1 /* 2 * EAP-WSC server for Wi-Fi Protected Setup 3 * Copyright (c) 2007-2008, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "eloop.h" 13 #include "eap_i.h" 14 #include "eap_common/eap_wsc_common.h" 15 #include "p2p/p2p.h" 16 #include "wps/wps.h" 17 18 19 struct eap_wsc_data { 20 enum { START, MESG, FRAG_ACK, WAIT_FRAG_ACK, DONE, FAIL } state; 21 int registrar; 22 struct wpabuf *in_buf; 23 struct wpabuf *out_buf; 24 enum wsc_op_code in_op_code, out_op_code; 25 size_t out_used; 26 size_t fragment_size; 27 struct wps_data *wps; 28 int ext_reg_timeout; 29 }; 30 31 32 #ifndef CONFIG_NO_STDOUT_DEBUG 33 static const char * eap_wsc_state_txt(int state) 34 { 35 switch (state) { 36 case START: 37 return "START"; 38 case MESG: 39 return "MESG"; 40 case FRAG_ACK: 41 return "FRAG_ACK"; 42 case WAIT_FRAG_ACK: 43 return "WAIT_FRAG_ACK"; 44 case DONE: 45 return "DONE"; 46 case FAIL: 47 return "FAIL"; 48 default: 49 return "?"; 50 } 51 } 52 #endif /* CONFIG_NO_STDOUT_DEBUG */ 53 54 55 static void eap_wsc_state(struct eap_wsc_data *data, int state) 56 { 57 wpa_printf(MSG_DEBUG, "EAP-WSC: %s -> %s", 58 eap_wsc_state_txt(data->state), 59 eap_wsc_state_txt(state)); 60 data->state = state; 61 } 62 63 64 static void eap_wsc_ext_reg_timeout(void *eloop_ctx, void *timeout_ctx) 65 { 66 struct eap_sm *sm = eloop_ctx; 67 struct eap_wsc_data *data = timeout_ctx; 68 69 if (sm->method_pending != METHOD_PENDING_WAIT) 70 return; 71 72 wpa_printf(MSG_DEBUG, "EAP-WSC: Timeout while waiting for an External " 73 "Registrar"); 74 data->ext_reg_timeout = 1; 75 eap_sm_pending_cb(sm); 76 } 77 78 79 static void * eap_wsc_init(struct eap_sm *sm) 80 { 81 struct eap_wsc_data *data; 82 int registrar; 83 struct wps_config cfg; 84 85 if (sm->identity && sm->identity_len == WSC_ID_REGISTRAR_LEN && 86 os_memcmp(sm->identity, WSC_ID_REGISTRAR, WSC_ID_REGISTRAR_LEN) == 87 0) 88 registrar = 0; /* Supplicant is Registrar */ 89 else if (sm->identity && sm->identity_len == WSC_ID_ENROLLEE_LEN && 90 os_memcmp(sm->identity, WSC_ID_ENROLLEE, WSC_ID_ENROLLEE_LEN) 91 == 0) 92 registrar = 1; /* Supplicant is Enrollee */ 93 else { 94 wpa_hexdump_ascii(MSG_INFO, "EAP-WSC: Unexpected identity", 95 sm->identity, sm->identity_len); 96 return NULL; 97 } 98 99 data = os_zalloc(sizeof(*data)); 100 if (data == NULL) 101 return NULL; 102 data->state = registrar ? START : MESG; 103 data->registrar = registrar; 104 105 os_memset(&cfg, 0, sizeof(cfg)); 106 cfg.wps = sm->cfg->wps; 107 cfg.registrar = registrar; 108 if (registrar) { 109 if (!sm->cfg->wps || !sm->cfg->wps->registrar) { 110 wpa_printf(MSG_INFO, "EAP-WSC: WPS Registrar not " 111 "initialized"); 112 os_free(data); 113 return NULL; 114 } 115 } else { 116 if (sm->user == NULL || sm->user->password == NULL) { 117 /* 118 * In theory, this should not really be needed, but 119 * Windows 7 uses Registrar mode to probe AP's WPS 120 * capabilities before trying to use Enrollee and fails 121 * if the AP does not allow that probing to happen.. 122 */ 123 wpa_printf(MSG_DEBUG, "EAP-WSC: No AP PIN (password) " 124 "configured for Enrollee functionality - " 125 "allow for probing capabilities (M1)"); 126 } else { 127 cfg.pin = sm->user->password; 128 cfg.pin_len = sm->user->password_len; 129 } 130 } 131 cfg.assoc_wps_ie = sm->assoc_wps_ie; 132 cfg.peer_addr = sm->peer_addr; 133 #ifdef CONFIG_P2P 134 if (sm->assoc_p2p_ie) { 135 if (!sm->cfg->wps->use_passphrase) { 136 wpa_printf(MSG_DEBUG, 137 "EAP-WSC: Prefer PSK format for non-6 GHz P2P client"); 138 cfg.use_psk_key = 1; 139 } 140 cfg.p2p_dev_addr = p2p_get_go_dev_addr(sm->assoc_p2p_ie); 141 } 142 #endif /* CONFIG_P2P */ 143 cfg.pbc_in_m1 = sm->cfg->pbc_in_m1; 144 data->wps = wps_init(&cfg); 145 if (data->wps == NULL) { 146 os_free(data); 147 return NULL; 148 } 149 data->fragment_size = sm->cfg->fragment_size > 0 ? 