Line data Source code
1 : /*
2 : * Wi-Fi Protected Setup - External Registrar
3 : * Copyright (c) 2009-2013, Jouni Malinen <j@w1.fi>
4 : *
5 : * This software may be distributed under the terms of the BSD license.
6 : * See README for more details.
7 : */
8 :
9 : #include "includes.h"
10 :
11 : #include "common.h"
12 : #include "base64.h"
13 : #include "uuid.h"
14 : #include "eloop.h"
15 : #include "httpread.h"
16 : #include "http_client.h"
17 : #include "http_server.h"
18 : #include "upnp_xml.h"
19 : #include "wps_i.h"
20 : #include "wps_upnp.h"
21 : #include "wps_upnp_i.h"
22 : #include "wps_er.h"
23 :
24 :
25 : static void wps_er_deinit_finish(void *eloop_data, void *user_ctx);
26 : static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
27 : static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
28 : static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
29 : static int wps_er_send_get_device_info(struct wps_er_ap *ap,
30 : void (*m1_handler)(struct wps_er_ap *ap,
31 : struct wpabuf *m1));
32 :
33 :
34 125 : static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
35 : enum wps_event event)
36 : {
37 : union wps_event_data data;
38 125 : struct wps_event_er_enrollee *ev = &data.enrollee;
39 :
40 125 : if (wps->event_cb == NULL)
41 125 : return;
42 :
43 125 : os_memset(&data, 0, sizeof(data));
44 125 : ev->uuid = sta->uuid;
45 125 : ev->mac_addr = sta->addr;
46 125 : ev->m1_received = sta->m1_received;
47 125 : ev->config_methods = sta->config_methods;
48 125 : ev->dev_passwd_id = sta->dev_passwd_id;
49 125 : ev->pri_dev_type = sta->pri_dev_type;
50 125 : ev->dev_name = sta->dev_name;
51 125 : ev->manufacturer = sta->manufacturer;
52 125 : ev->model_name = sta->model_name;
53 125 : ev->model_number = sta->model_number;
54 125 : ev->serial_number = sta->serial_number;
55 125 : wps->event_cb(wps->cb_ctx, event, &data);
56 : }
57 :
58 :
59 149 : static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr,
60 : const u8 *uuid)
61 : {
62 : struct wps_er_sta *sta;
63 173 : dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
64 255 : if ((addr == NULL ||
65 231 : os_memcmp(sta->addr, addr, ETH_ALEN) == 0) &&
66 1 : (uuid == NULL ||
67 1 : os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0))
68 104 : return sta;
69 : }
70 45 : return NULL;
71 : }
72 :
73 :
74 39 : static void wps_er_sta_free(struct wps_er_sta *sta)
75 : {
76 39 : wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
77 39 : if (sta->wps)
78 4 : wps_deinit(sta->wps);
79 39 : os_free(sta->manufacturer);
80 39 : os_free(sta->model_name);
81 39 : os_free(sta->model_number);
82 39 : os_free(sta->serial_number);
83 39 : os_free(sta->dev_name);
84 39 : http_client_free(sta->http);
85 39 : eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
86 39 : os_free(sta->cred);
87 39 : os_free(sta);
88 39 : }
89 :
90 :
91 55 : static void wps_er_sta_remove_all(struct wps_er_ap *ap)
92 : {
93 : struct wps_er_sta *prev, *sta;
94 93 : dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
95 38 : wps_er_sta_free(sta);
96 55 : }
97 :
98 :
99 201 : static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
100 : struct in_addr *addr, const u8 *uuid,
101 : const u8 *mac_addr)
102 : {
103 : struct wps_er_ap *ap;
104 203 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
105 119 : if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
106 107 : (uuid == NULL ||
107 224 : os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0) &&
108 7 : (mac_addr == NULL ||
109 7 : os_memcmp(mac_addr, ap->mac_addr, ETH_ALEN) == 0))
110 117 : return ap;
111 : }
112 84 : return NULL;
113 : }
114 :
115 :
116 156 : static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
117 : {
118 : struct wps_er_ap *ap;
119 157 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
120 156 : if (ap->id == id)
121 155 : return ap;
122 : }
123 1 : return NULL;
124 : }
125 :
126 :
127 87 : static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
128 : enum wps_event event)
129 : {
130 : union wps_event_data data;
131 87 : struct wps_event_er_ap *evap = &data.ap;
132 :
133 87 : if (wps->event_cb == NULL)
134 87 : return;
135 :
136 87 : os_memset(&data, 0, sizeof(data));
137 87 : evap->uuid = ap->uuid;
138 87 : evap->friendly_name = ap->friendly_name;
139 87 : evap->manufacturer = ap->manufacturer;
140 87 : evap->manufacturer_url = ap->manufacturer_url;
141 87 : evap->model_description = ap->model_description;
142 87 : evap->model_name = ap->model_name;
143 87 : evap->model_number = ap->model_number;
144 87 : evap->model_url = ap->model_url;
145 87 : evap->serial_number = ap->serial_number;
146 87 : evap->upc = ap->upc;
147 87 : evap->pri_dev_type = ap->pri_dev_type;
148 87 : evap->wps_state = ap->wps_state;
149 87 : evap->mac_addr = ap->mac_addr;
150 87 : wps->event_cb(wps->cb_ctx, event, &data);
151 : }
152 :
153 :
154 55 : static void wps_er_ap_free(struct wps_er_ap *ap)
155 : {
156 55 : http_client_free(ap->http);
157 55 : ap->http = NULL;
158 :
159 55 : os_free(ap->location);
160 55 : os_free(ap->friendly_name);
161 55 : os_free(ap->manufacturer);
162 55 : os_free(ap->manufacturer_url);
163 55 : os_free(ap->model_description);
164 55 : os_free(ap->model_name);
165 55 : os_free(ap->model_number);
166 55 : os_free(ap->model_url);
167 55 : os_free(ap->serial_number);
168 55 : os_free(ap->udn);
169 55 : os_free(ap->upc);
170 :
171 55 : os_free(ap->scpd_url);
172 55 : os_free(ap->control_url);
173 55 : os_free(ap->event_sub_url);
174 :
175 55 : os_free(ap->ap_settings);
176 :
177 55 : os_free(ap);
178 55 : }
179 :
180 :
181 31 : static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap)
182 : {
183 31 : wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)",
184 : inet_ntoa(ap->addr), ap->location);
185 31 : dl_list_del(&ap->list);
186 31 : wps_er_ap_free(ap);
187 :
188 31 : if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing))
189 27 : wps_er_deinit_finish(er, NULL);
190 31 : }
191 :
192 :
193 31 : static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c,
194 : enum http_client_event event)
195 : {
196 31 : struct wps_er_ap *ap = ctx;
197 :
198 31 : switch (event) {
199 : case HTTP_CLIENT_OK:
200 19 : wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events");
201 19 : ap->subscribed = 0;
202 19 : break;
203 : case HTTP_CLIENT_FAILED:
204 : case HTTP_CLIENT_INVALID_REPLY:
205 : case HTTP_CLIENT_TIMEOUT:
206 12 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from "
207 : "events");
208 12 : break;
209 : }
210 31 : http_client_free(ap->http);
211 31 : ap->http = NULL;
212 :
213 : /*
214 : * Need to get rid of the AP entry regardless of whether we managed to
215 : * unsubscribe cleanly or not.
216 : */
217 31 : wps_er_ap_unsubscribed(ap->er, ap);
218 31 : }
219 :
220 :
221 31 : static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap)
222 : {
223 : struct wpabuf *req;
224 : struct sockaddr_in dst;
225 : char *url, *path;
226 : char sid[100];
227 :
228 31 : if (ap->event_sub_url == NULL) {
229 0 : wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
230 : "subscribe");
231 0 : goto fail;
232 : }
233 31 : if (ap->http) {
234 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
235 : "send subscribe request");
236 0 : goto fail;
237 : }
238 :
239 31 : url = http_client_url_parse(ap->event_sub_url, &dst, &path);
240 31 : if (url == NULL) {
241 0 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
242 0 : goto fail;
243 : }
244 :
245 31 : req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
246 31 : if (req == NULL) {
247 0 : os_free(url);
248 0 : goto fail;
249 : }
250 31 : uuid_bin2str(ap->sid, sid, sizeof(sid));
251 31 : wpabuf_printf(req,
252 : "UNSUBSCRIBE %s HTTP/1.1\r\n"
253 : "HOST: %s:%d\r\n"
254 : "SID: uuid:%s\r\n"
255 : "\r\n",
256 31 : path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid);
257 31 : os_free(url);
258 31 : wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request",
259 : wpabuf_head(req), wpabuf_len(req));
260 :
261 31 : ap->http = http_client_addr(&dst, req, 1000,
262 : wps_er_http_unsubscribe_cb, ap);
263 31 : if (ap->http == NULL) {
264 0 : wpabuf_free(req);
265 0 : goto fail;
266 : }
267 62 : return;
268 :
269 : fail:
270 : /*
271 : * Need to get rid of the AP entry even when we fail to unsubscribe
272 : * cleanly.
273 : */
274 0 : wps_er_ap_unsubscribed(ap->er, ap);
275 : }
276 :
277 :
278 35 : static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er,
279 : const u8 *uuid)
280 : {
281 : struct wps_er_ap_settings *s;
282 35 : dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list)
283 2 : if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0)
284 2 : return s;
285 33 : return NULL;
286 : }
287 :
288 :
289 30 : int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr)
290 : {
291 : struct wps_er_ap *ap;
292 : struct wps_er_ap_settings *settings;
293 :
294 30 : ap = wps_er_ap_get(er, addr, NULL, NULL);
295 30 : if (ap == NULL || ap->ap_settings == NULL)
296 26 : return -1;
297 :
298 4 : settings = wps_er_ap_get_settings(er, ap->uuid);
299 4 : if (!settings) {
300 4 : settings = os_zalloc(sizeof(*settings));
301 4 : if (settings == NULL)
302 1 : return -1;
303 3 : os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN);
304 3 : dl_list_add(&er->ap_settings, &settings->list);
305 : }
306 3 : os_memcpy(&settings->ap_settings, ap->ap_settings,
307 : sizeof(struct wps_credential));
308 :
309 3 : return 0;
310 : }
311 :
312 :
313 31 : static int wps_er_ap_use_cached_settings(struct wps_er *er,
314 : struct wps_er_ap *ap)
315 : {
316 : struct wps_er_ap_settings *s;
317 :
318 31 : if (ap->ap_settings)
319 0 : return 0;
320 :
321 31 : s = wps_er_ap_get_settings(ap->er, ap->uuid);
322 31 : if (!s)
323 29 : return -1;
324 :
325 2 : ap->ap_settings = os_malloc(sizeof(*ap->ap_settings));
326 2 : if (ap->ap_settings == NULL)
327 1 : return -1;
328 :
329 1 : os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings));
330 1 : wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings");
331 1 : return 0;
332 : }
333 :
334 :
335 55 : static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap)
336 : {
337 55 : wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
338 : inet_ntoa(ap->addr), ap->location);
339 55 : eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
340 55 : wps_er_sta_remove_all(ap);
341 55 : wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
342 55 : http_client_free(ap->http);
343 55 : ap->http = NULL;
344 55 : if (ap->wps) {
345 1 : wps_deinit(ap->wps);
346 1 : ap->wps = NULL;
347 : }
348 :
349 55 : dl_list_del(&ap->list);
350 55 : if (ap->subscribed) {
351 31 : dl_list_add(&er->ap_unsubscribing, &ap->list);
352 31 : wps_er_ap_unsubscribe(er, ap);
353 : } else
354 24 : wps_er_ap_free(ap);
355 55 : }
356 :
357 :
358 19 : static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
359 : {
360 19 : struct wps_er *er = eloop_data;
361 19 : struct wps_er_ap *ap = user_ctx;
362 19 : wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
363 19 : wps_er_ap_remove_entry(er, ap);
364 19 : }
365 :
366 :
367 31 : static int wps_er_get_sid(struct wps_er_ap *ap, char *sid)
368 : {
369 : char *pos;
370 : char txt[100];
371 :
372 31 : if (!sid) {
373 1 : wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)",
374 : inet_ntoa(ap->addr), ap->location);
375 1 : return -1;
376 : }
377 :
378 30 : pos = os_strstr(sid, "uuid:");
379 30 : if (!pos) {
380 1 : wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
381 : "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
382 : sid);
383 1 : return -1;
384 : }
385 :
386 29 : pos += 5;
387 29 : if (uuid_str2bin(pos, ap->sid) < 0) {
388 1 : wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
389 : "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
390 : sid);
391 1 : return -1;
392 : }
393 :
394 28 : uuid_bin2str(ap->sid, txt, sizeof(txt));
395 28 : wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s",
396 : inet_ntoa(ap->addr), ap->location, txt);
397 :
398 28 : return 0;
399 : }
400 :
401 :
402 32 : static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
403 : enum http_client_event event)
404 : {
405 32 : struct wps_er_ap *ap = ctx;
406 :
407 32 : switch (event) {
408 : case HTTP_CLIENT_OK:
409 31 : wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
410 31 : ap->subscribed = 1;
411 31 : wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID"));
412 31 : wps_er_ap_use_cached_settings(ap->er, ap);
413 31 : wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
414 31 : break;
415 : case HTTP_CLIENT_FAILED:
416 : case HTTP_CLIENT_INVALID_REPLY:
417 : case HTTP_CLIENT_TIMEOUT:
418 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
419 1 : break;
420 : }
421 32 : http_client_free(ap->http);
422 32 : ap->http = NULL;
423 32 : }
424 :
425 :
426 36 : static void wps_er_subscribe(struct wps_er_ap *ap)
427 : {
428 : struct wpabuf *req;
429 : struct sockaddr_in dst;
430 : char *url, *path;
431 :
432 36 : if (ap->event_sub_url == NULL) {
433 1 : wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
434 : "subscribe");
435 1 : return;
436 : }
437 35 : if (ap->http) {
438 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
439 : "send subscribe request");
440 0 : return;
441 : }
442 :
443 35 : url = http_client_url_parse(ap->event_sub_url, &dst, &path);
444 35 : if (url == NULL) {
445 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
446 1 : return;
447 : }
448 :
449 34 : req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
450 34 : if (req == NULL) {
451 1 : os_free(url);
452 1 : return;
453 : }
454 165 : wpabuf_printf(req,
455 : "SUBSCRIBE %s HTTP/1.1\r\n"
456 : "HOST: %s:%d\r\n"
457 : "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
458 : "NT: upnp:event\r\n"
459 : "TIMEOUT: Second-%d\r\n"
460 : "\r\n",
461 33 : path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
462 66 : ap->er->ip_addr_text, ap->er->http_port,
463 33 : ap->er->event_id, ap->id, 1800);
464 33 : os_free(url);
465 33 : wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
466 : wpabuf_head(req), wpabuf_len(req));
467 :
468 33 : ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
469 : ap);
470 33 : if (ap->http == NULL)
471 1 : wpabuf_free(req);
472 : }
473 :
474 :
475 37 : static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
476 : {
477 : struct wps_parse_attr attr;
478 :
479 37 : if (wps_parse_msg(m1, &attr) < 0) {
480 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
481 38 : return;
482 : }
483 36 : if (attr.primary_dev_type)
484 36 : os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
485 36 : if (attr.wps_state)
486 36 : ap->wps_state = *attr.wps_state;
487 36 : if (attr.mac_addr)
488 36 : os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
489 :
490 36 : wps_er_subscribe(ap);
491 : }
492 :
493 :
494 42 : static void wps_er_get_device_info(struct wps_er_ap *ap)
495 : {
496 42 : wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
497 42 : }
498 :
499 :
500 42 : static const char * wps_er_find_wfadevice(const char *data)
501 : {
502 : const char *tag, *tagname, *end;
503 : char *val;
504 42 : int found = 0;
505 :
506 124 : while (!found) {
507 : /* Find next <device> */
508 : for (;;) {
509 379 : if (xml_next_tag(data, &tag, &tagname, &end))
510 1 : return NULL;
511 378 : data = end;
512 419 : if (!os_strncasecmp(tagname, "device", 6) &&
513 82 : *tag != '/' &&
514 41 : (tagname[6] == '>' || !isgraph(tagname[6]))) {
515 : break;
516 : }
517 337 : }
518 :
519 : /* Check whether deviceType is WFADevice */
520 41 : val = xml_get_first_item(data, "deviceType");
521 41 : if (val == NULL)
522 1 : return NULL;
523 40 : wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val);
524 80 : found = os_strcasecmp(val, "urn:schemas-wifialliance-org:"
525 40 : "device:WFADevice:1") == 0;
526 40 : os_free(val);
527 : }
528 :
529 40 : return data;
530 : }
531 :
532 :
533 42 : static void wps_er_parse_device_description(struct wps_er_ap *ap,
534 : struct wpabuf *reply)
535 : {
536 : /* Note: reply includes null termination after the buffer data */
537 42 : const char *tmp, *data = wpabuf_head(reply);
538 : char *pos;
539 :
540 42 : wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
541 : wpabuf_head(reply), wpabuf_len(reply));
542 :
543 : /*
544 : * The root device description may include multiple devices, so first
545 : * find the beginning of the WFADevice description to allow the
546 : * simplistic parser to pick the correct entries.
547 : */
548 42 : tmp = wps_er_find_wfadevice(data);
549 42 : if (tmp == NULL) {
550 2 : wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - "
551 : "trying to parse invalid data");
552 : } else
553 40 : data = tmp;
554 :
555 42 : ap->friendly_name = xml_get_first_item(data, "friendlyName");
556 42 : wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
557 :
558 42 : ap->manufacturer = xml_get_first_item(data, "manufacturer");
559 42 : wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
560 :
561 42 : ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
562 42 : wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
563 : ap->manufacturer_url);
564 :
565 42 : ap->model_description = xml_get_first_item(data, "modelDescription");
566 42 : wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
567 : ap->model_description);
568 :
569 42 : ap->model_name = xml_get_first_item(data, "modelName");
570 42 : wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
571 :
572 42 : ap->model_number = xml_get_first_item(data, "modelNumber");
573 42 : wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
574 :
575 42 : ap->model_url = xml_get_first_item(data, "modelURL");
576 42 : wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
577 :
578 42 : ap->serial_number = xml_get_first_item(data, "serialNumber");
579 42 : wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
580 :
581 42 : ap->udn = xml_get_first_item(data, "UDN");
582 42 : if (ap->udn) {
583 40 : wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
584 40 : pos = os_strstr(ap->udn, "uuid:");
585 40 : if (pos) {
586 40 : pos += 5;
587 40 : if (uuid_str2bin(pos, ap->uuid) < 0)
588 1 : wpa_printf(MSG_DEBUG,
589 : "WPS ER: Invalid UUID in UDN");
590 : }
591 : }
592 :
593 42 : ap->upc = xml_get_first_item(data, "UPC");
594 42 : wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
595 :
596 42 : ap->scpd_url = http_link_update(
597 42 : xml_get_first_item(data, "SCPDURL"), ap->location);
598 42 : wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
599 :
600 42 : ap->control_url = http_link_update(
601 42 : xml_get_first_item(data, "controlURL"), ap->location);
602 42 : wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
603 :
604 42 : ap->event_sub_url = http_link_update(
605 42 : xml_get_first_item(data, "eventSubURL"), ap->location);
606 42 : wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
607 42 : }
608 :
609 :
610 47 : static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
611 : enum http_client_event event)
612 : {
613 47 : struct wps_er_ap *ap = ctx;
614 : struct wpabuf *reply;
615 47 : int ok = 0;
616 :
617 47 : switch (event) {
618 : case HTTP_CLIENT_OK:
619 42 : reply = http_client_get_body(c);
620 42 : if (reply == NULL)
621 0 : break;
622 42 : wps_er_parse_device_description(ap, reply);
623 42 : ok = 1;
624 42 : break;
625 : case HTTP_CLIENT_FAILED:
626 : case HTTP_CLIENT_INVALID_REPLY:
627 : case HTTP_CLIENT_TIMEOUT:
628 5 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
629 5 : break;
630 : }
631 47 : http_client_free(ap->http);
632 47 : ap->http = NULL;
633 47 : if (ok)
634 42 : wps_er_get_device_info(ap);
635 47 : }
636 :
637 :
638 137 : void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
639 : const char *location, int max_age)
640 : {
641 : struct wps_er_ap *ap;
642 :
643 137 : ap = wps_er_ap_get(er, addr, uuid, NULL);
644 137 : if (ap) {
645 : /* Update advertisement timeout */
646 80 : eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
647 80 : eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
648 80 : return;
649 : }
650 :
651 57 : ap = os_zalloc(sizeof(*ap));
652 57 : if (ap == NULL)
653 1 : return;
654 56 : dl_list_init(&ap->sta);
655 56 : ap->er = er;
656 56 : ap->id = ++er->next_ap_id;
657 56 : ap->location = os_strdup(location);
658 56 : if (ap->location == NULL) {
659 1 : os_free(ap);
660 1 : return;
661 : }
662 55 : dl_list_add(&er->ap, &ap->list);
663 :
664 55 : ap->addr.s_addr = addr->s_addr;
665 55 : os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
666 55 : eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
667 :
668 55 : wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
669 : inet_ntoa(ap->addr), ap->location);
670 :
671 : /* Fetch device description */
672 55 : ap->http = http_client_url(ap->location, NULL, 10000,
673 : wps_er_http_dev_desc_cb, ap);
674 : }
675 :
676 :
677 30 : void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
678 : {
679 : struct wps_er_ap *ap;
680 30 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
681 5 : if (ap->addr.s_addr == addr->s_addr) {
682 5 : wps_er_ap_remove_entry(er, ap);
683 35 : return;
684 : }
685 : }
686 : }
687 :
688 :
689 55 : static void wps_er_ap_remove_all(struct wps_er *er)
690 : {
691 : struct wps_er_ap *prev, *ap;
692 : struct wps_er_ap_settings *prev_s, *s;
693 86 : dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
694 31 : wps_er_ap_remove_entry(er, ap);
695 58 : dl_list_for_each_safe(s, prev_s, &er->ap_settings,
696 : struct wps_er_ap_settings, list)
697 3 : os_free(s);
698 55 : }
699 :
700 :
701 171 : static void http_put_date(struct wpabuf *buf)
702 : {
703 171 : wpabuf_put_str(buf, "Date: ");
704 171 : format_date(buf);
705 171 : wpabuf_put_str(buf, "\r\n");
706 171 : }
707 :
708 :
709 3 : static void wps_er_http_resp_not_found(struct http_request *req)
710 : {
711 : struct wpabuf *buf;
712 3 : buf = wpabuf_alloc(200);
713 3 : if (buf == NULL) {
714 1 : http_request_deinit(req);
715 4 : return;
716 : }
717 :
718 2 : wpabuf_put_str(buf,
719 : "HTTP/1.1 404 Not Found\r\n"
720 : "Server: unspecified, UPnP/1.0, unspecified\r\n"
721 : "Connection: close\r\n");
722 2 : http_put_date(buf);
723 2 : wpabuf_put_str(buf, "\r\n");
724 2 : http_request_send_and_deinit(req, buf);
725 : }
726 :
727 :
728 155 : static void wps_er_http_resp_ok(struct http_request *req)
729 : {
730 : struct wpabuf *buf;
731 155 : buf = wpabuf_alloc(200);
732 155 : if (buf == NULL) {
733 1 : http_request_deinit(req);
734 156 : return;
735 : }
736 :
737 154 : wpabuf_put_str(buf,
738 : "HTTP/1.1 200 OK\r\n"
739 : "Server: unspecified, UPnP/1.0, unspecified\r\n"
740 : "Connection: close\r\n"
741 : "Content-Length: 0\r\n");
742 154 : http_put_date(buf);
743 154 : wpabuf_put_str(buf, "\r\n");
744 154 : http_request_send_and_deinit(req, buf);
745 : }
746 :
747 :
748 1 : static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
749 : {
750 1 : struct wps_er_sta *sta = eloop_data;
751 1 : wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
752 1 : dl_list_del(&sta->list);
753 1 : wps_er_sta_free(sta);
754 1 : }
755 :
756 :
757 144 : static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
758 : const u8 *addr,
759 : struct wps_parse_attr *attr,
760 : int probe_req)
761 : {
762 144 : struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL);
763 144 : int new_sta = 0;
764 : int m1;
765 :
766 144 : m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
767 :
768 144 : if (sta == NULL) {
769 : /*
770 : * Only allow new STA entry to be added based on Probe Request
771 : * or M1. This will filter out bogus events and anything that
772 : * may have been ongoing at the time ER subscribed for events.
