Disconnect hostapd from building in base
[dragonfly.git] / contrib / hostapd / src / wps / wps_upnp.c
CommitLineData
a875087d
JL
1/*
2 * UPnP WPS Device
3 * Copyright (c) 2000-2003 Intel Corporation
4 * Copyright (c) 2006-2007 Sony Corporation
5 * Copyright (c) 2008-2009 Atheros Communications
4781064b 6 * Copyright (c) 2009-2010, Jouni Malinen <j@w1.fi>
a875087d
JL
7 *
8 * See below for more details on licensing and code history.
9 */
10
11/*
12 * This has been greatly stripped down from the original file
13 * (upnp_wps_device.c) by Ted Merrill, Atheros Communications
14 * in order to eliminate use of the bulky libupnp library etc.
15 *
16 * History:
17 * upnp_wps_device.c is/was a shim layer between wps_opt_upnp.c and
18 * the libupnp library.
19 * The layering (by Sony) was well done; only a very minor modification
20 * to API of upnp_wps_device.c was required.
21 * libupnp was found to be undesirable because:
22 * -- It consumed too much code and data space
23 * -- It uses multiple threads, making debugging more difficult
24 * and possibly reducing reliability.
25 * -- It uses static variables and only supports one instance.
26 * The shim and libupnp are here replaced by special code written
27 * specifically for the needs of hostapd.
28 * Various shortcuts can and are taken to keep the code size small.
29 * Generally, execution time is not as crucial.
30 *
31 * BUGS:
32 * -- UPnP requires that we be able to resolve domain names.
33 * While uncommon, if we have to do it then it will stall the entire
34 * hostapd program, which is bad.
35 * This is because we use the standard linux getaddrinfo() function
36 * which is syncronous.
37 * An asyncronous solution would be to use the free "ares" library.
38 * -- Does not have a robust output buffering scheme. Uses a single
39 * fixed size output buffer per TCP/HTTP connection, with possible (although
40 * unlikely) possibility of overflow and likely excessive use of RAM.
41 * A better solution would be to write the HTTP output as a buffered stream,
42 * using chunking: (handle header specially, then) generate data with
43 * a printf-like function into a buffer, catching buffer full condition,
44 * then send it out surrounded by http chunking.
45 * -- There is some code that could be separated out into the common
46 * library to be shared with wpa_supplicant.
47 * -- Needs renaming with module prefix to avoid polluting the debugger
48 * namespace and causing possible collisions with other static fncs
49 * and structure declarations when using the debugger.
4781064b 50 * -- The http error code generation is pretty bogus, hopefully no one cares.
a875087d
JL
51 *
52 * Author: Ted Merrill, Atheros Communications, based upon earlier work
53 * as explained above and below.
54 *
55 * Copyright:
56 * Copyright 2008 Atheros Communications.
57 *
58 * The original header (of upnp_wps_device.c) reads:
59 *
60 * Copyright (c) 2006-2007 Sony Corporation. All Rights Reserved.
61 *
62 * File Name: upnp_wps_device.c
63 * Description: EAP-WPS UPnP device source
64 *
65 * Redistribution and use in source and binary forms, with or without
66 * modification, are permitted provided that the following conditions
67 * are met:
68 *
69 * * Redistributions of source code must retain the above copyright
70 * notice, this list of conditions and the following disclaimer.
71 * * Redistributions in binary form must reproduce the above copyright
72 * notice, this list of conditions and the following disclaimer in
73 * the documentation and/or other materials provided with the
74 * distribution.
75 * * Neither the name of Sony Corporation nor the names of its
76 * contributors may be used to endorse or promote products derived
77 * from this software without specific prior written permission.
78 *
79 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
80 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
81 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
82 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
83 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
84 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
85 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
86 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
87 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
88 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
89 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
90 *
91 * Portions from Intel libupnp files, e.g. genlib/net/http/httpreadwrite.c
92 * typical header:
93 *
94 * Copyright (c) 2000-2003 Intel Corporation
95 * All rights reserved.
96 *
97 * Redistribution and use in source and binary forms, with or without
98 * modification, are permitted provided that the following conditions are met:
99 *
100 * * Redistributions of source code must retain the above copyright notice,
101 * this list of conditions and the following disclaimer.
102 * * Redistributions in binary form must reproduce the above copyright notice,
103 * this list of conditions and the following disclaimer in the documentation
104 * and/or other materials provided with the distribution.
105 * * Neither name of Intel Corporation nor the names of its contributors
106 * may be used to endorse or promote products derived from this software
107 * without specific prior written permission.
108 *
109 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
110 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
111 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
112 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR
113 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
114 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
115 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
116 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
117 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
118 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
119 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
120*/
121
122/*
123 * Overview of WPS over UPnP:
124 *
125 * UPnP is a protocol that allows devices to discover each other and control
126 * each other. In UPnP terminology, a device is either a "device" (a server
127 * that provides information about itself and allows itself to be controlled)
128 * or a "control point" (a client that controls "devices") or possibly both.
129 * This file implements a UPnP "device".
130 *
131 * For us, we use mostly basic UPnP discovery, but the control part of interest
132 * is WPS carried via UPnP messages. There is quite a bit of basic UPnP
133 * discovery to do before we can get to WPS, however.
134 *
135 * UPnP discovery begins with "devices" send out multicast UDP packets to a
136 * certain fixed multicast IP address and port, and "control points" sending
137 * out other such UDP packets.
138 *
139 * The packets sent by devices are NOTIFY packets (not to be confused with TCP
140 * NOTIFY packets that are used later) and those sent by control points are
141 * M-SEARCH packets. These packets contain a simple HTTP style header. The
142 * packets are sent redundantly to get around packet loss. Devices respond to
143 * M-SEARCH packets with HTTP-like UDP packets containing HTTP/1.1 200 OK
144 * messages, which give similar information as the UDP NOTIFY packets.
