xref: /freebsd/contrib/wpa/src/ap/wps_hostapd.c (revision cddbc3b40812213ff00041f79174cac0be360a2a)
1 /*
2  * hostapd / WPS integration
3  * Copyright (c) 2008-2016, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "utils/uuid.h"
14 #include "common/wpa_ctrl.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/ieee802_11_common.h"
17 #include "eapol_auth/eapol_auth_sm.h"
18 #include "eapol_auth/eapol_auth_sm_i.h"
19 #include "wps/wps.h"
20 #include "wps/wps_defs.h"
21 #include "wps/wps_dev_attr.h"
22 #include "wps/wps_attr_parse.h"
23 #include "hostapd.h"
24 #include "ap_config.h"
25 #include "ap_drv_ops.h"
26 #include "beacon.h"
27 #include "sta_info.h"
28 #include "wps_hostapd.h"
29 
30 
31 #ifdef CONFIG_WPS_UPNP
32 #include "wps/wps_upnp.h"
33 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
34 				 struct wps_context *wps);
35 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd);
36 #endif /* CONFIG_WPS_UPNP */
37 
38 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
39 				    const u8 *bssid,
40 				    const u8 *ie, size_t ie_len,
41 				    int ssi_signal);
42 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx);
43 static void hostapd_wps_nfc_clear(struct wps_context *wps);
44 
45 
46 struct wps_for_each_data {
47 	int (*func)(struct hostapd_data *h, void *ctx);
48 	void *ctx;
49 	struct hostapd_data *calling_hapd;
50 };
51 
52 
53 static int wps_for_each(struct hostapd_iface *iface, void *ctx)
54 {
55 	struct wps_for_each_data *data = ctx;
56 	size_t j;
57 
58 	if (iface == NULL)
59 		return 0;
60 	for (j = 0; j < iface->num_bss; j++) {
61 		struct hostapd_data *hapd = iface->bss[j];
62 		int ret;
63 
64 		if (hapd != data->calling_hapd &&
65 		    (hapd->conf->wps_independent ||
66 		     data->calling_hapd->conf->wps_independent))
67 			continue;
68 
69 		ret = data->func(hapd, data->ctx);
70 		if (ret)
71 			return ret;
72 	}
73 
74 	return 0;
75 }
76 
77 
78 static int hostapd_wps_for_each(struct hostapd_data *hapd,
79 				int (*func)(struct hostapd_data *h, void *ctx),
80 				void *ctx)
81 {
82 	struct hostapd_iface *iface = hapd->iface;
83 	struct wps_for_each_data data;
84 	data.func = func;
85 	data.ctx = ctx;
86 	data.calling_hapd = hapd;
87 	if (iface->interfaces == NULL ||
88 	    iface->interfaces->for_each_interface == NULL)
89 		return wps_for_each(iface, &data);
90 	return iface->interfaces->for_each_interface(iface->interfaces,
91 						     wps_for_each, &data);
92 }
93 
94 
95 static int hostapd_wps_new_psk_cb(void *ctx, const u8 *mac_addr,
96 				  const u8 *p2p_dev_addr, const u8 *psk,
97 				  size_t psk_len)
98 {
99 	struct hostapd_data *hapd = ctx;
100 	struct hostapd_wpa_psk *p;
101 	struct hostapd_ssid *ssid = &hapd->conf->ssid;
102 
103 	if (is_zero_ether_addr(p2p_dev_addr)) {
104 		wpa_printf(MSG_DEBUG,
105 			   "Received new WPA/WPA2-PSK from WPS for STA " MACSTR,
106 			   MAC2STR(mac_addr));
107 	} else {
108 		wpa_printf(MSG_DEBUG,
109 			   "Received new WPA/WPA2-PSK from WPS for STA " MACSTR
110 			   " P2P Device Addr " MACSTR,
111 			   MAC2STR(mac_addr), MAC2STR(p2p_dev_addr));
112 	}
113 	wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
114 
115 	if (psk_len != PMK_LEN) {
116 		wpa_printf(MSG_DEBUG, "Unexpected PSK length %lu",
117 			   (unsigned long) psk_len);
118 		return -1;
119 	}
120 
121 	/* Add the new PSK to runtime PSK list */
122 	p = os_zalloc(sizeof(*p));
123 	if (p == NULL)
124 		return -1;
125 	os_memcpy(p->addr, mac_addr, ETH_ALEN);
126 	os_memcpy(p->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
127 	os_memcpy(p->psk, psk, PMK_LEN);
128 
129 	if (hapd->new_psk_cb) {
130 		hapd->new_psk_cb(hapd->new_psk_cb_ctx, mac_addr, p2p_dev_addr,
131 				 psk, psk_len);
132 	}
133 
134 	p->next = ssid->wpa_psk;
135 	ssid->wpa_psk = p;
136 
137 	if (ssid->wpa_psk_file) {
138 		FILE *f;
139 		char hex[PMK_LEN * 2 + 1];
140 		/* Add the new PSK to PSK list file */
141 		f = fopen(ssid->wpa_psk_file, "a");
142 		if (f == NULL) {
143 			wpa_printf(MSG_DEBUG, "Failed to add the PSK to "
144 				   "'%s'", ssid->wpa_psk_file);
145 			return -1;
146 		}
147 
148 		wpa_snprintf_hex(hex, sizeof(hex), psk, psk_len);
149 		fprintf(f, MACSTR " %s\n", MAC2STR(mac_addr), hex);
150 		fclose(f);
151 	}
152 
153 	return 0;
154 }
155 
156 
157 static int hostapd_wps_set_ie_cb(void *ctx, struct wpabuf *beacon_ie,
158 				 struct wpabuf *probe_resp_ie)
159 {
160 	struct hostapd_data *hapd = ctx;
161 	wpabuf_free(hapd->wps_beacon_ie);
162 	hapd->wps_beacon_ie = beacon_ie;
163 	wpabuf_free(hapd->wps_probe_resp_ie);
164 	hapd->wps_probe_resp_ie = probe_resp_ie;
165 	if (hapd->beacon_set_done)
166 		ieee802_11_set_beacon(hapd);
167 	return hostapd_set_ap_wps_ie(hapd);
168 }
169 
170 
171 static void hostapd_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
172 				      const struct wps_device_data *dev)
173 {
174 	struct hostapd_data *hapd = ctx;
175 	char uuid[40], txt[400];
176 	int len;
177 	char devtype[WPS_DEV_TYPE_BUFSIZE];
178 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
179 		return;
180 	wpa_printf(MSG_DEBUG, "WPS: PIN needed for E-UUID %s", uuid);
181 	len = os_snprintf(txt, sizeof(txt), WPS_EVENT_PIN_NEEDED
182 			  "%s " MACSTR " [%s|%s|%s|%s|%s|%s]",
183 			  uuid, MAC2STR(dev->mac_addr), dev->device_name,
184 			  dev->manufacturer, dev->model_name,
185 			  dev->model_number, dev->serial_number,
186 			  wps_dev_type_bin2str(dev->pri_dev_type, devtype,
187 					       sizeof(devtype)));
188 	if (!os_snprintf_error(sizeof(txt), len))
189 		wpa_msg(hapd->msg_ctx, MSG_INFO, "%s", txt);
190 
191 	if (hapd->conf->wps_pin_requests) {
192 		FILE *f;
193 		struct os_time t;
194 		f = fopen(hapd->conf->wps_pin_requests, "a");
195 		if (f == NULL)
196 			return;
197 		os_get_time(&t);
198 		fprintf(f, "%ld\t%s\t" MACSTR "\t%s\t%s\t%s\t%s\t%s"
199 			"\t%s\n",
200 			t.sec, uuid, MAC2STR(dev->mac_addr), dev->device_name,
201 			dev->manufacturer, dev->model_name, dev->model_number,
202 			dev->serial_number,
203 			wps_dev_type_bin2str(dev->pri_dev_type, devtype,
204 					     sizeof(devtype)));
205 		fclose(f);
206 	}
207 }
208 
209 
210 struct wps_stop_reg_data {
211 	struct hostapd_data *current_hapd;
212 	const u8 *uuid_e;
213 	const u8 *dev_pw;
214 	size_t dev_pw_len;
215 };
216 
217 static int wps_stop_registrar(struct hostapd_data *hapd, void *ctx)
218 {
219 	struct wps_stop_reg_data *data = ctx;
220 	if (hapd != data->current_hapd && hapd->wps != NULL)
221 		wps_registrar_complete(hapd->wps->registrar, data->uuid_e,
222 				       data->dev_pw, data->dev_pw_len);
223 	return 0;
224 }
225 
226 
227 static void hostapd_wps_reg_success_cb(void *ctx, const u8 *mac_addr,
228 				       const u8 *uuid_e, const u8 *dev_pw,
229 				       size_t dev_pw_len)
230 {
231 	struct hostapd_data *hapd = ctx;
232 	char uuid[40];
233 	struct wps_stop_reg_data data;
234 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
235 		return;
236 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_REG_SUCCESS MACSTR " %s",
237 		MAC2STR(mac_addr), uuid);
238 	if (hapd->wps_reg_success_cb)
239 		hapd->wps_reg_success_cb(hapd->wps_reg_success_cb_ctx,
240 					 mac_addr, uuid_e);
241 	data.current_hapd = hapd;
242 	data.uuid_e = uuid_e;
243 	data.dev_pw = dev_pw;
244 	data.dev_pw_len = dev_pw_len;
245 	hostapd_wps_for_each(hapd, wps_stop_registrar, &data);
246 }
247 
248 
249 static void hostapd_wps_enrollee_seen_cb(void *ctx, const u8 *addr,
250 					 const u8 *uuid_e,
251 					 const u8 *pri_dev_type,
252 					 u16 config_methods,
253 					 u16 dev_password_id, u8 request_type,
254 					 const char *dev_name)
255 {
256 	struct hostapd_data *hapd = ctx;
257 	char uuid[40];
258 	char devtype[WPS_DEV_TYPE_BUFSIZE];
259 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
260 		return;
261 	if (dev_name == NULL)
262 		dev_name = "";
263 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ENROLLEE_SEEN MACSTR
264 		     " %s %s 0x%x %u %u [%s]",
265 		     MAC2STR(addr), uuid,
266 		     wps_dev_type_bin2str(pri_dev_type, devtype,
267 					  sizeof(devtype)),
268 		     config_methods, dev_password_id, request_type, dev_name);
269 }
270 
271 
272 static void wps_reload_config(void *eloop_data, void *user_ctx)
273 {
274 	struct hostapd_iface *iface = eloop_data;
275 
276 	wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
277 	if (iface->interfaces == NULL ||
278 	    iface->interfaces->reload_config(iface) < 0) {
279 		wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
280 			   "configuration");
281 	}
282 }
283 
284 
285 void hostapd_wps_eap_completed(struct hostapd_data *hapd)
286 {
287 	/*
288 	 * Reduce race condition of the station trying to reconnect immediately
289 	 * after AP reconfiguration through WPS by rescheduling the reload
290 	 * timeout to happen after EAP completion rather than the originally
291 	 * scheduled 100 ms after new configuration became known.
