Branch data Line data Source code
1 : : /*
2 : : * UPnP WPS Device
3 : : * Copyright (c) 2000-2003 Intel Corporation
4 : : * Copyright (c) 2006-2007 Sony Corporation
5 : : * Copyright (c) 2008-2009 Atheros Communications
6 : : * Copyright (c) 2009-2010, Jouni Malinen <j@w1.fi>
7 : : *
8 : : * See below for more details on licensing and code history.
9 : : */
10 : :
11 : : /*
12 : : * This has been greatly stripped down from the original file
13 : : * (upnp_wps_device.c) by Ted Merrill, Atheros Communications
14 : : * in order to eliminate use of the bulky libupnp library etc.
15 : : *
16 : : * History:
17 : : * upnp_wps_device.c is/was a shim layer between wps_opt_upnp.c and
18 : : * the libupnp library.
19 : : * The layering (by Sony) was well done; only a very minor modification
20 : : * to API of upnp_wps_device.c was required.
21 : : * libupnp was found to be undesirable because:
22 : : * -- It consumed too much code and data space
23 : : * -- It uses multiple threads, making debugging more difficult
24 : : * and possibly reducing reliability.
25 : : * -- It uses static variables and only supports one instance.
26 : : * The shim and libupnp are here replaced by special code written
27 : : * specifically for the needs of hostapd.
28 : : * Various shortcuts can and are taken to keep the code size small.
29 : : * Generally, execution time is not as crucial.
30 : : *
31 : : * BUGS:
32 : : * -- UPnP requires that we be able to resolve domain names.
33 : : * While uncommon, if we have to do it then it will stall the entire
34 : : * hostapd program, which is bad.
35 : : * This is because we use the standard linux getaddrinfo() function
36 : : * which is syncronous.
37 : : * An asyncronous solution would be to use the free "ares" library.
38 : : * -- Does not have a robust output buffering scheme. Uses a single
39 : : * fixed size output buffer per TCP/HTTP connection, with possible (although
40 : : * unlikely) possibility of overflow and likely excessive use of RAM.
41 : : * A better solution would be to write the HTTP output as a buffered stream,
42 : : * using chunking: (handle header specially, then) generate data with
43 : : * a printf-like function into a buffer, catching buffer full condition,
44 : : * then send it out surrounded by http chunking.
45 : : * -- There is some code that could be separated out into the common
46 : : * library to be shared with wpa_supplicant.
47 : : * -- Needs renaming with module prefix to avoid polluting the debugger
48 : : * namespace and causing possible collisions with other static fncs
49 : : * and structure declarations when using the debugger.
50 : : * -- The http error code generation is pretty bogus, hopefully no one cares.
51 : : *
52 : : * Author: Ted Merrill, Atheros Communications, based upon earlier work
53 : : * as explained above and below.
54 : : *
55 : : * Copyright:
56 : : * Copyright 2008 Atheros Communications.
57 : : *
58 : : * The original header (of upnp_wps_device.c) reads:
59 : : *
60 : : * Copyright (c) 2006-2007 Sony Corporation. All Rights Reserved.
61 : : *
62 : : * File Name: upnp_wps_device.c
63 : : * Description: EAP-WPS UPnP device source
64 : : *
65 : : * Redistribution and use in source and binary forms, with or without
66 : : * modification, are permitted provided that the following conditions
67 : : * are met:
68 : : *
69 : : * * Redistributions of source code must retain the above copyright
70 : : * notice, this list of conditions and the following disclaimer.
71 : : * * Redistributions in binary form must reproduce the above copyright
72 : : * notice, this list of conditions and the following disclaimer in
73 : : * the documentation and/or other materials provided with the
74 : : * distribution.
75 : : * * Neither the name of Sony Corporation nor the names of its
76 : : * contributors may be used to endorse or promote products derived
77 : : * from this software without specific prior written permission.
78 : : *
79 : : * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
80 : : * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
81 : : * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
82 : : * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
83 : : * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
84 : : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
85 : : * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
86 : : * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
87 : : * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
88 : : * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
89 : : * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
90 : : *
91 : : * Portions from Intel libupnp files, e.g. genlib/net/http/httpreadwrite.c
92 : : * typical header:
93 : : *
94 : : * Copyright (c) 2000-2003 Intel Corporation
95 : : * All rights reserved.
96 : : *
97 : : * Redistribution and use in source and binary forms, with or without
98 : : * modification, are permitted provided that the following conditions are met:
99 : : *
100 : : * * Redistributions of source code must retain the above copyright notice,
101 : : * this list of conditions and the following disclaimer.
102 : : * * Redistributions in binary form must reproduce the above copyright notice,
103 : : * this list of conditions and the following disclaimer in the documentation
104 : : * and/or other materials provided with the distribution.
105 : : * * Neither name of Intel Corporation nor the names of its contributors
106 : : * may be used to endorse or promote products derived from this software
107 : : * without specific prior written permission.
108 : : *
109 : : * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
110 : : * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
111 : : * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
112 : : * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
113 : : * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
114 : : * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
115 : : * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
116 : : * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
117 : : * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
118 : : * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
119 : : * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
120 : : */
121 : :
122 : : /*
123 : : * Overview of WPS over UPnP:
124 : : *
125 : : * UPnP is a protocol that allows devices to discover each other and control
126 : : * each other. In UPnP terminology, a device is either a "device" (a server
127 : : * that provides information about itself and allows itself to be controlled)
128 : : * or a "control point" (a client that controls "devices") or possibly both.
129 : : * This file implements a UPnP "device".
130 : : *
131 : : * For us, we use mostly basic UPnP discovery, but the control part of interest
132 : : * is WPS carried via UPnP messages. There is quite a bit of basic UPnP
133 : : * discovery to do before we can get to WPS, however.
134 : : *
135 : : * UPnP discovery begins with "devices" send out multicast UDP packets to a
136 : : * certain fixed multicast IP address and port, and "control points" sending
137 : : * out other such UDP packets.
138 : : *
139 : : * The packets sent by devices are NOTIFY packets (not to be confused with TCP
140 : : * NOTIFY packets that are used later) and those sent by control points are
141 : : * M-SEARCH packets. These packets contain a simple HTTP style header. The
142 : : * packets are sent redundantly to get around packet loss. Devices respond to
143 : : * M-SEARCH packets with HTTP-like UDP packets containing HTTP/1.1 200 OK
144 : : * messages, which give similar information as the UDP NOTIFY packets.
145 : : *
146 : : * The above UDP packets advertise the (arbitrary) TCP ports that the
147 : : * respective parties will listen to. The control point can then do a HTTP
148 : : * SUBSCRIBE (something like an HTTP PUT) after which the device can do a
149 : : * separate HTTP NOTIFY (also like an HTTP PUT) to do event messaging.
150 : : *
151 : : * The control point will also do HTTP GET of the "device file" listed in the
152 : : * original UDP information from the device (see UPNP_WPS_DEVICE_XML_FILE
153 : : * data), and based on this will do additional GETs... HTTP POSTs are done to
154 : : * cause an action.
155 : : *
156 : : * Beyond some basic information in HTTP headers, additional information is in
157 : : * the HTTP bodies, in a format set by the SOAP and XML standards, a markup
158 : : * language related to HTML used for web pages. This language is intended to
159 : : * provide the ultimate in self-documentation by providing a universal
160 : : * namespace based on pseudo-URLs called URIs. Note that although a URI looks
161 : : * like a URL (a web address), they are never accessed as such but are used
162 : : * only as identifiers.
163 : : *
164 : : * The POST of a GetDeviceInfo gets information similar to what might be
165 : : * obtained from a probe request or response on Wi-Fi. WPS messages M1-M8
166 : : * are passed via a POST of a PutMessage; the M1-M8 WPS messages are converted
167 : : * to a bin64 ascii representation for encapsulation. When proxying messages,
168 : : * WLANEvent and PutWLANResponse are used.
169 : : *
170 : : * This of course glosses over a lot of details.
171 : : */
172 : :
173 : : #include "includes.h"
174 : :
175 : : #include <time.h>
176 : : #include <net/if.h>
177 : : #include <netdb.h>
178 : : #include <sys/ioctl.h>
179 : :
180 : : #include "common.h"
181 : : #include "uuid.h"
182 : : #include "base64.h"
183 : : #include "wps.h"
184 : : #include "wps_i.h"
185 : : #include "wps_upnp.h"
186 : : #include "wps_upnp_i.h"
187 : :
188 : :
189 : : /*
190 : : * UPnP allows a client ("control point") to send a server like us ("device")
191 : : * a domain name for registration, and we are supposed to resolve it. This is
192 : : * bad because, using the standard Linux library, we will stall the entire
193 : : * hostapd waiting for resolution.
194 : : *
195 : : * The "correct" solution would be to use an event driven library for domain
196 : : * name resolution such as "ares". However, this would increase code size
197 : : * further. Since it is unlikely that we'll actually see such domain names, we
198 : : * can just refuse to accept them.
199 : : */
200 : : #define NO_DOMAIN_NAME_RESOLUTION 1 /* 1 to allow only dotted ip addresses */
201 : :
202 : :
203 : : /*
204 : : * UPnP does not scale well. If we were in a room with thousands of control
205 : : * points then potentially we could be expected to handle subscriptions for
206 : : * each of them, which would exhaust our memory. So we must set a limit. In
207 : : * practice we are unlikely to see more than one or two.
208 : : */
209 : : #define MAX_SUBSCRIPTIONS 4 /* how many subscribing clients we handle */
210 : : #define MAX_ADDR_PER_SUBSCRIPTION 8
211 : :
212 : : /* Maximum number of Probe Request events per second */
213 : : #define MAX_EVENTS_PER_SEC 5
214 : :
215 : :
216 : : static struct upnp_wps_device_sm *shared_upnp_device = NULL;
217 : :
218 : :
219 : : /* Write the current date/time per RFC */
220 : 58 : void format_date(struct wpabuf *buf)
221 : : {
222 : 58 : const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat";
223 : 58 : const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0"
224 : : "Jul\0Aug\0Sep\0Oct\0Nov\0Dec";
225 : : struct tm *date;
226 : : time_t t;
227 : :
228 : 58 : t = time(NULL);
229 : 58 : date = gmtime(&t);
230 : 58 : wpabuf_printf(buf, "%s, %02d %s %d %02d:%02d:%02d GMT",
231 : 58 : &weekday_str[date->tm_wday * 4], date->tm_mday,
232 : 116 : &month_str[date->tm_mon * 4], date->tm_year + 1900,
233 : : date->tm_hour, date->tm_min, date->tm_sec);
234 : 58 : }
235 : :
236 : :
237 : : /***************************************************************************
238 : : * UUIDs (unique identifiers)
239 : : *
240 : : * These are supposed to be unique in all the world.
241 : : * Sometimes permanent ones are used, sometimes temporary ones
242 : : * based on random numbers... there are different rules for valid content
243 : : * of different types.
244 : : * Each uuid is 16 bytes long.
245 : : **************************************************************************/
246 : :
247 : : /* uuid_make -- construct a random UUID
248 : : * The UPnP documents don't seem to offer any guidelines as to which method to
249 : : * use for constructing UUIDs for subscriptions. Presumably any method from
250 : : * rfc4122 is good enough; I've chosen random number method.
251 : : */
252 : 2 : static void uuid_make(u8 uuid[UUID_LEN])
253 : : {
254 : 2 : os_get_random(uuid, UUID_LEN);
255 : :
256 : : /* Replace certain bits as specified in rfc4122 or X.667 */
257 : 2 : uuid[6] &= 0x0f; uuid[6] |= (4 << 4); /* version 4 == random gen */
258 : 2 : uuid[8] &= 0x3f; uuid[8] |= 0x80;
259 : 2 : }
260 : :
261 : :
262 : : /*
263 : : * Subscriber address handling.
264 : : * Since a subscriber may have an arbitrary number of addresses, we have to
265 : : * add a bunch of code to handle them.
266 : : *
267 : : * Addresses are passed in text, and MAY be domain names instead of the (usual
268 : : * and expected) dotted IP addresses. Resolving domain names consumes a lot of
269 : : * resources. Worse, we are currently using the standard Linux getaddrinfo()
270 : : * which will block the entire program until complete or timeout! The proper
271 : : * solution would be to use the "ares" library or similar with more state
272 : : * machine steps etc. or just disable domain name resolution by setting
273 : : * NO_DOMAIN_NAME_RESOLUTION to 1 at top of this file.
274 : : */
275 : :
276 : : /* subscr_addr_delete -- delete single unlinked subscriber address
277 : : * (be sure to unlink first if need be)
278 : : */
279 : 2 : void subscr_addr_delete(struct subscr_addr *a)
280 : : {
281 : : /*
282 : : * Note: do NOT free domain_and_port or path because they point to
283 : : * memory within the allocation of "a".
