src/wps/wps_er.c

   1 /*
   2  * Wi-Fi Protected Setup - External Registrar
   3  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "base64.h"
  19 #include "uuid.h"
  20 #include "eloop.h"
  21 #include "httpread.h"
  22 #include "http_client.h"
  23 #include "http_server.h"
  24 #include "upnp_xml.h"
  25 #include "wps_i.h"
  26 #include "wps_upnp.h"
  27 #include "wps_upnp_i.h"
  28 #include "wps_er.h"
  29
  30
  31 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
  32 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
  33 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
  34 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
  35                                        void (*m1_handler)(struct wps_er_ap *ap,
  36                                                           struct wpabuf *m1));
  37
  38
  39 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
  40                              enum wps_event event)
  41 {
  42         union wps_event_data data;
  43         struct wps_event_er_enrollee *ev = &data.enrollee;
  44
  45         if (wps->event_cb == NULL)
  46                 return;
  47
  48         os_memset(&data, 0, sizeof(data));
  49         ev->uuid = sta->uuid;
  50         ev->mac_addr = sta->addr;
  51         ev->m1_received = sta->m1_received;
  52         ev->config_methods = sta->config_methods;
  53         ev->dev_passwd_id = sta->dev_passwd_id;
  54         ev->pri_dev_type = sta->pri_dev_type;
  55         ev->dev_name = sta->dev_name;
  56         ev->manufacturer = sta->manufacturer;
  57         ev->model_name = sta->model_name;
  58         ev->model_number = sta->model_number;
  59         ev->serial_number = sta->serial_number;
  60         wps->event_cb(wps->cb_ctx, event, &data);
  61 }
  62
  63
  64 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr)
  65 {
  66         struct wps_er_sta *sta;
  67         dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
  68                 if (os_memcmp(sta->addr, addr, ETH_ALEN) == 0)
  69                         return sta;
  70         }
  71         return NULL;
  72 }
  73
  74
  75 static void wps_er_sta_free(struct wps_er_sta *sta)
  76 {
  77         wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
  78         if (sta->wps)
  79                 wps_deinit(sta->wps);
  80         os_free(sta->manufacturer);
  81         os_free(sta->model_name);
  82         os_free(sta->model_number);
  83         os_free(sta->serial_number);
  84         os_free(sta->dev_name);
  85         http_client_free(sta->http);
  86         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
  87         os_free(sta);
  88 }
  89
  90
  91 static void wps_er_sta_remove_all(struct wps_er_ap *ap)
  92 {
  93         struct wps_er_sta *prev, *sta;
  94         dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
  95                 wps_er_sta_free(sta);
  96 }
  97
  98
  99 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
 100                                         struct in_addr *addr, const u8 *uuid)
 101 {
 102         struct wps_er_ap *ap;
 103         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 104                 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
 105                     (uuid == NULL ||
 106                      os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0))
 107                         return ap;
 108         }
 109         return NULL;
 110 }
 111
 112
 113 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
 114 {
 115         struct wps_er_ap *ap;
 116         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 117                 if (ap->id == id)
 118                         return ap;
 119         }
 120         return NULL;
 121 }
 122
 123
 124 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
 125                             enum wps_event event)
 126 {
 127         union wps_event_data data;
 128         struct wps_event_er_ap *evap = &data.ap;
 129
 130         if (wps->event_cb == NULL)
 131                 return;
 132
 133         os_memset(&data, 0, sizeof(data));
 134         evap->uuid = ap->uuid;
 135         evap->friendly_name = ap->friendly_name;
 136         evap->manufacturer = ap->manufacturer;
 137         evap->manufacturer_url = ap->manufacturer_url;
 138         evap->model_description = ap->model_description;
 139         evap->model_name = ap->model_name;
 140         evap->model_number = ap->model_number;
 141         evap->model_url = ap->model_url;
 142         evap->serial_number = ap->serial_number;
 143         evap->upc = ap->upc;
 144         evap->pri_dev_type = ap->pri_dev_type;
 145         evap->wps_state = ap->wps_state;
 146         evap->mac_addr = ap->mac_addr;
 147         wps->event_cb(wps->cb_ctx, event, &data);
 148 }
 149
 150
 151 static void wps_er_ap_free(struct wps_er *er, struct wps_er_ap *ap)
 152 {
 153         /* TODO: if ap->subscribed, unsubscribe from events if the AP is still
 154          * alive */
 155         wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
 156                    inet_ntoa(ap->addr), ap->location);
 157         eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 158         wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
 159         os_free(ap->location);
 160         http_client_free(ap->http);
 161         if (ap->wps)
 162                 wps_deinit(ap->wps);
 163
 164         os_free(ap->friendly_name);
 165         os_free(ap->manufacturer);
 166         os_free(ap->manufacturer_url);
 167         os_free(ap->model_description);
 168         os_free(ap->model_name);
 169         os_free(ap->model_number);
 170         os_free(ap->model_url);
 171         os_free(ap->serial_number);
 172         os_free(ap->udn);
 173         os_free(ap->upc);
 174
 175         os_free(ap->scpd_url);
 176         os_free(ap->control_url);
 177         os_free(ap->event_sub_url);
 178
 179         os_free(ap->ap_settings);
 180
 181         wps_er_sta_remove_all(ap);
 182
 183         os_free(ap);
 184 }