292 	 */
293 	if (eloop_deplete_timeout(0, 0, wps_reload_config, hapd->iface, NULL) ==
294 	    1)
295 		wpa_printf(MSG_DEBUG, "WPS: Reschedule immediate configuration reload");
296 }
297 
298 
299 static void hapd_new_ap_event(struct hostapd_data *hapd, const u8 *attr,
300 			      size_t attr_len)
301 {
302 	size_t blen = attr_len * 2 + 1;
303 	char *buf = os_malloc(blen);
304 	if (buf) {
305 		wpa_snprintf_hex(buf, blen, attr, attr_len);
306 		wpa_msg(hapd->msg_ctx, MSG_INFO,
307 			WPS_EVENT_NEW_AP_SETTINGS "%s", buf);
308 		os_free(buf);
309 	}
310 }
311 
312 
313 static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
314 				       const struct wps_credential *cred)
315 {
316 	struct hostapd_bss_config *bss = hapd->conf;
317 
318 	wpa_printf(MSG_DEBUG, "WPS: Updating in-memory configuration");
319 
320 	bss->wps_state = 2;
321 	if (cred->ssid_len <= SSID_MAX_LEN) {
322 		os_memcpy(bss->ssid.ssid, cred->ssid, cred->ssid_len);
323 		bss->ssid.ssid_len = cred->ssid_len;
324 		bss->ssid.ssid_set = 1;
325 	}
326 
327 	if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
328 	    (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
329 		bss->wpa = 3;
330 	else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
331 		bss->wpa = 2;
332 	else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
333 		bss->wpa = 1;
334 	else
335 		bss->wpa = 0;
336 
337 	if (bss->wpa) {
338 		if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA))
339 			bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
340 		if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK))
341 			bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
342 
343 		bss->wpa_pairwise = 0;
344 		if (cred->encr_type & WPS_ENCR_AES) {
345 			if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
346 				bss->wpa_pairwise |= WPA_CIPHER_GCMP;
347 			else
348 				bss->wpa_pairwise |= WPA_CIPHER_CCMP;
349 		}
350 		if (cred->encr_type & WPS_ENCR_TKIP)
351 			bss->wpa_pairwise |= WPA_CIPHER_TKIP;
352 		bss->rsn_pairwise = bss->wpa_pairwise;
353 		bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa,
354 							    bss->wpa_pairwise,
355 							    bss->rsn_pairwise);
356 
357 		if (cred->key_len >= 8 && cred->key_len < 64) {
358 			os_free(bss->ssid.wpa_passphrase);
359 			bss->ssid.wpa_passphrase = os_zalloc(cred->key_len + 1);
360 			if (bss->ssid.wpa_passphrase)
361 				os_memcpy(bss->ssid.wpa_passphrase, cred->key,
362 					  cred->key_len);
363 			hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
364 		} else if (cred->key_len == 64) {
365 			hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
366 			bss->ssid.wpa_psk =
367 				os_zalloc(sizeof(struct hostapd_wpa_psk));
368 			if (bss->ssid.wpa_psk &&
369 			    hexstr2bin((const char *) cred->key,
370 				       bss->ssid.wpa_psk->psk, PMK_LEN) == 0) {
371 				bss->ssid.wpa_psk->group = 1;
372 				os_free(bss->ssid.wpa_passphrase);
373 				bss->ssid.wpa_passphrase = NULL;
374 			}
375 		}
376 		bss->auth_algs = 1;
377 	} else {
378 		/*
379 		 * WPS 2.0 does not allow WEP to be configured, so no need to
380 		 * process that option here either.
381 		 */
382 		bss->auth_algs = 1;
383 	}
384 
385 	/* Schedule configuration reload after short period of time to allow
386 	 * EAP-WSC to be finished.
387 	 */
388 	eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
389 			       NULL);
390 
391 	return 0;
392 }
393 
394 
395 static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
396 {
397 	const struct wps_credential *cred = ctx;
398 	FILE *oconf, *nconf;
399 	size_t len, i;
400 	char *tmp_fname;
401 	char buf[1024];
402 	int multi_bss;
403 	int wpa;
404 
405 	if (hapd->wps == NULL)
406 		return 0;
407 
408 	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
409 			cred->cred_attr, cred->cred_attr_len);
410 
411 	wpa_printf(MSG_DEBUG, "WPS: Received new AP Settings");
412 	wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
413 	wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
414 		   cred->auth_type);
415 	wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
416 	wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
417 	wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
418 			cred->key, cred->key_len);
419 	wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
420 		   MAC2STR(cred->mac_addr));
421 
422 	if ((hapd->conf->wps_cred_processing == 1 ||
423 	     hapd->conf->wps_cred_processing == 2) && cred->cred_attr) {
424 		hapd_new_ap_event(hapd, cred->cred_attr, cred->cred_attr_len);
425 	} else if (hapd->conf->wps_cred_processing == 1 ||
426 		   hapd->conf->wps_cred_processing == 2) {
427 		struct wpabuf *attr;
428 		attr = wpabuf_alloc(200);
429 		if (attr && wps_build_credential_wrap(attr, cred) == 0)
430 			hapd_new_ap_event(hapd, wpabuf_head_u8(attr),
431 					  wpabuf_len(attr));
432 		wpabuf_free(attr);
433 	} else
434 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS);
435 
436 	if (hapd->conf->wps_cred_processing == 1)
437 		return 0;
438 
439 	os_memcpy(hapd->wps->ssid, cred->ssid, cred->ssid_len);
440 	hapd->wps->ssid_len = cred->ssid_len;
441 	hapd->wps->encr_types = cred->encr_type;
442 	hapd->wps->encr_types_rsn = cred->encr_type;
443 	hapd->wps->encr_types_wpa = cred->encr_type;
444 	hapd->wps->auth_types = cred->auth_type;
445 	hapd->wps->ap_encr_type = cred->encr_type;
446 	hapd->wps->ap_auth_type = cred->auth_type;
447 	if (cred->key_len == 0) {
448 		os_free(hapd->wps->network_key);
449 		hapd->wps->network_key = NULL;
450 		hapd->wps->network_key_len = 0;
451 	} else if ((cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) &&
452 		   (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN)) {
453 		wpa_printf(MSG_INFO, "WPS: Invalid key length %lu for WPA/WPA2",
454 			   (unsigned long) cred->key_len);
455 		return -1;
456 	} else {
457 		if (hapd->wps->network_key == NULL ||
458 		    hapd->wps->network_key_len < cred->key_len) {
459 			hapd->wps->network_key_len = 0;
460 			os_free(hapd->wps->network_key);
461 			hapd->wps->network_key = os_malloc(cred->key_len);
462 			if (hapd->wps->network_key == NULL)
463 				return -1;
464 		}
465 		hapd->wps->network_key_len = cred->key_len;
466 		os_memcpy(hapd->wps->network_key, cred->key, cred->key_len);
467 	}
468 	hapd->wps->wps_state = WPS_STATE_CONFIGURED;
469 
470 	if (hapd->iface->config_fname == NULL)
471 		return hapd_wps_reconfig_in_memory(hapd, cred);
472 	len = os_strlen(hapd->iface->config_fname) + 5;
473 	tmp_fname = os_malloc(len);
474 	if (tmp_fname == NULL)
475 		return -1;
476 	os_snprintf(tmp_fname, len, "%s-new", hapd->iface->config_fname);
477 
478 	oconf = fopen(hapd->iface->config_fname, "r");
479 	if (oconf == NULL) {
480 		wpa_printf(MSG_WARNING, "WPS: Could not open current "
481 			   "configuration file");
482 		os_free(tmp_fname);
483 		return -1;
484 	}
485 
486 	nconf = fopen(tmp_fname, "w");
487 	if (nconf == NULL) {
488 		wpa_printf(MSG_WARNING, "WPS: Could not write updated "
489 			   "configuration file");
490 		os_free(tmp_fname);
491 		fclose(oconf);
492 		return -1;
493 	}
494 
495 	fprintf(nconf, "# WPS configuration - START\n");
496 
497 	fprintf(nconf, "wps_state=2\n");
498 
499 	if (is_hex(cred->ssid, cred->ssid_len)) {
500 		fprintf(nconf, "ssid2=");
501 		for (i = 0; i < cred->ssid_len; i++)
502 			fprintf(nconf, "%02x", cred->ssid[i]);
503 		fprintf(nconf, "\n");
504 	} else {
505 		fprintf(nconf, "ssid=");
506 		for (i = 0; i < cred->ssid_len; i++)
507 			fputc(cred->ssid[i], nconf);
508 		fprintf(nconf, "\n");
509 	}
510 
511 	if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
512 	    (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
513 		wpa = 3;
514 	else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
515 		wpa = 2;
516 	else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
517 		wpa = 1;
518 	else
519 		wpa = 0;
520 
521 	if (wpa) {
522 		char *prefix;
523 		fprintf(nconf, "wpa=%d\n", wpa);
524 
525 		fprintf(nconf, "wpa_key_mgmt=");
526 		prefix = "";
527 		if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) {
528 			fprintf(nconf, "WPA-EAP");
529 			prefix = " ";
530 		}
531 		if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK))
532 			fprintf(nconf, "%sWPA-PSK", prefix);
533 		fprintf(nconf, "\n");
534 
535 		fprintf(nconf, "wpa_pairwise=");
536 		prefix = "";
537 		if (cred->encr_type & WPS_ENCR_AES) {
538 			if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
539 				fprintf(nconf, "GCMP");
540 			else
541 				fprintf(nconf, "CCMP");
542 
543 			prefix = " ";
544 		}
545 		if (cred->encr_type & WPS_ENCR_TKIP) {
546 			fprintf(nconf, "%sTKIP", prefix);
547 		}
548 		fprintf(nconf, "\n");
549 
550 		if (cred->key_len >= 8 && cred->key_len < 64) {
551 			fprintf(nconf, "wpa_passphrase=");
552 			for (i = 0; i < cred->key_len; i++)
553 				fputc(cred->key[i], nconf);
554 			fprintf(nconf, "\n");
555 		} else if (cred->key_len == 64) {
556 			fprintf(nconf, "wpa_psk=");
557 			for (i = 0; i < cred->key_len; i++)
558 				fputc(cred->key[i], nconf);
559 			fprintf(nconf, "\n");
560 		} else {
561 			wpa_printf(MSG_WARNING, "WPS: Invalid key length %lu "
562 				   "for WPA/WPA2",
563 				   (unsigned long) cred->key_len);
564 		}
565 
566 		fprintf(nconf, "auth_algs=1\n");
567 	} else {
568 		/*
569 		 * WPS 2.0 does not allow WEP to be configured, so no need to
570 		 * process that option here either.
