3 * Copyright (c) 2000-2003 Intel Corporation
4 * Copyright (c) 2006-2007 Sony Corporation
5 * Copyright (c) 2008-2009 Atheros Communications
6 * Copyright (c) 2009-2010, Jouni Malinen <j@w1.fi>
8 * See below for more details on licensing and code history.
12 * This has been greatly stripped down from the original file
13 * (upnp_wps_device.c) by Ted Merrill, Atheros Communications
14 * in order to eliminate use of the bulky libupnp library etc.
17 * upnp_wps_device.c is/was a shim layer between wps_opt_upnp.c and
18 * the libupnp library.
19 * The layering (by Sony) was well done; only a very minor modification
20 * to API of upnp_wps_device.c was required.
21 * libupnp was found to be undesirable because:
22 * -- It consumed too much code and data space
23 * -- It uses multiple threads, making debugging more difficult
24 * and possibly reducing reliability.
25 * -- It uses static variables and only supports one instance.
26 * The shim and libupnp are here replaced by special code written
27 * specifically for the needs of hostapd.
28 * Various shortcuts can and are taken to keep the code size small.
29 * Generally, execution time is not as crucial.
32 * -- UPnP requires that we be able to resolve domain names.
33 * While uncommon, if we have to do it then it will stall the entire
34 * hostapd program, which is bad.
35 * This is because we use the standard linux getaddrinfo() function
36 * which is syncronous.
37 * An asyncronous solution would be to use the free "ares" library.
38 * -- Does not have a robust output buffering scheme. Uses a single
39 * fixed size output buffer per TCP/HTTP connection, with possible (although
40 * unlikely) possibility of overflow and likely excessive use of RAM.
41 * A better solution would be to write the HTTP output as a buffered stream,
42 * using chunking: (handle header specially, then) generate data with
43 * a printf-like function into a buffer, catching buffer full condition,
44 * then send it out surrounded by http chunking.
45 * -- There is some code that could be separated out into the common
46 * library to be shared with wpa_supplicant.
47 * -- Needs renaming with module prefix to avoid polluting the debugger
48 * namespace and causing possible collisions with other static fncs
49 * and structure declarations when using the debugger.
50 * -- The http error code generation is pretty bogus, hopefully noone cares.
52 * Author: Ted Merrill, Atheros Communications, based upon earlier work
53 * as explained above and below.
56 * Copyright 2008 Atheros Communications.
58 * The original header (of upnp_wps_device.c) reads:
60 * Copyright (c) 2006-2007 Sony Corporation. All Rights Reserved.
62 * File Name: upnp_wps_device.c
63 * Description: EAP-WPS UPnP device source
65 * Redistribution and use in source and binary forms, with or without
66 * modification, are permitted provided that the following conditions
69 * * Redistributions of source code must retain the above copyright
70 * notice, this list of conditions and the following disclaimer.
71 * * Redistributions in binary form must reproduce the above copyright
72 * notice, this list of conditions and the following disclaimer in
73 * the documentation and/or other materials provided with the
75 * * Neither the name of Sony Corporation nor the names of its
76 * contributors may be used to endorse or promote products derived
77 * from this software without specific prior written permission.
79 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
80 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
81 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
82 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
83 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
84 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
85 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
86 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
87 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
88 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
89 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
91 * Portions from Intel libupnp files, e.g. genlib/net/http/httpreadwrite.c
94 * Copyright (c) 2000-2003 Intel Corporation
95 * All rights reserved.
97 * Redistribution and use in source and binary forms, with or without
98 * modification, are permitted provided that the following conditions are met:
100 * * Redistributions of source code must retain the above copyright notice,
101 * this list of conditions and the following disclaimer.
102 * * Redistributions in binary form must reproduce the above copyright notice,
103 * this list of conditions and the following disclaimer in the documentation
104 * and/or other materials provided with the distribution.
105 * * Neither name of Intel Corporation nor the names of its contributors
106 * may be used to endorse or promote products derived from this software
107 * without specific prior written permission.
