Tvheadend

/*

 *  tvheadend, CWC interface

 *  Copyright (C) 2007 Andreas ?man

 *

 *  This program is free software: you can redistribute it and/or modify

 *  it under the terms of the GNU General Public License as published by

 *  the Free Software Foundation, either version 3 of the License, or

 *  (at your option) any later version.

 *

 *  This program is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *  GNU General Public License for more details.

 *

 *  You should have received a copy of the GNU General Public License

 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */

#include <pthread.h>

#include <assert.h>

#include <string.h>

#include <stdio.h>

#include <unistd.h>

#include <stdlib.h>

#include <stdarg.h>

#include <errno.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <ctype.h>

#include "tvheadend.h"

#include "tcp.h"

#include "psi.h"

#include "tsdemux.h"

#include "ffdecsa/FFdecsa.h"

#include "cwc.h"

#include "notify.h"

#include "atomic.h"

#include "dtable.h"

#include "subscriptions.h"

#include <openssl/des.h>

/**

 *

 */

#define CWC_KEEPALIVE_INTERVAL 30

#define CWS_NETMSGSIZE 272

#define CWS_FIRSTCMDNO 0xe0

/**

 * cards for which emm updates are handled

 */

typedef enum {

  CARD_IRDETO,

  CARD_DRE,

  CARD_CONAX,

  CARD_SECA,

  CARD_VIACCESS,

  CARD_UNKNOWN

} card_type_t;

typedef enum {

  MSG_CLIENT_2_SERVER_LOGIN = CWS_FIRSTCMDNO,

  MSG_CLIENT_2_SERVER_LOGIN_ACK,

  MSG_CLIENT_2_SERVER_LOGIN_NAK,

  MSG_CARD_DATA_REQ,

  MSG_CARD_DATA,

  MSG_SERVER_2_CLIENT_NAME,

  MSG_SERVER_2_CLIENT_NAME_ACK,

  MSG_SERVER_2_CLIENT_NAME_NAK,

  MSG_SERVER_2_CLIENT_LOGIN,

  MSG_SERVER_2_CLIENT_LOGIN_ACK,

  MSG_SERVER_2_CLIENT_LOGIN_NAK,

  MSG_ADMIN,

  MSG_ADMIN_ACK,

  MSG_ADMIN_LOGIN,

  MSG_ADMIN_LOGIN_ACK,

  MSG_ADMIN_LOGIN_NAK,

  MSG_ADMIN_COMMAND,

  MSG_ADMIN_COMMAND_ACK,

  MSG_ADMIN_COMMAND_NAK,

  MSG_KEEPALIVE = CWS_FIRSTCMDNO + 0x1d

} net_msg_type_t;

/**

 *

 */

TAILQ_HEAD(cwc_queue, cwc);

LIST_HEAD(cwc_service_list, cwc_service);

TAILQ_HEAD(cwc_message_queue, cwc_message);

LIST_HEAD(ecm_section_list, ecm_section);

static struct cwc_queue cwcs;

static pthread_cond_t cwc_config_changed;

static pthread_mutex_t cwc_mutex;

static char *crypt_md5(const char *pw, const char *salt);

/**

 *

 */

typedef struct ecm_section {

  int es_section;

  int es_channel;

  uint16_t es_seq;

  char es_nok;

  char es_pending;

  int64_t es_time;  // time request was sent

  size_t es_ecmsize;

  uint8_t es_ecm[4070];

} ecm_section_t;

/**

 *

 */

typedef struct ecm_pid {

  LIST_ENTRY(ecm_pid) ep_link;

  uint16_t ep_pid;

  int ep_last_section;

  struct ecm_section *ep_sections[256];

} ecm_pid_t;

/**

 *

 */

typedef struct cwc_service {

  th_descrambler_t cs_head;

  service_t *cs_service;

  struct cwc *cs_cwc;

  LIST_ENTRY(cwc_service) cs_link;

  int cs_okchannel;

  /**

   * Status of the key(s) in cs_keys

   */

  enum {

    CS_UNKNOWN,

    CS_RESOLVED,

    CS_FORBIDDEN

  } cs_keystate;

  void *cs_keys;

  uint8_t cs_cw[16];

  int cs_pending_cw_update;

  /**

   * CSA

   */

  int cs_cluster_size;

  uint8_t *cs_tsbcluster;

  int cs_fill;

  LIST_HEAD(, ecm_pid) cs_pids;

} cwc_service_t;