145 *
146 * The above UDP packets advertise the (arbitrary) TCP ports that the
147 * respective parties will listen to. The control point can then do a HTTP
148 * SUBSCRIBE (something like an HTTP PUT) after which the device can do a
149 * separate HTTP NOTIFY (also like an HTTP PUT) to do event messaging.
150 *
151 * The control point will also do HTTP GET of the "device file" listed in the
152 * original UDP information from the device (see UPNP_WPS_DEVICE_XML_FILE
153 * data), and based on this will do additional GETs... HTTP POSTs are done to
154 * cause an action.
155 *
156 * Beyond some basic information in HTTP headers, additional information is in
157 * the HTTP bodies, in a format set by the SOAP and XML standards, a markup
158 * language related to HTML used for web pages. This language is intended to
159 * provide the ultimate in self-documentation by providing a universal
160 * namespace based on pseudo-URLs called URIs. Note that although a URI looks
161 * like a URL (a web address), they are never accessed as such but are used
162 * only as identifiers.
163 *
164 * The POST of a GetDeviceInfo gets information similar to what might be
165 * obtained from a probe request or response on Wi-Fi. WPS messages M1-M8
166 * are passed via a POST of a PutMessage; the M1-M8 WPS messages are converted
167 * to a bin64 ascii representation for encapsulation. When proxying messages,
168 * WLANEvent and PutWLANResponse are used.
169 *
170 * This of course glosses over a lot of details.
171 */
172
173#include "includes.h"
174
4781064b 175#include <time.h>
a875087d
JL
176#include <net/if.h>
177#include <netdb.h>
178#include <sys/ioctl.h>
179
180#include "common.h"
181#include "uuid.h"
182#include "base64.h"
183#include "wps.h"
184#include "wps_i.h"
185#include "wps_upnp.h"
186#include "wps_upnp_i.h"
187
188
189/*
190 * UPnP allows a client ("control point") to send a server like us ("device")
191 * a domain name for registration, and we are supposed to resolve it. This is
192 * bad because, using the standard Linux library, we will stall the entire
193 * hostapd waiting for resolution.
194 *
195 * The "correct" solution would be to use an event driven library for domain
196 * name resolution such as "ares". However, this would increase code size
197 * further. Since it is unlikely that we'll actually see such domain names, we
198 * can just refuse to accept them.
199 */
200#define NO_DOMAIN_NAME_RESOLUTION 1 /* 1 to allow only dotted ip addresses */
201
202
203/*
204 * UPnP does not scale well. If we were in a room with thousands of control
205 * points then potentially we could be expected to handle subscriptions for
206 * each of them, which would exhaust our memory. So we must set a limit. In
207 * practice we are unlikely to see more than one or two.
208 */
209#define MAX_SUBSCRIPTIONS 4 /* how many subscribing clients we handle */
210#define MAX_ADDR_PER_SUBSCRIPTION 8
211
4781064b
JM
212/* Maximum number of Probe Request events per second */
213#define MAX_EVENTS_PER_SEC 5
214
215
216static struct upnp_wps_device_sm *shared_upnp_device = NULL;
217
a875087d
JL
218
219/* Write the current date/time per RFC */
220void format_date(struct wpabuf *buf)
221{
222 const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat";
223 const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0"
224 "Jul\0Aug\0Sep\0Oct\0Nov\0Dec";
225 struct tm *date;
226 time_t t;
227
228 t = time(NULL);
229 date = gmtime(&t);
230 wpabuf_printf(buf, "%s, %02d %s %d %02d:%02d:%02d GMT",
231 &weekday_str[date->tm_wday * 4], date->tm_mday,
232 &month_str[date->tm_mon * 4], date->tm_year + 1900,
233 date->tm_hour, date->tm_min, date->tm_sec);
234}
235
236
237/***************************************************************************
238 * UUIDs (unique identifiers)
239 *
240 * These are supposed to be unique in all the world.
241 * Sometimes permanent ones are used, sometimes temporary ones
242 * based on random numbers... there are different rules for valid content
243 * of different types.
244 * Each uuid is 16 bytes long.
245 **************************************************************************/
246
247/* uuid_make -- construct a random UUID
248 * The UPnP documents don't seem to offer any guidelines as to which method to
249 * use for constructing UUIDs for subscriptions. Presumably any method from
250 * rfc4122 is good enough; I've chosen random number method.
251 */
252static void uuid_make(u8 uuid[UUID_LEN])
253{
254 os_get_random(uuid, UUID_LEN);
255
256 /* Replace certain bits as specified in rfc4122 or X.667 */
257 uuid[6] &= 0x0f; uuid[6] |= (4 << 4); /* version 4 == random gen */
258 uuid[8] &= 0x3f; uuid[8] |= 0x80;
259}
260
261
262/*
263 * Subscriber address handling.
264 * Since a subscriber may have an arbitrary number of addresses, we have to
265 * add a bunch of code to handle them.
266 *
267 * Addresses are passed in text, and MAY be domain names instead of the (usual
268 * and expected) dotted IP addresses. Resolving domain names consumes a lot of
269 * resources. Worse, we are currently using the standard Linux getaddrinfo()
270 * which will block the entire program until complete or timeout! The proper
271 * solution would be to use the "ares" library or similar with more state
272 * machine steps etc. or just disable domain name resolution by setting
273 * NO_DOMAIN_NAME_RESOLUTION to 1 at top of this file.
274 */
275
276/* subscr_addr_delete -- delete single unlinked subscriber address
277 * (be sure to unlink first if need be)
278 */
4781064b 279void subscr_addr_delete(struct subscr_addr *a)
a875087d
JL
280{
281 /*
282 * Note: do NOT free domain_and_port or path because they point to
283 * memory within the allocation of "a".