 185
 186
 187 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
 188 {
 189         struct wps_er *er = eloop_data;
 190         struct wps_er_ap *ap = user_ctx;
 191         wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
 192         dl_list_del(&ap->list);
 193         wps_er_ap_free(er, ap);
 194 }
 195
 196
 197 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
 198                                      enum http_client_event event)
 199 {
 200         struct wps_er_ap *ap = ctx;
 201
 202         switch (event) {
 203         case HTTP_CLIENT_OK:
 204                 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
 205                 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
 206                 break;
 207         case HTTP_CLIENT_FAILED:
 208         case HTTP_CLIENT_INVALID_REPLY:
 209         case HTTP_CLIENT_TIMEOUT:
 210                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
 211                 break;
 212         }
 213         http_client_free(ap->http);
 214         ap->http = NULL;
 215 }
 216
 217
 218 static void wps_er_subscribe(struct wps_er_ap *ap)
 219 {
 220         struct wpabuf *req;
 221         struct sockaddr_in dst;
 222         char *url, *path;
 223
 224         if (ap->event_sub_url == NULL) {
 225                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 226                            "subscribe");
 227                 return;
 228         }
 229         if (ap->http) {
 230                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 231                            "send subscribe request");
 232                 return;
 233         }
 234
 235         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 236         if (url == NULL) {
 237                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 238                 return;
 239         }
 240
 241         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 242         if (req == NULL) {
 243                 os_free(url);
 244                 return;
 245         }
 246         wpabuf_printf(req,
 247                       "SUBSCRIBE %s HTTP/1.1\r\n"
 248                       "HOST: %s:%d\r\n"
 249                       "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
 250                       "NT: upnp:event\r\n"
 251                       "TIMEOUT: Second-%d\r\n"
 252                       "\r\n",
 253                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
 254                       ap->er->ip_addr_text, ap->er->http_port,
 255                       ap->er->event_id, ap->id, 1800);
 256         os_free(url);
 257         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
 258                           wpabuf_head(req), wpabuf_len(req));
 259
 260         ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
 261                                     ap);
 262         if (ap->http == NULL)
 263                 wpabuf_free(req);
 264 }
 265
 266
 267 static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
 268 {
 269         struct wps_parse_attr attr;
 270
 271         if (wps_parse_msg(m1, &attr) < 0) {
 272                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
 273                 return;
 274         }
 275         if (attr.primary_dev_type)
 276                 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
 277         if (attr.wps_state)
 278                 ap->wps_state = *attr.wps_state;
 279         if (attr.mac_addr)
 280                 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
 281
 282         wps_er_subscribe(ap);
 283 }
 284
 285
 286 static void wps_er_get_device_info(struct wps_er_ap *ap)
 287 {
 288         wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
 289 }
 290
 291
 292 static void wps_er_parse_device_description(struct wps_er_ap *ap,
 293                                             struct wpabuf *reply)
 294 {
 295         /* Note: reply includes null termination after the buffer data */
 296         const char *data = wpabuf_head(reply);
 297         char *pos;
 298
 299         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
 300                           wpabuf_head(reply), wpabuf_len(reply));
 301
 302         ap->friendly_name = xml_get_first_item(data, "friendlyName");
 303         wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
 304
 305         ap->manufacturer = xml_get_first_item(data, "manufacturer");
 306         wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
 307
 308         ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
 309         wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
 310                    ap->manufacturer_url);
 311
 312         ap->model_description = xml_get_first_item(data, "modelDescription");
 313         wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
 314                    ap->model_description);
 315
 316         ap->model_name = xml_get_first_item(data, "modelName");
 317         wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
 318
 319         ap->model_number = xml_get_first_item(data, "modelNumber");
 320         wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
 321
 322         ap->model_url = xml_get_first_item(data, "modelURL");
 323         wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
 324
 325         ap->serial_number = xml_get_first_item(data, "serialNumber");
 326         wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
 327
 328         ap->udn = xml_get_first_item(data, "UDN");
 329         wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
 330         pos = os_strstr(ap->udn, "uuid:");
 331         if (pos) {
 332                 pos += 5;
 333                 uuid_str2bin(pos, ap->uuid);
 334         }
 335
 336         ap->upc = xml_get_first_item(data, "UPC");
 337         wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
 338
 339         ap->scpd_url = http_link_update(
 340                 xml_get_first_item(data, "SCPDURL"), ap->location);
 341         wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
 342
 343         ap->control_url = http_link_update(
 344                 xml_get_first_item(data, "controlURL"), ap->location);
 345         wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
 346
 347         ap->event_sub_url = http_link_update(
 348                 xml_get_first_item(data, "eventSubURL"), ap->location);
 349         wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
 350 }
 351
 352
 353 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
 354                                     enum http_client_event event)
 355 {
 356         struct wps_er_ap *ap = ctx;
 357         struct wpabuf *reply;
 358         int ok = 0;
 359
 360         switch (event) {
 361         case HTTP_CLIENT_OK:
 362                 reply = http_client_get_body(c);
 363                 if (reply == NULL)
 364                         break;
 365                 wps_er_parse_device_description(ap, reply);
 366                 ok = 1;
 367                 break;
 368         case HTTP_CLIENT_FAILED:
 369         case HTTP_CLIENT_INVALID_REPLY:
 370         case HTTP_CLIENT_TIMEOUT:
 371                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
 372                 break;
 373         }
 374         http_client_free(ap->http);
 375         ap->http = NULL;
 376         if (ok)
 377                 wps_er_get_device_info(ap);
 378 }
 379
 380
 381 void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
 382                    const char *location, int max_age)
 383 {
 384         struct wps_er_ap *ap;
 385
 386         ap = wps_er_ap_get(er, addr, uuid);
 387         if (ap) {
 388                 /* Update advertisement timeout */
 389                 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 390                 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 391                 return;
 392         }
 393
 394         ap = os_zalloc(sizeof(*ap));
 395         if (ap == NULL)
 396                 return;
 397         dl_list_init(&ap->sta);
 398         ap->er = er;
 399         ap->id = ++er->next_ap_id;
 400         ap->location = os_strdup(location);
 401         if (ap->location == NULL) {
 402                 os_free(ap);
 403                 return;
 404         }
 405         dl_list_add(&er->ap, &ap->list);
 406
 407         ap->addr.s_addr = addr->s_addr;
 408         os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
 409         eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 410
 411         wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
 412                    inet_ntoa(ap->addr), ap->location);
 413
 414         /* Fetch device description */
 415         ap->http = http_client_url(ap->location, NULL, 10000,
 416                                    wps_er_http_dev_desc_cb, ap);
 417 }
 418
 419
 420 void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
 421 {
 422         struct wps_er_ap *ap;
 423         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 424                 if (ap->addr.s_addr == addr->s_addr) {
 425                         dl_list_del(&ap->list);
 426                         wps_er_ap_free(er, ap);
 427                         return;
 428                 }
 429         }
 430 }
 431
 432
 433 static void wps_er_ap_remove_all(struct wps_er *er)
 434 {
 435         struct wps_er_ap *prev, *ap;
 436         dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
 437                 wps_er_ap_free(er, ap);
 438 }
 439
 440
 441 static void http_put_date(struct wpabuf *buf)
 442 {
 443         wpabuf_put_str(buf, "Date: ");
 444         format_date(buf);
 445         wpabuf_put_str(buf, "\r\n");
 446 }
 447
 448
 449 static void wps_er_http_resp_not_found(struct http_request *req)
 450 {
 451         struct wpabuf *buf;
 452         buf = wpabuf_alloc(200);
 453         if (buf == NULL) {
 454                 http_request_deinit(req);
 455                 return;
 456         }
 457
 458         wpabuf_put_str(buf,
 459                        "HTTP/1.1 404 Not Found\r\n"
 460                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 461                        "Connection: close\r\n");
 462         http_put_date(buf);
 463         wpabuf_put_str(buf, "\r\n");
 464         http_request_send_and_deinit(req, buf);
 465 }
 466
 467
 468 static void wps_er_http_resp_ok(struct http_request *req)
 469 {
 470         struct wpabuf *buf;
 471         buf = wpabuf_alloc(200);
 472         if (buf == NULL) {
 473                 http_request_deinit(req);
 474                 return;
 475         }
 476
 477         wpabuf_put_str(buf,
 478                        "HTTP/1.1 200 OK\r\n"
 479                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 480                        "Connection: close\r\n"
 481                        "Content-Length: 0\r\n");
 482         http_put_date(buf);
 483         wpabuf_put_str(buf, "\r\n");
 484         http_request_send_and_deinit(req, buf);
 485 }
 486
 487
 488 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
 489 {
 490         struct wps_er_sta *sta = eloop_data;
 491         wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
 492         dl_list_del(&sta->list);
 493         wps_er_sta_free(sta);
 494 }
 495
 496
 497 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
 498                                                const u8 *addr,
 499                                                struct wps_parse_attr *attr,
 500                                                int probe_req)
 501 {
 502         struct wps_er_sta *sta = wps_er_sta_get(ap, addr);
 503         int new_sta = 0;
 504         int m1;
 505
 506         m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
 507
 508         if (sta == NULL) {
 509                 /*
 510                  * Only allow new STA entry to be added based on Probe Request
 511                  * or M1. This will filter out bogus events and anything that
 512                  * may have been ongoing at the time ER subscribed for events.
 513                  */
 514                 if (!probe_req && !m1)
 515                         return NULL;
 516
 517                 sta = os_zalloc(sizeof(*sta));
 518                 if (sta == NULL)
 519                         return NULL;
 520                 os_memcpy(sta->addr, addr, ETH_ALEN);
 521                 sta->ap = ap;
 522                 dl_list_add(&ap->sta, &sta->list);
 523                 new_sta = 1;
 524         }
 525
 526         if (m1)
 527                 sta->m1_received = 1;
 528
 529         if (attr->config_methods && (!probe_req || !sta->m1_received))
 530                 sta->config_methods = WPA_GET_BE16(attr->config_methods);
 531         if (attr->uuid_e && (!probe_req || !sta->m1_received))
 532                 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
 533         if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
 534                 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
 535         if (attr->dev_password_id && (!probe_req || !sta->m1_received))
 536                 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
 537
 538         if (attr->manufacturer) {
 539                 os_free(sta->manufacturer);
 540                 sta->manufacturer = os_malloc(attr->manufacturer_len + 1);
 541                 if (sta->manufacturer) {
 542                         os_memcpy(sta->manufacturer, attr->manufacturer,
 543                                   attr->manufacturer_len);
 544                         sta->manufacturer[attr->manufacturer_len] = '\0';
 545                 }
 546         }
 547
 548         if (attr->model_name) {
 549                 os_free(sta->model_name);
 550                 sta->model_name = os_malloc(attr->model_name_len + 1);
 551                 if (sta->model_name) {
 552                         os_memcpy(sta->model_name, attr->model_name,
 553                                   attr->model_name_len);
 554                         sta->model_name[attr->model_name_len] = '\0';
 555                 }
 556         }
 557
 558         if (attr->model_number) {
 559                 os_free(sta->model_number);
 560                 sta->model_number = os_malloc(attr->model_number_len + 1);
 561                 if (sta->model_number) {
 562                         os_memcpy(sta->model_number, attr->model_number,
 563                                   attr->model_number_len);
 564                         sta->model_number[attr->model_number_len] = '\0';
 565                 }
 566         }
 567
 568         if (attr->serial_number) {
 569                 os_free(sta->serial_number);
 570                 sta->serial_number = os_malloc(attr->serial_number_len + 1);
 571                 if (sta->serial_number) {
 572                         os_memcpy(sta->serial_number, attr->serial_number,
 573                                   attr->serial_number_len);
 574                         sta->serial_number[attr->serial_number_len] = '\0';
 575                 }
 576         }
 577
 578         if (attr->dev_name) {
 579                 os_free(sta->dev_name);
 580                 sta->dev_name = os_malloc(attr->dev_name_len + 1);
 581                 if (sta->dev_name) {
 582                         os_memcpy(sta->dev_name, attr->dev_name,
 583                                   attr->dev_name_len);
 584                         sta->dev_name[attr->dev_name_len] = '\0';
 585                 }
 586         }
 587
 588         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 589         eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
 590
 591         if (m1 || new_sta)
 592                 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
 593
 594         return sta;
 595 }
 596
 597
 598 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
 599                                                const u8 *addr,
 600                                                struct wpabuf *msg)
 601 {
 602         struct wps_parse_attr attr;
 603
 604         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
 605                    MACSTR, MAC2STR(addr));
 606         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 607                         "(TLVs from Probe Request)", msg);
 608
 609         if (wps_parse_msg(msg, &attr) < 0) {
 610                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 611                            "WLANEvent message");
 612                 return;
 613         }
 614
 615         wps_er_add_sta_data(ap, addr, &attr, 1);
 616 }
 617
 618
 619 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
 620                                              enum http_client_event event)
 621 {
 622         struct wps_er_sta *sta = ctx;
 623
 624         switch (event) {
 625         case HTTP_CLIENT_OK:
 626                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
 627                 break;
 628         case HTTP_CLIENT_FAILED:
 629         case HTTP_CLIENT_INVALID_REPLY:
 630         case HTTP_CLIENT_TIMEOUT:
 631                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
 632                 break;
 633         }
 634         http_client_free(sta->http);
 635         sta->http = NULL;
 636 }
 637
 638
 639 static const char *soap_prefix =
 640         "<?xml version=\"1.0\"?>\n"
 641         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 642         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
 643         "<s:Body>\n";
 644 static const char *soap_postfix =
 645         "</s:Body>\n</s:Envelope>\n";
 646 static const char *urn_wfawlanconfig =
 647         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
 648
 649 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
 650                                        const char *name, const char *arg_name,
 651                                        const char *path,
 652                                        const struct sockaddr_in *dst,
 653                                        char **len_ptr, char **body_ptr)
 654 {
 655         unsigned char *encoded;
 656         size_t encoded_len;
 657         struct wpabuf *buf;
 658
 659         if (msg) {
 660                 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
 661                                         &encoded_len);
 662                 if (encoded == NULL)
 663                         return NULL;
 664         } else {
 665                 encoded = NULL;
 666                 encoded_len = 0;
 667         }
 668
 669         buf = wpabuf_alloc(1000 + encoded_len);
 670         if (buf == NULL) {
 671                 os_free(encoded);
 672                 return NULL;
 673         }
 674
 675         wpabuf_printf(buf,
 676                       "POST %s HTTP/1.1\r\n"
 677                       "Host: %s:%d\r\n"
 678                       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
 679                       "Content-Length: ",
 680                       path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
 681
 682         *len_ptr = wpabuf_put(buf, 0);
 683         wpabuf_printf(buf,
 684                       "        \r\n"
 685                       "SOAPACTION: \"%s#%s\"\r\n"
 686                       "\r\n",
 687                       urn_wfawlanconfig, name);
 688
 689         *body_ptr = wpabuf_put(buf, 0);
 690
 691         wpabuf_put_str(buf, soap_prefix);
 692         wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
 693         wpabuf_put_str(buf, urn_wfawlanconfig);
 694         wpabuf_put_str(buf, "\">\n");
 695         if (encoded) {
 696                 wpabuf_printf(buf, "<%s>%s</%s>\n",
 697                               arg_name, (char *) encoded, arg_name);
 698                 os_free(encoded);
 699         }
 700
 701         return buf;
 702 }
 703
 704
 705 static void wps_er_soap_end(struct wpabuf *buf, const char *name,
 706                             char *len_ptr, char *body_ptr)
 707 {
 708         char len_buf[10];
 709         wpabuf_printf(buf, "</u:%s>\n", name);
 710         wpabuf_put_str(buf, soap_postfix);
 711         os_snprintf(len_buf, sizeof(len_buf), "%d",
 712                     (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
 713         os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
 714 }
 715
 716
 717 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
 718 {
 719         struct wpabuf *buf;
 720         char *len_ptr, *body_ptr;
 721         struct sockaddr_in dst;
 722         char *url, *path;
 723
 724         if (sta->http) {
 725                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
 726                            "ignore new request");
 727                 wpabuf_free(msg);
 728                 return;
 729         }
 730
 731         if (sta->ap->control_url == NULL) {
 732                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
 733                 wpabuf_free(msg);
 734                 return;
 735         }
 736
 737         url = http_client_url_parse(sta->ap->control_url, &dst, &path);
 738         if (url == NULL) {
 739                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
 740                 wpabuf_free(msg);
 741                 return;
 742         }
 743
 744         buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
 745                               &len_ptr, &body_ptr);
 746         wpabuf_free(msg);
 747         os_free(url);
 748         if (buf == NULL)
 749                 return;
 750         wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
 751                       UPNP_WPS_WLANEVENT_TYPE_EAP);
 752         wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
 753                       MAC2STR(sta->addr));
 754
 755         wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
 756
 757         sta->http = http_client_addr(&dst, buf, 1000,
 758                                      wps_er_http_put_wlan_response_cb, sta);
 759         if (sta->http == NULL)
 760                 wpabuf_free(buf);
 761 }
 762
 763
 764 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
 765                                enum wsc_op_code op_code)
 766 {
 767         enum wps_process_res res;
 768
 769         res = wps_process_msg(sta->wps, op_code, msg);
 770         if (res == WPS_CONTINUE) {
 771                 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
 772                 if (next)
 773                         wps_er_sta_send_msg(sta, next);
 774         } else {
 775                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
 776                            "enrollee (res=%d)",
 777                            res == WPS_DONE ? "succeeded" : "failed", res);
 778                 wps_deinit(sta->wps);
 779                 sta->wps = NULL;
 780                 if (res == WPS_DONE) {
 781                         /* Remove the STA entry after short timeout */
 782                         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 783                         eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
 784                                                NULL);
 785                 }
 786         }
 787 }
 788
 789
 790 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
 791 {
 792         struct wps_config cfg;
 793
 794         if (sta->wps)
 795                 wps_deinit(sta->wps);
 796
 797         os_memset(&cfg, 0, sizeof(cfg));
 798         cfg.wps = sta->ap->er->wps;
 799         cfg.registrar = 1;
 800         cfg.peer_addr = sta->addr;
 801
 802         sta->wps = wps_init(&cfg);
 803         if (sta->wps == NULL)
 804                 return;
 805         sta->wps->er = 1;
 806         sta->wps->use_cred = sta->ap->ap_settings;
 807
 808         wps_er_sta_process(sta, msg, WSC_MSG);
 809 }
 810
 811
 812 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
 813                                          struct wpabuf *msg)
 814 {
 815         struct wps_parse_attr attr;
 816         struct wps_er_sta *sta;
 817
 818         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
 819                    MAC2STR(addr));
 820         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 821                         "(TLVs from EAP-WSC)", msg);
 822
 823         if (wps_parse_msg(msg, &attr) < 0) {
 824                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 825                            "WLANEvent message");
 826                 return;
 827         }
 828
 829         sta = wps_er_add_sta_data(ap, addr, &attr, 0);
 830         if (sta == NULL)
 831                 return;
 832
 833         if (attr.msg_type && *attr.msg_type == WPS_M1)
 834                 wps_er_sta_start(sta, msg);
 835         else if (sta->wps) {
 836                 enum wsc_op_code op_code = WSC_MSG;
 837                 if (attr.msg_type) {
 838                         switch (*attr.msg_type) {
 839                         case WPS_WSC_ACK:
 840                                 op_code = WSC_ACK;
 841                                 break;
 842                         case WPS_WSC_NACK:
 843                                 op_code = WSC_NACK;
 844                                 break;
 845                         case WPS_WSC_DONE:
 846                                 op_code = WSC_Done;
 847                                 break;
 848                         }
 849                 }
 850                 wps_er_sta_process(sta, msg, op_code);
 851         }
 852 }
 853
 854
 855 static void wps_er_process_wlanevent(struct wps_er_ap *ap,
 856                                      struct wpabuf *event)
 857 {
 858         u8 *data;
 859         u8 wlan_event_type;
 860         u8 wlan_event_mac[ETH_ALEN];
 861         struct wpabuf msg;
 862
 863         wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
 864                     wpabuf_head(event), wpabuf_len(event));
 865         if (wpabuf_len(event) < 1 + 17) {
 866                 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
 867                 return;
 868         }
 869
 870         data = wpabuf_mhead(event);
 871         wlan_event_type = data[0];
 872         if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
 873                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
 874                            "WLANEvent");
 875                 return;
 876         }
 877
 878         wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
 879
 880         switch (wlan_event_type) {
 881         case 1:
 882                 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
 883                 break;
 884         case 2:
 885                 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
 886                 break;
 887         default:
 888                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
 889                            wlan_event_type);
 890                 break;
 891         }
 892 }
 893
 894
 895 static void wps_er_http_event(struct wps_er *er, struct http_request *req,
 896                               unsigned int ap_id)
 897 {
 898         struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
 899         struct wpabuf *event;
 900         enum http_reply_code ret;
 901
 902         if (ap == NULL) {
 903                 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
 904                            "%u", ap_id);
 905                 wps_er_http_resp_not_found(req);
 906                 return;
 907         }
 908         wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
 909                    ap_id, http_request_get_data(req));
 910
 911         event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
 912                                     &ret);
 913         if (event == NULL) {
 914                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
 915                            "from the event notification");
 916                 /*
 917                  * Reply with OK anyway to avoid getting unregistered from
 918                  * events.
 919                  */
 920                 wps_er_http_resp_ok(req);
 921                 return;
 922         }
 923
 924         wps_er_process_wlanevent(ap, event);
 925
 926         wpabuf_free(event);
 927         wps_er_http_resp_ok(req);
 928 }
 929
 930
 931 static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
 932 {
 933         char *uri = http_request_get_uri(req);
 934
 935         if (os_strncmp(uri, "/event/", 7) == 0) {
 936                 unsigned int event_id;
 937                 char *pos;
 938                 event_id = atoi(uri + 7);
 939                 if (event_id != er->event_id) {
 940                         wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
 941                                    "unknown event id %u", event_id);
 942                         return;
 943                 }
 944                 pos = os_strchr(uri + 7, '/');
 945                 if (pos == NULL)
 946                         return;
 947                 pos++;
 948                 wps_er_http_event(er, req, atoi(pos));
 949         } else {
 950                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
 951                            uri);
 952                 wps_er_http_resp_not_found(req);
 953         }
 954 }
 955
 956
 957 static void wps_er_http_req(void *ctx, struct http_request *req)
 958 {
 959         struct wps_er *er = ctx;
 960         struct sockaddr_in *cli = http_request_get_cli_addr(req);
 961         enum httpread_hdr_type type = http_request_get_type(req);
 962         struct wpabuf *buf;
 963
 964         wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
 965                    "%s:%d",
 966                    http_request_get_uri(req), type,
 967                    inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
 968
 969         switch (type) {
 970         case HTTPREAD_HDR_TYPE_NOTIFY:
 971                 wps_er_http_notify(er, req);
 972                 break;
 973         default:
 974                 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
 975                            "%d", type);
 976                 buf = wpabuf_alloc(200);
 977                 if (buf == NULL) {
 978                         http_request_deinit(req);
 979                         return;
 980                 }
 981                 wpabuf_put_str(buf,
 982                                "HTTP/1.1 501 Unimplemented\r\n"
 983                                "Connection: close\r\n");
 984                 http_put_date(buf);
 985                 wpabuf_put_str(buf, "\r\n");
 986                 http_request_send_and_deinit(req, buf);
 987                 break;
 988         }
 989 }
 990
 991
 992 struct wps_er *
 993 wps_er_init(struct wps_context *wps, const char *ifname)
 994 {
 995         struct wps_er *er;
 996         struct in_addr addr;
 997
 998         er = os_zalloc(sizeof(*er));
 999         if (er == NULL)
1000                 return NULL;
1001         dl_list_init(&er->ap);
1002
1003         er->multicast_sd = -1;
1004         er->ssdp_sd = -1;
1005
1006         os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1007         er->wps = wps;
1008         os_get_random((unsigned char *) &er->event_id, sizeof(er->event_id));
1009
1010         if (get_netif_info(ifname,
1011                            &er->ip_addr, &er->ip_addr_text,
1012                            er->mac_addr, &er->mac_addr_text)) {
1013                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1014                            "for %s. Does it have IP address?", ifname);
1015                 wps_er_deinit(er);
1016                 return NULL;
1017         }
1018
1019         if (wps_er_ssdp_init(er) < 0) {
1020                 wps_er_deinit(er);
1021                 return NULL;
1022         }
1023
1024         addr.s_addr = er->ip_addr;
1025         er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1026         if (er->http_srv == NULL) {
1027                 wps_er_deinit(er);
1028                 return NULL;
1029         }
1030         er->http_port = http_server_get_port(er->http_srv);
1031
1032         wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s "
1033                    "mac_addr=%s)",
1034                    er->ifname, er->ip_addr_text, er->mac_addr_text);
1035
1036         return er;
1037 }
1038
1039
1040 void wps_er_refresh(struct wps_er *er)
1041 {
1042         struct wps_er_ap *ap;
1043         struct wps_er_sta *sta;
1044
1045         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1046                 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
1047                 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
1048                         wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
1049         }
1050
1051         wps_er_send_ssdp_msearch(er);
1052 }
1053
1054
1055 void wps_er_deinit(struct wps_er *er)
1056 {
1057         if (er == NULL)
1058                 return;
1059         http_server_deinit(er->http_srv);
1060         wps_er_ap_remove_all(er);
1061         wps_er_ssdp_deinit(er);
1062         os_free(er->ip_addr_text);
1063         os_free(er->mac_addr_text);
1064         os_free(er);
1065 }
1066
1067
1068 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1069                                        enum http_client_event event)
1070 {
1071         struct wps_er_ap *ap = ctx;
1072
1073         switch (event) {
1074         case HTTP_CLIENT_OK:
1075                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1076                 break;
1077         case HTTP_CLIENT_FAILED:
1078         case HTTP_CLIENT_INVALID_REPLY:
1079         case HTTP_CLIENT_TIMEOUT:
1080                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1081                 break;
1082         }
1083         http_client_free(ap->http);
1084         ap->http = NULL;
1085 }
1086
1087
1088 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1089 {
1090         struct wpabuf *buf;
1091         char *len_ptr, *body_ptr;
1092         struct sockaddr_in dst;
1093         char *url, *path;
1094
1095         if (ap->control_url == NULL) {
1096                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1097                 return;
1098         }
1099
1100         if (ap->http) {
1101                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1102                            "ignore new request");
1103                 return;
1104         }
1105
1106         url = http_client_url_parse(ap->control_url, &dst, &path);
1107         if (url == NULL) {
1108                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1109                 return;
1110         }
1111
1112         buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1113                               &dst, &len_ptr, &body_ptr);
1114         os_free(url);
1115         if (buf == NULL)
1116                 return;
1117
1118         wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1119
1120         ap->http = http_client_addr(&dst, buf, 1000,
1121                                     wps_er_http_set_sel_reg_cb, ap);
1122         if (ap->http == NULL)
1123                 wpabuf_free(buf);
1124 }
1125
1126
1127 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1128 {
1129         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1130         wpabuf_put_be16(msg, 1);
1131         wpabuf_put_u8(msg, !!sel_reg);
1132         return 0;
1133 }
1134
1135
1136 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1137 {
1138         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1139         wpabuf_put_be16(msg, 2);
1140         wpabuf_put_be16(msg, dev_passwd_id);
1141         return 0;
1142 }
1143
1144
1145 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1146                                                u16 sel_reg_config_methods)
1147 {
1148         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1149         wpabuf_put_be16(msg, 2);
1150         wpabuf_put_be16(msg, sel_reg_config_methods);
1151         return 0;
1152 }
1153
1154
1155 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1156                         u16 sel_reg_config_methods)
1157 {
1158         struct wpabuf *msg;
1159         struct wps_er_ap *ap;
1160
1161         msg = wpabuf_alloc(500);
1162         if (msg == NULL)
1163                 return;
1164
1165         if (wps_build_version(msg) ||
1166             wps_er_build_selected_registrar(msg, sel_reg) ||
1167             wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1168             wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods)) {
1169                 wpabuf_free(msg);
1170                 return;
1171         }
1172
1173         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list)
1174                 wps_er_send_set_sel_reg(ap, msg);
1175
1176         wpabuf_free(msg);
1177 }
1178
1179
1180 int wps_er_pbc(struct wps_er *er, const u8 *uuid)
1181 {
1182         if (er == NULL || er->wps == NULL)
1183                 return -1;
1184
1185         /*
1186          * TODO: Should enable PBC mode only in a single AP based on which AP
1187          * the Enrollee (uuid) is using. Now, we may end up enabling multiple
1188          * APs in PBC mode which could result in session overlap at the
1189          * Enrollee.
1190          */
1191         if (wps_registrar_button_pushed(er->wps->registrar))
1192                 return -1;
1193
1194         return 0;
1195 }
1196
1197
1198 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1199 {
1200         struct wps_er_ap *ap = ctx;
1201         wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1202         os_free(ap->ap_settings);
1203         ap->ap_settings = os_malloc(sizeof(*cred));
1204         if (ap->ap_settings) {
1205                 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1206                 ap->ap_settings->cred_attr = NULL;
1207         }
1208
1209         /* TODO: send info through ctrl_iface */
1210 }
1211
1212
1213 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1214                                        enum http_client_event event)
1215 {
1216         struct wps_er_ap *ap = ctx;
1217         struct wpabuf *reply;
1218         char *msg = NULL;
1219
1220         switch (event) {
1221         case HTTP_CLIENT_OK:
1222                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1223                 reply = http_client_get_body(c);
1224                 if (reply == NULL)
1225                         break;
1226                 msg = os_zalloc(wpabuf_len(reply) + 1);
1227                 if (msg == NULL)
1228                         break;
1229                 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1230                 break;
1231         case HTTP_CLIENT_FAILED:
1232         case HTTP_CLIENT_INVALID_REPLY:
1233         case HTTP_CLIENT_TIMEOUT:
1234                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1235                 if (ap->wps) {
1236                         wps_deinit(ap->wps);
1237                         ap->wps = NULL;
1238                 }
1239                 break;
1240         }
1241         http_client_free(ap->http);
1242         ap->http = NULL;
1243
1244         if (msg) {
1245                 struct wpabuf *buf;
1246                 enum http_reply_code ret;
1247                 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1248                 os_free(msg);
1249                 if (buf == NULL) {
1250                         wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1251                                    "NewOutMessage from PutMessage response");
1252                         return;
1253                 }
1254                 wps_er_ap_process(ap, buf);
1255                 wpabuf_free(buf);
1256         }
1257 }
1258
1259
1260 static void wps_er_ap_put_message(struct wps_er_ap *ap,
1261                                   const struct wpabuf *msg)
1262 {
1263         struct wpabuf *buf;
1264         char *len_ptr, *body_ptr;
1265         struct sockaddr_in dst;
1266         char *url, *path;
1267
1268         if (ap->http) {
1269                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1270                            "with the AP - cannot continue learn");
1271                 return;
1272         }
1273
1274         if (ap->control_url == NULL) {
1275                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1276                 return;
1277         }
1278
1279         url = http_client_url_parse(ap->control_url, &dst, &path);
1280         if (url == NULL) {
1281                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1282                 return;
1283         }
1284
1285         buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1286                               &len_ptr, &body_ptr);
1287         os_free(url);
1288         if (buf == NULL)
1289                 return;
1290
