Line data Source code
1 : /*
2 : * UPnP WPS Device
3 : * Copyright (c) 2000-2003 Intel Corporation
4 : * Copyright (c) 2006-2007 Sony Corporation
5 : * Copyright (c) 2008-2009 Atheros Communications
6 : * Copyright (c) 2009-2010, Jouni Malinen <j@w1.fi>
7 : *
8 : * See below for more details on licensing and code history.
9 : */
10 :
11 : /*
12 : * This has been greatly stripped down from the original file
13 : * (upnp_wps_device.c) by Ted Merrill, Atheros Communications
14 : * in order to eliminate use of the bulky libupnp library etc.
15 : *
16 : * History:
17 : * upnp_wps_device.c is/was a shim layer between wps_opt_upnp.c and
18 : * the libupnp library.
19 : * The layering (by Sony) was well done; only a very minor modification
20 : * to API of upnp_wps_device.c was required.
21 : * libupnp was found to be undesirable because:
22 : * -- It consumed too much code and data space
23 : * -- It uses multiple threads, making debugging more difficult
24 : * and possibly reducing reliability.
25 : * -- It uses static variables and only supports one instance.
26 : * The shim and libupnp are here replaced by special code written
27 : * specifically for the needs of hostapd.
28 : * Various shortcuts can and are taken to keep the code size small.
29 : * Generally, execution time is not as crucial.
30 : *
31 : * BUGS:
32 : * -- UPnP requires that we be able to resolve domain names.
33 : * While uncommon, if we have to do it then it will stall the entire
34 : * hostapd program, which is bad.
35 : * This is because we use the standard linux getaddrinfo() function
36 : * which is syncronous.
37 : * An asyncronous solution would be to use the free "ares" library.
38 : * -- Does not have a robust output buffering scheme. Uses a single
39 : * fixed size output buffer per TCP/HTTP connection, with possible (although
40 : * unlikely) possibility of overflow and likely excessive use of RAM.
41 : * A better solution would be to write the HTTP output as a buffered stream,
42 : * using chunking: (handle header specially, then) generate data with
43 : * a printf-like function into a buffer, catching buffer full condition,
44 : * then send it out surrounded by http chunking.
45 : * -- There is some code that could be separated out into the common
46 : * library to be shared with wpa_supplicant.
47 : * -- Needs renaming with module prefix to avoid polluting the debugger
48 : * namespace and causing possible collisions with other static fncs
49 : * and structure declarations when using the debugger.
50 : * -- The http error code generation is pretty bogus, hopefully no one cares.
51 : *
52 : * Author: Ted Merrill, Atheros Communications, based upon earlier work
53 : * as explained above and below.
54 : *
55 : * Copyright:
56 : * Copyright 2008 Atheros Communications.
57 : *
58 : * The original header (of upnp_wps_device.c) reads:
59 : *
60 : * Copyright (c) 2006-2007 Sony Corporation. All Rights Reserved.
61 : *
62 : * File Name: upnp_wps_device.c
63 : * Description: EAP-WPS UPnP device source
64 : *
65 : * Redistribution and use in source and binary forms, with or without
66 : * modification, are permitted provided that the following conditions
67 : * are met:
68 : *
69 : * * Redistributions of source code must retain the above copyright
70 : * notice, this list of conditions and the following disclaimer.
71 : * * Redistributions in binary form must reproduce the above copyright
72 : * notice, this list of conditions and the following disclaimer in
73 : * the documentation and/or other materials provided with the
74 : * distribution.
75 : * * Neither the name of Sony Corporation nor the names of its
76 : * contributors may be used to endorse or promote products derived
77 : * from this software without specific prior written permission.
78 : *
79 : * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
80 : * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
81 : * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
82 : * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
83 : * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
84 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
85 : * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
86 : * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
87 : * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
88 : * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
89 : * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
90 : *
91 : * Portions from Intel libupnp files, e.g. genlib/net/http/httpreadwrite.c
92 : * typical header:
93 : *
94 : * Copyright (c) 2000-2003 Intel Corporation
95 : * All rights reserved.
96 : *
97 : * Redistribution and use in source and binary forms, with or without
98 : * modification, are permitted provided that the following conditions are met:
99 : *
100 : * * Redistributions of source code must retain the above copyright notice,
101 : * this list of conditions and the following disclaimer.
102 : * * Redistributions in binary form must reproduce the above copyright notice,
103 : * this list of conditions and the following disclaimer in the documentation
104 : * and/or other materials provided with the distribution.
105 : * * Neither name of Intel Corporation nor the names of its contributors
106 : * may be used to endorse or promote products derived from this software
107 : * without specific prior written permission.
108 : *
109 : * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
110 : * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
111 : * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
112 : * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
113 : * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
114 : * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
115 : * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
116 : * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
117 : * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
118 : * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
119 : * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
120 : */
121 :
122 : /*
123 : * Overview of WPS over UPnP:
124 : *
125 : * UPnP is a protocol that allows devices to discover each other and control
126 : * each other. In UPnP terminology, a device is either a "device" (a server
127 : * that provides information about itself and allows itself to be controlled)
128 : * or a "control point" (a client that controls "devices") or possibly both.
129 : * This file implements a UPnP "device".
130 : *
131 : * For us, we use mostly basic UPnP discovery, but the control part of interest
132 : * is WPS carried via UPnP messages. There is quite a bit of basic UPnP
133 : * discovery to do before we can get to WPS, however.
134 : *
135 : * UPnP discovery begins with "devices" send out multicast UDP packets to a
136 : * certain fixed multicast IP address and port, and "control points" sending
137 : * out other such UDP packets.
138 : *
139 : * The packets sent by devices are NOTIFY packets (not to be confused with TCP
140 : * NOTIFY packets that are used later) and those sent by control points are
141 : * M-SEARCH packets. These packets contain a simple HTTP style header. The
142 : * packets are sent redundantly to get around packet loss. Devices respond to
143 : * M-SEARCH packets with HTTP-like UDP packets containing HTTP/1.1 200 OK
144 : * messages, which give similar information as the UDP NOTIFY packets.
