• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Wi-Fi Protected Setup
3  * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/dh_group5.h"
13 #include "common/ieee802_11_defs.h"
14 #include "wps_i.h"
15 #include "wps_dev_attr.h"
16 
17 
18 #ifdef CONFIG_WPS_TESTING
19 int wps_version_number = 0x20;
20 int wps_testing_stub_cred = 0;
21 int wps_corrupt_pkhash = 0;
22 int wps_force_auth_types_in_use = 0;
23 u16 wps_force_auth_types = 0;
24 int wps_force_encr_types_in_use = 0;
25 u16 wps_force_encr_types = 0;
26 #endif /* CONFIG_WPS_TESTING */
27 
28 /**
29  * wps_init - Initialize WPS Registration protocol data
30  * @cfg: WPS configuration
31  * Returns: Pointer to allocated data or %NULL on failure
32  *
33  * This function is used to initialize WPS data for a registration protocol
34  * instance (i.e., each run of registration protocol as a Registrar of
35  * Enrollee. The caller is responsible for freeing this data after the
36  * registration run has been completed by calling wps_deinit().
37  */
wps_init(const struct wps_config * cfg)38 struct wps_data * wps_init(const struct wps_config *cfg)
39 {
40 	struct wps_data *data = os_zalloc(sizeof(*data));
41 	if (data == NULL)
42 		return NULL;
43 	data->wps = cfg->wps;
44 	data->registrar = cfg->registrar;
45 	if (cfg->registrar) {
46 		os_memcpy(data->uuid_r, cfg->wps->uuid, WPS_UUID_LEN);
47 	} else {
48 		os_memcpy(data->mac_addr_e, cfg->wps->dev.mac_addr, ETH_ALEN);
49 		os_memcpy(data->uuid_e, cfg->wps->uuid, WPS_UUID_LEN);
50 	}
51 	if (cfg->pin) {
52 		data->dev_pw_id = cfg->dev_pw_id;
53 		data->dev_password = os_memdup(cfg->pin, cfg->pin_len);
54 		if (data->dev_password == NULL) {
55 			os_free(data);
56 			return NULL;
57 		}
58 		data->dev_password_len = cfg->pin_len;
59 		wpa_hexdump_key(MSG_DEBUG, "WPS: AP PIN dev_password",
60 				data->dev_password, data->dev_password_len);
61 	}
62 
63 #ifdef CONFIG_WPS_NFC
64 	if (cfg->pin == NULL &&
65 	    cfg->dev_pw_id == DEV_PW_NFC_CONNECTION_HANDOVER)
66 		data->dev_pw_id = cfg->dev_pw_id;
67 
68 	if (cfg->wps->ap && !cfg->registrar && cfg->wps->ap_nfc_dev_pw_id) {
69 		/* Keep AP PIN as alternative Device Password */
70 		data->alt_dev_pw_id = data->dev_pw_id;
71 		data->alt_dev_password = data->dev_password;
72 		data->alt_dev_password_len = data->dev_password_len;
73 
74 		data->dev_pw_id = cfg->wps->ap_nfc_dev_pw_id;
75 		data->dev_password =
76 			os_memdup(wpabuf_head(cfg->wps->ap_nfc_dev_pw),
77 				  wpabuf_len(cfg->wps->ap_nfc_dev_pw));
78 		if (data->dev_password == NULL) {
79 			os_free(data);
80 			return NULL;
81 		}
82 		data->dev_password_len = wpabuf_len(cfg->wps->ap_nfc_dev_pw);
83 		wpa_hexdump_key(MSG_DEBUG, "WPS: NFC dev_password",
84 			    data->dev_password, data->dev_password_len);
85 	}
86 #endif /* CONFIG_WPS_NFC */
87 
88 	data->pbc = cfg->pbc;
89 	if (cfg->pbc) {
90 		/* Use special PIN '00000000' for PBC */