109 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
110 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
111 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
112 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
113 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
114 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
115 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
116 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
117 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
118 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
119 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
123 * Overview of WPS over UPnP:
125 * UPnP is a protocol that allows devices to discover each other and control
126 * each other. In UPnP terminology, a device is either a "device" (a server
127 * that provides information about itself and allows itself to be controlled)
128 * or a "control point" (a client that controls "devices") or possibly both.
129 * This file implements a UPnP "device".
131 * For us, we use mostly basic UPnP discovery, but the control part of interest
132 * is WPS carried via UPnP messages. There is quite a bit of basic UPnP
133 * discovery to do before we can get to WPS, however.
135 * UPnP discovery begins with "devices" send out multicast UDP packets to a
136 * certain fixed multicast IP address and port, and "control points" sending
137 * out other such UDP packets.
139 * The packets sent by devices are NOTIFY packets (not to be confused with TCP
140 * NOTIFY packets that are used later) and those sent by control points are
141 * M-SEARCH packets. These packets contain a simple HTTP style header. The
142 * packets are sent redundantly to get around packet loss. Devices respond to
143 * M-SEARCH packets with HTTP-like UDP packets containing HTTP/1.1 200 OK
144 * messages, which give similar information as the UDP NOTIFY packets.
146 * The above UDP packets advertise the (arbitrary) TCP ports that the
147 * respective parties will listen to. The control point can then do a HTTP
148 * SUBSCRIBE (something like an HTTP PUT) after which the device can do a
149 * separate HTTP NOTIFY (also like an HTTP PUT) to do event messaging.
151 * The control point will also do HTTP GET of the "device file" listed in the
152 * original UDP information from the device (see UPNP_WPS_DEVICE_XML_FILE
153 * data), and based on this will do additional GETs... HTTP POSTs are done to
156 * Beyond some basic information in HTTP headers, additional information is in
157 * the HTTP bodies, in a format set by the SOAP and XML standards, a markup
158 * language related to HTML used for web pages. This language is intended to
159 * provide the ultimate in self-documentation by providing a universal
160 * namespace based on pseudo-URLs called URIs. Note that although a URI looks
161 * like a URL (a web address), they are never accessed as such but are used
162 * only as identifiers.
164 * The POST of a GetDeviceInfo gets information similar to what might be
165 * obtained from a probe request or response on Wi-Fi. WPS messages M1-M8
166 * are passed via a POST of a PutMessage; the M1-M8 WPS messages are converted
167 * to a bin64 ascii representation for encapsulation. When proxying messages,
168 * WLANEvent and PutWLANResponse are used.
170 * This of course glosses over a lot of details.
173 #include "includes.h"
178 #include <sys/ioctl.h>
185 #include "wps_upnp.h"
186 #include "wps_upnp_i.h"
190 * UPnP allows a client ("control point") to send a server like us ("device")
191 * a domain name for registration, and we are supposed to resolve it. This is
192 * bad because, using the standard Linux library, we will stall the entire
193 * hostapd waiting for resolution.
195 * The "correct" solution would be to use an event driven library for domain
196 * name resolution such as "ares". However, this would increase code size
197 * further. Since it is unlikely that we'll actually see such domain names, we
198 * can just refuse to accept them.
200 #define NO_DOMAIN_NAME_RESOLUTION 1 /* 1 to allow only dotted ip addresses */
204 * UPnP does not scale well. If we were in a room with thousands of control
205 * points then potentially we could be expected to handle subscriptions for
206 * each of them, which would exhaust our memory. So we must set a limit. In
207 * practice we are unlikely to see more than one or two.
209 #define MAX_SUBSCRIPTIONS 4 /* how many subscribing clients we handle */
210 #define MAX_ADDR_PER_SUBSCRIPTION 8
212 /* Maximum number of Probe Request events per second */
213 #define MAX_EVENTS_PER_SEC 5
215 /* Write the current date/time per RFC */
216 void format_date(struct wpabuf *buf)
218 const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat";
219 const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0"
220 "Jul\0Aug\0Sep\0Oct\0Nov\0Dec";
226 wpabuf_printf(buf, "%s, %02d %s %d %02d:%02d:%02d GMT",
227 &weekday_str[date->tm_wday * 4], date->tm_mday,
228 &month_str[date->tm_mon * 4], date->tm_year + 1900,
229 date->tm_hour, date->tm_min, date->tm_sec);
233 /***************************************************************************
234 * UUIDs (unique identifiers)
236 * These are supposed to be unique in all the world.