284 */
285 os_free(a);
286}
287
288
a875087d
JL
289/* subscr_addr_free_all -- unlink and delete list of subscriber addresses. */
290static void subscr_addr_free_all(struct subscription *s)
291{
4781064b
JM
292 struct subscr_addr *a, *tmp;
293 dl_list_for_each_safe(a, tmp, &s->addr_list, struct subscr_addr, list)
294 {
295 dl_list_del(&a->list);
a875087d
JL
296 subscr_addr_delete(a);
297 }
298}
299
300
a875087d 301/* subscr_addr_add_url -- add address(es) for one url to subscription */
4781064b
JM
302static void subscr_addr_add_url(struct subscription *s, const char *url,
303 size_t url_len)
a875087d
JL
304{
305 int alloc_len;
306 char *scratch_mem = NULL;
307 char *mem;
4781064b 308 char *host;
a875087d
JL
309 char *delim;
310 char *path;
a875087d
JL
311 int port = 80; /* port to send to (default is port 80) */
312 struct addrinfo hints;
313 struct addrinfo *result = NULL;
314 struct addrinfo *rp;
315 int rerr;
4781064b 316 size_t host_len, path_len;
a875087d
JL
317
318 /* url MUST begin with http: */
4781064b 319 if (url_len < 7 || os_strncasecmp(url, "http://", 7))
a875087d
JL
320 goto fail;
321 url += 7;
4781064b 322 url_len -= 7;
a875087d 323
4781064b
JM
324 /* Make a copy of the string to allow modification during parsing */
325 scratch_mem = dup_binstr(url, url_len);
a875087d
JL
326 if (scratch_mem == NULL)
327 goto fail;
4781064b
JM
328 wpa_printf(MSG_DEBUG, "WPS UPnP: Adding URL '%s'", scratch_mem);
329 host = scratch_mem;
330 path = os_strchr(host, '/');
331 if (path)
332 *path++ = '\0'; /* null terminate host */
333
334 /* Process and remove optional port component */
335 delim = os_strchr(host, ':');
a875087d 336 if (delim) {
4781064b
JM
337 *delim = '\0'; /* null terminate host name for now */
338 if (isdigit(delim[1]))
339 port = atol(delim + 1);
a875087d
JL
340 }
341
342 /*
343 * getaddrinfo does the right thing with dotted decimal notations, or
344 * will resolve domain names. Resolving domain names will unfortunately
345 * hang the entire program until it is resolved or it times out
346 * internal to getaddrinfo; fortunately we think that the use of actual
347 * domain names (vs. dotted decimal notations) should be uncommon.
348 */
349 os_memset(&hints, 0, sizeof(struct addrinfo));
350 hints.ai_family = AF_INET; /* IPv4 */
351 hints.ai_socktype = SOCK_STREAM;
352#if NO_DOMAIN_NAME_RESOLUTION
353 /* Suppress domain name resolutions that would halt
354 * the program for periods of time
355 */
356 hints.ai_flags = AI_NUMERICHOST;
357#else
358 /* Allow domain name resolution. */
359 hints.ai_flags = 0;
360#endif
361 hints.ai_protocol = 0; /* Any protocol? */
4781064b 362 rerr = getaddrinfo(host, NULL /* fill in port ourselves */,
a875087d
JL
363 &hints, &result);
364 if (rerr) {
365 wpa_printf(MSG_INFO, "WPS UPnP: Resolve error %d (%s) on: %s",
4781064b 366 rerr, gai_strerror(rerr), host);
a875087d
JL
367 goto fail;
368 }
4781064b
JM
369
370 if (delim)
371 *delim = ':'; /* Restore port */
372
373 host_len = os_strlen(host);
374 path_len = path ? os_strlen(path) : 0;
375 alloc_len = host_len + 1 + 1 + path_len + 1;
376
a875087d 377 for (rp = result; rp; rp = rp->ai_next) {
4781064b
JM
378 struct subscr_addr *a;
379
a875087d 380 /* Limit no. of address to avoid denial of service attack */
4781064b 381 if (dl_list_len(&s->addr_list) >= MAX_ADDR_PER_SUBSCRIPTION) {
a875087d
JL
382 wpa_printf(MSG_INFO, "WPS UPnP: subscr_addr_add_url: "
383 "Ignoring excessive addresses");
384 break;
385 }
386
387 a = os_zalloc(sizeof(*a) + alloc_len);
388 if (a == NULL)
4781064b
JM
389 break;
390 mem = (char *) (a + 1);
a875087d 391 a->domain_and_port = mem;
4781064b
JM
392 os_memcpy(mem, host, host_len);
393 mem += host_len + 1;
a875087d 394 a->path = mem;
4781064b 395 if (path == NULL || path[0] != '/')
a875087d 396 *mem++ = '/';
4781064b
JM
397 if (path)
398 os_memcpy(mem, path, path_len);
a875087d
JL
399 os_memcpy(&a->saddr, rp->ai_addr, sizeof(a->saddr));
400 a->saddr.sin_port = htons(port);
401
4781064b 402 dl_list_add(&s->addr_list, &a->list);
a875087d
JL
403 }
404
405fail:
406 if (result)
407 freeaddrinfo(result);
408 os_free(scratch_mem);
a875087d
JL
409}
410
411
412/* subscr_addr_list_create -- create list from urls in string.
413 * Each url is enclosed by angle brackets.