773 : */
774 44 : if (!probe_req && !m1)
775 4 : return NULL;
776 :
777 40 : sta = os_zalloc(sizeof(*sta));
778 40 : if (sta == NULL)
779 1 : return NULL;
780 39 : os_memcpy(sta->addr, addr, ETH_ALEN);
781 39 : sta->ap = ap;
782 39 : dl_list_add(&ap->sta, &sta->list);
783 39 : new_sta = 1;
784 : }
785 :
786 139 : if (m1)
787 47 : sta->m1_received = 1;
788 :
789 139 : if (attr->config_methods && (!probe_req || !sta->m1_received))
790 86 : sta->config_methods = WPA_GET_BE16(attr->config_methods);
791 139 : if (attr->uuid_e && (!probe_req || !sta->m1_received))
792 93 : os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
793 139 : if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
794 80 : os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
795 139 : if (attr->dev_password_id && (!probe_req || !sta->m1_received))
796 76 : sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
797 :
798 139 : if (attr->manufacturer) {
799 84 : os_free(sta->manufacturer);
800 84 : sta->manufacturer = dup_binstr(attr->manufacturer,
801 84 : attr->manufacturer_len);
802 : }
803 :
804 139 : if (attr->model_name) {
805 83 : os_free(sta->model_name);
806 83 : sta->model_name = dup_binstr(attr->model_name,
807 83 : attr->model_name_len);
808 : }
809 :
810 139 : if (attr->model_number) {
811 82 : os_free(sta->model_number);
812 82 : sta->model_number = dup_binstr(attr->model_number,
813 82 : attr->model_number_len);
814 : }
815 :
816 139 : if (attr->serial_number) {
817 34 : os_free(sta->serial_number);
818 34 : sta->serial_number = dup_binstr(attr->serial_number,
819 34 : attr->serial_number_len);
820 : }
821 :
822 139 : if (attr->dev_name) {
823 79 : os_free(sta->dev_name);
824 79 : sta->dev_name = dup_binstr(attr->dev_name, attr->dev_name_len);
825 : }
826 :
827 139 : eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
828 139 : eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
829 :
830 139 : if (m1 || new_sta)
831 85 : wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
832 :
833 139 : return sta;
834 : }
835 :
836 :
837 49 : static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
838 : const u8 *addr,
839 : struct wpabuf *msg)
840 : {
841 : struct wps_parse_attr attr;
842 :
843 294 : wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
844 294 : MACSTR, MAC2STR(addr));
845 49 : wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
846 : "(TLVs from Probe Request)", msg);
847 :
848 49 : if (wps_validate_probe_req(msg, addr) < 0) {
849 0 : wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied "
850 0 : "Probe Request frame from " MACSTR, MAC2STR(addr));
851 0 : return;
852 : }
853 :
854 49 : if (wps_parse_msg(msg, &attr) < 0) {
855 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
856 : "WLANEvent message");
857 1 : return;
858 : }
859 :
860 48 : wps_er_add_sta_data(ap, addr, &attr, 1);
861 48 : wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0);
862 : }
863 :
864 :
865 44 : static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
866 : enum http_client_event event)
867 : {
868 44 : struct wps_er_sta *sta = ctx;
869 :
870 44 : switch (event) {
871 : case HTTP_CLIENT_OK:
872 40 : wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
873 40 : break;
874 : case HTTP_CLIENT_FAILED:
875 : case HTTP_CLIENT_INVALID_REPLY:
876 : case HTTP_CLIENT_TIMEOUT:
877 4 : wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
878 4 : break;
879 : }
880 44 : http_client_free(sta->http);
881 44 : sta->http = NULL;
882 44 : }
883 :
884 :
885 : static const char *soap_prefix =
886 : "<?xml version=\"1.0\"?>\n"
887 : "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
888 : "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
889 : "<s:Body>\n";
890 : static const char *soap_postfix =
891 : "</s:Body>\n</s:Envelope>\n";
892 : static const char *urn_wfawlanconfig =
893 : "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
894 :
895 178 : static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
896 : const char *name, const char *arg_name,
897 : const char *path,
898 : const struct sockaddr_in *dst,
899 : char **len_ptr, char **body_ptr)
900 : {
901 : unsigned char *encoded;
902 : size_t encoded_len;
903 : struct wpabuf *buf;
904 :
905 178 : if (msg) {
906 125 : encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
907 : &encoded_len);
908 125 : if (encoded == NULL)
909 3 : return NULL;
910 : } else {
911 53 : encoded = NULL;
912 53 : encoded_len = 0;
913 : }
914 :
915 175 : buf = wpabuf_alloc(1000 + encoded_len);
916 175 : if (buf == NULL) {
917 1 : os_free(encoded);
918 1 : return NULL;
919 : }
920 :
921 174 : wpabuf_printf(buf,
922 : "POST %s HTTP/1.1\r\n"
923 : "Host: %s:%d\r\n"
924 : "Content-Type: text/xml; charset=\"utf-8\"\r\n"
925 : "Content-Length: ",
926 174 : path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
927 :
928 174 : *len_ptr = wpabuf_put(buf, 0);
929 174 : wpabuf_printf(buf,
930 : " \r\n"
931 : "SOAPACTION: \"%s#%s\"\r\n"
932 : "\r\n",
933 : urn_wfawlanconfig, name);
934 :
935 174 : *body_ptr = wpabuf_put(buf, 0);
936 :
937 174 : wpabuf_put_str(buf, soap_prefix);
938 174 : wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
939 174 : wpabuf_put_str(buf, urn_wfawlanconfig);
940 174 : wpabuf_put_str(buf, "\">\n");
941 174 : if (encoded) {
942 121 : wpabuf_printf(buf, "<%s>%s</%s>\n",
943 : arg_name, (char *) encoded, arg_name);
944 121 : os_free(encoded);
945 : }
946 :
947 174 : return buf;
948 : }
949 :
950 :
951 174 : static void wps_er_soap_end(struct wpabuf *buf, const char *name,
952 : char *len_ptr, char *body_ptr)
953 : {
954 : char len_buf[10];
955 174 : wpabuf_printf(buf, "</u:%s>\n", name);
956 174 : wpabuf_put_str(buf, soap_postfix);
957 174 : os_snprintf(len_buf, sizeof(len_buf), "%d",
958 174 : (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
959 174 : os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
960 174 : }
961 :
962 :
963 48 : static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
964 : {
965 : struct wpabuf *buf;
966 : char *len_ptr, *body_ptr;
967 : struct sockaddr_in dst;
968 : char *url, *path;
969 :
970 48 : if (sta->http) {
971 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
972 : "ignore new request");
973 0 : wpabuf_free(msg);
974 0 : return;
975 : }
976 :
977 48 : if (sta->ap->control_url == NULL) {
978 0 : wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
979 0 : wpabuf_free(msg);
980 0 : return;
981 : }
982 :
983 48 : url = http_client_url_parse(sta->ap->control_url, &dst, &path);
984 48 : if (url == NULL) {
985 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
986 1 : wpabuf_free(msg);
987 1 : return;
988 : }
989 :
990 47 : buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
991 : &len_ptr, &body_ptr);
992 47 : wpabuf_free(msg);
993 47 : os_free(url);
994 47 : if (buf == NULL)
995 2 : return;
996 45 : wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
997 : UPNP_WPS_WLANEVENT_TYPE_EAP);
998 270 : wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
999 270 : MAC2STR(sta->addr));
1000 :
1001 45 : wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
1002 :
1003 45 : sta->http = http_client_addr(&dst, buf, 1000,
1004 : wps_er_http_put_wlan_response_cb, sta);
1005 45 : if (sta->http == NULL)
1006 1 : wpabuf_free(buf);
1007 : }
1008 :
1009 :
1010 86 : static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
1011 : enum wsc_op_code op_code)
1012 : {
1013 : enum wps_process_res res;
1014 :
1015 86 : res = wps_process_msg(sta->wps, op_code, msg);
1016 86 : if (res == WPS_CONTINUE) {
1017 48 : struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
1018 48 : if (next)
1019 48 : wps_er_sta_send_msg(sta, next);
1020 : } else {
1021 38 : wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
1022 : "enrollee (res=%d)",
1023 : res == WPS_DONE ? "succeeded" : "failed", res);