237 * Sometimes permanent ones are used, sometimes temporary ones
238 * based on random numbers... there are different rules for valid content
239 * of different types.
240 * Each uuid is 16 bytes long.
241 **************************************************************************/
243 /* uuid_make -- construct a random UUID
244 * The UPnP documents don't seem to offer any guidelines as to which method to
245 * use for constructing UUIDs for subscriptions. Presumably any method from
246 * rfc4122 is good enough; I've chosen random number method.
248 static void uuid_make(u8 uuid[UUID_LEN])
250 os_get_random(uuid, UUID_LEN);
252 /* Replace certain bits as specified in rfc4122 or X.667 */
253 uuid[6] &= 0x0f; uuid[6] |= (4 << 4); /* version 4 == random gen */
254 uuid[8] &= 0x3f; uuid[8] |= 0x80;
259 * Subscriber address handling.
260 * Since a subscriber may have an arbitrary number of addresses, we have to
261 * add a bunch of code to handle them.
263 * Addresses are passed in text, and MAY be domain names instead of the (usual
264 * and expected) dotted IP addresses. Resolving domain names consumes a lot of
265 * resources. Worse, we are currently using the standard Linux getaddrinfo()
266 * which will block the entire program until complete or timeout! The proper
267 * solution would be to use the "ares" library or similar with more state
268 * machine steps etc. or just disable domain name resolution by setting
269 * NO_DOMAIN_NAME_RESOLUTION to 1 at top of this file.
272 /* subscr_addr_delete -- delete single unlinked subscriber address
273 * (be sure to unlink first if need be)
275 void subscr_addr_delete(struct subscr_addr *a)
278 * Note: do NOT free domain_and_port or path because they point to
279 * memory within the allocation of "a".
285 /* subscr_addr_free_all -- unlink and delete list of subscriber addresses. */
286 static void subscr_addr_free_all(struct subscription *s)
288 struct subscr_addr *a, *tmp;
289 dl_list_for_each_safe(a, tmp, &s->addr_list, struct subscr_addr, list)
291 dl_list_del(&a->list);
292 subscr_addr_delete(a);
297 /* subscr_addr_add_url -- add address(es) for one url to subscription */
298 static void subscr_addr_add_url(struct subscription *s, const char *url,
302 char *scratch_mem = NULL;
304 char *domain_and_port;
308 int port = 80; /* port to send to (default is port 80) */
309 struct addrinfo hints;
310 struct addrinfo *result = NULL;
314 /* url MUST begin with http: */
315 if (url_len < 7 || os_strncasecmp(url, "http://", 7))
320 /* allocate memory for the extra stuff we need */
321 alloc_len = 2 * (url_len + 1);
322 scratch_mem = os_zalloc(alloc_len);
323 if (scratch_mem == NULL)
326 os_strncpy(mem, url, url_len);
327 wpa_printf(MSG_DEBUG, "WPS UPnP: Adding URL '%s'", mem);
328 domain_and_port = mem;
329 mem += 1 + os_strlen(mem);
330 delim = os_strchr(domain_and_port, '/');
332 *delim++ = 0; /* null terminate domain and port */
335 path = domain_and_port + os_strlen(domain_and_port);
338 strcpy(domain, domain_and_port);
339 delim = os_strchr(domain, ':');
341 *delim++ = 0; /* null terminate domain */
347 * getaddrinfo does the right thing with dotted decimal notations, or
348 * will resolve domain names. Resolving domain names will unfortunately
349 * hang the entire program until it is resolved or it times out
350 * internal to getaddrinfo; fortunately we think that the use of actual
351 * domain names (vs. dotted decimal notations) should be uncommon.
