contrib/hostapd/src/wps/wps_er.c

   1 /*
   2  * Wi-Fi Protected Setup - External Registrar
   3  * Copyright (c) 2009-2013, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "base64.h"
  13 #include "uuid.h"
  14 #include "eloop.h"
  15 #include "httpread.h"
  16 #include "http_client.h"
  17 #include "http_server.h"
  18 #include "upnp_xml.h"
  19 #include "wps_i.h"
  20 #include "wps_upnp.h"
  21 #include "wps_upnp_i.h"
  22 #include "wps_er.h"
  23
  24
  25 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx);
  26 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx);
  27 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx);
  28 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg);
  29 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
  30                                        void (*m1_handler)(struct wps_er_ap *ap,
  31                                                           struct wpabuf *m1));
  32
  33
  34 static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta,
  35                              enum wps_event event)
  36 {
  37         union wps_event_data data;
  38         struct wps_event_er_enrollee *ev = &data.enrollee;
  39
  40         if (wps->event_cb == NULL)
  41                 return;
  42
  43         os_memset(&data, 0, sizeof(data));
  44         ev->uuid = sta->uuid;
  45         ev->mac_addr = sta->addr;
  46         ev->m1_received = sta->m1_received;
  47         ev->config_methods = sta->config_methods;
  48         ev->dev_passwd_id = sta->dev_passwd_id;
  49         ev->pri_dev_type = sta->pri_dev_type;
  50         ev->dev_name = sta->dev_name;
  51         ev->manufacturer = sta->manufacturer;
  52         ev->model_name = sta->model_name;
  53         ev->model_number = sta->model_number;
  54         ev->serial_number = sta->serial_number;
  55         wps->event_cb(wps->cb_ctx, event, &data);
  56 }
  57
  58
  59 static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr,
  60                                           const u8 *uuid)
  61 {
  62         struct wps_er_sta *sta;
  63         dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) {
  64                 if ((addr == NULL ||
  65                      os_memcmp(sta->addr, addr, ETH_ALEN) == 0) &&
  66                     (uuid == NULL ||
  67                      os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0))
  68                         return sta;
  69         }
  70         return NULL;
  71 }
  72
  73
  74 static void wps_er_sta_free(struct wps_er_sta *sta)
  75 {
  76         wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE);
  77         if (sta->wps)
  78                 wps_deinit(sta->wps);
  79         os_free(sta->manufacturer);
  80         os_free(sta->model_name);
  81         os_free(sta->model_number);
  82         os_free(sta->serial_number);
  83         os_free(sta->dev_name);
  84         http_client_free(sta->http);
  85         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
  86         os_free(sta->cred);
  87         os_free(sta);
  88 }
  89
  90
  91 static void wps_er_sta_remove_all(struct wps_er_ap *ap)
  92 {
  93         struct wps_er_sta *prev, *sta;
  94         dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list)
  95                 wps_er_sta_free(sta);
  96 }
  97
  98
  99 static struct wps_er_ap * wps_er_ap_get(struct wps_er *er,
 100                                         struct in_addr *addr, const u8 *uuid,
 101                                         const u8 *mac_addr)
 102 {
 103         struct wps_er_ap *ap;
 104         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 105                 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) &&
 106                     (uuid == NULL ||
 107                      os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0) &&
 108                     (mac_addr == NULL ||
 109                      os_memcmp(mac_addr, ap->mac_addr, ETH_ALEN) == 0))
 110                         return ap;
 111         }
 112         return NULL;
 113 }
 114
 115
 116 static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id)
 117 {
 118         struct wps_er_ap *ap;
 119         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 120                 if (ap->id == id)
 121                         return ap;
 122         }
 123         return NULL;
 124 }
 125
 126
 127 static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap,
 128                             enum wps_event event)
 129 {
 130         union wps_event_data data;
 131         struct wps_event_er_ap *evap = &data.ap;
 132
 133         if (wps->event_cb == NULL)
 134                 return;
 135
 136         os_memset(&data, 0, sizeof(data));
 137         evap->uuid = ap->uuid;
 138         evap->friendly_name = ap->friendly_name;
 139         evap->manufacturer = ap->manufacturer;
 140         evap->manufacturer_url = ap->manufacturer_url;
 141         evap->model_description = ap->model_description;
 142         evap->model_name = ap->model_name;
 143         evap->model_number = ap->model_number;
 144         evap->model_url = ap->model_url;
 145         evap->serial_number = ap->serial_number;
 146         evap->upc = ap->upc;
 147         evap->pri_dev_type = ap->pri_dev_type;
 148         evap->wps_state = ap->wps_state;
 149         evap->mac_addr = ap->mac_addr;
 150         wps->event_cb(wps->cb_ctx, event, &data);
 151 }
 152
 153
 154 static void wps_er_ap_free(struct wps_er_ap *ap)
 155 {
 156         http_client_free(ap->http);
 157         ap->http = NULL;
 158
 159         os_free(ap->location);
 160         os_free(ap->friendly_name);
 161         os_free(ap->manufacturer);
 162         os_free(ap->manufacturer_url);
 163         os_free(ap->model_description);
 164         os_free(ap->model_name);
 165         os_free(ap->model_number);
 166         os_free(ap->model_url);
 167         os_free(ap->serial_number);
 168         os_free(ap->udn);
 169         os_free(ap->upc);
 170
 171         os_free(ap->scpd_url);
 172         os_free(ap->control_url);
 173         os_free(ap->event_sub_url);
 174
 175         os_free(ap->ap_settings);
 176
 177         os_free(ap);
 178 }
 179
 180
 181 static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap)
 182 {
 183         wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)",
 184                    inet_ntoa(ap->addr), ap->location);
 185         dl_list_del(&ap->list);
 186         wps_er_ap_free(ap);
 187
 188         if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing))
 189                 wps_er_deinit_finish(er, NULL);
 190 }
 191
 192
 193 static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c,
 194                                        enum http_client_event event)
 195 {
 196         struct wps_er_ap *ap = ctx;
 197
 198         switch (event) {
 199         case HTTP_CLIENT_OK:
 200                 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events");
 201                 ap->subscribed = 0;
 202                 break;
 203         case HTTP_CLIENT_FAILED:
 204         case HTTP_CLIENT_INVALID_REPLY:
 205         case HTTP_CLIENT_TIMEOUT:
 206                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from "
 207                            "events");
 208                 break;
 209         }
 210         http_client_free(ap->http);
 211         ap->http = NULL;
 212
 213         /*
 214          * Need to get rid of the AP entry regardless of whether we managed to
 215          * unsubscribe cleanly or not.
 216          */
 217         wps_er_ap_unsubscribed(ap->er, ap);
 218 }
 219
 220
 221 static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap)
 222 {
 223         struct wpabuf *req;
 224         struct sockaddr_in dst;
 225         char *url, *path;
 226         char sid[100];
 227
 228         if (ap->event_sub_url == NULL) {
 229                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 230                            "subscribe");
 231                 goto fail;
 232         }
 233         if (ap->http) {
 234                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 235                            "send subscribe request");
 236                 goto fail;
 237         }
 238
 239         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 240         if (url == NULL) {
 241                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 242                 goto fail;
 243         }
 244
 245         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 246         if (req == NULL) {
 247                 os_free(url);
 248                 goto fail;
 249         }
 250         uuid_bin2str(ap->sid, sid, sizeof(sid));
 251         wpabuf_printf(req,
 252                       "UNSUBSCRIBE %s HTTP/1.1\r\n"
 253                       "HOST: %s:%d\r\n"
 254                       "SID: uuid:%s\r\n"
 255                       "\r\n",
 256                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid);
 257         os_free(url);
 258         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request",
 259                           wpabuf_head(req), wpabuf_len(req));
 260
 261         ap->http = http_client_addr(&dst, req, 1000,
 262                                     wps_er_http_unsubscribe_cb, ap);
 263         if (ap->http == NULL) {
 264                 wpabuf_free(req);
 265                 goto fail;
 266         }
 267         return;
 268
 269 fail:
 270         /*
 271          * Need to get rid of the AP entry even when we fail to unsubscribe
 272          * cleanly.
