src/wps/wps_er.c

   1 /*
   2  * Wi-Fi Protected Setup - External Registrar
   3  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "base64.h"
  19 #include "uuid.h"
  20 #include "eloop.h"
  21 #include "httpread.h"
  22 #include "http_client.h"
  23 #include "http_server.h"
  24 #include "upnp_xml.h"
  25 #include "wps_i.h"
  26 #include "wps_upnp.h"
  27 #include "wps_upnp_i.h"
  28
  29
  30 /* TODO:
  31  * send notification of new AP device with wpa_msg
  32  * re-send notifications with wpa_msg if ER re-started (to update wpa_gui-qt4)
  33  * (also re-send SSDP M-SEARCH in this case to find new APs)
  34  * parse UPnP event messages
  35  */
  36
  37 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
  38 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
  39
  40
  41 struct wps_er_sta {
  42         struct wps_er_sta *next;
  43         struct wps_er_ap *ap;
  44         u8 addr[ETH_ALEN];
  45         u16 config_methods;
  46         u8 uuid[WPS_UUID_LEN];
  47         u8 pri_dev_type[8];
  48         u16 dev_passwd_id;
  49         int m1_received;
  50         char *manufacturer;
  51         char *model_name;
  52         char *model_number;
  53         char *serial_number;
  54         char *dev_name;
  55         struct wps_data *wps;
  56         struct http_client *http;
  57 };
  58
  59 struct wps_er_ap {
  60         struct wps_er_ap *next;
  61         struct wps_er *er;
  62         struct wps_er_sta *sta; /* list of STAs/Enrollees using this AP */
  63         struct in_addr addr;
  64         char *location;
  65         struct http_client *http;
  66         struct wps_data *wps;
  67
  68         u8 uuid[WPS_UUID_LEN];
  69         char *friendly_name;
  70         char *manufacturer;
  71         char *manufacturer_url;
  72         char *model_description;
  73         char *model_name;
  74         char *model_number;
  75         char *model_url;
  76         char *serial_number;
  77         char *udn;
  78         char *upc;
  79
  80         char *scpd_url;
  81         char *control_url;
  82         char *event_sub_url;
  83
  84         int subscribed;
  85         unsigned int id;
  86
  87         struct wps_credential *ap_settings;
  88 };
  89
  90 struct wps_er {
  91         struct wps_context *wps;
  92         char ifname[17];
  93         char *mac_addr_text; /* mac addr of network i.f. we use */
  94         u8 mac_addr[ETH_ALEN]; /* mac addr of network i.f. we use */
  95         char *ip_addr_text; /* IP address of network i.f. we use */
  96         unsigned ip_addr; /* IP address of network i.f. we use (host order) */
  97         int multicast_sd;
  98         int ssdp_sd;
  99         struct wps_er_ap *ap;
 100         struct http_server *http_srv;
 101         int http_port;
 102         unsigned int next_ap_id;
 103 };
 104
 105
 106 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
 107
 108
 109 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
 110                              enum wps_event event)
 111 {
 112         union wps_event_data data;
 113         struct wps_event_er_enrollee *ev = &data.enrollee;
 114
 115         if (wps->event_cb == NULL)
 116                 return;
 117
 118         os_memset(&data, 0, sizeof(data));
 119         ev->uuid = sta->uuid;
 120         ev->mac_addr = sta->addr;
 121         ev->m1_received = sta->m1_received;
 122         ev->config_methods = sta->config_methods;
 123         ev->dev_passwd_id = sta->dev_passwd_id;
 124         ev->pri_dev_type = sta->pri_dev_type;
 125         ev->dev_name = sta->dev_name;
 126         ev->manufacturer = sta->manufacturer;
 127         ev->model_name = sta->model_name;
 128         ev->model_number = sta->model_number;
 129         ev->serial_number = sta->serial_number;
 130         wps->event_cb(wps->cb_ctx, event, &data);
 131 }
 132
 133
 134 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr)
 135 {
 136         struct wps_er_sta *sta = ap->sta;
 137         while (sta) {
 138                 if (os_memcmp(sta->addr, addr, ETH_ALEN) == 0)
 139                         return sta;
 140                 sta = sta->next;
 141         }
 142         return NULL;
 143 }
 144
 145
 146 static void wps_er_sta_free(struct wps_er_sta *sta)
 147 {
 148         wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
 149         if (sta->wps)
 150                 wps_deinit(sta->wps);
 151         os_free(sta->manufacturer);
 152         os_free(sta->model_name);
 153         os_free(sta->model_number);
 154         os_free(sta->serial_number);
 155         os_free(sta->dev_name);
 156         http_client_free(sta->http);
 157         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 158         os_free(sta);
 159 }
 160
 161
 162 static void wps_er_sta_remove_all(struct wps_er_ap *ap)
 163 {
 164         struct wps_er_sta *prev, *sta;
 165
 166         sta = ap->sta;
 167         ap->sta = NULL;
 168
 169         while (sta) {
 170                 prev = sta;
 171                 sta = sta->next;
 172                 wps_er_sta_free(prev);
 173         }
 174 }
 175
 176
 177 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
 178                                         struct in_addr *addr)
 179 {
 180         struct wps_er_ap *ap;
 181         for (ap = er->ap; ap; ap = ap->next) {
 182                 if (ap->addr.s_addr == addr->s_addr)
 183                         break;
 184         }
 185         return ap;
 186 }
 187
 188
 189 static struct wps_er_ap * wps_er_ap_get_uuid(struct wps_er *er, const u8 *uuid)
 190 {
 191         struct wps_er_ap *ap;
 192         for (ap = er->ap; ap; ap = ap->next) {
 193                 if (os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0)
 194                         break;
 195         }
 196         return ap;
 197 }
 198
 199
 200 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
 201 {
 202         struct wps_er_ap *ap;
 203         for (ap = er->ap; ap; ap = ap->next) {
 204                 if (ap->id == id)
 205                         break;
 206         }
 207         return ap;
 208 }
 209
 210
 211 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
 212                             enum wps_event event)
 213 {
 214         union wps_event_data data;
 215         struct wps_event_er_ap *evap = &data.ap;
 216
 217         if (wps->event_cb == NULL)
 218                 return;
 219
 220         os_memset(&data, 0, sizeof(data));
 221         evap->uuid = ap->uuid;
 222         evap->friendly_name = ap->friendly_name;
 223         evap->manufacturer = ap->manufacturer;
 224         evap->manufacturer_url = ap->manufacturer_url;
 225         evap->model_description = ap->model_description;
 226         evap->model_name = ap->model_name;
 227         evap->model_number = ap->model_number;
 228         evap->model_url = ap->model_url;
 229         evap->serial_number = ap->serial_number;
 230         evap->upc = ap->upc;
 231         wps->event_cb(wps->cb_ctx, event, &data);
 232 }
 233
 234