1291         wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1292
1293         ap->http = http_client_addr(&dst, buf, 10000,
1294                                     wps_er_http_put_message_cb, ap);
1295         if (ap->http == NULL)
1296                 wpabuf_free(buf);
1297 }
1298
1299
1300 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1301 {
1302         enum wps_process_res res;
1303
1304         res = wps_process_msg(ap->wps, WSC_MSG, msg);
1305         if (res == WPS_CONTINUE) {
1306                 enum wsc_op_code op_code;
1307                 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1308                 if (next) {
1309                         wps_er_ap_put_message(ap, next);
1310                         wpabuf_free(next);
1311                 } else {
1312                         wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1313                                    "message");
1314                         wps_deinit(ap->wps);
1315                         ap->wps = NULL;
1316                 }
1317         } else {
1318                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1319                            "AP (res=%d)", res);
1320                 wps_deinit(ap->wps);
1321                 ap->wps = NULL;
1322         }
1323 }
1324
1325
1326 static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1327 {
1328         struct wps_config cfg;
1329
1330         if (ap->wps) {
1331                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1332                            "progress with this AP");
1333                 return;
1334         }
1335
1336         os_memset(&cfg, 0, sizeof(cfg));
1337         cfg.wps = ap->er->wps;
1338         cfg.registrar = 1;
1339         ap->wps = wps_init(&cfg);
1340         if (ap->wps == NULL)
1341                 return;
1342         ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1343         ap->wps->ap_settings_cb_ctx = ap;
1344
1345         wps_er_ap_process(ap, m1);
1346 }
1347
1348
1349 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1350 {
1351         struct wpabuf *info;
1352         enum http_reply_code ret;
1353
1354         wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1355                    "from the AP");
1356         info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1357         if (info == NULL) {
1358                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1359                            "NewDeviceInfo from GetDeviceInfo response");
1360                 return;
1361         }
1362
1363         ap->m1_handler(ap, info);
1364         wpabuf_free(info);
1365 }
1366
1367
1368 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1369                                         enum http_client_event event)
1370 {
1371         struct wps_er_ap *ap = ctx;
1372         struct wpabuf *reply;
1373         char *dev_info = NULL;
1374
1375         switch (event) {
1376         case HTTP_CLIENT_OK:
1377                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1378                 reply = http_client_get_body(c);
1379                 if (reply == NULL)
1380                         break;
1381                 dev_info = os_zalloc(wpabuf_len(reply) + 1);
1382                 if (dev_info == NULL)
1383                         break;
1384                 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1385                 break;
1386         case HTTP_CLIENT_FAILED:
1387         case HTTP_CLIENT_INVALID_REPLY:
1388         case HTTP_CLIENT_TIMEOUT:
1389                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1390                 break;
1391         }
1392         http_client_free(ap->http);
1393         ap->http = NULL;
1394
1395         if (dev_info) {
1396                 wps_er_ap_learn(ap, dev_info);
1397                 os_free(dev_info);
1398         }
1399 }
1400
1401
1402 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
1403                                        void (*m1_handler)(struct wps_er_ap *ap,
1404                                                           struct wpabuf *m1))
1405 {
1406         struct wpabuf *buf;
1407         char *len_ptr, *body_ptr;
1408         struct sockaddr_in dst;
1409         char *url, *path;
1410
1411         if (ap->http) {
1412                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1413                            "with the AP - cannot get device info");
1414                 return -1;
1415         }
1416
1417         if (ap->control_url == NULL) {
1418                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1419                 return -1;
1420         }
1421
1422         url = http_client_url_parse(ap->control_url, &dst, &path);
1423         if (url == NULL) {
1424                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1425                 return -1;
1426         }
1427
1428         buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1429                               &len_ptr, &body_ptr);
1430         os_free(url);
1431         if (buf == NULL)
1432                 return -1;
1433
1434         wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1435
1436         ap->http = http_client_addr(&dst, buf, 10000,
1437                                     wps_er_http_get_dev_info_cb, ap);
1438         if (ap->http == NULL) {
1439                 wpabuf_free(buf);
1440                 return -1;
1441         }
1442
1443         ap->m1_handler = m1_handler;
1444
1445         return 0;
1446 }
1447
1448
1449 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *pin,
1450                  size_t pin_len)
1451 {
1452         struct wps_er_ap *ap;
1453
1454         if (er == NULL)
1455                 return -1;
1456
1457         ap = wps_er_ap_get(er, NULL, uuid);
1458         if (ap == NULL) {
1459                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1460                            "request");
1461                 return -1;
1462         }
1463         if (ap->wps) {
1464                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1465                            "with the AP - cannot start learn");
1466                 return -1;
1467         }
1468
1469         if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
1470                 return -1;
1471
1472         /* TODO: add PIN without SetSelectedRegistrar trigger to all APs */
1473         wps_registrar_add_pin(er->wps->registrar, uuid, pin, pin_len, 0);
1474
1475         return 0;
1476 }