1 /* 2 * UPnP WPS Device - Web connections 3 * Copyright (c) 2000-2003 Intel Corporation 4 * Copyright (c) 2006-2007 Sony Corporation 5 * Copyright (c) 2008-2009 Atheros Communications 6 * Copyright (c) 2009, Jouni Malinen <j@w1.fi> 7 * 8 * See wps_upnp.c for more details on licensing and code history. 9 */ 10 11 #include "includes.h" 12 13 #include "common.h" 14 #include "base64.h" 15 #include "uuid.h" 16 #include "httpread.h" 17 #include "http_server.h" 18 #include "wps_i.h" 19 #include "wps_upnp.h" 20 #include "wps_upnp_i.h" 21 #include "upnp_xml.h" 22 23 /*************************************************************************** 24 * Web connections (we serve pages of info about ourselves, handle 25 * requests, etc. etc.). 26 **************************************************************************/ 27 28 #define WEB_CONNECTION_TIMEOUT_SEC 30 /* Drop web connection after t.o. */ 29 #define WEB_CONNECTION_MAX_READ 8000 /* Max we'll read for TCP request */ 30 #define MAX_WEB_CONNECTIONS 10 /* max simultaneous web connects */ 31 32 33 static const char *urn_wfawlanconfig = 34 "urn:schemas-wifialliance-org:service:WFAWLANConfig:1"; 35 static const char *http_server_hdr = 36 "Server: unspecified, UPnP/1.0, unspecified\r\n"; 37 static const char *http_connection_close = 38 "Connection: close\r\n"; 39 40 /* 41 * "Files" that we serve via HTTP. The format of these files is given by 42 * WFA WPS specifications. Extra white space has been removed to save space. 43 */ 44 45 static const char wps_scpd_xml[] = 46 "<?xml version=\"1.0\"?>\n" 47 "<scpd xmlns=\"urn:schemas-upnp-org:service-1-0\">\n" 48 "<specVersion><major>1</major><minor>0</minor></specVersion>\n" 49 "<actionList>\n" 50 "<action>\n" 51 "<name>GetDeviceInfo</name>\n" 52 "<argumentList>\n" 53 "<argument>\n" 54 "<name>NewDeviceInfo</name>\n" 55 "<direction>out</direction>\n" 56 "<relatedStateVariable>DeviceInfo</relatedStateVariable>\n" 57 "</argument>\n" 58 "</argumentList>\n" 59 "</action>\n" 60 "<action>\n" 61 "<name>PutMessage</name>\n" 62 "<argumentList>\n" 63 "<argument>\n" 64 "<name>NewInMessage</name>\n" 65 "<direction>in</direction>\n" 66 "<relatedStateVariable>InMessage</relatedStateVariable>\n" 67 "</argument>\n" 68 "<argument>\n" 69 "<name>NewOutMessage</name>\n" 70 "<direction>out</direction>\n" 71 "<relatedStateVariable>OutMessage</relatedStateVariable>\n" 72 "</argument>\n" 73 "</argumentList>\n" 74 "</action>\n" 75 "<action>\n" 76 "<name>PutWLANResponse</name>\n" 77 "<argumentList>\n" 78 "<argument>\n" 79 "<name>NewMessage</name>\n" 80 "<direction>in</direction>\n" 81 "<relatedStateVariable>Message</relatedStateVariable>\n" 82 "</argument>\n" 83 "<argument>\n" 84 "<name>NewWLANEventType</name>\n" 85 "<direction>in</direction>\n" 86 "<relatedStateVariable>WLANEventType</relatedStateVariable>\n" 87 "</argument>\n" 88 "<argument>\n" 89 "<name>NewWLANEventMAC</name>\n" 90 "<direction>in</direction>\n" 91 "<relatedStateVariable>WLANEventMAC</relatedStateVariable>\n" 92 "</argument>\n" 93 "</argumentList>\n" 94 "</action>\n" 95 "<action>\n" 96 "<name>SetSelectedRegistrar</name>\n" 97 "<argumentList>\n" 98 "<argument>\n" 99 "<name>NewMessage</name>\n" 100 "<direction>in</direction>\n" 101 "<relatedStateVariable>Message</relatedStateVariable>\n" 102 "</argument>\n" 103 "</argumentList>\n" 104 "</action>\n" 105 "</actionList>\n" 106 "<serviceStateTable>\n" 107 "<stateVariable sendEvents=\"no\">\n" 108 "<name>Message</name>\n" 109 "<dataType>bin.base64</dataType>\n" 110 "</stateVariable>\n" 111 "<stateVariable sendEvents=\"no\">\n" 112 "<name>InMessage</name>\n" 113 "<dataType>bin.base64</dataType>\n" 114 "</stateVariable>\n" 115 "<stateVariable sendEvents=\"no\">\n" 116 "<name>OutMessage</name>\n" 117 "<dataType>bin.base64</dataType>\n" 118 "</stateVariable>\n" 119 "<stateVariable sendEvents=\"no\">\n" 120 "<name>DeviceInfo</name>\n" 121 "<dataType>bin.base64</dataType>\n" 122 "</stateVariable>\n" 123 "<stateVariable sendEvents=\"yes\">\n" 124 "<name>APStatus</name>\n" 125 "<dataType>ui1</dataType>\n" 126 "</stateVariable>\n" 127 "<stateVariable sendEvents=\"yes\">\n" 128 "<name>STAStatus</name>\n" 129 "<dataType>ui1</dataType>\n" 130 "</stateVariable>\n" 131 "<stateVariable sendEvents=\"yes\">\n" 132 "<name>WLANEvent</name>\n" 133 "<dataType>bin.base64</dataType>\n" 134 "</stateVariable>\n" 135 "<stateVariable sendEvents=\"no\">\n" 136 "<name>WLANEventType</name>\n" 137 "<dataType>ui1</dataType>\n" 138 "</stateVariable>\n" 139 "<stateVariable sendEvents=\"no\">\n" 140 "<name>WLANEventMAC</name>\n" 141 "<dataType>string</dataType>\n" 142 "</stateVariable>\n" 143 "<stateVariable sendEvents=\"no\">\n" 144 "<name>WLANResponse</name>\n" 145 "<dataType>bin.base64</dataType>\n" 146 "</stateVariable>\n" 147 "</serviceStateTable>\n" 148 "</scpd>\n" 149 ; 150 151 152 static const char *wps_device_xml_prefix = 153 "<?xml version=\"1.0\"?