Index: vendor/wpa/dist/src/wps/wps_er.c =================================================================== --- vendor/wpa/dist/src/wps/wps_er.c (revision 361935) +++ vendor/wpa/dist/src/wps/wps_er.c (revision 361936) @@ -1,2105 +1,2105 @@ /* * Wi-Fi Protected Setup - External Registrar * Copyright (c) 2009-2013, Jouni Malinen * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "includes.h" #include "common.h" #include "base64.h" #include "uuid.h" #include "eloop.h" #include "httpread.h" #include "http_client.h" #include "http_server.h" #include "upnp_xml.h" #include "wps_i.h" #include "wps_upnp.h" #include "wps_upnp_i.h" #include "wps_er.h" static void wps_er_deinit_finish(void *eloop_data, void *user_ctx); static void wps_er_ap_timeout(void *eloop_data, void *user_ctx); static void wps_er_sta_timeout(void *eloop_data, void *user_ctx); static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg); static int wps_er_send_get_device_info(struct wps_er_ap *ap, void (*m1_handler)(struct wps_er_ap *ap, struct wpabuf *m1)); static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta, enum wps_event event) { union wps_event_data data; struct wps_event_er_enrollee *ev = &data.enrollee; if (wps->event_cb == NULL) return; os_memset(&data, 0, sizeof(data)); ev->uuid = sta->uuid; ev->mac_addr = sta->addr; ev->m1_received = sta->m1_received; ev->config_methods = sta->config_methods; ev->dev_passwd_id = sta->dev_passwd_id; ev->pri_dev_type = sta->pri_dev_type; ev->dev_name = sta->dev_name; ev->manufacturer = sta->manufacturer; ev->model_name = sta->model_name; ev->model_number = sta->model_number; ev->serial_number = sta->serial_number; wps->event_cb(wps->cb_ctx, event, &data); } static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr, const u8 *uuid) { struct wps_er_sta *sta; dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) { if ((addr == NULL || os_memcmp(sta->addr, addr, ETH_ALEN) == 0) && (uuid == NULL || os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0)) return sta; } return NULL; } static void wps_er_sta_free(struct wps_er_sta *sta) { wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE); if (sta->wps) wps_deinit(sta->wps); os_free(sta->manufacturer); os_free(sta->model_name); os_free(sta->model_number); os_free(sta->serial_number); os_free(sta->dev_name); http_client_free(sta->http); eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); os_free(sta->cred); os_free(sta); } static void wps_er_sta_remove_all(struct wps_er_ap *ap) { struct wps_er_sta *prev, *sta; dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list) wps_er_sta_free(sta); } static struct wps_er_ap * wps_er_ap_get(struct wps_er *er, struct in_addr *addr, const u8 *uuid, const u8 *mac_addr) { struct wps_er_ap *ap; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { if ((addr == NULL || ap->addr.s_addr == addr->s_addr) && (uuid == NULL || os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0) && (mac_addr == NULL || os_memcmp(mac_addr, ap->mac_addr, ETH_ALEN) == 0)) return ap; } return NULL; } static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id) { struct wps_er_ap *ap; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { if (ap->id == id) return ap; } return NULL; } static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap, enum wps_event event) { union wps_event_data data; struct wps_event_er_ap *evap = &data.ap; if (wps->event_cb == NULL) return; os_memset(&data, 0, sizeof(data)); evap->uuid = ap->uuid; evap->friendly_name = ap->friendly_name; evap->manufacturer = ap->manufacturer; evap->manufacturer_url = ap->manufacturer_url; evap->model_description = ap->model_description; evap->model_name = ap->model_name; evap->model_number = ap->model_number; evap->model_url = ap->model_url; evap->serial_number = ap->serial_number; evap->upc = ap->upc; evap->pri_dev_type = ap->pri_dev_type; evap->wps_state = ap->wps_state; evap->mac_addr = ap->mac_addr; wps->event_cb(wps->cb_ctx, event, &data); } static void wps_er_ap_free(struct wps_er_ap *ap) { http_client_free(ap->http); ap->http = NULL; os_free(ap->location); os_free(ap->friendly_name); os_free(ap->manufacturer); os_free(ap->manufacturer_url); os_free(ap->model_description); os_free(ap->model_name); os_free(ap->model_number); os_free(ap->model_url); os_free(ap->serial_number); os_free(ap->udn); os_free(ap->upc); os_free(ap->scpd_url); os_free(ap->control_url); os_free(ap->event_sub_url); os_free(ap->ap_settings); os_free(ap); } static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap) { wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)", inet_ntoa(ap->addr), ap->location); dl_list_del(&ap->list); wps_er_ap_free(ap); if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing)) wps_er_deinit_finish(er, NULL); } static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events"); ap->subscribed = 0; break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from " "events"); break; } http_client_free(ap->http); ap->http = NULL; /* * Need to get rid of the AP entry regardless of whether we managed to * unsubscribe cleanly or not. */ wps_er_ap_unsubscribed(ap->er, ap); } static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap) { struct wpabuf *req; struct sockaddr_in dst; char *url, *path; char sid[100]; if (ap->event_sub_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " "subscribe"); goto fail; } if (ap->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " "send subscribe request"); goto fail; } url = http_client_url_parse(ap->event_sub_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); goto fail; } req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); if (req == NULL) { os_free(url); goto fail; } uuid_bin2str(ap->sid, sid, sizeof(sid)); wpabuf_printf(req, "UNSUBSCRIBE %s HTTP/1.1\r\n" "HOST: %s:%d\r\n" "SID: uuid:%s\r\n" "\r\n", path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid); os_free(url); wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request", wpabuf_head(req), wpabuf_len(req)); ap->http = http_client_addr(&dst, req, 1000, wps_er_http_unsubscribe_cb, ap); if (ap->http == NULL) { wpabuf_free(req); goto fail; } return; fail: /* * Need to get rid of the AP entry even when we fail to unsubscribe * cleanly. */ wps_er_ap_unsubscribed(ap->er, ap); } static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er, const u8 *uuid) { struct wps_er_ap_settings *s; dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list) if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0) return s; return NULL; } int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr) { struct wps_er_ap *ap; struct wps_er_ap_settings *settings; ap = wps_er_ap_get(er, addr, NULL, NULL); if (ap == NULL || ap->ap_settings == NULL) return -1; settings = wps_er_ap_get_settings(er, ap->uuid); if (!settings) { settings = os_zalloc(sizeof(*settings)); if (settings == NULL) return -1; os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN); dl_list_add(&er->ap_settings, &settings->list); } os_memcpy(&settings->ap_settings, ap->ap_settings, sizeof(struct wps_credential)); return 0; } static int wps_er_ap_use_cached_settings(struct wps_er *er, struct wps_er_ap *ap) { struct wps_er_ap_settings *s; if (ap->ap_settings) return 0; s = wps_er_ap_get_settings(ap->er, ap->uuid); if (!s) return -1; ap->ap_settings = os_memdup(&s->ap_settings, sizeof(*ap->ap_settings)); if (ap->ap_settings == NULL) return -1; wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings"); return 0; } static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap) { wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)", inet_ntoa(ap->addr), ap->location); eloop_cancel_timeout(wps_er_ap_timeout, er, ap); wps_er_sta_remove_all(ap); wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE); http_client_free(ap->http); ap->http = NULL; if (ap->wps) { wps_deinit(ap->wps); ap->wps = NULL; } dl_list_del(&ap->list); if (ap->subscribed) { dl_list_add(&er->ap_unsubscribing, &ap->list); wps_er_ap_unsubscribe(er, ap); } else wps_er_ap_free(ap); } static void wps_er_ap_timeout(void *eloop_data, void *user_ctx) { struct wps_er *er = eloop_data; struct wps_er_ap *ap = user_ctx; wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out"); wps_er_ap_remove_entry(er, ap); } static int wps_er_get_sid(struct wps_er_ap *ap, char *sid) { char *pos; char txt[100]; if (!sid) { wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)", inet_ntoa(ap->addr), ap->location); return -1; } pos = os_strstr(sid, "uuid:"); if (!pos) { wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, sid); return -1; } pos += 5; if (uuid_str2bin(pos, ap->sid) < 0) { wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, sid); return -1; } uuid_bin2str(ap->sid, txt, sizeof(txt)); wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s", inet_ntoa(ap->addr), ap->location, txt); return 0; } static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events"); ap->subscribed = 1; wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID")); wps_er_ap_use_cached_settings(ap->er, ap); wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD); break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events"); break; } http_client_free(ap->http); ap->http = NULL; } static void wps_er_subscribe(struct wps_er_ap *ap) { struct wpabuf *req; struct sockaddr_in dst; char *url, *path; if (ap->event_sub_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " "subscribe"); return; } if (ap->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " "send subscribe request"); return; } url = http_client_url_parse(ap->event_sub_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); return; } req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); if (req == NULL) { os_free(url); return; } wpabuf_printf(req, "SUBSCRIBE %s HTTP/1.1\r\n" "HOST: %s:%d\r\n" "CALLBACK: \r\n" "NT: upnp:event\r\n" "TIMEOUT: Second-%d\r\n" "\r\n", path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), ap->er->ip_addr_text, ap->er->http_port, ap->er->event_id, ap->id, 1800); os_free(url); wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request", wpabuf_head(req), wpabuf_len(req)); ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb, ap); if (ap->http == NULL) wpabuf_free(req); } static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1) { struct wps_parse_attr attr; if (wps_parse_msg(m1, &attr) < 0) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1"); return; } if (attr.primary_dev_type) os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8); if (attr.wps_state) ap->wps_state = *attr.wps_state; if (attr.mac_addr) os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN); wps_er_subscribe(ap); } static void wps_er_get_device_info(struct wps_er_ap *ap) { wps_er_send_get_device_info(ap, wps_er_ap_get_m1); } static const char * wps_er_find_wfadevice(const char *data) { const char *tag, *tagname, *end; char *val; int found = 0; while (!found) { /* Find next */ for (;;) { if (xml_next_tag(data, &tag, &tagname, &end)) return NULL; data = end; if (!os_strncasecmp(tagname, "device", 6) && *tag != '/' && (tagname[6] == '>' || !isgraph(tagname[6]))) { break; } } /* Check whether deviceType is WFADevice */ val = xml_get_first_item(data, "deviceType"); if (val == NULL) return NULL; wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val); found = os_strcasecmp(val, "urn:schemas-wifialliance-org:" "device:WFADevice:1") == 0; os_free(val); } return data; } static void wps_er_parse_device_description(struct wps_er_ap *ap, struct wpabuf *reply) { /* Note: reply includes null termination after the buffer data */ const char *tmp, *data = wpabuf_head(reply); char *pos; wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info", wpabuf_head(reply), wpabuf_len(reply)); /* * The root device description may include multiple devices, so first * find the beginning of the WFADevice description to allow the * simplistic parser to pick the correct entries. */ tmp = wps_er_find_wfadevice(data); if (tmp == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - " "trying to parse invalid data"); } else data = tmp; ap->friendly_name = xml_get_first_item(data, "friendlyName"); wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name); ap->manufacturer = xml_get_first_item(data, "manufacturer"); wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer); ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL"); wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'", ap->manufacturer_url); ap->model_description = xml_get_first_item(data, "modelDescription"); wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'", ap->model_description); ap->model_name = xml_get_first_item(data, "modelName"); wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name); ap->model_number = xml_get_first_item(data, "modelNumber"); wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number); ap->model_url = xml_get_first_item(data, "modelURL"); wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url); ap->serial_number = xml_get_first_item(data, "serialNumber"); wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number); ap->udn = xml_get_first_item(data, "UDN"); if (ap->udn) { wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn); pos = os_strstr(ap->udn, "uuid:"); if (pos) { pos += 5; if (uuid_str2bin(pos, ap->uuid) < 0) wpa_printf(MSG_DEBUG, "WPS ER: Invalid UUID in UDN"); } } ap->upc = xml_get_first_item(data, "UPC"); wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc); ap->scpd_url = http_link_update( xml_get_first_item(data, "SCPDURL"), ap->location); wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url); ap->control_url = http_link_update( xml_get_first_item(data, "controlURL"), ap->location); wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url); ap->event_sub_url = http_link_update( xml_get_first_item(data, "eventSubURL"), ap->location); wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url); } static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; struct wpabuf *reply; int ok = 0; switch (event) { case HTTP_CLIENT_OK: reply = http_client_get_body(c); if (reply == NULL) break; wps_er_parse_device_description(ap, reply); ok = 1; break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info"); break; } http_client_free(ap->http); ap->http = NULL; if (ok) wps_er_get_device_info(ap); } void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr, const char *location, int max_age) { struct wps_er_ap *ap; ap = wps_er_ap_get(er, addr, uuid, NULL); if (ap) { /* Update advertisement timeout */ eloop_cancel_timeout(wps_er_ap_timeout, er, ap); eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); return; } ap = os_zalloc(sizeof(*ap)); if (ap == NULL) return; dl_list_init(&ap->sta); ap->er = er; ap->id = ++er->next_ap_id; ap->location = os_strdup(location); if (ap->location == NULL) { os_free(ap); return; } dl_list_add(&er->ap, &ap->list); ap->addr.s_addr = addr->s_addr; os_memcpy(ap->uuid, uuid, WPS_UUID_LEN); eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)", inet_ntoa(ap->addr), ap->location); /* Fetch device description */ ap->http = http_client_url(ap->location, NULL, 10000, wps_er_http_dev_desc_cb, ap); } void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr) { struct wps_er_ap *ap; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { if (ap->addr.s_addr == addr->s_addr) { wps_er_ap_remove_entry(er, ap); return; } } } static void wps_er_ap_remove_all(struct wps_er *er) { struct wps_er_ap *prev, *ap; struct wps_er_ap_settings *prev_s, *s; dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list) wps_er_ap_remove_entry(er, ap); dl_list_for_each_safe(s, prev_s, &er->ap_settings, struct wps_er_ap_settings, list) os_free(s); } static void http_put_date(struct wpabuf *buf) { wpabuf_put_str(buf, "Date: "); format_date(buf); wpabuf_put_str(buf, "\r\n"); } static void wps_er_http_resp_not_found(struct http_request *req) { struct wpabuf *buf; buf = wpabuf_alloc(200); if (buf == NULL) { http_request_deinit(req); return; } wpabuf_put_str(buf, "HTTP/1.1 404 Not Found\r\n" "Server: unspecified, UPnP/1.0, unspecified\r\n" "Connection: close\r\n"); http_put_date(buf); wpabuf_put_str(buf, "\r\n"); http_request_send_and_deinit(req, buf); } static void wps_er_http_resp_ok(struct http_request *req) { struct wpabuf *buf; buf = wpabuf_alloc(200); if (buf == NULL) { http_request_deinit(req); return; } wpabuf_put_str(buf, "HTTP/1.1 200 OK\r\n" "Server: unspecified, UPnP/1.0, unspecified\r\n" "Connection: close\r\n" "Content-Length: 0\r\n"); http_put_date(buf); wpabuf_put_str(buf, "\r\n"); http_request_send_and_deinit(req, buf); } static void wps_er_sta_timeout(void *eloop_data, void *user_ctx) { struct wps_er_sta *sta = eloop_data; wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out"); dl_list_del(&sta->list); wps_er_sta_free(sta); } static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap, const u8 *addr, struct wps_parse_attr *attr, int probe_req) { struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL); int new_sta = 0; int m1; m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1; if (sta == NULL) { /* * Only allow new STA entry to be added based on Probe Request * or M1. This will filter out bogus events and anything that * may have been ongoing at the time ER subscribed for events. */ if (!probe_req && !m1) return NULL; sta = os_zalloc(sizeof(*sta)); if (sta == NULL) return NULL; os_memcpy(sta->addr, addr, ETH_ALEN); sta->ap = ap; dl_list_add(&ap->sta, &sta->list); new_sta = 1; } if (m1) sta->m1_received = 1; if (attr->config_methods && (!probe_req || !sta->m1_received)) sta->config_methods = WPA_GET_BE16(attr->config_methods); if (attr->uuid_e && (!probe_req || !sta->m1_received)) os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN); if (attr->primary_dev_type && (!probe_req || !sta->m1_received)) os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8); if (attr->dev_password_id && (!probe_req || !sta->m1_received)) sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id); if (attr->manufacturer) { os_free(sta->manufacturer); sta->manufacturer = dup_binstr(attr->manufacturer, attr->manufacturer_len); } if (attr->model_name) { os_free(sta->model_name); sta->model_name = dup_binstr(attr->model_name, attr->model_name_len); } if (attr->model_number) { os_free(sta->model_number); sta->model_number = dup_binstr(attr->model_number, attr->model_number_len); } if (attr->serial_number) { os_free(sta->serial_number); sta->serial_number = dup_binstr(attr->serial_number, attr->serial_number_len); } if (attr->dev_name) { os_free(sta->dev_name); sta->dev_name = dup_binstr(attr->dev_name, attr->dev_name_len); } eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL); if (m1 || new_sta) wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); return sta; } static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap, const u8 *addr, struct wpabuf *msg) { struct wps_parse_attr attr; wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from " MACSTR, MAC2STR(addr)); wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " "(TLVs from Probe Request)", msg); if (wps_validate_probe_req(msg, addr) < 0) { wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied " "Probe Request frame from " MACSTR, MAC2STR(addr)); return; } if (wps_parse_msg(msg, &attr) < 0) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " "WLANEvent message"); return; } wps_er_add_sta_data(ap, addr, &attr, 1); wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0); } static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_sta *sta = ctx; switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK"); break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed"); break; } http_client_free(sta->http); sta->http = NULL; } static const char *soap_prefix = "\n" "\n" "\n"; static const char *soap_postfix = "\n\n"; static const char *urn_wfawlanconfig = "urn:schemas-wifialliance-org:service:WFAWLANConfig:1"; static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg, const char *name, const char *arg_name, const char *path, const struct sockaddr_in *dst, char **len_ptr, char **body_ptr) { unsigned char *encoded; size_t encoded_len; struct wpabuf *buf; if (msg) { encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg), &encoded_len); if (encoded == NULL) return NULL; } else { encoded = NULL; encoded_len = 0; } buf = wpabuf_alloc(1000 + encoded_len); if (buf == NULL) { os_free(encoded); return NULL; } wpabuf_printf(buf, "POST %s HTTP/1.1\r\n" "Host: %s:%d\r\n" "Content-Type: text/xml; charset=\"utf-8\"\r\n" "Content-Length: ", path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port)); *len_ptr = wpabuf_put(buf, 0); wpabuf_printf(buf, " \r\n" "SOAPACTION: \"%s#%s\"\r\n" "\r\n", urn_wfawlanconfig, name); *body_ptr = wpabuf_put(buf, 0); wpabuf_put_str(buf, soap_prefix); wpabuf_printf(buf, "\n"); if (encoded) { wpabuf_printf(buf, "<%s>%s\n", arg_name, (char *) encoded, arg_name); os_free(encoded); } return buf; } static void wps_er_soap_end(struct wpabuf *buf, const char *name, char *len_ptr, char *body_ptr) { char len_buf[10]; wpabuf_printf(buf, "\n", name); wpabuf_put_str(buf, soap_postfix); os_snprintf(len_buf, sizeof(len_buf), "%d", (int) ((char *) wpabuf_put(buf, 0) - body_ptr)); os_memcpy(len_ptr, len_buf, os_strlen(len_buf)); } static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg) { struct wpabuf *buf; char *len_ptr, *body_ptr; struct sockaddr_in dst; char *url, *path; if (sta->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - " "ignore new request"); wpabuf_free(msg); return; } if (sta->ap->control_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); wpabuf_free(msg); return; } url = http_client_url_parse(sta->ap->control_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); wpabuf_free(msg); return; } buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst, &len_ptr, &body_ptr); wpabuf_free(msg); os_free(url); if (buf == NULL) return; wpabuf_printf(buf, "%d\n", UPNP_WPS_WLANEVENT_TYPE_EAP); wpabuf_printf(buf, "" MACSTR "\n", MAC2STR(sta->addr)); wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr); sta->http = http_client_addr(&dst, buf, 1000, wps_er_http_put_wlan_response_cb, sta); if (sta->http == NULL) wpabuf_free(buf); } static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg, enum wsc_op_code op_code) { enum wps_process_res res; res = wps_process_msg(sta->wps, op_code, msg); if (res == WPS_CONTINUE) { struct wpabuf *next = wps_get_msg(sta->wps, &op_code); if (next) wps_er_sta_send_msg(sta, next); } else { wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the " "enrollee (res=%d)", res == WPS_DONE ? "succeeded" : "failed", res); wps_deinit(sta->wps); sta->wps = NULL; if (res == WPS_DONE) { /* Remove the STA entry after short timeout */ eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); eloop_register_timeout(10, 0, wps_er_sta_timeout, sta, NULL); } } } static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg) { struct wps_config cfg; if (sta->wps) wps_deinit(sta->wps); os_memset(&cfg, 0, sizeof(cfg)); cfg.wps = sta->ap->er->wps; cfg.registrar = 1; cfg.peer_addr = sta->addr; sta->wps = wps_init(&cfg); if (sta->wps == NULL) return; sta->wps->er = 1; sta->wps->use_cred = sta->ap->ap_settings; if (sta->ap->ap_settings) { os_free(sta->cred); sta->cred = os_malloc(sizeof(*sta->cred)); if (sta->cred) { os_memcpy(sta->cred, sta->ap->ap_settings, sizeof(*sta->cred)); sta->cred->cred_attr = NULL; os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN); sta->wps->use_cred = sta->cred; } } wps_er_sta_process(sta, msg, WSC_MSG); } static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr, struct wpabuf *msg) { struct wps_parse_attr attr; struct wps_er_sta *sta; wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR, MAC2STR(addr)); wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " "(TLVs from EAP-WSC)", msg); if (wps_parse_msg(msg, &attr) < 0) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " "WLANEvent message"); return; } sta = wps_er_add_sta_data(ap, addr, &attr, 0); if (sta == NULL) return; if (attr.msg_type && *attr.msg_type == WPS_M1) wps_er_sta_start(sta, msg); else if (sta->wps) { enum wsc_op_code op_code = WSC_MSG; if (attr.msg_type) { switch (*attr.msg_type) { case WPS_WSC_ACK: op_code = WSC_ACK; break; case WPS_WSC_NACK: op_code = WSC_NACK; break; case WPS_WSC_DONE: op_code = WSC_Done; break; } } wps_er_sta_process(sta, msg, op_code); } } static void wps_er_process_wlanevent(struct wps_er_ap *ap, struct wpabuf *event) { u8 *data; u8 wlan_event_type; u8 wlan_event_mac[ETH_ALEN]; struct wpabuf msg; wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent", wpabuf_head(event), wpabuf_len(event)); if (wpabuf_len(event) < 1 + 17) { wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent"); return; } data = wpabuf_mhead(event); wlan_event_type = data[0]; if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) { wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in " "WLANEvent"); return; } wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17)); switch (wlan_event_type) { case 1: wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg); break; case 2: wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg); break; default: wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d", wlan_event_type); break; } } static void wps_er_http_event(struct wps_er *er, struct http_request *req, unsigned int ap_id) { struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id); struct wpabuf *event; enum http_reply_code ret; if (ap == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id " "%u", ap_id); wps_er_http_resp_not_found(req); return; } wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s", ap_id, http_request_get_data(req)); event = xml_get_base64_item(http_request_get_data(req), "WLANEvent", &ret); if (event == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent " "from the event notification"); /* * Reply with OK anyway to avoid getting unregistered from * events. */ wps_er_http_resp_ok(req); return; } wps_er_process_wlanevent(ap, event); wpabuf_free(event); wps_er_http_resp_ok(req); } static void wps_er_http_notify(struct wps_er *er, struct http_request *req) { char *uri = http_request_get_uri(req); if (os_strncmp(uri, "/event/", 7) == 0) { unsigned int event_id; char *pos; event_id = atoi(uri + 7); if (event_id != er->event_id) { wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an " "unknown event id %u", event_id); return; } pos = os_strchr(uri + 7, '/'); if (pos == NULL) return; pos++; wps_er_http_event(er, req, atoi(pos)); } else { wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'", uri); wps_er_http_resp_not_found(req); } } static void wps_er_http_req(void *ctx, struct http_request *req) { struct wps_er *er = ctx; struct sockaddr_in *cli = http_request_get_cli_addr(req); enum httpread_hdr_type type = http_request_get_type(req); struct wpabuf *buf; wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from " "%s:%d", http_request_get_uri(req), type, inet_ntoa(cli->sin_addr), ntohs(cli->sin_port)); switch (type) { case HTTPREAD_HDR_TYPE_NOTIFY: wps_er_http_notify(er, req); break; default: wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type " "%d", type); buf = wpabuf_alloc(200); if (buf == NULL) { http_request_deinit(req); return; } wpabuf_put_str(buf, "HTTP/1.1 501 Unimplemented\r\n" "Connection: close\r\n"); http_put_date(buf); wpabuf_put_str(buf, "\r\n"); http_request_send_and_deinit(req, buf); break; } } struct wps_er * wps_er_init(struct wps_context *wps, const char *ifname, const char *filter) { struct wps_er *er; struct in_addr addr; er = os_zalloc(sizeof(*er)); if (er == NULL) return NULL; dl_list_init(&er->ap); dl_list_init(&er->ap_unsubscribing); dl_list_init(&er->ap_settings); er->multicast_sd = -1; er->ssdp_sd = -1; os_strlcpy(er->ifname, ifname, sizeof(er->ifname)); er->wps = wps; if (os_get_random((unsigned char *) &er->event_id, sizeof(er->event_id)) < 0) { wps_er_deinit(er, NULL, NULL); return NULL; } /* Limit event_id to < 32 bits to avoid issues with atoi() */ er->event_id &= 0x0fffffff; if (filter && os_strncmp(filter, "ifname=", 7) == 0) { const char *pos, *end; pos = filter + 7; end = os_strchr(pos, ' '); if (end) { size_t len = end - pos; os_strlcpy(er->ifname, pos, len < sizeof(er->ifname) ? len + 1 : sizeof(er->ifname)); filter = end + 1; } else { os_strlcpy(er->ifname, pos, sizeof(er->ifname)); filter = NULL; } er->forced_ifname = 1; } if (filter) { if (inet_aton(filter, &er->filter_addr) == 0) { wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter " "address %s", filter); wps_er_deinit(er, NULL, NULL); return NULL; } wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections " "with %s", filter); } if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text, - er->mac_addr)) { + NULL, er->mac_addr)) { wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " "for %s. Does it have IP address?", er->ifname); wps_er_deinit(er, NULL, NULL); return NULL; } if (wps_er_ssdp_init(er) < 0) { wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed"); wps_er_deinit(er, NULL, NULL); return NULL; } addr.s_addr = er->ip_addr; er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er); if (er->http_srv == NULL) { wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed"); wps_er_deinit(er, NULL, NULL); return NULL; } er->http_port = http_server_get_port(er->http_srv); wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)", er->ifname, er->ip_addr_text); return er; } void wps_er_refresh(struct wps_er *er) { struct wps_er_ap *ap; struct wps_er_sta *sta; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD); dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); } wps_er_send_ssdp_msearch(er); } static void wps_er_deinit_finish(void *eloop_data, void *user_ctx) { struct wps_er *er = eloop_data; void (*deinit_done_cb)(void *ctx); void *deinit_done_ctx; struct wps_er_ap *ap, *tmp; wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit"); dl_list_for_each_safe(ap, tmp, &er->ap_unsubscribing, struct wps_er_ap, list) { wpa_printf(MSG_DEBUG, "WPS ER: AP entry for %s (%s) still in ap_unsubscribing list - free it", inet_ntoa(ap->addr), ap->location); dl_list_del(&ap->list); wps_er_ap_free(ap); } eloop_cancel_timeout(wps_er_deinit_finish, er, NULL); deinit_done_cb = er->deinit_done_cb; deinit_done_ctx = er->deinit_done_ctx; os_free(er->ip_addr_text); os_free(er); if (deinit_done_cb) deinit_done_cb(deinit_done_ctx); } void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx) { if (er == NULL) return; http_server_deinit(er->http_srv); wps_er_ap_remove_all(er); wps_er_ssdp_deinit(er); eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0, wps_er_deinit_finish, er, NULL); wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout"); er->deinitializing = 1; er->deinit_done_cb = cb; er->deinit_done_ctx = ctx; } static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; union wps_event_data data; os_memset(&data, 0, sizeof(data)); switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK"); data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE; data.set_sel_reg.uuid = ap->uuid; break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed"); data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED; data.set_sel_reg.uuid = ap->uuid; break; } http_client_free(ap->http); ap->http = NULL; if (data.set_sel_reg.uuid) ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); } static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg) { struct wpabuf *buf; char *len_ptr, *body_ptr; struct sockaddr_in dst; char *url, *path; if (ap->control_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); return; } if (ap->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - " "ignore new request"); return; } if (ap->wps) { wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - " "skip SetSelectedRegistrar"); return; } url = http_client_url_parse(ap->control_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); return; } buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path, &dst, &len_ptr, &body_ptr); os_free(url); if (buf == NULL) return; wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr); ap->http = http_client_addr(&dst, buf, 1000, wps_er_http_set_sel_reg_cb, ap); if (ap->http == NULL) wpabuf_free(buf); } static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg) { wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR); wpabuf_put_be16(msg, 1); wpabuf_put_u8(msg, !!sel_reg); return 0; } static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id) { wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID); wpabuf_put_be16(msg, 2); wpabuf_put_be16(msg, dev_passwd_id); return 0; } static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg, u16 sel_reg_config_methods) { wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS); wpabuf_put_be16(msg, 2); wpabuf_put_be16(msg, sel_reg_config_methods); return 0; } static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r) { wpabuf_put_be16(msg, ATTR_UUID_R); wpabuf_put_be16(msg, WPS_UUID_LEN); wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN); return 0; } void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id, u16 sel_reg_config_methods) { struct wpabuf *msg; struct wps_er_ap *ap; struct wps_registrar *reg = er->wps->registrar; const u8 *auth_macs; u8 bcast[ETH_ALEN]; size_t count; union wps_event_data data; if (er->skip_set_sel_reg) { wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar"); return; } msg = wpabuf_alloc(500); if (msg == NULL) return; auth_macs = wps_authorized_macs(reg, &count); if (count == 0) { os_memset(bcast, 0xff, ETH_ALEN); auth_macs = bcast; count = 1; } if (wps_build_version(msg) || wps_er_build_selected_registrar(msg, sel_reg) || wps_er_build_dev_password_id(msg, dev_passwd_id) || wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) || wps_build_wfa_ext(msg, 0, auth_macs, count, 0) || wps_er_build_uuid_r(msg, er->wps->uuid)) { wpabuf_free(msg); return; } os_memset(&data, 0, sizeof(data)); data.set_sel_reg.sel_reg = sel_reg; data.set_sel_reg.dev_passwd_id = dev_passwd_id; data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods; data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { if (er->set_sel_reg_uuid_filter && os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter, WPS_UUID_LEN) != 0) continue; data.set_sel_reg.uuid = ap->uuid; er->wps->event_cb(er->wps->cb_ctx, WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); wps_er_send_set_sel_reg(ap, msg); } wpabuf_free(msg); } int wps_er_pbc(struct wps_er *er, const u8 *uuid, const u8 *addr) { int res; struct wps_er_ap *ap; if (er == NULL || er->wps == NULL) return -1; if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) { wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC " "mode"); return -2; } if (uuid) ap = wps_er_ap_get(er, NULL, uuid, NULL); else ap = NULL; if (ap == NULL) { struct wps_er_sta *sta = NULL; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { sta = wps_er_sta_get(ap, addr, uuid); if (sta) { uuid = ap->uuid; break; } } if (sta == NULL) return -3; /* Unknown UUID */ } if (ap->ap_settings == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known"); return -4; } er->set_sel_reg_uuid_filter = uuid; res = wps_registrar_button_pushed(er->wps->registrar, NULL); er->set_sel_reg_uuid_filter = NULL; if (res) return -1; return 0; } static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred) { struct wps_er_ap *ap = ctx; union wps_event_data data; wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received"); os_free(ap->ap_settings); ap->ap_settings = os_malloc(sizeof(*cred)); if (ap->ap_settings) { os_memcpy(ap->ap_settings, cred, sizeof(*cred)); ap->ap_settings->cred_attr = NULL; } os_memset(&data, 0, sizeof(data)); data.ap_settings.uuid = ap->uuid; data.ap_settings.cred = cred; ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS, &data); } const u8 * wps_er_get_sta_uuid(struct wps_er *er, const u8 *addr) { struct wps_er_ap *ap; dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { struct wps_er_sta *sta; sta = wps_er_sta_get(ap, addr, NULL); if (sta) return sta->uuid; } return NULL; } static void wps_er_http_put_message_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; struct wpabuf *reply; char *msg = NULL; switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK"); reply = http_client_get_body(c); if (reply) msg = os_zalloc(wpabuf_len(reply) + 1); if (msg == NULL) { if (ap->wps) { wps_deinit(ap->wps); ap->wps = NULL; } break; } os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply)); break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed"); if (ap->wps) { wps_deinit(ap->wps); ap->wps = NULL; } break; } http_client_free(ap->http); ap->http = NULL; if (msg) { struct wpabuf *buf; enum http_reply_code ret; buf = xml_get_base64_item(msg, "NewOutMessage", &ret); os_free(msg); if (buf == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " "NewOutMessage from PutMessage response"); wps_deinit(ap->wps); ap->wps = NULL; return; } wps_er_ap_process(ap, buf); wpabuf_free(buf); } } static void wps_er_ap_put_message(struct wps_er_ap *ap, const struct wpabuf *msg) { struct wpabuf *buf; char *len_ptr, *body_ptr; struct sockaddr_in dst; char *url, *path; if (ap->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " "with the AP - cannot continue learn"); return; } if (ap->control_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); return; } url = http_client_url_parse(ap->control_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); goto fail; } buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst, &len_ptr, &body_ptr); os_free(url); if (buf == NULL) goto fail; wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr); ap->http = http_client_addr(&dst, buf, 10000, wps_er_http_put_message_cb, ap); if (ap->http == NULL) { wpabuf_free(buf); goto fail; } return; fail: if (ap->wps) { wps_deinit(ap->wps); ap->wps = NULL; } } static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg) { enum wps_process_res res; struct wps_parse_attr attr; enum wsc_op_code op_code; op_code = WSC_MSG; if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) { switch (*attr.msg_type) { case WPS_WSC_ACK: op_code = WSC_ACK; break; case WPS_WSC_NACK: op_code = WSC_NACK; break; case WPS_WSC_DONE: op_code = WSC_Done; break; } } res = wps_process_msg(ap->wps, op_code, msg); if (res == WPS_CONTINUE) { struct wpabuf *next = wps_get_msg(ap->wps, &op_code); if (next) { wps_er_ap_put_message(ap, next); wpabuf_free(next); } else { wpa_printf(MSG_DEBUG, "WPS ER: Failed to build " "message"); wps_deinit(ap->wps); ap->wps = NULL; } } else if (res == WPS_DONE) { wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done"); wps_deinit(ap->wps); ap->wps = NULL; } else { wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from " "AP (res=%d)", res); wps_deinit(ap->wps); ap->wps = NULL; } } static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1) { struct wps_config cfg; if (ap->wps) { wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " "progress with this AP"); return; } os_memset(&cfg, 0, sizeof(cfg)); cfg.wps = ap->er->wps; cfg.registrar = 1; ap->wps = wps_init(&cfg); if (ap->wps == NULL) return; ap->wps->ap_settings_cb = wps_er_ap_settings_cb; ap->wps->ap_settings_cb_ctx = ap; wps_er_ap_process(ap, m1); } static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info) { struct wpabuf *info; enum http_reply_code ret; wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) " "from the AP"); info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret); if (info == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " "NewDeviceInfo from GetDeviceInfo response"); return; } ap->m1_handler(ap, info); wpabuf_free(info); } static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c, enum http_client_event event) { struct wps_er_ap *ap = ctx; struct wpabuf *reply; char *dev_info = NULL; switch (event) { case HTTP_CLIENT_OK: wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK"); reply = http_client_get_body(c); if (reply == NULL) break; dev_info = os_zalloc(wpabuf_len(reply) + 1); if (dev_info == NULL) break; os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply)); break; case HTTP_CLIENT_FAILED: case HTTP_CLIENT_INVALID_REPLY: case HTTP_CLIENT_TIMEOUT: wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed"); break; } http_client_free(ap->http); ap->http = NULL; if (dev_info) { wps_er_ap_learn(ap, dev_info); os_free(dev_info); } } static int wps_er_send_get_device_info(struct wps_er_ap *ap, void (*m1_handler)(struct wps_er_ap *ap, struct wpabuf *m1)) { struct wpabuf *buf; char *len_ptr, *body_ptr; struct sockaddr_in dst; char *url, *path; if (ap->http) { wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " "with the AP - cannot get device info"); return -1; } if (ap->control_url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); return -1; } url = http_client_url_parse(ap->control_url, &dst, &path); if (url == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); return -1; } buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst, &len_ptr, &body_ptr); os_free(url); if (buf == NULL) return -1; wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr); ap->http = http_client_addr(&dst, buf, 10000, wps_er_http_get_dev_info_cb, ap); if (ap->http == NULL) { wpabuf_free(buf); return -1; } ap->m1_handler = m1_handler; return 0; } int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *addr, const u8 *pin, size_t pin_len) { struct wps_er_ap *ap; if (er == NULL) return -1; ap = wps_er_ap_get(er, NULL, uuid, addr); if (ap == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn " "request"); return -1; } if (uuid == NULL) uuid = ap->uuid; if (ap->wps) { wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " "with the AP - cannot start learn"); return -1; } if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0) return -1; er->skip_set_sel_reg = 1; wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); er->skip_set_sel_reg = 0; return 0; } int wps_er_set_config(struct wps_er *er, const u8 *uuid, const u8 *addr, const struct wps_credential *cred) { struct wps_er_ap *ap; if (er == NULL) return -1; ap = wps_er_ap_get(er, NULL, uuid, addr); if (ap == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config " "request"); return -1; } os_free(ap->ap_settings); ap->ap_settings = os_memdup(cred, sizeof(*cred)); if (ap->ap_settings == NULL) return -1; ap->ap_settings->cred_attr = NULL; wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set " "config request"); return 0; } static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1) { struct wps_config cfg; if (ap->wps) { wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " "progress with this AP"); return; } os_memset(&cfg, 0, sizeof(cfg)); cfg.wps = ap->er->wps; cfg.registrar = 1; cfg.new_ap_settings = ap->ap_settings; ap->wps = wps_init(&cfg); if (ap->wps == NULL) return; ap->wps->ap_settings_cb = NULL; ap->wps->ap_settings_cb_ctx = NULL; wps_er_ap_process(ap, m1); } int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *addr, const u8 *pin, size_t pin_len, const struct wps_credential *cred) { struct wps_er_ap *ap; if (er == NULL) return -1; ap = wps_er_ap_get(er, NULL, uuid, addr); if (ap == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config " "request"); return -1; } if (uuid == NULL) uuid = ap->uuid; if (ap->wps) { wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " "with the AP - cannot start config"); return -1; } os_free(ap->ap_settings); ap->ap_settings = os_memdup(cred, sizeof(*cred)); if (ap->ap_settings == NULL) return -1; ap->ap_settings->cred_attr = NULL; if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0) return -1; er->skip_set_sel_reg = 1; wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); er->skip_set_sel_reg = 0; return 0; } #ifdef CONFIG_WPS_NFC struct wpabuf * wps_er_config_token_from_cred(struct wps_context *wps, struct wps_credential *cred) { struct wpabuf *ret; struct wps_data data; ret = wpabuf_alloc(500); if (ret == NULL) return NULL; os_memset(&data, 0, sizeof(data)); data.wps = wps; data.use_cred = cred; if (wps_build_cred(&data, ret) || wps_build_wfa_ext(ret, 0, NULL, 0, 0)) { wpabuf_free(ret); return NULL; } return ret; } struct wpabuf * wps_er_nfc_config_token(struct wps_er *er, const u8 *uuid, const u8 *addr) { struct wps_er_ap *ap; if (er == NULL) return NULL; ap = wps_er_ap_get(er, NULL, uuid, addr); if (ap == NULL) return NULL; if (ap->ap_settings == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the " "selected AP"); return NULL; } return wps_er_config_token_from_cred(er->wps, ap->ap_settings); } struct wpabuf * wps_er_nfc_handover_sel(struct wps_er *er, struct wps_context *wps, const u8 *uuid, const u8 *addr, struct wpabuf *pubkey) { struct wps_er_ap *ap; if (er == NULL) return NULL; ap = wps_er_ap_get(er, NULL, uuid, addr); if (ap == NULL) return NULL; if (ap->ap_settings == NULL) { wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the " "selected AP"); return NULL; } os_memcpy(wps->ssid, ap->ap_settings->ssid, ap->ap_settings->ssid_len); wps->ssid_len = ap->ap_settings->ssid_len; return wps_build_nfc_handover_sel(wps, pubkey, addr, 0); } #endif /* CONFIG_WPS_NFC */ Index: vendor/wpa/dist/src/wps/wps_upnp.c =================================================================== --- vendor/wpa/dist/src/wps/wps_upnp.c (revision 361935) +++ vendor/wpa/dist/src/wps/wps_upnp.c (revision 361936) @@ -1,1219 +1,1253 @@ /* * UPnP WPS Device * Copyright (c) 2000-2003 Intel Corporation * Copyright (c) 2006-2007 Sony Corporation * Copyright (c) 2008-2009 Atheros Communications * Copyright (c) 2009-2010, Jouni Malinen * * See below for more details on licensing and code history. */ /* * This has been greatly stripped down from the original file * (upnp_wps_device.c) by Ted Merrill, Atheros Communications * in order to eliminate use of the bulky libupnp library etc. * * History: * upnp_wps_device.c is/was a shim layer between wps_opt_upnp.c and * the libupnp library. * The layering (by Sony) was well done; only a very minor modification * to API of upnp_wps_device.c was required. * libupnp was found to be undesirable because: * -- It consumed too much code and data space * -- It uses multiple threads, making debugging more difficult * and possibly reducing reliability. * -- It uses static variables and only supports one instance. * The shim and libupnp are here replaced by special code written * specifically for the needs of hostapd. * Various shortcuts can and are taken to keep the code size small. * Generally, execution time is not as crucial. * * BUGS: * -- UPnP requires that we be able to resolve domain names. * While uncommon, if we have to do it then it will stall the entire * hostapd program, which is bad. * This is because we use the standard linux getaddrinfo() function * which is syncronous. * An asyncronous solution would be to use the free "ares" library. * -- Does not have a robust output buffering scheme. Uses a single * fixed size output buffer per TCP/HTTP connection, with possible (although * unlikely) possibility of overflow and likely excessive use of RAM. * A better solution would be to write the HTTP output as a buffered stream, * using chunking: (handle header specially, then) generate data with * a printf-like function into a buffer, catching buffer full condition, * then send it out surrounded by http chunking. * -- There is some code that could be separated out into the common * library to be shared with wpa_supplicant. * -- Needs renaming with module prefix to avoid polluting the debugger * namespace and causing possible collisions with other static fncs * and structure declarations when using the debugger. * -- The http error code generation is pretty bogus, hopefully no one cares. * * Author: Ted Merrill, Atheros Communications, based upon earlier work * as explained above and below. * * Copyright: * Copyright 2008 Atheros Communications. * * The original header (of upnp_wps_device.c) reads: * * Copyright (c) 2006-2007 Sony Corporation. All Rights Reserved. * * File Name: upnp_wps_device.c * Description: EAP-WPS UPnP device source * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * Neither the name of Sony Corporation nor the names of its * contributors may be used to endorse or promote products derived * from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * * Portions from Intel libupnp files, e.g. genlib/net/http/httpreadwrite.c * typical header: * * Copyright (c) 2000-2003 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * Neither name of Intel Corporation nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* * Overview of WPS over UPnP: * * UPnP is a protocol that allows devices to discover each other and control * each other. In UPnP terminology, a device is either a "device" (a server * that provides information about itself and allows itself to be controlled) * or a "control point" (a client that controls "devices") or possibly both. * This file implements a UPnP "device". * * For us, we use mostly basic UPnP discovery, but the control part of interest * is WPS carried via UPnP messages. There is quite a bit of basic UPnP * discovery to do before we can get to WPS, however. * * UPnP discovery begins with "devices" send out multicast UDP packets to a * certain fixed multicast IP address and port, and "control points" sending * out other such UDP packets. * * The packets sent by devices are NOTIFY packets (not to be confused with TCP * NOTIFY packets that are used later) and those sent by control points are * M-SEARCH packets. These packets contain a simple HTTP style header. The * packets are sent redundantly to get around packet loss. Devices respond to * M-SEARCH packets with HTTP-like UDP packets containing HTTP/1.1 200 OK * messages, which give similar information as the UDP NOTIFY packets. * * The above UDP packets advertise the (arbitrary) TCP ports that the * respective parties will listen to. The control point can then do a HTTP * SUBSCRIBE (something like an HTTP PUT) after which the device can do a * separate HTTP NOTIFY (also like an HTTP PUT) to do event messaging. * * The control point will also do HTTP GET of the "device file" listed in the * original UDP information from the device (see UPNP_WPS_DEVICE_XML_FILE * data), and based on this will do additional GETs... HTTP POSTs are done to * cause an action. * * Beyond some basic information in HTTP headers, additional information is in * the HTTP bodies, in a format set by the SOAP and XML standards, a markup * language related to HTML used for web pages. This language is intended to * provide the ultimate in self-documentation by providing a universal * namespace based on pseudo-URLs called URIs. Note that although a URI looks * like a URL (a web address), they are never accessed as such but are used * only as identifiers. * * The POST of a GetDeviceInfo gets information similar to what might be * obtained from a probe request or response on Wi-Fi. WPS messages M1-M8 * are passed via a POST of a PutMessage; the M1-M8 WPS messages are converted * to a bin64 ascii representation for encapsulation. When proxying messages, * WLANEvent and PutWLANResponse are used. * * This of course glosses over a lot of details. */ #include "includes.h" #include #include #include #include #include "common.h" #include "uuid.h" #include "base64.h" #include "wps.h" #include "wps_i.h" #include "wps_upnp.h" #include "wps_upnp_i.h" /* * UPnP allows a client ("control point") to send a server like us ("device") * a domain name for registration, and we are supposed to resolve it. This is * bad because, using the standard Linux library, we will stall the entire * hostapd waiting for resolution. * * The "correct" solution would be to use an event driven library for domain * name resolution such as "ares". However, this would increase code size * further. Since it is unlikely that we'll actually see such domain names, we * can just refuse to accept them. */ #define NO_DOMAIN_NAME_RESOLUTION 1 /* 1 to allow only dotted ip addresses */ /* * UPnP does not scale well. If we were in a room with thousands of control * points then potentially we could be expected to handle subscriptions for * each of them, which would exhaust our memory. So we must set a limit. In * practice we are unlikely to see more than one or two. */ #define MAX_SUBSCRIPTIONS 4 /* how many subscribing clients we handle */ #define MAX_ADDR_PER_SUBSCRIPTION 8 /* Maximum number of Probe Request events per second */ #define MAX_EVENTS_PER_SEC 5 static struct upnp_wps_device_sm *shared_upnp_device = NULL; /* Write the current date/time per RFC */ void format_date(struct wpabuf *buf) { const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat"; const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0" "Jul\0Aug\0Sep\0Oct\0Nov\0Dec"; struct tm *date; time_t t; t = time(NULL); date = gmtime(&t); if (date == NULL) return; wpabuf_printf(buf, "%s, %02d %s %d %02d:%02d:%02d GMT", &weekday_str[date->tm_wday * 4], date->tm_mday, &month_str[date->tm_mon * 4], date->tm_year + 1900, date->tm_hour, date->tm_min, date->tm_sec); } /*************************************************************************** * UUIDs (unique identifiers) * * These are supposed to be unique in all the world. * Sometimes permanent ones are used, sometimes temporary ones * based on random numbers... there are different rules for valid content * of different types. * Each uuid is 16 bytes long. **************************************************************************/ /* uuid_make -- construct a random UUID * The UPnP documents don't seem to offer any guidelines as to which method to * use for constructing UUIDs for subscriptions. Presumably any method from * rfc4122 is good enough; I've chosen random number method. */ static int uuid_make(u8 uuid[UUID_LEN]) { if (os_get_random(uuid, UUID_LEN) < 0) return -1; /* Replace certain bits as specified in rfc4122 or X.667 */ uuid[6] &= 0x0f; uuid[6] |= (4 << 4); /* version 4 == random gen */ uuid[8] &= 0x3f; uuid[8] |= 0x80; return 0; } /* * Subscriber address handling. * Since a subscriber may have an arbitrary number of addresses, we have to * add a bunch of code to handle them. * * Addresses are passed in text, and MAY be domain names instead of the (usual * and expected) dotted IP addresses. Resolving domain names consumes a lot of * resources. Worse, we are currently using the standard Linux getaddrinfo() * which will block the entire program until complete or timeout! The proper * solution would be to use the "ares" library or similar with more state * machine steps etc. or just disable domain name resolution by setting * NO_DOMAIN_NAME_RESOLUTION to 1 at top of this file. */ /* subscr_addr_delete -- delete single unlinked subscriber address * (be sure to unlink first if need be) */ void subscr_addr_delete(struct subscr_addr *a) { /* * Note: do NOT free domain_and_port or path because they point to * memory within the allocation of "a". */ os_free(a); } /* subscr_addr_free_all -- unlink and delete list of subscriber addresses. */ static void subscr_addr_free_all(struct subscription *s) { struct subscr_addr *a, *tmp; dl_list_for_each_safe(a, tmp, &s->addr_list, struct subscr_addr, list) { dl_list_del(&a->list); subscr_addr_delete(a); } } +static int local_network_addr(struct upnp_wps_device_sm *sm, + struct sockaddr_in *addr) +{ + return (addr->sin_addr.s_addr & sm->netmask.s_addr) == + (sm->ip_addr & sm->netmask.s_addr); +} + + /* subscr_addr_add_url -- add address(es) for one url to subscription */ static void subscr_addr_add_url(struct subscription *s, const char *url, size_t url_len) { int alloc_len; char *scratch_mem = NULL; char *mem; char *host; char *delim; char *path; int port = 80; /* port to send to (default is port 80) */ struct addrinfo hints; struct addrinfo *result = NULL; struct addrinfo *rp; int rerr; size_t host_len, path_len; /* url MUST begin with http: */ if (url_len < 7 || os_strncasecmp(url, "http://", 7)) goto fail; url += 7; url_len -= 7; /* Make a copy of the string to allow modification during parsing */ scratch_mem = dup_binstr(url, url_len); if (scratch_mem == NULL) goto fail; wpa_printf(MSG_DEBUG, "WPS UPnP: Adding URL '%s'", scratch_mem); host = scratch_mem; path = os_strchr(host, '/'); if (path) *path++ = '\0'; /* null terminate host */ /* Process and remove optional port component */ delim = os_strchr(host, ':'); if (delim) { *delim = '\0'; /* null terminate host name for now */ if (isdigit(delim[1])) port = atol(delim + 1); } /* * getaddrinfo does the right thing with dotted decimal notations, or * will resolve domain names. Resolving domain names will unfortunately * hang the entire program until it is resolved or it times out * internal to getaddrinfo; fortunately we think that the use of actual * domain names (vs. dotted decimal notations) should be uncommon. */ os_memset(&hints, 0, sizeof(struct addrinfo)); hints.ai_family = AF_INET; /* IPv4 */ hints.ai_socktype = SOCK_STREAM; #if NO_DOMAIN_NAME_RESOLUTION /* Suppress domain name resolutions that would halt * the program for periods of time */ hints.ai_flags = AI_NUMERICHOST; #else /* Allow domain name resolution. */ hints.ai_flags = 0; #endif hints.ai_protocol = 0; /* Any protocol? */ rerr = getaddrinfo(host, NULL /* fill in port ourselves */, &hints, &result); if (rerr) { wpa_printf(MSG_INFO, "WPS UPnP: Resolve error %d (%s) on: %s", rerr, gai_strerror(rerr), host); goto fail; } if (delim) *delim = ':'; /* Restore port */ host_len = os_strlen(host); path_len = path ? os_strlen(path) : 0; alloc_len = host_len + 1 + 1 + path_len + 1; for (rp = result; rp; rp = rp->ai_next) { struct subscr_addr *a; + struct sockaddr_in *addr = (struct sockaddr_in *) rp->ai_addr; /* Limit no. of address to avoid denial of service attack */ if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) { wpa_printf(MSG_INFO, "WPS UPnP: subscr_addr_add_url: " "Ignoring excessive addresses"); break; } + if (!local_network_addr(s->sm, addr)) { + wpa_printf(MSG_INFO, + "WPS UPnP: Ignore a delivery URL that points to another network %s", + inet_ntoa(addr->sin_addr)); + continue; + } + a = os_zalloc(sizeof(*a) + alloc_len); if (a == NULL) break; mem = (char *) (a + 1); a->domain_and_port = mem; os_memcpy(mem, host, host_len); mem += host_len + 1; a->path = mem; if (path == NULL || path[0] != '/') *mem++ = '/'; if (path) os_memcpy(mem, path, path_len); os_memcpy(&a->saddr, rp->ai_addr, sizeof(a->saddr)); a->saddr.sin_port = htons(port); dl_list_add(&s->addr_list, &a->list); } fail: if (result) freeaddrinfo(result); os_free(scratch_mem); } /* subscr_addr_list_create -- create list from urls in string. * Each url is enclosed by angle brackets. */ static void subscr_addr_list_create(struct subscription *s, const char *url_list) { const char *end; wpa_printf(MSG_DEBUG, "WPS UPnP: Parsing URL list '%s'", url_list); for (;;) { while (*url_list == ' ' || *url_list == '\t') url_list++; if (*url_list != '<') break; url_list++; end = os_strchr(url_list, '>'); if (end == NULL) break; subscr_addr_add_url(s, url_list, end - url_list); url_list = end + 1; } } static void wpabuf_put_property(struct wpabuf *buf, const char *name, const char *value) { wpabuf_put_str(buf, ""); wpabuf_printf(buf, "<%s>", name); if (value) wpabuf_put_str(buf, value); wpabuf_printf(buf, "", name); wpabuf_put_str(buf, "\n"); } /** * upnp_wps_device_send_event - Queue event messages for subscribers * @sm: WPS UPnP state machine from upnp_wps_device_init() * * This function queues the last WLANEvent to be sent for all currently * subscribed UPnP control points. sm->wlanevent must have been set with the * encoded data before calling this function. */ static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm) { /* Enqueue event message for all subscribers */ struct wpabuf *buf; /* holds event message */ int buf_size = 0; struct subscription *s, *tmp; /* Actually, utf-8 is the default, but it doesn't hurt to specify it */ const char *format_head = "\n" "\n"; const char *format_tail = "\n"; struct os_reltime now; if (dl_list_empty(&sm->subscriptions)) { /* optimize */ return; } if (os_get_reltime(&now) == 0) { if (now.sec != sm->last_event_sec) { sm->last_event_sec = now.sec; sm->num_events_in_sec = 1; } else { sm->num_events_in_sec++; /* * In theory, this should apply to all WLANEvent * notifications, but EAP messages are of much higher * priority and Probe Request notifications should not * be allowed to drop EAP messages, so only throttle * Probe Request notifications. */ if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC && sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE) { wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle " "event notifications (%u seen " "during one second)", sm->num_events_in_sec); return; } } } /* Determine buffer size needed first */ buf_size += os_strlen(format_head); buf_size += 50 + 2 * os_strlen("WLANEvent"); if (sm->wlanevent) buf_size += os_strlen(sm->wlanevent); buf_size += os_strlen(format_tail); buf = wpabuf_alloc(buf_size); if (buf == NULL) return; wpabuf_put_str(buf, format_head); wpabuf_put_property(buf, "WLANEvent", sm->wlanevent); wpabuf_put_str(buf, format_tail); wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:\n%s", (char *) wpabuf_head(buf)); dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription, list) { event_add(s, buf, sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE); } wpabuf_free(buf); } /* * Event subscription (subscriber machines register with us to receive event * messages). * This is the result of an incoming HTTP over TCP SUBSCRIBE request. */ /* subscription_destroy -- destroy an unlinked subscription * Be sure to unlink first if necessary. */ void subscription_destroy(struct subscription *s) { struct upnp_wps_device_interface *iface; wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s); subscr_addr_free_all(s); event_delete_all(s); dl_list_for_each(iface, &s->sm->interfaces, struct upnp_wps_device_interface, list) upnp_er_remove_notification(iface->wps->registrar, s); os_free(s); } /* subscription_list_age -- remove expired subscriptions */ static void subscription_list_age(struct upnp_wps_device_sm *sm, time_t now) { struct subscription *s, *tmp; dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription, list) { if (s->timeout_time > now) break; wpa_printf(MSG_DEBUG, "WPS UPnP: Removing aged subscription"); dl_list_del(&s->list); subscription_destroy(s); } } /* subscription_find -- return existing subscription matching uuid, if any * returns NULL if not found */ struct subscription * subscription_find(struct upnp_wps_device_sm *sm, const u8 uuid[UUID_LEN]) { struct subscription *s; dl_list_for_each(s, &sm->subscriptions, struct subscription, list) { if (os_memcmp(s->uuid, uuid, UUID_LEN) == 0) return s; /* Found match */ } return NULL; } static struct wpabuf * build_fake_wsc_ack(void) { struct wpabuf *msg = wpabuf_alloc(100); if (msg == NULL) return NULL; wpabuf_put_u8(msg, UPNP_WPS_WLANEVENT_TYPE_EAP); wpabuf_put_str(msg, "00:00:00:00:00:00"); if (wps_build_version(msg) || wps_build_msg_type(msg, WPS_WSC_ACK)) { wpabuf_free(msg); return NULL; } /* Enrollee Nonce */ wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE); wpabuf_put_be16(msg, WPS_NONCE_LEN); wpabuf_put(msg, WPS_NONCE_LEN); /* Registrar Nonce */ wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE); wpabuf_put_be16(msg, WPS_NONCE_LEN); wpabuf_put(msg, WPS_NONCE_LEN); if (wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { wpabuf_free(msg); return NULL; } return msg; } /* subscription_first_event -- send format/queue event that is automatically * sent on a new subscription. */ static int subscription_first_event(struct subscription *s) { /* * Actually, utf-8 is the default, but it doesn't hurt to specify it. * * APStatus is apparently a bit set, * 0x1 = configuration change (but is always set?) * 0x10 = ap is locked * * Per UPnP spec, we send out the last value of each variable, even * for WLANEvent, whatever it was. */ char *wlan_event; struct wpabuf *buf; int ap_status = 1; /* TODO: add 0x10 if access point is locked */ const char *head = "\n" "\n"; const char *tail = "\n"; char txt[10]; int ret; if (s->sm->wlanevent == NULL) { /* * There