1 /*
2 * Wi-Fi Protected Setup - External Registrar
3 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "base64.h"
13 #include "uuid.h"
14 #include "eloop.h"
15 #include "httpread.h"
16 #include "http_client.h"
17 #include "http_server.h"
18 #include "upnp_xml.h"
19 #include "wps_i.h"
20 #include "wps_upnp.h"
21 #include "wps_upnp_i.h"
22 #include "wps_er.h"
23
24
25 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx);
26 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
27 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
28 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
29 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
30 void (*m1_handler)(struct wps_er_ap *ap,
31 struct wpabuf *m1));
32
33
wps_er_sta_event(struct wps_context * wps,struct wps_er_sta * sta,enum wps_event event)34 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
35 enum wps_event event)
36 {
37 union wps_event_data data;
38 struct wps_event_er_enrollee *ev = &data.enrollee;
39
40 if (wps->event_cb == NULL)
41 return;
42
43 os_memset(&data, 0, sizeof(data));
44 ev->uuid = sta->uuid;
45 ev->mac_addr = sta->addr;
46 ev->m1_received = sta->m1_received;
47 ev->config_methods = sta->config_methods;
48 ev->dev_passwd_id = sta->dev_passwd_id;
49 ev->pri_dev_type = sta->pri_dev_type;
50 ev->dev_name = sta->dev_name;
51 ev->manufacturer = sta->manufacturer;
52 ev->model_name = sta->model_name;
53 ev->model_number = sta->model_number;
54 ev->serial_number = sta->serial_number;
55 wps->event_cb(wps->cb_ctx, event, &data);
56 }
57
58
wps_er_sta_get(struct wps_er_ap * ap,const u8 * addr,const u8 * uuid)59 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr,
60 const u8 *uuid)
61 {
62 struct wps_er_sta *sta;
63 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
64 if ((addr == NULL ||
65 os_memcmp(sta->addr, addr, ETH_ALEN) == 0) &&
66 (uuid == NULL ||
67 os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0))
68 return sta;
69 }
70 return NULL;
71 }
72
73
wps_er_sta_free(struct wps_er_sta * sta)74 static void wps_er_sta_free(struct wps_er_sta *sta)
75 {
76 wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
77 if (sta->wps)
78 wps_deinit(sta->wps);
79 os_free(sta->manufacturer);
80 os_free(sta->model_name);
81 os_free(sta->model_number);
82 os_free(sta->serial_number);
83 os_free(sta->dev_name);
84 http_client_free(sta->http);
85 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
86 os_free(sta->cred);
87 os_free(sta);
88 }
89
90
wps_er_sta_remove_all(struct wps_er_ap * ap)91 static void wps_er_sta_remove_all(struct wps_er_ap *ap)
92 {
93 struct wps_er_sta *prev, *sta;
94 dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
95 wps_er_sta_free(sta);
96 }
97
98
wps_er_ap_get(struct wps_er * er,struct in_addr * addr,const u8 * uuid)99 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
100 struct in_addr *addr, const u8 *uuid)
101 {
102 struct wps_er_ap *ap;
103 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
104 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
105 (uuid == NULL ||
106 os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0))
107 return ap;
108 }
109 return NULL;
110 }
111
112
wps_er_ap_get_id(struct wps_er * er,unsigned int id)113 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
114 {
115 struct wps_er_ap *ap;
116 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
117 if (ap->id == id)
118 return ap;
119 }
120 return NULL;
121 }
122
123
wps_er_ap_event(struct wps_context * wps,struct wps_er_ap * ap,enum wps_event event)124 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
125 enum wps_event event)
126 {
127 union wps_event_data data;
128 struct wps_event_er_ap *evap = &data.ap;
129
130 if (wps->event_cb == NULL)
131 return;
132
133 os_memset(&data, 0, sizeof(data));
134 evap->uuid = ap->uuid;
135 evap->friendly_name = ap->friendly_name;
136 evap->manufacturer = ap->manufacturer;
137 evap->manufacturer_url = ap->manufacturer_url;
138 evap->model_description = ap->model_description;
139 evap->model_name = ap->model_name;
140 evap->model_number = ap->model_number;
141 evap->model_url = ap->model_url;
142 evap->serial_number = ap->serial_number;
143 evap->upc = ap->upc;
144 evap->pri_dev_type = ap->pri_dev_type;
145 evap->wps_state = ap->wps_state;
146 evap->mac_addr = ap->mac_addr;
147 wps->event_cb(wps->cb_ctx, event, &data);
148 }
149
150
wps_er_ap_free(struct wps_er_ap * ap)151 static void wps_er_ap_free(struct wps_er_ap *ap)
152 {
153 http_client_free(ap->http);
154 ap->http = NULL;
155
156 os_free(ap->location);
157 os_free(ap->friendly_name);
158 os_free(ap->manufacturer);
159 os_free(ap->manufacturer_url);
160 os_free(ap->model_description);
161 os_free(ap->model_name);
162 os_free(ap->model_number);
163 os_free(ap->model_url);
164 os_free(ap->serial_number);
165 os_free(ap->udn);
166 os_free(ap->upc);
167
168 os_free(ap->scpd_url);
169 os_free(ap->control_url);
170 os_free(ap->event_sub_url);
171
172 os_free(ap->ap_settings);
173
174 os_free(ap);
175 }
176
177
wps_er_ap_unsubscribed(struct wps_er * er,struct wps_er_ap * ap)178 static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap)
179 {
180 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)",
181 inet_ntoa(ap->addr), ap->location);
182 dl_list_del(&ap->list);
183 wps_er_ap_free(ap);
184
185 if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing)) {
186 eloop_cancel_timeout(wps_er_deinit_finish, er, NULL);
187 wps_er_deinit_finish(er, NULL);
188 }
189 }
190
191
wps_er_http_unsubscribe_cb(void * ctx,struct http_client * c,enum http_client_event event)192 static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c,
193 enum http_client_event event)
194 {
195 struct wps_er_ap *ap = ctx;
196
197 switch (event) {
198 case HTTP_CLIENT_OK:
199 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events");
200 ap->subscribed = 0;
201 break;
202 case HTTP_CLIENT_FAILED:
203 case HTTP_CLIENT_INVALID_REPLY:
204 case HTTP_CLIENT_TIMEOUT:
205 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from "
206 "events");
207 break;
208 }
209 http_client_free(ap->http);
210 ap->http = NULL;
211
212 /*
213 * Need to get rid of the AP entry regardless of whether we managed to
214 * unsubscribe cleanly or not.
215 */
216 wps_er_ap_unsubscribed(ap->er, ap);
217 }
218
219
wps_er_ap_unsubscribe(struct wps_er * er,struct wps_er_ap * ap)220 static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap)
221 {
222 struct wpabuf *req;
223 struct sockaddr_in dst;
224 char *url, *path;
225 char sid[100];
226
227 if (ap->event_sub_url == NULL) {
228 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
229 "subscribe");
230 goto fail;
231 }
232 if (ap->http) {
233 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
234 "send subscribe request");
235 goto fail;
236 }
237
238 url = http_client_url_parse(ap->event_sub_url, &dst, &path);
239 if (url == NULL) {
240 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
241 goto fail;
242 }
243
244 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
245 if (req == NULL) {
246 os_free(url);
247 goto fail;
248 }
249 uuid_bin2str(ap->sid, sid, sizeof(sid));
250 wpabuf_printf(req,
251 "UNSUBSCRIBE %s HTTP/1.1\r\n"
252 "HOST: %s:%d\r\n"
253 "SID: uuid:%s\r\n"
254 "\r\n",
255 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid);
256 os_free(url);
257 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request",
258 wpabuf_head(req), wpabuf_len(req));
259
260 ap->http = http_client_addr(&dst, req, 1000,
261 wps_er_http_unsubscribe_cb, ap);
262 if (ap->http == NULL) {
263 wpabuf_free(req);
264 goto fail;
265 }
266 return;
267
268 fail:
269 /*
270 * Need to get rid of the AP entry even when we fail to unsubscribe
271 * cleanly.
