Home | History | Annotate | Download | only in p2p
      1 /*
      2  * P2P - IE parser
      3  * Copyright (c) 2009-2010, Atheros Communications
      4  *
      5  * This software may be distributed under the terms of the BSD license.
      6  * See README for more details.
      7  */
      8 
      9 #include "includes.h"
     10 
     11 #include "common.h"
     12 #include "common/ieee802_11_defs.h"
     13 #include "common/ieee802_11_common.h"
     14 #include "wps/wps_i.h"
     15 #include "p2p_i.h"
     16 
     17 
     18 static int p2p_parse_attribute(u8 id, const u8 *data, u16 len,
     19 			       struct p2p_message *msg)
     20 {
     21 	const u8 *pos;
     22 	size_t i, nlen;
     23 	char devtype[WPS_DEV_TYPE_BUFSIZE];
     24 
     25 	switch (id) {
     26 	case P2P_ATTR_CAPABILITY:
     27 		if (len < 2) {
     28 			wpa_printf(MSG_DEBUG, "P2P: Too short Capability "
     29 				   "attribute (length %d)", len);
     30 			return -1;
     31 		}
     32 		msg->capability = data;
     33 		wpa_printf(MSG_DEBUG, "P2P: * Device Capability %02x "
     34 			   "Group Capability %02x",
     35 			   data[0], data[1]);
     36 		break;
     37 	case P2P_ATTR_DEVICE_ID:
     38 		if (len < ETH_ALEN) {
     39 			wpa_printf(MSG_DEBUG, "P2P: Too short Device ID "
     40 				   "attribute (length %d)", len);
     41 			return -1;
     42 		}
     43 		msg->device_id = data;
     44 		wpa_printf(MSG_DEBUG, "P2P: * Device ID " MACSTR,
     45 			   MAC2STR(msg->device_id));
     46 		break;
     47 	case P2P_ATTR_GROUP_OWNER_INTENT:
     48 		if (len < 1) {
     49 			wpa_printf(MSG_DEBUG, "P2P: Too short GO Intent "
     50 				   "attribute (length %d)", len);
     51 			return -1;
     52 		}
     53 		msg->go_intent = data;
     54 		wpa_printf(MSG_DEBUG, "P2P: * GO Intent: Intent %u "
     55 			   "Tie breaker %u", data[0] >> 1, data[0] & 0x01);
     56 		break;
     57 	case P2P_ATTR_STATUS:
     58 		if (len < 1) {
     59 			wpa_printf(MSG_DEBUG, "P2P: Too short Status "
     60 				   "attribute (length %d)", len);
     61 			return -1;
     62 		}
     63 		msg->status = data;
     64 		wpa_printf(MSG_DEBUG, "P2P: * Status: %d", data[0]);
     65 		break;
     66 	case P2P_ATTR_LISTEN_CHANNEL:
     67 		if (len == 0) {
     68 			wpa_printf(MSG_DEBUG, "P2P: * Listen Channel: Ignore "
     69 				   "null channel");
     70 			break;
     71 		}
     72 		if (len < 5) {
     73 			wpa_printf(MSG_DEBUG, "P2P: Too short Listen Channel "
     74 				   "attribute (length %d)", len);
     75 			return -1;
     76 		}
     77 		msg->listen_channel = data;
     78 		wpa_printf(MSG_DEBUG, "P2P: * Listen Channel: "
     79 			   "Country %c%c(0x%02x) Regulatory "
     80 			   "Class %d Channel Number %d", data[0], data[1],
     81 			   data[2], data[3], data[4]);
     82 		break;
     83 	case P2P_ATTR_OPERATING_CHANNEL:
     84 		if (len == 0) {
     85 			wpa_printf(MSG_DEBUG, "P2P: * Operating Channel: "
     86 				   "Ignore null channel");
     87 			break;
     88 		}
     89 		if (len < 5) {
     90 			wpa_printf(MSG_DEBUG, "P2P: Too short Operating "
     91 				   "Channel attribute (length %d)", len);
     92 			return -1;
     93 		}
     94 		msg->operating_channel = data;
     95 		wpa_printf(MSG_DEBUG, "P2P: * Operating Channel: "
     96 			   "Country %c%c(0x%02x) Regulatory "