150 sm->cfg->fragment_size : WSC_FRAGMENT_SIZE; 151 152 return data; 153 } 154 155 156 static void eap_wsc_reset(struct eap_sm *sm, void *priv) 157 { 158 struct eap_wsc_data *data = priv; 159 eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data); 160 wpabuf_free(data->in_buf); 161 wpabuf_free(data->out_buf); 162 wps_deinit(data->wps); 163 os_free(data); 164 } 165 166 167 static struct wpabuf * eap_wsc_build_start(struct eap_sm *sm, 168 struct eap_wsc_data *data, u8 id) 169 { 170 struct wpabuf *req; 171 172 req = eap_msg_alloc(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, 2, 173 EAP_CODE_REQUEST, id); 174 if (req == NULL) { 175 wpa_printf(MSG_ERROR, "EAP-WSC: Failed to allocate memory for " 176 "request"); 177 return NULL; 178 } 179 180 wpa_printf(MSG_DEBUG, "EAP-WSC: Send WSC/Start"); 181 wpabuf_put_u8(req, WSC_Start); /* Op-Code */ 182 wpabuf_put_u8(req, 0); /* Flags */ 183 184 return req; 185 } 186 187 188 static struct wpabuf * eap_wsc_build_msg(struct eap_wsc_data *data, u8 id) 189 { 190 struct wpabuf *req; 191 u8 flags; 192 size_t send_len, plen; 193 194 flags = 0; 195 send_len = wpabuf_len(data->out_buf) - data->out_used; 196 if (2 + send_len > data->fragment_size) { 197 send_len = data->fragment_size - 2; 198 flags |= WSC_FLAGS_MF; 199 if (data->out_used == 0) { 200 flags |= WSC_FLAGS_LF; 201 send_len -= 2; 202 } 203 } 204 plen = 2 + send_len; 205 if (flags & WSC_FLAGS_LF) 206 plen += 2; 207 req = eap_msg_alloc(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, plen, 208 EAP_CODE_REQUEST, id); 209 if (req == NULL) { 210 wpa_printf(MSG_ERROR, "EAP-WSC: Failed to allocate memory for " 211 "request"); 212 return NULL; 213 } 214 215 wpabuf_put_u8(req, data->out_op_code); /* Op-Code */ 216 wpabuf_put_u8(req, flags); /* Flags */ 217 if (flags & WSC_FLAGS_LF) 218 wpabuf_put_be16(req, wpabuf_len(data->out_buf)); 219 220 wpabuf_put_data(req, wpabuf_head_u8(data->out_buf) + data->out_used, 221 send_len); 222 data->out_used += send_len; 223 224 if (data->out_used == wpabuf_len(data->out_buf)) { 225 wpa_printf(MSG_DEBUG, "EAP-WSC: Sending out %lu bytes " 226 "(message sent completely)", 227 (unsigned long) send_len); 228 wpabuf_free(data->out_buf); 229 data->out_buf = NULL; 230 data->out_used = 0; 231 eap_wsc_state(data, MESG); 232 } else { 233 wpa_printf(MSG_DEBUG, "EAP-WSC: Sending out %lu bytes " 234 "(%lu more to send)", (unsigned long) send_len, 235 (unsigned long) wpabuf_len(data->out_buf) - 236 data->out_used); 237 eap_wsc_state(data, WAIT_FRAG_ACK); 238 } 239 240 return req; 241 } 242 243 244 static struct wpabuf * eap_wsc_buildReq(struct eap_sm *sm, void *priv, u8 id) 245 { 246 struct eap_wsc_data *data = priv; 247 248 switch (data->state) { 249 case START: 250 return eap_wsc_build_start(sm, data, id); 251 case MESG: 252 if (data->out_buf == NULL) { 253 data->out_buf = wps_get_msg(data->wps, 254 &data->out_op_code); 255 if (data->out_buf == NULL) { 256 wpa_printf(MSG_DEBUG, "EAP-WSC: Failed to " 257 "receive message from