1 /*
2  * Wi-Fi Protected Setup
3  * Copyright (c) 2007-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/dh_group5.h"
13 #include "common/ieee802_11_defs.h"
14 #include "wps_i.h"
15 #include "wps_dev_attr.h"
16 
17 
18 #ifdef CONFIG_WPS_TESTING
19 int wps_version_number = 0x20;
20 int wps_testing_stub_cred = 0;
21 int wps_corrupt_pkhash = 0;
22 int wps_force_auth_types_in_use = 0;
23 u16 wps_force_auth_types = 0;
24 int wps_force_encr_types_in_use = 0;
25 u16 wps_force_encr_types = 0;
26 #endif /* CONFIG_WPS_TESTING */
27 
28 /**
29  * wps_init - Initialize WPS Registration protocol data
30  * @cfg: WPS configuration
31  * Returns: Pointer to allocated data or %NULL on failure
32  *
33  * This function is used to initialize WPS data for a registration protocol
34  * instance (i.e., each run of registration protocol as a Registrar of
35  * Enrollee. The caller is responsible for freeing this data after the
36  * registration run has been completed by calling wps_deinit().
37  */
wps_init(const struct wps_config *cfg)38 struct wps_data * wps_init(const struct wps_config *cfg)
39 {
40 	struct wps_data *data = os_zalloc(sizeof(*data));
41 	if (data == NULL)
42 		return NULL;
43 	data->wps = cfg->wps;
44 	data->registrar = cfg->registrar;
45 	if (cfg->registrar) {
46 		os_memcpy(data->uuid_r, cfg->wps->uuid, WPS_UUID_LEN);
47 	} else {
48 		os_memcpy(data->mac_addr_e, cfg->wps->dev.mac_addr, ETH_ALEN);
49 		os_memcpy(data->uuid_e, cfg->wps->uuid, WPS_UUID_LEN);
50 	}
51 	if (cfg->pin) {
52 		data->dev_pw_id = cfg->dev_pw_id;
53 		data->dev_password = os_memdup(cfg->pin, cfg->pin_len);
54 		if (data->dev_password == NULL) {
55 			os_free(data);
56 			return NULL;
57 		}
58 		data->dev_password_len = cfg->pin_len;
59 		wpa_hexdump_key(MSG_DEBUG, "WPS: AP PIN dev_password",
60 				data->dev_password, data->dev_password_len);
61 	}
62 
63 #ifdef CONFIG_WPS_NFC
64 	if (cfg->pin == NULL &&
65 	    cfg->dev_pw_id == DEV_PW_NFC_CONNECTION_HANDOVER)
66 		data->dev_pw_id = cfg->dev_pw_id;
67 
68 	if (cfg->wps->ap && !cfg->registrar && cfg->wps->ap_nfc_dev_pw_id) {
69 		/* Keep AP PIN as alternative Device Password */
70 		data->alt_dev_pw_id = data->dev_pw_id;
71 		data->alt_dev_password = data->dev_password;
72 		data->alt_dev_password_len = data->dev_password_len;
73 
74 		data->dev_pw_id = cfg->wps->ap_nfc_dev_pw_id;
75 		data->dev_password =
76 			os_memdup(wpabuf_head(cfg->wps->ap_nfc_dev_pw),
77 				  wpabuf_len(cfg->wps->ap_nfc_dev_pw));
78 		if (data->dev_password == NULL) {
79 			os_free(data);
80 			return NULL;
81 		}
82 		data->dev_password_len = wpabuf_len(cfg->wps->ap_nfc_dev_pw);
83 		wpa_hexdump_key(MSG_DEBUG, "WPS: NFC dev_password",
84 			    data->dev_password, data->dev_password_len);
85 	}
86 #endif /* CONFIG_WPS_NFC */
87 
88 	data->pbc = cfg->pbc;
89 	if (cfg->pbc) {
90 		/* Use special PIN '00000000' for PBC */