91 		data->dev_pw_id = DEV_PW_PUSHBUTTON;
92 		bin_clear_free(data->dev_password, data->dev_password_len);
93 		data->dev_password = (u8 *) os_strdup("00000000");
94 		if (data->dev_password == NULL) {
95 			os_free(data);
96 			return NULL;
97 		}
98 		data->dev_password_len = 8;
99 	}
100 
101 	data->state = data->registrar ? RECV_M1 : SEND_M1;
102 
103 	if (cfg->assoc_wps_ie) {
104 		struct wps_parse_attr attr;
105 		wpa_hexdump_buf(MSG_DEBUG, "WPS: WPS IE from (Re)AssocReq",
106 				cfg->assoc_wps_ie);
107 		if (wps_parse_msg(cfg->assoc_wps_ie, &attr) < 0) {
108 			wpa_printf(MSG_DEBUG, "WPS: Failed to parse WPS IE "
109 				   "from (Re)AssocReq");
110 		} else if (attr.request_type == NULL) {
111 			wpa_printf(MSG_DEBUG, "WPS: No Request Type attribute "
112 				   "in (Re)AssocReq WPS IE");
113 		} else {
114 			wpa_printf(MSG_DEBUG, "WPS: Request Type (from WPS IE "
115 				   "in (Re)AssocReq WPS IE): %d",
116 				   *attr.request_type);
117 			data->request_type = *attr.request_type;
118 		}
119 	}
120 
121 	if (cfg->new_ap_settings) {
122 		data->new_ap_settings =
123 			os_memdup(cfg->new_ap_settings,
124 				  sizeof(*data->new_ap_settings));
125 		if (data->new_ap_settings == NULL) {
126 			bin_clear_free(data->dev_password,
127 				       data->dev_password_len);
128 			os_free(data);
129 			return NULL;
130 		}
131 	}
132 
133 	if (cfg->peer_addr)
134 		os_memcpy(data->peer_dev.mac_addr, cfg->peer_addr, ETH_ALEN);
135 	if (cfg->p2p_dev_addr)
136 		os_memcpy(data->p2p_dev_addr, cfg->p2p_dev_addr, ETH_ALEN);
137 
138 	data->use_psk_key = cfg->use_psk_key;
139 	data->pbc_in_m1 = cfg->pbc_in_m1;
140 
141 	if (cfg->peer_pubkey_hash) {
142 		os_memcpy(data->peer_pubkey_hash, cfg->peer_pubkey_hash,
143 			  WPS_OOB_PUBKEY_HASH_LEN);
144 		data->peer_pubkey_hash_set = 1;
145 	}
146 
147 	data->multi_ap_backhaul_sta = cfg->multi_ap_backhaul_sta;
148 	data->multi_ap_profile = cfg->multi_ap_profile;
149 
150 	return data;
151 }
152 
153 
154 /**
155  * wps_deinit - Deinitialize WPS Registration protocol data
156  * @data: WPS Registration protocol data from wps_init()
157  */
wps_deinit(struct wps_data * data)158 void wps_deinit(struct wps_data *data)
159 {
160 #ifdef CONFIG_WPS_NFC
161 	if (data->registrar && data->nfc_pw_token)
162 		wps_registrar_remove_nfc_pw_token(data->wps->registrar,
163 						  data->nfc_pw_token);
164 #endif /* CONFIG_WPS_NFC */
165 
166 	if (data->wps_pin_revealed) {
167 		wpa_printf(MSG_DEBUG, "WPS: Full PIN information revealed and "
168 			   "negotiation failed");
169 		if (data->registrar)
170 			wps_registrar_invalidate_pin(data->wps->registrar,
171 						     data->uuid_e);
172 	} else if (data->registrar)
173 		wps_registrar_unlock_pin(data->wps->registrar, data->uuid_e);
174 
175 	wpabuf_clear_free(data->dh_privkey);
176 	wpabuf_free(data->dh_pubkey_e);
177 	wpabuf_free(data->dh_pubkey_r);
178 	wpabuf_free(data->last_msg);
