wps.c revision 04949598a23f501be6eec21697465fd46a28840a
1/* 2 * Wi-Fi Protected Setup 3 * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "crypto/dh_group5.h" 13#include "common/ieee802_11_defs.h" 14#include "wps_i.h" 15#include "wps_dev_attr.h" 16 17 18#ifdef CONFIG_WPS_TESTING 19int wps_version_number = 0x20; 20int wps_testing_dummy_cred = 0; 21#endif /* CONFIG_WPS_TESTING */ 22 23 24/** 25 * wps_init - Initialize WPS Registration protocol data 26 * @cfg: WPS configuration 27 * Returns: Pointer to allocated data or %NULL on failure 28 * 29 * This function is used to initialize WPS data for a registration protocol 30 * instance (i.e., each run of registration protocol as a Registrar of 31 * Enrollee. The caller is responsible for freeing this data after the 32 * registration run has been completed by calling wps_deinit(). 33 */ 34struct wps_data * wps_init(const struct wps_config *cfg) 35{ 36 struct wps_data *data = os_zalloc(sizeof(*data)); 37 if (data == NULL) 38 return NULL; 39 data->wps = cfg->wps; 40 data->registrar = cfg->registrar; 41 if (cfg->registrar) { 42 os_memcpy(data->uuid_r, cfg->wps->uuid, WPS_UUID_LEN); 43 } else { 44 os_memcpy(data->mac_addr_e, cfg->wps->dev.mac_addr, ETH_ALEN); 45 os_memcpy(data->uuid_e, cfg->wps->uuid, WPS_UUID_LEN); 46 } 47 if (cfg->pin) { 48 data->dev_pw_id = data->wps->oob_dev_pw_id == 0 ? 49 cfg->dev_pw_id : data->wps->oob_dev_pw_id; 50 data->dev_password = os_malloc(cfg->pin_len); 51 if (data->dev_password == NULL) { 52 os_free(data); 53 return NULL; 54 } 55 os_memcpy(data->dev_password, cfg->pin, cfg->pin_len); 56 data->dev_password_len = cfg->pin_len; 57 } 58 59#ifdef CONFIG_WPS_NFC 60 if (cfg->wps->ap && !cfg->registrar && cfg->wps->ap_nfc_dev_pw_id) { 61 data->dev_pw_id = cfg->wps->ap_nfc_dev_pw_id; 62 os_free(data->dev_password); 63 data->dev_password = 64 os_malloc(wpabuf_len(cfg->wps->ap_nfc_dev_pw)); 65 if (data->dev_password == NULL) { 66 os_free(data); 67 return NULL; 68 } 69 os_memcpy(data->dev_password, 70 wpabuf_head(cfg->wps->ap_nfc_dev_pw), 71 wpabuf_len(cfg->wps->ap_nfc_dev_pw)); 72 data->dev_password_len = wpabuf_len(cfg->wps->ap_nfc_dev_pw); 73 } 74#endif /* CONFIG_WPS_NFC */ 75 76 data->pbc = cfg->pbc; 77 if (cfg->pbc) { 78 /* Use special PIN '00000000' for PBC */ 79 data->dev_pw_id = DEV_PW_PUSHBUTTON; 80 os_free(data->dev_password); 81 data->dev_password = (u8 *) os_strdup("00000000"); 82 if (data->dev_password == NULL) { 83 os_free(data); 84 return NULL; 85 } 86 data->dev_password_len = 8; 87 } 88 89 data->state = data->registrar ? RECV_M1 : SEND_M1; 90 91 if (cfg->assoc_wps_ie) { 92 struct wps_parse_attr attr; 93 wpa_hexdump_buf(MSG_DEBUG, "WPS: WPS IE from (Re)AssocReq", 94 cfg->assoc_wps_ie); 95 if (wps_parse_msg(cfg->assoc_wps_ie, &attr) < 0) { 96 wpa_printf(MSG_DEBUG, "WPS: Failed to parse WPS IE " 97 "from (Re)AssocReq"); 98 } else if (attr.request_type == NULL) { 99 wpa_printf(MSG_DEBUG, "WPS: No Request Type attribute " 100 "in (Re)AssocReq WPS IE"); 101 } else { 102 wpa_printf(MSG_DEBUG, "WPS: Request Type (from WPS IE " 103 "in (Re)AssocReq WPS IE): %d", 104 *attr.request_type); 105 data->request_type = *attr.request_type; 106 } 107 } 108 109 if (cfg->new_ap_settings) { 110 data->new_ap_settings = 111 os_malloc(sizeof(*data->new_ap_settings)); 112 if (data->new_ap_settings == NULL) { 113 os_free(data); 114 return NULL; 115 } 116 os_memcpy(data->new_ap_settings, cfg->new_ap_settings, 117 sizeof(*data->new_ap_settings)); 118 } 119 120 if (cfg->peer_addr) 121 os_memcpy(data->peer_dev.mac_addr, cfg->peer_addr, ETH_ALEN); 122 if (cfg->p2p_dev_addr) 123 os_memcpy(data->p2p_dev_addr, cfg->p2p_dev_addr, ETH_ALEN); 124 125 data->use_psk_key = cfg->use_psk_key; 126 data->pbc_in_m1 = cfg->pbc_in_m1; 127 128 return data; 129} 130 131 132/** 133 * wps_deinit - Deinitialize WPS Registration protocol data 134 * @data: WPS Registration protocol data from wps_init() 135 */ 136void wps_deinit(struct wps_data *data) 137{ 138#ifdef CONFIG_WPS_NFC 139 if (data->registrar && data->nfc_pw_token) 140 wps_registrar_remove_nfc_pw_token(data->wps->registrar, 141 data->nfc_pw_token); 142#endif /* CONFIG_WPS_NFC */ 143 144 if (data->wps_pin_revealed) { 145 wpa_printf(MSG_DEBUG, "WPS: Full PIN information revealed and " 146 "negotiation failed"); 147 if (data->registrar) 148 wps_registrar_invalidate_pin(data->wps->registrar, 149 data->uuid_e); 150 } else if (data->registrar) 151 wps_registrar_unlock_pin(data->wps->registrar, data->uuid_e); 152 153 wpabuf_free(data->dh_privkey); 154 wpabuf_free(data->dh_pubkey_e); 155 wpabuf_free(data->dh_pubkey_r); 156 wpabuf_free(data->last_msg); 157 os_free(data->dev_password); 158 os_free(data->new_psk); 159 wps_device_data_free(&data->peer_dev); 160 os_free(data->new_ap_settings); 161 dh5_free(data->dh_ctx); 162 os_free(data->nfc_pw_token); 163 os_free(data); 164} 165 166 167/** 168 * wps_process_msg - Process a WPS message 169 * @wps: WPS Registration protocol data from wps_init() 170 * @op_code: Message OP Code 171 * @msg: Message data 172 * Returns: Processing result 173 * 174 * This function is used to process WPS messages with OP Codes WSC_ACK, 175 * WSC_NACK, WSC_MSG, and WSC_Done. The caller (e.g., EAP server/peer) is 176 * responsible for reassembling the messages before calling this function. 177 * Response to this message is built by calling wps_get_msg(). 178 */ 179enum wps_process_res wps_process_msg(struct wps_data *wps, 180 enum wsc_op_code op_code, 181 const struct wpabuf *msg) 182{ 183 if (wps->registrar) 184 return wps_registrar_process_msg(wps, op_code, msg); 185 else 186 return wps_enrollee_process_msg(wps, op_code, msg); 187} 188 189 190/** 191 * wps_get_msg - Build a WPS message 192 * @wps: WPS Registration protocol data from wps_init() 193 * @op_code: Buffer for returning message OP Code 194 * Returns: The generated WPS message or %NULL on failure 195 * 196 * This function is used to build a response to a message processed by calling 197 * wps_process_msg(). The caller is responsible for freeing the buffer. 