>\n" 154 "<root xmlns=\"urn:schemas-upnp-org:device-1-0\">\n" 155 "<specVersion>\n" 156 "<major>1</major>\n" 157 "<minor>0</minor>\n" 158 "</specVersion>\n" 159 "<device>\n" 160 "<deviceType>urn:schemas-wifialliance-org:device:WFADevice:1" 161 "</deviceType>\n"; 162 163 static const char *wps_device_xml_postfix = 164 "<serviceList>\n" 165 "<service>\n" 166 "<serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1" 167 "</serviceType>\n" 168 "<serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>" 169 "\n" 170 "<SCPDURL>" UPNP_WPS_SCPD_XML_FILE "</SCPDURL>\n" 171 "<controlURL>" UPNP_WPS_DEVICE_CONTROL_FILE "</controlURL>\n" 172 "<eventSubURL>" UPNP_WPS_DEVICE_EVENT_FILE "</eventSubURL>\n" 173 "</service>\n" 174 "</serviceList>\n" 175 "</device>\n" 176 "</root>\n"; 177 178 179 /* format_wps_device_xml -- produce content of "file" wps_device.xml 180 * (UPNP_WPS_DEVICE_XML_FILE) 181 */ 182 static void format_wps_device_xml(struct upnp_wps_device_sm *sm, 183 struct wpabuf *buf) 184 { 185 const char *s; 186 char uuid_string[80]; 187 struct upnp_wps_device_interface *iface; 188 189 iface = dl_list_first(&sm->interfaces, 190 struct upnp_wps_device_interface, list); 191 192 wpabuf_put_str(buf, wps_device_xml_prefix); 193 194 /* 195 * Add required fields with default values if not configured. Add 196 * optional and recommended fields only if configured. 197 */ 198 s = iface->wps->friendly_name; 199 s = ((s && *s) ? s : "WPS Access Point"); 200 xml_add_tagged_data(buf, "friendlyName", s); 201 202 s = iface->wps->dev.manufacturer; 203 s = ((s && *s) ? s : ""); 204 xml_add_tagged_data(buf, "manufacturer", s); 205 206 if (iface->wps->manufacturer_url) 207 xml_add_tagged_data(buf, "manufacturerURL", 208 iface->wps->manufacturer_url); 209 210 if (iface->wps->model_description) 211 xml_add_tagged_data(buf, "modelDescription", 212 iface->wps->model_description); 213 214 s = iface->wps->dev.model_name; 215 s = ((s && *s) ? s : ""); 216 xml_add_tagged_data(buf, "modelName", s); 217 218 if (iface->wps->dev.model_number) 219 xml_add_tagged_data(buf, "modelNumber", 220 iface->wps->dev.model_number); 221 222 if (iface->wps->model_url) 223 xml_add_tagged_data(buf, "modelURL", iface->wps->model_url); 224 225 if (iface->wps->dev.serial_number) 226 xml_add_tagged_data(buf, "serialNumber", 227 iface->wps->dev.serial_number); 228 229 uuid_bin2str(iface->wps->uuid, uuid_string, sizeof(uuid_string)); 230 s = uuid_string; 231 /* Need "uuid:" prefix, thus we can't use xml_add_tagged_data() 232 * easily... 233 */ 234 wpabuf_put_str(buf, "<UDN>uuid:"); 235 xml_data_encode(buf, s, os_strlen(s)); 236 wpabuf_put_str(buf, "</UDN>\n"); 237 238 if (iface->wps->upc) 239 xml_add_tagged_data(buf, "UPC", iface->wps->upc); 240 241 wpabuf_put_str(buf, wps_device_xml_postfix); 242 } 243 244 245 static void http_put_reply_code(struct wpabuf *buf, enum http_reply_code code) 246 { 247 wpabuf_put_str(buf, "HTTP/1.1 "); 248 switch (code) { 249 case HTTP_OK: 250 wpabuf_put_str(buf, "200 OK\r\n"); 251 break; 252 case HTTP_BAD_REQUEST: 253 wpabuf_put_str(buf, "400 Bad request\r\n"); 254 break; 255 case HTTP_PRECONDITION_FAILED: 256 wpabuf_put_str(buf, "412 Precondition failed\r\n"); 257 break; 258 case HTTP_UNIMPLEMENTED: 259 wpabuf_put_str(buf, "501 Unimplemented\r\n"); 260 break; 261 case HTTP_INTERNAL_SERVER_ERROR: 262 default: 263 wpabuf_put_str(buf, "500 Internal server error\r\n"); 264 break; 265 } 266 } 267 268 269 static void http_put_date(struct wpabuf *buf) 270 { 271 wpabuf_put_str(buf, "Date: "); 272 format_date(buf); 273 wpabuf_put_str(buf, "\r\n"); 274 } 275 276 277 static void http_put_empty(struct wpabuf *buf, enum http_reply_code code) 278 { 279 http_put_reply_code(buf, code); 280 wpabuf_put_str(buf, http_server_hdr); 281 wpabuf_put_str(buf, http_connection_close); 282 wpabuf_put_str(buf, "Content-Length: 0\r\n" 283 "\r\n"); 284 } 285 286 287 /* Given that we have received a header w/ GET, act upon it 288 * 289 * Format of GET (case-insensitive): 290 * 291 * First line must be: 292 * GET /<file> HTTP/1.1 293 * Since we don't do anything fancy we just ignore other lines. 294 * 295 * Our response (if no error) which includes only required lines is: 296 * HTTP/1.1 200 OK 297 * Connection: close 298 * Content-Type: text/xml 299 * Date: <rfc1123-date> 300 * 301 * Header lines must end with \r\n 302 * Per RFC 2616, content-length: is not required but connection:close 303 * would appear to be required (given that we will be closing it!). 