2 * Hotspot 2.0 OSU client
3 * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
13 #include "private/android_filesystem_config.h"
17 #include "utils/browser.h"
18 #include "utils/base64.h"
19 #include "utils/xml-utils.h"
20 #include "utils/http-utils.h"
21 #include "common/wpa_ctrl.h"
22 #include "common/wpa_helpers.h"
23 #include "eap_common/eap_defs.h"
24 #include "crypto/crypto.h"
25 #include "crypto/sha256.h"
26 #include "osu_client.h"
29 void write_result(struct hs20_osu_client *ctx, const char *fmt, ...)
36 vsnprintf(buf, sizeof(buf), fmt, ap);
38 write_summary(ctx, "%s", buf);
40 if (!ctx->result_file)
43 f = fopen(ctx->result_file, "w");
55 void write_summary(struct hs20_osu_client *ctx, const char *fmt, ...)
60 if (!ctx->summary_file)
63 f = fopen(ctx->summary_file, "a");
75 void debug_dump_node(struct hs20_osu_client *ctx, const char *title,
78 char *str = xml_node_to_str(ctx->xml, node);
79 wpa_printf(MSG_DEBUG, "[hs20] %s: '%s'", title, str);
84 static int valid_fqdn(const char *fqdn)
88 /* TODO: could make this more complete.. */
89 if (strchr(fqdn, '.') == 0 || strlen(fqdn) > 255)
91 for (pos = fqdn; *pos; pos++) {
92 if (*pos >= 'a' && *pos <= 'z')
94 if (*pos >= 'A' && *pos <= 'Z')
96 if (*pos >= '0' && *pos <= '9')
98 if (*pos == '-' || *pos == '.' || *pos == '_')
106 int osu_get_certificate(struct hs20_osu_client *ctx, xml_node_t *getcert)
109 char *url, *user = NULL, *pw = NULL;
113 proto = xml_node_get_attr_value(ctx->xml, getcert,
114 "enrollmentProtocol");
117 wpa_printf(MSG_INFO, "getCertificate - enrollmentProtocol=%s", proto);
118 write_summary(ctx, "getCertificate - enrollmentProtocol=%s", proto);
119 if (os_strcasecmp(proto, "EST") != 0) {
120 wpa_printf(MSG_INFO, "Unsupported enrollmentProtocol");
121 xml_node_get_attr_value_free(ctx->xml, proto);
124 xml_node_get_attr_value_free(ctx->xml, proto);
126 node = get_node(ctx->xml, getcert, "enrollmentServerURI");
128 wpa_printf(MSG_INFO, "Could not find enrollmentServerURI node");
129 xml_node_get_attr_value_free(ctx->xml, proto);
132 url = xml_node_get_text(ctx->xml, node);
134 wpa_printf(MSG_INFO, "Could not get URL text");
137 wpa_printf(MSG_INFO, "enrollmentServerURI: %s", url);
138 write_summary(ctx, "enrollmentServerURI: %s", url);
140 node = get_node(ctx->xml, getcert, "estUserID");
141 if (node == NULL && !ctx->client_cert_present) {
142 wpa_printf(MSG_INFO, "Could not find estUserID node");
146 user = xml_node_get_text(ctx->xml, node);
148 wpa_printf(MSG_INFO, "Could not get estUserID text");
151 wpa_printf(MSG_INFO, "estUserID: %s", user);
152 write_summary(ctx, "estUserID: %s", user);
155 node = get_node(ctx->xml, getcert, "estPassword");
156 if (node == NULL && !ctx->client_cert_present) {
157 wpa_printf(MSG_INFO, "Could not find estPassword node");
161 pw = xml_node_get_base64_text(ctx->xml, node, NULL);
163 wpa_printf(MSG_INFO, "Could not get estPassword text");
166 wpa_printf(MSG_INFO, "estPassword: %s", pw);
169 mkdir("Cert", S_IRWXU);
170 if (est_load_cacerts(ctx, url) < 0 ||
171 est_build_csr(ctx, url) < 0 ||
172 est_simple_enroll(ctx, url, user, pw) < 0)
177 xml_node_get_text_free(ctx->xml, url);
178 xml_node_get_text_free(ctx->xml, user);
179 xml_node_get_text_free(ctx->xml, pw);
185 static int process_est_cert(struct hs20_osu_client *ctx, xml_node_t *cert,
188 u8 digest1[SHA256_MAC_LEN], digest2[SHA256_MAC_LEN];
190 size_t der_len, pem_len;
194 wpa_printf(MSG_INFO, "PPS for certificate credential - fqdn=%s", fqdn);
196 fingerprint = xml_node_get_text(ctx->xml, cert);
197 if (fingerprint == NULL)
199 if (hexstr2bin(fingerprint, digest1, SHA256_MAC_LEN) < 0) {
200 wpa_printf(MSG_INFO, "Invalid SHA256 hash value");
201 write_result(ctx, "Invalid client certificate SHA256 hash value in PPS");
202 xml_node_get_text_free(ctx->xml, fingerprint);
205 xml_node_get_text_free(ctx->xml, fingerprint);
207 der = os_readfile("Cert/est_cert.der", &der_len);
209 wpa_printf(MSG_INFO, "Could not find client certificate from EST");
210 write_result(ctx, "Could not find client certificate from EST");
214 if (sha256_vector(1, (const u8 **) &der, &der_len, digest2) < 0) {
220 if (os_memcmp(digest1, digest2, sizeof(digest1)) != 0) {
221 wpa_printf(MSG_INFO, "Client certificate from EST does not match fingerprint from PPS MO");
222 write_result(ctx, "Client certificate from EST does not match fingerprint from PPS MO");
226 wpa_printf(MSG_INFO, "Client certificate from EST matches PPS MO");
227 unlink("Cert/est_cert.der");
229 os_snprintf(buf, sizeof(buf), "SP/%s/client-ca.pem", fqdn);
230 if (rename("Cert/est-cacerts.pem", buf) < 0) {
231 wpa_printf(MSG_INFO, "Could not move est-cacerts.pem to client-ca.pem: %s",
235 pem = os_readfile(buf, &pem_len);
237 os_snprintf(buf, sizeof(buf), "SP/%s/client-cert.pem", fqdn);
238 if (rename("Cert/est_cert.pem", buf) < 0) {
239 wpa_printf(MSG_INFO, "Could not move est_cert.pem to client-cert.pem: %s",
246 FILE *f = fopen(buf, "a");
248 fwrite(pem, pem_len, 1, f);
254 os_snprintf(buf, sizeof(buf), "SP/%s/client-key.pem", fqdn);
255 if (rename("Cert/privkey-plain.pem", buf) < 0) {
256 wpa_printf(MSG_INFO, "Could not move privkey-plain.pem to client-key.pem: %s",
261 unlink("Cert/est-req.b64");
262 unlink("Cert/est-req.pem");
263 unlink("Cert/est-resp.raw");
270 #define TMP_CERT_DL_FILE "tmp-cert-download"
272 static int download_cert(struct hs20_osu_client *ctx, xml_node_t *params,
275 xml_node_t *url_node, *hash_node;
279 u8 digest1[SHA256_MAC_LEN], digest2[SHA256_MAC_LEN];
284 url_node = get_node(ctx->xml, params, "CertURL");
285 hash_node = get_node(ctx->xml, params, "CertSHA256Fingerprint");
286 if (url_node == NULL || hash_node == NULL)
288 url = xml_node_get_text(ctx->xml, url_node);
289 hash = xml_node_get_text(ctx->xml, hash_node);
290 if (url == NULL || hash == NULL) {
291 xml_node_get_text_free(ctx->xml, url);
292 xml_node_get_text_free(ctx->xml, hash);
296 wpa_printf(MSG_INFO, "CertURL: %s", url);
297 wpa_printf(MSG_INFO, "SHA256 hash: %s", hash);
299 if (hexstr2bin(hash, digest1, SHA256_MAC_LEN) < 0) {
300 wpa_printf(MSG_INFO, "Invalid SHA256 hash value");
301 write_result(ctx, "Invalid SHA256 hash value for downloaded certificate");
302 xml_node_get_text_free(ctx->xml, hash);
305 xml_node_get_text_free(ctx->xml, hash);
307 write_summary(ctx, "Download certificate from %s", url);
308 ctx->no_osu_cert_validation = 1;
309 http_ocsp_set(ctx->http, 1);
310 res = http_download_file(ctx->http, url, TMP_CERT_DL_FILE, NULL);
311 http_ocsp_set(ctx->http,
312 (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
313 ctx->no_osu_cert_validation = 0;
314 xml_node_get_text_free(ctx->xml, url);
318 cert = os_readfile(TMP_CERT_DL_FILE, &len);
319 remove(TMP_CERT_DL_FILE);
323 if (sha256_vector(1, (const u8 **) &cert, &len, digest2) < 0) {
328 if (os_memcmp(digest1, digest2, sizeof(digest1)) != 0) {
329 wpa_printf(MSG_INFO, "Downloaded certificate fingerprint did not match");
330 write_result(ctx, "Downloaded certificate fingerprint did not match");
335 b64 = base64_encode((unsigned char *) cert, len, NULL);
340 f = fopen(fname, "wb");
346 fprintf(f, "-----BEGIN CERTIFICATE-----\n"
348 "-----END CERTIFICATE-----\n",
354 wpa_printf(MSG_INFO, "Downloaded certificate into %s and validated fingerprint",
356 write_summary(ctx, "Downloaded certificate into %s and validated fingerprint",
363 static int cmd_dl_osu_ca(struct hs20_osu_client *ctx, const char *pps_fname,
364 const char *ca_fname)
366 xml_node_t *pps, *node;
369 pps = node_from_file(ctx->xml, pps_fname);
371 wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
375 node = get_child_node(ctx->xml, pps,
376 "SubscriptionUpdate/TrustRoot");
378 wpa_printf(MSG_INFO, "No SubscriptionUpdate/TrustRoot/CertURL found from PPS");
379 xml_node_free(ctx->xml, pps);
383 ret = download_cert(ctx, node, ca_fname);
384 xml_node_free(ctx->xml, pps);
390 static int cmd_dl_polupd_ca(struct hs20_osu_client *ctx, const char *pps_fname,
391 const char *ca_fname)
393 xml_node_t *pps, *node;
396 pps = node_from_file(ctx->xml, pps_fname);
398 wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
402 node = get_child_node(ctx->xml, pps,
403 "Policy/PolicyUpdate/TrustRoot");
405 wpa_printf(MSG_INFO, "No Policy/PolicyUpdate/TrustRoot/CertURL found from PPS");
406 xml_node_free(ctx->xml, pps);
410 ret = download_cert(ctx, node, ca_fname);
411 xml_node_free(ctx->xml, pps);
417 static int cmd_dl_aaa_ca(struct hs20_osu_client *ctx, const char *pps_fname,
418 const char *ca_fname)
420 xml_node_t *pps, *node, *aaa;
423 pps = node_from_file(ctx->xml, pps_fname);
425 wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
429 node = get_child_node(ctx->xml, pps,
430 "AAAServerTrustRoot");
432 wpa_printf(MSG_INFO, "No AAAServerTrustRoot/CertURL found from PPS");
433 xml_node_free(ctx->xml, pps);
437 aaa = xml_node_first_child(ctx->xml, node);
439 wpa_printf(MSG_INFO, "No AAAServerTrustRoot/CertURL found from PPS");
440 xml_node_free(ctx->xml, pps);
444 ret = download_cert(ctx, aaa, ca_fname);
445 xml_node_free(ctx->xml, pps);
451 static int download_trust_roots(struct hs20_osu_client *ctx,
452 const char *pps_fname)
458 dir = os_strdup(pps_fname);
461 pos = os_strrchr(dir, '/');
468 snprintf(fname, sizeof(fname), "%s/ca.pem", dir);
469 ret = cmd_dl_osu_ca(ctx, pps_fname, fname);
470 snprintf(fname, sizeof(fname), "%s/polupd-ca.pem", dir);
471 cmd_dl_polupd_ca(ctx, pps_fname, fname);
472 snprintf(fname, sizeof(fname), "%s/aaa-ca.pem", dir);
473 cmd_dl_aaa_ca(ctx, pps_fname, fname);
481 static int server_dnsname_suffix_match(struct hs20_osu_client *ctx,
484 size_t match_len, len, i;
487 match_len = os_strlen(fqdn);
489 for (i = 0; i < ctx->server_dnsname_count; i++) {
491 "Checking suffix match against server dNSName %s",
492 ctx->server_dnsname[i]);
493 val = ctx->server_dnsname[i];
494 len = os_strlen(val);
499 if (os_strncasecmp(val + len - match_len, fqdn, match_len) != 0)
500 continue; /* no match */
502 if (match_len == len)
503 return 1; /* exact match */
505 if (val[len - match_len - 1] == '.')
506 return 1; /* full label match completes suffix match */
508 /* Reject due to incomplete label match */
511 /* None of the dNSName(s) matched */
516 int hs20_add_pps_mo(struct hs20_osu_client *ctx, const char *uri,
517 xml_node_t *add_mo, char *fname, size_t fname_len)
521 xml_node_t *tnds, *mo, *cert;
525 if (strncmp(uri, "./Wi-Fi/", 8) != 0) {
526 wpa_printf(MSG_INFO, "Unsupported location for addMO to add PPS MO: '%s'",
528 write_result(ctx, "Unsupported location for addMO to add PPS MO: '%s'",
533 fqdn = strdup(uri + 8);
536 pos = strchr(fqdn, '/');
538 if (os_strcasecmp(pos, "/PerProviderSubscription") != 0) {
539 wpa_printf(MSG_INFO, "Unsupported location for addMO to add PPS MO (extra directory): '%s'",
541 write_result(ctx, "Unsupported location for addMO to "
542 "add PPS MO (extra directory): '%s'", uri);
545 *pos = '\0'; /* remove trailing slash and PPS node name */
547 wpa_printf(MSG_INFO, "SP FQDN: %s", fqdn);
549 if (!server_dnsname_suffix_match(ctx, fqdn)) {
550 wpa_printf(MSG_INFO, "FQDN '%s' for new PPS MO did not have suffix match with server's dNSName values",
552 write_result(ctx, "FQDN '%s' for new PPS MO did not have suffix match with server's dNSName values",
558 if (!valid_fqdn(fqdn)) {
559 wpa_printf(MSG_INFO, "Invalid FQDN '%s'", fqdn);
560 write_result(ctx, "Invalid FQDN '%s'", fqdn);
565 mkdir("SP", S_IRWXU);
566 snprintf(fname, fname_len, "SP/%s", fqdn);
567 if (mkdir(fname, S_IRWXU) < 0) {
568 if (errno != EEXIST) {
570 wpa_printf(MSG_INFO, "mkdir(%s) failed: %s",
571 fname, strerror(err));
578 /* Allow processes running with Group ID as AID_WIFI,
579 * to read files from SP/<fqdn> directory */
580 if (chown(fname, -1, AID_WIFI)) {
581 wpa_printf(MSG_INFO, "CTRL: Could not chown directory: %s",
583 /* Try to continue anyway */
585 if (chmod(fname, S_IRWXU | S_IRGRP | S_IXGRP) < 0) {
586 wpa_printf(MSG_INFO, "CTRL: Could not chmod directory: %s",
588 /* Try to continue anyway */
592 snprintf(fname, fname_len, "SP/%s/pps.xml", fqdn);
594 if (os_file_exists(fname)) {
595 wpa_printf(MSG_INFO, "PPS file '%s' exists - reject addMO",
597 write_result(ctx, "PPS file '%s' exists - reject addMO",
602 wpa_printf(MSG_INFO, "Using PPS file: %s", fname);
604 str = xml_node_get_text(ctx->xml, add_mo);
606 wpa_printf(MSG_INFO, "Could not extract MO text");
610 wpa_printf(MSG_DEBUG, "[hs20] addMO text: '%s'", str);
612 tnds = xml_node_from_buf(ctx->xml, str);
613 xml_node_get_text_free(ctx->xml, str);
615 wpa_printf(MSG_INFO, "[hs20] Could not parse addMO text");
620 mo = tnds_to_mo(ctx->xml, tnds);
622 wpa_printf(MSG_INFO, "[hs20] Could not parse addMO TNDS text");
627 debug_dump_node(ctx, "Parsed TNDS", mo);
629 name = xml_node_get_localname(ctx->xml, mo);
630 if (os_strcasecmp(name, "PerProviderSubscription") != 0) {
631 wpa_printf(MSG_INFO, "[hs20] Unexpected PPS MO root node name '%s'",
637 cert = get_child_node(ctx->xml, mo,
638 "Credential/DigitalCertificate/"
639 "CertSHA256Fingerprint");
640 if (cert && process_est_cert(ctx, cert, fqdn) < 0) {
641 xml_node_free(ctx->xml, mo);
647 if (node_to_file(ctx->xml, fname, mo) < 0) {
648 wpa_printf(MSG_INFO, "Could not write MO to file");
649 xml_node_free(ctx->xml, mo);
652 xml_node_free(ctx->xml, mo);
654 wpa_printf(MSG_INFO, "A new PPS MO added as '%s'", fname);
655 write_summary(ctx, "A new PPS MO added as '%s'", fname);
657 ret = download_trust_roots(ctx, fname);
659 wpa_printf(MSG_INFO, "Remove invalid PPS MO file");
660 write_summary(ctx, "Remove invalid PPS MO file");
668 int update_pps_file(struct hs20_osu_client *ctx, const char *pps_fname,
675 if (ctx->client_cert_present) {
677 cert = get_child_node(ctx->xml, pps,
678 "Credential/DigitalCertificate/"
679 "CertSHA256Fingerprint");
680 if (cert && os_file_exists("Cert/est_cert.der") &&
681 process_est_cert(ctx, cert, ctx->fqdn) < 0) {
682 wpa_printf(MSG_INFO, "EST certificate update processing failed on PPS MO update");
687 wpa_printf(MSG_INFO, "Updating PPS MO %s", pps_fname);
689 str = xml_node_to_str(ctx->xml, pps);
691 wpa_printf(MSG_ERROR, "No node found");
694 wpa_printf(MSG_MSGDUMP, "[hs20] Updated PPS: '%s'", str);
696 snprintf(backup, sizeof(backup), "%s.bak", pps_fname);
697 rename(pps_fname, backup);
698 f = fopen(pps_fname, "w");
700 wpa_printf(MSG_INFO, "Could not write PPS");
701 rename(backup, pps_fname);
705 fprintf(f, "%s\n", str);
714 void get_user_pw(struct hs20_osu_client *ctx, xml_node_t *pps,
715 const char *alt_loc, char **user, char **pw)
719 node = get_child_node(ctx->xml, pps,
720 "Credential/UsernamePassword/Username");
722 *user = xml_node_get_text(ctx->xml, node);
724 node = get_child_node(ctx->xml, pps,
725 "Credential/UsernamePassword/Password");
727 *pw = xml_node_get_base64_text(ctx->xml, node, NULL);
729 node = get_child_node(ctx->xml, pps, alt_loc);
732 a = get_node(ctx->xml, node, "Username");
734 xml_node_get_text_free(ctx->xml, *user);
735 *user = xml_node_get_text(ctx->xml, a);
736 wpa_printf(MSG_INFO, "Use OSU username '%s'", *user);
739 a = get_node(ctx->xml, node, "Password");
742 *pw = xml_node_get_base64_text(ctx->xml, a, NULL);
743 wpa_printf(MSG_INFO, "Use OSU password");
749 /* Remove old credentials based on HomeSP/FQDN */
750 static void remove_sp_creds(struct hs20_osu_client *ctx, const char *fqdn)
753 os_snprintf(cmd, sizeof(cmd), "REMOVE_CRED provisioning_sp=%s", fqdn);
754 if (wpa_command(ctx->ifname, cmd) < 0)
755 wpa_printf(MSG_INFO, "Failed to remove old credential(s)");
759 static void set_pps_cred_policy_spe(struct hs20_osu_client *ctx, int id,
765 ssid = get_node(ctx->xml, spe, "SSID");
768 txt = xml_node_get_text(ctx->xml, ssid);
771 wpa_printf(MSG_DEBUG, "- Policy/SPExclusionList/<X+>/SSID = %s", txt);
772 if (set_cred_quoted(ctx->ifname, id, "excluded_ssid", txt) < 0)
773 wpa_printf(MSG_INFO, "Failed to set cred excluded_ssid");
774 xml_node_get_text_free(ctx->xml, txt);
778 static void set_pps_cred_policy_spel(struct hs20_osu_client *ctx, int id,
783 xml_node_for_each_child(ctx->xml, child, spel) {
784 xml_node_for_each_check(ctx->xml, child);
785 set_pps_cred_policy_spe(ctx, id, child);
790 static void set_pps_cred_policy_prp(struct hs20_osu_client *ctx, int id,
794 char *txt = NULL, *pos;
795 char *prio, *country_buf = NULL;
800 node = get_node(ctx->xml, prp, "Priority");
803 prio = xml_node_get_text(ctx->xml, node);
806 wpa_printf(MSG_INFO, "- Policy/PreferredRoamingPartnerList/<X+>/Priority = %s",
808 priority = atoi(prio);
809 xml_node_get_text_free(ctx->xml, prio);
811 node = get_node(ctx->xml, prp, "Country");
813 country_buf = xml_node_get_text(ctx->xml, node);
814 if (country_buf == NULL)
816 country = country_buf;
817 wpa_printf(MSG_INFO, "- Policy/PreferredRoamingPartnerList/<X+>/Country = %s",
823 node = get_node(ctx->xml, prp, "FQDN_Match");
826 txt = xml_node_get_text(ctx->xml, node);
829 wpa_printf(MSG_INFO, "- Policy/PreferredRoamingPartnerList/<X+>/FQDN_Match = %s",
831 pos = strrchr(txt, ',');
836 snprintf(val, sizeof(val), "%s,%d,%d,%s", txt,
837 strcmp(pos, "includeSubdomains") != 0, priority, country);
838 if (set_cred_quoted(ctx->ifname, id, "roaming_partner", val) < 0)
839 wpa_printf(MSG_INFO, "Failed to set cred roaming_partner");
841 xml_node_get_text_free(ctx->xml, country_buf);
842 xml_node_get_text_free(ctx->xml, txt);
846 static void set_pps_cred_policy_prpl(struct hs20_osu_client *ctx, int id,
851 xml_node_for_each_child(ctx->xml, child, prpl) {
852 xml_node_for_each_check(ctx->xml, child);
853 set_pps_cred_policy_prp(ctx, id, child);
858 static void set_pps_cred_policy_min_backhaul(struct hs20_osu_client *ctx, int id,
859 xml_node_t *min_backhaul)
862 char *type, *dl = NULL, *ul = NULL;
865 node = get_node(ctx->xml, min_backhaul, "NetworkType");
867 wpa_printf(MSG_INFO, "Ignore MinBackhaulThreshold without mandatory NetworkType node");
871 type = xml_node_get_text(ctx->xml, node);
874 wpa_printf(MSG_INFO, "- Policy/MinBackhaulThreshold/<X+>/NetworkType = %s",
876 if (os_strcasecmp(type, "home") == 0)
878 else if (os_strcasecmp(type, "roaming") == 0)
881 wpa_printf(MSG_INFO, "Ignore MinBackhaulThreshold with invalid NetworkType");
882 xml_node_get_text_free(ctx->xml, type);
885 xml_node_get_text_free(ctx->xml, type);
887 node = get_node(ctx->xml, min_backhaul, "DLBandwidth");
889 dl = xml_node_get_text(ctx->xml, node);
891 node = get_node(ctx->xml, min_backhaul, "ULBandwidth");
893 ul = xml_node_get_text(ctx->xml, node);
895 if (dl == NULL && ul == NULL) {
896 wpa_printf(MSG_INFO, "Ignore MinBackhaulThreshold without either DLBandwidth or ULBandwidth nodes");
901 wpa_printf(MSG_INFO, "- Policy/MinBackhaulThreshold/<X+>/DLBandwidth = %s",
904 wpa_printf(MSG_INFO, "- Policy/MinBackhaulThreshold/<X+>/ULBandwidth = %s",
909 set_cred(ctx->ifname, id, "min_dl_bandwidth_home", dl) < 0)
910 wpa_printf(MSG_INFO, "Failed to set cred bandwidth limit");
912 set_cred(ctx->ifname, id, "min_ul_bandwidth_home", ul) < 0)
913 wpa_printf(MSG_INFO, "Failed to set cred bandwidth limit");
916 set_cred(ctx->ifname, id, "min_dl_bandwidth_roaming", dl) <
918 wpa_printf(MSG_INFO, "Failed to set cred bandwidth limit");
