Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

WPS: Add prefixes to public event_* functions

Browse Source 
openssl engines may dynamically load external libraries. Our event_*()
functions happen to be named very generically, such that event_add()
collides with the libevent library (https://libevent.org/). This can
have disastrous effects (esp. when using CONFIG_WPA_TRACE, which enables
partial linking) when our SSL engines call into the WPS event_add()
instead of their intended libevent event_add().

Resolve this by providing a more unique prefix to these functions.

Rename performed via:

  sed -i -E \
    's:\<event_(add|delete_all|send_all_later|send_stop_all)\>:wps_upnp_event_\1:g' \
     $(git grep -l event_)

Tested via (among other things) hwsim '-f ap_wps' module.

Signed-off-by: Brian Norris <briannorris@chromium.org>
This commit is contained in:
Brian Norris 2019-12-02 12:14:47 -08:00 committed by Jouni Malinen
parent e371d3771c
commit e6d3aca9cf
4 changed files with 29 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/wps/wps_upnp.c
View File

@ -519,8 +519,9 @@ static void upnp_wps_device_send_event(struct upnp_wps_device_sm *sm)
dl_list_for_each_safe(s, tmp, &sm->subscriptions, struct subscription,
list) {
event_add(s, buf,
sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
wps_upnp_event_add(
s, buf,
sm->wlanevent_type == UPNP_WPS_WLANEVENT_TYPE_PROBE);
}
wpabuf_free(buf);
@ -541,7 +542,7 @@ void subscription_destroy(struct subscription *s)
struct upnp_wps_device_interface *iface;
wpa_printf(MSG_DEBUG, "WPS UPnP: Destroy subscription %p", s);
subscr_addr_free_all(s);
event_delete_all(s);
wps_upnp_event_delete_all(s);
dl_list_for_each(iface, &s->sm->interfaces,
struct upnp_wps_device_interface, list)
upnp_er_remove_notification(iface->wps->registrar, s);
@ -672,7 +673,7 @@ static int subscription_first_event(struct subscription *s)
wpabuf_put_property(buf, "WLANEvent", wlan_event);
wpabuf_put_str(buf, tail);
ret = event_add(s, buf, 0);
ret = wps_upnp_event_add(s, buf, 0);
if (ret) {
wpabuf_free(buf);
return ret;
@ -749,7 +750,7 @@ struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
"WPS UPnP: Subscription %p (SID %s) started with %s",
s, str, callback_urls);
/* Schedule sending this */
event_send_all_later(sm);
wps_upnp_event_send_all_later(sm);
return s;
}
@ -987,7 +988,7 @@ static void upnp_wps_device_stop(struct upnp_wps_device_sm *sm)
advertisement_state_machine_stop(sm, 1);
event_send_stop_all(sm);
wps_upnp_event_send_stop_all(sm);
os_free(sm->wlanevent);
sm->wlanevent = NULL;
os_free(sm->ip_addr_text);