179 	bin_clear_free(data->dev_password, data->dev_password_len);
180 	bin_clear_free(data->alt_dev_password, data->alt_dev_password_len);
181 	bin_clear_free(data->new_psk, data->new_psk_len);
182 	wps_device_data_free(&data->peer_dev);
183 	bin_clear_free(data->new_ap_settings, sizeof(*data->new_ap_settings));
184 	dh5_free(data->dh_ctx);
185 	os_free(data);
186 }
187 
188 #ifdef HARMONY_P2P_CONNECTIVITY_PATCH
wps_check_msg_done(struct wps_data * wps)189 int wps_check_msg_done(struct wps_data *wps)
190 {
191 	wpa_printf(MSG_DEBUG, "WPS: State=%d\n", wps->state);
192 	return (wps->state == WPS_FINISHED);
193 }
194 #endif
195 
196 /**
197  * wps_process_msg - Process a WPS message
198  * @wps: WPS Registration protocol data from wps_init()
199  * @op_code: Message OP Code
200  * @msg: Message data
201  * Returns: Processing result
202  *
203  * This function is used to process WPS messages with OP Codes WSC_ACK,
204  * WSC_NACK, WSC_MSG, and WSC_Done. The caller (e.g., EAP server/peer) is
205  * responsible for reassembling the messages before calling this function.
206  * Response to this message is built by calling wps_get_msg().
207  */
wps_process_msg(struct wps_data * wps,enum wsc_op_code op_code,const struct wpabuf * msg)208 enum wps_process_res wps_process_msg(struct wps_data *wps,
209 				     enum wsc_op_code op_code,
210 				     const struct wpabuf *msg)
211 {
212 	if (wps->registrar)
213 		return wps_registrar_process_msg(wps, op_code, msg);
214 	else
215 		return wps_enrollee_process_msg(wps, op_code, msg);
216 }
217 
218 
219 /**
220  * wps_get_msg - Build a WPS message
221  * @wps: WPS Registration protocol data from wps_init()
222  * @op_code: Buffer for returning message OP Code
223  * Returns: The generated WPS message or %NULL on failure
224  *
225  * This function is used to build a response to a message processed by calling
226  * wps_process_msg(). The caller is responsible for freeing the buffer.
227  */
wps_get_msg(struct wps_data * wps,enum wsc_op_code * op_code)228 struct wpabuf * wps_get_msg(struct wps_data *wps, enum wsc_op_code *op_code)
229 {
230 	if (wps->registrar)
231 		return wps_registrar_get_msg(wps, op_code);
232 	else
233 		return wps_enrollee_get_msg(wps, op_code);
234 }
235 
236 
237 /**
238  * wps_is_selected_pbc_registrar - Check whether WPS IE indicates active PBC
239  * @msg: WPS IE contents from Beacon or Probe Response frame
240  * Returns: 1 if PBC Registrar is active, 0 if not
241  */
wps_is_selected_pbc_registrar(const struct wpabuf * msg)242 int wps_is_selected_pbc_registrar(const struct wpabuf *msg)
243 {
244 	struct wps_parse_attr attr;
245 
246 	/*
247 	 * In theory, this could also verify that attr.sel_reg_config_methods
248 	 * includes WPS_CONFIG_PUSHBUTTON, but some deployed AP implementations
249 	 * do not set Selected Registrar Config Methods attribute properly, so
250 	 * it is safer to just use Device Password ID here.