 235 static void wps_er_ap_free(struct wps_er *er, struct wps_er_ap *ap)
 236 {
 237         /* TODO: if ap->subscribed, unsubscribe from events if the AP is still
 238          * alive */
 239         wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
 240                    inet_ntoa(ap->addr), ap->location);
 241         eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 242         wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
 243         os_free(ap->location);
 244         http_client_free(ap->http);
 245         if (ap->wps)
 246                 wps_deinit(ap->wps);
 247
 248         os_free(ap->friendly_name);
 249         os_free(ap->manufacturer);
 250         os_free(ap->manufacturer_url);
 251         os_free(ap->model_description);
 252         os_free(ap->model_name);
 253         os_free(ap->model_number);
 254         os_free(ap->model_url);
 255         os_free(ap->serial_number);
 256         os_free(ap->udn);
 257         os_free(ap->upc);
 258
 259         os_free(ap->scpd_url);
 260         os_free(ap->control_url);
 261         os_free(ap->event_sub_url);
 262
 263         os_free(ap->ap_settings);
 264
 265         wps_er_sta_remove_all(ap);
 266
 267         os_free(ap);
 268 }
 269
 270
 271 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
 272 {
 273         struct wps_er *er = eloop_data;
 274         struct wps_er_ap *ap = user_ctx;
 275         wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
 276         wps_er_ap_free(er, ap);
 277 }
 278
 279
 280 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
 281                                      enum http_client_event event)
 282 {
 283         struct wps_er_ap *ap = ctx;
 284
 285         switch (event) {
 286         case HTTP_CLIENT_OK:
 287                 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
 288                 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
 289                 break;
 290         case HTTP_CLIENT_FAILED:
 291         case HTTP_CLIENT_INVALID_REPLY:
 292         case HTTP_CLIENT_TIMEOUT:
 293                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
 294                 break;
 295         }
 296         http_client_free(ap->http);
 297         ap->http = NULL;
 298 }
 299
 300
 301 static void wps_er_subscribe(struct wps_er_ap *ap)
 302 {
 303         struct wpabuf *req;
 304         struct sockaddr_in dst;
 305         char *url, *path;
 306
 307         if (ap->event_sub_url == NULL) {
 308                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 309                            "subscribe");
 310                 return;
 311         }
 312         if (ap->http) {
 313                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 314                            "send subscribe request");
 315                 return;
 316         }
 317
 318         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 319         if (url == NULL) {
 320                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 321                 return;
 322         }
 323
 324         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 325         if (req == NULL) {
 326                 os_free(url);
 327                 return;
 328         }
 329         wpabuf_printf(req,
 330                       "SUBSCRIBE %s HTTP/1.1\r\n"
 331                       "HOST: %s:%d\r\n"
 332                       "CALLBACK: <http://%s:%d/event/%d>\r\n"
 333                       "NT: upnp:event\r\n"
 334                       "TIMEOUT: Second-%d\r\n"
 335                       "\r\n",
 336                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
 337                       ap->er->ip_addr_text, ap->er->http_port, ap->id, 1800);
 338         os_free(url);
 339         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
 340                           wpabuf_head(req), wpabuf_len(req));
 341
 342         ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
 343                                     ap);
 344         if (ap->http == NULL)
 345                 wpabuf_free(req);
 346 }
 347
 348
 349 static void wps_er_parse_device_description(struct wps_er_ap *ap,
 350                                             struct wpabuf *reply)
 351 {
 352         /* Note: reply includes null termination after the buffer data */
 353         const char *data = wpabuf_head(reply);
 354         char *pos;
 355
 356         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
 357                           wpabuf_head(reply), wpabuf_len(reply));
 358
 359         ap->friendly_name = xml_get_first_item(data, "friendlyName");
 360         wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
 361
 362         ap->manufacturer = xml_get_first_item(data, "manufacturer");
 363         wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
 364
 365         ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
 366         wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
 367                    ap->manufacturer_url);
 368
 369         ap->model_description = xml_get_first_item(data, "modelDescription");
 370         wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
 371                    ap->model_description);
 372
 373         ap->model_name = xml_get_first_item(data, "modelName");
 374         wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
 375
 376         ap->model_number = xml_get_first_item(data, "modelNumber");
 377         wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
 378
 379         ap->model_url = xml_get_first_item(data, "modelURL");
 380         wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
 381
 382         ap->serial_number = xml_get_first_item(data, "serialNumber");
 383         wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
 384
 385         ap->udn = xml_get_first_item(data, "UDN");
 386         wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
 387         pos = os_strstr(ap->udn, "uuid:");
 388         if (pos) {
 389                 pos += 5;
 390                 uuid_str2bin(pos, ap->uuid);
 391         }
 392
 393         ap->upc = xml_get_first_item(data, "UPC");
 394         wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
 395
 396         ap->scpd_url = http_link_update(
 397                 xml_get_first_item(data, "SCPDURL"), ap->location);
 398         wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
 399
 400         ap->control_url = http_link_update(
 401                 xml_get_first_item(data, "controlURL"), ap->location);
 402         wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
 403
 404         ap->event_sub_url = http_link_update(
 405                 xml_get_first_item(data, "eventSubURL"), ap->location);
 406         wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
 407 }
 408
 409
 410 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
 411                                     enum http_client_event event)
 412 {
 413         struct wps_er_ap *ap = ctx;
 414         struct wpabuf *reply;
 415         int subscribe = 0;
 416
 417         switch (event) {
 418         case HTTP_CLIENT_OK:
 419                 reply = http_client_get_body(c);
 420                 if (reply == NULL)
 421                         break;
 422                 wps_er_parse_device_description(ap, reply);
 423                 subscribe = 1;
 424                 break;
 425         case HTTP_CLIENT_FAILED:
 426         case HTTP_CLIENT_INVALID_REPLY:
 427         case HTTP_CLIENT_TIMEOUT:
 428                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
 429                 break;
 430         }
 431         http_client_free(ap->http);
 432         ap->http = NULL;
 433         if (subscribe)
 434                 wps_er_subscribe(ap);
 435 }
 436
 437
 438 static void wps_er_ap_add(struct wps_er *er, struct in_addr *addr,
 439                           const char *location, int max_age)
 440 {
 441         struct wps_er_ap *ap;
 442
 443         ap = wps_er_ap_get(er, addr);
 444         if (ap) {
 445                 /* Update advertisement timeout */
 446                 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 447                 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 448                 return;
 449         }
 450
 451         ap = os_zalloc(sizeof(*ap));
 452         if (ap == NULL)
 453                 return;
 454         ap->er = er;
 455         ap->id = ++er->next_ap_id;
 456         ap->location = os_strdup(location);
 457         if (ap->location == NULL) {
 458                 os_free(ap);
 459                 return;
 460         }
 461         ap->next = er->ap;
 462         er->ap = ap;
 463
 464         ap->addr.s_addr = addr->s_addr;
 465         eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 466
 467         wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
 468                    inet_ntoa(ap->addr), ap->location);
 469
 470         /* Fetch device description */
 471         ap->http = http_client_url(ap->location, NULL, 10000,
 472                                    wps_er_http_dev_desc_cb, ap);
 473 }
 474
 475
 476 static void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
 477 {
 478         struct wps_er_ap *prev = NULL, *ap = er->ap;
 479
 480         while (ap) {
 481                 if (ap->addr.s_addr == addr->s_addr) {
 482                         if (prev)
 483                                 prev->next = ap->next;
 484                         else
 485                                 er->ap = ap->next;
 486                         wps_er_ap_free(er, ap);
 487                         return;
 488                 }
 489                 prev = ap;
 490                 ap = ap->next;
 491         }
 492 }
 493
 494
 495 static void wps_er_ap_remove_all(struct wps_er *er)
 496 {
 497         struct wps_er_ap *prev, *ap;
 498
 499         ap = er->ap;
 500         er->ap = NULL;
 501
 502         while (ap) {
 503                 prev = ap;
 504                 ap = ap->next;
 505                 wps_er_ap_free(er, prev);
 506         }
 507 }
 508
 509
 510 static void wps_er_ssdp_rx(int sd, void *eloop_ctx, void *sock_ctx)
 511 {
 512         struct wps_er *er = eloop_ctx;
 513         struct sockaddr_in addr; /* client address */
 514         socklen_t addr_len;
 515         int nread;
 516         char buf[MULTICAST_MAX_READ], *pos, *pos2, *start;
 517         int wfa = 0, byebye = 0;
 518         int max_age = -1;
 519         char *location = NULL;
 520
 521         addr_len = sizeof(addr);
 522         nread = recvfrom(sd, buf, sizeof(buf) - 1, 0,
 523                          (struct sockaddr *) &addr, &addr_len);
 524         if (nread <= 0)
 525                 return;
 526         buf[nread] = '\0';
 527
 528         wpa_printf(MSG_DEBUG, "WPS ER: Received SSDP from %s",
 529                    inet_ntoa(addr.sin_addr));
 530         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Received SSDP contents",
 531                           (u8 *) buf, nread);
 532
 533         if (sd == er->multicast_sd) {
 534                 /* Reply to M-SEARCH */
 535                 if (os_strncmp(buf, "HTTP/1.1 200 OK", 15) != 0)
 536                         return; /* unexpected response header */
 537         } else {
 538                 /* Unsolicited message (likely NOTIFY or M-SEARCH) */
 539                 if (os_strncmp(buf, "NOTIFY ", 7) != 0)
 540                         return; /* only process notifications */
 541         }
 542
 543         for (start = buf; start && *start; start = pos) {
 544                 pos = os_strchr(start, '\n');
 545                 if (pos) {
 546                         if (pos[-1] == '\r')
 547                                 pos[-1] = '\0';
 548                         *pos++ = '\0';
 549                 }
 550                 if (os_strstr(start, "schemas-wifialliance-org:device:"
 551                               "WFADevice:1"))
 552                         wfa = 1;
 553                 if (os_strstr(start, "schemas-wifialliance-org:service:"
 554                               "WFAWLANConfig:1"))
 555                         wfa = 1;
 556                 if (os_strncasecmp(start, "LOCATION:", 9) == 0) {
 557                         start += 9;
 558                         while (*start == ' ')
 559                                 start++;
 560                         location = start;
 561                 } else if (os_strncasecmp(start, "NTS:", 4) == 0) {
 562                         if (os_strstr(start, "ssdp:byebye"))
 563                                 byebye = 1;
 564                 } else if (os_strncasecmp(start, "CACHE-CONTROL:", 14) == 0) {
 565                         start += 9;
 566                         while (*start == ' ')
 567                                 start++;
 568                         pos2 = os_strstr(start, "max-age=");
 569                         if (pos2 == NULL)
 570                                 continue;
 571                         pos2 += 8;
 572                         max_age = atoi(pos2);
 573                 }
 574         }
 575
 576         if (!wfa)
 577                 return; /* Not WPS advertisement/reply */
 578
 579         if (byebye) {
 580                 wps_er_ap_remove(er, &addr.sin_addr);
 581                 return;
 582         }
 583
 584         if (!location)
 585                 return; /* Unknown location */
 586
 587         if (max_age < 1)
 588                 return; /* No max-age reported */
 589
 590         wpa_printf(MSG_DEBUG, "WPS ER: AP discovered: %s "
 591                    "(packet source: %s  max-age: %d)",
 592                    location, inet_ntoa(addr.sin_addr), max_age);
 593
 594         wps_er_ap_add(er, &addr.sin_addr, location, max_age);
 595 }
 596
 597
 598 static void wps_er_send_ssdp_msearch(struct wps_er *er)
 599 {
 600         struct wpabuf *msg;
 601         struct sockaddr_in dest;
 602
 603         msg = wpabuf_alloc(500);
 604         if (msg == NULL)