WPS"); 258 return NULL; 259 } 260 data->out_used = 0; 261 } 262 /* fall through */ 263 case WAIT_FRAG_ACK: 264 return eap_wsc_build_msg(data, id); 265 case FRAG_ACK: 266 return eap_wsc_build_frag_ack(id, EAP_CODE_REQUEST); 267 default: 268 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected state %d in " 269 "buildReq", data->state); 270 return NULL; 271 } 272 } 273 274 275 static bool eap_wsc_check(struct eap_sm *sm, void *priv, 276 struct wpabuf *respData) 277 { 278 const u8 *pos; 279 size_t len; 280 281 pos = eap_hdr_validate(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, 282 respData, &len); 283 if (pos == NULL || len < 2) { 284 wpa_printf(MSG_INFO, "EAP-WSC: Invalid frame"); 285 return true; 286 } 287 288 return false; 289 } 290 291 292 static int eap_wsc_process_cont(struct eap_wsc_data *data, 293 const u8 *buf, size_t len, u8 op_code) 294 { 295 /* Process continuation of a pending message */ 296 if (op_code != data->in_op_code) { 297 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d in " 298 "fragment (expected %d)", 299 op_code, data->in_op_code); 300 eap_wsc_state(data, FAIL); 301 return -1; 302 } 303 304 if (len > wpabuf_tailroom(data->in_buf)) { 305 wpa_printf(MSG_DEBUG, "EAP-WSC: Fragment overflow"); 306 eap_wsc_state(data, FAIL); 307 return -1; 308 } 309 310 wpabuf_put_data(data->in_buf, buf, len); 311 wpa_printf(MSG_DEBUG, "EAP-WSC: Received %lu bytes, waiting for %lu " 312 "bytes more", (unsigned long) len, 313 (unsigned long) wpabuf_tailroom(data->in_buf)); 314 315 return 0; 316 } 317 318 319 static int eap_wsc_process_fragment(struct eap_wsc_data *data, 320 u8 flags, u8 op_code, u16 message_length, 321 const u8 *buf, size_t len) 322 { 323 /* Process a fragment that is not the last one of the message */ 324 if (data->in_buf == NULL && !(flags & WSC_FLAGS_LF)) { 325 wpa_printf(MSG_DEBUG, "EAP-WSC: No Message Length " 326 "field in a fragmented packet"); 327 return -1; 328 } 329 330 if (data->in_buf == NULL) { 331 /* First fragment of the message */ 332 data->in_buf = wpabuf_alloc(message_length); 333 if (data->in_buf == NULL) { 334 wpa_printf(MSG_DEBUG, "EAP-WSC: No memory for " 335 "message"); 336 return -1; 337 } 338 data->in_op_code = op_code; 339 wpabuf_put_data(data->in_buf, buf, len); 340 wpa_printf(MSG_DEBUG, "EAP-WSC: Received %lu bytes in " 341 "first fragment, waiting for %lu bytes more", 342 (unsigned long) len, 343 (unsigned long) wpabuf_tailroom(data->in_buf)); 344 } 345 346 return 0; 347 } 348 349 350 static void eap_wsc_process(struct eap_sm *sm, void *priv, 351 struct wpabuf *respData) 352 { 353 struct eap_wsc_data *data = priv; 354 const u8 *start, *pos, *end; 355 size_t len; 356 u8 op_code, flags; 357 u16 message_length = 0; 358 enum wps_process_res res; 359 struct wpabuf tmpbuf; 360 361 eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data); 362 if (data->ext_reg_timeout) { 363 eap_wsc_state(data, FAIL); 364 return; 365 } 366 367 pos = eap_hdr_validate(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, 368 respData, &len); 369 if (pos == NULL || len < 2) 370 return; /* Should not happen; message already verified */ 371 372 start = pos; 373 end = start + len; 374 375 op_code = *pos++; 376 flags = *pos++; 377 if (flags & WSC_FLAGS_LF) { 378 if (end - pos < 2) { 379 wpa_printf(MSG_DEBUG, "EAP-WSC: Message underflow"); 380 return; 381 } 382 message_length = WPA_GET_BE16(pos); 383 pos += 