static struct wpabuf * eap_wsc_buildReq(struct eap_sm *sm, void *priv, u8 id) { struct eap_wsc_data *data = priv; switch (data->state) { case START: return eap_wsc_build_start(sm, data, id); case MESG: if (data->out_buf == NULL) { data->out_buf = wps_get_msg(data->wps, &data->out_op_code); if (data->out_buf == NULL) { wpa_printf(MSG_DEBUG, "EAP-WSC: Failed to " "receive message from WPS"); return NULL; } data->out_used = 0; } /* pass through */ case WAIT_FRAG_ACK: return eap_wsc_build_msg(data, id); case FRAG_ACK: return eap_wsc_build_frag_ack(id, EAP_CODE_REQUEST); default: wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected state %d in " "buildReq", data->state); return NULL; } }
static struct wpabuf * eap_wsc_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, const struct wpabuf *reqData) { struct eap_wsc_data *data = priv; const u8 *start, *pos, *end; size_t len; u8 op_code, flags, id; u16 message_length = 0; enum wps_process_res res; struct wpabuf tmpbuf; struct wpabuf *r; pos = eap_hdr_validate(EAP_VENDOR_WFA, EAP_VENDOR_TYPE_WSC, reqData, &len); if (pos == NULL || len < 2) { ret->ignore = TRUE; return NULL; } id = eap_get_id(reqData); start = pos; end = start + len; op_code = *pos++; flags = *pos++; if (flags & WSC_FLAGS_LF) { if (end - pos < 2) { wpa_printf(MSG_DEBUG, "EAP-WSC: Message underflow"); ret->ignore = TRUE; return NULL; } message_length = WPA_GET_BE16(pos); pos += 2; if (message_length < end - pos || message_length > 50000) { wpa_printf(MSG_DEBUG, "EAP-WSC: Invalid Message " "Length"); ret->ignore = TRUE; return NULL; } } wpa_printf(MSG_DEBUG, "EAP-WSC: Received packet: Op-Code %d " "Flags 0x%x Message Length %d", op_code, flags, message_length); if (data->state == WAIT_FRAG_ACK) { if (op_code != WSC_FRAG_ACK) { wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d " "in WAIT_FRAG_ACK state", op_code); ret->ignore = TRUE; return NULL; } wpa_printf(MSG_DEBUG, "EAP-WSC: Fragment acknowledged"); eap_wsc_state(data, MESG); return eap_wsc_build_msg(data, ret, id); } if (op_code != WSC_ACK && op_code != WSC_NACK && op_code != WSC_MSG && op_code != WSC_Done && op_code != WSC_Start) { wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d", op_code); ret->ignore = TRUE; return NULL; } if (data->state == WAIT_START) { if (op_code != WSC_Start) { wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d " "in WAIT_START state", op_code); ret->ignore = TRUE; return NULL; } wpa_printf(MSG_DEBUG, "EAP-WSC: Received start"); eap_wsc_state(data, MESG); /* Start message has empty payload, skip processing */ goto send_msg; } else if (op_code == WSC_Start) { wpa_printf(MSG_DEBUG, "EAP-WSC: Unexpected Op-Code %d", op_code); ret->ignore = TRUE; return NULL; } if (data->in_buf && eap_wsc_process_cont(data, pos, end - pos, op_code) < 0) { ret->ignore = TRUE; return NULL; } if (flags & WSC_FLAGS_MF) { return eap_wsc_process_fragment(data, ret, id, flags, op_code, message_length, pos, end - pos); } if (data->in_buf == NULL) { /* Wrap unfragmented messages as wpabuf without extra copy */ wpabuf_set(&tmpbuf, pos, end - pos); data->in_buf = &tmpbuf; } res = wps_process_msg(data->wps, op_code, data->in_buf); switch (res) { case WPS_DONE: wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing completed " "successfully - wait for EAP failure"); eap_wsc_state(data, FAIL); break; case WPS_CONTINUE: eap_wsc_state(data, MESG); break; case WPS_FAILURE: case WPS_PENDING: wpa_printf(MSG_DEBUG, "EAP-WSC: WPS processing failed"); eap_wsc_state(data, FAIL); break; } if (data->in_buf != &tmpbuf) wpabuf_free(data->in_buf); data->in_buf = NULL; send_msg: if (data->out_buf == NULL) { data->out_buf = wps_get_msg(data->wps, &data->out_op_code); if (data->out_buf == NULL) { wpa_printf(MSG_DEBUG, "EAP-WSC: Failed to receive " "message from WPS"); eap_wsc_state(data, FAIL); ret->methodState = METHOD_DONE; ret->decision = DECISION_FAIL; return NULL; } data->out_used = 0; } eap_wsc_state(data, MESG); r = eap_wsc_build_msg(data, ret, id); if (data->state == FAIL && ret->methodState == METHOD_DONE) { /* Use reduced client timeout for WPS to avoid long wait */ if (sm->ClientTimeout > 2) sm->ClientTimeout = 2; } return r; }