571 		 */
572 		fprintf(nconf, "auth_algs=1\n");
573 	}
574 
575 	fprintf(nconf, "# WPS configuration - END\n");
576 
577 	multi_bss = 0;
578 	while (fgets(buf, sizeof(buf), oconf)) {
579 		if (os_strncmp(buf, "bss=", 4) == 0)
580 			multi_bss = 1;
581 		if (!multi_bss &&
582 		    (str_starts(buf, "ssid=") ||
583 		     str_starts(buf, "ssid2=") ||
584 		     str_starts(buf, "auth_algs=") ||
585 		     str_starts(buf, "wep_default_key=") ||
586 		     str_starts(buf, "wep_key") ||
587 		     str_starts(buf, "wps_state=") ||
588 		     str_starts(buf, "wpa=") ||
589 		     str_starts(buf, "wpa_psk=") ||
590 		     str_starts(buf, "wpa_pairwise=") ||
591 		     str_starts(buf, "rsn_pairwise=") ||
592 		     str_starts(buf, "wpa_key_mgmt=") ||
593 		     str_starts(buf, "wpa_passphrase="))) {
594 			fprintf(nconf, "#WPS# %s", buf);
595 		} else
596 			fprintf(nconf, "%s", buf);
597 	}
598 
599 	fclose(nconf);
600 	fclose(oconf);
601 
602 	if (rename(tmp_fname, hapd->iface->config_fname) < 0) {
603 		wpa_printf(MSG_WARNING, "WPS: Failed to rename the updated "
604 			   "configuration file: %s", strerror(errno));
605 		os_free(tmp_fname);
606 		return -1;
607 	}
608 
609 	os_free(tmp_fname);
610 
611 	/* Schedule configuration reload after short period of time to allow
612 	 * EAP-WSC to be finished.
613 	 */
614 	eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
615 			       NULL);
616 
617 	wpa_printf(MSG_DEBUG, "WPS: AP configuration updated");
618 
619 	return 0;
620 }
621 
622 
623 static int hostapd_wps_cred_cb(void *ctx, const struct wps_credential *cred)
624 {
625 	struct hostapd_data *hapd = ctx;
626 	return hostapd_wps_for_each(hapd, hapd_wps_cred_cb, (void *) cred);
627 }
628 
629 
630 static void hostapd_wps_reenable_ap_pin(void *eloop_data, void *user_ctx)
631 {
632 	struct hostapd_data *hapd = eloop_data;
633 
634 	if (hapd->conf->ap_setup_locked)
635 		return;
636 	if (hapd->ap_pin_failures_consecutive >= 10)
637 		return;
638 
639 	wpa_printf(MSG_DEBUG, "WPS: Re-enable AP PIN");
640 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
641 	hapd->wps->ap_setup_locked = 0;
642 	wps_registrar_update_ie(hapd->wps->registrar);
643 }
644 
645 
646 static int wps_pwd_auth_fail(struct hostapd_data *hapd, void *ctx)
647 {
648 	struct wps_event_pwd_auth_fail *data = ctx;
649 
650 	if (!data->enrollee || hapd->conf->ap_pin == NULL || hapd->wps == NULL)
651 		return 0;
652 
653 	/*
654 	 * Registrar failed to prove its knowledge of the AP PIN. Lock AP setup
655 	 * for some time if this happens multiple times to slow down brute
656 	 * force attacks.
657 	 */
658 	hapd->ap_pin_failures++;
659 	hapd->ap_pin_failures_consecutive++;
660 	wpa_printf(MSG_DEBUG, "WPS: AP PIN authentication failure number %u "
661 		   "(%u consecutive)",
662 		   hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
663 	if (hapd->ap_pin_failures < 3)
664 		return 0;
665 
666 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_LOCKED);
667 	hapd->wps->ap_setup_locked = 1;
668 
669 	wps_registrar_update_ie(hapd->wps->registrar);
670 
671 	if (!hapd->conf->ap_setup_locked &&
672 	    hapd->ap_pin_failures_consecutive >= 10) {
673 		/*
674 		 * In indefinite lockdown - disable automatic AP PIN
675 		 * reenablement.
676 		 */
677 		eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
678 		wpa_printf(MSG_DEBUG, "WPS: AP PIN disabled indefinitely");
679 	} else if (!hapd->conf->ap_setup_locked) {
680 		if (hapd->ap_pin_lockout_time == 0)
681 			hapd->ap_pin_lockout_time = 60;
682 		else if (hapd->ap_pin_lockout_time < 365 * 24 * 60 * 60 &&
683 			 (hapd->ap_pin_failures % 3) == 0)
684 			hapd->ap_pin_lockout_time *= 2;
685 
686 		wpa_printf(MSG_DEBUG, "WPS: Disable AP PIN for %u seconds",
687 			   hapd->ap_pin_lockout_time);
688 		eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
689 		eloop_register_timeout(hapd->ap_pin_lockout_time, 0,
690 				       hostapd_wps_reenable_ap_pin, hapd,
691 				       NULL);
692 	}
693 
694 	return 0;
695 }
696 
697 
698 static void hostapd_pwd_auth_fail(struct hostapd_data *hapd,
699 				  struct wps_event_pwd_auth_fail *data)
700 {
701 	/* Update WPS Status - Authentication Failure */
702 	wpa_printf(MSG_DEBUG, "WPS: Authentication failure update");
703 	hapd->wps_stats.status = WPS_STATUS_FAILURE;
704 	hapd->wps_stats.failure_reason = WPS_EI_AUTH_FAILURE;
705 	os_memcpy(hapd->wps_stats.peer_addr, data->peer_macaddr, ETH_ALEN);
706 
707 	hostapd_wps_for_each(hapd, wps_pwd_auth_fail, data);
708 }
709 
710 
711 static int wps_ap_pin_success(struct hostapd_data *hapd, void *ctx)
712 {
713 	if (hapd->conf->ap_pin == NULL || hapd->wps == NULL)
714 		return 0;
715 
716 	if (hapd->ap_pin_failures_consecutive == 0)
717 		return 0;
718 
719 	wpa_printf(MSG_DEBUG, "WPS: Clear consecutive AP PIN failure counter "
720 		   "- total validation failures %u (%u consecutive)",
721 		   hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
722 	hapd->ap_pin_failures_consecutive = 0;
723 
724 	return 0;
725 }
726 
727 
728 static void hostapd_wps_ap_pin_success(struct hostapd_data *hapd)
729 {
730 	hostapd_wps_for_each(hapd, wps_ap_pin_success, NULL);
731 }
732 
733 
734 static void hostapd_wps_event_pbc_overlap(struct hostapd_data *hapd)
735 {
736 	/* Update WPS Status - PBC Overlap */
737 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_OVERLAP;
738 }
739 
740 
741 static void hostapd_wps_event_pbc_timeout(struct hostapd_data *hapd)
742 {
743 	/* Update WPS PBC Status:PBC Timeout */
744 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_TIMEOUT;
745 }
746 
747 
748 static void hostapd_wps_event_pbc_active(struct hostapd_data *hapd)
749 {
750 	/* Update WPS PBC status - Active */
751 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_ACTIVE;
752 }
753 
754 
755 static void hostapd_wps_event_pbc_disable(struct hostapd_data *hapd)
756 {
757 	/* Update WPS PBC status - Active */
758 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
759 }
760 
761 
762 static void hostapd_wps_event_success(struct hostapd_data *hapd,
763 				      struct wps_event_success *success)
764 {
765 	/* Update WPS status - Success */
766 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
767 	hapd->wps_stats.status = WPS_STATUS_SUCCESS;
768 	os_memcpy(hapd->wps_stats.peer_addr, success->peer_macaddr, ETH_ALEN);
769 }
770 
771 
772 static void hostapd_wps_event_fail(struct hostapd_data *hapd,
773 				   struct wps_event_fail *fail)
774 {
775 	/* Update WPS status - Failure */
776 	hapd->wps_stats.status = WPS_STATUS_FAILURE;
777 	os_memcpy(hapd->wps_stats.peer_addr, fail->peer_macaddr, ETH_ALEN);
778 
779 	hapd->wps_stats.failure_reason = fail->error_indication;
780 
781 	if (fail->error_indication > 0 &&
782 	    fail->error_indication < NUM_WPS_EI_VALUES) {
783 		wpa_msg(hapd->msg_ctx, MSG_INFO,
784 			WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)",
785 			fail->msg, fail->config_error, fail->error_indication,