353 os_memset(&hints, 0, sizeof(struct addrinfo));
354 hints.ai_family = AF_INET; /* IPv4 */
355 hints.ai_socktype = SOCK_STREAM;
356 #if NO_DOMAIN_NAME_RESOLUTION
357 /* Suppress domain name resolutions that would halt
358 * the program for periods of time
360 hints.ai_flags = AI_NUMERICHOST;
362 /* Allow domain name resolution. */
365 hints.ai_protocol = 0; /* Any protocol? */
366 rerr = getaddrinfo(domain, NULL /* fill in port ourselves */,
369 wpa_printf(MSG_INFO, "WPS UPnP: Resolve error %d (%s) on: %s",
370 rerr, gai_strerror(rerr), domain);
373 for (rp = result; rp; rp = rp->ai_next) {
374 struct subscr_addr *a;
376 /* Limit no. of address to avoid denial of service attack */
377 if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) {
378 wpa_printf(MSG_INFO, "WPS UPnP: subscr_addr_add_url: "
379 "Ignoring excessive addresses");
383 a = os_zalloc(sizeof(*a) + alloc_len);
386 mem = (void *) (a + 1);
387 a->domain_and_port = mem;
388 strcpy(mem, domain_and_port);
389 mem += 1 + strlen(mem);
394 mem += 1 + os_strlen(mem);
395 os_memcpy(&a->saddr, rp->ai_addr, sizeof(a->saddr));
396 a->saddr.sin_port = htons(port);
398 dl_list_add(&s->addr_list, &a->list);
403 freeaddrinfo(result);
404 os_free(scratch_mem);
408 /* subscr_addr_list_create -- create list from urls in string.
409 * Each url is enclosed by angle brackets.
411 static void subscr_addr_list_create(struct subscription *s,
412 const char *url_list)
415 wpa_printf(MSG_DEBUG, "WPS UPnP: Parsing URL list '%s'", url_list);
417 while (*url_list == ' ' || *url_list == '\t')
419 if (*url_list != '<')
422 end = os_strchr(url_list, '>');
425 subscr_addr_add_url(s, url_list, end - url_list);
431 int send_wpabuf(int fd, struct wpabuf *buf)
433 wpa_printf(MSG_DEBUG, "WPS UPnP: Send %lu byte message",
434 (unsigned long) wpabuf_len(buf));
436 if (write(fd, wpabuf_head(buf), wpabuf_len(buf)) !=
437 (int) wpabuf_len(buf)) {
438 wpa_printf(MSG_ERROR, "WPS UPnP: Failed to send buffer: "
440 errno, strerror(errno));
448 static void wpabuf_put_property(struct wpabuf *buf, const char *name,
451 wpabuf_put_str(buf, "<e:property>");
452 wpabuf_printf(buf, "<%s>", name);
454 wpabuf_put_str(buf, value);
455 wpabuf_printf(buf, "</%s>", name);
456 wpabuf_put_str(buf, "</e:property>\n");
461 * upnp_wps_device_send_event - Queue event messages for subscribers
462 * @sm: WPS UPnP state machine from upnp_wps_device_init()
464 * This function queues the last WLANEvent to be sent for all currently
465 * subscribed UPnP control points. sm->wlanevent must have been set with the
466 * encoded data before calling this function.
468 static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
470 /* Enqueue event message for all subscribers */
471 struct wpabuf *buf; /* holds event message */
473 struct subscription *s, *tmp;
474 /* Actually, utf-8 is the default, but it doesn't hurt to specify it */
475 const char *format_head =
476 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
477 "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
478 const char *format_tail = "</e:propertyset>\n";
481 if (dl_list_empty(&sm->subscriptions)) {
486 if (os_get_time(&now) == 0) {
487 if (now.sec != sm->last_event_sec) {
488 sm->last_event_sec = now.sec;
489 sm->num_events_in_sec = 1;
491 sm->num_events_in_sec++;
493 * In theory, this should apply to all WLANEvent
494 * notifications, but EAP messages are of much higher
495 * priority and Probe Request notifications should not
496 * be allowed to drop EAP messages, so only throttle
497 * Probe Request notifications.
