自学教程：C++ wpabuf_free函数代码示例

static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,				       union wpa_event_data *data){	u8 bssid[ETH_ALEN];	int ft_completed = wpa_ft_is_completed(wpa_s->wpa);	if (data)		wpa_supplicant_event_associnfo(wpa_s, data);	wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATED);	if (wpa_s->use_client_mlme)		os_memcpy(bssid, wpa_s->bssid, ETH_ALEN);	if (wpa_s->use_client_mlme ||	    (wpa_drv_get_bssid(wpa_s, bssid) >= 0 &&	     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)) {		wpa_msg(wpa_s, MSG_DEBUG, "Associated to a new BSS: BSSID="			MACSTR, MAC2STR(bssid));		os_memcpy(wpa_s->bssid, bssid, ETH_ALEN);		os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);		if (wpa_supplicant_dynamic_keys(wpa_s) && !ft_completed) {			wpa_clear_keys(wpa_s, bssid);		}		if (wpa_supplicant_select_config(wpa_s) < 0) {			wpa_supplicant_disassociate(				wpa_s, WLAN_REASON_DEAUTH_LEAVING);			return;		}	}	wpa_msg(wpa_s, MSG_INFO, "Associated with " MACSTR, MAC2STR(bssid));	if (wpa_s->current_ssid) {		/* When using scanning (ap_scan=1), SIM PC/SC interface can be		 * initialized before association, but for other modes,		 * initialize PC/SC here, if the current configuration needs		 * smartcard or SIM/USIM. */		wpa_supplicant_scard_init(wpa_s, wpa_s->current_ssid);	}	wpa_sm_notify_assoc(wpa_s->wpa, bssid);	l2_packet_notify_auth_start(wpa_s->l2);	/*	 * Set portEnabled first to FALSE in order to get EAP state machine out	 * of the SUCCESS state and eapSuccess cleared. Without this, EAPOL PAE	 * state machine may transit to AUTHENTICATING state based on obsolete	 * eapSuccess and then trigger BE_AUTH to SUCCESS and PAE to	 * AUTHENTICATED without ever giving chance to EAP state machine to	 * reset the state.	 */	if (!ft_completed) {		eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);		eapol_sm_notify_portValid(wpa_s->eapol, FALSE);	}	if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) || ft_completed)		eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);	/* 802.1X::portControl = Auto */	eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE);	wpa_s->eapol_received = 0;	if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||	    wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {		wpa_supplicant_cancel_auth_timeout(wpa_s);		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);	} else if (!ft_completed) {		/* Timeout for receiving the first EAPOL packet */		wpa_supplicant_req_auth_timeout(wpa_s, 10, 0);	}	wpa_supplicant_cancel_scan(wpa_s);	if (wpa_s->driver_4way_handshake &&	    wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {		/*		 * We are done; the driver will take care of RSN 4-way		 * handshake.		 */		wpa_supplicant_cancel_auth_timeout(wpa_s);		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);		eapol_sm_notify_portValid(wpa_s->eapol, TRUE);		eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);	}	if (wpa_s->pending_eapol_rx) {		struct os_time now, age;		os_get_time(&now);		os_time_sub(&now, &wpa_s->pending_eapol_rx_time, &age);		if (age.sec == 0 && age.usec < 100000 &&		    os_memcmp(wpa_s->pending_eapol_rx_src, bssid, ETH_ALEN) ==		    0) {			wpa_printf(MSG_DEBUG, "Process pending EAPOL frame "				   "that was received just before association "				   "notification");			wpa_supplicant_rx_eapol(				wpa_s, wpa_s->pending_eapol_rx_src,				wpabuf_head(wpa_s->pending_eapol_rx),				wpabuf_len(wpa_s->pending_eapol_rx));		}		wpabuf_free(wpa_s->pending_eapol_rx);		wpa_s->pending_eapol_rx = NULL;	}}

static int ikev2_derive_keys(struct ikev2_initiator_data *data){	u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];	size_t buf_len, pad_len;	struct wpabuf *shared;	const struct ikev2_integ_alg *integ;	const struct ikev2_prf_alg *prf;	const struct ikev2_encr_alg *encr;	int ret;	const u8 *addr[2];	size_t len[2];	/* RFC 4306, Sect. 2.14 */	integ = ikev2_get_integ(data->proposal.integ);	prf = ikev2_get_prf(data->proposal.prf);	encr = ikev2_get_encr(data->proposal.encr);	if (integ == NULL || prf == NULL || encr == NULL) {		wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal");		return -1;	}	shared = dh_derive_shared(data->r_dh_public, data->i_dh_private,				  data->dh);	if (shared == NULL)		return -1;	/* Construct Ni | Nr | SPIi | SPIr */	buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;	buf = os_malloc(buf_len);	if (buf == NULL) {		wpabuf_free(shared);		return -1;	}	pos = buf;	os_memcpy(pos, data->i_nonce, data->i_nonce_len);	pos += data->i_nonce_len;	os_memcpy(pos, data->r_nonce, data->r_nonce_len);	pos += data->r_nonce_len;	os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);	pos += IKEV2_SPI_LEN;	os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);	/* SKEYSEED = prf(Ni | Nr, g^ir) */	/* Use zero-padding per RFC 4306, Sect. 2.14 */	pad_len = data->dh->prime_len - wpabuf_len(shared);	pad = os_zalloc(pad_len ? pad_len : 1);	if (pad == NULL) {		wpabuf_free(shared);		os_free(buf);		return -1;	}	addr[0] = pad;	len[0] = pad_len;	addr[1] = wpabuf_head(shared);	len[1] = wpabuf_len(shared);	if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,			   2, addr, len, skeyseed) < 0) {		wpabuf_free(shared);		os_free(buf);		os_free(pad);		return -1;	}	os_free(pad);	wpabuf_free(shared);	/* DH parameters are not needed anymore, so free them */	wpabuf_free(data->r_dh_public);	data->r_dh_public = NULL;	wpabuf_free(data->i_dh_private);	data->i_dh_private = NULL;	wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",			skeyseed, prf->hash_len);	ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,				   &data->keys);	os_free(buf);	return ret;}

void handle_probe_req(struct hostapd_data *hapd,		      const struct ieee80211_mgmt *mgmt, size_t len,		      int ssi_signal){	u8 *resp;	struct ieee802_11_elems elems;	const u8 *ie;	size_t ie_len;	size_t i, resp_len;	int noack;	enum ssid_match_result res;	ie = mgmt->u.probe_req.variable;	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req))		return;	ie_len = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req));	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++)		if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,					    mgmt->sa, mgmt->da, mgmt->bssid,					    ie, ie_len, ssi_signal) > 0)			return;	if (!hapd->iconf->send_probe_response)		return;	if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) {		wpa_printf(MSG_DEBUG, "Could not parse ProbeReq from " MACSTR,			   MAC2STR(mgmt->sa));		return;	}	if ((!elems.ssid || !elems.supp_rates)) {		wpa_printf(MSG_DEBUG, "STA " MACSTR " sent probe request "			   "without SSID or supported rates element",			   MAC2STR(mgmt->sa));		return;	}	/*	 * No need to reply if the Probe Request frame was sent on an adjacent	 * channel. IEEE Std 802.11-2012 describes this as a requirement for an	 * AP with dot11RadioMeasurementActivated set to true, but strictly	 * speaking does not allow such ignoring of Probe Request frames if	 * dot11RadioMeasurementActivated is false. Anyway, this can help reduce	 * number of unnecessary Probe Response frames for cases where the STA	 * is less likely to see them (Probe Request frame sent on a	 * neighboring, but partially overlapping, channel).	 */	if (elems.ds_params &&	    hapd->iface->current_mode &&	    (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G ||	     hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211B) &&	    hapd->iconf->channel != elems.ds_params[0]) {		wpa_printf(MSG_DEBUG,			   "Ignore Probe Request due to DS Params mismatch: chan=%u != ds.chan=%u",			   hapd->iconf->channel, elems.ds_params[0]);		return;	}#ifdef CONFIG_P2P	if (hapd->p2p && elems.wps_ie) {		struct wpabuf *wps;		wps = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA);		if (wps && !p2p_group_match_dev_type(hapd->p2p_group, wps)) {			wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request "				   "due to mismatch with Requested Device "				   "Type");			wpabuf_free(wps);			return;		}		wpabuf_free(wps);	}	if (hapd->p2p && elems.p2p) {		struct wpabuf *p2p;		p2p = ieee802_11_vendor_ie_concat(ie, ie_len, P2P_IE_VENDOR_TYPE);		if (p2p && !p2p_group_match_dev_id(hapd->p2p_group, p2p)) {			wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request "				   "due to mismatch with Device ID");			wpabuf_free(p2p);			return;		}		wpabuf_free(p2p);	}#endif /* CONFIG_P2P */	if (hapd->conf->ignore_broadcast_ssid && elems.ssid_len == 0 &&	    elems.ssid_list_len == 0) {		wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for "			   "broadcast SSID ignored", MAC2STR(mgmt->sa));		return;	}#ifdef CONFIG_P2P	if ((hapd->conf->p2p & P2P_GROUP_OWNER) &&	    elems.ssid_len == P2P_WILDCARD_SSID_LEN &&	    os_memcmp(elems.ssid, P2P_WILDCARD_SSID,		      P2P_WILDCARD_SSID_LEN) == 0) {		/* Process P2P Wildcard SSID like Wildcard SSID *///.........这里部分代码省略.........

