?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Reduce differences between our VKERNEL and VKERNEL64 configurations.
[dragonfly.git] / contrib / hostapd / src / wps / wps_upnp_web.c
blobb6374540e9a00d4154f82bcf7ce6178de92364e4
1 /*
2 * UPnP WPS Device - Web connections
3 * Copyright (c) 2000-2003 Intel Corporation
4 * Copyright (c) 2006-2007 Sony Corporation
5 * Copyright (c) 2008-2009 Atheros Communications
6 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
7 *
8 * See wps_upnp.c for more details on licensing and code history.
9 */
10
11 #include "includes.h"
12 #include <fcntl.h>
13
14 #include "common.h"
15 #include "base64.h"
16 #include "eloop.h"
17 #include "uuid.h"
18 #include "httpread.h"
19 #include "wps_i.h"
20 #include "wps_upnp.h"
21 #include "wps_upnp_i.h"
22
23 /***************************************************************************
24 * Web connections (we serve pages of info about ourselves, handle
25 * requests, etc. etc.).
26 **************************************************************************/
27
28 #define WEB_CONNECTION_TIMEOUT_SEC 30 /* Drop web connection after t.o. */
29 #define WEB_CONNECTION_MAX_READ 8000 /* Max we'll read for TCP request */
30 #define MAX_WEB_CONNECTIONS 10 /* max simultaneous web connects */
31
32
33 static const char *urn_wfawlanconfig =
34 "urn:schemas-wifialliance-org:service:WFAWLANConfig:1";
35 static const char *http_server_hdr =
36 "Server: unspecified, UPnP/1.0, unspecified\r\n";
37 static const char *http_connection_close =
38 "Connection: close\r\n";
39
40 /*
41 * Incoming web connections are recorded in this struct.
42 * A web connection is a TCP connection to us, the server;
43 * it is called a "web connection" because we use http and serve
44 * data that looks like web pages.
45 * State information is need to track the connection until we figure
46 * out what they want and what we want to do about it.
47 */
48 struct web_connection {
49 /* double linked list */
50 struct web_connection *next;
51 struct web_connection *prev;
52 struct upnp_wps_device_sm *sm; /* parent */
53 int sd; /* socket to read from */
54 struct sockaddr_in cli_addr;
55 int sd_registered; /* nonzero if we must cancel registration */
56 struct httpread *hread; /* state machine for reading socket */
57 int n_rcvd_data; /* how much data read so far */
58 int done; /* internal flag, set when we've finished */
59 };
60
61
62 /*
63 * XML parsing and formatting
64 *
65 * XML is a markup language based on unicode; usually (and in our case,
66 * always!) based on utf-8. utf-8 uses a variable number of bytes per
67 * character. utf-8 has the advantage that all non-ASCII unicode characters are
68 * represented by sequences of non-ascii (high bit set) bytes, whereas ASCII
69 * characters are single ascii bytes, thus we can use typical text processing.
70 *
71 * (One other interesting thing about utf-8 is that it is possible to look at
72 * any random byte and determine if it is the first byte of a character as
73 * versus a continuation byte).
74 *
75 * The base syntax of XML uses a few ASCII punctionation characters; any
76 * characters that would appear in the payload data are rewritten using
77 * sequences, e.g., &amp; for ampersand(&) and &lt for left angle bracket (<).
78 * Five such escapes total (more can be defined but that does not apply to our
79 * case). Thus we can safely parse for angle brackets etc.
80 *
81 * XML describes tree structures of tagged data, with each element beginning
82 * with an opening tag <label> and ending with a closing tag </label> with
83 * matching label. (There is also a self-closing tag <label/> which is supposed
84 * to be equivalent to <label></label>, i.e., no payload, but we are unlikely
85 * to see it for our purpose).
86 *
87 * Actually the opening tags are a little more complicated because they can
88 * contain "attributes" after the label (delimited by ascii space or tab chars)
89 * of the form attribute_label="value" or attribute_label='value'; as it turns
90 * out we do not have to read any of these attributes, just ignore them.
91 *
92 * Labels are any sequence of chars other than space, tab, right angle bracket
93 * (and ?), but may have an inner structure of <namespace><colon><plain_label>.
94 * As it turns out, we can ignore the namespaces, in fact we can ignore the
95 * entire tree hierarchy, because the plain labels we are looking for will be
96 * unique (not in general, but for this application). We do however have to be
97 * careful to skip over the namespaces.
98 *
99 * In generating XML we have to be more careful, but that is easy because
100 * everything we do is pretty canned. The only real care to take is to escape
101 * any special chars in our payload.
102 */
103
104 /**
105 * xml_next_tag - Advance to next tag
106 * @in: Input
107 * @out: OUT: start of tag just after '<'
108 * @out_tagname: OUT: start of name of tag, skipping namespace
109 * @end: OUT: one after tag
110 * Returns: 0 on success, 1 on failure
111 *
112 * A tag has form:
113 * <left angle bracket><...><right angle bracket>
114 * Within the angle brackets, there is an optional leading forward slash (which
115 * makes the tag an ending tag), then an optional leading label (followed by
116 * colon) and then the tag name itself.
117 *
118 * Note that angle brackets present in the original data must have been encoded
119 * as &lt; and &gt; so they will not trouble us.
120 */
121 static int xml_next_tag(char *in, char **out, char **out_tagname,
122 char **end)
123 {
124 while (*in && *in != '<')
125 in++;
126 if (*in != '<')
127 return 1;
128 *out = ++in;
129 if (*in == '/')
130 in++;
131 *out_tagname = in; /* maybe */
132 while (isalnum(*in) || *in == '-')
133 in++;
134 if (*in == ':')
135 *out_tagname = ++in;
136 while (*in && *in != '>')
137 in++;
138 if (*in != '>')
139 return 1;
140 *end = ++in;
141 return 0;
142 }
143
144
145 /* xml_data_encode -- format data for xml file, escaping special characters.
146 *
147 * Note that we assume we are using utf8 both as input and as output!
148 * In utf8, characters may be classed as follows:
149 * 0xxxxxxx(2) -- 1 byte ascii char
150 * 11xxxxxx(2) -- 1st byte of multi-byte char w/ unicode value >= 0x80
151 * 110xxxxx(2) -- 1st byte of 2 byte sequence (5 payload bits here)
152 * 1110xxxx(2) -- 1st byte of 3 byte sequence (4 payload bits here)
153 * 11110xxx(2) -- 1st byte of 4 byte sequence (3 payload bits here)
154 * 10xxxxxx(2) -- extension byte (6 payload bits per byte)
155 * Some values implied by the above are however illegal because they
156 * do not represent unicode chars or are not the shortest encoding.
157 * Actually, we can almost entirely ignore the above and just do
158 * text processing same as for ascii text.
159 *
160 * XML is written with arbitrary unicode characters, except that five
161 * characters have special meaning and so must be escaped where they
162 * appear in payload data... which we do here.
163 */
164 static void xml_data_encode(struct wpabuf *buf, const char *data, int len)
165 {
166 int i;
167 for (i = 0; i < len; i++) {
168 u8 c = ((u8 *) data)[i];
169 if (c == '<') {
170 wpabuf_put_str(buf, "&lt;");
171 continue;
172 }
173 if (c == '>') {
174 wpabuf_put_str(buf, "&gt;");
175 continue;
176 }
177 if (c == '&') {
178 wpabuf_put_str(buf, "&amp;");
179 continue;
180 }
181 if (c == '\'') {
182 wpabuf_put_str(buf, "&apos;");
183 continue;
184 }
185 if (c == '"') {
186 wpabuf_put_str(buf, "&quot;");
187 continue;
188 }
189 /*
190 * We could try to represent control characters using the
191 * sequence: &#x; where x is replaced by a hex numeral, but not
192 * clear why we would do this.
193 */
194 wpabuf_put_u8(buf, c);
195 }
196 }
197
198
199 /* xml_add_tagged_data -- format tagged data as a new xml line.
200 *
201 * tag must not have any special chars.
202 * data may have special chars, which are escaped.
203 */
204 static void xml_add_tagged_data(struct wpabuf *buf, const char *tag,
205 const char *data)
206 {
207 wpabuf_printf(buf, "<%s>", tag);
208 xml_data_encode(buf, data, os_strlen(data));
209 wpabuf_printf(buf, "</%s>\n", tag);
210 }
211
212
213 /* A POST body looks something like (per upnp spec):
214 * <?xml version="1.0"?>
215 * <s:Envelope
216 * xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
217 * s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
218 * <s:Body>
219 * <u:actionName xmlns:u="urn:schemas-upnp-org:service:serviceType:v">
220 * <argumentName>in arg value</argumentName>
221 * other in args and their values go here, if any
222 * </u:actionName>
223 * </s:Body>
224 * </s:Envelope>
225 *
226 * where :
227 * s: might be some other namespace name followed by colon
228 * u: might be some other namespace name followed by colon
229 * actionName will be replaced according to action requested
230 * schema following actionName will be WFA scheme instead
231 * argumentName will be actual argument name
232 * (in arg value) will be actual argument value
233 */
234 static int
235 upnp_get_first_document_item(char *doc, const char *item, char **value)
236 {
237 const char *match = item;
238 int match_len = os_strlen(item);
239 char *tag;
240 char *tagname;
241 char *end;
242
243 *value = NULL; /* default, bad */
244
245 /*
246 * This is crude: ignore any possible tag name conflicts and go right
247 * to the first tag of this name. This should be ok for the limited
248 * domain of UPnP messages.