198 */ 199struct wpabuf * wps_get_msg(struct wps_data *wps, enum wsc_op_code *op_code) 200{ 201 if (wps->registrar) 202 return wps_registrar_get_msg(wps, op_code); 203 else 204 return wps_enrollee_get_msg(wps, op_code); 205} 206 207 208/** 209 * wps_is_selected_pbc_registrar - Check whether WPS IE indicates active PBC 210 * @msg: WPS IE contents from Beacon or Probe Response frame 211 * Returns: 1 if PBC Registrar is active, 0 if not 212 */ 213int wps_is_selected_pbc_registrar(const struct wpabuf *msg) 214{ 215 struct wps_parse_attr attr; 216 217 /* 218 * In theory, this could also verify that attr.sel_reg_config_methods 219 * includes WPS_CONFIG_PUSHBUTTON, but some deployed AP implementations 220 * do not set Selected Registrar Config Methods attribute properly, so 221 * it is safer to just use Device Password ID here. 222 */ 223 224 if (wps_parse_msg(msg, &attr) < 0 || 225 !attr.selected_registrar || *attr.selected_registrar == 0 || 226 !attr.dev_password_id || 227 WPA_GET_BE16(attr.dev_password_id) != DEV_PW_PUSHBUTTON) 228 return 0; 229 230#ifdef CONFIG_WPS_STRICT 231 if (!attr.sel_reg_config_methods || 232 !(WPA_GET_BE16(attr.sel_reg_config_methods) & 233 WPS_CONFIG_PUSHBUTTON)) 234 return 0; 235#endif /* CONFIG_WPS_STRICT */ 236 237 return 1; 238} 239 240 241static int is_selected_pin_registrar(struct wps_parse_attr *attr) 242{ 243 /* 244 * In theory, this could also verify that attr.sel_reg_config_methods 245 * includes WPS_CONFIG_LABEL, WPS_CONFIG_DISPLAY, or WPS_CONFIG_KEYPAD, 246 * but some deployed AP implementations do not set Selected Registrar 247 * Config Methods attribute properly, so it is safer to just use 248 * Device Password ID here. 249 */ 250 251 if (!attr->selected_registrar || *attr->selected_registrar == 0) 252 return 0; 253 254 if (attr->dev_password_id != NULL && 255 WPA_GET_BE16(attr->dev_password_id) == DEV_PW_PUSHBUTTON) 256 return 0; 257 258#ifdef CONFIG_WPS_STRICT 259 if (!attr->sel_reg_config_methods || 260 !(WPA_GET_BE16(attr->sel_reg_config_methods) & 261 (WPS_CONFIG_LABEL | WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD))) 262 return 0; 263#endif /* CONFIG_WPS_STRICT */ 264 265 return 1; 266} 267 268 269/** 270 * wps_is_selected_pin_registrar - Check whether WPS IE indicates active PIN 271 * @msg: WPS IE contents from Beacon or Probe Response frame 272 * Returns: 1 if PIN Registrar is active, 0 if not 273 */ 274int wps_is_selected_pin_registrar(const struct wpabuf *msg) 275{ 276 struct wps_parse_attr attr; 277 278 if (wps_parse_msg(msg, &attr) < 0) 279 return 0; 280 281 return is_selected_pin_registrar(&attr); 282} 283 284 285/** 286 * wps_is_addr_authorized - Check whether WPS IE authorizes MAC address 287 * @msg: WPS IE contents from Beacon or Probe Response frame 288 * @addr: MAC address to search for 289 * @ver1_compat: Whether to use version 1 compatibility mode 290 * Returns: 1 if address is authorized, 0 if not 291 */ 292int wps_is_addr_authorized(const struct wpabuf *msg, const u8 *addr, 293 int ver1_compat) 294{ 295 struct wps_parse_attr attr; 296 unsigned int i; 297 const u8 *pos; 298 const u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 299 300 if (wps_parse_msg(msg, &attr) < 0) 301 return 0; 302 303 if (!attr.version2 && ver1_compat) { 304 /* 305 * Version 1.0 AP - AuthorizedMACs not used, so revert back to 306 * old mechanism of using SelectedRegistrar. 