91 		data->dev_pw_id = DEV_PW_PUSHBUTTON;
92 		bin_clear_free(data->dev_password, data->dev_password_len);
93 		data->dev_password = (u8 *) os_strdup("00000000");
94 		if (data->dev_password == NULL) {
95 			os_free(data);
96 			return NULL;
97 		}
98 		data->dev_password_len = 8;
99 	}
100 
101 	data->state = data->registrar ? RECV_M1 : SEND_M1;
102 
103 	if (cfg->assoc_wps_ie) {
104 		struct wps_parse_attr attr;
105 		wpa_hexdump_buf(MSG_DEBUG, "WPS: WPS IE from (Re)AssocReq",
106 				cfg->assoc_wps_ie);
107 		if (wps_parse_msg(cfg->assoc_wps_ie, &attr) < 0) {
108 			wpa_printf(MSG_DEBUG, "WPS: Failed to parse WPS IE "
109 				   "from (Re)AssocReq");
110 		} else if (attr.request_type == NULL) {
111 			wpa_printf(MSG_DEBUG, "WPS: No Request Type attribute "
112 				   "in (Re)AssocReq WPS IE");
113 		} else {
114 			wpa_printf(MSG_DEBUG, "WPS: Request Type (from WPS IE "
115 				   "in (Re)AssocReq WPS IE): %d",
116 				   *attr.request_type);
117 			data->request_type = *attr.request_type;
118 		}
119 	}
120 
121 	if (cfg->new_ap_settings) {
122 		data->new_ap_settings =
123 			os_memdup(cfg->new_ap_settings,
124 				  sizeof(*data->new_ap_settings));
125 		if (data->new_ap_settings == NULL) {
126 			bin_clear_free(data->dev_password,
127 				       data->dev_password_len);
128 			os_free(data);
129 			return NULL;
130 		}
131 	}
132 
133 	if (cfg->peer_addr)
134 		os_memcpy(data->peer_dev.mac_addr, cfg->peer_addr, ETH_ALEN);
135 	if (cfg->p2p_dev_addr)
136 		os_memcpy(data->p2p_dev_addr, cfg->p2p_dev_addr, ETH_ALEN);
137 
138 	data->use_psk_key = cfg->use_psk_key;
139 	data->pbc_in_m1 = cfg->pbc_in_m1;
140 
141 	if (cfg->peer_pubkey_hash) {
142 		os_memcpy(data->peer_pubkey_hash, cfg->peer_pubkey_hash,
143 			  WPS_OOB_PUBKEY_HASH_LEN);
144 		data->peer_pubkey_hash_set = 1;
145 	}
146 
147 	data->multi_ap_backhaul_sta = cfg->multi_ap_backhaul_sta;
148 
149 	return data;
150 }
151 
152 
153 /**
154  * wps_deinit - Deinitialize WPS Registration protocol data
155  * @data: WPS Registration protocol data from wps_init()
156  */
wps_deinit(struct wps_data *data)157 void wps_deinit(struct wps_data *data)
158 {
159 #ifdef CONFIG_WPS_NFC
160 	if (data->registrar && data->nfc_pw_token)
161 		wps_registrar_remove_nfc_pw_token(data->wps->registrar,
162 						  data->nfc_pw_token);
163 #endif /* CONFIG_WPS_NFC */
164 
165 	if (data->wps_pin_revealed) {
166 		wpa_printf(MSG_DEBUG, "WPS: Full PIN information revealed and "
167 			   "negotiation failed");
168 		if (data->registrar)
169 			wps_registrar_invalidate_pin(data->wps->registrar,
170 						     data->uuid_e);
171 	} else if (data->registrar)
172 		wps_registrar_unlock_pin(data->wps->registrar, data->uuid_e);
173 
174 	wpabuf_clear_free(data->dh_privkey);
175 	wpabuf_free(data->dh_pubkey_e);
176 	wpabuf_free(data->dh_pubkey_r);
177 	wpabuf_free(data->last_msg);
178 	bin_clear_free(data->dev_password, data->dev_password_len);