249 */
250 for (;;) {
251 if (xml_next_tag(doc, &tag, &tagname, &end))
252 return 1;
253 doc = end;
254 if (!os_strncasecmp(tagname, match, match_len) &&
255 *tag != '/' &&
256 (tagname[match_len] == '>' ||
257 !isgraph(tagname[match_len]))) {
258 break;
259 }
260 }
261 end = doc;
262 while (*end && *end != '<')
263 end++;
264 *value = os_zalloc(1 + (end - doc));
265 if (*value == NULL)
266 return 1;
267 os_memcpy(*value, doc, end - doc);
268 return 0;
269 }
270
271
272 /*
273 * "Files" that we serve via HTTP. The format of these files is given by
274 * WFA WPS specifications. Extra white space has been removed to save space.
275 */
276
277 static const char wps_scpd_xml[] =
278 "<?xml version=\"1.0\"?>\n"
279 "<scpd xmlns=\"urn:schemas-upnp-org:service-1-0\">\n"
280 "<specVersion><major>1</major><minor>0</minor></specVersion>\n"
281 "<actionList>\n"
282 "<action>\n"
283 "<name>GetDeviceInfo</name>\n"
284 "<argumentList>\n"
285 "<argument>\n"
286 "<name>NewDeviceInfo</name>\n"
287 "<direction>out</direction>\n"
288 "<relatedStateVariable>DeviceInfo</relatedStateVariable>\n"
289 "</argument>\n"
290 "</argumentList>\n"
291 "</action>\n"
292 "<action>\n"
293 "<name>PutMessage</name>\n"
294 "<argumentList>\n"
295 "<argument>\n"
296 "<name>NewInMessage</name>\n"
297 "<direction>in</direction>\n"
298 "<relatedStateVariable>InMessage</relatedStateVariable>\n"
299 "</argument>\n"
300 "<argument>\n"
301 "<name>NewOutMessage</name>\n"
302 "<direction>out</direction>\n"
303 "<relatedStateVariable>OutMessage</relatedStateVariable>\n"
304 "</argument>\n"
305 "</argumentList>\n"
306 "</action>\n"
307 "<action>\n"
308 "<name>GetAPSettings</name>\n"
309 "<argumentList>\n"
310 "<argument>\n"
311 "<name>NewMessage</name>\n"
312 "<direction>in</direction>\n"
313 "<relatedStateVariable>Message</relatedStateVariable>\n"
314 "</argument>\n"
315 "<argument>\n"
316 "<name>NewAPSettings</name>\n"
317 "<direction>out</direction>\n"
318 "<relatedStateVariable>APSettings</relatedStateVariable>\n"
319 "</argument>\n"
320 "</argumentList>\n"
321 "</action>\n"
322 "<action>\n"
323 "<name>SetAPSettings</name>\n"
324 "<argumentList>\n"
325 "<argument>\n"
326 "<name>APSettings</name>\n"
327 "<direction>in</direction>\n"
328 "<relatedStateVariable>APSettings</relatedStateVariable>\n"
329 "</argument>\n"
330 "</argumentList>\n"
331 "</action>\n"
332 "<action>\n"
333 "<name>DelAPSettings</name>\n"
334 "<argumentList>\n"
335 "<argument>\n"
336 "<name>NewAPSettings</name>\n"
337 "<direction>in</direction>\n"
338 "<relatedStateVariable>APSettings</relatedStateVariable>\n"
339 "</argument>\n"
340 "</argumentList>\n"
341 "</action>\n"
342 "<action>\n"
343 "<name>GetSTASettings</name>\n"
344 "<argumentList>\n"
345 "<argument>\n"
346 "<name>NewMessage</name>\n"
347 "<direction>in</direction>\n"
348 "<relatedStateVariable>Message</relatedStateVariable>\n"
349 "</argument>\n"
350 "<argument>\n"
351 "<name>NewSTASettings</name>\n"
352 "<direction>out</direction>\n"
353 "<relatedStateVariable>STASettings</relatedStateVariable>\n"
354 "</argument>\n"
355 "</argumentList>\n"
356 "</action>\n"
357 "<action>\n"
358 "<name>SetSTASettings</name>\n"
359 "<argumentList>\n"
360 "<argument>\n"
361 "<name>NewSTASettings</name>\n"
362 "<direction>out</direction>\n"
363 "<relatedStateVariable>STASettings</relatedStateVariable>\n"
364 "</argument>\n"
365 "</argumentList>\n"
366 "</action>\n"
367 "<action>\n"
368 "<name>DelSTASettings</name>\n"
369 "<argumentList>\n"
370 "<argument>\n"
371 "<name>NewSTASettings</name>\n"
372 "<direction>in</direction>\n"
373 "<relatedStateVariable>STASettings</relatedStateVariable>\n"
374 "</argument>\n"
375 "</argumentList>\n"
376 "</action>\n"
377 "<action>\n"
378 "<name>PutWLANResponse</name>\n"
379 "<argumentList>\n"
380 "<argument>\n"
381 "<name>NewMessage</name>\n"
382 "<direction>in</direction>\n"
383 "<relatedStateVariable>Message</relatedStateVariable>\n"
384 "</argument>\n"
385 "<argument>\n"
386 "<name>NewWLANEventType</name>\n"
387 "<direction>in</direction>\n"
388 "<relatedStateVariable>WLANEventType</relatedStateVariable>\n"
389 "</argument>\n"
390 "<argument>\n"
391 "<name>NewWLANEventMAC</name>\n"
392 "<direction>in</direction>\n"
393 "<relatedStateVariable>WLANEventMAC</relatedStateVariable>\n"
394 "</argument>\n"
395 "</argumentList>\n"
396 "</action>\n"
397 "<action>\n"
398 "<name>SetSelectedRegistrar</name>\n"
399 "<argumentList>\n"
400 "<argument>\n"
401 "<name>NewMessage</name>\n"
402 "<direction>in</direction>\n"
403 "<relatedStateVariable>Message</relatedStateVariable>\n"
404 "</argument>\n"
405 "</argumentList>\n"
406 "</action>\n"
407 "<action>\n"
408 "<name>RebootAP</name>\n"
409 "<argumentList>\n"
410 "<argument>\n"
411 "<name>NewAPSettings</name>\n"
412 "<direction>in</direction>\n"
413 "<relatedStateVariable>APSettings</relatedStateVariable>\n"
414 "</argument>\n"
415 "</argumentList>\n"
416 "</action>\n"
417 "<action>\n"
418 "<name>ResetAP</name>\n"
419 "<argumentList>\n"
420 "<argument>\n"
421 "<name>NewMessage</name>\n"
422 "<direction>in</direction>\n"
423 "<relatedStateVariable>Message</relatedStateVariable>\n"
424 "</argument>\n"
425 "</argumentList>\n"
426 "</action>\n"
427 "<action>\n"
428 "<name>RebootSTA</name>\n"
429 "<argumentList>\n"
430 "<argument>\n"
431 "<name>NewSTASettings</name>\n"
432 "<direction>in</direction>\n"
433 "<relatedStateVariable>APSettings</relatedStateVariable>\n"
434 "</argument>\n"
435 "</argumentList>\n"
436 "</action>\n"
437 "<action>\n"
438 "<name>ResetSTA</name>\n"
439 "<argumentList>\n"
440 "<argument>\n"
441 "<name>NewMessage</name>\n"
442 "<direction>in</direction>\n"
443 "<relatedStateVariable>Message</relatedStateVariable>\n"
444 "</argument>\n"
445 "</argumentList>\n"
446 "</action>\n"
447 "</actionList>\n"
448 "<serviceStateTable>\n"
449 "<stateVariable sendEvents=\"no\">\n"
450 "<name>Message</name>\n"
451 "<dataType>bin.base64</dataType>\n"
452 "</stateVariable>\n"
453 "<stateVariable sendEvents=\"no\">\n"
454 "<name>InMessage</name>\n"
455 "<dataType>bin.base64</dataType>\n"
456 "</stateVariable>\n"
457 "<stateVariable sendEvents=\"no\">\n"
458 "<name>OutMessage</name>\n"
459 "<dataType>bin.base64</dataType>\n"
460 "</stateVariable>\n"
461 "<stateVariable sendEvents=\"no\">\n"
462 "<name>DeviceInfo</name>\n"
463 "<dataType>bin.base64</dataType>\n"
464 "</stateVariable>\n"
465 "<stateVariable sendEvents=\"no\">\n"
466 "<name>APSettings</name>\n"
467 "<dataType>bin.base64</dataType>\n"
468 "</stateVariable>\n"
469 "<stateVariable sendEvents=\"yes\">\n"
470 "<name>APStatus</name>\n"
471 "<dataType>ui1</dataType>\n"
472 "</stateVariable>\n"
473 "<stateVariable sendEvents=\"no\">\n"
474 "<name>STASettings</name>\n"
475 "<dataType>bin.base64</dataType>\n"
476 "</stateVariable>\n"
477 "<stateVariable sendEvents=\"yes\">\n"
478 "<name>STAStatus</name>\n"
479 "<dataType>ui1</dataType>\n"
480 "</stateVariable>\n"
481 "<stateVariable sendEvents=\"yes\">\n"
482 "<name>WLANEvent</name>\n"
483 "<dataType>bin.base64</dataType>\n"
484 "</stateVariable>\n"
485 "<stateVariable sendEvents=\"no\">\n"
486 "<name>WLANEventType</name>\n"
487 "<dataType>ui1</dataType>\n"
488 "</stateVariable>\n"
489 "<stateVariable sendEvents=\"no\">\n"
490 "<name>WLANEventMAC</name>\n"
491 "<dataType>string</dataType>\n"
492 "</stateVariable>\n"
493 "<stateVariable sendEvents=\"no\">\n"
494 "<name>WLANResponse</name>\n"
495 "<dataType>bin.base64</dataType>\n"
496 "</stateVariable>\n"
497 "</serviceStateTable>\n"
498 "</scpd>\n"
499 ;
500
501
502 static const char *wps_device_xml_prefix =
503 "<?xml version=\"1.0\"?>\n"
504 "<root xmlns=\"urn:schemas-upnp-org:device-1-0\">\n"
505 "<specVersion>\n"
506 "<major>1</major>\n"
507 "<minor>0</minor>\n"
508 "</specVersion>\n"
509 "<device>\n"
510 "<deviceType>urn:schemas-wifialliance-org:device:WFADevice:1"
511 "</deviceType>\n";
512
513 static const char *wps_device_xml_postfix =
514 "<serviceList>\n"
515 "<service>\n"
516 "<serviceType>urn:schemas-wifialliance-org:service:WFAWLANConfig:1"
517 "</serviceType>\n"
518 "<serviceId>urn:wifialliance-org:serviceId:WFAWLANConfig1</serviceId>"
519 "\n"
520 "<SCPDURL>" UPNP_WPS_SCPD_XML_FILE "</SCPDURL>\n"
521 "<controlURL>" UPNP_WPS_DEVICE_CONTROL_FILE "</controlURL>\n"
522 "<eventSubURL>" UPNP_WPS_DEVICE_EVENT_FILE "</eventSubURL>\n"
523 "</service>\n"
524 "</serviceList>\n"
525 "</device>\n"
526 "</root>\n";
527
528
529 /* format_wps_device_xml -- produce content of "file" wps_device.xml
530 * (UPNP_WPS_DEVICE_XML_FILE)
531 */
532 static void format_wps_device_xml(struct upnp_wps_device_sm *sm,
533 struct wpabuf *buf)
534 {
535 const char *s;
536 char uuid_string[80];
537
538 wpabuf_put_str(buf, wps_device_xml_prefix);
539
540 /*
541 * Add required fields with default values if not configured. Add
542 * optional and recommended fields only if configured.
543 */
544 s = sm->wps->friendly_name;
545 s = ((s && *s) ? s : "WPS Access Point");
546 xml_add_tagged_data(buf, "friendlyName", s);
547
548 s = sm->wps->dev.manufacturer;
549 s = ((s && *s) ? s : "");
550 xml_add_tagged_data(buf, "manufacturer", s);
551
552 if (sm->wps->manufacturer_url)
553 xml_add_tagged_data(buf, "manufacturerURL",
554 sm->wps->manufacturer_url);
555
556 if (sm->wps->model_description)
557 xml_add_tagged_data(buf, "modelDescription",
558 sm->wps->model_description);
559
560 s = sm->wps->dev.model_name;
561 s = ((s && *s) ? s : "");
562 xml_add_tagged_data(buf, "modelName", s);
563
564 if (sm->wps->dev.model_number)
565 xml_add_tagged_data(buf, "modelNumber",
566 sm->wps->dev.model_number);
567
568 if (sm->wps->model_url)
569 xml_add_tagged_data(buf, "modelURL", sm->wps->model_url);
570
571 if (sm->wps->dev.serial_number)
572 xml_add_tagged_data(buf, "serialNumber",
573 sm->wps->dev.serial_number);
574
575 uuid_bin2str(sm->wps->uuid, uuid_string, sizeof(uuid_string));
576 s = uuid_string;
577 /* Need "uuid:" prefix, thus we can't use xml_add_tagged_data()
578 * easily...
579 */
580 wpabuf_put_str(buf, "<UDN>uuid:");
581 xml_data_encode(buf, s, os_strlen(s));
582 wpabuf_put_str(buf, "</UDN>\n");
583
584 if (sm->wps->upc)
585 xml_add_tagged_data(buf, "UPC", sm->wps->upc);
586
587 wpabuf_put_str(buf, wps_device_xml_postfix);
588 }
589
590
591 void web_connection_stop(struct web_connection *c)
592 {
593 struct upnp_wps_device_sm *sm = c->sm;
594
595 httpread_destroy(c->hread);
596 c->hread = NULL;
597 close(c->sd);
598 c->sd = -1;
599 if (c->next == c) {
600 sm->web_connections = NULL;
601 } else {
602 if (sm->web_connections == c)
603 sm->web_connections = c->next;
604 c->next->prev = c->prev;
605 c->prev->next = c->next;
606 }
607 os_free(c);
608 sm->n_web_connections--;
609 }
610
611
612 static void http_put_reply_code(struct wpabuf *buf, enum http_reply_code code)
613 {
614 wpabuf_put_str(buf, "HTTP/1.1 ");
615 switch (code) {
616 case HTTP_OK:
617 wpabuf_put_str(buf, "200 OK\r\n");
618 break;
619 case HTTP_BAD_REQUEST:
620 wpabuf_put_str(buf, "400 Bad request\r\n");
621 break;
622 case HTTP_PRECONDITION_FAILED:
623 wpabuf_put_str(buf, "412 Precondition failed\r\n");
624 break;
625 case HTTP_UNIMPLEMENTED:
626 wpabuf_put_str(buf, "501 Unimplemented\r\n");
627 break;
628 case HTTP_INTERNAL_SERVER_ERROR:
629 default:
630 wpabuf_put_str(buf, "500 Internal server error\r\n");
631 break;
632 }
633 }
634
635
636 static void http_put_date(struct wpabuf *buf)
637 {
638 wpabuf_put_str(buf, "Date: ");
639 format_date(buf);
640 wpabuf_put_str(buf, "\r\n");
641 }
642
643
644 static void http_put_empty(struct wpabuf *buf, enum http_reply_code code)
645 {
646 http_put_reply_code(buf, code);
647 wpabuf_put_str(buf, http_server_hdr);
648 wpabuf_put_str(buf, http_connection_close);
649 wpabuf_put_str(buf, "Content-Length: 0\r\n"
650 "\r\n");
651 }
652
653
654 /* Given that we have received a header w/ GET, act upon it
655 *
656 * Format of GET (case-insensitive):
657 *
658 * First line must be:
659 * GET /<file> HTTP/1.1
660 * Since we don't do anything fancy we just ignore other lines.
661 *
662 * Our response (if no error) which includes only required lines is:
663 * HTTP/1.1 200 OK
664 * Connection: close
665 * Content-Type: text/xml
666 * Date: <rfc1123-date>
667 *
668 * Header lines must end with \r\n
669 * Per RFC 2616, content-length: is not required but connection:close
670 * would appear to be required (given that we will be closing it!).
671 */
672 static void web_connection_parse_get(struct web_connection *c, char *filename)
673 {
674 struct upnp_wps_device_sm *sm = c->sm;
675 struct wpabuf *buf; /* output buffer, allocated */
676 char *put_length_here;
677 char *body_start;
678 enum {
679 GET_DEVICE_XML_FILE,
680 GET_SCPD_XML_FILE
681 } req;
682 size_t extra_len = 0;
683 int body_length;
684 char len_buf[10];
685
686 /*
687 * It is not required that filenames be case insensitive but it is
688 * allowed and cannot hurt here.
689 */
690 if (filename == NULL)
691 filename = "(null)"; /* just in case */
692 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_XML_FILE) == 0) {
693 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for device XML");
694 req = GET_DEVICE_XML_FILE;
695 extra_len = 3000;
696 if (sm->wps->friendly_name)
697 extra_len += os_strlen(sm->wps->friendly_name);
698 if (sm->wps->manufacturer_url)
699 extra_len += os_strlen(sm->wps->manufacturer_url);
700 if (sm->wps->model_description)
701 extra_len += os_strlen(sm->wps->model_description);
702 if (sm->wps->model_url)
703 extra_len += os_strlen(sm->wps->model_url);
704 if (sm->wps->upc)
705 extra_len += os_strlen(sm->wps->upc);
706 } else if (!os_strcasecmp(filename, UPNP_WPS_SCPD_XML_FILE)) {
707 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET for SCPD XML");
708 req = GET_SCPD_XML_FILE;
709 extra_len = os_strlen(wps_scpd_xml);
710 } else {
711 /* File not found */
712 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP GET file not found: %s",
713 filename);
714 buf = wpabuf_alloc(200);
715 if (buf == NULL)
716 return;
717 wpabuf_put_str(buf,
718 "HTTP/1.1 404 Not Found\r\n"
719 "Connection: close\r\n");
720
721 http_put_date(buf);
722
723 /* terminating empty line */
724 wpabuf_put_str(buf, "\r\n");
725
726 goto send_buf;
727 }
728
729 buf = wpabuf_alloc(1000 + extra_len);
730 if (buf == NULL)
731 return;
732
733 wpabuf_put_str(buf,
734 "HTTP/1.1 200 OK\r\n"
735 "Content-Type: text/xml; charset=\"utf-8\"\r\n");
736 wpabuf_put_str(buf, "Server: Unspecified, UPnP/1.0, Unspecified\r\n");
737 wpabuf_put_str(buf, "Connection: close\r\n");
738 wpabuf_put_str(buf, "Content-Length: ");
739 /*
740 * We will paste the length in later, leaving some extra whitespace.