786 			wps_ei_str(fail->error_indication));
787 	} else {
788 		wpa_msg(hapd->msg_ctx, MSG_INFO,
789 			WPS_EVENT_FAIL "msg=%d config_error=%d",
790 			fail->msg, fail->config_error);
791 	}
792 }
793 
794 
795 static void hostapd_wps_event_cb(void *ctx, enum wps_event event,
796 				 union wps_event_data *data)
797 {
798 	struct hostapd_data *hapd = ctx;
799 
800 	switch (event) {
801 	case WPS_EV_M2D:
802 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_M2D);
803 		break;
804 	case WPS_EV_FAIL:
805 		hostapd_wps_event_fail(hapd, &data->fail);
806 		break;
807 	case WPS_EV_SUCCESS:
808 		hostapd_wps_event_success(hapd, &data->success);
809 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_SUCCESS);
810 		break;
811 	case WPS_EV_PWD_AUTH_FAIL:
812 		hostapd_pwd_auth_fail(hapd, &data->pwd_auth_fail);
813 		break;
814 	case WPS_EV_PBC_OVERLAP:
815 		hostapd_wps_event_pbc_overlap(hapd);
816 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_OVERLAP);
817 		break;
818 	case WPS_EV_PBC_TIMEOUT:
819 		hostapd_wps_event_pbc_timeout(hapd);
820 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_TIMEOUT);
821 		break;
822 	case WPS_EV_PBC_ACTIVE:
823 		hostapd_wps_event_pbc_active(hapd);
824 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ACTIVE);
825 		break;
826 	case WPS_EV_PBC_DISABLE:
827 		hostapd_wps_event_pbc_disable(hapd);
828 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_DISABLE);
829 		break;
830 	case WPS_EV_ER_AP_ADD:
831 		break;
832 	case WPS_EV_ER_AP_REMOVE:
833 		break;
834 	case WPS_EV_ER_ENROLLEE_ADD:
835 		break;
836 	case WPS_EV_ER_ENROLLEE_REMOVE:
837 		break;
838 	case WPS_EV_ER_AP_SETTINGS:
839 		break;
840 	case WPS_EV_ER_SET_SELECTED_REGISTRAR:
841 		break;
842 	case WPS_EV_AP_PIN_SUCCESS:
843 		hostapd_wps_ap_pin_success(hapd);
844 		break;
845 	}
846 	if (hapd->wps_event_cb)
847 		hapd->wps_event_cb(hapd->wps_event_cb_ctx, event, data);
848 }
849 
850 
851 static int hostapd_wps_rf_band_cb(void *ctx)
852 {
853 	struct hostapd_data *hapd = ctx;
854 
855 	return hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
856 		WPS_RF_50GHZ :
857 		hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
858 		WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
859 }
860 
861 
862 static void hostapd_wps_clear_ies(struct hostapd_data *hapd, int deinit_only)
863 {
864 	wpabuf_free(hapd->wps_beacon_ie);
865 	hapd->wps_beacon_ie = NULL;
866 
867 	wpabuf_free(hapd->wps_probe_resp_ie);
868 	hapd->wps_probe_resp_ie = NULL;
869 
870 	if (deinit_only) {
871 		if (hapd->drv_priv)
872 			hostapd_reset_ap_wps_ie(hapd);
873 		return;
874 	}
875 
876 	hostapd_set_ap_wps_ie(hapd);
877 }
878 
879 
880 static int get_uuid_cb(struct hostapd_iface *iface, void *ctx)
881 {
882 	const u8 **uuid = ctx;
883 	size_t j;
884 
885 	if (iface == NULL)
886 		return 0;
887 	for (j = 0; j < iface->num_bss; j++) {
888 		struct hostapd_data *hapd = iface->bss[j];
889 		if (hapd->wps && !hapd->conf->wps_independent &&
890 		    !is_nil_uuid(hapd->wps->uuid)) {
891 			*uuid = hapd->wps->uuid;
892 			return 1;
893 		}
894 	}
895 
896 	return 0;
897 }
898 
899 
900 static const u8 * get_own_uuid(struct hostapd_iface *iface)
901 {
902 	const u8 *uuid;
903 	if (iface->interfaces == NULL ||
904 	    iface->interfaces->for_each_interface == NULL)
905 		return NULL;
906 	uuid = NULL;
907 	iface->interfaces->for_each_interface(iface->interfaces, get_uuid_cb,
908 					      &uuid);
909 	return uuid;
910 }
911 
912 
913 static int count_interface_cb(struct hostapd_iface *iface, void *ctx)
914 {
915 	int *count= ctx;
916 	(*count)++;
917 	return 0;
918 }
919 
920 
921 static int interface_count(struct hostapd_iface *iface)
922 {
923 	int count = 0;
924 	if (iface->interfaces == NULL ||
925 	    iface->interfaces->for_each_interface == NULL)
926 		return 0;
927 	iface->interfaces->for_each_interface(iface->interfaces,
928 					      count_interface_cb, &count);
929 	return count;
930 }
931 
932 
933 static int hostapd_wps_set_vendor_ext(struct hostapd_data *hapd,
934 				      struct wps_context *wps)
935 {
936 	int i;
937 
938 	for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) {
939 		wpabuf_free(wps->dev.vendor_ext[i]);
940 		wps->dev.vendor_ext[i] = NULL;
941 
942 		if (hapd->conf->wps_vendor_ext[i] == NULL)
943 			continue;
944 
945 		wps->dev.vendor_ext[i] =
946 			wpabuf_dup(hapd->conf->wps_vendor_ext[i]);
947 		if (wps->dev.vendor_ext[i] == NULL) {
948 			while (--i >= 0)
949 				wpabuf_free(wps->dev.vendor_ext[i]);
950 			return -1;
951 		}
952 	}
953 
954 	return 0;
955 }
956 
957 
958 static void hostapd_free_wps(struct wps_context *wps)
959 {
960 	int i;
961 
962 	for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
963 		wpabuf_free(wps->dev.vendor_ext[i]);
964 	wps_device_data_free(&wps->dev);
965 	os_free(wps->network_key);
966 	hostapd_wps_nfc_clear(wps);
967 	wpabuf_free(wps->dh_pubkey);
968 	wpabuf_free(wps->dh_privkey);
969 	os_free(wps);
970 }
971 
972 
973 int hostapd_init_wps(struct hostapd_data *hapd,
974 		     struct hostapd_bss_config *conf)
975 {
976 	struct wps_context *wps;
977 	struct wps_registrar_config cfg;
978 
979 	if (conf->wps_state == 0) {
980 		hostapd_wps_clear_ies(hapd, 0);
981 		return 0;
982 	}
983 
984 	wps = os_zalloc(sizeof(*wps));
985 	if (wps == NULL)
986 		return -1;
987 
988 	wps->cred_cb = hostapd_wps_cred_cb;
989 	wps->event_cb = hostapd_wps_event_cb;
990 	wps->rf_band_cb = hostapd_wps_rf_band_cb;
991 	wps->cb_ctx = hapd;
992 
993 	os_memset(&cfg, 0, sizeof(cfg));
994 	wps->wps_state = hapd->conf->wps_state;
995 	wps->ap_setup_locked = hapd->conf->ap_setup_locked;
996 	if (is_nil_uuid(hapd->conf->uuid)) {
997 		const u8 *uuid;
998 		uuid = get_own_uuid(hapd->iface);
999 		if (uuid && !conf->wps_independent) {
1000 			os_memcpy(wps->uuid, uuid, UUID_LEN);
1001 			wpa_hexdump(MSG_DEBUG, "WPS: Clone UUID from another "
1002 				    "interface", wps->uuid, UUID_LEN);
1003 		} else {
1004 			uuid_gen_mac_addr(hapd->own_addr, wps->uuid);
1005 			wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC "
1006 				    "address", wps->uuid, UUID_LEN);
1007 		}
1008 	} else {
1009 		os_memcpy(wps->uuid, hapd->conf->uuid, UUID_LEN);
1010 		wpa_hexdump(MSG_DEBUG, "WPS: Use configured UUID",
1011 			    wps->uuid, UUID_LEN);
1012 	}
1013 	wps->ssid_len = hapd->conf->ssid.ssid_len;
1014 	os_memcpy(wps->ssid, hapd->conf->ssid.ssid, wps->ssid_len);
1015 	wps->ap = 1;
1016 	os_memcpy(wps->dev.mac_addr, hapd->own_addr, ETH_ALEN);
1017 	wps->dev.device_name = hapd->conf->device_name ?
1018 		os_strdup(hapd->conf->device_name) : NULL;
1019 	wps->dev.manufacturer = hapd->conf->manufacturer ?
1020 		os_strdup(hapd->conf->manufacturer) : NULL;
1021 	wps->dev.model_name = hapd->conf->model_name ?
1022 		os_strdup(hapd->conf->model_name) : NULL;
1023 	wps->dev.model_number = hapd->conf->model_number ?
1024 		os_strdup(hapd->conf->model_number) : NULL;
1025 	wps->dev.serial_number = hapd->conf->serial_number ?