304 */ 305 static void web_connection_parse_get(struct upnp_wps_device_sm *sm, 306 struct http_request *hreq, char *filename) 307 { 308 struct wpabuf *buf; /* output buffer, allocated */ 309 char *put_length_here; 310 char *body_start; 311 enum { 312 GET_DEVICE_XML_FILE, 313 GET_SCPD_XML_FILE 314 } req; 315 size_t extra_len = 0; 316 int body_length; 317 char len_buf[10]; 318 struct upnp_wps_device_interface *iface; 319 320 iface = dl_list_first(&sm->interfaces, 321 struct upnp_wps_device_interface, list); 322 323 /* 324 * It is not required that filenames be case insensitive but it is 325 * allowed and cannot hurt here. 326 */ 327 if (filename == NULL) 328 filename = "(null)"; /* just in case */ 329 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_XML_FILE) == 0) { 330 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for device XML"); 331 req = GET_DEVICE_XML_FILE; 332 extra_len = 3000; 333 if (iface->wps->friendly_name) 334 extra_len += os_strlen(iface->wps->friendly_name); 335 if (iface->wps->manufacturer_url) 336 extra_len += os_strlen(iface->wps->manufacturer_url); 337 if (iface->wps->model_description) 338 extra_len += os_strlen(iface->wps->model_description); 339 if (iface->wps->model_url) 340 extra_len += os_strlen(iface->wps->model_url); 341 if (iface->wps->upc) 342 extra_len += os_strlen(iface->wps->upc); 343 } else if (!os_strcasecmp(filename, UPNP_WPS_SCPD_XML_FILE)) { 344 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for SCPD XML"); 345 req = GET_SCPD_XML_FILE; 346 extra_len = os_strlen(wps_scpd_xml); 347 } else { 348 /* File not found */ 349 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET file not found: %s", 350 filename); 351 buf = wpabuf_alloc(200); 352 if (buf == NULL) { 353 http_request_deinit(hreq); 354 return; 355 } 356 wpabuf_put_str(buf, 357 "HTTP/1.1 404 Not Found\r\n" 358 "Connection: close\r\n"); 359 360 http_put_date(buf); 361 362 /* terminating empty line */ 363 wpabuf_put_str(buf, "\r\n"); 364 365 goto send_buf; 366 } 367 368 buf = wpabuf_alloc(1000 + extra_len); 369 if (buf == NULL) { 370 http_request_deinit(hreq); 371 return; 372 } 373 374 wpabuf_put_str(buf, 375 "HTTP/1.1 200 OK\r\n" 376 "Content-Type: text/xml; charset=\"utf-8\"\r\n"); 377 wpabuf_put_str(buf, "Server: Unspecified, UPnP/1.0, Unspecified\r\n"); 378 wpabuf_put_str(buf, "Connection: close\r\n"); 379 wpabuf_put_str(buf, "Content-Length: "); 380 /* 381 * We will paste the length in later, leaving some extra whitespace. 382 * HTTP code is supposed to be tolerant of extra whitespace. 383 */ 384 put_length_here = wpabuf_put(buf, 0); 385 wpabuf_put_str(buf, " \r\n"); 386 387 http_put_date(buf); 388 389 /* terminating empty line */ 390 wpabuf_put_str(buf, "\r\n"); 391 392 body_start = wpabuf_put(buf, 0); 393 394 switch (req) { 395 case GET_DEVICE_XML_FILE: 396 format_wps_device_xml(sm, buf); 397 break; 398 case GET_SCPD_XML_FILE: 399 wpabuf_put_str(buf, wps_scpd_xml); 400 break; 401 } 402 403 /* Now patch in the content length at the end */ 404 body_length = (char *) wpabuf_put(buf, 0) - body_start; 405 os_snprintf(len_buf, 10, "%d", body_length); 406 os_memcpy(put_length_here, len_buf, os_strlen(len_buf)); 407 408 send_buf: 409 http_request_send_and_deinit(hreq, buf); 410 } 411 412 413 static enum http_reply_code 414 web_process_get_device_info(struct upnp_wps_device_sm *sm, 415 struct wpabuf **reply, const char **replyname) 416 { 417 static const char *name = "NewDeviceInfo"; 418 struct wps_config cfg; 419 struct upnp_wps_device_interface *iface; 420 struct upnp_wps_peer *peer; 421 422 iface = dl_list_first(&sm->interfaces, 423 struct upnp_wps_device_interface, list); 424 peer = &iface->peer; 425 426 wpa_printf(MSG_DEBUG, "WPS UPnP: GetDeviceInfo"); 427 428 if (iface->ctx->ap_pin == NULL) 429 return HTTP_INTERNAL_SERVER_ERROR; 430 431 /* 432 * Request for DeviceInfo, i.e., M1 TLVs. This is a start of WPS 433 * registration over UPnP with the AP acting as an Enrollee. It should 434 * be noted that this is frequently used just to get the device data, 435 * i.e., there may not be any intent to actually complete the 436 * registration. 437 */ 438 439 if (peer->wps) 440 wps_deinit(peer->wps); 441 442 os_memset(&cfg, 0, sizeof(cfg)); 443 cfg.wps = iface->wps; 444 cfg.pin = (u8 *) iface->ctx->ap_pin; 445 cfg.pin_len = os_strlen(iface->ctx->ap_pin); 446 peer->wps = wps_init(&cfg); 447 if (peer->wps) { 448 enum wsc_op_code op_code; 449 *reply = wps_get_msg(peer->wps, &op_code); 450 if (*reply == NULL) { 451 wps_deinit(peer->wps); 452 peer->wps = NULL; 453 } 454 } else 455 *reply = NULL; 456 if (*reply == NULL) { 457 wpa_printf(MSG_INFO, "WPS UPnP: Failed to get DeviceInfo"); 458 return HTTP_INTERNAL_SERVER_ERROR; 459 } 460 *replyname = name; 461 return HTTP_OK; 462 } 463 464 465 static enum http_reply_code 466 web_process_put_message(struct upnp_wps_device_sm *sm, char *data, 467 struct wpabuf **reply, const char **replyname) 468 { 469 struct wpabuf *msg; 470 static const char *name = "NewOutMessage"; 471 enum http_reply_code ret; 472 enum wps_process_res res; 473 enum wsc_op_code op_code; 474 struct upnp_wps_device_interface *iface; 475 476 iface = dl_list_first(&sm->interfaces, 477 struct upnp_wps_device_interface, list); 478 479 /* 480 * PutMessage is used by external UPnP-based Registrar to perform WPS 481 * operation with the access point itself; as compared with 482 * PutWLANResponse which is for proxying. 483 */ 484 wpa_printf(MSG_DEBUG, "WPS UPnP: PutMessage"); 485 msg = xml_get_base64_item(data, "NewInMessage", &ret); 486 if (msg == NULL) 487 return ret; 488 res = wps_process_msg(iface->peer.wps, WSC_UPnP, msg); 489 if (res == WPS_FAILURE) 490 *reply = NULL; 491 else 492 *reply = wps_get_msg(iface->peer.wps, &op_code); 493 wpabuf_free(msg); 494 if (*reply == NULL) 495 return HTTP_INTERNAL_SERVER_ERROR; 496 *replyname = name; 497 return HTTP_OK; 498 } 499 500 501 static enum http_reply_code 502 web_process_put_wlan_response(struct upnp_wps_device_sm *sm, char *data, 503 struct wpabuf **reply, const char **replyname) 504 { 505 struct wpabuf *msg; 506 enum http_reply_code ret; 507 u8 macaddr[ETH_ALEN]; 508 int ev_type; 509 int type; 510 char *val; 511 struct upnp_wps_device_interface *iface; 512 int ok = 0; 513 514 /* 515 * External UPnP-based Registrar is passing us a message to be proxied 516 * over to a Wi-Fi -based client of ours. 517 */ 518 519 wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse"); 520 msg = xml_get_base64_item(data, "NewMessage", &ret); 521 if (msg == NULL) { 522 wpa_printf(MSG_DEBUG, "WPS UPnP: Could not extract NewMessage " 523 "from PutWLANResponse"); 524 return ret; 525 } 526 val = xml_get_first_item(data, "NewWLANEventType"); 527 if (val == NULL) { 528 wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventType in " 529 "PutWLANResponse"); 530 wpabuf_free(msg); 531 return UPNP_ARG_VALUE_INVALID; 532 } 533 ev_type = atol(val); 534 os_free(val); 535 val = xml_get_first_item(data, "NewWLANEventMAC"); 536 if (val == NULL) { 537 wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventMAC in " 538 "PutWLANResponse"); 539 wpabuf_free(msg); 540 return UPNP_ARG_VALUE_INVALID; 541 } 542 if (hwaddr_aton(val, macaddr)) { 543 wpa_printf(MSG_DEBUG, "WPS UPnP: Invalid NewWLANEventMAC in " 544 "PutWLANResponse: '%s'", val); 545 #ifdef CONFIG_WPS_STRICT 546 { 547 struct wps_parse_attr attr; 548 if (wps_parse_msg(msg, &attr) < 0 || attr.version2) { 549 wpabuf_free(msg); 550 os_free(val); 551 return UPNP_ARG_VALUE_INVALID; 552 } 553 } 554 #endif /* CONFIG_WPS_STRICT */ 555 if (hwaddr_aton2(val, macaddr) > 0) { 556 /* 557 * At least some versions of Intel PROset seem to be 558 * using dot-deliminated MAC address format here. 559 */ 560 wpa_printf(MSG_DEBUG, "WPS UPnP: Workaround - allow " 561 "incorrect MAC address format in " 562 "NewWLANEventMAC: %s -> " MACSTR, 563 val, MAC2STR(macaddr)); 564 } else { 565 wpabuf_free(msg); 566 os_free(val); 567 return UPNP_ARG_VALUE_INVALID; 568 } 569 } 570 os_free(val); 571 if (ev_type == UPNP_WPS_WLANEVENT_TYPE_EAP) { 572 struct wps_parse_attr attr; 573 if (wps_parse_msg(msg, &attr) < 0 || 574 attr.msg_type == NULL) 575 type = -1; 576 else 577 type = *attr.msg_type; 578 wpa_printf(MSG_DEBUG, "WPS UPnP: Message Type %d", type); 579 } else 580 type = -1; 581 dl_list_for_each(iface, &sm->interfaces, 582 struct upnp_wps_device_interface, list) { 583 if (iface->ctx->rx_req_put_wlan_response && 584 iface->ctx->rx_req_put_wlan_response(iface->priv, ev_type, 585 macaddr, msg, type) 586 == 0) 587 ok = 1; 588 } 589 590 if (!ok) { 591 wpa_printf(MSG_INFO, "WPS UPnP: Fail: sm->ctx->" 592 "rx_req_put_wlan_response"); 593 wpabuf_free(msg); 594 return HTTP_INTERNAL_SERVER_ERROR; 595 } 596 wpabuf_free(msg); 597 *replyname = NULL; 598 *reply = NULL; 599 return HTTP_OK; 600 } 601 602 603 static int find_er_addr(struct subscription *s, struct sockaddr_in *cli) 604 { 605 struct subscr_addr *a; 606 607 dl_list_for_each(a, &s->addr_list, struct subscr_addr, list) { 608 if (cli->sin_addr.s_addr == a->saddr.sin_addr.s_addr) 609 return 1; 610 } 611 return 0; 612 } 613 614 615 static struct subscription * find_er(struct upnp_wps_device_sm *sm, 616 struct sockaddr_in *cli) 617 { 618 struct subscription *s; 619 dl_list_for_each(s, &sm->subscriptions, struct subscription, list) 620 if (find_er_addr(s, cli)) 621 return s; 622 return NULL; 623 } 624 625 626 static enum http_reply_code 627 web_process_set_selected_registrar(struct upnp_wps_device_sm *sm, 628 struct sockaddr_in *cli, char *data, 629 struct wpabuf **reply, 630 const char **replyname) 631 { 632 struct wpabuf *msg; 633 enum http_reply_code ret; 634 struct subscription *s; 635 struct upnp_wps_device_interface *iface; 636 int err = 0; 637 638 wpa_printf(MSG_DEBUG, "WPS UPnP: SetSelectedRegistrar"); 639 s = find_er(sm, cli); 640 if (s == NULL) { 641 wpa_printf(MSG_DEBUG, "WPS UPnP: Ignore SetSelectedRegistrar " 642 "from unknown ER"); 643 return UPNP_ACTION_FAILED; 644 } 645 msg = xml_get_base64_item(data, "NewMessage", &ret); 646 if (msg == NULL) 647 return ret; 648 dl_list_for_each(iface, &sm->interfaces, 649 struct upnp_wps_device_interface, list) { 650 if (upnp_er_set_selected_registrar(iface->wps->registrar, s, 651 msg)) 652 err = 1; 653 } 654 wpabuf_free(msg); 655 if (err) 656 return HTTP_INTERNAL_SERVER_ERROR; 657 *replyname = NULL; 658 *reply = NULL; 659 return HTTP_OK; 660 } 661 662 663 static const char *soap_prefix = 664 "<?xml version=\"1.0\"?>\n" 665 "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" " 666 "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n" 667 "<s:Body>\n"; 668 static const char *soap_postfix = 669 "</s:Body>\n</s:Envelope>\n"; 670 671 static const char *soap_error_prefix = 672 "<s:Fault>\n" 673 "<faultcode>s:Client</faultcode>\n" 674 "<faultstring>UPnPError</faultstring>\n" 675 "<detail>\n" 676 "<UPnPError xmlns=\"urn:schemas-upnp-org:control-1-0\">\n"; 677 static const char *soap_error_postfix = 678 "<errorDescription>Error</errorDescription>\n" 679 "</UPnPError>\n" 680 "</detail>\n" 681 "</s:Fault>\n"; 682 683 static void web_connection_send_reply(struct http_request *req, 684 enum http_reply_code ret, 685 const char *action, int action_len, 686 const struct wpabuf *reply, 687 const char *replyname) 688 { 689 struct wpabuf *buf; 690 char *replydata; 691 char *put_length_here = NULL; 692 char *body_start = NULL; 693 694 if (reply) { 695 size_t len; 696 replydata = (char *) base64_encode(wpabuf_head(reply), 697 wpabuf_len(reply), &len); 698 } else 699 replydata = NULL; 700 701 /* Parameters of the response: 702 * action(action_len) -- action we are responding to 703 * replyname -- a name we need for the reply 704 * replydata -- NULL or null-terminated string 705 */ 706 buf = wpabuf_alloc(1000 + (replydata ? os_strlen(replydata) : 0U) + 707 (action_len > 0 ? action_len * 2 : 0)); 708 if (buf == NULL) { 709 wpa_printf(MSG_INFO, "WPS UPnP: Cannot allocate reply to " 710 "POST"); 711 os_free(replydata); 712 http_request_deinit(req); 713 return; 714 } 715 716 /* 717 * Assuming we will be successful, put in the output header first. 718 * Note: we do not keep connections alive (and httpread does 719 * not support it)... therefore we must have Connection: close. 720 */ 721 if (ret == HTTP_OK) { 722 wpabuf_put_str(buf, 723 "HTTP/1.1 200 OK\r\n" 724 "Content-Type: text/xml; " 725 "charset=\"utf-8\"\r\n"); 726 } else { 727 wpabuf_printf(buf, "HTTP/1.1 %d Error\r\n", ret); 728 } 729 wpabuf_put_str(buf, http_connection_close); 730 731 wpabuf_put_str(buf, "Content-Length: "); 732 /* 733 * We will paste the length in later, leaving some extra whitespace. 734 * HTTP code is supposed to be tolerant of extra whitespace. 735 */ 736 put_length_here = wpabuf_put(buf, 0); 737 wpabuf_put_str(buf, " \r\n"); 738 739 http_put_date(buf); 740 741 /* terminating empty line */ 742 wpabuf_put_str(buf, "\r\n"); 743 744 body_start = wpabuf_put(buf, 0); 745 746 if (ret == HTTP_OK) { 747 wpabuf_put_str(buf, soap_prefix); 748 wpabuf_put_str(buf, "<u:"); 749 wpabuf_put_data(buf, action, action_len); 750 wpabuf_put_str(buf, "Response xmlns:u=\""); 751 wpabuf_put_str(buf, urn_wfawlanconfig); 752 wpabuf_put_str(buf, "\">\n"); 753 if (replydata && replyname) { 754 /* TODO: might possibly need to escape part of reply 755 * data? ... 756 * probably not, unlikely to have ampersand(&) or left 757 * angle bracket (<) in it... 758 */ 759 wpabuf_printf(buf, "<%s>", replyname); 760 wpabuf_put_str(buf, replydata); 761 wpabuf_printf(buf, "</%s>\n", replyname); 762 } 763 wpabuf_put_str(buf, "</u:"); 764 wpabuf_put_data(buf, action, action_len); 765 wpabuf_put_str(buf, "Response>\n"); 766 wpabuf_put_str(buf, soap_postfix); 767 } else { 768 /* Error case */ 769 wpabuf_put_str(buf, soap_prefix); 770 wpabuf_put_str(buf, soap_error_prefix); 771 wpabuf_printf(buf, "<errorCode>%d</errorCode>\n", ret); 772 wpabuf_put_str(buf, soap_error_postfix); 773 wpabuf_put_str(buf, soap_postfix); 774 } 775 os_free(replydata); 776 777 /* Now patch in the content length at the end */ 778 if (body_start && put_length_here) { 779 int body_length = (char *) wpabuf_put(buf, 0) - body_start; 780 char len_buf[10]; 781 os_snprintf(len_buf, sizeof(len_buf), "%d", body_length); 782 os_memcpy(put_length_here, len_buf, os_strlen(len_buf)); 783 } 784 785 http_request_send_and_deinit(req, buf); 786 } 787 788 789 static const char * web_get_action(struct http_request *req, 790 size_t *action_len) 791 { 792 const char *match; 793 int match_len; 794 char *b; 795 char *action; 796 797 *action_len = 0; 798 /* The SOAPAction line of the header tells us what we want to do */ 799 b = http_request_get_hdr_line(req, "SOAPAction:"); 800 if (b == NULL) 801 return NULL; 802 if (*b == '"') 803 b++; 804 else 805 return NULL; 806 match = urn_wfawlanconfig; 807 match_len = os_strlen(urn_wfawlanconfig) - 1; 808 if (os_strncasecmp(b, match, match_len)) 809 return NULL; 810 b += match_len; 811 /* skip over version */ 812 while (isgraph(*b) && *b != '#') 813 b++; 814 if (*b != '#') 815 return NULL; 816 b++; 817 /* Following the sharp(#) should be the action and a double quote */ 818 action = b; 819 while (isgraph(*b) && *b != '"') 820 b++; 821 if (*b != '"') 822 return NULL; 823 *action_len = b - action; 824 return action; 825 } 826 827 828 /* Given that we have received a header w/ POST, act upon it 829 * 830 * Format of POST (case-insensitive): 831 * 832 * First line must be: 833 * POST /<file> HTTP/1.1 834 * Since we don't do anything fancy we just ignore other lines. 