 273          */
 274         wps_er_ap_unsubscribed(ap->er, ap);
 275 }
 276
 277
 278 static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er,
 279                                                           const u8 *uuid)
 280 {
 281         struct wps_er_ap_settings *s;
 282         dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list)
 283                 if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0)
 284                         return s;
 285         return NULL;
 286 }
 287
 288
 289 int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr)
 290 {
 291         struct wps_er_ap *ap;
 292         struct wps_er_ap_settings *settings;
 293
 294         ap = wps_er_ap_get(er, addr, NULL, NULL);
 295         if (ap == NULL || ap->ap_settings == NULL)
 296                 return -1;
 297
 298         settings = wps_er_ap_get_settings(er, ap->uuid);
 299         if (!settings) {
 300                 settings = os_zalloc(sizeof(*settings));
 301                 if (settings == NULL)
 302                         return -1;
 303                 os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN);
 304                 dl_list_add(&er->ap_settings, &settings->list);
 305         }
 306         os_memcpy(&settings->ap_settings, ap->ap_settings,
 307                   sizeof(struct wps_credential));
 308
 309         return 0;
 310 }
 311
 312
 313 static int wps_er_ap_use_cached_settings(struct wps_er *er,
 314                                          struct wps_er_ap *ap)
 315 {
 316         struct wps_er_ap_settings *s;
 317
 318         if (ap->ap_settings)
 319                 return 0;
 320
 321         s = wps_er_ap_get_settings(ap->er, ap->uuid);
 322         if (!s)
 323                 return -1;
 324
 325         ap->ap_settings = os_malloc(sizeof(*ap->ap_settings));
 326         if (ap->ap_settings == NULL)
 327                 return -1;
 328
 329         os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings));
 330         wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings");
 331         return 0;
 332 }
 333
 334
 335 static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap)
 336 {
 337         wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)",
 338                    inet_ntoa(ap->addr), ap->location);
 339         eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 340         wps_er_sta_remove_all(ap);
 341         wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE);
 342         http_client_free(ap->http);
 343         ap->http = NULL;
 344         if (ap->wps) {
 345                 wps_deinit(ap->wps);
 346                 ap->wps = NULL;
 347         }
 348
 349         dl_list_del(&ap->list);
 350         if (ap->subscribed) {
 351                 dl_list_add(&er->ap_unsubscribing, &ap->list);
 352                 wps_er_ap_unsubscribe(er, ap);
 353         } else
 354                 wps_er_ap_free(ap);
 355 }
 356
 357
 358 static void wps_er_ap_timeout(void *eloop_data, void *user_ctx)
 359 {
 360         struct wps_er *er = eloop_data;
 361         struct wps_er_ap *ap = user_ctx;
 362         wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out");
 363         wps_er_ap_remove_entry(er, ap);
 364 }
 365
 366
 367 static int wps_er_get_sid(struct wps_er_ap *ap, char *sid)
 368 {
 369         char *pos;
 370         char txt[100];
 371
 372         if (!sid) {
 373                 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)",
 374                            inet_ntoa(ap->addr), ap->location);
 375                 return -1;
 376         }
 377
 378         pos = os_strstr(sid, "uuid:");
 379         if (!pos) {
 380                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
 381                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
 382                            sid);
 383                 return -1;
 384         }
 385
 386         pos += 5;
 387         if (uuid_str2bin(pos, ap->sid) < 0) {
 388                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from "
 389                            "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location,
 390                            sid);
 391                 return -1;
 392         }
 393
 394         uuid_bin2str(ap->sid, txt, sizeof(txt));
 395         wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s",
 396                    inet_ntoa(ap->addr), ap->location, txt);
 397
 398         return 0;
 399 }
 400
 401
 402 static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c,
 403                                      enum http_client_event event)
 404 {
 405         struct wps_er_ap *ap = ctx;
 406
 407         switch (event) {
 408         case HTTP_CLIENT_OK:
 409                 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events");
 410                 ap->subscribed = 1;
 411                 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID"));
 412                 wps_er_ap_use_cached_settings(ap->er, ap);
 413                 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD);
 414                 break;
 415         case HTTP_CLIENT_FAILED:
 416         case HTTP_CLIENT_INVALID_REPLY:
 417         case HTTP_CLIENT_TIMEOUT:
 418                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events");
 419                 break;
 420         }
 421         http_client_free(ap->http);
 422         ap->http = NULL;
 423 }
 424
 425
 426 static void wps_er_subscribe(struct wps_er_ap *ap)
 427 {
 428         struct wpabuf *req;
 429         struct sockaddr_in dst;
 430         char *url, *path;
 431
 432         if (ap->event_sub_url == NULL) {
 433                 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot "
 434                            "subscribe");
 435                 return;
 436         }
 437         if (ap->http) {
 438                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot "
 439                            "send subscribe request");
 440                 return;
 441         }
 442
 443         url = http_client_url_parse(ap->event_sub_url, &dst, &path);
 444         if (url == NULL) {
 445                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL");
 446                 return;
 447         }
 448
 449         req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000);
 450         if (req == NULL) {
 451                 os_free(url);
 452                 return;
 453         }
 454         wpabuf_printf(req,
 455                       "SUBSCRIBE %s HTTP/1.1\r\n"
 456                       "HOST: %s:%d\r\n"
 457                       "CALLBACK: <http://%s:%d/event/%u/%u>\r\n"
 458                       "NT: upnp:event\r\n"
 459                       "TIMEOUT: Second-%d\r\n"
 460                       "\r\n",
 461                       path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port),
 462                       ap->er->ip_addr_text, ap->er->http_port,
 463                       ap->er->event_id, ap->id, 1800);
 464         os_free(url);
 465         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request",
 466                           wpabuf_head(req), wpabuf_len(req));
 467
 468         ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb,
 469                                     ap);
 470         if (ap->http == NULL)
 471                 wpabuf_free(req);
 472 }
 473
 474
 475 static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1)
 476 {
 477         struct wps_parse_attr attr;
 478
 479         if (wps_parse_msg(m1, &attr) < 0) {
 480                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1");
 481                 return;
 482         }
 483         if (attr.primary_dev_type)
 484                 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8);
 485         if (attr.wps_state)
 486                 ap->wps_state = *attr.wps_state;
 487         if (attr.mac_addr)
 488                 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN);
 489
 490         wps_er_subscribe(ap);
 491 }
 492
 493
 494 static void wps_er_get_device_info(struct wps_er_ap *ap)
 495 {
 496         wps_er_send_get_device_info(ap, wps_er_ap_get_m1);
 497 }
 498
 499
 500 static const char * wps_er_find_wfadevice(const char *data)
 501 {
 502         const char *tag, *tagname, *end;
 503         char *val;
 504         int found = 0;
 505
 506         while (!found) {
 507                 /* Find next <device> */
 508                 for (;;) {
 509                         if (xml_next_tag(data, &tag, &tagname, &end))
 510                                 return NULL;
 511                         data = end;
 512                         if (!os_strncasecmp(tagname, "device", 6) &&
 513                             *tag != '/' &&
 514                             (tagname[6] == '>' || !isgraph(tagname[6]))) {
 515                                 break;
 516                         }
 517                 }
 518
 519                 /* Check whether deviceType is WFADevice */
 520                 val = xml_get_first_item(data, "deviceType");
 521                 if (val == NULL)
 522                         return NULL;
 523                 wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val);
 524                 found = os_strcasecmp(val, "urn:schemas-wifialliance-org:"
 525                                       "device:WFADevice:1") == 0;
 526                 os_free(val);
 527         }
 528
 529         return data;
 530 }
 531
 532
 533 static void wps_er_parse_device_description(struct wps_er_ap *ap,
 534                                             struct wpabuf *reply)
 535 {
 536         /* Note: reply includes null termination after the buffer data */
 537         const char *tmp, *data = wpabuf_head(reply);
 538         char *pos;
 539
 540         wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info",
 541                           wpabuf_head(reply), wpabuf_len(reply));
 542
 543         /*
 544          * The root device description may include multiple devices, so first
 545          * find the beginning of the WFADevice description to allow the
 546          * simplistic parser to pick the correct entries.
