diff --git a/hs20/client/Android.mk b/hs20/client/Android.mk
index bb77341..a8ff6fc 100644
--- a/hs20/client/Android.mk
+++ b/hs20/client/Android.mk
@@ -30,10 +30,7 @@
 L_CFLAGS += -DCONFIG_CTRL_IFACE_UNIX
 L_CFLAGS += -DCONFIG_CTRL_IFACE_CLIENT_DIR=\"/data/misc/wifi/sockets\"
 
-OBJS = spp_client.c
-OBJS += oma_dm_client.c
-OBJS += osu_client.c
-OBJS += est.c
+OBJS = osu_client.c
 OBJS += ../../src/common/wpa_ctrl.c
 OBJS += ../../src/common/wpa_helpers.c
 OBJS += ../../src/utils/xml-utils.c
diff --git a/hs20/client/Makefile b/hs20/client/Makefile
index 4dcfe2d..9e65dc6 100644
--- a/hs20/client/Makefile
+++ b/hs20/client/Makefile
@@ -24,10 +24,7 @@
 endif
 endif
 
-OBJS=spp_client.o
-OBJS += oma_dm_client.o
-OBJS += osu_client.o
-OBJS += est.o
+OBJS = osu_client.o
 OBJS += ../../src/utils/xml-utils.o
 CFLAGS += -DCONFIG_CTRL_IFACE
 CFLAGS += -DCONFIG_CTRL_IFACE_UNIX
diff --git a/hs20/client/devdetail.xml b/hs20/client/devdetail.xml
deleted file mode 100644
index 6d0389e..0000000
--- a/hs20/client/devdetail.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-<DevDetail xmlns="urn:oma:mo:oma-dm-devdetail:1.0">
-	<Ext>
-		<org.wi-fi>
-			<Wi-Fi>
-				<EAPMethodList>
-					<EAPMethod1>
-						<EAPType>13</EAPType>
-					</EAPMethod1>
-					<EAPMethod2>
-						<EAPType>21</EAPType>
-						<InnerMethod>MS-CHAP-V2</InnerMethod>
-					</EAPMethod2>
-					<EAPMethod3>
-						<EAPType>18</EAPType>
-					</EAPMethod3>
-					<EAPMethod4>
-						<EAPType>23</EAPType>
-					</EAPMethod4>
-					<EAPMethod5>
-						<EAPType>50</EAPType>
-					</EAPMethod5>
-				</EAPMethodList>
-				<ManufacturingCertificate>false</ManufacturingCertificate>
-				<Wi-FiMACAddress>020102030405</Wi-FiMACAddress>
-				<IMSI>310026000000000</IMSI>
-				<IMEI_MEID>imei:490123456789012</IMEI_MEID>
-				<ClientTriggerRedirectURI>http://localhost:12345/</ClientTriggerRedirectURI>
-				<Ops>
-					<launchBrowserToURI></launchBrowserToURI>
-					<negotiateClientCertTLS></negotiateClientCertTLS>
-					<getCertificate></getCertificate>
-				</Ops>
-			</Wi-Fi>
-		</org.wi-fi>
-	</Ext>
-	<URI>
-		<MaxDepth>0</MaxDepth>
-		<MaxTotLen>0</MaxTotLen>
-		<MaxSegLen>0</MaxSegLen>
-	</URI>
-	<DevType>MobilePhone</DevType>
-	<OEM>Manufacturer</OEM>
-	<FwV>1.0</FwV>
-	<SwV>1.0</SwV>
-	<HwV>1.0</HwV>
-	<LrgObj>false</LrgObj>
-</DevDetail>
diff --git a/hs20/client/devinfo.xml b/hs20/client/devinfo.xml
deleted file mode 100644
index d48a520..0000000
--- a/hs20/client/devinfo.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-<DevInfo xmlns="urn:oma:mo:oma-dm-devinfo:1.0">
-	<DevId>urn:Example:HS20-station:123456</DevId>
-	<Man>Manufacturer</Man>
-	<Mod>HS20-station</Mod>
-	<DmV>1.2</DmV>
-	<Lang>en</Lang>
-</DevInfo>
diff --git a/hs20/client/est.c b/hs20/client/est.c
deleted file mode 100644
index 425b72d..0000000
--- a/hs20/client/est.c
+++ /dev/null
@@ -1,742 +0,0 @@
-/*
- * Hotspot 2.0 OSU client - EST client
- * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include "includes.h"
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-#include <openssl/pkcs7.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <openssl/opensslv.h>
-#include <openssl/buffer.h>
-
-#include "common.h"
-#include "utils/base64.h"
-#include "utils/xml-utils.h"
-#include "utils/http-utils.h"
-#include "osu_client.h"
-
-
-static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7,
-			 size_t len, char *pem_file, char *der_file)
-{
-#ifdef OPENSSL_IS_BORINGSSL
-	CBS pkcs7_cbs;
-#else /* OPENSSL_IS_BORINGSSL */
-	PKCS7 *p7 = NULL;
-	const unsigned char *p = pkcs7;
-#endif /* OPENSSL_IS_BORINGSSL */
-	STACK_OF(X509) *certs;
-	int i, num, ret = -1;
-	BIO *out = NULL;
-
-#ifdef OPENSSL_IS_BORINGSSL
-	certs = sk_X509_new_null();
-	if (!certs)
-		goto fail;
-	CBS_init(&pkcs7_cbs, pkcs7, len);
-	if (!PKCS7_get_certificates(certs, &pkcs7_cbs)) {
-		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
-			   ERR_error_string(ERR_get_error(), NULL));
-		write_result(ctx, "Could not parse PKCS#7 object from EST");
-		goto fail;
-	}
-#else /* OPENSSL_IS_BORINGSSL */
-	p7 = d2i_PKCS7(NULL, &p, len);
-	if (p7 == NULL) {
-		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
-			   ERR_error_string(ERR_get_error(), NULL));
-		write_result(ctx, "Could not parse PKCS#7 object from EST");
-		goto fail;
-	}
-
-	switch (OBJ_obj2nid(p7->type)) {
-	case NID_pkcs7_signed:
-		certs = p7->d.sign->cert;
-		break;
-	case NID_pkcs7_signedAndEnveloped:
-		certs = p7->d.signed_and_enveloped->cert;
-		break;
-	default:
-		certs = NULL;
-		break;
-	}
-#endif /* OPENSSL_IS_BORINGSSL */
-
-	if (!certs || ((num = sk_X509_num(certs)) == 0)) {
-		wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object");
-		write_result(ctx, "No certificates found in PKCS#7 object");
-		goto fail;
-	}
-
-	if (der_file) {
-		FILE *f = fopen(der_file, "wb");
-		if (f == NULL)
-			goto fail;
-		i2d_X509_fp(f, sk_X509_value(certs, 0));
-		fclose(f);
-	}
-
-	if (pem_file) {
-		out = BIO_new(BIO_s_file());
-		if (out == NULL ||
-		    BIO_write_filename(out, pem_file) <= 0)
-			goto fail;
-
-		for (i = 0; i < num; i++) {
-			X509 *cert = sk_X509_value(certs, i);
-			X509_print(out, cert);
-			PEM_write_bio_X509(out, cert);
-			BIO_puts(out, "\n");
-		}
-	}
-
-	ret = 0;
-
-fail:
-#ifdef OPENSSL_IS_BORINGSSL
-	if (certs)
-		sk_X509_pop_free(certs, X509_free);
-#else /* OPENSSL_IS_BORINGSSL */
-	PKCS7_free(p7);
-#endif /* OPENSSL_IS_BORINGSSL */
-	if (out)
-		BIO_free_all(out);
-
-	return ret;
-}
-
-
-int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
-{
-	char *buf, *resp;
-	size_t buflen;
-	unsigned char *pkcs7;
-	size_t pkcs7_len, resp_len;
-	int res;
-
-	buflen = os_strlen(url) + 100;
-	buf = os_malloc(buflen);
-	if (buf == NULL)
-		return -1;
-
-	os_snprintf(buf, buflen, "%s/cacerts", url);
-	wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
-	write_summary(ctx, "Download EST cacerts from %s", buf);
-	ctx->no_osu_cert_validation = 1;
-	http_ocsp_set(ctx->http, 1);
-	res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
-				 ctx->ca_fname);
-	http_ocsp_set(ctx->http,
-		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
-	ctx->no_osu_cert_validation = 0;
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
-			   buf);
-		write_result(ctx, "Failed to download EST cacerts from %s",
-			     buf);
-		os_free(buf);
-		return -1;
-	}
-	os_free(buf);
-
-	resp = os_readfile("Cert/est-cacerts.txt", &resp_len);
-	if (resp == NULL) {
-		wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt");
-		write_result(ctx, "Could not read EST cacerts");
-		return -1;
-	}
-
-	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
-	if (pkcs7 && pkcs7_len < resp_len / 2) {
-		wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary",
-			   (unsigned int) pkcs7_len, (unsigned int) resp_len);
-		os_free(pkcs7);
-		pkcs7 = NULL;
-	}
-	if (pkcs7 == NULL) {
-		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
-		pkcs7 = os_malloc(resp_len);
-		if (pkcs7) {
-			os_memcpy(pkcs7, resp, resp_len);
-			pkcs7_len = resp_len;
-		}
-	}
-	os_free(resp);
-
-	if (pkcs7 == NULL) {
-		wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts");
-		write_result(ctx, "Could not fetch EST PKCS#7 cacerts");
-		return -1;
-	}
-
-	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem",
-			    NULL);
-	os_free(pkcs7);
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response");
-		write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response");
-		return -1;
-	}
-	unlink("Cert/est-cacerts.txt");
-
-	return 0;
-}
-
-
-/*
- * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
- *
- * AttrOrOID ::= CHOICE {
- *   oid OBJECT IDENTIFIER,
- *   attribute Attribute }
- *
- * Attribute ::= SEQUENCE {
- *   type OBJECT IDENTIFIER,
- *   values SET SIZE(1..MAX) OF OBJECT IDENTIFIER }
- */
-
-typedef struct {
-	ASN1_OBJECT *type;
-	STACK_OF(ASN1_OBJECT) *values;
-} Attribute;
-
-typedef struct {
-	int type;
-	union {
-		ASN1_OBJECT *oid;
-		Attribute *attribute;
-	} d;
-} AttrOrOID;
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-DEFINE_STACK_OF(AttrOrOID)
-#endif
-
-typedef struct {
-	int type;
-	STACK_OF(AttrOrOID) *attrs;
-} CsrAttrs;
-
-ASN1_SEQUENCE(Attribute) = {
-	ASN1_SIMPLE(Attribute, type, ASN1_OBJECT),
-	ASN1_SET_OF(Attribute, values, ASN1_OBJECT)
-} ASN1_SEQUENCE_END(Attribute);
-
-ASN1_CHOICE(AttrOrOID) = {
-	ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT),
-	ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute)
-} ASN1_CHOICE_END(AttrOrOID);
-
-ASN1_CHOICE(CsrAttrs) = {
-	ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID)
-} ASN1_CHOICE_END(CsrAttrs);
-
-IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs);
-
-
-static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid,
-			     STACK_OF(X509_EXTENSION) *exts)
-{
-	char txt[100];
-	int res;
-
-	if (!oid)
-		return;
-
-	res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
-	if (res < 0 || res >= (int) sizeof(txt))
-		return;
-
-	if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) {
-		wpa_printf(MSG_INFO, "TODO: csrattr challengePassword");
-	} else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) {
-		wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption");
