1 /*
2  * WPA Supplicant / UDP socket -based control interface
3  * Copyright (c) 2004-2005, Jouni Malinen <j@w1.fi>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Alternatively, this software may be distributed under the terms of BSD
10  * license.
11  *
12  * See README and COPYING for more details.
13  */
14 
15 #include "includes.h"
16 
17 #include "common.h"
18 #include "eloop.h"
19 #include "config.h"
20 #include "eapol_supp/eapol_supp_sm.h"
21 #include "wpa_supplicant_i.h"
22 #include "ctrl_iface.h"
23 #include "wpa_ctrl.h"
24 
25 
26 #define COOKIE_LEN 8
27 
28 /* Per-interface ctrl_iface */
29 
30 /**
31  * struct wpa_ctrl_dst - Internal data structure of control interface monitors
32  *
33  * This structure is used to store information about registered control
34  * interface monitors into struct wpa_supplicant. This data is private to
35  * ctrl_iface_udp.c and should not be touched directly from other files.
36  */
37 struct wpa_ctrl_dst {
38 	struct wpa_ctrl_dst *next;
39 	struct sockaddr_in addr;
40 	socklen_t addrlen;
41 	int debug_level;
42 	int errors;
43 };
44 
45 
46 struct ctrl_iface_priv {
47 	struct wpa_supplicant *wpa_s;
48 	int sock;
49 	struct wpa_ctrl_dst *ctrl_dst;
50 	u8 cookie[COOKIE_LEN];
51 };
52 
53 
54 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
55 					   int level, const char *buf,
56 					   size_t len);
57 
58 
59 static int wpa_supplicant_ctrl_iface_attach(struct ctrl_iface_priv *priv,
60 					    struct sockaddr_in *from,
61 					    socklen_t fromlen)
62 {
63 	struct wpa_ctrl_dst *dst;
64 
65 	dst = os_zalloc(sizeof(*dst));
66 	if (dst == NULL)
67 		return -1;
68 	os_memcpy(&dst->addr, from, sizeof(struct sockaddr_in));
69 	dst->addrlen = fromlen;
70 	dst->debug_level = MSG_INFO;
71 	dst->next = priv->ctrl_dst;
72 	priv->ctrl_dst = dst;
73 	wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor attached %s:%d",
74 		   inet_ntoa(from->sin_addr), ntohs(from->sin_port));
75 	return 0;
76 }
77 
78 
79 static int wpa_supplicant_ctrl_iface_detach(struct ctrl_iface_priv *priv,
80 					    struct sockaddr_in *from,
81 					    socklen_t fromlen)
82 {
83 	struct wpa_ctrl_dst *dst, *prev = NULL;
84 
85 	dst = priv->ctrl_dst;
86 	while (dst) {
87 		if (from->sin_addr.s_addr == dst->addr.sin_addr.s_addr &&
88 		    from->sin_port == dst->addr.sin_port) {
89 			if (prev == NULL)
90 				priv->ctrl_dst = dst->next;
91 			else
92 				prev->next = dst->next;
93 			os_free(dst);
94 			wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor detached "
95 				   "%s:%d", inet_ntoa(from->sin_addr),
96 				   ntohs(from->sin_port));
97 			return 0;
98 		}
99 		prev = dst;
100 		dst = dst->next;
101 	}
102 	return -1;
103 }
104 
105 