145 : *
146 : * The above UDP packets advertise the (arbitrary) TCP ports that the
147 : * respective parties will listen to. The control point can then do a HTTP
148 : * SUBSCRIBE (something like an HTTP PUT) after which the device can do a
149 : * separate HTTP NOTIFY (also like an HTTP PUT) to do event messaging.
150 : *
151 : * The control point will also do HTTP GET of the "device file" listed in the
152 : * original UDP information from the device (see UPNP_WPS_DEVICE_XML_FILE
153 : * data), and based on this will do additional GETs... HTTP POSTs are done to
154 : * cause an action.
155 : *
156 : * Beyond some basic information in HTTP headers, additional information is in
157 : * the HTTP bodies, in a format set by the SOAP and XML standards, a markup
158 : * language related to HTML used for web pages. This language is intended to
159 : * provide the ultimate in self-documentation by providing a universal
160 : * namespace based on pseudo-URLs called URIs. Note that although a URI looks
161 : * like a URL (a web address), they are never accessed as such but are used
162 : * only as identifiers.
163 : *
164 : * The POST of a GetDeviceInfo gets information similar to what might be
165 : * obtained from a probe request or response on Wi-Fi. WPS messages M1-M8
166 : * are passed via a POST of a PutMessage; the M1-M8 WPS messages are converted
167 : * to a bin64 ascii representation for encapsulation. When proxying messages,
168 : * WLANEvent and PutWLANResponse are used.
169 : *
170 : * This of course glosses over a lot of details.
171 : */
172 :
173 : #include "includes.h"
174 :
175 : #include <time.h>
176 : #include <net/if.h>
177 : #include <netdb.h>
178 : #include <sys/ioctl.h>
179 :
180 : #include "common.h"
181 : #include "uuid.h"
182 : #include "base64.h"
183 : #include "wps.h"
184 : #include "wps_i.h"
185 : #include "wps_upnp.h"
186 : #include "wps_upnp_i.h"
187 :
188 :
189 : /*
190 : * UPnP allows a client ("control point") to send a server like us ("device")
191 : * a domain name for registration, and we are supposed to resolve it. This is
192 : * bad because, using the standard Linux library, we will stall the entire
193 : * hostapd waiting for resolution.
194 : *
195 : * The "correct" solution would be to use an event driven library for domain
196 : * name resolution such as "ares". However, this would increase code size
197 : * further. Since it is unlikely that we'll actually see such domain names, we
198 : * can just refuse to accept them.
199 : */
200 : #define NO_DOMAIN_NAME_RESOLUTION 1 /* 1 to allow only dotted ip addresses */
201 :
202 :
203 : /*
204 : * UPnP does not scale well. If we were in a room with thousands of control
205 : * points then potentially we could be expected to handle subscriptions for
206 : * each of them, which would exhaust our memory. So we must set a limit. In
207 : * practice we are unlikely to see more than one or two.
208 : */
209 : #define MAX_SUBSCRIPTIONS 4 /* how many subscribing clients we handle */
210 : #define MAX_ADDR_PER_SUBSCRIPTION 8
211 :
212 : /* Maximum number of Probe Request events per second */
213 : #define MAX_EVENTS_PER_SEC 5
214 :
215 :
216 : static struct upnp_wps_device_sm *shared_upnp_device = NULL;
217 :
218 :
219 : /* Write the current date/time per RFC */
220 1039 : void format_date(struct wpabuf *buf)
221 : {
222 1039 : const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat";
223 1039 : const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0"
224 : "Jul\0Aug\0Sep\0Oct\0Nov\0Dec";
225 : struct tm *date;
226 : time_t t;
227 :
228 1039 : t = time(NULL);
229 1039 : date = gmtime(&t);
230 1039 : if (date == NULL)
231 1039 : return;
232 4156 : wpabuf_printf(buf, "%s, %02d %s %d %02d:%02d:%02d GMT",
233 1039 : &weekday_str[date->tm_wday * 4], date->tm_mday,
234 2078 : &month_str[date->tm_mon * 4], date->tm_year + 1900,
235 : date->tm_hour, date->tm_min, date->tm_sec);
236 : }
237 :
238 :
239 : /***************************************************************************
240 : * UUIDs (unique identifiers)
241 : *
242 : * These are supposed to be unique in all the world.
243 : * Sometimes permanent ones are used, sometimes temporary ones
244 : * based on random numbers... there are different rules for valid content
245 : * of different types.
246 : * Each uuid is 16 bytes long.
247 : **************************************************************************/
248 :
249 : /* uuid_make -- construct a random UUID
250 : * The UPnP documents don't seem to offer any guidelines as to which method to
251 : * use for constructing UUIDs for subscriptions. Presumably any method from
252 : * rfc4122 is good enough; I've chosen random number method.
253 : */
254 44 : static int uuid_make(u8 uuid[UUID_LEN])
255 : {
256 44 : if (os_get_random(uuid, UUID_LEN) < 0)
257 1 : return -1;
258 :
259 : /* Replace certain bits as specified in rfc4122 or X.667 */
260 43 : uuid[6] &= 0x0f; uuid[6] |= (4 << 4); /* version 4 == random gen */
261 43 : uuid[8] &= 0x3f; uuid[8] |= 0x80;
262 :
263 43 : return 0;
264 : }
265 :
266 :
267 : /*
268 : * Subscriber address handling.
269 : * Since a subscriber may have an arbitrary number of addresses, we have to
270 : * add a bunch of code to handle them.
271 : *
272 : * Addresses are passed in text, and MAY be domain names instead of the (usual
273 : * and expected) dotted IP addresses. Resolving domain names consumes a lot of
274 : * resources. Worse, we are currently using the standard Linux getaddrinfo()
275 : * which will block the entire program until complete or timeout! The proper
276 : * solution would be to use the "ares" library or similar with more state
277 : * machine steps etc. or just disable domain name resolution by setting
278 : * NO_DOMAIN_NAME_RESOLUTION to 1 at top of this file.