741 * HTTP code is supposed to be tolerant of extra whitespace.
742 */
743 put_length_here = wpabuf_put(buf, 0);
744 wpabuf_put_str(buf, " \r\n");
745
746 http_put_date(buf);
747
748 /* terminating empty line */
749 wpabuf_put_str(buf, "\r\n");
750
751 body_start = wpabuf_put(buf, 0);
752
753 switch (req) {
754 case GET_DEVICE_XML_FILE:
755 format_wps_device_xml(sm, buf);
756 break;
757 case GET_SCPD_XML_FILE:
758 wpabuf_put_str(buf, wps_scpd_xml);
759 break;
760 }
761
762 /* Now patch in the content length at the end */
763 body_length = (char *) wpabuf_put(buf, 0) - body_start;
764 os_snprintf(len_buf, 10, "%d", body_length);
765 os_memcpy(put_length_here, len_buf, os_strlen(len_buf));
766
767 send_buf:
768 send_wpabuf(c->sd, buf);
769 wpabuf_free(buf);
770 }
771
772
773 static struct wpabuf * web_get_item(char *data, const char *name,
774 enum http_reply_code *ret)
775 {
776 char *msg;
777 struct wpabuf *buf;
778 unsigned char *decoded;
779 size_t len;
780
781 if (upnp_get_first_document_item(data, name, &msg)) {
782 *ret = UPNP_ARG_VALUE_INVALID;
783 return NULL;
784 }
785
786 decoded = base64_decode((unsigned char *) msg, os_strlen(msg), &len);
787 os_free(msg);
788 if (decoded == NULL) {
789 *ret = UPNP_OUT_OF_MEMORY;
790 return NULL;
791 }
792
793 buf = wpabuf_alloc_ext_data(decoded, len);
794 if (buf == NULL) {
795 os_free(decoded);
796 *ret = UPNP_OUT_OF_MEMORY;
797 return NULL;
798 }
799 return buf;
800 }
801
802
803 static enum http_reply_code
804 web_process_get_device_info(struct upnp_wps_device_sm *sm,
805 struct wpabuf **reply, const char **replyname)
806 {
807 static const char *name = "NewDeviceInfo";
808
809 wpa_printf(MSG_DEBUG, "WPS UPnP: GetDeviceInfo");
810 if (sm->ctx->rx_req_get_device_info == NULL)
811 return HTTP_INTERNAL_SERVER_ERROR;
812 *reply = sm->ctx->rx_req_get_device_info(sm->priv, &sm->peer);
813 if (*reply == NULL) {
814 wpa_printf(MSG_INFO, "WPS UPnP: Failed to get DeviceInfo");
815 return HTTP_INTERNAL_SERVER_ERROR;
816 }
817 *replyname = name;
818 return HTTP_OK;
819 }
820
821
822 static enum http_reply_code
823 web_process_put_message(struct upnp_wps_device_sm *sm, char *data,
824 struct wpabuf **reply, const char **replyname)
825 {
826 struct wpabuf *msg;
827 static const char *name = "NewOutMessage";
828 enum http_reply_code ret;
829
830 /*
831 * PutMessage is used by external UPnP-based Registrar to perform WPS
832 * operation with the access point itself; as compared with
833 * PutWLANResponse which is for proxying.
834 */
835 wpa_printf(MSG_DEBUG, "WPS UPnP: PutMessage");
836 if (sm->ctx->rx_req_put_message == NULL)
837 return HTTP_INTERNAL_SERVER_ERROR;
838 msg = web_get_item(data, "NewInMessage", &ret);
839 if (msg == NULL)
840 return ret;
841 *reply = sm->ctx->rx_req_put_message(sm->priv, &sm->peer, msg);
842 wpabuf_free(msg);
843 if (*reply == NULL)
844 return HTTP_INTERNAL_SERVER_ERROR;
845 *replyname = name;
846 return HTTP_OK;
847 }
848
849
850 static enum http_reply_code
851 web_process_get_ap_settings(struct upnp_wps_device_sm *sm, char *data,
852 struct wpabuf **reply, const char **replyname)
853 {
854 struct wpabuf *msg;
855 static const char *name = "NewAPSettings";
856 enum http_reply_code ret;
857
858 wpa_printf(MSG_DEBUG, "WPS UPnP: GetAPSettings");
859 if (sm->ctx->rx_req_get_ap_settings == NULL)
860 return HTTP_INTERNAL_SERVER_ERROR;
861 msg = web_get_item(data, "NewMessage", &ret);
862 if (msg == NULL)
863 return ret;
864 *reply = sm->ctx->rx_req_get_ap_settings(sm->priv, msg);
865 wpabuf_free(msg);
866 if (*reply == NULL)
867 return HTTP_INTERNAL_SERVER_ERROR;
868 *replyname = name;
869 return HTTP_OK;
870 }
871
872
873 static enum http_reply_code
874 web_process_set_ap_settings(struct upnp_wps_device_sm *sm, char *data,
875 struct wpabuf **reply, const char **replyname)
876 {
877 struct wpabuf *msg;
878 enum http_reply_code ret;
879
880 wpa_printf(MSG_DEBUG, "WPS UPnP: SetAPSettings");
881 msg = web_get_item(data, "NewAPSettings", &ret);
882 if (msg == NULL)
883 return ret;
884 if (!sm->ctx->rx_req_set_ap_settings ||
885 sm->ctx->rx_req_set_ap_settings(sm->priv, msg)) {
886 wpabuf_free(msg);
887 return HTTP_INTERNAL_SERVER_ERROR;
888 }
889 wpabuf_free(msg);
890 *replyname = NULL;
891 *reply = NULL;
892 return HTTP_OK;
893 }
894
895
896 static enum http_reply_code
897 web_process_del_ap_settings(struct upnp_wps_device_sm *sm, char *data,
898 struct wpabuf **reply, const char **replyname)
899 {
900 struct wpabuf *msg;
901 enum http_reply_code ret;
902
903 wpa_printf(MSG_DEBUG, "WPS UPnP: DelAPSettings");
904 msg = web_get_item(data, "NewAPSettings", &ret);
905 if (msg == NULL)
906 return ret;
907 if (!sm->ctx->rx_req_del_ap_settings ||
908 sm->ctx->rx_req_del_ap_settings(sm->priv, msg)) {
909 wpabuf_free(msg);
910 return HTTP_INTERNAL_SERVER_ERROR;
911 }
912 wpabuf_free(msg);
913 *replyname = NULL;
914 *reply = NULL;
915 return HTTP_OK;
916 }
917
918
919 static enum http_reply_code
920 web_process_get_sta_settings(struct upnp_wps_device_sm *sm, char *data,
921 struct wpabuf **reply, const char **replyname)
922 {
923 struct wpabuf *msg;
924 static const char *name = "NewSTASettings";
925 enum http_reply_code ret;
926
927 wpa_printf(MSG_DEBUG, "WPS UPnP: GetSTASettings");
928 if (sm->ctx->rx_req_get_sta_settings == NULL)
929 return HTTP_INTERNAL_SERVER_ERROR;
930 msg = web_get_item(data, "NewMessage", &ret);
931 if (msg == NULL)
932 return ret;
933 *reply = sm->ctx->rx_req_get_sta_settings(sm->priv, msg);
934 wpabuf_free(msg);
935 if (*reply == NULL)
936 return HTTP_INTERNAL_SERVER_ERROR;
937 *replyname = name;
938 return HTTP_OK;
939 }
940
941
942 static enum http_reply_code
943 web_process_set_sta_settings(struct upnp_wps_device_sm *sm, char *data,
944 struct wpabuf **reply, const char **replyname)
945 {
946 struct wpabuf *msg;
947 enum http_reply_code ret;
948
949 wpa_printf(MSG_DEBUG, "WPS UPnP: SetSTASettings");
950 msg = web_get_item(data, "NewSTASettings", &ret);
951 if (msg == NULL)
952 return ret;
953 if (!sm->ctx->rx_req_set_sta_settings ||
954 sm->ctx->rx_req_set_sta_settings(sm->priv, msg)) {
955 wpabuf_free(msg);
956 return HTTP_INTERNAL_SERVER_ERROR;
957 }
958 wpabuf_free(msg);
959 *replyname = NULL;
960 *reply = NULL;
961 return HTTP_OK;
962 }
963
964
965 static enum http_reply_code
966 web_process_del_sta_settings(struct upnp_wps_device_sm *sm, char *data,
967 struct wpabuf **reply, const char **replyname)
968 {
969 struct wpabuf *msg;
970 enum http_reply_code ret;
971
972 wpa_printf(MSG_DEBUG, "WPS UPnP: DelSTASettings");
973 msg = web_get_item(data, "NewSTASettings", &ret);
974 if (msg == NULL)
975 return ret;
976 if (!sm->ctx->rx_req_del_sta_settings ||
977 sm->ctx->rx_req_del_sta_settings(sm->priv, msg)) {
978 wpabuf_free(msg);
979 return HTTP_INTERNAL_SERVER_ERROR;
980 }
981 wpabuf_free(msg);
982 *replyname = NULL;
983 *reply = NULL;
984 return HTTP_OK;
985 }
986
987
988 static enum http_reply_code
989 web_process_put_wlan_response(struct upnp_wps_device_sm *sm, char *data,
990 struct wpabuf **reply, const char **replyname)
991 {
992 struct wpabuf *msg;
993 enum http_reply_code ret;
994 u8 macaddr[ETH_ALEN];
995 int ev_type;
996 int type;
997 char *val;
998
999 /*
1000 * External UPnP-based Registrar is passing us a message to be proxied
1001 * over to a Wi-Fi -based client of ours.
