wps_er.c revision c5ec7f57ead87efa365800228aa0b09a12d9e6c4
1/* 2 * Wi-Fi Protected Setup - External Registrar 3 * Copyright (c) 2009, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "base64.h" 13#include "uuid.h" 14#include "eloop.h" 15#include "httpread.h" 16#include "http_client.h" 17#include "http_server.h" 18#include "upnp_xml.h" 19#include "wps_i.h" 20#include "wps_upnp.h" 21#include "wps_upnp_i.h" 22#include "wps_er.h" 23 24 25static void wps_er_deinit_finish(void *eloop_data, void *user_ctx); 26static void wps_er_ap_timeout(void *eloop_data, void *user_ctx); 27static void wps_er_sta_timeout(void *eloop_data, void *user_ctx); 28static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg); 29static int wps_er_send_get_device_info(struct wps_er_ap *ap, 30 void (*m1_handler)(struct wps_er_ap *ap, 31 struct wpabuf *m1)); 32 33 34static void wps_er_sta_event(struct wps_context *wps, struct wps_er_sta *sta, 35 enum wps_event event) 36{ 37 union wps_event_data data; 38 struct wps_event_er_enrollee *ev = &data.enrollee; 39 40 if (wps->event_cb == NULL) 41 return; 42 43 os_memset(&data, 0, sizeof(data)); 44 ev->uuid = sta->uuid; 45 ev->mac_addr = sta->addr; 46 ev->m1_received = sta->m1_received; 47 ev->config_methods = sta->config_methods; 48 ev->dev_passwd_id = sta->dev_passwd_id; 49 ev->pri_dev_type = sta->pri_dev_type; 50 ev->dev_name = sta->dev_name; 51 ev->manufacturer = sta->manufacturer; 52 ev->model_name = sta->model_name; 53 ev->model_number = sta->model_number; 54 ev->serial_number = sta->serial_number; 55 wps->event_cb(wps->cb_ctx, event, &data); 56} 57 58 59static struct wps_er_sta * wps_er_sta_get(struct wps_er_ap *ap, const u8 *addr, 60 const u8 *uuid) 61{ 62 struct wps_er_sta *sta; 63 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) { 64 if ((addr == NULL || 65 os_memcmp(sta->addr, addr, ETH_ALEN) == 0) && 66 (uuid == NULL || 67 os_memcmp(uuid, sta->uuid, WPS_UUID_LEN) == 0)) 68 return sta; 69 } 70 return NULL; 71} 72 73 74static void wps_er_sta_free(struct wps_er_sta *sta) 75{ 76 wps_er_sta_event(sta->ap->er->wps, sta, WPS_EV_ER_ENROLLEE_REMOVE); 77 if (sta->wps) 78 wps_deinit(sta->wps); 79 os_free(sta->manufacturer); 80 os_free(sta->model_name); 81 os_free(sta->model_number); 82 os_free(sta->serial_number); 83 os_free(sta->dev_name); 84 http_client_free(sta->http); 85 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 86 os_free(sta->cred); 87 os_free(sta); 88} 89 90 91static void wps_er_sta_remove_all(struct wps_er_ap *ap) 92{ 93 struct wps_er_sta *prev, *sta; 94 dl_list_for_each_safe(sta, prev, &ap->sta, struct wps_er_sta, list) 95 wps_er_sta_free(sta); 96} 97 98 99static struct wps_er_ap * wps_er_ap_get(struct wps_er *er, 100 struct in_addr *addr, const u8 *uuid) 101{ 102 struct wps_er_ap *ap; 103 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 104 if ((addr == NULL || ap->addr.s_addr == addr->s_addr) && 105 (uuid == NULL || 106 os_memcmp(uuid, ap->uuid, WPS_UUID_LEN) == 0)) 107 return ap; 108 } 109 return NULL; 110} 111 112 113static struct wps_er_ap * wps_er_ap_get_id(struct wps_er *er, unsigned int id) 114{ 115 struct wps_er_ap *ap; 116 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 117 if (ap->id == id) 118 return ap; 119 } 120 return NULL; 121} 122 123 124static void wps_er_ap_event(struct wps_context *wps, struct wps_er_ap *ap, 125 enum wps_event event) 126{ 127 union wps_event_data data; 128 struct wps_event_er_ap *evap = &data.ap; 129 130 if (wps->event_cb == NULL) 131 return; 132 133 os_memset(&data, 0, sizeof(data)); 134 evap->uuid = ap->uuid; 135 evap->friendly_name = ap->friendly_name; 136 evap->manufacturer = ap->manufacturer; 137 evap->manufacturer_url = ap->manufacturer_url; 138 evap->model_description = ap->model_description; 139 evap->model_name = ap->model_name; 140 evap->model_number = ap->model_number; 141 evap->model_url = ap->model_url; 142 evap->serial_number = ap->serial_number; 143 evap->upc = ap->upc; 144 evap->pri_dev_type = ap->pri_dev_type; 145 evap->wps_state = ap->wps_state; 146 evap->mac_addr = ap->mac_addr; 147 wps->event_cb(wps->cb_ctx, event, &data); 148} 149 150 151static void wps_er_ap_free(struct wps_er_ap *ap) 152{ 153 http_client_free(ap->http); 154 ap->http = NULL; 155 156 os_free(ap->location); 157 os_free(ap->friendly_name); 158 os_free(ap->manufacturer); 159 os_free(ap->manufacturer_url); 160 os_free(ap->model_description); 161 os_free(ap->model_name); 162 os_free(ap->model_number); 163 os_free(ap->model_url); 164 os_free(ap->serial_number); 165 os_free(ap->udn); 166 os_free(ap->upc); 167 168 os_free(ap->scpd_url); 169 os_free(ap->control_url); 170 os_free(ap->event_sub_url); 171 172 os_free(ap->ap_settings); 173 174 os_free(ap); 175} 176 177 178static void wps_er_ap_unsubscribed(struct wps_er *er, struct wps_er_ap *ap) 179{ 180 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from AP %s (%s)", 181 inet_ntoa(ap->addr), ap->location); 182 dl_list_del(&ap->list); 183 wps_er_ap_free(ap); 184 185 if (er->deinitializing && dl_list_empty(&er->ap_unsubscribing)) { 186 eloop_cancel_timeout(wps_er_deinit_finish, er, NULL); 187 wps_er_deinit_finish(er, NULL); 188 } 189} 190 191 192static void wps_er_http_unsubscribe_cb(void *ctx, struct http_client *c, 193 enum http_client_event event) 194{ 195 struct wps_er_ap *ap = ctx; 196 197 switch (event) { 198 case HTTP_CLIENT_OK: 199 wpa_printf(MSG_DEBUG, "WPS ER: Unsubscribed from events"); 200 ap->subscribed = 0; 201 break; 202 case HTTP_CLIENT_FAILED: 203 case HTTP_CLIENT_INVALID_REPLY: 204 case HTTP_CLIENT_TIMEOUT: 205 wpa_printf(MSG_DEBUG, "WPS ER: Failed to unsubscribe from " 206 "events"); 207 break; 208 } 209 http_client_free(ap->http); 210 ap->http = NULL; 211 212 /* 213 * Need to get rid of the AP entry regardless of whether we managed to 214 * unsubscribe cleanly or not. 215 */ 216 wps_er_ap_unsubscribed(ap->er, ap); 217} 218 219 220static void wps_er_ap_unsubscribe(struct wps_er *er, struct wps_er_ap *ap) 221{ 222 struct wpabuf *req; 223 struct sockaddr_in dst; 224 char *url, *path; 225 char sid[100]; 226 227 if (ap->event_sub_url == NULL) { 228 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " 229 "subscribe"); 230 goto fail; 231 } 232 if (ap->http) { 233 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " 234 "send subscribe request"); 235 goto fail; 236 } 237 238 url = http_client_url_parse(ap->event_sub_url, &dst, &path); 239 if (url == NULL) { 240 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); 241 goto fail; 242 } 243 244 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); 245 if (req == NULL) { 246 os_free(url); 247 goto fail; 248 } 249 uuid_bin2str(ap->sid, sid, sizeof(sid)); 250 wpabuf_printf(req, 251 "UNSUBSCRIBE %s HTTP/1.1\r\n" 252 "HOST: %s:%d\r\n" 253 "SID: uuid:%s\r\n" 254 "\r\n", 255 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), sid); 256 os_free(url); 257 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Unsubscription request", 258 wpabuf_head(req), wpabuf_len(req)); 259 260 ap->http = http_client_addr(&dst, req, 1000, 261 wps_er_http_unsubscribe_cb, ap); 262 if (ap->http == NULL) { 263 wpabuf_free(req); 264 goto fail; 265 } 266 return; 267 268fail: 269 /* 270 * Need to get rid of the AP entry even when we fail to unsubscribe 271 * cleanly. 