279 : */
280 :
281 : /* subscr_addr_delete -- delete single unlinked subscriber address
282 : * (be sure to unlink first if need be)
283 : */
284 46 : void subscr_addr_delete(struct subscr_addr *a)
285 : {
286 : /*
287 : * Note: do NOT free domain_and_port or path because they point to
288 : * memory within the allocation of "a".
289 : */
290 46 : os_free(a);
291 46 : }
292 :
293 :
294 : /* subscr_addr_free_all -- unlink and delete list of subscriber addresses. */
295 44 : static void subscr_addr_free_all(struct subscription *s)
296 : {
297 : struct subscr_addr *a, *tmp;
298 81 : dl_list_for_each_safe(a, tmp, &s->addr_list, struct subscr_addr, list)
299 : {
300 37 : dl_list_del(&a->list);
301 37 : subscr_addr_delete(a);
302 : }
303 44 : }
304 :
305 :
306 : /* subscr_addr_add_url -- add address(es) for one url to subscription */
307 64 : static void subscr_addr_add_url(struct subscription *s, const char *url,
308 : size_t url_len)
309 : {
310 : int alloc_len;
311 64 : char *scratch_mem = NULL;
312 : char *mem;
313 : char *host;
314 : char *delim;
315 : char *path;
316 64 : int port = 80; /* port to send to (default is port 80) */
317 : struct addrinfo hints;
318 64 : struct addrinfo *result = NULL;
319 : struct addrinfo *rp;
320 : int rerr;
321 : size_t host_len, path_len;
322 :
323 : /* url MUST begin with http: */
324 64 : if (url_len < 7 || os_strncasecmp(url, "http://", 7))
325 : goto fail;
326 64 : url += 7;
327 64 : url_len -= 7;
328 :
329 : /* Make a copy of the string to allow modification during parsing */
330 64 : scratch_mem = dup_binstr(url, url_len);
331 64 : if (scratch_mem == NULL)
332 1 : goto fail;
333 63 : wpa_printf(MSG_DEBUG, "WPS UPnP: Adding URL '%s'", scratch_mem);
334 63 : host = scratch_mem;
335 63 : path = os_strchr(host, '/');
336 63 : if (path)
337 63 : *path++ = '\0'; /* null terminate host */
338 :
339 : /* Process and remove optional port component */
340 63 : delim = os_strchr(host, ':');
341 63 : if (delim) {
342 63 : *delim = '\0'; /* null terminate host name for now */
343 63 : if (isdigit(delim[1]))
344 63 : port = atol(delim + 1);
345 : }
346 :
347 : /*
348 : * getaddrinfo does the right thing with dotted decimal notations, or
349 : * will resolve domain names. Resolving domain names will unfortunately
350 : * hang the entire program until it is resolved or it times out
351 : * internal to getaddrinfo; fortunately we think that the use of actual
352 : * domain names (vs. dotted decimal notations) should be uncommon.
353 : */
354 63 : os_memset(&hints, 0, sizeof(struct addrinfo));
355 63 : hints.ai_family = AF_INET; /* IPv4 */
356 63 : hints.ai_socktype = SOCK_STREAM;
357 : #if NO_DOMAIN_NAME_RESOLUTION
358 : /* Suppress domain name resolutions that would halt
359 : * the program for periods of time
360 : */
361 63 : hints.ai_flags = AI_NUMERICHOST;
362 : #else
363 : /* Allow domain name resolution. */
364 : hints.ai_flags = 0;
365 : #endif
366 63 : hints.ai_protocol = 0; /* Any protocol? */
367 63 : rerr = getaddrinfo(host, NULL /* fill in port ourselves */,
368 : &hints, &result);
369 63 : if (rerr) {
370 0 : wpa_printf(MSG_INFO, "WPS UPnP: Resolve error %d (%s) on: %s",
371 : rerr, gai_strerror(rerr), host);
372 0 : goto fail;
373 : }
374 :
375 63 : if (delim)
376 63 : *delim = ':'; /* Restore port */
377 :
378 63 : host_len = os_strlen(host);
379 63 : path_len = path ? os_strlen(path) : 0;
380 63 : alloc_len = host_len + 1 + 1 + path_len + 1;
381 :
382 109 : for (rp = result; rp; rp = rp->ai_next) {
383 : struct subscr_addr *a;
384 :
385 : /* Limit no. of address to avoid denial of service attack */
386 63 : if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) {
387 16 : wpa_printf(MSG_INFO, "WPS UPnP: subscr_addr_add_url: "
388 : "Ignoring excessive addresses");
389 16 : break;
390 : }
391 :
392 47 : a = os_zalloc(sizeof(*a) + alloc_len);
393 47 : if (a == NULL)
394 1 : break;
395 46 : mem = (char *) (a + 1);
396 46 : a->domain_and_port = mem;
397 46 : os_memcpy(mem, host, host_len);
398 46 : mem += host_len + 1;
399 46 : a->path = mem;
400 46 : if (path == NULL || path[0] != '/')
401 46 : *mem++ = '/';
402 46 : if (path)
403 46 : os_memcpy(mem, path, path_len);
404 46 : os_memcpy(&a->saddr, rp->ai_addr, sizeof(a->saddr));
405 46 : a->saddr.sin_port = htons(port);
406 :
407 46 : dl_list_add(&s->addr_list, &a->list);
408 : }
409 :
410 : fail:
411 64 : if (result)
412 63 : freeaddrinfo(result);
413 64 : os_free(scratch_mem);
414 64 : }
415 :
416 :
417 : /* subscr_addr_list_create -- create list from urls in string.
418 : * Each url is enclosed by angle brackets.