251 	 */
252 
253 	if (wps_parse_msg(msg, &attr) < 0 ||
254 	    !attr.selected_registrar || *attr.selected_registrar == 0 ||
255 	    !attr.dev_password_id ||
256 	    WPA_GET_BE16(attr.dev_password_id) != DEV_PW_PUSHBUTTON)
257 		return 0;
258 
259 #ifdef CONFIG_WPS_STRICT
260 	if (!attr.sel_reg_config_methods ||
261 	    !(WPA_GET_BE16(attr.sel_reg_config_methods) &
262 	      WPS_CONFIG_PUSHBUTTON))
263 		return 0;
264 #endif /* CONFIG_WPS_STRICT */
265 
266 	return 1;
267 }
268 
269 
is_selected_pin_registrar(struct wps_parse_attr * attr)270 static int is_selected_pin_registrar(struct wps_parse_attr *attr)
271 {
272 	/*
273 	 * In theory, this could also verify that attr.sel_reg_config_methods
274 	 * includes WPS_CONFIG_LABEL, WPS_CONFIG_DISPLAY, or WPS_CONFIG_KEYPAD,
275 	 * but some deployed AP implementations do not set Selected Registrar
276 	 * Config Methods attribute properly, so it is safer to just use
277 	 * Device Password ID here.
278 	 */
279 
280 	if (!attr->selected_registrar || *attr->selected_registrar == 0)
281 		return 0;
282 
283 	if (attr->dev_password_id != NULL &&
284 	    WPA_GET_BE16(attr->dev_password_id) == DEV_PW_PUSHBUTTON)
285 		return 0;
286 
287 #ifdef CONFIG_WPS_STRICT
288 	if (!attr->sel_reg_config_methods ||
289 	    !(WPA_GET_BE16(attr->sel_reg_config_methods) &
290 	      (WPS_CONFIG_LABEL | WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD)))
291 		return 0;
292 #endif /* CONFIG_WPS_STRICT */
293 
294 	return 1;
295 }
296 
297 
298 /**
299  * wps_is_selected_pin_registrar - Check whether WPS IE indicates active PIN
300  * @msg: WPS IE contents from Beacon or Probe Response frame
301  * Returns: 1 if PIN Registrar is active, 0 if not
302  */
wps_is_selected_pin_registrar(const struct wpabuf * msg)303 int wps_is_selected_pin_registrar(const struct wpabuf *msg)
304 {
305 	struct wps_parse_attr attr;
306 
307 	if (wps_parse_msg(msg, &attr) < 0)
308 		return 0;
309 
310 	return is_selected_pin_registrar(&attr);
311 }
312 
313 
314 /**
315  * wps_is_addr_authorized - Check whether WPS IE authorizes MAC address
316  * @msg: WPS IE contents from Beacon or Probe Response frame
317  * @addr: MAC address to search for
318  * @ver1_compat: Whether to use version 1 compatibility mode
319  * Returns: 2 if the specified address is explicit authorized, 1 if address is
320  * authorized (broadcast), 0 if not
321  */
wps_is_addr_authorized(const struct wpabuf * msg,const u8 * addr,int ver1_compat)322 int wps_is_addr_authorized(const struct wpabuf *msg, const u8 *addr,
323 			   int ver1_compat)
324 {
325 	struct wps_parse_attr attr;
326 	unsigned int i;
327 	const u8 *pos;
328 	const u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
329 
330 	if (wps_parse_msg(msg, &attr) < 0)
331 		return 0;
332 
333 	if (!attr.version2 && ver1_compat) {
334 		/*
335 		 * Version 1.0 AP - AuthorizedMACs not used, so revert back to
336 		 * old mechanism of using SelectedRegistrar.
