jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

WPS: Add prefixes to public event_* functions

Browse source 
openssl engines may dynamically load external libraries. Our event_*()
functions happen to be named very generically, such that event_add()
collides with the libevent library (https://libevent.org/). This can
have disastrous effects (esp. when using CONFIG_WPA_TRACE, which enables
partial linking) when our SSL engines call into the WPS event_add()
instead of their intended libevent event_add().

Resolve this by providing a more unique prefix to these functions.

Rename performed via:

  sed -i -E \
    's:\<event_(add|delete_all|send_all_later|send_stop_all)\>:wps_upnp_event_\1:g' \
     $(git grep -l event_)

Tested via (among other things) hwsim '-f ap_wps' module.

Signed-off-by: Brian Norris <briannorris@chromium.org>
This commit is contained in:
Brian Norris 2019-12-02 12:14:47 -08:00 committed by Jouni Malinen
parent e371d3771c
commit e6d3aca9cf
4 changed files with 29 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/wps/wps_upnp.c
View file

@ -519,7 +519,8 @@ static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription, dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
list) { list) {
event_add(s, buf, wps_upnp_event_add(
s, buf,
sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE); sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
} }
@ -541,7 +542,7 @@ void subscription_destroy(struct subscription *s)
struct upnp_wps_device_interface *iface; struct upnp_wps_device_interface *iface;
wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s); wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
subscr_addr_free_all(s); subscr_addr_free_all(s);
event_delete_all(s); wps_upnp_event_delete_all(s);
dl_list_for_each(iface, &s->sm->interfaces, dl_list_for_each(iface, &s->sm->interfaces,
struct upnp_wps_device_interface, list) struct upnp_wps_device_interface, list)
upnp_er_remove_notification(iface->wps->registrar, s); upnp_er_remove_notification(iface->wps->registrar, s);
@ -672,7 +673,7 @@ static int subscription_first_event(struct subscription *s)
wpabuf_put_property(buf, "WLANEvent", wlan_event); wpabuf_put_property(buf, "WLANEvent", wlan_event);
wpabuf_put_str(buf, tail); wpabuf_put_str(buf, tail);
ret = event_add(s, buf, 0); ret = wps_upnp_event_add(s, buf, 0);
if (ret) { if (ret) {
wpabuf_free(buf); wpabuf_free(buf);
return ret; return ret;
@ -749,7 +750,7 @@ struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
"WPS UPnP: Subscription %p (SID %s) started with %s", "WPS UPnP: Subscription %p (SID %s) started with %s",
s, str, callback_urls); s, str, callback_urls);
/* Schedule sending this */ /* Schedule sending this */
event_send_all_later(sm); wps_upnp_event_send_all_later(sm);
return s; return s;
} }
@ -987,7 +988,7 @@ static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
advertisement_state_machine_stop(sm, 1); advertisement_state_machine_stop(sm, 1);
event_send_stop_all(sm); wps_upnp_event_send_stop_all(sm);
os_free(sm->wlanevent); os_free(sm->wlanevent);
sm->wlanevent = NULL; sm->wlanevent = NULL;
os_free(sm->ip_addr_text); os_free(sm->ip_addr_text);