/** * upnp_wps_device_send_event - Queue event messages for subscribers * @sm: WPS UPnP state machine from upnp_wps_device_init() * * This function queues the last WLANEvent to be sent for all currently * subscribed UPnP control points. sm->wlanevent must have been set with the * encoded data before calling this function. */static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm){	/* Enqueue event message for all subscribers */	struct wpabuf *buf; /* holds event message */	int buf_size = 0;	struct subscription *s, *tmp;	/* Actually, utf-8 is the default, but it doesn't hurt to specify it */	const char *format_head =		"<?xml version=/"1.0/" encoding=/"utf-8/"?>/n"		"<e:propertyset xmlns:e=/"urn:schemas-upnp-org:event-1-0/">/n";	const char *format_tail = "</e:propertyset>/n";	struct os_time now;	if (dl_list_empty(&sm->subscriptions)) {		/* optimize */		return;	}	if (os_get_time(&now) == 0) {		if (now.sec != sm->last_event_sec) {			sm->last_event_sec = now.sec;			sm->num_events_in_sec = 1;		} else {			sm->num_events_in_sec++;			/*			 * In theory, this should apply to all WLANEvent			 * notifications, but EAP messages are of much higher			 * priority and Probe Request notifications should not			 * be allowed to drop EAP messages, so only throttle			 * Probe Request notifications.			 */			if (sm->num_events_in_sec > MAX_EVENTS_PER_SEC &&			    sm->wlanevent_type ==			    UPNP_WPS_WLANEVENT_TYPE_PROBE) {				wpa_printf(MSG_DEBUG, "WPS UPnP: Throttle "					   "event notifications (%u seen "					   "during one second)",					   sm->num_events_in_sec);				return;			}		}	}	/* Determine buffer size needed first */	buf_size += os_strlen(format_head);	buf_size += 50 + 2 * os_strlen("WLANEvent");	if (sm->wlanevent)		buf_size += os_strlen(sm->wlanevent);	buf_size += os_strlen(format_tail);	buf = wpabuf_alloc(buf_size);	if (buf == NULL)		return;	wpabuf_put_str(buf, format_head);	wpabuf_put_property(buf, "WLANEvent", sm->wlanevent);	wpabuf_put_str(buf, format_tail);	wpa_printf(MSG_MSGDUMP, "WPS UPnP: WLANEvent message:/n%s",		   (char *) wpabuf_head(buf));	dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,			      list) {		event_add(s, buf,			  sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);	}	wpabuf_free(buf);}

static enum wps_process_res wps_process_wsc_msg(struct wps_data *wps,                        const struct wpabuf *msg){    struct wps_parse_attr attr;    enum wps_process_res ret = WPS_CONTINUE;    wpa_printf(MSG_DEBUG, "WPS: Received WSC_MSG");    if (wps_parse_msg(msg, &attr) < 0)        return WPS_FAILURE;    if (!wps_version_supported(attr.version)) {        wpa_printf(MSG_DEBUG, "WPS: Unsupported message version 0x%x",               attr.version ? *attr.version : 0);        return WPS_FAILURE;    }    if (attr.enrollee_nonce == NULL ||        os_memcmp(wps->nonce_e, attr.enrollee_nonce, WPS_NONCE_LEN != 0)) {        wpa_printf(MSG_DEBUG, "WPS: Mismatch in enrollee nonce");        return WPS_FAILURE;    }    if (attr.msg_type == NULL) {        wpa_printf(MSG_DEBUG, "WPS: No Message Type attribute");        return WPS_FAILURE;    }    switch (*attr.msg_type) {    case WPS_M2:        ret = wps_process_m2(wps, msg, &attr);        break;    case WPS_M2D:        ret = wps_process_m2d(wps, &attr);        break;    case WPS_M4:        ret = wps_process_m4(wps, msg, &attr);        if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)            wps_fail_event(wps->wps, WPS_M4);        break;    case WPS_M6:        ret = wps_process_m6(wps, msg, &attr);        if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)            wps_fail_event(wps->wps, WPS_M6);        break;    case WPS_M8:        ret = wps_process_m8(wps, msg, &attr);        if (ret == WPS_FAILURE || wps->state == SEND_WSC_NACK)            wps_fail_event(wps->wps, WPS_M8);        break;    default:        wpa_printf(MSG_DEBUG, "WPS: Unsupported Message Type %d",               *attr.msg_type);        return WPS_FAILURE;    }    /*     * Save a copy of the last message for Authenticator derivation if we     * are continuing. However, skip M2D since it is not authenticated and     * neither is the ACK/NACK response frame. This allows the possibly     * following M2 to be processed correctly by using the previously sent     * M1 in Authenticator derivation.     */    if (ret == WPS_CONTINUE && *attr.msg_type != WPS_M2D) {        /* Save a copy of the last message for Authenticator derivation         */        wpabuf_free(wps->last_msg);        wps->last_msg = wpabuf_dup(msg);    }    return ret;}

void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,			       const u8 *data, size_t len, int rx_freq){	struct p2p_message msg;	struct p2p_device *dev;	int freq;	int reject = 1;	struct wpabuf *resp;    u8 status = P2P_SC_FAIL_INFO_CURRENTLY_UNAVAILABLE;	if (p2p_parse(data, len, &msg))		return;#ifdef CONFIG_MTK_WFD        if(wfd_process_request_by_policy(p2p, &msg, &status, 0) != 0) {            goto out;        }#endif	wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG,		"P2P: Received Provision Discovery Request from " MACSTR		" with config methods 0x%x (freq=%d)",		MAC2STR(sa), msg.wps_config_methods, rx_freq);	dev = p2p_get_device(p2p, sa);#ifdef CONFIG_MTK_WFD    if(dev) {        p2p_copy_wfd_info(dev, 0, &msg, 0);    }#endif	if (dev == NULL || (dev->flags & P2P_DEV_PROBE_REQ_ONLY)) {		wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG,			"P2P: Provision Discovery Request from "			"unknown peer " MACSTR, MAC2STR(sa));		if (p2p_add_device(p2p, sa, rx_freq, 0, data + 1, len - 1, 0))		{			wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG,			        "P2P: Provision Discovery Request add device "				"failed " MACSTR, MAC2STR(sa));		}	} else if (msg.wfd_subelems) {		wpabuf_free(dev->info.wfd_subelems);		dev->info.wfd_subelems = wpabuf_dup(msg.wfd_subelems);	}	if (!(msg.wps_config_methods &	      (WPS_CONFIG_DISPLAY | WPS_CONFIG_KEYPAD |	       WPS_CONFIG_PUSHBUTTON))) {		wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG, "P2P: Unsupported "			"Config Methods in Provision Discovery Request");		goto out;	}	if (msg.group_id) {		size_t i;		for (i = 0; i < p2p->num_groups; i++) {			if (p2p_group_is_group_id_match(p2p->groups[i],							msg.group_id,							msg.group_id_len))				break;		}		if (i == p2p->num_groups) {			wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG, "P2P: PD "				"request for unknown P2P Group ID - reject");			goto out;		}	}	if (dev)		dev->flags &= ~(P2P_DEV_PD_PEER_DISPLAY |				P2P_DEV_PD_PEER_KEYPAD);	if (msg.wps_config_methods & WPS_CONFIG_DISPLAY) {		wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG, "P2P: Peer " MACSTR			" requested us to show a PIN on display", MAC2STR(sa));		if (dev)			dev->flags |= P2P_DEV_PD_PEER_KEYPAD;	} else if (msg.wps_config_methods & WPS_CONFIG_KEYPAD) {		wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG, "P2P: Peer " MACSTR			" requested us to write its PIN using keypad",			MAC2STR(sa));		if (dev)			dev->flags |= P2P_DEV_PD_PEER_DISPLAY;	}	reject = 0;out:	resp = p2p_build_prov_disc_resp(p2p, msg.dialog_token,					reject ? 0 : msg.wps_config_methods,					msg.group_id, msg.group_id_len);	if (resp == NULL) {		p2p_parse_free(&msg);		return;	}	wpa_msg(p2p->cfg->msg_ctx, MSG_DEBUG,		"P2P: Sending Provision Discovery Response");//.........这里部分代码省略.........

void p2p_rx_gas_comeback_req(struct p2p_data *p2p, const u8 *sa,			     const u8 *data, size_t len, int rx_freq){	struct wpabuf *resp;	u8 dialog_token;	size_t frag_len;	int more = 0;	wpa_hexdump(MSG_DEBUG, "P2P: RX GAS Comeback Request", data, len);	if (len < 1)		return;	dialog_token = *data;	p2p_dbg(p2p, "Dialog Token: %u", dialog_token);	if (dialog_token != p2p->sd_resp_dialog_token) {		p2p_dbg(p2p, "No pending SD response fragment for dialog token %u",			dialog_token);		return;	}	if (p2p->sd_resp == NULL) {		p2p_dbg(p2p, "No pending SD response fragment available");		return;	}	if (os_memcmp(sa, p2p->sd_resp_addr, ETH_ALEN) != 0) {		p2p_dbg(p2p, "No pending SD response fragment for " MACSTR,			MAC2STR(sa));		return;	}	frag_len = wpabuf_len(p2p->sd_resp) - p2p->sd_resp_pos;	if (frag_len > 1400) {		frag_len = 1400;		more = 1;	}	resp = p2p_build_gas_comeback_resp(dialog_token, WLAN_STATUS_SUCCESS,					   p2p->srv_update_indic,					   wpabuf_head_u8(p2p->sd_resp) +					   p2p->sd_resp_pos, frag_len,					   p2p->sd_frag_id, more,					   wpabuf_len(p2p->sd_resp));	if (resp == NULL)		return;	p2p_dbg(p2p, "Send GAS Comeback Response (frag_id %d more=%d frag_len=%d)",		p2p->sd_frag_id, more, (int) frag_len);	p2p->sd_frag_id++;	p2p->sd_resp_pos += frag_len;	if (more) {		p2p_dbg(p2p, "%d more bytes remain to be sent",			(int) (wpabuf_len(p2p->sd_resp) - p2p->sd_resp_pos));	} else {		p2p_dbg(p2p, "All fragments of SD response sent");		wpabuf_free(p2p->sd_resp);		p2p->sd_resp = NULL;	}	p2p->pending_action_state = P2P_NO_PENDING_ACTION;	if (p2p_send_action(p2p, rx_freq, sa, p2p->cfg->dev_addr,			    p2p->cfg->dev_addr,			    wpabuf_head(resp), wpabuf_len(resp), 200) < 0)		p2p_dbg(p2p, "Failed to send Action frame");	wpabuf_free(resp);}

//.........这里部分代码省略.........	pos += 2;	p2p_dbg(p2p, "Query Response Length: %d", slen);	if (pos + slen > end) {		p2p_dbg(p2p, "Not enough Query Response data");		return;	}	if (slen == 0) {		p2p_dbg(p2p, "No Query Response data");		return;	}	end = pos + slen;	if (p2p->sd_rx_resp) {		 /*		  * ANQP header is only included in the first fragment; rest of		  * the fragments start with continue TLVs.		  */		goto skip_nqp_header;	}	/* ANQP Query Response */	if (pos + 4 > end)		return;	if (WPA_GET_LE16(pos) != ANQP_VENDOR_SPECIFIC) {		p2p_dbg(p2p, "Unsupported ANQP Info ID %u", WPA_GET_LE16(pos));		return;	}	pos += 2;	slen = WPA_GET_LE16(pos);	pos += 2;	p2p_dbg(p2p, "ANQP Query Response length: %u", slen);	if (slen < 3 + 1) {		p2p_dbg(p2p, "Invalid ANQP Query Response length");		return;	}	if (pos + 4 > end)		return;	if (WPA_GET_BE32(pos) != P2P_IE_VENDOR_TYPE) {		p2p_dbg(p2p, "Unsupported ANQP vendor OUI-type %08x",			WPA_GET_BE32(pos));		return;	}	pos += 4;	if (pos + 2 > end)		return;	p2p->sd_rx_update_indic = WPA_GET_LE16(pos);	p2p_dbg(p2p, "Service Update Indicator: %u", p2p->sd_rx_update_indic);	pos += 2;skip_nqp_header:	if (wpabuf_resize(&p2p->sd_rx_resp, end - pos) < 0)		return;	wpabuf_put_data(p2p->sd_rx_resp, pos, end - pos);	p2p_dbg(p2p, "Current SD reassembly buffer length: %u",		(unsigned int) wpabuf_len(p2p->sd_rx_resp));	if (more_frags) {		p2p_dbg(p2p, "More fragments remains");		/* TODO: what would be a good size limit? */		if (wpabuf_len(p2p->sd_rx_resp) > 64000) {			wpabuf_free(p2p->sd_rx_resp);			p2p->sd_rx_resp = NULL;			p2p_dbg(p2p, "Too long SD response - drop it");			return;		}		p2p_send_gas_comeback_req(p2p, sa, dialog_token, rx_freq);		return;	}#ifdef CONFIG_MTK_P2P	p2p->sd_peer->flags |= P2P_DEV_SD_INFO;	p2p->sd_peer->flags &= ~P2P_DEV_SD_SCHEDULE;#endif	p2p->sd_peer = NULL;	if (p2p->sd_query) {		if (!p2p->sd_query->for_all_peers) {			struct p2p_sd_query *q;			p2p_dbg(p2p, "Remove completed SD query %p",				p2p->sd_query);			q = p2p->sd_query;			p2p_unlink_sd_query(p2p, p2p->sd_query);			p2p_free_sd_query(q);		}		p2p->sd_query = NULL;	}	if (p2p->cfg->sd_response)		p2p->cfg->sd_response(p2p->cfg->cb_ctx, sa,				      p2p->sd_rx_update_indic,				      wpabuf_head(p2p->sd_rx_resp),				      wpabuf_len(p2p->sd_rx_resp));	wpabuf_free(p2p->sd_rx_resp);	p2p->sd_rx_resp = NULL;	p2p_continue_find(p2p);}

static struct wpabuf * eap_fast_build_crypto_binding(	struct eap_sm *sm, struct eap_fast_data *data){	struct wpabuf *buf;	struct eap_tlv_result_tlv *result;	struct eap_tlv_crypto_binding_tlv *binding;	buf = wpabuf_alloc(2 * sizeof(*result) + sizeof(*binding));	if (buf == NULL)		return NULL;	if (data->send_new_pac || data->anon_provisioning ||	    data->phase2_method)		data->final_result = 0;	else		data->final_result = 1;	if (!data->final_result || data->eap_seq > 1) {		/* Intermediate-Result */		wpa_printf(MSG_DEBUG, "EAP-FAST: Add Intermediate-Result TLV "			   "(status=SUCCESS)");		result = wpabuf_put(buf, sizeof(*result));		result->tlv_type = host_to_be16(			EAP_TLV_TYPE_MANDATORY |			EAP_TLV_INTERMEDIATE_RESULT_TLV);		result->length = host_to_be16(2);		result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);	}	if (data->final_result) {		/* Result TLV */		wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV "			   "(status=SUCCESS)");		result = wpabuf_put(buf, sizeof(*result));		result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |						EAP_TLV_RESULT_TLV);		result->length = host_to_be16(2);		result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);	}	/* Crypto-Binding TLV */	binding = wpabuf_put(buf, sizeof(*binding));	binding->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |					 EAP_TLV_CRYPTO_BINDING_TLV);	binding->length = host_to_be16(sizeof(*binding) -				       sizeof(struct eap_tlv_hdr));	binding->version = EAP_FAST_VERSION;	binding->received_version = data->peer_version;	binding->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;	if (random_get_bytes(binding->nonce, sizeof(binding->nonce)) < 0) {		wpabuf_free(buf);		return NULL;	}	/*	 * RFC 4851, Section 4.2.8:	 * The nonce in a request MUST have its least significant bit set to 0.	 */	binding->nonce[sizeof(binding->nonce) - 1] &= ~0x01;	os_memcpy(data->crypto_binding_nonce, binding->nonce,		  sizeof(binding->nonce));	/*	 * RFC 4851, Section 5.3:	 * CMK = CMK[j]	 * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV )	 */	hmac_sha1(data->cmk, EAP_FAST_CMK_LEN,		  (u8 *) binding, sizeof(*binding),		  binding->compound_mac);	wpa_printf(MSG_DEBUG, "EAP-FAST: Add Crypto-Binding TLV: Version %d "		   "Received Version %d SubType %d",		   binding->version, binding->received_version,		   binding->subtype);	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",		    binding->nonce, sizeof(binding->nonce));	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",		    binding->compound_mac, sizeof(binding->compound_mac));	return buf;}

void p2p_rx_gas_initial_resp(struct p2p_data *p2p, const u8 *sa,			     const u8 *data, size_t len, int rx_freq){	const u8 *pos = data;	const u8 *end = data + len;	const u8 *next;	u8 dialog_token;	u16 status_code;	u16 comeback_delay;	u16 slen;	u16 update_indic;	if (p2p->state != P2P_SD_DURING_FIND || p2p->sd_peer == NULL ||	    os_memcmp(sa, p2p->sd_peer->info.p2p_device_addr, ETH_ALEN) != 0) {		p2p_dbg(p2p, "Ignore unexpected GAS Initial Response from "			MACSTR, MAC2STR(sa));		return;	}	p2p->cfg->send_action_done(p2p->cfg->cb_ctx);	p2p_clear_timeout(p2p);	p2p_dbg(p2p, "Received GAS Initial Response from " MACSTR " (len=%d)",		MAC2STR(sa), (int) len);	if (len < 5 + 2) {		p2p_dbg(p2p, "Too short GAS Initial Response frame");		return;	}	dialog_token = *pos++;	/* TODO: check dialog_token match */	status_code = WPA_GET_LE16(pos);	pos += 2;	comeback_delay = WPA_GET_LE16(pos);	pos += 2;	p2p_dbg(p2p, "dialog_token=%u status_code=%u comeback_delay=%u",		dialog_token, status_code, comeback_delay);	if (status_code) {		p2p_dbg(p2p, "Service Discovery failed: status code %u",			status_code);		return;	}	if (*pos != WLAN_EID_ADV_PROTO) {		p2p_dbg(p2p, "Unexpected IE in GAS Initial Response: %u", *pos);		return;	}	pos++;	slen = *pos++;	next = pos + slen;	if (next > end || slen < 2) {		p2p_dbg(p2p, "Invalid IE in GAS Initial Response");		return;	}	pos++; /* skip QueryRespLenLimit and PAME-BI */	if (*pos != ACCESS_NETWORK_QUERY_PROTOCOL) {		p2p_dbg(p2p, "Unsupported GAS advertisement protocol id %u",			*pos);		return;	}	pos = next;	/* Query Response */	if (pos + 2 > end) {		p2p_dbg(p2p, "Too short Query Response");		return;	}	slen = WPA_GET_LE16(pos);	pos += 2;	p2p_dbg(p2p, "Query Response Length: %d", slen);	if (pos + slen > end) {		p2p_dbg(p2p, "Not enough Query Response data");		return;	}	end = pos + slen;	if (comeback_delay) {		p2p_dbg(p2p, "Fragmented response - request fragments");		if (p2p->sd_rx_resp) {			p2p_dbg(p2p, "Drop old SD reassembly buffer");			wpabuf_free(p2p->sd_rx_resp);			p2p->sd_rx_resp = NULL;		}		p2p_send_gas_comeback_req(p2p, sa, dialog_token, rx_freq);		return;	}	/* ANQP Query Response */	if (pos + 4 > end)		return;	if (WPA_GET_LE16(pos) != ANQP_VENDOR_SPECIFIC) {		p2p_dbg(p2p, "Unsupported ANQP Info ID %u", WPA_GET_LE16(pos));		return;	}	pos += 2;	slen = WPA_GET_LE16(pos);	pos += 2;//.........这里部分代码省略.........

static enum http_reply_codeweb_process_put_wlan_response(struct upnp_wps_device_sm *sm, char *data,			      struct wpabuf **reply, const char **replyname){	struct wpabuf *msg;	enum http_reply_code ret;	u8 macaddr[ETH_ALEN];	int ev_type;	int type;	char *val;	/*	 * External UPnP-based Registrar is passing us a message to be proxied	 * over to a Wi-Fi -based client of ours.	 */	wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse");	msg = xml_get_base64_item(data, "NewMessage", &ret);	if (msg == NULL) {		wpa_printf(MSG_DEBUG, "WPS UPnP: Could not extract NewMessage "			   "from PutWLANResponse");		return ret;	}	val = xml_get_first_item(data, "NewWLANEventType");	if (val == NULL) {		wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventType in "			   "PutWLANResponse");		wpabuf_free(msg);		return UPNP_ARG_VALUE_INVALID;	}	ev_type = atol(val);	os_free(val);	val = xml_get_first_item(data, "NewWLANEventMAC");	if (val == NULL) {		wpa_printf(MSG_DEBUG, "WPS UPnP: No NewWLANEventMAC in "			   "PutWLANResponse");		wpabuf_free(msg);		return UPNP_ARG_VALUE_INVALID;	}	if (hwaddr_aton(val, macaddr)) {		wpa_printf(MSG_DEBUG, "WPS UPnP: Invalid NewWLANEventMAC in "			   "PutWLANResponse: '%s'", val);		if (hwaddr_aton2(val, macaddr) > 0) {			/*			 * At least some versions of Intel PROset seem to be			 * using dot-deliminated MAC address format here.			 */			wpa_printf(MSG_DEBUG, "WPS UPnP: Workaround - allow "				   "incorrect MAC address format in "				   "NewWLANEventMAC");		} else {			wpabuf_free(msg);			os_free(val);			return UPNP_ARG_VALUE_INVALID;		}	}	os_free(val);	if (ev_type == UPNP_WPS_WLANEVENT_TYPE_EAP) {		struct wps_parse_attr attr;		if (wps_parse_msg(msg, &attr) < 0 ||		    attr.msg_type == NULL)			type = -1;		else			type = *attr.msg_type;		wpa_printf(MSG_DEBUG, "WPS UPnP: Message Type %d", type);	} else		type = -1;	if (!sm->ctx->rx_req_put_wlan_response ||	    sm->ctx->rx_req_put_wlan_response(sm->priv, ev_type, macaddr, msg,					      type)) {		wpa_printf(MSG_INFO, "WPS UPnP: Fail: sm->ctx->"			   "rx_req_put_wlan_response");		wpabuf_free(msg);		return HTTP_INTERNAL_SERVER_ERROR;	}	wpabuf_free(msg);	*replyname = NULL;	*reply = NULL;	return HTTP_OK;}

