
 734
 735
 736 static void hostapd_pwd_auth_fail(struct hostapd_data *hapd,
 737                                   struct wps_event_pwd_auth_fail *data)
 738 {
 739         /* Update WPS Status - Authentication Failure */
 740         wpa_printf(MSG_DEBUG, "WPS: Authentication failure update");
 741         hapd->wps_stats.status = WPS_STATUS_FAILURE;
 742         hapd->wps_stats.failure_reason = WPS_EI_AUTH_FAILURE;
 743         os_memcpy(hapd->wps_stats.peer_addr, data->peer_macaddr, ETH_ALEN);
 744
 745         hostapd_wps_for_each(hapd, wps_pwd_auth_fail, data);
 746 }
 747
 748
 749 static int wps_ap_pin_success(struct hostapd_data *hapd, void *ctx)
 750 {
 751         if (hapd->conf->ap_pin == NULL || hapd->wps == NULL)
 752                 return 0;
 753
 754         if (hapd->ap_pin_failures_consecutive == 0)
 755                 return 0;
 756
 757         wpa_printf(MSG_DEBUG, "WPS: Clear consecutive AP PIN failure counter "
 758                    "- total validation failures %u (%u consecutive)",
 759                    hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
 760         hapd->ap_pin_failures_consecutive = 0;
 761
 762         return 0;
 763 }
 764
 765
 766 static void hostapd_wps_ap_pin_success(struct hostapd_data *hapd)
 767 {
 768         hostapd_wps_for_each(hapd, wps_ap_pin_success, NULL);
 769 }
 770
 771
 772 static void hostapd_wps_event_pbc_overlap(struct hostapd_data *hapd)
 773 {
 774         /* Update WPS Status - PBC Overlap */
 775         hapd->wps_stats.pbc_status = WPS_PBC_STATUS_OVERLAP;
 776 }
 777
 778
 779 static void hostapd_wps_event_pbc_timeout(struct hostapd_data *hapd)
 780 {
 781         /* Update WPS PBC Status:PBC Timeout */
 782         hapd->wps_stats.pbc_status = WPS_PBC_STATUS_TIMEOUT;
 783 }
 784
 785
 786 static void hostapd_wps_event_pbc_active(struct hostapd_data *hapd)
 787 {
 788         /* Update WPS PBC status - Active */
 789         hapd->wps_stats.pbc_status = WPS_PBC_STATUS_ACTIVE;
 790 }
 791
 792
 793 static void hostapd_wps_event_pbc_disable(struct hostapd_data *hapd)
 794 {
 795         /* Update WPS PBC status - Active */
 796         hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
 797 }
 798
 799
 800 static void hostapd_wps_event_success(struct hostapd_data *hapd,
 801                                       struct wps_event_success *success)
 802 {
 803         /* Update WPS status - Success */
 804         hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
 805         hapd->wps_stats.status = WPS_STATUS_SUCCESS;
 806         os_memcpy(hapd->wps_stats.peer_addr, success->peer_macaddr, ETH_ALEN);
 807 }
 808
 809
 810 static void hostapd_wps_event_fail(struct hostapd_data *hapd,
 811                                    struct wps_event_fail *fail)
 812 {
 813         /* Update WPS status - Failure */
 814         hapd->wps_stats.status = WPS_STATUS_FAILURE;
 815         os_memcpy(hapd->wps_stats.peer_addr, fail->peer_macaddr, ETH_ALEN);
 816
 817         hapd->wps_stats.failure_reason = fail->error_indication;
 818
 819         if (fail->error_indication > 0 &&
 820             fail->error_indication < NUM_WPS_EI_VALUES) {
 821                 wpa_msg(hapd->msg_ctx, MSG_INFO,
 822                         WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)",
 823                         fail->msg, fail->config_error, fail->error_indication,
 824                         wps_ei_str(fail->error_indication));
 825         } else {
 826                 wpa_msg(hapd->msg_ctx, MSG_INFO,
 827                         WPS_EVENT_FAIL "msg=%d config_error=%d",
 828                         fail->msg, fail->config_error);
 829         }
 830 }
 831
 832
 833 static void hostapd_wps_event_cb(void *ctx, enum wps_event event,
 834                                  union wps_event_data *data)
 835 {
 836         struct hostapd_data *hapd = ctx;
 837
 838         switch (event) {
 839         case WPS_EV_M2D:
 840                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_M2D);
 841                 break;
 842         case WPS_EV_FAIL:
 843                 hostapd_wps_event_fail(hapd, &data->fail);
 844                 break;
 845         case WPS_EV_SUCCESS:
 846                 hostapd_wps_event_success(hapd, &data->success);
 847                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_SUCCESS);
 848                 break;
 849         case WPS_EV_PWD_AUTH_FAIL:
 850                 hostapd_pwd_auth_fail(hapd, &data->pwd_auth_fail);
 851                 break;
 852         case WPS_EV_PBC_OVERLAP:
 853                 hostapd_wps_event_pbc_overlap(hapd);
 854                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_OVERLAP);
 855                 break;
 856         case WPS_EV_PBC_TIMEOUT:
 857                 hostapd_wps_event_pbc_timeout(hapd);
 858                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_TIMEOUT);
 859                 break;
 860         case WPS_EV_PBC_ACTIVE:
 861                 hostapd_wps_event_pbc_active(hapd);
 862                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ACTIVE);
 863                 break;
 864         case WPS_EV_PBC_DISABLE:
 865                 hostapd_wps_event_pbc_disable(hapd);
 866                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_DISABLE);
 867                 break;
 868         case WPS_EV_ER_AP_ADD:
 869                 break;
 870         case WPS_EV_ER_AP_REMOVE:
 871                 break;
 872         case WPS_EV_ER_ENROLLEE_ADD:
 873                 break;
 874         case WPS_EV_ER_ENROLLEE_REMOVE:
 875                 break;
 876         case WPS_EV_ER_AP_SETTINGS:
 877                 break;
 878         case WPS_EV_ER_SET_SELECTED_REGISTRAR:
 879                 break;
 880         case WPS_EV_AP_PIN_SUCCESS:
 881                 hostapd_wps_ap_pin_success(hapd);
 882                 break;
 883         }
 884         if (hapd->wps_event_cb)
 885                 hapd->wps_event_cb(hapd->wps_event_cb_ctx, event, data);
 886 }
 887
 888
 889 static int hostapd_wps_rf_band_cb(void *ctx)
 890 {
 891         struct hostapd_data *hapd = ctx;
 892
 893         return hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
 894                 WPS_RF_50GHZ :
 895                 hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
 896                 WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
 897 }
 898
 899
 900 static void hostapd_wps_clear_ies(struct hostapd_data *hapd, int deinit_only)
 901 {
 902         wpabuf_free(hapd->wps_beacon_ie);
 903         hapd->wps_beacon_ie = NULL;
 904
 905         wpabuf_free(hapd->wps_probe_resp_ie);
 906         hapd->wps_probe_resp_ie = NULL;
 907
 908         if (deinit_only) {
 909                 if (hapd->drv_priv)
 910                         hostapd_reset_ap_wps_ie(hapd);
 911                 return;
 912         }
 913
 914         hostapd_set_ap_wps_ie(hapd);
 915 }
 916
 917
 918 static int get_uuid_cb(struct hostapd_iface *iface, void *ctx)
 919 {
 920         const u8 **uuid = ctx;
 921         size_t j;
 922
 923         if (iface == NULL)
 924                 return 0;
 925         for (j = 0; j < iface->num_bss; j++) {
 926                 struct hostapd_data *hapd = iface->bss[j];
 927                 if (hapd->wps && !hapd->conf->wps_independent &&
 928                     !is_nil_uuid(hapd->wps->uuid)) {
 929                         *uuid = hapd->wps->uuid;
 930                         return 1;
 931                 }
 932         }
 933
 934         return 0;
 935 }
 936
 937
 938 static const u8 * get_own_uuid(struct hostapd_iface *iface)
 939 {
 940         const u8 *uuid;
 941         if (iface->interfaces == NULL ||
 942             iface->interfaces->for_each_interface == NULL)
 943                 return NULL;
 944         uuid = NULL;
 945         iface->interfaces->for_each_interface(iface->interfaces, get_uuid_cb,
 946                                               &uuid);
 947         return uuid;
 948 }
 949
 950
 951 static int count_interface_cb(struct hostapd_iface *iface, void *ctx)
 952 {
 953         int *count= ctx;
 954         (*count)++;
 955         return 0;
 956 }
 957
 958
 959 static int interface_count(struct hostapd_iface *iface)
 960 {
 961         int count = 0;
 962         if (iface->interfaces == NULL ||
 963             iface->interfaces->for_each_interface == NULL)
 964                 return 0;
 965         iface->interfaces->for_each_interface(iface->interfaces,
 966                                               count_interface_cb, &count);
 967         return count;
 968 }
 969
 970
 971 static int hostapd_wps_set_vendor_ext(struct hostapd_data *hapd,
 972                                       struct wps_context *wps)
 973 {
 974         int i;
 975
 976         for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) {
 977                 wpabuf_free(wps->dev.vendor_ext[i]);
 978                 wps->dev.vendor_ext[i] = NULL;
 979
 980                 if (hapd->conf->wps_vendor_ext[i] == NULL)
 981                         continue;
 982
 983                 wps->dev.vendor_ext[i] =
 984                         wpabuf_dup(hapd->conf->wps_vendor_ext[i]);
 985                 if (wps->dev.vendor_ext[i] == NULL) {
 986                         while (--i >= 0)
 987                                 wpabuf_free(wps->dev.vendor_ext[i]);
 988                         return -1;
 989                 }
 990         }
 991
 992         return 0;
 993 }
 994
 995
 996 static void hostapd_free_wps(struct wps_context *wps)
 997 {
 998         int i;
 999
1000         for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
1001                 wpabuf_free(wps->dev.vendor_ext[i]);
1002         wps_device_data_free(&wps->dev);
1003         os_free(wps->network_key);
1004         hostapd_wps_nfc_clear(wps);
1005         wpabuf_free(wps->dh_pubkey);
1006         wpabuf_free(wps->dh_privkey);
1007         os_free(wps);
1008 }
1009
1010
1011 int hostapd_init_wps(struct hostapd_data *hapd,
1012                      struct hostapd_bss_config *conf)
1013 {
1014         struct wps_context *wps;
1015         struct wps_registrar_config cfg;
1016         u8 *multi_ap_netw_key = NULL;
1017
1018         if (conf->wps_state == 0) {
1019                 hostapd_wps_clear_ies(hapd, 0);
1020                 return 0;
1021         }
1022
1023         wps = os_zalloc(sizeof(*wps));
1024         if (wps == NULL)
1025                 return -1;
1026
1027         wps->cred_cb = hostapd_wps_cred_cb;
1028         wps->event_cb = hostapd_wps_event_cb;
1029         wps->rf_band_cb = hostapd_wps_rf_band_cb;
1030         wps->cb_ctx = hapd;
1031
1032         os_memset(&cfg, 0, sizeof(cfg));
1033         wps->wps_state = hapd->conf->wps_state;
1034         wps->ap_setup_locked = hapd->conf->ap_setup_locked;
1035         if (is_nil_uuid(hapd->conf->uuid)) {
1036                 const u8 *uuid;
1037                 uuid = get_own_uuid(hapd->iface);
1038                 if (uuid && !conf->wps_independent) {
1039                         os_memcpy(wps->uuid, uuid, UUID_LEN);
1040                         wpa_hexdump(MSG_DEBUG, "WPS: Clone UUID from another "
1041                                     "interface", wps->uuid, UUID_LEN);
1042                 } else {
1043                         uuid_gen_mac_addr(hapd->own_addr, wps->uuid);
1044                         wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC "
1045                                     "address", wps->uuid, UUID_LEN);
1046                 }
1047         } else {
1048                 os_memcpy(wps->uuid, hapd->conf->uuid, UUID_LEN);
1049                 wpa_hexdump(MSG_DEBUG, "WPS: Use configured UUID",
1050                             wps->uuid, UUID_LEN);
1051         }
1052         wps->ssid_len = hapd->conf->ssid.ssid_len;
1053         os_memcpy(wps->ssid, hapd->conf->ssid.ssid, wps->ssid_len);
1054         wps->ap = 1;
1055         os_memcpy(wps->dev.mac_addr, hapd->own_addr, ETH_ALEN);
1056         wps->dev.device_name = hapd->conf->device_name ?
1057                 os_strdup(hapd->conf->device_name) : NULL;
1058         wps->dev.manufacturer = hapd->conf->manufacturer ?
1059                 os_strdup(hapd->conf->manufacturer) : NULL;
1060         wps->dev.model_name = hapd->conf->model_name ?
1061                 os_strdup(hapd->conf->model_name) : NULL;
1062         wps->dev.model_number = hapd->conf->model_number ?
1063                 os_strdup(hapd->conf->model_number) : NULL;
1064         wps->dev.serial_number = hapd->conf->serial_number ?
1065                 os_strdup(hapd->conf->serial_number) : NULL;
1066         wps->config_methods =
1067                 wps_config_methods_str2bin(hapd->conf->config_methods);
1068         if ((wps->config_methods &
1069              (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY |
1070               WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) {
1071                 wpa_printf(MSG_INFO, "WPS: Converting display to "
1072                            "virtual_display for WPS 2.0 compliance");
1073                 wps->config_methods |= WPS_CONFIG_VIRT_DISPLAY;
1074         }
1075         if ((wps->config_methods &
1076              (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON |
1077               WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) {
1078                 wpa_printf(MSG_INFO, "WPS: Converting push_button to "
1079                            "virtual_push_button for WPS 2.0 compliance");
1080                 wps->config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
1081         }
1082         os_memcpy(wps->dev.pri_dev_type, hapd->conf->device_type,
1083                   WPS_DEV_TYPE_LEN);
1084
1085         if (hostapd_wps_set_vendor_ext(hapd, wps) < 0)
1086                 goto fail;
1087
1088         wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
1089
1090         if (conf->wps_rf_bands) {
1091                 wps->dev.rf_bands = conf->wps_rf_bands;
1092         } else {
1093                 wps->dev.rf_bands =
1094                         hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
1095                         WPS_RF_50GHZ :
1096                         hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
1097                         WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
1098         }
1099
1100         if (conf->wpa & WPA_PROTO_RSN) {
1101                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1102                         wps->auth_types |= WPS_AUTH_WPA2PSK;
1103                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1104                         wps->auth_types |= WPS_AUTH_WPA2;
1105
1106                 if (conf->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1107                                           WPA_CIPHER_CCMP_256 |
1108                                           WPA_CIPHER_GCMP_256)) {
1109                         wps->encr_types |= WPS_ENCR_AES;
1110                         wps->encr_types_rsn |= WPS_ENCR_AES;
1111                 }
1112                 if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
1113                         wps->encr_types |= WPS_ENCR_TKIP;
1114                         wps->encr_types_rsn |= WPS_ENCR_TKIP;
1115                 }
1116         }
1117
1118         if (conf->wpa & WPA_PROTO_WPA) {
1119                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1120                         wps->auth_types |= WPS_AUTH_WPAPSK;
1121                 if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1122                         wps->auth_types |= WPS_AUTH_WPA;
1123
1124                 if (conf->wpa_pairwise & WPA_CIPHER_CCMP) {
1125                         wps->encr_types |= WPS_ENCR_AES;
1126                         wps->encr_types_wpa |= WPS_ENCR_AES;
1127                 }
1128                 if (conf->wpa_pairwise & WPA_CIPHER_TKIP) {
1129                         wps->encr_types |= WPS_ENCR_TKIP;
1130                         wps->encr_types_wpa |= WPS_ENCR_TKIP;
1131                 }
1132         }
1133
1134         if (conf->ssid.security_policy == SECURITY_PLAINTEXT) {
1135                 wps->encr_types |= WPS_ENCR_NONE;
1136                 wps->auth_types |= WPS_AUTH_OPEN;
1137         }
1138
1139         if (conf->ssid.wpa_psk_file) {
1140                 /* Use per-device PSKs */
1141         } else if (conf->ssid.wpa_passphrase) {
1142                 wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase);
1143                 wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase);
1144         } else if (conf->ssid.wpa_psk) {
1145                 wps->network_key = os_malloc(2 * PMK_LEN + 1);
1146                 if (wps->network_key == NULL)
1147                         goto fail;
1148                 wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1,
1149                                  conf->ssid.wpa_psk->psk, PMK_LEN);
1150                 wps->network_key_len = 2 * PMK_LEN;
1151         } else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) {
1152                 wps->network_key = os_malloc(conf->ssid.wep.len[0]);
1153                 if (wps->network_key == NULL)
1154                         goto fail;
1155                 os_memcpy(wps->network_key, conf->ssid.wep.key[0],
1156                           conf->ssid.wep.len[0]);
1157                 wps->network_key_len = conf->ssid.wep.len[0];
1158         }
1159
1160         if (conf->ssid.wpa_psk) {
1161                 os_memcpy(wps->psk, conf->ssid.wpa_psk->psk, PMK_LEN);
1162                 wps->psk_set = 1;
1163         }
1164
1165         wps->ap_auth_type = wps->auth_types;
1166         wps->ap_encr_type = wps->encr_types;
1167         if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) {
1168                 /* Override parameters to enable security by default */
1169                 wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
1170                 wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
1171                 wps->encr_types_rsn = WPS_ENCR_AES | WPS_ENCR_TKIP;
1172                 wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP;
1173         }
1174
1175         if ((hapd->conf->multi_ap & FRONTHAUL_BSS) &&
1176             hapd->conf->multi_ap_backhaul_ssid.ssid_len) {
1177                 cfg.multi_ap_backhaul_ssid_len =
1178                         hapd->conf->multi_ap_backhaul_ssid.ssid_len;
1179                 cfg.multi_ap_backhaul_ssid =
1180                         hapd->conf->multi_ap_backhaul_ssid.ssid;
1181
1182                 if (conf->multi_ap_backhaul_ssid.wpa_passphrase) {
1183                         cfg.multi_ap_backhaul_network_key = (const u8 *)
1184                                 conf->multi_ap_backhaul_ssid.wpa_passphrase;
1185                         cfg.multi_ap_backhaul_network_key_len =
1186                                 os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase);
1187                 } else if (conf->multi_ap_backhaul_ssid.wpa_psk) {
1188                         multi_ap_netw_key = os_malloc(2 * PMK_LEN + 1);
1189                         if (!multi_ap_netw_key)
1190                                 goto fail;
1191                         wpa_snprintf_hex((char *) multi_ap_netw_key,
