LCOV - code coverage report
Current view: top level - src/wps - wps_er.c (source / functions) Hit Total Coverage
Test: wpa_supplicant/hostapd combined for hwsim test run 1422976643 Lines: 846 1115 75.9 %
Date: 2015-02-03 Functions: 67 72 93.1 %

          Line data    Source code
       1             : /*
       2             :  * Wi-Fi Protected Setup - External Registrar
       3             :  * Copyright (c) 2009-2013, Jouni Malinen <j@w1.fi>
       4             :  *
       5             :  * This software may be distributed under the terms of the BSD license.
       6             :  * See README for more details.
       7             :  */
       8             : 
       9             : #include "includes.h"
      10             : 
      11             : #include "common.h"
      12             : #include "base64.h"
      13             : #include "uuid.h"
      14             : #include "eloop.h"
      15             : #include "httpread.h"
      16             : #include "http_client.h"
      17             : #include "http_server.h"
      18             : #include "upnp_xml.h"
      19             : #include "wps_i.h"
      20             : #include "wps_upnp.h"
      21             : #include "wps_upnp_i.h"
      22             : #include "wps_er.h"
      23             : 
      24             : 
      25             : static void wps_er_deinit_finish(void *eloop_data, void *user_ctx);
      26             : static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
      27             : static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
      28             : static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
      29             : static int wps_er_send_get_device_info(struct wps_er_ap *ap,
      30             :                                        void (*m1_handler)(struct wps_er_ap *ap,
      31             :                                                           struct wpabuf *m1));
      32             : 
      33             : 
      34          51 : static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
      35             :                              enum wps_event event)
      36             : {
      37             :         union wps_event_data data;
      38          51 :         struct wps_event_er_enrollee *ev = &data.enrollee;
      39             : 
      40          51 :         if (wps->event_cb == NULL)
      41          51 :                 return;
      42             : 
      43          51 :         os_memset(&data, 0, sizeof(data));
      44          51 :         ev->uuid = sta->uuid;
      45          51 :         ev->mac_addr = sta->addr;
      46          51 :         ev->m1_received = sta->m1_received;
      47          51 :         ev->config_methods = sta->config_methods;
      48          51 :         ev->dev_passwd_id = sta->dev_passwd_id;
      49          51 :         ev->pri_dev_type = sta->pri_dev_type;
      50          51 :         ev->dev_name = sta->dev_name;
      51          51 :         ev->manufacturer = sta->manufacturer;
      52          51 :         ev->model_name = sta->model_name;
      53          51 :         ev->model_number = sta->model_number;
      54          51 :         ev->serial_number = sta->serial_number;
      55          51 :         wps->event_cb(wps->cb_ctx, event, &data);
      56             : }
      57             : 
      58             : 
      59          58 : static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr,
      60             :                                           const u8 *uuid)
      61             : {
      62             :         struct wps_er_sta *sta;
      63          72 :         dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
      64         100 :                 if ((addr == NULL ||
      65          86 :                      os_memcmp(sta->addr, addr, ETH_ALEN) == 0) &&
      66           0 :                     (uuid == NULL ||
      67           0 :                      os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0))
      68          36 :                         return sta;
      69             :         }
      70          22 :         return NULL;
      71             : }
      72             : 
      73             : 
      74          21 : static void wps_er_sta_free(struct wps_er_sta *sta)
      75             : {
      76          21 :         wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
      77          21 :         if (sta->wps)
      78           2 :                 wps_deinit(sta->wps);
      79          21 :         os_free(sta->manufacturer);
      80          21 :         os_free(sta->model_name);
      81          21 :         os_free(sta->model_number);
      82          21 :         os_free(sta->serial_number);
      83          21 :         os_free(sta->dev_name);
      84          21 :         http_client_free(sta->http);
      85          21 :         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
      86          21 :         os_free(sta->cred);
      87          21 :         os_free(sta);
      88          21 : }
      89             : 
      90             : 
      91          10 : static void wps_er_sta_remove_all(struct wps_er_ap *ap)
      92             : {
      93             :         struct wps_er_sta *prev, *sta;
      94          31 :         dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
      95          21 :                 wps_er_sta_free(sta);
      96          10 : }
      97             : 
      98             : 
      99          55 : static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
     100             :                                         struct in_addr *addr, const u8 *uuid,
     101             :                                         const u8 *mac_addr)
     102             : {
     103             :         struct wps_er_ap *ap;
     104          55 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
     105          45 :                 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
     106          38 :                     (uuid == NULL ||
     107          83 :                      os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0) &&
     108           7 :                     (mac_addr == NULL ||
     109           7 :                      os_memcmp(mac_addr, ap->mac_addr, ETH_ALEN) == 0))
     110          45 :                         return ap;
     111             :         }
     112          10 :         return NULL;
     113             : }
     114             : 
     115             : 
     116          54 : static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
     117             : {
     118             :         struct wps_er_ap *ap;
     119          54 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
     120          54 :                 if (ap->id == id)
     121          54 :                         return ap;
     122             :         }
     123           0 :         return NULL;
     124             : }
     125             : 
     126             : 
     127          21 : static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
     128             :                             enum wps_event event)
     129             : {
     130             :         union wps_event_data data;
     131          21 :         struct wps_event_er_ap *evap = &data.ap;
     132             : 
     133          21 :         if (wps->event_cb == NULL)
     134          21 :                 return;
     135             : 
     136          21 :         os_memset(&data, 0, sizeof(data));
     137          21 :         evap->uuid = ap->uuid;
     138          21 :         evap->friendly_name = ap->friendly_name;
     139          21 :         evap->manufacturer = ap->manufacturer;
     140          21 :         evap->manufacturer_url = ap->manufacturer_url;
     141          21 :         evap->model_description = ap->model_description;
     142          21 :         evap->model_name = ap->model_name;
     143          21 :         evap->model_number = ap->model_number;
     144          21 :         evap->model_url = ap->model_url;
     145          21 :         evap->serial_number = ap->serial_number;
     146          21 :         evap->upc = ap->upc;
     147          21 :         evap->pri_dev_type = ap->pri_dev_type;
     148          21 :         evap->wps_state = ap->wps_state;
     149          21 :         evap->mac_addr = ap->mac_addr;
     150          21 :         wps->event_cb(wps->cb_ctx, event, &data);
     151             : }
     152             : 
     153             : 
     154          10 : static void wps_er_ap_free(struct wps_er_ap *ap)
     155             : {
     156          10 :         http_client_free(ap->http);
     157          10 :         ap->http = NULL;
     158             : 
     159          10 :         os_free(ap->location);
     160          10 :         os_free(ap->friendly_name);
     161          10 :         os_free(ap->manufacturer);
     162          10 :         os_free(ap->manufacturer_url);
     163          10 :         os_free(ap->model_description);
     164          10 :         os_free(ap->model_name);
     165          10 :         os_free(ap->model_number);
     166          10 :         os_free(ap->model_url);
     167          10 :         os_free(ap->serial_number);
     168          10 :         os_free(ap->udn);
     169          10 :         os_free(ap->upc);
     170             : 
     171          10 :         os_free(ap->scpd_url);
     172          10 :         os_free(ap->control_url);
     173          10 :         os_free(ap->event_sub_url);
     174             : 
     175          10 :         os_free(ap->ap_settings);
     176             : 
     177          10 :         os_free(ap);
     178          10 : }
     179             : 
     180             : 
     181          10 : static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap)
     182             : {
     183          10 :         wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)",
     184             :                    inet_ntoa(ap->addr), ap->location);
     185          10 :         dl_list_del(&ap->list);
     186          10 :         wps_er_ap_free(ap);
     187             : 
     188          10 :         if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing))
     189          10 :                 wps_er_deinit_finish(er, NULL);
     190          10 : }
     191             : 
     192             : 
     193          10 : static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c,
     194             :                                        enum http_client_event event)
     195             : {
     196          10 :         struct wps_er_ap *ap = ctx;
     197             : 
     198          10 :         switch (event) {
     199             :         case HTTP_CLIENT_OK:
     200          10 :                 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events");
     201          10 :                 ap->subscribed = 0;
     202          10 :                 break;
     203             :         case HTTP_CLIENT_FAILED:
     204             :         case HTTP_CLIENT_INVALID_REPLY:
     205             :         case HTTP_CLIENT_TIMEOUT:
     206           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from "
     207             :                            "events");
     208           0 :                 break;
     209             :         }
     210          10 :         http_client_free(ap->http);
     211          10 :         ap->http = NULL;
     212             : 
     213             :         /*
     214             :          * Need to get rid of the AP entry regardless of whether we managed to
     215             :          * unsubscribe cleanly or not.
     216             :          */
     217          10 :         wps_er_ap_unsubscribed(ap->er, ap);
     218          10 : }
     219             : 
     220             : 
     221          10 : static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap)
     222             : {
     223             :         struct wpabuf *req;
     224             :         struct sockaddr_in dst;
     225             :         char *url, *path;
     226             :         char sid[100];
     227             : 
     228          10 :         if (ap->event_sub_url == NULL) {
     229           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
     230             :                            "subscribe");
     231           0 :                 goto fail;
     232             :         }
     233          10 :         if (ap->http) {
     234           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
     235             :                            "send subscribe request");
     236           0 :                 goto fail;
     237             :         }
     238             : 
     239          10 :         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
     240          10 :         if (url == NULL) {
     241           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
     242           0 :                 goto fail;
     243             :         }
     244             : 
     245          10 :         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
     246          10 :         if (req == NULL) {
     247           0 :                 os_free(url);
     248           0 :                 goto fail;
     249             :         }
     250          10 :         uuid_bin2str(ap->sid, sid, sizeof(sid));
     251          10 :         wpabuf_printf(req,
     252             :                       "UNSUBSCRIBE %s HTTP/1.1\r\n"
     253             :                       "HOST: %s:%d\r\n"
     254             :                       "SID: uuid:%s\r\n"
     255             :                       "\r\n",
     256          10 :                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid);
     257          10 :         os_free(url);
     258          10 :         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request",
     259             :                           wpabuf_head(req), wpabuf_len(req));
     260             : 
     261          10 :         ap->http = http_client_addr(&dst, req, 1000,
     262             :                                     wps_er_http_unsubscribe_cb, ap);
     263          10 :         if (ap->http == NULL) {
     264           0 :                 wpabuf_free(req);
     265           0 :                 goto fail;
     266             :         }
     267          20 :         return;
     268             : 
     269             : fail:
     270             :         /*
     271             :          * Need to get rid of the AP entry even when we fail to unsubscribe
     272             :          * cleanly.
     273             :          */
     274           0 :         wps_er_ap_unsubscribed(ap->er, ap);
     275             : }
     276             : 
     277             : 
     278          10 : static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er,
     279             :                                                           const u8 *uuid)
     280             : {
     281             :         struct wps_er_ap_settings *s;
     282          10 :         dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list)
     283           0 :                 if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0)
     284           0 :                         return s;
     285          10 :         return NULL;
     286             : }
     287             : 
     288             : 
     289           0 : int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr)
     290             : {
     291             :         struct wps_er_ap *ap;
     292             :         struct wps_er_ap_settings *settings;
     293             : 
     294           0 :         ap = wps_er_ap_get(er, addr, NULL, NULL);
     295           0 :         if (ap == NULL || ap->ap_settings == NULL)
     296           0 :                 return -1;
     297             : 
     298           0 :         settings = wps_er_ap_get_settings(er, ap->uuid);
     299           0 :         if (!settings) {
     300           0 :                 settings = os_zalloc(sizeof(*settings));
     301           0 :                 if (settings == NULL)
     302           0 :                         return -1;
     303           0 :                 os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN);
     304           0 :                 dl_list_add(&er->ap_settings, &settings->list);
     305             :         }
     306           0 :         os_memcpy(&settings->ap_settings, ap->ap_settings,
     307             :                   sizeof(struct wps_credential));
     308             : 
     309           0 :         return 0;
     310             : }
     311             : 
     312             : 
     313          10 : static int wps_er_ap_use_cached_settings(struct wps_er *er,
     314             :                                          struct wps_er_ap *ap)
     315             : {
     316             :         struct wps_er_ap_settings *s;
     317             : 
     318          10 :         if (ap->ap_settings)
     319           0 :                 return 0;
     320             : 
     321          10 :         s = wps_er_ap_get_settings(ap->er, ap->uuid);
     322          10 :         if (!s)
     323          10 :                 return -1;
     324             : 
     325           0 :         ap->ap_settings = os_malloc(sizeof(*ap->ap_settings));
     326           0 :         if (ap->ap_settings == NULL)
     327           0 :                 return -1;
     328             : 
     329           0 :         os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings));
     330           0 :         wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings");
     331           0 :         return 0;
     332             : }
     333             : 
     334             : 
     335          10 : static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap)
     336             : {
     337          10 :         wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
     338             :                    inet_ntoa(ap->addr), ap->location);
     339          10 :         eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
     340          10 :         wps_er_sta_remove_all(ap);
     341          10 :         wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
     342          10 :         http_client_free(ap->http);
     343          10 :         ap->http = NULL;
     344          10 :         if (ap->wps) {
     345           0 :                 wps_deinit(ap->wps);
     346           0 :                 ap->wps = NULL;
     347             :         }
     348             : 
     349          10 :         dl_list_del(&ap->list);
     350          10 :         if (ap->subscribed) {
     351          10 :                 dl_list_add(&er->ap_unsubscribing, &ap->list);
     352          10 :                 wps_er_ap_unsubscribe(er, ap);
     353             :         } else
     354           0 :                 wps_er_ap_free(ap);
     355          10 : }
     356             : 
     357             : 
     358           0 : static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
     359             : {
     360           0 :         struct wps_er *er = eloop_data;
     361           0 :         struct wps_er_ap *ap = user_ctx;
     362           0 :         wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
     363           0 :         wps_er_ap_remove_entry(er, ap);
     364           0 : }
     365             : 
     366             : 
     367          10 : static int wps_er_get_sid(struct wps_er_ap *ap, char *sid)
     368             : {
     369             :         char *pos;
     370             :         char txt[100];
     371             : 
     372          10 :         if (!sid) {
     373           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)",
     374             :                            inet_ntoa(ap->addr), ap->location);
     375           0 :                 return -1;
     376             :         }
     377             : 
     378          10 :         pos = os_strstr(sid, "uuid:");
     379          10 :         if (!pos) {
     380           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
     381             :                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
     382             :                            sid);
     383           0 :                 return -1;
     384             :         }
     385             : 
     386          10 :         pos += 5;
     387          10 :         if (uuid_str2bin(pos, ap->sid) < 0) {
     388           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
     389             :                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
     390             :                            sid);
     391           0 :                 return -1;
     392             :         }
     393             : 
     394          10 :         uuid_bin2str(ap->sid, txt, sizeof(txt));
     395          10 :         wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s",
     396             :                    inet_ntoa(ap->addr), ap->location, txt);
     397             : 
     398          10 :         return 0;
     399             : }
     400             : 
     401             : 
     402          10 : static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
     403             :                                      enum http_client_event event)
     404             : {
     405          10 :         struct wps_er_ap *ap = ctx;
     406             : 
     407          10 :         switch (event) {
     408             :         case HTTP_CLIENT_OK:
     409          10 :                 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
     410          10 :                 ap->subscribed = 1;
     411          10 :                 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID"));
     412          10 :                 wps_er_ap_use_cached_settings(ap->er, ap);
     413          10 :                 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
     414          10 :                 break;
     415             :         case HTTP_CLIENT_FAILED:
     416             :         case HTTP_CLIENT_INVALID_REPLY:
     417             :         case HTTP_CLIENT_TIMEOUT:
     418           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
     419           0 :                 break;
     420             :         }
     421          10 :         http_client_free(ap->http);
     422          10 :         ap->http = NULL;
     423          10 : }
     424             : 
     425             : 
     426          10 : static void wps_er_subscribe(struct wps_er_ap *ap)
     427             : {
     428             :         struct wpabuf *req;
     429             :         struct sockaddr_in dst;
     430             :         char *url, *path;
     431             : 
     432          10 :         if (ap->event_sub_url == NULL) {
     433           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
     434             :                            "subscribe");
     435           0 :                 return;
     436             :         }
     437          10 :         if (ap->http) {
     438           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
     439             :                            "send subscribe request");
     440           0 :                 return;
     441             :         }
     442             : 
     443          10 :         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
     444          10 :         if (url == NULL) {
     445           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
     446           0 :                 return;
     447             :         }
     448             : 
     449          10 :         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
     450          10 :         if (req == NULL) {
     451           0 :                 os_free(url);
     452           0 :                 return;
     453             :         }
     454          50 :         wpabuf_printf(req,
     455             :                       "SUBSCRIBE %s HTTP/1.1\r\n"
     456             :                       "HOST: %s:%d\r\n"
     457             :                       "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
     458             :                       "NT: upnp:event\r\n"
     459             :                       "TIMEOUT: Second-%d\r\n"
     460             :                       "\r\n",
     461          10 :                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
     462          20 :                       ap->er->ip_addr_text, ap->er->http_port,
     463          10 :                       ap->er->event_id, ap->id, 1800);
     464          10 :         os_free(url);
     465          10 :         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
     466             :                           wpabuf_head(req), wpabuf_len(req));
     467             : 
     468          10 :         ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
     469             :                                     ap);
     470          10 :         if (ap->http == NULL)
     471           0 :                 wpabuf_free(req);
     472             : }
     473             : 
     474             : 
     475          10 : static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
     476             : {
     477             :         struct wps_parse_attr attr;
     478             : 
     479          10 :         if (wps_parse_msg(m1, &attr) < 0) {
     480           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
     481          10 :                 return;
     482             :         }
     483          10 :         if (attr.primary_dev_type)
     484          10 :                 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
     485          10 :         if (attr.wps_state)
     486          10 :                 ap->wps_state = *attr.wps_state;
     487          10 :         if (attr.mac_addr)
     488          10 :                 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
     489             : 
     490          10 :         wps_er_subscribe(ap);
     491             : }
     492             : 
     493             : 
     494          10 : static void wps_er_get_device_info(struct wps_er_ap *ap)
     495             : {
     496          10 :         wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
     497          10 : }
     498             : 
     499             : 
     500          10 : static const char * wps_er_find_wfadevice(const char *data)
     501             : {
     502             :         const char *tag, *tagname, *end;
     503             :         char *val;
     504          10 :         int found = 0;
     505             : 
     506          30 :         while (!found) {
     507             :                 /* Find next <device> */
     508             :                 for (;;) {
     509          90 :                         if (xml_next_tag(data, &tag, &tagname, &end))
     510           0 :                                 return NULL;
     511          90 :                         data = end;
     512         100 :                         if (!os_strncasecmp(tagname, "device", 6) &&
     513          20 :                             *tag != '/' &&
     514          10 :                             (tagname[6] == '>' || !isgraph(tagname[6]))) {
     515             :                                 break;
     516             :                         }
     517          80 :                 }
     518             : 
     519             :                 /* Check whether deviceType is WFADevice */
     520          10 :                 val = xml_get_first_item(data, "deviceType");
     521          10 :                 if (val == NULL)
     522           0 :                         return NULL;
     523          10 :                 wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val);
     524          20 :                 found = os_strcasecmp(val, "urn:schemas-wifialliance-org:"
     525          10 :                                       "device:WFADevice:1") == 0;
     526          10 :                 os_free(val);
     527             :         }
     528             : 
     529          10 :         return data;
     530             : }
     531             : 
     532             : 
     533          10 : static void wps_er_parse_device_description(struct wps_er_ap *ap,
     534             :                                             struct wpabuf *reply)
     535             : {
     536             :         /* Note: reply includes null termination after the buffer data */
     537          10 :         const char *tmp, *data = wpabuf_head(reply);
     538             :         char *pos;
     539             : 
     540          10 :         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
     541             :                           wpabuf_head(reply), wpabuf_len(reply));
     542             : 
     543             :         /*
     544             :          * The root device description may include multiple devices, so first
     545             :          * find the beginning of the WFADevice description to allow the
     546             :          * simplistic parser to pick the correct entries.
     547             :          */
     548          10 :         tmp = wps_er_find_wfadevice(data);
     549          10 :         if (tmp == NULL) {
     550           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - "
     551             :                            "trying to parse invalid data");
     552             :         } else
     553          10 :                 data = tmp;
     554             : 
     555          10 :         ap->friendly_name = xml_get_first_item(data, "friendlyName");
     556          10 :         wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
     557             : 
     558          10 :         ap->manufacturer = xml_get_first_item(data, "manufacturer");
     559          10 :         wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
     560             : 
     561          10 :         ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
     562          10 :         wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
     563             :                    ap->manufacturer_url);
     564             : 
     565          10 :         ap->model_description = xml_get_first_item(data, "modelDescription");
     566          10 :         wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
     567             :                    ap->model_description);
     568             : 
     569          10 :         ap->model_name = xml_get_first_item(data, "modelName");
     570          10 :         wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
     571             : 
     572          10 :         ap->model_number = xml_get_first_item(data, "modelNumber");
     573          10 :         wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
     574             : 
     575          10 :         ap->model_url = xml_get_first_item(data, "modelURL");
     576          10 :         wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
     577             : 
     578          10 :         ap->serial_number = xml_get_first_item(data, "serialNumber");
     579          10 :         wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
     580             : 
     581          10 :         ap->udn = xml_get_first_item(data, "UDN");
     582          10 :         if (ap->udn) {
     583          10 :                 wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
     584          10 :                 pos = os_strstr(ap->udn, "uuid:");
     585          10 :                 if (pos) {
     586          10 :                         pos += 5;
     587          10 :                         if (uuid_str2bin(pos, ap->uuid) < 0)
     588           0 :                                 wpa_printf(MSG_DEBUG,
     589             :                                            "WPS ER: Invalid UUID in UDN");
     590             :                 }
     591             :         }
     592             : 
     593          10 :         ap->upc = xml_get_first_item(data, "UPC");
     594          10 :         wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
     595             : 
     596          10 :         ap->scpd_url = http_link_update(
     597          10 :                 xml_get_first_item(data, "SCPDURL"), ap->location);
     598          10 :         wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
     599             : 
     600          10 :         ap->control_url = http_link_update(
     601          10 :                 xml_get_first_item(data, "controlURL"), ap->location);
     602          10 :         wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
     603             : 
     604          10 :         ap->event_sub_url = http_link_update(
     605          10 :                 xml_get_first_item(data, "eventSubURL"), ap->location);
     606          10 :         wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
     607          10 : }
     608             : 
     609             : 
     610          10 : static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
     611             :                                     enum http_client_event event)
     612             : {
     613          10 :         struct wps_er_ap *ap = ctx;
     614             :         struct wpabuf *reply;
     615          10 :         int ok = 0;
     616             : 
     617          10 :         switch (event) {
     618             :         case HTTP_CLIENT_OK:
     619          10 :                 reply = http_client_get_body(c);
     620          10 :                 if (reply == NULL)
     621           0 :                         break;
     622          10 :                 wps_er_parse_device_description(ap, reply);
     623          10 :                 ok = 1;
     624          10 :                 break;
     625             :         case HTTP_CLIENT_FAILED:
     626             :         case HTTP_CLIENT_INVALID_REPLY:
     627             :         case HTTP_CLIENT_TIMEOUT:
     628           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
     629           0 :                 break;
     630             :         }
     631          10 :         http_client_free(ap->http);
     632          10 :         ap->http = NULL;
     633          10 :         if (ok)
     634          10 :                 wps_er_get_device_info(ap);
     635          10 : }
     636             : 
     637             : 
     638          40 : void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
     639             :                    const char *location, int max_age)
     640             : {
     641             :         struct wps_er_ap *ap;
     642             : 
     643          40 :         ap = wps_er_ap_get(er, addr, uuid, NULL);
     644          40 :         if (ap) {
     645             :                 /* Update advertisement timeout */
     646          30 :                 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
     647          30 :                 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
     648          30 :                 return;
     649             :         }
     650             : 
     651          10 :         ap = os_zalloc(sizeof(*ap));
     652          10 :         if (ap == NULL)
     653           0 :                 return;
     654          10 :         dl_list_init(&ap->sta);
     655          10 :         ap->er = er;
     656          10 :         ap->id = ++er->next_ap_id;
     657          10 :         ap->location = os_strdup(location);
     658          10 :         if (ap->location == NULL) {
     659           0 :                 os_free(ap);
     660           0 :                 return;
     661             :         }
     662          10 :         dl_list_add(&er->ap, &ap->list);
     663             : 
     664          10 :         ap->addr.s_addr = addr->s_addr;
     665          10 :         os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
     666          10 :         eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
     667             : 
     668          10 :         wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
     669             :                    inet_ntoa(ap->addr), ap->location);
     670             : 
     671             :         /* Fetch device description */
     672          10 :         ap->http = http_client_url(ap->location, NULL, 10000,
     673             :                                    wps_er_http_dev_desc_cb, ap);
     674             : }
     675             : 
     676             : 
     677           0 : void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
     678             : {
     679             :         struct wps_er_ap *ap;
     680           0 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
     681           0 :                 if (ap->addr.s_addr == addr->s_addr) {
     682           0 :                         wps_er_ap_remove_entry(er, ap);
     683           0 :                         return;
     684             :                 }
     685             :         }
     686             : }
     687             : 
     688             : 
     689          10 : static void wps_er_ap_remove_all(struct wps_er *er)
     690             : {
     691             :         struct wps_er_ap *prev, *ap;
     692             :         struct wps_er_ap_settings *prev_s, *s;
     693          20 :         dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
     694          10 :                 wps_er_ap_remove_entry(er, ap);
     695          10 :         dl_list_for_each_safe(s, prev_s, &er->ap_settings,
     696             :                               struct wps_er_ap_settings, list)
     697           0 :                 os_free(s);
     698          10 : }
     699             : 
     700             : 
     701          54 : static void http_put_date(struct wpabuf *buf)
     702             : {
     703          54 :         wpabuf_put_str(buf, "Date: ");
     704          54 :         format_date(buf);
     705          54 :         wpabuf_put_str(buf, "\r\n");
     706          54 : }
     707             : 
     708             : 
     709           0 : static void wps_er_http_resp_not_found(struct http_request *req)
     710             : {
     711             :         struct wpabuf *buf;
     712           0 :         buf = wpabuf_alloc(200);
     713           0 :         if (buf == NULL) {
     714           0 :                 http_request_deinit(req);
     715           0 :                 return;
     716             :         }
     717             : 
     718           0 :         wpabuf_put_str(buf,
     719             :                        "HTTP/1.1 404 Not Found\r\n"
     720             :                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
     721             :                        "Connection: close\r\n");
     722           0 :         http_put_date(buf);
     723           0 :         wpabuf_put_str(buf, "\r\n");
     724           0 :         http_request_send_and_deinit(req, buf);
     725             : }
     726             : 
     727             : 
     728          54 : static void wps_er_http_resp_ok(struct http_request *req)
     729             : {
     730             :         struct wpabuf *buf;
     731          54 :         buf = wpabuf_alloc(200);
     732          54 :         if (buf == NULL) {
     733           0 :                 http_request_deinit(req);
     734          54 :                 return;
     735             :         }
     736             : 
     737          54 :         wpabuf_put_str(buf,
     738             :                        "HTTP/1.1 200 OK\r\n"
     739             :                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
     740             :                        "Connection: close\r\n"
     741             :                        "Content-Length: 0\r\n");
     742          54 :         http_put_date(buf);
     743          54 :         wpabuf_put_str(buf, "\r\n");
     744          54 :         http_request_send_and_deinit(req, buf);
     745             : }
     746             : 
     747             : 
     748           0 : static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
     749             : {
     750           0 :         struct wps_er_sta *sta = eloop_data;
     751           0 :         wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
     752           0 :         dl_list_del(&sta->list);
     753           0 :         wps_er_sta_free(sta);
     754           0 : }
     755             : 
     756             : 
     757          54 : static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
     758             :                                                const u8 *addr,
     759             :                                                struct wps_parse_attr *attr,
     760             :                                                int probe_req)
     761             : {
     762          54 :         struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL);
     763          54 :         int new_sta = 0;
     764             :         int m1;
     765             : 
     766          54 :         m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
     767             : 
     768          54 :         if (sta == NULL) {
     769             :                 /*
     770             :                  * Only allow new STA entry to be added based on Probe Request
     771             :                  * or M1. This will filter out bogus events and anything that
     772             :                  * may have been ongoing at the time ER subscribed for events.
     773             :                  */
     774          21 :                 if (!probe_req && !m1)
     775           0 :                         return NULL;
     776             : 
     777          21 :                 sta = os_zalloc(sizeof(*sta));
     778          21 :                 if (sta == NULL)
     779           0 :                         return NULL;
     780          21 :                 os_memcpy(sta->addr, addr, ETH_ALEN);
     781          21 :                 sta->ap = ap;
     782          21 :                 dl_list_add(&ap->sta, &sta->list);
     783          21 :                 new_sta = 1;
     784             :         }
     785             : 
     786          54 :         if (m1)
     787           8 :                 sta->m1_received = 1;
     788             : 
     789          54 :         if (attr->config_methods && (!probe_req || !sta->m1_received))
     790          33 :                 sta->config_methods = WPA_GET_BE16(attr->config_methods);
     791          54 :         if (attr->uuid_e && (!probe_req || !sta->m1_received))
     792          33 :                 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
     793          54 :         if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
     794          33 :                 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
     795          54 :         if (attr->dev_password_id && (!probe_req || !sta->m1_received))
     796          33 :                 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
     797             : 
     798          54 :         if (attr->manufacturer) {
     799          33 :                 os_free(sta->manufacturer);
     800          33 :                 sta->manufacturer = dup_binstr(attr->manufacturer,
     801             :                                                attr->manufacturer_len);
     802             :         }
     803             : 
     804          54 :         if (attr->model_name) {
     805          33 :                 os_free(sta->model_name);
     806          33 :                 sta->model_name = dup_binstr(attr->model_name,
     807             :                                              attr->model_name_len);
     808             :         }
     809             : 
     810          54 :         if (attr->model_number) {
     811          33 :                 os_free(sta->model_number);
     812          33 :                 sta->model_number = dup_binstr(attr->model_number,
     813             :                                                attr->model_number_len);
     814             :         }
     815             : 
     816          54 :         if (attr->serial_number) {
     817           8 :                 os_free(sta->serial_number);
     818           8 :                 sta->serial_number = dup_binstr(attr->serial_number,
     819             :                                                 attr->serial_number_len);
     820             :         }
     821             : 
     822          54 :         if (attr->dev_name) {
     823          33 :                 os_free(sta->dev_name);
     824          33 :                 sta->dev_name = dup_binstr(attr->dev_name, attr->dev_name_len);
     825             :         }
     826             : 
     827          54 :         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
     828          54 :         eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
     829             : 
     830          54 :         if (m1 || new_sta)
     831          29 :                 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
     832             : 
     833          54 :         return sta;
     834             : }
     835             : 
     836             : 
     837          25 : static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
     838             :                                                const u8 *addr,
     839             :                                                struct wpabuf *msg)
     840             : {
     841             :         struct wps_parse_attr attr;
     842             : 
     843         150 :         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
     844         150 :                    MACSTR, MAC2STR(addr));
     845          25 :         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
     846             :                         "(TLVs from Probe Request)", msg);
     847             : 
     848          25 :         if (wps_validate_probe_req(msg, addr) < 0) {
     849           0 :                 wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied "
     850           0 :                            "Probe Request frame from " MACSTR, MAC2STR(addr));
     851           0 :                 return;
     852             :         }
     853             : 
     854          25 :         if (wps_parse_msg(msg, &attr) < 0) {
     855           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
     856             :                            "WLANEvent message");
     857           0 :                 return;
     858             :         }
     859             : 
     860          25 :         wps_er_add_sta_data(ap, addr, &attr, 1);
     861          25 :         wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0);
     862             : }
     863             : 
     864             : 
     865          23 : static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
     866             :                                              enum http_client_event event)
     867             : {
     868          23 :         struct wps_er_sta *sta = ctx;
     869             : 
     870          23 :         switch (event) {
     871             :         case HTTP_CLIENT_OK:
     872          23 :                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
     873          23 :                 break;
     874             :         case HTTP_CLIENT_FAILED:
     875             :         case HTTP_CLIENT_INVALID_REPLY:
     876             :         case HTTP_CLIENT_TIMEOUT:
     877           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
     878           0 :                 break;
     879             :         }
     880          23 :         http_client_free(sta->http);
     881          23 :         sta->http = NULL;
     882          23 : }
     883             : 
     884             : 
     885             : static const char *soap_prefix =
     886             :         "<?xml version=\"1.0\"?>\n"
     887             :         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
     888             :         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
     889             :         "<s:Body>\n";
     890             : static const char *soap_postfix =
     891             :         "</s:Body>\n</s:Envelope>\n";
     892             : static const char *urn_wfawlanconfig =
     893             :         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
     894             : 
     895          63 : static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
     896             :                                        const char *name, const char *arg_name,
     897             :                                        const char *path,
     898             :                                        const struct sockaddr_in *dst,
     899             :                                        char **len_ptr, char **body_ptr)
     900             : {
     901             :         unsigned char *encoded;
     902             :         size_t encoded_len;
     903             :         struct wpabuf *buf;
     904             : 
     905          63 :         if (msg) {
     906          51 :                 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
     907             :                                         &encoded_len);
     908          51 :                 if (encoded == NULL)
     909           0 :                         return NULL;
     910             :         } else {
     911          12 :                 encoded = NULL;
     912          12 :                 encoded_len = 0;
     913             :         }
     914             : 
     915          63 :         buf = wpabuf_alloc(1000 + encoded_len);
     916          63 :         if (buf == NULL) {
     917           0 :                 os_free(encoded);
     918           0 :                 return NULL;
     919             :         }
     920             : 
     921          63 :         wpabuf_printf(buf,
     922             :                       "POST %s HTTP/1.1\r\n"
     923             :                       "Host: %s:%d\r\n"
     924             :                       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
     925             :                       "Content-Length: ",
     926          63 :                       path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
     927             : 
     928          63 :         *len_ptr = wpabuf_put(buf, 0);
     929          63 :         wpabuf_printf(buf,
     930             :                       "        \r\n"
     931             :                       "SOAPACTION: \"%s#%s\"\r\n"
     932             :                       "\r\n",
     933             :                       urn_wfawlanconfig, name);
     934             : 
     935          63 :         *body_ptr = wpabuf_put(buf, 0);
     936             : 
     937          63 :         wpabuf_put_str(buf, soap_prefix);
     938          63 :         wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
     939          63 :         wpabuf_put_str(buf, urn_wfawlanconfig);
     940          63 :         wpabuf_put_str(buf, "\">\n");
     941          63 :         if (encoded) {
     942          51 :                 wpabuf_printf(buf, "<%s>%s</%s>\n",
     943             :                               arg_name, (char *) encoded, arg_name);
     944          51 :                 os_free(encoded);
     945             :         }
     946             : 
     947          63 :         return buf;
     948             : }
     949             : 
     950             : 
     951          63 : static void wps_er_soap_end(struct wpabuf *buf, const char *name,
     952             :                             char *len_ptr, char *body_ptr)
     953             : {
     954             :         char len_buf[10];
     955          63 :         wpabuf_printf(buf, "</u:%s>\n", name);
     956          63 :         wpabuf_put_str(buf, soap_postfix);
     957          63 :         os_snprintf(len_buf, sizeof(len_buf), "%d",
     958          63 :                     (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
     959          63 :         os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
     960          63 : }
     961             : 
     962             : 
     963          23 : static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
     964             : {
     965             :         struct wpabuf *buf;
     966             :         char *len_ptr, *body_ptr;
     967             :         struct sockaddr_in dst;
     968             :         char *url, *path;
     969             : 
     970          23 :         if (sta->http) {
     971           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
     972             :                            "ignore new request");
     973           0 :                 wpabuf_free(msg);
     974           0 :                 return;
     975             :         }
     976             : 
     977          23 :         if (sta->ap->control_url == NULL) {
     978           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
     979           0 :                 wpabuf_free(msg);
     980           0 :                 return;
     981             :         }
     982             : 
     983          23 :         url = http_client_url_parse(sta->ap->control_url, &dst, &path);
     984          23 :         if (url == NULL) {
     985           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
     986           0 :                 wpabuf_free(msg);
     987           0 :                 return;
     988             :         }
     989             : 
     990          23 :         buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
     991             :                               &len_ptr, &body_ptr);
     992          23 :         wpabuf_free(msg);
     993          23 :         os_free(url);
     994          23 :         if (buf == NULL)
     995           0 :                 return;
     996          23 :         wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
     997             :                       UPNP_WPS_WLANEVENT_TYPE_EAP);
     998         138 :         wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
     999         138 :                       MAC2STR(sta->addr));
    1000             : 
    1001          23 :         wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
    1002             : 
    1003          23 :         sta->http = http_client_addr(&dst, buf, 1000,
    1004             :                                      wps_er_http_put_wlan_response_cb, sta);
    1005          23 :         if (sta->http == NULL)
    1006           0 :                 wpabuf_free(buf);
    1007             : }
    1008             : 
    1009             : 
    1010          29 : static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
    1011             :                                enum wsc_op_code op_code)
    1012             : {
    1013             :         enum wps_process_res res;
    1014             : 
    1015          29 :         res = wps_process_msg(sta->wps, op_code, msg);
    1016          29 :         if (res == WPS_CONTINUE) {
    1017          23 :                 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
    1018          23 :                 if (next)
    1019          23 :                         wps_er_sta_send_msg(sta, next);
    1020             :         } else {
    1021           6 :                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
    1022             :                            "enrollee (res=%d)",
    1023             :                            res == WPS_DONE ? "succeeded" : "failed", res);
    1024           6 :                 wps_deinit(sta->wps);
    1025           6 :                 sta->wps = NULL;
    1026           6 :                 if (res == WPS_DONE) {
    1027             :                         /* Remove the STA entry after short timeout */
    1028           6 :                         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
    1029           6 :                         eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
    1030             :                                                NULL);
    1031             :                 }
    1032             :         }
    1033          29 : }
    1034             : 
    1035             : 
    1036           8 : static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
    1037             : {
    1038             :         struct wps_config cfg;
    1039             : 
    1040           8 :         if (sta->wps)
    1041           0 :                 wps_deinit(sta->wps);
    1042             : 
    1043           8 :         os_memset(&cfg, 0, sizeof(cfg));
    1044           8 :         cfg.wps = sta->ap->er->wps;
    1045           8 :         cfg.registrar = 1;
    1046           8 :         cfg.peer_addr = sta->addr;
    1047             : 
    1048           8 :         sta->wps = wps_init(&cfg);
    1049           8 :         if (sta->wps == NULL)
    1050           8 :                 return;
    1051           8 :         sta->wps->er = 1;
    1052           8 :         sta->wps->use_cred = sta->ap->ap_settings;
    1053           8 :         if (sta->ap->ap_settings) {
    1054           8 :                 os_free(sta->cred);
    1055           8 :                 sta->cred = os_malloc(sizeof(*sta->cred));
    1056           8 :                 if (sta->cred) {
    1057           8 :                         os_memcpy(sta->cred, sta->ap->ap_settings,
    1058             :                                   sizeof(*sta->cred));
    1059           8 :                         sta->cred->cred_attr = NULL;
    1060           8 :                         os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN);
    1061           8 :                         sta->wps->use_cred = sta->cred;
    1062             :                 }
    1063             :         }
    1064             : 
    1065           8 :         wps_er_sta_process(sta, msg, WSC_MSG);
    1066             : }
    1067             : 
    1068             : 
    1069          29 : static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
    1070             :                                          struct wpabuf *msg)
    1071             : {
    1072             :         struct wps_parse_attr attr;
    1073             :         struct wps_er_sta *sta;
    1074             : 
    1075         174 :         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
    1076         174 :                    MAC2STR(addr));
    1077          29 :         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
    1078             :                         "(TLVs from EAP-WSC)", msg);
    1079             : 
    1080          29 :         if (wps_parse_msg(msg, &attr) < 0) {
    1081           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
    1082             :                            "WLANEvent message");
    1083           0 :                 return;
    1084             :         }
    1085             : 
    1086          29 :         sta = wps_er_add_sta_data(ap, addr, &attr, 0);
    1087          29 :         if (sta == NULL)
    1088           0 :                 return;
    1089             : 
    1090          29 :         if (attr.msg_type && *attr.msg_type == WPS_M1)
    1091           8 :                 wps_er_sta_start(sta, msg);
    1092          21 :         else if (sta->wps) {
    1093          21 :                 enum wsc_op_code op_code = WSC_MSG;
    1094          21 :                 if (attr.msg_type) {
    1095          21 :                         switch (*attr.msg_type) {
    1096             :                         case WPS_WSC_ACK:
    1097           0 :                                 op_code = WSC_ACK;
    1098           0 :                                 break;
    1099             :                         case WPS_WSC_NACK:
    1100           0 :                                 op_code = WSC_NACK;
    1101           0 :                                 break;
    1102             :                         case WPS_WSC_DONE:
    1103           6 :                                 op_code = WSC_Done;
    1104           6 :                                 break;
    1105             :                         }
    1106             :                 }
    1107          21 :                 wps_er_sta_process(sta, msg, op_code);
    1108             :         }
    1109             : }
    1110             : 
    1111             : 
    1112          54 : static void wps_er_process_wlanevent(struct wps_er_ap *ap,
    1113             :                                      struct wpabuf *event)
    1114             : {
    1115             :         u8 *data;
    1116             :         u8 wlan_event_type;
    1117             :         u8 wlan_event_mac[ETH_ALEN];
    1118             :         struct wpabuf msg;
    1119             : 
    1120          54 :         wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
    1121             :                     wpabuf_head(event), wpabuf_len(event));
    1122          54 :         if (wpabuf_len(event) < 1 + 17) {
    1123           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
    1124           0 :                 return;
    1125             :         }
    1126             : 
    1127          54 :         data = wpabuf_mhead(event);
    1128          54 :         wlan_event_type = data[0];
    1129          54 :         if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
    1130           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
    1131             :                            "WLANEvent");
    1132           0 :                 return;
    1133             :         }
    1134             : 
    1135          54 :         wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
    1136             : 
    1137          54 :         switch (wlan_event_type) {
    1138             :         case 1:
    1139          25 :                 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
    1140          25 :                 break;
    1141             :         case 2:
    1142          29 :                 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
    1143          29 :                 break;
    1144             :         default:
    1145           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
    1146             :                            wlan_event_type);
    1147           0 :                 break;
    1148             :         }
    1149             : }
    1150             : 
    1151             : 
    1152          54 : static void wps_er_http_event(struct wps_er *er, struct http_request *req,
    1153             :                               unsigned int ap_id)
    1154             : {
    1155          54 :         struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
    1156             :         struct wpabuf *event;
    1157             :         enum http_reply_code ret;
    1158             : 
    1159          54 :         if (ap == NULL) {
    1160           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
    1161             :                            "%u", ap_id);
    1162           0 :                 wps_er_http_resp_not_found(req);
    1163           0 :                 return;
    1164             :         }
    1165          54 :         wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
    1166             :                    ap_id, http_request_get_data(req));
    1167             : 
    1168          54 :         event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
    1169             :                                     &ret);
    1170          54 :         if (event == NULL) {
    1171           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
    1172             :                            "from the event notification");
    1173             :                 /*
    1174             :                  * Reply with OK anyway to avoid getting unregistered from
    1175             :                  * events.
    1176             :                  */
    1177           0 :                 wps_er_http_resp_ok(req);
    1178           0 :                 return;
    1179             :         }
    1180             : 
    1181          54 :         wps_er_process_wlanevent(ap, event);
    1182             : 
    1183          54 :         wpabuf_free(event);
    1184          54 :         wps_er_http_resp_ok(req);
    1185             : }
    1186             : 
    1187             : 
    1188          54 : static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
    1189             : {
    1190          54 :         char *uri = http_request_get_uri(req);
    1191             : 
    1192          54 :         if (os_strncmp(uri, "/event/", 7) == 0) {
    1193             :                 unsigned int event_id;
    1194             :                 char *pos;
    1195          54 :                 event_id = atoi(uri + 7);
    1196          54 :                 if (event_id != er->event_id) {
    1197           0 :                         wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
    1198             :                                    "unknown event id %u", event_id);
    1199           0 :                         return;
    1200             :                 }
    1201          54 :                 pos = os_strchr(uri + 7, '/');
    1202          54 :                 if (pos == NULL)
    1203           0 :                         return;
    1204          54 :                 pos++;
    1205          54 :                 wps_er_http_event(er, req, atoi(pos));
    1206             :         } else {
    1207           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
    1208             :                            uri);
    1209           0 :                 wps_er_http_resp_not_found(req);
    1210             :         }
    1211             : }
    1212             : 
    1213             : 
    1214          54 : static void wps_er_http_req(void *ctx, struct http_request *req)
    1215             : {
    1216          54 :         struct wps_er *er = ctx;
    1217          54 :         struct sockaddr_in *cli = http_request_get_cli_addr(req);
    1218          54 :         enum httpread_hdr_type type = http_request_get_type(req);
    1219             :         struct wpabuf *buf;
    1220             : 
    1221          54 :         wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
    1222             :                    "%s:%d",
    1223             :                    http_request_get_uri(req), type,
    1224          54 :                    inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
    1225             : 
    1226          54 :         switch (type) {
    1227             :         case HTTPREAD_HDR_TYPE_NOTIFY:
    1228          54 :                 wps_er_http_notify(er, req);
    1229          54 :                 break;
    1230             :         default:
    1231           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
    1232             :                            "%d", type);
    1233           0 :                 buf = wpabuf_alloc(200);
    1234           0 :                 if (buf == NULL) {
    1235           0 :                         http_request_deinit(req);
    1236          54 :                         return;
    1237             :                 }
    1238           0 :                 wpabuf_put_str(buf,
    1239             :                                "HTTP/1.1 501 Unimplemented\r\n"
    1240             :                                "Connection: close\r\n");
    1241           0 :                 http_put_date(buf);
    1242           0 :                 wpabuf_put_str(buf, "\r\n");
    1243           0 :                 http_request_send_and_deinit(req, buf);
    1244           0 :                 break;
    1245             :         }
    1246             : }
    1247             : 
    1248             : 
    1249             : struct wps_er *
    1250          10 : wps_er_init(struct wps_context *wps, const char *ifname, const char *filter)
    1251             : {
    1252             :         struct wps_er *er;
    1253             :         struct in_addr addr;
    1254             : 
    1255          10 :         er = os_zalloc(sizeof(*er));
    1256          10 :         if (er == NULL)
    1257           0 :                 return NULL;
    1258          10 :         dl_list_init(&er->ap);
    1259          10 :         dl_list_init(&er->ap_unsubscribing);
    1260          10 :         dl_list_init(&er->ap_settings);
    1261             : 
    1262          10 :         er->multicast_sd = -1;
    1263          10 :         er->ssdp_sd = -1;
    1264             : 
    1265          10 :         os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
    1266          10 :         er->wps = wps;
    1267          10 :         if (os_get_random((unsigned char *) &er->event_id,
    1268             :                           sizeof(er->event_id)) < 0) {
    1269           0 :                 wps_er_deinit(er, NULL, NULL);
    1270           0 :                 return NULL;
    1271             :         }
    1272             :         /* Limit event_id to < 32 bits to avoid issues with atoi() */
    1273          10 :         er->event_id &= 0x0fffffff;
    1274             : 
    1275          10 :         if (filter && os_strncmp(filter, "ifname=", 7) == 0) {
    1276             :                 const char *pos, *end;
    1277          10 :                 pos = filter + 7;
    1278          10 :                 end = os_strchr(pos, ' ');
    1279          10 :                 if (end) {
    1280           0 :                         size_t len = end - pos;
    1281           0 :                         os_strlcpy(er->ifname, pos, len < sizeof(er->ifname) ?