void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,				  const u8 *sa, const u8 *data, size_t slen){	const u8 *pos = data;	u8 subtype;	struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);	struct wpa_bss_anqp *anqp = NULL;	int ret;	if (slen < 2)		return;	if (bss)		anqp = bss->anqp;	subtype = *pos++;	slen--;	pos++; /* Reserved */	slen--;	switch (subtype) {	case HS20_STYPE_CAPABILITY_LIST:		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" HS Capability List", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "HS Capability List", pos, slen);		break;	case HS20_STYPE_OPERATOR_FRIENDLY_NAME:		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" Operator Friendly Name", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "oper friendly name", pos, slen);		if (anqp) {			wpabuf_free(anqp->hs20_operator_friendly_name);			anqp->hs20_operator_friendly_name =				wpabuf_alloc_copy(pos, slen);		}		break;	case HS20_STYPE_WAN_METRICS:		wpa_hexdump(MSG_DEBUG, "WAN Metrics", pos, slen);		if (slen < 13) {			wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short WAN "				"Metrics value from " MACSTR, MAC2STR(sa));			break;		}		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" WAN Metrics %02x:%u:%u:%u:%u:%u", MAC2STR(sa),			pos[0], WPA_GET_LE32(pos + 1), WPA_GET_LE32(pos + 5),			pos[9], pos[10], WPA_GET_LE16(pos + 11));		if (anqp) {			wpabuf_free(anqp->hs20_wan_metrics);			anqp->hs20_wan_metrics = wpabuf_alloc_copy(pos, slen);		}		break;	case HS20_STYPE_CONNECTION_CAPABILITY:		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" Connection Capability", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "conn capability", pos, slen);		if (anqp) {			wpabuf_free(anqp->hs20_connection_capability);			anqp->hs20_connection_capability =				wpabuf_alloc_copy(pos, slen);		}		break;	case HS20_STYPE_OPERATING_CLASS:		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" Operating Class", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "Operating Class", pos, slen);		if (anqp) {			wpabuf_free(anqp->hs20_operating_class);			anqp->hs20_operating_class =				wpabuf_alloc_copy(pos, slen);		}		break;	case HS20_STYPE_OSU_PROVIDERS_LIST:		wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR			" OSU Providers list", MAC2STR(sa));		wpa_s->num_prov_found++;		if (anqp) {			wpabuf_free(anqp->hs20_osu_providers_list);			anqp->hs20_osu_providers_list =				wpabuf_alloc_copy(pos, slen);		}		break;	case HS20_STYPE_ICON_BINARY_FILE:		ret = hs20_process_icon_binary_file(wpa_s, sa, pos, slen);		if (wpa_s->fetch_osu_icon_in_progress) {			hs20_osu_icon_fetch_result(wpa_s, ret);			eloop_cancel_timeout(hs20_continue_icon_fetch,					     wpa_s, NULL);			eloop_register_timeout(0, 0, hs20_continue_icon_fetch,					       wpa_s, NULL);		}		break;	default:		wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);		break;	}}

static void eap_peap_process_phase2_response(struct eap_sm *sm,					     struct eap_peap_data *data,					     struct wpabuf *in_data){	u8 next_type = EAP_TYPE_NONE;	const struct eap_hdr *hdr;	const u8 *pos;	size_t left;	if (data->state == PHASE2_TLV) {		eap_peap_process_phase2_tlv(sm, data, in_data);		return;	}#ifdef EAP_SERVER_TNC	if (data->state == PHASE2_SOH) {		eap_peap_process_phase2_soh(sm, data, in_data);		return;	}#endif /* EAP_SERVER_TNC */	if (data->phase2_priv == NULL) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: %s - Phase2 not "			   "initialized?!", __func__);		return;	}	hdr = wpabuf_head(in_data);	pos = (const u8 *) (hdr + 1);	if (wpabuf_len(in_data) > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {		left = wpabuf_len(in_data) - sizeof(*hdr);		wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Phase2 type Nak'ed; "			    "allowed types", pos + 1, left - 1);		eap_sm_process_nak(sm, pos + 1, left - 1);		if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&		    sm->user->methods[sm->user_eap_method_index].method !=		    EAP_TYPE_NONE) {			next_type = sm->user->methods[				sm->user_eap_method_index++].method;			wpa_printf(MSG_DEBUG, "EAP-PEAP: try EAP type %d",				   next_type);		} else {			eap_peap_req_failure(sm, data);			next_type = EAP_TYPE_NONE;		}		eap_peap_phase2_init(sm, data, next_type);		return;	}	if (data->phase2_method->check(sm, data->phase2_priv, in_data)) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 check() asked to "			   "ignore the packet");		return;	}	data->phase2_method->process(sm, data->phase2_priv, in_data);	if (sm->method_pending == METHOD_PENDING_WAIT) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 method is in "			   "pending wait state - save decrypted response");		wpabuf_free(data->pending_phase2_resp);		data->pending_phase2_resp = wpabuf_dup(in_data);	}	if (!data->phase2_method->isDone(sm, data->phase2_priv))		return;	if (!data->phase2_method->isSuccess(sm, data->phase2_priv)) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 method failed");		eap_peap_req_failure(sm, data);		next_type = EAP_TYPE_NONE;		eap_peap_phase2_init(sm, data, next_type);		return;	}	os_free(data->phase2_key);	if (data->phase2_method->getKey) {		data->phase2_key = data->phase2_method->getKey(			sm, data->phase2_priv, &data->phase2_key_len);		if (data->phase2_key == NULL) {			wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 getKey "				   "failed");			eap_peap_req_failure(sm, data);			eap_peap_phase2_init(sm, data, EAP_TYPE_NONE);			return;		}	}	switch (data->state) {	case PHASE1_ID2:	case PHASE2_ID:	case PHASE2_SOH:		if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {			wpa_hexdump_ascii(MSG_DEBUG, "EAP_PEAP: Phase2 "					  "Identity not found in the user "					  "database",					  sm->identity, sm->identity_len);			eap_peap_req_failure(sm, data);			next_type = EAP_TYPE_NONE;//.........这里部分代码省略.........

//.........这里部分代码省略.........	 * [Associated BSSID]	 * [Coupled Sink Info]	 * [WFD Extended Capability]	 *	 * Probe Response:	 * WFD Device Info	 * [Associated BSSID]	 * [Coupled Sink Info]	 * [WFD Extended Capability]	 * [WFD Session Info]	 *	 * (Re)Association Response, P2P Invitation Req/Resp,	 * Provision Discovery Resp:	 * WFD Device Info	 * [Associated BSSID]	 * [Coupled Sink Info]	 * [WFD Session Info]	 */	len = 0;	if (global->wfd_subelem[WFD_SUBELEM_DEVICE_INFO])		len += wpabuf_len(global->wfd_subelem[					  WFD_SUBELEM_DEVICE_INFO]);	if (global->wfd_subelem[WFD_SUBELEM_ASSOCIATED_BSSID])		len += wpabuf_len(global->wfd_subelem[					  WFD_SUBELEM_ASSOCIATED_BSSID]);	if (global->wfd_subelem[WFD_SUBELEM_COUPLED_SINK])		len += wpabuf_len(global->wfd_subelem[					  WFD_SUBELEM_COUPLED_SINK]);	if (global->wfd_subelem[WFD_SUBELEM_SESSION_INFO])		len += wpabuf_len(global->wfd_subelem[					  WFD_SUBELEM_SESSION_INFO]);	if (global->wfd_subelem[WFD_SUBELEM_EXT_CAPAB])		len += wpabuf_len(global->wfd_subelem[WFD_SUBELEM_EXT_CAPAB]);	buf = wpabuf_alloc(len);	if (buf == NULL)		return -1;	if (global->wfd_subelem[WFD_SUBELEM_DEVICE_INFO])		wpabuf_put_buf(buf,			       global->wfd_subelem[WFD_SUBELEM_DEVICE_INFO]);	if (global->wfd_subelem[WFD_SUBELEM_ASSOCIATED_BSSID])		wpabuf_put_buf(buf, global->wfd_subelem[				       WFD_SUBELEM_ASSOCIATED_BSSID]);	if (global->wfd_subelem[WFD_SUBELEM_COUPLED_SINK])		wpabuf_put_buf(buf,			       global->wfd_subelem[WFD_SUBELEM_COUPLED_SINK]);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for Beacon", ie);	p2p_set_wfd_ie_beacon(global->p2p, ie);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for (Re)Association Request",			ie);	p2p_set_wfd_ie_assoc_req(global->p2p, ie);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for GO Negotiation", ie);	p2p_set_wfd_ie_go_neg(global->p2p, ie);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for Provision Discovery "			"Request", ie);	p2p_set_wfd_ie_prov_disc_req(global->p2p, ie);	plen = buf->used;	if (global->wfd_subelem[WFD_SUBELEM_EXT_CAPAB])		wpabuf_put_buf(buf,			       global->wfd_subelem[WFD_SUBELEM_EXT_CAPAB]);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for Probe Request", ie);	p2p_set_wfd_ie_probe_req(global->p2p, ie);	if (global->wfd_subelem[WFD_SUBELEM_SESSION_INFO])		wpabuf_put_buf(buf,			       global->wfd_subelem[WFD_SUBELEM_SESSION_INFO]);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for Probe Response", ie);	p2p_set_wfd_ie_probe_resp(global->p2p, ie);	/* Remove WFD Extended Capability from buffer */	buf->used = plen;	if (global->wfd_subelem[WFD_SUBELEM_SESSION_INFO])		wpabuf_put_buf(buf,			       global->wfd_subelem[WFD_SUBELEM_SESSION_INFO]);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for P2P Invitation", ie);	p2p_set_wfd_ie_invitation(global->p2p, ie);	ie = wifi_display_encaps(buf);	wpa_hexdump_buf(MSG_DEBUG, "WFD: WFD IE for Provision Discovery "			"Response", ie);	p2p_set_wfd_ie_prov_disc_resp(global->p2p, ie);	wpabuf_free(buf);	return 0;}

static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,					    const u8 *sa, u16 info_id,					    const u8 *data, size_t slen){	const u8 *pos = data;	struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);	switch (info_id) {	case ANQP_CAPABILITY_LIST:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" ANQP Capability list", MAC2STR(sa));		break;	case ANQP_VENUE_NAME:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" Venue Name", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);		if (bss) {			wpabuf_free(bss->anqp_venue_name);			bss->anqp_venue_name = wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_NETWORK_AUTH_TYPE:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" Network Authentication Type information",			MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "				  "Type", pos, slen);		if (bss) {			wpabuf_free(bss->anqp_network_auth_type);			bss->anqp_network_auth_type =				wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_ROAMING_CONSORTIUM:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" Roaming Consortium list", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",				  pos, slen);		if (bss) {			wpabuf_free(bss->anqp_roaming_consortium);			bss->anqp_roaming_consortium =				wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_IP_ADDR_TYPE_AVAILABILITY:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" IP Address Type Availability information",			MAC2STR(sa));		wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",			    pos, slen);		if (bss) {			wpabuf_free(bss->anqp_ip_addr_type_availability);			bss->anqp_ip_addr_type_availability =				wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_NAI_REALM:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" NAI Realm list", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);		if (bss) {			wpabuf_free(bss->anqp_nai_realm);			bss->anqp_nai_realm = wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_3GPP_CELLULAR_NETWORK:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" 3GPP Cellular Network information", MAC2STR(sa));		wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",				  pos, slen);		if (bss) {			wpabuf_free(bss->anqp_3gpp);			bss->anqp_3gpp = wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_DOMAIN_NAME:		wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR			" Domain Name list", MAC2STR(sa));		wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);		if (bss) {			wpabuf_free(bss->anqp_domain_name);			bss->anqp_domain_name = wpabuf_alloc_copy(pos, slen);		}		break;	case ANQP_VENDOR_SPECIFIC:		if (slen < 3)			return;		switch (WPA_GET_BE24(pos)) {		default:			wpa_printf(MSG_DEBUG, "Interworking: Unsupported "				   "vendor-specific ANQP OUI %06x",				   WPA_GET_BE24(pos));			return;		}		break;	default:		wpa_printf(MSG_DEBUG, "Interworking: Unsupported ANQP Info ID "			   "%u", info_id);		break;//.........这里部分代码省略.........

//.........这里部分代码省略.........	wpa_hexdump(MSG_MSGDUMP, "EAP-PSK: PCHANNEL - nonce",		    nonce, sizeof(nonce));	wpa_hexdump(MSG_MSGDUMP, "EAP-PSK: PCHANNEL - hdr",		    wpabuf_head(reqData), 5);	wpa_hexdump(MSG_MSGDUMP, "EAP-PSK: PCHANNEL - cipher msg", msg, left);	decrypted = os_malloc(left);	if (decrypted == NULL) {		ret->methodState = METHOD_DONE;		ret->decision = DECISION_FAIL;		return NULL;	}	os_memcpy(decrypted, msg, left);	if (aes_128_eax_decrypt(data->tek, nonce, sizeof(nonce),				wpabuf_head(reqData),				sizeof(struct eap_hdr) + 1 +				sizeof(*hdr3) - EAP_PSK_MAC_LEN, decrypted,				left, tag)) {		wpa_printf(MSG_WARNING, "EAP-PSK: PCHANNEL decryption failed");		os_free(decrypted);		return NULL;	}	wpa_hexdump(MSG_DEBUG, "EAP-PSK: Decrypted PCHANNEL message",		    decrypted, left);	/* Verify R flag */	switch (decrypted[0] >> 6) {	case EAP_PSK_R_FLAG_CONT:		wpa_printf(MSG_DEBUG, "EAP-PSK: R flag - CONT - unsupported");		failed = 1;		break;	case EAP_PSK_R_FLAG_DONE_SUCCESS:		wpa_printf(MSG_DEBUG, "EAP-PSK: R flag - DONE_SUCCESS");		break;	case EAP_PSK_R_FLAG_DONE_FAILURE:		wpa_printf(MSG_DEBUG, "EAP-PSK: R flag - DONE_FAILURE");		wpa_printf(MSG_INFO, "EAP-PSK: Authentication server rejected "			   "authentication");		failed = 1;		break;	}	data_len = 1;	if ((decrypted[0] & EAP_PSK_E_FLAG) && left > 1)		data_len++;	plen = sizeof(*hdr4) + 4 + 16 + data_len;	resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PSK, plen,			     EAP_CODE_RESPONSE, eap_get_id(reqData));	if (resp == NULL) {		os_free(decrypted);		return NULL;	}	hdr4 = wpabuf_put(resp, sizeof(*hdr4));	hdr4->flags = EAP_PSK_FLAGS_SET_T(3); /* T=3 */	os_memcpy(hdr4->rand_s, hdr3->rand_s, EAP_PSK_RAND_LEN);	rpchannel = wpabuf_put(resp, 4 + 16 + data_len);	/* nonce++ */	inc_byte_array(nonce, sizeof(nonce));	os_memcpy(rpchannel, nonce + 12, 4);	if (decrypted[0] & EAP_PSK_E_FLAG) {		wpa_printf(MSG_DEBUG, "EAP-PSK: Unsupported E (Ext) flag");		failed = 1;		rpchannel[4 + 16] = (EAP_PSK_R_FLAG_DONE_FAILURE << 6) |			EAP_PSK_E_FLAG;		if (left > 1) {			/* Add empty EXT_Payload with same EXT_Type */			rpchannel[4 + 16 + 1] = decrypted[1];		}	} else if (failed)		rpchannel[4 + 16] = EAP_PSK_R_FLAG_DONE_FAILURE << 6;	else		rpchannel[4 + 16] = EAP_PSK_R_FLAG_DONE_SUCCESS << 6;	wpa_hexdump(MSG_DEBUG, "EAP-PSK: reply message (plaintext)",		    rpchannel + 4 + 16, data_len);	if (aes_128_eax_encrypt(data->tek, nonce, sizeof(nonce),				wpabuf_head(resp),				sizeof(struct eap_hdr) + 1 + sizeof(*hdr4),				rpchannel + 4 + 16, data_len, rpchannel + 4)) {		os_free(decrypted);		wpabuf_free(resp);		return NULL;	}	wpa_hexdump(MSG_DEBUG, "EAP-PSK: reply message (PCHANNEL)",		    rpchannel, 4 + 16 + data_len);	wpa_printf(MSG_DEBUG, "EAP-PSK: Completed %ssuccessfully",		   failed ? "un" : "");	data->state = PSK_DONE;	ret->methodState = METHOD_DONE;	ret->decision = failed ? DECISION_FAIL : DECISION_UNCOND_SUCC;	os_free(decrypted);	return resp;}

//.........这里部分代码省略.........	}	if (sta->no_ht_gf_set) {		sta->no_ht_gf_set = 0;		hapd->iface->num_sta_ht_no_gf--;	}	if (sta->no_ht_set) {		sta->no_ht_set = 0;		hapd->iface->num_sta_no_ht--;	}	if (sta->ht_20mhz_set) {		sta->ht_20mhz_set = 0;		hapd->iface->num_sta_ht_20mhz--;	}#ifdef CONFIG_IEEE80211N	ht40_intolerant_remove(hapd->iface, sta);#endif /* CONFIG_IEEE80211N */#ifdef CONFIG_P2P	if (sta->no_p2p_set) {		sta->no_p2p_set = 0;		hapd->num_sta_no_p2p--;		if (hapd->num_sta_no_p2p == 0)			hostapd_p2p_non_p2p_sta_disconnected(hapd);	}#endif /* CONFIG_P2P */#if defined(NEED_AP_MLME) && defined(CONFIG_IEEE80211N)	if (hostapd_ht_operation_update(hapd->iface) > 0)		set_beacon++;#endif /* NEED_AP_MLME && CONFIG_IEEE80211N */#ifdef CONFIG_MESH	if (hapd->mesh_sta_free_cb)		hapd->mesh_sta_free_cb(sta);#endif /* CONFIG_MESH */	if (set_beacon)		ieee802_11_set_beacons(hapd->iface);	wpa_printf(MSG_DEBUG, "%s: cancel ap_handle_timer for " MACSTR,		   __func__, MAC2STR(sta->addr));	eloop_cancel_timeout(ap_handle_timer, hapd, sta);	eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);	eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta);	eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);	eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);	sae_clear_retransmit_timer(hapd, sta);	ieee802_1x_free_station(sta);	wpa_auth_sta_deinit(sta->wpa_sm);	rsn_preauth_free_station(hapd, sta);#ifndef CONFIG_NO_RADIUS	if (hapd->radius)		radius_client_flush_auth(hapd->radius, sta->addr);#endif /* CONFIG_NO_RADIUS */	os_free(sta->challenge);#ifdef CONFIG_IEEE80211W	os_free(sta->sa_query_trans_id);	eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);#endif /* CONFIG_IEEE80211W */#ifdef CONFIG_P2P	p2p_group_notif_disassoc(hapd->p2p_group, sta->addr);#endif /* CONFIG_P2P */#ifdef CONFIG_INTERWORKING	if (sta->gas_dialog) {		int i;		for (i = 0; i < GAS_DIALOG_MAX; i++)			gas_serv_dialog_clear(&sta->gas_dialog[i]);		os_free(sta->gas_dialog);	}#endif /* CONFIG_INTERWORKING */	wpabuf_free(sta->wps_ie);	wpabuf_free(sta->p2p_ie);	wpabuf_free(sta->hs20_ie);	os_free(sta->ht_capabilities);	os_free(sta->vht_capabilities);	hostapd_free_psk_list(sta->psk);	os_free(sta->identity);	os_free(sta->radius_cui);	os_free(sta->remediation_url);	wpabuf_free(sta->hs20_deauth_req);	os_free(sta->hs20_session_info_url);#ifdef CONFIG_SAE	sae_clear_data(sta->sae);	os_free(sta->sae);#endif /* CONFIG_SAE */	os_free(sta);}