499 if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC &&
500 sm->wlanevent_type ==
501 UPNP_WPS_WLANEVENT_TYPE_PROBE) {
502 wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle "
503 "event notifications (%u seen "
504 "during one second)",
505 sm->num_events_in_sec);
511 /* Determine buffer size needed first */
512 buf_size += os_strlen(format_head);
513 buf_size += 50 + 2 * os_strlen("WLANEvent");
515 buf_size += os_strlen(sm->wlanevent);
516 buf_size += os_strlen(format_tail);
518 buf = wpabuf_alloc(buf_size);
521 wpabuf_put_str(buf, format_head);
522 wpabuf_put_property(buf, "WLANEvent", sm->wlanevent);
523 wpabuf_put_str(buf, format_tail);
525 wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:\n%s",
526 (char *) wpabuf_head(buf));
528 dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
531 sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
539 * Event subscription (subscriber machines register with us to receive event
541 * This is the result of an incoming HTTP over TCP SUBSCRIBE request.
544 /* subscription_destroy -- destroy an unlinked subscription
545 * Be sure to unlink first if necessary.
547 void subscription_destroy(struct subscription *s)
549 wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
550 subscr_addr_free_all(s);
552 upnp_er_remove_notification(s);
557 /* subscription_list_age -- remove expired subscriptions */
558 static void subscription_list_age(struct upnp_wps_device_sm *sm, time_t now)
560 struct subscription *s, *tmp;
561 dl_list_for_each_safe(s, tmp, &sm->subscriptions,
562 struct subscription, list) {
563 if (s->timeout_time > now)
565 wpa_printf(MSG_DEBUG, "WPS UPnP: Removing aged subscription");
566 dl_list_del(&s->list);
567 subscription_destroy(s);
572 /* subscription_find -- return existing subscription matching uuid, if any
573 * returns NULL if not found
575 struct subscription * subscription_find(struct upnp_wps_device_sm *sm,
576 const u8 uuid[UUID_LEN])
578 struct subscription *s;
579 dl_list_for_each(s, &sm->subscriptions, struct subscription, list) {
580 if (os_memcmp(s->uuid, uuid, UUID_LEN) == 0)
581 return s; /* Found match */
587 static struct wpabuf * build_fake_wsc_ack(void)
589 struct wpabuf *msg = wpabuf_alloc(100);
592 wpabuf_put_u8(msg, UPNP_WPS_WLANEVENT_TYPE_EAP);
593 wpabuf_put_str(msg, "00:00:00:00:00:00");
594 if (wps_build_version(msg) ||
595 wps_build_msg_type(msg, WPS_WSC_ACK)) {
600 wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE);
601 wpabuf_put_be16(msg, WPS_NONCE_LEN);
602 wpabuf_put(msg, WPS_NONCE_LEN);
603 /* Registrar Nonce */
604 wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
605 wpabuf_put_be16(msg, WPS_NONCE_LEN);
606 wpabuf_put(msg, WPS_NONCE_LEN);
607 wps_build_wfa_ext(msg, 0, NULL, 0);
612 /* subscription_first_event -- send format/queue event that is automatically
613 * sent on a new subscription.
615 static int subscription_first_event(struct subscription *s)
618 * Actually, utf-8 is the default, but it doesn't hurt to specify it.
620 * APStatus is apparently a bit set,
621 * 0x1 = configuration change (but is always set?)
622 * 0x10 = ap is locked
624 * Per UPnP spec, we send out the last value of each variable, even
625 * for WLANEvent, whatever it was.
629 int ap_status = 1; /* TODO: add 0x10 if access point is locked */
631 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
632 "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
633 const char *tail = "</e:propertyset>\n";
637 if (s->sm->wlanevent == NULL) {
639 * There has been no events before the subscription. However,
640 * UPnP device architecture specification requires all the
641 * evented variables to be included, so generate a dummy event
642 * for this particular case using a WSC_ACK and all-zeros
643 * nonces. The ER (UPnP control point) will ignore this, but at
644 * least it will learn that WLANEvent variable will be used in
645 * event notifications in the future.
648 wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the "
649 "initial WLANEvent");
650 msg = build_fake_wsc_ack();
652 s->sm->wlanevent = (char *)
653 base64_encode(wpabuf_head(msg),
654 wpabuf_len(msg), NULL);
659 wlan_event = s->sm->wlanevent;
660 if (wlan_event == NULL || *wlan_event == '\0') {
661 wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for "
662 "initial event message");
665 buf = wpabuf_alloc(500 + os_strlen(wlan_event));
669 wpabuf_put_str(buf, head);
670 wpabuf_put_property(buf, "STAStatus", "1");
671 os_snprintf(txt, sizeof(txt), "%d", ap_status);
672 wpabuf_put_property(buf, "APStatus", txt);
674 wpabuf_put_property(buf, "WLANEvent", wlan_event);
675 wpabuf_put_str(buf, tail);
677 ret = event_add(s, buf, 0);
689 * subscription_start - Remember a UPnP control point to send events to.
690 * @sm: WPS UPnP state machine from upnp_wps_device_init()
691 * @callback_urls: Callback URLs
692 * Returns: %NULL on error, or pointer to new subscription structure.
694 struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
695 const char *callback_urls)
697 struct subscription *s;
698 time_t now = time(NULL);
699 time_t expire = now + UPNP_SUBSCRIBE_SEC;
701 /* Get rid of expired subscriptions so we have room */
702 subscription_list_age(sm, now);
704 /* If too many subscriptions, remove oldest */
705 if (dl_list_len(&sm->subscriptions) >= MAX_SUBSCRIPTIONS) {
706 s = dl_list_first(&sm->subscriptions, struct subscription,
708 wpa_printf(MSG_INFO, "WPS UPnP: Too many subscriptions, "
710 dl_list_del(&s->list);
711 subscription_destroy(s);
714 s = os_zalloc(sizeof(*s));
717 dl_list_init(&s->addr_list);
718 dl_list_init(&s->event_queue);
721 s->timeout_time = expire;
723 subscr_addr_list_create(s, callback_urls);
724 if (dl_list_empty(&s->addr_list)) {
725 wpa_printf(MSG_DEBUG, "WPS UPnP: No valid callback URLs in "
726 "'%s' - drop subscription", callback_urls);
727 subscription_destroy(s);
731 /* Add to end of list, since it has the highest expiration time */
732 dl_list_add_tail(&sm->subscriptions, &s->list);
733 /* Queue up immediate event message (our last event)
734 * as required by UPnP spec.
736 if (subscription_first_event(s)) {
737 wpa_printf(MSG_INFO, "WPS UPnP: Dropping subscriber due to "
739 dl_list_del(&s->list);
740 subscription_destroy(s);
743 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p started with %s",
745 /* Schedule sending this */
746 event_send_all_later(sm);
751 /* subscription_renew -- find subscription and reset timeout */
752 struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
753 const u8 uuid[UUID_LEN])
755 time_t now = time(NULL);
756 time_t expire = now + UPNP_SUBSCRIBE_SEC;
757 struct subscription *s = subscription_find(sm, uuid);
760 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewed");
761 dl_list_del(&s->list);
762 s->timeout_time = expire;
763 /* add back to end of list, since it now has highest expiry */
764 dl_list_add_tail(&sm->subscriptions, &s->list);
770 * upnp_wps_device_send_wlan_event - Event notification
771 * @sm: WPS UPnP state machine from upnp_wps_device_init()
772 * @from_mac_addr: Source (Enrollee) MAC address for the event
773 * @ev_type: Event type
775 * Returns: 0 on success, -1 on failure
777 * Tell external Registrars (UPnP control points) that something happened. In
778 * particular, events include WPS messages from clients that are proxied to
779 * external Registrars.