414 */
415static void subscr_addr_list_create(struct subscription *s,
416 const char *url_list)
417{
4781064b
JM
418 const char *end;
419 wpa_printf(MSG_DEBUG, "WPS UPnP: Parsing URL list '%s'", url_list);
a875087d
JL
420 for (;;) {
421 while (*url_list == ' ' || *url_list == '\t')
422 url_list++;
423 if (*url_list != '<')
424 break;
425 url_list++;
426 end = os_strchr(url_list, '>');
427 if (end == NULL)
428 break;
4781064b
JM
429 subscr_addr_add_url(s, url_list, end - url_list);
430 url_list = end + 1;
a875087d 431 }
a875087d
JL
432}
433
434
435static void wpabuf_put_property(struct wpabuf *buf, const char *name,
436 const char *value)
437{
438 wpabuf_put_str(buf, "<e:property>");
439 wpabuf_printf(buf, "<%s>", name);
440 if (value)
441 wpabuf_put_str(buf, value);
442 wpabuf_printf(buf, "</%s>", name);
443 wpabuf_put_str(buf, "</e:property>\n");
444}
445
446
447/**
448 * upnp_wps_device_send_event - Queue event messages for subscribers
449 * @sm: WPS UPnP state machine from upnp_wps_device_init()
450 *
451 * This function queues the last WLANEvent to be sent for all currently
452 * subscribed UPnP control points. sm->wlanevent must have been set with the
453 * encoded data before calling this function.
454 */
455static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
456{
457 /* Enqueue event message for all subscribers */
458 struct wpabuf *buf; /* holds event message */
459 int buf_size = 0;
4781064b 460 struct subscription *s, *tmp;
a875087d
JL
461 /* Actually, utf-8 is the default, but it doesn't hurt to specify it */
462 const char *format_head =
463 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
464 "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
465 const char *format_tail = "</e:propertyset>\n";
4781064b 466 struct os_reltime now;
a875087d 467
4781064b 468 if (dl_list_empty(&sm->subscriptions)) {
a875087d
JL
469 /* optimize */
470 return;
471 }
472
4781064b
JM
473 if (os_get_reltime(&now) == 0) {
474 if (now.sec != sm->last_event_sec) {
475 sm->last_event_sec = now.sec;
476 sm->num_events_in_sec = 1;
477 } else {
478 sm->num_events_in_sec++;
479 /*
480 * In theory, this should apply to all WLANEvent
481 * notifications, but EAP messages are of much higher
482 * priority and Probe Request notifications should not
483 * be allowed to drop EAP messages, so only throttle
484 * Probe Request notifications.
485 */
486 if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC &&
487 sm->wlanevent_type ==
488 UPNP_WPS_WLANEVENT_TYPE_PROBE) {
489 wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle "
490 "event notifications (%u seen "
491 "during one second)",
492 sm->num_events_in_sec);
493 return;
494 }
495 }
496 }
497
a875087d
JL
498 /* Determine buffer size needed first */
499 buf_size += os_strlen(format_head);
500 buf_size += 50 + 2 * os_strlen("WLANEvent");
501 if (sm->wlanevent)
502 buf_size += os_strlen(sm->wlanevent);
503 buf_size += os_strlen(format_tail);
504
505 buf = wpabuf_alloc(buf_size);
506 if (buf == NULL)
507 return;
508 wpabuf_put_str(buf, format_head);
509 wpabuf_put_property(buf, "WLANEvent", sm->wlanevent);
510 wpabuf_put_str(buf, format_tail);
511
512 wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:\n%s",
513 (char *) wpabuf_head(buf));
514
4781064b
JM
515 dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
516 list) {
517 event_add(s, buf,
518 sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
519 }
a875087d
JL
520
521 wpabuf_free(buf);
522}
523
524
525/*
526 * Event subscription (subscriber machines register with us to receive event
527 * messages).
528 * This is the result of an incoming HTTP over TCP SUBSCRIBE request.
529 */
530
a875087d
JL
531/* subscription_destroy -- destroy an unlinked subscription
532 * Be sure to unlink first if necessary.
533 */
534void subscription_destroy(struct subscription *s)
535{
4781064b 536 struct upnp_wps_device_interface *iface;
a875087d 537 wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
4781064b 538 subscr_addr_free_all(s);
a875087d 539 event_delete_all(s);
4781064b
JM
540 dl_list_for_each(iface, &s->sm->interfaces,
541 struct upnp_wps_device_interface, list)
542 upnp_er_remove_notification(iface->wps->registrar, s);
a875087d
JL
543 os_free(s);
544}
545
546
547/* subscription_list_age -- remove expired subscriptions */
548static void subscription_list_age(struct upnp_wps_device_sm *sm, time_t now)
549{
4781064b
JM
550 struct subscription *s, *tmp;
551 dl_list_for_each_safe(s, tmp, &sm->subscriptions,
552 struct subscription, list) {
553 if (s->timeout_time > now)
554 break;
a875087d 555 wpa_printf(MSG_DEBUG, "WPS UPnP: Removing aged subscription");
4781064b 556 dl_list_del(&s->list);
a875087d
JL
557 subscription_destroy(s);
558 }
559}
560
561
562/* subscription_find -- return existing subscription matching uuid, if any
563 * returns NULL if not found
564 */
565struct subscription * subscription_find(struct upnp_wps_device_sm *sm,
566 const u8 uuid[UUID_LEN])
567{
4781064b
JM
568 struct subscription *s;
569 dl_list_for_each(s, &sm->subscriptions, struct subscription, list) {
a875087d
JL
570 if (os_memcmp(s->uuid, uuid, UUID_LEN) == 0)
571 return s; /* Found match */
4781064b 572 }
a875087d
JL
573 return NULL;
574}
575
576
577static struct wpabuf * build_fake_wsc_ack(void)
578{
579 struct wpabuf *msg = wpabuf_alloc(100);
580 if (msg == NULL)
581 return NULL;
582 wpabuf_put_u8(msg, UPNP_WPS_WLANEVENT_TYPE_EAP);
583 wpabuf_put_str(msg, "00:00:00:00:00:00");
4781064b
JM
584 if (wps_build_version(msg) ||
585 wps_build_msg_type(msg, WPS_WSC_ACK)) {
586 wpabuf_free(msg);
587 return NULL;
588 }
a875087d
JL
589 /* Enrollee Nonce */
590 wpabuf_put_be16(msg, ATTR_ENROLLEE_NONCE);
591 wpabuf_put_be16(msg, WPS_NONCE_LEN);
592 wpabuf_put(msg, WPS_NONCE_LEN);
593 /* Registrar Nonce */
594 wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE);
595 wpabuf_put_be16(msg, WPS_NONCE_LEN);
596 wpabuf_put(msg, WPS_NONCE_LEN);
4781064b 597 wps_build_wfa_ext(msg, 0, NULL, 0);
a875087d
JL
598 return msg;
599}
600
601
602/* subscription_first_event -- send format/queue event that is automatically
603 * sent on a new subscription.