     97 			   "Class %d Channel Number %d", data[0], data[1],
     98 			   data[2], data[3], data[4]);
     99 		break;
    100 	case P2P_ATTR_CHANNEL_LIST:
    101 		if (len < 3) {
    102 			wpa_printf(MSG_DEBUG, "P2P: Too short Channel List "
    103 				   "attribute (length %d)", len);
    104 			return -1;
    105 		}
    106 		msg->channel_list = data;
    107 		msg->channel_list_len = len;
    108 		wpa_printf(MSG_DEBUG, "P2P: * Channel List: Country String "
    109 			   "'%c%c(0x%02x)'", data[0], data[1], data[2]);
    110 		wpa_hexdump(MSG_MSGDUMP, "P2P: Channel List",
    111 			    msg->channel_list, msg->channel_list_len);
    112 		break;
    113 	case P2P_ATTR_GROUP_INFO:
    114 		msg->group_info = data;
    115 		msg->group_info_len = len;
    116 		wpa_printf(MSG_DEBUG, "P2P: * Group Info");
    117 		break;
    118 	case P2P_ATTR_DEVICE_INFO:
    119 		if (len < ETH_ALEN + 2 + 8 + 1) {
    120 			wpa_printf(MSG_DEBUG, "P2P: Too short Device Info "
    121 				   "attribute (length %d)", len);
    122 			return -1;
    123 		}
    124 		msg->p2p_device_info = data;
    125 		msg->p2p_device_info_len = len;
    126 		pos = data;
    127 		msg->p2p_device_addr = pos;
    128 		pos += ETH_ALEN;
    129 		msg->config_methods = WPA_GET_BE16(pos);
    130 		pos += 2;
    131 		msg->pri_dev_type = pos;
    132 		pos += 8;
    133 		msg->num_sec_dev_types = *pos++;
    134 		if (msg->num_sec_dev_types * 8 > data + len - pos) {
    135 			wpa_printf(MSG_DEBUG, "P2P: Device Info underflow");
    136 			return -1;
    137 		}
    138 		pos += msg->num_sec_dev_types * 8;
    139 		if (data + len - pos < 4) {
    140 			wpa_printf(MSG_DEBUG, "P2P: Invalid Device Name "
    141 				   "length %d", (int) (data + len - pos));
    142 			return -1;
    143 		}
    144 		if (WPA_GET_BE16(pos) != ATTR_DEV_NAME) {
    145 			wpa_hexdump(MSG_DEBUG, "P2P: Unexpected Device Name "
    146 				    "header", pos, 4);
    147 			return -1;
    148 		}
    149 		pos += 2;
    150 		nlen = WPA_GET_BE16(pos);
    151 		pos += 2;
    152 		if (data + len - pos < (int) nlen || nlen > 32) {
    153 			wpa_printf(MSG_DEBUG, "P2P: Invalid Device Name "
    154 				   "length %d (buf len %d)", (int) nlen,
    155 				   (int) (data + len - pos));
    156 			return -1;
    157 		}
    158 		os_memcpy(msg->device_name, pos, nlen);
    159 		msg->device_name[nlen] = '\0';
    160 		for (i = 0; i < nlen; i++) {
    161 			if (msg->device_name[i] == '\0')
    162 				break;
    163 			if (msg->device_name[i] > 0 &&
    164 			    msg->device_name[i] < 32)
    165 				msg->device_name[i] = '_';
    166 		}
    167 		wpa_printf(MSG_DEBUG, "P2P: * Device Info: addr " MACSTR
    168 			   " primary device type %s device name '%s' "
    169 			   "config methods 0x%x",
    170 			   MAC2STR(msg->p2p_device_addr),
    171 			   wps_dev_type_bin2str(msg->pri_dev_type, devtype,
    172 						sizeof(devtype)),
    173 			   msg->device_name, msg->config_methods);
    174 		break;
    175 	case P2P_ATTR_CONFIGURATION_TIMEOUT:
    176 		if (len < 2) {
    177 			wpa_printf(MSG_DEBUG, "P2P: Too short Configuration "
    178 				   "Timeout attribute (length %d)", len);
    179 			return -1;
    180 		}
    181 		msg->config_timeout = data;
    182 		wpa_printf(MSG_DEBUG, "P2P: * Configuration Timeout");
    183 		break;
    184 	case P2P_ATTR_INTENDED_INTERFACE_ADDR:
    185 		if (len < ETH_ALEN) {
    186 			wpa_printf(MSG_DEBUG, "P2P: Too short Intended P2P "
    187 				   "Interface Address attribute (length %d)",
    188 				   len);
    189 			return -1;
    190 		}
    191 		msg->intended_addr = data;
    192 		wpa_printf(MSG_DEBUG, "P2P: * Intended P2P Interface Address: "
    193 			   MACSTR, MAC2STR(msg->intended_addr));
    194 		break;
    195 	case P2P_ATTR_GROUP_BSSID:
    196 		if (len < ETH_ALEN) {
    197 			wpa_printf(MSG_DEBUG, "P2P: Too short P2P Group BSSID "
    198 				   "attribute (length %d)", len);
    199 			return -1;
    200 		}
    201 		msg->group_bssid = data;
    202 		wpa_printf(MSG_DEBUG, "P2P: * P2P Group BSSID: " MACSTR,
    203 			   MAC2STR(msg->group_bssid));
    204 		break;
    205 	case P2P_ATTR_GROUP_ID:
    206 		if (len < ETH_ALEN || len > ETH_ALEN + 32) {
    207 			wpa_printf(MSG_DEBUG, "P2P: Invalid P2P Group ID "
    208 				   "attribute length %d", len);
    209 			return -1;
    210 		}
    211 		msg->group_id = data;
    212 		msg->group_id_len = len;
    213 		wpa_printf(MSG_DEBUG, "P2P: * P2P Group ID: Device Address "
    214 			   MACSTR, MAC2STR(msg->group_id));
    215 		wpa_hexdump_ascii(MSG_DEBUG, "P2P: * P2P Group ID: SSID",
    216 				  msg->group_id + ETH_ALEN,
    217 				  msg->group_id_len - ETH_ALEN);
    218 		break;
    219 	case P2P_ATTR_INVITATION_FLAGS:
    220 		if (len < 1) {
    221 			wpa_printf(MSG_DEBUG, "P2P: Too short Invitation "
    222 				   "Flag attribute (length %d)", len);
    223 			return -1;
    224 		}
    225 		msg->invitation_flags = data;
    226 		wpa_printf(MSG_DEBUG, "P2P: * Invitation Flags: bitmap 0x%x",
    227 			   data[0]);
    228 		break;
    229 	case P2P_ATTR_MANAGEABILITY:
    230 		if (len < 1) {
    231 			wpa_printf(MSG_DEBUG, "P2P: Too short Manageability "
    232 				   "attribute (length %d)", len);
    233 			return -1;
    234 		}
    235 		msg->manageability = data;
    236 		wpa_printf(MSG_DEBUG, "P2P: * Manageability: bitmap 0x%x",
    237 			   data[0]);
    238 		break;
    239 	case P2P_ATTR_NOTICE_OF_ABSENCE:
    240 		if (len < 2) {
    241 			wpa_printf(MSG_DEBUG, "P2P: Too short Notice of "
    242 				   "Absence attribute (length %d)", len);
    243 			return -1;
    244 		}
    245 		msg->noa = data;
    246 		msg->noa_len = len;
    247 		wpa_printf(MSG_DEBUG, "P2P: * Notice of Absence");
    248 		break;
    249 	case P2P_ATTR_EXT_LISTEN_TIMING:
    250 		if (len < 4) {
    251 			wpa_printf(MSG_DEBUG, "P2P: Too short Extended Listen "
    252 				   "Timing attribute (length %d)", len);
    253 			return -1;
    254 		}
    255 		msg->ext_listen_timing = data;
    256 		wpa_printf(MSG_DEBUG, "P2P: * Extended Listen Timing "
    257 			   "(period %u msec  interval %u msec)",
    258 			   WPA_GET_LE16(msg->ext_listen_timing),
    259 			   WPA_GET_LE16(msg->ext_listen_timing + 2));
    260 		break;
    261 	case P2P_ATTR_MINOR_REASON_CODE:
    262 		if (len < 1) {
    263 			wpa_printf(MSG_DEBUG, "P2P: Too short Minor Reason "
    264 				   "Code attribute (length %d)", len);
    265 			return -1;
    266 		}
    267 		msg->minor_reason_code = data;
    268 		wpa_printf(MSG_DEBUG, "P2P: * Minor Reason Code: %u",
    269 			   *msg->minor_reason_code);
    270 		break;
    271 	case P2P_ATTR_OOB_GO_NEG_CHANNEL:
    272 		if (len < 6) {
    273 			wpa_printf(MSG_DEBUG, "P2P: Too short OOB GO Neg "
    274 				   "Channel attribute (length %d)", len);
    275 			return -1;
    276 		}
    277 		msg->oob_go_neg_channel = data;
    278 		wpa_printf(MSG_DEBUG, "P2P: * OOB GO Neg Channel: "
    279 			   "Country %c%c(0x%02x) Operating Class %d "
    280 			   "Channel Number %d Role %d",
    281 			   data[0], data[1], data[2], data[3], data[4],
    282 			   data[5]);
    283 		break;
    284 	default:
    285 		wpa_printf(MSG_DEBUG, "P2P: Skipped unknown attribute %d "
    286 			   "(length %d)", id, len);
    287 		break;
    288 	}
    289 
    290 	return 0;
    291 }
    292 
    293 
    294 /**
    295  * p2p_parse_p2p_ie - Parse P2P IE
    296  * @buf: Concatenated P2P IE(s) payload
    297  * @msg: Buffer for returning parsed attributes
    298  * Returns: 0 on success, -1 on failure
    299  *
    300  * Note: Caller is responsible for clearing the msg data structure before
    301  * calling this function.
    302  */
    303 int p2p_parse_p2p_ie(const struct wpabuf *buf, struct p2p_message *msg)
    304 {
    305 	const u8 *pos = wpabuf_head_u8(buf);
    306 	const u8 *end = pos + wpabuf_len(buf);
    307 
    308 	wpa_printf(MSG_DEBUG, "P2P: Parsing P2P IE");
    309 
    310 	while (pos < end) {
    311 		u16 attr_len;
    312 		if (pos + 2 >= end) {
    313 			wpa_printf(MSG_DEBUG, "P2P: Invalid P2P attribute");
    314 			return -1;
    315 		}
    316 		attr_len = WPA_GET_LE16(pos + 1);
    317 		wpa_printf(MSG_DEBUG, "P2P: Attribute %d length %u",
    318 			   pos[0], attr_len);
    319 		if (pos + 3 + attr_len > end) {
    320 			wpa_printf(MSG_DEBUG, "P2P: Attribute underflow "
    321 				   "(len=%u left=%d)",
    322 				   attr_len, (int) (end - pos - 3));
    323 			wpa_hexdump(MSG_MSGDUMP, "P2P: Data", pos, end - pos);
    324 			return -1;
    325 		}
    326 		if (p2p_parse_attribute(pos[0], pos + 3, attr_len, msg))
    327 			return -1;
    328 		pos += 3 + attr_len;
    329 	}
    330 
    331 	return 0;
    332 }
    333 
    334 
    335 static int p2p_parse_wps_ie(const struct wpabuf *buf, struct p2p_message *msg)
    336 {
    337 	struct wps_parse_attr attr;
    338 	int i;
    339 
    340 	wpa_printf(MSG_DEBUG, "P2P: Parsing WPS IE");
    341 	if (wps_parse_msg(buf, &attr))
    342 		return -1;
    343 	if (attr.dev_name && attr.dev_name_len < sizeof(msg->device_name) &&
    344 	    !msg->device_name[0])
    345 		os_memcpy(msg->device_name, attr.dev_name, attr.dev_name_len);
    346 	if (attr.config_methods) {
    347 		msg->wps_config_methods =
    348 			WPA_GET_BE16(attr.config_methods);
    349 		wpa_printf(MSG_DEBUG, "P2P: Config Methods (WPS): 0x%x",
    350 			   msg->wps_config_methods);
    351 	}
    352 	if (attr.dev_password_id) {
    353 		msg->dev_password_id = WPA_GET_BE16(attr.dev_password_id);
    354 		wpa_printf(MSG_DEBUG, "P2P: Device Password ID: %d",
    355 			   msg->dev_password_id);
    356 		msg->dev_password_id_present = 1;
    357 	}
    358 	if (attr.primary_dev_type) {
    359 		char devtype[WPS_DEV_TYPE_BUFSIZE];
    360 		msg->wps_pri_dev_type = attr.primary_dev_type;
    361 		wpa_printf(MSG_DEBUG, "P2P: Primary Device Type (WPS): %s",
    362 			   wps_dev_type_bin2str(msg->wps_pri_dev_type, devtype,
    363 						sizeof(devtype)));
    364 	}
    365 	if (attr.sec_dev_type_list) {
    366 		msg->wps_sec_dev_type_list = attr.sec_dev_type_list;
    367 		msg->wps_sec_dev_type_list_len = attr.sec_dev_type_list_len;
    368 	}
    369 
    370 	for (i = 0; i < P2P_MAX_WPS_VENDOR_EXT; i++) {
    371 		msg->wps_vendor_ext[i] = attr.vendor_ext[i];
    372 		msg->wps_vendor_ext_len[i] = attr.vendor_ext_len[i];
    373 	}
    374 
    375 	msg->manufacturer = attr.manufacturer;
    376 	msg->manufacturer_len = attr.manufacturer_len;
    377 	msg->model_name = attr.model_name;
    378 	msg->model_name_len = attr.model_name_len;
    379 	msg->model_number = attr.model_number;
    380 	msg->model_number_len = attr.model_number_len;
    381 	msg->serial_number = attr.serial_number;
    382 	msg->serial_number_len = attr.serial_number_len;
    383 
    384 	msg->oob_dev_password = attr.oob_dev_password;
    385 	msg->oob_dev_password_len = attr.oob_dev_password_len;
    386 
    387 	return 0;
    388 }
    389 
    390 
    391 /**
    392  * p2p_parse_ies - Parse P2P message IEs (both WPS and P2P IE)
    393  * @data: IEs from the message
    394  * @len: Length of data buffer in octets
    395  * @msg: Buffer for returning parsed attributes
    396  * Returns: 0 on success, -1 on failure
    397  *
    398  * Note: Caller is responsible for clearing the msg data structure before
    399  * calling this function.
    400  *
    401  * Note: Caller must free temporary memory allocations by calling
    402  * p2p_parse_free() when the parsed data is not needed anymore.
    403  */
    404 int p2p_parse_ies(const u8 *data, size_t len, struct p2p_message *msg)
    405 {
    406 	struct ieee802_11_elems elems;
    407 
    408 	ieee802_11_parse_elems(data, len, &elems, 0);
    409 	if (elems.ds_params && elems.ds_params_len >= 1)
    410 		msg->ds_params = elems.ds_params;
    411 	if (elems.ssid)
    412 		msg->ssid = elems.ssid - 2;
    413 
    414 	msg->wps_attributes = ieee802_11_vendor_ie_concat(data, len,
    415 							  WPS_DEV_OUI_WFA);
    416 	if (msg->wps_attributes &&
    417 	    p2p_parse_wps_ie(msg->wps_attributes, msg)) {
    418 		p2p_parse_free(msg);
    419 		return -1;
    420 	}
    421 
    422 	msg->p2p_attributes = ieee802_11_vendor_ie_concat(data, len,
    423 							  P2P_IE_VENDOR_TYPE);
    424 	if (msg->p2p_attributes &&
    425 	    p2p_parse_p2p_ie(msg->p2p_attributes, msg)) {
    426 		wpa_printf(MSG_DEBUG, "P2P: Failed to parse P2P IE data");
    427 		if (msg->p2p_attributes)
    428 			wpa_hexdump_buf(MSG_MSGDUMP, "P2P: P2P IE data",
    429 					msg->p2p_attributes);
    430 		p2p_parse_free(msg);
    431 		return -1;
    432 	}
    433 
    434 #ifdef CONFIG_WIFI_DISPLAY
    435 	if (elems.wfd) {
    436 		msg->wfd_subelems = ieee802_11_vendor_ie_concat(
    437 			data, len, WFD_IE_VENDOR_TYPE);
    438 	}
    439 #endif /* CONFIG_WIFI_DISPLAY */
    440 
    441 	return 0;
    442 }
    443 
    444 
    445 /**
    446  * p2p_parse - Parse a P2P Action frame contents
    447  * @data: Action frame payload after Category and Code fields
    448  * @len: Length of data buffer in octets
    449  * @msg: Buffer for returning parsed attributes
    450  * Returns: 0 on success, -1 on failure
    451  *
    452  * Note: Caller must free temporary memory allocations by calling
    453  * p2p_parse_free() when the parsed data is not needed anymore.