 605                 return;
 606
 607         wpabuf_put_str(msg,
 608                        "M-SEARCH * HTTP/1.1\r\n"
 609                        "HOST: 239.255.255.250:1900\r\n"
 610                        "MAN: \"ssdp:discover\"\r\n"
 611                        "MX: 3\r\n"
 612                        "ST: urn:schemas-wifialliance-org:device:WFADevice:1"
 613                        "\r\n"
 614                        "\r\n");
 615
 616         os_memset(&dest, 0, sizeof(dest));
 617         dest.sin_family = AF_INET;
 618         dest.sin_addr.s_addr = inet_addr(UPNP_MULTICAST_ADDRESS);
 619         dest.sin_port = htons(UPNP_MULTICAST_PORT);
 620
 621         if (sendto(er->multicast_sd, wpabuf_head(msg), wpabuf_len(msg), 0,
 622                    (struct sockaddr *) &dest, sizeof(dest)) < 0)
 623                 wpa_printf(MSG_DEBUG, "WPS ER: M-SEARCH sendto failed: "
 624                            "%d (%s)", errno, strerror(errno));
 625
 626         wpabuf_free(msg);
 627 }
 628
 629
 630 static void http_put_date(struct wpabuf *buf)
 631 {
 632         wpabuf_put_str(buf, "Date: ");
 633         format_date(buf);
 634         wpabuf_put_str(buf, "\r\n");
 635 }
 636
 637
 638 static void wps_er_http_resp_not_found(struct http_request *req)
 639 {
 640         struct wpabuf *buf;
 641         buf = wpabuf_alloc(200);
 642         if (buf == NULL) {
 643                 http_request_deinit(req);
 644                 return;
 645         }
 646
 647         wpabuf_put_str(buf,
 648                        "HTTP/1.1 404 Not Found\r\n"
 649                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 650                        "Connection: close\r\n");
 651         http_put_date(buf);
 652         wpabuf_put_str(buf, "\r\n");
 653         http_request_send_and_deinit(req, buf);
 654 }
 655
 656
 657 static void wps_er_http_resp_ok(struct http_request *req)
 658 {
 659         struct wpabuf *buf;
 660         buf = wpabuf_alloc(200);
 661         if (buf == NULL) {
 662                 http_request_deinit(req);
 663                 return;
 664         }
 665
 666         wpabuf_put_str(buf,
 667                        "HTTP/1.1 200 OK\r\n"
 668                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 669                        "Connection: close\r\n"
 670                        "Content-Length: 0\r\n");
 671         http_put_date(buf);
 672         wpabuf_put_str(buf, "\r\n");
 673         http_request_send_and_deinit(req, buf);
 674 }
 675
 676
 677 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
 678 {
 679         struct wps_er_sta *sta = eloop_data;
 680         wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
 681         wps_er_sta_free(sta);
 682 }
 683
 684
 685 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
 686                                                const u8 *addr,
 687                                                struct wps_parse_attr *attr,
 688                                                int probe_req)
 689 {
 690         struct wps_er_sta *sta = wps_er_sta_get(ap, addr);
 691         int new_sta = 0;
 692         int m1;
 693
 694         m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
 695
 696         if (sta == NULL) {
 697                 /*
 698                  * Only allow new STA entry to be added based on Probe Request
 699                  * or M1. This will filter out bogus events and anything that
 700                  * may have been ongoing at the time ER subscribed for events.
 701                  */
 702                 if (!probe_req && !m1)
 703                         return NULL;
 704
 705                 sta = os_zalloc(sizeof(*sta));
 706                 if (sta == NULL)
 707                         return NULL;
 708                 os_memcpy(sta->addr, addr, ETH_ALEN);
 709                 sta->ap = ap;
 710                 sta->next = ap->sta;
 711                 ap->sta = sta;
 712                 new_sta = 1;
 713         }
 714
 715         if (m1)
 716                 sta->m1_received = 1;
 717
 718         if (attr->config_methods && (!probe_req || !sta->m1_received))
 719                 sta->config_methods = WPA_GET_BE16(attr->config_methods);
 720         if (attr->uuid_e && (!probe_req || !sta->m1_received))
 721                 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
 722         if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
 723                 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
 724         if (attr->dev_password_id && (!probe_req || !sta->m1_received))
 725                 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
 726
 727         if (attr->manufacturer) {
 728                 os_free(sta->manufacturer);
 729                 sta->manufacturer = os_malloc(attr->manufacturer_len + 1);
 730                 if (sta->manufacturer) {
 731                         os_memcpy(sta->manufacturer, attr->manufacturer,
 732                                   attr->manufacturer_len);
 733                         sta->manufacturer[attr->manufacturer_len] = '\0';
 734                 }
 735         }
 736
 737         if (attr->model_name) {
 738                 os_free(sta->model_name);
 739                 sta->model_name = os_malloc(attr->model_name_len + 1);
 740                 if (sta->model_name) {
 741                         os_memcpy(sta->model_name, attr->model_name,
 742                                   attr->model_name_len);
 743                         sta->model_name[attr->model_name_len] = '\0';
 744                 }
 745         }
 746
 747         if (attr->model_number) {
 748                 os_free(sta->model_number);
 749                 sta->model_number = os_malloc(attr->model_number_len + 1);
 750                 if (sta->model_number) {
 751                         os_memcpy(sta->model_number, attr->model_number,
 752                                   attr->model_number_len);
 753                         sta->model_number[attr->model_number_len] = '\0';
 754                 }
 755         }
 756
 757         if (attr->serial_number) {
 758                 os_free(sta->serial_number);
 759                 sta->serial_number = os_malloc(attr->serial_number_len + 1);
 760                 if (sta->serial_number) {
 761                         os_memcpy(sta->serial_number, attr->serial_number,
 762                                   attr->serial_number_len);
 763                         sta->serial_number[attr->serial_number_len] = '\0';
 764                 }
 765         }
 766
 767         if (attr->dev_name) {
 768                 os_free(sta->dev_name);
 769                 sta->dev_name = os_malloc(attr->dev_name_len + 1);
 770                 if (sta->dev_name) {
 771                         os_memcpy(sta->dev_name, attr->dev_name,
 772                                   attr->dev_name_len);
 773                         sta->dev_name[attr->dev_name_len] = '\0';
 774                 }
 775         }
 776