284 : : */
285 : 2 : os_free(a);
286 : 2 : }
287 : :
288 : :
289 : : /* subscr_addr_free_all -- unlink and delete list of subscriber addresses. */
290 : 2 : static void subscr_addr_free_all(struct subscription *s)
291 : : {
292 : : struct subscr_addr *a, *tmp;
293 [ + + ]: 4 : dl_list_for_each_safe(a, tmp, &s->addr_list, struct subscr_addr, list)
294 : : {
295 : 2 : dl_list_del(&a->list);
296 : 2 : subscr_addr_delete(a);
297 : : }
298 : 2 : }
299 : :
300 : :
301 : : /* subscr_addr_add_url -- add address(es) for one url to subscription */
302 : 2 : static void subscr_addr_add_url(struct subscription *s, const char *url,
303 : : size_t url_len)
304 : : {
305 : : int alloc_len;
306 : 2 : char *scratch_mem = NULL;
307 : : char *mem;
308 : : char *host;
309 : : char *delim;
310 : : char *path;
311 : 2 : int port = 80; /* port to send to (default is port 80) */
312 : : struct addrinfo hints;
313 : 2 : struct addrinfo *result = NULL;
314 : : struct addrinfo *rp;
315 : : int rerr;
316 : : size_t host_len, path_len;
317 : :
318 : : /* url MUST begin with http: */
319 [ + - ][ + - ]: 2 : if (url_len < 7 || os_strncasecmp(url, "http://", 7))
320 : : goto fail;
321 : 2 : url += 7;
322 : 2 : url_len -= 7;
323 : :
324 : : /* Make a copy of the string to allow modification during parsing */
325 : 2 : scratch_mem = dup_binstr(url, url_len);
326 [ - + ]: 2 : if (scratch_mem == NULL)
327 : 0 : goto fail;
328 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Adding URL '%s'", scratch_mem);
329 : 2 : host = scratch_mem;
330 : 2 : path = os_strchr(host, '/');
331 [ + - ]: 2 : if (path)
332 : 2 : *path++ = '\0'; /* null terminate host */
333 : :
334 : : /* Process and remove optional port component */
335 : 2 : delim = os_strchr(host, ':');
336 [ + - ]: 2 : if (delim) {
337 : 2 : *delim = '\0'; /* null terminate host name for now */
338 [ + - ]: 2 : if (isdigit(delim[1]))
339 : 2 : port = atol(delim + 1);
340 : : }
341 : :
342 : : /*
343 : : * getaddrinfo does the right thing with dotted decimal notations, or
344 : : * will resolve domain names. Resolving domain names will unfortunately
345 : : * hang the entire program until it is resolved or it times out
346 : : * internal to getaddrinfo; fortunately we think that the use of actual
347 : : * domain names (vs. dotted decimal notations) should be uncommon.
348 : : */
349 : 2 : os_memset(&hints, 0, sizeof(struct addrinfo));
350 : 2 : hints.ai_family = AF_INET; /* IPv4 */
351 : 2 : hints.ai_socktype = SOCK_STREAM;
352 : : #if NO_DOMAIN_NAME_RESOLUTION
353 : : /* Suppress domain name resolutions that would halt
354 : : * the program for periods of time
355 : : */
356 : 2 : hints.ai_flags = AI_NUMERICHOST;
357 : : #else
358 : : /* Allow domain name resolution. */
359 : : hints.ai_flags = 0;
360 : : #endif
361 : 2 : hints.ai_protocol = 0; /* Any protocol? */
362 : 2 : rerr = getaddrinfo(host, NULL /* fill in port ourselves */,
363 : : &hints, &result);
364 [ - + ]: 2 : if (rerr) {
365 : 0 : wpa_printf(MSG_INFO, "WPS UPnP: Resolve error %d (%s) on: %s",
366 : : rerr, gai_strerror(rerr), host);
367 : 0 : goto fail;
368 : : }
369 : :
370 [ + - ]: 2 : if (delim)
371 : 2 : *delim = ':'; /* Restore port */
372 : :
373 : 2 : host_len = os_strlen(host);
374 [ + - ]: 2 : path_len = path ? os_strlen(path) : 0;
375 : 2 : alloc_len = host_len + 1 + 1 + path_len + 1;
376 : :
377 [ + + ]: 4 : for (rp = result; rp; rp = rp->ai_next) {
378 : : struct subscr_addr *a;
379 : :
380 : : /* Limit no. of address to avoid denial of service attack */
381 [ - + ]: 2 : if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) {
382 : 0 : wpa_printf(MSG_INFO, "WPS UPnP: subscr_addr_add_url: "
383 : : "Ignoring excessive addresses");
384 : 0 : break;
385 : : }
386 : :
387 : 2 : a = os_zalloc(sizeof(*a) + alloc_len);
388 [ - + ]: 2 : if (a == NULL)
389 : 0 : break;
390 : 2 : mem = (char *) (a + 1);
391 : 2 : a->domain_and_port = mem;
392 : 2 : os_memcpy(mem, host, host_len);
393 : 2 : mem += host_len + 1;
394 : 2 : a->path = mem;
395 [ + - ][ + - ]: 2 : if (path == NULL || path[0] != '/')
396 : 2 : *mem++ = '/';
397 [ + - ]: 2 : if (path)
398 : 2 : os_memcpy(mem, path, path_len);
399 : 2 : os_memcpy(&a->saddr, rp->ai_addr, sizeof(a->saddr));
400 : 2 : a->saddr.sin_port = htons(port);
401 : :
402 : 2 : dl_list_add(&s->addr_list, &a->list);
403 : : }
404 : :
405 : : fail:
406 [ + - ]: 2 : if (result)
407 : 2 : freeaddrinfo(result);
408 : 2 : os_free(scratch_mem);
409 : 2 : }
410 : :
411 : :
412 : : /* subscr_addr_list_create -- create list from urls in string.
413 : : * Each url is enclosed by angle brackets.