1002 */
1003
1004 wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse");
1005 msg = web_get_item(data, "NewMessage", &ret);
1006 if (msg == NULL)
1007 return ret;
1008 if (upnp_get_first_document_item(data, "NewWLANEventType", &val)) {
1009 wpabuf_free(msg);
1010 return UPNP_ARG_VALUE_INVALID;
1011 }
1012 ev_type = atol(val);
1013 os_free(val);
1014 val = NULL;
1015 if (upnp_get_first_document_item(data, "NewWLANEventMAC", &val) ||
1016 hwaddr_aton(val, macaddr)) {
1017 wpabuf_free(msg);
1018 os_free(val);
1019 return UPNP_ARG_VALUE_INVALID;
1020 }
1021 os_free(val);
1022 if (ev_type == UPNP_WPS_WLANEVENT_TYPE_EAP) {
1023 struct wps_parse_attr attr;
1024 if (wps_parse_msg(msg, &attr) < 0 ||
1025 attr.msg_type == NULL)
1026 type = -1;
1027 else
1028 type = *attr.msg_type;
1029 wpa_printf(MSG_DEBUG, "WPS UPnP: Message Type %d", type);
1030 } else
1031 type = -1;
1032 if (!sm->ctx->rx_req_put_wlan_response ||
1033 sm->ctx->rx_req_put_wlan_response(sm->priv, ev_type, macaddr, msg,
1034 type)) {
1035 wpa_printf(MSG_INFO, "WPS UPnP: Fail: sm->ctx->"
1036 "rx_req_put_wlan_response");
1037 wpabuf_free(msg);
1038 return HTTP_INTERNAL_SERVER_ERROR;
1039 }
1040 wpabuf_free(msg);
1041 *replyname = NULL;
1042 *reply = NULL;
1043 return HTTP_OK;
1044 }
1045
1046
1047 static enum http_reply_code
1048 web_process_set_selected_registrar(struct upnp_wps_device_sm *sm, char *data,
1049 struct wpabuf **reply,
1050 const char **replyname)
1051 {
1052 struct wpabuf *msg;
1053 enum http_reply_code ret;
1054
1055 wpa_printf(MSG_DEBUG, "WPS UPnP: SetSelectedRegistrar");
1056 msg = web_get_item(data, "NewMessage", &ret);
1057 if (msg == NULL)
1058 return ret;
1059 if (!sm->ctx->rx_req_set_selected_registrar ||
1060 sm->ctx->rx_req_set_selected_registrar(sm->priv, msg)) {
1061 wpabuf_free(msg);
1062 return HTTP_INTERNAL_SERVER_ERROR;
1063 }
1064 wpabuf_free(msg);
1065 *replyname = NULL;
1066 *reply = NULL;
1067 return HTTP_OK;
1068 }
1069
1070
1071 static enum http_reply_code
1072 web_process_reboot_ap(struct upnp_wps_device_sm *sm, char *data,
1073 struct wpabuf **reply, const char **replyname)
1074 {
1075 struct wpabuf *msg;
1076 enum http_reply_code ret;
1077
1078 wpa_printf(MSG_DEBUG, "WPS UPnP: RebootAP");
1079 msg = web_get_item(data, "NewAPSettings", &ret);
1080 if (msg == NULL)
1081 return ret;
1082 if (!sm->ctx->rx_req_reboot_ap ||
1083 sm->ctx->rx_req_reboot_ap(sm->priv, msg)) {
1084 wpabuf_free(msg);
1085 return HTTP_INTERNAL_SERVER_ERROR;
1086 }
1087 wpabuf_free(msg);
1088 *replyname = NULL;
1089 *reply = NULL;
1090 return HTTP_OK;
1091 }
1092
1093
1094 static enum http_reply_code
1095 web_process_reset_ap(struct upnp_wps_device_sm *sm, char *data,
1096 struct wpabuf **reply, const char **replyname)
1097 {
1098 struct wpabuf *msg;
1099 enum http_reply_code ret;
1100
1101 wpa_printf(MSG_DEBUG, "WPS UPnP: ResetAP");
1102 msg = web_get_item(data, "NewMessage", &ret);
1103 if (msg == NULL)
1104 return ret;
1105 if (!sm->ctx->rx_req_reset_ap ||
1106 sm->ctx->rx_req_reset_ap(sm->priv, msg)) {
1107 wpabuf_free(msg);
1108 return HTTP_INTERNAL_SERVER_ERROR;
1109 }
1110 wpabuf_free(msg);
1111 *replyname = NULL;
1112 *reply = NULL;
1113 return HTTP_OK;
1114 }
1115
1116
1117 static enum http_reply_code
1118 web_process_reboot_sta(struct upnp_wps_device_sm *sm, char *data,
1119 struct wpabuf **reply, const char **replyname)
1120 {
1121 struct wpabuf *msg;
1122 enum http_reply_code ret;
1123
1124 wpa_printf(MSG_DEBUG, "WPS UPnP: RebootSTA");
1125 msg = web_get_item(data, "NewSTASettings", &ret);
1126 if (msg == NULL)
1127 return ret;
1128 if (!sm->ctx->rx_req_reboot_sta ||
1129 sm->ctx->rx_req_reboot_sta(sm->priv, msg)) {
1130 wpabuf_free(msg);
1131 return HTTP_INTERNAL_SERVER_ERROR;
1132 }
1133 wpabuf_free(msg);
1134 *replyname = NULL;
1135 *reply = NULL;
1136 return HTTP_OK;
1137 }
1138
1139
1140 static enum http_reply_code
1141 web_process_reset_sta(struct upnp_wps_device_sm *sm, char *data,
1142 struct wpabuf **reply, const char **replyname)
1143 {
1144 struct wpabuf *msg;
1145 enum http_reply_code ret;
1146
1147 wpa_printf(MSG_DEBUG, "WPS UPnP: ResetSTA");
1148 msg = web_get_item(data, "NewMessage", &ret);
1149 if (msg == NULL)
1150 return ret;
1151 if (!sm->ctx->rx_req_reset_sta ||
1152 sm->ctx->rx_req_reset_sta(sm->priv, msg)) {
1153 wpabuf_free(msg);
1154 return HTTP_INTERNAL_SERVER_ERROR;
1155 }
1156 wpabuf_free(msg);
1157 *replyname = NULL;
1158 *reply = NULL;
1159 return HTTP_OK;
1160 }
1161
1162
1163 static const char *soap_prefix =
1164 "<?xml version=\"1.0\"?>\n"
1165 "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" "
1166 "s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n"
1167 "<s:Body>\n";
1168 static const char *soap_postfix =
1169 "</s:Body>\n</s:Envelope>\n";
1170
1171 static const char *soap_error_prefix =
1172 "<s:Fault>\n"
1173 "<faultcode>s:Client</faultcode>\n"
1174 "<faultstring>UPnPError</faultstring>\n"
1175 "<detail>\n"
1176 "<UPnPError xmlns=\"urn:schemas-upnp-org:control-1-0\">\n";
1177 static const char *soap_error_postfix =
1178 "<errorDescription>Error</errorDescription>\n"
1179 "</UPnPError>\n"
1180 "</detail>\n"
1181 "</s:Fault>\n";
1182
1183 static void web_connection_send_reply(struct web_connection *c,
1184 enum http_reply_code ret,
1185 const char *action, int action_len,
1186 const struct wpabuf *reply,
1187 const char *replyname)
1188 {
1189 struct wpabuf *buf;
1190 char *replydata;
1191 char *put_length_here = NULL;
1192 char *body_start = NULL;
1193
1194 if (reply) {
1195 size_t len;
1196 replydata = (char *) base64_encode(wpabuf_head(reply),
1197 wpabuf_len(reply), &len);
1198 } else
1199 replydata = NULL;
1200
1201 /* Parameters of the response:
1202 * action(action_len) -- action we are responding to
1203 * replyname -- a name we need for the reply
1204 * replydata -- NULL or null-terminated string
1205 */
1206 buf = wpabuf_alloc(1000 + (replydata ? os_strlen(replydata) : 0U) +
1207 (action_len > 0 ? action_len * 2 : 0));
1208 if (buf == NULL) {
1209 wpa_printf(MSG_INFO, "WPS UPnP: Cannot allocate reply to "
1210 "POST");
1211 wpabuf_free(buf);
1212 os_free(replydata);
1213 return;
1214 }
1215
1216 /*
1217 * Assuming we will be successful, put in the output header first.
1218 * Note: we do not keep connections alive (and httpread does
1219 * not support it)... therefore we must have Connection: close.