 547          */
 548         tmp = wps_er_find_wfadevice(data);
 549         if (tmp == NULL) {
 550                 wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - "
 551                            "trying to parse invalid data");
 552         } else
 553                 data = tmp;
 554
 555         ap->friendly_name = xml_get_first_item(data, "friendlyName");
 556         wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name);
 557
 558         ap->manufacturer = xml_get_first_item(data, "manufacturer");
 559         wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer);
 560
 561         ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL");
 562         wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'",
 563                    ap->manufacturer_url);
 564
 565         ap->model_description = xml_get_first_item(data, "modelDescription");
 566         wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'",
 567                    ap->model_description);
 568
 569         ap->model_name = xml_get_first_item(data, "modelName");
 570         wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name);
 571
 572         ap->model_number = xml_get_first_item(data, "modelNumber");
 573         wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number);
 574
 575         ap->model_url = xml_get_first_item(data, "modelURL");
 576         wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url);
 577
 578         ap->serial_number = xml_get_first_item(data, "serialNumber");
 579         wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number);
 580
 581         ap->udn = xml_get_first_item(data, "UDN");
 582         wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn);
 583         pos = os_strstr(ap->udn, "uuid:");
 584         if (pos) {
 585                 pos += 5;
 586                 if (uuid_str2bin(pos, ap->uuid) < 0)
 587                         wpa_printf(MSG_DEBUG, "WPS ER: Invalid UUID in UDN");
 588         }
 589
 590         ap->upc = xml_get_first_item(data, "UPC");
 591         wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc);
 592
 593         ap->scpd_url = http_link_update(
 594                 xml_get_first_item(data, "SCPDURL"), ap->location);
 595         wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url);
 596
 597         ap->control_url = http_link_update(
 598                 xml_get_first_item(data, "controlURL"), ap->location);
 599         wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url);
 600
 601         ap->event_sub_url = http_link_update(
 602                 xml_get_first_item(data, "eventSubURL"), ap->location);
 603         wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url);
 604 }
 605
 606
 607 static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c,
 608                                     enum http_client_event event)
 609 {
 610         struct wps_er_ap *ap = ctx;
 611         struct wpabuf *reply;
 612         int ok = 0;
 613
 614         switch (event) {
 615         case HTTP_CLIENT_OK:
 616                 reply = http_client_get_body(c);
 617                 if (reply == NULL)
 618                         break;
 619                 wps_er_parse_device_description(ap, reply);
 620                 ok = 1;
 621                 break;
 622         case HTTP_CLIENT_FAILED:
 623         case HTTP_CLIENT_INVALID_REPLY:
 624         case HTTP_CLIENT_TIMEOUT:
 625                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info");
 626                 break;
 627         }
 628         http_client_free(ap->http);
 629         ap->http = NULL;
 630         if (ok)
 631                 wps_er_get_device_info(ap);
 632 }
 633
 634
 635 void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr,
 636                    const char *location, int max_age)
 637 {
 638         struct wps_er_ap *ap;
 639
 640         ap = wps_er_ap_get(er, addr, uuid, NULL);
 641         if (ap) {
 642                 /* Update advertisement timeout */
 643                 eloop_cancel_timeout(wps_er_ap_timeout, er, ap);
 644                 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 645                 return;
 646         }
 647
 648         ap = os_zalloc(sizeof(*ap));
 649         if (ap == NULL)
 650                 return;
 651         dl_list_init(&ap->sta);
 652         ap->er = er;
 653         ap->id = ++er->next_ap_id;
 654         ap->location = os_strdup(location);
 655         if (ap->location == NULL) {
 656                 os_free(ap);
 657                 return;
 658         }
 659         dl_list_add(&er->ap, &ap->list);
 660
 661         ap->addr.s_addr = addr->s_addr;
 662         os_memcpy(ap->uuid, uuid, WPS_UUID_LEN);
 663         eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap);
 664
 665         wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)",
 666                    inet_ntoa(ap->addr), ap->location);
 667
 668         /* Fetch device description */
 669         ap->http = http_client_url(ap->location, NULL, 10000,
 670                                    wps_er_http_dev_desc_cb, ap);
 671 }
 672
 673
 674 void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr)
 675 {
 676         struct wps_er_ap *ap;
 677         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
 678                 if (ap->addr.s_addr == addr->s_addr) {
 679                         wps_er_ap_remove_entry(er, ap);
 680                         return;
 681                 }
 682         }
 683 }
 684
 685
 686 static void wps_er_ap_remove_all(struct wps_er *er)
 687 {
 688         struct wps_er_ap *prev, *ap;
 689         struct wps_er_ap_settings *prev_s, *s;
 690         dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list)
 691                 wps_er_ap_remove_entry(er, ap);
 692         dl_list_for_each_safe(s, prev_s, &er->ap_settings,
 693                               struct wps_er_ap_settings, list)
 694                 os_free(s);
 695 }
 696
 697
 698 static void http_put_date(struct wpabuf *buf)
 699 {
 700         wpabuf_put_str(buf, "Date: ");
 701         format_date(buf);
 702         wpabuf_put_str(buf, "\r\n");
 703 }
 704
 705
 706 static void wps_er_http_resp_not_found(struct http_request *req)
 707 {
 708         struct wpabuf *buf;
 709         buf = wpabuf_alloc(200);
 710         if (buf == NULL) {
 711                 http_request_deinit(req);
 712                 return;
 713         }
 714
 715         wpabuf_put_str(buf,
 716                        "HTTP/1.1 404 Not Found\r\n"
 717                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 718                        "Connection: close\r\n");
 719         http_put_date(buf);
 720         wpabuf_put_str(buf, "\r\n");
 721         http_request_send_and_deinit(req, buf);
 722 }
 723
 724
 725 static void wps_er_http_resp_ok(struct http_request *req)
 726 {
 727         struct wpabuf *buf;
 728         buf = wpabuf_alloc(200);
 729         if (buf == NULL) {
 730                 http_request_deinit(req);
 731                 return;
 732         }
 733
 734         wpabuf_put_str(buf,
 735                        "HTTP/1.1 200 OK\r\n"
 736                        "Server: unspecified, UPnP/1.0, unspecified\r\n"
 737                        "Connection: close\r\n"
 738                        "Content-Length: 0\r\n");
 739         http_put_date(buf);
 740         wpabuf_put_str(buf, "\r\n");
 741         http_request_send_and_deinit(req, buf);
 742 }
 743
 744
 745 static void wps_er_sta_timeout(void *eloop_data, void *user_ctx)
 746 {
 747         struct wps_er_sta *sta = eloop_data;
 748         wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out");
 749         dl_list_del(&sta->list);
 750         wps_er_sta_free(sta);
 751 }
 752
 753
 754 static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap,
 755                                                const u8 *addr,
 756                                                struct wps_parse_attr *attr,
 757                                                int probe_req)
 758 {
 759         struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL);
 760         int new_sta = 0;
 761         int m1;
 762
 763         m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1;
 764
 765         if (sta == NULL) {
 766                 /*
 767                  * Only allow new STA entry to be added based on Probe Request
 768                  * or M1. This will filter out bogus events and anything that
 769                  * may have been ongoing at the time ER subscribed for events.