781 int upnp_wps_device_send_wlan_event(struct upnp_wps_device_sm *sm,
782 const u8 from_mac_addr[ETH_ALEN],
783 enum upnp_wps_wlanevent_type ev_type,
784 const struct wpabuf *msg)
788 const u8 *mac = from_mac_addr;
799 os_snprintf(type, sizeof(type), "%1u", ev_type);
801 raw_len = 1 + 17 + (msg ? wpabuf_len(msg) : 0);
802 raw = os_zalloc(raw_len);
806 *(raw + pos) = (u8) ev_type;
808 os_snprintf(mac_text, sizeof(mac_text), MACSTR, MAC2STR(mac));
809 wpa_printf(MSG_DEBUG, "WPS UPnP: Proxying WLANEvent from %s",
811 os_memcpy(raw + pos, mac_text, 17);
814 os_memcpy(raw + pos, wpabuf_head(msg), wpabuf_len(msg));
815 pos += wpabuf_len(msg);
819 val = (char *) base64_encode(raw, raw_len, &val_len);
823 os_free(sm->wlanevent);
825 sm->wlanevent_type = ev_type;
826 upnp_wps_device_send_event(sm);
837 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
838 #include <sys/sysctl.h>
839 #include <net/route.h>
840 #include <net/if_dl.h>
842 static int eth_get(const char *device, u8 ea[ETH_ALEN])
844 struct if_msghdr *ifm;
845 struct sockaddr_dl *sdl;
848 int mib[] = { CTL_NET, AF_ROUTE, 0, AF_LINK, NET_RT_IFLIST, 0 };
850 if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0)
852 if ((buf = os_malloc(len)) == NULL)
854 if (sysctl(mib, 6, buf, &len, NULL, 0) < 0) {
858 for (p = buf; p < buf + len; p += ifm->ifm_msglen) {
859 ifm = (struct if_msghdr *)p;
860 sdl = (struct sockaddr_dl *)(ifm + 1);
861 if (ifm->ifm_type != RTM_IFINFO ||
862 (ifm->ifm_addrs & RTA_IFP) == 0)
864 if (sdl->sdl_family != AF_LINK || sdl->sdl_nlen == 0 ||
865 os_memcmp(sdl->sdl_data, device, sdl->sdl_nlen) != 0)
867 os_memcpy(ea, LLADDR(sdl), sdl->sdl_alen);
872 if (p >= buf + len) {
878 #endif /* __FreeBSD__ */
882 * get_netif_info - Get hw and IP addresses for network device
883 * @net_if: Selected network interface name
884 * @ip_addr: Buffer for returning IP address in network byte order
885 * @ip_addr_text: Buffer for returning a pointer to allocated IP address text
886 * @mac: Buffer for returning MAC address
887 * Returns: 0 on success, -1 on failure
889 int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
894 struct sockaddr_in *addr;
895 struct in_addr in_addr;
897 *ip_addr_text = os_zalloc(16);
898 if (*ip_addr_text == NULL)
901 sock = socket(AF_INET, SOCK_DGRAM, 0);
905 os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
906 if (ioctl(sock, SIOCGIFADDR, &req) < 0) {
907 wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFADDR failed: %d (%s)",
908 errno, strerror(errno));
911 addr = (void *) &req.ifr_addr;
912 *ip_addr = addr->sin_addr.s_addr;
913 in_addr.s_addr = *ip_addr;
914 os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr));
917 os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
918 if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) {
919 wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFHWADDR failed: "
920 "%d (%s)", errno, strerror(errno));
923 os_memcpy(mac, req.ifr_addr.sa_data, 6);
924 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
925 if (eth_get(net_if, mac) < 0) {
926 wpa_printf(MSG_ERROR, "WPS UPnP: Failed to get MAC address");
930 #error MAC address fetch not implemented
939 os_free(*ip_addr_text);
940 *ip_addr_text = NULL;
945 static void upnp_wps_free_msearchreply(struct dl_list *head)
947 struct advertisement_state_machine *a, *tmp;
948 dl_list_for_each_safe(a, tmp, head, struct advertisement_state_machine,
950 msearchreply_state_machine_stop(a);
954 static void upnp_wps_free_subscriptions(struct dl_list *head)
956 struct subscription *s, *tmp;
957 dl_list_for_each_safe(s, tmp, head, struct subscription, list) {
958 dl_list_del(&s->list);
959 subscription_destroy(s);
965 * upnp_wps_device_stop - Stop WPS UPnP operations on an interface
966 * @sm: WPS UPnP state machine from upnp_wps_device_init()
968 void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
970 if (!sm || !sm->started)
973 wpa_printf(MSG_DEBUG, "WPS UPnP: Stop device");
974 web_listener_stop(sm);
975 upnp_wps_free_msearchreply(&sm->msearch_replies);
976 upnp_wps_free_subscriptions(&sm->subscriptions);
978 advertisement_state_machine_stop(sm, 1);
980 event_send_stop_all(sm);
981 os_free(sm->wlanevent);
982 sm->wlanevent = NULL;
983 os_free(sm->ip_addr_text);
984 sm->ip_addr_text = NULL;
985 if (sm->multicast_sd >= 0)
986 close(sm->multicast_sd);
987 sm->multicast_sd = -1;
988 ssdp_listener_stop(sm);
995 * upnp_wps_device_start - Start WPS UPnP operations on an interface
996 * @sm: WPS UPnP state machine from upnp_wps_device_init()
997 * @net_if: Selected network interface name
998 * Returns: 0 on success, -1 on failure
1000 int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if)
1006 upnp_wps_device_stop(sm);
1008 sm->multicast_sd = -1;
1011 sm->advertise_count = 0;
1013 /* Fix up linux multicast handling */
1014 if (add_ssdp_network(net_if))
1017 /* Determine which IP and mac address we're using */
1018 if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text,
1020 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1021 "for %s. Does it have IP address?", net_if);
1025 /* Listen for incoming TCP connections so that others
1026 * can fetch our "xml files" from us.
1028 if (web_listener_start(sm))
1031 /* Set up for receiving discovery (UDP) packets */
1032 if (ssdp_listener_start(sm))
1035 /* Set up for sending multicast */
1036 if (ssdp_open_multicast(sm) < 0)
1040 * Broadcast NOTIFY messages to let the world know we exist.
1041 * This is done via a state machine since the messages should not be
1042 * all sent out at once.
1044 if (advertisement_state_machine_start(sm))
1050 upnp_wps_device_stop(sm);
1056 * upnp_wps_device_deinit - Deinitialize WPS UPnP
1057 * @sm: WPS UPnP state machine from upnp_wps_device_init()
1059 void upnp_wps_device_deinit(struct upnp_wps_device_sm *sm)
1064 upnp_wps_device_stop(sm);
1067 wps_deinit(sm->peer.wps);
1068 os_free(sm->root_dir);
1069 os_free(sm->desc_url);
1070 os_free(sm->ctx->ap_pin);
1077 * upnp_wps_device_init - Initialize WPS UPnP
1078 * @ctx: callback table; we must eventually free it
1079 * @wps: Pointer to longterm WPS context
1080 * @priv: External context data that will be used in callbacks
1081 * Returns: WPS UPnP state or %NULL on failure
1083 struct upnp_wps_device_sm *
1084 upnp_wps_device_init(struct upnp_wps_device_ctx *ctx, struct wps_context *wps,
1087 struct upnp_wps_device_sm *sm;
1089 sm = os_zalloc(sizeof(*sm));
1091 wpa_printf(MSG_ERROR, "WPS UPnP: upnp_wps_device_init failed");
1098 dl_list_init(&sm->msearch_replies);
1099 dl_list_init(&sm->subscriptions);
1106 * upnp_wps_subscribers - Check whether there are any event subscribers
1107 * @sm: WPS UPnP state machine from upnp_wps_device_init()
1108 * Returns: 0 if no subscribers, 1 if subscribers
1110 int upnp_wps_subscribers(struct upnp_wps_device_sm *sm)
1112 return !dl_list_empty(&sm->subscriptions);
1116 int upnp_wps_set_ap_pin(struct upnp_wps_device_sm *sm, const char *ap_pin)
1121 os_free(sm->ctx->ap_pin);
1123 sm->ctx->ap_pin = os_strdup(ap_pin);
1124 if (sm->ctx->ap_pin == NULL)
1127 sm->ctx->ap_pin = NULL;