libeap/src/wps/wps_upnp_web.c

   1 /*
   2  * UPnP WPS Device - Web connections
   3  * Copyright (c) 2000-2003 Intel Corporation
   4  * Copyright (c) 2006-2007 Sony Corporation
   5  * Copyright (c) 2008-2009 Atheros Communications
   6  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   7  *
   8  * See wps_upnp.c for more details on licensing and code history.
   9  */
  10
  11 #include "includes.h"
  12
  13 #include "common.h"
  14 #include "base64.h"
  15 #include "uuid.h"
  16 #include "httpread.h"
  17 #include "http_server.h"
  18 #include "wps_i.h"
  19 #include "wps_upnp.h"
  20 #include "wps_upnp_i.h"
  21 #include "upnp_xml.h"
  22
  23 /***************************************************************************
  24  * Web connections (we serve pages of info about ourselves, handle
  25  * requests, etc. etc.).
  26  **************************************************************************/
  27
  28 #define WEB_CONNECTION_TIMEOUT_SEC 30   /* Drop web connection after t.o. */
  29 #define WEB_CONNECTION_MAX_READ 8000    /* Max we'll read for TCP request */
  30 #define MAX_WEB_CONNECTIONS 10          /* max simultaneous web connects */
  31
  32
  33 static const char *urn_wfawlanconfig =
  34         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
  35 static const char *http_server_hdr =
  36         "Server: unspecified, UPnP/1.0, unspecified\r\n";
  37 static const char *http_connection_close =
  38         "Connection: close\r\n";
  39
  40 /*
  41  * "Files" that we serve via HTTP. The format of these files is given by
  42  * WFA WPS specifications. Extra white space has been removed to save space.
  43  */
  44
  45 static const char wps_scpd_xml[] =
  46 "<?xml version=\"1.0\"?>\n"
  47 "<scpd xmlns=\"urn:schemas-upnp-org:service-1-0\">\n"
  48 "<specVersion><major>1</major><minor>0</minor></specVersion>\n"
  49 "<actionList>\n"
  50 "<action>\n"
  51 "<name>GetDeviceInfo</name>\n"
  52 "<argumentList>\n"
  53 "<argument>\n"
  54 "<name>NewDeviceInfo</name>\n"
  55 "<direction>out</direction>\n"
  56 "<relatedStateVariable>DeviceInfo</relatedStateVariable>\n"
  57 "</argument>\n"
  58 "</argumentList>\n"
  59 "</action>\n"
  60 "<action>\n"
  61 "<name>PutMessage</name>\n"
  62 "<argumentList>\n"
  63 "<argument>\n"
  64 "<name>NewInMessage</name>\n"
  65 "<direction>in</direction>\n"
  66 "<relatedStateVariable>InMessage</relatedStateVariable>\n"
  67 "</argument>\n"
  68 "<argument>\n"
  69 "<name>NewOutMessage</name>\n"
  70 "<direction>out</direction>\n"
  71 "<relatedStateVariable>OutMessage</relatedStateVariable>\n"
  72 "</argument>\n"
  73 "</argumentList>\n"
  74 "</action>\n"
  75 "<action>\n"
  76 "<name>PutWLANResponse</name>\n"
  77 "<argumentList>\n"
  78 "<argument>\n"
  79 "<name>NewMessage</name>\n"
  80 "<direction>in</direction>\n"
  81 "<relatedStateVariable>Message</relatedStateVariable>\n"
  82 "</argument>\n"
  83 "<argument>\n"
  84 "<name>NewWLANEventType</name>\n"
  85 "<direction>in</direction>\n"
  86 "<relatedStateVariable>WLANEventType</relatedStateVariable>\n"
  87 "</argument>\n"
  88 "<argument>\n"
  89 "<name>NewWLANEventMAC</name>\n"
  90 "<direction>in</direction>\n"
  91 "<relatedStateVariable>WLANEventMAC</relatedStateVariable>\n"
  92 "</argument>\n"
  93 "</argumentList>\n"
  94 "</action>\n"
  95 "<action>\n"
  96 "<name>SetSelectedRegistrar</name>\n"
  97 "<argumentList>\n"
  98 "<argument>\n"
  99 "<name>NewMessage</name>\n"
 100 "<direction>in</direction>\n"
 101 "<relatedStateVariable>Message</relatedStateVariable>\n"
 102 "</argument>\n"
 103 "</argumentList>\n"
 104 "</action>\n"
 105 "</actionList>\n"
 106 "<serviceStateTable>\n"
 107 "<stateVariable sendEvents=\"no\">\n"
 108 "<name>Message</name>\n"
 109 "<dataType>bin.base64</dataType>\n"
 110 "</stateVariable>\n"
 111 "<stateVariable sendEvents=\"no\">\n"
 112 "<name>InMessage</name>\n"
 113 "<dataType>bin.base64</dataType>\n"
 114 "</stateVariable>\n"
 115 "<stateVariable sendEvents=\"no\">\n"
 116 "<name>OutMessage</name>\n"
 117 "<dataType>bin.base64</dataType>\n"
 118 "</stateVariable>\n"
 119 "<stateVariable sendEvents=\"no\">\n"
 120 "<name>DeviceInfo</name>\n"
 121 "<dataType>bin.base64</dataType>\n"
 122 "</stateVariable>\n"
 123 "<stateVariable sendEvents=\"yes\">\n"
 124 "<name>APStatus</name>\n"
 125 "<dataType>ui1</dataType>\n"
 126 "</stateVariable>\n"
 127 "<stateVariable sendEvents=\"yes\">\n"
 128 "<name>STAStatus</name>\n"
 129 "<dataType>ui1</dataType>\n"
 130 "</stateVariable>\n"
 131 "<stateVariable sendEvents=\"yes\">\n"
 132 "<name>WLANEvent</name>\n"
 133 "<dataType>bin.base64</dataType>\n"
 134 "</stateVariable>\n"
 135 "<stateVariable sendEvents=\"no\">\n"
 136 "<name>WLANEventType</name>\n"
 137 "<dataType>ui1</dataType>\n"
 138 "</stateVariable>\n"
 139 "<stateVariable sendEvents=\"no\">\n"
 140 "<name>WLANEventMAC</name>\n"
 141 "<dataType>string</dataType>\n"
 142 "</stateVariable>\n"
 143 "<stateVariable sendEvents=\"no\">\n"
 144 "<name>WLANResponse</name>\n"
 145 "<dataType>bin.base64</dataType>\n"
 146 "</stateVariable>\n"
 147 "</serviceStateTable>\n"
 148 "</scpd>\n"
 149 ;
 150
 151
 152 static const char *wps_device_xml_prefix =
 153         "<?xml version=\"1.0\"?>\n"
 154         "<root xmlns=\"urn:schemas-upnp-org:device-1-0\">\n"
 155         "<specVersion>\n"
 156         "<major>1</major>\n"
 157         "<minor>0</minor>\n"
 158         "</specVersion>\n"
 159         "<device>\n"
 160         "<deviceType>urn:schemas-wifialliance-org:device:WFADevice:1"
 161         "</deviceType>\n";
 162
 163 static const char *wps_device_xml_postfix =
 164         "<serviceList>\n"
 165         "<service>\n"
 166         "<serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1"
 167         "</serviceType>\n"
 168         "<serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>"
 169         "\n"
 170         "<SCPDURL>" UPNP_WPS_SCPD_XML_FILE "</SCPDURL>\n"
 171         "<controlURL>" UPNP_WPS_DEVICE_CONTROL_FILE "</controlURL>\n"
 172         "<eventSubURL>" UPNP_WPS_DEVICE_EVENT_FILE "</eventSubURL>\n"
 173         "</service>\n"
 174         "</serviceList>\n"
 175         "</device>\n"
 176         "</root>\n";
 177
 178
 179 /* format_wps_device_xml -- produce content of "file" wps_device.xml
 180  * (UPNP_WPS_DEVICE_XML_FILE)
 181  */
 182 static void format_wps_device_xml(struct upnp_wps_device_interface *iface,
 183                                   struct upnp_wps_device_sm *sm,
 184                                   struct wpabuf *buf)
 185 {
 186         const char *s;
 187         char uuid_string[80];
 188
 189         wpabuf_put_str(buf, wps_device_xml_prefix);
 190
 191         /*
 192          * Add required fields with default values if not configured. Add
 193          * optional and recommended fields only if configured.