272 */ 273 wps_er_ap_unsubscribed(ap->er, ap); 274} 275 276 277static struct wps_er_ap_settings * wps_er_ap_get_settings(struct wps_er *er, 278 const u8 *uuid) 279{ 280 struct wps_er_ap_settings *s; 281 dl_list_for_each(s, &er->ap_settings, struct wps_er_ap_settings, list) 282 if (os_memcmp(uuid, s->uuid, WPS_UUID_LEN) == 0) 283 return s; 284 return NULL; 285} 286 287 288int wps_er_ap_cache_settings(struct wps_er *er, struct in_addr *addr) 289{ 290 struct wps_er_ap *ap; 291 struct wps_er_ap_settings *settings; 292 293 ap = wps_er_ap_get(er, addr, NULL); 294 if (ap == NULL || ap->ap_settings == NULL) 295 return -1; 296 297 settings = wps_er_ap_get_settings(er, ap->uuid); 298 if (!settings) { 299 settings = os_zalloc(sizeof(*settings)); 300 if (settings == NULL) 301 return -1; 302 os_memcpy(settings->uuid, ap->uuid, WPS_UUID_LEN); 303 dl_list_add(&er->ap_settings, &settings->list); 304 } 305 os_memcpy(&settings->ap_settings, ap->ap_settings, 306 sizeof(struct wps_credential)); 307 308 return 0; 309} 310 311 312static int wps_er_ap_use_cached_settings(struct wps_er *er, 313 struct wps_er_ap *ap) 314{ 315 struct wps_er_ap_settings *s; 316 317 if (ap->ap_settings) 318 return 0; 319 320 s = wps_er_ap_get_settings(ap->er, ap->uuid); 321 if (!s) 322 return -1; 323 324 ap->ap_settings = os_malloc(sizeof(*ap->ap_settings)); 325 if (ap->ap_settings == NULL) 326 return -1; 327 328 os_memcpy(ap->ap_settings, &s->ap_settings, sizeof(*ap->ap_settings)); 329 wpa_printf(MSG_DEBUG, "WPS ER: Use cached AP settings"); 330 return 0; 331} 332 333 334static void wps_er_ap_remove_entry(struct wps_er *er, struct wps_er_ap *ap) 335{ 336 wpa_printf(MSG_DEBUG, "WPS ER: Removing AP entry for %s (%s)", 337 inet_ntoa(ap->addr), ap->location); 338 eloop_cancel_timeout(wps_er_ap_timeout, er, ap); 339 wps_er_sta_remove_all(ap); 340 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_REMOVE); 341 http_client_free(ap->http); 342 ap->http = NULL; 343 if (ap->wps) { 344 wps_deinit(ap->wps); 345 ap->wps = NULL; 346 } 347 348 dl_list_del(&ap->list); 349 if (ap->subscribed) { 350 dl_list_add(&er->ap_unsubscribing, &ap->list); 351 wps_er_ap_unsubscribe(er, ap); 352 } else 353 wps_er_ap_free(ap); 354} 355 356 357static void wps_er_ap_timeout(void *eloop_data, void *user_ctx) 358{ 359 struct wps_er *er = eloop_data; 360 struct wps_er_ap *ap = user_ctx; 361 wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out"); 362 wps_er_ap_remove_entry(er, ap); 363} 364 365 366static int wps_er_get_sid(struct wps_er_ap *ap, char *sid) 367{ 368 char *pos; 369 char txt[100]; 370 371 if (!sid) { 372 wpa_printf(MSG_DEBUG, "WPS ER: No SID received from %s (%s)", 373 inet_ntoa(ap->addr), ap->location); 374 return -1; 375 } 376 377 pos = os_strstr(sid, "uuid:"); 378 if (!pos) { 379 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " 380 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, 381 sid); 382 return -1; 383 } 384 385 pos += 5; 386 if (uuid_str2bin(pos, ap->sid) < 0) { 387 wpa_printf(MSG_DEBUG, "WPS ER: Invalid SID received from " 388 "%s (%s): '%s'", inet_ntoa(ap->addr), ap->location, 389 sid); 390 return -1; 391 } 392 393 uuid_bin2str(ap->sid, txt, sizeof(txt)); 394 wpa_printf(MSG_DEBUG, "WPS ER: SID for subscription with %s (%s): %s", 395 inet_ntoa(ap->addr), ap->location, txt); 396 397 return 0; 398} 399 400 401static void wps_er_http_subscribe_cb(void *ctx, struct http_client *c, 402 enum http_client_event event) 403{ 404 struct wps_er_ap *ap = ctx; 405 406 switch (event) { 407 case HTTP_CLIENT_OK: 408 wpa_printf(MSG_DEBUG, "WPS ER: Subscribed to events"); 409 ap->subscribed = 1; 410 wps_er_get_sid(ap, http_client_get_hdr_line(c, "SID")); 411 wps_er_ap_use_cached_settings(ap->er, ap); 412 wps_er_ap_event(ap->er->wps, ap, WPS_EV_ER_AP_ADD); 413 break; 414 case HTTP_CLIENT_FAILED: 415 case HTTP_CLIENT_INVALID_REPLY: 416 case HTTP_CLIENT_TIMEOUT: 417 wpa_printf(MSG_DEBUG, "WPS ER: Failed to subscribe to events"); 418 break; 419 } 420 http_client_free(ap->http); 421 ap->http = NULL; 422} 423 424 425static void wps_er_subscribe(struct wps_er_ap *ap) 426{ 427 struct wpabuf *req; 428 struct sockaddr_in dst; 429 char *url, *path; 430 431 if (ap->event_sub_url == NULL) { 432 wpa_printf(MSG_DEBUG, "WPS ER: No eventSubURL - cannot " 433 "subscribe"); 434 return; 435 } 436 if (ap->http) { 437 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request - cannot " 438 "send subscribe request"); 439 return; 440 } 441 442 url = http_client_url_parse(ap->event_sub_url, &dst, &path); 443 if (url == NULL) { 444 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse eventSubURL"); 445 return; 446 } 447 448 req = wpabuf_alloc(os_strlen(ap->event_sub_url) + 1000); 449 if (req == NULL) { 450 os_free(url); 451 return; 452 } 453 wpabuf_printf(req, 454 "SUBSCRIBE %s HTTP/1.1\r\n" 455 "HOST: %s:%d\r\n" 456 "CALLBACK: <http://%s:%d/event/%u/%u>\r\n" 457 "NT: upnp:event\r\n" 458 "TIMEOUT: Second-%d\r\n" 459 "\r\n", 460 path, inet_ntoa(dst.sin_addr), ntohs(dst.sin_port), 461 ap->er->ip_addr_text, ap->er->http_port, 462 ap->er->event_id, ap->id, 1800); 463 os_free(url); 464 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Subscription request", 465 wpabuf_head(req), wpabuf_len(req)); 466 467 ap->http = http_client_addr(&dst, req, 1000, wps_er_http_subscribe_cb, 468 ap); 469 if (ap->http == NULL) 470 wpabuf_free(req); 471} 472 473 474static void wps_er_ap_get_m1(struct wps_er_ap *ap, struct wpabuf *m1) 475{ 476 struct wps_parse_attr attr; 477 478 if (wps_parse_msg(m1, &attr) < 0) { 479 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse M1"); 480 return; 481 } 482 if (attr.primary_dev_type) 483 os_memcpy(ap->pri_dev_type, attr.primary_dev_type, 8); 484 if (attr.wps_state) 485 ap->wps_state = *attr.wps_state; 486 if (attr.mac_addr) 487 os_memcpy(ap->mac_addr, attr.mac_addr, ETH_ALEN); 488 489 wps_er_subscribe(ap); 490} 491 492 493static void wps_er_get_device_info(struct wps_er_ap *ap) 494{ 495 wps_er_send_get_device_info(ap, wps_er_ap_get_m1); 496} 497 498 499static const char * wps_er_find_wfadevice(const char *data) 500{ 501 const char *tag, *tagname, *end; 502 char *val; 503 int found = 0; 504 505 while (!found) { 506 /* Find next <device> */ 507 for (;;) { 508 if (xml_next_tag(data, &tag, &tagname, &end)) 509 return NULL; 510 data = end; 511 if (!os_strncasecmp(tagname, "device", 6) && 512 *tag != '/' && 513 (tagname[6] == '>' || !isgraph(tagname[6]))) { 514 break; 515 } 516 } 517 518 /* Check whether deviceType is WFADevice */ 519 val = xml_get_first_item(data, "deviceType"); 520 if (val == NULL) 521 return NULL; 522 wpa_printf(MSG_DEBUG, "WPS ER: Found deviceType '%s'", val); 523 found = os_strcasecmp(val, "urn:schemas-wifialliance-org:" 524 "device:WFADevice:1") == 0; 525 os_free(val); 526 } 527 528 return data; 529} 530 531 532static void wps_er_parse_device_description(struct wps_er_ap *ap, 533 struct wpabuf *reply) 534{ 535 /* Note: reply includes null termination after the buffer data */ 536 const char *tmp, *data = wpabuf_head(reply); 537 char *pos; 538 539 wpa_hexdump_ascii(MSG_MSGDUMP, "WPS ER: Device info", 540 wpabuf_head(reply), wpabuf_len(reply)); 541 542 /* 543 * The root device description may include multiple devices, so first 544 * find the beginning of the WFADevice description to allow the 545 * simplistic parser to pick the correct entries. 