 777         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 778         eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
 779
 780         if (m1 || new_sta)
 781                 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
 782
 783         return sta;
 784 }
 785
 786
 787 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
 788                                                const u8 *addr,
 789                                                struct wpabuf *msg)
 790 {
 791         struct wps_parse_attr attr;
 792
 793         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
 794                    MACSTR, MAC2STR(addr));
 795         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 796                         "(TLVs from Probe Request)", msg);
 797
 798         if (wps_parse_msg(msg, &attr) < 0) {
 799                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 800                            "WLANEvent message");
 801                 return;
 802         }
 803
 804         wps_er_add_sta_data(ap, addr, &attr, 1);
 805 }
 806
 807
 808 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
 809                                              enum http_client_event event)
 810 {
 811         struct wps_er_sta *sta = ctx;
 812
 813         switch (event) {
 814         case HTTP_CLIENT_OK:
 815                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
 816                 break;
 817         case HTTP_CLIENT_FAILED:
 818         case HTTP_CLIENT_INVALID_REPLY:
 819         case HTTP_CLIENT_TIMEOUT:
 820                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
 821                 break;
 822         }
 823         http_client_free(sta->http);
 824         sta->http = NULL;
 825 }
 826
 827
 828 static const char *soap_prefix =
 829         "<?xml version=\"1.0\"?>\n"
 830         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 831         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
 832         "<s:Body>\n";
 833 static const char *soap_postfix =
 834         "</s:Body>\n</s:Envelope>\n";
 835 static const char *urn_wfawlanconfig =
 836         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
 837
 838 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
 839                                        const char *name, const char *arg_name,
 840                                        const char *path,
 841                                        const struct sockaddr_in *dst,
 842                                        char **len_ptr, char **body_ptr)
 843 {
 844         unsigned char *encoded;
 845         size_t encoded_len;
 846         struct wpabuf *buf;
 847
 848         if (msg) {
 849                 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
 850                                         &encoded_len);
 851                 if (encoded == NULL)
 852                         return NULL;
 853         } else {
 854                 encoded = NULL;
 855                 encoded_len = 0;
 856         }
 857
 858         buf = wpabuf_alloc(1000 + encoded_len);
 859         if (buf == NULL) {
 860                 os_free(encoded);
 861                 return NULL;
 862         }
 863
 864         wpabuf_printf(buf,
 865                       "POST %s HTTP/1.1\r\n"
 866                       "Host: %s:%d\r\n"
 867                       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
 868                       "Content-Length: ",
 869                       path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
 870
 871         *len_ptr = wpabuf_put(buf, 0);
 872         wpabuf_printf(buf,
 873                       "        \r\n"
 874                       "SOAPACTION: \"%s#%s\"\r\n"
 875                       "\r\n",
 876                       urn_wfawlanconfig, name);
 877
 878         *body_ptr = wpabuf_put(buf, 0);
 879
 880         wpabuf_put_str(buf, soap_prefix);
 881         wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
 882         wpabuf_put_str(buf, urn_wfawlanconfig);
 883         wpabuf_put_str(buf, "\">\n");
 884         if (encoded) {
 885                 wpabuf_printf(buf, "<%s>%s</%s>\n",
 886                               arg_name, (char *) encoded, arg_name);
 887                 os_free(encoded);
 888         }
 889
 890         return buf;
 891 }
 892
 893
 894 static void wps_er_soap_end(struct wpabuf *buf, const char *name,
 895                             char *len_ptr, char *body_ptr)
 896 {
 897         char len_buf[10];
 898         wpabuf_printf(buf, "</u:%s>\n", name);
 899         wpabuf_put_str(buf, soap_postfix);
 900         os_snprintf(len_buf, sizeof(len_buf), "%d",
 901                     (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
 902         os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
 903 }
 904
 905
 906 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
 907 {
 908         struct wpabuf *buf;
 909         char *len_ptr, *body_ptr;
 910         struct sockaddr_in dst;
 911         char *url, *path;
 912
 913         if (sta->http) {
 914                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
 915                            "ignore new request");
 916                 wpabuf_free(msg);
 917                 return;
 918         }
 919
 920         if (sta->ap->control_url == NULL) {
 921                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
 922                 wpabuf_free(msg);
 923                 return;
 924         }
 925
 926         url = http_client_url_parse(sta->ap->control_url, &dst, &path);
 927         if (url == NULL) {
 928                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
 929                 wpabuf_free(msg);
 930                 return;
 931         }
 932
 933         buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
 934                               &len_ptr, &body_ptr);
 935         wpabuf_free(msg);
 936         os_free(url);
 937         if (buf == NULL)
 938                 return;
 939         wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
 940                       UPNP_WPS_WLANEVENT_TYPE_EAP);
 941         wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
 942                       MAC2STR(sta->addr));
 943
 944         wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
 945
 946         sta->http = http_client_addr(&dst, buf, 1000,
 947                                      wps_er_http_put_wlan_response_cb, sta);
 948         if (sta->http == NULL)
 949                 wpabuf_free(buf);
 950 }
 951
 952
 953 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
 954                                enum wsc_op_code op_code)
 955 {
 956         enum wps_process_res res;
 957
 958         res = wps_process_msg(sta->wps, op_code, msg);
 959         if (res == WPS_CONTINUE) {
 960                 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
 961                 if (next)
 962                         wps_er_sta_send_msg(sta, next);
 963         }
 964 }
 965
 966