272 */
273 wps_er_ap_unsubscribed(ap->er, ap);
274 }
275
276
wps_er_ap_get_settings(struct wps_er * er,const u8 * uuid)277 static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er,
278 const u8 *uuid)
279 {
280 struct wps_er_ap_settings *s;
281 dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list)
282 if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0)
283 return s;
284 return NULL;
285 }
286
287
wps_er_ap_cache_settings(struct wps_er * er,struct in_addr * addr)288 int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr)
289 {
290 struct wps_er_ap *ap;
291 struct wps_er_ap_settings *settings;
292
293 ap = wps_er_ap_get(er, addr, NULL);
294 if (ap == NULL || ap->ap_settings == NULL)
295 return -1;
296
297 settings = wps_er_ap_get_settings(er, ap->uuid);
298 if (!settings) {
299 settings = os_zalloc(sizeof(*settings));
300 if (settings == NULL)
301 return -1;
302 os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN);
303 dl_list_add(&er->ap_settings, &settings->list);
304 }
305 os_memcpy(&settings->ap_settings, ap->ap_settings,
306 sizeof(struct wps_credential));
307
308 return 0;
309 }
310
311
wps_er_ap_use_cached_settings(struct wps_er * er,struct wps_er_ap * ap)312 static int wps_er_ap_use_cached_settings(struct wps_er *er,
313 struct wps_er_ap *ap)
314 {
315 struct wps_er_ap_settings *s;
316
317 if (ap->ap_settings)
318 return 0;
319
320 s = wps_er_ap_get_settings(ap->er, ap->uuid);
321 if (!s)
322 return -1;
323
324 ap->ap_settings = os_malloc(sizeof(*ap->ap_settings));
325 if (ap->ap_settings == NULL)
326 return -1;
327
328 os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings));
329 wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings");
330 return 0;
331 }
332
333
wps_er_ap_remove_entry(struct wps_er * er,struct wps_er_ap * ap)334 static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap)
335 {
336 wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
337 inet_ntoa(ap->addr), ap->location);
338 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
339 wps_er_sta_remove_all(ap);
340 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
341 http_client_free(ap->http);
342 ap->http = NULL;
343 if (ap->wps) {
344 wps_deinit(ap->wps);
345 ap->wps = NULL;
346 }
347
348 dl_list_del(&ap->list);
349 if (ap->subscribed) {
350 dl_list_add(&er->ap_unsubscribing, &ap->list);
351 wps_er_ap_unsubscribe(er, ap);
352 } else
353 wps_er_ap_free(ap);
354 }
355
356
wps_er_ap_timeout(void * eloop_data,void * user_ctx)357 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
358 {
359 struct wps_er *er = eloop_data;
360 struct wps_er_ap *ap = user_ctx;
361 wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
362 wps_er_ap_remove_entry(er, ap);
363 }
364
365
wps_er_get_sid(struct wps_er_ap * ap,char * sid)366 static int wps_er_get_sid(struct wps_er_ap *ap, char *sid)
367 {
368 char *pos;
369 char txt[100];
370
371 if (!sid) {
372 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)",
373 inet_ntoa(ap->addr), ap->location);
374 return -1;
375 }
376
377 pos = os_strstr(sid, "uuid:");
378 if (!pos) {
379 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
380 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
381 sid);
382 return -1;
383 }
384
385 pos += 5;
386 if (uuid_str2bin(pos, ap->sid) < 0) {
387 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
388 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
389 sid);
390 return -1;
391 }
392
393 uuid_bin2str(ap->sid, txt, sizeof(txt));
394 wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s",
395 inet_ntoa(ap->addr), ap->location, txt);
396
397 return 0;
398 }
399
400
wps_er_http_subscribe_cb(void * ctx,struct http_client * c,enum http_client_event event)401 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
402 enum http_client_event event)
403 {
404 struct wps_er_ap *ap = ctx;
405
406 switch (event) {
407 case HTTP_CLIENT_OK:
408 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
409 ap->subscribed = 1;
410 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID"));
411 wps_er_ap_use_cached_settings(ap->er, ap);
412 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
413 break;
414 case HTTP_CLIENT_FAILED:
415 case HTTP_CLIENT_INVALID_REPLY:
416 case HTTP_CLIENT_TIMEOUT:
417 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
418 break;
419 }
420 http_client_free(ap->http);
421 ap->http = NULL;
422 }
423
424
wps_er_subscribe(struct wps_er_ap * ap)425 static void wps_er_subscribe(struct wps_er_ap *ap)
426 {
427 struct wpabuf *req;
428 struct sockaddr_in dst;
429 char *url, *path;
430
431 if (ap->event_sub_url == NULL) {
432 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
433 "subscribe");
434 return;
435 }
436 if (ap->http) {
437 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
438 "send subscribe request");
439 return;
440 }
441
442 url = http_client_url_parse(ap->event_sub_url, &dst, &path);
443 if (url == NULL) {
444 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
445 return;
446 }
447
448 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
449 if (req == NULL) {
450 os_free(url);
451 return;
452 }
453 wpabuf_printf(req,
454 "SUBSCRIBE %s HTTP/1.1\r\n"
455 "HOST: %s:%d\r\n"
456 "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
457 "NT: upnp:event\r\n"
458 "TIMEOUT: Second-%d\r\n"
459 "\r\n",
460 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
461 ap->er->ip_addr_text, ap->er->http_port,
462 ap->er->event_id, ap->id, 1800);
463 os_free(url);
464 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
465 wpabuf_head(req), wpabuf_len(req));
466
467 ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
468 ap);
469 if (ap->http == NULL)
470 wpabuf_free(req);
471 }
472
473
wps_er_ap_get_m1(struct wps_er_ap * ap,struct wpabuf * m1)474 static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
475 {
476 struct wps_parse_attr attr;
477
478 if (wps_parse_msg(m1, &attr) < 0) {
479 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
480 return;
481 }
482 if (attr.primary_dev_type)
483 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
484 if (attr.wps_state)
485 ap->wps_state = *attr.wps_state;
486 if (attr.mac_addr)
487 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
488
489 wps_er_subscribe(ap);
490 }
491
492
wps_er_get_device_info(struct wps_er_ap * ap)493 static void wps_er_get_device_info(struct wps_er_ap *ap)
494 {
495 wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
496 }
497
498
wps_er_find_wfadevice(const char * data)499 static const char * wps_er_find_wfadevice(const char *data)
500 {
501 const char *tag, *tagname, *end;
502 char *val;
503 int found = 0;
504
505 while (!found) {
506 /* Find next <device> */
507 for (;;) {
508 if (xml_next_tag(data, &tag, &tagname, &end))
509 return NULL;
510 data = end;
511 if (!os_strncasecmp(tagname, "device", 6) &&
512 *tag != '/' &&
513 (tagname[6] == '>' || !isgraph(tagname[6]))) {
514 break;
515 }
516 }
517
518 /* Check whether deviceType is WFADevice */
519 val = xml_get_first_item(data, "deviceType");
520 if (val == NULL)
521 return NULL;
522 wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val);
523 found = os_strcasecmp(val, "urn:schemas-wifialliance-org:"
524 "device:WFADevice:1") == 0;
525 os_free(val);
526 }
527
528 return data;
529 }
530
531
wps_er_parse_device_description(struct wps_er_ap * ap,struct wpabuf * reply)532 static void wps_er_parse_device_description(struct wps_er_ap *ap,
533 struct wpabuf *reply)
534 {
535 /* Note: reply includes null termination after the buffer data */
536 const char *tmp, *data = wpabuf_head(reply);
537 char *pos;
538
539 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
540 wpabuf_head(reply), wpabuf_len(reply));
541
542 /*
543 * The root device description may include multiple devices, so first
544 * find the beginning of the WFADevice description to allow the
545 * simplistic parser to pick the correct entries.