414 : : */
415 : 2 : static void subscr_addr_list_create(struct subscription *s,
416 : : const char *url_list)
417 : : {
418 : : const char *end;
419 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Parsing URL list '%s'", url_list);
420 : : for (;;) {
421 [ - + ][ - + ]: 4 : while (*url_list == ' ' || *url_list == '\t')
422 : 0 : url_list++;
423 [ + + ]: 4 : if (*url_list != '<')
424 : 2 : break;
425 : 2 : url_list++;
426 : 2 : end = os_strchr(url_list, '>');
427 [ - + ]: 2 : if (end == NULL)
428 : 0 : break;
429 : 2 : subscr_addr_add_url(s, url_list, end - url_list);
430 : 2 : url_list = end + 1;
431 : 2 : }
432 : 2 : }
433 : :
434 : :
435 : 0 : int send_wpabuf(int fd, struct wpabuf *buf)
436 : : {
437 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Send %lu byte message",
438 : : (unsigned long) wpabuf_len(buf));
439 : 0 : errno = 0;
440 [ # # ]: 0 : if (write(fd, wpabuf_head(buf), wpabuf_len(buf)) !=
441 : 0 : (int) wpabuf_len(buf)) {
442 : 0 : wpa_printf(MSG_ERROR, "WPS UPnP: Failed to send buffer: "
443 : : "errno=%d (%s)",
444 : 0 : errno, strerror(errno));
445 : 0 : return -1;
446 : : }
447 : :
448 : 0 : return 0;
449 : : }
450 : :
451 : :
452 : 20 : static void wpabuf_put_property(struct wpabuf *buf, const char *name,
453 : : const char *value)
454 : : {
455 : 20 : wpabuf_put_str(buf, "<e:property>");
456 : 20 : wpabuf_printf(buf, "<%s>", name);
457 [ + - ]: 20 : if (value)
458 : 20 : wpabuf_put_str(buf, value);
459 : 20 : wpabuf_printf(buf, "</%s>", name);
460 : 20 : wpabuf_put_str(buf, "</e:property>\n");
461 : 20 : }
462 : :
463 : :
464 : : /**
465 : : * upnp_wps_device_send_event - Queue event messages for subscribers
466 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
467 : : *
468 : : * This function queues the last WLANEvent to be sent for all currently
469 : : * subscribed UPnP control points. sm->wlanevent must have been set with the
470 : : * encoded data before calling this function.
471 : : */
472 : 17 : static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
473 : : {
474 : : /* Enqueue event message for all subscribers */
475 : : struct wpabuf *buf; /* holds event message */
476 : 17 : int buf_size = 0;
477 : : struct subscription *s, *tmp;
478 : : /* Actually, utf-8 is the default, but it doesn't hurt to specify it */
479 : 17 : const char *format_head =
480 : : "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
481 : : "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
482 : 17 : const char *format_tail = "</e:propertyset>\n";
483 : : struct os_reltime now;
484 : :
485 [ + + ]: 17 : if (dl_list_empty(&sm->subscriptions)) {
486 : : /* optimize */
487 : 3 : return;
488 : : }
489 : :
490 [ + - ]: 14 : if (os_get_reltime(&now) == 0) {
491 [ + + ]: 14 : if (now.sec != sm->last_event_sec) {
492 : 6 : sm->last_event_sec = now.sec;
493 : 6 : sm->num_events_in_sec = 1;
494 : : } else {
495 : 8 : sm->num_events_in_sec++;
496 : : /*
497 : : * In theory, this should apply to all WLANEvent
498 : : * notifications, but EAP messages are of much higher
499 : : * priority and Probe Request notifications should not
500 : : * be allowed to drop EAP messages, so only throttle
501 : : * Probe Request notifications.
502 : : */
503 [ - + ][ # # ]: 8 : if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC &&
504 : 0 : sm->wlanevent_type ==
505 : : UPNP_WPS_WLANEVENT_TYPE_PROBE) {
506 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle "
507 : : "event notifications (%u seen "
508 : : "during one second)",
509 : : sm->num_events_in_sec);
510 : 0 : return;
511 : : }
512 : : }
513 : : }
514 : :
515 : : /* Determine buffer size needed first */
516 : 14 : buf_size += os_strlen(format_head);
517 : 14 : buf_size += 50 + 2 * os_strlen("WLANEvent");
518 [ + - ]: 14 : if (sm->wlanevent)
519 : 14 : buf_size += os_strlen(sm->wlanevent);
520 : 14 : buf_size += os_strlen(format_tail);
521 : :
522 : 14 : buf = wpabuf_alloc(buf_size);
523 [ - + ]: 14 : if (buf == NULL)
524 : 0 : return;
525 : 14 : wpabuf_put_str(buf, format_head);
526 : 14 : wpabuf_put_property(buf, "WLANEvent", sm->wlanevent);
527 : 14 : wpabuf_put_str(buf, format_tail);
528 : :
529 : 14 : wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:\n%s",
530 : 14 : (char *) wpabuf_head(buf));
531 : :
532 [ + + ]: 28 : dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
533 : : list) {
534 : 14 : event_add(s, buf,
535 : 14 : sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
536 : : }
537 : :
538 : 17 : wpabuf_free(buf);
539 : : }
540 : :
541 : :
542 : : /*
543 : : * Event subscription (subscriber machines register with us to receive event
544 : : * messages).
545 : : * This is the result of an incoming HTTP over TCP SUBSCRIBE request.
546 : : */
547 : :
548 : : /* subscription_destroy -- destroy an unlinked subscription
549 : : * Be sure to unlink first if necessary.
550 : : */
551 : 2 : void subscription_destroy(struct subscription *s)
552 : : {
553 : : struct upnp_wps_device_interface *iface;
554 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
555 : 2 : subscr_addr_free_all(s);
556 : 2 : event_delete_all(s);
557 [ + + ]: 4 : dl_list_for_each(iface, &s->sm->interfaces,
558 : : struct upnp_wps_device_interface, list)
559 : 2 : upnp_er_remove_notification(iface->wps->registrar, s);
560 : 2 : os_free(s);
561 : 2 : }
562 : :
563 : :
564 : : /* subscription_list_age -- remove expired subscriptions */
565 : 2 : static void subscription_list_age(struct upnp_wps_device_sm *sm, time_t now)
566 : : {
567 : : struct subscription *s, *tmp;
568 [ - + ]: 2 : dl_list_for_each_safe(s, tmp, &sm->subscriptions,
569 : : struct subscription, list) {
570 [ # # ]: 0 : if (s->timeout_time > now)
571 : 0 : break;
572 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Removing aged subscription");
573 : 0 : dl_list_del(&s->list);
574 : 0 : subscription_destroy(s);
575 : : }
576 : 2 : }
577 : :
578 : :
579 : : /* subscription_find -- return existing subscription matching uuid, if any
580 : : * returns NULL if not found
581 : : */
582 : 0 : struct subscription * subscription_find(struct upnp_wps_device_sm *sm,
583 : : const u8 uuid[UUID_LEN])
584 : : {
585 : : struct subscription *s;
586 [ # # ]: 0 : dl_list_for_each(s, &sm->subscriptions, struct subscription, list) {
587 [ # # ]: 0 : if (os_memcmp(s->uuid, uuid, UUID_LEN) == 0)
588 : 0 : return s; /* Found match */
589 : : }
590 : 0 : return NULL;
591 : : }
592 : :
593 : :
594 : 1 : static struct wpabuf * build_fake_wsc_ack(void)
595 : : {
596 : 1 : struct wpabuf *msg = wpabuf_alloc(100);
597 [ - + ]: 1 : if (msg == NULL)
598 : 0 : return NULL;
599 : 1 : wpabuf_put_u8(msg, UPNP_WPS_WLANEVENT_TYPE_EAP);
600 : 1 : wpabuf_put_str(msg, "00:00:00:00:00:00");
601 [ + - - + ]: 2 : if (wps_build_version(msg) ||
602 : 1 : wps_build_msg_type(msg, WPS_WSC_ACK)) {
603 : 0 : wpabuf_free(msg);
604 : 0 : return NULL;
605 : : }
606 : : /* Enrollee Nonce */
607 : 1 : wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE);
608 : 1 : wpabuf_put_be16(msg, WPS_NONCE_LEN);
609 : 1 : wpabuf_put(msg, WPS_NONCE_LEN);
610 : : /* Registrar Nonce */
611 : 1 : wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
612 : 1 : wpabuf_put_be16(msg, WPS_NONCE_LEN);
613 : 1 : wpabuf_put(msg, WPS_NONCE_LEN);
614 : 1 : wps_build_wfa_ext(msg, 0, NULL, 0);
615 : 1 : return msg;
616 : : }
617 : :
618 : :
619 : : /* subscription_first_event -- send format/queue event that is automatically
620 : : * sent on a new subscription.