419 : */
420 43 : static void subscr_addr_list_create(struct subscription *s,
421 : const char *url_list)
422 : {
423 : const char *end;
424 43 : wpa_printf(MSG_DEBUG, "WPS UPnP: Parsing URL list '%s'", url_list);
425 : for (;;) {
426 216 : while (*url_list == ' ' || *url_list == '\t')
427 2 : url_list++;
428 107 : if (*url_list != '<')
429 42 : break;
430 65 : url_list++;
431 65 : end = os_strchr(url_list, '>');
432 65 : if (end == NULL)
433 1 : break;
434 64 : subscr_addr_add_url(s, url_list, end - url_list);
435 64 : url_list = end + 1;
436 64 : }
437 43 : }
438 :
439 :
440 781 : static void wpabuf_put_property(struct wpabuf *buf, const char *name,
441 : const char *value)
442 : {
443 781 : wpabuf_put_str(buf, "<e:property>");
444 781 : wpabuf_printf(buf, "<%s>", name);
445 781 : if (value)
446 781 : wpabuf_put_str(buf, value);
447 781 : wpabuf_printf(buf, "</%s>", name);
448 781 : wpabuf_put_str(buf, "</e:property>\n");
449 781 : }
450 :
451 :
452 : /**
453 : * upnp_wps_device_send_event - Queue event messages for subscribers
454 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
455 : *
456 : * This function queues the last WLANEvent to be sent for all currently
457 : * subscribed UPnP control points. sm->wlanevent must have been set with the
458 : * encoded data before calling this function.
459 : */
460 852 : static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
461 : {
462 : /* Enqueue event message for all subscribers */
463 : struct wpabuf *buf; /* holds event message */
464 852 : int buf_size = 0;
465 : struct subscription *s, *tmp;
466 : /* Actually, utf-8 is the default, but it doesn't hurt to specify it */
467 852 : const char *format_head =
468 : "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
469 : "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
470 852 : const char *format_tail = "</e:propertyset>\n";
471 : struct os_reltime now;
472 :
473 852 : if (dl_list_empty(&sm->subscriptions)) {
474 : /* optimize */
475 241 : return;
476 : }
477 :
478 796 : if (os_get_reltime(&now) == 0) {
479 796 : if (now.sec != sm->last_event_sec) {
480 158 : sm->last_event_sec = now.sec;
481 158 : sm->num_events_in_sec = 1;
482 : } else {
483 638 : sm->num_events_in_sec++;
484 : /*
485 : * In theory, this should apply to all WLANEvent
486 : * notifications, but EAP messages are of much higher
487 : * priority and Probe Request notifications should not
488 : * be allowed to drop EAP messages, so only throttle
489 : * Probe Request notifications.
490 : */
491 775 : if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC &&
492 137 : sm->wlanevent_type ==
493 : UPNP_WPS_WLANEVENT_TYPE_PROBE) {
494 128 : wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle "
495 : "event notifications (%u seen "
496 : "during one second)",
497 : sm->num_events_in_sec);
498 128 : return;
499 : }
500 : }
501 : }
502 :
503 : /* Determine buffer size needed first */
504 668 : buf_size += os_strlen(format_head);
505 668 : buf_size += 50 + 2 * os_strlen("WLANEvent");
506 668 : if (sm->wlanevent)
507 668 : buf_size += os_strlen(sm->wlanevent);
508 668 : buf_size += os_strlen(format_tail);
509 :
510 668 : buf = wpabuf_alloc(buf_size);
511 668 : if (buf == NULL)
512 1 : return;
513 667 : wpabuf_put_str(buf, format_head);
514 667 : wpabuf_put_property(buf, "WLANEvent", sm->wlanevent);
515 667 : wpabuf_put_str(buf, format_tail);
516 :
517 667 : wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:\n%s",
518 667 : (char *) wpabuf_head(buf));
519 :
520 1343 : dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
521 : list) {
522 676 : event_add(s, buf,
523 676 : sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
524 : }
525 :
526 667 : wpabuf_free(buf);
527 : }
528 :
529 :
530 : /*
531 : * Event subscription (subscriber machines register with us to receive event
532 : * messages).
533 : * This is the result of an incoming HTTP over TCP SUBSCRIBE request.
534 : */
535 :
536 : /* subscription_destroy -- destroy an unlinked subscription
537 : * Be sure to unlink first if necessary.
538 : */
539 44 : void subscription_destroy(struct subscription *s)
540 : {
541 : struct upnp_wps_device_interface *iface;
542 44 : wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
543 44 : subscr_addr_free_all(s);
544 44 : event_delete_all(s);
545 88 : dl_list_for_each(iface, &s->sm->interfaces,
546 : struct upnp_wps_device_interface, list)
547 44 : upnp_er_remove_notification(iface->wps->registrar, s);
548 44 : os_free(s);
549 44 : }
550 :
551 :
552 : /* subscription_list_age -- remove expired subscriptions */
553 45 : static void subscription_list_age(struct upnp_wps_device_sm *sm, time_t now)
554 : {
555 : struct subscription *s, *tmp;
556 45 : dl_list_for_each_safe(s, tmp, &sm->subscriptions,
557 : struct subscription, list) {
558 16 : if (s->timeout_time > now)
559 16 : break;
560 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Removing aged subscription");
561 0 : dl_list_del(&s->list);
562 0 : subscription_destroy(s);
563 : }
564 45 : }
565 :
566 :
567 : /* subscription_find -- return existing subscription matching uuid, if any
568 : * returns NULL if not found
569 : */
570 26 : struct subscription * subscription_find(struct upnp_wps_device_sm *sm,
571 : const u8 uuid[UUID_LEN])
572 : {
573 : struct subscription *s;
574 27 : dl_list_for_each(s, &sm->subscriptions, struct subscription, list) {
575 24 : if (os_memcmp(s->uuid, uuid, UUID_LEN) == 0)
576 23 : return s; /* Found match */
577 : }
578 3 : return NULL;
579 : }
580 :
581 :
582 7 : static struct wpabuf * build_fake_wsc_ack(void)
583 : {
584 7 : struct wpabuf *msg = wpabuf_alloc(100);
585 7 : if (msg == NULL)
586 0 : return NULL;
587 7 : wpabuf_put_u8(msg, UPNP_WPS_WLANEVENT_TYPE_EAP);
588 7 : wpabuf_put_str(msg, "00:00:00:00:00:00");
589 14 : if (wps_build_version(msg) ||
590 7 : wps_build_msg_type(msg, WPS_WSC_ACK)) {
591 0 : wpabuf_free(msg);
592 0 : return NULL;
593 : }
594 : /* Enrollee Nonce */
595 7 : wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE);
596 7 : wpabuf_put_be16(msg, WPS_NONCE_LEN);
597 7 : wpabuf_put(msg, WPS_NONCE_LEN);
598 : /* Registrar Nonce */
599 7 : wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
600 7 : wpabuf_put_be16(msg, WPS_NONCE_LEN);
601 7 : wpabuf_put(msg, WPS_NONCE_LEN);
602 7 : if (wps_build_wfa_ext(msg, 0, NULL, 0)) {
603 0 : wpabuf_free(msg);
604 0 : return NULL;
605 : }
606 7 : return msg;
607 : }
608 :
609 :
610 : /* subscription_first_event -- send format/queue event that is automatically
611 : * sent on a new subscription.
612 : */
613 39 : static int subscription_first_event(struct subscription *s)
614 : {
615 : /*
616 : * Actually, utf-8 is the default, but it doesn't hurt to specify it.
617 : *
618 : * APStatus is apparently a bit set,
619 : * 0x1 = configuration change (but is always set?)
620 : * 0x10 = ap is locked
621 : *
622 : * Per UPnP spec, we send out the last value of each variable, even
623 : * for WLANEvent, whatever it was.
624 : */
625 : char *wlan_event;
626 : struct wpabuf *buf;
627 39 : int ap_status = 1; /* TODO: add 0x10 if access point is locked */
628 39 : const char *head =
629 : "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
630 : "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
631 39 : const char *tail = "</e:propertyset>\n";
632 : char txt[10];
633 : int ret;
634 :
635 39 : if (s->sm->wlanevent == NULL) {
636 : /*
637 : * There has been no events before the subscription. However,
638 : * UPnP device architecture specification requires all the
639 : * evented variables to be included, so generate a dummy event
640 : * for this particular case using a WSC_ACK and all-zeros
641 : * nonces. The ER (UPnP control point) will ignore this, but at
642 : * least it will learn that WLANEvent variable will be used in
643 : * event notifications in the future.
644 : */
645 : struct wpabuf *msg;
646 7 : wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the "
647 : "initial WLANEvent");
648 7 : msg = build_fake_wsc_ack();
649 7 : if (msg) {
650 14 : s->sm->wlanevent = (char *)
651 7 : base64_encode(wpabuf_head(msg),
652 : wpabuf_len(msg), NULL);
653 7 : wpabuf_free(msg);
654 : }
655 : }
656 :
657 39 : wlan_event = s->sm->wlanevent;
658 39 : if (wlan_event == NULL || *wlan_event == '\0') {
659 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for "
660 : "initial event message");
661 0 : wlan_event = "";
662 : }
663 39 : buf = wpabuf_alloc(500 + os_strlen(wlan_event));
664 39 : if (buf == NULL)
665 1 : return -1;
666 :
667 38 : wpabuf_put_str(buf, head);
668 38 : wpabuf_put_property(buf, "STAStatus", "1");
669 38 : os_snprintf(txt, sizeof(txt), "%d", ap_status);
670 38 : wpabuf_put_property(buf, "APStatus", txt);
671 38 : if (*wlan_event)
672 38 : wpabuf_put_property(buf, "WLANEvent", wlan_event);
673 38 : wpabuf_put_str(buf, tail);
674 :
675 38 : ret = event_add(s, buf, 0);
676 38 : if (ret) {
677 1 : wpabuf_free(buf);
678 1 : return ret;
679 : }
680 37 : wpabuf_free(buf);
681 :
682 37 : return 0;
683 : }
684 :
685 :
686 : /**
687 : * subscription_start - Remember a UPnP control point to send events to.
688 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
689 : * @callback_urls: Callback URLs
690 : * Returns: %NULL on error, or pointer to new subscription structure.
691 : */
692 45 : struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
693 : const char *callback_urls)
694 : {
695 : struct subscription *s;
696 45 : time_t now = time(NULL);
697 45 : time_t expire = now + UPNP_SUBSCRIBE_SEC;
698 : char str[80];
699 :
700 : /* Get rid of expired subscriptions so we have room */
701 45 : subscription_list_age(sm, now);
702 :
703 : /* If too many subscriptions, remove oldest */
704 45 : if (dl_list_len(&sm->subscriptions) >= MAX_SUBSCRIPTIONS) {
705 4 : s = dl_list_first(&sm->subscriptions, struct subscription,
706 : list);
707 4 : if (s) {
708 4 : wpa_printf(MSG_INFO,
709 : "WPS UPnP: Too many subscriptions, trashing oldest");
710 4 : dl_list_del(&s->list);
711 4 : subscription_destroy(s);
712 : }
713 : }
714 :
715 45 : s = os_zalloc(sizeof(*s));
716 45 : if (s == NULL)
717 1 : return NULL;
718 44 : dl_list_init(&s->addr_list);
719 44 : dl_list_init(&s->event_queue);
720 :
721 44 : s->sm = sm;
722 44 : s->timeout_time = expire;
723 44 : if (uuid_make(s->uuid) < 0) {
724 1 : subscription_destroy(s);
725 1 : return NULL;
726 : }
727 43 : subscr_addr_list_create(s, callback_urls);
728 43 : if (dl_list_empty(&s->addr_list)) {
729 4 : wpa_printf(MSG_DEBUG, "WPS UPnP: No valid callback URLs in "
730 : "'%s' - drop subscription", callback_urls);
731 4 : subscription_destroy(s);
732 4 : return NULL;
733 : }
734 :
735 : /* Add to end of list, since it has the highest expiration time */
736 39 : dl_list_add_tail(&sm->subscriptions, &s->list);
737 : /* Queue up immediate event message (our last event)
738 : * as required by UPnP spec.