 967 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
 968 {
 969         struct wps_config cfg;
 970
 971         if (sta->wps)
 972                 wps_deinit(sta->wps);
 973
 974         os_memset(&cfg, 0, sizeof(cfg));
 975         cfg.wps = sta->ap->er->wps;
 976         cfg.registrar = 1;
 977         cfg.peer_addr = sta->addr;
 978
 979         sta->wps = wps_init(&cfg);
 980         if (sta->wps == NULL)
 981                 return;
 982         sta->wps->er = 1;
 983         sta->wps->use_cred = sta->ap->ap_settings;
 984
 985         wps_er_sta_process(sta, msg, WSC_MSG);
 986 }
 987
 988
 989 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
 990                                          struct wpabuf *msg)
 991 {
 992         struct wps_parse_attr attr;
 993         struct wps_er_sta *sta;
 994
 995         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
 996                    MAC2STR(addr));
 997         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 998                         "(TLVs from EAP-WSC)", msg);
 999
1000         if (wps_parse_msg(msg, &attr) < 0) {
1001                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
1002                            "WLANEvent message");
1003                 return;
1004         }
1005
1006         sta = wps_er_add_sta_data(ap, addr, &attr, 0);
1007         if (sta == NULL)
1008                 return;
1009
1010         if (attr.msg_type && *attr.msg_type == WPS_M1)
1011                 wps_er_sta_start(sta, msg);
1012         else if (sta->wps) {
1013                 enum wsc_op_code op_code = WSC_MSG;
1014                 if (attr.msg_type) {
1015                         switch (*attr.msg_type) {
1016                         case WPS_WSC_ACK:
1017                                 op_code = WSC_ACK;
1018                                 break;
1019                         case WPS_WSC_NACK:
1020                                 op_code = WSC_NACK;
1021                                 break;
1022                         case WPS_WSC_DONE:
1023                                 op_code = WSC_Done;
1024                                 break;
1025                         }
1026                 }
1027                 wps_er_sta_process(sta, msg, op_code);
1028         }
1029 }
1030
1031
1032 static void wps_er_process_wlanevent(struct wps_er_ap *ap,
1033                                      struct wpabuf *event)
1034 {
1035         u8 *data;
1036         u8 wlan_event_type;
1037         u8 wlan_event_mac[ETH_ALEN];
1038         struct wpabuf msg;
1039
1040         wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
1041                     wpabuf_head(event), wpabuf_len(event));
1042         if (wpabuf_len(event) < 1 + 17) {
1043                 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
1044                 return;
1045         }
1046
1047         data = wpabuf_mhead(event);
1048         wlan_event_type = data[0];
1049         if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
1050                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
1051                            "WLANEvent");
1052                 return;
1053         }
1054
1055         wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
1056
1057         switch (wlan_event_type) {
1058         case 1:
1059                 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
1060                 break;
1061         case 2:
1062                 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
1063                 break;
1064         default:
1065                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
1066                            wlan_event_type);
1067                 break;
1068         }
1069 }
1070
1071
1072 static void wps_er_http_event(struct wps_er *er, struct http_request *req,
1073                               unsigned int ap_id)
1074 {
1075         struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
1076         struct wpabuf *event;
1077         enum http_reply_code ret;
1078
1079         if (ap == NULL) {
1080                 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
1081                            "%u", ap_id);
1082                 wps_er_http_resp_not_found(req);
1083                 return;
1084         }
1085         wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
1086                    ap_id, http_request_get_data(req));
1087
1088         event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
1089                                     &ret);
1090         if (event == NULL) {
1091                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
1092                            "from the event notification");
1093                 /*
1094                  * Reply with OK anyway to avoid getting unregistered from
1095                  * events.
1096                  */
1097                 wps_er_http_resp_ok(req);
1098                 return;
1099         }
1100
1101         wps_er_process_wlanevent(ap, event);
1102
1103         wpabuf_free(event);
1104         wps_er_http_resp_ok(req);
1105 }
1106
1107
1108 static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
1109 {
1110         char *uri = http_request_get_uri(req);
1111
1112         if (os_strncmp(uri, "/event/", 7) == 0) {
1113                 wps_er_http_event(er, req, atoi(uri + 7));
1114         } else {
1115                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
1116                            uri);
1117                 wps_er_http_resp_not_found(req);
1118         }
1119 }
1120
1121
1122 static void wps_er_http_req(void *ctx, struct http_request *req)
1123 {
1124         struct wps_er *er = ctx;
1125         struct sockaddr_in *cli = http_request_get_cli_addr(req);
1126         enum httpread_hdr_type type = http_request_get_type(req);
1127         struct wpabuf *buf;
1128
1129         wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
1130                    "%s:%d",
1131                    http_request_get_uri(req), type,
1132                    inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
1133
1134         switch (type) {
1135         case HTTPREAD_HDR_TYPE_NOTIFY:
1136                 wps_er_http_notify(er, req);
1137                 break;
1138         default:
1139                 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
1140                            "%d", type);
1141                 buf = wpabuf_alloc(200);
1142                 if (buf == NULL) {
1143                         http_request_deinit(req);
1144                         return;
1145                 }
1146                 wpabuf_put_str(buf,
1147                                "HTTP/1.1 501 Unimplemented\r\n"
1148                                "Connection: close\r\n");
1149                 http_put_date(buf);
1150                 wpabuf_put_str(buf, "\r\n");
1151                 http_request_send_and_deinit(req, buf);
1152                 break;
1153         }
1154 }
1155
1156
1157 struct wps_er *