835 * 836 * Our response (if no error) which includes only required lines is: 837 * HTTP/1.1 200 OK 838 * Connection: close 839 * Content-Type: text/xml 840 * Date: <rfc1123-date> 841 * 842 * Header lines must end with \r\n 843 * Per RFC 2616, content-length: is not required but connection:close 844 * would appear to be required (given that we will be closing it!). 845 */ 846 static void web_connection_parse_post(struct upnp_wps_device_sm *sm, 847 struct sockaddr_in *cli, 848 struct http_request *req, 849 const char *filename) 850 { 851 enum http_reply_code ret; 852 char *data = http_request_get_data(req); /* body of http msg */ 853 const char *action = NULL; 854 size_t action_len = 0; 855 const char *replyname = NULL; /* argument name for the reply */ 856 struct wpabuf *reply = NULL; /* data for the reply */ 857 858 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_CONTROL_FILE)) { 859 wpa_printf(MSG_INFO, "WPS UPnP: Invalid POST filename %s", 860 filename); 861 ret = HTTP_NOT_FOUND; 862 goto bad; 863 } 864 865 ret = UPNP_INVALID_ACTION; 866 action = web_get_action(req, &action_len); 867 if (action == NULL) 868 goto bad; 869 870 if (!os_strncasecmp("GetDeviceInfo", action, action_len)) 871 ret = web_process_get_device_info(sm, &reply, &replyname); 872 else if (!os_strncasecmp("PutMessage", action, action_len)) 873 ret = web_process_put_message(sm, data, &reply, &replyname); 874 else if (!os_strncasecmp("PutWLANResponse", action, action_len)) 875 ret = web_process_put_wlan_response(sm, data, &reply, 876 &replyname); 877 else if (!os_strncasecmp("SetSelectedRegistrar", action, action_len)) 878 ret = web_process_set_selected_registrar(sm, cli, data, &reply, 879 &replyname); 880 else 881 wpa_printf(MSG_INFO, "WPS UPnP: Unknown POST type"); 882 883 bad: 884 if (ret != HTTP_OK) 885 wpa_printf(MSG_INFO, "WPS UPnP: POST failure ret=%d", ret); 886 web_connection_send_reply(req, ret, action, action_len, reply, 887 replyname); 888 wpabuf_free(reply); 889 } 890 891 892 /* Given that we have received a header w/ SUBSCRIBE, act upon it 893 * 894 * Format of SUBSCRIBE (case-insensitive): 895 * 896 * First line must be: 897 * SUBSCRIBE /wps_event HTTP/1.1 898 * 899 * Our response (if no error) which includes only required lines is: 900 * HTTP/1.1 200 OK 901 * Server: xx, UPnP/1.0, xx 902 * SID: uuid:xxxxxxxxx 903 * Timeout: Second-<n> 904 * Content-Length: 0 905 * Date: xxxx 906 * 907 * Header lines must end with \r\n 908 * Per RFC 2616, content-length: is not required but connection:close 909 * would appear to be required (given that we will be closing it!). 910 */ 911 static void web_connection_parse_subscribe(struct upnp_wps_device_sm *sm, 912 struct http_request *req, 913 const char *filename) 914 { 915 struct wpabuf *buf; 916 char *b; 917 char *hdr = http_request_get_hdr(req); 918 char *h; 919 char *match; 920 int match_len; 921 char *end; 922 int len; 923 int got_nt = 0; 924 u8 uuid[UUID_LEN]; 925 int got_uuid = 0; 926 char *callback_urls = NULL; 927 struct subscription *s = NULL; 928 enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR; 929 930 buf = wpabuf_alloc(1000); 931 if (buf == NULL) { 932 http_request_deinit(req); 933 return; 934 } 935 936 wpa_hexdump_ascii(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE", 937 (u8 *) hdr, os_strlen(hdr)); 938 939 /* Parse/validate headers */ 940 h = hdr; 941 /* First line: SUBSCRIBE /wps_event HTTP/1.1 942 * has already been parsed. 943 */ 944 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) { 945 ret = HTTP_PRECONDITION_FAILED; 946 goto error; 947 } 948 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE for event"); 949 end = os_strchr(h, '\n'); 950 951 for (; end != NULL; h = end + 1) { 952 /* Option line by option line */ 953 h = end + 1; 954 end = os_strchr(h, '\n'); 955 if (end == NULL) 956 break; /* no unterminated lines allowed */ 957 958 /* NT assures that it is our type of subscription; 959 * not used for a renewal. 960 **/ 961 match = "NT:"; 962 match_len = os_strlen(match); 963 if (os_strncasecmp(h, match, match_len) == 0) { 964 h += match_len; 965 while (*h == ' ' || *h == '\t') 966 h++; 967 match = "upnp:event"; 968 match_len = os_strlen(match); 969 if (os_strncasecmp(h, match, match_len) != 0) { 970 ret = HTTP_BAD_REQUEST; 971 goto error; 972 } 973 got_nt = 1; 974 continue; 975 } 976 /* HOST should refer to us */ 977 #if 0 978 match = "HOST:"; 979 match_len = os_strlen(match); 980 if (os_strncasecmp(h, match, match_len) == 0) { 981 h += match_len; 982 while (*h == ' ' || *h == '\t') 983 h++; 984 ..... 