-	} else {
-		wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt);
-	}
-}
-
-
-static void add_csrattrs_ext_req(struct hs20_osu_client *ctx,
-				 STACK_OF(ASN1_OBJECT) *values,
-				 STACK_OF(X509_EXTENSION) *exts)
-{
-	char txt[100];
-	int i, num, res;
-
-	num = sk_ASN1_OBJECT_num(values);
-	for (i = 0; i < num; i++) {
-		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i);
-
-		res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
-		if (res < 0 || res >= (int) sizeof(txt))
-			continue;
-
-		if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) {
-			wpa_printf(MSG_INFO, "TODO: extReq macAddress");
-		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) {
-			wpa_printf(MSG_INFO, "TODO: extReq imei");
-		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) {
-			wpa_printf(MSG_INFO, "TODO: extReq meid");
-		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) {
-			wpa_printf(MSG_INFO, "TODO: extReq DevId");
-		} else {
-			wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s",
-				   txt);
-		}
-	}
-}
-
-
-static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr,
-			      STACK_OF(X509_EXTENSION) *exts)
-{
-	char txt[100], txt2[100];
-	int i, num, res;
-
-	if (!attr || !attr->type || !attr->values)
-		return;
-
-	res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1);
-	if (res < 0 || res >= (int) sizeof(txt))
-		return;
-
-	if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) {
-		add_csrattrs_ext_req(ctx, attr->values, exts);
-		return;
-	}
-
-	num = sk_ASN1_OBJECT_num(attr->values);
-	for (i = 0; i < num; i++) {
-		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i);
-
-		res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1);
-		if (res < 0 || res >= (int) sizeof(txt2))
-			continue;
-
-		wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s",
-			   txt, txt2);
-	}
-}
-
-
-static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs,
-			 STACK_OF(X509_EXTENSION) *exts)
-{
-	int i, num;
-
-	if (!csrattrs || ! csrattrs->attrs)
-		return;
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-	num = sk_AttrOrOID_num(csrattrs->attrs);
-#else
-	num = SKM_sk_num(AttrOrOID, csrattrs->attrs);
-#endif
-	for (i = 0; i < num; i++) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-		AttrOrOID *ao = sk_AttrOrOID_value(csrattrs->attrs, i);
-#else
-		AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i);
-#endif
-		switch (ao->type) {
-		case 0:
-			add_csrattrs_oid(ctx, ao->d.oid, exts);
-			break;
-		case 1:
-			add_csrattrs_attr(ctx, ao->d.attribute, exts);
-			break;
-		}
-	}
-}
-
-
-static int generate_csr(struct hs20_osu_client *ctx, char *key_pem,
-			char *csr_pem, char *est_req, char *old_cert,
-			CsrAttrs *csrattrs)
-{
-	EVP_PKEY_CTX *pctx = NULL;
-	EVP_PKEY *pkey = NULL;
-	X509_REQ *req = NULL;
-	int ret = -1;
-	unsigned int val;
-	X509_NAME *subj = NULL;
-	char name[100];
-	STACK_OF(X509_EXTENSION) *exts = NULL;
-	X509_EXTENSION *ex;
-	BIO *out;
-	CONF *ctmp = NULL;
-
-	wpa_printf(MSG_INFO, "Generate RSA private key");
-	write_summary(ctx, "Generate RSA private key");
-	pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
-	if (!pctx)
-		return -1;
-
-	if (EVP_PKEY_keygen_init(pctx) <= 0)
-		goto fail;
-
-	if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0)
-		goto fail;
-
-	if (EVP_PKEY_keygen(pctx, &pkey) <= 0)
-		goto fail;
-	EVP_PKEY_CTX_free(pctx);
-	pctx = NULL;
-
-	if (key_pem) {
-		FILE *f = fopen(key_pem, "wb");
-		if (f == NULL)
-			goto fail;
-		if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL)) {
-			wpa_printf(MSG_INFO, "Could not write private key: %s",
-				   ERR_error_string(ERR_get_error(), NULL));
-			fclose(f);
-			goto fail;
-		}
-		fclose(f);
-	}
-
-	wpa_printf(MSG_INFO, "Generate CSR");
-	write_summary(ctx, "Generate CSR");
-	req = X509_REQ_new();
-	if (req == NULL)
-		goto fail;
-
-	if (old_cert) {
-		FILE *f;
-		X509 *cert;
-		int res;
-
-		f = fopen(old_cert, "r");
-		if (f == NULL)
-			goto fail;
-		cert = PEM_read_X509(f, NULL, NULL, NULL);
-		fclose(f);
-
-		if (cert == NULL)
-			goto fail;
-		res = X509_REQ_set_subject_name(req,
-						X509_get_subject_name(cert));
-		X509_free(cert);
-		if (!res)
-			goto fail;
-	} else {
-		os_get_random((u8 *) &val, sizeof(val));
-		os_snprintf(name, sizeof(name), "cert-user-%u", val);
-		subj = X509_NAME_new();
-		if (subj == NULL ||
-		    !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC,
-						(unsigned char *) name,
-						-1, -1, 0) ||
-		    !X509_REQ_set_subject_name(req, subj))
-			goto fail;
-		X509_NAME_free(subj);
-		subj = NULL;
-	}
-
-	if (!X509_REQ_set_pubkey(req, pkey))
-		goto fail;
-
-	exts = sk_X509_EXTENSION_new_null();
-	if (!exts)
-		goto fail;
-
-	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_basic_constraints,
-				  "CA:FALSE");
-	if (ex == NULL ||
-	    !sk_X509_EXTENSION_push(exts, ex))
-		goto fail;
-
-	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_key_usage,
-				  "nonRepudiation,digitalSignature,keyEncipherment");
-	if (ex == NULL ||
-	    !sk_X509_EXTENSION_push(exts, ex))
-		goto fail;
-
-	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_ext_key_usage,
-				  "1.3.6.1.4.1.40808.1.1.2");
-	if (ex == NULL ||
-	    !sk_X509_EXTENSION_push(exts, ex))
-		goto fail;
-
-	add_csrattrs(ctx, csrattrs, exts);
-
-	if (!X509_REQ_add_extensions(req, exts))
-		goto fail;
-	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-	exts = NULL;
-
-	if (!X509_REQ_sign(req, pkey, EVP_sha256()))
-		goto fail;
-
-	out = BIO_new(BIO_s_mem());
-	if (out) {
-		char *txt;
-		size_t rlen;
-
-#if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
-		X509_REQ_print(out, req);
-#endif
-		rlen = BIO_ctrl_pending(out);
-		txt = os_malloc(rlen + 1);
-		if (txt) {
-			int res = BIO_read(out, txt, rlen);
-			if (res > 0) {
-				txt[res] = '\0';
-				wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s",
-					   txt);
-			}
-			os_free(txt);
-		}
-		BIO_free(out);
-	}
-
-	if (csr_pem) {
-		FILE *f = fopen(csr_pem, "w");
-		if (f == NULL)
-			goto fail;
-#if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
-		X509_REQ_print_fp(f, req);
-#endif
-		if (!PEM_write_X509_REQ(f, req)) {
-			fclose(f);
-			goto fail;
-		}
-		fclose(f);
-	}
-
-	if (est_req) {
-		BIO *mem = BIO_new(BIO_s_mem());
-		BUF_MEM *ptr;
-		char *pos, *end, *buf_end;
-		FILE *f;
-
-		if (mem == NULL)
-			goto fail;
-		if (!PEM_write_bio_X509_REQ(mem, req)) {
-			BIO_free(mem);
-			goto fail;
-		}
-
-		BIO_get_mem_ptr(mem, &ptr);
-		pos = ptr->data;
-		buf_end = pos + ptr->length;
-
-		/* Remove START/END lines */
-		while (pos < buf_end && *pos != '\n')
-			pos++;
-		if (pos == buf_end) {
-			BIO_free(mem);
-			goto fail;
-		}
-		pos++;
-
-		end = pos;
-		while (end < buf_end && *end != '-')
-			end++;
-
-		f = fopen(est_req, "w");
-		if (f == NULL) {
-			BIO_free(mem);
-			goto fail;
-		}
-		fwrite(pos, end - pos, 1, f);
-		fclose(f);
-
-		BIO_free(mem);
-	}
-
-	ret = 0;
-fail:
-	if (exts)
-		sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-	if (subj)
-		X509_NAME_free(subj);
-	if (req)
-		X509_REQ_free(req);
-	if (pkey)
-		EVP_PKEY_free(pkey);
-	if (pctx)
-		EVP_PKEY_CTX_free(pctx);
-	return ret;
-}
-
-
-int est_build_csr(struct hs20_osu_client *ctx, const char *url)
-{
-	char *buf;
-	size_t buflen;
-	int res;
-	char old_cert_buf[200];
-	char *old_cert = NULL;
-	CsrAttrs *csrattrs = NULL;
-
-	buflen = os_strlen(url) + 100;
-	buf = os_malloc(buflen);
-	if (buf == NULL)
-		return -1;
-
-	os_snprintf(buf, buflen, "%s/csrattrs", url);
-	wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
-	write_summary(ctx, "Download EST csrattrs from %s", buf);
-	ctx->no_osu_cert_validation = 1;
-	http_ocsp_set(ctx->http, 1);
-	res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
-				 ctx->ca_fname);
-	http_ocsp_set(ctx->http,
-		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
-	ctx->no_osu_cert_validation = 0;
-	os_free(buf);
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
-	} else {
-		size_t resp_len;
-		char *resp;
-		unsigned char *attrs;
-		const unsigned char *pos;
-		size_t attrs_len;
-
-		resp = os_readfile("Cert/est-csrattrs.txt", &resp_len);
-		if (resp == NULL) {
-			wpa_printf(MSG_INFO, "Could not read csrattrs");
-			return -1;
-		}
-
-		attrs = base64_decode(resp, resp_len, &attrs_len);
-		os_free(resp);
-
-		if (attrs == NULL) {
-			wpa_printf(MSG_INFO, "Could not base64 decode csrattrs");
-			return -1;
-		}
-		unlink("Cert/est-csrattrs.txt");
-
-		pos = attrs;
-		csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len);
-		os_free(attrs);
-		if (csrattrs == NULL) {
-			wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1");
-			/* Continue assuming no additional requirements */
-		}
-	}
-
-	if (ctx->client_cert_present) {
-		os_snprintf(old_cert_buf, sizeof(old_cert_buf),
-			    "SP/%s/client-cert.pem", ctx->fqdn);
-		old_cert = old_cert_buf;
-	}
-
-	res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem",
-			   "Cert/est-req.b64", old_cert, csrattrs);
-	if (csrattrs)
-		CsrAttrs_free(csrattrs);
-
-	return res;
-}
-
-
-int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
-		      const char *user, const char *pw)
-{