546 */
547 tmp = wps_er_find_wfadevice(data);
548 if (tmp == NULL) {
549 wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - "
550 "trying to parse invalid data");
551 } else
552 data = tmp;
553
554 ap->friendly_name = xml_get_first_item(data, "friendlyName");
555 wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
556
557 ap->manufacturer = xml_get_first_item(data, "manufacturer");
558 wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
559
560 ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
561 wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
562 ap->manufacturer_url);
563
564 ap->model_description = xml_get_first_item(data, "modelDescription");
565 wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
566 ap->model_description);
567
568 ap->model_name = xml_get_first_item(data, "modelName");
569 wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
570
571 ap->model_number = xml_get_first_item(data, "modelNumber");
572 wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
573
574 ap->model_url = xml_get_first_item(data, "modelURL");
575 wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
576
577 ap->serial_number = xml_get_first_item(data, "serialNumber");
578 wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
579
580 ap->udn = xml_get_first_item(data, "UDN");
581 wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
582 pos = os_strstr(ap->udn, "uuid:");
583 if (pos) {
584 pos += 5;
585 if (uuid_str2bin(pos, ap->uuid) < 0)
586 wpa_printf(MSG_DEBUG, "WPS ER: Invalid UUID in UDN");
587 }
588
589 ap->upc = xml_get_first_item(data, "UPC");
590 wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
591
592 ap->scpd_url = http_link_update(
593 xml_get_first_item(data, "SCPDURL"), ap->location);
594 wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
595
596 ap->control_url = http_link_update(
597 xml_get_first_item(data, "controlURL"), ap->location);
598 wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
599
600 ap->event_sub_url = http_link_update(
601 xml_get_first_item(data, "eventSubURL"), ap->location);
602 wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
603 }
604
605
wps_er_http_dev_desc_cb(void * ctx,struct http_client * c,enum http_client_event event)606 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
607 enum http_client_event event)
608 {
609 struct wps_er_ap *ap = ctx;
610 struct wpabuf *reply;
611 int ok = 0;
612
613 switch (event) {
614 case HTTP_CLIENT_OK:
615 reply = http_client_get_body(c);
616 if (reply == NULL)
617 break;
618 wps_er_parse_device_description(ap, reply);
619 ok = 1;
620 break;
621 case HTTP_CLIENT_FAILED:
622 case HTTP_CLIENT_INVALID_REPLY:
623 case HTTP_CLIENT_TIMEOUT:
624 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
625 break;
626 }
627 http_client_free(ap->http);
628 ap->http = NULL;
629 if (ok)
630 wps_er_get_device_info(ap);
631 }
632
633
wps_er_ap_add(struct wps_er * er,const u8 * uuid,struct in_addr * addr,const char * location,int max_age)634 void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
635 const char *location, int max_age)
636 {
637 struct wps_er_ap *ap;
638
639 ap = wps_er_ap_get(er, addr, uuid);
640 if (ap) {
641 /* Update advertisement timeout */
642 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
643 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
644 return;
645 }
646
647 ap = os_zalloc(sizeof(*ap));
648 if (ap == NULL)
649 return;
650 dl_list_init(&ap->sta);
651 ap->er = er;
652 ap->id = ++er->next_ap_id;
653 ap->location = os_strdup(location);
654 if (ap->location == NULL) {
655 os_free(ap);
656 return;
657 }
658 dl_list_add(&er->ap, &ap->list);
659
660 ap->addr.s_addr = addr->s_addr;
661 os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
662 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
663
664 wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
665 inet_ntoa(ap->addr), ap->location);
666
667 /* Fetch device description */
668 ap->http = http_client_url(ap->location, NULL, 10000,
669 wps_er_http_dev_desc_cb, ap);
670 }
671
672
wps_er_ap_remove(struct wps_er * er,struct in_addr * addr)673 void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
674 {
675 struct wps_er_ap *ap;
676 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
677 if (ap->addr.s_addr == addr->s_addr) {
678 wps_er_ap_remove_entry(er, ap);
679 return;
680 }
681 }
682 }
683
684
wps_er_ap_remove_all(struct wps_er * er)685 static void wps_er_ap_remove_all(struct wps_er *er)
686 {
687 struct wps_er_ap *prev, *ap;
688 struct wps_er_ap_settings *prev_s, *s;
689 dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
690 wps_er_ap_remove_entry(er, ap);
691 dl_list_for_each_safe(s, prev_s, &er->ap_settings,
692 struct wps_er_ap_settings, list)
693 os_free(s);
694 }
695
696
http_put_date(struct wpabuf * buf)697 static void http_put_date(struct wpabuf *buf)
698 {
699 wpabuf_put_str(buf, "Date: ");
700 format_date(buf);
701 wpabuf_put_str(buf, "\r\n");
702 }
703
704
wps_er_http_resp_not_found(struct http_request * req)705 static void wps_er_http_resp_not_found(struct http_request *req)
706 {
707 struct wpabuf *buf;
708 buf = wpabuf_alloc(200);
709 if (buf == NULL) {
710 http_request_deinit(req);
711 return;
712 }
713
714 wpabuf_put_str(buf,
715 "HTTP/1.1 404 Not Found\r\n"
716 "Server: unspecified, UPnP/1.0, unspecified\r\n"
717 "Connection: close\r\n");
718 http_put_date(buf);
719 wpabuf_put_str(buf, "\r\n");
720 http_request_send_and_deinit(req, buf);
721 }
722
723
wps_er_http_resp_ok(struct http_request * req)724 static void wps_er_http_resp_ok(struct http_request *req)
725 {
726 struct wpabuf *buf;
727 buf = wpabuf_alloc(200);
728 if (buf == NULL) {
729 http_request_deinit(req);
730 return;
731 }
732
733 wpabuf_put_str(buf,
734 "HTTP/1.1 200 OK\r\n"
735 "Server: unspecified, UPnP/1.0, unspecified\r\n"
736 "Connection: close\r\n"
737 "Content-Length: 0\r\n");
738 http_put_date(buf);
739 wpabuf_put_str(buf, "\r\n");
740 http_request_send_and_deinit(req, buf);
741 }
742
743
wps_er_sta_timeout(void * eloop_data,void * user_ctx)744 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
745 {
746 struct wps_er_sta *sta = eloop_data;
747 wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
748 dl_list_del(&sta->list);
749 wps_er_sta_free(sta);
750 }
751
752
wps_er_add_sta_data(struct wps_er_ap * ap,const u8 * addr,struct wps_parse_attr * attr,int probe_req)753 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
754 const u8 *addr,
755 struct wps_parse_attr *attr,
756 int probe_req)
757 {
758 struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL);
759 int new_sta = 0;
760 int m1;
761
762 m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
763
764 if (sta == NULL) {
765 /*
766 * Only allow new STA entry to be added based on Probe Request
767 * or M1. This will filter out bogus events and anything that
768 * may have been ongoing at the time ER subscribed for events.