739 : */
740 39 : if (subscription_first_event(s)) {
741 2 : wpa_printf(MSG_INFO, "WPS UPnP: Dropping subscriber due to "
742 : "event backlog");
743 2 : dl_list_del(&s->list);
744 2 : subscription_destroy(s);
745 2 : return NULL;
746 : }
747 37 : uuid_bin2str(s->uuid, str, sizeof(str));
748 37 : wpa_printf(MSG_DEBUG,
749 : "WPS UPnP: Subscription %p (SID %s) started with %s",
750 : s, str, callback_urls);
751 : /* Schedule sending this */
752 37 : event_send_all_later(sm);
753 37 : return s;
754 : }
755 :
756 :
757 : /* subscription_renew -- find subscription and reset timeout */
758 3 : struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
759 : const u8 uuid[UUID_LEN])
760 : {
761 3 : time_t now = time(NULL);
762 3 : time_t expire = now + UPNP_SUBSCRIBE_SEC;
763 3 : struct subscription *s = subscription_find(sm, uuid);
764 3 : if (s == NULL)
765 1 : return NULL;
766 2 : wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewed");
767 2 : dl_list_del(&s->list);
768 2 : s->timeout_time = expire;
769 : /* add back to end of list, since it now has highest expiry */
770 2 : dl_list_add_tail(&sm->subscriptions, &s->list);
771 2 : return s;
772 : }
773 :
774 :
775 : /**
776 : * upnp_wps_device_send_wlan_event - Event notification
777 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
778 : * @from_mac_addr: Source (Enrollee) MAC address for the event
779 : * @ev_type: Event type
780 : * @msg: Event data
781 : * Returns: 0 on success, -1 on failure
782 : *
783 : * Tell external Registrars (UPnP control points) that something happened. In
784 : * particular, events include WPS messages from clients that are proxied to
785 : * external Registrars.
786 : */
787 1625 : int upnp_wps_device_send_wlan_event(struct upnp_wps_device_sm *sm,
788 : const u8 from_mac_addr[ETH_ALEN],
789 : enum upnp_wps_wlanevent_type ev_type,
790 : const struct wpabuf *msg)
791 : {
792 1625 : int ret = -1;
793 : char type[2];
794 1625 : const u8 *mac = from_mac_addr;
795 : char mac_text[18];
796 1625 : u8 *raw = NULL;
797 : size_t raw_len;
798 : char *val;
799 : size_t val_len;
800 1625 : int pos = 0;
801 :
802 1625 : if (!sm)
803 771 : goto fail;
804 :
805 854 : os_snprintf(type, sizeof(type), "%1u", ev_type);
806 :
807 854 : raw_len = 1 + 17 + (msg ? wpabuf_len(msg) : 0);
808 854 : raw = os_zalloc(raw_len);
809 854 : if (!raw)
810 1 : goto fail;
811 :
812 853 : *(raw + pos) = (u8) ev_type;
813 853 : pos += 1;
814 853 : os_snprintf(mac_text, sizeof(mac_text), MACSTR, MAC2STR(mac));
815 853 : wpa_printf(MSG_DEBUG, "WPS UPnP: Proxying WLANEvent from %s",
816 : mac_text);
817 853 : os_memcpy(raw + pos, mac_text, 17);
818 853 : pos += 17;
819 853 : if (msg) {
820 853 : os_memcpy(raw + pos, wpabuf_head(msg), wpabuf_len(msg));
821 853 : pos += wpabuf_len(msg);
822 : }
823 853 : raw_len = pos;
824 :
825 853 : val = (char *) base64_encode(raw, raw_len, &val_len);
826 853 : if (val == NULL)
827 1 : goto fail;
828 :
829 852 : os_free(sm->wlanevent);
830 852 : sm->wlanevent = val;
831 852 : sm->wlanevent_type = ev_type;
832 852 : upnp_wps_device_send_event(sm);
833 :
834 852 : ret = 0;
835 :
836 : fail:
837 1625 : os_free(raw);
838 :
839 1625 : return ret;
840 : }
841 :
842 :
843 : #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
844 : #include <sys/sysctl.h>
845 : #include <net/route.h>
846 : #include <net/if_dl.h>
847 :
848 : static int eth_get(const char *device, u8 ea[ETH_ALEN])
849 : {
850 : struct if_msghdr *ifm;
851 : struct sockaddr_dl *sdl;
852 : u_char *p, *buf;
853 : size_t len;
854 : int mib[] = { CTL_NET, AF_ROUTE, 0, AF_LINK, NET_RT_IFLIST, 0 };
855 :
856 : if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0)
857 : return -1;
858 : if ((buf = os_malloc(len)) == NULL)
859 : return -1;
860 : if (sysctl(mib, 6, buf, &len, NULL, 0) < 0) {
861 : os_free(buf);
862 : return -1;
863 : }
864 : for (p = buf; p < buf + len; p += ifm->ifm_msglen) {
865 : ifm = (struct if_msghdr *)p;
866 : sdl = (struct sockaddr_dl *)(ifm + 1);
867 : if (ifm->ifm_type != RTM_IFINFO ||
868 : (ifm->ifm_addrs & RTA_IFP) == 0)
869 : continue;
870 : if (sdl->sdl_family != AF_LINK || sdl->sdl_nlen == 0 ||
871 : os_memcmp(sdl->sdl_data, device, sdl->sdl_nlen) != 0)
872 : continue;
873 : os_memcpy(ea, LLADDR(sdl), sdl->sdl_alen);
874 : break;
875 : }
876 : os_free(buf);
877 :
878 : if (p >= buf + len) {
879 : errno = ESRCH;
880 : return -1;
881 : }
882 : return 0;
883 : }
884 : #endif /* __FreeBSD__ */
885 :
886 :
887 : /**
888 : * get_netif_info - Get hw and IP addresses for network device
889 : * @net_if: Selected network interface name
890 : * @ip_addr: Buffer for returning IP address in network byte order
891 : * @ip_addr_text: Buffer for returning a pointer to allocated IP address text
892 : * @mac: Buffer for returning MAC address
893 : * Returns: 0 on success, -1 on failure
894 : */