546 */ 547 tmp = wps_er_find_wfadevice(data); 548 if (tmp == NULL) { 549 wpa_printf(MSG_DEBUG, "WPS ER: WFADevice:1 device not found - " 550 "trying to parse invalid data"); 551 } else 552 data = tmp; 553 554 ap->friendly_name = xml_get_first_item(data, "friendlyName"); 555 wpa_printf(MSG_DEBUG, "WPS ER: friendlyName='%s'", ap->friendly_name); 556 557 ap->manufacturer = xml_get_first_item(data, "manufacturer"); 558 wpa_printf(MSG_DEBUG, "WPS ER: manufacturer='%s'", ap->manufacturer); 559 560 ap->manufacturer_url = xml_get_first_item(data, "manufacturerURL"); 561 wpa_printf(MSG_DEBUG, "WPS ER: manufacturerURL='%s'", 562 ap->manufacturer_url); 563 564 ap->model_description = xml_get_first_item(data, "modelDescription"); 565 wpa_printf(MSG_DEBUG, "WPS ER: modelDescription='%s'", 566 ap->model_description); 567 568 ap->model_name = xml_get_first_item(data, "modelName"); 569 wpa_printf(MSG_DEBUG, "WPS ER: modelName='%s'", ap->model_name); 570 571 ap->model_number = xml_get_first_item(data, "modelNumber"); 572 wpa_printf(MSG_DEBUG, "WPS ER: modelNumber='%s'", ap->model_number); 573 574 ap->model_url = xml_get_first_item(data, "modelURL"); 575 wpa_printf(MSG_DEBUG, "WPS ER: modelURL='%s'", ap->model_url); 576 577 ap->serial_number = xml_get_first_item(data, "serialNumber"); 578 wpa_printf(MSG_DEBUG, "WPS ER: serialNumber='%s'", ap->serial_number); 579 580 ap->udn = xml_get_first_item(data, "UDN"); 581 wpa_printf(MSG_DEBUG, "WPS ER: UDN='%s'", ap->udn); 582 pos = os_strstr(ap->udn, "uuid:"); 583 if (pos) { 584 pos += 5; 585 if (uuid_str2bin(pos, ap->uuid) < 0) 586 wpa_printf(MSG_DEBUG, "WPS ER: Invalid UUID in UDN"); 587 } 588 589 ap->upc = xml_get_first_item(data, "UPC"); 590 wpa_printf(MSG_DEBUG, "WPS ER: UPC='%s'", ap->upc); 591 592 ap->scpd_url = http_link_update( 593 xml_get_first_item(data, "SCPDURL"), ap->location); 594 wpa_printf(MSG_DEBUG, "WPS ER: SCPDURL='%s'", ap->scpd_url); 595 596 ap->control_url = http_link_update( 597 xml_get_first_item(data, "controlURL"), ap->location); 598 wpa_printf(MSG_DEBUG, "WPS ER: controlURL='%s'", ap->control_url); 599 600 ap->event_sub_url = http_link_update( 601 xml_get_first_item(data, "eventSubURL"), ap->location); 602 wpa_printf(MSG_DEBUG, "WPS ER: eventSubURL='%s'", ap->event_sub_url); 603} 604 605 606static void wps_er_http_dev_desc_cb(void *ctx, struct http_client *c, 607 enum http_client_event event) 608{ 609 struct wps_er_ap *ap = ctx; 610 struct wpabuf *reply; 611 int ok = 0; 612 613 switch (event) { 614 case HTTP_CLIENT_OK: 615 reply = http_client_get_body(c); 616 if (reply == NULL) 617 break; 618 wps_er_parse_device_description(ap, reply); 619 ok = 1; 620 break; 621 case HTTP_CLIENT_FAILED: 622 case HTTP_CLIENT_INVALID_REPLY: 623 case HTTP_CLIENT_TIMEOUT: 624 wpa_printf(MSG_DEBUG, "WPS ER: Failed to fetch device info"); 625 break; 626 } 627 http_client_free(ap->http); 628 ap->http = NULL; 629 if (ok) 630 wps_er_get_device_info(ap); 631} 632 633 634void wps_er_ap_add(struct wps_er *er, const u8 *uuid, struct in_addr *addr, 635 const char *location, int max_age) 636{ 637 struct wps_er_ap *ap; 638 639 ap = wps_er_ap_get(er, addr, uuid); 640 if (ap) { 641 /* Update advertisement timeout */ 642 eloop_cancel_timeout(wps_er_ap_timeout, er, ap); 643 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); 644 return; 645 } 646 647 ap = os_zalloc(sizeof(*ap)); 648 if (ap == NULL) 649 return; 650 dl_list_init(&ap->sta); 651 ap->er = er; 652 ap->id = ++er->next_ap_id; 653 ap->location = os_strdup(location); 654 if (ap->location == NULL) { 655 os_free(ap); 656 return; 657 } 658 dl_list_add(&er->ap, &ap->list); 659 660 ap->addr.s_addr = addr->s_addr; 661 os_memcpy(ap->uuid, uuid, WPS_UUID_LEN); 662 eloop_register_timeout(max_age, 0, wps_er_ap_timeout, er, ap); 663 664 wpa_printf(MSG_DEBUG, "WPS ER: Added AP entry for %s (%s)", 665 inet_ntoa(ap->addr), ap->location); 666 667 /* Fetch device description */ 668 ap->http = http_client_url(ap->location, NULL, 10000, 669 wps_er_http_dev_desc_cb, ap); 670} 671 672 673void wps_er_ap_remove(struct wps_er *er, struct in_addr *addr) 674{ 675 struct wps_er_ap *ap; 676 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 677 if (ap->addr.s_addr == addr->s_addr) { 678 wps_er_ap_remove_entry(er, ap); 679 return; 680 } 681 } 682} 683 684 685static void wps_er_ap_remove_all(struct wps_er *er) 686{ 687 struct wps_er_ap *prev, *ap; 688 struct wps_er_ap_settings *prev_s, *s; 689 dl_list_for_each_safe(ap, prev, &er->ap, struct wps_er_ap, list) 690 wps_er_ap_remove_entry(er, ap); 691 dl_list_for_each_safe(s, prev_s, &er->ap_settings, 692 struct wps_er_ap_settings, list) 693 os_free(s); 694} 695 696 697static void http_put_date(struct wpabuf *buf) 698{ 699 wpabuf_put_str(buf, "Date: "); 700 format_date(buf); 701 wpabuf_put_str(buf, "\r\n"); 702} 703 704 705static void wps_er_http_resp_not_found(struct http_request *req) 706{ 707 struct wpabuf *buf; 708 buf = wpabuf_alloc(200); 709 if (buf == NULL) { 710 http_request_deinit(req); 711 return; 712 } 713 714 wpabuf_put_str(buf, 715 "HTTP/1.1 404 Not Found\r\n" 716 "Server: unspecified, UPnP/1.0, unspecified\r\n" 717 "Connection: close\r\n"); 718 http_put_date(buf); 719 wpabuf_put_str(buf, "\r\n"); 720 http_request_send_and_deinit(req, buf); 721} 722 723 724static void wps_er_http_resp_ok(struct http_request *req) 725{ 726 struct wpabuf *buf; 727 buf = wpabuf_alloc(200); 728 if (buf == NULL) { 729 http_request_deinit(req); 730 return; 731 } 732 733 wpabuf_put_str(buf, 734 "HTTP/1.1 200 OK\r\n" 735 "Server: unspecified, UPnP/1.0, unspecified\r\n" 736 "Connection: close\r\n" 737 "Content-Length: 0\r\n"); 738 http_put_date(buf); 739 wpabuf_put_str(buf, "\r\n"); 740 http_request_send_and_deinit(req, buf); 741} 742 743 744static void wps_er_sta_timeout(void *eloop_data, void *user_ctx) 745{ 746 struct wps_er_sta *sta = eloop_data; 747 wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out"); 748 dl_list_del(&sta->list); 749 wps_er_sta_free(sta); 750} 751 752 753static struct wps_er_sta * wps_er_add_sta_data(struct wps_er_ap *ap, 754 const u8 *addr, 755 struct wps_parse_attr *attr, 756 int probe_req) 757{ 758 struct wps_er_sta *sta = wps_er_sta_get(ap, addr, NULL); 759 int new_sta = 0; 760 int m1; 761 762 m1 = !probe_req && attr->msg_type && *attr->msg_type == WPS_M1; 763 764 if (sta == NULL) { 765 /* 766 * Only allow new STA entry to be added based on Probe Request 767 * or M1. This will filter out bogus events and anything that 768 * may have been ongoing at the time ER subscribed for events. 