920 set_cred(ctx->ifname, id, "min_ul_bandwidth_roaming", ul) <
922 wpa_printf(MSG_INFO, "Failed to set cred bandwidth limit");
925 xml_node_get_text_free(ctx->xml, dl);
926 xml_node_get_text_free(ctx->xml, ul);
930 static void set_pps_cred_policy_min_backhaul_list(struct hs20_osu_client *ctx,
931 int id, xml_node_t *node)
935 wpa_printf(MSG_INFO, "- Policy/MinBackhaulThreshold");
937 xml_node_for_each_child(ctx->xml, child, node) {
938 xml_node_for_each_check(ctx->xml, child);
939 set_pps_cred_policy_min_backhaul(ctx, id, child);
944 static void set_pps_cred_policy_update(struct hs20_osu_client *ctx, int id,
947 wpa_printf(MSG_INFO, "- Policy/PolicyUpdate");
948 /* Not used in wpa_supplicant */
952 static void set_pps_cred_policy_required_proto_port(struct hs20_osu_client *ctx,
953 int id, xml_node_t *tuple)
960 node = get_node(ctx->xml, tuple, "IPProtocol");
962 wpa_printf(MSG_INFO, "Ignore RequiredProtoPortTuple without mandatory IPProtocol node");
966 proto = xml_node_get_text(ctx->xml, node);
970 wpa_printf(MSG_INFO, "- Policy/RequiredProtoPortTuple/<X+>/IPProtocol = %s",
973 node = get_node(ctx->xml, tuple, "PortNumber");
974 port = node ? xml_node_get_text(ctx->xml, node) : NULL;
976 wpa_printf(MSG_INFO, "- Policy/RequiredProtoPortTuple/<X+>/PortNumber = %s",
978 buflen = os_strlen(proto) + os_strlen(port) + 10;
979 buf = os_malloc(buflen);
981 os_snprintf(buf, buflen, "%s:%s", proto, port);
982 xml_node_get_text_free(ctx->xml, port);
984 buflen = os_strlen(proto) + 10;
985 buf = os_malloc(buflen);
987 os_snprintf(buf, buflen, "%s", proto);
990 xml_node_get_text_free(ctx->xml, proto);
995 if (set_cred(ctx->ifname, id, "req_conn_capab", buf) < 0)
996 wpa_printf(MSG_INFO, "Could not set req_conn_capab");
1002 static void set_pps_cred_policy_required_proto_ports(struct hs20_osu_client *ctx,
1003 int id, xml_node_t *node)
1007 wpa_printf(MSG_INFO, "- Policy/RequiredProtoPortTuple");
1009 xml_node_for_each_child(ctx->xml, child, node) {
1010 xml_node_for_each_check(ctx->xml, child);
1011 set_pps_cred_policy_required_proto_port(ctx, id, child);
1016 static void set_pps_cred_policy_max_bss_load(struct hs20_osu_client *ctx, int id,
1019 char *str = xml_node_get_text(ctx->xml, node);
1022 wpa_printf(MSG_INFO, "- Policy/MaximumBSSLoadValue - %s", str);
1023 if (set_cred(ctx->ifname, id, "max_bss_load", str) < 0)
1024 wpa_printf(MSG_INFO, "Failed to set cred max_bss_load limit");
1025 xml_node_get_text_free(ctx->xml, str);
1029 static void set_pps_cred_policy(struct hs20_osu_client *ctx, int id,
1035 wpa_printf(MSG_INFO, "- Policy");
1037 xml_node_for_each_child(ctx->xml, child, node) {
1038 xml_node_for_each_check(ctx->xml, child);
1039 name = xml_node_get_localname(ctx->xml, child);
1040 if (os_strcasecmp(name, "PreferredRoamingPartnerList") == 0)
1041 set_pps_cred_policy_prpl(ctx, id, child);
1042 else if (os_strcasecmp(name, "MinBackhaulThreshold") == 0)
1043 set_pps_cred_policy_min_backhaul_list(ctx, id, child);
1044 else if (os_strcasecmp(name, "PolicyUpdate") == 0)
1045 set_pps_cred_policy_update(ctx, id, child);
1046 else if (os_strcasecmp(name, "SPExclusionList") == 0)
1047 set_pps_cred_policy_spel(ctx, id, child);
1048 else if (os_strcasecmp(name, "RequiredProtoPortTuple") == 0)
1049 set_pps_cred_policy_required_proto_ports(ctx, id, child);
1050 else if (os_strcasecmp(name, "MaximumBSSLoadValue") == 0)
1051 set_pps_cred_policy_max_bss_load(ctx, id, child);
1053 wpa_printf(MSG_INFO, "Unknown Policy node '%s'", name);
1058 static void set_pps_cred_priority(struct hs20_osu_client *ctx, int id,
1061 char *str = xml_node_get_text(ctx->xml, node);
1064 wpa_printf(MSG_INFO, "- CredentialPriority = %s", str);
1065 if (set_cred(ctx->ifname, id, "sp_priority", str) < 0)
1066 wpa_printf(MSG_INFO, "Failed to set cred sp_priority");
1067 xml_node_get_text_free(ctx->xml, str);
1071 static void set_pps_cred_aaa_server_trust_root(struct hs20_osu_client *ctx,
1072 int id, xml_node_t *node)
1074 wpa_printf(MSG_INFO, "- AAAServerTrustRoot - TODO");
1078 static void set_pps_cred_sub_update(struct hs20_osu_client *ctx, int id,
1081 wpa_printf(MSG_INFO, "- SubscriptionUpdate");
1082 /* not used within wpa_supplicant */
1086 static void set_pps_cred_home_sp_network_id(struct hs20_osu_client *ctx,
1087 int id, xml_node_t *node)
1089 xml_node_t *ssid_node, *hessid_node;
1090 char *ssid, *hessid;
1092 ssid_node = get_node(ctx->xml, node, "SSID");
1093 if (ssid_node == NULL) {
1094 wpa_printf(MSG_INFO, "Ignore HomeSP/NetworkID without mandatory SSID node");
1098 hessid_node = get_node(ctx->xml, node, "HESSID");
1100 ssid = xml_node_get_text(ctx->xml, ssid_node);
1103 hessid = hessid_node ? xml_node_get_text(ctx->xml, hessid_node) : NULL;
1105 wpa_printf(MSG_INFO, "- HomeSP/NetworkID/<X+>/SSID = %s", ssid);
1107 wpa_printf(MSG_INFO, "- HomeSP/NetworkID/<X+>/HESSID = %s",
1110 /* TODO: Configure to wpa_supplicant */
1112 xml_node_get_text_free(ctx->xml, ssid);
1113 xml_node_get_text_free(ctx->xml, hessid);
1117 static void set_pps_cred_home_sp_network_ids(struct hs20_osu_client *ctx,
1118 int id, xml_node_t *node)
1122 wpa_printf(MSG_INFO, "- HomeSP/NetworkID");
1124 xml_node_for_each_child(ctx->xml, child, node) {
1125 xml_node_for_each_check(ctx->xml, child);
1126 set_pps_cred_home_sp_network_id(ctx, id, child);
1131 static void set_pps_cred_home_sp_friendly_name(struct hs20_osu_client *ctx,
1132 int id, xml_node_t *node)
1134 char *str = xml_node_get_text(ctx->xml, node);
1137 wpa_printf(MSG_INFO, "- HomeSP/FriendlyName = %s", str);
1138 /* not used within wpa_supplicant(?) */
1139 xml_node_get_text_free(ctx->xml, str);
1143 static void set_pps_cred_home_sp_icon_url(struct hs20_osu_client *ctx,
1144 int id, xml_node_t *node)
1146 char *str = xml_node_get_text(ctx->xml, node);
1149 wpa_printf(MSG_INFO, "- HomeSP/IconURL = %s", str);
1150 /* not used within wpa_supplicant */
1151 xml_node_get_text_free(ctx->xml, str);
1155 static void set_pps_cred_home_sp_fqdn(struct hs20_osu_client *ctx, int id,
1158 char *str = xml_node_get_text(ctx->xml, node);
1161 wpa_printf(MSG_INFO, "- HomeSP/FQDN = %s", str);
1162 if (set_cred_quoted(ctx->ifname, id, "domain", str) < 0)
1163 wpa_printf(MSG_INFO, "Failed to set cred domain");
1164 if (set_cred_quoted(ctx->ifname, id, "domain_suffix_match", str) < 0)
1165 wpa_printf(MSG_INFO, "Failed to set cred domain_suffix_match");
1166 xml_node_get_text_free(ctx->xml, str);
1170 static void set_pps_cred_home_sp_oi(struct hs20_osu_client *ctx, int id,
1175 char *homeoi = NULL;
1179 xml_node_for_each_child(ctx->xml, child, node) {
1180 xml_node_for_each_check(ctx->xml, child);
1181 name = xml_node_get_localname(ctx->xml, child);
1182 if (strcasecmp(name, "HomeOI") == 0 && !homeoi) {
1183 homeoi = xml_node_get_text(ctx->xml, child);
1184 wpa_printf(MSG_INFO, "- HomeSP/HomeOIList/<X+>/HomeOI = %s",
1186 } else if (strcasecmp(name, "HomeOIRequired") == 0) {
1187 str = xml_node_get_text(ctx->xml, child);
1188 wpa_printf(MSG_INFO, "- HomeSP/HomeOIList/<X+>/HomeOIRequired = '%s'",
1192 required = strcasecmp(str, "true") == 0;
1193 xml_node_get_text_free(ctx->xml, str);
1195 wpa_printf(MSG_INFO, "Unknown HomeOIList node '%s'",
1199 if (homeoi == NULL) {
1200 wpa_printf(MSG_INFO, "- HomeSP/HomeOIList/<X+> without HomeOI ignored");
1204 wpa_printf(MSG_INFO, "- HomeSP/HomeOIList/<X+> '%s' required=%d",
1208 if (set_cred(ctx->ifname, id, "required_roaming_consortium",
1210 wpa_printf(MSG_INFO, "Failed to set cred required_roaming_consortium");
1212 if (set_cred_quoted(ctx->ifname, id, "roaming_consortium",
1214 wpa_printf(MSG_INFO, "Failed to set cred roaming_consortium");
1217 xml_node_get_text_free(ctx->xml, homeoi);
1221 static void set_pps_cred_home_sp_oi_list(struct hs20_osu_client *ctx, int id,
1226 wpa_printf(MSG_INFO, "- HomeSP/HomeOIList");
1228 xml_node_for_each_child(ctx->xml, child, node) {
1229 xml_node_for_each_check(ctx->xml, child);
1230 set_pps_cred_home_sp_oi(ctx, id, child);
1235 static void set_pps_cred_home_sp_other_partner(struct hs20_osu_client *ctx,
1236 int id, xml_node_t *node)
1242 xml_node_for_each_child(ctx->xml, child, node) {
1243 xml_node_for_each_check(ctx->xml, child);
1244 name = xml_node_get_localname(ctx->xml, child);
1245 if (os_strcasecmp(name, "FQDN") == 0 && !fqdn) {
1246 fqdn = xml_node_get_text(ctx->xml, child);
1247 wpa_printf(MSG_INFO, "- HomeSP/OtherHomePartners/<X+>/FQDN = %s",
1250 wpa_printf(MSG_INFO, "Unknown OtherHomePartners node '%s'",
1255 wpa_printf(MSG_INFO, "- HomeSP/OtherHomePartners/<X+> without FQDN ignored");
1259 if (set_cred_quoted(ctx->ifname, id, "domain", fqdn) < 0)
1260 wpa_printf(MSG_INFO, "Failed to set cred domain for OtherHomePartners node");
1262 xml_node_get_text_free(ctx->xml, fqdn);
1266 static void set_pps_cred_home_sp_other_partners(struct hs20_osu_client *ctx,
1272 wpa_printf(MSG_INFO, "- HomeSP/OtherHomePartners");
1274 xml_node_for_each_child(ctx->xml, child, node) {
1275 xml_node_for_each_check(ctx->xml, child);
1276 set_pps_cred_home_sp_other_partner(ctx, id, child);