106 static int wpa_supplicant_ctrl_iface_level(struct ctrl_iface_priv *priv,
107 					   struct sockaddr_in *from,
108 					   socklen_t fromlen,
109 					   char *level)
110 {
111 	struct wpa_ctrl_dst *dst;
112 
113 	wpa_printf(MSG_DEBUG, "CTRL_IFACE LEVEL %s", level);
114 
115 	dst = priv->ctrl_dst;
116 	while (dst) {
117 		if (from->sin_addr.s_addr == dst->addr.sin_addr.s_addr &&
118 		    from->sin_port == dst->addr.sin_port) {
119 			wpa_printf(MSG_DEBUG, "CTRL_IFACE changed monitor "
120 				   "level %s:%d", inet_ntoa(from->sin_addr),
121 				   ntohs(from->sin_port));
122 			dst->debug_level = atoi(level);
123 			return 0;
124 		}
125 		dst = dst->next;
126 	}
127 
128 	return -1;
129 }
130 
131 
132 static char *
133 wpa_supplicant_ctrl_iface_get_cookie(struct ctrl_iface_priv *priv,
134 				     size_t *reply_len)
135 {
136 	char *reply;
137 	reply = os_malloc(7 + 2 * COOKIE_LEN + 1);
138 	if (reply == NULL) {
139 		*reply_len = 1;
140 		return NULL;
141 	}
142 
143 	os_memcpy(reply, "COOKIE=", 7);
144 	wpa_snprintf_hex(reply + 7, 2 * COOKIE_LEN + 1,
145 			 priv->cookie, COOKIE_LEN);
146 
147 	*reply_len = 7 + 2 * COOKIE_LEN;
148 	return reply;
149 }
150 
151 
152 static void wpa_supplicant_ctrl_iface_receive(int sock, void *eloop_ctx,
153 					      void *sock_ctx)
154 {
155 	struct wpa_supplicant *wpa_s = eloop_ctx;
156 	struct ctrl_iface_priv *priv = sock_ctx;
157 	char buf[256], *pos;
158 	int res;
159 	struct sockaddr_in from;
160 	socklen_t fromlen = sizeof(from);
161 	char *reply = NULL;
162 	size_t reply_len = 0;
163 	int new_attached = 0;
164 	u8 cookie[COOKIE_LEN];
165 
166 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
167 		       (struct sockaddr *) &from, &fromlen);
168 	if (res < 0) {
169 		perror("recvfrom(ctrl_iface)");
170 		return;
171 	}
172 	if (from.sin_addr.s_addr != htonl((127 << 24) | 1)) {
173 		/*
174 		 * The OS networking stack is expected to drop this kind of
175 		 * frames since the socket is bound to only localhost address.
176 		 * Just in case, drop the frame if it is coming from any other
177 		 * address.
178 		 */
179 		wpa_printf(MSG_DEBUG, "CTRL: Drop packet from unexpected "
180 			   "source %s", inet_ntoa(from.sin_addr));
181 		return;
182 	}
183 	buf[res] = '\0';
184 
185 	if (os_strcmp(buf, "GET_COOKIE") == 0) {
186 		reply = wpa_supplicant_ctrl_iface_get_cookie(priv, &reply_len);
187 		goto done;
188 	}
189 
190 	/*
191 	 * Require that the client includes a prefix with the 'cookie' value
192 	 * fetched with GET_COOKIE command. This is used to verify that the
193 	 * client has access to a bidirectional link over UDP in order to
194 	 * avoid attacks using forged localhost IP address even if the OS does
195 	 * not block such frames from remote destinations.
196 	 */
197 	if (os_strncmp(buf, "COOKIE=", 7) != 0) {
198 		wpa_printf(MSG_DEBUG, "CTLR: No cookie in the request - "
199 			   "drop request");
200 		return;
201 	}
202 
203 	if (hexstr2bin(buf + 7, cookie, COOKIE_LEN) < 0) {
204 		wpa_printf(MSG_DEBUG, "CTLR: Invalid cookie format in the "
205 			   "request - drop request");
206 		return;
207 	}
208 
209 	if (os_memcmp(cookie, priv->cookie, COOKIE_LEN) != 0) {
210 		wpa_printf(MSG_DEBUG, "CTLR: Invalid cookie in the request - "
211 			   "drop request");
212 		return;
213 	}
214 
215 	pos = buf + 7 + 2 * COOKIE_LEN;
216 	while (*pos == ' ')
217 		pos++;
218 
219 	if (os_strcmp(pos, "ATTACH") == 0) {
220 		if (wpa_supplicant_ctrl_iface_attach(priv, &from, fromlen))
221 			reply_len = 1;
222 		else {
223 			new_attached = 1;
224 			reply_len = 2;
225 		}
226 	} else if (os_strcmp(pos, "DETACH") == 0) {
227 		if (wpa_supplicant_ctrl_iface_detach(priv, &from, fromlen))
228 			reply_len = 1;
229 		else
230 			reply_len = 2;
231 	} else if (os_strncmp(pos, "LEVEL ", 6) == 0) {
232 		if (wpa_supplicant_ctrl_iface_level(priv, &from, fromlen,
233 						    pos + 6))
234 			reply_len = 1;
235 		else
236 			reply_len = 2;
237 	} else {
238 		reply = wpa_supplicant_ctrl_iface_process(wpa_s, pos,
239 							  &reply_len);
240 	}
241 
242  done:
243 	if (reply) {
244 		sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
245 		       fromlen);
246 		os_free(reply);
247 	} else if (reply_len == 1) {
248 		sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
249 		       fromlen);
250 	} else if (reply_len == 2) {
251 		sendto(sock, "OK\n", 3, 0, (struct sockaddr *) &from,
252 		       fromlen);
253 	}
254 
255 	if (new_attached)
256 		eapol_sm_notify_ctrl_attached(wpa_s->eapol);
257 }
258 
259 
260 static void wpa_supplicant_ctrl_iface_msg_cb(void *ctx, int level,
261 					     const char *txt, size_t len)
262 {
263 	struct wpa_supplicant *wpa_s = ctx;
264 	if (wpa_s == NULL || wpa_s->ctrl_iface == NULL)
265 		return;
266 	wpa_supplicant_ctrl_iface_send(wpa_s->ctrl_iface, level, txt, len);
267 }
268 
269 
270 struct ctrl_iface_priv *
271 wpa_supplicant_ctrl_iface_init(struct wpa_supplicant *wpa_s)
272 {
273 	struct ctrl_iface_priv *priv;
274 	struct sockaddr_in addr;
275 
276 	priv = os_zalloc(sizeof(*priv));
277 	if (priv == NULL)
278 		return NULL;
279 	priv->wpa_s = wpa_s;
280 	priv->sock = -1;
281 	os_get_random(priv->cookie, COOKIE_LEN);
282 
283 	if (wpa_s->conf->ctrl_interface == NULL)
284 		return priv;
285 
286 	priv->sock = socket(PF_INET, SOCK_DGRAM, 0);
287 	if (priv->sock < 0) {
288 		perror("socket(PF_INET)");
289 		goto fail;
290 	}
291 
292 	os_memset(&addr, 0, sizeof(addr));
293 	addr.sin_family = AF_INET;
294 	addr.sin_addr.s_addr = htonl((127 << 24) | 1);
295 	addr.sin_port = htons(WPA_CTRL_IFACE_PORT);
296 	if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
297 		perror("bind(AF_INET)");
298 		goto fail;
299 	}
300 
301 	eloop_register_read_sock(priv->sock, wpa_supplicant_ctrl_iface_receive,
302 				 wpa_s, priv);
303 	wpa_msg_register_cb(wpa_supplicant_ctrl_iface_msg_cb);
304 
305 	return priv;
306 
307 fail:
308 	if (priv->sock >= 0)
309 		close(priv->sock);
310 	os_free(priv);
311 	return NULL;
312 }
313 
314 
315 void wpa_supplicant_ctrl_iface_deinit(struct ctrl_iface_priv *priv)
316 {
317 	struct wpa_ctrl_dst *dst, *prev;
318 
319 	if (priv->sock > -1) {
320 		eloop_unregister_read_sock(priv->sock);
321 		if (priv->ctrl_dst) {
322 			/*
323 			 * Wait a second before closing the control socket if
324 			 * there are any attached monitors in order to allow
325 			 * them to receive any pending messages.