895 90 : int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
896 : u8 mac[ETH_ALEN])
897 : {
898 : struct ifreq req;
899 90 : int sock = -1;
900 : struct sockaddr_in *addr;
901 : struct in_addr in_addr;
902 :
903 90 : *ip_addr_text = os_zalloc(16);
904 90 : if (*ip_addr_text == NULL)
905 1 : goto fail;
906 :
907 89 : sock = socket(AF_INET, SOCK_DGRAM, 0);
908 89 : if (sock < 0)
909 0 : goto fail;
910 :
911 89 : os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
912 89 : if (ioctl(sock, SIOCGIFADDR, &req) < 0) {
913 2 : wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFADDR failed: %d (%s)",
914 2 : errno, strerror(errno));
915 1 : goto fail;
916 : }
917 88 : addr = (void *) &req.ifr_addr;
918 88 : *ip_addr = addr->sin_addr.s_addr;
919 88 : in_addr.s_addr = *ip_addr;
920 88 : os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr));
921 :
922 : #ifdef __linux__
923 88 : os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
924 88 : if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) {
925 0 : wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFHWADDR failed: "
926 0 : "%d (%s)", errno, strerror(errno));
927 0 : goto fail;
928 : }
929 88 : os_memcpy(mac, req.ifr_addr.sa_data, 6);
930 : #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
931 : if (eth_get(net_if, mac) < 0) {
932 : wpa_printf(MSG_ERROR, "WPS UPnP: Failed to get MAC address");
933 : goto fail;
934 : }
935 : #else
936 : #error MAC address fetch not implemented
937 : #endif
938 :
939 88 : close(sock);
940 88 : return 0;
941 :
942 : fail:
943 2 : if (sock >= 0)
944 1 : close(sock);
945 2 : os_free(*ip_addr_text);
946 2 : *ip_addr_text = NULL;
947 2 : return -1;
948 : }
949 :
950 :
951 37 : static void upnp_wps_free_msearchreply(struct dl_list *head)
952 : {
953 : struct advertisement_state_machine *a, *tmp;
954 39 : dl_list_for_each_safe(a, tmp, head, struct advertisement_state_machine,
955 : list)
956 2 : msearchreply_state_machine_stop(a);
957 37 : }
958 :
959 :
960 37 : static void upnp_wps_free_subscriptions(struct dl_list *head,
961 : struct wps_registrar *reg)
962 : {
963 : struct subscription *s, *tmp;
964 47 : dl_list_for_each_safe(s, tmp, head, struct subscription, list) {
965 10 : if (reg && s->reg != reg)
966 0 : continue;
967 10 : dl_list_del(&s->list);
968 10 : subscription_destroy(s);
969 : }
970 37 : }
971 :
972 :
973 : /**
974 : * upnp_wps_device_stop - Stop WPS UPnP operations on an interface
975 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
976 : */
977 39 : static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
978 : {
979 39 : if (!sm || !sm->started)
980 41 : return;
981 :
982 37 : wpa_printf(MSG_DEBUG, "WPS UPnP: Stop device");
983 37 : web_listener_stop(sm);
984 37 : ssdp_listener_stop(sm);
985 37 : upnp_wps_free_msearchreply(&sm->msearch_replies);
986 37 : upnp_wps_free_subscriptions(&sm->subscriptions, NULL);
987 :
988 37 : advertisement_state_machine_stop(sm, 1);
989 :
990 37 : event_send_stop_all(sm);
991 37 : os_free(sm->wlanevent);
992 37 : sm->wlanevent = NULL;
993 37 : os_free(sm->ip_addr_text);
994 37 : sm->ip_addr_text = NULL;
995 37 : if (sm->multicast_sd >= 0)
996 35 : close(sm->multicast_sd);
997 37 : sm->multicast_sd = -1;
998 :
999 37 : sm->started = 0;
1000 : }
1001 :
1002 :
1003 : /**
1004 : * upnp_wps_device_start - Start WPS UPnP operations on an interface
1005 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1006 : * @net_if: Selected network interface name
1007 : * Returns: 0 on success, -1 on failure
1008 : */
1009 37 : static int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if)
1010 : {
1011 37 : if (!sm || !net_if)
1012 0 : return -1;
1013 :
1014 37 : if (sm->started)
1015 0 : upnp_wps_device_stop(sm);
1016 :
1017 37 : sm->multicast_sd = -1;
1018 37 : sm->ssdp_sd = -1;
1019 37 : sm->started = 1;
1020 37 : sm->advertise_count = 0;
1021 :
1022 : /* Fix up linux multicast handling */
1023 37 : if (add_ssdp_network(net_if))
1024 0 : goto fail;
1025 :
1026 : /* Determine which IP and mac address we're using */
1027 37 : if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text,
1028 37 : sm->mac_addr)) {
1029 1 : wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1030 : "for %s. Does it have IP address?", net_if);
1031 1 : goto fail;
1032 : }
1033 :
1034 : /* Listen for incoming TCP connections so that others
1035 : * can fetch our "xml files" from us.
1036 : */
1037 36 : if (web_listener_start(sm))
1038 0 : goto fail;
1039 :
1040 : /* Set up for receiving discovery (UDP) packets */
1041 36 : if (ssdp_listener_start(sm))
1042 1 : goto fail;
1043 :
1044 : /* Set up for sending multicast */
1045 35 : if (ssdp_open_multicast(sm) < 0)
1046 0 : goto fail;
1047 :
1048 : /*
1049 : * Broadcast NOTIFY messages to let the world know we exist.
1050 : * This is done via a state machine since the messages should not be
1051 : * all sent out at once.