-	char *buf, *resp, *req, *req2;
-	size_t buflen, resp_len, len, pkcs7_len;
-	unsigned char *pkcs7;
-	char client_cert_buf[200];
-	char client_key_buf[200];
-	const char *client_cert = NULL, *client_key = NULL;
-	int res;
-
-	req = os_readfile("Cert/est-req.b64", &len);
-	if (req == NULL) {
-		wpa_printf(MSG_INFO, "Could not read Cert/req.b64");
-		return -1;
-	}
-	req2 = os_realloc(req, len + 1);
-	if (req2 == NULL) {
-		os_free(req);
-		return -1;
-	}
-	req2[len] = '\0';
-	req = req2;
-	wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req);
-
-	buflen = os_strlen(url) + 100;
-	buf = os_malloc(buflen);
-	if (buf == NULL) {
-		os_free(req);
-		return -1;
-	}
-
-	if (ctx->client_cert_present) {
-		os_snprintf(buf, buflen, "%s/simplereenroll", url);
-		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
-			    "SP/%s/client-cert.pem", ctx->fqdn);
-		client_cert = client_cert_buf;
-		os_snprintf(client_key_buf, sizeof(client_key_buf),
-			    "SP/%s/client-key.pem", ctx->fqdn);
-		client_key = client_key_buf;
-	} else
-		os_snprintf(buf, buflen, "%s/simpleenroll", url);
-	wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
-	write_summary(ctx, "EST simpleenroll URL: %s", buf);
-	ctx->no_osu_cert_validation = 1;
-	http_ocsp_set(ctx->http, 1);
-	resp = http_post(ctx->http, buf, req, "application/pkcs10",
-			 "Content-Transfer-Encoding: base64",
-			 ctx->ca_fname, user, pw, client_cert, client_key,
-			 &resp_len);
-	http_ocsp_set(ctx->http,
-		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
-	ctx->no_osu_cert_validation = 0;
-	os_free(buf);
-	if (resp == NULL) {
-		wpa_printf(MSG_INFO, "EST certificate enrollment failed");
-		write_result(ctx, "EST certificate enrollment failed");
-		return -1;
-	}
-	wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp);
-
-	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
-	if (pkcs7 == NULL) {
-		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
-		pkcs7 = os_malloc(resp_len);
-		if (pkcs7) {
-			os_memcpy(pkcs7, resp, resp_len);
-			pkcs7_len = resp_len;
-		}
-	}
-	os_free(resp);
-
-	if (pkcs7 == NULL) {
-		wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response");
-		write_result(ctx, "Failed to parse EST simpleenroll base64 response");
-		return -1;
-	}
-
-	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem",
-			    "Cert/est_cert.der");
-	os_free(pkcs7);
-
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file");
-		write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "EST simple%senroll completed successfully",
-		   ctx->client_cert_present ? "re" : "");
-	write_summary(ctx, "EST simple%senroll completed successfully",
-		      ctx->client_cert_present ? "re" : "");
-
-	return 0;
-}
diff --git a/hs20/client/oma_dm_client.c b/hs20/client/oma_dm_client.c
deleted file mode 100644
index bcd68b8..0000000
--- a/hs20/client/oma_dm_client.c
+++ /dev/null
@@ -1,1398 +0,0 @@
-/*
- * Hotspot 2.0 - OMA DM client
- * Copyright (c) 2013-2014, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include "includes.h"
-
-#include "common.h"
-#include "wpa_helpers.h"
-#include "xml-utils.h"
-#include "http-utils.h"
-#include "utils/browser.h"
-#include "osu_client.h"
-
-
-#define DM_SERVER_INITIATED_MGMT 1200
-#define DM_CLIENT_INITIATED_MGMT 1201
-#define DM_GENERIC_ALERT 1226
-
-/* OMA-TS-SyncML-RepPro-V1_2_2 - 10. Response Status Codes */
-#define DM_RESP_OK 200
-#define DM_RESP_AUTH_ACCEPTED 212
-#define DM_RESP_CHUNKED_ITEM_ACCEPTED 213
-#define DM_RESP_NOT_EXECUTED 215
-#define DM_RESP_ATOMIC_ROLL_BACK_OK 216
-#define DM_RESP_NOT_MODIFIED 304
-#define DM_RESP_BAD_REQUEST 400
-#define DM_RESP_UNAUTHORIZED 401
-#define DM_RESP_FORBIDDEN 403
-#define DM_RESP_NOT_FOUND 404
-#define DM_RESP_COMMAND_NOT_ALLOWED 405
-#define DM_RESP_OPTIONAL_FEATURE_NOT_SUPPORTED 406
-#define DM_RESP_MISSING_CREDENTIALS 407
-#define DM_RESP_CONFLICT 409
-#define DM_RESP_GONE 410
-#define DM_RESP_INCOMPLETE_COMMAND 412
-#define DM_RESP_REQ_ENTITY_TOO_LARGE 413
-#define DM_RESP_URI_TOO_LONG 414
-#define DM_RESP_UNSUPPORTED_MEDIA_TYPE_OR_FORMAT 415
-#define DM_RESP_REQ_TOO_BIG 416
-#define DM_RESP_ALREADY_EXISTS 418
-#define DM_RESP_DEVICE_FULL 420
-#define DM_RESP_SIZE_MISMATCH 424
-#define DM_RESP_PERMISSION_DENIED 425
-#define DM_RESP_COMMAND_FAILED 500
-#define DM_RESP_COMMAND_NOT_IMPLEMENTED 501
-#define DM_RESP_ATOMIC_ROLL_BACK_FAILED 516
-
-#define DM_HS20_SUBSCRIPTION_CREATION \
-	"org.wi-fi.hotspot2dot0.SubscriptionCreation"
-#define DM_HS20_SUBSCRIPTION_PROVISIONING \
-	"org.wi-fi.hotspot2dot0.SubscriptionProvisioning"
-#define DM_HS20_SUBSCRIPTION_REMEDIATION \
-	"org.wi-fi.hotspot2dot0.SubscriptionRemediation"
-#define DM_HS20_POLICY_UPDATE \
-	"org.wi-fi.hotspot2dot0.PolicyUpdate"
-
-#define DM_URI_PPS "./Wi-Fi/org.wi-fi/PerProviderSubscription"
-#define DM_URI_LAUNCH_BROWSER \
-	"./DevDetail/Ext/org.wi-fi/Wi-Fi/Ops/launchBrowserToURI"
-
-
-static void add_item(struct hs20_osu_client *ctx, xml_node_t *parent,
-		     const char *locuri, const char *data);
-
-
-static const char * int2str(int val)
-{
-	static char buf[20];
-	snprintf(buf, sizeof(buf), "%d", val);
-	return buf;
-}
-
-
-static char * oma_dm_get_target_locuri(struct hs20_osu_client *ctx,
-				       xml_node_t *node)
-{
-	xml_node_t *locuri;
-	char *uri, *ret = NULL;
-
-	locuri = get_node(ctx->xml, node, "Item/Target/LocURI");
-	if (locuri == NULL)
-		return NULL;
-
-	uri = xml_node_get_text(ctx->xml, locuri);
-	if (uri)
-		ret = os_strdup(uri);
-	xml_node_get_text_free(ctx->xml, uri);
-	return ret;
-}
-
-
-static void oma_dm_add_locuri(struct hs20_osu_client *ctx, xml_node_t *parent,
-			      const char *element, const char *uri)
-{
-	xml_node_t *node;
-
-	node = xml_node_create(ctx->xml, parent, NULL, element);
-	if (node == NULL)
-		return;
-	xml_node_create_text(ctx->xml, node, NULL, "LocURI", uri);
-}
-
-
-static xml_node_t * oma_dm_build_hdr(struct hs20_osu_client *ctx,
-				     const char *url, int msgid)
-{
-	xml_node_t *syncml, *synchdr;
-	xml_namespace_t *ns;
-
-	if (!ctx->devid) {
-		wpa_printf(MSG_ERROR,
-			   "DevId from devinfo.xml is not available - cannot use OMA DM");
-		return NULL;
-	}
-
-	syncml = xml_node_create_root(ctx->xml, "SYNCML:SYNCML1.2", NULL, &ns,
-				      "SyncML");
-
-	synchdr = xml_node_create(ctx->xml, syncml, NULL, "SyncHdr");
-	xml_node_create_text(ctx->xml, synchdr, NULL, "VerDTD", "1.2");
-	xml_node_create_text(ctx->xml, synchdr, NULL, "VerProto", "DM/1.2");
-	xml_node_create_text(ctx->xml, synchdr, NULL, "SessionID", "1");
-	xml_node_create_text(ctx->xml, synchdr, NULL, "MsgID", int2str(msgid));
-
-	oma_dm_add_locuri(ctx, synchdr, "Target", url);
-	oma_dm_add_locuri(ctx, synchdr, "Source", ctx->devid);
-
-	return syncml;
-}
-
-
-static void oma_dm_add_cmdid(struct hs20_osu_client *ctx, xml_node_t *parent,
-			     int cmdid)
-{
-	xml_node_create_text(ctx->xml, parent, NULL, "CmdID", int2str(cmdid));
-}
-
-
-static xml_node_t * add_alert(struct hs20_osu_client *ctx, xml_node_t *parent,
-			      int cmdid, int data)
-{
-	xml_node_t *node;
-
-	node = xml_node_create(ctx->xml, parent, NULL, "Alert");
-	if (node == NULL)
-		return NULL;
-	oma_dm_add_cmdid(ctx, node, cmdid);
-	xml_node_create_text(ctx->xml, node, NULL, "Data", int2str(data));
-
-	return node;
-}
-
-
-static xml_node_t * add_status(struct hs20_osu_client *ctx, xml_node_t *parent,
-			       int msgref, int cmdref, int cmdid,
-			       const char *cmd, int data, const char *targetref)
-{
-	xml_node_t *node;
-
-	node = xml_node_create(ctx->xml, parent, NULL, "Status");
-	if (node == NULL)
-		return NULL;
-	oma_dm_add_cmdid(ctx, node, cmdid);
-	xml_node_create_text(ctx->xml, node, NULL, "MsgRef", int2str(msgref));
-	if (cmdref)
-		xml_node_create_text(ctx->xml, node, NULL, "CmdRef",
-				     int2str(cmdref));
-	xml_node_create_text(ctx->xml, node, NULL, "Cmd", cmd);
-	xml_node_create_text(ctx->xml, node, NULL, "Data", int2str(data));
-	if (targetref) {
-		xml_node_create_text(ctx->xml, node, NULL, "TargetRef",
-				     targetref);
-	}
-
-	return node;
-}
-
-
-static xml_node_t * add_results(struct hs20_osu_client *ctx, xml_node_t *parent,
-				int msgref, int cmdref, int cmdid,
-				const char *locuri, const char *data)
-{
-	xml_node_t *node;
-
-	node = xml_node_create(ctx->xml, parent, NULL, "Results");
-	if (node == NULL)
-		return NULL;
-
-	oma_dm_add_cmdid(ctx, node, cmdid);
-	xml_node_create_text(ctx->xml, node, NULL, "MsgRef", int2str(msgref));
-	xml_node_create_text(ctx->xml, node, NULL, "CmdRef", int2str(cmdref));
-	add_item(ctx, node, locuri, data);
-
-	return node;
-}
-
-
-static char * mo_str(struct hs20_osu_client *ctx, const char *urn,
-		     const char *fname)
-{
-	xml_node_t *fnode, *tnds;
-	char *str;
-
-	fnode = node_from_file(ctx->xml, fname);
-	if (!fnode)
-		return NULL;
-	tnds = mo_to_tnds(ctx->xml, fnode, 0, urn, "syncml:dmddf1.2");
-	xml_node_free(ctx->xml, fnode);
-	if (!tnds)
-		return NULL;
-
-	str = xml_node_to_str(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (str == NULL)
-		return NULL;
-	wpa_printf(MSG_INFO, "MgmtTree: %s", str);
-
-	return str;
-}
-
-
-static void add_item(struct hs20_osu_client *ctx, xml_node_t *parent,
-		     const char *locuri, const char *data)
-{
-	xml_node_t *item, *node;
-
-	item = xml_node_create(ctx->xml, parent, NULL, "Item");
-	oma_dm_add_locuri(ctx, item, "Source", locuri);
-	node = xml_node_create(ctx->xml, item, NULL, "Meta");
-	xml_node_create_text_ns(ctx->xml, node, "syncml:metinf", "Format",
-				"Chr");
-	xml_node_create_text_ns(ctx->xml, node, "syncml:metinf", "Type",
-				"text/plain");
-	xml_node_create_text(ctx->xml, item, NULL, "Data", data);
-}
-
-
-static void add_replace_devinfo(struct hs20_osu_client *ctx, xml_node_t *parent,
-				int cmdid)
-{
-	xml_node_t *info, *child, *replace;
-	const char *name;
-	char locuri[200], *txt;
-
-	info = node_from_file(ctx->xml, "devinfo.xml");
-	if (info == NULL) {
-		wpa_printf(MSG_INFO, "Could not read devinfo.xml");
-		return;
-	}
-
-	replace = xml_node_create(ctx->xml, parent, NULL, "Replace");
-	if (replace == NULL) {
-		xml_node_free(ctx->xml, info);
-		return;
-	}
-	oma_dm_add_cmdid(ctx, replace, cmdid);
-
-	xml_node_for_each_child(ctx->xml, child, info) {
-		xml_node_for_each_check(ctx->xml, child);
-		name = xml_node_get_localname(ctx->xml, child);
-		os_snprintf(locuri, sizeof(locuri), "./DevInfo/%s", name);
-		txt = xml_node_get_text(ctx->xml, child);
-		if (txt) {
-			add_item(ctx, replace, locuri, txt);
-			xml_node_get_text_free(ctx->xml, txt);
-		}
-	}
-
-	xml_node_free(ctx->xml, info);
-}
-
-
-static void oma_dm_add_hs20_generic_alert(struct hs20_osu_client *ctx,
-					  xml_node_t *syncbody,
-					  int cmdid, const char *oper,
-					  const char *data)
-{
-	xml_node_t *node, *item;
-	char buf[200];
-
-	node = add_alert(ctx, syncbody, cmdid, DM_GENERIC_ALERT);
-
-	item = xml_node_create(ctx->xml, node, NULL, "Item");
-	oma_dm_add_locuri(ctx, item, "Source", DM_URI_PPS);
-	node = xml_node_create(ctx->xml, item, NULL, "Meta");
-	snprintf(buf, sizeof(buf), "Reversed-Domain-Name: %s", oper);
-	xml_node_create_text_ns(ctx->xml, node, "syncml:metinf", "Type", buf);
-	xml_node_create_text_ns(ctx->xml, node, "syncml:metinf", "Format",
-				"xml");
-	xml_node_create_text(ctx->xml, item, NULL, "Data", data);
-}
-
-
-static xml_node_t * build_oma_dm_1(struct hs20_osu_client *ctx,
-				   const char *url, int msgid, const char *oper)
-{
-	xml_node_t *syncml, *syncbody;
-	char *str;
-	int cmdid = 0;
-
-	syncml = oma_dm_build_hdr(ctx, url, msgid);
-	if (syncml == NULL)
-		return NULL;
-
-	syncbody = xml_node_create(ctx->xml, syncml, NULL, "SyncBody");
-	if (syncbody == NULL) {
-		xml_node_free(ctx->xml, syncml);
-		return NULL;
-	}
-
-	cmdid++;
-	add_alert(ctx, syncbody, cmdid, DM_CLIENT_INITIATED_MGMT);
-
-	str = mo_str(ctx, NULL, "devdetail.xml");
-	if (str == NULL) {
-		xml_node_free(ctx->xml, syncml);
-		return NULL;
-	}
-	cmdid++;
-	oma_dm_add_hs20_generic_alert(ctx, syncbody, cmdid, oper, str);
-	os_free(str);
-
-	cmdid++;
-	add_replace_devinfo(ctx, syncbody, cmdid);
-
-	xml_node_create(ctx->xml, syncbody, NULL, "Final");
-
-	return syncml;
-}
-
-
-static xml_node_t * build_oma_dm_1_sub_reg(struct hs20_osu_client *ctx,
-					   const char *url, int msgid)
-{
-	xml_node_t *syncml;
-
-	syncml = build_oma_dm_1(ctx, url, msgid, DM_HS20_SUBSCRIPTION_CREATION);
-	if (syncml)
-		debug_dump_node(ctx, "OMA-DM Package 1 (sub reg)", syncml);
-
-	return syncml;
-}
-
-
-static xml_node_t * build_oma_dm_1_sub_prov(struct hs20_osu_client *ctx,
-					    const char *url, int msgid)
-{
-	xml_node_t *syncml;
-
-	syncml = build_oma_dm_1(ctx, url, msgid,
-				DM_HS20_SUBSCRIPTION_PROVISIONING);
-	if (syncml)
-		debug_dump_node(ctx, "OMA-DM Package 1 (sub prov)", syncml);
-
-	return syncml;
-}
-
-
-static xml_node_t * build_oma_dm_1_pol_upd(struct hs20_osu_client *ctx,
-					   const char *url, int msgid)
-{
-	xml_node_t *syncml;
-
-	syncml = build_oma_dm_1(ctx, url, msgid, DM_HS20_POLICY_UPDATE);
-	if (syncml)
-		debug_dump_node(ctx, "OMA-DM Package 1 (pol upd)", syncml);
-
-	return syncml;
-}
-
-
-static xml_node_t * build_oma_dm_1_sub_rem(struct hs20_osu_client *ctx,
-					   const char *url, int msgid)
-{
-	xml_node_t *syncml;
-
-	syncml = build_oma_dm_1(ctx, url, msgid,
-				DM_HS20_SUBSCRIPTION_REMEDIATION);
-	if (syncml)
-		debug_dump_node(ctx, "OMA-DM Package 1 (sub rem)", syncml);
-
-	return syncml;
-}
-
-
-static int oma_dm_exec_browser(struct hs20_osu_client *ctx, xml_node_t *exec)
-{
-	xml_node_t *node;
-	char *data;
-	int res;
-
-	node = get_node(ctx->xml, exec, "Item/Data");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Data node found");
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	data = xml_node_get_text(ctx->xml, node);
-	if (data == NULL) {
-		wpa_printf(MSG_INFO, "Invalid data");
-		return DM_RESP_BAD_REQUEST;
-	}
-	wpa_printf(MSG_INFO, "Data: %s", data);
-	wpa_printf(MSG_INFO, "Launch browser to URI '%s'", data);
-	write_summary(ctx, "Launch browser to URI '%s'", data);
-	res = hs20_web_browser(data, 1);
-	xml_node_get_text_free(ctx->xml, data);
-	if (res > 0) {
-		wpa_printf(MSG_INFO, "User response in browser completed successfully");
-		write_summary(ctx, "User response in browser completed successfully");
-		return DM_RESP_OK;
-	} else {
-		wpa_printf(MSG_INFO, "Failed to receive user response");
-		write_summary(ctx, "Failed to receive user response");
-		return DM_RESP_COMMAND_FAILED;
-	}
-}
-
-
-static int oma_dm_exec_get_cert(struct hs20_osu_client *ctx, xml_node_t *exec)
-{
-	xml_node_t *node, *getcert;
-	char *data;
-	const char *name;
-	int res;
-
-	wpa_printf(MSG_INFO, "Client certificate enrollment");
-	write_summary(ctx, "Client certificate enrollment");
-
-	node = get_node(ctx->xml, exec, "Item/Data");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Data node found");
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	data = xml_node_get_text(ctx->xml, node);
-	if (data == NULL) {
-		wpa_printf(MSG_INFO, "Invalid data");
-		return DM_RESP_BAD_REQUEST;
-	}
-	wpa_printf(MSG_INFO, "Data: %s", data);
-	getcert = xml_node_from_buf(ctx->xml, data);
-	xml_node_get_text_free(ctx->xml, data);
-
-	if (getcert == NULL) {
-		wpa_printf(MSG_INFO, "Could not parse Item/Data node contents");
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	debug_dump_node(ctx, "OMA-DM getCertificate", getcert);
-
-	name = xml_node_get_localname(ctx->xml, getcert);
-	if (name == NULL || os_strcasecmp(name, "getCertificate") != 0) {
-		wpa_printf(MSG_INFO, "Unexpected getCertificate node name '%s'",
-			   name);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	res = osu_get_certificate(ctx, getcert);
-
-	xml_node_free(ctx->xml, getcert);
-
-	return res == 0 ? DM_RESP_OK : DM_RESP_COMMAND_FAILED;
-}
-
-
-static int oma_dm_exec(struct hs20_osu_client *ctx, xml_node_t *exec)
-{
-	char *locuri;
-	int ret;
-
-	locuri = oma_dm_get_target_locuri(ctx, exec);
-	if (locuri == NULL) {
-		wpa_printf(MSG_INFO, "No Target LocURI node found");
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	wpa_printf(MSG_INFO, "Target LocURI: %s", locuri);
-
-	if (os_strcasecmp(locuri, "./DevDetail/Ext/org.wi-fi/Wi-Fi/Ops/"
-			  "launchBrowserToURI") == 0) {
-		ret = oma_dm_exec_browser(ctx, exec);
-	} else if (os_strcasecmp(locuri, "./DevDetail/Ext/org.wi-fi/Wi-Fi/Ops/"
-			  "getCertificate") == 0) {
-		ret = oma_dm_exec_get_cert(ctx, exec);
-	} else {
-		wpa_printf(MSG_INFO, "Unsupported exec Target LocURI");
-		ret = DM_RESP_NOT_FOUND;
-	}
-	os_free(locuri);
-
-	return ret;
-}
-
-
-static int oma_dm_run_add(struct hs20_osu_client *ctx, const char *locuri,
-			  xml_node_t *add, xml_node_t *pps,
-			  const char *pps_fname)
-{
-	const char *pos;
-	size_t fqdn_len;
-	xml_node_t *node, *tnds, *unode, *pps_node;
-	char *data, *uri, *upos, *end;
-	int use_tnds = 0;
-	size_t uri_len;
-
-	wpa_printf(MSG_INFO, "Add command target LocURI: %s", locuri);
-
-	if (os_strncasecmp(locuri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Do not allow Add outside ./Wi-Fi");
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos = locuri + 8;
-
-	if (ctx->fqdn == NULL)
-		return DM_RESP_COMMAND_FAILED;
-	fqdn_len = os_strlen(ctx->fqdn);
-	if (os_strncasecmp(pos, ctx->fqdn, fqdn_len) != 0 ||
-	    pos[fqdn_len] != '/') {
-		wpa_printf(MSG_INFO, "Do not allow Add outside ./Wi-Fi/%s",
-			   ctx->fqdn);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += fqdn_len + 1;
-
-	if (os_strncasecmp(pos, "PerProviderSubscription/", 24) != 0) {
-		wpa_printf(MSG_INFO,
-			   "Do not allow Add outside ./Wi-Fi/%s/PerProviderSubscription",
-			   ctx->fqdn);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += 24;
-
-	wpa_printf(MSG_INFO, "Add command for PPS node %s", pos);
-
-	pps_node = get_node(ctx->xml, pps, pos);
-	if (pps_node) {
-		wpa_printf(MSG_INFO, "Specified PPS node exists already");
-		return DM_RESP_ALREADY_EXISTS;
-	}
-
-	uri = os_strdup(pos);
-	if (uri == NULL)
-		return DM_RESP_COMMAND_FAILED;
-	while (!pps_node) {
-		upos = os_strrchr(uri, '/');
-		if (!upos)
-			break;
-		upos[0] = '\0';
-		pps_node = get_node(ctx->xml, pps, uri);
-		wpa_printf(MSG_INFO, "Node %s %s", uri,
-			   pps_node ? "exists" : "does not exist");
-	}
-
-	wpa_printf(MSG_INFO, "Parent URI: %s", uri);
-
-	if (!pps_node) {
-		/* Add at root of PPS MO */
-		pps_node = pps;
-	}
-
-	uri_len = os_strlen(uri);