    1282             :                                    len + 1 : sizeof(er->ifname));
    1283           0 :                         filter = end + 1;
    1284             :                 } else {
    1285          10 :                         os_strlcpy(er->ifname, pos, sizeof(er->ifname));
    1286          10 :                         filter = NULL;
    1287             :                 }
    1288          10 :                 er->forced_ifname = 1;
    1289             :         }
    1290             : 
    1291          10 :         if (filter) {
    1292           0 :                 if (inet_aton(filter, &er->filter_addr) == 0) {
    1293           0 :                         wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter "
    1294             :                                    "address %s", filter);
    1295           0 :                         wps_er_deinit(er, NULL, NULL);
    1296           0 :                         return NULL;
    1297             :                 }
    1298           0 :                 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections "
    1299             :                            "with %s", filter);
    1300             :         }
    1301          10 :         if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text,
    1302          10 :                            er->mac_addr)) {
    1303           0 :                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
    1304           0 :                            "for %s. Does it have IP address?", er->ifname);
    1305           0 :                 wps_er_deinit(er, NULL, NULL);
    1306           0 :                 return NULL;
    1307             :         }
    1308             : 
    1309          10 :         if (wps_er_ssdp_init(er) < 0) {
    1310           0 :                 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed");
    1311           0 :                 wps_er_deinit(er, NULL, NULL);
    1312           0 :                 return NULL;
    1313             :         }
    1314             : 
    1315          10 :         addr.s_addr = er->ip_addr;
    1316          10 :         er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
    1317          10 :         if (er->http_srv == NULL) {
    1318           0 :                 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed");
    1319           0 :                 wps_er_deinit(er, NULL, NULL);
    1320           0 :                 return NULL;
    1321             :         }
    1322          10 :         er->http_port = http_server_get_port(er->http_srv);
    1323             : 
    1324          20 :         wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)",
    1325          10 :                    er->ifname, er->ip_addr_text);
    1326             : 
    1327          10 :         return er;
    1328             : }
    1329             : 
    1330             : 
    1331           1 : void wps_er_refresh(struct wps_er *er)
    1332             : {
    1333             :         struct wps_er_ap *ap;
    1334             :         struct wps_er_sta *sta;
    1335             : 
    1336           2 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
    1337           1 :                 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
    1338           2 :                 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
    1339           1 :                         wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
    1340             :         }
    1341             : 
    1342           1 :         wps_er_send_ssdp_msearch(er);
    1343           1 : }
    1344             : 
    1345             : 
    1346          10 : static void wps_er_deinit_finish(void *eloop_data, void *user_ctx)
    1347             : {
    1348          10 :         struct wps_er *er = eloop_data;
    1349             :         void (*deinit_done_cb)(void *ctx);
    1350             :         void *deinit_done_ctx;
    1351             :         struct wps_er_ap *ap, *tmp;
    1352             : 
    1353          10 :         wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit");
    1354             : 
    1355          10 :         dl_list_for_each_safe(ap, tmp, &er->ap_unsubscribing, struct wps_er_ap,
    1356             :                               list) {
    1357           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: AP entry for %s (%s) still in ap_unsubscribing list - free it",
    1358             :                            inet_ntoa(ap->addr), ap->location);
    1359           0 :                 dl_list_del(&ap->list);
    1360           0 :                 wps_er_ap_free(ap);
    1361             :         }
    1362             : 
    1363          10 :         eloop_cancel_timeout(wps_er_deinit_finish, er, NULL);
    1364          10 :         deinit_done_cb = er->deinit_done_cb;
    1365          10 :         deinit_done_ctx = er->deinit_done_ctx;
    1366          10 :         os_free(er->ip_addr_text);
    1367          10 :         os_free(er);
    1368             : 
    1369          10 :         if (deinit_done_cb)
    1370           0 :                 deinit_done_cb(deinit_done_ctx);
    1371          10 : }
    1372             : 
    1373             : 
    1374         208 : void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx)
    1375             : {
    1376         208 :         if (er == NULL)
    1377         406 :                 return;
    1378          10 :         http_server_deinit(er->http_srv);
    1379          10 :         wps_er_ap_remove_all(er);
    1380          10 :         wps_er_ssdp_deinit(er);
    1381          10 :         eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0,
    1382             :                                wps_er_deinit_finish, er, NULL);
    1383          10 :         wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout");
    1384          10 :         er->deinitializing = 1;
    1385          10 :         er->deinit_done_cb = cb;
    1386          10 :         er->deinit_done_ctx = ctx;
    1387             : }
    1388             : 
    1389             : 
    1390          18 : static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
    1391             :                                        enum http_client_event event)
    1392             : {
    1393          18 :         struct wps_er_ap *ap = ctx;
    1394             :         union wps_event_data data;
    1395             : 
    1396          18 :         os_memset(&data, 0, sizeof(data));
    1397             : 
    1398          18 :         switch (event) {
    1399             :         case HTTP_CLIENT_OK:
    1400          18 :                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
    1401          18 :                 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE;
    1402          18 :                 data.set_sel_reg.uuid = ap->uuid;
    1403          18 :                 break;
    1404             :         case HTTP_CLIENT_FAILED:
    1405             :         case HTTP_CLIENT_INVALID_REPLY:
    1406             :         case HTTP_CLIENT_TIMEOUT:
    1407           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
    1408           0 :                 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED;
    1409           0 :                 data.set_sel_reg.uuid = ap->uuid;
    1410           0 :                 break;
    1411             :         }
    1412          18 :         http_client_free(ap->http);
    1413          18 :         ap->http = NULL;
    1414             : 
    1415          18 :         if (data.set_sel_reg.uuid)
    1416          18 :                 ap->er->wps->event_cb(ap->er->wps->cb_ctx,
    1417             :                                       WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
    1418          18 : }
    1419             : 
    1420             : 
    1421          26 : static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
    1422             : {
    1423             :         struct wpabuf *buf;
    1424             :         char *len_ptr, *body_ptr;
    1425             :         struct sockaddr_in dst;
    1426             :         char *url, *path;
    1427             : 
    1428          26 :         if (ap->control_url == NULL) {
    1429           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
    1430           0 :                 return;
    1431             :         }
    1432             : 
    1433          26 :         if (ap->http) {
    1434           2 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
    1435             :                            "ignore new request");
    1436           2 :                 return;
    1437             :         }
    1438             : 
    1439          24 :         if (ap->wps) {
    1440           4 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - "
    1441             :                            "skip SetSelectedRegistrar");
    1442           4 :                 return;
    1443             :         }
    1444             : 
    1445          20 :         url = http_client_url_parse(ap->control_url, &dst, &path);
    1446          20 :         if (url == NULL) {
    1447           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
    1448           0 :                 return;
    1449             :         }
    1450             : 
    1451          20 :         buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
    1452             :                               &dst, &len_ptr, &body_ptr);
    1453          20 :         os_free(url);
    1454          20 :         if (buf == NULL)
    1455           0 :                 return;
    1456             : 
    1457          20 :         wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
    1458             : 
    1459          20 :         ap->http = http_client_addr(&dst, buf, 1000,
    1460             :                                     wps_er_http_set_sel_reg_cb, ap);
    1461          20 :         if (ap->http == NULL)
    1462           0 :                 wpabuf_free(buf);
    1463             : }
    1464             : 
    1465             : 
    1466          26 : static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
    1467             : {
    1468          26 :         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
    1469          26 :         wpabuf_put_be16(msg, 1);
    1470          26 :         wpabuf_put_u8(msg, !!sel_reg);
    1471          26 :         return 0;
    1472             : }
    1473             : 
    1474             : 
    1475          26 : static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
    1476             : {
    1477          26 :         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
    1478          26 :         wpabuf_put_be16(msg, 2);
    1479          26 :         wpabuf_put_be16(msg, dev_passwd_id);
    1480          26 :         return 0;
    1481             : }
    1482             : 
    1483             : 
    1484          26 : static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
    1485             :                                                u16 sel_reg_config_methods)
    1486             : {
    1487          26 :         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
    1488          26 :         wpabuf_put_be16(msg, 2);
    1489          26 :         wpabuf_put_be16(msg, sel_reg_config_methods);
    1490          26 :         return 0;
    1491             : }
    1492             : 
    1493             : 
    1494          26 : static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r)
    1495             : {
    1496          26 :         wpabuf_put_be16(msg, ATTR_UUID_R);
    1497          26 :         wpabuf_put_be16(msg, WPS_UUID_LEN);
    1498          26 :         wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN);
    1499          26 :         return 0;
    1500             : }
    1501             : 
    1502             : 
    1503          28 : void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
    1504             :                         u16 sel_reg_config_methods)
    1505             : {
    1506             :         struct wpabuf *msg;
    1507             :         struct wps_er_ap *ap;
    1508          28 :         struct wps_registrar *reg = er->wps->registrar;
    1509             :         const u8 *auth_macs;
    1510             :         u8 bcast[ETH_ALEN];
    1511             :         size_t count;
    1512             :         union wps_event_data data;
    1513             : 
    1514          28 :         if (er->skip_set_sel_reg) {
    1515           2 :                 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar");
    1516           2 :                 return;
    1517             :         }
    1518             : 
    1519          26 :         msg = wpabuf_alloc(500);
    1520          26 :         if (msg == NULL)
    1521           0 :                 return;
    1522             : 
    1523          26 :         auth_macs = wps_authorized_macs(reg, &count);
    1524          26 :         if (count == 0) {
    1525          15 :                 os_memset(bcast, 0xff, ETH_ALEN);
    1526          15 :                 auth_macs = bcast;
    1527          15 :                 count = 1;
    1528             :         }
    1529             : 
    1530          52 :         if (wps_build_version(msg) ||
    1531          52 :             wps_er_build_selected_registrar(msg, sel_reg) ||
    1532          52 :             wps_er_build_dev_password_id(msg, dev_passwd_id) ||
    1533          52 :             wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
    1534          52 :             wps_build_wfa_ext(msg, 0, auth_macs, count) ||
    1535          26 :             wps_er_build_uuid_r(msg, er->wps->uuid)) {
    1536           0 :                 wpabuf_free(msg);
    1537           0 :                 return;
    1538             :         }
    1539             : 
    1540          26 :         os_memset(&data, 0, sizeof(data));
    1541          26 :         data.set_sel_reg.sel_reg = sel_reg;
    1542          26 :         data.set_sel_reg.dev_passwd_id = dev_passwd_id;
    1543          26 :         data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods;
    1544          26 :         data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START;