1281 static void set_pps_cred_home_sp_roaming_consortium_oi(
1282 struct hs20_osu_client *ctx, int id, xml_node_t *node)
1284 char *str = xml_node_get_text(ctx->xml, node);
1287 wpa_printf(MSG_INFO, "- HomeSP/RoamingConsortiumOI = %s", str);
1288 /* TODO: Set to wpa_supplicant */
1289 xml_node_get_text_free(ctx->xml, str);
1293 static void set_pps_cred_home_sp(struct hs20_osu_client *ctx, int id,
1299 wpa_printf(MSG_INFO, "- HomeSP");
1301 xml_node_for_each_child(ctx->xml, child, node) {
1302 xml_node_for_each_check(ctx->xml, child);
1303 name = xml_node_get_localname(ctx->xml, child);
1304 if (os_strcasecmp(name, "NetworkID") == 0)
1305 set_pps_cred_home_sp_network_ids(ctx, id, child);
1306 else if (os_strcasecmp(name, "FriendlyName") == 0)
1307 set_pps_cred_home_sp_friendly_name(ctx, id, child);
1308 else if (os_strcasecmp(name, "IconURL") == 0)
1309 set_pps_cred_home_sp_icon_url(ctx, id, child);
1310 else if (os_strcasecmp(name, "FQDN") == 0)
1311 set_pps_cred_home_sp_fqdn(ctx, id, child);
1312 else if (os_strcasecmp(name, "HomeOIList") == 0)
1313 set_pps_cred_home_sp_oi_list(ctx, id, child);
1314 else if (os_strcasecmp(name, "OtherHomePartners") == 0)
1315 set_pps_cred_home_sp_other_partners(ctx, id, child);
1316 else if (os_strcasecmp(name, "RoamingConsortiumOI") == 0)
1317 set_pps_cred_home_sp_roaming_consortium_oi(ctx, id,
1320 wpa_printf(MSG_INFO, "Unknown HomeSP node '%s'", name);
1325 static void set_pps_cred_sub_params(struct hs20_osu_client *ctx, int id,
1328 wpa_printf(MSG_INFO, "- SubscriptionParameters");
1329 /* not used within wpa_supplicant */
1333 static void set_pps_cred_creation_date(struct hs20_osu_client *ctx, int id,
1336 char *str = xml_node_get_text(ctx->xml, node);
1339 wpa_printf(MSG_INFO, "- Credential/CreationDate = %s", str);
1340 /* not used within wpa_supplicant */
1341 xml_node_get_text_free(ctx->xml, str);
1345 static void set_pps_cred_expiration_date(struct hs20_osu_client *ctx, int id,
1348 char *str = xml_node_get_text(ctx->xml, node);
1351 wpa_printf(MSG_INFO, "- Credential/ExpirationDate = %s", str);
1352 /* not used within wpa_supplicant */
1353 xml_node_get_text_free(ctx->xml, str);
1357 static void set_pps_cred_username(struct hs20_osu_client *ctx, int id,
1360 char *str = xml_node_get_text(ctx->xml, node);
1363 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/Username = %s",
1365 if (set_cred_quoted(ctx->ifname, id, "username", str) < 0)
1366 wpa_printf(MSG_INFO, "Failed to set cred username");
1367 xml_node_get_text_free(ctx->xml, str);
1371 static void set_pps_cred_password(struct hs20_osu_client *ctx, int id,
1375 char *pw, *hex, *pos, *end;
1377 pw = xml_node_get_base64_text(ctx->xml, node, &len);
1381 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/Password = %s", pw);
1383 hex = malloc(len * 2 + 1);
1388 end = hex + len * 2 + 1;
1390 for (i = 0; i < len; i++) {
1391 snprintf(pos, end - pos, "%02x", pw[i]);
1396 if (set_cred(ctx->ifname, id, "password", hex) < 0)
1397 wpa_printf(MSG_INFO, "Failed to set cred password");
1402 static void set_pps_cred_machine_managed(struct hs20_osu_client *ctx, int id,
1405 char *str = xml_node_get_text(ctx->xml, node);
1408 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/MachineManaged = %s",
1410 /* not used within wpa_supplicant */
1411 xml_node_get_text_free(ctx->xml, str);
1415 static void set_pps_cred_soft_token_app(struct hs20_osu_client *ctx, int id,
1418 char *str = xml_node_get_text(ctx->xml, node);
1421 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/SoftTokenApp = %s",
1423 /* not used within wpa_supplicant */
1424 xml_node_get_text_free(ctx->xml, str);
1428 static void set_pps_cred_able_to_share(struct hs20_osu_client *ctx, int id,
1431 char *str = xml_node_get_text(ctx->xml, node);
1434 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/AbleToShare = %s",
1436 /* not used within wpa_supplicant */
1437 xml_node_get_text_free(ctx->xml, str);
1441 static void set_pps_cred_eap_method(struct hs20_osu_client *ctx, int id,
1444 wpa_printf(MSG_INFO, "- Credential/UsernamePassword/EAPMethod - TODO");
1448 static void set_pps_cred_username_password(struct hs20_osu_client *ctx, int id,
1454 wpa_printf(MSG_INFO, "- Credential/UsernamePassword");
1456 xml_node_for_each_child(ctx->xml, child, node) {
1457 xml_node_for_each_check(ctx->xml, child);
1458 name = xml_node_get_localname(ctx->xml, child);
1459 if (os_strcasecmp(name, "Username") == 0)
1460 set_pps_cred_username(ctx, id, child);
1461 else if (os_strcasecmp(name, "Password") == 0)
1462 set_pps_cred_password(ctx, id, child);
1463 else if (os_strcasecmp(name, "MachineManaged") == 0)
1464 set_pps_cred_machine_managed(ctx, id, child);
1465 else if (os_strcasecmp(name, "SoftTokenApp") == 0)
1466 set_pps_cred_soft_token_app(ctx, id, child);
1467 else if (os_strcasecmp(name, "AbleToShare") == 0)
1468 set_pps_cred_able_to_share(ctx, id, child);
1469 else if (os_strcasecmp(name, "EAPMethod") == 0)
1470 set_pps_cred_eap_method(ctx, id, child);
1472 wpa_printf(MSG_INFO, "Unknown Credential/UsernamePassword node '%s'",
1478 static void set_pps_cred_digital_cert(struct hs20_osu_client *ctx, int id,
1479 xml_node_t *node, const char *fqdn)
1481 char buf[200], dir[200];
1483 wpa_printf(MSG_INFO, "- Credential/DigitalCertificate");
1485 if (getcwd(dir, sizeof(dir)) == NULL)
1488 /* TODO: could build username from Subject of Subject AltName */
1489 if (set_cred_quoted(ctx->ifname, id, "username", "cert") < 0) {
1490 wpa_printf(MSG_INFO, "Failed to set username");
1493 snprintf(buf, sizeof(buf), "%s/SP/%s/client-cert.pem", dir, fqdn);
1494 if (os_file_exists(buf)) {
1495 if (set_cred_quoted(ctx->ifname, id, "client_cert", buf) < 0) {
1496 wpa_printf(MSG_INFO, "Failed to set client_cert");
1500 snprintf(buf, sizeof(buf), "%s/SP/%s/client-key.pem", dir, fqdn);
1501 if (os_file_exists(buf)) {
1502 if (set_cred_quoted(ctx->ifname, id, "private_key", buf) < 0) {
1503 wpa_printf(MSG_INFO, "Failed to set private_key");
1509 static void set_pps_cred_realm(struct hs20_osu_client *ctx, int id,
1510 xml_node_t *node, const char *fqdn, int sim)
1512 char *str = xml_node_get_text(ctx->xml, node);
1513 char buf[200], dir[200];
1518 wpa_printf(MSG_INFO, "- Credential/Realm = %s", str);
1519 if (set_cred_quoted(ctx->ifname, id, "realm", str) < 0)
1520 wpa_printf(MSG_INFO, "Failed to set cred realm");
1521 xml_node_get_text_free(ctx->xml, str);
1526 if (getcwd(dir, sizeof(dir)) == NULL)
1528 snprintf(buf, sizeof(buf), "%s/SP/%s/aaa-ca.pem", dir, fqdn);
1529 if (os_file_exists(buf)) {
1530 if (set_cred_quoted(ctx->ifname, id, "ca_cert", buf) < 0) {
1531 wpa_printf(MSG_INFO, "Failed to set CA cert");
1537 static void set_pps_cred_check_aaa_cert_status(struct hs20_osu_client *ctx,
1538 int id, xml_node_t *node)
1540 char *str = xml_node_get_text(ctx->xml, node);
1545 wpa_printf(MSG_INFO, "- Credential/CheckAAAServerCertStatus = %s", str);
1546 if (os_strcasecmp(str, "true") == 0 &&
1547 set_cred(ctx->ifname, id, "ocsp", "2") < 0)
1548 wpa_printf(MSG_INFO, "Failed to set cred ocsp");
1549 xml_node_get_text_free(ctx->xml, str);
1553 static void set_pps_cred_sim(struct hs20_osu_client *ctx, int id,
1554 xml_node_t *sim, xml_node_t *realm)
1557 char *imsi, *eaptype, *str, buf[20];
1562 node = get_node(ctx->xml, sim, "EAPType");
1564 wpa_printf(MSG_INFO, "No SIM/EAPType node in credential");
1567 eaptype = xml_node_get_text(ctx->xml, node);
1568 if (eaptype == NULL) {
1569 wpa_printf(MSG_INFO, "Could not extract SIM/EAPType");
1572 wpa_printf(MSG_INFO, " - Credential/SIM/EAPType = %s", eaptype);
1573 type = atoi(eaptype);
1574 xml_node_get_text_free(ctx->xml, eaptype);
1578 if (set_cred(ctx->ifname, id, "eap", "SIM") < 0)
1579 wpa_printf(MSG_INFO, "Could not set eap=SIM");
1582 if (set_cred(ctx->ifname, id, "eap", "AKA") < 0)
1583 wpa_printf(MSG_INFO, "Could not set eap=SIM");
1585 case EAP_TYPE_AKA_PRIME:
1586 if (set_cred(ctx->ifname, id, "eap", "AKA'") < 0)
1587 wpa_printf(MSG_INFO, "Could not set eap=SIM");
1590 wpa_printf(MSG_INFO, "Unsupported SIM/EAPType %d", type);
1594 node = get_node(ctx->xml, sim, "IMSI");
1596 wpa_printf(MSG_INFO, "No SIM/IMSI node in credential");
1599 imsi = xml_node_get_text(ctx->xml, node);
1601 wpa_printf(MSG_INFO, "Could not extract SIM/IMSI");
1604 wpa_printf(MSG_INFO, " - Credential/SIM/IMSI = %s", imsi);
1605 imsi_len = os_strlen(imsi);
1606 if (imsi_len < 7 || imsi_len + 2 > sizeof(buf)) {
1607 wpa_printf(MSG_INFO, "Invalid IMSI length");
1608 xml_node_get_text_free(ctx->xml, imsi);
1612 str = xml_node_get_text(ctx->xml, node);
1615 pos = os_strstr(str, "mnc");
1616 if (pos && os_strlen(pos) >= 6) {
1617 if (os_strncmp(imsi + 3, pos + 3, 3) == 0)
1619 else if (os_strncmp(imsi + 3, pos + 4, 2) == 0)
1622 xml_node_get_text_free(ctx->xml, str);
1625 os_memcpy(buf, imsi, 3 + mnc_len);
1626 buf[3 + mnc_len] = '-';
1627 os_strlcpy(buf + 3 + mnc_len + 1, imsi + 3 + mnc_len,
1628 sizeof(buf) - 3 - mnc_len - 1);
1630 xml_node_get_text_free(ctx->xml, imsi);
1632 if (set_cred_quoted(ctx->ifname, id, "imsi", buf) < 0)
1633 wpa_printf(MSG_INFO, "Could not set IMSI");
1635 if (set_cred_quoted(ctx->ifname, id, "milenage",
1636 "90dca4eda45b53cf0f12d7c9c3bc6a89:"
1637 "cb9cccc4b9258e6dca4760379fb82581:000000000123") <
1639 wpa_printf(MSG_INFO, "Could not set Milenage parameters");
1643 static void set_pps_cred_credential(struct hs20_osu_client *ctx, int id,
1644 xml_node_t *node, const char *fqdn)
1646 xml_node_t *child, *sim, *realm;
1649 wpa_printf(MSG_INFO, "- Credential");
1651 sim = get_node(ctx->xml, node, "SIM");
1652 realm = get_node(ctx->xml, node, "Realm");
1654 xml_node_for_each_child(ctx->xml, child, node) {
1655 xml_node_for_each_check(ctx->xml, child);
1656 name = xml_node_get_localname(ctx->xml, child);
1657 if (os_strcasecmp(name, "CreationDate") == 0)
1658 set_pps_cred_creation_date(ctx, id, child);
1659 else if (os_strcasecmp(name, "ExpirationDate") == 0)
1660 set_pps_cred_expiration_date(ctx, id, child);
1661 else if (os_strcasecmp(name, "UsernamePassword") == 0)
1662 set_pps_cred_username_password(ctx, id, child);
1663 else if (os_strcasecmp(name, "DigitalCertificate") == 0)
1664 set_pps_cred_digital_cert(ctx, id, child, fqdn);
1665 else if (os_strcasecmp(name, "Realm") == 0)
1666 set_pps_cred_realm(ctx, id, child, fqdn, sim != NULL);
1667 else if (os_strcasecmp(name, "CheckAAAServerCertStatus") == 0)
1668 set_pps_cred_check_aaa_cert_status(ctx, id, child);
1669 else if (os_strcasecmp(name, "SIM") == 0)
1670 set_pps_cred_sim(ctx, id, child, realm);
1672 wpa_printf(MSG_INFO, "Unknown Credential node '%s'",
1678 static void set_pps_credential(struct hs20_osu_client *ctx, int id,
1679 xml_node_t *cred, const char *fqdn)
1684 xml_node_for_each_child(ctx->xml, child, cred) {
1685 xml_node_for_each_check(ctx->xml, child);
1686 name = xml_node_get_localname(ctx->xml, child);
1687 if (os_strcasecmp(name, "Policy") == 0)
1688 set_pps_cred_policy(ctx, id, child);
1689 else if (os_strcasecmp(name, "CredentialPriority") == 0)
1690 set_pps_cred_priority(ctx, id, child);
1691 else if (os_strcasecmp(name, "AAAServerTrustRoot") == 0)
1692 set_pps_cred_aaa_server_trust_root(ctx, id, child);
1693 else if (os_strcasecmp(name, "SubscriptionUpdate") == 0)
1694 set_pps_cred_sub_update(ctx, id, child);
1695 else if (os_strcasecmp(name, "HomeSP") == 0)
1696 set_pps_cred_home_sp(ctx, id, child);
1697 else if (os_strcasecmp(name, "SubscriptionParameters") == 0)
1698 set_pps_cred_sub_params(ctx, id, child);
1699 else if (os_strcasecmp(name, "Credential") == 0)
1700 set_pps_cred_credential(ctx, id, child, fqdn);
1702 wpa_printf(MSG_INFO, "Unknown credential node '%s'",
1708 static void set_pps(struct hs20_osu_client *ctx, xml_node_t *pps,
1714 char *update_identifier = NULL;
1717 * TODO: Could consider more complex mechanism that would remove
1718 * credentials only if there are changes in the information sent to
1721 remove_sp_creds(ctx, fqdn);
1723 xml_node_for_each_child(ctx->xml, child, pps) {
1724 xml_node_for_each_check(ctx->xml, child);
1725 name = xml_node_get_localname(ctx->xml, child);
1726 if (os_strcasecmp(name, "UpdateIdentifier") == 0) {
1727 update_identifier = xml_node_get_text(ctx->xml, child);
1728 if (update_identifier) {
1729 wpa_printf(MSG_INFO, "- UpdateIdentifier = %s",
1736 xml_node_for_each_child(ctx->xml, child, pps) {
1737 xml_node_for_each_check(ctx->xml, child);
1738 name = xml_node_get_localname(ctx->xml, child);
1739 if (os_strcasecmp(name, "UpdateIdentifier") == 0)
1741 id = add_cred(ctx->ifname);
1743 wpa_printf(MSG_INFO, "Failed to add credential to wpa_supplicant");
1744 write_summary(ctx, "Failed to add credential to wpa_supplicant");
1747 write_summary(ctx, "Add a credential to wpa_supplicant");
1748 if (update_identifier &&
1749 set_cred(ctx->ifname, id, "update_identifier",
1750 update_identifier) < 0)
1751 wpa_printf(MSG_INFO, "Failed to set update_identifier");
1752 if (set_cred_quoted(ctx->ifname, id, "provisioning_sp", fqdn) <
1754 wpa_printf(MSG_INFO, "Failed to set provisioning_sp");
1755 wpa_printf(MSG_INFO, "credential localname: '%s'", name);
1756 set_pps_credential(ctx, id, child, fqdn);
1757 ctx->pps_cred_set = 1;
1760 xml_node_get_text_free(ctx->xml, update_identifier);
1764 void cmd_set_pps(struct hs20_osu_client *ctx, const char *pps_fname)
1768 char *fqdn_buf = NULL, *pos;
1770 pps = node_from_file(ctx->xml, pps_fname);
1772 wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
1776 fqdn = os_strstr(pps_fname, "SP/");
1778 fqdn_buf = os_strdup(fqdn + 3);
1779 if (fqdn_buf == NULL)
1781 pos = os_strchr(fqdn_buf, '/');
1788 wpa_printf(MSG_INFO, "Set PPS MO info to wpa_supplicant - SP FQDN %s",
1790 set_pps(ctx, pps, fqdn);
1793 xml_node_free(ctx->xml, pps);
1797 static int cmd_get_fqdn(struct hs20_osu_client *ctx, const char *pps_fname)
1799 xml_node_t *pps, *node;
1802 pps = node_from_file(ctx->xml, pps_fname);
1804 wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
1808 node = get_child_node(ctx->xml, pps, "HomeSP/FQDN");
1810 fqdn = xml_node_get_text(ctx->xml, node);
1812 xml_node_free(ctx->xml, pps);
1815 FILE *f = fopen("pps-fqdn", "w");
1817 fprintf(f, "%s", fqdn);
1820 xml_node_get_text_free(ctx->xml, fqdn);
1824 xml_node_get_text_free(ctx->xml, fqdn);
1829 static void cmd_to_tnds(struct hs20_osu_client *ctx, const char *in_fname,
1830 const char *out_fname, const char *urn, int use_path)
1832 xml_node_t *mo, *node;
1834 mo = node_from_file(ctx->xml, in_fname);
1836 wpa_printf(MSG_INFO, "Could not read or parse '%s'", in_fname);
1840 node = mo_to_tnds(ctx->xml, mo, use_path, urn, NULL);
1842 node_to_file(ctx->xml, out_fname, node);
1843 xml_node_free(ctx->xml, node);
1846 xml_node_free(ctx->xml, mo);
1850 static void cmd_from_tnds(struct hs20_osu_client *ctx, const char *in_fname,
1851 const char *out_fname)
1853 xml_node_t *tnds, *mo;
1855 tnds = node_from_file(ctx->xml, in_fname);
1857 wpa_printf(MSG_INFO, "Could not read or parse '%s'", in_fname);
1861 mo = tnds_to_mo(ctx->xml, tnds);
1863 node_to_file(ctx->xml, out_fname, mo);
1864 xml_node_free(ctx->xml, mo);
1867 xml_node_free(ctx->xml, tnds);
1874 char mime_type[256];
1881 unsigned int methods;
1884 struct osu_lang_text friendly_name[MAX_OSU_VALS];
1885 size_t friendly_name_count;
1886 struct osu_lang_text serv_desc[MAX_OSU_VALS];
1887 size_t serv_desc_count;
1888 struct osu_icon icon[MAX_OSU_VALS];
1893 static struct osu_data * parse_osu_providers(const char *fname, size_t *count)
1897 struct osu_data *osu = NULL, *last = NULL;
1898 size_t osu_count = 0;
1901 f = fopen(fname, "r");
1903 wpa_printf(MSG_ERROR, "Could not open %s", fname);
1907 while (fgets(buf, sizeof(buf), f)) {
1908 pos = strchr(buf, '\n');
1912 if (strncmp(buf, "OSU-PROVIDER ", 13) == 0) {
1913 last = realloc(osu, (osu_count + 1) * sizeof(*osu));
1917 last = &osu[osu_count++];
1918 memset(last, 0, sizeof(*last));
1919 snprintf(last->bssid, sizeof(last->bssid), "%s",
1926 if (strncmp(buf, "uri=", 4) == 0) {
1927 snprintf(last->url, sizeof(last->url), "%s", buf + 4);
1931 if (strncmp(buf, "methods=", 8) == 0) {
1932 last->methods = strtol(buf + 8, NULL, 16);
1936 if (strncmp(buf, "osu_ssid=", 9) == 0) {
1937 snprintf(last->osu_ssid, sizeof(last->osu_ssid),
1942 if (os_strncmp(buf, "osu_nai=", 8) == 0) {
1943 os_snprintf(last->osu_nai, sizeof(last->osu_nai),
1948 if (strncmp(buf, "friendly_name=", 14) == 0) {
1949 struct osu_lang_text *txt;
1950 if (last->friendly_name_count == MAX_OSU_VALS)
1952 pos = strchr(buf + 14, ':');
1956 txt = &last->friendly_name[last->friendly_name_count++];
1957 snprintf(txt->lang, sizeof(txt->lang), "%s", buf + 14);
1958 snprintf(txt->text, sizeof(txt->text), "%s", pos);
1961 if (strncmp(buf, "desc=", 5) == 0) {
1962 struct osu_lang_text *txt;
1963 if (last->serv_desc_count == MAX_OSU_VALS)
1965 pos = strchr(buf + 5, ':');
1969 txt = &last->serv_desc[last->serv_desc_count++];
1970 snprintf(txt->lang, sizeof(txt->lang), "%s", buf + 5);
1971 snprintf(txt->text, sizeof(txt->text), "%s", pos);
1974 if (strncmp(buf, "icon=", 5) == 0) {
1975 struct osu_icon *icon;
1976 if (last->icon_count == MAX_OSU_VALS)
1978 icon = &last->icon[last->icon_count++];
1979 icon->id = atoi(buf + 5);
1980 pos = strchr(buf, ':');
1983 pos = strchr(pos + 1, ':');
1986 pos = strchr(pos + 1, ':');
1990 end = strchr(pos, ':');
1994 snprintf(icon->lang, sizeof(icon->lang), "%s", pos);
1997 end = strchr(pos, ':');
2000 snprintf(icon->mime_type, sizeof(icon->mime_type),
2006 end = strchr(pos, ':');
2009 snprintf(icon->filename, sizeof(icon->filename),
2022 static int osu_connect(struct hs20_osu_client *ctx, const char *bssid,
2023 const char *ssid, const char *url,
2024 unsigned int methods, int no_prod_assoc,
2025 const char *osu_nai)
2028 const char *ifname = ctx->ifname;
2030 struct wpa_ctrl *mon;
2033 id = add_network(ifname);
2036 if (set_network_quoted(ifname, id, "ssid", ssid) < 0)
2038 if (osu_nai && os_strlen(osu_nai) > 0) {
2039 char dir[255], fname[300];
2040 if (getcwd(dir, sizeof(dir)) == NULL)
2042 os_snprintf(fname, sizeof(fname), "%s/osu-ca.pem", dir);
2044 if (set_network(ifname, id, "proto", "OSEN") < 0 ||
2045 set_network(ifname, id, "key_mgmt", "OSEN") < 0 ||
2046 set_network(ifname, id, "pairwise", "CCMP") < 0 ||
2047 set_network(ifname, id, "group", "GTK_NOT_USED") < 0 ||
2048 set_network(ifname, id, "eap", "WFA-UNAUTH-TLS") < 0 ||
2049 set_network(ifname, id, "ocsp", "2") < 0 ||
2050 set_network_quoted(ifname, id, "identity", osu_nai) < 0 ||
2051 set_network_quoted(ifname, id, "ca_cert", fname) < 0)
2054 if (set_network(ifname, id, "key_mgmt", "NONE") < 0)
2058 mon = open_wpa_mon(ifname);
2062 wpa_printf(MSG_INFO, "Associate with OSU SSID");
2063 write_summary(ctx, "Associate with OSU SSID");
2064 snprintf(buf, sizeof(buf), "SELECT_NETWORK %d", id);
2065 if (wpa_command(ifname, buf) < 0)
2068 res = get_wpa_cli_event(mon, "CTRL-EVENT-CONNECTED",
2071 wpa_ctrl_detach(mon);
2072 wpa_ctrl_close(mon);
2075 wpa_printf(MSG_INFO, "Could not connect");
2076 write_summary(ctx, "Could not connect to OSU network");
2077 wpa_printf(MSG_INFO, "Remove OSU network connection");
2078 snprintf(buf, sizeof(buf), "REMOVE_NETWORK %d", id);
2079 wpa_command(ifname, buf);
2083 write_summary(ctx, "Waiting for IP address for subscription registration");
2084 if (wait_ip_addr(ifname, 15) < 0) {
2085 wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
2088 if (no_prod_assoc) {
2091 wpa_printf(MSG_INFO, "No production connection used for testing purposes");
2092 write_summary(ctx, "No production connection used for testing purposes");
2096 ctx->no_reconnect = 1;
2098 res = cmd_prov(ctx, url);
2099 else if (methods & 0x01)
2100 res = cmd_oma_dm_prov(ctx, url);
2102 wpa_printf(MSG_INFO, "Remove OSU network connection");
2103 write_summary(ctx, "Remove OSU network connection");
2104 snprintf(buf, sizeof(buf), "REMOVE_NETWORK %d", id);
2105 wpa_command(ifname, buf);
2110 wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
2111 write_summary(ctx, "Requesting reconnection with updated configuration");
2112 if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0) {
2113 wpa_printf(MSG_INFO, "Failed to request wpa_supplicant to reconnect");
2114 write_summary(ctx, "Failed to request wpa_supplicant to reconnect");
2122 static int cmd_osu_select(struct hs20_osu_client *ctx, const char *dir,
2123 int connect, int no_prod_assoc,
2124 const char *friendly_name)
2128 struct osu_data *osu = NULL, *last = NULL;
2129 size_t osu_count, i, j;
2132 write_summary(ctx, "OSU provider selection");
2135 wpa_printf(MSG_INFO, "Missing dir parameter to osu_select");
2139 snprintf(fname, sizeof(fname), "%s/osu-providers.txt", dir);
2140 osu = parse_osu_providers(fname, &osu_count);
2142 wpa_printf(MSG_INFO, "Could not any OSU providers from %s",
2144 write_result(ctx, "No OSU providers available");
2148 if (friendly_name) {
2149 for (i = 0; i < osu_count; i++) {
2151 for (j = 0; j < last->friendly_name_count; j++) {
2152 if (os_strcmp(last->friendly_name[j].text,
2153 friendly_name) == 0)
2156 if (j < last->friendly_name_count)
2159 if (i == osu_count) {
2160 wpa_printf(MSG_INFO, "Requested operator friendly name '%s' not found in the list of available providers",
2162 write_summary(ctx, "Requested operator friendly name '%s' not found in the list of available providers",
2168 wpa_printf(MSG_INFO, "OSU Provider selected based on requested operator friendly name '%s'",
2170 write_summary(ctx, "OSU Provider selected based on requested operator friendly name '%s'",
2176 snprintf(fname, sizeof(fname), "%s/osu-providers.html", dir);
2177 f = fopen(fname, "w");
2179 wpa_printf(MSG_INFO, "Could not open %s", fname);
2184 fprintf(f, "<html><head>"
2185 "<meta http-equiv=\"Content-type\" content=\"text/html; "
2186 "charset=utf-8\"<title>Select service operator</title>"
2187 "</head><body><h1>Select service operator</h1>\n");
2190 fprintf(f, "No online signup available\n");
2192 for (i = 0; i < osu_count; i++) {
2196 "<a href=\"http://localhost:12345/osu/%d\">"
2197 "<table><tr><td>", (int) i + 1);
2200 "<a href=\"osu://%d\">"
2201 "<table><tr><td>", (int) i + 1);
2202 #endif /* ANDROID */
2203 for (j = 0; j < last->icon_count; j++) {
2204 fprintf(f, "<img src=\"osu-icon-%d.%s\">\n",
2206 strcasecmp(last->icon[j].mime_type,
2207 "image/png") == 0 ? "png" : "icon");
2210 for (j = 0; j < last->friendly_name_count; j++) {
2211 fprintf(f, "<small>[%s]</small> %s<br>\n",
2212 last->friendly_name[j].lang,
2213 last->friendly_name[j].text);
2215 fprintf(f, "<tr><td colspan=2>");
2216 for (j = 0; j < last->serv_desc_count; j++) {
2217 fprintf(f, "<small>[%s]</small> %s<br>\n",
2218 last->serv_desc[j].lang,
2219 last->serv_desc[j].text);
2221 fprintf(f, "</table></a><br><small>BSSID: %s<br>\n"
2223 last->bssid, last->osu_ssid);
2225 fprintf(f, "NAI: %s<br>\n", last->osu_nai);
2226 fprintf(f, "URL: %s<br>\n"
2227 "methods:%s%s<br>\n"
2230 last->methods & 0x01 ? " OMA-DM" : "",
2231 last->methods & 0x02 ? " SOAP-XML-SPP" : "");
2234 fprintf(f, "</body></html>\n");
2238 snprintf(fname, sizeof(fname), "file://%s/osu-providers.html", dir);
2239 write_summary(ctx, "Start web browser with OSU provider selection page");
2240 ret = hs20_web_browser(fname);
2243 if (ret > 0 && (size_t) ret <= osu_count) {
2247 wpa_printf(MSG_INFO, "Selected OSU id=%d", ret);
2248 last = &osu[ret - 1];
2250 wpa_printf(MSG_INFO, "BSSID: %s", last->bssid);
2251 wpa_printf(MSG_INFO, "SSID: %s", last->osu_ssid);
2252 wpa_printf(MSG_INFO, "URL: %s", last->url);
2253 write_summary(ctx, "Selected OSU provider id=%d BSSID=%s SSID=%s URL=%s",
2254 ret, last->bssid, last->osu_ssid, last->url);
2256 ctx->friendly_name_count = last->friendly_name_count;
2257 for (j = 0; j < last->friendly_name_count; j++) {
2258 wpa_printf(MSG_INFO, "FRIENDLY_NAME: [%s]%s",
2259 last->friendly_name[j].lang,
2260 last->friendly_name[j].text);
2261 os_strlcpy(ctx->friendly_name[j].lang,
2262 last->friendly_name[j].lang,
2263 sizeof(ctx->friendly_name[j].lang));
2264 os_strlcpy(ctx->friendly_name[j].text,
2265 last->friendly_name[j].text,
2266 sizeof(ctx->friendly_name[j].text));
2269 ctx->icon_count = last->icon_count;
2270 for (j = 0; j < last->icon_count; j++) {
2273 os_snprintf(fname, sizeof(fname), "%s/osu-icon-%d.%s",
2274 dir, last->icon[j].id,
2275 strcasecmp(last->icon[j].mime_type,
2278 wpa_printf(MSG_INFO, "ICON: %s (%s)",
2279 fname, last->icon[j].filename);
2280 os_strlcpy(ctx->icon_filename[j],
2281 last->icon[j].filename,
2282 sizeof(ctx->icon_filename[j]));
2284 data = os_readfile(fname, &data_len);
2286 sha256_vector(1, (const u8 **) &data, &data_len,
2293 if (last->methods & 0x02)
2294 ret = cmd_prov(ctx, last->url);
2295 else if (last->methods & 0x01)
2296 ret = cmd_oma_dm_prov(ctx, last->url);
2300 ret = osu_connect(ctx, last->bssid, last->osu_ssid,
2301 last->url, last->methods,
2302 no_prod_assoc, last->osu_nai);
2312 static int cmd_signup(struct hs20_osu_client *ctx, int no_prod_assoc,
2313 const char *friendly_name)
2316 char fname[300], buf[400];
2317 struct wpa_ctrl *mon;
2321 ifname = ctx->ifname;
2323 if (getcwd(dir, sizeof(dir)) == NULL)
2326 snprintf(fname, sizeof(fname), "%s/osu-info", dir);
2327 if (mkdir(fname, S_IRWXU | S_IRWXG) < 0 && errno != EEXIST) {
2328 wpa_printf(MSG_INFO, "mkdir(%s) failed: %s",
2329 fname, strerror(errno));
2333 snprintf(buf, sizeof(buf), "SET osu_dir %s", fname);
2334 if (wpa_command(ifname, buf) < 0) {
2335 wpa_printf(MSG_INFO, "Failed to configure osu_dir to wpa_supplicant");
2339 mon = open_wpa_mon(ifname);
2343 wpa_printf(MSG_INFO, "Starting OSU fetch");
2344 write_summary(ctx, "Starting OSU provider information fetch");
2345 if (wpa_command(ifname, "FETCH_OSU") < 0) {
2346 wpa_printf(MSG_INFO, "Could not start OSU fetch");
2347 wpa_ctrl_detach(mon);
2348 wpa_ctrl_close(mon);
2351 res = get_wpa_cli_event(mon, "OSU provider fetch completed",
2354 wpa_ctrl_detach(mon);
2355 wpa_ctrl_close(mon);
2358 wpa_printf(MSG_INFO, "OSU fetch did not complete");
2359 write_summary(ctx, "OSU fetch did not complete");
2362 wpa_printf(MSG_INFO, "OSU provider fetch completed");
2364 return cmd_osu_select(ctx, fname, 1, no_prod_assoc, friendly_name);
2368 static int cmd_sub_rem(struct hs20_osu_client *ctx, const char *address,
2369 const char *pps_fname, const char *ca_fname)
2371 xml_node_t *pps, *node;
2372 char pps_fname_buf[300];
2373 char ca_fname_buf[200];
2374 char *cred_username = NULL;
2375 char *cred_password = NULL;
2376 char *sub_rem_uri = NULL;
2377 char client_cert_buf[200];
2378 char *client_cert = NULL;
2379 char client_key_buf[200];
2380 char *client_key = NULL;
2383 wpa_printf(MSG_INFO, "Subscription remediation requested with Server URL: %s",
2388 wpa_printf(MSG_INFO, "Determining PPS file based on Home SP information");
2389 if (os_strncmp(address, "fqdn=", 5) == 0) {
2390 wpa_printf(MSG_INFO, "Use requested FQDN from command line");
2391 os_snprintf(buf, sizeof(buf), "%s", address + 5);
2393 } else if (get_wpa_status(ctx->ifname, "provisioning_sp", buf,
2395 wpa_printf(MSG_INFO, "Could not get provisioning Home SP FQDN from wpa_supplicant");
2399 ctx->fqdn = os_strdup(buf);
2400 if (ctx->fqdn == NULL)
2402 wpa_printf(MSG_INFO, "Home SP FQDN for current credential: %s",
2404 os_snprintf(pps_fname_buf, sizeof(pps_fname_buf),
2405 "SP/%s/pps.xml", ctx->fqdn);
2406 pps_fname = pps_fname_buf;
2408 os_snprintf(ca_fname_buf, sizeof(ca_fname_buf), "SP/%s/ca.pem",
2410 ca_fname = ca_fname_buf;
2413 if (!os_file_exists(pps_fname)) {
2414 wpa_printf(MSG_INFO, "PPS file '%s' does not exist or is not accessible",
2418 wpa_printf(MSG_INFO, "Using PPS file: %s", pps_fname);
2420 if (ca_fname && !os_file_exists(ca_fname)) {
2421 wpa_printf(MSG_INFO, "CA file '%s' does not exist or is not accessible",
2425 wpa_printf(MSG_INFO, "Using server trust root: %s", ca_fname);
2426 ctx->ca_fname = ca_fname;
2428 pps = node_from_file(ctx->xml, pps_fname);
2430 wpa_printf(MSG_INFO, "Could not read PPS MO");
2436 node = get_child_node(ctx->xml, pps, "HomeSP/FQDN");
2438 wpa_printf(MSG_INFO, "No HomeSP/FQDN found from PPS");
2441 tmp = xml_node_get_text(ctx->xml, node);
2443 wpa_printf(MSG_INFO, "No HomeSP/FQDN text found from PPS");
2446 ctx->fqdn = os_strdup(tmp);
2447 xml_node_get_text_free(ctx->xml, tmp);
2449 wpa_printf(MSG_INFO, "No FQDN known");
2454 node = get_child_node(ctx->xml, pps,
2455 "SubscriptionUpdate/UpdateMethod");
2458 tmp = xml_node_get_text(ctx->xml, node);
2459 if (tmp && os_strcasecmp(tmp, "OMA-DM-ClientInitiated") == 0)
2464 wpa_printf(MSG_INFO, "No UpdateMethod specified - assume SPP");
2468 get_user_pw(ctx, pps, "SubscriptionUpdate/UsernamePassword",
2469 &cred_username, &cred_password);
2471 wpa_printf(MSG_INFO, "Using username: %s", cred_username);
2473 wpa_printf(MSG_DEBUG, "Using password: %s", cred_password);
2475 if (cred_username == NULL && cred_password == NULL &&
2476 get_child_node(ctx->xml, pps, "Credential/DigitalCertificate")) {
2477 wpa_printf(MSG_INFO, "Using client certificate");
2478 os_snprintf(client_cert_buf, sizeof(client_cert_buf),
2479 "SP/%s/client-cert.pem", ctx->fqdn);
2480 client_cert = client_cert_buf;
2481 os_snprintf(client_key_buf, sizeof(client_key_buf),
2482 "SP/%s/client-key.pem", ctx->fqdn);
2483 client_key = client_key_buf;
2484 ctx->client_cert_present = 1;
2487 node = get_child_node(ctx->xml, pps, "SubscriptionUpdate/URI");
2489 sub_rem_uri = xml_node_get_text(ctx->xml, node);
2491 (!address || os_strcmp(address, sub_rem_uri) != 0)) {
2492 wpa_printf(MSG_INFO, "Override sub rem URI based on PPS: %s",
2494 address = sub_rem_uri;
2498 wpa_printf(MSG_INFO, "Server URL not known");
2502 write_summary(ctx, "Wait for IP address for subscriptiom remediation");
2503 wpa_printf(MSG_INFO, "Wait for IP address before starting subscription remediation");
2505 if (wait_ip_addr(ctx->ifname, 15) < 0) {
2506 wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
2510 spp_sub_rem(ctx, address, pps_fname,
2511 client_cert, client_key,
2512 cred_username, cred_password, pps);
2514 oma_dm_sub_rem(ctx, address, pps_fname,
2515 client_cert, client_key,
2516 cred_username, cred_password, pps);
2518 xml_node_get_text_free(ctx->xml, sub_rem_uri);
2519 xml_node_get_text_free(ctx->xml, cred_username);
2520 str_clear_free(cred_password);
2521 xml_node_free(ctx->xml, pps);
2526 static int cmd_pol_upd(struct hs20_osu_client *ctx, const char *address,
2527 const char *pps_fname, const char *ca_fname)
2531 char pps_fname_buf[300];
2532 char ca_fname_buf[200];
2534 char *cred_username = NULL;
2535 char *cred_password = NULL;
2536 char client_cert_buf[200];
2537 char *client_cert = NULL;
2538 char client_key_buf[200];
2539 char *client_key = NULL;
2542 wpa_printf(MSG_INFO, "Policy update requested");
2546 wpa_printf(MSG_INFO, "Determining PPS file based on Home SP information");
2547 if (os_strncmp(address, "fqdn=", 5) == 0) {
2548 wpa_printf(MSG_INFO, "Use requested FQDN from command line");
2549 os_snprintf(buf, sizeof(buf), "%s", address + 5);
2551 } else if (get_wpa_status(ctx->ifname, "provisioning_sp", buf,
2553 wpa_printf(MSG_INFO, "Could not get provisioning Home SP FQDN from wpa_supplicant");
2557 ctx->fqdn = os_strdup(buf);
2558 if (ctx->fqdn == NULL)
2560 wpa_printf(MSG_INFO, "Home SP FQDN for current credential: %s",
2562 os_snprintf(pps_fname_buf, sizeof(pps_fname_buf),
2563 "SP/%s/pps.xml", ctx->fqdn);
2564 pps_fname = pps_fname_buf;
2566 os_snprintf(ca_fname_buf, sizeof(ca_fname_buf), "SP/%s/ca.pem",
2568 ca_fname = ca_fname_buf;
2571 if (!os_file_exists(pps_fname)) {
2572 wpa_printf(MSG_INFO, "PPS file '%s' does not exist or is not accessible",
2576 wpa_printf(MSG_INFO, "Using PPS file: %s", pps_fname);
2578 if (ca_fname && !os_file_exists(ca_fname)) {
2579 wpa_printf(MSG_INFO, "CA file '%s' does not exist or is not accessible",
2583 wpa_printf(MSG_INFO, "Using server trust root: %s", ca_fname);
2584 ctx->ca_fname = ca_fname;
2586 pps = node_from_file(ctx->xml, pps_fname);
2588 wpa_printf(MSG_INFO, "Could not read PPS MO");
2594 node = get_child_node(ctx->xml, pps, "HomeSP/FQDN");
2596 wpa_printf(MSG_INFO, "No HomeSP/FQDN found from PPS");
2599 tmp = xml_node_get_text(ctx->xml, node);
2601 wpa_printf(MSG_INFO, "No HomeSP/FQDN text found from PPS");
2604 ctx->fqdn = os_strdup(tmp);
2605 xml_node_get_text_free(ctx->xml, tmp);
2607 wpa_printf(MSG_INFO, "No FQDN known");
2612 node = get_child_node(ctx->xml, pps,
2613 "Policy/PolicyUpdate/UpdateMethod");
2616 tmp = xml_node_get_text(ctx->xml, node);
2617 if (tmp && os_strcasecmp(tmp, "OMA-DM-ClientInitiated") == 0)
2622 wpa_printf(MSG_INFO, "No UpdateMethod specified - assume SPP");
2626 get_user_pw(ctx, pps, "Policy/PolicyUpdate/UsernamePassword",
2627 &cred_username, &cred_password);
2629 wpa_printf(MSG_INFO, "Using username: %s", cred_username);
2631 wpa_printf(MSG_DEBUG, "Using password: %s", cred_password);
2633 if (cred_username == NULL && cred_password == NULL &&
2634 get_child_node(ctx->xml, pps, "Credential/DigitalCertificate")) {
2635 wpa_printf(MSG_INFO, "Using client certificate");
2636 os_snprintf(client_cert_buf, sizeof(client_cert_buf),
2637 "SP/%s/client-cert.pem", ctx->fqdn);
2638 client_cert = client_cert_buf;
2639 os_snprintf(client_key_buf, sizeof(client_key_buf),
2640 "SP/%s/client-key.pem", ctx->fqdn);
2641 client_key = client_key_buf;
2645 node = get_child_node(ctx->xml, pps, "Policy/PolicyUpdate/URI");
2647 uri = xml_node_get_text(ctx->xml, node);
2648 wpa_printf(MSG_INFO, "URI based on PPS: %s", uri);
2653 wpa_printf(MSG_INFO, "Server URL not known");
2658 spp_pol_upd(ctx, address, pps_fname,
2659 client_cert, client_key,
2660 cred_username, cred_password, pps);
2662 oma_dm_pol_upd(ctx, address, pps_fname,
2663 client_cert, client_key,
2664 cred_username, cred_password, pps);
2666 xml_node_get_text_free(ctx->xml, uri);
2667 xml_node_get_text_free(ctx->xml, cred_username);
2668 str_clear_free(cred_password);
2669 xml_node_free(ctx->xml, pps);
2675 static char * get_hostname(const char *url)
2677 const char *pos, *end, *end2;
2683 pos = os_strchr(url, '/');
2691 end = os_strchr(pos, '/');
2692 end2 = os_strchr(pos, ':');
2693 if (end && end2 && end2 < end)
2705 ret = os_malloc(end - pos + 2);
2709 os_memcpy(ret, pos, end - pos + 1);
2710 ret[end - pos + 1] = '\0';
2716 static int osu_cert_cb(void *_ctx, struct http_cert *cert)
2718 struct hs20_osu_client *ctx = _ctx;
2723 wpa_printf(MSG_INFO, "osu_cert_cb(osu_cert_validation=%d)",
2724 !ctx->no_osu_cert_validation);
2726 host = get_hostname(ctx->server_url);
2728 for (i = 0; i < ctx->server_dnsname_count; i++)
2729 os_free(ctx->server_dnsname[i]);
2730 os_free(ctx->server_dnsname);
2731 ctx->server_dnsname = os_calloc(cert->num_dnsname, sizeof(char *));
2732 ctx->server_dnsname_count = 0;
2735 for (i = 0; i < cert->num_dnsname; i++) {
2736 if (ctx->server_dnsname) {
2737 ctx->server_dnsname[ctx->server_dnsname_count] =
2738 os_strdup(cert->dnsname[i]);
2739 if (ctx->server_dnsname[ctx->server_dnsname_count])
2740 ctx->server_dnsname_count++;
2742 if (host && os_strcasecmp(host, cert->dnsname[i]) == 0)
2744 wpa_printf(MSG_INFO, "dNSName '%s'", cert->dnsname[i]);
2747 if (host && !found) {
2748 wpa_printf(MSG_INFO, "Server name from URL (%s) did not match any dNSName - abort connection",
2750 write_result(ctx, "Server name from URL (%s) did not match any dNSName - abort connection",
2758 for (i = 0; i < cert->num_othername; i++) {
2759 if (os_strcmp(cert->othername[i].oid,
2760 "1.3.6.1.4.1.40808.1.1.1") == 0) {
2761 wpa_hexdump_ascii(MSG_INFO,
2762 "id-wfa-hotspot-friendlyName",
2763 cert->othername[i].data,
2764 cert->othername[i].len);
2768 for (j = 0; !ctx->no_osu_cert_validation &&
2769 j < ctx->friendly_name_count; j++) {
2771 for (i = 0; i < cert->num_othername; i++) {
2772 if (os_strcmp(cert->othername[i].oid,
2773 "1.3.6.1.4.1.40808.1.1.1") != 0)
2775 if (cert->othername[i].len < 3)
2777 if (os_strncasecmp((char *) cert->othername[i].data,
2778 ctx->friendly_name[j].lang, 3) != 0)
2780 if (os_strncmp((char *) cert->othername[i].data + 3,
2781 ctx->friendly_name[j].text,
2782 cert->othername[i].len - 3) == 0) {
2789 wpa_printf(MSG_INFO, "No friendly name match found for '[%s]%s'",
2790 ctx->friendly_name[j].lang,
2791 ctx->friendly_name[j].text);
2792 write_result(ctx, "No friendly name match found for '[%s]%s'",