has been no events before the subscription. However, * UPnP device architecture specification requires all the * evented variables to be included, so generate a dummy event * for this particular case using a WSC_ACK and all-zeros * nonces. The ER (UPnP control point) will ignore this, but at * least it will learn that WLANEvent variable will be used in * event notifications in the future. */ struct wpabuf *msg; wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the " "initial WLANEvent"); msg = build_fake_wsc_ack(); if (msg) { s->sm->wlanevent = (char *) base64_encode(wpabuf_head(msg), wpabuf_len(msg), NULL); wpabuf_free(msg); } } wlan_event = s->sm->wlanevent; if (wlan_event == NULL || *wlan_event == '\0') { wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for " "initial event message"); wlan_event = ""; } buf = wpabuf_alloc(500 + os_strlen(wlan_event)); if (buf == NULL) return -1; wpabuf_put_str(buf, head); wpabuf_put_property(buf, "STAStatus", "1"); os_snprintf(txt, sizeof(txt), "%d", ap_status); wpabuf_put_property(buf, "APStatus", txt); if (*wlan_event) wpabuf_put_property(buf, "WLANEvent", wlan_event); wpabuf_put_str(buf, tail); ret = event_add(s, buf, 0); if (ret) { wpabuf_free(buf); return ret; } wpabuf_free(buf); return 0; } /** * subscription_start - Remember a UPnP control point to send events to. * @sm: WPS UPnP state machine from upnp_wps_device_init() * @callback_urls: Callback URLs * Returns: %NULL on error, or pointer to new subscription structure. */ struct subscription * subscription_start(struct upnp_wps_device_sm *sm, const char *callback_urls) { struct subscription *s; time_t now = time(NULL); time_t expire = now + UPNP_SUBSCRIBE_SEC; char str[80]; /* Get rid of expired subscriptions so we have room */ subscription_list_age(sm, now); /* If too many subscriptions, remove oldest */ if (dl_list_len(&sm->subscriptions) >= MAX_SUBSCRIPTIONS) { s = dl_list_first(&sm->subscriptions, struct subscription, list); if (s) { wpa_printf(MSG_INFO, "WPS UPnP: Too many subscriptions, trashing oldest"); dl_list_del(&s->list); subscription_destroy(s); } } s = os_zalloc(sizeof(*s)); if (s == NULL) return NULL; dl_list_init(&s->addr_list); dl_list_init(&s->event_queue); s->sm = sm; s->timeout_time = expire; if (uuid_make(s->uuid) < 0) { subscription_destroy(s); return NULL; } subscr_addr_list_create(s, callback_urls); if (dl_list_empty(&s->addr_list)) { wpa_printf(MSG_DEBUG, "WPS UPnP: No valid callback URLs in " "'%s' - drop subscription", callback_urls); subscription_destroy(s); return NULL; } /* Add to end of list, since it has the highest expiration time */ dl_list_add_tail(&sm->subscriptions, &s->list); /* Queue up immediate event message (our last event) * as required by UPnP spec. */ if (subscription_first_event(s)) { wpa_printf(MSG_INFO, "WPS UPnP: Dropping subscriber due to " "event backlog"); dl_list_del(&s->list); subscription_destroy(s); return NULL; } uuid_bin2str(s->uuid, str, sizeof(str)); wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p (SID %s) started with %s", s, str, callback_urls); /* Schedule sending this */ event_send_all_later(sm); return s; } /* subscription_renew -- find subscription and reset timeout */ struct subscription * subscription_renew(struct upnp_wps_device_sm *sm, const u8 uuid[UUID_LEN]) { time_t now = time(NULL); time_t expire = now + UPNP_SUBSCRIBE_SEC; struct subscription *s = subscription_find(sm, uuid); if (s == NULL) return NULL; wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewed"); dl_list_del(&s->list); s->timeout_time = expire; /* add back to end of list, since it now has highest expiry */ dl_list_add_tail(&sm->subscriptions, &s->list); return s; } /** * upnp_wps_device_send_wlan_event - Event notification * @sm: WPS UPnP state machine from upnp_wps_device_init() * @from_mac_addr: Source (Enrollee) MAC address for the event * @ev_type: Event type * @msg: Event data * Returns: 0 on success, -1 on failure * * Tell external Registrars (UPnP control points) that something happened. In * particular, events include WPS messages from clients that are proxied to * external Registrars. */ int upnp_wps_device_send_wlan_event(struct upnp_wps_device_sm *sm, const u8 from_mac_addr[ETH_ALEN], enum upnp_wps_wlanevent_type ev_type, const struct wpabuf *msg) { int ret = -1; char type[2]; const u8 *mac = from_mac_addr; char mac_text[18]; u8 *raw = NULL; size_t raw_len; char *val; size_t val_len; int pos = 0; if (!sm) goto fail; os_snprintf(type, sizeof(type), "%1u", ev_type); raw_len = 1 + 17 + (msg ? wpabuf_len(msg) : 0); raw = os_zalloc(raw_len); if (!raw) goto fail; *(raw + pos) = (u8) ev_type; pos += 1; os_snprintf(mac_text, sizeof(mac_text), MACSTR, MAC2STR(mac)); wpa_printf(MSG_DEBUG, "WPS UPnP: Proxying WLANEvent from %s", mac_text); os_memcpy(raw + pos, mac_text, 17); pos += 17; if (msg) { os_memcpy(raw + pos, wpabuf_head(msg), wpabuf_len(msg)); pos += wpabuf_len(msg); } raw_len = pos; val = (char *) base64_encode(raw, raw_len, &val_len); if (val == NULL) goto fail; os_free(sm->wlanevent); sm->wlanevent = val; sm->wlanevent_type = ev_type; upnp_wps_device_send_event(sm); ret = 0; fail: os_free(raw); return ret; } #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) #include #include #include static int eth_get(const char *device, u8 ea[ETH_ALEN]) { struct if_msghdr *ifm; struct sockaddr_dl *sdl; u_char *p, *buf; size_t len; int mib[] = { CTL_NET, AF_ROUTE, 0, AF_LINK, NET_RT_IFLIST, 0 }; if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0) return -1; if ((buf = os_malloc(len)) == NULL) return -1; if (sysctl(mib, 6, buf, &len, NULL, 0) < 0) { os_free(buf); return -1; } for (p = buf; p < buf + len; p += ifm->ifm_msglen) { ifm = (struct if_msghdr *)p; sdl = (struct sockaddr_dl *)(ifm + 1); if (ifm->ifm_type != RTM_IFINFO || (ifm->ifm_addrs & RTA_IFP) == 0) continue; if (sdl->sdl_family != AF_LINK || sdl->sdl_nlen == 0 || os_memcmp(sdl->sdl_data, device, sdl->sdl_nlen) != 0) continue; os_memcpy(ea, LLADDR(sdl), sdl->sdl_alen); break; } os_free(buf); if (p >= buf + len) { errno = ESRCH; return -1; } return 0; } #endif /* __FreeBSD__ */ /** * get_netif_info - Get hw and IP addresses for network device * @net_if: Selected network interface name * @ip_addr: Buffer for returning IP address in network byte order * @ip_addr_text: Buffer for returning a pointer to allocated IP address text + * @netmask: Buffer for returning netmask or %NULL if not needed * @mac: Buffer for returning MAC address * Returns: 0 on success, -1 on failure */ int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, - u8 mac[ETH_ALEN]) + struct in_addr *netmask, u8 mac[ETH_ALEN]) { struct ifreq req; int sock = -1; struct sockaddr_in *addr; struct in_addr in_addr; *ip_addr_text = os_zalloc(16); if (*ip_addr_text == NULL) goto fail; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) goto fail; os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); if (ioctl(sock, SIOCGIFADDR, &req) < 0) { wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFADDR failed: %d (%s)", errno, strerror(errno)); goto fail; } addr = (void *) &req.ifr_addr; *ip_addr = addr->sin_addr.s_addr; in_addr.s_addr = *ip_addr; os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr)); + if (netmask) { + os_memset(&req, 0, sizeof(req)); + os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); + if (ioctl(sock, SIOCGIFNETMASK, &req) < 0) { + wpa_printf(MSG_ERROR, + "WPS UPnP: SIOCGIFNETMASK failed: %d (%s)", + errno, strerror(errno)); + goto fail; + } + addr = (struct sockaddr_in *) &req.ifr_netmask; + netmask->s_addr = addr->sin_addr.s_addr; + } + #ifdef __linux__ os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name)); if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) { wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFHWADDR failed: " "%d (%s)", errno, strerror(errno)); goto fail; } os_memcpy(mac, req.ifr_addr.sa_data, 6); #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) if (eth_get(net_if, mac) < 0) { wpa_printf(MSG_ERROR, "WPS UPnP: Failed to get MAC address"); goto fail; } #else #error MAC address fetch not implemented #endif close(sock); return 0; fail: if (sock >= 0) close(sock); os_free(*ip_addr_text); *ip_addr_text = NULL; return -1; } static void upnp_wps_free_msearchreply(struct dl_list *head) { struct advertisement_state_machine *a, *tmp; dl_list_for_each_safe(a, tmp, head, struct advertisement_state_machine, list) msearchreply_state_machine_stop(a); } static void upnp_wps_free_subscriptions(struct dl_list *head, struct wps_registrar *reg) { struct subscription *s, *tmp; dl_list_for_each_safe(s, tmp, head, struct subscription, list) { if (reg && s->reg != reg) continue; dl_list_del(&s->list); subscription_destroy(s); } } /** * upnp_wps_device_stop - Stop WPS UPnP operations on an interface * @sm: WPS UPnP state machine from upnp_wps_device_init() */ static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm) { if (!sm || !sm->started) return; wpa_printf(MSG_DEBUG, "WPS UPnP: Stop device"); web_listener_stop(sm); ssdp_listener_stop(sm); upnp_wps_free_msearchreply(&sm->msearch_replies); upnp_wps_free_subscriptions(&sm->subscriptions, NULL); advertisement_state_machine_stop(sm, 1); event_send_stop_all(sm); os_free(sm->wlanevent); sm->wlanevent = NULL; os_free(sm->ip_addr_text); sm->ip_addr_text = NULL; if (sm->multicast_sd >= 0) close(sm->multicast_sd); sm->multicast_sd = -1; sm->started = 0; } /** * upnp_wps_device_start - Start WPS UPnP operations on an interface * @sm: WPS UPnP state machine from upnp_wps_device_init() * @net_if: Selected network interface name * Returns: 0 on success, -1 on failure */ static int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if) { if (!sm || !net_if) return -1; if (sm->started) upnp_wps_device_stop(sm); sm->multicast_sd = -1; sm->ssdp_sd = -1; sm->started = 1; sm->advertise_count = 0; /* Fix up linux multicast handling */ if (add_ssdp_network(net_if)) goto fail; /* Determine which IP and mac address we're using */ if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text, - sm->mac_addr)) { + &sm->netmask, sm->mac_addr)) { wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " "for %s. Does it have IP address?", net_if); goto fail; } + wpa_printf(MSG_DEBUG, "WPS UPnP: Local IP address %s netmask %s hwaddr " + MACSTR, + sm->ip_addr_text, inet_ntoa(sm->netmask), + MAC2STR(sm->mac_addr)); /* Listen for incoming TCP connections so that others * can fetch our "xml files" from us. */ if (web_listener_start(sm)) goto fail; /* Set up for receiving discovery (UDP) packets */ if (ssdp_listener_start(sm)) goto fail; /* Set up for sending multicast */ if (ssdp_open_multicast(sm) < 0) goto fail; /* * Broadcast NOTIFY messages to let the world