static struct wpabuf * eap_psk_process_1(struct eap_psk_data *data,					 struct eap_method_ret *ret,					 const struct wpabuf *reqData){	const struct eap_psk_hdr_1 *hdr1;	struct eap_psk_hdr_2 *hdr2;	struct wpabuf *resp;	u8 *buf, *pos;	size_t buflen, len;	const u8 *cpos;	wpa_printf(MSG_DEBUG, "EAP-PSK: in INIT state");	cpos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PSK, reqData, &len);	hdr1 = (const struct eap_psk_hdr_1 *) cpos;	if (cpos == NULL || len < sizeof(*hdr1)) {		wpa_printf(MSG_INFO, "EAP-PSK: Invalid first message "			   "length (%lu; expected %lu or more)",			   (unsigned long) len,			   (unsigned long) sizeof(*hdr1));		ret->ignore = TRUE;		return NULL;	}	wpa_printf(MSG_DEBUG, "EAP-PSK: Flags=0x%x", hdr1->flags);	if (EAP_PSK_FLAGS_GET_T(hdr1->flags) != 0) {		wpa_printf(MSG_INFO, "EAP-PSK: Unexpected T=%d (expected 0)",			   EAP_PSK_FLAGS_GET_T(hdr1->flags));		ret->methodState = METHOD_DONE;		ret->decision = DECISION_FAIL;		return NULL;	}	wpa_hexdump(MSG_DEBUG, "EAP-PSK: RAND_S", hdr1->rand_s,		    EAP_PSK_RAND_LEN);	os_free(data->id_s);	data->id_s_len = len - sizeof(*hdr1);	data->id_s = os_malloc(data->id_s_len);	if (data->id_s == NULL) {		wpa_printf(MSG_ERROR, "EAP-PSK: Failed to allocate memory for "			   "ID_S (len=%lu)", (unsigned long) data->id_s_len);		ret->ignore = TRUE;		return NULL;	}	os_memcpy(data->id_s, (u8 *) (hdr1 + 1), data->id_s_len);	wpa_hexdump_ascii(MSG_DEBUG, "EAP-PSK: ID_S",			  data->id_s, data->id_s_len);	if (os_get_random(data->rand_p, EAP_PSK_RAND_LEN)) {		wpa_printf(MSG_ERROR, "EAP-PSK: Failed to get random data");		ret->ignore = TRUE;		return NULL;	}	resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PSK,			     sizeof(*hdr2) + data->id_p_len, EAP_CODE_RESPONSE,			     eap_get_id(reqData));	if (resp == NULL)		return NULL;	hdr2 = wpabuf_put(resp, sizeof(*hdr2));	hdr2->flags = EAP_PSK_FLAGS_SET_T(1); /* T=1 */	os_memcpy(hdr2->rand_s, hdr1->rand_s, EAP_PSK_RAND_LEN);	os_memcpy(hdr2->rand_p, data->rand_p, EAP_PSK_RAND_LEN);	wpabuf_put_data(resp, data->id_p, data->id_p_len);	/* MAC_P = OMAC1-AES-128(AK, ID_P||ID_S||RAND_S||RAND_P) */	buflen = data->id_p_len + data->id_s_len + 2 * EAP_PSK_RAND_LEN;	buf = os_malloc(buflen);	if (buf == NULL) {		wpabuf_free(resp);		return NULL;	}	os_memcpy(buf, data->id_p, data->id_p_len);	pos = buf + data->id_p_len;	os_memcpy(pos, data->id_s, data->id_s_len);	pos += data->id_s_len;	os_memcpy(pos, hdr1->rand_s, EAP_PSK_RAND_LEN);	pos += EAP_PSK_RAND_LEN;	os_memcpy(pos, data->rand_p, EAP_PSK_RAND_LEN);	if (omac1_aes_128(data->ak, buf, buflen, hdr2->mac_p)) {		os_free(buf);		wpabuf_free(resp);		return NULL;	}	os_free(buf);	wpa_hexdump(MSG_DEBUG, "EAP-PSK: RAND_P", hdr2->rand_p,		    EAP_PSK_RAND_LEN);	wpa_hexdump(MSG_DEBUG, "EAP-PSK: MAC_P", hdr2->mac_p, EAP_PSK_MAC_LEN);	wpa_hexdump_ascii(MSG_DEBUG, "EAP-PSK: ID_P",			  data->id_p, data->id_p_len);	data->state = PSK_MAC_SENT;	return resp;}

//.........这里部分代码省略.........	hostapd_config_free_radius(conf->radius->acct_servers,				   conf->radius->num_acct_servers);	hostapd_config_free_radius_attr(conf->radius_auth_req_attr);	hostapd_config_free_radius_attr(conf->radius_acct_req_attr);	os_free(conf->rsn_preauth_interfaces);	os_free(conf->ctrl_interface);	os_free(conf->ca_cert);	os_free(conf->server_cert);	os_free(conf->private_key);	os_free(conf->private_key_passwd);	os_free(conf->dh_file);	os_free(conf->pac_opaque_encr_key);	os_free(conf->eap_fast_a_id);	os_free(conf->eap_fast_a_id_info);	os_free(conf->eap_sim_db);	os_free(conf->radius_server_clients);	os_free(conf->test_socket);	os_free(conf->radius);	os_free(conf->radius_das_shared_secret);	hostapd_config_free_vlan(conf);	if (conf->ssid.dyn_vlan_keys) {		struct hostapd_ssid *ssid = &conf->ssid;		size_t i;		for (i = 0; i <= ssid->max_dyn_vlan_keys; i++) {			if (ssid->dyn_vlan_keys[i] == NULL)				continue;			hostapd_config_free_wep(ssid->dyn_vlan_keys[i]);			os_free(ssid->dyn_vlan_keys[i]);		}		os_free(ssid->dyn_vlan_keys);		ssid->dyn_vlan_keys = NULL;	}	os_free(conf->time_zone);#ifdef CONFIG_IEEE80211R	{		struct ft_remote_r0kh *r0kh, *r0kh_prev;		struct ft_remote_r1kh *r1kh, *r1kh_prev;		r0kh = conf->r0kh_list;		conf->r0kh_list = NULL;		while (r0kh) {			r0kh_prev = r0kh;			r0kh = r0kh->next;			os_free(r0kh_prev);		}		r1kh = conf->r1kh_list;		conf->r1kh_list = NULL;		while (r1kh) {			r1kh_prev = r1kh;			r1kh = r1kh->next;			os_free(r1kh_prev);		}	}#endif /* CONFIG_IEEE80211R */#ifdef CONFIG_WPS	os_free(conf->wps_pin_requests);	os_free(conf->device_name);	os_free(conf->manufacturer);	os_free(conf->model_name);	os_free(conf->model_number);	os_free(conf->serial_number);	os_free(conf->config_methods);	os_free(conf->ap_pin);	os_free(conf->extra_cred);	os_free(conf->ap_settings);	os_free(conf->upnp_iface);	os_free(conf->friendly_name);	os_free(conf->manufacturer_url);	os_free(conf->model_description);	os_free(conf->model_url);	os_free(conf->upc);	wpabuf_free(conf->wps_nfc_dh_pubkey);	wpabuf_free(conf->wps_nfc_dh_privkey);	wpabuf_free(conf->wps_nfc_dev_pw);#endif /* CONFIG_WPS */	os_free(conf->roaming_consortium);	os_free(conf->venue_name);	os_free(conf->nai_realm_data);	os_free(conf->network_auth_type);	os_free(conf->anqp_3gpp_cell_net);	os_free(conf->domain_name);#ifdef CONFIG_RADIUS_TEST	os_free(conf->dump_msk_file);#endif /* CONFIG_RADIUS_TEST */#ifdef CONFIG_HS20	os_free(conf->hs20_oper_friendly_name);	os_free(conf->hs20_wan_metrics);	os_free(conf->hs20_connection_capability);	os_free(conf->hs20_operating_class);#endif /* CONFIG_HS20 */	wpabuf_free(conf->vendor_elements);}

static void eap_peap_process_phase2(struct eap_sm *sm,				    struct eap_peap_data *data,				    const struct wpabuf *respData,				    struct wpabuf *in_buf){	struct wpabuf *in_decrypted;	const struct eap_hdr *hdr;	size_t len;	wpa_printf(MSG_DEBUG, "EAP-PEAP: received %lu bytes encrypted data for"		   " Phase 2", (unsigned long) wpabuf_len(in_buf));	if (data->pending_phase2_resp) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - "			   "skip decryption and use old data");		eap_peap_process_phase2_response(sm, data,						 data->pending_phase2_resp);		wpabuf_free(data->pending_phase2_resp);		data->pending_phase2_resp = NULL;		return;	}	in_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,					      in_buf);	if (in_decrypted == NULL) {		wpa_printf(MSG_INFO, "EAP-PEAP: Failed to decrypt Phase 2 "			   "data");		eap_peap_state(data, FAILURE);		return;	}	wpa_hexdump_buf_key(MSG_DEBUG, "EAP-PEAP: Decrypted Phase 2 EAP",			    in_decrypted);	hdr = wpabuf_head(in_decrypted);	if (data->peap_version == 0 && data->state != PHASE2_TLV) {		const struct eap_hdr *resp;		struct eap_hdr *nhdr;		struct wpabuf *nbuf =			wpabuf_alloc(sizeof(struct eap_hdr) +				     wpabuf_len(in_decrypted));		if (nbuf == NULL) {			wpabuf_free(in_decrypted);			return;		}		resp = wpabuf_head(respData);		nhdr = wpabuf_put(nbuf, sizeof(*nhdr));		nhdr->code = resp->code;		nhdr->identifier = resp->identifier;		nhdr->length = host_to_be16(sizeof(struct eap_hdr) +					    wpabuf_len(in_decrypted));		wpabuf_put_buf(nbuf, in_decrypted);		wpabuf_free(in_decrypted);		in_decrypted = nbuf;	} else if (data->peap_version >= 2) {		struct eap_tlv_hdr *tlv;		struct wpabuf *nmsg;		if (wpabuf_len(in_decrypted) < sizeof(*tlv) + sizeof(*hdr)) {			wpa_printf(MSG_INFO, "EAP-PEAPv2: Too short Phase 2 "				   "EAP TLV");			wpabuf_free(in_decrypted);			return;		}		tlv = wpabuf_mhead(in_decrypted);		if ((be_to_host16(tlv->tlv_type) & EAP_TLV_TYPE_MASK) !=		    EAP_TLV_EAP_PAYLOAD_TLV) {			wpa_printf(MSG_INFO, "EAP-PEAPv2: Not an EAP TLV");			wpabuf_free(in_decrypted);			return;		}		if (sizeof(*tlv) + be_to_host16(tlv->length) >		    wpabuf_len(in_decrypted)) {			wpa_printf(MSG_INFO, "EAP-PEAPv2: Invalid EAP TLV "				   "length");			wpabuf_free(in_decrypted);			return;		}		hdr = (struct eap_hdr *) (tlv + 1);		if (be_to_host16(hdr->length) > be_to_host16(tlv->length)) {			wpa_printf(MSG_INFO, "EAP-PEAPv2: No room for full "				   "EAP packet in EAP TLV");			wpabuf_free(in_decrypted);			return;		}		nmsg = wpabuf_alloc(be_to_host16(hdr->length));		if (nmsg == NULL) {			wpabuf_free(in_decrypted);			return;		}		wpabuf_put_data(nmsg, hdr, be_to_host16(hdr->length));		wpabuf_free(in_decrypted);		in_decrypted = nmsg;	}//.........这里部分代码省略.........