 770                  */
 771                 if (!probe_req && !m1)
 772                         return NULL;
 773
 774                 sta = os_zalloc(sizeof(*sta));
 775                 if (sta == NULL)
 776                         return NULL;
 777                 os_memcpy(sta->addr, addr, ETH_ALEN);
 778                 sta->ap = ap;
 779                 dl_list_add(&ap->sta, &sta->list);
 780                 new_sta = 1;
 781         }
 782
 783         if (m1)
 784                 sta->m1_received = 1;
 785
 786         if (attr->config_methods && (!probe_req || !sta->m1_received))
 787                 sta->config_methods = WPA_GET_BE16(attr->config_methods);
 788         if (attr->uuid_e && (!probe_req || !sta->m1_received))
 789                 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN);
 790         if (attr->primary_dev_type && (!probe_req || !sta->m1_received))
 791                 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8);
 792         if (attr->dev_password_id && (!probe_req || !sta->m1_received))
 793                 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id);
 794
 795         if (attr->manufacturer) {
 796                 os_free(sta->manufacturer);
 797                 sta->manufacturer = dup_binstr(attr->manufacturer,
 798                                                attr->manufacturer_len);
 799         }
 800
 801         if (attr->model_name) {
 802                 os_free(sta->model_name);
 803                 sta->model_name = dup_binstr(attr->model_name,
 804                                              attr->model_name_len);
 805         }
 806
 807         if (attr->model_number) {
 808                 os_free(sta->model_number);
 809                 sta->model_number = dup_binstr(attr->model_number,
 810                                                attr->model_number_len);
 811         }
 812
 813         if (attr->serial_number) {
 814                 os_free(sta->serial_number);
 815                 sta->serial_number = dup_binstr(attr->serial_number,
 816                                                 attr->serial_number_len);
 817         }
 818
 819         if (attr->dev_name) {
 820                 os_free(sta->dev_name);
 821                 sta->dev_name = dup_binstr(attr->dev_name, attr->dev_name_len);
 822         }
 823
 824         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
 825         eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL);
 826
 827         if (m1 || new_sta)
 828                 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
 829
 830         return sta;
 831 }
 832
 833
 834 static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap,
 835                                                const u8 *addr,
 836                                                struct wpabuf *msg)
 837 {
 838         struct wps_parse_attr attr;
 839
 840         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from "
 841                    MACSTR, MAC2STR(addr));
 842         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
 843                         "(TLVs from Probe Request)", msg);
 844
 845         if (wps_validate_probe_req(msg, addr) < 0) {
 846                 wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied "
 847                            "Probe Request frame from " MACSTR, MAC2STR(addr));
 848                 return;
 849         }
 850
 851         if (wps_parse_msg(msg, &attr) < 0) {
 852                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
 853                            "WLANEvent message");
 854                 return;
 855         }
 856
 857         wps_er_add_sta_data(ap, addr, &attr, 1);
 858         wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0);
 859 }
 860
 861
 862 static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c,
 863                                              enum http_client_event event)
 864 {
 865         struct wps_er_sta *sta = ctx;
 866
 867         switch (event) {
 868         case HTTP_CLIENT_OK:
 869                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK");
 870                 break;
 871         case HTTP_CLIENT_FAILED:
 872         case HTTP_CLIENT_INVALID_REPLY:
 873         case HTTP_CLIENT_TIMEOUT:
 874                 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed");
 875                 break;
 876         }
 877         http_client_free(sta->http);
 878         sta->http = NULL;
 879 }
 880
 881
 882 static const char *soap_prefix =
 883         "<?xml version=\"1.0\"?>\n"
 884         "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
 885         "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
 886         "<s:Body>\n";
 887 static const char *soap_postfix =
 888         "</s:Body>\n</s:Envelope>\n";
 889 static const char *urn_wfawlanconfig =
 890         "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
 891
 892 static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg,
 893                                        const char *name, const char *arg_name,
 894                                        const char *path,
 895                                        const struct sockaddr_in *dst,
 896                                        char **len_ptr, char **body_ptr)
 897 {
 898         unsigned char *encoded;
 899         size_t encoded_len;
 900         struct wpabuf *buf;
 901
 902         if (msg) {
 903                 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg),
 904                                         &encoded_len);
 905                 if (encoded == NULL)
 906                         return NULL;
 907         } else {
 908                 encoded = NULL;
 909                 encoded_len = 0;
 910         }
 911
 912         buf = wpabuf_alloc(1000 + encoded_len);
 913         if (buf == NULL) {
 914                 os_free(encoded);
 915                 return NULL;
 916         }
 917
 918         wpabuf_printf(buf,
 919                       "POST %s HTTP/1.1\r\n"
 920                       "Host: %s:%d\r\n"
 921                       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
 922                       "Content-Length: ",
 923                       path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port));
 924
 925         *len_ptr = wpabuf_put(buf, 0);
 926         wpabuf_printf(buf,
 927                       "        \r\n"
 928                       "SOAPACTION: \"%s#%s\"\r\n"
 929                       "\r\n",
 930                       urn_wfawlanconfig, name);
 931
 932         *body_ptr = wpabuf_put(buf, 0);
 933
 934         wpabuf_put_str(buf, soap_prefix);
 935         wpabuf_printf(buf, "<u:%s xmlns:u=\"", name);
 936         wpabuf_put_str(buf, urn_wfawlanconfig);
 937         wpabuf_put_str(buf, "\">\n");
 938         if (encoded) {
 939                 wpabuf_printf(buf, "<%s>%s</%s>\n",
 940                               arg_name, (char *) encoded, arg_name);
 941                 os_free(encoded);
 942         }
 943
 944         return buf;
 945 }
 946
 947
 948 static void wps_er_soap_end(struct wpabuf *buf, const char *name,
 949                             char *len_ptr, char *body_ptr)
 950 {
 951         char len_buf[10];
 952         wpabuf_printf(buf, "</u:%s>\n", name);
 953         wpabuf_put_str(buf, soap_postfix);
 954         os_snprintf(len_buf, sizeof(len_buf), "%d",
 955                     (int) ((char *) wpabuf_put(buf, 0) - body_ptr));
 956         os_memcpy(len_ptr, len_buf, os_strlen(len_buf));
 957 }
 958
 959
 960 static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg)
 961 {
 962         struct wpabuf *buf;
 963         char *len_ptr, *body_ptr;
 964         struct sockaddr_in dst;
 965         char *url, *path;
 966
 967         if (sta->http) {
 968                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - "
 969                            "ignore new request");
 970                 wpabuf_free(msg);
 971                 return;
 972         }
 973
 974         if (sta->ap->control_url == NULL) {
 975                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
 976                 wpabuf_free(msg);
 977                 return;
 978         }
 979
 980         url = http_client_url_parse(sta->ap->control_url, &dst, &path);
 981         if (url == NULL) {
 982                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
 983                 wpabuf_free(msg);
 984                 return;
 985         }
 986
 987         buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst,
 988                               &len_ptr, &body_ptr);
 989         wpabuf_free(msg);
 990         os_free(url);
 991         if (buf == NULL)
 992                 return;
 993         wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n",
 994                       UPNP_WPS_WLANEVENT_TYPE_EAP);
 995         wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n",
 996                       MAC2STR(sta->addr));
 997
 998         wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr);
 999
1000         sta->http = http_client_addr(&dst, buf, 1000,
1001                                      wps_er_http_put_wlan_response_cb, sta);
1002         if (sta->http == NULL)
1003                 wpabuf_free(buf);
1004 }
1005
1006
1007 static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg,
1008                                enum wsc_op_code op_code)
1009 {
1010         enum wps_process_res res;
1011
1012         res = wps_process_msg(sta->wps, op_code, msg);
1013         if (res == WPS_CONTINUE) {
1014                 struct wpabuf *next = wps_get_msg(sta->wps, &op_code);
1015                 if (next)
1016                         wps_er_sta_send_msg(sta, next);
1017         } else {
1018                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the "
1019                            "enrollee (res=%d)",
1020                            res == WPS_DONE ? "succeeded" : "failed", res);