    1545             : 
    1546          52 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
    1547          27 :                 if (er->set_sel_reg_uuid_filter &&
    1548           1 :                     os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter,
    1549             :                               WPS_UUID_LEN) != 0)
    1550           0 :                         continue;
    1551          26 :                 data.set_sel_reg.uuid = ap->uuid;
    1552          26 :                 er->wps->event_cb(er->wps->cb_ctx,
    1553             :                                   WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
    1554          26 :                 wps_er_send_set_sel_reg(ap, msg);
    1555             :         }
    1556             : 
    1557          26 :         wpabuf_free(msg);
    1558             : }
    1559             : 
    1560             : 
    1561           4 : int wps_er_pbc(struct wps_er *er, const u8 *uuid, const u8 *addr)
    1562             : {
    1563             :         int res;
    1564             :         struct wps_er_ap *ap;
    1565             : 
    1566           4 :         if (er == NULL || er->wps == NULL)
    1567           0 :                 return -1;
    1568             : 
    1569           4 :         if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) {
    1570           1 :                 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC "
    1571             :                            "mode");
    1572           1 :                 return -2;
    1573             :         }
    1574             : 
    1575           3 :         if (uuid)
    1576           0 :                 ap = wps_er_ap_get(er, NULL, uuid, NULL);
    1577             :         else
    1578           3 :                 ap = NULL;
    1579           3 :         if (ap == NULL) {
    1580           3 :                 struct wps_er_sta *sta = NULL;
    1581           4 :                 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
    1582           3 :                         sta = wps_er_sta_get(ap, addr, uuid);
    1583           3 :                         if (sta) {
    1584           2 :                                 uuid = ap->uuid;
    1585           2 :                                 break;
    1586             :                         }
    1587             :                 }
    1588           3 :                 if (sta == NULL)
    1589           1 :                         return -3; /* Unknown UUID */
    1590             :         }
    1591             : 
    1592           2 :         if (ap->ap_settings == NULL) {
    1593           1 :                 wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known");
    1594           1 :                 return -4;
    1595             :         }
    1596             : 
    1597           1 :         er->set_sel_reg_uuid_filter = uuid;
    1598           1 :         res = wps_registrar_button_pushed(er->wps->registrar, NULL);
    1599           1 :         er->set_sel_reg_uuid_filter = NULL;
    1600           1 :         if (res)
    1601           0 :                 return -1;
    1602             : 
    1603           1 :         return 0;
    1604             : }
    1605             : 
    1606             : 
    1607           1 : static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
    1608             : {
    1609           1 :         struct wps_er_ap *ap = ctx;
    1610             :         union wps_event_data data;
    1611             : 
    1612           1 :         wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
    1613           1 :         os_free(ap->ap_settings);
    1614           1 :         ap->ap_settings = os_malloc(sizeof(*cred));
    1615           1 :         if (ap->ap_settings) {
    1616           1 :                 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
    1617           1 :                 ap->ap_settings->cred_attr = NULL;
    1618             :         }
    1619             : 
    1620           1 :         os_memset(&data, 0, sizeof(data));
    1621           1 :         data.ap_settings.uuid = ap->uuid;
    1622           1 :         data.ap_settings.cred = cred;
    1623           1 :         ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS,
    1624             :                               &data);
    1625           1 : }
    1626             : 
    1627             : 
    1628           1 : const u8 * wps_er_get_sta_uuid(struct wps_er *er, const u8 *addr)
    1629             : {
    1630             :         struct wps_er_ap *ap;
    1631           1 :         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
    1632             :                 struct wps_er_sta *sta;
    1633           1 :                 sta = wps_er_sta_get(ap, addr, NULL);
    1634           1 :                 if (sta)
    1635           1 :                         return sta->uuid;
    1636             :         }
    1637           0 :         return NULL;
    1638             : }
    1639             : 
    1640             : 
    1641           8 : static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
    1642             :                                        enum http_client_event event)
    1643             : {
    1644           8 :         struct wps_er_ap *ap = ctx;
    1645             :         struct wpabuf *reply;
    1646           8 :         char *msg = NULL;
    1647             : 
    1648           8 :         switch (event) {
    1649             :         case HTTP_CLIENT_OK:
    1650           7 :                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
    1651           7 :                 reply = http_client_get_body(c);
    1652           7 :                 if (reply == NULL)
    1653           0 :                         break;
    1654           7 :                 msg = os_zalloc(wpabuf_len(reply) + 1);
    1655           7 :                 if (msg == NULL)
    1656           0 :                         break;
    1657           7 :                 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
    1658           7 :                 break;
    1659             :         case HTTP_CLIENT_FAILED:
    1660             :         case HTTP_CLIENT_INVALID_REPLY:
    1661             :         case HTTP_CLIENT_TIMEOUT:
    1662           1 :                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
    1663           1 :                 if (ap->wps) {
    1664           1 :                         wps_deinit(ap->wps);
    1665           1 :                         ap->wps = NULL;
    1666             :                 }
    1667           1 :                 break;
    1668             :         }
    1669           8 :         http_client_free(ap->http);
    1670           8 :         ap->http = NULL;
    1671             : 
    1672           8 :         if (msg) {
    1673             :                 struct wpabuf *buf;
    1674             :                 enum http_reply_code ret;
    1675           7 :                 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
    1676           7 :                 os_free(msg);
    1677           7 :                 if (buf == NULL) {
    1678           0 :                         wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
    1679             :                                    "NewOutMessage from PutMessage response");
    1680           0 :                         wps_deinit(ap->wps);
    1681           0 :                         ap->wps = NULL;
    1682           8 :                         return;
    1683             :                 }
    1684           7 :                 wps_er_ap_process(ap, buf);
    1685           7 :                 wpabuf_free(buf);
    1686             :         }
    1687             : }
    1688             : 
    1689             : 
    1690           8 : static void wps_er_ap_put_message(struct wps_er_ap *ap,
    1691             :                                   const struct wpabuf *msg)
    1692             : {
    1693             :         struct wpabuf *buf;
    1694             :         char *len_ptr, *body_ptr;
    1695             :         struct sockaddr_in dst;
    1696             :         char *url, *path;
    1697             : 
    1698           8 :         if (ap->http) {
    1699           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
    1700             :                            "with the AP - cannot continue learn");
    1701           0 :                 return;
    1702             :         }
    1703             : 
    1704           8 :         if (ap->control_url == NULL) {
    1705           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
    1706           0 :                 return;
    1707             :         }
    1708             : 
    1709           8 :         url = http_client_url_parse(ap->control_url, &dst, &path);
    1710           8 :         if (url == NULL) {
    1711           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
    1712           0 :                 return;
    1713             :         }
    1714             : 
    1715           8 :         buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
    1716             :                               &len_ptr, &body_ptr);
    1717           8 :         os_free(url);
    1718           8 :         if (buf == NULL)
    1719           0 :                 return;
    1720             : 
    1721           8 :         wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
    1722             : 
    1723           8 :         ap->http = http_client_addr(&dst, buf, 10000,
    1724             :                                     wps_er_http_put_message_cb, ap);
    1725           8 :         if (ap->http == NULL)
    1726           0 :                 wpabuf_free(buf);
    1727             : }
    1728             : 
    1729             : 
    1730           9 : static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
    1731             : {
    1732             :         enum wps_process_res res;
    1733             :         struct wps_parse_attr attr;
    1734             :         enum wsc_op_code op_code;
    1735             : 
    1736           9 :         op_code = WSC_MSG;
    1737           9 :         if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) {
    1738           9 :                 switch (*attr.msg_type) {
    1739             :                 case WPS_WSC_ACK:
    1740           0 :                         op_code = WSC_ACK;
    1741           0 :                         break;
    1742             :                 case WPS_WSC_NACK:
    1743           0 :                         op_code = WSC_NACK;
    1744           0 :                         break;
    1745             :                 case WPS_WSC_DONE:
    1746           1 :                         op_code = WSC_Done;
    1747           1 :                         break;
    1748             :                 }
    1749             :         }
    1750             : 
    1751           9 :         res = wps_process_msg(ap->wps, op_code, msg);
    1752           9 :         if (res == WPS_CONTINUE) {
    1753           8 :                 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
    1754           8 :                 if (next) {
    1755           8 :                         wps_er_ap_put_message(ap, next);
    1756           8 :                         wpabuf_free(next);
    1757             :                 } else {
    1758           0 :                         wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
    1759             :                                    "message");
    1760           0 :                         wps_deinit(ap->wps);
    1761           0 :                         ap->wps = NULL;
    1762             :                 }
    1763           1 :         } else if (res == WPS_DONE) {
    1764           1 :                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done");
    1765           1 :                 wps_deinit(ap->wps);
    1766           1 :                 ap->wps = NULL;
    1767             :         } else {
    1768           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
    1769             :                            "AP (res=%d)", res);
    1770           0 :                 wps_deinit(ap->wps);
    1771           0 :                 ap->wps = NULL;
    1772             :         }
    1773           9 : }
    1774             : 
    1775             : 
    1776           1 : static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
    1777             : {
    1778             :         struct wps_config cfg;
    1779             : 
    1780           1 :         if (ap->wps) {
    1781           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
    1782             :                            "progress with this AP");
    1783           0 :                 return;
    1784             :         }
    1785             : 
    1786           1 :         os_memset(&cfg, 0, sizeof(cfg));
    1787           1 :         cfg.wps = ap->er->wps;
    1788           1 :         cfg.registrar = 1;
    1789           1 :         ap->wps = wps_init(&cfg);
    1790           1 :         if (ap->wps == NULL)
    1791           0 :                 return;
    1792           1 :         ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
    1793           1 :         ap->wps->ap_settings_cb_ctx = ap;
    1794             : 
    1795           1 :         wps_er_ap_process(ap, m1);
    1796             : }
    1797             : 
    1798             : 
    1799          12 : static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
    1800             : {
    1801             :         struct wpabuf *info;
    1802             :         enum http_reply_code ret;
    1803             : 
    1804          12 :         wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
    1805             :                    "from the AP");
    1806          12 :         info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
    1807          12 :         if (info == NULL) {
    1808           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
    1809             :                            "NewDeviceInfo from GetDeviceInfo response");
    1810          12 :                 return;