769 */
770 if (!probe_req && !m1)
771 return NULL;
772
773 sta = os_zalloc(sizeof(*sta));
774 if (sta == NULL)
775 return NULL;
776 os_memcpy(sta->addr, addr, ETH_ALEN);
777 sta->ap = ap;
778 dl_list_add(&ap->sta, &sta->list);
779 new_sta = 1;
780 }
781
782 if (m1)
783 sta->m1_received = 1;
784
785 if (attr->config_methods && (!probe_req || !sta->m1_received))
786 sta->config_methods = WPA_GET_BE16(attr->config_methods);
787 if (attr->uuid_e && (!probe_req || !sta->m1_received))
788 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
789 if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
790 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
791 if (attr->dev_password_id && (!probe_req || !sta->m1_received))
792 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
793
794 if (attr->manufacturer) {
795 os_free(sta->manufacturer);
796 sta->manufacturer = os_malloc(attr->manufacturer_len + 1);
797 if (sta->manufacturer) {
798 os_memcpy(sta->manufacturer, attr->manufacturer,
799 attr->manufacturer_len);
800 sta->manufacturer[attr->manufacturer_len] = '\0';
801 }
802 }
803
804 if (attr->model_name) {
805 os_free(sta->model_name);
806 sta->model_name = os_malloc(attr->model_name_len + 1);
807 if (sta->model_name) {
808 os_memcpy(sta->model_name, attr->model_name,
809 attr->model_name_len);
810 sta->model_name[attr->model_name_len] = '\0';
811 }
812 }
813
814 if (attr->model_number) {
815 os_free(sta->model_number);
816 sta->model_number = os_malloc(attr->model_number_len + 1);
817 if (sta->model_number) {
818 os_memcpy(sta->model_number, attr->model_number,
819 attr->model_number_len);
820 sta->model_number[attr->model_number_len] = '\0';
821 }
822 }
823
824 if (attr->serial_number) {
825 os_free(sta->serial_number);
826 sta->serial_number = os_malloc(attr->serial_number_len + 1);
827 if (sta->serial_number) {
828 os_memcpy(sta->serial_number, attr->serial_number,
829 attr->serial_number_len);
830 sta->serial_number[attr->serial_number_len] = '\0';
831 }
832 }
833
834 if (attr->dev_name) {
835 os_free(sta->dev_name);
836 sta->dev_name = os_malloc(attr->dev_name_len + 1);
837 if (sta->dev_name) {
838 os_memcpy(sta->dev_name, attr->dev_name,
839 attr->dev_name_len);
840 sta->dev_name[attr->dev_name_len] = '\0';
841 }
842 }
843
844 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
845 eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
846
847 if (m1 || new_sta)
848 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
849
850 return sta;
851 }
852
853
wps_er_process_wlanevent_probe_req(struct wps_er_ap * ap,const u8 * addr,struct wpabuf * msg)854 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
855 const u8 *addr,
856 struct wpabuf *msg)
857 {
858 struct wps_parse_attr attr;
859
860 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
861 MACSTR, MAC2STR(addr));
862 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
863 "(TLVs from Probe Request)", msg);
864
865 if (wps_validate_probe_req(msg, addr) < 0) {
866 wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied "
867 "Probe Request frame from " MACSTR, MAC2STR(addr));
868 return;
869 }
870
871 if (wps_parse_msg(msg, &attr) < 0) {
872 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
873 "WLANEvent message");
874 return;
875 }
876
877 wps_er_add_sta_data(ap, addr, &attr, 1);
878 wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0);
879 }
880
881
wps_er_http_put_wlan_response_cb(void * ctx,struct http_client * c,enum http_client_event event)882 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
883 enum http_client_event event)
884 {
885 struct wps_er_sta *sta = ctx;
886
887 switch (event) {
888 case HTTP_CLIENT_OK:
889 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
890 break;
891 case HTTP_CLIENT_FAILED:
892 case HTTP_CLIENT_INVALID_REPLY:
893 case HTTP_CLIENT_TIMEOUT:
894 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
895 break;
896 }
897 http_client_free(sta->http);
898 sta->http = NULL;
899 }
900
901
902 static const char *soap_prefix =
903 "<?xml version=\"1.0\"?>\n"
904 "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
905 "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
906 "<s:Body>\n";
907 static const char *soap_postfix =
908 "</s:Body>\n</s:Envelope>\n";
909 static const char *urn_wfawlanconfig =
910 "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
911
wps_er_soap_hdr(const struct wpabuf * msg,const char * name,const char * arg_name,const char * path,const struct sockaddr_in * dst,char ** len_ptr,char ** body_ptr)912 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
913 const char *name, const char *arg_name,
914 const char *path,
915 const struct sockaddr_in *dst,
916 char **len_ptr, char **body_ptr)
917 {
918 unsigned char *encoded;
919 size_t encoded_len;
920 struct wpabuf *buf;
921
922 if (msg) {
923 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
924 &encoded_len);
925 if (encoded == NULL)
926 return NULL;
927 } else {
928 encoded = NULL;
929 encoded_len = 0;
930 }
931
932 buf = wpabuf_alloc(1000 + encoded_len);
933 if (buf == NULL) {
934 os_free(encoded);
935 return NULL;
936 }
937
938 wpabuf_printf(buf,
939 "POST %s HTTP/1.1\r\n"
940 "Host: %s:%d\r\n"
941 "Content-Type: text/xml; charset=\"utf-8\"\r\n"
942 "Content-Length: ",
943 path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
944
945 *len_ptr = wpabuf_put(buf, 0);
946 wpabuf_printf(buf,
947 " \r\n"
948 "SOAPACTION: \"%s#%s\"\r\n"
949 "\r\n",
950 urn_wfawlanconfig, name);
951
952 *body_ptr = wpabuf_put(buf, 0);
953
954 wpabuf_put_str(buf, soap_prefix);
955 wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
956 wpabuf_put_str(buf, urn_wfawlanconfig);
957 wpabuf_put_str(buf, "\">\n");
958 if (encoded) {
959 wpabuf_printf(buf, "<%s>%s</%s>\n",
960 arg_name, (char *) encoded, arg_name);
961 os_free(encoded);
962 }
963
964 return buf;
965 }
966
967
wps_er_soap_end(struct wpabuf * buf,const char * name,char * len_ptr,char * body_ptr)968 static void wps_er_soap_end(struct wpabuf *buf, const char *name,
969 char *len_ptr, char *body_ptr)
970 {
971 char len_buf[10];
972 wpabuf_printf(buf, "</u:%s>\n", name);
973 wpabuf_put_str(buf, soap_postfix);
974 os_snprintf(len_buf, sizeof(len_buf), "%d",
975 (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