 194          */
 195         s = iface->wps->friendly_name;
 196         s = ((s && *s) ? s : "WPS Access Point");
 197         xml_add_tagged_data(buf, "friendlyName", s);
 198
 199         s = iface->wps->dev.manufacturer;
 200         s = ((s && *s) ? s : "");
 201         xml_add_tagged_data(buf, "manufacturer", s);
 202
 203         if (iface->wps->manufacturer_url)
 204                 xml_add_tagged_data(buf, "manufacturerURL",
 205                                     iface->wps->manufacturer_url);
 206
 207         if (iface->wps->model_description)
 208                 xml_add_tagged_data(buf, "modelDescription",
 209                                     iface->wps->model_description);
 210
 211         s = iface->wps->dev.model_name;
 212         s = ((s && *s) ? s : "");
 213         xml_add_tagged_data(buf, "modelName", s);
 214
 215         if (iface->wps->dev.model_number)
 216                 xml_add_tagged_data(buf, "modelNumber",
 217                                     iface->wps->dev.model_number);
 218
 219         if (iface->wps->model_url)
 220                 xml_add_tagged_data(buf, "modelURL", iface->wps->model_url);
 221
 222         if (iface->wps->dev.serial_number)
 223                 xml_add_tagged_data(buf, "serialNumber",
 224                                     iface->wps->dev.serial_number);
 225
 226         uuid_bin2str(iface->wps->uuid, uuid_string, sizeof(uuid_string));
 227         s = uuid_string;
 228         /* Need "uuid:" prefix, thus we can't use xml_add_tagged_data()
 229          * easily...
 230          */
 231         wpabuf_put_str(buf, "<UDN>uuid:");
 232         xml_data_encode(buf, s, os_strlen(s));
 233         wpabuf_put_str(buf, "</UDN>\n");
 234
 235         if (iface->wps->upc)
 236                 xml_add_tagged_data(buf, "UPC", iface->wps->upc);
 237
 238         wpabuf_put_str(buf, wps_device_xml_postfix);
 239 }
 240
 241
 242 static void http_put_reply_code(struct wpabuf *buf, enum http_reply_code code)
 243 {
 244         wpabuf_put_str(buf, "HTTP/1.1 ");
 245         switch (code) {
 246         case HTTP_OK:
 247                 wpabuf_put_str(buf, "200 OK\r\n");
 248                 break;
 249         case HTTP_BAD_REQUEST:
 250                 wpabuf_put_str(buf, "400 Bad request\r\n");
 251                 break;
 252         case HTTP_PRECONDITION_FAILED:
 253                 wpabuf_put_str(buf, "412 Precondition failed\r\n");
 254                 break;
 255         case HTTP_UNIMPLEMENTED:
 256                 wpabuf_put_str(buf, "501 Unimplemented\r\n");
 257                 break;
 258         case HTTP_INTERNAL_SERVER_ERROR:
 259         default:
 260                 wpabuf_put_str(buf, "500 Internal server error\r\n");
 261                 break;
 262         }
 263 }
 264
 265
 266 static void http_put_date(struct wpabuf *buf)
 267 {
 268         wpabuf_put_str(buf, "Date: ");
 269         format_date(buf);
 270         wpabuf_put_str(buf, "\r\n");
 271 }
 272
 273
 274 static void http_put_empty(struct wpabuf *buf, enum http_reply_code code)
 275 {
 276         http_put_reply_code(buf, code);
 277         wpabuf_put_str(buf, http_server_hdr);
 278         wpabuf_put_str(buf, http_connection_close);
 279         wpabuf_put_str(buf, "Content-Length: 0\r\n"
 280                        "\r\n");
 281 }
 282
 283
 284 /* Given that we have received a header w/ GET, act upon it
 285  *
 286  * Format of GET (case-insensitive):
 287  *
 288  * First line must be:
 289  *      GET /<file> HTTP/1.1
 290  * Since we don't do anything fancy we just ignore other lines.
 291  *
 292  * Our response (if no error) which includes only required lines is:
 293  * HTTP/1.1 200 OK
 294  * Connection: close
 295  * Content-Type: text/xml
 296  * Date: <rfc1123-date>
 297  *
 298  * Header lines must end with \r\n
 299  * Per RFC 2616, content-length: is not required but connection:close
 300  * would appear to be required (given that we will be closing it!).
 301  */
 302 static void web_connection_parse_get(struct upnp_wps_device_sm *sm,
 303                                      struct http_request *hreq, char *filename)
 304 {
 305         struct wpabuf *buf; /* output buffer, allocated */
 306         char *put_length_here;
 307         char *body_start;
 308         enum {
 309                 GET_DEVICE_XML_FILE,
 310                 GET_SCPD_XML_FILE
 311         } req;
 312         size_t extra_len = 0;
 313         int body_length;
 314         char len_buf[10];
 315         struct upnp_wps_device_interface *iface;
 316
 317         iface = dl_list_first(&sm->interfaces,
 318                               struct upnp_wps_device_interface, list);
 319         if (iface == NULL) {
 320                 http_request_deinit(hreq);
 321                 return;
 322         }
 323
 324         /*
 325          * It is not required that filenames be case insensitive but it is
 326          * allowed and cannot hurt here.
 327          */
 328         if (os_strcasecmp(filename, UPNP_WPS_DEVICE_XML_FILE) == 0) {
 329                 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for device XML");
 330                 req = GET_DEVICE_XML_FILE;
 331                 extra_len = 3000;
 332                 if (iface->wps->friendly_name)
 333                         extra_len += os_strlen(iface->wps->friendly_name);
 334                 if (iface->wps->manufacturer_url)
 335                         extra_len += os_strlen(iface->wps->manufacturer_url);
 336                 if (iface->wps->model_description)
 337                         extra_len += os_strlen(iface->wps->model_description);
 338                 if (iface->wps->model_url)
 339                         extra_len += os_strlen(iface->wps->model_url);
 340                 if (iface->wps->upc)
 341                         extra_len += os_strlen(iface->wps->upc);
 342         } else if (!os_strcasecmp(filename, UPNP_WPS_SCPD_XML_FILE)) {
 343                 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for SCPD XML");
 344                 req = GET_SCPD_XML_FILE;
 345                 extra_len = os_strlen(wps_scpd_xml);
 346         } else {
 347                 /* File not found */
 348                 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET file not found: %s",
 349                            filename);
 350                 buf = wpabuf_alloc(200);
 351                 if (buf == NULL) {
 352                         http_request_deinit(hreq);
 353                         return;
 354                 }
 355                 wpabuf_put_str(buf,
 356                                "HTTP/1.1 404 Not Found\r\n"
 357                                "Connection: close\r\n");
 358
 359                 http_put_date(buf);
 360
 361                 /* terminating empty line */
 362                 wpabuf_put_str(buf, "\r\n");
 363
 364                 goto send_buf;
 365         }
 366
 367         buf = wpabuf_alloc(1000 + extra_len);
 368         if (buf == NULL) {
 369                 http_request_deinit(hreq);
 370                 return;
 371         }
 372
 373         wpabuf_put_str(buf,
 374                        "HTTP/1.1 200 OK\r\n"
 375                        "Content-Type: text/xml; charset=\"utf-8\"\r\n");
 376         wpabuf_put_str(buf, "Server: Unspecified, UPnP/1.0, Unspecified\r\n");
 377         wpabuf_put_str(buf, "Connection: close\r\n");
 378         wpabuf_put_str(buf, "Content-Length: ");
 379         /*
 380          * We will paste the length in later, leaving some extra whitespace.
 381          * HTTP code is supposed to be tolerant of extra whitespace.
 382          */
 383         put_length_here = wpabuf_put(buf, 0);
 384         wpabuf_put_str(buf, "        \r\n");
 385
 386         http_put_date(buf);
 387
 388         /* terminating empty line */
 389         wpabuf_put_str(buf, "\r\n");
 390
 391         body_start = wpabuf_put(buf, 0);
 392
 393         switch (req) {
 394         case GET_DEVICE_XML_FILE:
 395                 format_wps_device_xml(iface, sm, buf);
 396                 break;
 397         case GET_SCPD_XML_FILE:
 398                 wpabuf_put_str(buf, wps_scpd_xml);
 399                 break;
 400         }
 401
 402         /* Now patch in the content length at the end */
 403         body_length = (char *) wpabuf_put(buf, 0) - body_start;
 404         os_snprintf(len_buf, 10, "%d", body_length);
 405         os_memcpy(put_length_here, len_buf, os_strlen(len_buf));
 406
 407 send_buf:
 408         http_request_send_and_deinit(hreq, buf);
 409 }
 410
 411
 412 static enum http_reply_code
 413 web_process_get_device_info(struct upnp_wps_device_sm *sm,
 414                             struct wpabuf **reply, const char **replyname)
 415 {
 416         static const char *name = "NewDeviceInfo";
 417         struct wps_config cfg;
 418         struct upnp_wps_device_interface *iface;
 419         struct upnp_wps_peer *peer;
 420
 421         iface = dl_list_first(&sm->interfaces,
 422                               struct upnp_wps_device_interface, list);
 423
 424         wpa_printf(MSG_DEBUG, "WPS UPnP: GetDeviceInfo");
 425
 426         if (!iface || iface->ctx->ap_pin == NULL)
 427                 return HTTP_INTERNAL_SERVER_ERROR;
 428
 429         peer = &iface->peer;
 430
 431         /*
 432          * Request for DeviceInfo, i.e., M1 TLVs. This is a start of WPS
 433          * registration over UPnP with the AP acting as an Enrollee. It should
 434          * be noted that this is frequently used just to get the device data,
 435          * i.e., there may not be any intent to actually complete the
 436          * registration.
 437          */
 438
 439         if (peer->wps)
 440                 wps_deinit(peer->wps);
 441
 442         os_memset(&cfg, 0, sizeof(cfg));
 443         cfg.wps = iface->wps;
 444         cfg.pin = (u8 *) iface->ctx->ap_pin;
 445         cfg.pin_len = os_strlen(iface->ctx->ap_pin);
 446         peer->wps = wps_init(&cfg);
 447         if (peer->wps) {
 448                 enum wsc_op_code op_code;
 449                 *reply = wps_get_msg(peer->wps, &op_code);
 450                 if (*reply == NULL) {
 451                         wps_deinit(peer->wps);
 452                         peer->wps = NULL;
 453                 }
 454         } else
 455                 *reply = NULL;
 456         if (*reply == NULL) {
 457                 wpa_printf(MSG_INFO, "WPS UPnP: Failed to get DeviceInfo");
 458                 return HTTP_INTERNAL_SERVER_ERROR;
 459         }
 460         *replyname = name;
 461         return HTTP_OK;
 462 }
 463
 464
 465 static enum http_reply_code
 466 web_process_put_message(struct upnp_wps_device_sm *sm, char *data,
 467                         struct wpabuf **reply, const char **replyname)
 468 {
 469         struct wpabuf *msg;
 470         static const char *name = "NewOutMessage";
 471         enum http_reply_code ret;
 472         enum wps_process_res res;
 473         enum wsc_op_code op_code;
 474         struct upnp_wps_device_interface *iface;
 475
 476         iface = dl_list_first(&sm->interfaces,
 477                               struct upnp_wps_device_interface, list);
 478         if (!iface)
 479                 return HTTP_INTERNAL_SERVER_ERROR;
 480
 481         /*
 482          * PutMessage is used by external UPnP-based Registrar to perform WPS
 483          * operation with the access point itself; as compared with
 484          * PutWLANResponse which is for proxying.