2; 384 385 if (message_length < end - pos || message_length > 50000) { 386 wpa_printf(MSG_DEBUG, "EAP-WSC: Invalid Message " 387 "Length"); 388 return; 389 } 390 } 391 392 wpa_printf(MSG_DEBUG, "EAP-WSC: Received packet: Op-Code %d " 393 "Flags 0x%x Message Length %d", 394 op_code, flags, message_length); 395 396 if (data->state == WAIT_FRAG_ACK) { 397 if (op_code != WSC_FRAG_ACK) { 398 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d " 399 "in WAIT_FRAG_ACK state", op_code); 400 eap_wsc_state(data, FAIL); 401 return; 402 } 403 wpa_printf(MSG_DEBUG, "EAP-WSC: Fragment acknowledged"); 404 eap_wsc_state(data, MESG); 405 return; 406 } 407 408 if (op_code != WSC_ACK && op_code != WSC_NACK && op_code != WSC_MSG && 409 op_code != WSC_Done) { 410 wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d", 411 op_code); 412 eap_wsc_state(data, FAIL); 413 return; 414 } 415 416 if (data->in_buf && 417 eap_wsc_process_cont(data, pos, end - pos, op_code) < 0) { 418 eap_wsc_state(data, FAIL); 419 return; 420 } 421 422 if (flags & WSC_FLAGS_MF) { 423 if (eap_wsc_process_fragment(data, flags, op_code, 424 message_length, pos, end - pos) < 425 0) 426 eap_wsc_state(data, FAIL); 427 else 428 eap_wsc_state(data, FRAG_ACK); 429 return; 430 } 431 432 if (data->in_buf == NULL) { 433 /* Wrap unfragmented messages as wpabuf without extra copy */ 434 wpabuf_set(&tmpbuf, pos, end - pos); 435 data->in_buf = &tmpbuf; 436 } 437 438 res = wps_process_msg(data->wps, op_code, data->in_buf); 439 switch (res) { 440 case WPS_DONE: 441 wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing completed " 442 "successfully - report EAP failure"); 443 eap_wsc_state(data, FAIL); 444 break; 445 case WPS_CONTINUE: 446 eap_wsc_state(data, MESG); 447 break; 448 case WPS_FAILURE: 449 wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing failed"); 450 eap_wsc_state(data, FAIL); 451 break; 452 case WPS_PENDING: 453 eap_wsc_state(data, MESG); 454 sm->method_pending = METHOD_PENDING_WAIT; 455 eloop_cancel_timeout(eap_wsc_ext_reg_timeout, sm, data); 456 eloop_register_timeout(5, 0, eap_wsc_ext_reg_timeout, 457 sm, data); 458 break; 459 } 460 461 if (data->in_buf != &tmpbuf) 462 wpabuf_free(data->in_buf); 463 data->in_buf = NULL; 464 } 465 466 467 static bool eap_wsc_isDone(struct eap_sm *sm, void *priv) 468 { 469 struct eap_wsc_data *data = priv; 470 return data->state == FAIL; 471 } 472 473 474 static bool eap_wsc_isSuccess(struct eap_sm *sm, void *priv) 475 { 476 /* EAP-WSC will always result in EAP-Failure */ 477 return false; 478 } 479 480 481 static int eap_wsc_getTimeout(struct eap_sm *sm, void *priv) 482 { 483 /* Recommended retransmit times: retransmit timeout 5 seconds, 484 * per-message timeout 15 seconds, i.e., 3 tries. */ 485 sm->MaxRetrans = 2; /* total 3 attempts */ 486 return 5; 487 } 488 489 490 int eap_server_wsc_register(void) 491 { 492 struct eap_method *eap; 493 494 eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 495 EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, 496 "WSC"); 497 if (eap == NULL) 498 return -1; 499 500 eap->init = eap_wsc_init; 501 eap->reset = eap_wsc_reset; 502 eap->buildReq = eap_wsc_buildReq; 503 eap->check = eap_wsc_check; 504 eap->process = eap_wsc_process; 505 eap->isDone = eap_wsc_isDone; 506 eap->isSuccess = eap_wsc_isSuccess; 507 eap->getTimeout = eap_wsc_getTimeout; 508 509 return eap_server_method_register(eap); 510 } 511