-	os_strlcpy(uri, pos + uri_len, os_strlen(pos));
-	upos = uri;
-	while (*upos == '/')
-		upos++;
-	wpa_printf(MSG_INFO, "Nodes to add: %s", upos);
-
-	for (;;) {
-		end = os_strchr(upos, '/');
-		if (!end)
-			break;
-		*end = '\0';
-		wpa_printf(MSG_INFO, "Adding interim node %s", upos);
-		pps_node = xml_node_create(ctx->xml, pps_node, NULL, upos);
-		if (pps_node == NULL) {
-			os_free(uri);
-			return DM_RESP_COMMAND_FAILED;
-		}
-		upos = end + 1;
-	}
-
-	wpa_printf(MSG_INFO, "Adding node %s", upos);
-
-	node = get_node(ctx->xml, add, "Item/Meta/Type");
-	if (node) {
-		char *type;
-		type = xml_node_get_text(ctx->xml, node);
-		if (type == NULL) {
-			wpa_printf(MSG_ERROR, "Could not find type text");
-			os_free(uri);
-			return DM_RESP_BAD_REQUEST;
-		}
-		use_tnds = node &&
-			os_strstr(type, "application/vnd.syncml.dmtnds+xml");
-	}
-
-	node = get_node(ctx->xml, add, "Item/Data");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Add/Item/Data found");
-		os_free(uri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	data = xml_node_get_text(ctx->xml, node);
-	if (data == NULL) {
-		wpa_printf(MSG_INFO, "Could not get Add/Item/Data text");
-		os_free(uri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	wpa_printf(MSG_DEBUG, "Add/Item/Data: %s", data);
-
-	if (use_tnds) {
-		tnds = xml_node_from_buf(ctx->xml, data);
-		xml_node_get_text_free(ctx->xml, data);
-		if (tnds == NULL) {
-			wpa_printf(MSG_INFO,
-				   "Could not parse Add/Item/Data text");
-			os_free(uri);
-			return DM_RESP_BAD_REQUEST;
-		}
-
-		unode = tnds_to_mo(ctx->xml, tnds);
-		xml_node_free(ctx->xml, tnds);
-		if (unode == NULL) {
-			wpa_printf(MSG_INFO, "Could not parse TNDS text");
-			os_free(uri);
-			return DM_RESP_BAD_REQUEST;
-		}
-
-		debug_dump_node(ctx, "Parsed TNDS", unode);
-
-		xml_node_add_child(ctx->xml, pps_node, unode);
-	} else {
-		/* TODO: What to do here? */
-		os_free(uri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	os_free(uri);
-
-	if (update_pps_file(ctx, pps_fname, pps) < 0)
-		return DM_RESP_COMMAND_FAILED;
-
-	ctx->pps_updated = 1;
-
-	return DM_RESP_OK;
-}
-
-
-static int oma_dm_add(struct hs20_osu_client *ctx, xml_node_t *add,
-		      xml_node_t *pps, const char *pps_fname)
-{
-	xml_node_t *node;
-	char *locuri;
-	char fname[300];
-	int ret;
-
-	node = get_node(ctx->xml, add, "Item/Target/LocURI");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Target LocURI node found");
-		return DM_RESP_BAD_REQUEST;
-	}
-	locuri = xml_node_get_text(ctx->xml, node);
-	if (locuri == NULL) {
-		wpa_printf(MSG_ERROR, "No LocURI node text found");
-		return DM_RESP_BAD_REQUEST;
-	}
-	wpa_printf(MSG_INFO, "Target LocURI: %s", locuri);
-	if (os_strncasecmp(locuri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Unsupported Add Target LocURI");
-		xml_node_get_text_free(ctx->xml, locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-
-	node = get_node(ctx->xml, add, "Item/Data");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Data node found");
-		xml_node_get_text_free(ctx->xml, locuri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	if (pps_fname && os_file_exists(pps_fname)) {
-		ret = oma_dm_run_add(ctx, locuri, add, pps, pps_fname);
-		if (ret != DM_RESP_OK) {
-			xml_node_get_text_free(ctx->xml, locuri);
-			return ret;
-		}
-		ret = 0;
-		os_strlcpy(fname, pps_fname, sizeof(fname));
-	} else
-		ret = hs20_add_pps_mo(ctx, locuri, node, fname, sizeof(fname));
-	xml_node_get_text_free(ctx->xml, locuri);
-	if (ret < 0)
-		return ret == -2 ? DM_RESP_ALREADY_EXISTS :
-			DM_RESP_COMMAND_FAILED;
-
-	if (ctx->no_reconnect == 2) {
-		os_snprintf(ctx->pps_fname, sizeof(ctx->pps_fname), "%s",
-			    fname);
-		ctx->pps_cred_set = 1;
-		return DM_RESP_OK;
-	}
-
-	wpa_printf(MSG_INFO, "Updating wpa_supplicant credentials");
-	cmd_set_pps(ctx, fname);
-
-	if (ctx->no_reconnect)
-		return DM_RESP_OK;
-
-	wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
-	if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0)
-		wpa_printf(MSG_INFO, "Failed to request wpa_supplicant to reconnect");
-
-	return DM_RESP_OK;
-}
-
-
-static int oma_dm_replace(struct hs20_osu_client *ctx, xml_node_t *replace,
-			  xml_node_t *pps, const char *pps_fname)
-{
-	char *locuri, *pos;
-	size_t fqdn_len;
-	xml_node_t *node, *tnds, *unode, *pps_node, *parent;
-	char *data;
-	int use_tnds = 0;
-
-	locuri = oma_dm_get_target_locuri(ctx, replace);
-	if (locuri == NULL)
-		return DM_RESP_BAD_REQUEST;
-
-	wpa_printf(MSG_INFO, "Replace command target LocURI: %s", locuri);
-	if (os_strncasecmp(locuri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Do not allow Replace outside ./Wi-Fi");
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos = locuri + 8;
-
-	if (ctx->fqdn == NULL) {
-		os_free(locuri);
-		return DM_RESP_COMMAND_FAILED;
-	}
-	fqdn_len = os_strlen(ctx->fqdn);
-	if (os_strncasecmp(pos, ctx->fqdn, fqdn_len) != 0 ||
-	    pos[fqdn_len] != '/') {
-		wpa_printf(MSG_INFO, "Do not allow Replace outside ./Wi-Fi/%s",
-			   ctx->fqdn);
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += fqdn_len + 1;
-
-	if (os_strncasecmp(pos, "PerProviderSubscription/", 24) != 0) {
-		wpa_printf(MSG_INFO,
-			   "Do not allow Replace outside ./Wi-Fi/%s/PerProviderSubscription",
-			   ctx->fqdn);
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += 24;
-
-	wpa_printf(MSG_INFO, "Replace command for PPS node %s", pos);
-
-	pps_node = get_node(ctx->xml, pps, pos);
-	if (pps_node == NULL) {
-		wpa_printf(MSG_INFO, "Specified PPS node not found");
-		os_free(locuri);
-		return DM_RESP_NOT_FOUND;
-	}
-
-	node = get_node(ctx->xml, replace, "Item/Meta/Type");
-	if (node) {
-		char *type;
-		type = xml_node_get_text(ctx->xml, node);
-		if (type == NULL) {
-			wpa_printf(MSG_INFO, "Could not find type text");
-			os_free(locuri);
-			return DM_RESP_BAD_REQUEST;
-		}
-		use_tnds = node &&
-			os_strstr(type, "application/vnd.syncml.dmtnds+xml");
-	}
-
-	node = get_node(ctx->xml, replace, "Item/Data");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Replace/Item/Data found");
-		os_free(locuri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	data = xml_node_get_text(ctx->xml, node);
-	if (data == NULL) {
-		wpa_printf(MSG_INFO, "Could not get Replace/Item/Data text");
-		os_free(locuri);
-		return DM_RESP_BAD_REQUEST;
-	}
-
-	wpa_printf(MSG_DEBUG, "Replace/Item/Data: %s", data);
-
-	if (use_tnds) {
-		tnds = xml_node_from_buf(ctx->xml, data);
-		xml_node_get_text_free(ctx->xml, data);
-		if (tnds == NULL) {
-			wpa_printf(MSG_INFO,
-				   "Could not parse Replace/Item/Data text");
-			os_free(locuri);
-			return DM_RESP_BAD_REQUEST;
-		}
-
-		unode = tnds_to_mo(ctx->xml, tnds);
-		xml_node_free(ctx->xml, tnds);
-		if (unode == NULL) {
-			wpa_printf(MSG_INFO, "Could not parse TNDS text");
-			os_free(locuri);
-			return DM_RESP_BAD_REQUEST;
-		}
-
-		debug_dump_node(ctx, "Parsed TNDS", unode);
-
-		parent = xml_node_get_parent(ctx->xml, pps_node);
-		xml_node_detach(ctx->xml, pps_node);
-		xml_node_add_child(ctx->xml, parent, unode);
-	} else {
-		xml_node_set_text(ctx->xml, pps_node, data);
-		xml_node_get_text_free(ctx->xml, data);
-	}
-
-	os_free(locuri);
-
-	if (update_pps_file(ctx, pps_fname, pps) < 0)
-		return DM_RESP_COMMAND_FAILED;
-
-	ctx->pps_updated = 1;
-
-	return DM_RESP_OK;
-}
-
-
-static int oma_dm_get(struct hs20_osu_client *ctx, xml_node_t *get,
-		      xml_node_t *pps, const char *pps_fname, char **value)
-{
-	char *locuri, *pos;
-	size_t fqdn_len;
-	xml_node_t *pps_node;
-	const char *name;
-
-	*value = NULL;
-
-	locuri = oma_dm_get_target_locuri(ctx, get);
-	if (locuri == NULL)
-		return DM_RESP_BAD_REQUEST;
-
-	wpa_printf(MSG_INFO, "Get command target LocURI: %s", locuri);
-	if (os_strncasecmp(locuri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Do not allow Get outside ./Wi-Fi");
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos = locuri + 8;
-
-	if (ctx->fqdn == NULL)
-		return DM_RESP_COMMAND_FAILED;
-	fqdn_len = os_strlen(ctx->fqdn);
-	if (os_strncasecmp(pos, ctx->fqdn, fqdn_len) != 0 ||
-	    pos[fqdn_len] != '/') {
-		wpa_printf(MSG_INFO, "Do not allow Get outside ./Wi-Fi/%s",
-			   ctx->fqdn);
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += fqdn_len + 1;
-
-	if (os_strncasecmp(pos, "PerProviderSubscription/", 24) != 0) {
-		wpa_printf(MSG_INFO,
-			   "Do not allow Get outside ./Wi-Fi/%s/PerProviderSubscription",
-			   ctx->fqdn);
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-	pos += 24;
-
-	wpa_printf(MSG_INFO, "Get command for PPS node %s", pos);
-
-	pps_node = get_node(ctx->xml, pps, pos);
-	if (pps_node == NULL) {
-		wpa_printf(MSG_INFO, "Specified PPS node not found");
-		os_free(locuri);
-		return DM_RESP_NOT_FOUND;
-	}
-
-	name = xml_node_get_localname(ctx->xml, pps_node);
-	wpa_printf(MSG_INFO, "Get command returned node with name '%s'", name);
-	if (os_strcasecmp(name, "Password") == 0) {
-		wpa_printf(MSG_INFO, "Do not allow Get for Password node");
-		os_free(locuri);
-		return DM_RESP_PERMISSION_DENIED;
-	}
-
-	/*
-	 * TODO: No support for DMTNDS, so if interior node, reply with a
-	 * list of children node names in Results element. The child list type is
-	 * defined in [DMTND].