1026 		os_strdup(hapd->conf->serial_number) : NULL;
1027 	wps->config_methods =
1028 		wps_config_methods_str2bin(hapd->conf->config_methods);
1029 	if ((wps->config_methods &
1030 	     (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY |
1031 	      WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) {
1032 		wpa_printf(MSG_INFO, "WPS: Converting display to "
1033 			   "virtual_display for WPS 2.0 compliance");
1034 		wps->config_methods |= WPS_CONFIG_VIRT_DISPLAY;
1035 	}
1036 	if ((wps->config_methods &
1037 	     (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON |
1038 	      WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) {
1039 		wpa_printf(MSG_INFO, "WPS: Converting push_button to "
1040 			   "virtual_push_button for WPS 2.0 compliance");
1041 		wps->config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
1042 	}
1043 	os_memcpy(wps->dev.pri_dev_type, hapd->conf->device_type,
1044 		  WPS_DEV_TYPE_LEN);
1045 
1046 	if (hostapd_wps_set_vendor_ext(hapd, wps) < 0)
1047 		goto fail;
1048 
1049 	wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
1050 
1051 	if (conf->wps_rf_bands) {
1052 		wps->dev.rf_bands = conf->wps_rf_bands;
1053 	} else {
1054 		wps->dev.rf_bands =
1055 			hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
1056 			WPS_RF_50GHZ :
1057 			hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
1058 			WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
1059 	}
1060 
1061 	if (conf->wpa & WPA_PROTO_RSN) {
1062 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1063 			wps->auth_types |= WPS_AUTH_WPA2PSK;
1064 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1065 			wps->auth_types |= WPS_AUTH_WPA2;
1066 
1067 		if (conf->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1068 					  WPA_CIPHER_CCMP_256 |
1069 					  WPA_CIPHER_GCMP_256)) {
1070 			wps->encr_types |= WPS_ENCR_AES;
1071 			wps->encr_types_rsn |= WPS_ENCR_AES;
1072 		}
1073 		if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
1074 			wps->encr_types |= WPS_ENCR_TKIP;
1075 			wps->encr_types_rsn |= WPS_ENCR_TKIP;
1076 		}
1077 	}
1078 
1079 	if (conf->wpa & WPA_PROTO_WPA) {
1080 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1081 			wps->auth_types |= WPS_AUTH_WPAPSK;
1082 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1083 			wps->auth_types |= WPS_AUTH_WPA;
1084 
1085 		if (conf->wpa_pairwise & WPA_CIPHER_CCMP) {
1086 			wps->encr_types |= WPS_ENCR_AES;
1087 			wps->encr_types_wpa |= WPS_ENCR_AES;
1088 		}
1089 		if (conf->wpa_pairwise & WPA_CIPHER_TKIP) {
1090 			wps->encr_types |= WPS_ENCR_TKIP;
1091 			wps->encr_types_wpa |= WPS_ENCR_TKIP;
1092 		}
1093 	}
1094 
1095 	if (conf->ssid.security_policy == SECURITY_PLAINTEXT) {
1096 		wps->encr_types |= WPS_ENCR_NONE;
1097 		wps->auth_types |= WPS_AUTH_OPEN;
1098 	}
1099 
1100 	if (conf->ssid.wpa_psk_file) {
1101 		/* Use per-device PSKs */
1102 	} else if (conf->ssid.wpa_passphrase) {
1103 		wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase);
1104 		wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase);
1105 	} else if (conf->ssid.wpa_psk) {
1106 		wps->network_key = os_malloc(2 * PMK_LEN + 1);
1107 		if (wps->network_key == NULL)
1108 			goto fail;
1109 		wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1,
1110 				 conf->ssid.wpa_psk->psk, PMK_LEN);
1111 		wps->network_key_len = 2 * PMK_LEN;
1112 	} else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) {
1113 		wps->network_key = os_malloc(conf->ssid.wep.len[0]);
1114 		if (wps->network_key == NULL)
1115 			goto fail;
1116 		os_memcpy(wps->network_key, conf->ssid.wep.key[0],
1117 			  conf->ssid.wep.len[0]);
1118 		wps->network_key_len = conf->ssid.wep.len[0];
1119 	}
1120 
1121 	if (conf->ssid.wpa_psk) {
1122 		os_memcpy(wps->psk, conf->ssid.wpa_psk->psk, PMK_LEN);
1123 		wps->psk_set = 1;
1124 	}
1125 
1126 	wps->ap_auth_type = wps->auth_types;
1127 	wps->ap_encr_type = wps->encr_types;
1128 	if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) {
1129 		/* Override parameters to enable security by default */
1130 		wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
1131 		wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
1132 		wps->encr_types_rsn = WPS_ENCR_AES | WPS_ENCR_TKIP;
1133 		wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP;
1134 	}
1135 
1136 	wps->ap_settings = conf->ap_settings;
1137 	wps->ap_settings_len = conf->ap_settings_len;
1138 
1139 	cfg.new_psk_cb = hostapd_wps_new_psk_cb;
1140 	cfg.set_ie_cb = hostapd_wps_set_ie_cb;
1141 	cfg.pin_needed_cb = hostapd_wps_pin_needed_cb;
1142 	cfg.reg_success_cb = hostapd_wps_reg_success_cb;
1143 	cfg.enrollee_seen_cb = hostapd_wps_enrollee_seen_cb;
1144 	cfg.cb_ctx = hapd;
1145 	cfg.skip_cred_build = conf->skip_cred_build;
1146 	cfg.extra_cred = conf->extra_cred;
1147 	cfg.extra_cred_len = conf->extra_cred_len;
1148 	cfg.disable_auto_conf = (hapd->conf->wps_cred_processing == 1) &&
1149 		conf->skip_cred_build;
1150 	if (conf->ssid.security_policy == SECURITY_STATIC_WEP)
1151 		cfg.static_wep_only = 1;
1152 	cfg.dualband = interface_count(hapd->iface) > 1;
1153 	if ((wps->dev.rf_bands & (WPS_RF_50GHZ | WPS_RF_24GHZ)) ==
1154 	    (WPS_RF_50GHZ | WPS_RF_24GHZ))
1155 		cfg.dualband = 1;
1156 	if (cfg.dualband)
1157 		wpa_printf(MSG_DEBUG, "WPS: Dualband AP");
1158 	cfg.force_per_enrollee_psk = conf->force_per_enrollee_psk;
1159 
1160 	wps->registrar = wps_registrar_init(wps, &cfg);
1161 	if (wps->registrar == NULL) {
1162 		wpa_printf(MSG_ERROR, "Failed to initialize WPS Registrar");
1163 		goto fail;
1164 	}
1165 
1166 #ifdef CONFIG_WPS_UPNP
1167 	wps->friendly_name = hapd->conf->friendly_name;
1168 	wps->manufacturer_url = hapd->conf->manufacturer_url;
1169 	wps->model_description = hapd->conf->model_description;
1170 	wps->model_url = hapd->conf->model_url;
1171 	wps->upc = hapd->conf->upc;
1172 #endif /* CONFIG_WPS_UPNP */
1173 
1174 	hostapd_register_probereq_cb(hapd, hostapd_wps_probe_req_rx, hapd);
1175 
1176 	hapd->wps = wps;
1177 
1178 	return 0;
1179 
1180 fail:
1181 	hostapd_free_wps(wps);
1182 	return -1;
1183 }
1184 
1185 
1186 int hostapd_init_wps_complete(struct hostapd_data *hapd)
1187 {
1188 	struct wps_context *wps = hapd->wps;
1189 
1190 	if (wps == NULL)
1191 		return 0;
1192 
1193 #ifdef CONFIG_WPS_UPNP
1194 	if (hostapd_wps_upnp_init(hapd, wps) < 0) {
1195 		wpa_printf(MSG_ERROR, "Failed to initialize WPS UPnP");
1196 		wps_registrar_deinit(wps->registrar);
1197 		hostapd_free_wps(wps);
1198 		hapd->wps = NULL;
1199 		return -1;
1200 	}
1201 #endif /* CONFIG_WPS_UPNP */
1202 
1203 	return 0;
1204 }
1205 
1206 
1207 static void hostapd_wps_nfc_clear(struct wps_context *wps)
1208 {
1209 #ifdef CONFIG_WPS_NFC
1210 	wpa_printf(MSG_DEBUG, "WPS: Clear NFC Tag context %p", wps);
1211 	wps->ap_nfc_dev_pw_id = 0;
1212 	wpabuf_free(wps->ap_nfc_dh_pubkey);
1213 	wps->ap_nfc_dh_pubkey = NULL;
1214 	wpabuf_free(wps->ap_nfc_dh_privkey);
1215 	wps->ap_nfc_dh_privkey = NULL;
1216 	wpabuf_free(wps->ap_nfc_dev_pw);
1217 	wps->ap_nfc_dev_pw = NULL;
1218 #endif /* CONFIG_WPS_NFC */
1219 }
1220 
1221 
1222 void hostapd_deinit_wps(struct hostapd_data *hapd)
1223 {
1224 	eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
1225 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1226 	eloop_cancel_timeout(wps_reload_config, hapd->iface, NULL);
1227 	if (hapd->wps == NULL) {
1228 		hostapd_wps_clear_ies(hapd, 1);
1229 		return;
1230 	}