976 os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
977 }
978
979
wps_er_sta_send_msg(struct wps_er_sta * sta,struct wpabuf * msg)980 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
981 {
982 struct wpabuf *buf;
983 char *len_ptr, *body_ptr;
984 struct sockaddr_in dst;
985 char *url, *path;
986
987 if (sta->http) {
988 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
989 "ignore new request");
990 wpabuf_free(msg);
991 return;
992 }
993
994 if (sta->ap->control_url == NULL) {
995 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
996 wpabuf_free(msg);
997 return;
998 }
999
1000 url = http_client_url_parse(sta->ap->control_url, &dst, &path);
1001 if (url == NULL) {
1002 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1003 wpabuf_free(msg);
1004 return;
1005 }
1006
1007 buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
1008 &len_ptr, &body_ptr);
1009 wpabuf_free(msg);
1010 os_free(url);
1011 if (buf == NULL)
1012 return;
1013 wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
1014 UPNP_WPS_WLANEVENT_TYPE_EAP);
1015 wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
1016 MAC2STR(sta->addr));
1017
1018 wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
1019
1020 sta->http = http_client_addr(&dst, buf, 1000,
1021 wps_er_http_put_wlan_response_cb, sta);
1022 if (sta->http == NULL)
1023 wpabuf_free(buf);
1024 }
1025
1026
wps_er_sta_process(struct wps_er_sta * sta,struct wpabuf * msg,enum wsc_op_code op_code)1027 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
1028 enum wsc_op_code op_code)
1029 {
1030 enum wps_process_res res;
1031
1032 res = wps_process_msg(sta->wps, op_code, msg);
1033 if (res == WPS_CONTINUE) {
1034 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
1035 if (next)
1036 wps_er_sta_send_msg(sta, next);
1037 } else {
1038 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
1039 "enrollee (res=%d)",
1040 res == WPS_DONE ? "succeeded" : "failed", res);
1041 wps_deinit(sta->wps);
1042 sta->wps = NULL;
1043 if (res == WPS_DONE) {
1044 /* Remove the STA entry after short timeout */
1045 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
1046 eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
1047 NULL);
1048 }
1049 }
1050 }
1051
1052
wps_er_sta_start(struct wps_er_sta * sta,struct wpabuf * msg)1053 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
1054 {
1055 struct wps_config cfg;
1056
1057 if (sta->wps)
1058 wps_deinit(sta->wps);
1059
1060 os_memset(&cfg, 0, sizeof(cfg));
1061 cfg.wps = sta->ap->er->wps;
1062 cfg.registrar = 1;
1063 cfg.peer_addr = sta->addr;
1064
1065 sta->wps = wps_init(&cfg);
1066 if (sta->wps == NULL)
1067 return;
1068 sta->wps->er = 1;
1069 sta->wps->use_cred = sta->ap->ap_settings;
1070 if (sta->ap->ap_settings) {
1071 os_free(sta->cred);
1072 sta->cred = os_malloc(sizeof(*sta->cred));
1073 if (sta->cred) {
1074 os_memcpy(sta->cred, sta->ap->ap_settings,
1075 sizeof(*sta->cred));
1076 sta->cred->cred_attr = NULL;
1077 os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN);
1078 sta->wps->use_cred = sta->cred;
1079 }
1080 }
1081
1082 wps_er_sta_process(sta, msg, WSC_MSG);
1083 }
1084
1085
wps_er_process_wlanevent_eap(struct wps_er_ap * ap,const u8 * addr,struct wpabuf * msg)1086 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
1087 struct wpabuf *msg)
1088 {
1089 struct wps_parse_attr attr;
1090 struct wps_er_sta *sta;
1091
1092 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
1093 MAC2STR(addr));
1094 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
1095 "(TLVs from EAP-WSC)", msg);
1096
1097 if (wps_parse_msg(msg, &attr) < 0) {
1098 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
1099 "WLANEvent message");
1100 return;
1101 }
1102
1103 sta = wps_er_add_sta_data(ap, addr, &attr, 0);
1104 if (sta == NULL)
1105 return;
1106
1107 if (attr.msg_type && *attr.msg_type == WPS_M1)
1108 wps_er_sta_start(sta, msg);
1109 else if (sta->wps) {
1110 enum wsc_op_code op_code = WSC_MSG;
1111 if (attr.msg_type) {
1112 switch (*attr.msg_type) {
1113 case WPS_WSC_ACK:
1114 op_code = WSC_ACK;
1115 break;
1116 case WPS_WSC_NACK:
1117 op_code = WSC_NACK;
1118 break;
1119 case WPS_WSC_DONE:
1120 op_code = WSC_Done;
1121 break;
1122 }
1123 }
1124 wps_er_sta_process(sta, msg, op_code);
1125 }
1126 }
1127
1128
wps_er_process_wlanevent(struct wps_er_ap * ap,struct wpabuf * event)1129 static void wps_er_process_wlanevent(struct wps_er_ap *ap,
1130 struct wpabuf *event)
1131 {
1132 u8 *data;
1133 u8 wlan_event_type;
1134 u8 wlan_event_mac[ETH_ALEN];
1135 struct wpabuf msg;
1136
1137 wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
1138 wpabuf_head(event), wpabuf_len(event));
1139 if (wpabuf_len(event) < 1 + 17) {
1140 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
1141 return;
1142 }
1143
1144 data = wpabuf_mhead(event);
1145 wlan_event_type = data[0];
1146 if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
1147 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
1148 "WLANEvent");
1149 return;
1150 }
1151
1152 wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
1153
1154 switch (wlan_event_type) {
1155 case 1:
1156 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
1157 break;
1158 case 2:
1159 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
1160 break;
1161 default:
1162 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
1163 wlan_event_type);
1164 break;
1165 }
1166 }
1167
1168
wps_er_http_event(struct wps_er * er,struct http_request * req,unsigned int ap_id)1169 static void wps_er_http_event(struct wps_er *er, struct http_request *req,
1170 unsigned int ap_id)
1171 {
1172 struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
1173 struct wpabuf *event;
1174 enum http_reply_code ret;
1175
1176 if (ap == NULL) {
1177 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
1178 "%u", ap_id);
1179 wps_er_http_resp_not_found(req);
1180 return;
1181 }
1182 wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
1183 ap_id, http_request_get_data(req));
1184
1185 event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
1186 &ret);
1187 if (event == NULL) {
1188 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
1189 "from the event notification");
1190 /*
1191 * Reply with OK anyway to avoid getting unregistered from
1192 * events.