604 */
605static int subscription_first_event(struct subscription *s)
606{
607 /*
608 * Actually, utf-8 is the default, but it doesn't hurt to specify it.
609 *
610 * APStatus is apparently a bit set,
611 * 0x1 = configuration change (but is always set?)
612 * 0x10 = ap is locked
613 *
614 * Per UPnP spec, we send out the last value of each variable, even
615 * for WLANEvent, whatever it was.
616 */
617 char *wlan_event;
618 struct wpabuf *buf;
619 int ap_status = 1; /* TODO: add 0x10 if access point is locked */
620 const char *head =
621 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
622 "<e:propertyset xmlns:e=\"urn:schemas-upnp-org:event-1-0\">\n";
623 const char *tail = "</e:propertyset>\n";
624 char txt[10];
4781064b 625 int ret;
a875087d
JL
626
627 if (s->sm->wlanevent == NULL) {
628 /*
629 * There has been no events before the subscription. However,
630 * UPnP device architecture specification requires all the
631 * evented variables to be included, so generate a dummy event
632 * for this particular case using a WSC_ACK and all-zeros
633 * nonces. The ER (UPnP control point) will ignore this, but at
634 * least it will learn that WLANEvent variable will be used in
635 * event notifications in the future.
636 */
637 struct wpabuf *msg;
638 wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the "
639 "initial WLANEvent");
640 msg = build_fake_wsc_ack();
641 if (msg) {
642 s->sm->wlanevent = (char *)
643 base64_encode(wpabuf_head(msg),
644 wpabuf_len(msg), NULL);
645 wpabuf_free(msg);
646 }
647 }
648
649 wlan_event = s->sm->wlanevent;
650 if (wlan_event == NULL || *wlan_event == '\0') {
651 wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for "
652 "initial event message");
653 wlan_event = "";
654 }
655 buf = wpabuf_alloc(500 + os_strlen(wlan_event));
656 if (buf == NULL)
4781064b 657 return -1;
a875087d
JL
658
659 wpabuf_put_str(buf, head);
660 wpabuf_put_property(buf, "STAStatus", "1");
661 os_snprintf(txt, sizeof(txt), "%d", ap_status);
662 wpabuf_put_property(buf, "APStatus", txt);
663 if (*wlan_event)
664 wpabuf_put_property(buf, "WLANEvent", wlan_event);
665 wpabuf_put_str(buf, tail);
666
4781064b
JM
667 ret = event_add(s, buf, 0);
668 if (ret) {
a875087d 669 wpabuf_free(buf);
4781064b 670 return ret;
a875087d
JL
671 }
672 wpabuf_free(buf);
673
674 return 0;
675}
676
677
678/**
679 * subscription_start - Remember a UPnP control point to send events to.
680 * @sm: WPS UPnP state machine from upnp_wps_device_init()
681 * @callback_urls: Callback URLs
682 * Returns: %NULL on error, or pointer to new subscription structure.
683 */
684struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
685 const char *callback_urls)
686{
687 struct subscription *s;
688 time_t now = time(NULL);
689 time_t expire = now + UPNP_SUBSCRIBE_SEC;
690
691 /* Get rid of expired subscriptions so we have room */
692 subscription_list_age(sm, now);
693
694 /* If too many subscriptions, remove oldest */
4781064b
JM
695 if (dl_list_len(&sm->subscriptions) >= MAX_SUBSCRIPTIONS) {
696 s = dl_list_first(&sm->subscriptions, struct subscription,
697 list);
a875087d
JL
698 wpa_printf(MSG_INFO, "WPS UPnP: Too many subscriptions, "
699 "trashing oldest");
4781064b 700 dl_list_del(&s->list);
a875087d
JL
701 subscription_destroy(s);
702 }
703
704 s = os_zalloc(sizeof(*s));
705 if (s == NULL)
706 return NULL;
4781064b
JM
707 dl_list_init(&s->addr_list);
708 dl_list_init(&s->event_queue);
a875087d
JL
709
710 s->sm = sm;
711 s->timeout_time = expire;
712 uuid_make(s->uuid);
713 subscr_addr_list_create(s, callback_urls);
4781064b
JM
714 if (dl_list_empty(&s->addr_list)) {
715 wpa_printf(MSG_DEBUG, "WPS UPnP: No valid callback URLs in "
716 "'%s' - drop subscription", callback_urls);
717 subscription_destroy(s);
718 return NULL;
719 }
720
a875087d 721 /* Add to end of list, since it has the highest expiration time */
4781064b 722 dl_list_add_tail(&sm->subscriptions, &s->list);
a875087d
JL
723 /* Queue up immediate event message (our last event)
724 * as required by UPnP spec.