1231 #ifdef CONFIG_WPS_UPNP
1232 	hostapd_wps_upnp_deinit(hapd);
1233 #endif /* CONFIG_WPS_UPNP */
1234 	wps_registrar_deinit(hapd->wps->registrar);
1235 	wps_free_pending_msgs(hapd->wps->upnp_msgs);
1236 	hostapd_free_wps(hapd->wps);
1237 	hapd->wps = NULL;
1238 	hostapd_wps_clear_ies(hapd, 1);
1239 }
1240 
1241 
1242 void hostapd_update_wps(struct hostapd_data *hapd)
1243 {
1244 	if (hapd->wps == NULL)
1245 		return;
1246 
1247 #ifdef CONFIG_WPS_UPNP
1248 	hapd->wps->friendly_name = hapd->conf->friendly_name;
1249 	hapd->wps->manufacturer_url = hapd->conf->manufacturer_url;
1250 	hapd->wps->model_description = hapd->conf->model_description;
1251 	hapd->wps->model_url = hapd->conf->model_url;
1252 	hapd->wps->upc = hapd->conf->upc;
1253 #endif /* CONFIG_WPS_UPNP */
1254 
1255 	hostapd_wps_set_vendor_ext(hapd, hapd->wps);
1256 
1257 	if (hapd->conf->wps_state)
1258 		wps_registrar_update_ie(hapd->wps->registrar);
1259 	else
1260 		hostapd_deinit_wps(hapd);
1261 }
1262 
1263 
1264 struct wps_add_pin_data {
1265 	const u8 *addr;
1266 	const u8 *uuid;
1267 	const u8 *pin;
1268 	size_t pin_len;
1269 	int timeout;
1270 	int added;
1271 };
1272 
1273 
1274 static int wps_add_pin(struct hostapd_data *hapd, void *ctx)
1275 {
1276 	struct wps_add_pin_data *data = ctx;
1277 	int ret;
1278 
1279 	if (hapd->wps == NULL)
1280 		return 0;
1281 	ret = wps_registrar_add_pin(hapd->wps->registrar, data->addr,
1282 				    data->uuid, data->pin, data->pin_len,
1283 				    data->timeout);
1284 	if (ret == 0)
1285 		data->added++;
1286 	return ret;
1287 }
1288 
1289 
1290 int hostapd_wps_add_pin(struct hostapd_data *hapd, const u8 *addr,
1291 			const char *uuid, const char *pin, int timeout)
1292 {
1293 	u8 u[UUID_LEN];
1294 	struct wps_add_pin_data data;
1295 
1296 	data.addr = addr;
1297 	data.uuid = u;
1298 	data.pin = (const u8 *) pin;
1299 	data.pin_len = os_strlen(pin);
1300 	data.timeout = timeout;
1301 	data.added = 0;
1302 
1303 	if (os_strcmp(uuid, "any") == 0)
1304 		data.uuid = NULL;
1305 	else {
1306 		if (uuid_str2bin(uuid, u))
1307 			return -1;
1308 		data.uuid = u;
1309 	}
1310 	if (hostapd_wps_for_each(hapd, wps_add_pin, &data) < 0)
1311 		return -1;
1312 	return data.added ? 0 : -1;
1313 }
1314 
1315 
1316 struct wps_button_pushed_ctx {
1317 	const u8 *p2p_dev_addr;
1318 	unsigned int count;
1319 };
1320 
1321 static int wps_button_pushed(struct hostapd_data *hapd, void *ctx)
1322 {
1323 	struct wps_button_pushed_ctx *data = ctx;
1324 
1325 	if (hapd->wps) {
1326 		data->count++;
1327 		return wps_registrar_button_pushed(hapd->wps->registrar,
1328 						   data->p2p_dev_addr);
1329 	}
1330 
1331 	return 0;
1332 }
1333 
1334 
1335 int hostapd_wps_button_pushed(struct hostapd_data *hapd,
1336 			      const u8 *p2p_dev_addr)
1337 {
1338 	struct wps_button_pushed_ctx ctx;
1339 	int ret;
1340 
1341 	os_memset(&ctx, 0, sizeof(ctx));
1342 	ctx.p2p_dev_addr = p2p_dev_addr;
1343 	ret = hostapd_wps_for_each(hapd, wps_button_pushed, &ctx);
1344 	if (ret == 0 && !ctx.count)
1345 		ret = -1;
1346 	return ret;
1347 }
1348 
1349 
1350 struct wps_cancel_ctx {
1351 	unsigned int count;
1352 };
1353 
1354 static int wps_cancel(struct hostapd_data *hapd, void *ctx)
1355 {
1356 	struct wps_cancel_ctx *data = ctx;
1357 
1358 	if (hapd->wps) {
1359 		data->count++;
1360 		wps_registrar_wps_cancel(hapd->wps->registrar);
1361 		ap_for_each_sta(hapd, ap_sta_wps_cancel, NULL);
1362 	}
1363 
1364 	return 0;
1365 }
1366 
1367 
1368 int hostapd_wps_cancel(struct hostapd_data *hapd)
1369 {
1370 	struct wps_cancel_ctx ctx;
1371 	int ret;
1372 
1373 	os_memset(&ctx, 0, sizeof(ctx));
1374 	ret = hostapd_wps_for_each(hapd, wps_cancel, &ctx);
1375 	if (ret == 0 && !ctx.count)
1376 		ret = -1;
1377 	return ret;
1378 }
1379 
1380 
1381 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
1382 				    const u8 *bssid,
1383 				    const u8 *ie, size_t ie_len,
1384 				    int ssi_signal)
1385 {
1386 	struct hostapd_data *hapd = ctx;
1387 	struct wpabuf *wps_ie;
1388 	struct ieee802_11_elems elems;
1389 
1390 	if (hapd->wps == NULL)
1391 		return 0;
1392 
1393 	if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) {
1394 		wpa_printf(MSG_DEBUG, "WPS: Could not parse ProbeReq from "
1395 			   MACSTR, MAC2STR(addr));
1396 		return 0;
1397 	}
1398 
1399 	if (elems.ssid && elems.ssid_len > 0 &&
1400 	    (elems.ssid_len != hapd->conf->ssid.ssid_len ||
1401 	     os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) !=
1402 	     0))
1403 		return 0; /* Not for us */
1404 
1405 	wps_ie = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA);
1406 	if (wps_ie == NULL)
1407 		return 0;
1408 	if (wps_validate_probe_req(wps_ie, addr) < 0) {
1409 		wpabuf_free(wps_ie);
1410 		return 0;
1411 	}
1412 
1413 	if (wpabuf_len(wps_ie) > 0) {
1414 		int p2p_wildcard = 0;
1415 #ifdef CONFIG_P2P
1416 		if (elems.ssid && elems.ssid_len == P2P_WILDCARD_SSID_LEN &&
1417 		    os_memcmp(elems.ssid, P2P_WILDCARD_SSID,
1418 			      P2P_WILDCARD_SSID_LEN) == 0)
1419 			p2p_wildcard = 1;
1420 #endif /* CONFIG_P2P */
1421 		wps_registrar_probe_req_rx(hapd->wps->registrar, addr, wps_ie,
1422 					   p2p_wildcard);
1423 #ifdef CONFIG_WPS_UPNP
1424 		/* FIX: what exactly should be included in the WLANEvent?
1425 		 * WPS attributes? Full ProbeReq frame? */
1426 		if (!p2p_wildcard)
1427 			upnp_wps_device_send_wlan_event(
1428 				hapd->wps_upnp, addr,
1429 				UPNP_WPS_WLANEVENT_TYPE_PROBE, wps_ie);
1430 #endif /* CONFIG_WPS_UPNP */
1431 	}
1432 
1433 	wpabuf_free(wps_ie);
1434 
1435 	return 0;
1436 }
1437 
1438 
1439 #ifdef CONFIG_WPS_UPNP
1440 
1441 static int hostapd_rx_req_put_wlan_response(
1442 	void *priv, enum upnp_wps_wlanevent_type ev_type,
1443 	const u8 *mac_addr, const struct wpabuf *msg,
1444 	enum wps_msg_type msg_type)
1445 {
1446 	struct hostapd_data *hapd = priv;
1447 	struct sta_info *sta;
1448 	struct upnp_pending_message *p;
1449 
1450 	wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse ev_type=%d mac_addr="
1451 		   MACSTR, ev_type, MAC2STR(mac_addr));
1452 	wpa_hexdump(MSG_MSGDUMP, "WPS UPnP: PutWLANResponse NewMessage",
1453 		    wpabuf_head(msg), wpabuf_len(msg));
1454 	if (ev_type != UPNP_WPS_WLANEVENT_TYPE_EAP) {
1455 		wpa_printf(MSG_DEBUG, "WPS UPnP: Ignored unexpected "
1456 			   "PutWLANResponse WLANEventType %d", ev_type);
1457 		return -1;
1458 	}
1459 
1460 	/*
1461 	 * EAP response to ongoing to WPS Registration. Send it to EAP-WSC
1462 	 * server implementation for delivery to the peer.
1463 	 */
1464 
1465 	sta = ap_get_sta(hapd, mac_addr);
1466 #ifndef CONFIG_WPS_STRICT
1467 	if (!sta) {
1468 		/*
1469 		 * Workaround - Intel wsccmd uses bogus NewWLANEventMAC:
1470 		 * Pick STA that is in an ongoing WPS registration without
1471 		 * checking the MAC address.
1472 		 */
1473 		wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based "
1474 			   "on NewWLANEventMAC; try wildcard match");
1475 		for (sta = hapd->sta_list; sta; sta = sta->next) {
1476 			if (sta->eapol_sm && (sta->flags & WLAN_STA_WPS))
1477 				break;
1478 		}
1479 	}
1480 #endif /* CONFIG_WPS_STRICT */
1481 
1482 	if (!sta || !(sta->flags & WLAN_STA_WPS)) {
1483 		wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found");
1484 		return 0;
1485 	}
1486 
1487 	if (!sta->eapol_sm) {
1488 		/*
1489 		 * This can happen, e.g., if an ER sends an extra message after
1490 		 * the station has disassociated (but not fully
1491 		 * deauthenticated).