1024 38 : wps_deinit(sta->wps);
1025 38 : sta->wps = NULL;
1026 38 : if (res == WPS_DONE) {
1027 : /* Remove the STA entry after short timeout */
1028 10 : eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
1029 10 : eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
1030 : NULL);
1031 : }
1032 : }
1033 86 : }
1034 :
1035 :
1036 47 : static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
1037 : {
1038 : struct wps_config cfg;
1039 :
1040 47 : if (sta->wps)
1041 4 : wps_deinit(sta->wps);
1042 :
1043 47 : os_memset(&cfg, 0, sizeof(cfg));
1044 47 : cfg.wps = sta->ap->er->wps;
1045 47 : cfg.registrar = 1;
1046 47 : cfg.peer_addr = sta->addr;
1047 :
1048 47 : sta->wps = wps_init(&cfg);
1049 47 : if (sta->wps == NULL)
1050 48 : return;
1051 46 : sta->wps->er = 1;
1052 46 : sta->wps->use_cred = sta->ap->ap_settings;
1053 46 : if (sta->ap->ap_settings) {
1054 13 : os_free(sta->cred);
1055 13 : sta->cred = os_malloc(sizeof(*sta->cred));
1056 13 : if (sta->cred) {
1057 13 : os_memcpy(sta->cred, sta->ap->ap_settings,
1058 : sizeof(*sta->cred));
1059 13 : sta->cred->cred_attr = NULL;
1060 13 : os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN);
1061 13 : sta->wps->use_cred = sta->cred;
1062 : }
1063 : }
1064 :
1065 46 : wps_er_sta_process(sta, msg, WSC_MSG);
1066 : }
1067 :
1068 :
1069 98 : static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
1070 : struct wpabuf *msg)
1071 : {
1072 : struct wps_parse_attr attr;
1073 : struct wps_er_sta *sta;
1074 :
1075 588 : wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
1076 588 : MAC2STR(addr));
1077 98 : wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
1078 : "(TLVs from EAP-WSC)", msg);
1079 :
1080 98 : if (wps_parse_msg(msg, &attr) < 0) {
1081 2 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
1082 : "WLANEvent message");
1083 2 : return;
1084 : }
1085 :
1086 96 : sta = wps_er_add_sta_data(ap, addr, &attr, 0);
1087 96 : if (sta == NULL)
1088 5 : return;
1089 :
1090 91 : if (attr.msg_type && *attr.msg_type == WPS_M1)
1091 47 : wps_er_sta_start(sta, msg);
1092 44 : else if (sta->wps) {
1093 40 : enum wsc_op_code op_code = WSC_MSG;
1094 40 : if (attr.msg_type) {
1095 40 : switch (*attr.msg_type) {
1096 : case WPS_WSC_ACK:
1097 1 : op_code = WSC_ACK;
1098 1 : break;
1099 : case WPS_WSC_NACK:
1100 1 : op_code = WSC_NACK;
1101 1 : break;
1102 : case WPS_WSC_DONE:
1103 10 : op_code = WSC_Done;
1104 10 : break;
1105 : }
1106 : }
1107 40 : wps_er_sta_process(sta, msg, op_code);
1108 : }
1109 : }
1110 :
1111 :
1112 150 : static void wps_er_process_wlanevent(struct wps_er_ap *ap,
1113 : struct wpabuf *event)
1114 : {
1115 : u8 *data;
1116 : u8 wlan_event_type;
1117 : u8 wlan_event_mac[ETH_ALEN];
1118 : struct wpabuf msg;
1119 :
1120 150 : wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
1121 : wpabuf_head(event), wpabuf_len(event));
1122 150 : if (wpabuf_len(event) < 1 + 17) {
1123 1 : wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
1124 1 : return;
1125 : }
1126 :
1127 149 : data = wpabuf_mhead(event);
1128 149 : wlan_event_type = data[0];
1129 149 : if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
1130 1 : wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
1131 : "WLANEvent");
1132 1 : return;
1133 : }
1134 :
1135 148 : wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
1136 :
1137 148 : switch (wlan_event_type) {
1138 : case 1:
1139 49 : wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
1140 49 : break;
1141 : case 2:
1142 98 : wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
1143 98 : break;
1144 : default:
1145 1 : wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
1146 : wlan_event_type);
1147 1 : break;
1148 : }
1149 : }
1150 :
1151 :
1152 156 : static void wps_er_http_event(struct wps_er *er, struct http_request *req,
1153 : unsigned int ap_id)
1154 : {
1155 156 : struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
1156 : struct wpabuf *event;
1157 : enum http_reply_code ret;
1158 :
1159 156 : if (ap == NULL) {
1160 1 : wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
1161 : "%u", ap_id);
1162 1 : wps_er_http_resp_not_found(req);
1163 1 : return;
1164 : }
1165 155 : wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
1166 : ap_id, http_request_get_data(req));
1167 :
1168 155 : event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
1169 : &ret);
1170 155 : if (event == NULL) {
1171 5 : wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
1172 : "from the event notification");
1173 : /*
1174 : * Reply with OK anyway to avoid getting unregistered from
1175 : * events.
1176 : */
1177 5 : wps_er_http_resp_ok(req);
1178 5 : return;
1179 : }
1180 :
1181 150 : wps_er_process_wlanevent(ap, event);
1182 :
1183 150 : wpabuf_free(event);
1184 150 : wps_er_http_resp_ok(req);
1185 : }
1186 :
1187 :
1188 160 : static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
1189 : {
1190 160 : char *uri = http_request_get_uri(req);
1191 :
1192 160 : if (os_strncmp(uri, "/event/", 7) == 0) {
1193 : unsigned int event_id;
1194 : char *pos;
1195 158 : event_id = atoi(uri + 7);
1196 158 : if (event_id != er->event_id) {
1197 1 : wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
1198 : "unknown event id %u", event_id);
1199 1 : return;
1200 : }
1201 157 : pos = os_strchr(uri + 7, '/');
1202 157 : if (pos == NULL)
1203 1 : return;
1204 156 : pos++;
1205 156 : wps_er_http_event(er, req, atoi(pos));
1206 : } else {
1207 2 : wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
1208 : uri);
1209 2 : wps_er_http_resp_not_found(req);
1210 : }
1211 : }
1212 :
1213 :
1214 176 : static void wps_er_http_req(void *ctx, struct http_request *req)
1215 : {
1216 176 : struct wps_er *er = ctx;
1217 176 : struct sockaddr_in *cli = http_request_get_cli_addr(req);
1218 176 : enum httpread_hdr_type type = http_request_get_type(req);
1219 : struct wpabuf *buf;
1220 :
1221 176 : wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
1222 : "%s:%d",
1223 : http_request_get_uri(req), type,
1224 176 : inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
1225 :
1226 176 : switch (type) {
1227 : case HTTPREAD_HDR_TYPE_NOTIFY:
1228 160 : wps_er_http_notify(er, req);
1229 160 : break;
1230 : default:
1231 16 : wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
1232 : "%d", type);
1233 16 : buf = wpabuf_alloc(200);
1234 16 : if (buf == NULL) {
1235 1 : http_request_deinit(req);
1236 177 : return;
1237 : }
1238 15 : wpabuf_put_str(buf,
1239 : "HTTP/1.1 501 Unimplemented\r\n"
1240 : "Connection: close\r\n");
1241 15 : http_put_date(buf);
1242 15 : wpabuf_put_str(buf, "\r\n");
1243 15 : http_request_send_and_deinit(req, buf);
1244 15 : break;
1245 : }
1246 : }
1247 :
1248 :
1249 : struct wps_er *
1250 56 : wps_er_init(struct wps_context *wps, const char *ifname, const char *filter)
1251 : {
1252 : struct wps_er *er;
1253 : struct in_addr addr;
1254 :
1255 56 : er = os_zalloc(sizeof(*er));
1256 56 : if (er == NULL)
1257 1 : return NULL;
1258 55 : dl_list_init(&er->ap);
1259 55 : dl_list_init(&er->ap_unsubscribing);
1260 55 : dl_list_init(&er->ap_settings);
1261 :
1262 55 : er->multicast_sd = -1;
1263 55 : er->ssdp_sd = -1;
1264 :
1265 55 : os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1266 55 : er->wps = wps;
1267 55 : if (os_get_random((unsigned char *) &er->event_id,
1268 : sizeof(er->event_id)) < 0) {
1269 1 : wps_er_deinit(er, NULL, NULL);
1270 1 : return NULL;
1271 : }
1272 : /* Limit event_id to < 32 bits to avoid issues with atoi() */
1273 54 : er->event_id &= 0x0fffffff;
1274 :
1275 54 : if (filter && os_strncmp(filter, "ifname=", 7) == 0) {
1276 : const char *pos, *end;
1277 54 : pos = filter + 7;
1278 54 : end = os_strchr(pos, ' ');
1279 54 : if (end) {
1280 2 : size_t len = end - pos;
1281 2 : os_strlcpy(er->ifname, pos, len < sizeof(er->ifname) ?
1282 : len + 1 : sizeof(er->ifname));
1283 2 : filter = end + 1;
1284 : } else {
1285 52 : os_strlcpy(er->ifname, pos, sizeof(er->ifname));
1286 52 : filter = NULL;
1287 : }
1288 54 : er->forced_ifname = 1;
1289 : }
1290 :
1291 54 : if (filter) {
1292 2 : if (inet_aton(filter, &er->filter_addr) == 0) {
1293 1 : wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter "
1294 : "address %s", filter);
1295 1 : wps_er_deinit(er, NULL, NULL);
1296 1 : return NULL;
1297 : }
1298 1 : wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections "
1299 : "with %s", filter);
1300 : }
1301 53 : if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text,
1302 53 : er->mac_addr)) {
1303 1 : wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1304 1 : "for %s. Does it have IP address?", er->ifname);
1305 1 : wps_er_deinit(er, NULL, NULL);
1306 1 : return NULL;
1307 : }
1308 :
1309 52 : if (wps_er_ssdp_init(er) < 0) {
1310 1 : wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed");
1311 1 : wps_er_deinit(er, NULL, NULL);
1312 1 : return NULL;
1313 : }
1314 :
1315 51 : addr.s_addr = er->ip_addr;
1316 51 : er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1317 51 : if (er->http_srv == NULL) {
1318 2 : wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed");
1319 2 : wps_er_deinit(er, NULL, NULL);
1320 2 : return NULL;
1321 : }
1322 49 : er->http_port = http_server_get_port(er->http_srv);
1323 :
1324 98 : wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)",
1325 49 : er->ifname, er->ip_addr_text);
1326 :
1327 49 : return er;
1328 : }
1329 :
1330 :
1331 1 : void wps_er_refresh(struct wps_er *er)
1332 : {
1333 : struct wps_er_ap *ap;
1334 : struct wps_er_sta *sta;
1335 :
1336 2 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1337 1 : wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
1338 2 : dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
1339 1 : wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
1340 : }
1341 :
1342 1 : wps_er_send_ssdp_msearch(er);
1343 1 : }
1344 :
1345 :
1346 55 : static void wps_er_deinit_finish(void *eloop_data, void *user_ctx)
1347 : {
1348 55 : struct wps_er *er = eloop_data;
1349 : void (*deinit_done_cb)(void *ctx);
1350 : void *deinit_done_ctx;
1351 : struct wps_er_ap *ap, *tmp;
1352 :
1353 55 : wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit");
1354 :
1355 55 : dl_list_for_each_safe(ap, tmp, &er->ap_unsubscribing, struct wps_er_ap,
1356 : list) {
1357 0 : wpa_printf(MSG_DEBUG, "WPS ER: AP entry for %s (%s) still in ap_unsubscribing list - free it",
1358 : inet_ntoa(ap->addr), ap->location);
1359 0 : dl_list_del(&ap->list);
1360 0 : wps_er_ap_free(ap);
1361 : }
1362 :
1363 55 : eloop_cancel_timeout(wps_er_deinit_finish, er, NULL);
1364 55 : deinit_done_cb = er->deinit_done_cb;
1365 55 : deinit_done_ctx = er->deinit_done_ctx;
1366 55 : os_free(er->ip_addr_text);
1367 55 : os_free(er);
1368 :
1369 55 : if (deinit_done_cb)
1370 1 : deinit_done_cb(deinit_done_ctx);
1371 55 : }
1372 :
1373 :
1374 654 : void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx)
1375 : {
1376 654 : if (er == NULL)
1377 1253 : return;
1378 55 : http_server_deinit(er->http_srv);
1379 55 : wps_er_ap_remove_all(er);
1380 55 : wps_er_ssdp_deinit(er);
1381 55 : eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0,
1382 : wps_er_deinit_finish, er, NULL);
1383 55 : wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout");
1384 55 : er->deinitializing = 1;
1385 55 : er->deinit_done_cb = cb;
1386 55 : er->deinit_done_ctx = ctx;
1387 : }
1388 :
1389 :
1390 30 : static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1391 : enum http_client_event event)
1392 : {
1393 30 : struct wps_er_ap *ap = ctx;
1394 : union wps_event_data data;
1395 :
1396 30 : os_memset(&data, 0, sizeof(data));
1397 :
1398 30 : switch (event) {
1399 : case HTTP_CLIENT_OK:
1400 30 : wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1401 30 : data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE;
1402 30 : data.set_sel_reg.uuid = ap->uuid;
1403 30 : break;
1404 : case HTTP_CLIENT_FAILED:
1405 : case HTTP_CLIENT_INVALID_REPLY:
1406 : case HTTP_CLIENT_TIMEOUT:
1407 0 : wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1408 0 : data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED;
1409 0 : data.set_sel_reg.uuid = ap->uuid;
1410 0 : break;
1411 : }
1412 30 : http_client_free(ap->http);
1413 30 : ap->http = NULL;
1414 :
1415 30 : if (data.set_sel_reg.uuid)
1416 30 : ap->er->wps->event_cb(ap->er->wps->cb_ctx,
1417 : WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1418 30 : }
1419 :
1420 :
1421 57 : static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1422 : {
1423 : struct wpabuf *buf;
1424 : char *len_ptr, *body_ptr;
1425 : struct sockaddr_in dst;
1426 : char *url, *path;
1427 :
1428 57 : if (ap->control_url == NULL) {
1429 0 : wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1430 0 : return;
1431 : }
1432 :
1433 57 : if (ap->http) {
1434 2 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1435 : "ignore new request");
1436 2 : return;
1437 : }
1438 :
1439 55 : if (ap->wps) {
1440 20 : wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - "
1441 : "skip SetSelectedRegistrar");
1442 20 : return;
1443 : }
1444 :
1445 35 : url = http_client_url_parse(ap->control_url, &dst, &path);
1446 35 : if (url == NULL) {
1447 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1448 1 : return;
1449 : }
1450 :
1451 34 : buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1452 : &dst, &len_ptr, &body_ptr);
1453 34 : os_free(url);
1454 34 : if (buf == NULL)
1455 1 : return;
1456 :
1457 33 : wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1458 :
1459 33 : ap->http = http_client_addr(&dst, buf, 1000,
1460 : wps_er_http_set_sel_reg_cb, ap);
1461 33 : if (ap->http == NULL)
1462 1 : wpabuf_free(buf);
1463 : }
1464 :
1465 :
1466 57 : static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1467 : {
1468 57 : wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1469 57 : wpabuf_put_be16(msg, 1);
1470 57 : wpabuf_put_u8(msg, !!sel_reg);
1471 57 : return 0;
1472 : }
1473 :
1474 :
1475 57 : static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1476 : {
1477 57 : wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1478 57 : wpabuf_put_be16(msg, 2);
1479 57 : wpabuf_put_be16(msg, dev_passwd_id);
1480 57 : return 0;
1481 : }
1482 :
1483 :
1484 57 : static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1485 : u16 sel_reg_config_methods)
1486 : {
1487 57 : wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1488 57 : wpabuf_put_be16(msg, 2);
1489 57 : wpabuf_put_be16(msg, sel_reg_config_methods);
1490 57 : return 0;
1491 : }
1492 :
1493 :
1494 57 : static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r)
1495 : {
1496 57 : wpabuf_put_be16(msg, ATTR_UUID_R);
1497 57 : wpabuf_put_be16(msg, WPS_UUID_LEN);
1498 57 : wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN);
1499 57 : return 0;
1500 : }
1501 :
1502 :
1503 73 : void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1504 : u16 sel_reg_config_methods)
1505 : {
1506 : struct wpabuf *msg;
1507 : struct wps_er_ap *ap;
1508 73 : struct wps_registrar *reg = er->wps->registrar;
1509 : const u8 *auth_macs;
1510 : u8 bcast[ETH_ALEN];
1511 : size_t count;
1512 : union wps_event_data data;
1513 :
1514 73 : if (er->skip_set_sel_reg) {
1515 15 : wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar");
1516 15 : return;
1517 : }
1518 :
1519 58 : msg = wpabuf_alloc(500);
1520 58 : if (msg == NULL)
1521 1 : return;
1522 :
1523 57 : auth_macs = wps_authorized_macs(reg, &count);
1524 57 : if (count == 0) {
1525 34 : os_memset(bcast, 0xff, ETH_ALEN);
1526 34 : auth_macs = bcast;
1527 34 : count = 1;
1528 : }
1529 :
1530 114 : if (wps_build_version(msg) ||
1531 114 : wps_er_build_selected_registrar(msg, sel_reg) ||
1532 114 : wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1533 114 : wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
1534 114 : wps_build_wfa_ext(msg, 0, auth_macs, count) ||
1535 57 : wps_er_build_uuid_r(msg, er->wps->uuid)) {
1536 0 : wpabuf_free(msg);
1537 0 : return;