1021                 wps_deinit(sta->wps);
1022                 sta->wps = NULL;
1023                 if (res == WPS_DONE) {
1024                         /* Remove the STA entry after short timeout */
1025                         eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL);
1026                         eloop_register_timeout(10, 0, wps_er_sta_timeout, sta,
1027                                                NULL);
1028                 }
1029         }
1030 }
1031
1032
1033 static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg)
1034 {
1035         struct wps_config cfg;
1036
1037         if (sta->wps)
1038                 wps_deinit(sta->wps);
1039
1040         os_memset(&cfg, 0, sizeof(cfg));
1041         cfg.wps = sta->ap->er->wps;
1042         cfg.registrar = 1;
1043         cfg.peer_addr = sta->addr;
1044
1045         sta->wps = wps_init(&cfg);
1046         if (sta->wps == NULL)
1047                 return;
1048         sta->wps->er = 1;
1049         sta->wps->use_cred = sta->ap->ap_settings;
1050         if (sta->ap->ap_settings) {
1051                 os_free(sta->cred);
1052                 sta->cred = os_malloc(sizeof(*sta->cred));
1053                 if (sta->cred) {
1054                         os_memcpy(sta->cred, sta->ap->ap_settings,
1055                                   sizeof(*sta->cred));
1056                         sta->cred->cred_attr = NULL;
1057                         os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN);
1058                         sta->wps->use_cred = sta->cred;
1059                 }
1060         }
1061
1062         wps_er_sta_process(sta, msg, WSC_MSG);
1063 }
1064
1065
1066 static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr,
1067                                          struct wpabuf *msg)
1068 {
1069         struct wps_parse_attr attr;
1070         struct wps_er_sta *sta;
1071
1072         wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR,
1073                    MAC2STR(addr));
1074         wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message "
1075                         "(TLVs from EAP-WSC)", msg);
1076
1077         if (wps_parse_msg(msg, &attr) < 0) {
1078                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in "
1079                            "WLANEvent message");
1080                 return;
1081         }
1082
1083         sta = wps_er_add_sta_data(ap, addr, &attr, 0);
1084         if (sta == NULL)
1085                 return;
1086
1087         if (attr.msg_type && *attr.msg_type == WPS_M1)
1088                 wps_er_sta_start(sta, msg);
1089         else if (sta->wps) {
1090                 enum wsc_op_code op_code = WSC_MSG;
1091                 if (attr.msg_type) {
1092                         switch (*attr.msg_type) {
1093                         case WPS_WSC_ACK:
1094                                 op_code = WSC_ACK;
1095                                 break;
1096                         case WPS_WSC_NACK:
1097                                 op_code = WSC_NACK;
1098                                 break;
1099                         case WPS_WSC_DONE:
1100                                 op_code = WSC_Done;
1101                                 break;
1102                         }
1103                 }
1104                 wps_er_sta_process(sta, msg, op_code);
1105         }
1106 }
1107
1108
1109 static void wps_er_process_wlanevent(struct wps_er_ap *ap,
1110                                      struct wpabuf *event)
1111 {
1112         u8 *data;
1113         u8 wlan_event_type;
1114         u8 wlan_event_mac[ETH_ALEN];
1115         struct wpabuf msg;
1116
1117         wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent",
1118                     wpabuf_head(event), wpabuf_len(event));
1119         if (wpabuf_len(event) < 1 + 17) {
1120                 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent");
1121                 return;
1122         }
1123
1124         data = wpabuf_mhead(event);
1125         wlan_event_type = data[0];
1126         if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) {
1127                 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in "
1128                            "WLANEvent");
1129                 return;
1130         }
1131
1132         wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17));
1133
1134         switch (wlan_event_type) {
1135         case 1:
1136                 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg);
1137                 break;
1138         case 2:
1139                 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg);
1140                 break;
1141         default:
1142                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d",
1143                            wlan_event_type);
1144                 break;
1145         }
1146 }
1147
1148
1149 static void wps_er_http_event(struct wps_er *er, struct http_request *req,
1150                               unsigned int ap_id)
1151 {
1152         struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id);
1153         struct wpabuf *event;
1154         enum http_reply_code ret;
1155
1156         if (ap == NULL) {
1157                 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id "
1158                            "%u", ap_id);
1159                 wps_er_http_resp_not_found(req);
1160                 return;
1161         }
1162         wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s",
1163                    ap_id, http_request_get_data(req));
1164
1165         event = xml_get_base64_item(http_request_get_data(req), "WLANEvent",
1166                                     &ret);
1167         if (event == NULL) {
1168                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent "
1169                            "from the event notification");
1170                 /*
1171                  * Reply with OK anyway to avoid getting unregistered from
1172                  * events.
1173                  */
1174                 wps_er_http_resp_ok(req);
1175                 return;
1176         }
1177
1178         wps_er_process_wlanevent(ap, event);
1179
1180         wpabuf_free(event);
1181         wps_er_http_resp_ok(req);
1182 }
1183
1184
1185 static void wps_er_http_notify(struct wps_er *er, struct http_request *req)
1186 {
1187         char *uri = http_request_get_uri(req);
1188
1189         if (os_strncmp(uri, "/event/", 7) == 0) {
1190                 unsigned int event_id;
1191                 char *pos;
1192                 event_id = atoi(uri + 7);
1193                 if (event_id != er->event_id) {
1194                         wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an "
1195                                    "unknown event id %u", event_id);
1196                         return;
1197                 }
1198                 pos = os_strchr(uri + 7, '/');
1199                 if (pos == NULL)
1200                         return;
1201                 pos++;
1202                 wps_er_http_event(er, req, atoi(pos));
1203         } else {
1204                 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'",
1205                            uri);
1206                 wps_er_http_resp_not_found(req);
1207         }
1208 }
1209
1210
1211 static void wps_er_http_req(void *ctx, struct http_request *req)
1212 {
1213         struct wps_er *er = ctx;
1214         struct sockaddr_in *cli = http_request_get_cli_addr(req);
1215         enum httpread_hdr_type type = http_request_get_type(req);
1216         struct wpabuf *buf;
1217
1218         wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from "
1219                    "%s:%d",
1220                    http_request_get_uri(req), type,
1221                    inet_ntoa(cli->sin_addr), ntohs(cli->sin_port));
1222
1223         switch (type) {
1224         case HTTPREAD_HDR_TYPE_NOTIFY:
1225                 wps_er_http_notify(er, req);
1226                 break;
1227         default:
1228                 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type "
1229                            "%d", type);
1230                 buf = wpabuf_alloc(200);
1231                 if (buf == NULL) {
1232                         http_request_deinit(req);
1233                         return;
1234                 }
1235                 wpabuf_put_str(buf,
1236                                "HTTP/1.1 501 Unimplemented\r\n"
1237                                "Connection: close\r\n");
1238                 http_put_date(buf);
1239                 wpabuf_put_str(buf, "\r\n");
1240                 http_request_send_and_deinit(req, buf);
1241                 break;
1242         }
1243 }
1244
1245
1246 struct wps_er *
1247 wps_er_init(struct wps_context *wps, const char *ifname, const char *filter)
1248 {
1249         struct wps_er *er;
1250         struct in_addr addr;
1251
1252         er = os_zalloc(sizeof(*er));
1253         if (er == NULL)
1254                 return NULL;
1255         dl_list_init(&er->ap);
1256         dl_list_init(&er->ap_unsubscribing);
1257         dl_list_init(&er->ap_settings);
1258
1259         er->multicast_sd = -1;
1260         er->ssdp_sd = -1;
1261
1262         os_strlcpy(er->ifname, ifname, sizeof(er->ifname));
1263         er->wps = wps;
1264         if (os_get_random((unsigned char *) &er->event_id,
1265                           sizeof(er->event_id)) < 0) {
1266                 wps_er_deinit(er, NULL, NULL);
1267                 return NULL;
1268         }
1269         /* Limit event_id to < 32 bits to avoid issues with atoi() */
1270         er->event_id &= 0x0fffffff;
1271
1272         if (filter && os_strncmp(filter, "ifname=", 7) == 0) {
1273                 const char *pos, *end;
1274                 pos = filter + 7;
1275                 end = os_strchr(pos, ' ');
1276                 if (end) {
1277                         size_t len = end - pos;
1278                         os_strlcpy(er->ifname, pos, len < sizeof(er->ifname) ?