1492 		 */
1493 		wpa_printf(MSG_DEBUG, "WPS UPnP: Matching STA did not have EAPOL state machine initialized");
1494 		return 0;
1495 	}
1496 
1497 	p = os_zalloc(sizeof(*p));
1498 	if (p == NULL)
1499 		return -1;
1500 	os_memcpy(p->addr, sta->addr, ETH_ALEN);
1501 	p->msg = wpabuf_dup(msg);
1502 	p->type = msg_type;
1503 	p->next = hapd->wps->upnp_msgs;
1504 	hapd->wps->upnp_msgs = p;
1505 
1506 	return eapol_auth_eap_pending_cb(sta->eapol_sm, sta->eapol_sm->eap);
1507 }
1508 
1509 
1510 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
1511 				 struct wps_context *wps)
1512 {
1513 	struct upnp_wps_device_ctx *ctx;
1514 
1515 	if (!hapd->conf->upnp_iface)
1516 		return 0;
1517 	ctx = os_zalloc(sizeof(*ctx));
1518 	if (ctx == NULL)
1519 		return -1;
1520 
1521 	ctx->rx_req_put_wlan_response = hostapd_rx_req_put_wlan_response;
1522 	if (hapd->conf->ap_pin)
1523 		ctx->ap_pin = os_strdup(hapd->conf->ap_pin);
1524 
1525 	hapd->wps_upnp = upnp_wps_device_init(ctx, wps, hapd,
1526 					      hapd->conf->upnp_iface);
1527 	if (hapd->wps_upnp == NULL)
1528 		return -1;
1529 	wps->wps_upnp = hapd->wps_upnp;
1530 
1531 	return 0;
1532 }
1533 
1534 
1535 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd)
1536 {
1537 	upnp_wps_device_deinit(hapd->wps_upnp, hapd);
1538 }
1539 
1540 #endif /* CONFIG_WPS_UPNP */
1541 
1542 
1543 int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr,
1544 			    char *buf, size_t buflen)
1545 {
1546 	if (hapd->wps == NULL)
1547 		return 0;
1548 	return wps_registrar_get_info(hapd->wps->registrar, addr, buf, buflen);
1549 }
1550 
1551 
1552 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx)
1553 {
1554 	struct hostapd_data *hapd = eloop_data;
1555 	wpa_printf(MSG_DEBUG, "WPS: AP PIN timed out");
1556 	hostapd_wps_ap_pin_disable(hapd);
1557 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_PIN_DISABLED);
1558 }
1559 
1560 
1561 static void hostapd_wps_ap_pin_enable(struct hostapd_data *hapd, int timeout)
1562 {
1563 	wpa_printf(MSG_DEBUG, "WPS: Enabling AP PIN (timeout=%d)", timeout);
1564 	hapd->ap_pin_failures = 0;
1565 	hapd->ap_pin_failures_consecutive = 0;
1566 	hapd->conf->ap_setup_locked = 0;
1567 	if (hapd->wps->ap_setup_locked) {
1568 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
1569 		hapd->wps->ap_setup_locked = 0;
1570 		wps_registrar_update_ie(hapd->wps->registrar);
1571 	}
1572 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1573 	if (timeout > 0)
1574 		eloop_register_timeout(timeout, 0,
1575 				       hostapd_wps_ap_pin_timeout, hapd, NULL);
1576 }
1577 
1578 
1579 static int wps_ap_pin_disable(struct hostapd_data *hapd, void *ctx)
1580 {
1581 	os_free(hapd->conf->ap_pin);
1582 	hapd->conf->ap_pin = NULL;
1583 #ifdef CONFIG_WPS_UPNP
1584 	upnp_wps_set_ap_pin(hapd->wps_upnp, NULL);
1585 #endif /* CONFIG_WPS_UPNP */
1586 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1587 	return 0;
1588 }
1589 
1590 
1591 void hostapd_wps_ap_pin_disable(struct hostapd_data *hapd)
1592 {
1593 	wpa_printf(MSG_DEBUG, "WPS: Disabling AP PIN");
1594 	hostapd_wps_for_each(hapd, wps_ap_pin_disable, NULL);
1595 }
1596 
1597 
1598 struct wps_ap_pin_data {
1599 	char pin_txt[9];
1600 	int timeout;
1601 };
1602 
1603 
1604 static int wps_ap_pin_set(struct hostapd_data *hapd, void *ctx)
1605 {
1606 	struct wps_ap_pin_data *data = ctx;
1607 
1608 	if (!hapd->wps)
1609 		return 0;
1610 
1611 	os_free(hapd->conf->ap_pin);
1612 	hapd->conf->ap_pin = os_strdup(data->pin_txt);
1613 #ifdef CONFIG_WPS_UPNP
1614 	upnp_wps_set_ap_pin(hapd->wps_upnp, data->pin_txt);
1615 #endif /* CONFIG_WPS_UPNP */
1616 	hostapd_wps_ap_pin_enable(hapd, data->timeout);
1617 	return 0;
1618 }
1619 
1620 
1621 const char * hostapd_wps_ap_pin_random(struct hostapd_data *hapd, int timeout)
1622 {
1623 	unsigned int pin;
1624 	struct wps_ap_pin_data data;
1625 
1626 	if (wps_generate_pin(&pin) < 0)
1627 		return NULL;
1628 	os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%08u", pin);
1629 	data.timeout = timeout;
1630 	hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1631 	return hapd->conf->ap_pin;
1632 }
1633 
1634 
1635 const char * hostapd_wps_ap_pin_get(struct hostapd_data *hapd)
1636 {
1637 	return hapd->conf->ap_pin;
1638 }
1639 
1640 
1641 int hostapd_wps_ap_pin_set(struct hostapd_data *hapd, const char *pin,
1642 			   int timeout)
1643 {
1644 	struct wps_ap_pin_data data;
1645 	int ret;
1646 
1647 	ret = os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%s", pin);
1648 	if (os_snprintf_error(sizeof(data.pin_txt), ret))
1649 		return -1;
1650 	data.timeout = timeout;
1651 	return hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1652 }
1653 
1654 
1655 static int wps_update_ie(struct hostapd_data *hapd, void *ctx)
1656 {
1657 	if (hapd->wps)
1658 		wps_registrar_update_ie(hapd->wps->registrar);
1659 	return 0;
1660 }
1661 
1662 
1663 void hostapd_wps_update_ie(struct hostapd_data *hapd)
1664 {
1665 	hostapd_wps_for_each(hapd, wps_update_ie, NULL);
1666 }
1667 
1668 
1669 int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid,
1670 			  const char *auth, const char *encr, const char *key)
1671 {
1672 	struct wps_credential cred;
1673 	size_t len;
1674 
1675 	os_memset(&cred, 0, sizeof(cred));
1676 
1677 	len = os_strlen(ssid);
1678 	if ((len & 1) || len > 2 * sizeof(cred.ssid) ||
1679 	    hexstr2bin(ssid, cred.ssid, len / 2))
1680 		return -1;
1681 	cred.ssid_len = len / 2;
1682 
1683 	if (os_strncmp(auth, "OPEN", 4) == 0)
1684 		cred.auth_type = WPS_AUTH_OPEN;
1685 	else if (os_strncmp(auth, "WPAPSK", 6) == 0)
1686 		cred.auth_type = WPS_AUTH_WPAPSK;
1687 	else if (os_strncmp(auth, "WPA2PSK", 7) == 0)
1688 		cred.auth_type = WPS_AUTH_WPA2PSK;
1689 	else
1690 		return -1;
1691 
1692 	if (encr) {
1693 		if (os_strncmp(encr, "NONE", 4) == 0)
1694 			cred.encr_type = WPS_ENCR_NONE;
1695 		else if (os_strncmp(encr, "TKIP", 4) == 0)
1696 			cred.encr_type = WPS_ENCR_TKIP;
1697 		else if (os_strncmp(encr, "CCMP", 4) == 0)
1698 			cred.encr_type = WPS_ENCR_AES;
1699 		else
1700 			return -1;
1701 	} else
1702 		cred.encr_type = WPS_ENCR_NONE;
1703 
1704 	if (key) {
1705 		len = os_strlen(key);
1706 		if ((len & 1) || len > 2 * sizeof(cred.key) ||
1707 		    hexstr2bin(key, cred.key, len / 2))
1708 			return -1;
1709 		cred.key_len = len / 2;
1710 	}
1711 
1712 	return wps_registrar_config_ap(hapd->wps->registrar, &cred);
1713 }
1714 
1715 
1716 #ifdef CONFIG_WPS_NFC
1717 
1718 struct wps_nfc_password_token_data {
1719 	const u8 *oob_dev_pw;
1720 	size_t oob_dev_pw_len;
1721 	int added;
1722 };
1723 
1724 
1725 static int wps_add_nfc_password_token(struct hostapd_data *hapd, void *ctx)
1726 {
1727 	struct wps_nfc_password_token_data *data = ctx;
1728 	int ret;
1729 
1730 	if (hapd->wps == NULL)
1731 		return 0;
1732 	ret = wps_registrar_add_nfc_password_token(hapd->wps->registrar,
1733 						   data->oob_dev_pw,
1734 						   data->oob_dev_pw_len);
1735 	if (ret == 0)
1736 		data->added++;
1737 	return ret;
1738 }
1739 
1740 
1741 static int hostapd_wps_add_nfc_password_token(struct hostapd_data *hapd,
1742 					      struct wps_parse_attr *attr)
1743 {
1744 	struct wps_nfc_password_token_data data;
1745 
1746 	data.oob_dev_pw = attr->oob_dev_password;
1747 	data.oob_dev_pw_len = attr->oob_dev_password_len;
1748 	data.added = 0;
1749 	if (hostapd_wps_for_each(hapd, wps_add_nfc_password_token, &data) < 0)
1750 		return -1;
1751 	return data.added ? 0 : -1;
1752 }
1753 
1754 
1755 static int hostapd_wps_nfc_tag_process(struct hostapd_data *hapd,
1756 				       const struct wpabuf *wps)
1757 {
1758 	struct wps_parse_attr attr;
1759 
1760 	wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps);
1761 
1762 	if (wps_parse_msg(wps, &attr)) {
1763 		wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag");
1764 		return -1;
1765 	}
1766 
1767 	if (attr.oob_dev_password)
1768 		return hostapd_wps_add_nfc_password_token(hapd, &attr);