621 : : */
622 : 2 : static int subscription_first_event(struct subscription *s)
623 : : {
624 : : /*
625 : : * Actually, utf-8 is the default, but it doesn't hurt to specify it.
626 : : *
627 : : * APStatus is apparently a bit set,
628 : : * 0x1 = configuration change (but is always set?)
629 : : * 0x10 = ap is locked
630 : : *
631 : : * Per UPnP spec, we send out the last value of each variable, even
632 : : * for WLANEvent, whatever it was.
633 : : */
634 : : char *wlan_event;
635 : : struct wpabuf *buf;
636 : 2 : int ap_status = 1; /* TODO: add 0x10 if access point is locked */
637 : 2 : const char *head =
638 : : "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
639 : : "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
640 : 2 : const char *tail = "</e:propertyset>\n";
641 : : char txt[10];
642 : : int ret;
643 : :
644 [ + + ]: 2 : if (s->sm->wlanevent == NULL) {
645 : : /*
646 : : * There has been no events before the subscription. However,
647 : : * UPnP device architecture specification requires all the
648 : : * evented variables to be included, so generate a dummy event
649 : : * for this particular case using a WSC_ACK and all-zeros
650 : : * nonces. The ER (UPnP control point) will ignore this, but at
651 : : * least it will learn that WLANEvent variable will be used in
652 : : * event notifications in the future.
653 : : */
654 : : struct wpabuf *msg;
655 : 1 : wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the "
656 : : "initial WLANEvent");
657 : 1 : msg = build_fake_wsc_ack();
658 [ + - ]: 1 : if (msg) {
659 : 2 : s->sm->wlanevent = (char *)
660 : 1 : base64_encode(wpabuf_head(msg),
661 : : wpabuf_len(msg), NULL);
662 : 1 : wpabuf_free(msg);
663 : : }
664 : : }
665 : :
666 : 2 : wlan_event = s->sm->wlanevent;
667 [ + - ][ - + ]: 2 : if (wlan_event == NULL || *wlan_event == '\0') {
668 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for "
669 : : "initial event message");
670 : 0 : wlan_event = "";
671 : : }
672 : 2 : buf = wpabuf_alloc(500 + os_strlen(wlan_event));
673 [ - + ]: 2 : if (buf == NULL)
674 : 0 : return -1;
675 : :
676 : 2 : wpabuf_put_str(buf, head);
677 : 2 : wpabuf_put_property(buf, "STAStatus", "1");
678 : 2 : os_snprintf(txt, sizeof(txt), "%d", ap_status);
679 : 2 : wpabuf_put_property(buf, "APStatus", txt);
680 [ + - ]: 2 : if (*wlan_event)
681 : 2 : wpabuf_put_property(buf, "WLANEvent", wlan_event);
682 : 2 : wpabuf_put_str(buf, tail);
683 : :
684 : 2 : ret = event_add(s, buf, 0);
685 [ - + ]: 2 : if (ret) {
686 : 0 : wpabuf_free(buf);
687 : 0 : return ret;
688 : : }
689 : 2 : wpabuf_free(buf);
690 : :
691 : 2 : return 0;
692 : : }
693 : :
694 : :
695 : : /**
696 : : * subscription_start - Remember a UPnP control point to send events to.
697 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
698 : : * @callback_urls: Callback URLs
699 : : * Returns: %NULL on error, or pointer to new subscription structure.
700 : : */
701 : 2 : struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
702 : : const char *callback_urls)
703 : : {
704 : : struct subscription *s;
705 : 2 : time_t now = time(NULL);
706 : 2 : time_t expire = now + UPNP_SUBSCRIBE_SEC;
707 : :
708 : : /* Get rid of expired subscriptions so we have room */
709 : 2 : subscription_list_age(sm, now);
710 : :
711 : : /* If too many subscriptions, remove oldest */
712 [ - + ]: 2 : if (dl_list_len(&sm->subscriptions) >= MAX_SUBSCRIPTIONS) {
713 [ # # ]: 0 : s = dl_list_first(&sm->subscriptions, struct subscription,
714 : : list);
715 : 0 : wpa_printf(MSG_INFO, "WPS UPnP: Too many subscriptions, "
716 : : "trashing oldest");
717 : 0 : dl_list_del(&s->list);
718 : 0 : subscription_destroy(s);
719 : : }
720 : :
721 : 2 : s = os_zalloc(sizeof(*s));
722 [ - + ]: 2 : if (s == NULL)
723 : 0 : return NULL;
724 : 2 : dl_list_init(&s->addr_list);
725 : 2 : dl_list_init(&s->event_queue);
726 : :
727 : 2 : s->sm = sm;
728 : 2 : s->timeout_time = expire;
729 : 2 : uuid_make(s->uuid);
730 : 2 : subscr_addr_list_create(s, callback_urls);
731 [ - + ]: 2 : if (dl_list_empty(&s->addr_list)) {
732 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: No valid callback URLs in "
733 : : "'%s' - drop subscription", callback_urls);
734 : 0 : subscription_destroy(s);
735 : 0 : return NULL;
736 : : }
737 : :
738 : : /* Add to end of list, since it has the highest expiration time */
739 : 2 : dl_list_add_tail(&sm->subscriptions, &s->list);
740 : : /* Queue up immediate event message (our last event)
741 : : * as required by UPnP spec.