1538 : }
1539 :
1540 57 : os_memset(&data, 0, sizeof(data));
1541 57 : data.set_sel_reg.sel_reg = sel_reg;
1542 57 : data.set_sel_reg.dev_passwd_id = dev_passwd_id;
1543 57 : data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods;
1544 57 : data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START;
1545 :
1546 114 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1547 62 : if (er->set_sel_reg_uuid_filter &&
1548 5 : os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter,
1549 : WPS_UUID_LEN) != 0)
1550 0 : continue;
1551 57 : data.set_sel_reg.uuid = ap->uuid;
1552 57 : er->wps->event_cb(er->wps->cb_ctx,
1553 : WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1554 57 : wps_er_send_set_sel_reg(ap, msg);
1555 : }
1556 :
1557 57 : wpabuf_free(msg);
1558 : }
1559 :
1560 :
1561 9 : int wps_er_pbc(struct wps_er *er, const u8 *uuid, const u8 *addr)
1562 : {
1563 : int res;
1564 : struct wps_er_ap *ap;
1565 :
1566 9 : if (er == NULL || er->wps == NULL)
1567 0 : return -1;
1568 :
1569 9 : if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) {
1570 1 : wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC "
1571 : "mode");
1572 1 : return -2;
1573 : }
1574 :
1575 8 : if (uuid)
1576 5 : ap = wps_er_ap_get(er, NULL, uuid, NULL);
1577 : else
1578 3 : ap = NULL;
1579 8 : if (ap == NULL) {
1580 4 : struct wps_er_sta *sta = NULL;
1581 5 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1582 4 : sta = wps_er_sta_get(ap, addr, uuid);
1583 4 : if (sta) {
1584 3 : uuid = ap->uuid;
1585 3 : break;
1586 : }
1587 : }
1588 4 : if (sta == NULL)
1589 1 : return -3; /* Unknown UUID */
1590 : }
1591 :
1592 7 : if (ap->ap_settings == NULL) {
1593 1 : wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known");
1594 1 : return -4;
1595 : }
1596 :
1597 6 : er->set_sel_reg_uuid_filter = uuid;
1598 6 : res = wps_registrar_button_pushed(er->wps->registrar, NULL);
1599 6 : er->set_sel_reg_uuid_filter = NULL;
1600 6 : if (res)
1601 0 : return -1;
1602 :
1603 6 : return 0;
1604 : }
1605 :
1606 :
1607 9 : static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1608 : {
1609 9 : struct wps_er_ap *ap = ctx;
1610 : union wps_event_data data;
1611 :
1612 9 : wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1613 9 : os_free(ap->ap_settings);
1614 9 : ap->ap_settings = os_malloc(sizeof(*cred));
1615 9 : if (ap->ap_settings) {
1616 9 : os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1617 9 : ap->ap_settings->cred_attr = NULL;
1618 : }
1619 :
1620 9 : os_memset(&data, 0, sizeof(data));
1621 9 : data.ap_settings.uuid = ap->uuid;
1622 9 : data.ap_settings.cred = cred;
1623 9 : ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS,
1624 : &data);
1625 9 : }
1626 :
1627 :
1628 1 : const u8 * wps_er_get_sta_uuid(struct wps_er *er, const u8 *addr)
1629 : {
1630 : struct wps_er_ap *ap;
1631 1 : dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1632 : struct wps_er_sta *sta;
1633 1 : sta = wps_er_sta_get(ap, addr, NULL);
1634 1 : if (sta)
1635 1 : return sta->uuid;
1636 : }
1637 0 : return NULL;
1638 : }
1639 :
1640 :
1641 41 : static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1642 : enum http_client_event event)
1643 : {
1644 41 : struct wps_er_ap *ap = ctx;
1645 : struct wpabuf *reply;
1646 41 : char *msg = NULL;
1647 :
1648 41 : switch (event) {
1649 : case HTTP_CLIENT_OK:
1650 33 : wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1651 33 : reply = http_client_get_body(c);
1652 33 : if (reply)
1653 33 : msg = os_zalloc(wpabuf_len(reply) + 1);
1654 33 : if (msg == NULL) {
1655 1 : if (ap->wps) {
1656 1 : wps_deinit(ap->wps);
1657 1 : ap->wps = NULL;
1658 : }
1659 1 : break;
1660 : }
1661 32 : os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1662 32 : break;
1663 : case HTTP_CLIENT_FAILED:
1664 : case HTTP_CLIENT_INVALID_REPLY:
1665 : case HTTP_CLIENT_TIMEOUT:
1666 8 : wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1667 8 : if (ap->wps) {
1668 8 : wps_deinit(ap->wps);
1669 8 : ap->wps = NULL;
1670 : }
1671 8 : break;
1672 : }
1673 41 : http_client_free(ap->http);
1674 41 : ap->http = NULL;
1675 :
1676 41 : if (msg) {
1677 : struct wpabuf *buf;
1678 : enum http_reply_code ret;
1679 32 : buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1680 32 : os_free(msg);
1681 32 : if (buf == NULL) {
1682 1 : wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1683 : "NewOutMessage from PutMessage response");
1684 1 : wps_deinit(ap->wps);
1685 1 : ap->wps = NULL;
1686 42 : return;
1687 : }
1688 31 : wps_er_ap_process(ap, buf);
1689 31 : wpabuf_free(buf);
1690 : }
1691 : }
1692 :
1693 :
1694 45 : static void wps_er_ap_put_message(struct wps_er_ap *ap,
1695 : const struct wpabuf *msg)
1696 : {
1697 : struct wpabuf *buf;
1698 : char *len_ptr, *body_ptr;
1699 : struct sockaddr_in dst;
1700 : char *url, *path;
1701 :
1702 45 : if (ap->http) {
1703 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1704 : "with the AP - cannot continue learn");
1705 0 : return;
1706 : }
1707 :
1708 45 : if (ap->control_url == NULL) {
1709 0 : wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1710 0 : return;
1711 : }
1712 :
1713 45 : url = http_client_url_parse(ap->control_url, &dst, &path);
1714 45 : if (url == NULL) {
1715 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1716 1 : goto fail;
1717 : }
1718 :
1719 44 : buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1720 : &len_ptr, &body_ptr);
1721 44 : os_free(url);
1722 44 : if (buf == NULL)
1723 1 : goto fail;
1724 :
1725 43 : wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1726 :
1727 43 : ap->http = http_client_addr(&dst, buf, 10000,
1728 : wps_er_http_put_message_cb, ap);
1729 43 : if (ap->http == NULL) {
1730 1 : wpabuf_free(buf);
1731 1 : goto fail;
1732 : }
1733 42 : return;
1734 :
1735 : fail:
1736 3 : if (ap->wps) {
1737 3 : wps_deinit(ap->wps);
1738 3 : ap->wps = NULL;
1739 : }
1740 : }
1741 :
1742 :
1743 46 : static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1744 : {
1745 : enum wps_process_res res;
1746 : struct wps_parse_attr attr;
1747 : enum wsc_op_code op_code;
1748 :
1749 46 : op_code = WSC_MSG;
1750 46 : if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) {
1751 46 : switch (*attr.msg_type) {
1752 : case WPS_WSC_ACK:
1753 0 : op_code = WSC_ACK;
1754 0 : break;
1755 : case WPS_WSC_NACK:
1756 0 : op_code = WSC_NACK;
1757 0 : break;
1758 : case WPS_WSC_DONE:
1759 1 : op_code = WSC_Done;
1760 1 : break;
1761 : }
1762 : }
1763 :
1764 46 : res = wps_process_msg(ap->wps, op_code, msg);
1765 46 : if (res == WPS_CONTINUE) {
1766 45 : struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1767 45 : if (next) {
1768 45 : wps_er_ap_put_message(ap, next);
1769 45 : wpabuf_free(next);
1770 : } else {
1771 0 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1772 : "message");
1773 0 : wps_deinit(ap->wps);
1774 0 : ap->wps = NULL;
1775 : }
1776 1 : } else if (res == WPS_DONE) {
1777 1 : wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done");
1778 1 : wps_deinit(ap->wps);
1779 1 : ap->wps = NULL;
1780 : } else {
1781 0 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1782 : "AP (res=%d)", res);
1783 0 : wps_deinit(ap->wps);
1784 0 : ap->wps = NULL;
1785 : }
1786 46 : }
1787 :
1788 :
1789 14 : static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1790 : {
1791 : struct wps_config cfg;
1792 :
1793 14 : if (ap->wps) {
1794 0 : wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1795 : "progress with this AP");
1796 0 : return;
1797 : }
1798 :
1799 14 : os_memset(&cfg, 0, sizeof(cfg));
1800 14 : cfg.wps = ap->er->wps;
1801 14 : cfg.registrar = 1;
1802 14 : ap->wps = wps_init(&cfg);
1803 14 : if (ap->wps == NULL)
1804 0 : return;
1805 14 : ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1806 14 : ap->wps->ap_settings_cb_ctx = ap;
1807 :
1808 14 : wps_er_ap_process(ap, m1);
1809 : }
1810 :
1811 :
1812 53 : static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1813 : {
1814 : struct wpabuf *info;
1815 : enum http_reply_code ret;
1816 :
1817 53 : wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1818 : "from the AP");