1193 */
1194 wps_er_http_resp_ok(req);
1195 return;
1196 }
1197
1198 wps_er_process_wlanevent(ap, event);
1199
1200 wpabuf_free(event);
1201 wps_er_http_resp_ok(req);
1202 }
1203
1204
wps_er_http_notify(struct wps_er * er,struct http_request * req)1205 static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
1206 {
1207 char *uri = http_request_get_uri(req);
1208
1209 if (os_strncmp(uri, "/event/", 7) == 0) {
1210 unsigned int event_id;
1211 char *pos;
1212 event_id = atoi(uri + 7);
1213 if (event_id != er->event_id) {
1214 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
1215 "unknown event id %u", event_id);
1216 return;
1217 }
1218 pos = os_strchr(uri + 7, '/');
1219 if (pos == NULL)
1220 return;
1221 pos++;
1222 wps_er_http_event(er, req, atoi(pos));
1223 } else {
1224 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
1225 uri);
1226 wps_er_http_resp_not_found(req);
1227 }
1228 }
1229
1230
wps_er_http_req(void * ctx,struct http_request * req)1231 static void wps_er_http_req(void *ctx, struct http_request *req)
1232 {
1233 struct wps_er *er = ctx;
1234 struct sockaddr_in *cli = http_request_get_cli_addr(req);
1235 enum httpread_hdr_type type = http_request_get_type(req);
1236 struct wpabuf *buf;
1237
1238 wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
1239 "%s:%d",
1240 http_request_get_uri(req), type,
1241 inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
1242
1243 switch (type) {
1244 case HTTPREAD_HDR_TYPE_NOTIFY:
1245 wps_er_http_notify(er, req);
1246 break;
1247 default:
1248 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
1249 "%d", type);
1250 buf = wpabuf_alloc(200);
1251 if (buf == NULL) {
1252 http_request_deinit(req);
1253 return;
1254 }
1255 wpabuf_put_str(buf,
1256 "HTTP/1.1 501 Unimplemented\r\n"
1257 "Connection: close\r\n");
1258 http_put_date(buf);
1259 wpabuf_put_str(buf, "\r\n");
1260 http_request_send_and_deinit(req, buf);
1261 break;
1262 }
1263 }
1264
1265
1266 struct wps_er *
wps_er_init(struct wps_context * wps,const char * ifname,const char * filter)1267 wps_er_init(struct wps_context *wps, const char *ifname, const char *filter)
1268 {
1269 struct wps_er *er;
1270 struct in_addr addr;
1271
1272 er = os_zalloc(sizeof(*er));
1273 if (er == NULL)
1274 return NULL;
1275 dl_list_init(&er->ap);
1276 dl_list_init(&er->ap_unsubscribing);
1277 dl_list_init(&er->ap_settings);
1278
1279 er->multicast_sd = -1;
1280 er->ssdp_sd = -1;
1281
1282 os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1283 er->wps = wps;
1284 if (os_get_random((unsigned char *) &er->event_id,
1285 sizeof(er->event_id)) < 0) {
1286 wps_er_deinit(er, NULL, NULL);
1287 return NULL;
1288 }
1289 /* Limit event_id to < 32 bits to avoid issues with atoi() */
1290 er->event_id &= 0x0fffffff;
1291
1292 if (filter) {
1293 if (inet_aton(filter, &er->filter_addr) == 0) {
1294 wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter "
1295 "address %s", filter);
1296 wps_er_deinit(er, NULL, NULL);
1297 return NULL;
1298 }
1299 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections "
1300 "with %s", filter);
1301 }
1302 if (get_netif_info(ifname, &er->ip_addr, &er->ip_addr_text,
1303 er->mac_addr)) {
1304 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1305 "for %s. Does it have IP address?", ifname);
1306 wps_er_deinit(er, NULL, NULL);
1307 return NULL;
1308 }
1309
1310 if (wps_er_ssdp_init(er) < 0) {
1311 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed");
1312 wps_er_deinit(er, NULL, NULL);
1313 return NULL;
1314 }
1315
1316 addr.s_addr = er->ip_addr;
1317 er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1318 if (er->http_srv == NULL) {
1319 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed");
1320 wps_er_deinit(er, NULL, NULL);
1321 return NULL;
1322 }
1323 er->http_port = http_server_get_port(er->http_srv);
1324
1325 wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)",
1326 er->ifname, er->ip_addr_text);
1327
1328 return er;
1329 }
1330
1331
wps_er_refresh(struct wps_er * er)1332 void wps_er_refresh(struct wps_er *er)
1333 {
1334 struct wps_er_ap *ap;
1335 struct wps_er_sta *sta;
1336
1337 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1338 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
1339 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
1340 wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
1341 }
1342
1343 wps_er_send_ssdp_msearch(er);
1344 }
1345
1346
wps_er_deinit_finish(void * eloop_data,void * user_ctx)1347 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx)
1348 {
1349 struct wps_er *er = eloop_data;
1350 void (*deinit_done_cb)(void *ctx);
1351 void *deinit_done_ctx;
1352
1353 wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit");
1354
1355 deinit_done_cb = er->deinit_done_cb;
1356 deinit_done_ctx = er->deinit_done_ctx;
1357 os_free(er->ip_addr_text);
1358 os_free(er);
1359
1360 if (deinit_done_cb)
1361 deinit_done_cb(deinit_done_ctx);
1362 }
1363
1364
wps_er_deinit(struct wps_er * er,void (* cb)(void * ctx),void * ctx)1365 void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx)
1366 {
1367 if (er == NULL)
1368 return;
1369 http_server_deinit(er->http_srv);
1370 wps_er_ap_remove_all(er);
1371 wps_er_ssdp_deinit(er);
1372 eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0,
1373 wps_er_deinit_finish, er, NULL);
1374 wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout");
1375 er->deinitializing = 1;
1376 er->deinit_done_cb = cb;
1377 er->deinit_done_ctx = ctx;
1378 }
1379
1380
wps_er_http_set_sel_reg_cb(void * ctx,struct http_client * c,enum http_client_event event)1381 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1382 enum http_client_event event)
1383 {
1384 struct wps_er_ap *ap = ctx;
1385 union wps_event_data data;
1386
1387 os_memset(&data, 0, sizeof(data));
1388
1389 switch (event) {
1390 case HTTP_CLIENT_OK:
1391 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1392 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE;
1393 data.set_sel_reg.uuid = ap->uuid;
1394 break;
1395 case HTTP_CLIENT_FAILED:
1396 case HTTP_CLIENT_INVALID_REPLY:
1397 case HTTP_CLIENT_TIMEOUT:
1398 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1399 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED;
1400 data.set_sel_reg.uuid = ap->uuid;
1401 break;
1402 }
1403 http_client_free(ap->http);
1404 ap->http = NULL;
1405
1406 if (data.set_sel_reg.uuid)
1407 ap->er->wps->event_cb(ap->er->wps->cb_ctx,
1408 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1409 }
1410
1411
wps_er_send_set_sel_reg(struct wps_er_ap * ap,struct wpabuf * msg)1412 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1413 {
1414 struct wpabuf *buf;
1415 char *len_ptr, *body_ptr;
1416 struct sockaddr_in dst;
1417 char *url, *path;
1418
1419 if (ap->control_url == NULL) {
1420 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1421 return;
1422 }
1423
1424 if (ap->http) {
1425 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1426 "ignore new request");
1427 return;
1428 }
1429
1430 if (ap->wps) {
1431 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - "
1432 "skip SetSelectedRegistrar");
1433 return;
1434 }
1435
1436 url = http_client_url_parse(ap->control_url, &dst, &path);
1437 if (url == NULL) {
1438 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1439 return;
1440 }
1441
1442 buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1443 &dst, &len_ptr, &body_ptr);
1444 os_free(url);
1445 if (buf == NULL)
1446 return;
1447
1448 wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1449
1450 ap->http = http_client_addr(&dst, buf, 1000,
1451 wps_er_http_set_sel_reg_cb, ap);
1452 if (ap->http == NULL)
1453 wpabuf_free(buf);
1454 }
1455
1456