1158 wps_er_init(struct wps_context *wps, const char *ifname)
1159 {
1160         struct wps_er *er;
1161         struct in_addr addr;
1162
1163         er = os_zalloc(sizeof(*er));
1164         if (er == NULL)
1165                 return NULL;
1166
1167         er->multicast_sd = -1;
1168         er->ssdp_sd = -1;
1169
1170         os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1171         er->wps = wps;
1172
1173         if (get_netif_info(ifname,
1174                            &er->ip_addr, &er->ip_addr_text,
1175                            er->mac_addr, &er->mac_addr_text)) {
1176                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1177                            "for %s. Does it have IP address?", ifname);
1178                 wps_er_deinit(er);
1179                 return NULL;
1180         }
1181
1182         if (add_ssdp_network(ifname)) {
1183                 wps_er_deinit(er);
1184                 return NULL;
1185         }
1186
1187         er->multicast_sd = ssdp_open_multicast_sock(er->ip_addr);
1188         if (er->multicast_sd < 0) {
1189                 wps_er_deinit(er);
1190                 return NULL;
1191         }
1192
1193         er->ssdp_sd = ssdp_listener_open();
1194         if (er->ssdp_sd < 0) {
1195                 wps_er_deinit(er);
1196                 return NULL;
1197         }
1198         if (eloop_register_sock(er->multicast_sd, EVENT_TYPE_READ,
1199                                 wps_er_ssdp_rx, er, NULL) ||
1200             eloop_register_sock(er->ssdp_sd, EVENT_TYPE_READ,
1201                                 wps_er_ssdp_rx, er, NULL)) {
1202                 wps_er_deinit(er);
1203                 return NULL;
1204         }
1205
1206         addr.s_addr = er->ip_addr;
1207         er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1208         if (er->http_srv == NULL) {
1209                 wps_er_deinit(er);
1210                 return NULL;
1211         }
1212         er->http_port = http_server_get_port(er->http_srv);
1213
1214         wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s "
1215                    "mac_addr=%s)",
1216                    er->ifname, er->ip_addr_text, er->mac_addr_text);
1217
1218         wps_er_send_ssdp_msearch(er);
1219
1220         return er;
1221 }
1222
1223
1224 void wps_er_deinit(struct wps_er *er)
1225 {
1226         if (er == NULL)
1227                 return;
1228         http_server_deinit(er->http_srv);
1229         wps_er_ap_remove_all(er);
1230         if (er->multicast_sd >= 0) {
1231                 eloop_unregister_sock(er->multicast_sd, EVENT_TYPE_READ);
1232                 close(er->multicast_sd);
1233         }
1234         if (er->ssdp_sd >= 0) {
1235                 eloop_unregister_sock(er->ssdp_sd, EVENT_TYPE_READ);
1236                 close(er->ssdp_sd);
1237         }
1238         os_free(er->ip_addr_text);
1239         os_free(er->mac_addr_text);
1240         os_free(er);
1241 }
1242
1243
1244 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1245                                        enum http_client_event event)
1246 {
1247         struct wps_er_ap *ap = ctx;
1248
1249         switch (event) {
1250         case HTTP_CLIENT_OK:
1251                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1252                 break;
1253         case HTTP_CLIENT_FAILED:
1254         case HTTP_CLIENT_INVALID_REPLY:
1255         case HTTP_CLIENT_TIMEOUT:
1256                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1257                 break;
1258         }
1259         http_client_free(ap->http);
1260         ap->http = NULL;
1261 }
1262
1263
1264 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1265 {
1266         struct wpabuf *buf;
1267         char *len_ptr, *body_ptr;
1268         struct sockaddr_in dst;
1269         char *url, *path;
1270
1271         if (ap->control_url == NULL) {
1272                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1273                 return;
1274         }
1275
1276         if (ap->http) {
1277                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1278                            "ignore new request");
1279                 return;
1280         }
1281
1282         url = http_client_url_parse(ap->control_url, &dst, &path);
1283         if (url == NULL) {
1284                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1285                 return;
1286         }
1287
1288         buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1289                               &dst, &len_ptr, &body_ptr);
1290         os_free(url);
1291         if (buf == NULL)
1292                 return;
1293
1294         wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1295
1296         ap->http = http_client_addr(&dst, buf, 1000,
1297                                     wps_er_http_set_sel_reg_cb, ap);
1298         if (ap->http == NULL)
1299                 wpabuf_free(buf);
1300 }
1301
1302
1303 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1304 {
1305         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1306         wpabuf_put_be16(msg, 1);
1307         wpabuf_put_u8(msg, !!sel_reg);
1308         return 0;
1309 }
1310
1311
1312 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1313 {
1314         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1315         wpabuf_put_be16(msg, 2);
1316         wpabuf_put_be16(msg, dev_passwd_id);
1317         return 0;
1318 }
1319
1320
1321 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1322                                                u16 sel_reg_config_methods)
1323 {
1324         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1325         wpabuf_put_be16(msg, 2);
1326         wpabuf_put_be16(msg, sel_reg_config_methods);
1327         return 0;
1328 }
1329
1330
1331 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1332                         u16 sel_reg_config_methods)
1333 {
1334         struct wpabuf *msg;
1335         struct wps_er_ap *ap;
1336
1337         msg = wpabuf_alloc(500);
1338         if (msg == NULL)
1339                 return;
1340
1341         if (wps_build_version(msg) ||
1342             wps_er_build_selected_registrar(msg, sel_reg) ||
1343             wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1344             wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods)) {
1345                 wpabuf_free(msg);
1346                 return;
1347         }
1348
1349         for (ap = er->ap; ap; ap = ap->next)
1350                 wps_er_send_set_sel_reg(ap, msg);
1351
1352         wpabuf_free(msg);
1353 }
1354
1355
1356 int wps_er_pbc(struct wps_er *er, const u8 *uuid)
1357 {
1358         if (er == NULL || er->wps == NULL)
1359                 return -1;
1360
1361         /*
1362          * TODO: Should enable PBC mode only in a single AP based on which AP
1363          * the Enrollee (uuid) is using. Now, we may end up enabling multiple
1364          * APs in PBC mode which could result in session overlap at the
1365          * Enrollee.
1366          */
1367         if (wps_registrar_button_pushed(er->wps->registrar))
1368                 return -1;
1369
1370         return 0;
1371 }
1372
1373
1374 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1375 {
1376         struct wps_er_ap *ap = ctx;
1377         wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1378         os_free(ap->ap_settings);
1379         ap->ap_settings = os_malloc(sizeof(*cred));
1380         if (ap->ap_settings) {
1381                 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1382                 ap->ap_settings->cred_attr = NULL;
1383         }
1384
1385         /* TODO: send info through ctrl_iface */
1386 }
1387
1388
1389 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1390                                        enum http_client_event event)
1391 {
1392         struct wps_er_ap *ap = ctx;
1393         struct wpabuf *reply;
1394         char *msg = NULL;
1395
1396         switch (event) {
1397         case HTTP_CLIENT_OK:
1398                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1399                 reply = http_client_get_body(c);
1400                 if (reply == NULL)
1401                         break;
1402                 msg = os_zalloc(wpabuf_len(reply) + 1);
1403                 if (msg == NULL)
1404                         break;
1405                 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1406                 break;
1407         case HTTP_CLIENT_FAILED:
1408         case HTTP_CLIENT_INVALID_REPLY:
1409         case HTTP_CLIENT_TIMEOUT:
1410                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1411                 break;
1412         }
1413         http_client_free(ap->http);
1414         ap->http = NULL;
1415
1416         if (msg) {
1417                 struct wpabuf *buf;
1418                 enum http_reply_code ret;
1419                 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1420                 os_free(msg);
1421                 if (buf == NULL) {
1422                         wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1423                                    "NewOutMessage from PutMessage response");
1424                         return;
1425                 }
1426                 wps_er_ap_process(ap, buf);
1427                 wpabuf_free(buf);
1428         }
1429 }
1430
1431
1432 static void wps_er_ap_put_message(struct wps_er_ap *ap,
1433                                   const struct wpabuf *msg)
1434 {
1435         struct wpabuf *buf;
1436         char *len_ptr, *body_ptr;
1437         struct sockaddr_in dst;
1438         char *url, *path;
1439
1440         if (ap->http) {
1441                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1442                            "with the AP - cannot continue learn");
1443                 return;
1444         }
1445
1446         if (ap->control_url == NULL) {
1447                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1448                 return;
1449         }
1450
1451         url = http_client_url_parse(ap->control_url, &dst, &path);
1452         if (url == NULL) {
1453                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1454                 return;
1455         }
1456
1457         buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1458                               &len_ptr, &body_ptr);
1459         os_free(url);
1460         if (buf == NULL)
1461                 return;
1462
1463         wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1464
1465         ap->http = http_client_addr(&dst, buf, 10000,
1466                                     wps_er_http_put_message_cb, ap);
1467         if (ap->http == NULL)
1468                 wpabuf_free(buf);
1469 }
1470
1471
1472 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1473 {
1474         enum wps_process_res res;
1475
1476         res = wps_process_msg(ap->wps, WSC_MSG, msg);
1477         if (res == WPS_CONTINUE) {
1478                 enum wsc_op_code op_code;
1479                 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1480                 if (next) {
1481                         wps_er_ap_put_message(ap, next);
1482                         wpabuf_free(next);
1483                 } else {
1484                         wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1485                                    "message");
1486                         wps_deinit(ap->wps);
1487                         ap->wps = NULL;
1488                 }
1489         } else {
1490                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1491                            "AP (res=%d)", res);
1492                 wps_deinit(ap->wps);
1493                 ap->wps = NULL;
1494         }
1495 }
1496
1497
1498 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1499 {
1500         struct wpabuf *info;
1501         enum http_reply_code ret;
1502         struct wps_config cfg;
1503
1504         wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1505                    "from the AP");
1506         info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1507         if (info == NULL) {
1508                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1509                            "NewDeviceInfo from GetDeviceInfo response");
1510                 return;
1511         }
1512
1513         if (ap->wps) {
1514                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1515                            "progress with this AP");
1516                 wpabuf_free(info);
1517                 return;
1518         }
1519
1520         os_memset(&cfg, 0, sizeof(cfg));
1521         cfg.wps = ap->er->wps;
1522         cfg.registrar = 1;
1523         ap->wps = wps_init(&cfg);
1524         if (ap->wps == NULL) {
1525                 wpabuf_free(info);
1526                 return;
1527         }
1528         ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1529         ap->wps->ap_settings_cb_ctx = ap;
1530
1531         wps_er_ap_process(ap, info);
1532         wpabuf_free(info);
1533 }
1534
1535
1536 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1537                                         enum http_client_event event)
1538 {
1539         struct wps_er_ap *ap = ctx;
1540         struct wpabuf *reply;
1541         char *dev_info = NULL;
1542
1543         switch (event) {
1544         case HTTP_CLIENT_OK:
1545                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1546                 reply = http_client_get_body(c);
1547                 if (reply == NULL)
1548                         break;
1549                 dev_info = os_zalloc(wpabuf_len(reply) + 1);
1550                 if (dev_info == NULL)
1551                         break;
1552                 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1553                 break;
1554         case HTTP_CLIENT_FAILED:
1555         case HTTP_CLIENT_INVALID_REPLY:
1556         case HTTP_CLIENT_TIMEOUT:
1557                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1558                 break;
1559         }
1560         http_client_free(ap->http);
1561         ap->http = NULL;
1562
1563         if (dev_info) {
1564                 wps_er_ap_learn(ap, dev_info);
1565                 os_free(dev_info);
1566         }
1567 }
1568
1569
1570 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *pin,
1571                  size_t pin_len)
1572 {
1573         struct wps_er_ap *ap;
1574         struct wpabuf *buf;
1575         char *len_ptr, *body_ptr;
1576         struct sockaddr_in dst;
1577         char *url, *path;
1578
1579         if (er == NULL)
1580                 return -1;
1581
1582         ap = wps_er_ap_get_uuid(er, uuid);
1583         if (ap == NULL) {
1584                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1585                            "request");
1586                 return -1;
1587         }
1588         if (ap->wps || ap->http) {
1589                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1590                            "with the AP - cannot start learn");
1591                 return -1;
1592         }
1593
1594         if (ap->control_url == NULL) {
1595                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1596                 return -1;
1597         }
1598
1599         url = http_client_url_parse(ap->control_url, &dst, &path);
1600         if (url == NULL) {
1601                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1602                 return -1;
1603         }
1604
1605         buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1606                               &len_ptr, &body_ptr);
1607         os_free(url);
1608         if (buf == NULL)
1609                 return -1;
1610
1611         wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1612
1613         ap->http = http_client_addr(&dst, buf, 10000,
1614                                     wps_er_http_get_dev_info_cb, ap);
1615         if (ap->http == NULL) {
1616                 wpabuf_free(buf);
1617                 return -1;
1618         }
1619
1620         /* TODO: add PIN without SetSelectedRegistrar trigger to all APs */
1621         wps_registrar_add_pin(er->wps->registrar, uuid, pin, pin_len, 0);
1622
1623         return 0;
1624 }