1052 : */
1053 35 : if (advertisement_state_machine_start(sm))
1054 0 : goto fail;
1055 :
1056 35 : return 0;
1057 :
1058 : fail:
1059 2 : upnp_wps_device_stop(sm);
1060 2 : return -1;
1061 : }
1062 :
1063 :
1064 : static struct upnp_wps_device_interface *
1065 37 : upnp_wps_get_iface(struct upnp_wps_device_sm *sm, void *priv)
1066 : {
1067 : struct upnp_wps_device_interface *iface;
1068 37 : dl_list_for_each(iface, &sm->interfaces,
1069 : struct upnp_wps_device_interface, list) {
1070 37 : if (iface->priv == priv)
1071 37 : return iface;
1072 : }
1073 0 : return NULL;
1074 : }
1075 :
1076 :
1077 : /**
1078 : * upnp_wps_device_deinit - Deinitialize WPS UPnP
1079 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1080 : * @priv: External context data that was used in upnp_wps_device_init() call
1081 : */
1082 592 : void upnp_wps_device_deinit(struct upnp_wps_device_sm *sm, void *priv)
1083 : {
1084 : struct upnp_wps_device_interface *iface;
1085 :
1086 592 : if (!sm)
1087 555 : return;
1088 :
1089 37 : iface = upnp_wps_get_iface(sm, priv);
1090 37 : if (iface == NULL) {
1091 0 : wpa_printf(MSG_ERROR, "WPS UPnP: Could not find the interface "
1092 : "instance to deinit");
1093 0 : return;
1094 : }
1095 37 : wpa_printf(MSG_DEBUG, "WPS UPnP: Deinit interface instance %p", iface);
1096 37 : if (dl_list_len(&sm->interfaces) == 1) {
1097 37 : wpa_printf(MSG_DEBUG, "WPS UPnP: Deinitializing last instance "
1098 : "- free global device instance");
1099 37 : upnp_wps_device_stop(sm);
1100 : } else
1101 0 : upnp_wps_free_subscriptions(&sm->subscriptions,
1102 0 : iface->wps->registrar);
1103 37 : dl_list_del(&iface->list);
1104 :
1105 37 : if (iface->peer.wps)
1106 24 : wps_deinit(iface->peer.wps);
1107 37 : os_free(iface->ctx->ap_pin);
1108 37 : os_free(iface->ctx);
1109 37 : os_free(iface);
1110 :
1111 37 : if (dl_list_empty(&sm->interfaces)) {
1112 37 : os_free(sm->root_dir);
1113 37 : os_free(sm->desc_url);
1114 37 : os_free(sm);
1115 37 : shared_upnp_device = NULL;
1116 : }
1117 : }
1118 :
1119 :
1120 : /**
1121 : * upnp_wps_device_init - Initialize WPS UPnP
1122 : * @ctx: callback table; we must eventually free it
1123 : * @wps: Pointer to longterm WPS context
1124 : * @priv: External context data that will be used in callbacks
1125 : * @net_if: Selected network interface name
1126 : * Returns: WPS UPnP state or %NULL on failure
1127 : */
1128 : struct upnp_wps_device_sm *
1129 37 : upnp_wps_device_init(struct upnp_wps_device_ctx *ctx, struct wps_context *wps,
1130 : void *priv, char *net_if)
1131 : {
1132 : struct upnp_wps_device_sm *sm;
1133 : struct upnp_wps_device_interface *iface;
1134 37 : int start = 0;
1135 :
1136 37 : iface = os_zalloc(sizeof(*iface));
1137 37 : if (iface == NULL) {
1138 0 : os_free(ctx->ap_pin);
1139 0 : os_free(ctx);
1140 0 : return NULL;
1141 : }
1142 37 : wpa_printf(MSG_DEBUG, "WPS UPnP: Init interface instance %p", iface);
1143 :
1144 37 : iface->ctx = ctx;
1145 37 : iface->wps = wps;
1146 37 : iface->priv = priv;
1147 :
1148 37 : if (shared_upnp_device) {
1149 0 : wpa_printf(MSG_DEBUG, "WPS UPnP: Share existing device "
1150 : "context");
1151 0 : sm = shared_upnp_device;
1152 : } else {
1153 37 : wpa_printf(MSG_DEBUG, "WPS UPnP: Initialize device context");
1154 37 : sm = os_zalloc(sizeof(*sm));
1155 37 : if (!sm) {
1156 0 : wpa_printf(MSG_ERROR, "WPS UPnP: upnp_wps_device_init "
1157 : "failed");
1158 0 : os_free(iface);
1159 0 : os_free(ctx->ap_pin);
1160 0 : os_free(ctx);
1161 0 : return NULL;
1162 : }
1163 37 : shared_upnp_device = sm;
1164 :
1165 37 : dl_list_init(&sm->msearch_replies);
1166 37 : dl_list_init(&sm->subscriptions);
1167 37 : dl_list_init(&sm->interfaces);
1168 37 : start = 1;
1169 : }
1170 :
1171 37 : dl_list_add(&sm->interfaces, &iface->list);
1172 :
1173 37 : if (start && upnp_wps_device_start(sm, net_if)) {
1174 2 : upnp_wps_device_deinit(sm, priv);
1175 2 : return NULL;
1176 : }
1177 :
1178 :
1179 35 : return sm;
1180 : }
1181 :
1182 :
1183 : /**
1184 : * upnp_wps_subscribers - Check whether there are any event subscribers
1185 : * @sm: WPS UPnP state machine from upnp_wps_device_init()
1186 : * Returns: 0 if no subscribers, 1 if subscribers
1187 : */
1188 25 : int upnp_wps_subscribers(struct upnp_wps_device_sm *sm)
1189 : {
1190 25 : return !dl_list_empty(&sm->subscriptions);
1191 : }
1192 :
1193 :
1194 15 : int upnp_wps_set_ap_pin(struct upnp_wps_device_sm *sm, const char *ap_pin)
1195 : {
1196 : struct upnp_wps_device_interface *iface;
1197 15 : if (sm == NULL)
1198 2 : return 0;
1199 :
1200 25 : dl_list_for_each(iface, &sm->interfaces,
1201 : struct upnp_wps_device_interface, list) {
1202 13 : os_free(iface->ctx->ap_pin);
1203 13 : if (ap_pin) {
1204 6 : iface->ctx->ap_pin = os_strdup(ap_pin);
1205 6 : if (iface->ctx->ap_pin == NULL)
1206 1 : return -1;
1207 : } else
1208 7 : iface->ctx->ap_pin = NULL;
1209 : }
1210 :
1211 12 : return 0;
1212 : }
|