wps_er_build_selected_registrar(struct wpabuf * msg,int sel_reg)1457 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1458 {
1459 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1460 wpabuf_put_be16(msg, 1);
1461 wpabuf_put_u8(msg, !!sel_reg);
1462 return 0;
1463 }
1464
1465
wps_er_build_dev_password_id(struct wpabuf * msg,u16 dev_passwd_id)1466 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1467 {
1468 wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1469 wpabuf_put_be16(msg, 2);
1470 wpabuf_put_be16(msg, dev_passwd_id);
1471 return 0;
1472 }
1473
1474
wps_er_build_sel_reg_config_methods(struct wpabuf * msg,u16 sel_reg_config_methods)1475 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1476 u16 sel_reg_config_methods)
1477 {
1478 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1479 wpabuf_put_be16(msg, 2);
1480 wpabuf_put_be16(msg, sel_reg_config_methods);
1481 return 0;
1482 }
1483
1484
wps_er_build_uuid_r(struct wpabuf * msg,const u8 * uuid_r)1485 static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r)
1486 {
1487 #ifdef CONFIG_WPS2
1488 wpabuf_put_be16(msg, ATTR_UUID_R);
1489 wpabuf_put_be16(msg, WPS_UUID_LEN);
1490 wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN);
1491 #endif /* CONFIG_WPS2 */
1492 return 0;
1493 }
1494
1495
wps_er_set_sel_reg(struct wps_er * er,int sel_reg,u16 dev_passwd_id,u16 sel_reg_config_methods)1496 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1497 u16 sel_reg_config_methods)
1498 {
1499 struct wpabuf *msg;
1500 struct wps_er_ap *ap;
1501 struct wps_registrar *reg = er->wps->registrar;
1502 const u8 *auth_macs;
1503 #ifdef CONFIG_WPS2
1504 u8 bcast[ETH_ALEN];
1505 #endif /* CONFIG_WPS2 */
1506 size_t count;
1507 union wps_event_data data;
1508
1509 if (er->skip_set_sel_reg) {
1510 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar");
1511 return;
1512 }
1513
1514 msg = wpabuf_alloc(500);
1515 if (msg == NULL)
1516 return;
1517
1518 auth_macs = wps_authorized_macs(reg, &count);
1519 #ifdef CONFIG_WPS2
1520 if (count == 0) {
1521 os_memset(bcast, 0xff, ETH_ALEN);
1522 auth_macs = bcast;
1523 count = 1;
1524 }
1525 #endif /* CONFIG_WPS2 */
1526
1527 if (wps_build_version(msg) ||
1528 wps_er_build_selected_registrar(msg, sel_reg) ||
1529 wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1530 wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
1531 wps_build_wfa_ext(msg, 0, auth_macs, count) ||
1532 wps_er_build_uuid_r(msg, er->wps->uuid)) {
1533 wpabuf_free(msg);
1534 return;
1535 }
1536
1537 os_memset(&data, 0, sizeof(data));
1538 data.set_sel_reg.sel_reg = sel_reg;
1539 data.set_sel_reg.dev_passwd_id = dev_passwd_id;
1540 data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods;
1541 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START;
1542
1543 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1544 if (er->set_sel_reg_uuid_filter &&
1545 os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter,
1546 WPS_UUID_LEN) != 0)
1547 continue;
1548 data.set_sel_reg.uuid = ap->uuid;
1549 er->wps->event_cb(er->wps->cb_ctx,
1550 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1551 wps_er_send_set_sel_reg(ap, msg);
1552 }
1553
1554 wpabuf_free(msg);
1555 }
1556
1557
wps_er_pbc(struct wps_er * er,const u8 * uuid)1558 int wps_er_pbc(struct wps_er *er, const u8 *uuid)
1559 {
1560 int res;
1561 struct wps_er_ap *ap;
1562
1563 if (er == NULL || er->wps == NULL)
1564 return -1;
1565
1566 if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) {
1567 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC "
1568 "mode");
1569 return -2;
1570 }
1571
1572 ap = wps_er_ap_get(er, NULL, uuid);
1573 if (ap == NULL) {
1574 struct wps_er_sta *sta = NULL;
1575 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1576 sta = wps_er_sta_get(ap, NULL, uuid);
1577 if (sta) {
1578 uuid = ap->uuid;
1579 break;
1580 }
1581 }
1582 if (sta == NULL)
1583 return -3; /* Unknown UUID */
1584 }
1585
1586 if (ap->ap_settings == NULL) {
1587 wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known");
1588 return -4;
1589 }
1590
1591 er->set_sel_reg_uuid_filter = uuid;
1592 res = wps_registrar_button_pushed(er->wps->registrar, NULL);
1593 er->set_sel_reg_uuid_filter = NULL;
1594 if (res)
1595 return -1;
1596
1597 return 0;
1598 }
1599
1600
wps_er_ap_settings_cb(void * ctx,const struct wps_credential * cred)1601 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1602 {
1603 struct wps_er_ap *ap = ctx;
1604 union wps_event_data data;
1605
1606 wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1607 os_free(ap->ap_settings);
1608 ap->ap_settings = os_malloc(sizeof(*cred));
1609 if (ap->ap_settings) {
1610 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1611 ap->ap_settings->cred_attr = NULL;
1612 }
1613
1614 os_memset(&data, 0, sizeof(data));
1615 data.ap_settings.uuid = ap->uuid;
1616 data.ap_settings.cred = cred;
1617 ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS,
1618 &data);
1619 }
1620
1621
wps_er_http_put_message_cb(void * ctx,struct http_client * c,enum http_client_event event)1622 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1623 enum http_client_event event)
1624 {
1625 struct wps_er_ap *ap = ctx;
1626 struct wpabuf *reply;
1627 char *msg = NULL;
1628
1629 switch (event) {
1630 case HTTP_CLIENT_OK:
1631 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1632 reply = http_client_get_body(c);
1633 if (reply == NULL)
1634 break;
1635 msg = os_zalloc(wpabuf_len(reply) + 1);
1636 if (msg == NULL)
1637 break;
1638 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1639 break;
1640 case HTTP_CLIENT_FAILED:
1641 case HTTP_CLIENT_INVALID_REPLY:
1642 case HTTP_CLIENT_TIMEOUT:
1643 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1644 if (ap->wps) {
1645 wps_deinit(ap->wps);
1646 ap->wps = NULL;
1647 }
1648 break;
1649 }
1650 http_client_free(ap->http);
1651 ap->http = NULL;
1652
1653 if (msg) {
1654 struct wpabuf *buf;
1655 enum http_reply_code ret;
1656 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1657 os_free(msg);
1658 if (buf == NULL) {
1659 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1660 "NewOutMessage from PutMessage response");
1661 wps_deinit(ap->wps);
1662 ap->wps = NULL;
1663 return;
1664 }
1665 wps_er_ap_process(ap, buf);
1666 wpabuf_free(buf);
1667 }
1668 }
1669
1670
wps_er_ap_put_message(struct wps_er_ap * ap,const struct wpabuf * msg)1671 static void wps_er_ap_put_message(struct wps_er_ap *ap,
1672 const struct wpabuf *msg)
1673 {
1674 struct wpabuf *buf;
1675 char *len_ptr, *body_ptr;
1676 struct sockaddr_in dst;
1677 char *url, *path;
1678
1679 if (ap->http) {
1680 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1681 "with the AP - cannot continue learn");
1682 return;
1683 }
1684
1685 if (ap->control_url == NULL) {
1686 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1687 return;
1688 }
1689
1690 url = http_client_url_parse(ap->control_url, &dst, &path);
1691 if (url == NULL) {
1692 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1693 return;
1694 }
1695
1696 buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1697 &len_ptr, &body_ptr);
1698 os_free(url);
1699 if (buf == NULL)
1700 return;
1701
1702 wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1703
1704 ap->http = http_client_addr(&dst, buf, 10000,
1705 wps_er_http_put_message_cb, ap);
1706 if (ap->http == NULL)
1707 wpabuf_free(buf);
1708 }
1709
1710
wps_er_ap_process(struct wps_er_ap * ap,struct wpabuf * msg)1711 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1712 {
1713 enum wps_process_res res;
1714 struct wps_parse_attr attr;
1715 enum wsc_op_code op_code;
1716
1717 op_code = WSC_MSG;