-	 */
-
-	*value = xml_node_get_text(ctx->xml, pps_node);
-	if (*value == NULL)
-		return DM_RESP_COMMAND_FAILED;
-
-	return DM_RESP_OK;
-}
-
-
-static int oma_dm_get_cmdid(struct hs20_osu_client *ctx, xml_node_t *node)
-{
-	xml_node_t *cnode;
-	char *str;
-	int ret;
-
-	cnode = get_node(ctx->xml, node, "CmdID");
-	if (cnode == NULL)
-		return 0;
-
-	str = xml_node_get_text(ctx->xml, cnode);
-	if (str == NULL)
-		return 0;
-	ret = atoi(str);
-	xml_node_get_text_free(ctx->xml, str);
-	return ret;
-}
-
-
-static xml_node_t * oma_dm_send_recv(struct hs20_osu_client *ctx,
-				     const char *url, xml_node_t *syncml,
-				     const char *ext_hdr,
-				     const char *username, const char *password,
-				     const char *client_cert,
-				     const char *client_key)
-{
-	xml_node_t *resp;
-	char *str, *res;
-	char *resp_uri = NULL;
-
-	str = xml_node_to_str(ctx->xml, syncml);
-	xml_node_free(ctx->xml, syncml);
-	if (str == NULL)
-		return NULL;
-
-	wpa_printf(MSG_INFO, "Send OMA DM Package");
-	write_summary(ctx, "Send OMA DM Package");
-	os_free(ctx->server_url);
-	ctx->server_url = os_strdup(url);
-	res = http_post(ctx->http, url, str, "application/vnd.syncml.dm+xml",
-			ext_hdr, ctx->ca_fname, username, password,
-			client_cert, client_key, NULL);
-	os_free(str);
-	os_free(resp_uri);
-	resp_uri = NULL;
-
-	if (res == NULL) {
-		const char *err = http_get_err(ctx->http);
-		if (err) {
-			wpa_printf(MSG_INFO, "HTTP error: %s", err);
-			write_result(ctx, "HTTP error: %s", err);
-		} else {
-			write_summary(ctx, "Failed to send OMA DM Package");
-		}
-		return NULL;
-	}
-	wpa_printf(MSG_DEBUG, "Server response: %s", res);
-
-	wpa_printf(MSG_INFO, "Process OMA DM Package");
-	write_summary(ctx, "Process received OMA DM Package");
-	resp = xml_node_from_buf(ctx->xml, res);
-	os_free(res);
-	if (resp == NULL) {
-		wpa_printf(MSG_INFO, "Failed to parse OMA DM response");
-		return NULL;
-	}
-
-	debug_dump_node(ctx, "OMA DM Package", resp);
-
-	return resp;
-}
-
-
-static xml_node_t * oma_dm_process(struct hs20_osu_client *ctx, const char *url,
-				   xml_node_t *resp, int msgid,
-				   char **ret_resp_uri,
-				   xml_node_t *pps, const char *pps_fname)
-{
-	xml_node_t *syncml, *syncbody, *hdr, *body, *child;
-	const char *name;
-	char *resp_uri = NULL;
-	int server_msgid = 0;
-	int cmdid = 0;
-	int server_cmdid;
-	int resp_needed = 0;
-	char *tmp;
-	int final = 0;
-	char *locuri;
-
-	*ret_resp_uri = NULL;
-
-	name = xml_node_get_localname(ctx->xml, resp);
-	if (name == NULL || os_strcasecmp(name, "SyncML") != 0) {
-		wpa_printf(MSG_INFO, "SyncML node not found");
-		return NULL;
-	}
-
-	hdr = get_node(ctx->xml, resp, "SyncHdr");
-	body = get_node(ctx->xml, resp, "SyncBody");
-	if (hdr == NULL || body == NULL) {
-		wpa_printf(MSG_INFO, "Could not find SyncHdr or SyncBody");
-		return NULL;
-	}
-
-	xml_node_for_each_child(ctx->xml, child, hdr) {
-		xml_node_for_each_check(ctx->xml, child);
-		name = xml_node_get_localname(ctx->xml, child);
-		wpa_printf(MSG_INFO, "SyncHdr %s", name);
-		if (os_strcasecmp(name, "RespURI") == 0) {
-			tmp = xml_node_get_text(ctx->xml, child);
-			if (tmp)
-				resp_uri = os_strdup(tmp);
-			xml_node_get_text_free(ctx->xml, tmp);
-		} else if (os_strcasecmp(name, "MsgID") == 0) {
-			tmp = xml_node_get_text(ctx->xml, child);
-			if (tmp)
-				server_msgid = atoi(tmp);
-			xml_node_get_text_free(ctx->xml, tmp);
-		}
-	}
-
-	wpa_printf(MSG_INFO, "Server MsgID: %d", server_msgid);
-	if (resp_uri)
-		wpa_printf(MSG_INFO, "RespURI: %s", resp_uri);
-
-	syncml = oma_dm_build_hdr(ctx, resp_uri ? resp_uri : url, msgid);
-	if (syncml == NULL) {
-		os_free(resp_uri);
-		return NULL;
-	}
-
-	syncbody = xml_node_create(ctx->xml, syncml, NULL, "SyncBody");
-	cmdid++;
-	add_status(ctx, syncbody, server_msgid, 0, cmdid, "SyncHdr",
-		   DM_RESP_AUTH_ACCEPTED, NULL);
-
-	xml_node_for_each_child(ctx->xml, child, body) {
-		xml_node_for_each_check(ctx->xml, child);
-		server_cmdid = oma_dm_get_cmdid(ctx, child);
-		name = xml_node_get_localname(ctx->xml, child);
-		wpa_printf(MSG_INFO, "SyncBody CmdID=%d - %s",
-			   server_cmdid, name);
-		if (os_strcasecmp(name, "Exec") == 0) {
-			int res = oma_dm_exec(ctx, child);
-			cmdid++;
-			locuri = oma_dm_get_target_locuri(ctx, child);
-			if (locuri == NULL)
-				res = DM_RESP_BAD_REQUEST;
-			add_status(ctx, syncbody, server_msgid, server_cmdid,
-				   cmdid, name, res, locuri);
-			os_free(locuri);
-			resp_needed = 1;
-		} else if (os_strcasecmp(name, "Add") == 0) {
-			int res = oma_dm_add(ctx, child, pps, pps_fname);
-			cmdid++;
-			locuri = oma_dm_get_target_locuri(ctx, child);
-			if (locuri == NULL)
-				res = DM_RESP_BAD_REQUEST;
-			add_status(ctx, syncbody, server_msgid, server_cmdid,
-				   cmdid, name, res, locuri);
-			os_free(locuri);
-			resp_needed = 1;
-		} else if (os_strcasecmp(name, "Replace") == 0) {
-			int res;
-			res = oma_dm_replace(ctx, child, pps, pps_fname);
-			cmdid++;
-			locuri = oma_dm_get_target_locuri(ctx, child);
-			if (locuri == NULL)
-				res = DM_RESP_BAD_REQUEST;
-			add_status(ctx, syncbody, server_msgid, server_cmdid,
-				   cmdid, name, res, locuri);
-			os_free(locuri);
-			resp_needed = 1;
-		} else if (os_strcasecmp(name, "Status") == 0) {
-			/* TODO: Verify success */
-		} else if (os_strcasecmp(name, "Get") == 0) {
-			int res;
-			char *value;
-			res = oma_dm_get(ctx, child, pps, pps_fname, &value);
-			cmdid++;
-			locuri = oma_dm_get_target_locuri(ctx, child);
-			if (locuri == NULL)
-				res = DM_RESP_BAD_REQUEST;
-			add_status(ctx, syncbody, server_msgid, server_cmdid,
-				   cmdid, name, res, locuri);
-			if (res == DM_RESP_OK && value) {
-				cmdid++;
-				add_results(ctx, syncbody, server_msgid,
-					    server_cmdid, cmdid, locuri, value);
-			}
-			os_free(locuri);
-			xml_node_get_text_free(ctx->xml, value);
-			resp_needed = 1;
-#if 0 /* TODO: MUST support */
-		} else if (os_strcasecmp(name, "Delete") == 0) {
-#endif
-#if 0 /* TODO: MUST support */
-		} else if (os_strcasecmp(name, "Sequence") == 0) {
-#endif
-		} else if (os_strcasecmp(name, "Final") == 0) {
-			final = 1;
-			break;
-		} else {
-			locuri = oma_dm_get_target_locuri(ctx, child);
-			add_status(ctx, syncbody, server_msgid, server_cmdid,
-				   cmdid, name, DM_RESP_COMMAND_NOT_IMPLEMENTED,
-				   locuri);
-			os_free(locuri);
-			resp_needed = 1;
-		}
-	}
-
-	if (!final) {
-		wpa_printf(MSG_INFO, "Final node not found");
-		xml_node_free(ctx->xml, syncml);
-		os_free(resp_uri);
-		return NULL;
-	}
-
-	if (!resp_needed) {
-		wpa_printf(MSG_INFO, "Exchange completed - no response needed");
-		xml_node_free(ctx->xml, syncml);
-		os_free(resp_uri);
-		return NULL;
-	}
-
-	xml_node_create(ctx->xml, syncbody, NULL, "Final");
-
-	debug_dump_node(ctx, "OMA-DM Package 3", syncml);
-
-	*ret_resp_uri = resp_uri;
-	return syncml;
-}
-
-
-int cmd_oma_dm_prov(struct hs20_osu_client *ctx, const char *url)
-{
-	xml_node_t *syncml, *resp;
-	char *resp_uri = NULL;
-	int msgid = 0;
-
-	if (url == NULL) {
-		wpa_printf(MSG_INFO, "Invalid prov command (missing URL)");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "OMA-DM credential provisioning requested");
-	write_summary(ctx, "OMA-DM credential provisioning");
-
-	msgid++;
-	syncml = build_oma_dm_1_sub_reg(ctx, url, msgid);
-	if (syncml == NULL)
-		return -1;
-
-	while (syncml) {
-		resp = oma_dm_send_recv(ctx, resp_uri ? resp_uri : url,
-					syncml, NULL, NULL, NULL, NULL, NULL);
-		if (resp == NULL)
-			return -1;
-
-		msgid++;
-		syncml = oma_dm_process(ctx, url, resp, msgid, &resp_uri,
-					NULL, NULL);
-		xml_node_free(ctx->xml, resp);
-	}
-
-	os_free(resp_uri);
-
-	return ctx->pps_cred_set ? 0 : -1;
-}
-
-
-int cmd_oma_dm_sim_prov(struct hs20_osu_client *ctx, const char *url)
-{
-	xml_node_t *syncml, *resp;
-	char *resp_uri = NULL;
-	int msgid = 0;
-
-	if (url == NULL) {
-		wpa_printf(MSG_INFO, "Invalid prov command (missing URL)");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "OMA-DM SIM provisioning requested");
-	ctx->no_reconnect = 2;
-
-	wpa_printf(MSG_INFO, "Wait for IP address before starting SIM provisioning");
-	write_summary(ctx, "Wait for IP address before starting SIM provisioning");
-
-	if (wait_ip_addr(ctx->ifname, 15) < 0) {
-		wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
-	}
-	write_summary(ctx, "OMA-DM SIM provisioning");
-
-	msgid++;
-	syncml = build_oma_dm_1_sub_prov(ctx, url, msgid);
-	if (syncml == NULL)
-		return -1;
-
-	while (syncml) {
-		resp = oma_dm_send_recv(ctx, resp_uri ? resp_uri : url,
-					syncml, NULL, NULL, NULL, NULL, NULL);
-		if (resp == NULL)
-			return -1;
-
-		msgid++;