know we exist. * This is done via a state machine since the messages should not be * all sent out at once. */ if (advertisement_state_machine_start(sm)) goto fail; return 0; fail: upnp_wps_device_stop(sm); return -1; } static struct upnp_wps_device_interface * upnp_wps_get_iface(struct upnp_wps_device_sm *sm, void *priv) { struct upnp_wps_device_interface *iface; dl_list_for_each(iface, &sm->interfaces, struct upnp_wps_device_interface, list) { if (iface->priv == priv) return iface; } return NULL; } /** * upnp_wps_device_deinit - Deinitialize WPS UPnP * @sm: WPS UPnP state machine from upnp_wps_device_init() * @priv: External context data that was used in upnp_wps_device_init() call */ void upnp_wps_device_deinit(struct upnp_wps_device_sm *sm, void *priv) { struct upnp_wps_device_interface *iface; struct upnp_wps_peer *peer; if (!sm) return; iface = upnp_wps_get_iface(sm, priv); if (iface == NULL) { wpa_printf(MSG_ERROR, "WPS UPnP: Could not find the interface " "instance to deinit"); return; } wpa_printf(MSG_DEBUG, "WPS UPnP: Deinit interface instance %p", iface); if (dl_list_len(&sm->interfaces) == 1) { wpa_printf(MSG_DEBUG, "WPS UPnP: Deinitializing last instance " "- free global device instance"); upnp_wps_device_stop(sm); } else upnp_wps_free_subscriptions(&sm->subscriptions, iface->wps->registrar); dl_list_del(&iface->list); while ((peer = dl_list_first(&iface->peers, struct upnp_wps_peer, list))) { if (peer->wps) wps_deinit(peer->wps); dl_list_del(&peer->list); os_free(peer); } os_free(iface->ctx->ap_pin); os_free(iface->ctx); os_free(iface); if (dl_list_empty(&sm->interfaces)) { os_free(sm->root_dir); os_free(sm->desc_url); os_free(sm); shared_upnp_device = NULL; } } /** * upnp_wps_device_init - Initialize WPS UPnP * @ctx: callback table; we must eventually free it * @wps: Pointer to longterm WPS context * @priv: External context data that will be used in callbacks * @net_if: Selected network interface name * Returns: WPS UPnP state or %NULL on failure */ struct upnp_wps_device_sm * upnp_wps_device_init(struct upnp_wps_device_ctx *ctx, struct wps_context *wps, void *priv, char *net_if) { struct upnp_wps_device_sm *sm; struct upnp_wps_device_interface *iface; int start = 0; iface = os_zalloc(sizeof(*iface)); if (iface == NULL) { os_free(ctx->ap_pin); os_free(ctx); return NULL; } wpa_printf(MSG_DEBUG, "WPS UPnP: Init interface instance %p", iface); dl_list_init(&iface->peers); iface->ctx = ctx; iface->wps = wps; iface->priv = priv; if (shared_upnp_device) { wpa_printf(MSG_DEBUG, "WPS UPnP: Share existing device " "context"); sm = shared_upnp_device; } else { wpa_printf(MSG_DEBUG, "WPS UPnP: Initialize device context"); sm = os_zalloc(sizeof(*sm)); if (!sm) { wpa_printf(MSG_ERROR, "WPS UPnP: upnp_wps_device_init " "failed"); os_free(iface); os_free(ctx->ap_pin); os_free(ctx); return NULL; } shared_upnp_device = sm; dl_list_init(&sm->msearch_replies); dl_list_init(&sm->subscriptions); dl_list_init(&sm->interfaces); start = 1; } dl_list_add(&sm->interfaces, &iface->list); if (start && upnp_wps_device_start(sm, net_if)) { upnp_wps_device_deinit(sm, priv); return NULL; } return sm; } /** * upnp_wps_subscribers - Check whether there are any event subscribers * @sm: WPS UPnP state machine from upnp_wps_device_init() * Returns: 0 if no subscribers, 1 if subscribers */ int upnp_wps_subscribers(struct upnp_wps_device_sm *sm) { return !dl_list_empty(&sm->subscriptions); } int upnp_wps_set_ap_pin(struct upnp_wps_device_sm *sm, const char *ap_pin) { struct upnp_wps_device_interface *iface; if (sm == NULL) return 0; dl_list_for_each(iface, &sm->interfaces, struct upnp_wps_device_interface, list) { os_free(iface->ctx->ap_pin); if (ap_pin) { iface->ctx->ap_pin = os_strdup(ap_pin); if (iface->ctx->ap_pin == NULL) return -1; } else iface->ctx->ap_pin = NULL; } return 0; } Index: vendor/wpa/dist/src/wps/wps_upnp_i.h =================================================================== --- vendor/wpa/dist/src/wps/wps_upnp_i.h (revision 361935) +++ vendor/wpa/dist/src/wps/wps_upnp_i.h (revision 361936) @@ -1,192 +1,193 @@ /* * UPnP for WPS / internal definitions * Copyright (c) 2000-2003 Intel Corporation * Copyright (c) 2006-2007 Sony Corporation * Copyright (c) 2008-2009 Atheros Communications * Copyright (c) 2009, Jouni Malinen * * See wps_upnp.c for more details on licensing and code history. */ #ifndef WPS_UPNP_I_H #define WPS_UPNP_I_H #include "utils/list.h" #include "http.h" #define UPNP_MULTICAST_ADDRESS "239.255.255.250" /* for UPnP multicasting */ #define UPNP_MULTICAST_PORT 1900 /* UDP port to monitor for UPnP */ /* min subscribe time per UPnP standard */ #define UPNP_SUBSCRIBE_SEC_MIN 1800 /* subscribe time we use */ #define UPNP_SUBSCRIBE_SEC (UPNP_SUBSCRIBE_SEC_MIN + 1) /* "filenames" used in URLs that we service via our "web server": */ #define UPNP_WPS_DEVICE_XML_FILE "wps_device.xml" #define UPNP_WPS_SCPD_XML_FILE "wps_scpd.xml" #define UPNP_WPS_DEVICE_CONTROL_FILE "wps_control" #define UPNP_WPS_DEVICE_EVENT_FILE "wps_event" #define MULTICAST_MAX_READ 1600 /* max bytes we'll read for UPD request */ struct upnp_wps_device_sm; struct wps_registrar; enum advertisement_type_enum { ADVERTISE_UP = 0, ADVERTISE_DOWN = 1, MSEARCH_REPLY = 2 }; /* * Advertisements are broadcast via UDP NOTIFYs, and are also the essence of * the reply to UDP M-SEARCH requests. This struct handles both cases. * * A state machine is needed because a number of variant forms must be sent in * separate packets and spread out in time to avoid congestion. */ struct advertisement_state_machine { struct dl_list list; enum advertisement_type_enum type; int state; int nerrors; struct sockaddr_in client; /* for M-SEARCH replies */ }; /* * An address of a subscriber (who may have multiple addresses). We are * supposed to send (via TCP) updates to each subscriber, trying each address * for a subscriber until we find one that seems to work. */ struct subscr_addr { struct dl_list list; char *domain_and_port; /* domain and port part of url */ char *path; /* "filepath" part of url (from "mem") */ struct sockaddr_in saddr; /* address for doing connect */ unsigned num_failures; }; /* * Subscribers to our events are recorded in this struct. This includes a max * of one outgoing connection (sending an "event message") per subscriber. We * also have to age out subscribers unless they renew. */ struct subscription { struct dl_list list; struct upnp_wps_device_sm *sm; /* parent */ time_t timeout_time; /* when to age out the subscription */ unsigned next_subscriber_sequence; /* number our messages */ /* * This uuid identifies the subscription and is randomly generated by * us and given to the subscriber when the subscription is accepted; * and is then included with each event sent to the subscriber. */ u8 uuid[UUID_LEN]; /* Linked list of address alternatives (rotate through on failure) */ struct dl_list addr_list; struct dl_list event_queue; /* Queued event messages. */ struct wps_event_ *current_event; /* non-NULL if being sent (not in q) */ int last_event_failed; /* Whether delivery of last event failed */ /* Information from SetSelectedRegistrar action */ u8 selected_registrar; u16 dev_password_id; u16 config_methods; u8 authorized_macs[WPS_MAX_AUTHORIZED_MACS][ETH_ALEN]; struct wps_registrar *reg; }; struct upnp_wps_device_interface { struct dl_list list; struct upnp_wps_device_ctx *ctx; /* callback table */ struct wps_context *wps; void *priv; struct dl_list peers; /* active UPnP peer sessions */ }; /* * Our instance data corresponding to the AP device. Note that there may be * multiple wireless interfaces sharing the same UPnP device instance. Each * such interface is stored in the list of struct upnp_wps_device_interface * instances. * * This is known as an opaque struct declaration to users of the WPS UPnP code. */ struct upnp_wps_device_sm { struct dl_list interfaces; /* struct upnp_wps_device_interface */ char *root_dir; char *desc_url; int started; /* nonzero if we are active */ u8 mac_addr[ETH_ALEN]; /* mac addr of network i.f. we use */ char *ip_addr_text; /* IP address of network i.f. we use */ unsigned ip_addr; /* IP address of network i.f. we use (host order) */ + struct in_addr netmask; int multicast_sd; /* send multicast messages over this socket */ int ssdp_sd; /* receive discovery UPD packets on socket */ int ssdp_sd_registered; /* nonzero if we must unregister */ unsigned advertise_count; /* how many advertisements done */ struct advertisement_state_machine advertisement; struct dl_list msearch_replies; int web_port; /* our port that others get xml files from */ struct http_server *web_srv; /* Note: subscriptions are kept in expiry order */ struct dl_list subscriptions; int event_send_all_queued; /* if we are scheduled to send events soon */ char *wlanevent; /* the last WLANEvent data */ enum upnp_wps_wlanevent_type wlanevent_type; os_time_t last_event_sec; unsigned int num_events_in_sec; }; /* wps_upnp.c */ void format_date(struct wpabuf *buf); struct subscription * subscription_start(struct upnp_wps_device_sm *sm, const char *callback_urls); struct subscription * subscription_renew(struct upnp_wps_device_sm *sm, const u8 uuid[UUID_LEN]); void subscription_destroy(struct subscription *s); struct subscription * subscription_find(struct upnp_wps_device_sm *sm, const u8 uuid[UUID_LEN]); void subscr_addr_delete(struct subscr_addr *a); int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text, - u8 mac[ETH_ALEN]); + struct in_addr *netmask, u8 mac[ETH_ALEN]); /* wps_upnp_ssdp.c */ void msearchreply_state_machine_stop(struct advertisement_state_machine *a); int advertisement_state_machine_start(struct upnp_wps_device_sm *sm); void advertisement_state_machine_stop(struct upnp_wps_device_sm *sm, int send_byebye); void ssdp_listener_stop(struct upnp_wps_device_sm *sm); int ssdp_listener_start(struct upnp_wps_device_sm *sm); int ssdp_listener_open(void); int add_ssdp_network(const char *net_if); int ssdp_open_multicast_sock(u32 ip_addr, const char *forced_ifname); int ssdp_open_multicast(struct upnp_wps_device_sm *sm); /* wps_upnp_web.c */ int web_listener_start(struct upnp_wps_device_sm *sm); void web_listener_stop(struct upnp_wps_device_sm *sm); /* wps_upnp_event.c */ int event_add(struct subscription *s, const struct wpabuf *data, int probereq); void event_delete_all(struct subscription *s); void event_send_all_later(struct upnp_wps_device_sm *sm); void event_send_stop_all(struct upnp_wps_device_sm *sm); /* wps_upnp_ap.c */ int upnp_er_set_selected_registrar(struct wps_registrar *reg, struct subscription *s, const struct wpabuf *msg); void upnp_er_remove_notification(struct wps_registrar *reg, struct subscription *s); #endif /* WPS_UPNP_I_H */