2793 ctx->friendly_name[j].lang,
2794 ctx->friendly_name[j].text);
2799 for (i = 0; i < cert->num_logo; i++) {
2800 struct http_logo *logo = &cert->logo[i];
2802 wpa_printf(MSG_INFO, "logo hash alg %s uri '%s'",
2803 logo->alg_oid, logo->uri);
2804 wpa_hexdump_ascii(MSG_INFO, "hashValue",
2805 logo->hash, logo->hash_len);
2808 for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
2810 char *name = ctx->icon_filename[j];
2811 size_t name_len = os_strlen(name);
2813 wpa_printf(MSG_INFO, "Looking for icon file name '%s' match",
2815 for (i = 0; i < cert->num_logo; i++) {
2816 struct http_logo *logo = &cert->logo[i];
2817 size_t uri_len = os_strlen(logo->uri);
2820 wpa_printf(MSG_INFO, "Comparing to '%s' uri_len=%d name_len=%d",
2821 logo->uri, (int) uri_len, (int) name_len);
2822 if (uri_len < 1 + name_len)
2824 pos = &logo->uri[uri_len - name_len - 1];
2828 if (os_strcmp(pos, name) == 0) {
2835 wpa_printf(MSG_INFO, "No icon filename match found for '%s'",
2838 "No icon filename match found for '%s'",
2844 for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
2847 for (i = 0; i < cert->num_logo; i++) {
2848 struct http_logo *logo = &cert->logo[i];
2850 if (logo->hash_len != 32)
2852 if (os_memcmp(logo->hash, ctx->icon_hash[j], 32) == 0) {
2859 wpa_printf(MSG_INFO, "No icon hash match found");
2860 write_result(ctx, "No icon hash match found");
2869 static int init_ctx(struct hs20_osu_client *ctx)
2871 xml_node_t *devinfo, *devid;
2873 os_memset(ctx, 0, sizeof(*ctx));
2874 ctx->ifname = "wlan0";
2875 ctx->xml = xml_node_init_ctx(ctx, NULL);
2876 if (ctx->xml == NULL)
2879 devinfo = node_from_file(ctx->xml, "devinfo.xml");
2881 wpa_printf(MSG_ERROR, "devinfo.xml not found");
2885 devid = get_node(ctx->xml, devinfo, "DevId");
2887 char *tmp = xml_node_get_text(ctx->xml, devid);
2889 ctx->devid = os_strdup(tmp);
2890 xml_node_get_text_free(ctx->xml, tmp);
2893 xml_node_free(ctx->xml, devinfo);
2895 if (ctx->devid == NULL) {
2896 wpa_printf(MSG_ERROR, "Could not fetch DevId from devinfo.xml");
2900 ctx->http = http_init_ctx(ctx, ctx->xml);
2901 if (ctx->http == NULL) {
2902 xml_node_deinit_ctx(ctx->xml);
2905 http_ocsp_set(ctx->http, 2);
2906 http_set_cert_cb(ctx->http, osu_cert_cb, ctx);
2912 static void deinit_ctx(struct hs20_osu_client *ctx)
2916 http_deinit_ctx(ctx->http);
2917 xml_node_deinit_ctx(ctx->xml);
2919 os_free(ctx->server_url);
2920 os_free(ctx->devid);
2922 for (i = 0; i < ctx->server_dnsname_count; i++)
2923 os_free(ctx->server_dnsname[i]);
2924 os_free(ctx->server_dnsname);
2928 static void check_workarounds(struct hs20_osu_client *ctx)
2932 unsigned long int val = 0;
2934 f = fopen("hs20-osu-client.workarounds", "r");
2938 if (fgets(buf, sizeof(buf), f))
2939 val = strtoul(buf, NULL, 16);
2944 wpa_printf(MSG_INFO, "Workarounds enabled: 0x%lx", val);
2945 ctx->workarounds = val;
2946 if (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL)
2947 http_ocsp_set(ctx->http, 1);
2952 static void usage(void)
2954 printf("usage: hs20-osu-client [-dddqqKt] [-S<station ifname>] \\\n"
2955 " [-w<wpa_supplicant ctrl_iface dir>] "
2956 "[-r<result file>] [-f<debug file>] \\\n"
2957 " [-s<summary file>] \\\n"
2958 " <command> [arguments..]\n"
2960 "- to_tnds <XML MO> <XML MO in TNDS format> [URN]\n"
2961 "- to_tnds2 <XML MO> <XML MO in TNDS format (Path) "
2963 "- from_tnds <XML MO in TNDS format> <XML MO>\n"
2964 "- set_pps <PerProviderSubscription XML file name>\n"
2965 "- get_fqdn <PerProviderSubscription XML file name>\n"
2966 "- pol_upd [Server URL] [PPS] [CA cert]\n"
2967 "- sub_rem <Server URL> [PPS] [CA cert]\n"
2968 "- prov <Server URL> [CA cert]\n"
2969 "- oma_dm_prov <Server URL> [CA cert]\n"
2970 "- sim_prov <Server URL> [CA cert]\n"
2971 "- oma_dm_sim_prov <Server URL> [CA cert]\n"
2972 "- signup [CA cert]\n"
2973 "- dl_osu_ca <PPS> <CA file>\n"
2974 "- dl_polupd_ca <PPS> <CA file>\n"
2975 "- dl_aaa_ca <PPS> <CA file>\n"
2977 "- parse_cert <X.509 certificate (DER)>\n"
2978 "- osu_select <OSU info directory> [CA cert]\n");
2982 int main(int argc, char *argv[])
2984 struct hs20_osu_client ctx;
2987 int no_prod_assoc = 0;
2988 const char *friendly_name = NULL;
2989 const char *wpa_debug_file_path = NULL;
2990 extern char *wpas_ctrl_path;
2991 extern int wpa_debug_level;
2992 extern int wpa_debug_show_keys;
2993 extern int wpa_debug_timestamp;
2995 if (init_ctx(&ctx) < 0)
2999 c = getopt(argc, argv, "df:hi:KNO:qr:s:S:tw:");
3004 if (wpa_debug_level > 0)
3008 wpa_debug_file_path = optarg;
3011 wpa_debug_show_keys++;
3017 friendly_name = optarg;
3023 ctx.result_file = optarg;
3026 ctx.summary_file = optarg;
3029 ctx.ifname = optarg;
3032 wpa_debug_timestamp++;
3035 wpas_ctrl_path = optarg;
3045 if (argc - optind < 1) {
3050 wpa_debug_open_file(wpa_debug_file_path);
3054 #endif /* __linux__ */
3056 if (ctx.result_file)
3057 unlink(ctx.result_file);
3058 wpa_printf(MSG_DEBUG, "===[hs20-osu-client START - command: %s ]======"
3059 "================", argv[optind]);
3060 check_workarounds(&ctx);
3062 if (strcmp(argv[optind], "to_tnds") == 0) {
3063 if (argc - optind < 2) {
3067 cmd_to_tnds(&ctx, argv[optind + 1], argv[optind + 2],
3068 argc > optind + 3 ? argv[optind + 3] : NULL,
3070 } else if (strcmp(argv[optind], "to_tnds2") == 0) {
3071 if (argc - optind < 2) {
3075 cmd_to_tnds(&ctx, argv[optind + 1], argv[optind + 2],
3076 argc > optind + 3 ? argv[optind + 3] : NULL,
3078 } else if (strcmp(argv[optind], "from_tnds") == 0) {
3079 if (argc - optind < 2) {
3083 cmd_from_tnds(&ctx, argv[optind + 1], argv[optind + 2]);
3084 } else if (strcmp(argv[optind], "sub_rem") == 0) {
3085 if (argc - optind < 2) {
3089 if (argc - optind < 2)
3090 wpa_printf(MSG_ERROR, "Server URL missing from command line");
3092 ret = cmd_sub_rem(&ctx, argv[optind + 1],
3094 argv[optind + 2] : NULL,
3096 argv[optind + 3] : NULL);
3097 } else if (strcmp(argv[optind], "pol_upd") == 0) {
3098 if (argc - optind < 2) {
3102 ret = cmd_pol_upd(&ctx, argc > 2 ? argv[optind + 1] : NULL,
3103 argc > optind + 2 ? argv[optind + 2] : NULL,
3104 argc > optind + 3 ? argv[optind + 3] : NULL);
3105 } else if (strcmp(argv[optind], "prov") == 0) {
3106 if (argc - optind < 2) {
3110 ctx.ca_fname = argv[optind + 2];
3111 cmd_prov(&ctx, argv[optind + 1]);
3112 } else if (strcmp(argv[optind], "sim_prov") == 0) {
3113 if (argc - optind < 2) {
3117 ctx.ca_fname = argv[optind + 2];
3118 cmd_sim_prov(&ctx, argv[optind + 1]);
3119 } else if (strcmp(argv[optind], "dl_osu_ca") == 0) {
3120 if (argc - optind < 2) {
3124 cmd_dl_osu_ca(&ctx, argv[optind + 1], argv[optind + 2]);
3125 } else if (strcmp(argv[optind], "dl_polupd_ca") == 0) {
3126 if (argc - optind < 2) {
3130 cmd_dl_polupd_ca(&ctx, argv[optind + 1], argv[optind + 2]);
3131 } else if (strcmp(argv[optind], "dl_aaa_ca") == 0) {
3132 if (argc - optind < 2) {
3136 cmd_dl_aaa_ca(&ctx, argv[optind + 1], argv[optind + 2]);
3137 } else if (strcmp(argv[optind], "osu_select") == 0) {
3138 if (argc - optind < 2) {
3142 ctx.ca_fname = argc > optind + 2 ? argv[optind + 2] : NULL;
3143 cmd_osu_select(&ctx, argv[optind + 1], 2, 1, NULL);
3144 } else if (strcmp(argv[optind], "signup") == 0) {
3145 ctx.ca_fname = argc > optind + 1 ? argv[optind + 1] : NULL;
3146 ret = cmd_signup(&ctx, no_prod_assoc, friendly_name);
3147 } else if (strcmp(argv[optind], "set_pps") == 0) {
3148 if (argc - optind < 2) {
3152 cmd_set_pps(&ctx, argv[optind + 1]);
3153 } else if (strcmp(argv[optind], "get_fqdn") == 0) {
3154 if (argc - optind < 1) {
3158 ret = cmd_get_fqdn(&ctx, argv[optind + 1]);
3159 } else if (strcmp(argv[optind], "oma_dm_prov") == 0) {
3160 if (argc - optind < 2) {
3164 ctx.ca_fname = argv[optind + 2];
3165 cmd_oma_dm_prov(&ctx, argv[optind + 1]);
3166 } else if (strcmp(argv[optind], "oma_dm_sim_prov") == 0) {
3167 if (argc - optind < 2) {
3171 ctx.ca_fname = argv[optind + 2];
3172 if (cmd_oma_dm_sim_prov(&ctx, argv[optind + 1]) < 0) {
3173 write_summary(&ctx, "Failed to complete OMA DM SIM provisioning");
3176 } else if (strcmp(argv[optind], "oma_dm_add") == 0) {
3177 if (argc - optind < 2) {
3181 cmd_oma_dm_add(&ctx, argv[optind + 1], argv[optind + 2]);
3182 } else if (strcmp(argv[optind], "oma_dm_replace") == 0) {
3183 if (argc - optind < 2) {
3187 cmd_oma_dm_replace(&ctx, argv[optind + 1], argv[optind + 2]);
3188 } else if (strcmp(argv[optind], "est_csr") == 0) {
3189 if (argc - optind < 2) {
3193 mkdir("Cert", S_IRWXU);
3194 est_build_csr(&ctx, argv[optind + 1]);
3195 } else if (strcmp(argv[optind], "browser") == 0) {
3198 if (argc - optind < 2) {
3203 wpa_printf(MSG_INFO, "Launch web browser to URL %s",
3205 ret = hs20_web_browser(argv[optind + 1]);
3206 wpa_printf(MSG_INFO, "Web browser result: %d", ret);
3207 } else if (strcmp(argv[optind], "parse_cert") == 0) {
3208 if (argc - optind < 2) {
3213 wpa_debug_level = MSG_MSGDUMP;
3214 http_parse_x509_certificate(ctx.http, argv[optind + 1]);
3215 wpa_debug_level = MSG_INFO;
3217 wpa_printf(MSG_INFO, "Unknown command '%s'", argv[optind]);
3221 wpa_printf(MSG_DEBUG,
3222 "===[hs20-osu-client END ]======================");
3224 wpa_debug_close_file();