static struct wpabuf *eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,		const struct wpabuf *reqData){	struct eap_pwd_data *data = priv;	struct wpabuf *resp = NULL;	const u8 *pos, *buf;	size_t len;	u16 tot_len = 0;	u8 lm_exch;	pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, reqData, &len);	if ((pos == NULL) || (len < 1)) {		wpa_printf(MSG_DEBUG, "EAP-pwd: Got a frame but pos is %s and "			   "len is %d",			   pos == NULL ? "NULL" : "not NULL", (int) len);		ret->ignore = TRUE;		return NULL;	}	ret->ignore = FALSE;	ret->methodState = METHOD_MAY_CONT;	ret->decision = DECISION_FAIL;	ret->allowNotifications = FALSE;	lm_exch = *pos;	pos++;                  /* skip over the bits and the exch */	len--;	/*	 * we're fragmenting so send out the next fragment	 */	if (data->out_frag_pos) {		/*		 * this should be an ACK		 */		if (len)			wpa_printf(MSG_INFO, "Bad Response! Fragmenting but "				   "not an ACK");		wpa_printf(MSG_DEBUG, "EAP-pwd: Got an ACK for a fragment");		/*		 * check if there are going to be more fragments		 */		len = wpabuf_len(data->outbuf) - data->out_frag_pos;		if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {			len = data->mtu - EAP_PWD_HDR_SIZE;			EAP_PWD_SET_MORE_BIT(lm_exch);		}		resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,				     EAP_PWD_HDR_SIZE + len,				     EAP_CODE_RESPONSE, eap_get_id(reqData));		if (resp == NULL) {			wpa_printf(MSG_INFO, "Unable to allocate memory for "				   "next fragment!");			return NULL;		}		wpabuf_put_u8(resp, lm_exch);		buf = wpabuf_head_u8(data->outbuf);		wpabuf_put_data(resp, buf + data->out_frag_pos, len);		data->out_frag_pos += len;		/*		 * this is the last fragment so get rid of the out buffer		 */		if (data->out_frag_pos >= wpabuf_len(data->outbuf)) {			wpabuf_free(data->outbuf);			data->outbuf = NULL;			data->out_frag_pos = 0;		}		wpa_printf(MSG_DEBUG, "EAP-pwd: Send %s fragment of %d bytes",			   data->out_frag_pos == 0 ? "last" : "next",			   (int) len);		if (data->state == SUCCESS_ON_FRAG_COMPLETION) {			ret->methodState = METHOD_DONE;			ret->decision = DECISION_UNCOND_SUCC;			eap_pwd_state(data, SUCCESS);		}		return resp;	}	/*	 * see if this is a fragment that needs buffering	 *	 * if it's the first fragment there'll be a length field	 */	if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {		if (len < 2) {			wpa_printf(MSG_DEBUG,				   "EAP-pwd: Frame too short to contain Total-Length field");			ret->ignore = TRUE;			return NULL;		}		tot_len = WPA_GET_BE16(pos);		wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose "			   "total length = %d", tot_len);		if (tot_len > 15000)			return NULL;		if (data->inbuf) {			wpa_printf(MSG_DEBUG,				   "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");//.........这里部分代码省略.........

static struct wpabuf * eap_peap_build_phase2_tlv(struct eap_sm *sm,						 struct eap_peap_data *data,						 u8 id){	struct wpabuf *buf, *encr_req;	size_t mlen;	mlen = 6; /* Result TLV */	if (data->crypto_binding != NO_BINDING)		mlen += 60; /* Cryptobinding TLV */#ifdef EAP_SERVER_TNC	if (data->soh_response)		mlen += wpabuf_len(data->soh_response);#endif /* EAP_SERVER_TNC */	buf = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TLV, mlen,			    EAP_CODE_REQUEST, id);	if (buf == NULL)		return NULL;	wpabuf_put_u8(buf, 0x80); /* Mandatory */	wpabuf_put_u8(buf, EAP_TLV_RESULT_TLV);	/* Length */	wpabuf_put_be16(buf, 2);	/* Status */	wpabuf_put_be16(buf, data->tlv_request == TLV_REQ_SUCCESS ?			EAP_TLV_RESULT_SUCCESS : EAP_TLV_RESULT_FAILURE);	if (data->peap_version == 0 && data->tlv_request == TLV_REQ_SUCCESS &&	    data->crypto_binding != NO_BINDING) {		u8 *mac;		u8 eap_type = EAP_TYPE_PEAP;		const u8 *addr[2];		size_t len[2];		u16 tlv_type;#ifdef EAP_SERVER_TNC		if (data->soh_response) {			wpa_printf(MSG_DEBUG, "EAP-PEAP: Adding MS-SOH "				   "Response TLV");			wpabuf_put_buf(buf, data->soh_response);			wpabuf_free(data->soh_response);			data->soh_response = NULL;		}#endif /* EAP_SERVER_TNC */		if (eap_peap_derive_cmk(sm, data) < 0 ||		    random_get_bytes(data->binding_nonce, 32)) {			wpabuf_free(buf);			return NULL;		}		/* Compound_MAC: HMAC-SHA1-160(cryptobinding TLV | EAP type) */		addr[0] = wpabuf_put(buf, 0);		len[0] = 60;		addr[1] = &eap_type;		len[1] = 1;		tlv_type = EAP_TLV_CRYPTO_BINDING_TLV;		if (data->peap_version >= 2)			tlv_type |= EAP_TLV_TYPE_MANDATORY;		wpabuf_put_be16(buf, tlv_type);		wpabuf_put_be16(buf, 56);		wpabuf_put_u8(buf, 0); /* Reserved */		wpabuf_put_u8(buf, data->peap_version); /* Version */		wpabuf_put_u8(buf, data->recv_version); /* RecvVersion */		wpabuf_put_u8(buf, 0); /* SubType: 0 = Request, 1 = Response */		wpabuf_put_data(buf, data->binding_nonce, 32); /* Nonce */		mac = wpabuf_put(buf, 20); /* Compound_MAC */		wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC CMK",			    data->cmk, 20);		wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC data 1",			    addr[0], len[0]);		wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC data 2",			    addr[1], len[1]);		hmac_sha1_vector(data->cmk, 20, 2, addr, len, mac);		wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC",			    mac, SHA1_MAC_LEN);		data->crypto_binding_sent = 1;	}	wpa_hexdump_buf_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 TLV data",			    buf);	encr_req = eap_server_tls_encrypt(sm, &data->ssl, buf);	wpabuf_free(buf);	return encr_req;}

/* subscription_first_event -- send format/queue event that is automatically * sent on a new subscription. */static int subscription_first_event(struct subscription *s){	/*	 * Actually, utf-8 is the default, but it doesn't hurt to specify it.	 *	 * APStatus is apparently a bit set,	 * 0x1 = configuration change (but is always set?)	 * 0x10 = ap is locked	 *	 * Per UPnP spec, we send out the last value of each variable, even	 * for WLANEvent, whatever it was.	 */	char *wlan_event;	struct wpabuf *buf;	int ap_status = 1;      /* TODO: add 0x10 if access point is locked */	const char *head =		"<?xml version=/"1.0/" encoding=/"utf-8/"?>/n"		"<e:propertyset xmlns:e=/"urn:schemas-upnp-org:event-1-0/">/n";	const char *tail = "</e:propertyset>/n";	char txt[10];	int ret;	if (s->sm->wlanevent == NULL) {		/*		 * There has been no events before the subscription. However,		 * UPnP device architecture specification requires all the		 * evented variables to be included, so generate a dummy event		 * for this particular case using a WSC_ACK and all-zeros		 * nonces. The ER (UPnP control point) will ignore this, but at		 * least it will learn that WLANEvent variable will be used in		 * event notifications in the future.		 */		struct wpabuf *msg;		wpa_printf(MSG_DEBUG, "WPS UPnP: Use a fake WSC_ACK as the "			   "initial WLANEvent");		msg = build_fake_wsc_ack();		if (msg) {			s->sm->wlanevent = (char *)				base64_encode(wpabuf_head(msg),					      wpabuf_len(msg), NULL);			wpabuf_free(msg);		}	}	wlan_event = s->sm->wlanevent;	if (wlan_event == NULL || *wlan_event == '/0') {		wpa_printf(MSG_DEBUG, "WPS UPnP: WLANEvent not known for "			   "initial event message");		wlan_event = "";	}	buf = wpabuf_alloc(500 + os_strlen(wlan_event));	if (buf == NULL)		return -1;	wpabuf_put_str(buf, head);	wpabuf_put_property(buf, "STAStatus", "1");	os_snprintf(txt, sizeof(txt), "%d", ap_status);	wpabuf_put_property(buf, "APStatus", txt);	if (*wlan_event)		wpabuf_put_property(buf, "WLANEvent", wlan_event);	wpabuf_put_str(buf, tail);	ret = event_add(s, buf, 0);	if (ret) {		wpabuf_free(buf);		return ret;	}	wpabuf_free(buf);	return 0;}

static struct wpabuf * eap_peap_buildReq(struct eap_sm *sm, void *priv, u8 id){	struct eap_peap_data *data = priv;	if (data->ssl.state == FRAG_ACK) {		return eap_server_tls_build_ack(id, EAP_TYPE_PEAP,						data->peap_version);	}	if (data->ssl.state == WAIT_FRAG_ACK) {		return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_PEAP,						data->peap_version, id);	}	switch (data->state) {	case START:		return eap_peap_build_start(sm, data, id);	case PHASE1:	case PHASE1_ID2:		if (data->peap_version < 2 &&		    tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {			wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase1 done, "				   "starting Phase2");			eap_peap_state(data, PHASE2_START);		}		break;	case PHASE2_ID:	case PHASE2_METHOD:		wpabuf_free(data->ssl.tls_out);		data->ssl.tls_out_pos = 0;		data->ssl.tls_out = eap_peap_build_phase2_req(sm, data, id);		break;#ifdef EAP_SERVER_TNC	case PHASE2_SOH:		wpabuf_free(data->ssl.tls_out);		data->ssl.tls_out_pos = 0;		data->ssl.tls_out = eap_peap_build_phase2_soh(sm, data, id);		break;#endif /* EAP_SERVER_TNC */	case PHASE2_TLV:		wpabuf_free(data->ssl.tls_out);		data->ssl.tls_out_pos = 0;		data->ssl.tls_out = eap_peap_build_phase2_tlv(sm, data, id);		break;	case SUCCESS_REQ:		wpabuf_free(data->ssl.tls_out);		data->ssl.tls_out_pos = 0;		data->ssl.tls_out = eap_peap_build_phase2_term(sm, data, id,							       1);		break;	case FAILURE_REQ:		wpabuf_free(data->ssl.tls_out);		data->ssl.tls_out_pos = 0;		data->ssl.tls_out = eap_peap_build_phase2_term(sm, data, id,							       0);		break;	default:		wpa_printf(MSG_DEBUG, "EAP-PEAP: %s - unexpected state %d",			   __func__, data->state);		return NULL;	}	return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_PEAP,					data->peap_version, id);}

int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,			const u8 *req_ies, size_t req_ies_len, int reassoc){	struct sta_info *sta;	int new_assoc, res;	struct ieee802_11_elems elems;	const u8 *ie;	size_t ielen;#if defined(CONFIG_IEEE80211R) || defined(CONFIG_IEEE80211W)	u8 buf[sizeof(struct ieee80211_mgmt) + 1024];	u8 *p = buf;	size_t len = 0;#endif /* CONFIG_IEEE80211R || CONFIG_IEEE80211W */	u16 reason = WLAN_REASON_UNSPECIFIED;	u16 status = WLAN_STATUS_SUCCESS;	if (addr == NULL) {		/*		 * This could potentially happen with unexpected event from the		 * driver wrapper. This was seen at least in one case where the		 * driver ended up being set to station mode while hostapd was		 * running, so better make sure we stop processing such an		 * event here.		 */		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "			   "no address");		return -1;	}	random_add_randomness(addr, ETH_ALEN);	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,		       HOSTAPD_LEVEL_INFO, "associated");	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);	if (elems.wps_ie) {		ie = elems.wps_ie - 2;		ielen = elems.wps_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");	} else if (elems.rsn_ie) {		ie = elems.rsn_ie - 2;		ielen = elems.rsn_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");	} else if (elems.wpa_ie) {		ie = elems.wpa_ie - 2;		ielen = elems.wpa_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");	} else {		ie = NULL;		ielen = 0;		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "			   "(Re)AssocReq");	}	sta = ap_get_sta(hapd, addr);	if (sta) {		accounting_sta_stop(hapd, sta);		/*		 * Make sure that the previously registered inactivity timer		 * will not remove the STA immediately.		 */		sta->timeout_next = STA_NULLFUNC;	} else {		sta = ap_sta_add(hapd, addr);		if (sta == NULL)			return -1;	}	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);#ifdef CONFIG_P2P	if (elems.p2p) {		wpabuf_free(sta->p2p_ie);		sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,							  P2P_IE_VENDOR_TYPE);	}#endif /* CONFIG_P2P */	if (hapd->conf->wpa) {		if (ie == NULL || ielen == 0) {#ifdef CONFIG_WPS			if (hapd->conf->wps_state) {				wpa_printf(MSG_DEBUG, "STA did not include "					   "WPA/RSN IE in (Re)Association "					   "Request - possible WPS use");				sta->flags |= WLAN_STA_MAYBE_WPS;				goto skip_wpa_check;			}#endif /* CONFIG_WPS */			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");			return -1;		}#ifdef CONFIG_WPS		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&		    os_memcmp(ie + 2, "/x00/x50/xf2/x04", 4) == 0) {			struct wpabuf *wps;			sta->flags |= WLAN_STA_WPS;			wps = ieee802_11_vendor_ie_concat(ie, ielen,							  WPS_IE_VENDOR_TYPE);			if (wps) {//.........这里部分代码省略.........

//.........这里部分代码省略.........		left -= 4;		if ((size_t) tlv_len > left) {			wpa_printf(MSG_DEBUG, "EAP-PEAP: TLV underrun "				   "(tlv_len=%d left=%lu)", tlv_len,				   (unsigned long) left);			eap_peap_state(data, FAILURE);			return;		}		switch (tlv_type) {		case EAP_TLV_VENDOR_SPECIFIC_TLV:			if (tlv_len < 4) {				wpa_printf(MSG_DEBUG, "EAP-PEAP: Too short "					   "vendor specific TLV (len=%d)",					   (int) tlv_len);				eap_peap_state(data, FAILURE);				return;			}			vendor_id = WPA_GET_BE32(pos);			if (vendor_id != EAP_VENDOR_MICROSOFT) {				if (mandatory) {					eap_peap_state(data, FAILURE);					return;				}				break;			}			vpos = pos + 4;			mandatory = !!(vpos[0] & 0x80);			tlv_type = vpos[0] & 0x3f;			tlv_type = (tlv_type << 8) | vpos[1];			vtlv_len = ((int) vpos[2] << 8) | vpos[3];			vpos += 4;			if (vpos + vtlv_len > pos + left) {				wpa_printf(MSG_DEBUG, "EAP-PEAP: Vendor TLV "					   "underrun");				eap_peap_state(data, FAILURE);				return;			}			if (tlv_type == 1) {				soh_tlv = vpos;				soh_tlv_len = vtlv_len;				break;			}			wpa_printf(MSG_DEBUG, "EAP-PEAP: Unsupported MS-TLV "				   "Type %d%s", tlv_type,				   mandatory ? " (mandatory)" : "");			if (mandatory) {				eap_peap_state(data, FAILURE);				return;			}			/* Ignore this TLV, but process other TLVs */			break;		default:			wpa_printf(MSG_DEBUG, "EAP-PEAP: Unsupported TLV Type "				   "%d%s", tlv_type,				   mandatory ? " (mandatory)" : "");			if (mandatory) {				eap_peap_state(data, FAILURE);				return;			}			/* Ignore this TLV, but process other TLVs */			break;		}		pos += tlv_len;		left -= tlv_len;	}	if (left) {		wpa_printf(MSG_DEBUG, "EAP-PEAP: Last TLV too short in "			   "Request (left=%lu)", (unsigned long) left);		eap_peap_state(data, FAILURE);		return;	}	/* Process supported TLVs */	if (soh_tlv) {		int failure = 0;		wpabuf_free(data->soh_response);		data->soh_response = tncs_process_soh(soh_tlv, soh_tlv_len,						      &failure);		if (failure) {			eap_peap_state(data, FAILURE);			return;		}	} else {		wpa_printf(MSG_DEBUG, "EAP-PEAP: No SoH TLV received");		eap_peap_state(data, FAILURE);		return;	}auth_method:	eap_peap_state(data, PHASE2_METHOD);	next_type = sm->user->methods[0].method;	sm->user_eap_method_index = 1;	wpa_printf(MSG_DEBUG, "EAP-PEAP: try EAP type %d", next_type);	eap_peap_phase2_init(sm, data, next_type);}

int ikev2_initiator_process(struct ikev2_initiator_data *data,			    const struct wpabuf *buf){	const struct ikev2_hdr *hdr;	u32 length, message_id;	const u8 *pos, *end;	struct ikev2_payloads pl;	wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)",		   (unsigned long) wpabuf_len(buf));	if (wpabuf_len(buf) < sizeof(*hdr)) {		wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR");		return -1;	}	hdr = (const struct ikev2_hdr *) wpabuf_head(buf);	end = wpabuf_head_u8(buf) + wpabuf_len(buf);	message_id = WPA_GET_BE32(hdr->message_id);	length = WPA_GET_BE32(hdr->length);	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Initiator's SPI",		    hdr->i_spi, IKEV2_SPI_LEN);	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Initiator's SPI",		    hdr->r_spi, IKEV2_SPI_LEN);	wpa_printf(MSG_DEBUG, "IKEV2:   Next Payload: %u  Version: 0x%x  "		   "Exchange Type: %u",		   hdr->next_payload, hdr->version, hdr->exchange_type);	wpa_printf(MSG_DEBUG, "IKEV2:   Message ID: %u  Length: %u",		   message_id, length);	if (hdr->version != IKEV2_VERSION) {		wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x "			   "(expected 0x%x)", hdr->version, IKEV2_VERSION);		return -1;	}	if (length != wpabuf_len(buf)) {		wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != "			   "RX: %lu)", (unsigned long) length,			   (unsigned long) wpabuf_len(buf));		return -1;	}	if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0)		return -1;	if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) !=	    IKEV2_HDR_RESPONSE) {		wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x",			   hdr->flags);		return -1;	}	if (data->state != SA_INIT) {		if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) {			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "				   "Initiator's SPI");			return -1;		}		if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) {			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "				   "Responder's SPI");			return -1;		}	}	pos = (const u8 *) (hdr + 1);	if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0)		return -1;	switch (data->state) {	case SA_INIT:		if (ikev2_process_sa_init(data, hdr, &pl) < 0)			return -1;		wpabuf_free(data->r_sign_msg);		data->r_sign_msg = wpabuf_dup(buf);		break;	case SA_AUTH:		if (ikev2_process_sa_auth(data, hdr, &pl) < 0)			return -1;		break;	case CHILD_SA:	case IKEV2_DONE:		break;	}	return 0;}

int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,			const u8 *req_ies, size_t req_ies_len, int reassoc){	struct sta_info *sta;	int new_assoc, res;	struct ieee802_11_elems elems;	const u8 *ie;	size_t ielen;	u16 reason = WLAN_REASON_UNSPECIFIED;	if (addr == NULL) {		/*		 * This could potentially happen with unexpected event from the		 * driver wrapper. This was seen at least in one case where the		 * driver ended up being set to station mode while hostapd was		 * running, so better make sure we stop processing such an		 * event here.		 */		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "			   "no address");		return -1;	}	random_add_randomness(addr, ETH_ALEN);	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,		       HOSTAPD_LEVEL_INFO, "associated");	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);	if (elems.wps_ie) {		ie = elems.wps_ie - 2;		ielen = elems.wps_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");	} else if (elems.rsn_ie) {		ie = elems.rsn_ie - 2;		ielen = elems.rsn_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");	} else if (elems.wpa_ie) {		ie = elems.wpa_ie - 2;		ielen = elems.wpa_ie_len + 2;		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");	} else {		ie = NULL;		ielen = 0;		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "			   "(Re)AssocReq");	}	sta = ap_get_sta(hapd, addr);	if (sta) {		accounting_sta_stop(hapd, sta);		/*		 * Make sure that the previously registered inactivity timer		 * will not remove the STA immediately.		 */		sta->timeout_next = STA_NULLFUNC;	} else {		sta = ap_sta_add(hapd, addr);		if (sta == NULL) {			hostapd_drv_sta_disassoc(hapd, addr,						 WLAN_REASON_DISASSOC_AP_BUSY);			return -1;		}	}	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);#ifdef CONFIG_P2P	if (elems.p2p) {		wpabuf_free(sta->p2p_ie);		sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,							  P2P_IE_VENDOR_TYPE);	}#endif /* CONFIG_P2P */	if (hapd->conf->wpa) {		if (ie == NULL || ielen == 0) {#ifdef CONFIG_WPS			if (hapd->conf->wps_state) {				wpa_printf(MSG_DEBUG, "STA did not include "					   "WPA/RSN IE in (Re)Association "					   "Request - possible WPS use");				sta->flags |= WLAN_STA_MAYBE_WPS;				goto skip_wpa_check;			}#endif /* CONFIG_WPS */			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");			return -1;		}#ifdef CONFIG_WPS		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&		    os_memcmp(ie + 2, "/x00/x50/xf2/x04", 4) == 0) {			struct wpabuf *wps;			sta->flags |= WLAN_STA_WPS;			wps = ieee802_11_vendor_ie_concat(ie, ielen,							  WPS_IE_VENDOR_TYPE);			if (wps) {				if (wps_is_20(wps)) {					wpa_printf(MSG_DEBUG, "WPS: STA "						   "supports WPS 2.0");//.........这里部分代码省略.........