337 		 */
338 		return is_selected_pin_registrar(&attr);
339 	}
340 
341 	if (!attr.authorized_macs)
342 		return 0;
343 
344 	pos = attr.authorized_macs;
345 	for (i = 0; i < attr.authorized_macs_len / ETH_ALEN; i++) {
346 		if (ether_addr_equal(pos, addr))
347 			return 2;
348 		if (ether_addr_equal(pos, bcast))
349 			return 1;
350 		pos += ETH_ALEN;
351 	}
352 
353 	return 0;
354 }
355 
356 
357 /**
358  * wps_ap_priority_compar - Prioritize WPS IE from two APs
359  * @wps_a: WPS IE contents from Beacon or Probe Response frame
360  * @wps_b: WPS IE contents from Beacon or Probe Response frame
361  * Returns: 1 if wps_b is considered more likely selection for WPS
362  * provisioning, -1 if wps_a is considered more like, or 0 if no preference
363  */
wps_ap_priority_compar(const struct wpabuf * wps_a,const struct wpabuf * wps_b)364 int wps_ap_priority_compar(const struct wpabuf *wps_a,
365 			   const struct wpabuf *wps_b)
366 {
367 	struct wps_parse_attr attr;
368 	int sel_a, sel_b;
369 
370 	if (wps_a == NULL || wps_parse_msg(wps_a, &attr) < 0)
371 		return 1;
372 	sel_a = attr.selected_registrar && *attr.selected_registrar != 0;
373 
374 	if (wps_b == NULL || wps_parse_msg(wps_b, &attr) < 0)
375 		return -1;
376 	sel_b = attr.selected_registrar && *attr.selected_registrar != 0;
377 
378 	if (sel_a && !sel_b)
379 		return -1;
380 	if (!sel_a && sel_b)
381 		return 1;
382 
383 	return 0;
384 }
385 
386 
387 /**
388  * wps_get_uuid_e - Get UUID-E from WPS IE
389  * @msg: WPS IE contents from Beacon or Probe Response frame
390  * Returns: Pointer to UUID-E or %NULL if not included
391  *
392  * The returned pointer is to the msg contents and it remains valid only as
393  * long as the msg buffer is valid.
394  */
wps_get_uuid_e(const struct wpabuf * msg)395 const u8 * wps_get_uuid_e(const struct wpabuf *msg)
396 {
397 	struct wps_parse_attr attr;
398 
399 	if (wps_parse_msg(msg, &attr) < 0)
400 		return NULL;
401 	return attr.uuid_e;
402 }
403 
404 
405 /**
406  * wps_is_20 - Check whether WPS attributes claim support for WPS 2.0
407  */
wps_is_20(const struct wpabuf * msg)408 int wps_is_20(const struct wpabuf *msg)
409 {
410 	struct wps_parse_attr attr;
411 
412 	if (msg == NULL || wps_parse_msg(msg, &attr) < 0)
413 		return 0;
414 	return attr.version2 != NULL;
415 }
416 
417 
418 /**
419  * wps_build_assoc_req_ie - Build WPS IE for (Re)Association Request
420  * @req_type: Value for Request Type attribute
421  * Returns: WPS IE or %NULL on failure
422  *
423  * The caller is responsible for freeing the buffer.
424  */
wps_build_assoc_req_ie(enum wps_request_type req_type)425 struct wpabuf * wps_build_assoc_req_ie(enum wps_request_type req_type)
426 {
427 	struct wpabuf *ie;
428 	u8 *len;
429 
430 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for (Re)Association "
431 		   "Request");
432 	ie = wpabuf_alloc(100);
433 	if (ie == NULL)
434 		return NULL;
435 
436 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
437 	len = wpabuf_put(ie, 1);
438 	wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
439 
440 	if (wps_build_version(ie) ||
441 	    wps_build_req_type(ie, req_type) ||
442 	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
443 		wpabuf_free(ie);
444 		return NULL;
445 	}
446 
447 	*len = wpabuf_len(ie) - 2;
448 
449 	return ie;
450 }
451 
452 
453 /**
454  * wps_build_assoc_resp_ie - Build WPS IE for (Re)Association Response
455  * Returns: WPS IE or %NULL on failure
456  *
457  * The caller is responsible for freeing the buffer.
458  */
wps_build_assoc_resp_ie(void)459 struct wpabuf * wps_build_assoc_resp_ie(void)
460 {
461 	struct wpabuf *ie;
462 	u8 *len;
463 
464 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for (Re)Association "
465 		   "Response");
466 	ie = wpabuf_alloc(100);
467 	if (ie == NULL)
468 		return NULL;
469 
470 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
471 	len = wpabuf_put(ie, 1);
472 	wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
473 
474 	if (wps_build_version(ie) ||
475 	    wps_build_resp_type(ie, WPS_RESP_AP) ||
476 	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
477 		wpabuf_free(ie);
478 		return NULL;
479 	}
480 
481 	*len = wpabuf_len(ie) - 2;
482 
483 	return ie;
484 }
485 
486 
487 /**
488  * wps_build_probe_req_ie - Build WPS IE for Probe Request
489  * @pw_id: Password ID (DEV_PW_PUSHBUTTON for active PBC and DEV_PW_DEFAULT for
490  * most other use cases)
491  * @dev: Device attributes
492  * @uuid: Own UUID
493  * @req_type: Value for Request Type attribute
494  * @num_req_dev_types: Number of requested device types
495  * @req_dev_types: Requested device types (8 * num_req_dev_types octets) or
496  *	%NULL if none
497  * Returns: WPS IE or %NULL on failure
498  *
499  * The caller is responsible for freeing the buffer.
500  */
wps_build_probe_req_ie(u16 pw_id,struct wps_device_data * dev,const u8 * uuid,enum wps_request_type req_type,unsigned int num_req_dev_types,const u8 * req_dev_types)501 struct wpabuf * wps_build_probe_req_ie(u16 pw_id, struct wps_device_data *dev,
502 				       const u8 *uuid,
503 				       enum wps_request_type req_type,
504 				       unsigned int num_req_dev_types,
505 				       const u8 *req_dev_types)
506 {
507 	struct wpabuf *ie;
508 
509 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for Probe Request");
510 
511 	ie = wpabuf_alloc(500);
512 	if (ie == NULL)
513 		return NULL;
514 
515 	if (wps_build_version(ie) ||
516 	    wps_build_req_type(ie, req_type) ||
517 	    wps_build_config_methods(ie, dev->config_methods) ||
518 	    wps_build_uuid_e(ie, uuid) ||
519 	    wps_build_primary_dev_type(dev, ie) ||
520 	    wps_build_rf_bands(dev, ie, 0) ||
521 	    wps_build_assoc_state(NULL, ie) ||
522 	    wps_build_config_error(ie, WPS_CFG_NO_ERROR) ||
523 	    wps_build_dev_password_id(ie, pw_id) ||
524 	    wps_build_manufacturer(dev, ie) ||
525 	    wps_build_model_name(dev, ie) ||
526 	    wps_build_model_number(dev, ie) ||
527 	    wps_build_dev_name(dev, ie) ||
528 	    wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0, 0) ||
529 	    wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types)
530 	    ||
531 	    wps_build_secondary_dev_type(dev, ie)
532 		) {
533 		wpabuf_free(ie);
534 		return NULL;
535 	}
536 
537 	return wps_ie_encapsulate(ie);
538 }
539 
540 
wps_free_pending_msgs(struct upnp_pending_message * msgs)541 void wps_free_pending_msgs(struct upnp_pending_message *msgs)
542 {
543 	struct upnp_pending_message *p, *prev;
544 	p = msgs;
545 	while (p) {
546 		prev = p;
547 		p = p->next;
548 		wpabuf_free(prev->msg);
549 		os_free(prev);
550 	}
551 }
552 
553 
wps_attr_text(struct wpabuf * data,char * buf,char * end)554 int wps_attr_text(struct wpabuf *data, char *buf, char *end)
555 {
556 	struct wps_parse_attr attr;