307 */ 308 return is_selected_pin_registrar(&attr); 309 } 310 311 if (!attr.authorized_macs) 312 return 0; 313 314 pos = attr.authorized_macs; 315 for (i = 0; i < attr.authorized_macs_len / ETH_ALEN; i++) { 316 if (os_memcmp(pos, addr, ETH_ALEN) == 0 || 317 os_memcmp(pos, bcast, ETH_ALEN) == 0) 318 return 1; 319 pos += ETH_ALEN; 320 } 321 322 return 0; 323} 324 325 326/** 327 * wps_ap_priority_compar - Prioritize WPS IE from two APs 328 * @wps_a: WPS IE contents from Beacon or Probe Response frame 329 * @wps_b: WPS IE contents from Beacon or Probe Response frame 330 * Returns: 1 if wps_b is considered more likely selection for WPS 331 * provisioning, -1 if wps_a is considered more like, or 0 if no preference 332 */ 333int wps_ap_priority_compar(const struct wpabuf *wps_a, 334 const struct wpabuf *wps_b) 335{ 336 struct wps_parse_attr attr_a, attr_b; 337 int sel_a, sel_b; 338 339 if (wps_a == NULL || wps_parse_msg(wps_a, &attr_a) < 0) 340 return 1; 341 if (wps_b == NULL || wps_parse_msg(wps_b, &attr_b) < 0) 342 return -1; 343 344 sel_a = attr_a.selected_registrar && *attr_a.selected_registrar != 0; 345 sel_b = attr_b.selected_registrar && *attr_b.selected_registrar != 0; 346 347 if (sel_a && !sel_b) 348 return -1; 349 if (!sel_a && sel_b) 350 return 1; 351 352 return 0; 353} 354 355 356/** 357 * wps_get_uuid_e - Get UUID-E from WPS IE 358 * @msg: WPS IE contents from Beacon or Probe Response frame 359 * Returns: Pointer to UUID-E or %NULL if not included 360 * 361 * The returned pointer is to the msg contents and it remains valid only as 362 * long as the msg buffer is valid. 363 */ 364const u8 * wps_get_uuid_e(const struct wpabuf *msg) 365{ 366 struct wps_parse_attr attr; 367 368 if (wps_parse_msg(msg, &attr) < 0) 369 return NULL; 370 return attr.uuid_e; 371} 372 373 374/** 375 * wps_is_20 - Check whether WPS attributes claim support for WPS 2.0 376 */ 377int wps_is_20(const struct wpabuf *msg) 378{ 379 struct wps_parse_attr attr; 380 381 if (msg == NULL || wps_parse_msg(msg, &attr) < 0) 382 return 0; 383 return attr.version2 != NULL; 384} 385 386 387/** 388 * wps_build_assoc_req_ie - Build WPS IE for (Re)Association Request 389 * @req_type: Value for Request Type attribute 390 * Returns: WPS IE or %NULL on failure 391 * 392 * The caller is responsible for freeing the buffer. 