1 /* 2 * Wi-Fi Protected Setup - External Registrar 3 * Copyright (c) 2009-2013, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "base64.h" 13 #include "uuid.h" 14 #include "eloop.h" 15 #include "httpread.h" 16 #include "http_client.h" 17 #include "http_server.h" 18 #include "upnp_xml.h" 19 #include "wps_i.h" 20 #include "wps_upnp.h" 21 #include "wps_upnp_i.h" 22 #include "wps_er.h" 23 24 25 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx); 26 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx); 27 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx); 28 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg); 29 static int wps_er_send_get_device_info(struct wps_er_ap *ap, 30 void (*m1_handler)(struct wps_er_ap *ap, 31 struct wpabuf *m1)); 32 33 34 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta, 35 enum wps_event event) 36 { 37 union wps_event_data data; 38 struct wps_event_er_enrollee *ev = &data.enrollee; 39 40 if (wps->event_cb == NULL) 41 return; 42 43 os_memset(&data, 0, sizeof(data)); 44 ev->uuid = sta->uuid; 45 ev->mac_addr = sta->addr; 46 ev->m1_received = sta->m1_received; 47 ev->config_methods = sta->config_methods; 48 ev->dev_passwd_id = sta->dev_passwd_id; 49 ev->pri_dev_type = sta->pri_dev_type; 50 ev->dev_name = sta->dev_name; 51 ev->manufacturer = sta->manufacturer; 52 ev->model_name = sta->model_name; 53 ev->model_number = sta->model_number; 54 ev->serial_number = sta->serial_number; 55 wps->event_cb(wps->cb_ctx, event, &data); 56 } 57 58 59 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr, 60 const u8 *uuid) 61 { 62 struct wps_er_sta *sta; 63 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) { 64 if ((addr == NULL || 65 os_memcmp(sta->addr, addr, ETH_ALEN) == 0) && 66 (uuid == NULL || 67 os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0)) 68 return sta; 69 } 70 return NULL; 71 } 72 73 74 static void wps_er_sta_free(struct wps_er_sta *sta) 75 { 76 wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE); 77 if (sta->wps) 78 wps_deinit(sta->wps); 79 os_free(sta->manufacturer); 80 os_free(sta->model_name); 81 os_free(sta->model_number); 82 os_free(sta->serial_number); 83 os_free(sta->dev_name); 84 http_client_free(sta->http); 85 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 86 os_free(sta->cred); 87 os_free(sta); 88 } 89 90 91 static void wps_er_sta_remove_all(struct wps_er_ap *ap) 92 { 93 struct wps_er_sta *prev, *sta; 94 dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list) 95 wps_er_sta_free(sta); 96 } 97 98 99 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er, 100 struct in_addr *addr, const u8 *uuid, 101 const u8 *mac_addr) 102 { 103 struct wps_er_ap *ap; 104 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 105 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) && 106 (uuid == NULL || 107 os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0) && 108 (mac_addr == NULL || 109 os_memcmp(mac_addr, ap->mac_addr, ETH_ALEN) == 0)) 110 return ap; 111 } 112 return NULL; 113 } 114 115 116 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id) 117 { 118 struct wps_er_ap *ap; 119 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 120 if (ap->id == id) 121 return ap; 122 } 123 return NULL; 124 } 125 126 127 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap, 128 enum wps_event event) 129 { 130 union wps_event_data data; 131 struct wps_event_er_ap *evap = &data.ap; 132 133 if (wps->event_cb == NULL) 134 return; 135 136 os_memset(&data, 0, sizeof(data)); 137 evap->uuid = ap->uuid; 138 evap->friendly_name = ap->friendly_name; 139 evap->manufacturer = ap->manufacturer; 140 evap->manufacturer_url = ap->manufacturer_url; 141 evap->model_description = ap->model_description; 142 evap->model_name = ap->model_name; 143 evap->model_number = ap->model_number; 144 evap->model_url = ap->model_url; 145 evap->serial_number = ap->serial_number; 146 evap->upc = ap->upc; 147 evap->pri_dev_type = ap->pri_dev_type; 148 evap->wps_state = ap->wps_state; 149 evap->mac_addr = ap->mac_addr; 150 wps->event_cb(wps->cb_ctx, event, &data); 151 } 152 153 154 static void wps_er_ap_free(struct wps_er_ap *ap) 155 { 156 http_client_free(ap->http); 157 ap->http = NULL; 158 159 os_free(ap->location); 160 os_free(ap->friendly_name); 161 os_free(ap->manufacturer); 162 os_free(ap->manufacturer_url); 163 os_free(ap->model_description); 164 os_free(ap->model_name); 165 os_free(ap->model_number); 166 os_free(ap->model_url); 167 os_free(ap->serial_number); 168 os_free(ap->udn); 169 os_free(ap->upc); 170 171 os_free(ap->scpd_url); 172 os_free(ap->control_url); 173 os_free(ap->event_sub_url); 174 175 os_free(ap->ap_settings); 176 177 os_free(ap); 178 } 179 180 181 static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap) 182 { 183 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)", 184 inet_ntoa(ap->addr), ap->location); 185 dl_list_del(&ap->list); 186 wps_er_ap_free(ap); 187 188 if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing)) 189 wps_er_deinit_finish(er, NULL); 190 } 191 192 193 static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c, 194 enum http_client_event event) 195 { 196 struct wps_er_ap *ap = ctx; 197 198 switch (event) { 199 case HTTP_CLIENT_OK: 200 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events"); 201 ap->subscribed = 0; 202 break; 203 case HTTP_CLIENT_FAILED: 204 case HTTP_CLIENT_INVALID_REPLY: 205 case HTTP_CLIENT_TIMEOUT: 206 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from " 207 "events"); 208 break; 209 } 210 http_client_free(ap->http); 211 ap->http = NULL; 212 213 /* 214 * Need to get rid of the AP entry regardless of whether we managed to 215 * unsubscribe cleanly or not. 216 */ 217 wps_er_ap_unsubscribed(ap->er, ap); 218 } 219 220 221 static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap) 222 { 223 struct wpabuf *req; 224 struct sockaddr_in dst; 225 char *url, *path; 226 char sid[100]; 227 228 if (ap->event_sub_url == NULL) { 229 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " 230 "subscribe"); 231 goto fail; 232 } 233 if (ap->http) { 234 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " 235 "send subscribe request"); 236 goto fail; 237 } 238 239 url = http_client_url_parse(ap->event_sub_url, &dst, &path); 240 if (url == NULL) { 241 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); 242 goto fail; 243 } 244 245 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); 246 if (req == NULL) { 247 os_free(url); 248 goto fail; 249 } 250 uuid_bin2str(ap->sid, sid, sizeof(sid)); 251 wpabuf_printf(req, 252 "UNSUBSCRIBE %s HTTP/1.1\r\n" 253 "HOST: %s:%d\r\n" 254 "SID: uuid:%s\r\n" 255 "\r\n", 256 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid); 257 os_free(url); 258 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request", 259 wpabuf_head(req), wpabuf_len(req)); 260 261 ap->http = http_client_addr(&dst, req, 1000, 262 wps_er_http_unsubscribe_cb, ap); 263 if (ap->http == NULL) { 264 wpabuf_free(req); 265 goto fail; 266 } 267 return; 268 269 fail: 270 /* 271 * Need to get rid of the AP entry even when we fail to unsubscribe 272 * cleanly. 