www.project-moonshot.org Git - mech_eap.orig/blob - libeap/src/wps/wps_er.c

   1 /*
   2  * Wi-Fi Protected Setup - External Registrar
   3  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "base64.h"
  19 #include "uuid.h"
  20 #include "eloop.h"
  21 #include "httpread.h"
  22 #include "http_client.h"
  23 #include "http_server.h"
  24 #include "upnp_xml.h"
  25 #include "wps_i.h"
  26 #include "wps_upnp.h"
  27 #include "wps_upnp_i.h"
  28 #include "wps_er.h"
  29
  30
  31 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx);
  32 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
  33 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
  34 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
  35 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
  36                                        void (*m1_handler)(struct wps_er_ap *ap,
  37                                                           struct wpabuf *m1));
  38
  39
  40 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
  41                              enum wps_event event)
  42 {
  43         union wps_event_data data;
  44         struct wps_event_er_enrollee *ev = &data.enrollee;
  45
  46         if (wps->event_cb == NULL)
  47                 return;
  48
  49         os_memset(&data, 0, sizeof(data));
  50         ev->uuid = sta->uuid;
  51         ev->mac_addr = sta->addr;
  52         ev->m1_received = sta->m1_received;
  53         ev->config_methods = sta->config_methods;
  54         ev->dev_passwd_id = sta->dev_passwd_id;
  55         ev->pri_dev_type = sta->pri_dev_type;
  56         ev->dev_name = sta->dev_name;
  57         ev->manufacturer = sta->manufacturer;
  58         ev->model_name = sta->model_name;
  59         ev->model_number = sta->model_number;
  60         ev->serial_number = sta->serial_number;
  61         wps->event_cb(wps->cb_ctx, event, &data);
  62 }
  63
  64
  65 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr)
  66 {
  67         struct wps_er_sta *sta;
  68         dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
  69                 if (os_memcmp(sta->addr, addr, ETH_ALEN) == 0)
  70                         return sta;
  71         }
  72         return NULL;
  73 }
  74
  75
  76 static void wps_er_sta_free(struct wps_er_sta *sta)
  77 {
  78         wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
  79         if (sta->wps)
  80                 wps_deinit(sta->wps);
  81         os_free(sta->manufacturer);
  82         os_free(sta->model_name);
  83         os_free(sta->model_number);
  84         os_free(sta->serial_number);
  85         os_free(sta->dev_name);
  86         http_client_free(sta->http);
  87         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
  88         os_free(sta->cred);
  89         os_free(sta);
  90 }
  91
  92
  93 static void wps_er_sta_remove_all(struct wps_er_ap *ap)
  94 {
  95         struct wps_er_sta *prev, *sta;
  96         dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
  97                 wps_er_sta_free(sta);
  98 }
  99
 100
 101 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
 102                                         struct in_addr *addr, const u8 *uuid)
 103 {
 104         struct wps_er_ap *ap;
 105         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 106                 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
 107                     (uuid == NULL ||
 108                      os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0))
 109                         return ap;
 110         }
 111         return NULL;
 112 }
 113
 114
 115 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
 116 {
 117         struct wps_er_ap *ap;
 118         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 119                 if (ap->id == id)
 120                         return ap;
 121         }
 122         return NULL;
 123 }
 124
 125
 126 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
 127                             enum wps_event event)
 128 {
 129         union wps_event_data data;
 130         struct wps_event_er_ap *evap = &data.ap;
 131
 132         if (wps->event_cb == NULL)
 133                 return;
 134
 135         os_memset(&data, 0, sizeof(data));
 136         evap->uuid = ap->uuid;
 137         evap->friendly_name = ap->friendly_name;
 138         evap->manufacturer = ap->manufacturer;
 139         evap->manufacturer_url = ap->manufacturer_url;
 140         evap->model_description = ap->model_description;
 141         evap->model_name = ap->model_name;
 142         evap->model_number = ap->model_number;
 143         evap->model_url = ap->model_url;
 144         evap->serial_number = ap->serial_number;
 145         evap->upc = ap->upc;
 146         evap->pri_dev_type = ap->pri_dev_type;
 147         evap->wps_state = ap->wps_state;
 148         evap->mac_addr = ap->mac_addr;
 149         wps->event_cb(wps->cb_ctx, event, &data);
 150 }
 151
 152
 153 static void wps_er_ap_free(struct wps_er_ap *ap)
 154 {
 155         http_client_free(ap->http);
 156         ap->http = NULL;
 157
 158         os_free(ap->location);
 159         os_free(ap->friendly_name);
 160         os_free(ap->manufacturer);
 161         os_free(ap->manufacturer_url);
 162         os_free(ap->model_description);
 163         os_free(ap->model_name);
 164         os_free(ap->model_number);
 165         os_free(ap->model_url);
 166         os_free(ap->serial_number);
 167         os_free(ap->udn);
 168         os_free(ap->upc);
 169
 170         os_free(ap->scpd_url);
 171         os_free(ap->control_url);
 172         os_free(ap->event_sub_url);
 173
 174         os_free(ap->ap_settings);
 175
 176         os_free(ap);
 177 }
 178
 179
 180 static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap)
 181 {
 182         wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)",
 183                    inet_ntoa(ap->addr), ap->location);
 184         dl_list_del(&ap->list);
 185         wps_er_ap_free(ap);
 186
 187         if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing)) {
 188                 eloop_cancel_timeout(wps_er_deinit_finish, er, NULL);
 189                 wps_er_deinit_finish(er, NULL);
 190         }
 191 }
 192
 193
 194 static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c,
 195                                        enum http_client_event event)
 196 {
 197         struct wps_er_ap *ap = ctx;
 198
 199         switch (event) {
 200         case HTTP_CLIENT_OK:
 201                 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events");
 202                 ap->subscribed = 0;
 203                 break;
 204         case HTTP_CLIENT_FAILED:
 205         case HTTP_CLIENT_INVALID_REPLY:
 206         case HTTP_CLIENT_TIMEOUT:
 207                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from "
 208                            "events");
 209                 break;
 210         }
 211         http_client_free(ap->http);
 212         ap->http = NULL;
 213
 214         /*
 215          * Need to get rid of the AP entry regardless of whether we managed to
 216          * unsubscribe cleanly or not.