    454  */
    455 int p2p_parse(const u8 *data, size_t len, struct p2p_message *msg)
    456 {
    457 	os_memset(msg, 0, sizeof(*msg));
    458 	wpa_printf(MSG_DEBUG, "P2P: Parsing the received message");
    459 	if (len < 1) {
    460 		wpa_printf(MSG_DEBUG, "P2P: No Dialog Token in the message");
    461 		return -1;
    462 	}
    463 	msg->dialog_token = data[0];
    464 	wpa_printf(MSG_DEBUG, "P2P: * Dialog Token: %d", msg->dialog_token);
    465 
    466 	return p2p_parse_ies(data + 1, len - 1, msg);
    467 }
    468 
    469 
    470 int p2p_parse_ies_separate(const u8 *wsc, size_t wsc_len, const u8 *p2p,
    471 			   size_t p2p_len, struct p2p_message *msg)
    472 {
    473 	os_memset(msg, 0, sizeof(*msg));
    474 
    475 	msg->wps_attributes = wpabuf_alloc_copy(wsc, wsc_len);
    476 	if (msg->wps_attributes &&
    477 	    p2p_parse_wps_ie(msg->wps_attributes, msg)) {
    478 		p2p_parse_free(msg);
    479 		return -1;
    480 	}
    481 
    482 	msg->p2p_attributes = wpabuf_alloc_copy(p2p, p2p_len);
    483 	if (msg->p2p_attributes &&
    484 	    p2p_parse_p2p_ie(msg->p2p_attributes, msg)) {
    485 		wpa_printf(MSG_DEBUG, "P2P: Failed to parse P2P IE data");
    486 		if (msg->p2p_attributes)
    487 			wpa_hexdump_buf(MSG_MSGDUMP, "P2P: P2P IE data",
    488 					msg->p2p_attributes);
    489 		p2p_parse_free(msg);
    490 		return -1;
    491 	}
    492 
    493 	return 0;
    494 }
    495 
    496 
    497 /**
    498  * p2p_parse_free - Free temporary data from P2P parsing
    499  * @msg: Parsed attributes
    500  */
    501 void p2p_parse_free(struct p2p_message *msg)
    502 {
    503 	wpabuf_free(msg->p2p_attributes);
    504 	msg->p2p_attributes = NULL;
    505 	wpabuf_free(msg->wps_attributes);
    506 	msg->wps_attributes = NULL;
    507 #ifdef CONFIG_WIFI_DISPLAY
    508 	wpabuf_free(msg->wfd_subelems);
    509 	msg->wfd_subelems = NULL;
    510 #endif /* CONFIG_WIFI_DISPLAY */
    511 }
    512 
    513 
    514 int p2p_group_info_parse(const u8 *gi, size_t gi_len,
    515 			 struct p2p_group_info *info)
    516 {
    517 	const u8 *g, *gend;
    518 
    519 	os_memset(info, 0, sizeof(*info));
    520 	if (gi == NULL)
    521 		return 0;
    522 
    523 	g = gi;
    524 	gend = gi + gi_len;
    525 	while (g < gend) {
    526 		struct p2p_client_info *cli;
    527 		const u8 *t, *cend;
    528 		int count;
    529 
    530 		cli = &info->client[info->num_clients];
    531 		cend = g + 1 + g[0];
    532 		if (cend > gend)
    533 			return -1; /* invalid data */
    534 		/* g at start of P2P Client Info Descriptor */
    535 		/* t at Device Capability Bitmap */
    536 		t = g + 1 + 2 * ETH_ALEN;
    537 		if (t > cend)
    538 			return -1; /* invalid data */
    539 		cli->p2p_device_addr = g + 1;
    540 		cli->p2p_interface_addr = g + 1 + ETH_ALEN;
    541 		cli->dev_capab = t[0];
    542 
    543 		if (t + 1 + 2 + 8 + 1 > cend)
    544 			return -1; /* invalid data */
    545 
    546 		cli->config_methods = WPA_GET_BE16(&t[1]);
    547 		cli->pri_dev_type = &t[3];
    548 
    549 		t += 1 + 2 + 8;
    550 		/* t at Number of Secondary Device Types */
    551 		cli->num_sec_dev_types = *t++;
    552 		if (t + 8 * cli->num_sec_dev_types > cend)
    553 			return -1; /* invalid data */
    554 		cli->sec_dev_types = t;
    555 		t += 8 * cli->num_sec_dev_types;
    556 
    557 		/* t at Device Name in WPS TLV format */
    558 		if (t + 2 + 2 > cend)
    559 			return -1; /* invalid data */
    560 		if (WPA_GET_BE16(t) != ATTR_DEV_NAME)
    561 			return -1; /* invalid Device Name TLV */
    562 		t += 2;
    563 		count = WPA_GET_BE16(t);
    564 		t += 2;
    565 		if (count > cend - t)
    566 			return -1; /* invalid Device Name TLV */
    567 		if (count >= 32)
    568 			count = 32;
    569 		cli->dev_name = (const char *) t;
    570 		cli->dev_name_len = count;
    571 
    572 		g = cend;
    573 
    574 		info->num_clients++;
    575 		if (info->num_clients == P2P_MAX_GROUP_ENTRIES)
    576 			return -1;
    577 	}
    578 
    579 	return 0;
    580 }
    581 
    582 
    583 static int p2p_group_info_text(const u8 *gi, size_t gi_len, char *buf,
    584 			       char *end)
    585 {
    586 	char *pos = buf;
    587 	int ret;
    588 	struct p2p_group_info info;
    589 	unsigned int i;
    590 
    591 	if (p2p_group_info_parse(gi, gi_len, &info) < 0)
    592 		return 0;
    593 
    594 	for (i = 0; i < info.num_clients; i++) {
    595 		struct p2p_client_info *cli;
    596 		char name[33];
    597 		char devtype[WPS_DEV_TYPE_BUFSIZE];
    598 		u8 s;
    599 		int count;
    600 
    601 		cli = &info.client[i];
    602 		ret = os_snprintf(pos, end - pos, "p2p_group_client: "
    603 				  "dev=" MACSTR " iface=" MACSTR,
    604 				  MAC2STR(cli->p2p_device_addr),
    605 				  MAC2STR(cli->p2p_interface_addr));
    606 		if (ret < 0 || ret >= end - pos)
    607 			return pos - buf;
    608 		pos += ret;
    609 
    610 		ret = os_snprintf(pos, end - pos,
    611 				  " dev_capab=0x%x config_methods=0x%x "
    612 				  "dev_type=%s",
    613 				  cli->dev_capab, cli->config_methods,
    614 				  wps_dev_type_bin2str(cli->pri_dev_type,
    615 						       devtype,
    616 						       sizeof(devtype)));
    617 		if (ret < 0 || ret >= end - pos)
    618 			return pos - buf;
    619 		pos += ret;
    620 
    621 		for (s = 0; s < cli->num_sec_dev_types; s++) {
    622 			ret = os_snprintf(pos, end - pos, " dev_type=%s",
    623 					  wps_dev_type_bin2str(
    624 						  &cli->sec_dev_types[s * 8],
    625 						  devtype, sizeof(devtype)));
    626 			if (ret < 0 || ret >= end - pos)
    627 				return pos - buf;
    628 			pos += ret;
    629 		}
    630 
    631 		os_memcpy(name, cli->dev_name, cli->dev_name_len);
    632 		name[cli->dev_name_len] = '\0';
    633 		count = (int) cli->dev_name_len - 1;
    634 		while (count >= 0) {
    635 			if (name[count] > 0 && name[count] < 32)
    636 				name[count] = '_';
    637 			count--;
    638 		}
    639 
    640 		ret = os_snprintf(pos, end - pos, " dev_name='%s'\n", name);
    641 		if (ret < 0 || ret >= end - pos)
    642 			return pos - buf;
    643 		pos += ret;
    644 	}
    645 
    646 	return pos - buf;
    647 }
    648 
    649 
    650 /**
    651  * p2p_attr_text - Build text format description of P2P IE attributes
    652  * @data: P2P IE contents
    653  * @buf: Buffer for returning text
    654  * @end: Pointer to the end of the buf area
    655  * Returns: Number of octets written to the buffer or -1 on faikure
    656  *
    657  * This function can be used to parse P2P IE contents into text format
    658  * field=value lines.