326 			 */
327 			wpa_printf(MSG_DEBUG, "CTRL_IFACE wait for attached "
328 				   "monitors to receive messages");
329 			os_sleep(1, 0);
330 		}
331 		close(priv->sock);
332 		priv->sock = -1;
333 	}
334 
335 	dst = priv->ctrl_dst;
336 	while (dst) {
337 		prev = dst;
338 		dst = dst->next;
339 		os_free(prev);
340 	}
341 	os_free(priv);
342 }
343 
344 
345 static void wpa_supplicant_ctrl_iface_send(struct ctrl_iface_priv *priv,
346 					   int level, const char *buf,
347 					   size_t len)
348 {
349 	struct wpa_ctrl_dst *dst, *next;
350 	char levelstr[10];
351 	int idx;
352 	char *sbuf;
353 	int llen;
354 
355 	dst = priv->ctrl_dst;
356 	if (priv->sock < 0 || dst == NULL)
357 		return;
358 
359 	os_snprintf(levelstr, sizeof(levelstr), "<%d>", level);
360 
361 	llen = os_strlen(levelstr);
362 	sbuf = os_malloc(llen + len);
363 	if (sbuf == NULL)
364 		return;
365 
366 	os_memcpy(sbuf, levelstr, llen);
367 	os_memcpy(sbuf + llen, buf, len);
368 
369 	idx = 0;
370 	while (dst) {
371 		next = dst->next;
372 		if (level >= dst->debug_level) {
373 			wpa_printf(MSG_DEBUG, "CTRL_IFACE monitor send %s:%d",
374 				   inet_ntoa(dst->addr.sin_addr),
375 				   ntohs(dst->addr.sin_port));
376 			if (sendto(priv->sock, sbuf, llen + len, 0,
377 				   (struct sockaddr *) &dst->addr,
378 				   sizeof(dst->addr)) < 0) {
379 				perror("sendto(CTRL_IFACE monitor)");
380 				dst->errors++;
381 				if (dst->errors > 10) {
382 					wpa_supplicant_ctrl_iface_detach(
383 						priv, &dst->addr,
384 						dst->addrlen);
385 				}
386 			} else
387 				dst->errors = 0;
388 		}
389 		idx++;
390 		dst = next;
391 	}
392 	os_free(sbuf);
393 }
394 
395 
396 void wpa_supplicant_ctrl_iface_wait(struct ctrl_iface_priv *priv)
397 {
398 	wpa_printf(MSG_DEBUG, "CTRL_IFACE - %s - wait for monitor",
399 		   priv->wpa_s->ifname);
400 	eloop_wait_for_read_sock(priv->sock);
401 }
402 
403 
404 /* Global ctrl_iface */
405 
406 struct ctrl_iface_global_priv {
407 	int sock;
408 	u8 cookie[COOKIE_LEN];
409 };
410 
411 
412 static char *
413 wpa_supplicant_global_get_cookie(struct ctrl_iface_global_priv *priv,
414 				 size_t *reply_len)
415 {
416 	char *reply;
417 	reply = os_malloc(7 + 2 * COOKIE_LEN + 1);
418 	if (reply == NULL) {
419 		*reply_len = 1;
420 		return NULL;
421 	}
422 
423 	os_memcpy(reply, "COOKIE=", 7);
424 	wpa_snprintf_hex(reply + 7, 2 * COOKIE_LEN + 1,
425 			 priv->cookie, COOKIE_LEN);
426 
427 	*reply_len = 7 + 2 * COOKIE_LEN;
428 	return reply;
429 }
430 
431 
432 static void wpa_supplicant_global_ctrl_iface_receive(int sock, void *eloop_ctx,
433 						     void *sock_ctx)
434 {
435 	struct wpa_global *global = eloop_ctx;
436 	struct ctrl_iface_global_priv *priv = sock_ctx;
437 	char buf[256], *pos;
438 	int res;
439 	struct sockaddr_in from;
440 	socklen_t fromlen = sizeof(from);
441 	char *reply;
442 	size_t reply_len;
443 	u8 cookie[COOKIE_LEN];
444 
445 	res = recvfrom(sock, buf, sizeof(buf) - 1, 0,
446 		       (struct sockaddr *) &from, &fromlen);
447 	if (res < 0) {
448 		perror("recvfrom(ctrl_iface)");
449 		return;
450 	}
451 	if (from.sin_addr.s_addr != htonl((127 << 24) | 1)) {
452 		/*
453 		 * The OS networking stack is expected to drop this kind of
454 		 * frames since the socket is bound to only localhost address.
455 		 * Just in case, drop the frame if it is coming from any other
456 		 * address.
457 		 */
458 		wpa_printf(MSG_DEBUG, "CTRL: Drop packet from unexpected "
459 			   "source %s", inet_ntoa(from.sin_addr));
460 		return;
461 	}
462 	buf[res] = '\0';
463 
464 	if (os_strcmp(buf, "GET_COOKIE") == 0) {
465 		reply = wpa_supplicant_global_get_cookie(priv, &reply_len);
466 		goto done;
467 	}
468 
469 	if (os_strncmp(buf, "COOKIE=", 7) != 0) {
470 		wpa_printf(MSG_DEBUG, "CTLR: No cookie in the request - "
471 			   "drop request");
472 		return;
473 	}
474 
475 	if (hexstr2bin(buf + 7, cookie, COOKIE_LEN) < 0) {
476 		wpa_printf(MSG_DEBUG, "CTLR: Invalid cookie format in the "
477 			   "request - drop request");
478 		return;
479 	}
480 
481 	if (os_memcmp(cookie, priv->cookie, COOKIE_LEN) != 0) {
482 		wpa_printf(MSG_DEBUG, "CTLR: Invalid cookie in the request - "
483 			   "drop request");
484 		return;
485 	}
486 
487 	pos = buf + 7 + 2 * COOKIE_LEN;
488 	while (*pos == ' ')
489 		pos++;
490 
491 	reply = wpa_supplicant_global_ctrl_iface_process(global, pos,
492 							 &reply_len);
493 
494  done:
495 	if (reply) {
496 		sendto(sock, reply, reply_len, 0, (struct sockaddr *) &from,
497 		       fromlen);
498 		os_free(reply);
499 	} else if (reply_len) {
500 		sendto(sock, "FAIL\n", 5, 0, (struct sockaddr *) &from,
501 		       fromlen);
502 	}
503 }
504 
505 
506 struct ctrl_iface_global_priv *
507 wpa_supplicant_global_ctrl_iface_init(struct wpa_global *global)
508 {
509 	struct ctrl_iface_global_priv *priv;
510 	struct sockaddr_in addr;
511 
512 	priv = os_zalloc(sizeof(*priv));
513 	if (priv == NULL)
514 		return NULL;
515 	priv->sock = -1;
516 	os_get_random(priv->cookie, COOKIE_LEN);
517 
518 	if (global->params.ctrl_interface == NULL)
519 		return priv;
520 
521 	wpa_printf(MSG_DEBUG, "Global control interface '%s'",
522 		   global->params.ctrl_interface);
523 
524 	priv->sock = socket(PF_INET, SOCK_DGRAM, 0);
525 	if (priv->sock < 0) {
526 		perror("socket(PF_INET)");
527 		goto fail;
528 	}
529 
530 	os_memset(&addr, 0, sizeof(addr));
531 	addr.sin_family = AF_INET;
532 	addr.sin_addr.s_addr = htonl((127 << 24) | 1);
533 	addr.sin_port = htons(WPA_GLOBAL_CTRL_IFACE_PORT);
534 	if (bind(priv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
535 		perror("bind(AF_INET)");
536 		goto fail;
537 	}
538 
539 	eloop_register_read_sock(priv->sock,
540 				 wpa_supplicant_global_ctrl_iface_receive,
541 				 global, priv);
542 
543 	return priv;
544 
545 fail:
546 	if (priv->sock >= 0)
547 		close(priv->sock);
548 	os_free(priv);
549 	return NULL;
550 }
551 
552 
553 void
554 wpa_supplicant_global_ctrl_iface_deinit(struct ctrl_iface_global_priv *priv)
555 {
556 	if (priv->sock >= 0) {
557 		eloop_unregister_read_sock(priv->sock);
558 		close(priv->sock);
559 	}
560 	os_free(priv);
561 }
562