 217          */
 218         wps_er_ap_unsubscribed(ap->er, ap);
 219 }
 220
 221
 222 static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap)
 223 {
 224         struct wpabuf *req;
 225         struct sockaddr_in dst;
 226         char *url, *path;
 227         char sid[100];
 228
 229         if (ap->event_sub_url == NULL) {
 230                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 231                            "subscribe");
 232                 goto fail;
 233         }
 234         if (ap->http) {
 235                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 236                            "send subscribe request");
 237                 goto fail;
 238         }
 239
 240         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 241         if (url == NULL) {
 242                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 243                 goto fail;
 244         }
 245
 246         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 247         if (req == NULL) {
 248                 os_free(url);
 249                 goto fail;
 250         }
 251         uuid_bin2str(ap->sid, sid, sizeof(sid));
 252         wpabuf_printf(req,
 253                       "UNSUBSCRIBE %s HTTP/1.1\r\n"
 254                       "HOST: %s:%d\r\n"
 255                       "SID: uuid:%s\r\n"
 256                       "\r\n",
 257                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid);
 258         os_free(url);
 259         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request",
 260                           wpabuf_head(req), wpabuf_len(req));
 261
 262         ap->http = http_client_addr(&dst, req, 1000,
 263                                     wps_er_http_unsubscribe_cb, ap);
 264         if (ap->http == NULL) {
 265                 wpabuf_free(req);
 266                 goto fail;
 267         }
 268         return;
 269
 270 fail:
 271         /*
 272          * Need to get rid of the AP entry even when we fail to unsubscribe
 273          * cleanly.
 274          */
 275         wps_er_ap_unsubscribed(ap->er, ap);
 276 }
 277
 278 static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap)
 279 {
 280         wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
 281                    inet_ntoa(ap->addr), ap->location);
 282         eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 283         wps_er_sta_remove_all(ap);
 284         wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
 285         http_client_free(ap->http);
 286         ap->http = NULL;
 287         if (ap->wps) {
 288                 wps_deinit(ap->wps);
 289                 ap->wps = NULL;
 290         }
 291
 292         dl_list_del(&ap->list);
 293         if (ap->subscribed) {
 294                 dl_list_add(&er->ap_unsubscribing, &ap->list);
 295                 wps_er_ap_unsubscribe(er, ap);
 296         } else
 297                 wps_er_ap_free(ap);
 298 }
 299
 300
 301 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
 302 {
 303         struct wps_er *er = eloop_data;
 304         struct wps_er_ap *ap = user_ctx;
 305         wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
 306         wps_er_ap_remove_entry(er, ap);
 307 }
 308
 309
 310 static int wps_er_get_sid(struct wps_er_ap *ap, char *sid)
 311 {
 312         char *pos;
 313         char txt[100];
 314
 315         if (!sid) {
 316                 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)",
 317                            inet_ntoa(ap->addr), ap->location);
 318                 return -1;
 319         }
 320
 321         pos = os_strstr(sid, "uuid:");
 322         if (!pos) {
 323                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
 324                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
 325                            sid);
 326                 return -1;
 327         }
 328
 329         pos += 5;
 330         if (uuid_str2bin(pos, ap->sid) < 0) {
 331                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
 332                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
 333                            sid);
 334                 return -1;
 335         }
 336
 337         uuid_bin2str(ap->sid, txt, sizeof(txt));
 338         wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s",
 339                    inet_ntoa(ap->addr), ap->location, txt);
 340
 341         return 0;
 342 }
 343
 344
 345 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
 346                                      enum http_client_event event)
 347 {
 348         struct wps_er_ap *ap = ctx;
 349
 350         switch (event) {
 351         case HTTP_CLIENT_OK:
 352                 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
 353                 ap->subscribed = 1;
 354                 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID"));
 355                 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
 356                 break;
 357         case HTTP_CLIENT_FAILED:
 358         case HTTP_CLIENT_INVALID_REPLY:
 359         case HTTP_CLIENT_TIMEOUT:
 360                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
 361                 break;
 362         }
 363         http_client_free(ap->http);
 364         ap->http = NULL;
 365 }
 366
 367
 368 static void wps_er_subscribe(struct wps_er_ap *ap)
 369 {
 370         struct wpabuf *req;
 371         struct sockaddr_in dst;
 372         char *url, *path;
 373
 374         if (ap->event_sub_url == NULL) {
 375                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 376                            "subscribe");
 377                 return;
 378         }
 379         if (ap->http) {
 380                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 381                            "send subscribe request");
 382                 return;
 383         }
 384
 385         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 386         if (url == NULL) {
 387                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 388                 return;
 389         }
 390
 391         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 392         if (req == NULL) {
 393                 os_free(url);
 394                 return;
 395         }
 396         wpabuf_printf(req,
 397                       "SUBSCRIBE %s HTTP/1.1\r\n"
 398                       "HOST: %s:%d\r\n"
 399                       "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
 400                       "NT: upnp:event\r\n"
 401                       "TIMEOUT: Second-%d\r\n"
 402                       "\r\n",
 403                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
 404                       ap->er->ip_addr_text, ap->er->http_port,
 405                       ap->er->event_id, ap->id, 1800);
 406         os_free(url);
 407         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
 408                           wpabuf_head(req), wpabuf_len(req));
 409
 410         ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
 411                                     ap);
 412         if (ap->http == NULL)
 413                 wpabuf_free(req);
 414 }
 415
 416
 417 static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
 418 {
 419         struct wps_parse_attr attr;
 420
 421         if (wps_parse_msg(m1, &attr) < 0) {
 422                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
 423                 return;
 424         }
 425         if (attr.primary_dev_type)
 426                 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
 427         if (attr.wps_state)
 428                 ap->wps_state = *attr.wps_state;
 429         if (attr.mac_addr)
 430                 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
 431
 432         wps_er_subscribe(ap);
 433 }
 434
 435
 436 static void wps_er_get_device_info(struct wps_er_ap *ap)
 437 {
 438         wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
 439 }
 440
 441
 442 static void wps_er_parse_device_description(struct wps_er_ap *ap,
 443                                             struct wpabuf *reply)
 444 {