1192                                          2 * PMK_LEN + 1,
1193                                          conf->multi_ap_backhaul_ssid.wpa_psk->psk,
1194                                          PMK_LEN);
1195                         cfg.multi_ap_backhaul_network_key = multi_ap_netw_key;
1196                         cfg.multi_ap_backhaul_network_key_len = 2 * PMK_LEN;
1197                 }
1198         }
1199
1200         wps->ap_settings = conf->ap_settings;
1201         wps->ap_settings_len = conf->ap_settings_len;
1202
1203         cfg.new_psk_cb = hostapd_wps_new_psk_cb;
1204         cfg.set_ie_cb = hostapd_wps_set_ie_cb;
1205         cfg.pin_needed_cb = hostapd_wps_pin_needed_cb;
1206         cfg.reg_success_cb = hostapd_wps_reg_success_cb;
1207         cfg.enrollee_seen_cb = hostapd_wps_enrollee_seen_cb;
1208         cfg.cb_ctx = hapd;
1209         cfg.skip_cred_build = conf->skip_cred_build;
1210         cfg.extra_cred = conf->extra_cred;
1211         cfg.extra_cred_len = conf->extra_cred_len;
1212         cfg.disable_auto_conf = (hapd->conf->wps_cred_processing == 1) &&
1213                 conf->skip_cred_build;
1214         if (conf->ssid.security_policy == SECURITY_STATIC_WEP)
1215                 cfg.static_wep_only = 1;
1216         cfg.dualband = interface_count(hapd->iface) > 1;
1217         if ((wps->dev.rf_bands & (WPS_RF_50GHZ | WPS_RF_24GHZ)) ==
1218             (WPS_RF_50GHZ | WPS_RF_24GHZ))
1219                 cfg.dualband = 1;
1220         if (cfg.dualband)
1221                 wpa_printf(MSG_DEBUG, "WPS: Dualband AP");
1222         cfg.force_per_enrollee_psk = conf->force_per_enrollee_psk;
1223
1224         wps->registrar = wps_registrar_init(wps, &cfg);
1225         if (wps->registrar == NULL) {
1226                 wpa_printf(MSG_ERROR, "Failed to initialize WPS Registrar");
1227                 goto fail;
1228         }
1229
1230 #ifdef CONFIG_WPS_UPNP
1231         wps->friendly_name = hapd->conf->friendly_name;
1232         wps->manufacturer_url = hapd->conf->manufacturer_url;
1233         wps->model_description = hapd->conf->model_description;
1234         wps->model_url = hapd->conf->model_url;
1235         wps->upc = hapd->conf->upc;
1236 #endif /* CONFIG_WPS_UPNP */
1237
1238         hostapd_register_probereq_cb(hapd, hostapd_wps_probe_req_rx, hapd);
1239
1240         hapd->wps = wps;
1241         bin_clear_free(multi_ap_netw_key, 2 * PMK_LEN);
1242
1243         return 0;
1244
1245 fail:
1246         bin_clear_free(multi_ap_netw_key, 2 * PMK_LEN);
1247         hostapd_free_wps(wps);
1248         return -1;
1249 }
1250
1251
1252 int hostapd_init_wps_complete(struct hostapd_data *hapd)
1253 {
1254         struct wps_context *wps = hapd->wps;
1255
1256         if (wps == NULL)
1257                 return 0;
1258
1259 #ifdef CONFIG_WPS_UPNP
1260         if (hostapd_wps_upnp_init(hapd, wps) < 0) {
1261                 wpa_printf(MSG_ERROR, "Failed to initialize WPS UPnP");
1262                 wps_registrar_deinit(wps->registrar);
1263                 hostapd_free_wps(wps);
1264                 hapd->wps = NULL;
1265                 return -1;
1266         }
1267 #endif /* CONFIG_WPS_UPNP */
1268
1269         return 0;
1270 }
1271
1272
1273 static void hostapd_wps_nfc_clear(struct wps_context *wps)
1274 {
1275 #ifdef CONFIG_WPS_NFC
1276         wpa_printf(MSG_DEBUG, "WPS: Clear NFC Tag context %p", wps);
1277         wps->ap_nfc_dev_pw_id = 0;
1278         wpabuf_free(wps->ap_nfc_dh_pubkey);
1279         wps->ap_nfc_dh_pubkey = NULL;
1280         wpabuf_free(wps->ap_nfc_dh_privkey);
1281         wps->ap_nfc_dh_privkey = NULL;
1282         wpabuf_free(wps->ap_nfc_dev_pw);
1283         wps->ap_nfc_dev_pw = NULL;
1284 #endif /* CONFIG_WPS_NFC */
1285 }
1286
1287
1288 void hostapd_deinit_wps(struct hostapd_data *hapd)
1289 {
1290         eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
1291         eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1292         eloop_cancel_timeout(wps_reload_config, hapd->iface, NULL);
1293         if (hapd->wps == NULL) {
1294                 hostapd_wps_clear_ies(hapd, 1);
1295                 return;
1296         }
1297 #ifdef CONFIG_WPS_UPNP
1298         hostapd_wps_upnp_deinit(hapd);
1299 #endif /* CONFIG_WPS_UPNP */
1300         wps_registrar_deinit(hapd->wps->registrar);
1301         wps_free_pending_msgs(hapd->wps->upnp_msgs);
1302         hostapd_free_wps(hapd->wps);
1303         hapd->wps = NULL;
1304         hostapd_wps_clear_ies(hapd, 1);
1305 }
1306
1307
1308 void hostapd_update_wps(struct hostapd_data *hapd)
1309 {
1310         if (hapd->wps == NULL)
1311                 return;
1312
1313 #ifdef CONFIG_WPS_UPNP
1314         hapd->wps->friendly_name = hapd->conf->friendly_name;
1315         hapd->wps->manufacturer_url = hapd->conf->manufacturer_url;
1316         hapd->wps->model_description = hapd->conf->model_description;
1317         hapd->wps->model_url = hapd->conf->model_url;
1318         hapd->wps->upc = hapd->conf->upc;
1319 #endif /* CONFIG_WPS_UPNP */
1320
1321         hostapd_wps_set_vendor_ext(hapd, hapd->wps);
1322
1323         if (hapd->conf->wps_state)
1324                 wps_registrar_update_ie(hapd->wps->registrar);
1325         else
1326                 hostapd_deinit_wps(hapd);
1327 }
1328
1329
1330 struct wps_add_pin_data {
1331         const u8 *addr;
1332         const u8 *uuid;
1333         const u8 *pin;
1334         size_t pin_len;
1335         int timeout;
1336         int added;
1337 };
1338
1339
1340 static int wps_add_pin(struct hostapd_data *hapd, void *ctx)
1341 {
1342         struct wps_add_pin_data *data = ctx;
1343         int ret;
1344
1345         if (hapd->wps == NULL)
1346                 return 0;
1347         ret = wps_registrar_add_pin(hapd->wps->registrar, data->addr,
1348                                     data->uuid, data->pin, data->pin_len,
1349                                     data->timeout);
1350         if (ret == 0)
1351                 data->added++;
1352         return ret;
1353 }
1354
1355
1356 int hostapd_wps_add_pin(struct hostapd_data *hapd, const u8 *addr,
1357                         const char *uuid, const char *pin, int timeout)
1358 {
1359         u8 u[UUID_LEN];
1360         struct wps_add_pin_data data;
1361
1362         data.addr = addr;
1363         data.uuid = u;
1364         data.pin = (const u8 *) pin;
1365         data.pin_len = os_strlen(pin);
1366         data.timeout = timeout;
1367         data.added = 0;
1368
1369         if (os_strcmp(uuid, "any") == 0)
1370                 data.uuid = NULL;
1371         else {
1372                 if (uuid_str2bin(uuid, u))
1373                         return -1;
1374                 data.uuid = u;
1375         }
1376         if (hostapd_wps_for_each(hapd, wps_add_pin, &data) < 0)
1377                 return -1;
1378         return data.added ? 0 : -1;
1379 }
1380
1381
1382 struct wps_button_pushed_ctx {
1383         const u8 *p2p_dev_addr;
1384         unsigned int count;
1385 };
1386
1387 static int wps_button_pushed(struct hostapd_data *hapd, void *ctx)
1388 {
1389         struct wps_button_pushed_ctx *data = ctx;
1390
1391         if (hapd->wps) {
1392                 data->count++;
1393                 return wps_registrar_button_pushed(hapd->wps->registrar,
1394                                                    data->p2p_dev_addr);
1395         }
1396
1397         return 0;
1398 }
1399
1400
1401 int hostapd_wps_button_pushed(struct hostapd_data *hapd,
1402                               const u8 *p2p_dev_addr)
1403 {
1404         struct wps_button_pushed_ctx ctx;
1405         int ret;
1406
1407         os_memset(&ctx, 0, sizeof(ctx));
1408         ctx.p2p_dev_addr = p2p_dev_addr;
1409         ret = hostapd_wps_for_each(hapd, wps_button_pushed, &ctx);
1410         if (ret == 0 && !ctx.count)
1411                 ret = -1;
1412         return ret;
1413 }
1414
1415
1416 struct wps_cancel_ctx {
1417         unsigned int count;
1418 };
1419
1420 static int wps_cancel(struct hostapd_data *hapd, void *ctx)
1421 {
1422         struct wps_cancel_ctx *data = ctx;
1423
1424         if (hapd->wps) {
1425                 data->count++;
1426                 wps_registrar_wps_cancel(hapd->wps->registrar);
1427                 ap_for_each_sta(hapd, ap_sta_wps_cancel, NULL);
1428         }
1429
1430         return 0;
1431 }
1432
1433
1434 int hostapd_wps_cancel(struct hostapd_data *hapd)
1435 {
1436         struct wps_cancel_ctx ctx;
1437         int ret;
1438
1439         os_memset(&ctx, 0, sizeof(ctx));
1440         ret = hostapd_wps_for_each(hapd, wps_cancel, &ctx);
1441         if (ret == 0 && !ctx.count)
1442                 ret = -1;
1443         return ret;
1444 }
1445
1446
1447 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
1448                                     const u8 *bssid,
1449                                     const u8 *ie, size_t ie_len,
1450                                     int ssi_signal)
1451 {
1452         struct hostapd_data *hapd = ctx;
1453         struct wpabuf *wps_ie;
1454         struct ieee802_11_elems elems;
1455
1456         if (hapd->wps == NULL)
1457                 return 0;
1458
1459         if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) {
1460                 wpa_printf(MSG_DEBUG, "WPS: Could not parse ProbeReq from "
1461                            MACSTR, MAC2STR(addr));
1462                 return 0;
1463         }
1464
1465         if (elems.ssid && elems.ssid_len > 0 &&
1466             (elems.ssid_len != hapd->conf->ssid.ssid_len ||
1467              os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) !=
1468              0))
1469                 return 0; /* Not for us */
1470
1471         wps_ie = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA);
1472         if (wps_ie == NULL)
1473                 return 0;
1474         if (wps_validate_probe_req(wps_ie, addr) < 0) {
1475                 wpabuf_free(wps_ie);
1476                 return 0;
1477         }
1478
1479         if (wpabuf_len(wps_ie) > 0) {
1480                 int p2p_wildcard = 0;
1481 #ifdef CONFIG_P2P
1482                 if (elems.ssid && elems.ssid_len == P2P_WILDCARD_SSID_LEN &&
1483                     os_memcmp(elems.ssid, P2P_WILDCARD_SSID,
1484                               P2P_WILDCARD_SSID_LEN) == 0)
1485                         p2p_wildcard = 1;
1486 #endif /* CONFIG_P2P */
1487                 wps_registrar_probe_req_rx(hapd->wps->registrar, addr, wps_ie,
1488                                            p2p_wildcard);
1489 #ifdef CONFIG_WPS_UPNP
1490                 /* FIX: what exactly should be included in the WLANEvent?
1491                  * WPS attributes? Full ProbeReq frame? */
1492                 if (!p2p_wildcard)
1493                         upnp_wps_device_send_wlan_event(
1494                                 hapd->wps_upnp, addr,
1495                                 UPNP_WPS_WLANEVENT_TYPE_PROBE, wps_ie);
1496 #endif /* CONFIG_WPS_UPNP */
1497         }
1498
1499         wpabuf_free(wps_ie);
1500
1501         return 0;
1502 }
1503
1504
1505 #ifdef CONFIG_WPS_UPNP
1506
1507 static int hostapd_rx_req_put_wlan_response(
1508         void *priv, enum upnp_wps_wlanevent_type ev_type,
1509         const u8 *mac_addr, const struct wpabuf *msg,
1510         enum wps_msg_type msg_type)
1511 {
1512         struct hostapd_data *hapd = priv;
1513         struct sta_info *sta;
1514         struct upnp_pending_message *p;
1515
1516         wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse ev_type=%d mac_addr="
1517                    MACSTR, ev_type, MAC2STR(mac_addr));
1518         wpa_hexdump(MSG_MSGDUMP, "WPS UPnP: PutWLANResponse NewMessage",
1519                     wpabuf_head(msg), wpabuf_len(msg));
1520         if (ev_type != UPNP_WPS_WLANEVENT_TYPE_EAP) {
1521                 wpa_printf(MSG_DEBUG, "WPS UPnP: Ignored unexpected "
1522                            "PutWLANResponse WLANEventType %d", ev_type);
1523                 return -1;
1524         }
1525
1526         /*
1527          * EAP response to ongoing to WPS Registration. Send it to EAP-WSC
1528          * server implementation for delivery to the peer.
1529          */
1530
1531         sta = ap_get_sta(hapd, mac_addr);
1532 #ifndef CONFIG_WPS_STRICT
1533         if (!sta) {
1534                 /*
1535                  * Workaround - Intel wsccmd uses bogus NewWLANEventMAC:
1536                  * Pick STA that is in an ongoing WPS registration without
1537                  * checking the MAC address.
1538                  */
1539                 wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based "
1540                            "on NewWLANEventMAC; try wildcard match");
1541                 for (sta = hapd->sta_list; sta; sta = sta->next) {
1542                         if (sta->eapol_sm && (sta->flags & WLAN_STA_WPS))
1543                                 break;
1544                 }
1545         }
1546 #endif /* CONFIG_WPS_STRICT */
1547
1548         if (!sta || !(sta->flags & WLAN_STA_WPS)) {
1549                 wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found");
1550                 return 0;
1551         }
1552
1553         if (!sta->eapol_sm) {
1554                 /*
1555                  * This can happen, e.g., if an ER sends an extra message after
1556                  * the station has disassociated (but not fully
1557                  * deauthenticated).