769 */ 770 if (!probe_req && !m1) 771 return NULL; 772 773 sta = os_zalloc(sizeof(*sta)); 774 if (sta == NULL) 775 return NULL; 776 os_memcpy(sta->addr, addr, ETH_ALEN); 777 sta->ap = ap; 778 dl_list_add(&ap->sta, &sta->list); 779 new_sta = 1; 780 } 781 782 if (m1) 783 sta->m1_received = 1; 784 785 if (attr->config_methods && (!probe_req || !sta->m1_received)) 786 sta->config_methods = WPA_GET_BE16(attr->config_methods); 787 if (attr->uuid_e && (!probe_req || !sta->m1_received)) 788 os_memcpy(sta->uuid, attr->uuid_e, WPS_UUID_LEN); 789 if (attr->primary_dev_type && (!probe_req || !sta->m1_received)) 790 os_memcpy(sta->pri_dev_type, attr->primary_dev_type, 8); 791 if (attr->dev_password_id && (!probe_req || !sta->m1_received)) 792 sta->dev_passwd_id = WPA_GET_BE16(attr->dev_password_id); 793 794 if (attr->manufacturer) { 795 os_free(sta->manufacturer); 796 sta->manufacturer = os_malloc(attr->manufacturer_len + 1); 797 if (sta->manufacturer) { 798 os_memcpy(sta->manufacturer, attr->manufacturer, 799 attr->manufacturer_len); 800 sta->manufacturer[attr->manufacturer_len] = '\0'; 801 } 802 } 803 804 if (attr->model_name) { 805 os_free(sta->model_name); 806 sta->model_name = os_malloc(attr->model_name_len + 1); 807 if (sta->model_name) { 808 os_memcpy(sta->model_name, attr->model_name, 809 attr->model_name_len); 810 sta->model_name[attr->model_name_len] = '\0'; 811 } 812 } 813 814 if (attr->model_number) { 815 os_free(sta->model_number); 816 sta->model_number = os_malloc(attr->model_number_len + 1); 817 if (sta->model_number) { 818 os_memcpy(sta->model_number, attr->model_number, 819 attr->model_number_len); 820 sta->model_number[attr->model_number_len] = '\0'; 821 } 822 } 823 824 if (attr->serial_number) { 825 os_free(sta->serial_number); 826 sta->serial_number = os_malloc(attr->serial_number_len + 1); 827 if (sta->serial_number) { 828 os_memcpy(sta->serial_number, attr->serial_number, 829 attr->serial_number_len); 830 sta->serial_number[attr->serial_number_len] = '\0'; 831 } 832 } 833 834 if (attr->dev_name) { 835 os_free(sta->dev_name); 836 sta->dev_name = os_malloc(attr->dev_name_len + 1); 837 if (sta->dev_name) { 838 os_memcpy(sta->dev_name, attr->dev_name, 839 attr->dev_name_len); 840 sta->dev_name[attr->dev_name_len] = '\0'; 841 } 842 } 843 844 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 845 eloop_register_timeout(300, 0, wps_er_sta_timeout, sta, NULL); 846 847 if (m1 || new_sta) 848 wps_er_sta_event(ap->er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); 849 850 return sta; 851} 852 853 854static void wps_er_process_wlanevent_probe_req(struct wps_er_ap *ap, 855 const u8 *addr, 856 struct wpabuf *msg) 857{ 858 struct wps_parse_attr attr; 859 860 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - Probe Request - from " 861 MACSTR, MAC2STR(addr)); 862 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " 863 "(TLVs from Probe Request)", msg); 864 865 if (wps_validate_probe_req(msg, addr) < 0) { 866 wpa_printf(MSG_INFO, "WPS-STRICT: ER: Ignore invalid proxied " 867 "Probe Request frame from " MACSTR, MAC2STR(addr)); 868 return; 869 } 870 871 if (wps_parse_msg(msg, &attr) < 0) { 872 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " 873 "WLANEvent message"); 874 return; 875 } 876 877 wps_er_add_sta_data(ap, addr, &attr, 1); 878 wps_registrar_probe_req_rx(ap->er->wps->registrar, addr, msg, 0); 879} 880 881 882static void wps_er_http_put_wlan_response_cb(void *ctx, struct http_client *c, 883 enum http_client_event event) 884{ 885 struct wps_er_sta *sta = ctx; 886 887 switch (event) { 888 case HTTP_CLIENT_OK: 889 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse OK"); 890 break; 891 case HTTP_CLIENT_FAILED: 892 case HTTP_CLIENT_INVALID_REPLY: 893 case HTTP_CLIENT_TIMEOUT: 894 wpa_printf(MSG_DEBUG, "WPS ER: PutWLANResponse failed"); 895 break; 896 } 897 http_client_free(sta->http); 898 sta->http = NULL; 899} 900 901 902static const char *soap_prefix = 903 "<?xml version=\"1.0\"?>\n" 904 "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" " 905 "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n" 906 "<s:Body>\n"; 907static const char *soap_postfix = 908 "</s:Body>\n</s:Envelope>\n"; 909static const char *urn_wfawlanconfig = 910 "urn:schemas-wifialliance-org:service:WFAWLANConfig:1"; 911 912static struct wpabuf * wps_er_soap_hdr(const struct wpabuf *msg, 913 const char *name, const char *arg_name, 914 const char *path, 915 const struct sockaddr_in *dst, 916 char **len_ptr, char **body_ptr) 917{ 918 unsigned char *encoded; 919 size_t encoded_len; 920 struct wpabuf *buf; 921 922 if (msg) { 923 encoded = base64_encode(wpabuf_head(msg), wpabuf_len(msg), 924 &encoded_len); 925 if (encoded == NULL) 926 return NULL; 927 } else { 928 encoded = NULL; 929 encoded_len = 0; 930 } 931 932 buf = wpabuf_alloc(1000 + encoded_len); 933 if (buf == NULL) { 934 os_free(encoded); 935 return NULL; 936 } 937 938 wpabuf_printf(buf, 939 "POST %s HTTP/1.1\r\n" 940 "Host: %s:%d\r\n" 941 "Content-Type: text/xml; charset=\"utf-8\"\r\n" 942 "Content-Length: ", 943 path, inet_ntoa(dst->sin_addr), ntohs(dst->sin_port)); 944 945 *len_ptr = wpabuf_put(buf, 0); 946 wpabuf_printf(buf, 947 " \r\n" 948 "SOAPACTION: \"%s#%s\"\r\n" 949 "\r\n", 950 urn_wfawlanconfig, name); 951 952 *body_ptr = wpabuf_put(buf, 0); 953 954 wpabuf_put_str(buf, soap_prefix); 955 wpabuf_printf(buf, "<u:%s xmlns:u=\"", name); 956 wpabuf_put_str(buf, urn_wfawlanconfig); 957 wpabuf_put_str(buf, "\">\n"); 958 if (encoded) { 959 wpabuf_printf(buf, "<%s>%s</%s>\n", 960 arg_name, (char *) encoded, arg_name); 961 os_free(encoded); 962 } 963 964 return buf; 965} 966 967 968static void wps_er_soap_end(struct wpabuf *buf, const char *name, 969 char *len_ptr, char *body_ptr) 970{ 971 char len_buf[10]; 972 wpabuf_printf(buf, "</u:%s>\n", name); 973 wpabuf_put_str(buf, soap_postfix); 974 os_snprintf(len_buf, sizeof(len_buf), "%d", 975 (int) ((char *) wpabuf_put(buf, 0) - body_ptr)); 976 os_memcpy(len_ptr, len_buf, os_strlen(len_buf)); 977} 978 979 980static void wps_er_sta_send_msg(struct wps_er_sta *sta, struct wpabuf *msg) 981{ 982 struct wpabuf *buf; 983 char *len_ptr, *body_ptr; 984 struct sockaddr_in dst; 985 char *url, *path; 986 987 if (sta->http) { 988 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for