179 	bin_clear_free(data->alt_dev_password, data->alt_dev_password_len);
180 	bin_clear_free(data->new_psk, data->new_psk_len);
181 	wps_device_data_free(&data->peer_dev);
182 	bin_clear_free(data->new_ap_settings, sizeof(*data->new_ap_settings));
183 	dh5_free(data->dh_ctx);
184 	os_free(data);
185 }
186 
187 #ifdef HARMONY_P2P_CONNECTIVITY_PATCH
wps_check_msg_done(struct wps_data *wps)188 int wps_check_msg_done(struct wps_data *wps)
189 {
190 	wpa_printf(MSG_DEBUG, "WPS: State=%d\n", wps->state);
191 	return (wps->state == WPS_FINISHED);
192 }
193 #endif
194 
195 /**
196  * wps_process_msg - Process a WPS message
197  * @wps: WPS Registration protocol data from wps_init()
198  * @op_code: Message OP Code
199  * @msg: Message data
200  * Returns: Processing result
201  *
202  * This function is used to process WPS messages with OP Codes WSC_ACK,
203  * WSC_NACK, WSC_MSG, and WSC_Done. The caller (e.g., EAP server/peer) is
204  * responsible for reassembling the messages before calling this function.
205  * Response to this message is built by calling wps_get_msg().
206  */
wps_process_msg(struct wps_data *wps, enum wsc_op_code op_code, const struct wpabuf *msg)207 enum wps_process_res wps_process_msg(struct wps_data *wps,
208 				     enum wsc_op_code op_code,
209 				     const struct wpabuf *msg)
210 {
211 	if (wps->registrar)
212 		return wps_registrar_process_msg(wps, op_code, msg);
213 	else
214 		return wps_enrollee_process_msg(wps, op_code, msg);
215 }
216 
217 
218 /**
219  * wps_get_msg - Build a WPS message
220  * @wps: WPS Registration protocol data from wps_init()
221  * @op_code: Buffer for returning message OP Code
222  * Returns: The generated WPS message or %NULL on failure
223  *
224  * This function is used to build a response to a message processed by calling
225  * wps_process_msg(). The caller is responsible for freeing the buffer.
226  */
wps_get_msg(struct wps_data *wps, enum wsc_op_code *op_code)227 struct wpabuf * wps_get_msg(struct wps_data *wps, enum wsc_op_code *op_code)
228 {
229 	if (wps->registrar)
230 		return wps_registrar_get_msg(wps, op_code);
231 	else
232 		return wps_enrollee_get_msg(wps, op_code);
233 }
234 
235 
236 /**
237  * wps_is_selected_pbc_registrar - Check whether WPS IE indicates active PBC
238  * @msg: WPS IE contents from Beacon or Probe Response frame
239  * Returns: 1 if PBC Registrar is active, 0 if not
240  */
wps_is_selected_pbc_registrar(const struct wpabuf *msg)241 int wps_is_selected_pbc_registrar(const struct wpabuf *msg)
242 {
243 	struct wps_parse_attr attr;
244 
245 	/*
246 	 * In theory, this could also verify that attr.sel_reg_config_methods
247 	 * includes WPS_CONFIG_PUSHBUTTON, but some deployed AP implementations
248 	 * do not set Selected Registrar Config Methods attribute properly, so
249 	 * it is safer to just use Device Password ID here.
250 	 */
251 
252 	if (wps_parse_msg(msg, &attr) < 0 ||
253 	    !attr.selected_registrar || *attr.selected_registrar == 0 ||
254 	    !attr.dev_password_id ||
255 	    WPA_GET_BE16(attr.dev_password_id) != DEV_PW_PUSHBUTTON)
256 		return 0;
257 
258 #ifdef CONFIG_WPS_STRICT
259 	if (!attr.sel_reg_config_methods ||
260 	    !(WPA_GET_BE16(attr.sel_reg_config_methods) &
261 	      WPS_CONFIG_PUSHBUTTON))
262 		return 0;
263 #endif /* CONFIG_WPS_STRICT */
264 
265 	return 1;
266 }
267 
268 
is_selected_pin_registrar(struct wps_parse_attr *attr)269 static int is_selected_pin_registrar(struct wps_parse_attr *attr)
270 {
271 	/*
272 	 * In theory, this could also verify that attr.sel_reg_config_methods
273 	 * includes WPS_CONFIG_LABEL, WPS_CONFIG_DISPLAY, or WPS_CONFIG_KEYPAD,
274 	 * but some deployed AP implementations do not set Selected Registrar
275 	 * Config Methods attribute properly, so it is safer to just use
276 	 * Device Password ID here.
277 	 */
278 
279 	if (!attr->selected_registrar || *attr->selected_registrar == 0)
280 		return 0;
281 
282 	if (attr->dev_password_id != NULL &&
283 	    WPA_GET_BE16(attr->dev_password_id) == DEV_PW_PUSHBUTTON)
284 		return 0;
285 
286 #ifdef CONFIG_WPS_STRICT
287 	if (!attr->sel_reg_config_methods ||
288 	    !(WPA_GET_BE16(attr->sel_reg_config_methods) &
289 	      (WPS_CONFIG_LABEL | WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD)))
290 		return 0;
291 #endif /* CONFIG_WPS_STRICT */
292 
293 	return 1;
294 }
295 
296 
297 /**
298  * wps_is_selected_pin_registrar - Check whether WPS IE indicates active PIN
299  * @msg: WPS IE contents from Beacon or Probe Response frame
300  * Returns: 1 if PIN Registrar is active, 0 if not
301  */
wps_is_selected_pin_registrar(const struct wpabuf *msg)302 int wps_is_selected_pin_registrar(const struct wpabuf *msg)
303 {
304 	struct wps_parse_attr attr;
305 
306 	if (wps_parse_msg(msg, &attr) < 0)
307 		return 0;
308 
309 	return is_selected_pin_registrar(&attr);
310 }
311 
312 
313 /**
314  * wps_is_addr_authorized - Check whether WPS IE authorizes MAC address
315  * @msg: WPS IE contents from Beacon or Probe Response frame
316  * @addr: MAC address to search for
317  * @ver1_compat: Whether to use version 1 compatibility mode
318  * Returns: 2 if the specified address is explicit authorized, 1 if address is
319  * authorized (broadcast), 0 if not
320  */
wps_is_addr_authorized(const struct wpabuf *msg, const u8 *addr, int ver1_compat)321 int wps_is_addr_authorized(const struct wpabuf *msg, const u8 *addr,
322 			   int ver1_compat)
323 {
324 	struct wps_parse_attr attr;
325 	unsigned int i;
326 	const u8 *pos;
327 	const u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
328 
329 	if (wps_parse_msg(msg, &attr) < 0)
330 		return 0;
331 
332 	if (!attr.version2 && ver1_compat) {
333 		/*
334 		 * Version 1.0 AP - AuthorizedMACs not used, so revert back to
335 		 * old mechanism of using SelectedRegistrar.
336 		 */
337 		return is_selected_pin_registrar(&attr);
338 	}
339 
340 	if (!attr.authorized_macs)
341 		return 0;
342 
343 	pos = attr.authorized_macs;
344 	for (i = 0; i < attr.authorized_macs_len / ETH_ALEN; i++) {
345 		if (os_memcmp(pos, addr, ETH_ALEN) == 0)
346 			return 2;
347 		if (os_memcmp(pos, bcast, ETH_ALEN) == 0)
348 			return 1;
349 		pos += ETH_ALEN;
350 	}
351 
352 	return 0;
353 }
354 
355 
356 /**
357  * wps_ap_priority_compar - Prioritize WPS IE from two APs
358  * @wps_a: WPS IE contents from Beacon or Probe Response frame
359  * @wps_b: WPS IE contents from Beacon or Probe Response frame
360  * Returns: 1 if wps_b is considered more likely selection for WPS
361  * provisioning, -1 if wps_a is considered more like, or 0 if no preference
362  */
wps_ap_priority_compar(const struct wpabuf *wps_a, const struct wpabuf *wps_b)363 int wps_ap_priority_compar(const struct wpabuf *wps_a,
364 			   const struct wpabuf *wps_b)
365 {
366 	struct wps_parse_attr attr;
367 	int sel_a, sel_b;
368 
369 	if (wps_a == NULL || wps_parse_msg(wps_a, &attr) < 0)
370 		return 1;
371 	sel_a = attr.selected_registrar && *attr.selected_registrar != 0;
372 
373 	if (wps_b == NULL || wps_parse_msg(wps_b, &attr) < 0)
374 		return -1;
375 	sel_b = attr.selected_registrar && *attr.selected_registrar != 0;
376 
377 	if (sel_a && !sel_b)
378 		return -1;
379 	if (!sel_a && sel_b)
380 		return 1;
381 
382 	return 0;
383 }
384 
385 
386 /**
387  * wps_get_uuid_e - Get UUID-E from WPS IE
388  * @msg: WPS IE contents from Beacon or Probe Response frame
389  * Returns: Pointer to UUID-E or %NULL if not included
390  *
391  * The returned pointer is to the msg contents and it remains valid only as
392  * long as the msg buffer is valid.
393  */
wps_get_uuid_e(const struct wpabuf *msg)394 const u8 * wps_get_uuid_e(const struct wpabuf *msg)
395 {
396 	struct wps_parse_attr attr;
397 
398 	if (wps_parse_msg(msg, &attr) < 0)
399 		return NULL;
400 	return attr.uuid_e;
401 }
402 
403 
404 /**
405  * wps_is_20 - Check whether WPS attributes claim support for WPS 2.0
406  */
wps_is_20(const struct wpabuf *msg)407 int wps_is_20(const struct wpabuf *msg)
408 {
409 	struct wps_parse_attr attr;
410 
411 	if (msg == NULL || wps_parse_msg(msg, &attr) < 0)
412 		return 0;
413 	return attr.version2 != NULL;
414 }
415 
416 
417 /**
418  * wps_build_assoc_req_ie - Build WPS IE for (Re)Association Request
419  * @req_type: Value for Request Type attribute
420  * Returns: WPS IE or %NULL on failure
421  *
422  * The caller is responsible for freeing the buffer.
423  */
wps_build_assoc_req_ie(enum wps_request_type req_type)424 struct wpabuf * wps_build_assoc_req_ie(enum wps_request_type req_type)
425 {
426 	struct wpabuf *ie;
427 	u8 *len;
428 
429 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for (Re)Association "
430 		   "Request");
431 	ie = wpabuf_alloc(100);
432 	if (ie == NULL)
433 		return NULL;
434 
435 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
436 	len = wpabuf_put(ie, 1);
437 	wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
438 
439 	if (wps_build_version(ie) ||
440 	    wps_build_req_type(ie, req_type) ||
441 	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
442 		wpabuf_free(ie);
443 		return NULL;
444 	}
445 
446 	*len = wpabuf_len(ie) - 2;
447 
448 	return ie;
449 }
450 
451 
452 /**
453  * wps_build_assoc_resp_ie - Build WPS IE for (Re)Association Response
454  * Returns: WPS IE or %NULL on failure
455  *
456  * The caller is responsible for freeing the buffer.
457  */
wps_build_assoc_resp_ie(void)458 struct wpabuf * wps_build_assoc_resp_ie(void)
459 {
460 	struct wpabuf *ie;
461 	u8 *len;
462 
463 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for (Re)Association "
464 		   "Response");
465 	ie = wpabuf_alloc(100);
466 	if (ie == NULL)
467 		return NULL;
468 
469 	wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
470 	len = wpabuf_put(ie, 1);
471 	wpabuf_put_be32(ie, WPS_DEV_OUI_WFA);
472 
473 	if (wps_build_version(ie) ||
474 	    wps_build_resp_type(ie, WPS_RESP_AP) ||
475 	    wps_build_wfa_ext(ie, 0, NULL, 0, 0)) {
476 		wpabuf_free(ie);
477 		return NULL;
478 	}
479 
480 	*len = wpabuf_len(ie) - 2;
481 
482 	return ie;
483 }
484 
485 
486 /**
487  * wps_build_probe_req_ie - Build WPS IE for Probe Request
488  * @pw_id: Password ID (DEV_PW_PUSHBUTTON for active PBC and DEV_PW_DEFAULT for
489  * most other use cases)
490  * @dev: Device attributes
491  * @uuid: Own UUID
492  * @req_type: Value for Request Type attribute
493  * @num_req_dev_types: Number of requested device types
494  * @req_dev_types: Requested device types (8 * num_req_dev_types octets) or
495  *	%NULL if none
496  * Returns: WPS IE or %NULL on failure
497  *
498  * The caller is responsible for freeing the buffer.
499  */
wps_build_probe_req_ie(u16 pw_id, struct wps_device_data *dev, const u8 *uuid, enum wps_request_type req_type, unsigned int num_req_dev_types, const u8 *req_dev_types)500 struct wpabuf * wps_build_probe_req_ie(u16 pw_id, struct wps_device_data *dev,
501 				       const u8 *uuid,
502 				       enum wps_request_type req_type,
503 				       unsigned int num_req_dev_types,
504 				       const u8 *req_dev_types)
505 {
506 	struct wpabuf *ie;
507 
508 	wpa_printf(MSG_EXCESSIVE, "WPS: Building WPS IE for Probe Request");
509 
510 	ie = wpabuf_alloc(500);
511 	if (ie == NULL)
512 		return NULL;
513 
514 	if (wps_build_version(ie) ||
515 	    wps_build_req_type(ie, req_type) ||
516 	    wps_build_config_methods(ie, dev->config_methods) ||
517 	    wps_build_uuid_e(ie, uuid) ||
518 	    wps_build_primary_dev_type(dev, ie) ||
519 	    wps_build_rf_bands(dev, ie, 0) ||
520 	    wps_build_assoc_state(NULL, ie) ||
521 	    wps_build_config_error(ie, WPS_CFG_NO_ERROR) ||
522 	    wps_build_dev_password_id(ie, pw_id) ||
523 	    wps_build_manufacturer(dev, ie) ||
524 	    wps_build_model_name(dev, ie) ||
525 	    wps_build_model_number(dev, ie) ||
526 	    wps_build_dev_name(dev, ie) ||
527 	    wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0, 0) ||
528 	    wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types)
529 	    ||
530 	    wps_build_secondary_dev_type(dev, ie)
531 		) {
532 		wpabuf_free(ie);
533 		return NULL;
534 	}
535 
536 	return wps_ie_encapsulate(ie);
537 }
538 
539 
wps_free_pending_msgs(struct upnp_pending_message *msgs)540 void wps_free_pending_msgs(struct upnp_pending_message *msgs)
541 {
542 	struct upnp_pending_message *p, *prev;
543 	p = msgs;
544 	while (p) {
545 		prev = p;
546 		p = p->next;
547 		wpabuf_free(prev->msg);
548 		os_free(prev);
549 	}
550 }
551 
552 
wps_attr_text(struct wpabuf *data, char *buf, char *end)553 int wps_attr_text(struct wpabuf *data, char *buf, char *end)
554 {
555 	struct wps_parse_attr attr;
556 	char *pos = buf;
557 	int ret;
558 
559 	if (wps_parse_msg(data, &attr) < 0)
560 		return -1;
561 
562 	if (attr.wps_state) {
563 		if (*attr.wps_state == WPS_STATE_NOT_CONFIGURED)
564 			ret = os_snprintf(pos, end - pos,
565 					  "wps_state=unconfigured\n");
566 		else if (*attr.wps_state == WPS_STATE_CONFIGURED)
567 			ret = os_snprintf(pos, end - pos,
568 					  "wps_state=configured\n");
569 		else
570 			ret = 0;
571 		if (os_snprintf_error(end - pos, ret))
572 			return pos - buf;
573 		pos += ret;
574 	}
575 
576 	if (attr.ap_setup_locked && *attr.ap_setup_locked) {
577 		ret = os_snprintf(pos, end - pos,
578 				  "wps_ap_setup_locked=1\n");
579 		if (os_snprintf_error(end - pos, ret))
580 			return pos - buf;
581 		pos += ret;
582 	}
583 
584 	if (attr.selected_registrar && *attr.selected_registrar) {
585 		ret = os_snprintf(pos, end - pos,
586 				  "wps_selected_registrar=1\n");
587 		if (os_snprintf_error(end - pos, ret))
588 			return pos - buf;
589 		pos += ret;
590 	}
591 
592 	if (attr.dev_password_id) {
593 		ret = os_snprintf(pos, end - pos,
594 				  "wps_device_password_id=%u\n",
595 				  WPA_GET_BE16(attr.dev_password_id));
596 		if (os_snprintf_error(end - pos, ret))
597 			return pos - buf;
598 		pos += ret;
599 	}
600 
601 	if (attr.sel_reg_config_methods) {
602 		ret = os_snprintf(pos, end - pos,
603 				  "wps_selected_registrar_config_methods="
604 				  "0x%04x\n",
605 				  WPA_GET_BE16(attr.sel_reg_config_methods));
606 		if (os_snprintf_error(end - pos, ret))
607 			return pos - buf;
608 		pos += ret;
609 	}
610 
611 	if (attr.primary_dev_type) {
612 		char devtype[WPS_DEV_TYPE_BUFSIZE];
613 		ret = os_snprintf(pos, end - pos,
614 				  "wps_primary_device_type=%s\n",
615 				  wps_dev_type_bin2str(attr.primary_dev_type,
616 						       devtype,
617 						       sizeof(devtype)));
618 		if (os_snprintf_error(end - pos, ret))
619 			return pos - buf;
620 		pos += ret;
621 	}
622 
623 	if (attr.dev_name) {
624 		char *str = os_malloc(attr.dev_name_len + 1);
625 		size_t i;
626 		if (str == NULL)
627 			return pos - buf;
628 		for (i = 0; i < attr.dev_name_len; i++) {
629 			if (attr.dev_name[i] == 0 ||
630 			    is_ctrl_char(attr.dev_name[i]))
631 				str[i] = '_';
632 			else
633 				str[i] = attr.dev_name[i];
634 		}
635 		str[i] = '\0';
636 		ret = os_snprintf(pos, end - pos, "wps_device_name=%s\n", str);
637 		os_free(str);
638 		if (os_snprintf_error(end - pos, ret))
639 			return pos - buf;
640 		pos += ret;
641 	}
642 
643 	if (attr.config_methods) {
644 		ret = os_snprintf(pos, end - pos,
645 				  "wps_config_methods=0x%04x\n",
646 				  WPA_GET_BE16(attr.config_methods));
647 		if (os_snprintf_error(end - pos, ret))
648 			return pos - buf;
649 		pos += ret;
650 	}
651 
652 	return pos - buf;
653 }
654 
655 
wps_ei_str(enum wps_error_indication ei)656 const char * wps_ei_str(enum wps_error_indication ei)
657 {
658 	switch (ei) {
659 	case WPS_EI_NO_ERROR:
660 		return "No Error";
661 	case WPS_EI_SECURITY_TKIP_ONLY_PROHIBITED:
662 		return "TKIP Only Prohibited";
663 	case WPS_EI_SECURITY_WEP_PROHIBITED:
664 		return "WEP Prohibited";
665 	case WPS_EI_AUTH_FAILURE:
666 		return "Authentication Failure";
667 	default:
668 		return "Unknown";
669 	}
670 }
671