1558                  */
1559                 wpa_printf(MSG_DEBUG, "WPS UPnP: Matching STA did not have EAPOL state machine initialized");
1560                 return 0;
1561         }
1562
1563         p = os_zalloc(sizeof(*p));
1564         if (p == NULL)
1565                 return -1;
1566         os_memcpy(p->addr, sta->addr, ETH_ALEN);
1567         p->msg = wpabuf_dup(msg);
1568         p->type = msg_type;
1569         p->next = hapd->wps->upnp_msgs;
1570         hapd->wps->upnp_msgs = p;
1571
1572         return eapol_auth_eap_pending_cb(sta->eapol_sm, sta->eapol_sm->eap);
1573 }
1574
1575
1576 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
1577                                  struct wps_context *wps)
1578 {
1579         struct upnp_wps_device_ctx *ctx;
1580
1581         if (!hapd->conf->upnp_iface)
1582                 return 0;
1583         ctx = os_zalloc(sizeof(*ctx));
1584         if (ctx == NULL)
1585                 return -1;
1586
1587         ctx->rx_req_put_wlan_response = hostapd_rx_req_put_wlan_response;
1588         if (hapd->conf->ap_pin)
1589                 ctx->ap_pin = os_strdup(hapd->conf->ap_pin);
1590
1591         hapd->wps_upnp = upnp_wps_device_init(ctx, wps, hapd,
1592                                               hapd->conf->upnp_iface);
1593         if (hapd->wps_upnp == NULL)
1594                 return -1;
1595         wps->wps_upnp = hapd->wps_upnp;
1596
1597         return 0;
1598 }
1599
1600
1601 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd)
1602 {
1603         upnp_wps_device_deinit(hapd->wps_upnp, hapd);
1604 }
1605
1606 #endif /* CONFIG_WPS_UPNP */
1607
1608
1609 int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr,
1610                             char *buf, size_t buflen)
1611 {
1612         if (hapd->wps == NULL)
1613                 return 0;
1614         return wps_registrar_get_info(hapd->wps->registrar, addr, buf, buflen);
1615 }
1616
1617
1618 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx)
1619 {
1620         struct hostapd_data *hapd = eloop_data;
1621         wpa_printf(MSG_DEBUG, "WPS: AP PIN timed out");
1622         hostapd_wps_ap_pin_disable(hapd);
1623         wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_PIN_DISABLED);
1624 }
1625
1626
1627 static void hostapd_wps_ap_pin_enable(struct hostapd_data *hapd, int timeout)
1628 {
1629         wpa_printf(MSG_DEBUG, "WPS: Enabling AP PIN (timeout=%d)", timeout);
1630         hapd->ap_pin_failures = 0;
1631         hapd->ap_pin_failures_consecutive = 0;
1632         hapd->conf->ap_setup_locked = 0;
1633         if (hapd->wps->ap_setup_locked) {
1634                 wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
1635                 hapd->wps->ap_setup_locked = 0;
1636                 wps_registrar_update_ie(hapd->wps->registrar);
1637         }
1638         eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1639         if (timeout > 0)
1640                 eloop_register_timeout(timeout, 0,
1641                                        hostapd_wps_ap_pin_timeout, hapd, NULL);
1642 }
1643
1644
1645 static int wps_ap_pin_disable(struct hostapd_data *hapd, void *ctx)
1646 {
1647         os_free(hapd->conf->ap_pin);
1648         hapd->conf->ap_pin = NULL;
1649 #ifdef CONFIG_WPS_UPNP
1650         upnp_wps_set_ap_pin(hapd->wps_upnp, NULL);
1651 #endif /* CONFIG_WPS_UPNP */
1652         eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1653         return 0;
1654 }
1655
1656
1657 void hostapd_wps_ap_pin_disable(struct hostapd_data *hapd)
1658 {
1659         wpa_printf(MSG_DEBUG, "WPS: Disabling AP PIN");
1660         hostapd_wps_for_each(hapd, wps_ap_pin_disable, NULL);
1661 }
1662
1663
1664 struct wps_ap_pin_data {
1665         char pin_txt[9];
1666         int timeout;
1667 };
1668
1669
1670 static int wps_ap_pin_set(struct hostapd_data *hapd, void *ctx)
1671 {
1672         struct wps_ap_pin_data *data = ctx;
1673
1674         if (!hapd->wps)
1675                 return 0;
1676
1677         os_free(hapd->conf->ap_pin);
1678         hapd->conf->ap_pin = os_strdup(data->pin_txt);
1679 #ifdef CONFIG_WPS_UPNP
1680         upnp_wps_set_ap_pin(hapd->wps_upnp, data->pin_txt);
1681 #endif /* CONFIG_WPS_UPNP */
1682         hostapd_wps_ap_pin_enable(hapd, data->timeout);
1683         return 0;
1684 }
1685
1686
1687 const char * hostapd_wps_ap_pin_random(struct hostapd_data *hapd, int timeout)
1688 {
1689         unsigned int pin;
1690         struct wps_ap_pin_data data;
1691
1692         if (wps_generate_pin(&pin) < 0)
1693                 return NULL;
1694         os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%08u", pin);
1695         data.timeout = timeout;
1696         hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1697         return hapd->conf->ap_pin;
1698 }
1699
1700
1701 const char * hostapd_wps_ap_pin_get(struct hostapd_data *hapd)
1702 {
1703         return hapd->conf->ap_pin;
1704 }
1705
1706
1707 int hostapd_wps_ap_pin_set(struct hostapd_data *hapd, const char *pin,
1708                            int timeout)
1709 {
1710         struct wps_ap_pin_data data;
1711         int ret;
1712
1713         ret = os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%s", pin);
1714         if (os_snprintf_error(sizeof(data.pin_txt), ret))
1715                 return -1;
1716         data.timeout = timeout;
1717         return hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1718 }
1719
1720
1721 static int wps_update_ie(struct hostapd_data *hapd, void *ctx)
1722 {
1723         if (hapd->wps)
1724                 wps_registrar_update_ie(hapd->wps->registrar);
1725         return 0;
1726 }
1727
1728
1729 void hostapd_wps_update_ie(struct hostapd_data *hapd)
1730 {
1731         hostapd_wps_for_each(hapd, wps_update_ie, NULL);
1732 }
1733
1734
1735 int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid,
1736                           const char *auth, const char *encr, const char *key)
1737 {
1738         struct wps_credential cred;
1739         size_t len;
1740
1741         os_memset(&cred, 0, sizeof(cred));
1742
1743         len = os_strlen(ssid);
1744         if ((len & 1) || len > 2 * sizeof(cred.ssid) ||
1745             hexstr2bin(ssid, cred.ssid, len / 2))
1746                 return -1;
1747         cred.ssid_len = len / 2;
1748
1749         if (os_strncmp(auth, "OPEN", 4) == 0)
1750                 cred.auth_type = WPS_AUTH_OPEN;
1751         else if (os_strncmp(auth, "WPAPSK", 6) == 0)
1752                 cred.auth_type = WPS_AUTH_WPAPSK;
1753         else if (os_strncmp(auth, "WPA2PSK", 7) == 0)
1754                 cred.auth_type = WPS_AUTH_WPA2PSK;
1755         else
1756                 return -1;
1757
1758         if (encr) {