742 : : */
743 [ - + ]: 2 : if (subscription_first_event(s)) {
744 : 0 : wpa_printf(MSG_INFO, "WPS UPnP: Dropping subscriber due to "
745 : : "event backlog");
746 : 0 : dl_list_del(&s->list);
747 : 0 : subscription_destroy(s);
748 : 0 : return NULL;
749 : : }
750 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p started with %s",
751 : : s, callback_urls);
752 : : /* Schedule sending this */
753 : 2 : event_send_all_later(sm);
754 : 2 : return s;
755 : : }
756 : :
757 : :
758 : : /* subscription_renew -- find subscription and reset timeout */
759 : 0 : struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
760 : : const u8 uuid[UUID_LEN])
761 : : {
762 : 0 : time_t now = time(NULL);
763 : 0 : time_t expire = now + UPNP_SUBSCRIBE_SEC;
764 : 0 : struct subscription *s = subscription_find(sm, uuid);
765 [ # # ]: 0 : if (s == NULL)
766 : 0 : return NULL;
767 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewed");
768 : 0 : dl_list_del(&s->list);
769 : 0 : s->timeout_time = expire;
770 : : /* add back to end of list, since it now has highest expiry */
771 : 0 : dl_list_add_tail(&sm->subscriptions, &s->list);
772 : 0 : return s;
773 : : }
774 : :
775 : :
776 : : /**
777 : : * upnp_wps_device_send_wlan_event - Event notification
778 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
779 : : * @from_mac_addr: Source (Enrollee) MAC address for the event
780 : : * @ev_type: Event type
781 : : * @msg: Event data
782 : : * Returns: 0 on success, -1 on failure
783 : : *
784 : : * Tell external Registrars (UPnP control points) that something happened. In
785 : : * particular, events include WPS messages from clients that are proxied to
786 : : * external Registrars.
787 : : */
788 : 105 : int upnp_wps_device_send_wlan_event(struct upnp_wps_device_sm *sm,
789 : : const u8 from_mac_addr[ETH_ALEN],
790 : : enum upnp_wps_wlanevent_type ev_type,
791 : : const struct wpabuf *msg)
792 : : {
793 : 105 : int ret = -1;
794 : : char type[2];
795 : 105 : const u8 *mac = from_mac_addr;
796 : : char mac_text[18];
797 : 105 : u8 *raw = NULL;
798 : : size_t raw_len;
799 : : char *val;
800 : : size_t val_len;
801 : 105 : int pos = 0;
802 : :
803 [ + + ]: 105 : if (!sm)
804 : 88 : goto fail;
805 : :
806 : 17 : os_snprintf(type, sizeof(type), "%1u", ev_type);
807 : :
808 [ + - ]: 17 : raw_len = 1 + 17 + (msg ? wpabuf_len(msg) : 0);
809 : 17 : raw = os_zalloc(raw_len);
810 [ - + ]: 17 : if (!raw)
811 : 0 : goto fail;
812 : :
813 : 17 : *(raw + pos) = (u8) ev_type;
814 : 17 : pos += 1;
815 : 17 : os_snprintf(mac_text, sizeof(mac_text), MACSTR, MAC2STR(mac));
816 : 17 : wpa_printf(MSG_DEBUG, "WPS UPnP: Proxying WLANEvent from %s",
817 : : mac_text);
818 : 17 : os_memcpy(raw + pos, mac_text, 17);
819 : 17 : pos += 17;
820 [ + - ]: 17 : if (msg) {
821 : 17 : os_memcpy(raw + pos, wpabuf_head(msg), wpabuf_len(msg));
822 : 17 : pos += wpabuf_len(msg);
823 : : }
824 : 17 : raw_len = pos;
825 : :
826 : 17 : val = (char *) base64_encode(raw, raw_len, &val_len);
827 [ - + ]: 17 : if (val == NULL)
828 : 0 : goto fail;
829 : :
830 : 17 : os_free(sm->wlanevent);
831 : 17 : sm->wlanevent = val;
832 : 17 : sm->wlanevent_type = ev_type;
833 : 17 : upnp_wps_device_send_event(sm);
834 : :
835 : 17 : ret = 0;
836 : :
837 : : fail:
838 : 105 : os_free(raw);
839 : :
840 : 105 : return ret;
841 : : }
842 : :
843 : :
844 : : #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
845 : : #include <sys/sysctl.h>
846 : : #include <net/route.h>
847 : : #include <net/if_dl.h>
848 : :
849 : : static int eth_get(const char *device, u8 ea[ETH_ALEN])
850 : : {
851 : : struct if_msghdr *ifm;
852 : : struct sockaddr_dl *sdl;
853 : : u_char *p, *buf;
854 : : size_t len;
855 : : int mib[] = { CTL_NET, AF_ROUTE, 0, AF_LINK, NET_RT_IFLIST, 0 };
856 : :
857 : : if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0)
858 : : return -1;
859 : : if ((buf = os_malloc(len)) == NULL)
860 : : return -1;
861 : : if (sysctl(mib, 6, buf, &len, NULL, 0) < 0) {
862 : : os_free(buf);
863 : : return -1;
864 : : }
865 : : for (p = buf; p < buf + len; p += ifm->ifm_msglen) {
866 : : ifm = (struct if_msghdr *)p;
867 : : sdl = (struct sockaddr_dl *)(ifm + 1);
868 : : if (ifm->ifm_type != RTM_IFINFO ||
869 : : (ifm->ifm_addrs & RTA_IFP) == 0)
870 : : continue;
871 : : if (sdl->sdl_family != AF_LINK || sdl->sdl_nlen == 0 ||
872 : : os_memcmp(sdl->sdl_data, device, sdl->sdl_nlen) != 0)
873 : : continue;
874 : : os_memcpy(ea, LLADDR(sdl), sdl->sdl_alen);
875 : : break;
876 : : }
877 : : os_free(buf);
878 : :
879 : : if (p >= buf + len) {
880 : : errno = ESRCH;
881 : : return -1;
882 : : }
883 : : return 0;
884 : : }
885 : : #endif /* __FreeBSD__ */
886 : :
887 : :
888 : : /**
889 : : * get_netif_info - Get hw and IP addresses for network device
890 : : * @net_if: Selected network interface name
891 : : * @ip_addr: Buffer for returning IP address in network byte order
892 : : * @ip_addr_text: Buffer for returning a pointer to allocated IP address text
893 : : * @mac: Buffer for returning MAC address
894 : : * Returns: 0 on success, -1 on failure
895 : : */
896 : 3 : int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
897 : : u8 mac[ETH_ALEN])
898 : : {
899 : : struct ifreq req;
900 : 3 : int sock = -1;
901 : : struct sockaddr_in *addr;
902 : : struct in_addr in_addr;
903 : :
904 : 3 : *ip_addr_text = os_zalloc(16);
905 [ - + ]: 3 : if (*ip_addr_text == NULL)
906 : 0 : goto fail;
907 : :
908 : 3 : sock = socket(AF_INET, SOCK_DGRAM, 0);
909 [ - + ]: 3 : if (sock < 0)
910 : 0 : goto fail;
911 : :
912 : 3 : os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
913 [ - + ]: 3 : if (ioctl(sock, SIOCGIFADDR, &req) < 0) {
914 : 0 : wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFADDR failed: %d (%s)",
915 : 0 : errno, strerror(errno));
916 : 0 : goto fail;
917 : : }
918 : 3 : addr = (void *) &req.ifr_addr;
919 : 3 : *ip_addr = addr->sin_addr.s_addr;
920 : 3 : in_addr.s_addr = *ip_addr;
921 : 3 : os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr));
922 : :
923 : : #ifdef __linux__
924 : 3 : os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
925 [ - + ]: 3 : if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) {
926 : 0 : wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFHWADDR failed: "
927 : 0 : "%d (%s)", errno, strerror(errno));
928 : 0 : goto fail;
929 : : }
930 : 3 : os_memcpy(mac, req.ifr_addr.sa_data, 6);
931 : : #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
932 : : if (eth_get(net_if, mac) < 0) {
933 : : wpa_printf(MSG_ERROR, "WPS UPnP: Failed to get MAC address");
934 : : goto fail;
935 : : }
936 : : #else
937 : : #error MAC address fetch not implemented
938 : : #endif
939 : :
940 : 3 : close(sock);
941 : 3 : return 0;
942 : :
943 : : fail:
944 [ # # ]: 0 : if (sock >= 0)
945 : 0 : close(sock);
946 : 0 : os_free(*ip_addr_text);
947 : 0 : *ip_addr_text = NULL;
948 : 3 : return -1;
949 : : }
950 : :
951 : :
952 : 2 : static void upnp_wps_free_msearchreply(struct dl_list *head)
953 : : {
954 : : struct advertisement_state_machine *a, *tmp;
955 [ - + ]: 2 : dl_list_for_each_safe(a, tmp, head, struct advertisement_state_machine,
956 : : list)
957 : 0 : msearchreply_state_machine_stop(a);
958 : 2 : }
959 : :
960 : :
961 : 2 : static void upnp_wps_free_subscriptions(struct dl_list *head,
962 : : struct wps_registrar *reg)
963 : : {
964 : : struct subscription *s, *tmp;
965 [ + + ]: 4 : dl_list_for_each_safe(s, tmp, head, struct subscription, list) {
966 [ - + ][ # # ]: 2 : if (reg && s->reg != reg)
967 : 0 : continue;
968 : 2 : dl_list_del(&s->list);
969 : 2 : subscription_destroy(s);
970 : : }
971 : 2 : }
972 : :
973 : :
974 : : /**
975 : : * upnp_wps_device_stop - Stop WPS UPnP operations on an interface
976 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
977 : : */
978 : 2 : static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
979 : : {
980 [ + - ][ - + ]: 2 : if (!sm || !sm->started)
981 : 2 : return;
982 : :
983 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Stop device");
984 : 2 : web_listener_stop(sm);
985 : 2 : ssdp_listener_stop(sm);
986 : 2 : upnp_wps_free_msearchreply(&sm->msearch_replies);
987 : 2 : upnp_wps_free_subscriptions(&sm->subscriptions, NULL);
988 : :
989 : 2 : advertisement_state_machine_stop(sm, 1);
990 : :
991 : 2 : event_send_stop_all(sm);
992 : 2 : os_free(sm->wlanevent);
993 : 2 : sm->wlanevent = NULL;
994 : 2 : os_free(sm->ip_addr_text);
995 : 2 : sm->ip_addr_text = NULL;
996 [ + - ]: 2 : if (sm->multicast_sd >= 0)
997 : 2 : close(sm->multicast_sd);
998 : 2 : sm->multicast_sd = -1;
999 : :
1000 : 2 : sm->started = 0;
1001 : : }
1002 : :
1003 : :
1004 : : /**
1005 : : * upnp_wps_device_start - Start WPS UPnP operations on an interface
1006 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1007 : : * @net_if: Selected network interface name
1008 : : * Returns: 0 on success, -1 on failure
1009 : : */
1010 : 2 : static int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if)
1011 : : {
1012 [ + - ][ - + ]: 2 : if (!sm || !net_if)
1013 : 0 : return -1;
1014 : :
1015 [ - + ]: 2 : if (sm->started)
1016 : 0 : upnp_wps_device_stop(sm);
1017 : :
1018 : 2 : sm->multicast_sd = -1;
1019 : 2 : sm->ssdp_sd = -1;
1020 : 2 : sm->started = 1;
1021 : 2 : sm->advertise_count = 0;
1022 : :
1023 : : /* Fix up linux multicast handling */
1024 [ - + ]: 2 : if (add_ssdp_network(net_if))
1025 : 0 : goto fail;
1026 : :
1027 : : /* Determine which IP and mac address we're using */
1028 [ - + ]: 2 : if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text,
1029 : 2 : sm->mac_addr)) {
1030 : 0 : wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1031 : : "for %s. Does it have IP address?", net_if);
1032 : 0 : goto fail;
1033 : : }
1034 : :
1035 : : /* Listen for incoming TCP connections so that others
1036 : : * can fetch our "xml files" from us.
1037 : : */
1038 [ - + ]: 2 : if (web_listener_start(sm))
1039 : 0 : goto fail;
1040 : :
1041 : : /* Set up for receiving discovery (UDP) packets */
1042 [ - + ]: 2 : if (ssdp_listener_start(sm))
1043 : 0 : goto fail;
1044 : :
1045 : : /* Set up for sending multicast */
1046 [ - + ]: 2 : if (ssdp_open_multicast(sm) < 0)
1047 : 0 : goto fail;
1048 : :
1049 : : /*
1050 : : * Broadcast NOTIFY messages to let the world know we exist.
1051 : : * This is done via a state machine since the messages should not be
1052 : : * all sent out at once.
1053 : : */
1054 [ - + ]: 2 : if (advertisement_state_machine_start(sm))
1055 : 0 : goto fail;
1056 : :
1057 : 2 : return 0;
1058 : :
1059 : : fail:
1060 : 0 : upnp_wps_device_stop(sm);
1061 : 2 : return -1;
1062 : : }
1063 : :
1064 : :
1065 : : static struct upnp_wps_device_interface *
1066 : 2 : upnp_wps_get_iface(struct upnp_wps_device_sm *sm, void *priv)
1067 : : {
1068 : : struct upnp_wps_device_interface *iface;
1069 [ + - ]: 2 : dl_list_for_each(iface, &sm->interfaces,
1070 : : struct upnp_wps_device_interface, list) {
1071 [ + - ]: 2 : if (iface->priv == priv)
1072 : 2 : return iface;
1073 : : }
1074 : 2 : return NULL;
1075 : : }
1076 : :
1077 : :
1078 : : /**
1079 : : * upnp_wps_device_deinit - Deinitialize WPS UPnP
1080 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1081 : : * @priv: External context data that was used in upnp_wps_device_init() call
1082 : : */
1083 : 74 : void upnp_wps_device_deinit(struct upnp_wps_device_sm *sm, void *priv)
1084 : : {
1085 : : struct upnp_wps_device_interface *iface;
1086 : :
1087 [ + + ]: 74 : if (!sm)
1088 : 72 : return;
1089 : :
1090 : 2 : iface = upnp_wps_get_iface(sm, priv);
1091 [ - + ]: 2 : if (iface == NULL) {
1092 : 0 : wpa_printf(MSG_ERROR, "WPS UPnP: Could not find the interface "
1093 : : "instance to deinit");
1094 : 0 : return;
1095 : : }
1096 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Deinit interface instance %p", iface);
1097 [ + - ]: 2 : if (dl_list_len(&sm->interfaces) == 1) {
1098 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Deinitializing last instance "
1099 : : "- free global device instance");
1100 : 2 : upnp_wps_device_stop(sm);
1101 : : } else
1102 : 0 : upnp_wps_free_subscriptions(&sm->subscriptions,
1103 : 0 : iface->wps->registrar);
1104 : 2 : dl_list_del(&iface->list);
1105 : :
1106 [ + - ]: 2 : if (iface->peer.wps)
1107 : 2 : wps_deinit(iface->peer.wps);
1108 : 2 : os_free(iface->ctx->ap_pin);
1109 : 2 : os_free(iface->ctx);
1110 : 2 : os_free(iface);
1111 : :
1112 [ + - ]: 2 : if (dl_list_empty(&sm->interfaces)) {
1113 : 2 : os_free(sm->root_dir);
1114 : 2 : os_free(sm->desc_url);
1115 : 2 : os_free(sm);
1116 : 74 : shared_upnp_device = NULL;
1117 : : }
1118 : : }
1119 : :
1120 : :
1121 : : /**
1122 : : * upnp_wps_device_init - Initialize WPS UPnP
1123 : : * @ctx: callback table; we must eventually free it
1124 : : * @wps: Pointer to longterm WPS context
1125 : : * @priv: External context data that will be used in callbacks
1126 : : * @net_if: Selected network interface name
1127 : : * Returns: WPS UPnP state or %NULL on failure
1128 : : */
1129 : : struct upnp_wps_device_sm *
1130 : 2 : upnp_wps_device_init(struct upnp_wps_device_ctx *ctx, struct wps_context *wps,
1131 : : void *priv, char *net_if)
1132 : : {
1133 : : struct upnp_wps_device_sm *sm;
1134 : : struct upnp_wps_device_interface *iface;
1135 : 2 : int start = 0;
1136 : :
1137 : 2 : iface = os_zalloc(sizeof(*iface));
1138 [ - + ]: 2 : if (iface == NULL) {
1139 : 0 : os_free(ctx->ap_pin);
1140 : 0 : os_free(ctx);
1141 : 0 : return NULL;
1142 : : }
1143 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Init interface instance %p", iface);
1144 : :
1145 : 2 : iface->ctx = ctx;
1146 : 2 : iface->wps = wps;
1147 : 2 : iface->priv = priv;
1148 : :
1149 [ - + ]: 2 : if (shared_upnp_device) {
1150 : 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Share existing device "
1151 : : "context");
1152 : 0 : sm = shared_upnp_device;
1153 : : } else {
1154 : 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Initialize device context");
1155 : 2 : sm = os_zalloc(sizeof(*sm));
1156 [ - + ]: 2 : if (!sm) {
1157 : 0 : wpa_printf(MSG_ERROR, "WPS UPnP: upnp_wps_device_init "
1158 : : "failed");
1159 : 0 : os_free(iface);
1160 : 0 : os_free(ctx->ap_pin);
1161 : 0 : os_free(ctx);
1162 : 0 : return NULL;
1163 : : }
1164 : 2 : shared_upnp_device = sm;
1165 : :
1166 : 2 : dl_list_init(&sm->msearch_replies);
1167 : 2 : dl_list_init(&sm->subscriptions);
1168 : 2 : dl_list_init(&sm->interfaces);
1169 : 2 : start = 1;
1170 : : }
1171 : :
1172 : 2 : dl_list_add(&sm->interfaces, &iface->list);
1173 : :
1174 [ - + ][ + - ]: 2 : if (start && upnp_wps_device_start(sm, net_if)) {
1175 : 0 : upnp_wps_device_deinit(sm, priv);
1176 : 0 : return NULL;
1177 : : }
1178 : :
1179 : :
1180 : 2 : return sm;
1181 : : }
1182 : :
1183 : :
1184 : : /**
1185 : : * upnp_wps_subscribers - Check whether there are any event subscribers
1186 : : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1187 : : * Returns: 0 if no subscribers, 1 if subscribers
1188 : : */
1189 : 4 : int upnp_wps_subscribers(struct upnp_wps_device_sm *sm)
1190 : : {
1191 : 4 : return !dl_list_empty(&sm->subscriptions);
1192 : : }
1193 : :
1194 : :
1195 : 0 : int upnp_wps_set_ap_pin(struct upnp_wps_device_sm *sm, const char *ap_pin)
1196 : : {
1197 : : struct upnp_wps_device_interface *iface;
1198 [ # # ]: 0 : if (sm == NULL)
1199 : 0 : return 0;
1200 : :
1201 [ # # ]: 0 : dl_list_for_each(iface, &sm->interfaces,
1202 : : struct upnp_wps_device_interface, list) {
1203 : 0 : os_free(iface->ctx->ap_pin);
1204 [ # # ]: 0 : if (ap_pin) {
1205 : 0 : iface->ctx->ap_pin = os_strdup(ap_pin);
1206 [ # # ]: 0 : if (iface->ctx->ap_pin == NULL)
1207 : 0 : return -1;
1208 : : } else
1209 : 0 : iface->ctx->ap_pin = NULL;
1210 : : }
1211 : :
1212 : 0 : return 0;
1213 : : }
|