1718 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) {
1719 switch (*attr.msg_type) {
1720 case WPS_WSC_ACK:
1721 op_code = WSC_ACK;
1722 break;
1723 case WPS_WSC_NACK:
1724 op_code = WSC_NACK;
1725 break;
1726 case WPS_WSC_DONE:
1727 op_code = WSC_Done;
1728 break;
1729 }
1730 }
1731
1732 res = wps_process_msg(ap->wps, op_code, msg);
1733 if (res == WPS_CONTINUE) {
1734 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1735 if (next) {
1736 wps_er_ap_put_message(ap, next);
1737 wpabuf_free(next);
1738 } else {
1739 wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1740 "message");
1741 wps_deinit(ap->wps);
1742 ap->wps = NULL;
1743 }
1744 } else if (res == WPS_DONE) {
1745 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done");
1746 wps_deinit(ap->wps);
1747 ap->wps = NULL;
1748 } else {
1749 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1750 "AP (res=%d)", res);
1751 wps_deinit(ap->wps);
1752 ap->wps = NULL;
1753 }
1754 }
1755
1756
wps_er_ap_learn_m1(struct wps_er_ap * ap,struct wpabuf * m1)1757 static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1758 {
1759 struct wps_config cfg;
1760
1761 if (ap->wps) {
1762 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1763 "progress with this AP");
1764 return;
1765 }
1766
1767 os_memset(&cfg, 0, sizeof(cfg));
1768 cfg.wps = ap->er->wps;
1769 cfg.registrar = 1;
1770 ap->wps = wps_init(&cfg);
1771 if (ap->wps == NULL)
1772 return;
1773 ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1774 ap->wps->ap_settings_cb_ctx = ap;
1775
1776 wps_er_ap_process(ap, m1);
1777 }
1778
1779
wps_er_ap_learn(struct wps_er_ap * ap,const char * dev_info)1780 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1781 {
1782 struct wpabuf *info;
1783 enum http_reply_code ret;
1784
1785 wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1786 "from the AP");
1787 info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1788 if (info == NULL) {
1789 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1790 "NewDeviceInfo from GetDeviceInfo response");
1791 return;
1792 }
1793
1794 ap->m1_handler(ap, info);
1795 wpabuf_free(info);
1796 }
1797
1798
wps_er_http_get_dev_info_cb(void * ctx,struct http_client * c,enum http_client_event event)1799 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1800 enum http_client_event event)
1801 {
1802 struct wps_er_ap *ap = ctx;
1803 struct wpabuf *reply;
1804 char *dev_info = NULL;
1805
1806 switch (event) {
1807 case HTTP_CLIENT_OK:
1808 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1809 reply = http_client_get_body(c);
1810 if (reply == NULL)
1811 break;
1812 dev_info = os_zalloc(wpabuf_len(reply) + 1);
1813 if (dev_info == NULL)
1814 break;
1815 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1816 break;
1817 case HTTP_CLIENT_FAILED:
1818 case HTTP_CLIENT_INVALID_REPLY:
1819 case HTTP_CLIENT_TIMEOUT:
1820 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1821 break;
1822 }
1823 http_client_free(ap->http);
1824 ap->http = NULL;
1825
1826 if (dev_info) {
1827 wps_er_ap_learn(ap, dev_info);
1828 os_free(dev_info);
1829 }
1830 }
1831
1832
wps_er_send_get_device_info(struct wps_er_ap * ap,void (* m1_handler)(struct wps_er_ap * ap,struct wpabuf * m1))1833 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
1834 void (*m1_handler)(struct wps_er_ap *ap,
1835 struct wpabuf *m1))
1836 {
1837 struct wpabuf *buf;
1838 char *len_ptr, *body_ptr;
1839 struct sockaddr_in dst;
1840 char *url, *path;
1841
1842 if (ap->http) {
1843 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1844 "with the AP - cannot get device info");
1845 return -1;
1846 }
1847
1848 if (ap->control_url == NULL) {
1849 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1850 return -1;
1851 }
1852
1853 url = http_client_url_parse(ap->control_url, &dst, &path);
1854 if (url == NULL) {
1855 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1856 return -1;
1857 }
1858
1859 buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1860 &len_ptr, &body_ptr);
1861 os_free(url);
1862 if (buf == NULL)
1863 return -1;
1864
1865 wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1866
1867 ap->http = http_client_addr(&dst, buf, 10000,
1868 wps_er_http_get_dev_info_cb, ap);
1869 if (ap->http == NULL) {
1870 wpabuf_free(buf);
1871 return -1;
1872 }
1873
1874 ap->m1_handler = m1_handler;
1875
1876 return 0;
1877 }
1878
1879
wps_er_learn(struct wps_er * er,const u8 * uuid,const u8 * pin,size_t pin_len)1880 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *pin,
1881 size_t pin_len)
1882 {
1883 struct wps_er_ap *ap;
1884
1885 if (er == NULL)
1886 return -1;
1887
1888 ap = wps_er_ap_get(er, NULL, uuid);
1889 if (ap == NULL) {
1890 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1891 "request");
1892 return -1;
1893 }
1894 if (ap->wps) {
1895 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1896 "with the AP - cannot start learn");
1897 return -1;
1898 }
1899
1900 if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
1901 return -1;
1902
1903 er->skip_set_sel_reg = 1;
1904 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1905 er->skip_set_sel_reg = 0;
1906
1907 return 0;
1908 }
1909
1910
wps_er_set_config(struct wps_er * er,const u8 * uuid,const struct wps_credential * cred)1911 int wps_er_set_config(struct wps_er *er, const u8 *uuid,
1912 const struct wps_credential *cred)
1913 {
1914 struct wps_er_ap *ap;
1915
1916 if (er == NULL)
1917 return -1;
1918
1919 ap = wps_er_ap_get(er, NULL, uuid);
1920 if (ap == NULL) {
1921 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config "
1922 "request");
1923 return -1;
1924 }
1925
1926 os_free(ap->ap_settings);
1927 ap->ap_settings = os_malloc(sizeof(*cred));
1928 if (ap->ap_settings == NULL)
1929 return -1;
1930 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1931 ap->ap_settings->cred_attr = NULL;
1932 wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set "
1933 "config request");
1934
1935 return 0;
1936 }
1937
1938
wps_er_ap_config_m1(struct wps_er_ap * ap,struct wpabuf * m1)1939 static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1940 {
1941 struct wps_config cfg;
1942
1943 if (ap->wps) {
1944 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1945 "progress with this AP");
1946 return;
1947 }
1948
1949 os_memset(&cfg, 0, sizeof(cfg));
1950 cfg.wps = ap->er->wps;
1951 cfg.registrar = 1;
1952 cfg.new_ap_settings = ap->ap_settings;
1953 ap->wps = wps_init(&cfg);
1954 if (ap->wps == NULL)
1955 return;
1956 ap->wps->ap_settings_cb = NULL;
1957 ap->wps->ap_settings_cb_ctx = NULL;
1958
1959 wps_er_ap_process(ap, m1);
1960 }
1961
1962
wps_er_config(struct wps_er * er,const u8 * uuid,const u8 * pin,size_t pin_len,const struct wps_credential * cred)1963 int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *pin,
1964 size_t pin_len, const struct wps_credential *cred)
1965 {
1966 struct wps_er_ap *ap;
1967
1968 if (er == NULL)
1969 return -1;
1970
1971 ap = wps_er_ap_get(er, NULL, uuid);
1972 if (ap == NULL) {
1973 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config "
1974 "request");
1975 return -1;
1976 }
1977 if (ap->wps) {
1978 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1979 "with the AP - cannot start config");
1980 return -1;
1981 }
1982
1983 os_free(ap->ap_settings);
1984 ap->ap_settings = os_malloc(sizeof(*cred));
1985 if (ap->ap_settings == NULL)
1986 return -1;
1987 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1988 ap->ap_settings->cred_attr = NULL;
1989
1990 if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0)
1991 return -1;
1992
1993 er->skip_set_sel_reg = 1;
1994 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1995 er->skip_set_sel_reg = 0;
1996
1997 return 0;
1998 }
1999