/**

 *

 */

typedef struct cwc_message {

  TAILQ_ENTRY(cwc_message) cm_link;

  int cm_len;

  uint8_t cm_data[CWS_NETMSGSIZE];

} cwc_message_t;

/**

 *

 */

typedef struct cwc_provider {

  uint32_t id;

  uint8_t sa[8];

} cwc_provider_t;

/**

 *

 */

typedef struct cwc {

  int cwc_fd;

  int cwc_connected;

  int cwc_retry_delay;

  pthread_cond_t cwc_cond;

  pthread_mutex_t cwc_writer_mutex; 

  pthread_cond_t cwc_writer_cond; 

  int cwc_writer_running;

  struct cwc_message_queue cwc_writeq;

  TAILQ_ENTRY(cwc) cwc_link; /* Linkage protected via cwc_mutex */

  struct cwc_service_list cwc_services;

  uint16_t cwc_caid;

  int cwc_seq;

  DES_key_schedule cwc_k1, cwc_k2;

  uint8_t cwc_buf[256];

  int cwc_bufptr;

  /* Card Unique Address */

  uint8_t cwc_ua[8];

  /* Provider IDs */

  cwc_provider_t cwc_providers[256];

  int cwc_num_providers;

  /* Emm forwarding */

  int cwc_forward_emm;

  /* Emm duplicate cache */

  struct {

#define EMM_CACHE_SIZE (1<<5)

#define EMM_CACHE_MASK (EMM_CACHE_SIZE-1)

    uint32_t cache[EMM_CACHE_SIZE];

    uint32_t w;

    uint32_t n;

  } cwc_emm_cache;

  /* Viaccess EMM assemble state */

  struct {

    int shared_toggle;

    int shared_len;

    uint8_t * shared_emm;

  } cwc_viaccess_emm;

  /* Card type */

  card_type_t cwc_card_type;

  /* From configuration */

  uint8_t cwc_confedkey[14];

  char *cwc_username;

  char *cwc_password;

  char *cwc_password_salted;   /* salted version */

  char *cwc_comment;

  char *cwc_hostname;

  int cwc_port;

  char *cwc_id;

  int cwc_emm;

  const char *cwc_errtxt;

  int cwc_enabled;

  int cwc_running;

  int cwc_reconfigure;

} cwc_t;

/**

 *

 */

static void cwc_service_destroy(th_descrambler_t *td);

static void cwc_detect_card_type(cwc_t *cwc);

void cwc_emm_conax(cwc_t *cwc, uint8_t *data, int len);

void cwc_emm_irdeto(cwc_t *cwc, uint8_t *data, int len);

void cwc_emm_dre(cwc_t *cwc, uint8_t *data, int len);

void cwc_emm_seca(cwc_t *cwc, uint8_t *data, int len);

void cwc_emm_viaccess(cwc_t *cwc, uint8_t *data, int len);

/**

 *

 */

static void 

des_key_parity_adjust(uint8_t *key, uint8_t len)

{

  uint8_t i, j, parity;

  for (i = 0; i < len; i++) {

    parity = 1;

    for (j = 1; j < 8; j++) if ((key[i] >> j) & 0x1) parity = ~parity & 0x01;

    key[i] |= parity;

  }

}

/**

 *

 */

static void

des_key_spread(uint8_t *normal, uint8_t *spread)

{

  spread[ 0] = normal[ 0] & 0xfe;

  spread[ 1] = ((normal[ 0] << 7) | (normal[ 1] >> 1)) & 0xfe;

  spread[ 2] = ((normal[ 1] << 6) | (normal[ 2] >> 2)) & 0xfe;

  spread[ 3] = ((normal[ 2] << 5) | (normal[ 3] >> 3)) & 0xfe;

  spread[ 4] = ((normal[ 3] << 4) | (normal[ 4] >> 4)) & 0xfe;

  spread[ 5] = ((normal[ 4] << 3) | (normal[ 5] >> 5)) & 0xfe;

  spread[ 6] = ((normal[ 5] << 2) | (normal[ 6] >> 6)) & 0xfe;

  spread[ 7] = normal[ 6] << 1;

  spread[ 8] = normal[ 7] & 0xfe;

  spread[ 9] = ((normal[ 7] << 7) | (normal[ 8] >> 1)) & 0xfe;

  spread[10] = ((normal[ 8] << 6) | (normal[ 9] >> 2)) & 0xfe;

  spread[11] = ((normal[ 9] << 5) | (normal[10] >> 3)) & 0xfe;

  spread[12] = ((normal[10] << 4) | (normal[11] >> 4)) & 0xfe;

  spread[13] = ((normal[11] << 3) | (normal[12] >> 5)) & 0xfe;

  spread[14] = ((normal[12] << 2) | (normal[13] >> 6)) & 0xfe;

  spread[15] = normal[13] << 1;

  des_key_parity_adjust(spread, 16);

}

/**

 *

 */

static void 

des_random_get(uint8_t *buffer, uint8_t len)

{

  uint8_t idx = 0;

  int randomNo = 0;

  for (idx = 0; idx < len; idx++) {

      if (!(idx % 3)) randomNo = rand();

      buffer[idx] = (randomNo >> ((idx % 3) << 3)) & 0xff;

    }

}

/**

 *

 */

static int

des_encrypt(uint8_t *buffer, int len, cwc_t *cwc)

{

  uint8_t checksum = 0;

  uint8_t noPadBytes;

  uint8_t padBytes[7];

  DES_cblock ivec;

  uint16_t i;

  noPadBytes = (8 - ((len - 1) % 8)) % 8;

  if (len + noPadBytes + 1 >= CWS_NETMSGSIZE-8) return -1;

  des_random_get(padBytes, noPadBytes);

  for (i = 0; i < noPadBytes; i++) buffer[len++] = padBytes[i];

  for (i = 2; i < len; i++) checksum ^= buffer[i];

  buffer[len++] = checksum;

  des_random_get((uint8_t *)ivec, 8);

  memcpy(buffer+len, ivec, 8);

  for (i = 2; i < len; i += 8) {

    DES_ncbc_encrypt(buffer+i, buffer+i, 8,  &cwc->cwc_k1, &ivec, 1);

    DES_ecb_encrypt((DES_cblock *)(buffer+i), (DES_cblock *)(buffer+i),

		    &cwc->cwc_k2, 0);

    DES_ecb_encrypt((DES_cblock *)(buffer+i), (DES_cblock *)(buffer+i),

		    &cwc->cwc_k1, 1);

    memcpy(ivec, buffer+i, 8);

  }

  len += 8;

  return len;

}

/**

 *

 */

static int 

des_decrypt(uint8_t *buffer, int len, cwc_t *cwc)

{

  DES_cblock ivec;

  DES_cblock nextIvec;

  int i;

  uint8_t checksum = 0;

  if ((len-2) % 8 || (len-2) < 16) return -1;

  len -= 8;

  memcpy(nextIvec, buffer+len, 8);

  for (i = 2; i < len; i += 8)

    {

      memcpy(ivec, nextIvec, 8);

      memcpy(nextIvec, buffer+i, 8);

      DES_ecb_encrypt((DES_cblock *)(buffer+i), (DES_cblock *)(buffer+i),

		      &cwc->cwc_k1, 0);

      DES_ecb_encrypt((DES_cblock *)(buffer+i), (DES_cblock *)(buffer+i),

		      &cwc->cwc_k2, 1);

      DES_ncbc_encrypt(buffer+i, buffer+i, 8,  &cwc->cwc_k1, &ivec, 0);

    } 

  for (i = 2; i < len; i++) checksum ^= buffer[i];

  if (checksum) return -1;

  return len;

}

/**

 *

 */

static void

des_make_login_key(cwc_t *cwc, uint8_t *k)

{

  uint8_t des14[14], spread[16];

  int i;

  for (i = 0; i < 14; i++) 

    des14[i] = cwc->cwc_confedkey[i] ^ k[i];

  des_key_spread(des14, spread);

  DES_set_key_unchecked((DES_cblock *)spread,     &cwc->cwc_k1);

  DES_set_key_unchecked((DES_cblock *)(spread+8), &cwc->cwc_k2);

}

/**

 *

 */

static void

des_make_session_key(cwc_t *cwc)

{

  uint8_t des14[14], spread[16], *k2 = (uint8_t *)cwc->cwc_password_salted;

  int i, l = strlen(cwc->cwc_password_salted);

  memcpy(des14, cwc->cwc_confedkey, 14);

  for (i = 0; i < l; i++)

    des14[i % 14] ^= k2[i];

  des_key_spread(des14, spread);

  DES_set_key_unchecked((DES_cblock *)spread,     &cwc->cwc_k1);

  DES_set_key_unchecked((DES_cblock *)(spread+8), &cwc->cwc_k2);

}

/**

 * Note, this function is called from multiple threads so beware of

 * locking / race issues (Note how we use atomic_add() to generate

 * the ID)

 */

static int

cwc_send_msg(cwc_t *cwc, const uint8_t *msg, size_t len, int sid, int enq)

{

  cwc_message_t *cm = malloc(sizeof(cwc_message_t));

  uint8_t *buf = cm->cm_data;

  int seq, n;

  if(len + 12 > CWS_NETMSGSIZE)

    return -1;

  memset(buf, 0, 12);

  memcpy(buf + 12, msg, len);

  len += 12;

  seq = atomic_add(&cwc->cwc_seq, 1);

  buf[2] = seq >> 8;

  buf[3] = seq;

  buf[4] = sid >> 8;

  buf[5] = sid;

  if((len = des_encrypt(buf, len, cwc)) < 0) {

    free(buf);

    return -1;

  }

  buf[0] = (len - 2) >> 8;

  buf[1] =  len - 2;

  if(enq) {

    cm->cm_len = len;

    pthread_mutex_lock(&cwc->cwc_writer_mutex);

    TAILQ_INSERT_TAIL(&cwc->cwc_writeq, cm, cm_link);

    pthread_cond_signal(&cwc->cwc_writer_cond);

    pthread_mutex_unlock(&cwc->cwc_writer_mutex);

  } else {

    n = write(cwc->cwc_fd, buf, len);

    free(cm);

  }

  return seq & 0xffff;

}

/**

 * Card data command

 */

static void

cwc_send_data_req(cwc_t *cwc)

{

  uint8_t buf[CWS_NETMSGSIZE];

  buf[0] = MSG_CARD_DATA_REQ;

  buf[1] = 0;

  buf[2] = 0;

  cwc_send_msg(cwc, buf, 3, 0, 0);

}

/**

 * Send keep alive

 */

static void

cwc_send_ka(cwc_t *cwc)

{

  uint8_t buf[CWS_NETMSGSIZE];

  buf[0] = MSG_KEEPALIVE;

  buf[1] = 0;

  buf[2] = 0;

  cwc_send_msg(cwc, buf, 3, 0, 0);

}

/**

 *

 */

static void 

cwc_comet_status_update(cwc_t *cwc)

{

  htsmsg_t *m = htsmsg_create_map();

  htsmsg_add_str(m, "id", cwc->cwc_id);

  htsmsg_add_u32(m, "connected", !!cwc->cwc_connected);

  notify_by_msg("cwcStatus", m);

}

/**

 * Handle reply to card data request

 */

static int

cwc_decode_card_data_reply(cwc_t *cwc, uint8_t *msg, int len)

{

  int plen, i;

  unsigned int nprov;

  const char *n;

  msg += 12;

  len -= 12;

  if(len < 3) {

    tvhlog(LOG_INFO, "cwc", "Invalid card data reply");

    return -1;

  }

  plen = (msg[1] & 0xf) << 8 | msg[2];

  if(plen < 14) {

    tvhlog(LOG_INFO, "cwc", "Invalid card data reply (message)");

    return -1;

  }

  nprov = msg[14];

  if(plen < nprov * 11) {

    tvhlog(LOG_INFO, "cwc", "Invalid card data reply (provider list)");

    return -1;

  }

  cwc->cwc_connected = 1;

  cwc_comet_status_update(cwc);

  cwc->cwc_caid = (msg[4] << 8) | msg[5];

  n = psi_caid2name(cwc->cwc_caid) ?: "Unknown";

  memcpy(cwc->cwc_ua, &msg[6], 8);

  tvhlog(LOG_INFO, "cwc", "%s: Connected as user 0x%02x "

	 "to a %s-card [0x%04x : %02x.%02x.%02x.%02x.%02x.%02x.%02x.%02x] "

	 "with %d providers", 

	 cwc->cwc_hostname,

	 msg[3], n, cwc->cwc_caid, 

	 cwc->cwc_ua[0], cwc->cwc_ua[1], cwc->cwc_ua[2], cwc->cwc_ua[3], cwc->cwc_ua[4], cwc->cwc_ua[5], cwc->cwc_ua[6], cwc->cwc_ua[7],

	 nprov);

  cwc_detect_card_type(cwc);

  msg  += 15;

  plen -= 12;

  cwc->cwc_num_providers = nprov;

  for(i = 0; i < nprov; i++) {

    cwc->cwc_providers[i].id = (msg[0] << 16) | (msg[1] << 8) | msg[2];

    cwc->cwc_providers[i].sa[0] = msg[3];

    cwc->cwc_providers[i].sa[1] = msg[4];

    cwc->cwc_providers[i].sa[2] = msg[5];

    cwc->cwc_providers[i].sa[3] = msg[6];

    cwc->cwc_providers[i].sa[4] = msg[7];

    cwc->cwc_providers[i].sa[5] = msg[8];

    cwc->cwc_providers[i].sa[6] = msg[9];

    cwc->cwc_providers[i].sa[7] = msg[10];

    tvhlog(LOG_INFO, "cwc", "%s: Provider ID #%d: 0x%06x %02x.%02x.%02x.%02x.%02x.%02x.%02x.%02x",

	   cwc->cwc_hostname, i + 1,

	   cwc->cwc_providers[i].id,

	   cwc->cwc_providers[i].sa[0],

	   cwc->cwc_providers[i].sa[1],

	   cwc->cwc_providers[i].sa[2],

	   cwc->cwc_providers[i].sa[3],

	   cwc->cwc_providers[i].sa[4],

	   cwc->cwc_providers[i].sa[5],

	   cwc->cwc_providers[i].sa[6],

	   cwc->cwc_providers[i].sa[7]);

    msg += 11;

  }

  cwc->cwc_forward_emm = 0;

  if (cwc->cwc_emm) {

    int emm_allowed = (cwc->cwc_ua[0] || cwc->cwc_ua[1] ||

		       cwc->cwc_ua[2] || cwc->cwc_ua[3] ||

		       cwc->cwc_ua[4] || cwc->cwc_ua[5] ||

		       cwc->cwc_ua[6] || cwc->cwc_ua[7]);

    if (!emm_allowed) {

      tvhlog(LOG_INFO, "cwc", 

	     "%s: Will not forward EMMs (not allowed by server)",

	     cwc->cwc_hostname);

	} else {

		tvhlog(LOG_INFO, "cwc", "%s: Will forward EMMs",

	     cwc->cwc_hostname);

      cwc->cwc_forward_emm = 1;

    }

	/*

    } else if (cwc->cwc_card_type != CARD_UNKNOWN) {

      tvhlog(LOG_INFO, "cwc", "%s: Will forward EMMs",

	     cwc->cwc_hostname);

      cwc->cwc_forward_emm = 1;

    } else {

      tvhlog(LOG_INFO, "cwc", 

	     "%s: Will not forward EMMs (unsupported CA system)",

	     cwc->cwc_hostname);

    }

    */

  }

  return 0;

}

/**

 * Detects the cam card type

 * If you want to add another card, have a look at

 * http://www.dvbservices.com/identifiers/ca_system_id?page=3

 * 

 * based on the equivalent in sasc-ng

 */

static void

cwc_detect_card_type(cwc_t *cwc)

{

  uint8_t c_sys = cwc->cwc_caid >> 8;

  switch(c_sys) {

  case 0x17:

  case 0x06: 

    cwc->cwc_card_type = CARD_IRDETO;

    tvhlog(LOG_INFO, "cwc", "%s: irdeto card",

	   cwc->cwc_hostname);

    break;

  case 0x05:

    cwc->cwc_card_type = CARD_VIACCESS;

    tvhlog(LOG_INFO, "cwc", "%s: viaccess card",

	   cwc->cwc_hostname);

    break;

  case 0x0b:

    cwc->cwc_card_type = CARD_CONAX;

    tvhlog(LOG_INFO, "cwc", "%s: conax card",

	   cwc->cwc_hostname);

    break;

  case 0x01:

    cwc->cwc_card_type = CARD_SECA;

    tvhlog(LOG_INFO, "cwc", "%s: seca card",

	   cwc->cwc_hostname);

  case 0x4a:

    cwc->cwc_card_type = CARD_DRE;

    tvhlog(LOG_INFO, "cwc", "%s: dre card",

	   cwc->cwc_hostname);

    break;

  default:

    cwc->cwc_card_type = CARD_UNKNOWN;

    break;

  }

}

/**

 * Login command

 */

static void

cwc_send_login(cwc_t *cwc)

{

  uint8_t buf[CWS_NETMSGSIZE];

  int ul = strlen(cwc->cwc_username) + 1;

  int pl = strlen(cwc->cwc_password_salted) + 1;

  buf[0] = MSG_CLIENT_2_SERVER_LOGIN;

  buf[1] = 0;

  buf[2] = ul + pl;

  memcpy(buf + 3,      cwc->cwc_username, ul);

  memcpy(buf + 3 + ul, cwc->cwc_password_salted, pl);

  cwc_send_msg(cwc, buf, ul + pl + 3, 0, 0);

}

static void

handle_ecm_reply(cwc_service_t *ct, ecm_section_t *es, uint8_t *msg,

		 int len, int seq)

{

  service_t *t = ct->cs_service;

  ecm_pid_t *ep;

  char chaninfo[32];

  int i;

  int64_t delay = (getmonoclock() - es->es_time) / 1000LL; // in ms

  if(es->es_channel != -1) {

    snprintf(chaninfo, sizeof(chaninfo), " (channel %d)", es->es_channel);

  } else {

    chaninfo[0] = 0;

  }

  es->es_pending = 0;

  if(len < 19) {

    /* ERROR */

    if(ct->cs_okchannel == es->es_channel)

      ct->cs_okchannel = -1;

    if(ct->cs_keystate == CS_FORBIDDEN)

      return; // We already know it's bad

    es->es_nok = 1;

    tvhlog(LOG_DEBUG, "cwc", "Received NOK for service \"%s\"%s (seqno: %d "

	   "Req delay: %lld ms)", t->s_svcname, chaninfo, seq, delay);

    LIST_FOREACH(ep, &ct->cs_pids, ep_link) {

      for(i = 0; i <= ep->ep_last_section; i++)

	if(ep->ep_sections[i] == NULL || 

	   ep->ep_sections[i]->es_pending ||

	   ep->ep_sections[i]->es_nok == 0)

	  return;

    }

    tvhlog(LOG_ERR, "cwc",

	   "Can not descramble service \"%s\", access denied (seqno: %d "

	   "Req delay: %lld ms)",

	   t->s_svcname, seq, delay);

    ct->cs_keystate = CS_FORBIDDEN;

    return;

  } else {

    ct->cs_okchannel = es->es_channel;

    es->es_nok = 0;

    tvhlog(LOG_DEBUG, "cwc",

	   "Received ECM reply%s for service \"%s\" "

	   "even: %02x.%02x.%02x.%02x.%02x.%02x.%02x.%02x"

	   " odd: %02x.%02x.%02x.%02x.%02x.%02x.%02x.%02x (seqno: %d "

	   "Req delay: %lld ms)",

	   chaninfo,

	   t->s_svcname,

	   msg[3 + 0], msg[3 + 1], msg[3 + 2], msg[3 + 3], msg[3 + 4],

	   msg[3 + 5], msg[3 + 6], msg[3 + 7], msg[3 + 8], msg[3 + 9],

	   msg[3 + 10],msg[3 + 11],msg[3 + 12],msg[3 + 13],msg[3 + 14],

	   msg[3 + 15], seq, delay);

    if(ct->cs_keystate != CS_RESOLVED)

      tvhlog(LOG_INFO, "cwc",

	     "Obtained key for for service \"%s\" in %lld ms, from %s",

	     t->s_svcname, delay, ct->cs_cwc->cwc_hostname);

    ct->cs_keystate = CS_RESOLVED;

    memcpy(ct->cs_cw, msg + 3, 16);

    ct->cs_pending_cw_update = 1;

  }

}

/**

 * Handle running reply

 * cwc_mutex is held

 */

static int

cwc_running_reply(cwc_t *cwc, uint8_t msgtype, uint8_t *msg, int len)

{

  cwc_service_t *ct;

  ecm_pid_t *ep;

  ecm_section_t *es;

  uint16_t seq = (msg[2] << 8) | msg[3];

  int i;

  len -= 12;

  msg += 12;

  switch(msgtype) {

  case 0x80:

  case 0x81:

    LIST_FOREACH(ct, &cwc->cwc_services, cs_link) {

      LIST_FOREACH(ep, &ct->cs_pids, ep_link) {

	for(i = 0; i <= ep->ep_last_section; i++) {

	  es = ep->ep_sections[i];

	  if(es != NULL) {

	    if(es->es_seq == seq && es->es_pending) {

	      handle_ecm_reply(ct, es, msg, len, seq);

	      return 0;

	    }

	  }

	}

      }

    }

    tvhlog(LOG_WARNING, "cwc", "Got unexpected ECM reply (seqno: %d)", seq);

    break;

  }

  return 0;

}

/**

 *

 */

static int

cwc_must_break(cwc_t *cwc)