273 */ 274 wps_er_ap_unsubscribed(ap->er, ap); 275 } 276 277 278 static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er, 279 const u8 *uuid) 280 { 281 struct wps_er_ap_settings *s; 282 dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list) 283 if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0) 284 return s; 285 return NULL; 286 } 287 288 289 int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr) 290 { 291 struct wps_er_ap *ap; 292 struct wps_er_ap_settings *settings; 293 294 ap = wps_er_ap_get(er, addr, NULL, NULL); 295 if (ap == NULL || ap->ap_settings == NULL) 296 return -1; 297 298 settings = wps_er_ap_get_settings(er, ap->uuid); 299 if (!settings) { 300 settings = os_zalloc(sizeof(*settings)); 301 if (settings == NULL) 302 return -1; 303 os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN); 304 dl_list_add(&er->ap_settings, &settings->list); 305 } 306 os_memcpy(&settings->ap_settings, ap->ap_settings, 307 sizeof(struct wps_credential)); 308 309 return 0; 310 } 311 312 313 static int wps_er_ap_use_cached_settings(struct wps_er *er, 314 struct wps_er_ap *ap) 315 { 316 struct wps_er_ap_settings *s; 317 318 if (ap->ap_settings) 319 return 0; 320 321 s = wps_er_ap_get_settings(ap->er, ap->uuid); 322 if (!s) 323 return -1; 324 325 ap->ap_settings = os_malloc(sizeof(*ap->ap_settings)); 326 if (ap->ap_settings == NULL) 327 return -1; 328 329 os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings)); 330 wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings"); 331 return 0; 332 } 333 334 335 static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap) 336 { 337 wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)", 338 inet_ntoa(ap->addr), ap->location); 339 eloop_cancel_timeout(wps_er_ap_timeout, er, ap); 340 wps_er_sta_remove_all(ap); 341 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE); 342 http_client_free(ap->http); 343 ap->http = NULL; 344 if (ap->wps) { 345 wps_deinit(ap->wps); 346 ap->wps = NULL; 347 } 348 349 dl_list_del(&ap->list); 350 if (ap->subscribed) { 351 dl_list_add(&er->ap_unsubscribing, &ap->list); 352 wps_er_ap_unsubscribe(er, ap); 353 } else 354 wps_er_ap_free(ap); 355 } 356 357 358 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx) 359 { 360 struct wps_er *er = eloop_data; 361 struct wps_er_ap *ap = user_ctx; 362 wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out"); 363 wps_er_ap_remove_entry(er, ap); 364 } 365 366 367 static int wps_er_get_sid(struct wps_er_ap *ap, char *sid) 368 { 369 char *pos; 370 char txt[100]; 371 372 if (!sid) { 373 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)", 374 inet_ntoa(ap->addr), ap->location); 375 return -1; 376 } 377 378 pos = os_strstr(sid, "uuid:"); 379 if (!pos) { 380 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " 381 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, 382 sid); 383 return -1; 384 } 385 386 pos += 5; 387 if (uuid_str2bin(pos, ap->sid) < 0) { 388 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " 389 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, 390 sid); 391 return -1; 392 } 393 394 uuid_bin2str(ap->sid, txt, sizeof(txt)); 395 wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s", 396 inet_ntoa(ap->addr), ap->location, txt); 397 398 return 0; 399 } 400 401 402 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c, 403 enum http_client_event event) 404 { 405 struct wps_er_ap *ap = ctx; 406 407 switch (event) { 408 case HTTP_CLIENT_OK: 409 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events"); 410 ap->subscribed = 1; 411 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID")); 412 wps_er_ap_use_cached_settings(ap->er, ap); 413 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD); 414 break; 415 case HTTP_CLIENT_FAILED: 416 case HTTP_CLIENT_INVALID_REPLY: 417 case HTTP_CLIENT_TIMEOUT: 418 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events"); 419 break; 420 } 421 http_client_free(ap->http); 422 ap->http = NULL; 423 } 424 425 426 static void wps_er_subscribe(struct wps_er_ap *ap) 427 { 428 struct wpabuf *req; 429 struct sockaddr_in dst; 430 char *url, *path; 431 432 if (ap->event_sub_url == NULL) { 433 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " 434 "subscribe"); 435 return; 436 } 437 if (ap->http) { 438 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " 439 "send subscribe request"); 440 return; 441 } 442 443 url = http_client_url_parse(ap->event_sub_url, &dst, &path); 444 if (url == NULL) { 445 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); 446 return; 447 } 448 449 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); 450 if (req == NULL) { 451 os_free(url); 452 return; 453 } 454 wpabuf_printf(req, 455 "SUBSCRIBE %s HTTP/1.1\r\n" 456 "HOST: %s:%d\r\n" 457 "CALLBACK: <http://%s:%d/event/%u/%u>\r\n" 458 "NT: upnp:event\r\n" 459 "TIMEOUT: Second-%d\r\n" 460 "\r\n", 461 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), 462 ap->er->ip_addr_text, ap->er->http_port, 463 ap->er->event_id, ap->id, 1800); 464 os_free(url); 465 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request", 466 wpabuf_head(req), wpabuf_len(req)); 467 468 ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb, 469 ap); 470 if (ap->http == NULL) 471 wpabuf_free(req); 472 } 473 474 475 static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1) 476 { 477 struct wps_parse_attr attr; 478 479 if (wps_parse_msg(m1, &attr) < 0) { 480 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1"); 481 return; 482 } 483 if (attr.primary_dev_type) 484 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8); 485 if (attr.wps_state) 486 ap->wps_state = *attr.wps_state; 487 if (attr.mac_addr) 488 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN); 489 490 wps_er_subscribe(ap); 491 } 492 493 494 static void wps_er_get_device_info(struct wps_er_ap *ap) 495 { 496 wps_er_send_get_device_info(ap, wps_er_ap_get_m1); 497 } 498 499 500 static const char * wps_er_find_wfadevice(const char *data) 501 { 502 const char *tag, *tagname, *end; 503 char *val; 504 int found = 0; 505 506 while (!found) { 507 /* Find next <device> */ 508 for (;;) { 509 if (xml_next_tag(data, &tag, &tagname, &end)) 510 return NULL; 511 data = end; 512 if (!os_strncasecmp(tagname, "device", 6) && 513 *tag != '/' && 514 (tagname[6] == '>' || !isgraph(tagname[6]))) { 515 break; 516 } 517 } 518 519 /* Check whether deviceType is WFADevice */ 520 val = xml_get_first_item(data, "deviceType"); 521 if (val == NULL) 522 return NULL; 523 wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val); 524 found = os_strcasecmp(val, "urn:schemas-wifialliance-org:" 525 "device:WFADevice:1") == 0; 526 os_free(val); 527 } 528 529 return data; 530 } 531 532 533 static void wps_er_parse_device_description(struct wps_er_ap *ap, 534 struct wpabuf *reply) 535 { 536 /* Note: reply includes null termination after the buffer data */ 537 const char *tmp, *data = wpabuf_head(reply); 538 char *pos; 539 540 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info", 541 wpabuf_head(reply), wpabuf_len(reply)); 542 543 /* 544 * The root device description may include multiple devices, so first 545 * find the beginning of the WFADevice description to allow the 546 * simplistic parser to pick the correct entries. 