27
src/wps/wps_upnp_event.c
View file

@ -96,8 +96,8 @@ static struct wps_event_ *event_dequeue(struct subscription *s)
} }
/* event_delete_all -- delete entire event queue and current event */ /* wps_upnp_event_delete_all -- delete entire event queue and current event */
void event_delete_all(struct subscription *s) void wps_upnp_event_delete_all(struct subscription *s)
{ {
struct wps_event_ *e; struct wps_event_ *e;
while ((e = event_dequeue(s)) != NULL) while ((e = event_dequeue(s)) != NULL)
@ -134,11 +134,11 @@ static void event_retry(struct wps_event_ *e, int do_next_address)
event_delete(e); event_delete(e);
s->last_event_failed = 1; s->last_event_failed = 1;
if (!dl_list_empty(&s->event_queue)) if (!dl_list_empty(&s->event_queue))
event_send_all_later(s->sm); wps_upnp_event_send_all_later(s->sm);
return; return;
} }
dl_list_add(&s->event_queue, &e->list); dl_list_add(&s->event_queue, &e->list);
event_send_all_later(sm); wps_upnp_event_send_all_later(sm);
} }
@ -228,7 +228,7 @@ static void event_http_cb(void *ctx, struct http_client *c,
/* Schedule sending more if there is more to send */ /* Schedule sending more if there is more to send */
if (!dl_list_empty(&s->event_queue)) if (!dl_list_empty(&s->event_queue))
event_send_all_later(s->sm); wps_upnp_event_send_all_later(s->sm);
break; break;
case HTTP_CLIENT_FAILED: case HTTP_CLIENT_FAILED:
wpa_printf(MSG_DEBUG, "WPS UPnP: Event send failure"); wpa_printf(MSG_DEBUG, "WPS UPnP: Event send failure");
@ -328,19 +328,19 @@ static void event_send_all_later_handler(void *eloop_data, void *user_ctx)
if (nerrors) { if (nerrors) {
/* Try again later */ /* Try again later */
event_send_all_later(sm); wps_upnp_event_send_all_later(sm);
} }
} }
/* event_send_all_later -- schedule sending events to all subscribers /* wps_upnp_event_send_all_later -- schedule sending events to all subscribers
* that need it. * that need it.
* This avoids two problems: * This avoids two problems:
* -- After getting a subscription, we should not send the first event * -- After getting a subscription, we should not send the first event
* until after our reply is fully queued to be sent back, * until after our reply is fully queued to be sent back,
* -- Possible stack depth or infinite recursion issues. * -- Possible stack depth or infinite recursion issues.
*/ */
void event_send_all_later(struct upnp_wps_device_sm *sm) void wps_upnp_event_send_all_later(struct upnp_wps_device_sm *sm)
{ {
/* /*
* The exact time in the future isn't too important. Waiting a bit * The exact time in the future isn't too important. Waiting a bit
@ -354,8 +354,8 @@ void event_send_all_later(struct upnp_wps_device_sm *sm)
} }
/* event_send_stop_all -- cleanup */ /* wps_upnp_event_send_stop_all -- cleanup */
void event_send_stop_all(struct upnp_wps_device_sm *sm) void wps_upnp_event_send_stop_all(struct upnp_wps_device_sm *sm)
{ {
if (sm->event_send_all_queued) if (sm->event_send_all_queued)
eloop_cancel_timeout(event_send_all_later_handler, NULL, sm); eloop_cancel_timeout(event_send_all_later_handler, NULL, sm);
@ -364,13 +364,14 @@ void event_send_stop_all(struct upnp_wps_device_sm *sm)
/** /**
* event_add - Add a new event to a queue * wps_upnp_event_add - Add a new event to a queue
* @s: Subscription * @s: Subscription
* @data: Event data (is copied; caller retains ownership) * @data: Event data (is copied; caller retains ownership)
* @probereq: Whether this is a Probe Request event * @probereq: Whether this is a Probe Request event
* Returns: 0 on success, -1 on error, 1 on max event queue limit reached * Returns: 0 on success, -1 on error, 1 on max event queue limit reached
*/ */
int event_add(struct subscription *s, const struct wpabuf *data, int probereq) int wps_upnp_event_add(struct subscription *s, const struct wpabuf *data,
int probereq)
{ {
struct wps_event_ *e; struct wps_event_ *e;
unsigned int len; unsigned int len;
@ -416,6 +417,6 @@ int event_add(struct subscription *s, const struct wpabuf *data, int probereq)
wpa_printf(MSG_DEBUG, "WPS UPnP: Queue event %p for subscriber %p " wpa_printf(MSG_DEBUG, "WPS UPnP: Queue event %p for subscriber %p "
"(queue len %u)", e, s, len + 1); "(queue len %u)", e, s, len + 1);
dl_list_add_tail(&s->event_queue, &e->list); dl_list_add_tail(&s->event_queue, &e->list);
event_send_all_later(s->sm); wps_upnp_event_send_all_later(s->sm);
return 0; return 0;
} }

9
src/wps/wps_upnp_i.h
View file

@ -177,10 +177,11 @@ int web_listener_start(struct upnp_wps_device_sm *sm);
void web_listener_stop(struct upnp_wps_device_sm *sm); void web_listener_stop(struct upnp_wps_device_sm *sm);
/* wps_upnp_event.c */ /* wps_upnp_event.c */
int event_add(struct subscription *s, const struct wpabuf *data, int probereq); int wps_upnp_event_add(struct subscription *s, const struct wpabuf *data,
void event_delete_all(struct subscription *s); int probereq);
void event_send_all_later(struct upnp_wps_device_sm *sm); void wps_upnp_event_delete_all(struct subscription *s);
void event_send_stop_all(struct upnp_wps_device_sm *sm); void wps_upnp_event_send_all_later(struct upnp_wps_device_sm *sm);
void wps_upnp_event_send_stop_all(struct upnp_wps_device_sm *sm);
/* wps_upnp_ap.c */ /* wps_upnp_ap.c */
int upnp_er_set_selected_registrar(struct wps_registrar *reg, int upnp_er_set_selected_registrar(struct wps_registrar *reg,

6
tests/hwsim/test_ap_wps.py
View file

@ -3130,7 +3130,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
sid = resp.getheader("sid") sid = resp.getheader("sid")
logger.debug("Subscription SID " + sid) logger.debug("Subscription SID " + sid)
with alloc_fail(hapd, 1, "=event_add"): with alloc_fail(hapd, 1, "=wps_upnp_event_add"):
for i in range(2): for i in range(2):
dev[1].dump_monitor() dev[1].dump_monitor()
dev[2].dump_monitor() dev[2].dump_monitor()
@ -3150,7 +3150,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
if resp.status != 200: if resp.status != 200:
raise Exception("Unexpected HTTP response: %d" % resp.status) raise Exception("Unexpected HTTP response: %d" % resp.status)
with alloc_fail(hapd, 1, "wpabuf_dup;event_add"): with alloc_fail(hapd, 1, "wpabuf_dup;wps_upnp_event_add"):
dev[1].dump_monitor() dev[1].dump_monitor()
dev[2].dump_monitor() dev[2].dump_monitor()
dev[1].request("WPS_PIN " + apdev[0]['bssid'] + " 12345670") dev[1].request("WPS_PIN " + apdev[0]['bssid'] + " 12345670")
@ -3198,7 +3198,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
if resp.status != 500: if resp.status != 500:
raise Exception("Unexpected HTTP response: %d" % resp.status) raise Exception("Unexpected HTTP response: %d" % resp.status)
with alloc_fail(hapd, 1, "event_add;subscription_first_event"): with alloc_fail(hapd, 1, "wps_upnp_event_add;subscription_first_event"):
conn.request("SUBSCRIBE", eventurl.path, "\r\n\r\n", headers) conn.request("SUBSCRIBE", eventurl.path, "\r\n\r\n", headers)
resp = conn.getresponse() resp = conn.getresponse()
if resp.status != 500: if resp.status != 500: