UPnP: Workaround bogus NewWLANEventMAC in PutWLANResponse

It looks like Intel wsccmd may send a bogus NewWLANEventMAC
(11:22:33:44:55:66) when acting as an wired external Registrar. Work
around this by going through all STAs if the address does not match and
pick the STA that is in an ongoing WPS registration.

hostapd/wps_hostapd.c

@@ -881,10 +881,26 @@ static int hostapd_rx_req_put_wlan_event_response(
 	hapd->wps->upnp_msg = wpabuf_dup(msg);
 
 	sta = ap_get_sta(hapd, mac_addr);
+	if (!sta) {
+		/*
+		 * Workaround - Intel wsccmd uses bogus NewWLANEventMAC:
+		 * Pick STA that is in an ongoing WPS registration without
+		 * checking the MAC address.
+		 */
+		wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based "
+			   "on NewWLANEventMAC; try wildcard match");
+		for (sta = hapd->sta_list; sta; sta = sta->next) {
+			if (sta->eapol_sm &&
+			    sta->eapol_sm->eap == hapd->wps->pending_session)
+				break;
+		}
+	}
 	if (sta)
 		return eapol_auth_eap_pending_cb(sta->eapol_sm,
 						 hapd->wps->pending_session);
 
+	wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found");
+
 	return 0;
 }