 445         /* Note: reply includes null termination after the buffer data */
 446         const char *data = wpabuf_head(reply);
 447         char *pos;
 448
 449         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
 450                           wpabuf_head(reply), wpabuf_len(reply));
 451
 452         ap->friendly_name = xml_get_first_item(data, "friendlyName");
 453         wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
 454
 455         ap->manufacturer = xml_get_first_item(data, "manufacturer");
 456         wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
 457
 458         ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
 459         wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
 460                    ap->manufacturer_url);
 461
 462         ap->model_description = xml_get_first_item(data, "modelDescription");
 463         wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
 464                    ap->model_description);
 465
 466         ap->model_name = xml_get_first_item(data, "modelName");
 467         wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
 468
 469         ap->model_number = xml_get_first_item(data, "modelNumber");
 470         wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
 471
 472         ap->model_url = xml_get_first_item(data, "modelURL");
 473         wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
 474
 475         ap->serial_number = xml_get_first_item(data, "serialNumber");
 476         wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
 477
 478         ap->udn = xml_get_first_item(data, "UDN");
 479         wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
 480         pos = os_strstr(ap->udn, "uuid:");
 481         if (pos) {
 482                 pos += 5;
 483                 if (uuid_str2bin(pos, ap->uuid) < 0)
 484                         wpa_printf(MSG_DEBUG, "WPS ER: Invalid UUID in UDN");
 485         }
 486
 487         ap->upc = xml_get_first_item(data, "UPC");
 488         wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
 489
 490         ap->scpd_url = http_link_update(
 491                 xml_get_first_item(data, "SCPDURL"), ap->location);
 492         wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
 493
 494         ap->control_url = http_link_update(
 495                 xml_get_first_item(data, "controlURL"), ap->location);
 496         wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
 497
 498         ap->event_sub_url = http_link_update(
 499                 xml_get_first_item(data, "eventSubURL"), ap->location);
 500         wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
 501 }
 502
 503
 504 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
 505                                     enum http_client_event event)
 506 {
 507         struct wps_er_ap *ap = ctx;
 508         struct wpabuf *reply;
 509         int ok = 0;
 510
 511         switch (event) {
 512         case HTTP_CLIENT_OK:
 513                 reply = http_client_get_body(c);
 514                 if (reply == NULL)
 515                         break;
 516                 wps_er_parse_device_description(ap, reply);
 517                 ok = 1;
 518                 break;
 519         case HTTP_CLIENT_FAILED:
 520         case HTTP_CLIENT_INVALID_REPLY:
 521         case HTTP_CLIENT_TIMEOUT:
 522                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
 523                 break;
 524         }
 525         http_client_free(ap->http);
 526         ap->http = NULL;
 527         if (ok)
 528                 wps_er_get_device_info(ap);
 529 }
 530
 531
 532 void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
 533                    const char *location, int max_age)
 534 {
 535         struct wps_er_ap *ap;
 536
 537         ap = wps_er_ap_get(er, addr, uuid);
 538         if (ap) {
 539                 /* Update advertisement timeout */
 540                 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 541                 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 542                 return;
 543         }
 544
 545         ap = os_zalloc(sizeof(*ap));
 546         if (ap == NULL)
 547                 return;
 548         dl_list_init(&ap->sta);
 549         ap->er = er;
 550         ap->id = ++er->next_ap_id;
 551         ap->location = os_strdup(location);
 552         if (ap->location == NULL) {
 553                 os_free(ap);
 554                 return;
 555         }
 556         dl_list_add(&er->ap, &ap->list);
 557
 558         ap->addr.s_addr = addr->s_addr;
 559         os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
 560         eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 561
 562         wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
 563                    inet_ntoa(ap->addr), ap->location);
 564
 565         /* Fetch device description */
 566         ap->http = http_client_url(ap->location, NULL, 10000,
 567                                    wps_er_http_dev_desc_cb, ap);
 568 }
 569
 570
 571 void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
 572 {
 573         struct wps_er_ap *ap;
 574         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 575                 if (ap->addr.s_addr == addr->s_addr) {
 576                         wps_er_ap_remove_entry(er, ap);
 577                         return;
 578                 }
 579         }
 580 }
 581
 582
 583 static void wps_er_ap_remove_all(struct wps_er *er)
 584 {
 585         struct wps_er_ap *prev, *ap;
 586         dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
 587                 wps_er_ap_remove_entry(er, ap);
 588 }
 589
 590
 591 static void http_put_date(struct wpabuf *buf)
 592 {
 593         wpabuf_put_str(buf, "Date: ");
 594         format_date(buf);
 595         wpabuf_put_str(buf, "\r\n");
 596 }
 597
 598
 599 static void wps_er_http_resp_not_found(struct http_request *req)
 600 {
 601         struct wpabuf *buf;
 602         buf = wpabuf_alloc(200);
 603         if (buf == NULL) {
 604                 http_request_deinit(req);
 605                 return;
 606         }
 607
 608         wpabuf_put_str(buf,
 609                        "HTTP/1.1 404 Not Found\r\n"
 610                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 611                        "Connection: close\r\n");
 612         http_put_date(buf);
 613         wpabuf_put_str(buf, "\r\n");
 614         http_request_send_and_deinit(req, buf);
 615 }
 616
 617
 618 static void wps_er_http_resp_ok(struct http_request *req)
 619 {
 620         struct wpabuf *buf;
 621         buf = wpabuf_alloc(200);
 622         if (buf == NULL) {
 623                 http_request_deinit(req);
 624                 return;
 625         }
 626
 627         wpabuf_put_str(buf,
 628                        "HTTP/1.1 200 OK\r\n"
 629                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 630                        "Connection: close\r\n"
 631                        "Content-Length: 0\r\n");
 632         http_put_date(buf);
 633         wpabuf_put_str(buf, "\r\n");
 634         http_request_send_and_deinit(req, buf);
 635 }
 636
 637
 638 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
 639 {
 640         struct wps_er_sta *sta = eloop_data;
 641         wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
 642         dl_list_del(&sta->list);
 643         wps_er_sta_free(sta);
 644 }
 645
 646
 647 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
 648                                                const u8 *addr,
 649                                                struct wps_parse_attr *attr,
 650                                                int probe_req)
 651 {
 652         struct wps_er_sta *sta = wps_er_sta_get(ap, addr);
 653         int new_sta = 0;
 654         int m1;
 655
 656         m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
 657
 658         if (sta == NULL) {
 659                 /*
 660                  * Only allow new STA entry to be added based on Probe Request
 661                  * or M1. This will filter out bogus events and anything that
 662                  * may have been ongoing at the time ER subscribed for events.