STA - " 989 "ignore new request"); 990 wpabuf_free(msg); 991 return; 992 } 993 994 if (sta->ap->control_url == NULL) { 995 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 996 wpabuf_free(msg); 997 return; 998 } 999 1000 url = http_client_url_parse(sta->ap->control_url, &dst, &path); 1001 if (url == NULL) { 1002 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1003 wpabuf_free(msg); 1004 return; 1005 } 1006 1007 buf = wps_er_soap_hdr(msg, "PutWLANResponse", "NewMessage", path, &dst, 1008 &len_ptr, &body_ptr); 1009 wpabuf_free(msg); 1010 os_free(url); 1011 if (buf == NULL) 1012 return; 1013 wpabuf_printf(buf, "<NewWLANEventType>%d</NewWLANEventType>\n", 1014 UPNP_WPS_WLANEVENT_TYPE_EAP); 1015 wpabuf_printf(buf, "<NewWLANEventMAC>" MACSTR "</NewWLANEventMAC>\n", 1016 MAC2STR(sta->addr)); 1017 1018 wps_er_soap_end(buf, "PutWLANResponse", len_ptr, body_ptr); 1019 1020 sta->http = http_client_addr(&dst, buf, 1000, 1021 wps_er_http_put_wlan_response_cb, sta); 1022 if (sta->http == NULL) 1023 wpabuf_free(buf); 1024} 1025 1026 1027static void wps_er_sta_process(struct wps_er_sta *sta, struct wpabuf *msg, 1028 enum wsc_op_code op_code) 1029{ 1030 enum wps_process_res res; 1031 1032 res = wps_process_msg(sta->wps, op_code, msg); 1033 if (res == WPS_CONTINUE) { 1034 struct wpabuf *next = wps_get_msg(sta->wps, &op_code); 1035 if (next) 1036 wps_er_sta_send_msg(sta, next); 1037 } else { 1038 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run %s with the " 1039 "enrollee (res=%d)", 1040 res == WPS_DONE ? "succeeded" : "failed", res); 1041 wps_deinit(sta->wps); 1042 sta->wps = NULL; 1043 if (res == WPS_DONE) { 1044 /* Remove the STA entry after short timeout */ 1045 eloop_cancel_timeout(wps_er_sta_timeout, sta, NULL); 1046 eloop_register_timeout(10, 0, wps_er_sta_timeout, sta, 1047 NULL); 1048 } 1049 } 1050} 1051 1052 1053static void wps_er_sta_start(struct wps_er_sta *sta, struct wpabuf *msg) 1054{ 1055 struct wps_config cfg; 1056 1057 if (sta->wps) 1058 wps_deinit(sta->wps); 1059 1060 os_memset(&cfg, 0, sizeof(cfg)); 1061 cfg.wps = sta->ap->er->wps; 1062 cfg.registrar = 1; 1063 cfg.peer_addr = sta->addr; 1064 1065 sta->wps = wps_init(&cfg); 1066 if (sta->wps == NULL) 1067 return; 1068 sta->wps->er = 1; 1069 sta->wps->use_cred = sta->ap->ap_settings; 1070 if (sta->ap->ap_settings) { 1071 os_free(sta->cred); 1072 sta->cred = os_malloc(sizeof(*sta->cred)); 1073 if (sta->cred) { 1074 os_memcpy(sta->cred, sta->ap->ap_settings, 1075 sizeof(*sta->cred)); 1076 sta->cred->cred_attr = NULL; 1077 os_memcpy(sta->cred->mac_addr, sta->addr, ETH_ALEN); 1078 sta->wps->use_cred = sta->cred; 1079 } 1080 } 1081 1082 wps_er_sta_process(sta, msg, WSC_MSG); 1083} 1084 1085 1086static void wps_er_process_wlanevent_eap(struct wps_er_ap *ap, const u8 *addr, 1087 struct wpabuf *msg) 1088{ 1089 struct wps_parse_attr attr; 1090 struct wps_er_sta *sta; 1091 1092 wpa_printf(MSG_DEBUG, "WPS ER: WLANEvent - EAP - from " MACSTR, 1093 MAC2STR(addr)); 1094 wpa_hexdump_buf(MSG_MSGDUMP, "WPS ER: WLANEvent - Enrollee's message " 1095 "(TLVs from EAP-WSC)", msg); 1096 1097 if (wps_parse_msg(msg, &attr) < 0) { 1098 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse TLVs in " 1099 "WLANEvent message"); 1100 return; 1101 } 1102 1103 sta = wps_er_add_sta_data(ap, addr, &attr, 0); 1104 if (sta == NULL) 1105 return; 1106 1107 if (attr.msg_type && *attr.msg_type == WPS_M1) 1108 wps_er_sta_start(sta, msg); 1109 else if (sta->wps) { 1110 enum wsc_op_code op_code = WSC_MSG; 1111 if (attr.msg_type) { 1112 switch (*attr.msg_type) { 1113 case WPS_WSC_ACK: 1114 op_code = WSC_ACK; 1115 break; 1116 case WPS_WSC_NACK: 1117 op_code = WSC_NACK; 1118 break; 1119 case WPS_WSC_DONE: 1120 op_code = WSC_Done; 1121 break; 1122 } 1123 } 1124 wps_er_sta_process(sta, msg, op_code); 1125 } 1126} 1127 1128 1129static void wps_er_process_wlanevent(struct wps_er_ap *ap, 1130 struct wpabuf *event) 1131{ 1132 u8 *data; 1133 u8 wlan_event_type; 1134 u8 wlan_event_mac[ETH_ALEN]; 1135 struct wpabuf msg; 1136 1137 wpa_hexdump(MSG_MSGDUMP, "WPS ER: Received WLANEvent", 1138 wpabuf_head(event), wpabuf_len(event)); 1139 if (wpabuf_len(event) < 1 + 17) { 1140 wpa_printf(MSG_DEBUG, "WPS ER: Too short WLANEvent"); 1141 return; 1142 } 1143 1144 data = wpabuf_mhead(event); 1145 wlan_event_type = data[0]; 1146 if (hwaddr_aton((char *) data + 1, wlan_event_mac) < 0) { 1147 wpa_printf(MSG_DEBUG, "WPS ER: Invalid WLANEventMAC in " 1148 "WLANEvent"); 1149 return; 1150 } 1151 1152 wpabuf_set(&msg, data + 1 + 17, wpabuf_len(event) - (1 + 17)); 1153 1154 switch (wlan_event_type) { 1155 case 1: 1156 wps_er_process_wlanevent_probe_req(ap, wlan_event_mac, &msg); 1157 break; 1158 case 2: 1159 wps_er_process_wlanevent_eap(ap, wlan_event_mac, &msg); 1160 break; 1161 default: 1162 wpa_printf(MSG_DEBUG, "WPS ER: Unknown WLANEventType %d", 1163 wlan_event_type); 1164 break; 1165 } 1166} 1167 1168 1169static void wps_er_http_event(struct wps_er *er, struct http_request *req, 1170 unsigned int ap_id) 1171{ 1172 struct wps_er_ap *ap = wps_er_ap_get_id(er, ap_id); 1173 struct wpabuf *event; 1174 enum http_reply_code ret; 1175 1176 if (ap == NULL) { 1177 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event from unknown AP id " 1178 "%u", ap_id); 1179 wps_er_http_resp_not_found(req); 1180 return; 1181 } 1182 wpa_printf(MSG_MSGDUMP, "WPS ER: HTTP event from AP id %u: %s", 1183 ap_id, http_request_get_data(req)); 1184 1185 event = xml_get_base64_item(http_request_get_data(req), "WLANEvent", 1186 &ret); 1187 if (event == NULL) { 1188 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract WLANEvent " 1189 "from the event notification"); 1190 /* 1191 * Reply with OK anyway to avoid getting unregistered from 1192 * events. 1193 */ 1194 wps_er_http_resp_ok(req); 1195 return; 1196 } 1197 1198 wps_er_process_wlanevent(ap, event); 1199 1200 wpabuf_free(event); 1201 wps_er_http_resp_ok(req); 1202} 1203 1204 1205static void wps_er_http_notify(struct wps_er *er, struct http_request *req) 1206{ 1207 char *uri = http_request_get_uri(req); 1208 1209 if (os_strncmp(uri, "/event/", 7) == 0) { 1210 unsigned int event_id; 1211 char *pos; 1212 event_id = atoi(uri + 7); 1213 if (event_id != er->event_id) { 1214 wpa_printf(MSG_DEBUG, "WPS ER: HTTP event for an " 1215 "unknown event id %u", event_id); 1216 return; 1217 } 1218 pos = os_strchr(uri + 7, '/'); 1219 if (pos == NULL) 1220 return; 1221 pos++; 1222 wps_er_http_event(er, req, atoi(pos)); 1223 } else { 1224 wpa_printf(MSG_DEBUG, "WPS ER: Unknown HTTP NOTIFY for '%s'", 1225 uri); 1226 wps_er_http_resp_not_found(req); 1227 } 1228} 1229 1230 1231static void wps_er_http_req(void *ctx, struct http_request *req) 1232{ 1233 struct wps_er *er = ctx; 1234 struct sockaddr_in *cli = http_request_get_cli_addr(req); 1235 enum httpread_hdr_type type = http_request_get_type(req); 1236 struct wpabuf *buf; 1237 1238 wpa_printf(MSG_DEBUG, "WPS ER: HTTP request: '%s' (type %d) from " 1239 "%s:%d", 1240 http_request_get_uri(req), type, 1241 inet_ntoa(cli->sin_addr), ntohs(cli->sin_port)); 1242 1243 switch (type) { 1244 case HTTPREAD_HDR_TYPE_NOTIFY: 1245 wps_er_http_notify(er, req); 1246 break; 1247 default: 1248 wpa_printf(MSG_DEBUG, "WPS ER: Unsupported HTTP request type " 1249 "%d", type); 1250 buf = wpabuf_alloc(200); 1251 if (buf == NULL) { 1252 http_request_deinit(req); 1253 return; 1254 } 1255 wpabuf_put_str(buf, 1256 "HTTP/1.1 501 Unimplemented\r\n" 1257 "Connection: close\r\n"); 1258 http_put_date(buf); 1259 wpabuf_put_str(buf, "\r\n"); 1260 http_request_send_and_deinit(req, buf); 1261 break; 1262 } 1263} 1264 1265 1266struct wps_er * 1267wps_er_init(struct wps_context *wps, const char *ifname, const char *filter) 1268{ 1269 struct wps_er *er; 1270 struct in_addr addr; 1271 1272 er = os_zalloc(sizeof(*er)); 1273 if (er == NULL) 1274 return NULL; 1275 dl_list_init(&er->ap); 1276 dl_list_init(&er->ap_unsubscribing); 1277 dl_list_init(&er->ap_settings); 1278 1279 er->multicast_sd = -1; 1280 er->ssdp_sd = -1; 1281 1282 os_strlcpy(er->ifname, ifname, sizeof(er->ifname)); 1283 er->wps = wps; 1284 if (os_get_random((unsigned char *) &er->event_id, 1285 sizeof(er->event_id)) < 0) { 1286 wps_er_deinit(er, NULL, NULL); 1287 return NULL; 1288 } 1289 /* Limit event_id to < 32 bits to avoid issues with atoi() */ 1290 er->event_id &= 0x0fffffff; 1291 1292 if (filter) { 1293 if (inet_aton(filter, &er->filter_addr) == 0) { 1294 wpa_printf(MSG_INFO, "WPS UPnP: Invalid filter " 1295 "address %s", filter); 1296 wps_er_deinit(er, NULL, NULL); 1297 return NULL; 1298 } 1299 wpa_printf(MSG_DEBUG, "WPS UPnP: Only accepting connections " 1300 "with %s", filter); 1301 } 1302 if (get_netif_info(ifname, &er->ip_addr, &er->ip_addr_text, 1303 er->mac_addr)) { 1304 wpa_printf(MSG_INFO, "WPS UPnP: Could not get IP/MAC address " 1305 "for %s. Does it have IP address?", ifname); 1306 wps_er_deinit(er, NULL, NULL); 1307 return NULL; 1308 } 1309 1310 if (wps_er_ssdp_init(er) < 0) { 1311 wpa_printf(MSG_INFO, "WPS UPnP: SSDP initialization failed"); 1312 wps_er_deinit(er, NULL, NULL); 1313 return NULL; 1314 } 1315 1316 addr.s_addr = er->ip_addr; 1317 er->http_srv = http_server_init(&addr, -1, wps_er_http_req, er); 1318 if (er->http_srv == NULL) { 1319 wpa_printf(MSG_INFO, "WPS UPnP: HTTP initialization failed"); 1320 wps_er_deinit(er, NULL, NULL); 1321 return NULL; 1322 } 1323 er->http_port = http_server_get_port(er->http_srv); 1324 1325 wpa_printf(MSG_DEBUG, "WPS ER: Start (ifname=%s ip_addr=%s)", 1326 er->ifname, er->ip_addr_text); 1327 1328 return er; 1329} 1330 1331 1332void wps_er_refresh(struct wps_er *er) 1333{ 1334 struct wps_er_ap *ap; 1335 struct wps_er_sta *sta; 1336 1337 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1338 wps_er_ap_event(er->wps, ap, WPS_EV_ER_AP_ADD); 1339 dl_list_for_each(sta, &ap->sta, struct wps_er_sta, list) 1340 wps_er_sta_event(er->wps, sta, WPS_EV_ER_ENROLLEE_ADD); 1341 } 1342 1343 wps_er_send_ssdp_msearch(er); 1344} 1345 1346 1347static void wps_er_deinit_finish(void *eloop_data, void *user_ctx) 1348{ 1349 struct wps_er *er = eloop_data; 1350 void (*deinit_done_cb)(void *ctx); 1351 void *deinit_done_ctx; 1352 1353 wpa_printf(MSG_DEBUG, "WPS ER: Finishing deinit"); 1354 1355 deinit_done_cb = er->deinit_done_cb; 1356 deinit_done_ctx = er->deinit_done_ctx; 1357 os_free(er->ip_addr_text); 1358 os_free(er); 1359 1360 if (deinit_done_cb) 1361 deinit_done_cb(deinit_done_ctx); 1362} 1363 1364 1365void wps_er_deinit(struct wps_er *er, void (*cb)(void *ctx), void *ctx) 1366{ 1367 if (er == NULL) 1368 return; 1369 http_server_deinit(er->http_srv); 1370 wps_er_ap_remove_all(er); 1371 wps_er_ssdp_deinit(er); 1372 eloop_register_timeout(dl_list_empty(&er->ap_unsubscribing) ? 0 : 5, 0, 1373 wps_er_deinit_finish, er, NULL); 1374 wpa_printf(MSG_DEBUG, "WPS ER: Finish deinit from timeout"); 1375 er->deinitializing = 1; 1376 er->deinit_done_cb = cb; 1377 er->deinit_done_ctx = ctx; 1378} 1379 1380 1381static void wps_er_http_set_sel_reg_cb(void *ctx, struct http_client *c, 1382 enum http_client_event event) 1383{ 1384 struct wps_er_ap *ap = ctx; 1385 union wps_event_data data; 1386 1387 os_memset(&data, 0, sizeof(data)); 1388 1389 switch (event) { 1390 case HTTP_CLIENT_OK: 1391 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar OK"); 1392 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_DONE; 1393 data.set_sel_reg.uuid = ap->uuid; 1394 break; 1395 case HTTP_CLIENT_FAILED: 1396 case HTTP_CLIENT_INVALID_REPLY: 1397 case HTTP_CLIENT_TIMEOUT: 1398 wpa_printf(MSG_DEBUG, "WPS ER: SetSelectedRegistrar failed"); 1399 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_FAILED; 1400 data.set_sel_reg.uuid = ap->uuid; 1401 break; 1402 } 1403 http_client_free(ap->http); 1404 ap->http = NULL; 1405 1406 if (data.set_sel_reg.uuid) 1407 ap->er->wps->event_cb(ap->er->wps->cb_ctx, 1408 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); 1409} 1410 1411 1412static void wps_er_send_set_sel_reg(struct wps_er_ap *ap, struct wpabuf *msg) 1413{ 1414 struct wpabuf *buf; 1415 char *len_ptr, *body_ptr; 1416 struct sockaddr_in dst; 1417 char *url, *path; 1418 1419 if (ap->control_url == NULL) { 1420 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1421 return; 1422 } 1423 1424 if (ap->http) { 1425 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP request for AP - " 1426 "ignore new request"); 1427 return; 1428 } 1429 1430 if (ap->wps) { 1431 wpa_printf(MSG_DEBUG, "WPS ER: Pending WPS operation for AP - " 1432 "skip SetSelectedRegistrar"); 1433 return; 1434 } 1435 1436 url = http_client_url_parse(ap->control_url, &dst, &path); 1437 if (url == NULL) { 1438 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1439 return; 1440 } 1441 1442 buf = wps_er_soap_hdr(msg, "SetSelectedRegistrar", "NewMessage", path, 1443 &dst, &len_ptr, &body_ptr); 1444 os_free(url); 1445 if (buf == NULL) 1446 return; 1447 1448 wps_er_soap_end(buf, "SetSelectedRegistrar", len_ptr, body_ptr); 1449 1450 ap->http = http_client_addr(&dst, buf, 1000, 1451 wps_er_http_set_sel_reg_cb, ap); 1452 if (ap->http == NULL) 1453 wpabuf_free(buf); 1454} 1455 1456 1457static int wps_er_build_selected_registrar(struct wpabuf *msg, int sel_reg) 1458{ 1459 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR); 1460 wpabuf_put_be16(msg, 1); 1461 wpabuf_put_u8(msg, !!sel_reg); 1462 return 0; 1463} 1464 1465 1466static int wps_er_build_dev_password_id(struct wpabuf *msg, u16 dev_passwd_id) 1467{ 1468 wpabuf_put_be16(msg, ATTR_DEV_PASSWORD_ID); 1469 wpabuf_put_be16(msg, 2); 1470 wpabuf_put_be16(msg, dev_passwd_id); 1471 return 0; 1472} 1473 1474 1475static int wps_er_build_sel_reg_config_methods(struct wpabuf *msg, 1476 u16 sel_reg_config_methods) 1477{ 1478 