547 */ 548 tmp = wps_er_find_wfadevice(data); 549 if (tmp == NULL) { 550 wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - " 551 "trying to parse invalid data"); 552 } else 553 data = tmp; 554 555 ap->friendly_name = xml_get_first_item(data, "friendlyName"); 556 wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name); 557 558 ap->manufacturer = xml_get_first_item(data, "manufacturer"); 559 wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer); 560 561 ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL"); 562 wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'", 563 ap->manufacturer_url); 564 565 ap->model_description = xml_get_first_item(data, "modelDescription"); 566 wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'", 567 ap->model_description); 568 569 ap->model_name = xml_get_first_item(data, "modelName"); 570 wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name); 571 572 ap->model_number = xml_get_first_item(data, "modelNumber"); 573 wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number); 574 575 ap->model_url = xml_get_first_item(data, "modelURL"); 576 wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url); 577 578 ap->serial_number = xml_get_first_item(data, "serialNumber"); 579 wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number); 580 581 ap->udn = xml_get_first_item(data, "UDN"); 582 if (ap->udn) { 583 wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn); 584 pos = os_strstr(ap->udn, "uuid:"); 585 if (pos) { 586 pos += 5; 587 if (uuid_str2bin(pos, ap->uuid) < 0) 588 wpa_printf(MSG_DEBUG, 589 "WPS ER: Invalid UUID in UDN"); 590 } 591 } 592 593 ap->upc = xml_get_first_item(data, "UPC"); 594 wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc); 595 596 ap->scpd_url = http_link_update( 597 xml_get_first_item(data, "SCPDURL"), ap->location); 598 wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url); 599 600 ap->control_url = http_link_update( 601 xml_get_first_item(data, "controlURL"), ap->location); 602 wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url); 603 604 ap->event_sub_url = http_link_update( 605 xml_get_first_item(data, "eventSubURL"), ap->location); 606 wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url); 607 } 608 609 610 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c, 611 enum http_client_event event) 612 { 613 struct wps_er_ap *ap = ctx; 614 struct wpabuf *reply; 615 int ok = 0; 616 617 switch (event) { 618 case HTTP_CLIENT_OK: 619 reply = http_client_get_body(c); 620 if (reply == NULL) 621 break; 622 wps_er_parse_device_description(ap, reply); 623 ok = 1; 624 break; 625 case HTTP_CLIENT_FAILED: 626 case HTTP_CLIENT_INVALID_REPLY: 627 case HTTP_CLIENT_TIMEOUT: 628 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info"); 629 break; 630 } 631 http_client_free(ap->http); 632 ap->http = NULL; 633 if (ok) 634 wps_er_get_device_info(ap); 635 } 636 637 638 void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr, 639 const char *location, int max_age) 640 { 641 struct wps_er_ap *ap; 642 643 ap = wps_er_ap_get(er, addr, uuid, NULL); 644 if (ap) { 645 /* Update advertisement timeout */ 646 eloop_cancel_timeout(wps_er_ap_timeout, er, ap); 647 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); 648 return; 649 } 650 651 ap = os_zalloc(sizeof(*ap)); 652 if (ap == NULL) 653 return; 654 dl_list_init(&ap->sta); 655 ap->er = er; 656 ap->id = ++er->next_ap_id; 657 ap->location = os_strdup(location); 658 if (ap->location == NULL) { 659 os_free(ap); 660 return; 661 } 662 dl_list_add(&er->ap, &ap->list); 663 664 ap->addr.s_addr = addr->s_addr; 665 os_memcpy(ap->uuid, uuid, WPS_UUID_LEN); 666 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); 667 668 wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)", 669 inet_ntoa(ap->addr), ap->location); 670 671 /* Fetch device description */ 672 ap->http = http_client_url(ap->location, NULL, 10000, 673 wps_er_http_dev_desc_cb, ap); 674 } 675 676 677 void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr) 678 { 679 struct wps_er_ap *ap; 680 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 681 if (ap->addr.s_addr == addr->s_addr) { 682 wps_er_ap_remove_entry(er, ap); 683 return; 684 } 685 } 686 } 687 688 689 static void wps_er_ap_remove_all(struct wps_er *er) 690 { 691 struct wps_er_ap *prev, *ap; 692 struct wps_er_ap_settings *prev_s, *s; 693 dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list) 694 wps_er_ap_remove_entry(er, ap); 695 dl_list_for_each_safe(s, prev_s, &er->ap_settings, 696 struct wps_er_ap_settings, list) 697 os_free(s); 698 } 699 700 701 static void http_put_date(struct wpabuf *buf) 702 { 703 wpabuf_put_str(buf, "Date: "); 704 format_date(buf); 705 wpabuf_put_str(buf, "\r\n"); 706 } 707 708 709 static void wps_er_http_resp_not_found(struct http_request *req) 710 { 711 struct wpabuf *buf; 712 buf = wpabuf_alloc(200); 713 if (buf == NULL) { 714 http_request_deinit(req); 715 return; 716 } 717 718 wpabuf_put_str(buf, 719 "HTTP/1.1 404 Not Found\r\n" 720 "Server: unspecified, UPnP/1.0, unspecified\r\n" 721 "Connection: close\r\n"); 722 http_put_date(buf); 723 wpabuf_put_str(buf, "\r\n"); 724 http_request_send_and_deinit(req, buf); 725 } 726 727 728 static void wps_er_http_resp_ok(struct http_request *req) 729 { 730 struct wpabuf *buf; 731 buf = wpabuf_alloc(200); 732 if (buf == NULL) { 733 http_request_deinit(req); 734 return; 735 } 736 737 wpabuf_put_str(buf, 738 "HTTP/1.1 200 OK\r\n" 739 "Server: unspecified, UPnP/1.0, unspecified\r\n" 740 "Connection: close\r\n" 741 "Content-Length: 0\r\n"); 742 http_put_date(buf); 743 wpabuf_put_str(buf, "\r\n"); 744 http_request_send_and_deinit(req, buf); 745 } 746 747 748 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx) 749 { 750 struct wps_er_sta *sta = eloop_data; 751 wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out"); 752 dl_list_del(&sta->list); 753 wps_er_sta_free(sta); 754 } 755 756 757 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap, 758 const u8 *addr, 759 struct wps_parse_attr *attr, 760 int probe_req) 761 { 762 struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL); 763 int new_sta = 0; 764 int m1; 765 766 m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1; 767 768 if (sta == NULL) { 769 /* 770 * Only allow new STA entry to be added based on Probe Request 771 * or M1. This will filter out bogus events and anything that 772 * may have been ongoing at the time ER subscribed for events. 