27
src/wps/wps_upnp_event.c
View File

@ -96,8 +96,8 @@ static struct wps_event_ *event_dequeue(struct subscription *s)
}
/* event_delete_all -- delete entire event queue and current event */
void event_delete_all(struct subscription *s)
/* wps_upnp_event_delete_all -- delete entire event queue and current event */
void wps_upnp_event_delete_all(struct subscription *s)
{
struct wps_event_ *e;
while ((e = event_dequeue(s)) != NULL)
@ -134,11 +134,11 @@ static void event_retry(struct wps_event_ *e, int do_next_address)
event_delete(e);
s->last_event_failed = 1;
if (!dl_list_empty(&s->event_queue))
event_send_all_later(s->sm);
wps_upnp_event_send_all_later(s->sm);
return;
}
dl_list_add(&s->event_queue, &e->list);
event_send_all_later(sm);
wps_upnp_event_send_all_later(sm);
}
@ -228,7 +228,7 @@ static void event_http_cb(void *ctx, struct http_client *c,
/* Schedule sending more if there is more to send */
if (!dl_list_empty(&s->event_queue))
event_send_all_later(s->sm);
wps_upnp_event_send_all_later(s->sm);
break;
case HTTP_CLIENT_FAILED:
wpa_printf(MSG_DEBUG, "WPS UPnP: Event send failure");
@ -328,19 +328,19 @@ static void event_send_all_later_handler(void *eloop_data, void *user_ctx)
if (nerrors) {
/* Try again later */
event_send_all_later(sm);
wps_upnp_event_send_all_later(sm);
}
}
/* event_send_all_later -- schedule sending events to all subscribers
/* wps_upnp_event_send_all_later -- schedule sending events to all subscribers
* that need it.
* This avoids two problems:
* -- After getting a subscription, we should not send the first event
* until after our reply is fully queued to be sent back,
* -- Possible stack depth or infinite recursion issues.
*/
void event_send_all_later(struct upnp_wps_device_sm *sm)
void wps_upnp_event_send_all_later(struct upnp_wps_device_sm *sm)
{
/*
* The exact time in the future isn't too important. Waiting a bit
@ -354,8 +354,8 @@ void event_send_all_later(struct upnp_wps_device_sm *sm)
}
/* event_send_stop_all -- cleanup */
void event_send_stop_all(struct upnp_wps_device_sm *sm)
/* wps_upnp_event_send_stop_all -- cleanup */
void wps_upnp_event_send_stop_all(struct upnp_wps_device_sm *sm)
{
if (sm->event_send_all_queued)
eloop_cancel_timeout(event_send_all_later_handler, NULL, sm);
@ -364,13 +364,14 @@ void event_send_stop_all(struct upnp_wps_device_sm *sm)
/**
* event_add - Add a new event to a queue
* wps_upnp_event_add - Add a new event to a queue
* @s: Subscription
* @data: Event data (is copied; caller retains ownership)
* @probereq: Whether this is a Probe Request event
* Returns: 0 on success, -1 on error, 1 on max event queue limit reached
*/
int event_add(struct subscription *s, const struct wpabuf *data, int probereq)
int wps_upnp_event_add(struct subscription *s, const struct wpabuf *data,
int probereq)
{
struct wps_event_ *e;
unsigned int len;
@ -416,6 +417,6 @@ int event_add(struct subscription *s, const struct wpabuf *data, int probereq)
wpa_printf(MSG_DEBUG, "WPS UPnP: Queue event %p for subscriber %p "
"(queue len %u)", e, s, len + 1);
dl_list_add_tail(&s->event_queue, &e->list);
event_send_all_later(s->sm);
wps_upnp_event_send_all_later(s->sm);
return 0;
}

9
src/wps/wps_upnp_i.h
View File

@ -177,10 +177,11 @@ int web_listener_start(struct upnp_wps_device_sm *sm);
void web_listener_stop(struct upnp_wps_device_sm *sm);
/* wps_upnp_event.c */
int event_add(struct subscription *s, const struct wpabuf *data, int probereq);
void event_delete_all(struct subscription *s);
void event_send_all_later(struct upnp_wps_device_sm *sm);
void event_send_stop_all(struct upnp_wps_device_sm *sm);
int wps_upnp_event_add(struct subscription *s, const struct wpabuf *data,
int probereq);
void wps_upnp_event_delete_all(struct subscription *s);
void wps_upnp_event_send_all_later(struct upnp_wps_device_sm *sm);
void wps_upnp_event_send_stop_all(struct upnp_wps_device_sm *sm);
/* wps_upnp_ap.c */
int upnp_er_set_selected_registrar(struct wps_registrar *reg,

6
tests/hwsim/test_ap_wps.py
View File

@ -3130,7 +3130,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
sid = resp.getheader("sid")
logger.debug("Subscription SID " + sid)
with alloc_fail(hapd, 1, "=event_add"):
with alloc_fail(hapd, 1, "=wps_upnp_event_add"):
for i in range(2):
dev[1].dump_monitor()
dev[2].dump_monitor()
@ -3150,7 +3150,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
if resp.status != 200:
raise Exception("Unexpected HTTP response: %d" % resp.status)
with alloc_fail(hapd, 1, "wpabuf_dup;event_add"):
with alloc_fail(hapd, 1, "wpabuf_dup;wps_upnp_event_add"):
dev[1].dump_monitor()
dev[2].dump_monitor()
dev[1].request("WPS_PIN " + apdev[0]['bssid'] + " 12345670")
@ -3198,7 +3198,7 @@ def test_ap_wps_upnp_subscribe(dev, apdev):
if resp.status != 500:
raise Exception("Unexpected HTTP response: %d" % resp.status)
with alloc_fail(hapd, 1, "event_add;subscription_first_event"):
with alloc_fail(hapd, 1, "wps_upnp_event_add;subscription_first_event"):
conn.request("SUBSCRIBE", eventurl.path, "\r\n\r\n", headers)
resp = conn.getresponse()
if resp.status != 500: