The gun was apparently bought “legally”, at least legal on part of the seller.
I read on the first day of this story that the gun was bought from a regular gun shop, but it was not bought by Hasan or anybody of that name. The dealer was not permitted to reveal the name, of course, but did tell the reporter that somebody other than Hasan bought the weapons (or possibly Hasan had forged ID?).