725 */
726 if (subscription_first_event(s)) {
727 wpa_printf(MSG_INFO, "WPS UPnP: Dropping subscriber due to "
728 "event backlog");
4781064b 729 dl_list_del(&s->list);
a875087d
JL
730 subscription_destroy(s);
731 return NULL;
732 }
733 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p started with %s",
734 s, callback_urls);
735 /* Schedule sending this */
736 event_send_all_later(sm);
737 return s;
738}
739
740
741/* subscription_renew -- find subscription and reset timeout */
742struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
743 const u8 uuid[UUID_LEN])
744{
745 time_t now = time(NULL);
746 time_t expire = now + UPNP_SUBSCRIBE_SEC;
747 struct subscription *s = subscription_find(sm, uuid);
748 if (s == NULL)
749 return NULL;
750 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewed");
4781064b 751 dl_list_del(&s->list);
a875087d
JL
752 s->timeout_time = expire;
753 /* add back to end of list, since it now has highest expiry */
4781064b 754 dl_list_add_tail(&sm->subscriptions, &s->list);
a875087d
JL
755 return s;
756}
757
758
759/**
760 * upnp_wps_device_send_wlan_event - Event notification
761 * @sm: WPS UPnP state machine from upnp_wps_device_init()
762 * @from_mac_addr: Source (Enrollee) MAC address for the event
763 * @ev_type: Event type
764 * @msg: Event data
765 * Returns: 0 on success, -1 on failure
766 *
767 * Tell external Registrars (UPnP control points) that something happened. In
768 * particular, events include WPS messages from clients that are proxied to
769 * external Registrars.
770 */
771int upnp_wps_device_send_wlan_event(struct upnp_wps_device_sm *sm,
772 const u8 from_mac_addr[ETH_ALEN],
773 enum upnp_wps_wlanevent_type ev_type,
774 const struct wpabuf *msg)
775{
776 int ret = -1;
777 char type[2];
778 const u8 *mac = from_mac_addr;
779 char mac_text[18];
780 u8 *raw = NULL;
781 size_t raw_len;
782 char *val;
783 size_t val_len;
784 int pos = 0;
785
786 if (!sm)
787 goto fail;
788
789 os_snprintf(type, sizeof(type), "%1u", ev_type);
790
791 raw_len = 1 + 17 + (msg ? wpabuf_len(msg) : 0);
792 raw = os_zalloc(raw_len);
793 if (!raw)
794 goto fail;
795
796 *(raw + pos) = (u8) ev_type;
797 pos += 1;
798 os_snprintf(mac_text, sizeof(mac_text), MACSTR, MAC2STR(mac));
799 wpa_printf(MSG_DEBUG, "WPS UPnP: Proxying WLANEvent from %s",
800 mac_text);
801 os_memcpy(raw + pos, mac_text, 17);
802 pos += 17;
803 if (msg) {
804 os_memcpy(raw + pos, wpabuf_head(msg), wpabuf_len(msg));
805 pos += wpabuf_len(msg);
806 }
807 raw_len = pos;
808
809 val = (char *) base64_encode(raw, raw_len, &val_len);
810 if (val == NULL)
811 goto fail;
812
813 os_free(sm->wlanevent);
814 sm->wlanevent = val;
4781064b 815 sm->wlanevent_type = ev_type;
a875087d
JL
816 upnp_wps_device_send_event(sm);
817
818 ret = 0;
819
820fail:
821 os_free(raw);
822
823 return ret;
824}
825
826
b833bff7 827#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
a875087d
JL
828#include <sys/sysctl.h>
829#include <net/route.h>
830#include <net/if_dl.h>
831
832static int eth_get(const char *device, u8 ea[ETH_ALEN])
833{
834 struct if_msghdr *ifm;
835 struct sockaddr_dl *sdl;
836 u_char *p, *buf;
837 size_t len;
838 int mib[] = { CTL_NET, AF_ROUTE, 0, AF_LINK, NET_RT_IFLIST, 0 };
839
840 if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0)
841 return -1;
842 if ((buf = os_malloc(len)) == NULL)
843 return -1;
844 if (sysctl(mib, 6, buf, &len, NULL, 0) < 0) {
845 os_free(buf);
846 return -1;
847 }
848 for (p = buf; p < buf + len; p += ifm->ifm_msglen) {
849 ifm = (struct if_msghdr *)p;
850 sdl = (struct sockaddr_dl *)(ifm + 1);
851 if (ifm->ifm_type != RTM_IFINFO ||
852 (ifm->ifm_addrs & RTA_IFP) == 0)
853 continue;
854 if (sdl->sdl_family != AF_LINK || sdl->sdl_nlen == 0 ||
855 os_memcmp(sdl->sdl_data, device, sdl->sdl_nlen) != 0)
856 continue;
857 os_memcpy(ea, LLADDR(sdl), sdl->sdl_alen);
858 break;
859 }
860 os_free(buf);
861
862 if (p >= buf + len) {
863 errno = ESRCH;
864 return -1;
865 }
866 return 0;
867}
b833bff7 868#endif /* __FreeBSD__ || __DragonFly__ */
a875087d
JL
869
870
871/**
872 * get_netif_info - Get hw and IP addresses for network device
873 * @net_if: Selected network interface name
874 * @ip_addr: Buffer for returning IP address in network byte order
875 * @ip_addr_text: Buffer for returning a pointer to allocated IP address text
876 * @mac: Buffer for returning MAC address
a875087d
JL
877 * Returns: 0 on success, -1 on failure
878 */
4781064b
JM
879int get_netif_info(const char *net_if, unsigned *ip_addr, char **ip_addr_text,