1759                 if (os_strncmp(encr, "NONE", 4) == 0)
1760                         cred.encr_type = WPS_ENCR_NONE;
1761                 else if (os_strncmp(encr, "TKIP", 4) == 0)
1762                         cred.encr_type = WPS_ENCR_TKIP;
1763                 else if (os_strncmp(encr, "CCMP", 4) == 0)
1764                         cred.encr_type = WPS_ENCR_AES;
1765                 else
1766                         return -1;
1767         } else
1768                 cred.encr_type = WPS_ENCR_NONE;
1769
1770         if (key) {
1771                 len = os_strlen(key);
1772                 if ((len & 1) || len > 2 * sizeof(cred.key) ||
1773                     hexstr2bin(key, cred.key, len / 2))
1774                         return -1;
1775                 cred.key_len = len / 2;
1776         }
1777
1778         return wps_registrar_config_ap(hapd->wps->registrar, &cred);
1779 }
1780
1781
1782 #ifdef CONFIG_WPS_NFC
1783
1784 struct wps_nfc_password_token_data {
1785         const u8 *oob_dev_pw;
1786         size_t oob_dev_pw_len;
1787         int added;
1788 };
1789
1790
1791 static int wps_add_nfc_password_token(struct hostapd_data *hapd, void *ctx)
1792 {
1793         struct wps_nfc_password_token_data *data = ctx;
1794         int ret;
1795
1796         if (hapd->wps == NULL)
1797                 return 0;
1798         ret = wps_registrar_add_nfc_password_token(hapd->wps->registrar,
1799                                                    data->oob_dev_pw,
1800                                                    data->oob_dev_pw_len);
1801         if (ret == 0)
1802                 data->added++;
1803         return ret;
1804 }
1805
1806
1807 static int hostapd_wps_add_nfc_password_token(struct hostapd_data *hapd,
1808                                               struct wps_parse_attr *attr)
1809 {
1810         struct wps_nfc_password_token_data data;
1811
1812         data.oob_dev_pw = attr->oob_dev_password;
1813         data.oob_dev_pw_len = attr->oob_dev_password_len;
1814         data.added = 0;
1815         if (hostapd_wps_for_each(hapd, wps_add_nfc_password_token, &data) < 0)
1816                 return -1;
1817         return data.added ? 0 : -1;
1818 }
1819
1820
1821 static int hostapd_wps_nfc_tag_process(struct hostapd_data *hapd,
1822                                        const struct wpabuf *wps)
1823 {
1824         struct wps_parse_attr attr;
1825
1826         wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps);
1827
1828         if (wps_parse_msg(wps, &attr)) {
1829                 wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag");
1830                 return -1;
1831         }
1832
1833         if (attr.oob_dev_password)
1834                 return hostapd_wps_add_nfc_password_token(hapd, &attr);
1835
1836         wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag");
1837         return -1;
1838 }
1839
1840
1841 int hostapd_wps_nfc_tag_read(struct hostapd_data *hapd,
1842                              const struct wpabuf *data)
1843 {
1844         const struct wpabuf *wps = data;
1845         struct wpabuf *tmp = NULL;
1846         int ret;
1847
1848         if (wpabuf_len(data) < 4)
1849                 return -1;
1850
1851         if (*wpabuf_head_u8(data) != 0x10) {
1852                 /* Assume this contains full NDEF record */
1853                 tmp = ndef_parse_wifi(data);
1854                 if (tmp == NULL) {
1855                         wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF");
1856                         return -1;
1857                 }
1858                 wps = tmp;
1859         }
1860
1861         ret = hostapd_wps_nfc_tag_process(hapd, wps);
1862         wpabuf_free(tmp);
1863         return ret;
1864 }
1865
1866
1867 struct wpabuf * hostapd_wps_nfc_config_token(struct hostapd_data *hapd,
1868                                              int ndef)
1869 {
1870         struct wpabuf *ret;
1871
1872         if (hapd->wps == NULL)
1873                 return NULL;
1874
1875         ret = wps_get_oob_cred(hapd->wps, hostapd_wps_rf_band_cb(hapd),
1876                                hapd->iconf->channel);
1877         if (ndef && ret) {
1878                 struct wpabuf *tmp;
1879                 tmp = ndef_build_wifi(ret);
1880                 wpabuf_free(ret);
1881                 if (tmp == NULL)
1882                         return NULL;
1883                 ret = tmp;
1884         }
1885
1886         return ret;
1887 }
1888
1889
1890 struct wpabuf * hostapd_wps_nfc_hs_cr(struct hostapd_data *hapd, int ndef)
1891 {
1892         struct wpabuf *ret;
1893
1894         if (hapd->wps == NULL)
1895                 return NULL;
1896
1897         if (hapd->conf->wps_nfc_dh_pubkey == NULL) {
1898                 struct wps_context *wps = hapd->wps;
1899                 if (wps_nfc_gen_dh(&hapd->conf->wps_nfc_dh_pubkey,
1900                                    &hapd->conf->wps_nfc_dh_privkey) < 0)
1901                         return NULL;
1902                 hostapd_wps_nfc_clear(wps);
1903                 wps->ap_nfc_dev_pw_id = DEV_PW_NFC_CONNECTION_HANDOVER;
1904                 wps->ap_nfc_dh_pubkey =
1905                         wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
1906                 wps->ap_nfc_dh_privkey =
1907                         wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
1908                 if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey) {
1909                         hostapd_wps_nfc_clear(wps);
1910                         return NULL;
1911                 }
1912         }
1913
1914         ret = wps_build_nfc_handover_sel(hapd->wps,
1915                                          hapd->conf->wps_nfc_dh_pubkey,
1916                                          hapd->own_addr, hapd->iface->freq);
1917
1918         if (ndef && ret) {
1919                 struct wpabuf *tmp;
1920                 tmp = ndef_build_wifi(ret);
1921                 wpabuf_free(ret);
1922                 if (tmp == NULL)
1923                         return NULL;
1924                 ret = tmp;
1925         }
1926
1927         return ret;
1928 }
1929
1930
1931 int hostapd_wps_nfc_report_handover(struct hostapd_data *hapd,
1932                                     const struct wpabuf *req,
1933                                     const struct wpabuf *sel)
1934 {
1935         struct wpabuf *wps;
1936         int ret = -1;
1937         u16 wsc_len;
1938         const u8 *pos;
1939         struct wpabuf msg;
1940         struct wps_parse_attr attr;
1941         u16 dev_pw_id;
1942
1943         /*
1944          * Enrollee/station is always initiator of the NFC connection handover,
1945          * so use the request message here to find Enrollee public key hash.