985 } 986 #endif 987 /* CALLBACK gives one or more URLs for NOTIFYs 988 * to be sent as a result of the subscription. 989 * Each URL is enclosed in angle brackets. 990 */ 991 match = "CALLBACK:"; 992 match_len = os_strlen(match); 993 if (os_strncasecmp(h, match, match_len) == 0) { 994 h += match_len; 995 while (*h == ' ' || *h == '\t') 996 h++; 997 len = end - h; 998 os_free(callback_urls); 999 callback_urls = dup_binstr(h, len); 1000 if (callback_urls == NULL) { 1001 ret = HTTP_INTERNAL_SERVER_ERROR; 1002 goto error; 1003 } 1004 continue; 1005 } 1006 /* SID is only for renewal */ 1007 match = "SID:"; 1008 match_len = os_strlen(match); 1009 if (os_strncasecmp(h, match, match_len) == 0) { 1010 h += match_len; 1011 while (*h == ' ' || *h == '\t') 1012 h++; 1013 match = "uuid:"; 1014 match_len = os_strlen(match); 1015 if (os_strncasecmp(h, match, match_len) != 0) { 1016 ret = HTTP_BAD_REQUEST; 1017 goto error; 1018 } 1019 h += match_len; 1020 while (*h == ' ' || *h == '\t') 1021 h++; 1022 if (uuid_str2bin(h, uuid)) { 1023 ret = HTTP_BAD_REQUEST; 1024 goto error; 1025 } 1026 got_uuid = 1; 1027 continue; 1028 } 1029 /* TIMEOUT is requested timeout, but apparently we can 1030 * just ignore this. 1031 */ 1032 } 1033 1034 if (got_uuid) { 1035 /* renewal */ 1036 wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription renewal"); 1037 if (callback_urls) { 1038 ret = HTTP_BAD_REQUEST; 1039 goto error; 1040 } 1041 s = subscription_renew(sm, uuid); 1042 if (s == NULL) { 1043 char str[80]; 1044 uuid_bin2str(uuid, str, sizeof(str)); 1045 wpa_printf(MSG_DEBUG, "WPS UPnP: Could not find " 1046 "SID %s", str); 1047 ret = HTTP_PRECONDITION_FAILED; 1048 goto error; 1049 } 1050 } else if (callback_urls) { 1051 wpa_printf(MSG_DEBUG, "WPS UPnP: New subscription"); 1052 if (!got_nt) { 1053 ret = HTTP_PRECONDITION_FAILED; 1054 goto error; 1055 } 1056 s = subscription_start(sm, callback_urls); 1057 if (s == NULL) { 1058 ret = HTTP_INTERNAL_SERVER_ERROR; 1059 goto error; 1060 } 1061 } else { 1062 ret = HTTP_PRECONDITION_FAILED; 1063 goto error; 1064 } 1065 1066 /* success */ 1067 http_put_reply_code(buf, HTTP_OK); 1068 wpabuf_put_str(buf, http_server_hdr); 1069 wpabuf_put_str(buf, http_connection_close); 1070 wpabuf_put_str(buf, "Content-Length: 0\r\n"); 1071 wpabuf_put_str(buf, "SID: uuid:"); 1072 /* subscription id */ 1073 b = wpabuf_put(buf, 0); 1074 uuid_bin2str(s->uuid, b, 80); 1075 wpa_printf(MSG_DEBUG, "WPS UPnP: Assigned SID %s", b); 1076 wpabuf_put(buf, os_strlen(b)); 1077 wpabuf_put_str(buf, "\r\n"); 1078 wpabuf_printf(buf, "Timeout: Second-%d\r\n", UPNP_SUBSCRIBE_SEC); 1079 http_put_date(buf); 1080 /* And empty line to terminate header: */ 1081 wpabuf_put_str(buf, "\r\n"); 1082 1083 os_free(callback_urls); 1084 http_request_send_and_deinit(req, buf); 1085 return; 1086 1087 error: 1088 /* Per UPnP spec: 1089 * Errors 1090 * Incompatible headers 1091 * 400 Bad Request. If SID header and one of NT or CALLBACK headers 1092 * are present, the publisher must respond with HTTP error 1093 * 400 Bad Request. 1094 * Missing or invalid CALLBACK 1095 * 412 Precondition Failed. If CALLBACK header is missing or does not 1096 * contain a valid HTTP URL, the publisher must respond with HTTP 1097 * error 412 Precondition Failed. 1098 * Invalid NT 1099 * 412 Precondition Failed. If NT header does not equal upnp:event, 1100 * the publisher must respond with HTTP error 412 Precondition 1101 * Failed. 1102 * [For resubscription, use 412 if unknown uuid]. 1103 * Unable to accept subscription 1104 * 5xx. If a publisher is not able to accept a subscription (such as 1105 * due to insufficient resources), it must respond with a 1106 * HTTP 500-series error code. 1107 * 599 Too many subscriptions (not a standard HTTP error) 1108 */ 1109 wpa_printf(MSG_DEBUG, "WPS UPnP: SUBSCRIBE failed - return %d", ret); 1110 http_put_empty(buf, ret); 1111 http_request_send_and_deinit(req, buf); 1112 os_free(callback_urls); 1113 } 1114 1115 1116 /* Given that we have received a header w/ UNSUBSCRIBE, act upon it 1117 * 1118 * Format of UNSUBSCRIBE (case-insensitive): 1119 * 1120 * First line must be: 1121 * UNSUBSCRIBE /wps_event HTTP/1.1 1122 * 1123 * Our response (if no error) which includes only required lines is: 1124 * HTTP/1.1 200 OK 1125 * Content-Length: 0 1126 * 1127 * Header lines must end with \r\n 1128 * Per RFC 2616, content-length: is not required but connection:close 1129 * would appear to be required (given that we will be closing it!). 1130 */ 1131 static void web_connection_parse_unsubscribe(struct upnp_wps_device_sm *sm, 1132 struct http_request *req, 1133 const char *filename) 1134 { 1135 struct wpabuf *buf; 1136 char *hdr = http_request_get_hdr(req); 1137 char *h; 1138 char *match; 1139 int match_len; 1140 char *end; 1141 u8 uuid[UUID_LEN]; 1142 int got_uuid = 0; 1143 struct subscription *s = NULL; 1144 enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR; 1145 1146 /* Parse/validate headers */ 1147 h = hdr; 1148 /* First line: UNSUBSCRIBE /wps_event HTTP/1.1 1149 * has already been parsed. 1150 */ 1151 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) { 1152 ret = HTTP_PRECONDITION_FAILED; 1153 goto send_msg; 1154 } 1155 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP UNSUBSCRIBE for event"); 1156 end = os_strchr(h, '\n'); 1157 1158 for (; end != NULL; h = end + 1) { 1159 /* Option line by option line */ 1160 h = end + 1; 1161 end = os_strchr(h, '\n'); 1162 if (end == NULL) 1163 break; /* no unterminated lines allowed */ 1164 1165 /* HOST should refer to us */ 1166 #if 0 1167 match = "HOST:"; 1168 match_len = os_strlen(match); 1169 if (os_strncasecmp(h, match, match_len) == 0) { 1170 h += match_len; 1171 while (*h == ' ' || *h == '\t') 1172 h++; 1173 ..... 1174 } 1175 #endif 1176 /* SID is only for renewal */ 1177 match = "SID:"; 1178 match_len = os_strlen(match); 1179 if (os_strncasecmp(h, match, match_len) == 0) { 1180 h += match_len; 1181 while (*h == ' ' || *h == '\t') 1182 h++; 1183 match = "uuid:"; 1184 match_len = os_strlen(match); 1185 if (os_strncasecmp(h, match, match_len) != 0) { 1186 ret = HTTP_BAD_REQUEST; 1187 goto send_msg; 1188 } 1189 h += match_len; 1190 while (*h == ' ' || *h == '\t') 1191 h++; 1192 if (uuid_str2bin(h, uuid)) { 1193 ret = HTTP_BAD_REQUEST; 1194 goto send_msg; 1195 } 1196 got_uuid = 1; 1197 continue; 1198 } 1199 } 1200 1201 if (got_uuid) { 1202 s = subscription_find(sm, uuid); 1203 if (s) { 1204 struct subscr_addr *sa; 1205 sa = dl_list_first(&s->addr_list, struct subscr_addr, 1206 list); 1207 wpa_printf(MSG_DEBUG, "WPS UPnP: Unsubscribing %p %s", 1208 s, (sa && sa->domain_and_port) ? 1209 sa->domain_and_port : "-null-"); 1210 dl_list_del(&s->list); 1211 subscription_destroy(s); 1212 } 1213 } else { 1214 wpa_printf(MSG_INFO, "WPS UPnP: Unsubscribe fails (not " 1215 "found)"); 1216 ret = HTTP_PRECONDITION_FAILED; 1217 goto send_msg; 1218 } 1219 1220 ret = HTTP_OK; 1221 1222 send_msg: 1223 buf = wpabuf_alloc(200); 1224 if (buf == NULL) { 1225 http_request_deinit(req); 1226 return; 1227 } 1228 http_put_empty(buf, ret); 1229 http_request_send_and_deinit(req, buf); 1230 } 1231 1232 1233 /* Send error in response to unknown requests */ 1234 static void web_connection_unimplemented(struct http_request *req) 1235 { 1236 struct wpabuf *buf; 1237 buf = wpabuf_alloc(200); 1238 if (buf == NULL) { 1239 http_request_deinit(req); 1240 return; 1241 } 1242 http_put_empty(buf, HTTP_UNIMPLEMENTED); 1243 http_request_send_and_deinit(req, buf); 1244 } 1245 1246 1247 1248 /* Called when we have gotten an apparently valid http request. 1249 */ 1250 static void web_connection_check_data(void *ctx, struct http_request *req) 1251 { 1252 struct upnp_wps_device_sm *sm = ctx; 1253 enum httpread_hdr_type htype = http_request_get_type(req); 1254 char *filename = http_request_get_uri(req); 1255 struct sockaddr_in *cli = http_request_get_cli_addr(req); 1256 1257 if (!filename) { 1258 wpa_printf(MSG_INFO, "WPS UPnP: Could not get HTTP URI"); 1259 http_request_deinit(req); 1260 return; 1261 } 1262 /* Trim leading slashes from filename */ 1263 while (*filename == '/') 1264 filename++; 1265 1266 wpa_printf(MSG_DEBUG, "WPS UPnP: Got HTTP request type %d from %s:%d", 1267 htype, inet_ntoa(cli->sin_addr), htons(cli->sin_port)); 1268 1269 switch (htype) { 1270 case HTTPREAD_HDR_TYPE_GET: 1271 web_connection_parse_get(sm, req, filename); 1272 break; 1273 case HTTPREAD_HDR_TYPE_POST: 1274 web_connection_parse_post(sm, cli, req, filename); 1275 break; 1276 case HTTPREAD_HDR_TYPE_SUBSCRIBE: 1277 web_connection_parse_subscribe(sm, req, filename); 1278 break; 1279 case HTTPREAD_HDR_TYPE_UNSUBSCRIBE: 1280 web_connection_parse_unsubscribe(sm, req, filename); 1281 break; 1282 1283 /* We are not required to support M-POST; just plain 1284 * POST is supposed to work, so we only support that. 1285 * If for some reason we need to support M-POST, it is 1286 * mostly the same as POST, with small differences. 1287 */ 1288 default: 1289 /* Send 501 for anything else */ 1290 web_connection_unimplemented(req); 1291 break; 1292 } 1293 } 1294 1295 1296 /* 1297 * Listening for web connections 1298 * We have a single TCP listening port, and hand off connections as we get 1299 * them. 1300 */ 1301 1302 void web_listener_stop(struct upnp_wps_device_sm *sm) 1303 { 1304 http_server_deinit(sm->web_srv); 1305 sm->web_srv = NULL; 1306 } 1307 1308 1309 int web_listener_start(struct upnp_wps_device_sm *sm) 1310 { 1311 struct in_addr addr; 1312 addr.s_addr = sm->ip_addr; 1313 sm->web_srv = http_server_init(&addr, -1, web_connection_check_data, 1314 sm); 1315 if (sm->web_srv == NULL) { 1316 web_listener_stop(sm); 1317 return -1; 1318 } 1319 sm->web_port = http_server_get_port(sm->web_srv); 1320 1321 return 0; 1322 } 1323