557 	char *pos = buf;
558 	int ret;
559 
560 	if (wps_parse_msg(data, &attr) < 0)
561 		return -1;
562 
563 	if (attr.wps_state) {
564 		if (*attr.wps_state == WPS_STATE_NOT_CONFIGURED)
565 			ret = os_snprintf(pos, end - pos,
566 					  "wps_state=unconfigured\n");
567 		else if (*attr.wps_state == WPS_STATE_CONFIGURED)
568 			ret = os_snprintf(pos, end - pos,
569 					  "wps_state=configured\n");
570 		else
571 			ret = 0;
572 		if (os_snprintf_error(end - pos, ret))
573 			return pos - buf;
574 		pos += ret;
575 	}
576 
577 	if (attr.ap_setup_locked && *attr.ap_setup_locked) {
578 		ret = os_snprintf(pos, end - pos,
579 				  "wps_ap_setup_locked=1\n");
580 		if (os_snprintf_error(end - pos, ret))
581 			return pos - buf;
582 		pos += ret;
583 	}
584 
585 	if (attr.selected_registrar && *attr.selected_registrar) {
586 		ret = os_snprintf(pos, end - pos,
587 				  "wps_selected_registrar=1\n");
588 		if (os_snprintf_error(end - pos, ret))
589 			return pos - buf;
590 		pos += ret;
591 	}
592 
593 	if (attr.dev_password_id) {
594 		ret = os_snprintf(pos, end - pos,
595 				  "wps_device_password_id=%u\n",
596 				  WPA_GET_BE16(attr.dev_password_id));
597 		if (os_snprintf_error(end - pos, ret))
598 			return pos - buf;
599 		pos += ret;
600 	}
601 
602 	if (attr.sel_reg_config_methods) {
603 		ret = os_snprintf(pos, end - pos,
604 				  "wps_selected_registrar_config_methods="
605 				  "0x%04x\n",
606 				  WPA_GET_BE16(attr.sel_reg_config_methods));
607 		if (os_snprintf_error(end - pos, ret))
608 			return pos - buf;
609 		pos += ret;
610 	}
611 
612 	if (attr.primary_dev_type) {
613 		char devtype[WPS_DEV_TYPE_BUFSIZE];
614 		ret = os_snprintf(pos, end - pos,
615 				  "wps_primary_device_type=%s\n",
616 				  wps_dev_type_bin2str(attr.primary_dev_type,
617 						       devtype,
618 						       sizeof(devtype)));
619 		if (os_snprintf_error(end - pos, ret))
620 			return pos - buf;
621 		pos += ret;
622 	}
623 
624 	if (attr.dev_name) {
625 		char *str = os_malloc(attr.dev_name_len + 1);
626 		size_t i;
627 		if (str == NULL)
628 			return pos - buf;
629 		for (i = 0; i < attr.dev_name_len; i++) {
630 			if (attr.dev_name[i] == 0 ||
631 			    is_ctrl_char(attr.dev_name[i]))
632 				str[i] = '_';
633 			else
634 				str[i] = attr.dev_name[i];
635 		}
636 		str[i] = '\0';
637 		ret = os_snprintf(pos, end - pos, "wps_device_name=%s\n", str);
638 		os_free(str);
639 		if (os_snprintf_error(end - pos, ret))
640 			return pos - buf;
641 		pos += ret;
642 	}
643 
644 	if (attr.config_methods) {
645 		ret = os_snprintf(pos, end - pos,
646 				  "wps_config_methods=0x%04x\n",
647 				  WPA_GET_BE16(attr.config_methods));
648 		if (os_snprintf_error(end - pos, ret))
649 			return pos - buf;
650 		pos += ret;
651 	}
652 
653 	return pos - buf;
654 }
655 
656 
wps_ei_str(enum wps_error_indication ei)657 const char * wps_ei_str(enum wps_error_indication ei)
658 {
659 	switch (ei) {
660 	case WPS_EI_NO_ERROR:
661 		return "No Error";
662 	case WPS_EI_SECURITY_TKIP_ONLY_PROHIBITED:
663 		return "TKIP Only Prohibited";
664 	case WPS_EI_SECURITY_WEP_PROHIBITED:
665 		return "WEP Prohibited";
666 	case WPS_EI_AUTH_FAILURE:
667 		return "Authentication Failure";
668 	default:
669 		return "Unknown";
670 	}
671 }
672