1946          */
1947         wps = ndef_parse_wifi(req);
1948         if (wps == NULL)
1949                 return -1;
1950         wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
1951                    "payload from NFC connection handover");
1952         wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps);
1953         if (wpabuf_len(wps) < 2) {
1954                 wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Request "
1955                            "Message");
1956                 goto out;
1957         }
1958         pos = wpabuf_head(wps);
1959         wsc_len = WPA_GET_BE16(pos);
1960         if (wsc_len > wpabuf_len(wps) - 2) {
1961                 wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) "
1962                            "in rt Wi-Fi Handover Request Message", wsc_len);
1963                 goto out;
1964         }
1965         pos += 2;
1966
1967         wpa_hexdump(MSG_DEBUG,
1968                     "WPS: WSC attributes in Wi-Fi Handover Request Message",
1969                     pos, wsc_len);
1970         if (wsc_len < wpabuf_len(wps) - 2) {
1971                 wpa_hexdump(MSG_DEBUG,
1972                             "WPS: Ignore extra data after WSC attributes",
1973                             pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len);
1974         }
1975
1976         wpabuf_set(&msg, pos, wsc_len);
1977         ret = wps_parse_msg(&msg, &attr);
1978         if (ret < 0) {
1979                 wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in "
1980                            "Wi-Fi Handover Request Message");
1981                 goto out;
1982         }
1983
1984         if (attr.oob_dev_password == NULL ||
1985             attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) {
1986                 wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password "
1987                            "included in Wi-Fi Handover Request Message");
1988                 ret = -1;
1989                 goto out;
1990         }
1991
1992         if (attr.uuid_e == NULL) {
1993                 wpa_printf(MSG_DEBUG, "WPS: No UUID-E included in Wi-Fi "
1994                            "Handover Request Message");
1995                 ret = -1;
1996                 goto out;
1997         }
1998
1999         wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", attr.uuid_e, WPS_UUID_LEN);
2000
2001         wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password",
2002                     attr.oob_dev_password, attr.oob_dev_password_len);
2003         dev_pw_id = WPA_GET_BE16(attr.oob_dev_password +
2004                                  WPS_OOB_PUBKEY_HASH_LEN);
2005         if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) {
2006                 wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID "
2007                            "%u in Wi-Fi Handover Request Message", dev_pw_id);
2008                 ret = -1;
2009                 goto out;
2010         }
2011         wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Public Key hash",
2012                     attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN);
2013
2014         ret = wps_registrar_add_nfc_pw_token(hapd->wps->registrar,
2015                                              attr.oob_dev_password,
2016                                              DEV_PW_NFC_CONNECTION_HANDOVER,
2017                                              NULL, 0, 1);
2018
2019 out:
2020         wpabuf_free(wps);
2021         return ret;
2022 }
2023
2024
2025 struct wpabuf * hostapd_wps_nfc_token_gen(struct hostapd_data *hapd, int ndef)
2026 {
2027         if (hapd->conf->wps_nfc_pw_from_config) {
2028                 return wps_nfc_token_build(ndef,
2029                                            hapd->conf->wps_nfc_dev_pw_id,
2030                                            hapd->conf->wps_nfc_dh_pubkey,
2031                                            hapd->conf->wps_nfc_dev_pw);
2032         }
2033
2034         return wps_nfc_token_gen(ndef, &hapd->conf->wps_nfc_dev_pw_id,
2035                                  &hapd->conf->wps_nfc_dh_pubkey,
2036                                  &hapd->conf->wps_nfc_dh_privkey,
2037                                  &hapd->conf->wps_nfc_dev_pw);
2038 }
2039
2040
2041 int hostapd_wps_nfc_token_enable(struct hostapd_data *hapd)
2042 {
2043         struct wps_context *wps = hapd->wps;
2044         struct wpabuf *pw;
2045
2046         if (wps == NULL)
2047                 return -1;
2048
2049         if (!hapd->conf->wps_nfc_dh_pubkey ||
2050             !hapd->conf->wps_nfc_dh_privkey ||
2051             !hapd->conf->wps_nfc_dev_pw ||
2052             !hapd->conf->wps_nfc_dev_pw_id)
2053                 return -1;
2054
2055         hostapd_wps_nfc_clear(wps);
2056         wpa_printf(MSG_DEBUG,
2057                    "WPS: Enable NFC Tag (Dev Pw Id %u) for AP interface %s (context %p)",
2058                    hapd->conf->wps_nfc_dev_pw_id, hapd->conf->iface, wps);
2059         wps->ap_nfc_dev_pw_id = hapd->conf->wps_nfc_dev_pw_id;
2060         wps->ap_nfc_dh_pubkey = wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
2061         wps->ap_nfc_dh_privkey = wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
2062         pw = hapd->conf->wps_nfc_dev_pw;
2063         wps->ap_nfc_dev_pw = wpabuf_alloc(
2064                 wpabuf_len(pw) * 2 + 1);
2065         if (wps->ap_nfc_dev_pw) {
2066                 wpa_snprintf_hex_uppercase(
2067                         (char *) wpabuf_put(wps->ap_nfc_dev_pw,
2068                                             wpabuf_len(pw) * 2),
2069                         wpabuf_len(pw) * 2 + 1,
2070                         wpabuf_head(pw), wpabuf_len(pw));
2071         }
2072
2073         if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey ||
2074             !wps->ap_nfc_dev_pw) {
2075                 hostapd_wps_nfc_clear(wps);
2076                 return -1;
2077         }
2078
2079         return 0;
2080 }
2081
2082
2083 void hostapd_wps_nfc_token_disable(struct hostapd_data *hapd)
2084 {
2085         wpa_printf(MSG_DEBUG, "WPS: Disable NFC token for AP interface %s",
2086                    hapd->conf->iface);
2087         hostapd_wps_nfc_clear(hapd->wps);
2088 }
2089
2090 #endif /* CONFIG_WPS_NFC */