393 */ 394struct wpabuf * wps_build_assoc_req_ie(enum wps_request_type req_type) 395{ 396 struct wpabuf *ie; 397 u8 *len; 398 399 wpa_printf(MSG_DEBUG, "WPS: Building WPS IE for (Re)Association " 400 "Request"); 401 ie = wpabuf_alloc(100); 402 if (ie == NULL) 403 return NULL; 404 405 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC); 406 len = wpabuf_put(ie, 1); 407 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA); 408 409 if (wps_build_version(ie) || 410 wps_build_req_type(ie, req_type) || 411 wps_build_wfa_ext(ie, 0, NULL, 0)) { 412 wpabuf_free(ie); 413 return NULL; 414 } 415 416 *len = wpabuf_len(ie) - 2; 417 418 return ie; 419} 420 421 422/** 423 * wps_build_assoc_resp_ie - Build WPS IE for (Re)Association Response 424 * Returns: WPS IE or %NULL on failure 425 * 426 * The caller is responsible for freeing the buffer. 427 */ 428struct wpabuf * wps_build_assoc_resp_ie(void) 429{ 430 struct wpabuf *ie; 431 u8 *len; 432 433 wpa_printf(MSG_DEBUG, "WPS: Building WPS IE for (Re)Association " 434 "Response"); 435 ie = wpabuf_alloc(100); 436 if (ie == NULL) 437 return NULL; 438 439 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC); 440 len = wpabuf_put(ie, 1); 441 wpabuf_put_be32(ie, WPS_DEV_OUI_WFA); 442 443 if (wps_build_version(ie) || 444 wps_build_resp_type(ie, WPS_RESP_AP) || 445 wps_build_wfa_ext(ie, 0, NULL, 0)) { 446 wpabuf_free(ie); 447 return NULL; 448 } 449 450 *len = wpabuf_len(ie) - 2; 451 452 return ie; 453} 454 455 456/** 457 * wps_build_probe_req_ie - Build WPS IE for Probe Request 458 * @pw_id: Password ID (DEV_PW_PUSHBUTTON for active PBC and DEV_PW_DEFAULT for 459 * most other use cases) 460 * @dev: Device attributes 461 * @uuid: Own UUID 462 * @req_type: Value for Request Type attribute 463 * @num_req_dev_types: Number of requested device types 464 * @req_dev_types: Requested device types (8 * num_req_dev_types octets) or 465 * %NULL if none 466 * Returns: WPS IE or %NULL on failure 467 * 468 * The caller is responsible for freeing the buffer. 469 */ 470struct wpabuf * wps_build_probe_req_ie(u16 pw_id, struct wps_device_data *dev, 471 const u8 *uuid, 472 enum wps_request_type req_type, 473 unsigned int num_req_dev_types, 474 const u8 *req_dev_types) 475{ 476 struct wpabuf *ie; 477 478 wpa_printf(MSG_DEBUG, "WPS: Building WPS IE for Probe Request"); 479 480 ie = wpabuf_alloc(500); 481 if (ie == NULL) 482 return NULL; 483 484 if (wps_build_version(ie) || 485 wps_build_req_type(ie, req_type) || 486 wps_build_config_methods(ie, dev->config_methods) || 487 wps_build_uuid_e(ie, uuid) || 488 wps_build_primary_dev_type(dev, ie) || 489 wps_build_rf_bands(dev, ie) || 490 wps_build_assoc_state(NULL, ie) || 491 wps_build_config_error(ie, WPS_CFG_NO_ERROR) || 492 wps_build_dev_password_id(ie, pw_id) || 493#ifdef CONFIG_WPS2 494 wps_build_manufacturer(dev, ie) || 495 wps_build_model_name(dev, ie) || 496 wps_build_model_number(dev, ie) || 497 wps_build_dev_name(dev, ie) || 498 wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0) || 499#endif /* CONFIG_WPS2 */ 500 wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types) 501 || 502 wps_build_secondary_dev_type(dev, ie) 503 ) { 504 wpabuf_free(ie); 505 return NULL; 506 } 507 