wpabuf_put_be16(msg, ATTR_SELECTED_REGISTRAR_CONFIG_METHODS); 1479 wpabuf_put_be16(msg, 2); 1480 wpabuf_put_be16(msg, sel_reg_config_methods); 1481 return 0; 1482} 1483 1484 1485static int wps_er_build_uuid_r(struct wpabuf *msg, const u8 *uuid_r) 1486{ 1487#ifdef CONFIG_WPS2 1488 wpabuf_put_be16(msg, ATTR_UUID_R); 1489 wpabuf_put_be16(msg, WPS_UUID_LEN); 1490 wpabuf_put_data(msg, uuid_r, WPS_UUID_LEN); 1491#endif /* CONFIG_WPS2 */ 1492 return 0; 1493} 1494 1495 1496void wps_er_set_sel_reg(struct wps_er *er, int sel_reg, u16 dev_passwd_id, 1497 u16 sel_reg_config_methods) 1498{ 1499 struct wpabuf *msg; 1500 struct wps_er_ap *ap; 1501 struct wps_registrar *reg = er->wps->registrar; 1502 const u8 *auth_macs; 1503#ifdef CONFIG_WPS2 1504 u8 bcast[ETH_ALEN]; 1505#endif /* CONFIG_WPS2 */ 1506 size_t count; 1507 union wps_event_data data; 1508 1509 if (er->skip_set_sel_reg) { 1510 wpa_printf(MSG_DEBUG, "WPS ER: Skip SetSelectedRegistrar"); 1511 return; 1512 } 1513 1514 msg = wpabuf_alloc(500); 1515 if (msg == NULL) 1516 return; 1517 1518 auth_macs = wps_authorized_macs(reg, &count); 1519#ifdef CONFIG_WPS2 1520 if (count == 0) { 1521 os_memset(bcast, 0xff, ETH_ALEN); 1522 auth_macs = bcast; 1523 count = 1; 1524 } 1525#endif /* CONFIG_WPS2 */ 1526 1527 if (wps_build_version(msg) || 1528 wps_er_build_selected_registrar(msg, sel_reg) || 1529 wps_er_build_dev_password_id(msg, dev_passwd_id) || 1530 wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) || 1531 wps_build_wfa_ext(msg, 0, auth_macs, count) || 1532 wps_er_build_uuid_r(msg, er->wps->uuid)) { 1533 wpabuf_free(msg); 1534 return; 1535 } 1536 1537 os_memset(&data, 0, sizeof(data)); 1538 data.set_sel_reg.sel_reg = sel_reg; 1539 data.set_sel_reg.dev_passwd_id = dev_passwd_id; 1540 data.set_sel_reg.sel_reg_config_methods = sel_reg_config_methods; 1541 data.set_sel_reg.state = WPS_ER_SET_SEL_REG_START; 1542 1543 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1544 if (er->set_sel_reg_uuid_filter && 1545 os_memcmp(ap->uuid, er->set_sel_reg_uuid_filter, 1546 WPS_UUID_LEN) != 0) 1547 continue; 1548 data.set_sel_reg.uuid = ap->uuid; 1549 er->wps->event_cb(er->wps->cb_ctx, 1550 WPS_EV_ER_SET_SELECTED_REGISTRAR, &data); 1551 wps_er_send_set_sel_reg(ap, msg); 1552 } 1553 1554 wpabuf_free(msg); 1555} 1556 1557 1558int wps_er_pbc(struct wps_er *er, const u8 *uuid) 1559{ 1560 int res; 1561 struct wps_er_ap *ap; 1562 1563 if (er == NULL || er->wps == NULL) 1564 return -1; 1565 1566 if (wps_registrar_pbc_overlap(er->wps->registrar, NULL, NULL)) { 1567 wpa_printf(MSG_DEBUG, "WPS ER: PBC overlap - do not start PBC " 1568 "mode"); 1569 return -2; 1570 } 1571 1572 ap = wps_er_ap_get(er, NULL, uuid); 1573 if (ap == NULL) { 1574 struct wps_er_sta *sta = NULL; 1575 dl_list_for_each(ap, &er->ap, struct wps_er_ap, list) { 1576 sta = wps_er_sta_get(ap, NULL, uuid); 1577 if (sta) { 1578 uuid = ap->uuid; 1579 break; 1580 } 1581 } 1582 if (sta == NULL) 1583 return -3; /* Unknown UUID */ 1584 } 1585 1586 if (ap->ap_settings == NULL) { 1587 wpa_printf(MSG_DEBUG, "WPS ER: AP settings not known"); 1588 return -4; 1589 } 1590 1591 er->set_sel_reg_uuid_filter = uuid; 1592 res = wps_registrar_button_pushed(er->wps->registrar, NULL); 1593 er->set_sel_reg_uuid_filter = NULL; 1594 if (res) 1595 return -1; 1596 1597 return 0; 1598} 1599 1600 1601static void wps_er_ap_settings_cb(void *ctx, const struct wps_credential *cred) 1602{ 1603 struct wps_er_ap *ap = ctx; 1604 union wps_event_data data; 1605 1606 wpa_printf(MSG_DEBUG, "WPS ER: AP Settings received"); 1607 os_free(ap->ap_settings); 1608 ap->ap_settings = os_malloc(sizeof(*cred)); 1609 if (ap->ap_settings) { 1610 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 1611 ap->ap_settings->cred_attr = NULL; 1612 } 1613 1614 os_memset(&data, 0, sizeof(data)); 1615 data.ap_settings.uuid = ap->uuid; 1616 data.ap_settings.cred = cred; 1617 ap->er->wps->event_cb(ap->er->wps->cb_ctx, WPS_EV_ER_AP_SETTINGS, 1618 &data); 1619} 1620 1621 1622static void wps_er_http_put_message_cb(void *ctx, struct http_client *c, 1623 enum http_client_event event) 1624{ 1625 struct wps_er_ap *ap = ctx; 1626 struct wpabuf *reply; 1627 char *msg = NULL; 1628 1629 switch (event) { 1630 case HTTP_CLIENT_OK: 1631 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage OK"); 1632 reply = http_client_get_body(c); 1633 if (reply == NULL) 1634 break; 1635 msg = os_zalloc(wpabuf_len(reply) + 1); 1636 if (msg == NULL) 1637 break; 1638 os_memcpy(msg, wpabuf_head(reply), wpabuf_len(reply)); 1639 break; 1640 case HTTP_CLIENT_FAILED: 1641 case HTTP_CLIENT_INVALID_REPLY: 1642 case HTTP_CLIENT_TIMEOUT: 1643 wpa_printf(MSG_DEBUG, "WPS ER: PutMessage failed"); 1644 if (ap->wps) { 1645 wps_deinit(ap->wps); 1646 ap->wps = NULL; 1647 } 1648 break; 1649 } 1650 http_client_free(ap->http); 1651 ap->http = NULL; 1652 1653 if (msg) { 1654 struct wpabuf *buf; 1655 enum http_reply_code ret; 1656 buf = xml_get_base64_item(msg, "NewOutMessage", &ret); 1657 os_free(msg); 1658 if (buf == NULL) { 1659 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " 1660 "NewOutMessage from PutMessage response"); 1661 wps_deinit(ap->wps); 1662 ap->wps = NULL; 1663 return; 1664 } 1665 wps_er_ap_process(ap, buf); 1666 wpabuf_free(buf); 1667 } 1668} 1669 1670 1671static void wps_er_ap_put_message(struct wps_er_ap *ap, 1672 const struct wpabuf *msg) 1673{ 1674 struct wpabuf *buf; 1675 char *len_ptr, *body_ptr; 1676 struct sockaddr_in dst; 1677 char *url, *path; 1678 1679 if (ap->http) { 1680 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " 1681 "with the AP - cannot continue learn"); 1682 return; 1683 } 1684 1685 if (ap->control_url == NULL) { 1686 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1687 return; 1688 } 1689 1690 url = http_client_url_parse(ap->control_url, &dst, &path); 1691 if (url == NULL) { 1692 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1693 return; 1694 } 1695 1696 buf = wps_er_soap_hdr(msg, "PutMessage", "NewInMessage", path, &dst, 1697 &len_ptr, &body_ptr); 1698 os_free(url); 1699 if (buf == NULL) 1700 return; 1701 1702 wps_er_soap_end(buf, "PutMessage", len_ptr, body_ptr); 1703 1704 ap->http = http_client_addr(&dst, buf, 10000, 1705 wps_er_http_put_message_cb, ap); 1706 if (ap->http == NULL) 1707 wpabuf_free(buf); 1708} 1709 1710 1711static void wps_er_ap_process(struct wps_er_ap *ap, struct wpabuf *msg) 1712{ 1713 enum wps_process_res res; 1714 struct wps_parse_attr attr; 1715 enum wsc_op_code op_code; 1716 1717 op_code = WSC_MSG; 1718 if (wps_parse_msg(msg, &attr) == 0 && attr.msg_type) { 1719 switch (*attr.msg_type) { 1720 case WPS_WSC_ACK: 1721 op_code = WSC_ACK; 1722 break; 1723 case WPS_WSC_NACK: 1724 op_code = WSC_NACK; 1725 break; 1726 case WPS_WSC_DONE: 1727 op_code = WSC_Done; 1728 break; 1729 } 1730 } 1731 1732 res = wps_process_msg(ap->wps, op_code, msg); 1733 if (res == WPS_CONTINUE) { 1734 struct