    1811             :         }
    1812             : 
    1813          12 :         ap->m1_handler(ap, info);
    1814          12 :         wpabuf_free(info);
    1815             : }
    1816             : 
    1817             : 
    1818          12 : static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
    1819             :                                         enum http_client_event event)
    1820             : {
    1821          12 :         struct wps_er_ap *ap = ctx;
    1822             :         struct wpabuf *reply;
    1823          12 :         char *dev_info = NULL;
    1824             : 
    1825          12 :         switch (event) {
    1826             :         case HTTP_CLIENT_OK:
    1827          12 :                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
    1828          12 :                 reply = http_client_get_body(c);
    1829          12 :                 if (reply == NULL)
    1830           0 :                         break;
    1831          12 :                 dev_info = os_zalloc(wpabuf_len(reply) + 1);
    1832          12 :                 if (dev_info == NULL)
    1833           0 :                         break;
    1834          12 :                 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
    1835          12 :                 break;
    1836             :         case HTTP_CLIENT_FAILED:
    1837             :         case HTTP_CLIENT_INVALID_REPLY:
    1838             :         case HTTP_CLIENT_TIMEOUT:
    1839           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
    1840           0 :                 break;
    1841             :         }
    1842          12 :         http_client_free(ap->http);
    1843          12 :         ap->http = NULL;
    1844             : 
    1845          12 :         if (dev_info) {
    1846          12 :                 wps_er_ap_learn(ap, dev_info);
    1847          12 :                 os_free(dev_info);
    1848             :         }
    1849          12 : }
    1850             : 
    1851             : 
    1852          12 : static int wps_er_send_get_device_info(struct wps_er_ap *ap,
    1853             :                                        void (*m1_handler)(struct wps_er_ap *ap,
    1854             :                                                           struct wpabuf *m1))
    1855             : {
    1856             :         struct wpabuf *buf;
    1857             :         char *len_ptr, *body_ptr;
    1858             :         struct sockaddr_in dst;
    1859             :         char *url, *path;
    1860             : 
    1861          12 :         if (ap->http) {
    1862           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
    1863             :                            "with the AP - cannot get device info");
    1864           0 :                 return -1;
    1865             :         }
    1866             : 
    1867          12 :         if (ap->control_url == NULL) {
    1868           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
    1869           0 :                 return -1;
    1870             :         }
    1871             : 
    1872          12 :         url = http_client_url_parse(ap->control_url, &dst, &path);
    1873          12 :         if (url == NULL) {
    1874           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
    1875           0 :                 return -1;
    1876             :         }
    1877             : 
    1878          12 :         buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
    1879             :                               &len_ptr, &body_ptr);
    1880          12 :         os_free(url);
    1881          12 :         if (buf == NULL)
    1882           0 :                 return -1;
    1883             : 
    1884          12 :         wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
    1885             : 
    1886          12 :         ap->http = http_client_addr(&dst, buf, 10000,
    1887             :                                     wps_er_http_get_dev_info_cb, ap);
    1888          12 :         if (ap->http == NULL) {
    1889           0 :                 wpabuf_free(buf);
    1890           0 :                 return -1;
    1891             :         }
    1892             : 
    1893          12 :         ap->m1_handler = m1_handler;
    1894             : 
    1895          12 :         return 0;
    1896             : }
    1897             : 
    1898             : 
    1899           1 : int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *addr,
    1900             :                  const u8 *pin, size_t pin_len)
    1901             : {
    1902             :         struct wps_er_ap *ap;
    1903             : 
    1904           1 :         if (er == NULL)
    1905           0 :                 return -1;
    1906             : 
    1907           1 :         ap = wps_er_ap_get(er, NULL, uuid, addr);
    1908           1 :         if (ap == NULL) {
    1909           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
    1910             :                            "request");
    1911           0 :                 return -1;
    1912             :         }
    1913           1 :         if (uuid == NULL)
    1914           0 :                 uuid = ap->uuid;
    1915           1 :         if (ap->wps) {
    1916           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
    1917             :                            "with the AP - cannot start learn");
    1918           0 :                 return -1;
    1919             :         }
    1920             : 
    1921           1 :         if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
    1922           0 :                 return -1;
    1923             : 
    1924           1 :         er->skip_set_sel_reg = 1;
    1925           1 :         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
    1926           1 :         er->skip_set_sel_reg = 0;
    1927             : 
    1928           1 :         return 0;
    1929             : }
    1930             : 
    1931             : 
    1932           8 : int wps_er_set_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
    1933             :                       const struct wps_credential *cred)
    1934             : {
    1935             :         struct wps_er_ap *ap;
    1936             : 
    1937           8 :         if (er == NULL)
    1938           0 :                 return -1;
    1939             : 
    1940           8 :         ap = wps_er_ap_get(er, NULL, uuid, addr);
    1941           8 :         if (ap == NULL) {
    1942           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config "
    1943             :                            "request");
    1944           0 :                 return -1;
    1945             :         }
    1946             : 
    1947           8 :         os_free(ap->ap_settings);
    1948           8 :         ap->ap_settings = os_malloc(sizeof(*cred));
    1949           8 :         if (ap->ap_settings == NULL)
    1950           0 :                 return -1;
    1951           8 :         os_memcpy(ap->ap_settings, cred, sizeof(*cred));
    1952           8 :         ap->ap_settings->cred_attr = NULL;
    1953           8 :         wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set "
    1954             :                    "config request");
    1955             : 
    1956           8 :         return 0;
    1957             : }
    1958             : 
    1959             : 
    1960           1 : static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1)
    1961             : {
    1962             :         struct wps_config cfg;
    1963             : 
    1964           1 :         if (ap->wps) {
    1965           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
    1966             :                            "progress with this AP");
    1967           0 :                 return;
    1968             :         }
    1969             : 
    1970           1 :         os_memset(&cfg, 0, sizeof(cfg));
    1971           1 :         cfg.wps = ap->er->wps;
    1972           1 :         cfg.registrar = 1;
    1973           1 :         cfg.new_ap_settings = ap->ap_settings;
    1974           1 :         ap->wps = wps_init(&cfg);
    1975           1 :         if (ap->wps == NULL)
    1976           0 :                 return;
    1977           1 :         ap->wps->ap_settings_cb = NULL;
    1978           1 :         ap->wps->ap_settings_cb_ctx = NULL;
    1979             : 
    1980           1 :         wps_er_ap_process(ap, m1);
    1981             : }
    1982             : 
    1983             : 
    1984           1 : int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
    1985             :                   const u8 *pin, size_t pin_len,
    1986             :                   const struct wps_credential *cred)
    1987             : {
    1988             :         struct wps_er_ap *ap;
    1989             : 
    1990           1 :         if (er == NULL)
    1991           0 :                 return -1;
    1992             : 
    1993           1 :         ap = wps_er_ap_get(er, NULL, uuid, addr);
    1994           1 :         if (ap == NULL) {
    1995           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config "
    1996             :                            "request");
    1997           0 :                 return -1;
    1998             :         }
    1999           1 :         if (uuid == NULL)
    2000           1 :                 uuid = ap->uuid;
    2001           1 :         if (ap->wps) {
    2002           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
    2003             :                            "with the AP - cannot start config");
    2004           0 :                 return -1;
    2005             :         }
    2006             : 
    2007           1 :         os_free(ap->ap_settings);
    2008           1 :         ap->ap_settings = os_malloc(sizeof(*cred));
    2009           1 :         if (ap->ap_settings == NULL)
    2010           0 :                 return -1;
    2011           1 :         os_memcpy(ap->ap_settings, cred, sizeof(*cred));
    2012           1 :         ap->ap_settings->cred_attr = NULL;
    2013             : 
    2014           1 :         if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0)
    2015           0 :                 return -1;
    2016             : 
    2017           1 :         er->skip_set_sel_reg = 1;
    2018           1 :         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
    2019           1 :         er->skip_set_sel_reg = 0;
    2020             : 
    2021           1 :         return 0;
    2022             : }
    2023             : 
    2024             : 
    2025             : #ifdef CONFIG_WPS_NFC
    2026             : 
    2027           2 : struct wpabuf * wps_er_config_token_from_cred(struct wps_context *wps,
    2028             :                                               struct wps_credential *cred)
    2029             : {
    2030             :         struct wpabuf *ret;
    2031             :         struct wps_data data;
    2032             : 
    2033           2 :         ret = wpabuf_alloc(500);
    2034           2 :         if (ret == NULL)
    2035           0 :                 return NULL;
    2036             : 
    2037           2 :         os_memset(&data, 0, sizeof(data));
    2038           2 :         data.wps = wps;
    2039           2 :         data.use_cred = cred;
    2040           4 :         if (wps_build_cred(&data, ret) ||
    2041           2 :             wps_build_wfa_ext(ret, 0, NULL, 0)) {
    2042           0 :                 wpabuf_free(ret);
    2043           0 :                 return NULL;
    2044             :         }
    2045             : 
    2046           2 :         return ret;
    2047             : }
    2048             : 
    2049             : 
    2050           2 : struct wpabuf * wps_er_nfc_config_token(struct wps_er *er, const u8 *uuid,
    2051             :                                         const u8 *addr)
    2052             : {
    2053             :         struct wps_er_ap *ap;
    2054             : 
    2055           2 :         if (er == NULL)
    2056           0 :                 return NULL;
    2057             : 
    2058           2 :         ap = wps_er_ap_get(er, NULL, uuid, addr);
    2059           2 :         if (ap == NULL)
    2060           0 :                 return NULL;
    2061           2 :         if (ap->ap_settings == NULL) {
    2062           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
    2063             :                            "selected AP");
    2064           0 :                 return NULL;
    2065             :         }
    2066             : 
    2067           2 :         return wps_er_config_token_from_cred(er->wps, ap->ap_settings);
    2068             : }
    2069             : 
    2070             : 
    2071           3 : struct wpabuf * wps_er_nfc_handover_sel(struct wps_er *er,
    2072             :                                         struct wps_context *wps, const u8 *uuid,
    2073             :                                         const u8 *addr, struct wpabuf *pubkey)
    2074             : {
    2075             :         struct wps_er_ap *ap;
    2076             : 
    2077           3 :         if (er == NULL)
    2078           0 :                 return NULL;
    2079             : 
    2080           3 :         ap = wps_er_ap_get(er, NULL, uuid, addr);
    2081           3 :         if (ap == NULL)
    2082           0 :                 return NULL;
    2083           3 :         if (ap->ap_settings == NULL) {
    2084           0 :                 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
    2085             :                            "selected AP");
    2086           0 :                 return NULL;
    2087             :         }
    2088             : 
    2089           3 :         os_memcpy(wps->ssid, ap->ap_settings->ssid, ap->ap_settings->ssid_len);
    2090           3 :         wps->ssid_len = ap->ap_settings->ssid_len;
    2091             : 
    2092           3 :         return wps_build_nfc_handover_sel(wps, pubkey, addr, 0);
    2093             : }
    2094             : 
    2095             : #endif /* CONFIG_WPS_NFC */

Generated by: LCOV version 1.10