1819 53 : info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1820 53 : if (info == NULL) {
1821 1 : wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1822 : "NewDeviceInfo from GetDeviceInfo response");
1823 54 : return;
1824 : }
1825 :
1826 52 : ap->m1_handler(ap, info);
1827 52 : wpabuf_free(info);
1828 : }
1829 :
1830 :
1831 53 : static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1832 : enum http_client_event event)
1833 : {
1834 53 : struct wps_er_ap *ap = ctx;
1835 : struct wpabuf *reply;
1836 53 : char *dev_info = NULL;
1837 :
1838 53 : switch (event) {
1839 : case HTTP_CLIENT_OK:
1840 53 : wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1841 53 : reply = http_client_get_body(c);
1842 53 : if (reply == NULL)
1843 0 : break;
1844 53 : dev_info = os_zalloc(wpabuf_len(reply) + 1);
1845 53 : if (dev_info == NULL)
1846 0 : break;
1847 53 : os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1848 53 : break;
1849 : case HTTP_CLIENT_FAILED:
1850 : case HTTP_CLIENT_INVALID_REPLY:
1851 : case HTTP_CLIENT_TIMEOUT:
1852 0 : wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1853 0 : break;
1854 : }
1855 53 : http_client_free(ap->http);
1856 53 : ap->http = NULL;
1857 :
1858 53 : if (dev_info) {
1859 53 : wps_er_ap_learn(ap, dev_info);
1860 53 : os_free(dev_info);
1861 : }
1862 53 : }
1863 :
1864 :
1865 57 : static int wps_er_send_get_device_info(struct wps_er_ap *ap,
1866 : void (*m1_handler)(struct wps_er_ap *ap,
1867 : struct wpabuf *m1))
1868 : {
1869 : struct wpabuf *buf;
1870 : char *len_ptr, *body_ptr;
1871 : struct sockaddr_in dst;
1872 : char *url, *path;
1873 :
1874 57 : if (ap->http) {
1875 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1876 : "with the AP - cannot get device info");
1877 0 : return -1;
1878 : }
1879 :
1880 57 : if (ap->control_url == NULL) {
1881 3 : wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1882 3 : return -1;
1883 : }
1884 :
1885 54 : url = http_client_url_parse(ap->control_url, &dst, &path);
1886 54 : if (url == NULL) {
1887 1 : wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1888 1 : return -1;
1889 : }
1890 :
1891 53 : buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1892 : &len_ptr, &body_ptr);
1893 53 : os_free(url);
1894 53 : if (buf == NULL)
1895 0 : return -1;
1896 :
1897 53 : wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1898 :
1899 53 : ap->http = http_client_addr(&dst, buf, 10000,
1900 : wps_er_http_get_dev_info_cb, ap);
1901 53 : if (ap->http == NULL) {
1902 0 : wpabuf_free(buf);
1903 0 : return -1;
1904 : }
1905 :
1906 53 : ap->m1_handler = m1_handler;
1907 :
1908 53 : return 0;
1909 : }
1910 :
1911 :
1912 15 : int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *addr,
1913 : const u8 *pin, size_t pin_len)
1914 : {
1915 : struct wps_er_ap *ap;
1916 :
1917 15 : if (er == NULL)
1918 0 : return -1;
1919 :
1920 15 : ap = wps_er_ap_get(er, NULL, uuid, addr);
1921 15 : if (ap == NULL) {
1922 1 : wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1923 : "request");
1924 1 : return -1;
1925 : }
1926 14 : if (uuid == NULL)
1927 0 : uuid = ap->uuid;
1928 14 : if (ap->wps) {
1929 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1930 : "with the AP - cannot start learn");
1931 0 : return -1;
1932 : }
1933 :
1934 14 : if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
1935 0 : return -1;
1936 :
1937 14 : er->skip_set_sel_reg = 1;
1938 14 : wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1939 14 : er->skip_set_sel_reg = 0;
1940 :
1941 14 : return 0;
1942 : }
1943 :
1944 :
1945 8 : int wps_er_set_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
1946 : const struct wps_credential *cred)
1947 : {
1948 : struct wps_er_ap *ap;
1949 :
1950 8 : if (er == NULL)
1951 0 : return -1;
1952 :
1953 8 : ap = wps_er_ap_get(er, NULL, uuid, addr);
1954 8 : if (ap == NULL) {
1955 0 : wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config "
1956 : "request");
1957 0 : return -1;
1958 : }
1959 :
1960 8 : os_free(ap->ap_settings);
1961 8 : ap->ap_settings = os_malloc(sizeof(*cred));
1962 8 : if (ap->ap_settings == NULL)
1963 0 : return -1;
1964 8 : os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1965 8 : ap->ap_settings->cred_attr = NULL;
1966 8 : wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set "
1967 : "config request");
1968 :
1969 8 : return 0;
1970 : }
1971 :
1972 :
1973 1 : static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1974 : {
1975 : struct wps_config cfg;
1976 :
1977 1 : if (ap->wps) {
1978 0 : wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1979 : "progress with this AP");
1980 0 : return;
1981 : }
1982 :
1983 1 : os_memset(&cfg, 0, sizeof(cfg));
1984 1 : cfg.wps = ap->er->wps;
1985 1 : cfg.registrar = 1;
1986 1 : cfg.new_ap_settings = ap->ap_settings;
1987 1 : ap->wps = wps_init(&cfg);
1988 1 : if (ap->wps == NULL)
1989 0 : return;
1990 1 : ap->wps->ap_settings_cb = NULL;
1991 1 : ap->wps->ap_settings_cb_ctx = NULL;
1992 :
1993 1 : wps_er_ap_process(ap, m1);
1994 : }
1995 :
1996 :
1997 1 : int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
1998 : const u8 *pin, size_t pin_len,
1999 : const struct wps_credential *cred)
2000 : {
2001 : struct wps_er_ap *ap;
2002 :
2003 1 : if (er == NULL)
2004 0 : return -1;
2005 :
2006 1 : ap = wps_er_ap_get(er, NULL, uuid, addr);
2007 1 : if (ap == NULL) {
2008 0 : wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config "
2009 : "request");
2010 0 : return -1;
2011 : }
2012 1 : if (uuid == NULL)
2013 1 : uuid = ap->uuid;
2014 1 : if (ap->wps) {
2015 0 : wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
2016 : "with the AP - cannot start config");
2017 0 : return -1;
2018 : }
2019 :
2020 1 : os_free(ap->ap_settings);
2021 1 : ap->ap_settings = os_malloc(sizeof(*cred));
2022 1 : if (ap->ap_settings == NULL)
2023 0 : return -1;
2024 1 : os_memcpy(ap->ap_settings, cred, sizeof(*cred));
2025 1 : ap->ap_settings->cred_attr = NULL;
2026 :
2027 1 : if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0)
2028 0 : return -1;
2029 :
2030 1 : er->skip_set_sel_reg = 1;
2031 1 : wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
2032 1 : er->skip_set_sel_reg = 0;
2033 :
2034 1 : return 0;
2035 : }
2036 :
2037 :
2038 : #ifdef CONFIG_WPS_NFC
2039 :
2040 2 : struct wpabuf * wps_er_config_token_from_cred(struct wps_context *wps,
2041 : struct wps_credential *cred)
2042 : {
2043 : struct wpabuf *ret;
2044 : struct wps_data data;
2045 :
2046 2 : ret = wpabuf_alloc(500);
2047 2 : if (ret == NULL)
2048 0 : return NULL;
2049 :
2050 2 : os_memset(&data, 0, sizeof(data));
2051 2 : data.wps = wps;
2052 2 : data.use_cred = cred;
2053 4 : if (wps_build_cred(&data, ret) ||
2054 2 : wps_build_wfa_ext(ret, 0, NULL, 0)) {
2055 0 : wpabuf_free(ret);
2056 0 : return NULL;
2057 : }
2058 :
2059 2 : return ret;
2060 : }
2061 :
2062 :
2063 2 : struct wpabuf * wps_er_nfc_config_token(struct wps_er *er, const u8 *uuid,
2064 : const u8 *addr)
2065 : {
2066 : struct wps_er_ap *ap;
2067 :
2068 2 : if (er == NULL)
2069 0 : return NULL;
2070 :
2071 2 : ap = wps_er_ap_get(er, NULL, uuid, addr);
2072 2 : if (ap == NULL)
2073 0 : return NULL;
2074 2 : if (ap->ap_settings == NULL) {
2075 0 : wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
2076 : "selected AP");
2077 0 : return NULL;
2078 : }
2079 :
2080 2 : return wps_er_config_token_from_cred(er->wps, ap->ap_settings);
2081 : }
2082 :
2083 :
2084 3 : struct wpabuf * wps_er_nfc_handover_sel(struct wps_er *er,
2085 : struct wps_context *wps, const u8 *uuid,
2086 : const u8 *addr, struct wpabuf *pubkey)
2087 : {
2088 : struct wps_er_ap *ap;
2089 :
2090 3 : if (er == NULL)
2091 0 : return NULL;
2092 :
2093 3 : ap = wps_er_ap_get(er, NULL, uuid, addr);
2094 3 : if (ap == NULL)
2095 0 : return NULL;
2096 3 : if (ap->ap_settings == NULL) {
2097 0 : wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
2098 : "selected AP");
2099 0 : return NULL;
2100 : }
2101 :
2102 3 : os_memcpy(wps->ssid, ap->ap_settings->ssid, ap->ap_settings->ssid_len);
2103 3 : wps->ssid_len = ap->ap_settings->ssid_len;
2104 :
2105 3 : return wps_build_nfc_handover_sel(wps, pubkey, addr, 0);
2106 : }
2107 :
2108 : #endif /* CONFIG_WPS_NFC */
|