 663                  */
 664                 if (!probe_req && !m1)
 665                         return NULL;
 666
 667                 sta = os_zalloc(sizeof(*sta));
 668                 if (sta == NULL)
 669                         return NULL;
 670                 os_memcpy(sta->addr, addr, ETH_ALEN);
 671                 sta->ap = ap;
 672                 dl_list_add(&ap->sta, &sta->list);
 673                 new_sta = 1;
 674         }
 675
 676         if (m1)
 677                 sta->m1_received = 1;
 678
 679         if (attr->config_methods && (!probe_req || !sta->m1_received))
 680                 sta->config_methods = WPA_GET_BE16(attr->config_methods);
 681         if (attr->uuid_e && (!probe_req || !sta->m1_received))
 682                 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
 683         if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
 684                 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
 685         if (attr->dev_password_id && (!probe_req || !sta->m1_received))
 686                 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
 687
 688         if (attr->manufacturer) {
 689                 os_free(sta->manufacturer);
 690                 sta->manufacturer = os_malloc(attr->manufacturer_len + 1);
 691                 if (sta->manufacturer) {
 692                         os_memcpy(sta->manufacturer, attr->manufacturer,
 693                                   attr->manufacturer_len);
 694                         sta->manufacturer[attr->manufacturer_len] = '\0';
 695                 }
 696         }
 697
 698         if (attr->model_name) {
 699                 os_free(sta->model_name);
 700                 sta->model_name = os_malloc(attr->model_name_len + 1);
 701                 if (sta->model_name) {
 702                         os_memcpy(sta->model_name, attr->model_name,
 703                                   attr->model_name_len);
 704                         sta->model_name[attr->model_name_len] = '\0';
 705                 }
 706         }
 707
 708         if (attr->model_number) {
 709                 os_free(sta->model_number);
 710                 sta->model_number = os_malloc(attr->model_number_len + 1);
 711                 if (sta->model_number) {
 712                         os_memcpy(sta->model_number, attr->model_number,
 713                                   attr->model_number_len);
 714                         sta->model_number[attr->model_number_len] = '\0';
 715                 }
 716         }
 717
 718         if (attr->serial_number) {
 719                 os_free(sta->serial_number);
 720                 sta->serial_number = os_malloc(attr->serial_number_len + 1);
 721                 if (sta->serial_number) {
 722                         os_memcpy(sta->serial_number, attr->serial_number,
 723                                   attr->serial_number_len);
 724                         sta->serial_number[attr->serial_number_len] = '\0';
 725                 }
 726         }
 727
 728         if (attr->dev_name) {
 729                 os_free(sta->dev_name);
 730                 sta->dev_name = os_malloc(attr->dev_name_len + 1);
 731                 if (sta->dev_name) {
 732                         os_memcpy(sta->dev_name, attr->dev_name,
 733                                   attr->dev_name_len);
 734                         sta->dev_name[attr->dev_name_len] = '\0';
 735                 }
 736         }
 737
 738         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 739         eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
 740
 741         if (m1 || new_sta)
 742                 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
 743
 744         return sta;
 745 }
 746
 747
 748 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
 749                                                const u8 *addr,
 750                                                struct wpabuf *msg)
 751 {
 752         struct wps_parse_attr attr;
 753
 754         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
 755                    MACSTR, MAC2STR(addr));
 756         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 757                         "(TLVs from Probe Request)", msg);
 758
 759         if (wps_parse_msg(msg, &attr) < 0) {
 760                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 761                            "WLANEvent message");
 762                 return;
 763         }
 764
 765         wps_er_add_sta_data(ap, addr, &attr, 1);
 766         wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0);
 767 }
 768
 769
 770 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
 771                                              enum http_client_event event)
 772 {
 773         struct wps_er_sta *sta = ctx;
 774
 775         switch (event) {
 776         case HTTP_CLIENT_OK:
 777                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
 778                 break;
 779         case HTTP_CLIENT_FAILED:
 780         case HTTP_CLIENT_INVALID_REPLY:
 781         case HTTP_CLIENT_TIMEOUT:
 782                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
 783                 break;
 784         }
 785         http_client_free(sta->http);
 786         sta->http = NULL;
 787 }
 788
 789
 790 static const char *soap_prefix =
 791         "<?xml version=\"1.0\"?>\n"
 792         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 793         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
 794         "<s:Body>\n";
 795 static const char *soap_postfix =
 796         "</s:Body>\n</s:Envelope>\n";
 797 static const char *urn_wfawlanconfig =
 798         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
 799
 800 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
 801                                        const char *name, const char *arg_name,
 802                                        const char *path,
 803                                        const struct sockaddr_in *dst,
 804                                        char **len_ptr, char **body_ptr)
 805 {
 806         unsigned char *encoded;
 807         size_t encoded_len;
 808         struct wpabuf *buf;
 809
 810         if (msg) {
 811                 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
 812                                         &encoded_len);
 813                 if (encoded == NULL)
 814                         return NULL;
 815         } else {
 816                 encoded = NULL;
 817                 encoded_len = 0;
 818         }
 819
 820         buf = wpabuf_alloc(1000 + encoded_len);
 821         if (buf == NULL) {
 822                 os_free(encoded);
 823                 return NULL;
 824         }
 825
 826         wpabuf_printf(buf,
 827                       "POST %s HTTP/1.1\r\n"
 828                       "Host: %s:%d\r\n"
 829                       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
 830                       "Content-Length: ",
 831                       path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
 832
 833         *len_ptr = wpabuf_put(buf, 0);
 834         wpabuf_printf(buf,
 835                       "        \r\n"
 836                       "SOAPACTION: \"%s#%s\"\r\n"
 837                       "\r\n",
 838                       urn_wfawlanconfig, name);
 839
 840         *body_ptr = wpabuf_put(buf, 0);
 841
 842         wpabuf_put_str(buf, soap_prefix);
 843         wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
 844         wpabuf_put_str(buf, urn_wfawlanconfig);
 845         wpabuf_put_str(buf, "\">\n");
 846         if (encoded) {
 847                 wpabuf_printf(buf, "<%s>%s</%s>\n",
 848                               arg_name, (char *) encoded, arg_name);
 849                 os_free(encoded);
 850         }
 851
 852         return buf;
 853 }
 854
 855
 856 static void wps_er_soap_end(struct wpabuf *buf, const char *name,
 857                             char *len_ptr, char *body_ptr)
 858 {
 859         char len_buf[10];
 860         wpabuf_printf(buf, "</u:%s>\n", name);
 861         wpabuf_put_str(buf, soap_postfix);
 862         os_snprintf(len_buf, sizeof(len_buf), "%d",
 863                     (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
 864         os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