 485          */
 486         wpa_printf(MSG_DEBUG, "WPS UPnP: PutMessage");
 487         msg = xml_get_base64_item(data, "NewInMessage", &ret);
 488         if (msg == NULL)
 489                 return ret;
 490         res = wps_process_msg(iface->peer.wps, WSC_UPnP, msg);
 491         if (res == WPS_FAILURE)
 492                 *reply = NULL;
 493         else
 494                 *reply = wps_get_msg(iface->peer.wps, &op_code);
 495         wpabuf_free(msg);
 496         if (*reply == NULL)
 497                 return HTTP_INTERNAL_SERVER_ERROR;
 498         *replyname = name;
 499         return HTTP_OK;
 500 }
 501
 502
 503 static enum http_reply_code
 504 web_process_put_wlan_response(struct upnp_wps_device_sm *sm, char *data,
 505                               struct wpabuf **reply, const char **replyname)
 506 {
 507         struct wpabuf *msg;
 508         enum http_reply_code ret;
 509         u8 macaddr[ETH_ALEN];
 510         int ev_type;
 511         int type;
 512         char *val;
 513         struct upnp_wps_device_interface *iface;
 514         int ok = 0;
 515
 516         /*
 517          * External UPnP-based Registrar is passing us a message to be proxied
 518          * over to a Wi-Fi -based client of ours.
 519          */
 520
 521         wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse");
 522         msg = xml_get_base64_item(data, "NewMessage", &ret);
 523         if (msg == NULL) {
 524                 wpa_printf(MSG_DEBUG, "WPS UPnP: Could not extract NewMessage "
 525                            "from PutWLANResponse");
 526                 return ret;
 527         }
 528         val = xml_get_first_item(data, "NewWLANEventType");
 529         if (val == NULL) {
 530                 wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventType in "
 531                            "PutWLANResponse");
 532                 wpabuf_free(msg);
 533                 return UPNP_ARG_VALUE_INVALID;
 534         }
 535         ev_type = atol(val);
 536         os_free(val);
 537         val = xml_get_first_item(data, "NewWLANEventMAC");
 538         if (val == NULL) {
 539                 wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventMAC in "
 540                            "PutWLANResponse");
 541                 wpabuf_free(msg);
 542                 return UPNP_ARG_VALUE_INVALID;
 543         }
 544         if (hwaddr_aton(val, macaddr)) {
 545                 wpa_printf(MSG_DEBUG, "WPS UPnP: Invalid NewWLANEventMAC in "
 546                            "PutWLANResponse: '%s'", val);
 547 #ifdef CONFIG_WPS_STRICT
 548                 {
 549                         struct wps_parse_attr attr;
 550                         if (wps_parse_msg(msg, &attr) < 0 || attr.version2) {
 551                                 wpabuf_free(msg);
 552                                 os_free(val);
 553                                 return UPNP_ARG_VALUE_INVALID;
 554                         }
 555                 }
 556 #endif /* CONFIG_WPS_STRICT */
 557                 if (hwaddr_aton2(val, macaddr) > 0) {
 558                         /*
 559                          * At least some versions of Intel PROset seem to be
 560                          * using dot-deliminated MAC address format here.
 561                          */
 562                         wpa_printf(MSG_DEBUG, "WPS UPnP: Workaround - allow "
 563                                    "incorrect MAC address format in "
 564                                    "NewWLANEventMAC: %s -> " MACSTR,
 565                                    val, MAC2STR(macaddr));
 566                 } else {
 567                         wpabuf_free(msg);
 568                         os_free(val);
 569                         return UPNP_ARG_VALUE_INVALID;
 570                 }
 571         }
 572         os_free(val);
 573         if (ev_type == UPNP_WPS_WLANEVENT_TYPE_EAP) {
 574                 struct wps_parse_attr attr;
 575                 if (wps_parse_msg(msg, &attr) < 0 ||
 576                     attr.msg_type == NULL)
 577                         type = -1;
 578                 else
 579                         type = *attr.msg_type;
 580                 wpa_printf(MSG_DEBUG, "WPS UPnP: Message Type %d", type);
 581         } else
 582                 type = -1;
 583         dl_list_for_each(iface, &sm->interfaces,
 584                          struct upnp_wps_device_interface, list) {
 585                 if (iface->ctx->rx_req_put_wlan_response &&
 586                     iface->ctx->rx_req_put_wlan_response(iface->priv, ev_type,
 587                                                          macaddr, msg, type)
 588                     == 0)
 589                         ok = 1;
 590         }
 591
 592         if (!ok) {
 593                 wpa_printf(MSG_INFO, "WPS UPnP: Fail: sm->ctx->"
 594                            "rx_req_put_wlan_response");
 595                 wpabuf_free(msg);
 596                 return HTTP_INTERNAL_SERVER_ERROR;
 597         }
 598         wpabuf_free(msg);
 599         *replyname = NULL;
 600         *reply = NULL;
 601         return HTTP_OK;
 602 }
 603
 604
 605 static int find_er_addr(struct subscription *s, struct sockaddr_in *cli)
 606 {
 607         struct subscr_addr *a;
 608
 609         dl_list_for_each(a, &s->addr_list, struct subscr_addr, list) {
 610                 if (cli->sin_addr.s_addr == a->saddr.sin_addr.s_addr)
 611                         return 1;
 612         }
 613         return 0;
 614 }
 615
 616
 617 static struct subscription * find_er(struct upnp_wps_device_sm *sm,
 618                                      struct sockaddr_in *cli)
 619 {
 620         struct subscription *s;
 621         dl_list_for_each(s, &sm->subscriptions, struct subscription, list)
 622                 if (find_er_addr(s, cli))
 623                         return s;
 624         return NULL;
 625 }
 626
 627
 628 static enum http_reply_code
 629 web_process_set_selected_registrar(struct upnp_wps_device_sm *sm,
 630                                    struct sockaddr_in *cli, char *data,
 631                                    struct wpabuf **reply,
 632                                    const char **replyname)
 633 {
 634         struct wpabuf *msg;
 635         enum http_reply_code ret;
 636         struct subscription *s;
 637         struct upnp_wps_device_interface *iface;
 638         int err = 0;
 639
 640         wpa_printf(MSG_DEBUG, "WPS UPnP: SetSelectedRegistrar");
 641         s = find_er(sm, cli);
 642         if (s == NULL) {
 643                 wpa_printf(MSG_DEBUG, "WPS UPnP: Ignore SetSelectedRegistrar "
 644                            "from unknown ER");
 645                 return UPNP_ACTION_FAILED;
 646         }
 647         msg = xml_get_base64_item(data, "NewMessage", &ret);
 648         if (msg == NULL)
 649                 return ret;
 650         dl_list_for_each(iface, &sm->interfaces,
 651                          struct upnp_wps_device_interface, list) {
 652                 if (upnp_er_set_selected_registrar(iface->wps->registrar, s,
 653                                                    msg))
 654                         err = 1;
 655         }
 656         wpabuf_free(msg);
 657         if (err)
 658                 return HTTP_INTERNAL_SERVER_ERROR;
 659         *replyname = NULL;
 660         *reply = NULL;
 661         return HTTP_OK;
 662 }
 663
 664
 665 static const char *soap_prefix =
 666         "<?xml version=\"1.0\"?>\n"
 667         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 668         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
 669         "<s:Body>\n";
 670 static const char *soap_postfix =
 671         "</s:Body>\n</s:Envelope>\n";
 672
 673 static const char *soap_error_prefix =
 674         "<s:Fault>\n"
 675         "<faultcode>s:Client</faultcode>\n"
 676         "<faultstring>UPnPError</faultstring>\n"
 677         "<detail>\n"
 678         "<UPnPError xmlns=\"urn:schemas-upnp-org:control-1-0\">\n";
 679 static const char *soap_error_postfix =
 680         "<errorDescription>Error</errorDescription>\n"
 681         "</UPnPError>\n"
 682         "</detail>\n"
 683         "</s:Fault>\n";
 684
 685 static void web_connection_send_reply(struct http_request *req,
 686                                       enum http_reply_code ret,
 687                                       const char *action, int action_len,
 688                                       const struct wpabuf *reply,
 689                                       const char *replyname)
 690 {
 691         struct wpabuf *buf;
 692         char *replydata;
 693         char *put_length_here = NULL;
 694         char *body_start = NULL;
 695
 696         if (reply) {
 697                 size_t len;
 698                 replydata = (char *) base64_encode(wpabuf_head(reply),
 699                                                    wpabuf_len(reply), &len);
 700         } else
 701                 replydata = NULL;
 702
 703         /* Parameters of the response:
 704          *      action(action_len) -- action we are responding to
 705          *      replyname -- a name we need for the reply
 706          *      replydata -- NULL or null-terminated string
 707          */
 708         buf = wpabuf_alloc(1000 + (replydata ? os_strlen(replydata) : 0U) +
 709                            (action_len > 0 ? action_len * 2 : 0));
 710         if (buf == NULL) {
 711                 wpa_printf(MSG_INFO, "WPS UPnP: Cannot allocate reply to "
 712                            "POST");
 713                 os_free(replydata);
 714                 http_request_deinit(req);
 715                 return;
 716         }
 717
 718         /*
 719          * Assuming we will be successful, put in the output header first.
 720          * Note: we do not keep connections alive (and httpread does
 721          * not support it)... therefore we must have Connection: close.
 722          */
 723         if (ret == HTTP_OK) {
 724                 wpabuf_put_str(buf,
 725                                "HTTP/1.1 200 OK\r\n"
 726                                "Content-Type: text/xml; "
 727                                "charset=\"utf-8\"\r\n");
 728         } else {
 729                 wpabuf_printf(buf, "HTTP/1.1 %d Error\r\n", ret);
 730         }
 731         wpabuf_put_str(buf, http_connection_close);
 732
 733         wpabuf_put_str(buf, "Content-Length: ");
 734         /*
 735          * We will paste the length in later, leaving some extra whitespace.
 736          * HTTP code is supposed to be tolerant of extra whitespace.
 737          */
 738         put_length_here = wpabuf_put(buf, 0);
 739         wpabuf_put_str(buf, "        \r\n");
 740
 741         http_put_date(buf);
 742
 743         /* terminating empty line */
 744         wpabuf_put_str(buf, "\r\n");
 745
 746         body_start = wpabuf_put(buf, 0);
 747
 748         if (ret == HTTP_OK) {
 749                 wpabuf_put_str(buf, soap_prefix);
 750                 wpabuf_put_str(buf, "<u:");
 751                 wpabuf_put_data(buf, action, action_len);
 752                 wpabuf_put_str(buf, "Response xmlns:u=\"");
 753                 wpabuf_put_str(buf, urn_wfawlanconfig);
 754                 wpabuf_put_str(buf, "\">\n");
 755                 if (replydata && replyname) {
 756                         /* TODO: might possibly need to escape part of reply
 757                          * data? ...
 758                          * probably not, unlikely to have ampersand(&) or left
 759                          * angle bracket (<) in it...
 760                          */
 761                         wpabuf_printf(buf, "<%s>", replyname);
 762                         wpabuf_put_str(buf, replydata);
 763                         wpabuf_printf(buf, "</%s>\n", replyname);
 764                 }
 765                 wpabuf_put_str(buf, "</u:");
 766                 wpabuf_put_data(buf, action, action_len);
 767                 wpabuf_put_str(buf, "Response>\n");
 768                 wpabuf_put_str(buf, soap_postfix);
 769         } else {
 770                 /* Error case */
 771                 wpabuf_put_str(buf, soap_prefix);
 772                 wpabuf_put_str(buf, soap_error_prefix);
 773                 wpabuf_printf(buf, "<errorCode>%d</errorCode>\n", ret);
 774                 wpabuf_put_str(buf, soap_error_postfix);
 775                 wpabuf_put_str(buf, soap_postfix);
 776         }
 777         os_free(replydata);
 778
 779         /* Now patch in the content length at the end */
 780         if (body_start && put_length_here) {
 781                 int body_length = (char *) wpabuf_put(buf, 0) - body_start;
 782                 char len_buf[10];
 783                 os_snprintf(len_buf, sizeof(len_buf), "%d", body_length);
 784                 os_memcpy(put_length_here, len_buf, os_strlen(len_buf));
 785         }
 786
 787         http_request_send_and_deinit(req, buf);
 788 }
 789
 790
 791 static const char * web_get_action(struct http_request *req,
 792                                    size_t *action_len)
 793 {
 794         const char *match;
 795         int match_len;
 796         char *b;
 797         char *action;
 798
 799         *action_len = 0;
 800         /* The SOAPAction line of the header tells us what we want to do */
 801         b = http_request_get_hdr_line(req, "SOAPAction:");
 802         if (b == NULL)
 803                 return NULL;
 804         if (*b == '"')
 805                 b++;
 806         else
 807                 return NULL;
 808         match = urn_wfawlanconfig;
 809         match_len = os_strlen(urn_wfawlanconfig) - 1;
 810         if (os_strncasecmp(b, match, match_len))
 811                 return NULL;
 812         b += match_len;
 813         /* skip over version */
 814         while (isgraph(*b) && *b != '#')
 815                 b++;
 816         if (*b != '#')
 817                 return NULL;
 818         b++;
 819         /* Following the sharp(#) should be the action and a double quote */
 820         action = b;
 821         while (isgraph(*b) && *b != '"')
 822                 b++;
 823         if (*b != '"')
 824                 return NULL;
 825         *action_len = b - action;
 826         return action;
 827 }
 828
 829
 830 /* Given that we have received a header w/ POST, act upon it
 831  *
 832  * Format of POST (case-insensitive):
 833  *
 834  * First line must be:
 835  *      POST /<file> HTTP/1.1
 836  * Since we don't do anything fancy we just ignore other lines.
 837  *
 838  * Our response (if no error) which includes only required lines is:
 839  * HTTP/1.1 200 OK
 840  * Connection: close
 841  * Content-Type: text/xml
 842  * Date: <rfc1123-date>
 843  *
 844  * Header lines must end with \r\n
 845  * Per RFC 2616, content-length: is not required but connection:close
 846  * would appear to be required (given that we will be closing it!).
 847  */
 848 static void web_connection_parse_post(struct upnp_wps_device_sm *sm,
 849                                       struct sockaddr_in *cli,
 850                                       struct http_request *req,
 851                                       const char *filename)
 852 {
 853         enum http_reply_code ret;
 854         char *data = http_request_get_data(req); /* body of http msg */
 855         const char *action = NULL;
 856         size_t action_len = 0;
 857         const char *replyname = NULL; /* argument name for the reply */
 858         struct wpabuf *reply = NULL; /* data for the reply */
 859
 860         if (os_strcasecmp(filename, UPNP_WPS_DEVICE_CONTROL_FILE)) {
 861                 wpa_printf(MSG_INFO, "WPS UPnP: Invalid POST filename %s",
 862                            filename);
 863                 ret = HTTP_NOT_FOUND;
 864                 goto bad;
 865         }
 866
 867         ret = UPNP_INVALID_ACTION;
 868         action = web_get_action(req, &action_len);
 869         if (action == NULL)
 870                 goto bad;
 871
 872         if (!os_strncasecmp("GetDeviceInfo", action, action_len))
 873                 ret = web_process_get_device_info(sm, &reply, &replyname);
 874         else if (!os_strncasecmp("PutMessage", action, action_len))
 875                 ret = web_process_put_message(sm, data, &reply, &replyname);
 876         else if (!os_strncasecmp("PutWLANResponse", action, action_len))
 877                 ret = web_process_put_wlan_response(sm, data, &reply,
 878                                                     &replyname);
 879         else if (!os_strncasecmp("SetSelectedRegistrar", action, action_len))
 880                 ret = web_process_set_selected_registrar(sm, cli, data, &reply,
 881                                                          &replyname);
 882         else
 883                 wpa_printf(MSG_INFO, "WPS UPnP: Unknown POST type");
 884
 885 bad:
 886         if (ret != HTTP_OK)
 887                 wpa_printf(MSG_INFO, "WPS UPnP: POST failure ret=%d", ret);
 888         web_connection_send_reply(req, ret, action, action_len, reply,
 889                                   replyname);
 890         wpabuf_free(reply);
 891 }
 892
 893
 894 /* Given that we have received a header w/ SUBSCRIBE, act upon it
 895  *
 896  * Format of SUBSCRIBE (case-insensitive):
 897  *
 898  * First line must be:
 899  *      SUBSCRIBE /wps_event HTTP/1.1
 900  *
 901  * Our response (if no error) which includes only required lines is:
 902  * HTTP/1.1 200 OK
 903  * Server: xx, UPnP/1.0, xx
 904  * SID: uuid:xxxxxxxxx
 905  * Timeout: Second-<n>
 906  * Content-Length: 0
 907  * Date: xxxx
 908  *
 909  * Header lines must end with \r\n
 910  * Per RFC 2616, content-length: is not required but connection:close
 911  * would appear to be required (given that we will be closing it!).
 912  */
 913 static void web_connection_parse_subscribe(struct upnp_wps_device_sm *sm,
 914                                            struct http_request *req,
 915                                            const char *filename)
 916 {
 917         struct wpabuf *buf;
 918         char *b;
 919         char *hdr = http_request_get_hdr(req);
 920         char *h;
 921         char *match;
 922         int match_len;
 923         char *end;
 924         int len;
 925         int got_nt = 0;
 926         u8 uuid[UUID_LEN];
 927         int got_uuid = 0;
 928         char *callback_urls = NULL;
 929         struct subscription *s = NULL;
 930         enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR;
 931
 932         buf = wpabuf_alloc(1000);
 933         if (buf == NULL) {
 934                 http_request_deinit(req);
 935                 return;
 936         }
 937
 938         wpa_hexdump_ascii(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE",
 939                           (u8 *) hdr, os_strlen(hdr));
 940
 941         /* Parse/validate headers */
 942         h = hdr;
 943         /* First line: SUBSCRIBE /wps_event HTTP/1.1
 944          * has already been parsed.
 945          */
 946         if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) {
 947                 ret = HTTP_PRECONDITION_FAILED;
 948                 goto error;
 949         }
 950         wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE for event");
 951         end = os_strchr(h, '\n');
 952
 953         while (end) {
 954                 /* Option line by option line */
 955                 h = end + 1;
 956                 end = os_strchr(h, '\n');
 957                 if (end == NULL)
 958                         break; /* no unterminated lines allowed */
 959
 960                 /* NT assures that it is our type of subscription;
 961                  * not used for a renewal.
 962                  **/
 963                 match = "NT:";
 964                 match_len = os_strlen(match);
 965                 if (os_strncasecmp(h, match, match_len) == 0) {
 966                         h += match_len;
 967                         while (*h == ' ' || *h == '\t')
 968                                 h++;
 969                         match = "upnp:event";
 970                         match_len = os_strlen(match);
 971                         if (os_strncasecmp(h, match, match_len) != 0) {
 972                                 ret = HTTP_BAD_REQUEST;
 973                                 goto error;
 974                         }
 975                         got_nt = 1;
 976                         continue;
 977                 }
 978                 /* HOST should refer to us */
 979 #if 0
 980                 match = "HOST:";
 981                 match_len = os_strlen(match);
 982                 if (os_strncasecmp(h, match, match_len) == 0) {
 983                         h += match_len;
 984                         while (*h == ' ' || *h == '\t')
 985                                 h++;
 986                         .....
 987                 }
 988 #endif
 989                 /* CALLBACK gives one or more URLs for NOTIFYs
 990                  * to be sent as a result of the subscription.
 991                  * Each URL is enclosed in angle brackets.