508#ifndef CONFIG_WPS2 509 if (dev->p2p && wps_build_dev_name(dev, ie)) { 510 wpabuf_free(ie); 511 return NULL; 512 } 513#endif /* CONFIG_WPS2 */ 514 515 return wps_ie_encapsulate(ie); 516} 517 518 519void wps_free_pending_msgs(struct upnp_pending_message *msgs) 520{ 521 struct upnp_pending_message *p, *prev; 522 p = msgs; 523 while (p) { 524 prev = p; 525 p = p->next; 526 wpabuf_free(prev->msg); 527 os_free(prev); 528 } 529} 530 531 532int wps_attr_text(struct wpabuf *data, char *buf, char *end) 533{ 534 struct wps_parse_attr attr; 535 char *pos = buf; 536 int ret; 537 538 if (wps_parse_msg(data, &attr) < 0) 539 return -1; 540 541 if (attr.wps_state) { 542 if (*attr.wps_state == WPS_STATE_NOT_CONFIGURED) 543 ret = os_snprintf(pos, end - pos, 544 "wps_state=unconfigured\n"); 545 else if (*attr.wps_state == WPS_STATE_CONFIGURED) 546 ret = os_snprintf(pos, end - pos, 547 "wps_state=configured\n"); 548 else 549 ret = 0; 550 if (ret < 0 || ret >= end - pos) 551 return pos - buf; 552 pos += ret; 553 } 554 555 if (attr.ap_setup_locked && *attr.ap_setup_locked) { 556 ret = os_snprintf(pos, end - pos, 557 "wps_ap_setup_locked=1\n"); 558 if (ret < 0 || ret >= end - pos) 559 return pos - buf; 560 pos += ret; 561 } 562 563 if (attr.selected_registrar && *attr.selected_registrar) { 564 ret = os_snprintf(pos, end - pos, 565 "wps_selected_registrar=1\n"); 566 if (ret < 0 || ret >= end - pos) 567 return pos - buf; 568 pos += ret; 569 } 570 571 if (attr.dev_password_id) { 572 ret = os_snprintf(pos, end - pos, 573 "wps_device_password_id=%u\n", 574 WPA_GET_BE16(attr.dev_password_id)); 575 if (ret < 0 || ret >= end - pos) 576 return pos - buf; 577 pos += ret; 578 } 579 580 if (attr.sel_reg_config_methods) { 581 ret = os_snprintf(pos, end - pos, 582 "wps_selected_registrar_config_methods=" 583 "0x%04x\n", 584 WPA_GET_BE16(attr.sel_reg_config_methods)); 585 if (ret < 0 || ret >= end - pos) 586 return pos - buf; 587 pos += ret; 588 } 589 590 if (attr.primary_dev_type) { 591 char devtype[WPS_DEV_TYPE_BUFSIZE]; 592 ret = os_snprintf(pos, end - pos, 593 "wps_primary_device_type=%s\n", 594 wps_dev_type_bin2str(attr.primary_dev_type, 595 devtype, 596 sizeof(devtype))); 597 if (ret < 0 || ret >= end - pos) 598 return pos - buf; 599 pos += ret; 600 } 601 602 if (attr.dev_name) { 603 char *str = os_malloc(attr.dev_name_len + 1); 604 size_t i; 605 if (str == NULL) 606 return pos - buf; 607 for (i = 0; i < attr.dev_name_len; i++) { 608 if (attr.dev_name[i] < 32) 609 str[i] = '_'; 610 else 611 str[i] = attr.dev_name[i]; 612 } 613 str[i] = '\0'; 614 ret = os_snprintf(pos, end - pos, "wps_device_name=%s\n", str); 615 os_free(str); 616 if (ret < 0 || ret >= end - pos) 617 return pos - buf; 618 pos += ret; 619 } 620 621 if (attr.config_methods) { 622 ret = os_snprintf(pos, end - pos, 623 "wps_config_methods=0x%04x\n", 624 WPA_GET_BE16(attr.config_methods)); 625 if (ret < 0 || ret >= end - pos) 626 return pos - buf; 627 pos += ret; 628 } 629 630 return pos - buf; 631} 632