 865 }
 866
 867
 868 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
 869 {
 870         struct wpabuf *buf;
 871         char *len_ptr, *body_ptr;
 872         struct sockaddr_in dst;
 873         char *url, *path;
 874
 875         if (sta->http) {
 876                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
 877                            "ignore new request");
 878                 wpabuf_free(msg);
 879                 return;
 880         }
 881
 882         if (sta->ap->control_url == NULL) {
 883                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
 884                 wpabuf_free(msg);
 885                 return;
 886         }
 887
 888         url = http_client_url_parse(sta->ap->control_url, &dst, &path);
 889         if (url == NULL) {
 890                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
 891                 wpabuf_free(msg);
 892                 return;
 893         }
 894
 895         buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
 896                               &len_ptr, &body_ptr);
 897         wpabuf_free(msg);
 898         os_free(url);
 899         if (buf == NULL)
 900                 return;
 901         wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
 902                       UPNP_WPS_WLANEVENT_TYPE_EAP);
 903         wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
 904                       MAC2STR(sta->addr));
 905
 906         wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
 907
 908         sta->http = http_client_addr(&dst, buf, 1000,
 909                                      wps_er_http_put_wlan_response_cb, sta);
 910         if (sta->http == NULL)
 911                 wpabuf_free(buf);
 912 }
 913
 914
 915 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
 916                                enum wsc_op_code op_code)
 917 {
 918         enum wps_process_res res;
 919
 920         res = wps_process_msg(sta->wps, op_code, msg);
 921         if (res == WPS_CONTINUE) {
 922                 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
 923                 if (next)
 924                         wps_er_sta_send_msg(sta, next);
 925         } else {
 926                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
 927                            "enrollee (res=%d)",
 928                            res == WPS_DONE ? "succeeded" : "failed", res);
 929                 wps_deinit(sta->wps);
 930                 sta->wps = NULL;
 931                 if (res == WPS_DONE) {
 932                         /* Remove the STA entry after short timeout */
 933                         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 934                         eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
 935                                                NULL);
 936                 }
 937         }
 938 }
 939
 940
 941 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
 942 {
 943         struct wps_config cfg;
 944
 945         if (sta->wps)
 946                 wps_deinit(sta->wps);
 947
 948         os_memset(&cfg, 0, sizeof(cfg));
 949         cfg.wps = sta->ap->er->wps;
 950         cfg.registrar = 1;
 951         cfg.peer_addr = sta->addr;
 952
 953         sta->wps = wps_init(&cfg);
 954         if (sta->wps == NULL)
 955                 return;
 956         sta->wps->er = 1;
 957         sta->wps->use_cred = sta->ap->ap_settings;
 958         if (sta->ap->ap_settings) {
 959                 os_free(sta->cred);
 960                 sta->cred = os_malloc(sizeof(*sta->cred));
 961                 if (sta->cred) {
 962                         os_memcpy(sta->cred, sta->ap->ap_settings,
 963                                   sizeof(*sta->cred));
 964                         sta->cred->cred_attr = NULL;
 965                         os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN);
 966                         sta->wps->use_cred = sta->cred;
 967                 }
 968         }
 969
 970         wps_er_sta_process(sta, msg, WSC_MSG);
 971 }
 972
 973
 974 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
 975                                          struct wpabuf *msg)
 976 {
 977         struct wps_parse_attr attr;
 978         struct wps_er_sta *sta;
 979
 980         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
 981                    MAC2STR(addr));
 982         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 983                         "(TLVs from EAP-WSC)", msg);
 984
 985         if (wps_parse_msg(msg, &attr) < 0) {
 986                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 987                            "WLANEvent message");
 988                 return;
 989         }
 990
 991         sta = wps_er_add_sta_data(ap, addr, &attr, 0);
 992         if (sta == NULL)
 993                 return;
 994
 995         if (attr.msg_type && *attr.msg_type == WPS_M1)
 996                 wps_er_sta_start(sta, msg);
 997         else if (sta->wps) {
 998                 enum wsc_op_code op_code = WSC_MSG;
 999                 if (attr.msg_type) {
1000                         switch (*attr.msg_type) {
1001                         case WPS_WSC_ACK:
1002                                 op_code = WSC_ACK;
1003                                 break;
1004                         case WPS_WSC_NACK:
1005                                 op_code = WSC_NACK;
1006                                 break;
1007                         case WPS_WSC_DONE:
1008                                 op_code = WSC_Done;
1009                                 break;
1010                         }
1011                 }
1012                 wps_er_sta_process(sta, msg, op_code);
1013         }
1014 }
1015
1016
1017 static void wps_er_process_wlanevent(struct wps_er_ap *ap,
1018                                      struct wpabuf *event)
1019 {
1020         u8 *data;
1021         u8 wlan_event_type;
1022         u8 wlan_event_mac[ETH_ALEN];
1023         struct wpabuf msg;
1024
1025         wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
1026                     wpabuf_head(event), wpabuf_len(event));
1027         if (wpabuf_len(event) < 1 + 17) {
1028                 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
1029                 return;
1030         }
1031
1032         data = wpabuf_mhead(event);
1033         wlan_event_type = data[0];
1034         if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
1035                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
1036                            "WLANEvent");
1037                 return;
1038         }
1039
1040         wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
1041
1042         switch (wlan_event_type) {
1043         case 1:
1044                 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
1045                 break;
1046         case 2:
1047                 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
1048                 break;
1049         default:
1050                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
1051                            wlan_event_type);
1052                 break;
1053         }
1054 }
1055
1056
1057 static void wps_er_http_event(struct wps_er *er, struct http_request *req,
1058                               unsigned int ap_id)
1059 {
1060         struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
1061         struct wpabuf *event;
1062         enum http_reply_code ret;
1063
1064         if (ap == NULL) {
1065                 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
1066                            "%u", ap_id);
1067                 wps_er_http_resp_not_found(req);
1068                 return;
1069         }
1070         wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
1071                    ap_id, http_request_get_data(req));
1072
1073         event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
1074                                     &ret);
1075         if (event == NULL) {
1076                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
1077                            "from the event notification");
1078                 /*
1079                  * Reply with OK anyway to avoid getting unregistered from
1080                  * events.
1081                  */
1082                 wps_er_http_resp_ok(req);
1083                 return;
1084         }
1085
1086         wps_er_process_wlanevent(ap, event);
1087
1088         wpabuf_free(event);
1089         wps_er_http_resp_ok(req);
1090 }
1091
1092
1093 static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
1094 {
1095         char *uri = http_request_get_uri(req);
1096
1097         if (os_strncmp(uri, "/event/", 7) == 0) {
1098                 unsigned int event_id;
1099                 char *pos;
1100                 event_id = atoi(uri + 7);
1101                 if (event_id != er->event_id) {
1102                         wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
1103                                    "unknown event id %u", event_id);
1104                         return;
1105                 }
1106                 pos = os_strchr(uri + 7, '/');
1107                 if (pos == NULL)
1108                         return;
1109                 pos++;
1110                 wps_er_http_event(er, req, atoi(pos));
1111         } else {
1112                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
1113                            uri);
1114                 wps_er_http_resp_not_found(req);
1115         }
1116 }
1117
1118
1119 static void wps_er_http_req(void *ctx, struct http_request *req)
1120 {
1121         struct wps_er *er = ctx;
1122         struct sockaddr_in *cli = http_request_get_cli_addr(req);
1123         enum httpread_hdr_type type = http_request_get_type(req);
1124         struct wpabuf *buf;
1125
1126         wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
1127                    "%s:%d",
1128                    http_request_get_uri(req), type,
1129                    inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
1130
1131         switch (type) {
1132         case HTTPREAD_HDR_TYPE_NOTIFY:
1133                 wps_er_http_notify(er, req);
1134                 break;
1135         default:
1136                 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
1137                            "%d", type);
1138                 buf = wpabuf_alloc(200);
1139                 if (buf == NULL) {
1140                         http_request_deinit(req);
1141                         return;
1142                 }
1143                 wpabuf_put_str(buf,
1144                                "HTTP/1.1 501 Unimplemented\r\n"
1145                                "Connection: close\r\n");
1146                 http_put_date(buf);
1147                 wpabuf_put_str(buf, "\r\n");
1148                 http_request_send_and_deinit(req, buf);
1149                 break;
1150         }
1151 }
1152
1153
1154 struct wps_er *
1155 wps_er_init(struct wps_context *wps, const char *ifname, const char *filter)
1156 {
1157         struct wps_er *er;
1158         struct in_addr addr;
1159
1160         er = os_zalloc(sizeof(*er));
1161         if (er == NULL)
1162                 return NULL;
1163         dl_list_init(&er->ap);
1164         dl_list_init(&er->ap_unsubscribing);
1165
1166         er->multicast_sd = -1;
1167         er->ssdp_sd = -1;
1168
1169         os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1170         er->wps = wps;
1171         if (os_get_random((unsigned char *) &er->event_id,
1172                           sizeof(er->event_id)) < 0) {
1173                 wps_er_deinit(er, NULL, NULL);
1174                 return NULL;
1175         }
1176         /* Limit event_id to < 32 bits to avoid issues with atoi() */
1177         er->event_id &= 0x0fffffff;
1178
1179         if (filter) {
1180                 if (inet_aton(filter, &er->filter_addr) == 0) {
1181                         wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter "
1182                                    "address %s", filter);
1183                         wps_er_deinit(er, NULL, NULL);
1184                         return NULL;
1185                 }
1186                 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections "
1187                            "with %s", filter);
1188         }
1189         if (get_netif_info(ifname, &er->ip_addr, &er->ip_addr_text,
1190                            er->mac_addr)) {
1191                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1192                            "for %s. Does it have IP address?", ifname);
1193                 wps_er_deinit(er, NULL, NULL);
1194                 return NULL;
1195         }
1196
1197         if (wps_er_ssdp_init(er) < 0) {
1198                 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed");
1199                 wps_er_deinit(er, NULL, NULL);
1200                 return NULL;
1201         }
1202
1203         addr.s_addr = er->ip_addr;
1204         er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1205         if (er->http_srv == NULL) {
1206                 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed");
1207                 wps_er_deinit(er, NULL, NULL);
1208                 return NULL;
1209         }
1210         er->http_port = http_server_get_port(er->http_srv);
1211
1212         wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)",
1213                    er->ifname, er->ip_addr_text);
1214
1215         return er;
1216 }
1217
1218
1219 void wps_er_refresh(struct wps_er *er)
1220 {
1221         struct wps_er_ap *ap;
1222         struct wps_er_sta *sta;
1223
1224         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1225                 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
1226                 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
1227                         wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
1228         }
1229
1230         wps_er_send_ssdp_msearch(er);
1231 }
1232
1233
1234 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx)
1235 {
1236         struct wps_er *er = eloop_data;
1237         void (*deinit_done_cb)(void *ctx);
1238         void *deinit_done_ctx;
1239
1240         wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit");
1241
1242         deinit_done_cb = er->deinit_done_cb;
1243         deinit_done_ctx = er->deinit_done_ctx;
1244         os_free(er->ip_addr_text);
1245         os_free(er);
1246
1247         if (deinit_done_cb)
1248                 deinit_done_cb(deinit_done_ctx);
1249 }
1250
1251
1252 void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx)
1253 {
1254         if (er == NULL)
1255                 return;
1256         http_server_deinit(er->http_srv);
1257         wps_er_ap_remove_all(er);
1258         wps_er_ssdp_deinit(er);
1259         eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0,
1260                                wps_er_deinit_finish, er, NULL);
1261         wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout");
1262         er->deinitializing = 1;
1263         er->deinit_done_cb = cb;
1264         er->deinit_done_ctx = ctx;
1265 }
1266
1267
1268 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1269                                        enum http_client_event event)
1270 {
1271         struct wps_er_ap *ap = ctx;
1272
1273         switch (event) {
1274         case HTTP_CLIENT_OK:
1275                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1276                 break;
1277         case HTTP_CLIENT_FAILED:
1278         case HTTP_CLIENT_INVALID_REPLY:
1279         case HTTP_CLIENT_TIMEOUT:
1280                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1281                 break;
1282         }
1283         http_client_free(ap->http);
1284         ap->http = NULL;
1285 }
1286
1287
1288 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1289 {
1290         struct wpabuf *buf;
1291         char *len_ptr, *body_ptr;
1292         struct sockaddr_in dst;
1293         char *url, *path;
1294
1295         if (ap->control_url == NULL) {
1296                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1297                 return;
1298         }
1299
1300         if (ap->http) {
1301                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1302                            "ignore new request");
1303                 return;
1304         }
1305
1306         if (ap->wps) {
1307                 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - "
1308                            "skip SetSelectedRegistrar");
1309                 return;
1310         }
1311
1312         url = http_client_url_parse(ap->control_url, &dst, &path);
1313         if (url == NULL) {
1314                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1315                 return;
1316         }
1317
1318         buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1319                               &dst, &len_ptr, &body_ptr);
1320         os_free(url);
1321         if (buf == NULL)
1322                 return;
1323
1324         wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1325
1326         ap->http = http_client_addr(&dst, buf, 1000,
1327                                     wps_er_http_set_sel_reg_cb, ap);
1328         if (ap->http == NULL)
1329                 wpabuf_free(buf);
1330 }
1331
1332
1333 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1334 {
1335         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1336         wpabuf_put_be16(msg, 1);
1337         wpabuf_put_u8(msg, !!sel_reg);
1338         return 0;
1339 }
1340
1341
1342 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1343 {
1344         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1345         wpabuf_put_be16(msg, 2);
1346         wpabuf_put_be16(msg, dev_passwd_id);
1347         return 0;
1348 }
1349
1350
1351 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1352                                                u16 sel_reg_config_methods)
1353 {
1354         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1355         wpabuf_put_be16(msg, 2);
1356         wpabuf_put_be16(msg, sel_reg_config_methods);
1357         return 0;
1358 }
1359
1360
1361 static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r)
1362 {
1363 #ifdef CONFIG_WPS2
1364         wpabuf_put_be16(msg, ATTR_UUID_R);
1365         wpabuf_put_be16(msg, WPS_UUID_LEN);
1366         wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN);
1367 #endif /* CONFIG_WPS2 */
1368         return 0;
1369 }
1370
1371
1372 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1373                         u16 sel_reg_config_methods)
1374 {
1375         struct wpabuf *msg;
1376         struct wps_er_ap *ap;
1377         struct wps_registrar *reg = er->wps->registrar;
1378         const u8 *auth_macs;
1379         size_t count;
1380
1381         if (er->skip_set_sel_reg) {
1382                 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar");
1383                 return;
1384         }
1385
1386         msg = wpabuf_alloc(500);
1387         if (msg == NULL)
1388                 return;
1389
1390         auth_macs = wps_authorized_macs(reg, &count);
1391
1392         if (wps_build_version(msg) ||
1393             wps_er_build_selected_registrar(msg, sel_reg) ||
1394             wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1395             wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
1396             wps_build_wfa_ext(msg, 0, auth_macs, count) ||
1397             wps_er_build_uuid_r(msg, er->wps->uuid)) {
1398                 wpabuf_free(msg);
1399                 return;
1400         }
1401
1402         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list)
1403                 wps_er_send_set_sel_reg(ap, msg);
1404
1405         wpabuf_free(msg);
1406 }
1407
1408
1409 int wps_er_pbc(struct wps_er *er, const u8 *uuid)
1410 {
1411         if (er == NULL || er->wps == NULL)
1412                 return -1;
1413
1414         if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) {
1415                 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC "
1416                            "mode");
1417                 return -1;
1418         }
1419
1420         /*
1421          * TODO: Should enable PBC mode only in a single AP based on which AP
1422          * the Enrollee (uuid) is using. Now, we may end up enabling multiple
1423          * APs in PBC mode which could result in session overlap at the
1424          * Enrollee.
1425          */
1426         if (wps_registrar_button_pushed(er->wps->registrar))
1427                 return -1;
1428
1429         return 0;
1430 }
1431
1432
1433 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1434 {
1435         struct wps_er_ap *ap = ctx;
1436         union wps_event_data data;
1437
1438         wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1439         os_free(ap->ap_settings);
1440         ap->ap_settings = os_malloc(sizeof(*cred));
1441         if (ap->ap_settings) {
1442                 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1443                 ap->ap_settings->cred_attr = NULL;
1444         }
1445
1446         os_memset(&data, 0, sizeof(data));
1447         data.ap_settings.uuid = ap->uuid;
1448         data.ap_settings.cred = cred;
1449         ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS,
1450                               &data);
1451 }
1452
1453
1454 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1455                                        enum http_client_event event)
1456 {
1457         struct wps_er_ap *ap = ctx;
1458         struct wpabuf *reply;
1459         char *msg = NULL;
1460
1461         switch (event) {
1462         case HTTP_CLIENT_OK:
1463                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1464                 reply = http_client_get_body(c);
1465                 if (reply == NULL)
1466                         break;
1467                 msg = os_zalloc(wpabuf_len(reply) + 1);
1468                 if (msg == NULL)
1469                         break;
1470                 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1471                 break;
1472         case HTTP_CLIENT_FAILED:
1473         case HTTP_CLIENT_INVALID_REPLY:
1474         case HTTP_CLIENT_TIMEOUT:
1475                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1476                 if (ap->wps) {
1477                         wps_deinit(ap->wps);
1478                         ap->wps = NULL;
1479                 }
1480                 break;
1481         }
1482         http_client_free(ap->http);
1483         ap->http = NULL;
1484
1485         if (msg) {
1486                 struct wpabuf *buf;
1487                 enum http_reply_code ret;
1488                 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1489                 os_free(msg);
1490                 if (buf == NULL) {
1491                         wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1492                                    "NewOutMessage from PutMessage response");
1493                         return;
1494                 }
1495                 wps_er_ap_process(ap, buf);
1496                 wpabuf_free(buf);
1497         }
1498 }
1499
1500
1501 static void wps_er_ap_put_message(struct wps_er_ap *ap,
1502                                   const struct wpabuf *msg)
1503 {
1504         struct wpabuf *buf;
1505         char *len_ptr, *body_ptr;
1506         struct sockaddr_in dst;
1507         char *url, *path;
1508
1509         if (ap->http) {
1510                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1511                            "with the AP - cannot continue learn");
1512                 return;
1513         }
1514
1515         if (ap->control_url == NULL) {
1516                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1517                 return;
1518         }
1519
1520         url = http_client_url_parse(ap->control_url, &dst, &path);
1521         if (url == NULL) {
1522                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1523                 return;
1524         }
1525
1526         buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1527                               &len_ptr, &body_ptr);
1528         os_free(url);
1529         if (buf == NULL)
1530                 return;
1531
1532         wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1533
1534         ap->http = http_client_addr(&dst, buf, 10000,
1535                                     wps_er_http_put_message_cb, ap);
1536         if (ap->http == NULL)
1537                 wpabuf_free(buf);
1538 }
1539
1540
1541 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1542 {
1543         enum wps_process_res res;
1544         struct wps_parse_attr attr;
1545         enum wsc_op_code op_code;
1546
1547         op_code = WSC_MSG;
1548         if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) {
1549                 switch (*attr.msg_type) {
1550                 case WPS_WSC_ACK:
1551                         op_code = WSC_ACK;
1552                         break;
1553                 case WPS_WSC_NACK:
1554                         op_code = WSC_NACK;