1279                                    len + 1 : sizeof(er->ifname));
1280                         filter = end + 1;
1281                 } else {
1282                         os_strlcpy(er->ifname, pos, sizeof(er->ifname));
1283                         filter = NULL;
1284                 }
1285                 er->forced_ifname = 1;
1286         }
1287
1288         if (filter) {
1289                 if (inet_aton(filter, &er->filter_addr) == 0) {
1290                         wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter "
1291                                    "address %s", filter);
1292                         wps_er_deinit(er, NULL, NULL);
1293                         return NULL;
1294                 }
1295                 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections "
1296                            "with %s", filter);
1297         }
1298         if (get_netif_info(er->ifname, &er->ip_addr, &er->ip_addr_text,
1299                            er->mac_addr)) {
1300                 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address "
1301                            "for %s. Does it have IP address?", er->ifname);
1302                 wps_er_deinit(er, NULL, NULL);
1303                 return NULL;
1304         }
1305
1306         if (wps_er_ssdp_init(er) < 0) {
1307                 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed");
1308                 wps_er_deinit(er, NULL, NULL);
1309                 return NULL;
1310         }
1311
1312         addr.s_addr = er->ip_addr;
1313         er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er);
1314         if (er->http_srv == NULL) {
1315                 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed");
1316                 wps_er_deinit(er, NULL, NULL);
1317                 return NULL;
1318         }
1319         er->http_port = http_server_get_port(er->http_srv);
1320
1321         wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)",
1322                    er->ifname, er->ip_addr_text);
1323
1324         return er;
1325 }
1326
1327
1328 void wps_er_refresh(struct wps_er *er)
1329 {
1330         struct wps_er_ap *ap;
1331         struct wps_er_sta *sta;
1332
1333         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1334                 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD);
1335                 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list)
1336                         wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD);
1337         }
1338
1339         wps_er_send_ssdp_msearch(er);
1340 }
1341
1342
1343 static void wps_er_deinit_finish(void *eloop_data, void *user_ctx)
1344 {
1345         struct wps_er *er = eloop_data;
1346         void (*deinit_done_cb)(void *ctx);
1347         void *deinit_done_ctx;
1348         struct wps_er_ap *ap, *tmp;
1349
1350         wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit");
1351
1352         dl_list_for_each_safe(ap, tmp, &er->ap_unsubscribing, struct wps_er_ap,
1353                               list) {
1354                 wpa_printf(MSG_DEBUG, "WPS ER: AP entry for %s (%s) still in ap_unsubscribing list - free it",
1355                            inet_ntoa(ap->addr), ap->location);
1356                 dl_list_del(&ap->list);
1357                 wps_er_ap_free(ap);
1358         }
1359
1360         eloop_cancel_timeout(wps_er_deinit_finish, er, NULL);
1361         deinit_done_cb = er->deinit_done_cb;
1362         deinit_done_ctx = er->deinit_done_ctx;
1363         os_free(er->ip_addr_text);
1364         os_free(er);
1365
1366         if (deinit_done_cb)
1367                 deinit_done_cb(deinit_done_ctx);
1368 }
1369
1370
1371 void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx)
1372 {
1373         if (er == NULL)
1374                 return;
1375         http_server_deinit(er->http_srv);
1376         wps_er_ap_remove_all(er);
1377         wps_er_ssdp_deinit(er);
1378         eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0,
1379                                wps_er_deinit_finish, er, NULL);
1380         wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout");
1381         er->deinitializing = 1;
1382         er->deinit_done_cb = cb;
1383         er->deinit_done_ctx = ctx;
1384 }
1385
1386
1387 static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c,
1388                                        enum http_client_event event)
1389 {
1390         struct wps_er_ap *ap = ctx;
1391         union wps_event_data data;
1392
1393         os_memset(&data, 0, sizeof(data));
1394
1395         switch (event) {
1396         case HTTP_CLIENT_OK:
1397                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK");
1398                 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE;
1399                 data.set_sel_reg.uuid = ap->uuid;
1400                 break;
1401         case HTTP_CLIENT_FAILED:
1402         case HTTP_CLIENT_INVALID_REPLY:
1403         case HTTP_CLIENT_TIMEOUT:
1404                 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed");
1405                 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED;
1406                 data.set_sel_reg.uuid = ap->uuid;
1407                 break;
1408         }
1409         http_client_free(ap->http);
1410         ap->http = NULL;
1411
1412         if (data.set_sel_reg.uuid)
1413                 ap->er->wps->event_cb(ap->er->wps->cb_ctx,
1414                                       WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1415 }
1416
1417
1418 static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg)
1419 {
1420         struct wpabuf *buf;
1421         char *len_ptr, *body_ptr;
1422         struct sockaddr_in dst;
1423         char *url, *path;
1424
1425         if (ap->control_url == NULL) {
1426                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1427                 return;
1428         }
1429
1430         if (ap->http) {
1431                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - "
1432                            "ignore new request");
1433                 return;
1434         }
1435
1436         if (ap->wps) {
1437                 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - "
1438                            "skip SetSelectedRegistrar");
1439                 return;
1440         }
1441
1442         url = http_client_url_parse(ap->control_url, &dst, &path);
1443         if (url == NULL) {
1444                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1445                 return;
1446         }
1447
1448         buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path,
1449                               &dst, &len_ptr, &body_ptr);
1450         os_free(url);
1451         if (buf == NULL)
1452                 return;
1453
1454         wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr);
1455
1456         ap->http = http_client_addr(&dst, buf, 1000,
1457                                     wps_er_http_set_sel_reg_cb, ap);
1458         if (ap->http == NULL)
1459                 wpabuf_free(buf);
1460 }
1461
1462
1463 static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg)
1464 {
1465         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR);
1466         wpabuf_put_be16(msg, 1);
1467         wpabuf_put_u8(msg, !!sel_reg);
1468         return 0;
1469 }
1470
1471
1472 static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id)
1473 {
1474         wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID);
1475         wpabuf_put_be16(msg, 2);
1476         wpabuf_put_be16(msg, dev_passwd_id);
1477         return 0;
1478 }
1479
1480
1481 static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg,
1482                                                u16 sel_reg_config_methods)
1483 {
1484         wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS);
1485         wpabuf_put_be16(msg, 2);
1486         wpabuf_put_be16(msg, sel_reg_config_methods);
1487         return 0;
1488 }
1489
1490
1491 static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r)
1492 {
1493 #ifdef CONFIG_WPS2
1494         wpabuf_put_be16(msg, ATTR_UUID_R);
1495         wpabuf_put_be16(msg, WPS_UUID_LEN);
1496         wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN);
1497 #endif /* CONFIG_WPS2 */
1498         return 0;
1499 }
1500
1501
1502 void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id,
1503                         u16 sel_reg_config_methods)
1504 {
1505         struct wpabuf *msg;
1506         struct wps_er_ap *ap;
1507         struct wps_registrar *reg = er->wps->registrar;
1508         const u8 *auth_macs;
1509 #ifdef CONFIG_WPS2
1510         u8 bcast[ETH_ALEN];
1511 #endif /* CONFIG_WPS2 */
1512         size_t count;
1513         union wps_event_data data;
1514
1515         if (er->skip_set_sel_reg) {
1516                 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar");
1517                 return;
1518         }
1519
1520         msg = wpabuf_alloc(500);
1521         if (msg == NULL)
1522                 return;
1523
1524         auth_macs = wps_authorized_macs(reg, &count);
1525 #ifdef CONFIG_WPS2
1526         if (count == 0) {
1527                 os_memset(bcast, 0xff, ETH_ALEN);
1528                 auth_macs = bcast;
1529                 count = 1;
1530         }
1531 #endif /* CONFIG_WPS2 */
1532
1533         if (wps_build_version(msg) ||
1534             wps_er_build_selected_registrar(msg, sel_reg) ||
1535             wps_er_build_dev_password_id(msg, dev_passwd_id) ||
1536             wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) ||
1537             wps_build_wfa_ext(msg, 0, auth_macs, count) ||
1538             wps_er_build_uuid_r(msg, er->wps->uuid)) {
1539                 wpabuf_free(msg);
1540                 return;
1541         }
1542
1543         os_memset(&data, 0, sizeof(data));