-		syncml = oma_dm_process(ctx, url, resp, msgid, &resp_uri,
-					NULL, NULL);
-		xml_node_free(ctx->xml, resp);
-	}
-
-	os_free(resp_uri);
-
-	if (ctx->pps_cred_set) {
-		wpa_printf(MSG_INFO, "Updating wpa_supplicant credentials");
-		cmd_set_pps(ctx, ctx->pps_fname);
-
-		wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
-		write_summary(ctx, "Requesting reconnection with updated configuration");
-		if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0) {
-			wpa_printf(MSG_INFO, "Failed to request wpa_supplicant to reconnect");
-			write_summary(ctx, "Failed to request wpa_supplicant to reconnect");
-			return -1;
-		}
-	}
-
-	return ctx->pps_cred_set ? 0 : -1;
-}
-
-
-void oma_dm_pol_upd(struct hs20_osu_client *ctx, const char *address,
-		    const char *pps_fname,
-		    const char *client_cert, const char *client_key,
-		    const char *cred_username, const char *cred_password,
-		    xml_node_t *pps)
-{
-	xml_node_t *syncml, *resp;
-	char *resp_uri = NULL;
-	int msgid = 0;
-
-	wpa_printf(MSG_INFO, "OMA-DM policy update");
-	write_summary(ctx, "OMA-DM policy update");
-
-	msgid++;
-	syncml = build_oma_dm_1_pol_upd(ctx, address, msgid);
-	if (syncml == NULL)
-		return;
-
-	while (syncml) {
-		resp = oma_dm_send_recv(ctx, resp_uri ? resp_uri : address,
-					syncml, NULL, cred_username,
-					cred_password, client_cert, client_key);
-		if (resp == NULL)
-			return;
-
-		msgid++;
-		syncml = oma_dm_process(ctx, address, resp, msgid, &resp_uri,
-					pps, pps_fname);
-		xml_node_free(ctx->xml, resp);
-	}
-
-	os_free(resp_uri);
-
-	if (ctx->pps_updated) {
-		wpa_printf(MSG_INFO, "Update wpa_supplicant credential based on updated PPS MO");
-		write_summary(ctx, "Update wpa_supplicant credential based on updated PPS MO and request connection");
-		cmd_set_pps(ctx, pps_fname);
-		if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0) {
-			wpa_printf(MSG_INFO,
-				   "Failed to request wpa_supplicant to reconnect");
-			write_summary(ctx,
-				      "Failed to request wpa_supplicant to reconnect");
-		}
-	}
-}
-
-
-void oma_dm_sub_rem(struct hs20_osu_client *ctx, const char *address,
-		    const char *pps_fname,
-		    const char *client_cert, const char *client_key,
-		    const char *cred_username, const char *cred_password,
-		    xml_node_t *pps)
-{
-	xml_node_t *syncml, *resp;
-	char *resp_uri = NULL;
-	int msgid = 0;
-
-	wpa_printf(MSG_INFO, "OMA-DM subscription remediation");
-	write_summary(ctx, "OMA-DM subscription remediation");
-
-	msgid++;
-	syncml = build_oma_dm_1_sub_rem(ctx, address, msgid);
-	if (syncml == NULL)
-		return;
-
-	while (syncml) {
-		resp = oma_dm_send_recv(ctx, resp_uri ? resp_uri : address,
-					syncml, NULL, cred_username,
-					cred_password, client_cert, client_key);
-		if (resp == NULL)
-			return;
-
-		msgid++;
-		syncml = oma_dm_process(ctx, address, resp, msgid, &resp_uri,
-					pps, pps_fname);
-		xml_node_free(ctx->xml, resp);
-	}
-
-	os_free(resp_uri);
-
-	wpa_printf(MSG_INFO, "Update wpa_supplicant credential based on updated PPS MO and request reconnection");
-	write_summary(ctx, "Update wpa_supplicant credential based on updated PPS MO and request reconnection");
-	cmd_set_pps(ctx, pps_fname);
-	if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0) {
-		wpa_printf(MSG_INFO, "Failed to request wpa_supplicant to reconnect");
-		write_summary(ctx, "Failed to request wpa_supplicant to reconnect");
-	}
-}
-
-
-void cmd_oma_dm_add(struct hs20_osu_client *ctx, const char *pps_fname,
-		    const char *add_fname)
-{
-	xml_node_t *pps, *add;
-	int res;
-
-	ctx->fqdn = os_strdup("wi-fi.org");
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "PPS file %s could not be parsed",
-			   pps_fname);
-		return;
-	}
-
-	add = node_from_file(ctx->xml, add_fname);
-	if (add == NULL) {
-		wpa_printf(MSG_INFO, "Add file %s could not be parsed",
-			   add_fname);
-		xml_node_free(ctx->xml, pps);
-		return;
-	}
-
-	res = oma_dm_add(ctx, add, pps, pps_fname);
-	wpa_printf(MSG_INFO, "oma_dm_add --> %d", res);
-
-	xml_node_free(ctx->xml, pps);
-	xml_node_free(ctx->xml, add);
-}
-
-
-void cmd_oma_dm_replace(struct hs20_osu_client *ctx, const char *pps_fname,
-			const char *replace_fname)
-{
-	xml_node_t *pps, *replace;
-	int res;
-
-	ctx->fqdn = os_strdup("wi-fi.org");
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "PPS file %s could not be parsed",
-			   pps_fname);
-		return;
-	}
-
-	replace = node_from_file(ctx->xml, replace_fname);
-	if (replace == NULL) {
-		wpa_printf(MSG_INFO, "Replace file %s could not be parsed",
-			   replace_fname);
-		xml_node_free(ctx->xml, pps);
-		return;
-	}
-
-	res = oma_dm_replace(ctx, replace, pps, pps_fname);
-	wpa_printf(MSG_INFO, "oma_dm_replace --> %d", res);
-
-	xml_node_free(ctx->xml, pps);
-	xml_node_free(ctx->xml, replace);
-}
diff --git a/hs20/client/osu_client.c b/hs20/client/osu_client.c
index 2ca85f9..f679df4 100644
--- a/hs20/client/osu_client.c
+++ b/hs20/client/osu_client.c
@@ -9,9 +9,6 @@
 #include "includes.h"
 #include <time.h>
 #include <sys/stat.h>
-#ifdef ANDROID
-#include "private/android_filesystem_config.h"
-#endif /* ANDROID */
 
 #include "common.h"
 #include "utils/browser.h"
@@ -25,10 +22,9 @@
 #include "crypto/sha256.h"
 #include "osu_client.h"
 
-const char *spp_xsd_fname = "spp.xsd";
+static void write_summary(struct hs20_osu_client *ctx, const char *fmt, ...);
 
-
-void write_result(struct hs20_osu_client *ctx, const char *fmt, ...)
+static void write_result(struct hs20_osu_client *ctx, const char *fmt, ...)
 {
 	va_list ap;
 	FILE *f;
@@ -54,7 +50,7 @@
 }
 
 
-void write_summary(struct hs20_osu_client *ctx, const char *fmt, ...)
+static void write_summary(struct hs20_osu_client *ctx, const char *fmt, ...)
 {
 	va_list ap;
 	FILE *f;
@@ -74,231 +70,6 @@
 }
 
 
-void debug_dump_node(struct hs20_osu_client *ctx, const char *title,
-		     xml_node_t *node)
-{
-	char *str = xml_node_to_str(ctx->xml, node);
-	wpa_printf(MSG_DEBUG, "[hs20] %s: '%s'", title, str);
-	free(str);
-}
-
-
-static int valid_fqdn(const char *fqdn)
-{
-	const char *pos;
-
-	/* TODO: could make this more complete.. */
-	if (strchr(fqdn, '.') == 0 || strlen(fqdn) > 255)
-		return 0;
-	for (pos = fqdn; *pos; pos++) {
-		if (*pos >= 'a' && *pos <= 'z')
-			continue;
-		if (*pos >= 'A' && *pos <= 'Z')
-			continue;
-		if (*pos >= '0' && *pos <= '9')
-			continue;
-		if (*pos == '-' || *pos == '.' || *pos == '_')
-			continue;
-		return 0;
-	}
-	return 1;
-}
-
-
-static int android_update_permission(const char *path, mode_t mode)
-{
-#ifdef ANDROID
-	/* we need to change file/folder permission for Android */
-
-	if (!path) {
-		wpa_printf(MSG_ERROR, "file path null");
-		return -1;
-	}
-
-	/* Allow processes running with Group ID as AID_WIFI,
-	 * to read files from SP, SP/<fqdn>, Cert and osu-info directories */
-	if (lchown(path, -1, AID_WIFI)) {
-		wpa_printf(MSG_INFO, "CTRL: Could not lchown directory: %s",
-			   strerror(errno));
-		return -1;
-	}
-
-	if (chmod(path, mode) < 0) {
-		wpa_printf(MSG_INFO, "CTRL: Could not chmod directory: %s",
-			   strerror(errno));
-		return -1;
-	}
-#endif  /* ANDROID */
-
-	return 0;
-}
-
-
-int osu_get_certificate(struct hs20_osu_client *ctx, xml_node_t *getcert)
-{
-	xml_node_t *node;
-	char *url, *user = NULL, *pw = NULL;
-	char *proto;
-	int ret = -1;
-
-	proto = xml_node_get_attr_value(ctx->xml, getcert,
-					"enrollmentProtocol");
-	if (!proto)
-		return -1;
-	wpa_printf(MSG_INFO, "getCertificate - enrollmentProtocol=%s", proto);
-	write_summary(ctx, "getCertificate - enrollmentProtocol=%s", proto);
-	if (os_strcasecmp(proto, "EST") != 0) {
-		wpa_printf(MSG_INFO, "Unsupported enrollmentProtocol");
-		xml_node_get_attr_value_free(ctx->xml, proto);
-		return -1;
-	}
-	xml_node_get_attr_value_free(ctx->xml, proto);
-
-	node = get_node(ctx->xml, getcert, "enrollmentServerURI");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "Could not find enrollmentServerURI node");
-		xml_node_get_attr_value_free(ctx->xml, proto);
-		return -1;
-	}
-	url = xml_node_get_text(ctx->xml, node);
-	if (url == NULL) {
-		wpa_printf(MSG_INFO, "Could not get URL text");
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "enrollmentServerURI: %s", url);
-	write_summary(ctx, "enrollmentServerURI: %s", url);
-
-	node = get_node(ctx->xml, getcert, "estUserID");
-	if (node == NULL && !ctx->client_cert_present) {
-		wpa_printf(MSG_INFO, "Could not find estUserID node");
-		goto fail;
-	}
-	if (node) {
-		user = xml_node_get_text(ctx->xml, node);
-		if (user == NULL) {
-			wpa_printf(MSG_INFO, "Could not get estUserID text");
-			goto fail;
-		}