773 */ 774 if (!probe_req && !m1) 775 return NULL; 776 777 sta = os_zalloc(sizeof(*sta)); 778 if (sta == NULL) 779 return NULL; 780 os_memcpy(sta->addr, addr, ETH_ALEN); 781 sta->ap = ap; 782 dl_list_add(&ap->sta, &sta->list); 783 new_sta = 1; 784 } 785 786 if (m1) 787 sta->m1_received = 1; 788 789 if (attr->config_methods && (!probe_req || !sta->m1_received)) 790 sta->config_methods = WPA_GET_BE16(attr->config_methods); 791 if (attr->uuid_e && (!probe_req || !sta->m1_received)) 792 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN); 793 if (attr->primary_dev_type && (!probe_req || !sta->m1_received)) 794 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8); 795 if (attr->dev_password_id && (!probe_req || !sta->m1_received)) 796 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id); 797 798 if (attr->manufacturer) { 799 os_free(sta->manufacturer); 800 sta->manufacturer = dup_binstr(attr->manufacturer, 801 attr->manufacturer_len); 802 } 803 804 if (attr->model_name) { 805 os_free(sta->model_name); 806 sta->model_name = dup_binstr(attr->model_name, 807 attr->model_name_len); 808 } 809 810 if (attr->model_number) { 811 os_free(sta->model_number); 812 sta->model_number = dup_binstr(attr->model_number, 813 attr->model_number_len); 814 } 815 816 if (attr->serial_number) { 817 os_free(sta->serial_number); 818 sta->serial_number = dup_binstr(attr->serial_number, 819 attr->serial_number_len); 820 } 821 822 if (attr->dev_name) { 823 os_free(sta->dev_name); 824 sta->dev_name = dup_binstr(attr->dev_name, attr->dev_name_len); 825 } 826 827 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 828 eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL); 829 830 if (m1 || new_sta) 831 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); 832 833 return sta; 834 } 835 836 837 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap, 838 const u8 *addr, 839 struct wpabuf *msg) 840 { 841 struct wps_parse_attr attr; 842 843 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from " 844 MACSTR, MAC2STR(addr)); 845 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " 846 "(TLVs from Probe Request)", msg); 847 848 if (wps_validate_probe_req(msg, addr) < 0) { 849 wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied " 850 "Probe Request frame from " MACSTR, MAC2STR(addr)); 851 return; 852 } 853 854 if (wps_parse_msg(msg, &attr) < 0) { 855 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " 856 "WLANEvent message"); 857 return; 858 } 859 860 wps_er_add_sta_data(ap, addr, &attr, 1); 861 wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0); 862 } 863 864 865 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c, 866 enum http_client_event event) 867 { 868 struct wps_er_sta *sta = ctx; 869 870 switch (event) { 871 case HTTP_CLIENT_OK: 872 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK"); 873 break; 874 case HTTP_CLIENT_FAILED: 875 case HTTP_CLIENT_INVALID_REPLY: 876 case HTTP_CLIENT_TIMEOUT: 877 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed"); 878 break; 879 } 880 http_client_free(sta->http); 881 sta->http = NULL; 882 } 883 884 885 static const char *soap_prefix = 886 "<?xml version=\"1.0\"?>\n" 887 "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" " 888 "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n" 889 "<s:Body>\n"; 890 static const char *soap_postfix = 891 "</s:Body>\n</s:Envelope>\n"; 892 static const char *urn_wfawlanconfig = 893 "urn:schemas-wifialliance-org:service:WFAWLANConfig:1"; 894 895 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg, 896 const char *name, const char *arg_name, 897 const char *path, 898 const struct sockaddr_in *dst, 899 char **len_ptr, char **body_ptr) 900 { 901 unsigned char *encoded; 902 size_t encoded_len; 903 struct wpabuf *buf; 904 905 if (msg) { 906 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg), 907 &encoded_len); 908 if (encoded == NULL) 909 return NULL; 910 } else { 911 encoded = NULL; 912 encoded_len = 0; 913 } 914 915 buf = wpabuf_alloc(1000 + encoded_len); 916 if (buf == NULL) { 917 os_free(encoded); 918 return NULL; 919 } 920 921 wpabuf_printf(buf, 922 "POST %s HTTP/1.1\r\n" 923 "Host: %s:%d\r\n" 924 "Content-Type: text/xml; charset=\"utf-8\"\r\n" 925 "Content-Length: ", 926 path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port)); 927 928 *len_ptr = wpabuf_put(buf, 0); 929 wpabuf_printf(buf, 930 " \r\n" 931 "SOAPACTION: \"%s#%s\"\r\n" 932 "\r\n", 933 urn_wfawlanconfig, name); 934 935 *body_ptr = wpabuf_put(buf, 0); 936 937 wpabuf_put_str(buf, soap_prefix); 938 wpabuf_printf(buf, "<u:%s xmlns:u=\"", name); 939 wpabuf_put_str(buf, urn_wfawlanconfig); 940 wpabuf_put_str(buf, "\">\n"); 941 if (encoded) { 942 wpabuf_printf(buf, "<%s>%s</%s>\n", 943 arg_name, (char *) encoded, arg_name); 944 os_free(encoded); 945 } 946 947 return buf; 948 } 949 950 951 static void wps_er_soap_end(struct wpabuf *buf, const char *name, 952 char *len_ptr, char *body_ptr) 953 { 954 char len_buf[10]; 955 wpabuf_printf(buf, "</u:%s>\n", name); 956 wpabuf_put_str(buf, soap_postfix); 957 os_snprintf(len_buf, sizeof(len_buf), "%d", 958 (int) ((char *) wpabuf_put(buf, 0) - body_ptr)); 959 os_memcpy(len_ptr, len_buf, os_strlen(len_buf)); 960 } 961 962 963 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg) 964 { 965 struct wpabuf *buf; 966 char *len_ptr, *body_ptr; 967 struct sockaddr_in dst; 968 char *url, *path; 969 970 if (sta->http) { 971 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - " 972 "ignore new request"); 973 wpabuf_free(msg); 974 return; 975 } 976 977 if (sta->ap->control_url == NULL) { 978 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 979 wpabuf_free(msg); 980 return; 981 } 982 983 url = http_client_url_parse(sta->ap->control_url, &dst, &path); 984 if (url == NULL) { 985 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 986 wpabuf_free(msg); 987 return; 988 } 989 990 buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst, 991 &len_ptr, &body_ptr); 992 wpabuf_free(msg); 993 os_free(url); 994 if (buf == NULL) 995 return; 996 wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n", 997 UPNP_WPS_WLANEVENT_TYPE_EAP); 998 wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n", 999 MAC2STR(sta->addr)); 1000 1001 wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr); 1002 1003 sta->http = http_client_addr(&dst, buf, 1000, 1004 wps_er_http_put_wlan_response_cb, sta); 1005 if (sta->http == NULL) 1006 wpabuf_free(buf); 1007 } 1008 1009 1010 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg, 1011 enum wsc_op_code op_code) 1012 { 1013 enum wps_process_res res; 1014 1015 res = wps_process_msg(sta->wps, op_code, msg); 1016 if (res == WPS_CONTINUE) { 1017 struct wpabuf *next = wps_get_msg(sta->wps, &op_code); 1018 if (next) 1019 wps_er_sta_send_msg(sta, next); 1020 } else { 1021 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the " 1022 "enrollee (res=%d)", 1023 res == WPS_DONE ? "succeeded" : "failed", res); 1024 wps_deinit(sta->wps); 1025 sta->wps = NULL; 1026 if (res == WPS_DONE) { 1027 /* Remove the STA entry after short timeout */ 1028 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 1029 eloop_register_timeout(10, 0, wps_er_sta_timeout, sta, 1030 NULL); 1031 } 1032 } 1033 } 1034 1035 1036 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg) 