1544         data.set_sel_reg.sel_reg = sel_reg;
1545         data.set_sel_reg.dev_passwd_id = dev_passwd_id;
1546         data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods;
1547         data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START;
1548
1549         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1550                 if (er->set_sel_reg_uuid_filter &&
1551                     os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter,
1552                               WPS_UUID_LEN) != 0)
1553                         continue;
1554                 data.set_sel_reg.uuid = ap->uuid;
1555                 er->wps->event_cb(er->wps->cb_ctx,
1556                                   WPS_EV_ER_SET_SELECTED_REGISTRAR, &data);
1557                 wps_er_send_set_sel_reg(ap, msg);
1558         }
1559
1560         wpabuf_free(msg);
1561 }
1562
1563
1564 int wps_er_pbc(struct wps_er *er, const u8 *uuid, const u8 *addr)
1565 {
1566         int res;
1567         struct wps_er_ap *ap;
1568
1569         if (er == NULL || er->wps == NULL)
1570                 return -1;
1571
1572         if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) {
1573                 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC "
1574                            "mode");
1575                 return -2;
1576         }
1577
1578         if (uuid)
1579                 ap = wps_er_ap_get(er, NULL, uuid, NULL);
1580         else
1581                 ap = NULL;
1582         if (ap == NULL) {
1583                 struct wps_er_sta *sta = NULL;
1584                 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1585                         sta = wps_er_sta_get(ap, addr, uuid);
1586                         if (sta) {
1587                                 uuid = ap->uuid;
1588                                 break;
1589                         }
1590                 }
1591                 if (sta == NULL)
1592                         return -3; /* Unknown UUID */
1593         }
1594
1595         if (ap->ap_settings == NULL) {
1596                 wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known");
1597                 return -4;
1598         }
1599
1600         er->set_sel_reg_uuid_filter = uuid;
1601         res = wps_registrar_button_pushed(er->wps->registrar, NULL);
1602         er->set_sel_reg_uuid_filter = NULL;
1603         if (res)
1604                 return -1;
1605
1606         return 0;
1607 }
1608
1609
1610 static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred)
1611 {
1612         struct wps_er_ap *ap = ctx;
1613         union wps_event_data data;
1614
1615         wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received");
1616         os_free(ap->ap_settings);
1617         ap->ap_settings = os_malloc(sizeof(*cred));
1618         if (ap->ap_settings) {
1619                 os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1620                 ap->ap_settings->cred_attr = NULL;
1621         }
1622
1623         os_memset(&data, 0, sizeof(data));
1624         data.ap_settings.uuid = ap->uuid;
1625         data.ap_settings.cred = cred;
1626         ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS,
1627                               &data);
1628 }
1629
1630
1631 const u8 * wps_er_get_sta_uuid(struct wps_er *er, const u8 *addr)
1632 {
1633         struct wps_er_ap *ap;
1634         dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) {
1635                 struct wps_er_sta *sta;
1636                 sta = wps_er_sta_get(ap, addr, NULL);
1637                 if (sta)
1638                         return sta->uuid;
1639         }
1640         return NULL;
1641 }
1642
1643
1644 static void wps_er_http_put_message_cb(void *ctx, struct http_client *c,
1645                                        enum http_client_event event)
1646 {
1647         struct wps_er_ap *ap = ctx;
1648         struct wpabuf *reply;
1649         char *msg = NULL;
1650
1651         switch (event) {
1652         case HTTP_CLIENT_OK:
1653                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK");
1654                 reply = http_client_get_body(c);
1655                 if (reply == NULL)
1656                         break;
1657                 msg = os_zalloc(wpabuf_len(reply) + 1);
1658                 if (msg == NULL)
1659                         break;
1660                 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply));
1661                 break;
1662         case HTTP_CLIENT_FAILED:
1663         case HTTP_CLIENT_INVALID_REPLY:
1664         case HTTP_CLIENT_TIMEOUT:
1665                 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed");
1666                 if (ap->wps) {
1667                         wps_deinit(ap->wps);
1668                         ap->wps = NULL;
1669                 }
1670                 break;
1671         }
1672         http_client_free(ap->http);
1673         ap->http = NULL;
1674
1675         if (msg) {
1676                 struct wpabuf *buf;
1677                 enum http_reply_code ret;
1678                 buf = xml_get_base64_item(msg, "NewOutMessage", &ret);
1679                 os_free(msg);
1680                 if (buf == NULL) {
1681                         wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1682                                    "NewOutMessage from PutMessage response");
1683                         wps_deinit(ap->wps);
1684                         ap->wps = NULL;
1685                         return;
1686                 }
1687                 wps_er_ap_process(ap, buf);
1688                 wpabuf_free(buf);
1689         }
1690 }
1691
1692
1693 static void wps_er_ap_put_message(struct wps_er_ap *ap,
1694                                   const struct wpabuf *msg)
1695 {
1696         struct wpabuf *buf;
1697         char *len_ptr, *body_ptr;
1698         struct sockaddr_in dst;
1699         char *url, *path;
1700
1701         if (ap->http) {
1702                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1703                            "with the AP - cannot continue learn");
1704                 return;
1705         }
1706
1707         if (ap->control_url == NULL) {
1708                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1709                 return;
1710         }
1711
1712         url = http_client_url_parse(ap->control_url, &dst, &path);
1713         if (url == NULL) {
1714                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1715                 return;
1716         }
1717
1718         buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst,
1719                               &len_ptr, &body_ptr);
1720         os_free(url);
1721         if (buf == NULL)
1722                 return;
1723
1724         wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr);
1725
1726         ap->http = http_client_addr(&dst, buf, 10000,
1727                                     wps_er_http_put_message_cb, ap);
1728         if (ap->http == NULL)
1729                 wpabuf_free(buf);
1730 }
1731
1732
1733 static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg)
1734 {
1735         enum wps_process_res res;
1736         struct wps_parse_attr attr;
1737         enum wsc_op_code op_code;
1738
1739         op_code = WSC_MSG;
1740         if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) {
1741                 switch (*attr.msg_type) {
1742                 case WPS_WSC_ACK:
1743                         op_code = WSC_ACK;
1744                         break;
1745                 case WPS_WSC_NACK:
1746                         op_code = WSC_NACK;
1747                         break;
1748                 case WPS_WSC_DONE:
1749                         op_code = WSC_Done;
1750                         break;
1751                 }
1752         }
1753
1754         res = wps_process_msg(ap->wps, op_code, msg);
1755         if (res == WPS_CONTINUE) {
1756                 struct wpabuf *next = wps_get_msg(ap->wps, &op_code);
1757                 if (next) {
1758                         wps_er_ap_put_message(ap, next);
1759                         wpabuf_free(next);
1760                 } else {
1761                         wpa_printf(MSG_DEBUG, "WPS ER: Failed to build "
1762                                    "message");
1763                         wps_deinit(ap->wps);
1764                         ap->wps = NULL;
1765                 }
1766         } else if (res == WPS_DONE) {
1767                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done");
1768                 wps_deinit(ap->wps);
1769                 ap->wps = NULL;
1770         } else {
1771                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from "
1772                            "AP (res=%d)", res);
1773                 wps_deinit(ap->wps);
1774                 ap->wps = NULL;
1775         }
1776 }
1777
1778
1779 static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1780 {
1781         struct wps_config cfg;
1782
1783         if (ap->wps) {
1784                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1785                            "progress with this AP");
1786                 return;
1787         }
1788
1789         os_memset(&cfg, 0, sizeof(cfg));
1790         cfg.wps = ap->er->wps;
1791         cfg.registrar = 1;
1792         ap->wps = wps_init(&cfg);
1793         if (ap->wps == NULL)
1794                 return;
1795         ap->wps->ap_settings_cb = wps_er_ap_settings_cb;
1796         ap->wps->ap_settings_cb_ctx = ap;
1797
1798         wps_er_ap_process(ap, m1);
1799 }
1800
1801
1802 static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info)
1803 {
1804         struct wpabuf *info;
1805         enum http_reply_code ret;
1806
1807         wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) "
1808                    "from the AP");
1809         info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret);
1810         if (info == NULL) {
1811                 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract "
1812                            "NewDeviceInfo from GetDeviceInfo response");
1813                 return;
1814         }
1815
1816         ap->m1_handler(ap, info);
1817         wpabuf_free(info);
1818 }
1819
1820
1821 static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c,
1822                                         enum http_client_event event)
1823 {
1824         struct wps_er_ap *ap = ctx;
1825         struct wpabuf *reply;
1826         char *dev_info = NULL;
1827
1828         switch (event) {
1829         case HTTP_CLIENT_OK:
1830                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK");
1831                 reply = http_client_get_body(c);
1832                 if (reply == NULL)
1833                         break;
1834                 dev_info = os_zalloc(wpabuf_len(reply) + 1);
1835                 if (dev_info == NULL)
1836                         break;
1837                 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply));
1838                 break;
1839         case HTTP_CLIENT_FAILED:
1840         case HTTP_CLIENT_INVALID_REPLY:
1841         case HTTP_CLIENT_TIMEOUT:
1842                 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed");
1843                 break;
1844         }
1845         http_client_free(ap->http);
1846         ap->http = NULL;
1847
1848         if (dev_info) {
1849                 wps_er_ap_learn(ap, dev_info);
1850                 os_free(dev_info);
1851         }
1852 }
1853
1854
1855 static int wps_er_send_get_device_info(struct wps_er_ap *ap,
1856                                        void (*m1_handler)(struct wps_er_ap *ap,
1857                                                           struct wpabuf *m1))
1858 {
1859         struct wpabuf *buf;
1860         char *len_ptr, *body_ptr;
1861         struct sockaddr_in dst;
1862         char *url, *path;
1863
1864         if (ap->http) {
1865                 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing "
1866                            "with the AP - cannot get device info");
1867                 return -1;
1868         }
1869
1870         if (ap->control_url == NULL) {
1871                 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP");
1872                 return -1;
1873         }
1874
1875         url = http_client_url_parse(ap->control_url, &dst, &path);
1876         if (url == NULL) {
1877                 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL");
1878                 return -1;
1879         }
1880
1881         buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst,
1882                               &len_ptr, &body_ptr);
1883         os_free(url);
1884         if (buf == NULL)
1885                 return -1;
1886
1887         wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr);
1888
1889         ap->http = http_client_addr(&dst, buf, 10000,
1890                                     wps_er_http_get_dev_info_cb, ap);
1891         if (ap->http == NULL) {
1892                 wpabuf_free(buf);
1893                 return -1;
1894         }
1895
1896         ap->m1_handler = m1_handler;
1897
1898         return 0;
1899 }
1900
1901
1902 int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *addr,
1903                  const u8 *pin, size_t pin_len)
1904 {
1905         struct wps_er_ap *ap;
1906
1907         if (er == NULL)
1908                 return -1;
1909
1910         ap = wps_er_ap_get(er, NULL, uuid, addr);
1911         if (ap == NULL) {
1912                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn "
1913                            "request");
1914                 return -1;
1915         }
1916         if (uuid == NULL)
1917                 uuid = ap->uuid;
1918         if (ap->wps) {
1919                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
1920                            "with the AP - cannot start learn");
1921                 return -1;
1922         }
1923
1924         if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0)
1925                 return -1;
1926
1927         er->skip_set_sel_reg = 1;
1928         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
1929         er->skip_set_sel_reg = 0;
1930
1931         return 0;
1932 }
1933
1934
1935 int wps_er_set_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
1936                       const struct wps_credential *cred)
1937 {
1938         struct wps_er_ap *ap;
1939
1940         if (er == NULL)
1941                 return -1;
1942
1943         ap = wps_er_ap_get(er, NULL, uuid, addr);
1944         if (ap == NULL) {
1945                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config "
1946                            "request");
1947                 return -1;
1948         }
1949
1950         os_free(ap->ap_settings);
1951         ap->ap_settings = os_malloc(sizeof(*cred));
1952         if (ap->ap_settings == NULL)
1953                 return -1;
1954         os_memcpy(ap->ap_settings, cred, sizeof(*cred));
1955         ap->ap_settings->cred_attr = NULL;
1956         wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set "
1957                    "config request");
1958
1959         return 0;
1960 }
1961
1962
1963 static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1)
1964 {
1965         struct wps_config cfg;
1966
1967         if (ap->wps) {
1968                 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in "
1969                            "progress with this AP");
1970                 return;
1971         }
1972
1973         os_memset(&cfg, 0, sizeof(cfg));
1974         cfg.wps = ap->er->wps;
1975         cfg.registrar = 1;
1976         cfg.new_ap_settings = ap->ap_settings;
1977         ap->wps = wps_init(&cfg);
1978         if (ap->wps == NULL)
1979                 return;
1980         ap->wps->ap_settings_cb = NULL;
1981         ap->wps->ap_settings_cb_ctx = NULL;
1982
1983         wps_er_ap_process(ap, m1);
1984 }
1985
1986
1987 int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *addr,
1988                   const u8 *pin, size_t pin_len,
1989                   const struct wps_credential *cred)
1990 {
1991         struct wps_er_ap *ap;
1992
1993         if (er == NULL)
1994                 return -1;
1995
1996         ap = wps_er_ap_get(er, NULL, uuid, addr);
1997         if (ap == NULL) {
1998                 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config "
1999                            "request");
2000                 return -1;
2001         }
2002         if (uuid == NULL)
2003                 uuid = ap->uuid;
2004         if (ap->wps) {
2005                 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing "
2006                            "with the AP - cannot start config");
2007                 return -1;
2008         }
2009
2010         os_free(ap->ap_settings);
2011         ap->ap_settings = os_malloc(sizeof(*cred));
2012         if (ap->ap_settings == NULL)
2013                 return -1;
2014         os_memcpy(ap->ap_settings, cred, sizeof(*cred));
2015         ap->ap_settings->cred_attr = NULL;
2016
2017         if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0)
2018                 return -1;
2019
2020         er->skip_set_sel_reg = 1;
2021         wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0);
2022         er->skip_set_sel_reg = 0;
2023
2024         return 0;
2025 }
2026
2027
2028 #ifdef CONFIG_WPS_NFC
2029
2030 struct wpabuf * wps_er_config_token_from_cred(struct wps_context *wps,
2031                                               struct wps_credential *cred)
2032 {
2033         struct wpabuf *ret;
2034         struct wps_data data;
2035
2036         ret = wpabuf_alloc(500);
2037         if (ret == NULL)
2038                 return NULL;
2039
2040         os_memset(&data, 0, sizeof(data));
2041         data.wps = wps;
2042         data.use_cred = cred;
2043         if (wps_build_cred(&data, ret) ||
2044             wps_build_wfa_ext(ret, 0, NULL, 0)) {
2045                 wpabuf_free(ret);
2046                 return NULL;
2047         }
2048
2049         return ret;
2050 }
2051
2052
2053 struct wpabuf * wps_er_nfc_config_token(struct wps_er *er, const u8 *uuid,
2054                                         const u8 *addr)
2055 {
2056         struct wps_er_ap *ap;
2057
2058         if (er == NULL)
2059                 return NULL;
2060
2061         ap = wps_er_ap_get(er, NULL, uuid, addr);
2062         if (ap == NULL)
2063                 return NULL;
2064         if (ap->ap_settings == NULL) {
2065                 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
2066                            "selected AP");
2067                 return NULL;
2068         }
2069
2070         return wps_er_config_token_from_cred(er->wps, ap->ap_settings);
2071 }
2072
2073
2074 struct wpabuf * wps_er_nfc_handover_sel(struct wps_er *er,
2075                                         struct wps_context *wps, const u8 *uuid,
2076                                         const u8 *addr, struct wpabuf *pubkey)
2077 {
2078         struct wps_er_ap *ap;
2079
2080         if (er == NULL)
2081                 return NULL;
2082
2083         ap = wps_er_ap_get(er, NULL, uuid, addr);
2084         if (ap == NULL)
2085                 return NULL;
2086         if (ap->ap_settings == NULL) {
2087                 wpa_printf(MSG_DEBUG, "WPS ER: No settings known for the "
2088                            "selected AP");
2089                 return NULL;
2090         }
2091
2092         os_memcpy(wps->ssid, ap->ap_settings->ssid, ap->ap_settings->ssid_len);
2093         wps->ssid_len = ap->ap_settings->ssid_len;
2094
2095         return wps_build_nfc_handover_sel(wps, pubkey, addr, 0);
2096 }
2097
2098 #endif /* CONFIG_WPS_NFC */