1769 
1770 	wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag");
1771 	return -1;
1772 }
1773 
1774 
1775 int hostapd_wps_nfc_tag_read(struct hostapd_data *hapd,
1776 			     const struct wpabuf *data)
1777 {
1778 	const struct wpabuf *wps = data;
1779 	struct wpabuf *tmp = NULL;
1780 	int ret;
1781 
1782 	if (wpabuf_len(data) < 4)
1783 		return -1;
1784 
1785 	if (*wpabuf_head_u8(data) != 0x10) {
1786 		/* Assume this contains full NDEF record */
1787 		tmp = ndef_parse_wifi(data);
1788 		if (tmp == NULL) {
1789 			wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF");
1790 			return -1;
1791 		}
1792 		wps = tmp;
1793 	}
1794 
1795 	ret = hostapd_wps_nfc_tag_process(hapd, wps);
1796 	wpabuf_free(tmp);
1797 	return ret;
1798 }
1799 
1800 
1801 struct wpabuf * hostapd_wps_nfc_config_token(struct hostapd_data *hapd,
1802 					     int ndef)
1803 {
1804 	struct wpabuf *ret;
1805 
1806 	if (hapd->wps == NULL)
1807 		return NULL;
1808 
1809 	ret = wps_get_oob_cred(hapd->wps, hostapd_wps_rf_band_cb(hapd),
1810 			       hapd->iconf->channel);
1811 	if (ndef && ret) {
1812 		struct wpabuf *tmp;
1813 		tmp = ndef_build_wifi(ret);
1814 		wpabuf_free(ret);
1815 		if (tmp == NULL)
1816 			return NULL;
1817 		ret = tmp;
1818 	}
1819 
1820 	return ret;
1821 }
1822 
1823 
1824 struct wpabuf * hostapd_wps_nfc_hs_cr(struct hostapd_data *hapd, int ndef)
1825 {
1826 	struct wpabuf *ret;
1827 
1828 	if (hapd->wps == NULL)
1829 		return NULL;
1830 
1831 	if (hapd->conf->wps_nfc_dh_pubkey == NULL) {
1832 		struct wps_context *wps = hapd->wps;
1833 		if (wps_nfc_gen_dh(&hapd->conf->wps_nfc_dh_pubkey,
1834 				   &hapd->conf->wps_nfc_dh_privkey) < 0)
1835 			return NULL;
1836 		hostapd_wps_nfc_clear(wps);
1837 		wps->ap_nfc_dev_pw_id = DEV_PW_NFC_CONNECTION_HANDOVER;
1838 		wps->ap_nfc_dh_pubkey =
1839 			wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
1840 		wps->ap_nfc_dh_privkey =
1841 			wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
1842 		if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey) {
1843 			hostapd_wps_nfc_clear(wps);
1844 			return NULL;
1845 		}
1846 	}
1847 
1848 	ret = wps_build_nfc_handover_sel(hapd->wps,
1849 					 hapd->conf->wps_nfc_dh_pubkey,
1850 					 hapd->own_addr, hapd->iface->freq);
1851 
1852 	if (ndef && ret) {
1853 		struct wpabuf *tmp;
1854 		tmp = ndef_build_wifi(ret);
1855 		wpabuf_free(ret);
1856 		if (tmp == NULL)
1857 			return NULL;
1858 		ret = tmp;
1859 	}
1860 
1861 	return ret;
1862 }
1863 
1864 
1865 int hostapd_wps_nfc_report_handover(struct hostapd_data *hapd,
1866 				    const struct wpabuf *req,
1867 				    const struct wpabuf *sel)
1868 {
1869 	struct wpabuf *wps;
1870 	int ret = -1;
1871 	u16 wsc_len;
1872 	const u8 *pos;
1873 	struct wpabuf msg;
1874 	struct wps_parse_attr attr;
1875 	u16 dev_pw_id;
1876 
1877 	/*
1878 	 * Enrollee/station is always initiator of the NFC connection handover,
1879 	 * so use the request message here to find Enrollee public key hash.
1880 	 */
1881 	wps = ndef_parse_wifi(req);
1882 	if (wps == NULL)
1883 		return -1;
1884 	wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
1885 		   "payload from NFC connection handover");
1886 	wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps);
1887 	if (wpabuf_len(wps) < 2) {
1888 		wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Request "
1889 			   "Message");
1890 		goto out;
1891 	}
1892 	pos = wpabuf_head(wps);
1893 	wsc_len = WPA_GET_BE16(pos);
1894 	if (wsc_len > wpabuf_len(wps) - 2) {
1895 		wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) "
1896 			   "in rt Wi-Fi Handover Request Message", wsc_len);
1897 		goto out;
1898 	}
1899 	pos += 2;
1900 
1901 	wpa_hexdump(MSG_DEBUG,
1902 		    "WPS: WSC attributes in Wi-Fi Handover Request Message",
1903 		    pos, wsc_len);
1904 	if (wsc_len < wpabuf_len(wps) - 2) {
1905 		wpa_hexdump(MSG_DEBUG,
1906 			    "WPS: Ignore extra data after WSC attributes",
1907 			    pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len);
1908 	}
1909 
1910 	wpabuf_set(&msg, pos, wsc_len);
1911 	ret = wps_parse_msg(&msg, &attr);
1912 	if (ret < 0) {
1913 		wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in "
1914 			   "Wi-Fi Handover Request Message");
1915 		goto out;
1916 	}
1917 
1918 	if (attr.oob_dev_password == NULL ||
1919 	    attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) {
1920 		wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password "
1921 			   "included in Wi-Fi Handover Request Message");
1922 		ret = -1;
1923 		goto out;
1924 	}
1925 
1926 	if (attr.uuid_e == NULL) {
1927 		wpa_printf(MSG_DEBUG, "WPS: No UUID-E included in Wi-Fi "
1928 			   "Handover Request Message");
1929 		ret = -1;
1930 		goto out;
1931 	}
1932 
1933 	wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", attr.uuid_e, WPS_UUID_LEN);
1934 
1935 	wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password",
1936 		    attr.oob_dev_password, attr.oob_dev_password_len);
1937 	dev_pw_id = WPA_GET_BE16(attr.oob_dev_password +
1938 				 WPS_OOB_PUBKEY_HASH_LEN);
1939 	if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) {
1940 		wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID "
1941 			   "%u in Wi-Fi Handover Request Message", dev_pw_id);
1942 		ret = -1;
1943 		goto out;
1944 	}
1945 	wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Public Key hash",
1946 		    attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN);
1947 
1948 	ret = wps_registrar_add_nfc_pw_token(hapd->wps->registrar,
1949 					     attr.oob_dev_password,
1950 					     DEV_PW_NFC_CONNECTION_HANDOVER,
1951 					     NULL, 0, 1);
1952 
1953 out:
1954 	wpabuf_free(wps);
1955 	return ret;
1956 }
1957 
1958 
1959 struct wpabuf * hostapd_wps_nfc_token_gen(struct hostapd_data *hapd, int ndef)
1960 {
1961 	if (hapd->conf->wps_nfc_pw_from_config) {
1962 		return wps_nfc_token_build(ndef,
1963 					   hapd->conf->wps_nfc_dev_pw_id,
1964 					   hapd->conf->wps_nfc_dh_pubkey,
1965 					   hapd->conf->wps_nfc_dev_pw);
1966 	}
1967 
1968 	return wps_nfc_token_gen(ndef, &hapd->conf->wps_nfc_dev_pw_id,
1969 				 &hapd->conf->wps_nfc_dh_pubkey,
1970 				 &hapd->conf->wps_nfc_dh_privkey,
1971 				 &hapd->conf->wps_nfc_dev_pw);
1972 }
1973 
1974 
1975 int hostapd_wps_nfc_token_enable(struct hostapd_data *hapd)
1976 {
1977 	struct wps_context *wps = hapd->wps;
1978 	struct wpabuf *pw;
1979 
1980 	if (wps == NULL)
1981 		return -1;
1982 
1983 	if (!hapd->conf->wps_nfc_dh_pubkey ||
1984 	    !hapd->conf->wps_nfc_dh_privkey ||
1985 	    !hapd->conf->wps_nfc_dev_pw ||
1986 	    !hapd->conf->wps_nfc_dev_pw_id)
1987 		return -1;
1988 
1989 	hostapd_wps_nfc_clear(wps);
1990 	wpa_printf(MSG_DEBUG,
1991 		   "WPS: Enable NFC Tag (Dev Pw Id %u) for AP interface %s (context %p)",
1992 		   hapd->conf->wps_nfc_dev_pw_id, hapd->conf->iface, wps);
1993 	wps->ap_nfc_dev_pw_id = hapd->conf->wps_nfc_dev_pw_id;
1994 	wps->ap_nfc_dh_pubkey = wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
1995 	wps->ap_nfc_dh_privkey = wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
1996 	pw = hapd->conf->wps_nfc_dev_pw;
1997 	wps->ap_nfc_dev_pw = wpabuf_alloc(
1998 		wpabuf_len(pw) * 2 + 1);
1999 	if (wps->ap_nfc_dev_pw) {
2000 		wpa_snprintf_hex_uppercase(
2001 			(char *) wpabuf_put(wps->ap_nfc_dev_pw,
2002 					    wpabuf_len(pw) * 2),
2003 			wpabuf_len(pw) * 2 + 1,
2004 			wpabuf_head(pw), wpabuf_len(pw));
2005 	}
2006 
2007 	if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey ||
2008 	    !wps->ap_nfc_dev_pw) {
2009 		hostapd_wps_nfc_clear(wps);
2010 		return -1;
2011 	}
2012 
2013 	return 0;
2014 }
2015 
2016 
2017 void hostapd_wps_nfc_token_disable(struct hostapd_data *hapd)
2018 {
2019 	wpa_printf(MSG_DEBUG, "WPS: Disable NFC token for AP interface %s",
2020 		   hapd->conf->iface);
2021 	hostapd_wps_nfc_clear(hapd->wps);
2022 }
2023 
2024 #endif /* CONFIG_WPS_NFC */
2025