 992                  */
 993                 match = "CALLBACK:";
 994                 match_len = os_strlen(match);
 995                 if (os_strncasecmp(h, match, match_len) == 0) {
 996                         h += match_len;
 997                         while (*h == ' ' || *h == '\t')
 998                                 h++;
 999                         len = end - h;
1000                         os_free(callback_urls);
1001                         callback_urls = dup_binstr(h, len);
1002                         if (callback_urls == NULL) {
1003                                 ret = HTTP_INTERNAL_SERVER_ERROR;
1004                                 goto error;
1005                         }
1006                         if (len > 0 && callback_urls[len - 1] == '\r')
1007                                 callback_urls[len - 1] = '\0';
1008                         continue;
1009                 }
1010                 /* SID is only for renewal */
1011                 match = "SID:";
1012                 match_len = os_strlen(match);
1013                 if (os_strncasecmp(h, match, match_len) == 0) {
1014                         h += match_len;
1015                         while (*h == ' ' || *h == '\t')
1016                                 h++;
1017                         match = "uuid:";
1018                         match_len = os_strlen(match);
1019                         if (os_strncasecmp(h, match, match_len) != 0) {
1020                                 ret = HTTP_BAD_REQUEST;
1021                                 goto error;
1022                         }
1023                         h += match_len;
1024                         while (*h == ' ' || *h == '\t')
1025                                 h++;
1026                         if (uuid_str2bin(h, uuid)) {
1027                                 ret = HTTP_BAD_REQUEST;
1028                                 goto error;
1029                         }
1030                         got_uuid = 1;
1031                         continue;
1032                 }
1033                 /* TIMEOUT is requested timeout, but apparently we can
1034                  * just ignore this.
1035                  */
1036         }
1037
1038         if (got_uuid) {
1039                 /* renewal */
1040                 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewal");
1041                 if (callback_urls) {
1042                         ret = HTTP_BAD_REQUEST;
1043                         goto error;
1044                 }
1045                 s = subscription_renew(sm, uuid);
1046                 if (s == NULL) {
1047                         char str[80];
1048                         uuid_bin2str(uuid, str, sizeof(str));
1049                         wpa_printf(MSG_DEBUG, "WPS UPnP: Could not find "
1050                                    "SID %s", str);
1051                         ret = HTTP_PRECONDITION_FAILED;
1052                         goto error;
1053                 }
1054         } else if (callback_urls) {
1055                 wpa_printf(MSG_DEBUG, "WPS UPnP: New subscription");
1056                 if (!got_nt) {
1057                         ret = HTTP_PRECONDITION_FAILED;
1058                         goto error;
1059                 }
1060                 s = subscription_start(sm, callback_urls);
1061                 if (s == NULL) {
1062                         ret = HTTP_INTERNAL_SERVER_ERROR;
1063                         goto error;
1064                 }
1065         } else {
1066                 ret = HTTP_PRECONDITION_FAILED;
1067                 goto error;
1068         }
1069
1070         /* success */
1071         http_put_reply_code(buf, HTTP_OK);
1072         wpabuf_put_str(buf, http_server_hdr);
1073         wpabuf_put_str(buf, http_connection_close);
1074         wpabuf_put_str(buf, "Content-Length: 0\r\n");
1075         wpabuf_put_str(buf, "SID: uuid:");
1076         /* subscription id */
1077         b = wpabuf_put(buf, 0);
1078         uuid_bin2str(s->uuid, b, 80);
1079         wpa_printf(MSG_DEBUG, "WPS UPnP: Assigned SID %s", b);
1080         wpabuf_put(buf, os_strlen(b));
1081         wpabuf_put_str(buf, "\r\n");
1082         wpabuf_printf(buf, "Timeout: Second-%d\r\n", UPNP_SUBSCRIBE_SEC);
1083         http_put_date(buf);
1084         /* And empty line to terminate header: */
1085         wpabuf_put_str(buf, "\r\n");
1086
1087         os_free(callback_urls);
1088         http_request_send_and_deinit(req, buf);
1089         return;
1090
1091 error:
1092         /* Per UPnP spec:
1093         * Errors
1094         * Incompatible headers
1095         *   400 Bad Request. If SID header and one of NT or CALLBACK headers
1096         *     are present, the publisher must respond with HTTP error
1097         *     400 Bad Request.
1098         * Missing or invalid CALLBACK
1099         *   412 Precondition Failed. If CALLBACK header is missing or does not
1100         *     contain a valid HTTP URL, the publisher must respond with HTTP
1101         *     error 412 Precondition Failed.
1102         * Invalid NT
1103         *   412 Precondition Failed. If NT header does not equal upnp:event,
1104         *     the publisher must respond with HTTP error 412 Precondition
1105         *     Failed.
1106         * [For resubscription, use 412 if unknown uuid].
1107         * Unable to accept subscription
1108         *   5xx. If a publisher is not able to accept a subscription (such as
1109         *     due to insufficient resources), it must respond with a
1110         *     HTTP 500-series error code.
1111         *   599 Too many subscriptions (not a standard HTTP error)
1112         */
1113         wpa_printf(MSG_DEBUG, "WPS UPnP: SUBSCRIBE failed - return %d", ret);
1114         http_put_empty(buf, ret);
1115         http_request_send_and_deinit(req, buf);
1116         os_free(callback_urls);
1117 }
1118
1119
1120 /* Given that we have received a header w/ UNSUBSCRIBE, act upon it
1121  *
1122  * Format of UNSUBSCRIBE (case-insensitive):
1123  *
1124  * First line must be:
1125  *      UNSUBSCRIBE /wps_event HTTP/1.1
1126  *
1127  * Our response (if no error) which includes only required lines is:
1128  * HTTP/1.1 200 OK
1129  * Content-Length: 0
1130  *
1131  * Header lines must end with \r\n
1132  * Per RFC 2616, content-length: is not required but connection:close
1133  * would appear to be required (given that we will be closing it!).
1134  */
1135 static void web_connection_parse_unsubscribe(struct upnp_wps_device_sm *sm,
1136                                              struct http_request *req,
1137                                              const char *filename)
1138 {
1139         struct wpabuf *buf;
1140         char *hdr = http_request_get_hdr(req);
1141         char *h;
1142         char *match;
1143         int match_len;
1144         char *end;
1145         u8 uuid[UUID_LEN];
1146         int got_uuid = 0;
1147         struct subscription *s = NULL;
1148         enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR;
1149
1150         /* Parse/validate headers */
1151         h = hdr;
1152         /* First line: UNSUBSCRIBE /wps_event HTTP/1.1
1153          * has already been parsed.