    659  */
    660 int p2p_attr_text(struct wpabuf *data, char *buf, char *end)
    661 {
    662 	struct p2p_message msg;
    663 	char *pos = buf;
    664 	int ret;
    665 
    666 	os_memset(&msg, 0, sizeof(msg));
    667 	if (p2p_parse_p2p_ie(data, &msg))
    668 		return -1;
    669 
    670 	if (msg.capability) {
    671 		ret = os_snprintf(pos, end - pos,
    672 				  "p2p_dev_capab=0x%x\n"
    673 				  "p2p_group_capab=0x%x\n",
    674 				  msg.capability[0], msg.capability[1]);
    675 		if (ret < 0 || ret >= end - pos)
    676 			return pos - buf;
    677 		pos += ret;
    678 	}
    679 
    680 	if (msg.pri_dev_type) {
    681 		char devtype[WPS_DEV_TYPE_BUFSIZE];
    682 		ret = os_snprintf(pos, end - pos,
    683 				  "p2p_primary_device_type=%s\n",
    684 				  wps_dev_type_bin2str(msg.pri_dev_type,
    685 						       devtype,
    686 						       sizeof(devtype)));
    687 		if (ret < 0 || ret >= end - pos)
    688 			return pos - buf;
    689 		pos += ret;
    690 	}
    691 
    692 	ret = os_snprintf(pos, end - pos, "p2p_device_name=%s\n",
    693 			  msg.device_name);
    694 	if (ret < 0 || ret >= end - pos)
    695 		return pos - buf;
    696 	pos += ret;
    697 
    698 	if (msg.p2p_device_addr) {
    699 		ret = os_snprintf(pos, end - pos, "p2p_device_addr=" MACSTR
    700 				  "\n",
    701 				  MAC2STR(msg.p2p_device_addr));
    702 		if (ret < 0 || ret >= end - pos)
    703 			return pos - buf;
    704 		pos += ret;
    705 	}
    706 
    707 	ret = os_snprintf(pos, end - pos, "p2p_config_methods=0x%x\n",
    708 			  msg.config_methods);
    709 	if (ret < 0 || ret >= end - pos)
    710 		return pos - buf;
    711 	pos += ret;
    712 
    713 	ret = p2p_group_info_text(msg.group_info, msg.group_info_len,
    714 				  pos, end);
    715 	if (ret < 0)
    716 		return pos - buf;
    717 	pos += ret;
    718 
    719 	return pos - buf;
    720 }
    721 
    722 
    723 int p2p_get_cross_connect_disallowed(const struct wpabuf *p2p_ie)
    724 {
    725 	struct p2p_message msg;
    726 
    727 	os_memset(&msg, 0, sizeof(msg));
    728 	if (p2p_parse_p2p_ie(p2p_ie, &msg))
    729 		return 0;
    730 
    731 	if (!msg.manageability)
    732 		return 0;
    733 
    734 	return !(msg.manageability[0] & P2P_MAN_CROSS_CONNECTION_PERMITTED);
    735 }
    736 
    737 
    738 u8 p2p_get_group_capab(const struct wpabuf *p2p_ie)
    739 {
    740 	struct p2p_message msg;
    741 
    742 	os_memset(&msg, 0, sizeof(msg));
    743 	if (p2p_parse_p2p_ie(p2p_ie, &msg))
    744 		return 0;
    745 
    746 	if (!msg.capability)
    747 		return 0;
    748 
    749 	return msg.capability[1];
    750 }
    751 
    752 
    753 const u8 * p2p_get_go_dev_addr(const struct wpabuf *p2p_ie)
    754 {
    755 	struct p2p_message msg;
    756 
    757 	os_memset(&msg, 0, sizeof(msg));
    758 	if (p2p_parse_p2p_ie(p2p_ie, &msg))
    759 		return NULL;
    760 
    761 	if (msg.p2p_device_addr)
    762 		return msg.p2p_device_addr;
    763 	if (msg.device_id)
    764 		return msg.device_id;
    765 
    766 	return NULL;
    767 }
    768