1037 { 1038 struct wps_config cfg; 1039 1040 if (sta->wps) 1041 wps_deinit(sta->wps); 1042 1043 os_memset(&cfg, 0, sizeof(cfg)); 1044 cfg.wps = sta->ap->er->wps; 1045 cfg.registrar = 1; 1046 cfg.peer_addr = sta->addr; 1047 1048 sta->wps = wps_init(&cfg); 1049 if (sta->wps == NULL) 1050 return; 1051 sta->wps->er = 1; 1052 sta->wps->use_cred = sta->ap->ap_settings; 1053 if (sta->ap->ap_settings) { 1054 os_free(sta->cred); 1055 sta->cred = os_malloc(sizeof(*sta->cred)); 1056 if (sta->cred) { 1057 os_memcpy(sta->cred, sta->ap->ap_settings, 1058 sizeof(*sta->cred)); 1059 sta->cred->cred_attr = NULL; 1060 os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN); 1061 sta->wps->use_cred = sta->cred; 1062 } 1063 } 1064 1065 wps_er_sta_process(sta, msg, WSC_MSG); 1066 } 1067 1068 1069 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr, 1070 struct wpabuf *msg) 1071 { 1072 struct wps_parse_attr attr; 1073 struct wps_er_sta *sta; 1074 1075 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR, 1076 MAC2STR(addr)); 1077 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " 1078 "(TLVs from EAP-WSC)", msg); 1079 1080 if (wps_parse_msg(msg, &attr) < 0) { 1081 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " 1082 "WLANEvent message"); 1083 return; 1084 } 1085 1086 sta = wps_er_add_sta_data(ap, addr, &attr, 0); 1087 if (sta == NULL) 1088 return; 1089 1090 if (attr.msg_type && *attr.msg_type == WPS_M1) 1091 wps_er_sta_start(sta, msg); 1092 else if (sta->wps) { 1093 enum wsc_op_code op_code = WSC_MSG; 1094 if (attr.msg_type) { 1095 switch (*attr.msg_type) { 1096 case WPS_WSC_ACK: 1097 op_code = WSC_ACK; 1098 break; 1099 case WPS_WSC_NACK: 1100 op_code = WSC_NACK; 1101 break; 1102 case WPS_WSC_DONE: 1103 op_code = WSC_Done; 1104 break; 1105 } 1106 } 1107 wps_er_sta_process(sta, msg, op_code); 1108 } 1109 } 1110 1111 1112 static void wps_er_process_wlanevent(struct wps_er_ap *ap, 1113 struct wpabuf *event) 1114 { 1115 u8 *data; 1116 u8 wlan_event_type; 1117 u8 wlan_event_mac[ETH_ALEN]; 1118 struct wpabuf msg; 1119 1120 wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent", 1121 wpabuf_head(event), wpabuf_len(event)); 1122 if (wpabuf_len(event) < 1 + 17) { 1123 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent"); 1124 return; 1125 } 1126 1127 data = wpabuf_mhead(event); 1128 wlan_event_type = data[0]; 1129 if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) { 1130 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in " 1131 "WLANEvent"); 1132 return; 1133 } 1134 1135 wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17)); 1136 1137 switch (wlan_event_type) { 1138 case 1: 1139 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg); 1140 break; 1141 case 2: 1142 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg); 1143 break; 1144 default: 1145 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d", 1146 wlan_event_type); 1147 break; 1148 } 1149 } 1150 1151 1152 static void wps_er_http_event(struct wps_er *er, struct http_request *req, 1153 unsigned int ap_id) 1154 { 1155 struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id); 1156 struct wpabuf *event; 1157 enum http_reply_code ret; 1158 1159 if (ap == NULL) { 1160 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id " 1161 "%u", ap_id); 1162 wps_er_http_resp_not_found(req); 1163 return; 1164 } 1165 wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s", 1166 ap_id, http_request_get_data(req)); 1167 1168 event = xml_get_base64_item(http_request_get_data(req), "WLANEvent", 1169 &ret); 1170 if (event == NULL) { 1171 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent " 1172 "from the event notification"); 1173 /* 1174 * Reply with OK anyway to avoid getting unregistered from 1175 * events. 1176 */ 1177 wps_er_http_resp_ok(req); 1178 return; 1179 } 1180 1181 wps_er_process_wlanevent(ap, event); 1182 1183 wpabuf_free(event); 1184 wps_er_http_resp_ok(req); 1185 } 1186 1187 1188 static void wps_er_http_notify(struct wps_er *er, struct http_request *req) 1189 { 1190 char *uri = http_request_get_uri(req); 1191 1192 if (os_strncmp(uri, "/event/", 7) == 0) { 1193 unsigned int event_id; 1194 char *pos; 1195 event_id = atoi(uri + 7); 1196 if (event_id != er->event_id) { 1197 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an " 1198 "unknown event id %u", event_id); 1199 return; 1200 } 1201 pos = os_strchr(uri + 7, '/'); 1202 if (pos == NULL) 1203 return; 1204 pos++; 1205 wps_er_http_event(er, req, atoi(pos)); 1206 } else { 1207 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'", 1208 uri); 1209 wps_er_http_resp_not_found(req); 1210 } 1211 } 1212 1213 1214 static void wps_er_http_req(void *ctx, struct http_request *req) 1215 { 1216 struct wps_er *er = ctx; 1217 struct sockaddr_in *cli = http_request_get_cli_addr(req); 1218 enum httpread_hdr_type type = http_request_get_type(req); 1219 struct wpabuf *buf; 1220 1221 wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from " 1222 "%s:%d", 1223 http_request_get_uri(req), type, 1224 inet_ntoa(cli->sin_addr), ntohs(cli->sin_port)); 1225 1226 switch (type) { 1227 case HTTPREAD_HDR_TYPE_NOTIFY: 1228 wps_er_http_notify(er, req); 1229 break; 1230 default: 1231 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type " 1232 "%d", type); 1233 buf = wpabuf_alloc(200); 1234 if (buf == NULL) { 1235 http_request_deinit(req); 1236 return; 1237 } 1238 wpabuf_put_str(buf, 1239 "HTTP/1.1 501 Unimplemented\r\n" 1240 "Connection: close\r\n"); 1241 http_put_date(buf); 1242 wpabuf_put_str(buf, "\r\n"); 1243 http_request_send_and_deinit(req, buf); 1244 break; 1245 } 1246 } 1247 1248 1249 struct wps_er * 1250 wps_er_init(struct wps_context *wps, const char *ifname, const char *filter) 1251 { 1252 struct wps_er *er; 1253 struct in_addr addr; 1254 1255 er = os_zalloc(sizeof(*er)); 1256 if (er == NULL) 1257 return NULL; 1258 dl_list_init(&er->ap); 1259 dl_list_init(&er->ap_unsubscribing); 1260 dl_list_init(&er->ap_settings); 1261 1262 er->multicast_sd = -1; 1263 er->ssdp_sd = -1; 1264 1265 os_strlcpy(er->ifname, ifname, sizeof(er->ifname)); 1266 er->wps = wps; 1267 if (os_get_random((unsigned char *) &er->event_id, 1268 sizeof(er->event_id)) < 0) { 1269 wps_er_deinit(er, NULL, NULL); 1270 return NULL; 1271 } 1272 /* Limit event_id to < 32 bits to avoid issues with atoi() */ 1273 er->event_id &= 0x0fffffff; 1274 1275 if (filter && os_strncmp(filter, "ifname=", 7) == 0) { 1276 const char *pos, *end; 1277 pos = filter + 7; 1278 end = os_strchr(pos, ' '); 1279 if (end) { 1280 size_t len = end - pos; 1281 os_strlcpy(er->ifname, pos, len < sizeof(er->ifname) ? 