wpabuf *next = wps_get_msg(ap->wps, &op_code); 1735 if (next) { 1736 wps_er_ap_put_message(ap, next); 1737 wpabuf_free(next); 1738 } else { 1739 wpa_printf(MSG_DEBUG, "WPS ER: Failed to build " 1740 "message"); 1741 wps_deinit(ap->wps); 1742 ap->wps = NULL; 1743 } 1744 } else if (res == WPS_DONE) { 1745 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run done"); 1746 wps_deinit(ap->wps); 1747 ap->wps = NULL; 1748 } else { 1749 wpa_printf(MSG_DEBUG, "WPS ER: Failed to process message from " 1750 "AP (res=%d)", res); 1751 wps_deinit(ap->wps); 1752 ap->wps = NULL; 1753 } 1754} 1755 1756 1757static void wps_er_ap_learn_m1(struct wps_er_ap *ap, struct wpabuf *m1) 1758{ 1759 struct wps_config cfg; 1760 1761 if (ap->wps) { 1762 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " 1763 "progress with this AP"); 1764 return; 1765 } 1766 1767 os_memset(&cfg, 0, sizeof(cfg)); 1768 cfg.wps = ap->er->wps; 1769 cfg.registrar = 1; 1770 ap->wps = wps_init(&cfg); 1771 if (ap->wps == NULL) 1772 return; 1773 ap->wps->ap_settings_cb = wps_er_ap_settings_cb; 1774 ap->wps->ap_settings_cb_ctx = ap; 1775 1776 wps_er_ap_process(ap, m1); 1777} 1778 1779 1780static void wps_er_ap_learn(struct wps_er_ap *ap, const char *dev_info) 1781{ 1782 struct wpabuf *info; 1783 enum http_reply_code ret; 1784 1785 wpa_printf(MSG_DEBUG, "WPS ER: Received GetDeviceInfo response (M1) " 1786 "from the AP"); 1787 info = xml_get_base64_item(dev_info, "NewDeviceInfo", &ret); 1788 if (info == NULL) { 1789 wpa_printf(MSG_DEBUG, "WPS ER: Could not extract " 1790 "NewDeviceInfo from GetDeviceInfo response"); 1791 return; 1792 } 1793 1794 ap->m1_handler(ap, info); 1795 wpabuf_free(info); 1796} 1797 1798 1799static void wps_er_http_get_dev_info_cb(void *ctx, struct http_client *c, 1800 enum http_client_event event) 1801{ 1802 struct wps_er_ap *ap = ctx; 1803 struct wpabuf *reply; 1804 char *dev_info = NULL; 1805 1806 switch (event) { 1807 case HTTP_CLIENT_OK: 1808 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo OK"); 1809 reply = http_client_get_body(c); 1810 if (reply == NULL) 1811 break; 1812 dev_info = os_zalloc(wpabuf_len(reply) + 1); 1813 if (dev_info == NULL) 1814 break; 1815 os_memcpy(dev_info, wpabuf_head(reply), wpabuf_len(reply)); 1816 break; 1817 case HTTP_CLIENT_FAILED: 1818 case HTTP_CLIENT_INVALID_REPLY: 1819 case HTTP_CLIENT_TIMEOUT: 1820 wpa_printf(MSG_DEBUG, "WPS ER: GetDeviceInfo failed"); 1821 break; 1822 } 1823 http_client_free(ap->http); 1824 ap->http = NULL; 1825 1826 if (dev_info) { 1827 wps_er_ap_learn(ap, dev_info); 1828 os_free(dev_info); 1829 } 1830} 1831 1832 1833static int wps_er_send_get_device_info(struct wps_er_ap *ap, 1834 void (*m1_handler)(struct wps_er_ap *ap, 1835 struct wpabuf *m1)) 1836{ 1837 struct wpabuf *buf; 1838 char *len_ptr, *body_ptr; 1839 struct sockaddr_in dst; 1840 char *url, *path; 1841 1842 if (ap->http) { 1843 wpa_printf(MSG_DEBUG, "WPS ER: Pending HTTP operation ongoing " 1844 "with the AP - cannot get device info"); 1845 return -1; 1846 } 1847 1848 if (ap->control_url == NULL) { 1849 wpa_printf(MSG_DEBUG, "WPS ER: No controlURL for AP"); 1850 return -1; 1851 } 1852 1853 url = http_client_url_parse(ap->control_url, &dst, &path); 1854 if (url == NULL) { 1855 wpa_printf(MSG_DEBUG, "WPS ER: Failed to parse controlURL"); 1856 return -1; 1857 } 1858 1859 buf = wps_er_soap_hdr(NULL, "GetDeviceInfo", NULL, path, &dst, 1860 &len_ptr, &body_ptr); 1861 os_free(url); 1862 if (buf == NULL) 1863 return -1; 1864 1865 wps_er_soap_end(buf, "GetDeviceInfo", len_ptr, body_ptr); 1866 1867 ap->http = http_client_addr(&dst, buf, 10000, 1868 wps_er_http_get_dev_info_cb, ap); 1869 if (ap->http == NULL) { 1870 wpabuf_free(buf); 1871 return -1; 1872 } 1873 1874 ap->m1_handler = m1_handler; 1875 1876 return 0; 1877} 1878 1879 1880int wps_er_learn(struct wps_er *er, const u8 *uuid, const u8 *pin, 1881 size_t pin_len) 1882{ 1883 struct wps_er_ap *ap; 1884 1885 if (er == NULL) 1886 return -1; 1887 1888 ap = wps_er_ap_get(er, NULL, uuid); 1889 if (ap == NULL) { 1890 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for learn " 1891 "request"); 1892 return -1; 1893 } 1894 if (ap->wps) { 1895 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " 1896 "with the AP - cannot start learn"); 1897 return -1; 1898 } 1899 1900 if (wps_er_send_get_device_info(ap, wps_er_ap_learn_m1) < 0) 1901 return -1; 1902 1903 er->skip_set_sel_reg = 1; 1904 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); 1905 er->skip_set_sel_reg = 0; 1906 1907 return 0; 1908} 1909 1910 1911int wps_er_set_config(struct wps_er *er, const u8 *uuid, 1912 const struct wps_credential *cred) 1913{ 1914 struct wps_er_ap *ap; 1915 1916 if (er == NULL) 1917 return -1; 1918 1919 ap = wps_er_ap_get(er, NULL, uuid); 1920 if (ap == NULL) { 1921 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for set config " 1922 "request"); 1923 return -1; 1924 } 1925 1926 os_free(ap->ap_settings); 1927 ap->ap_settings = os_malloc(sizeof(*cred)); 1928 if (ap->ap_settings == NULL) 1929 return -1; 1930 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 1931 ap->ap_settings->cred_attr = NULL; 1932 wpa_printf(MSG_DEBUG, "WPS ER: Updated local AP settings based set " 1933 "config request"); 1934 1935 return 0; 1936} 1937 1938 1939static void wps_er_ap_config_m1(struct wps_er_ap *ap, struct wpabuf *m1) 1940{ 1941 struct wps_config cfg; 1942 1943 if (ap->wps) { 1944 wpa_printf(MSG_DEBUG, "WPS ER: Protocol run already in " 1945 "progress with this AP"); 1946 return; 1947 } 1948 1949 os_memset(&cfg, 0, sizeof(cfg)); 1950 cfg.wps = ap->er->wps; 1951 cfg.registrar = 1; 1952 cfg.new_ap_settings = ap->ap_settings; 1953 ap->wps = wps_init(&cfg); 1954 if (ap->wps == NULL) 1955 return; 1956 ap->wps->ap_settings_cb = NULL; 1957 ap->wps->ap_settings_cb_ctx = NULL; 1958 1959 wps_er_ap_process(ap, m1); 1960} 1961 1962 1963int wps_er_config(struct wps_er *er, const u8 *uuid, const u8 *pin, 1964 size_t pin_len, const struct wps_credential *cred) 1965{ 1966 struct wps_er_ap *ap; 1967 1968 if (er == NULL) 1969 return -1; 1970 1971 ap = wps_er_ap_get(er, NULL, uuid); 1972 if (ap == NULL) { 1973 wpa_printf(MSG_DEBUG, "WPS ER: AP not found for config " 1974 "request"); 1975 return -1; 1976 } 1977 if (ap->wps) { 1978 wpa_printf(MSG_DEBUG, "WPS ER: Pending operation ongoing " 1979 "with the AP - cannot start config"); 1980 return -1; 1981 } 1982 1983 os_free(ap->ap_settings); 1984 ap->ap_settings = os_malloc(sizeof(*cred)); 1985 if (ap->ap_settings == NULL) 1986 return -1; 1987 os_memcpy(ap->ap_settings, cred, sizeof(*cred)); 1988 ap->ap_settings->cred_attr = NULL; 1989 1990 if (wps_er_send_get_device_info(ap, wps_er_ap_config_m1) < 0) 1991 return -1; 1992 1993 er->skip_set_sel_reg = 1; 1994 wps_registrar_add_pin(er->wps->registrar, NULL, uuid, pin, pin_len, 0); 1995 er->skip_set_sel_reg = 0; 1996 1997 return 0; 1998} 1999