880 u8 mac[ETH_ALEN])
a875087d
JL
881{
882 struct ifreq req;
883 int sock = -1;
884 struct sockaddr_in *addr;
885 struct in_addr in_addr;
886
887 *ip_addr_text = os_zalloc(16);
4781064b 888 if (*ip_addr_text == NULL)
a875087d
JL
889 goto fail;
890
891 sock = socket(AF_INET, SOCK_DGRAM, 0);
892 if (sock < 0)
893 goto fail;
894
895 os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
896 if (ioctl(sock, SIOCGIFADDR, &req) < 0) {
897 wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFADDR failed: %d (%s)",
898 errno, strerror(errno));
899 goto fail;
900 }
901 addr = (void *) &req.ifr_addr;
902 *ip_addr = addr->sin_addr.s_addr;
903 in_addr.s_addr = *ip_addr;
904 os_snprintf(*ip_addr_text, 16, "%s", inet_ntoa(in_addr));
905
906#ifdef __linux__
907 os_strlcpy(req.ifr_name, net_if, sizeof(req.ifr_name));
908 if (ioctl(sock, SIOCGIFHWADDR, &req) < 0) {
909 wpa_printf(MSG_ERROR, "WPS UPnP: SIOCGIFHWADDR failed: "
910 "%d (%s)", errno, strerror(errno));
911 goto fail;
912 }
913 os_memcpy(mac, req.ifr_addr.sa_data, 6);
b833bff7 914#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
a875087d
JL
915 if (eth_get(net_if, mac) < 0) {
916 wpa_printf(MSG_ERROR, "WPS UPnP: Failed to get MAC address");
917 goto fail;
918 }
919#else
920#error MAC address fetch not implemented
921#endif
a875087d
JL
922
923 close(sock);
924 return 0;
925
926fail:
927 if (sock >= 0)
928 close(sock);
929 os_free(*ip_addr_text);
930 *ip_addr_text = NULL;
a875087d
JL
931 return -1;
932}
933
934
4781064b
JM
935static void upnp_wps_free_msearchreply(struct dl_list *head)
936{
937 struct advertisement_state_machine *a, *tmp;
938 dl_list_for_each_safe(a, tmp, head, struct advertisement_state_machine,
939 list)
940 msearchreply_state_machine_stop(a);
941}
942
943
944static void upnp_wps_free_subscriptions(struct dl_list *head,
945 struct wps_registrar *reg)
946{
947 struct subscription *s, *tmp;
948 dl_list_for_each_safe(s, tmp, head, struct subscription, list) {
949 if (reg && s->reg != reg)
950 continue;
951 dl_list_del(&s->list);
952 subscription_destroy(s);
953 }
954}
955
956
a875087d
JL
957/**
958 * upnp_wps_device_stop - Stop WPS UPnP operations on an interface
959 * @sm: WPS UPnP state machine from upnp_wps_device_init()
960 */
4781064b 961static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
a875087d
JL
962{
963 if (!sm || !sm->started)
964 return;
965
966 wpa_printf(MSG_DEBUG, "WPS UPnP: Stop device");
967 web_listener_stop(sm);
4781064b
JM
968 ssdp_listener_stop(sm);
969 upnp_wps_free_msearchreply(&sm->msearch_replies);
970 upnp_wps_free_subscriptions(&sm->subscriptions, NULL);
a875087d
JL
971
972 advertisement_state_machine_stop(sm, 1);
973
974 event_send_stop_all(sm);
975 os_free(sm->wlanevent);
976 sm->wlanevent = NULL;
a875087d
JL
977 os_free(sm->ip_addr_text);
978 sm->ip_addr_text = NULL;
979 if (sm->multicast_sd >= 0)
980 close(sm->multicast_sd);
981 sm->multicast_sd = -1;
a875087d
JL
982
983 sm->started = 0;
984}
985
986
987/**
988 * upnp_wps_device_start - Start WPS UPnP operations on an interface
989 * @sm: WPS UPnP state machine from upnp_wps_device_init()
990 * @net_if: Selected network interface name
991 * Returns: 0 on success, -1 on failure
992 */
4781064b 993static int upnp_wps_device_start(struct upnp_wps_device_sm *sm, char *net_if)
a875087d
JL
994{
995 if (!sm || !net_if)
996 return -1;
997
998 if (sm->started)
999 upnp_wps_device_stop(sm);
1000
a875087d
JL
1001 sm->multicast_sd = -1;
1002 sm->ssdp_sd = -1;
1003 sm->started = 1;
1004 sm->advertise_count = 0;
1005
1006 /* Fix up linux multicast handling */
1007 if (add_ssdp_network(net_if))
1008 goto fail;
1009
1010 /* Determine which IP and mac address we're using */
4781064b
JM
1011 if (get_netif_info(net_if, &sm->ip_addr, &sm->ip_addr_text,
1012 sm->mac_addr)) {
a875087d
JL
1013 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1014 "for %s. Does it have IP address?", net_if);
1015 goto fail;
1016 }
1017
1018 /* Listen for incoming TCP connections so that others
1019 * can fetch our "xml files" from us.
1020 */
1021 if (web_listener_start(sm))
1022 goto fail;
1023
1024 /* Set up for receiving discovery (UDP) packets */
1025 if (ssdp_listener_start(sm))
1026 goto fail;
1027
1028 /* Set up for sending multicast */
1029 if (ssdp_open_multicast(sm) < 0)
1030 goto fail;
1031
1032 /*
1033 * Broadcast NOTIFY messages to let the world know we exist.
1034 * This is done via a state machine since the messages should not be
1035 * all sent out at once.
1036 */
1037 if (advertisement_state_machine_start(sm))
1038 goto fail;
1039
1040 return 0;
1041
1042fail:
1043 upnp_wps_device_stop(sm);
1044 return -1;
1045}
1046
1047
4781064b
JM
1048static struct upnp_wps_device_interface *
1049upnp_wps_get_iface(struct upnp_wps_device_sm *sm, void *priv)
1050{
1051 struct upnp_wps_device_interface *iface;
1052 dl_list_for_each(iface, &sm->interfaces,
1053 struct upnp_wps_device_interface, list) {
1054 if (iface->priv == priv)
1055 return iface;
1056 }
1057 return NULL;
1058}
1059
1060
a875087d
JL
1061/**
1062 * upnp_wps_device_deinit - Deinitialize WPS UPnP
1063 * @sm: WPS UPnP state machine from upnp_wps_device_init()
4781064b 1064 * @priv: External context data that was used in upnp_wps_device_init() call
a875087d 1065 */
4781064b 1066void upnp_wps_device_deinit(struct upnp_wps_device_sm *sm, void *priv)
a875087d 1067{
4781064b
JM
1068 struct upnp_wps_device_interface *iface;
1069
a875087d
JL
1070 if (!sm)
1071 return;
1072
4781064b
JM
1073 iface = upnp_wps_get_iface(sm, priv);
1074 if (iface == NULL) {
1075 wpa_printf(MSG_ERROR, "WPS UPnP: Could not find the interface "
1076 "instance to deinit");
1077 return;
1078 }
1079 wpa_printf(MSG_DEBUG, "WPS UPnP: Deinit interface instance %p", iface);
1080 if (dl_list_len(&sm->interfaces) == 1) {
1081 wpa_printf(MSG_DEBUG, "WPS UPnP: Deinitializing last instance "
1082 "- free global device instance");
1083 upnp_wps_device_stop(sm);
1084 } else
1085 upnp_wps_free_subscriptions(&sm->subscriptions,
1086 iface->wps->registrar);
1087 dl_list_del(&iface->list);
1088
1089 if (iface->peer.wps)
1090 wps_deinit(iface->peer.wps);
1091 os_free(iface->ctx->ap_pin);
1092 os_free(iface->ctx);
1093 os_free(iface);
1094
1095 if (dl_list_empty(&sm->interfaces)) {
1096 os_free(sm->root_dir);
1097 os_free(sm->desc_url);
1098 os_free(sm);
1099 shared_upnp_device = NULL;
1100 }
a875087d
JL
1101}
1102
1103
1104/**
1105 * upnp_wps_device_init - Initialize WPS UPnP
1106 * @ctx: callback table; we must eventually free it
1107 * @wps: Pointer to longterm WPS context
1108 * @priv: External context data that will be used in callbacks
4781064b 1109 * @net_if: Selected network interface name
a875087d
JL
1110 * Returns: WPS UPnP state or %NULL on failure
1111 */
1112struct upnp_wps_device_sm *
1113upnp_wps_device_init(struct upnp_wps_device_ctx *ctx, struct wps_context *wps,
4781064b 1114 void *priv, char *net_if)
a875087d
JL
1115{
1116 struct upnp_wps_device_sm *sm;
4781064b
JM
1117 struct upnp_wps_device_interface *iface;
1118 int start = 0;
a875087d 1119
4781064b
JM
1120 iface = os_zalloc(sizeof(*iface));
1121 if (iface == NULL) {
1122 os_free(ctx->ap_pin);
1123 os_free(ctx);
1124 return NULL;
1125 }
1126 wpa_printf(MSG_DEBUG, "WPS UPnP: Init interface instance %p", iface);
1127
1128 iface->ctx = ctx;
1129 iface->wps = wps;
1130 iface->priv = priv;
1131
1132 if (shared_upnp_device) {
1133 wpa_printf(MSG_DEBUG, "WPS UPnP: Share existing device "
1134 "context");
1135 sm = shared_upnp_device;
1136 } else {
1137 wpa_printf(MSG_DEBUG, "WPS UPnP: Initialize device context");
1138 sm = os_zalloc(sizeof(*sm));
1139 if (!sm) {
1140 wpa_printf(MSG_ERROR, "WPS UPnP: upnp_wps_device_init "
1141 "failed");
1142 os_free(iface);
1143 os_free(ctx->ap_pin);
1144 os_free(ctx);
1145 return NULL;
1146 }
1147 shared_upnp_device = sm;
1148
1149 dl_list_init(&sm->msearch_replies);
1150 dl_list_init(&sm->subscriptions);
1151 dl_list_init(&sm->interfaces);
1152 start = 1;
1153 }
1154
1155 dl_list_add(&sm->interfaces, &iface->list);
1156
1157 if (start && upnp_wps_device_start(sm, net_if)) {
1158 upnp_wps_device_deinit(sm, priv);
a875087d
JL
1159 return NULL;
1160 }
1161
a875087d
JL
1162
1163 return sm;
1164}
1165
1166
1167/**
1168 * upnp_wps_subscribers - Check whether there are any event subscribers
1169 * @sm: WPS UPnP state machine from upnp_wps_device_init()
1170 * Returns: 0 if no subscribers, 1 if subscribers
1171 */
1172int upnp_wps_subscribers(struct upnp_wps_device_sm *sm)
1173{
4781064b
JM
1174 return !dl_list_empty(&sm->subscriptions);
1175}
1176
1177
1178int upnp_wps_set_ap_pin(struct upnp_wps_device_sm *sm, const char *ap_pin)
1179{
1180 struct upnp_wps_device_interface *iface;
1181 if (sm == NULL)
1182 return 0;
1183
1184 dl_list_for_each(iface, &sm->interfaces,
1185 struct upnp_wps_device_interface, list) {
1186 os_free(iface->ctx->ap_pin);
1187 if (ap_pin) {
1188 iface->ctx->ap_pin = os_strdup(ap_pin);
1189 if (iface->ctx->ap_pin == NULL)
1190 return -1;
1191 } else
1192 iface->ctx->ap_pin = NULL;
1193 }
1194
1195 return 0;
a875087d 1196}