1282 len + 1 : sizeof(er->ifname)); 1283 filter = end + 1; 1284 } else { 1285 os_strlcpy(er->ifname, pos, sizeof(er->ifname)); 1286 filter = NULL; 1287 } 1288 er->forced_ifname = 1; 1289 } 1290 1291 if (filter) { 1292 if (inet_aton(filter, &er->filter_addr) == 0) { 1293 wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter " 1294 "address %s", filter); 1295 wps_er_deinit(er, NULL, NULL); 1296 return NULL; 1297 } 1298 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections " 1299 "with %s", filter); 1300 } 1301 if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text, 1302 er->mac_addr)) { 1303 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " 1304 "for %s. Does it have IP address?", er->ifname); 1305 wps_er_deinit(er, NULL, NULL); 1306 return NULL; 1307 } 1308 1309 if (wps_er_ssdp_init(er) < 0) { 1310 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed"); 1311 wps_er_deinit(er, NULL, NULL); 1312 return NULL; 1313 } 1314 1315 addr.s_addr = er->ip_addr; 1316 er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er); 1317 if (er->http_srv == NULL) { 1318 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed"); 1319 wps_er_deinit(er, NULL, NULL); 1320 return NULL; 1321 } 1322 er->http_port = http_server_get_port(er->http_srv); 1323 1324 wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)", 1325 er->ifname, er->ip_addr_text); 1326 1327 return er; 1328 } 1329 1330 1331 void wps_er_refresh(struct wps_er *er) 1332 { 1333 struct wps_er_ap *ap; 1334 struct wps_er_sta *sta; 1335 1336 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1337 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD); 1338 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) 1339 wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); 1340 } 1341 1342 wps_er_send_ssdp_msearch(er); 1343 } 1344 1345 1346 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx) 1347 { 1348 struct wps_er *er = eloop_data; 1349 void (*deinit_done_cb)(void *ctx); 1350 void *deinit_done_ctx; 1351 struct wps_er_ap *ap, *tmp; 1352 1353 wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit"); 1354 1355 dl_list_for_each_safe(ap, tmp, &er->ap_unsubscribing, struct wps_er_ap, 1356 list) { 1357 wpa_printf(MSG_DEBUG, "WPS ER: AP entry for %s (%s) still in ap_unsubscribing list - free it", 1358 inet_ntoa(ap->addr), ap->location); 1359 dl_list_del(&ap->list); 1360 wps_er_ap_free(ap); 1361 } 1362 1363 eloop_cancel_timeout(wps_er_deinit_finish, er, NULL); 1364 deinit_done_cb = er->deinit_done_cb; 1365 deinit_done_ctx = er->deinit_done_ctx; 1366 os_free(er->ip_addr_text); 1367 os_free(er); 1368 1369 if (deinit_done_cb) 1370 deinit_done_cb(deinit_done_ctx); 1371 } 1372 1373 1374 void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx) 1375 { 1376 if (er == NULL) 1377 return; 1378 http_server_deinit(er->http_srv); 1379 wps_er_ap_remove_all(er); 1380 wps_er_ssdp_deinit(er); 1381 eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0, 1382 wps_er_deinit_finish, er, NULL); 1383 wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout"); 1384 er->deinitializing = 1; 1385 er->deinit_done_cb = cb; 1386 er->deinit_done_ctx = ctx; 1387 } 1388 1389 1390 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c, 1391 enum http_client_event event) 1392 { 1393 struct wps_er_ap *ap = ctx; 1394 union wps_event_data data; 1395 1396 os_memset(&data, 0, sizeof(data)); 1397 1398 switch (event) { 1399 case HTTP_CLIENT_OK: 1400 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK"); 1401 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE; 1402 data.set_sel_reg.uuid = ap->uuid; 1403 break; 1404 case HTTP_CLIENT_FAILED: 1405 case HTTP_CLIENT_INVALID_REPLY: 1406 case HTTP_CLIENT_TIMEOUT: 1407 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed"); 1408 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED; 1409 data.set_sel_reg.uuid = ap->uuid; 1410 break; 1411 } 1412 http_client_free(ap->http); 1413 ap->http = NULL; 1414 1415 if (data.set_sel_reg.uuid) 1416 ap->er->wps->event_cb(ap->er->wps->cb_ctx, 1417 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); 1418 } 1419 1420 1421 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg) 1422 { 1423 struct wpabuf *buf; 1424 char *len_ptr, *body_ptr; 1425 struct sockaddr_in dst; 1426 char *url, *path; 1427 1428 if (ap->control_url == NULL) { 1429 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1430 return; 1431 } 1432 1433 if (ap->http) { 1434 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - " 1435 "ignore new request"); 1436 return; 1437 } 1438 1439 if (ap->wps) { 1440 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - " 1441 "skip SetSelectedRegistrar"); 1442 return; 1443 } 1444 1445 url = http_client_url_parse(ap->control_url, &dst, &path); 1446 if (url == NULL) { 1447 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1448 return; 1449 } 1450 1451 buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path, 1452 &dst, &len_ptr, &body_ptr); 1453 os_free(url); 1454 if (buf == NULL) 1455 return; 1456 1457 wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr); 1458 1459 ap->http = http_client_addr(&dst, buf, 1000, 1460 wps_er_http_set_sel_reg_cb, ap); 1461 if (ap->http == NULL) 1462 wpabuf_free(buf); 1463 } 1464 1465 1466 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg) 1467 { 1468 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR); 1469 wpabuf_put_be16(msg, 1); 1470 wpabuf_put_u8(msg, !!sel_reg); 1471 return 0; 1472 } 1473 1474 1475 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id) 1476 { 1477 wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID); 1478 wpabuf_put_be16(msg, 2); 1479 wpabuf_put_be16(msg, dev_passwd_id); 1480 return 0; 1481 } 1482 1483 1484 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg, 1485 u16 sel_reg_config_methods) 1486 { 1487 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS); 1488 wpabuf_put_be16(msg, 2); 1489 wpabuf_put_be16(msg, sel_reg_config_methods); 1490 return 0; 1491 } 1492 1493 1494 static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r) 1495 { 1496 wpabuf_put_be16(msg, ATTR_UUID_R); 1497 wpabuf_put_be16(msg, WPS_UUID_LEN); 1498 wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN); 1499 return 0; 1500 } 1501 1502 1503 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id, 1504 u16 sel_reg_config_methods) 1505 { 1506 struct wpabuf *msg; 1507 struct wps_er_ap *ap; 1508 struct wps_registrar *reg = er->wps->registrar; 1509 const u8 *auth_macs; 1510 u8 bcast[ETH_ALEN]; 1511 size_t count; 1512 union wps_event_data data; 1513 1514 if (er->skip_set_sel_reg) { 1515 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar"); 1516 return; 1517 } 1518 1519 msg = wpabuf_alloc(500); 1520 if (msg == NULL) 1521 return; 1522 1523 auth_macs = wps_authorized_macs(reg, &count); 1524 if (count == 0) { 1525 os_memset(bcast, 0xff, ETH_ALEN); 1526 auth_macs = bcast; 1527 count = 1; 1528 } 1529 1530 if (wps_build_version(msg) || 1531 wps_er_build_selected_registrar(msg, sel_reg) || 1532 wps_er_build_dev_password_id(msg, dev_passwd_id) || 1533 wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) || 1534 wps_build_wfa_ext(msg, 0, auth_macs, count) || 1535 wps_er_build_uuid_r(msg, er->wps->uuid)) { 1536 wpabuf_free(msg); 1537 return; 1538 } 1539 1540 os_memset(&data, 0, sizeof(data)); 1541 data.set_sel_reg.sel_reg = sel_reg; 1542 data.set_sel_reg.dev_passwd_id = dev_passwd_id; 1543 data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods; 1544 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START; 1545 1546 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1547 if (er->set_sel_reg_uuid_filter && 1548 os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter, 1549 WPS_UUID_LEN) != 0) 1550 continue; 1551 data.set_sel_reg.uuid = ap->uuid; 1552 er->wps->event_cb(er->wps->cb_ctx, 1553 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); 1554 wps_er_send_set_sel_reg(ap, msg); 1555 } 1556 1557 wpabuf_free(msg); 1558 } 1559 1560 1561 int wps_er_pbc(struct wps_er *er, const u8 *uuid, const u8 *addr) 1562 { 1563 int res; 1564 struct wps_er_ap *ap; 1565 1566 if (er == NULL || er->wps == NULL) 1567 return -1; 1568 1569 if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) { 1570 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC " 1571 "mode"); 1572 return -2; 1573 } 1574 1575 if (uuid) 1576 ap = wps_er_ap_get(er, NULL, uuid, NULL); 1577 else 1578 ap = NULL; 1579 if (ap == NULL) { 1580 struct wps_er_sta *sta = NULL; 1581 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1582 sta = wps_er_sta_get(ap, addr, uuid); 1583 if (sta) { 1584 uuid = ap->uuid; 1585 break; 1586 } 1587 } 1588 if (sta == NULL) 1589 return -3; /* Unknown UUID */ 1590 } 1591 1592 if (ap->ap_settings == NULL) { 1593 wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known"); 1594 return -4; 1595 } 1596 1597 er->set_sel_reg_uuid_filter = uuid; 1598 res = wps_registrar_button_pushed(er->wps->registrar, NULL); 1599 er->set_sel_reg_uuid_filter = NULL; 1600 if (res) 1601 return -1; 1602 1603 return 0; 1604 } 1605 1606 1607 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred) 1608 { 1609 struct wps_er_ap *ap = ctx; 1610 union wps_event_data data; 1611 1612 wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received"); 1613 os_free(ap->ap_settings); 1614 ap->ap_settings = os_malloc(sizeof(*cred)); 1615 if (ap->ap_settings) { 1616 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 1617 ap->ap_settings->cred_attr = NULL; 1618 } 1619 1620 os_memset(&data, 0, sizeof(data)); 1621 data.ap_settings.uuid = ap->uuid; 1622 data.ap_settings.cred = cred; 1623 ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS, 1624 &data); 1625 } 1626 1627 1628 const u8 * wps_er_get_sta_uuid(struct wps_er *er, const u8 *addr) 1629 { 1630 struct wps_er_ap *ap; 1631 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1632 struct wps_er_sta *sta; 1633 sta = wps_er_sta_get(ap, addr, NULL); 1634 if (sta) 1635 return sta->uuid; 1636 } 1637 return NULL; 1638 } 1639 1640 1641 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c, 1642 enum http_client_event event) 1643 { 1644 struct wps_er_ap *ap = ctx; 1645 struct wpabuf *reply; 1646 char *msg = NULL; 1647 1648 switch (event) { 1649 case HTTP_CLIENT_OK: 1650 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK"); 1651 reply = http_client_get_body(c); 1652 if (reply == NULL) 1653 break; 1654 msg = os_zalloc(wpabuf_len(reply) + 1); 1655 if (msg == NULL) 1656 break; 1657 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply)); 1658 break; 1659 case HTTP_CLIENT_FAILED: 1660 case HTTP_CLIENT_INVALID_REPLY: 1661 case HTTP_CLIENT_TIMEOUT: 1662 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed"); 1663 if (ap->wps) { 1664 wps_deinit(ap->wps); 1665 ap->wps = NULL; 1666 } 1667 break; 1668 } 1669 http_client_free(ap->http); 1670 ap->http = NULL; 1671 1672 if (msg) { 1673 struct wpabuf *buf; 1674 enum http_reply_code ret; 1675 buf = xml_get_base64_item(msg, "NewOutMessage", &ret); 1676 os_free(msg); 1677 if (buf == NULL) { 1678 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " 1679 "NewOutMessage from PutMessage response"); 1680 wps_deinit(ap->wps); 1681 ap->wps = NULL; 1682 return; 1683 } 1684 wps_er_ap_process(ap, buf); 1685 wpabuf_free(buf); 1686 } 1687 } 1688 1689 1690 static void wps_er_ap_put_message(struct wps_er_ap *ap, 1691 const struct wpabuf *msg) 1692 { 1693 struct wpabuf *buf; 1694 char *len_ptr, *body_ptr; 1695 struct sockaddr_in dst; 1696 char *url, *path; 1697 1698 if (ap->http) { 1699 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " 1700 "with the AP - cannot continue learn"); 1701 return; 1702 } 1703 1704 if (ap->control_url == NULL) { 1705 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1706 return; 1707 } 1708 1709 url = http_client_url_parse(ap->control_url, &dst, &path); 1710 if (url == NULL) { 1711 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1712 return; 1713 } 1714 1715 buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst, 1716 &len_ptr, &body_ptr); 1717 os_free(url); 1718 if (buf == NULL) 1719 return; 1720 1721 wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr); 1722 1723 ap->http = http_client_addr(&dst, buf, 10000, 1724 wps_er_http_put_message_cb, ap); 1725 if (ap->http == NULL) 1726 wpabuf_free(buf); 1727 } 1728 1729 1730 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg) 1731 { 1732 enum wps_process_res res; 1733 struct wps_parse_attr attr; 1734 enum wsc_op_code op_code; 1735 1736 op_code = WSC_MSG; 1737 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) { 1738 switch (*attr.msg_type) { 1739 case WPS_WSC_ACK: 1740 op_code = WSC_ACK; 1741 break; 1742 case WPS_WSC_NACK: 1743 op_code = WSC_NACK; 1744 break; 1745 case WPS_WSC_DONE: 1746 op_code = WSC_Done; 1747 break; 1748 } 1749 } 1750 1751 res = wps_process_msg(ap->wps, op_code, msg); 1752 if (res == WPS_CONTINUE) { 1753 struct wpabuf *next = wps_get_msg(ap->wps, &op_code); 1754 if (next) { 1755 wps_er_ap_put_message(ap, next); 1756 wpabuf_free(next); 1757 } else { 1758 wpa_printf(MSG_DEBUG, "WPS ER: Failed to build " 1759 "message"); 1760 wps_deinit(ap->wps); 1761 ap->wps = NULL; 1762 } 1763 } else if (res == WPS_DONE) { 1764 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done"); 1765 wps_deinit(ap->wps); 1766 ap->wps = NULL; 1767 } else { 1768 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from " 1769 "AP (res=%d)", res); 1770 wps_deinit(ap->wps); 1771 ap->wps = NULL; 1772 } 1773 } 1774 1775 1776 static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1) 1777 { 1778 struct wps_config cfg; 1779 1780 if (ap->wps) { 1781 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " 1782 "progress with this AP"); 1783 return; 1784 } 1785 1786 os_memset(&cfg, 0, sizeof(cfg)); 1787 cfg.wps = ap->er->wps; 1788 cfg.registrar = 1; 1789 ap->wps = wps_init(&cfg); 1790 if (ap->wps == NULL) 1791 return; 1792 ap->wps->ap_settings_cb = wps_er_ap_settings_cb; 1793 ap->wps->ap_settings_cb_ctx = ap; 1794 1795 wps_er_ap_process(ap, m1); 1796 } 1797 1798 1799 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info) 1800 { 1801 struct wpabuf *info; 1802 enum http_reply_code ret; 1803 1804 wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) " 1805 "from the AP"); 1806 info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret); 1807 if (info == NULL) { 1808 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " 1809 "NewDeviceInfo from GetDeviceInfo response"); 1810 return; 1811 } 1812 1813 ap->m1_handler(ap, info); 1814 wpabuf_free(info); 1815 } 1816 1817 1818 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c, 1819 enum http_client_event event) 1820 { 1821 struct wps_er_ap *ap = ctx; 1822 struct wpabuf *reply; 1823 char *dev_info = NULL; 1824 1825 switch (event) { 1826 case HTTP_CLIENT_OK: 1827 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK"); 1828 reply = http_client_get_body(c); 1829 if (reply == NULL) 1830 break; 1831 dev_info = os_zalloc(wpabuf_len(reply) + 1); 1832 if (dev_info == NULL) 1833 break; 1834 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply)); 1835 break; 1836 case HTTP_CLIENT_FAILED: 1837 case HTTP_CLIENT_INVALID_REPLY: 1838 case HTTP_CLIENT_TIMEOUT: 1839 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed"); 1840 break; 1841 } 1842 http_client_free(ap->http); 1843 ap->http = NULL; 1844 1845 if (dev_info) { 1846 wps_er_ap_learn(ap, dev_info); 1847 os_free(dev_info); 1848 } 1849 } 1850 1851 1852 static int wps_er_send_get_device_info(struct wps_er_ap *ap, 1853 void (*m1_handler)(struct wps_er_ap *ap, 1854 struct wpabuf *m1)) 1855 { 1856 struct wpabuf *buf; 1857 char *len_ptr, *body_ptr; 1858 struct sockaddr_in dst; 1859 char *url, *path; 1860 1861 if (ap->http) { 1862 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " 1863 "with the AP - cannot get device info"); 1864 return -1; 1865 } 1866 1867 if (ap->control_url == NULL) { 1868 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1869 return -1; 1870 } 1871 1872 url = http_client_url_parse(ap->control_url, &dst, &path); 1873 if (url == NULL) { 1874 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1875 return -1; 1876 } 1877 1878 buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst, 1879 &len_ptr, &body_ptr); 1880 os_free(url); 1881 if (buf == NULL) 1882 return -1; 1883 1884 wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr); 1885 1886 ap->http = http_client_addr(&dst, buf, 10000, 1887 wps_er_http_get_dev_info_cb, ap); 1888 if (ap->http == NULL) { 1889 wpabuf_free(buf); 1890 return -1; 1891 } 1892 1893 ap->m1_handler = m1_handler; 1894 1895 return 0; 1896 } 1897 1898 1899 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *addr, 1900 const u8 *pin, size_t pin_len) 1901 { 1902 struct wps_er_ap *ap; 1903 1904 if (er == NULL) 1905 return -1; 1906 1907 ap = wps_er_ap_get(er, NULL, uuid, addr); 1908 if (ap == NULL) { 1909 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn " 1910 "request"); 1911 return -1; 1912 } 1913 if (uuid == NULL) 1914 uuid = ap->uuid; 1915 if (ap->wps) { 1916 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " 1917 "with the AP - cannot start learn"); 1918 return -1; 1919 } 1920 1921 if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0) 1922 return -1; 1923 1924 er->skip_set_sel_reg = 1; 1925 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); 1926 er->skip_set_sel_reg = 0; 1927 1928 return 0; 1929 } 1930 1931 1932 int wps_er_set_config(struct wps_er *er, const u8 *uuid, const u8 *addr, 1933 const struct wps_credential *cred) 1934 { 1935 struct wps_er_ap *ap; 1936 1937 if (er == NULL) 1938 return -1; 1939 1940 ap = wps_er_ap_get(er, NULL, uuid, addr); 1941 if (ap == NULL) { 1942 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config " 1943 "request"); 1944 return -1; 1945 } 1946 1947 os_free(ap->ap_settings); 1948 ap->ap_settings = os_malloc(sizeof(*cred)); 1949 if (ap->ap_settings == NULL) 1950 return -1; 1951 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 1952 ap->ap_settings->cred_attr = NULL; 1953 wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set " 1954 "config request"); 1955 1956 return 0; 1957 } 1958 1959 1960 static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1) 1961 { 1962 struct wps_config cfg; 1963 1964 if (ap->wps) { 1965 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " 1966 "progress with this AP"); 1967 return; 1968 } 1969 1970 os_memset(&cfg, 0, sizeof(cfg)); 1971 cfg.wps = ap->er->wps; 1972 cfg.registrar = 1; 1973 cfg.new_ap_settings = ap->ap_settings; 1974 ap->wps = wps_init(&cfg); 1975 if (ap->wps == NULL) 1976 return; 1977 ap->wps->ap_settings_cb = NULL; 1978 ap->wps->ap_settings_cb_ctx = NULL; 1979 1980 wps_er_ap_process(ap, m1); 1981 } 1982 1983 1984 int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *addr, 1985 const u8 *pin, size_t pin_len, 1986 const struct wps_credential *cred) 1987 { 1988 struct wps_er_ap *ap; 1989 1990 if (er == NULL) 1991 return -1; 1992 1993 ap = wps_er_ap_get(er, NULL, uuid, addr); 1994 if (ap == NULL) { 1995 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config " 1996 "request"); 1997 return -1; 1998 } 1999 if (uuid == NULL) 2000 uuid = ap->uuid; 2001 if (ap->wps) { 2002 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " 2003 "with the AP - cannot start config"); 2004 return -1; 2005 } 2006 2007 os_free(ap->ap_settings); 2008 ap->ap_settings = os_malloc(sizeof(*cred)); 2009 if (ap->ap_settings == NULL) 2010 return -1; 2011 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 2012 ap->ap_settings->cred_attr = NULL; 2013 2014 if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0) 2015 return -1; 2016 2017 er->skip_set_sel_reg = 1; 2018 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); 2019 er->skip_set_sel_reg = 0; 2020 2021 return 0; 2022 } 2023 2024 2025 #ifdef CONFIG_WPS_NFC 2026 2027 struct wpabuf * wps_er_config_token_from_cred(struct wps_context *wps, 2028 struct wps_credential *cred) 2029 { 2030 struct wpabuf *ret; 2031 struct wps_data data; 2032 2033 ret = wpabuf_alloc(500); 2034 if (ret == NULL) 2035 return NULL; 2036 2037 os_memset(&data, 0, sizeof(data)); 2038 data.wps = wps; 2039 data.use_cred = cred; 2040 if (wps_build_cred(&data, ret) || 2041 wps_build_wfa_ext(ret, 0, NULL, 0)) { 2042 wpabuf_free(ret); 2043 return NULL; 2044 } 2045 2046 return ret; 2047 } 2048 2049 2050 struct wpabuf * wps_er_nfc_config_token(struct wps_er *er, const u8 *uuid, 2051 const u8 *addr) 2052 { 2053 struct wps_er_ap *ap; 2054 2055 if (er == NULL) 2056 return NULL; 2057 2058 ap = wps_er_ap_get(er, NULL, uuid, addr); 2059 if (ap == NULL) 2060 return NULL; 2061 if (ap->ap_settings == NULL) { 2062 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the " 2063 "selected AP"); 2064 return NULL; 2065 } 2066 2067 return wps_er_config_token_from_cred(er->wps, ap->ap_settings); 2068 } 2069 2070 2071 struct wpabuf * wps_er_nfc_handover_sel(struct wps_er *er, 2072 struct wps_context *wps, const u8 *uuid, 2073 const u8 *addr, struct wpabuf *pubkey) 2074 { 2075 struct wps_er_ap *ap; 2076 2077 if (er == NULL) 2078 return NULL; 2079 2080 ap = wps_er_ap_get(er, NULL, uuid, addr); 2081 if (ap == NULL) 2082 return NULL; 2083 if (ap->ap_settings == NULL) { 2084 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the " 2085 "selected AP"); 2086 return NULL; 2087 } 2088 2089 os_memcpy(wps->ssid, ap->ap_settings->ssid, ap->ap_settings->ssid_len); 2090 wps->ssid_len = ap->ap_settings->ssid_len; 2091 2092 return wps_build_nfc_handover_sel(wps, pubkey, addr, 0); 2093 } 2094 2095 #endif /* CONFIG_WPS_NFC */ 2096