1220 */
1221 if (ret == HTTP_OK) {
1222 wpabuf_put_str(buf,
1223 "HTTP/1.1 200 OK\r\n"
1224 "Content-Type: text/xml; "
1225 "charset=\"utf-8\"\r\n");
1226 } else {
1227 wpabuf_printf(buf, "HTTP/1.1 %d Error\r\n", ret);
1228 }
1229 wpabuf_put_str(buf, http_connection_close);
1230
1231 wpabuf_put_str(buf, "Content-Length: ");
1232 /*
1233 * We will paste the length in later, leaving some extra whitespace.
1234 * HTTP code is supposed to be tolerant of extra whitespace.
1235 */
1236 put_length_here = wpabuf_put(buf, 0);
1237 wpabuf_put_str(buf, " \r\n");
1238
1239 http_put_date(buf);
1240
1241 /* terminating empty line */
1242 wpabuf_put_str(buf, "\r\n");
1243
1244 body_start = wpabuf_put(buf, 0);
1245
1246 if (ret == HTTP_OK) {
1247 wpabuf_put_str(buf, soap_prefix);
1248 wpabuf_put_str(buf, "<u:");
1249 wpabuf_put_data(buf, action, action_len);
1250 wpabuf_put_str(buf, "Response xmlns:u=\"");
1251 wpabuf_put_str(buf, urn_wfawlanconfig);
1252 wpabuf_put_str(buf, "\">\n");
1253 if (replydata && replyname) {
1254 /* TODO: might possibly need to escape part of reply
1255 * data? ...
1256 * probably not, unlikely to have ampersand(&) or left
1257 * angle bracket (<) in it...
1258 */
1259 wpabuf_printf(buf, "<%s>", replyname);
1260 wpabuf_put_str(buf, replydata);
1261 wpabuf_printf(buf, "</%s>\n", replyname);
1262 }
1263 wpabuf_put_str(buf, "</u:");
1264 wpabuf_put_data(buf, action, action_len);
1265 wpabuf_put_str(buf, "Response>\n");
1266 wpabuf_put_str(buf, soap_postfix);
1267 } else {
1268 /* Error case */
1269 wpabuf_put_str(buf, soap_prefix);
1270 wpabuf_put_str(buf, soap_error_prefix);
1271 wpabuf_printf(buf, "<errorCode>%d</errorCode>\n", ret);
1272 wpabuf_put_str(buf, soap_error_postfix);
1273 wpabuf_put_str(buf, soap_postfix);
1274 }
1275 os_free(replydata);
1276
1277 /* Now patch in the content length at the end */
1278 if (body_start && put_length_here) {
1279 int body_length = (char *) wpabuf_put(buf, 0) - body_start;
1280 char len_buf[10];
1281 os_snprintf(len_buf, sizeof(len_buf), "%d", body_length);
1282 os_memcpy(put_length_here, len_buf, os_strlen(len_buf));
1283 }
1284
1285 send_wpabuf(c->sd, buf);
1286 wpabuf_free(buf);
1287 }
1288
1289
1290 static const char * web_get_action(struct web_connection *c,
1291 const char *filename, size_t *action_len)
1292 {
1293 const char *match;
1294 int match_len;
1295 char *b;
1296 char *action;
1297
1298 *action_len = 0;
1299 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_CONTROL_FILE)) {
1300 wpa_printf(MSG_INFO, "WPS UPnP: Invalid POST filename %s",
1301 filename);
1302 return NULL;
1303 }
1304 /* The SOAPAction line of the header tells us what we want to do */
1305 b = httpread_hdr_line_get(c->hread, "SOAPAction:");
1306 if (b == NULL)
1307 return NULL;
1308 if (*b == '"')
1309 b++;
1310 else
1311 return NULL;
1312 match = urn_wfawlanconfig;
1313 match_len = os_strlen(urn_wfawlanconfig) - 1;
1314 if (os_strncasecmp(b, match, match_len))
1315 return NULL;
1316 b += match_len;
1317 /* skip over version */
1318 while (isgraph(*b) && *b != '#')
1319 b++;
1320 if (*b != '#')
1321 return NULL;
1322 b++;
1323 /* Following the sharp(#) should be the action and a double quote */
1324 action = b;
1325 while (isgraph(*b) && *b != '"')
1326 b++;
1327 if (*b != '"')
1328 return NULL;
1329 *action_len = b - action;
1330 return action;
1331 }
1332
1333
1334 /* Given that we have received a header w/ POST, act upon it
1335 *
1336 * Format of POST (case-insensitive):
1337 *
1338 * First line must be:
1339 * POST /<file> HTTP/1.1
1340 * Since we don't do anything fancy we just ignore other lines.
1341 *
1342 * Our response (if no error) which includes only required lines is:
1343 * HTTP/1.1 200 OK
1344 * Connection: close
1345 * Content-Type: text/xml
1346 * Date: <rfc1123-date>
1347 *
1348 * Header lines must end with \r\n
1349 * Per RFC 2616, content-length: is not required but connection:close
1350 * would appear to be required (given that we will be closing it!).
1351 */
1352 static void web_connection_parse_post(struct web_connection *c,
1353 const char *filename)
1354 {
1355 enum http_reply_code ret;
1356 struct upnp_wps_device_sm *sm = c->sm;
1357 char *data = httpread_data_get(c->hread); /* body of http msg */
1358 const char *action;
1359 size_t action_len;
1360 const char *replyname = NULL; /* argument name for the reply */
1361 struct wpabuf *reply = NULL; /* data for the reply */
1362
1363 ret = UPNP_INVALID_ACTION;
1364 action = web_get_action(c, filename, &action_len);
1365 if (action == NULL)
1366 goto bad;
1367
1368 /*
1369 * There are quite a few possible actions. Although we appear to
1370 * support them all here, not all of them are necessarily supported by
1371 * callbacks at higher levels.
1372 */
1373 if (!os_strncasecmp("GetDeviceInfo", action, action_len))
1374 ret = web_process_get_device_info(sm, &reply, &replyname);
1375 else if (!os_strncasecmp("PutMessage", action, action_len))
1376 ret = web_process_put_message(sm, data, &reply, &replyname);
1377 else if (!os_strncasecmp("GetAPSettings", action, action_len))
1378 ret = web_process_get_ap_settings(sm, data, &reply,
1379 &replyname);
1380 else if (!os_strncasecmp("SetAPSettings", action, action_len))
1381 ret = web_process_set_ap_settings(sm, data, &reply,
1382 &replyname);
1383 else if (!os_strncasecmp("DelAPSettings", action, action_len))
1384 ret = web_process_del_ap_settings(sm, data, &reply,
1385 &replyname);
1386 else if (!os_strncasecmp("GetSTASettings", action, action_len))
1387 ret = web_process_get_sta_settings(sm, data, &reply,
1388 &replyname);
1389 else if (!os_strncasecmp("SetSTASettings", action, action_len))
1390 ret = web_process_set_sta_settings(sm, data, &reply,
1391 &replyname);
1392 else if (!os_strncasecmp("DelSTASettings", action, action_len))
1393 ret = web_process_del_sta_settings(sm, data, &reply,
1394 &replyname);
1395 else if (!os_strncasecmp("PutWLANResponse", action, action_len))
1396 ret = web_process_put_wlan_response(sm, data, &reply,
1397 &replyname);
1398 else if (!os_strncasecmp("SetSelectedRegistrar", action, action_len))
1399 ret = web_process_set_selected_registrar(sm, data, &reply,
1400 &replyname);
1401 else if (!os_strncasecmp("RebootAP", action, action_len))
1402 ret = web_process_reboot_ap(sm, data, &reply, &replyname);
1403 else if (!os_strncasecmp("ResetAP", action, action_len))
1404 ret = web_process_reset_ap(sm, data, &reply, &replyname);
1405 else if (!os_strncasecmp("RebootSTA", action, action_len))
1406 ret = web_process_reboot_sta(sm, data, &reply, &replyname);
1407 else if (!os_strncasecmp("ResetSTA", action, action_len))
1408 ret = web_process_reset_sta(sm, data, &reply, &replyname);
1409 else
1410 wpa_printf(MSG_INFO, "WPS UPnP: Unknown POST type");
1411
1412 bad:
1413 if (ret != HTTP_OK)
1414 wpa_printf(MSG_INFO, "WPS UPnP: POST failure ret=%d", ret);
1415 web_connection_send_reply(c, ret, action, action_len, reply,
1416 replyname);
1417 wpabuf_free(reply);
1418 }
1419
1420
1421 /* Given that we have received a header w/ SUBSCRIBE, act upon it
1422 *
1423 * Format of SUBSCRIBE (case-insensitive):
1424 *
1425 * First line must be:
1426 * SUBSCRIBE /wps_event HTTP/1.1
1427 *
1428 * Our response (if no error) which includes only required lines is:
1429 * HTTP/1.1 200 OK
1430 * Server: xx, UPnP/1.0, xx
1431 * SID: uuid:xxxxxxxxx
1432 * Timeout: Second-<n>
1433 * Content-Length: 0
1434 * Date: xxxx
1435 *
1436 * Header lines must end with \r\n
1437 * Per RFC 2616, content-length: is not required but connection:close
1438 * would appear to be required (given that we will be closing it!).