1154          */
1155         if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) {
1156                 ret = HTTP_PRECONDITION_FAILED;
1157                 goto send_msg;
1158         }
1159         wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP UNSUBSCRIBE for event");
1160         end = os_strchr(h, '\n');
1161
1162         while (end) {
1163                 /* Option line by option line */
1164                 h = end + 1;
1165                 end = os_strchr(h, '\n');
1166                 if (end == NULL)
1167                         break; /* no unterminated lines allowed */
1168
1169                 /* HOST should refer to us */
1170 #if 0
1171                 match = "HOST:";
1172                 match_len = os_strlen(match);
1173                 if (os_strncasecmp(h, match, match_len) == 0) {
1174                         h += match_len;
1175                         while (*h == ' ' || *h == '\t')
1176                                 h++;
1177                         .....
1178                 }
1179 #endif
1180                 match = "SID:";
1181                 match_len = os_strlen(match);
1182                 if (os_strncasecmp(h, match, match_len) == 0) {
1183                         h += match_len;
1184                         while (*h == ' ' || *h == '\t')
1185                                 h++;
1186                         match = "uuid:";
1187                         match_len = os_strlen(match);
1188                         if (os_strncasecmp(h, match, match_len) != 0) {
1189                                 ret = HTTP_BAD_REQUEST;
1190                                 goto send_msg;
1191                         }
1192                         h += match_len;
1193                         while (*h == ' ' || *h == '\t')
1194                                 h++;
1195                         if (uuid_str2bin(h, uuid)) {
1196                                 ret = HTTP_BAD_REQUEST;
1197                                 goto send_msg;
1198                         }
1199                         got_uuid = 1;
1200                         continue;
1201                 }
1202
1203                 match = "NT:";
1204                 match_len = os_strlen(match);
1205                 if (os_strncasecmp(h, match, match_len) == 0) {
1206                         ret = HTTP_BAD_REQUEST;
1207                         goto send_msg;
1208                 }
1209
1210                 match = "CALLBACK:";
1211                 match_len = os_strlen(match);
1212                 if (os_strncasecmp(h, match, match_len) == 0) {
1213                         ret = HTTP_BAD_REQUEST;
1214                         goto send_msg;
1215                 }
1216         }
1217
1218         if (got_uuid) {
1219                 char str[80];
1220
1221                 uuid_bin2str(uuid, str, sizeof(str));
1222
1223                 s = subscription_find(sm, uuid);
1224                 if (s) {
1225                         struct subscr_addr *sa;
1226                         sa = dl_list_first(&s->addr_list, struct subscr_addr,
1227                                            list);
1228                         wpa_printf(MSG_DEBUG,
1229                                    "WPS UPnP: Unsubscribing %p (SID %s) %s",
1230                                    s, str, (sa && sa->domain_and_port) ?
1231                                    sa->domain_and_port : "-null-");
1232                         dl_list_del(&s->list);
1233                         subscription_destroy(s);
1234                 } else {
1235                         wpa_printf(MSG_INFO,
1236                                    "WPS UPnP: Could not find matching subscription to unsubscribe (SID %s)",
1237                                    str);
1238                         ret = HTTP_PRECONDITION_FAILED;
1239                         goto send_msg;
1240                 }
1241         } else {
1242                 wpa_printf(MSG_INFO, "WPS UPnP: Unsubscribe fails (not "
1243                            "found)");
1244                 ret = HTTP_PRECONDITION_FAILED;
1245                 goto send_msg;
1246         }
1247
1248         ret = HTTP_OK;
1249
1250 send_msg:
1251         buf = wpabuf_alloc(200);
1252         if (buf == NULL) {
1253                 http_request_deinit(req);
1254                 return;
1255         }
1256         http_put_empty(buf, ret);
1257         http_request_send_and_deinit(req, buf);
1258 }
1259
1260
1261 /* Send error in response to unknown requests */
1262 static void web_connection_unimplemented(struct http_request *req)
1263 {
1264         struct wpabuf *buf;
1265         buf = wpabuf_alloc(200);
1266         if (buf == NULL) {
1267                 http_request_deinit(req);
1268                 return;
1269         }
1270         http_put_empty(buf, HTTP_UNIMPLEMENTED);
1271         http_request_send_and_deinit(req, buf);
1272 }
1273
1274
1275
1276 /* Called when we have gotten an apparently valid http request.
1277  */
1278 static void web_connection_check_data(void *ctx, struct http_request *req)
1279 {
1280         struct upnp_wps_device_sm *sm = ctx;
1281         enum httpread_hdr_type htype = http_request_get_type(req);
1282         char *filename = http_request_get_uri(req);
1283         struct sockaddr_in *cli = http_request_get_cli_addr(req);
1284
1285         if (!filename) {
1286                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get HTTP URI");
1287                 http_request_deinit(req);
1288                 return;
1289         }
1290         /* Trim leading slashes from filename */
1291         while (*filename == '/')
1292                 filename++;
1293
1294         wpa_printf(MSG_DEBUG, "WPS UPnP: Got HTTP request type %d from %s:%d",
1295                    htype, inet_ntoa(cli->sin_addr), htons(cli->sin_port));
1296
1297         switch (htype) {
1298         case HTTPREAD_HDR_TYPE_GET:
1299                 web_connection_parse_get(sm, req, filename);
1300                 break;
1301         case HTTPREAD_HDR_TYPE_POST:
1302                 web_connection_parse_post(sm, cli, req, filename);
1303                 break;
1304         case HTTPREAD_HDR_TYPE_SUBSCRIBE:
1305                 web_connection_parse_subscribe(sm, req, filename);
1306                 break;
1307         case HTTPREAD_HDR_TYPE_UNSUBSCRIBE:
1308                 web_connection_parse_unsubscribe(sm, req, filename);
1309                 break;
1310
1311                 /* We are not required to support M-POST; just plain
1312                  * POST is supposed to work, so we only support that.
1313                  * If for some reason we need to support M-POST, it is
1314                  * mostly the same as POST, with small differences.
1315                  */
1316         default:
1317                 /* Send 501 for anything else */
1318                 web_connection_unimplemented(req);
1319                 break;
1320         }
1321 }
1322
1323
1324 /*
1325  * Listening for web connections
1326  * We have a single TCP listening port, and hand off connections as we get
1327  * them.
1328  */
1329
1330 void web_listener_stop(struct upnp_wps_device_sm *sm)
1331 {
1332         http_server_deinit(sm->web_srv);
1333         sm->web_srv = NULL;
1334 }
1335
1336
1337 int web_listener_start(struct upnp_wps_device_sm *sm)
1338 {
1339         struct in_addr addr;
1340         addr.s_addr = sm->ip_addr;
1341         sm->web_srv = http_server_init(&addr, -1, web_connection_check_data,
1342                                        sm);
1343         if (sm->web_srv == NULL) {
1344                 web_listener_stop(sm);
1345                 return -1;
1346         }
1347         sm->web_port = http_server_get_port(sm->web_srv);
1348
1349         return 0;
1350 }