1555                         break;
1556                 case WPS_WSC_DONE:
1557                         op_code = WSC_Done;
1558                         break;
1559                 }
1560         }
1561
1562         res = wps_process_msg(ap->wps, op_code, msg);
1563         if (res == WPS_CONTINUE) {
1564                 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1565                 if (next) {
1566                         wps_er_ap_put_message(ap, next);
1567                         wpabuf_free(next);
1568                 } else {
1569                         wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1570                                    "message");
1571                         wps_deinit(ap->wps);
1572                         ap->wps = NULL;
1573                 }
1574         } else if (res == WPS_DONE) {
1575                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done");
1576                 wps_deinit(ap->wps);
1577                 ap->wps = NULL;
1578         } else {
1579                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1580                            "AP (res=%d)", res);
1581                 wps_deinit(ap->wps);
1582                 ap->wps = NULL;
1583         }
1584 }
1585
1586
1587 static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1588 {
1589         struct wps_config cfg;
1590
1591         if (ap->wps) {
1592                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1593                            "progress with this AP");
1594                 return;
1595         }
1596
1597         os_memset(&cfg, 0, sizeof(cfg));
1598         cfg.wps = ap->er->wps;
1599         cfg.registrar = 1;
1600         ap->wps = wps_init(&cfg);
1601         if (ap->wps == NULL)
1602                 return;
1603         ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1604         ap->wps->ap_settings_cb_ctx = ap;
1605
1606         wps_er_ap_process(ap, m1);
1607 }
1608
1609
1610 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1611 {
1612         struct wpabuf *info;
1613         enum http_reply_code ret;
1614
1615         wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1616                    "from the AP");
1617         info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1618         if (info == NULL) {
1619                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1620                            "NewDeviceInfo from GetDeviceInfo response");
1621                 return;
1622         }
1623
1624         ap->m1_handler(ap, info);
1625         wpabuf_free(info);
1626 }
1627
1628
1629 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1630                                         enum http_client_event event)
1631 {
1632         struct wps_er_ap *ap = ctx;
1633         struct wpabuf *reply;
1634         char *dev_info = NULL;
1635
1636         switch (event) {
1637         case HTTP_CLIENT_OK:
1638                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1639                 reply = http_client_get_body(c);
1640                 if (reply == NULL)
1641                         break;
1642                 dev_info = os_zalloc(wpabuf_len(reply) + 1);
1643                 if (dev_info == NULL)
1644                         break;
1645                 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1646                 break;
1647         case HTTP_CLIENT_FAILED:
1648         case HTTP_CLIENT_INVALID_REPLY:
1649         case HTTP_CLIENT_TIMEOUT:
1650                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1651                 break;
1652         }
1653         http_client_free(ap->http);
1654         ap->http = NULL;
1655
1656         if (dev_info) {
1657                 wps_er_ap_learn(ap, dev_info);
1658                 os_free(dev_info);
1659         }
1660 }
1661
1662
1663 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
1664                                        void (*m1_handler)(struct wps_er_ap *ap,
1665                                                           struct wpabuf *m1))
1666 {
1667         struct wpabuf *buf;
1668         char *len_ptr, *body_ptr;
1669         struct sockaddr_in dst;
1670         char *url, *path;
1671
1672         if (ap->http) {
1673                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1674                            "with the AP - cannot get device info");
1675                 return -1;
1676         }
1677
1678         if (ap->control_url == NULL) {
1679                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1680                 return -1;
1681         }
1682
1683         url = http_client_url_parse(ap->control_url, &dst, &path);
1684         if (url == NULL) {
1685                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1686                 return -1;
1687         }
1688
1689         buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1690                               &len_ptr, &body_ptr);
1691         os_free(url);
1692         if (buf == NULL)
1693                 return -1;
1694
1695         wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1696
1697         ap->http = http_client_addr(&dst, buf, 10000,
1698                                     wps_er_http_get_dev_info_cb, ap);
1699         if (ap->http == NULL) {
1700                 wpabuf_free(buf);
1701                 return -1;
1702         }
1703
1704         ap->m1_handler = m1_handler;
1705
1706         return 0;
1707 }
1708
1709
1710 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *pin,
1711                  size_t pin_len)
1712 {
1713         struct wps_er_ap *ap;
1714
1715         if (er == NULL)
1716                 return -1;
1717
1718         ap = wps_er_ap_get(er, NULL, uuid);
1719         if (ap == NULL) {
1720                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1721                            "request");
1722                 return -1;
1723         }
1724         if (ap->wps) {
1725                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1726                            "with the AP - cannot start learn");
1727                 return -1;
1728         }
1729
1730         if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
1731                 return -1;
1732
1733         er->skip_set_sel_reg = 1;
1734         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1735         er->skip_set_sel_reg = 0;
1736
1737         return 0;
1738 }
1739
1740
1741 static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1742 {
1743         struct wps_config cfg;
1744
1745         if (ap->wps) {
1746                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1747                            "progress with this AP");
1748                 return;
1749         }
1750
1751         os_memset(&cfg, 0, sizeof(cfg));
1752         cfg.wps = ap->er->wps;
1753         cfg.registrar = 1;
1754         cfg.new_ap_settings = ap->ap_settings;
1755         ap->wps = wps_init(&cfg);
1756         if (ap->wps == NULL)
1757                 return;
1758         ap->wps->ap_settings_cb = NULL;
1759         ap->wps->ap_settings_cb_ctx = NULL;
1760
1761         wps_er_ap_process(ap, m1);
1762 }
1763
1764
1765 int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *pin,
1766                   size_t pin_len, const struct wps_credential *cred)
1767 {
1768         struct wps_er_ap *ap;
1769
1770         if (er == NULL)
1771                 return -1;
1772
1773         ap = wps_er_ap_get(er, NULL, uuid);
1774         if (ap == NULL) {
1775                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config "
1776                            "request");
1777                 return -1;
1778         }
1779         if (ap->wps) {
1780                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1781                            "with the AP - cannot start config");
1782                 return -1;
1783         }
1784
1785         os_free(ap->ap_settings);
1786         ap->ap_settings = os_malloc(sizeof(*cred));
1787         if (ap->ap_settings == NULL)
1788                 return -1;
1789         os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1790         ap->ap_settings->cred_attr = NULL;
1791
1792         if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0)
1793                 return -1;
1794
1795         er->skip_set_sel_reg = 1;
1796         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1797         er->skip_set_sel_reg = 0;
1798
1799         return 0;
1800 }