1439 */
1440 static void web_connection_parse_subscribe(struct web_connection *c,
1441 const char *filename)
1442 {
1443 struct upnp_wps_device_sm *sm = c->sm;
1444 struct wpabuf *buf;
1445 char *b;
1446 char *hdr = httpread_hdr_get(c->hread);
1447 char *h;
1448 char *match;
1449 int match_len;
1450 char *end;
1451 int len;
1452 int got_nt = 0;
1453 u8 uuid[UUID_LEN];
1454 int got_uuid = 0;
1455 char *callback_urls = NULL;
1456 struct subscription *s = NULL;
1457 enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR;
1458
1459 buf = wpabuf_alloc(1000);
1460 if (buf == NULL)
1461 return;
1462
1463 /* Parse/validate headers */
1464 h = hdr;
1465 /* First line: SUBSCRIBE /wps_event HTTP/1.1
1466 * has already been parsed.
1467 */
1468 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) {
1469 ret = HTTP_PRECONDITION_FAILED;
1470 goto error;
1471 }
1472 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP SUBSCRIBE for event");
1473 end = os_strchr(h, '\n');
1474
1475 for (; end != NULL; h = end + 1) {
1476 /* Option line by option line */
1477 h = end + 1;
1478 end = os_strchr(h, '\n');
1479 if (end == NULL)
1480 break; /* no unterminated lines allowed */
1481
1482 /* NT assures that it is our type of subscription;
1483 * not used for a renewl.
1484 **/
1485 match = "NT:";
1486 match_len = os_strlen(match);
1487 if (os_strncasecmp(h, match, match_len) == 0) {
1488 h += match_len;
1489 while (*h == ' ' || *h == '\t')
1490 h++;
1491 match = "upnp:event";
1492 match_len = os_strlen(match);
1493 if (os_strncasecmp(h, match, match_len) != 0) {
1494 ret = HTTP_BAD_REQUEST;
1495 goto error;
1496 }
1497 got_nt = 1;
1498 continue;
1499 }
1500 /* HOST should refer to us */
1501 #if 0
1502 match = "HOST:";
1503 match_len = os_strlen(match);
1504 if (os_strncasecmp(h, match, match_len) == 0) {
1505 h += match_len;
1506 while (*h == ' ' || *h == '\t')
1507 h++;
1508 .....
1509 }
1510 #endif
1511 /* CALLBACK gives one or more URLs for NOTIFYs
1512 * to be sent as a result of the subscription.
1513 * Each URL is enclosed in angle brackets.
1514 */
1515 match = "CALLBACK:";
1516 match_len = os_strlen(match);
1517 if (os_strncasecmp(h, match, match_len) == 0) {
1518 h += match_len;
1519 while (*h == ' ' || *h == '\t')
1520 h++;
1521 len = end - h;
1522 os_free(callback_urls);
1523 callback_urls = os_malloc(len + 1);
1524 if (callback_urls == NULL) {
1525 ret = HTTP_INTERNAL_SERVER_ERROR;
1526 goto error;
1527 }
1528 os_memcpy(callback_urls, h, len);
1529 callback_urls[len] = 0;
1530 continue;
1531 }
1532 /* SID is only for renewal */
1533 match = "SID:";
1534 match_len = os_strlen(match);
1535 if (os_strncasecmp(h, match, match_len) == 0) {
1536 h += match_len;
1537 while (*h == ' ' || *h == '\t')
1538 h++;
1539 match = "uuid:";
1540 match_len = os_strlen(match);
1541 if (os_strncasecmp(h, match, match_len) != 0) {
1542 ret = HTTP_BAD_REQUEST;
1543 goto error;
1544 }
1545 h += match_len;
1546 while (*h == ' ' || *h == '\t')
1547 h++;
1548 if (uuid_str2bin(h, uuid)) {
1549 ret = HTTP_BAD_REQUEST;
1550 goto error;
1551 }
1552 got_uuid = 1;
1553 continue;
1554 }
1555 /* TIMEOUT is requested timeout, but apparently we can
1556 * just ignore this.
1557 */
1558 }
1559
1560 if (got_uuid) {
1561 /* renewal */
1562 if (callback_urls) {
1563 ret = HTTP_BAD_REQUEST;
1564 goto error;
1565 }
1566 s = subscription_renew(sm, uuid);
1567 if (s == NULL) {
1568 ret = HTTP_PRECONDITION_FAILED;
1569 goto error;
1570 }
1571 } else if (callback_urls) {
1572 if (!got_nt) {
1573 ret = HTTP_PRECONDITION_FAILED;
1574 goto error;
1575 }
1576 s = subscription_start(sm, callback_urls);
1577 if (s == NULL) {
1578 ret = HTTP_INTERNAL_SERVER_ERROR;
1579 goto error;
1580 }
1581 } else {
1582 ret = HTTP_PRECONDITION_FAILED;
1583 goto error;
1584 }
1585
1586 /* success */
1587 http_put_reply_code(buf, HTTP_OK);
1588 wpabuf_put_str(buf, http_server_hdr);
1589 wpabuf_put_str(buf, http_connection_close);
1590 wpabuf_put_str(buf, "Content-Length: 0\r\n");
1591 wpabuf_put_str(buf, "SID: uuid:");
1592 /* subscription id */
1593 b = wpabuf_put(buf, 0);
1594 uuid_bin2str(s->uuid, b, 80);
1595 wpabuf_put(buf, os_strlen(b));
1596 wpabuf_put_str(buf, "\r\n");
1597 wpabuf_printf(buf, "Timeout: Second-%d\r\n", UPNP_SUBSCRIBE_SEC);
1598 http_put_date(buf);
1599 /* And empty line to terminate header: */
1600 wpabuf_put_str(buf, "\r\n");
1601
1602 send_wpabuf(c->sd, buf);
1603 wpabuf_free(buf);
1604 os_free(callback_urls);
1605 return;
1606
1607 error:
1608 /* Per UPnP spec:
1609 * Errors
1610 * Incompatible headers
1611 * 400 Bad Request. If SID header and one of NT or CALLBACK headers
1612 * are present, the publisher must respond with HTTP error
1613 * 400 Bad Request.
1614 * Missing or invalid CALLBACK
1615 * 412 Precondition Failed. If CALLBACK header is missing or does not
1616 * contain a valid HTTP URL, the publisher must respond with HTTP
1617 * error 412 Precondition Failed.
1618 * Invalid NT
1619 * 412 Precondition Failed. If NT header does not equal upnp:event,
1620 * the publisher must respond with HTTP error 412 Precondition
1621 * Failed.
1622 * [For resubscription, use 412 if unknown uuid].
1623 * Unable to accept subscription
1624 * 5xx. If a publisher is not able to accept a subscription (such as
1625 * due to insufficient resources), it must respond with a
1626 * HTTP 500-series error code.
1627 * 599 Too many subscriptions (not a standard HTTP error)
1628 */
1629 http_put_empty(buf, ret);
1630 send_wpabuf(c->sd, buf);
1631 wpabuf_free(buf);
1632 os_free(callback_urls);
1633 }
1634
1635
1636 /* Given that we have received a header w/ UNSUBSCRIBE, act upon it
1637 *
1638 * Format of UNSUBSCRIBE (case-insensitive):
1639 *
1640 * First line must be:
1641 * UNSUBSCRIBE /wps_event HTTP/1.1
1642 *
1643 * Our response (if no error) which includes only required lines is:
1644 * HTTP/1.1 200 OK
1645 * Content-Length: 0
1646 *
1647 * Header lines must end with \r\n
1648 * Per RFC 2616, content-length: is not required but connection:close
1649 * would appear to be required (given that we will be closing it!).
1650 */
1651 static void web_connection_parse_unsubscribe(struct web_connection *c,
1652 const char *filename)
1653 {
1654 struct upnp_wps_device_sm *sm = c->sm;
1655 struct wpabuf *buf;
1656 char *hdr = httpread_hdr_get(c->hread);
1657 char *h;
1658 char *match;
1659 int match_len;
1660 char *end;
1661 u8 uuid[UUID_LEN];
1662 int got_uuid = 0;
1663 struct subscription *s = NULL;
1664 enum http_reply_code ret = HTTP_INTERNAL_SERVER_ERROR;
1665
1666 /* Parse/validate headers */
1667 h = hdr;
1668 /* First line: UNSUBSCRIBE /wps_event HTTP/1.1
1669 * has already been parsed.
1670 */
1671 if (os_strcasecmp(filename, UPNP_WPS_DEVICE_EVENT_FILE) != 0) {
1672 ret = HTTP_PRECONDITION_FAILED;
1673 goto send_msg;
1674 }
1675 wpa_printf(MSG_DEBUG, "WPS UPnP: HTTP UNSUBSCRIBE for event");
1676 end = os_strchr(h, '\n');
1677
1678 for (; end != NULL; h = end + 1) {
1679 /* Option line by option line */
1680 h = end + 1;
1681 end = os_strchr(h, '\n');
1682 if (end == NULL)
1683 break; /* no unterminated lines allowed */
1684
1685 /* HOST should refer to us */
1686 #if 0
1687 match = "HOST:";
1688 match_len = os_strlen(match);
1689 if (os_strncasecmp(h, match, match_len) == 0) {
1690 h += match_len;
1691 while (*h == ' ' || *h == '\t')
1692 h++;
1693 .....
1694 }
1695 #endif
1696 /* SID is only for renewal */
1697 match = "SID:";
1698 match_len = os_strlen(match);
1699 if (os_strncasecmp(h, match, match_len) == 0) {
1700 h += match_len;
1701 while (*h == ' ' || *h == '\t')
1702 h++;
1703 match = "uuid:";
1704 match_len = os_strlen(match);
1705 if (os_strncasecmp(h, match, match_len) != 0) {
1706 ret = HTTP_BAD_REQUEST;
1707 goto send_msg;
1708 }
1709 h += match_len;
1710 while (*h == ' ' || *h == '\t')
1711 h++;
1712 if (uuid_str2bin(h, uuid)) {
1713 ret = HTTP_BAD_REQUEST;
1714 goto send_msg;
1715 }
1716 got_uuid = 1;
1717 continue;
1718 }
1719 }
1720
1721 if (got_uuid) {
1722 s = subscription_find(sm, uuid);
1723 if (s) {
1724 wpa_printf(MSG_DEBUG, "WPS UPnP: Unsubscribing %p %s",
1725 s,
1726 (s && s->addr_list &&
1727 s->addr_list->domain_and_port) ?
1728 s->addr_list->domain_and_port : "-null-");
1729 subscription_unlink(s);
1730 subscription_destroy(s);
1731 }
1732 } else {
1733 wpa_printf(MSG_INFO, "WPS UPnP: Unsubscribe fails (not "
1734 "found)");
1735 ret = HTTP_PRECONDITION_FAILED;
1736 goto send_msg;
1737 }
1738
1739 ret = HTTP_OK;
1740
1741 send_msg:
1742 buf = wpabuf_alloc(200);
1743 if (buf == NULL)
1744 return;
1745 http_put_empty(buf, ret);
1746 send_wpabuf(c->sd, buf);
1747 wpabuf_free(buf);
1748 }
1749
1750
1751 /* Send error in response to unknown requests */
1752 static void web_connection_unimplemented(struct web_connection *c)
1753 {
1754 struct wpabuf *buf;
1755 buf = wpabuf_alloc(200);
1756 if (buf == NULL)
1757 return;
1758 http_put_empty(buf, HTTP_UNIMPLEMENTED);
1759 send_wpabuf(c->sd, buf);
1760 wpabuf_free(buf);
1761 }
1762
1763
1764
1765 /* Called when we have gotten an apparently valid http request.
1766 */
1767 static void web_connection_check_data(struct web_connection *c)
1768 {
1769 struct httpread *hread = c->hread;
1770 enum httpread_hdr_type htype = httpread_hdr_type_get(hread);
1771 /* char *data = httpread_data_get(hread); */
1772 char *filename = httpread_uri_get(hread);
1773
1774 c->done = 1;
1775 if (!filename) {
1776 wpa_printf(MSG_INFO, "WPS UPnP: Could not get HTTP URI");
1777 return;
1778 }
1779 /* Trim leading slashes from filename */
1780 while (*filename == '/')
1781 filename++;
1782
1783 wpa_printf(MSG_DEBUG, "WPS UPnP: Got HTTP request type %d from %s:%d",
1784 htype, inet_ntoa(c->cli_addr.sin_addr),
1785 htons(c->cli_addr.sin_port));
1786
1787 switch (htype) {
1788 case HTTPREAD_HDR_TYPE_GET:
1789 web_connection_parse_get(c, filename);
1790 break;
1791 case HTTPREAD_HDR_TYPE_POST:
1792 web_connection_parse_post(c, filename);
1793 break;
1794 case HTTPREAD_HDR_TYPE_SUBSCRIBE:
1795 web_connection_parse_subscribe(c, filename);
1796 break;
1797 case HTTPREAD_HDR_TYPE_UNSUBSCRIBE:
1798 web_connection_parse_unsubscribe(c, filename);
1799 break;
1800 /* We are not required to support M-POST; just plain
1801 * POST is supposed to work, so we only support that.
1802 * If for some reason we need to support M-POST, it is
1803 * mostly the same as POST, with small differences.
1804 */
1805 default:
1806 /* Send 501 for anything else */
1807 web_connection_unimplemented(c);
1808 break;
1809 }
1810 }
1811
1812
1813
1814 /* called back when we have gotten request */
1815 static void web_connection_got_file_handler(struct httpread *handle,
1816 void *cookie,
1817 enum httpread_event en)
1818 {
1819 struct web_connection *c = cookie;
1820
1821 if (en == HTTPREAD_EVENT_FILE_READY)
1822 web_connection_check_data(c);
1823 web_connection_stop(c);
1824 }
1825
1826
1827 /* web_connection_start - Start web connection
1828 * @sm: WPS UPnP state machine from upnp_wps_device_init()
1829 * @sd: Socket descriptor
1830 * @addr: Client address
1831 *
1832 * The socket descriptor sd is handed over for ownership by the WPS UPnP
1833 * state machine.
1834 */
1835 static void web_connection_start(struct upnp_wps_device_sm *sm,
1836 int sd, struct sockaddr_in *addr)
1837 {
1838 struct web_connection *c = NULL;
1839
1840 /* if too many connections, bail */
1841 if (sm->n_web_connections >= MAX_WEB_CONNECTIONS) {
1842 close(sd);
1843 return;
1844 }
1845
1846 c = os_zalloc(sizeof(*c));
1847 if (c == NULL)
1848 return;
1849 os_memcpy(&c->cli_addr, addr, sizeof(c->cli_addr));
1850 c->sm = sm;
1851 c->sd = sd;
1852 #if 0
1853 /*
1854 * Setting non-blocking should not be necessary for read, and can mess
1855 * up sending where blocking might be better.
1856 */
1857 if (fcntl(sd, F_SETFL, O_NONBLOCK) != 0)
1858 break;
1859 #endif
1860 c->hread = httpread_create(c->sd, web_connection_got_file_handler,
1861 c /* cookie */,
1862 WEB_CONNECTION_MAX_READ,
1863 WEB_CONNECTION_TIMEOUT_SEC);
1864 if (c->hread == NULL)
1865 goto fail;
1866 if (sm->web_connections) {
1867 c->next = sm->web_connections;
1868 c->prev = c->next->prev;
1869 c->prev->next = c;
1870 c->next->prev = c;
1871 } else {
1872 sm->web_connections = c->next = c->prev = c;
1873 }
1874 sm->n_web_connections++;
1875 return;
1876
1877 fail:
1878 if (c)
1879 web_connection_stop(c);
1880 }
1881
1882
1883 /*
1884 * Listening for web connections
1885 * We have a single TCP listening port, and hand off connections as we get
1886 * them.
1887 */
1888
1889 void web_listener_stop(struct upnp_wps_device_sm *sm)
1890 {
1891 if (sm->web_sd_registered) {
1892 sm->web_sd_registered = 0;
1893 eloop_unregister_sock(sm->web_sd, EVENT_TYPE_READ);
1894 }
1895 if (sm->web_sd >= 0)
1896 close(sm->web_sd);
1897 sm->web_sd = -1;
1898 }
1899
1900
1901 static void web_listener_handler(int sd, void *eloop_ctx, void *sock_ctx)
1902 {
1903 struct sockaddr_in addr;
1904 socklen_t addr_len = sizeof(addr);
1905 struct upnp_wps_device_sm *sm = sock_ctx;
1906 int new_sd;
1907
1908 /* Create state for new connection */
1909 /* Remember so we can cancel if need be */
1910 new_sd = accept(sm->web_sd, (struct sockaddr *) &addr, &addr_len);
1911 if (new_sd < 0) {
1912 wpa_printf(MSG_ERROR, "WPS UPnP: web listener accept "
1913 "errno=%d (%s) web_sd=%d",
1914 errno, strerror(errno), sm->web_sd);
1915 return;
1916 }
1917 web_connection_start(sm, new_sd, &addr);
1918 }
1919
1920
1921 int web_listener_start(struct upnp_wps_device_sm *sm)
1922 {
1923 struct sockaddr_in addr;
1924 int port;
1925
1926 sm->web_sd = socket(AF_INET, SOCK_STREAM, 0);
1927 if (sm->web_sd < 0)
1928 goto fail;
1929 if (fcntl(sm->web_sd, F_SETFL, O_NONBLOCK) != 0)
1930 goto fail;
1931 port = 49152; /* first non-reserved port */
1932 for (;;) {
1933 os_memset(&addr, 0, sizeof(addr));
1934 addr.sin_family = AF_INET;
1935 addr.sin_addr.s_addr = sm->ip_addr;
1936 addr.sin_port = htons(port);
1937 if (bind(sm->web_sd, (struct sockaddr *) &addr,
1938 sizeof(addr)) == 0)
1939 break;
1940 if (errno == EADDRINUSE) {
1941 /* search for unused port */
1942 if (++port == 65535)
1943 goto fail;
1944 continue;
1945 }
1946 goto fail;
1947 }
1948 if (listen(sm->web_sd, 10 /* max backlog */) != 0)
1949 goto fail;
1950 if (fcntl(sm->web_sd, F_SETFL, O_NONBLOCK) != 0)
1951 goto fail;
1952 if (eloop_register_sock(sm->web_sd, EVENT_TYPE_READ,
1953 web_listener_handler, NULL, sm))
1954 goto fail;
1955 sm->web_sd_registered = 1;
1956 sm->web_port = port;
1957
1958 return 0;
1959
1960 fail:
1961 /* Error */
1962 web_listener_stop(sm);
1963 return -1;
1964 }
DragonFly BSD