-		wpa_printf(MSG_INFO, "estUserID: %s", user);
-		write_summary(ctx, "estUserID: %s", user);
-	}
-
-	node = get_node(ctx->xml, getcert, "estPassword");
-	if (node == NULL && !ctx->client_cert_present) {
-		wpa_printf(MSG_INFO, "Could not find estPassword node");
-		goto fail;
-	}
-	if (node) {
-		pw = xml_node_get_base64_text(ctx->xml, node, NULL);
-		if (pw == NULL) {
-			wpa_printf(MSG_INFO, "Could not get estPassword text");
-			goto fail;
-		}
-		wpa_printf(MSG_INFO, "estPassword: %s", pw);
-	}
-
-	mkdir("Cert", S_IRWXU);
-	android_update_permission("Cert", S_IRWXU | S_IRWXG);
-
-	if (est_load_cacerts(ctx, url) < 0 ||
-	    est_build_csr(ctx, url) < 0 ||
-	    est_simple_enroll(ctx, url, user, pw) < 0)
-		goto fail;
-
-	ret = 0;
-fail:
-	xml_node_get_text_free(ctx->xml, url);
-	xml_node_get_text_free(ctx->xml, user);
-	xml_node_get_text_free(ctx->xml, pw);
-
-	return ret;
-}
-
-
-static int process_est_cert(struct hs20_osu_client *ctx, xml_node_t *cert,
-			    const char *fqdn)
-{
-	u8 digest1[SHA256_MAC_LEN], digest2[SHA256_MAC_LEN];
-	char *der, *pem;
-	size_t der_len, pem_len;
-	char *fingerprint;
-	char buf[200];
-
-	wpa_printf(MSG_INFO, "PPS for certificate credential - fqdn=%s", fqdn);
-
-	fingerprint = xml_node_get_text(ctx->xml, cert);
-	if (fingerprint == NULL)
-		return -1;
-	if (hexstr2bin(fingerprint, digest1, SHA256_MAC_LEN) < 0) {
-		wpa_printf(MSG_INFO, "Invalid SHA256 hash value");
-		write_result(ctx, "Invalid client certificate SHA256 hash value in PPS");
-		xml_node_get_text_free(ctx->xml, fingerprint);
-		return -1;
-	}
-	xml_node_get_text_free(ctx->xml, fingerprint);
-
-	der = os_readfile("Cert/est_cert.der", &der_len);
-	if (der == NULL) {
-		wpa_printf(MSG_INFO, "Could not find client certificate from EST");
-		write_result(ctx, "Could not find client certificate from EST");
-		return -1;
-	}
-
-	if (sha256_vector(1, (const u8 **) &der, &der_len, digest2) < 0) {
-		os_free(der);
-		return -1;
-	}
-	os_free(der);
-
-	if (os_memcmp(digest1, digest2, sizeof(digest1)) != 0) {
-		wpa_printf(MSG_INFO, "Client certificate from EST does not match fingerprint from PPS MO");
-		write_result(ctx, "Client certificate from EST does not match fingerprint from PPS MO");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "Client certificate from EST matches PPS MO");
-	unlink("Cert/est_cert.der");
-
-	os_snprintf(buf, sizeof(buf), "SP/%s/client-ca.pem", fqdn);
-	if (rename("Cert/est-cacerts.pem", buf) < 0) {
-		wpa_printf(MSG_INFO, "Could not move est-cacerts.pem to client-ca.pem: %s",
-			   strerror(errno));
-		return -1;
-	}
-	pem = os_readfile(buf, &pem_len);
-
-	os_snprintf(buf, sizeof(buf), "SP/%s/client-cert.pem", fqdn);
-	if (rename("Cert/est_cert.pem", buf) < 0) {
-		wpa_printf(MSG_INFO, "Could not move est_cert.pem to client-cert.pem: %s",
-			   strerror(errno));
-		os_free(pem);
-		return -1;
-	}
-
-	if (pem) {
-		FILE *f = fopen(buf, "a");
-		if (f) {
-			fwrite(pem, pem_len, 1, f);
-			fclose(f);
-		}
-		os_free(pem);
-	}
-
-	os_snprintf(buf, sizeof(buf), "SP/%s/client-key.pem", fqdn);
-	if (rename("Cert/privkey-plain.pem", buf) < 0) {
-		wpa_printf(MSG_INFO, "Could not move privkey-plain.pem to client-key.pem: %s",
-			   strerror(errno));
-		return -1;
-	}
-
-	unlink("Cert/est-req.b64");
-	unlink("Cert/est-req.pem");
-	rmdir("Cert");
-
-	return 0;
-}
-
-
 #define TMP_CERT_DL_FILE "tmp-cert-download"
 
 static int download_cert(struct hs20_osu_client *ctx, xml_node_t *params,
@@ -337,12 +108,10 @@
 	xml_node_get_text_free(ctx->xml, hash);
 
 	write_summary(ctx, "Download certificate from %s", url);
-	ctx->no_osu_cert_validation = 1;
 	http_ocsp_set(ctx->http, 1);
 	res = http_download_file(ctx->http, url, TMP_CERT_DL_FILE, NULL);
 	http_ocsp_set(ctx->http,
 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
-	ctx->no_osu_cert_validation = 0;
 	xml_node_get_text_free(ctx->xml, url);
 	if (res < 0)
 		return -1;
@@ -392,60 +161,6 @@
 }
 
 
-static int cmd_dl_osu_ca(struct hs20_osu_client *ctx, const char *pps_fname,
-			 const char *ca_fname)
-{
-	xml_node_t *pps, *node;
-	int ret;
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
-		return -1;
-	}
-
-	node = get_child_node(ctx->xml, pps,
-			      "SubscriptionUpdate/TrustRoot");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No SubscriptionUpdate/TrustRoot/CertURL found from PPS");
-		xml_node_free(ctx->xml, pps);
-		return -1;
-	}
-
-	ret = download_cert(ctx, node, ca_fname);
-	xml_node_free(ctx->xml, pps);
-
-	return ret;
-}
-
-
-static int cmd_dl_polupd_ca(struct hs20_osu_client *ctx, const char *pps_fname,
-			    const char *ca_fname)
-{
-	xml_node_t *pps, *node;
-	int ret;
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "Could not read or parse '%s'", pps_fname);
-		return -1;
-	}
-
-	node = get_child_node(ctx->xml, pps,
-			      "Policy/PolicyUpdate/TrustRoot");
-	if (node == NULL) {
-		wpa_printf(MSG_INFO, "No Policy/PolicyUpdate/TrustRoot/CertURL found from PPS");
-		xml_node_free(ctx->xml, pps);
-		return -2;
-	}
-
-	ret = download_cert(ctx, node, ca_fname);
-	xml_node_free(ctx->xml, pps);
-
-	return ret;
-}
-
-
 static int cmd_dl_aaa_ca(struct hs20_osu_client *ctx, const char *pps_fname,
 			 const char *ca_fname)
 {
@@ -480,298 +195,6 @@
 }
 
 
-static int download_trust_roots(struct hs20_osu_client *ctx,
-				const char *pps_fname)
-{
-	char *dir, *pos;
-	char fname[300];
-	int ret, ret1;
-
-	dir = os_strdup(pps_fname);
-	if (dir == NULL)
-		return -1;
-	pos = os_strrchr(dir, '/');
-	if (pos == NULL) {
-		os_free(dir);
-		return -1;
-	}
-	*pos = '\0';
-
-	snprintf(fname, sizeof(fname), "%s/ca.pem", dir);
-	ret = cmd_dl_osu_ca(ctx, pps_fname, fname);
-	snprintf(fname, sizeof(fname), "%s/polupd-ca.pem", dir);
-	ret1 = cmd_dl_polupd_ca(ctx, pps_fname, fname);
-	if (ret == 0 && ret1 == -1)
-		ret = -1;
-	snprintf(fname, sizeof(fname), "%s/aaa-ca.pem", dir);
-	ret1 = cmd_dl_aaa_ca(ctx, pps_fname, fname);
-	if (ret == 0 && ret1 == -1)
-		ret = -1;
-
-	os_free(dir);
-
-	return ret;
-}
-
-
-static int server_dnsname_suffix_match(struct hs20_osu_client *ctx,
-				       const char *fqdn)
-{
-	size_t match_len, len, i;
-	const char *val;
-
-	match_len = os_strlen(fqdn);
-
-	for (i = 0; i < ctx->server_dnsname_count; i++) {
-		wpa_printf(MSG_INFO,
-			   "Checking suffix match against server dNSName %s",
-			   ctx->server_dnsname[i]);
-		val = ctx->server_dnsname[i];
-		len = os_strlen(val);
-
-		if (match_len > len)
-			continue;
-
-		if (os_strncasecmp(val + len - match_len, fqdn, match_len) != 0)
-			continue; /* no match */
-
-		if (match_len == len)
-			return 1; /* exact match */
-
-		if (val[len - match_len - 1] == '.')
-			return 1; /* full label match completes suffix match */
-
-		/* Reject due to incomplete label match */
-	}
-
-	/* None of the dNSName(s) matched */
-	return 0;
-}
-
-
-int hs20_add_pps_mo(struct hs20_osu_client *ctx, const char *uri,
-		    xml_node_t *add_mo, char *fname, size_t fname_len)
-{
-	char *str;
-	char *fqdn, *pos;
-	xml_node_t *tnds, *mo, *cert;
-	const char *name;
-	int ret;
-
-	if (strncmp(uri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Unsupported location for addMO to add PPS MO: '%s'",
-			   uri);
-		write_result(ctx, "Unsupported location for addMO to add PPS MO: '%s'",
-			     uri);
-		return -1;
-	}
-
-	fqdn = strdup(uri + 8);
-	if (fqdn == NULL)
-		return -1;
-	pos = strchr(fqdn, '/');
-	if (pos) {
-		if (os_strcasecmp(pos, "/PerProviderSubscription") != 0) {
-			wpa_printf(MSG_INFO, "Unsupported location for addMO to add PPS MO (extra directory): '%s'",
-				   uri);
-			write_result(ctx, "Unsupported location for addMO to "
-				     "add PPS MO (extra directory): '%s'", uri);
-			free(fqdn);
-			return -1;
-		}
-		*pos = '\0'; /* remove trailing slash and PPS node name */
-	}
-	wpa_printf(MSG_INFO, "SP FQDN: %s", fqdn);
-
-	if (!server_dnsname_suffix_match(ctx, fqdn)) {
-		wpa_printf(MSG_INFO,
-			   "FQDN '%s' for new PPS MO did not have suffix match with server's dNSName values, count: %d",
-			   fqdn, (int) ctx->server_dnsname_count);
-		write_result(ctx, "FQDN '%s' for new PPS MO did not have suffix match with server's dNSName values",
-			     fqdn);
-		free(fqdn);
-		return -1;
-	}
-
-	if (!valid_fqdn(fqdn)) {
-		wpa_printf(MSG_INFO, "Invalid FQDN '%s'", fqdn);
-		write_result(ctx, "Invalid FQDN '%s'", fqdn);
-		free(fqdn);
-		return -1;
-	}
-
-	mkdir("SP", S_IRWXU);
-	snprintf(fname, fname_len, "SP/%s", fqdn);
-	if (mkdir(fname, S_IRWXU) < 0) {
-		if (errno != EEXIST) {
-			int err = errno;
-			wpa_printf(MSG_INFO, "mkdir(%s) failed: %s",
-				   fname, strerror(err));
-			free(fqdn);
-			return -1;
-		}
-	}
-
-	android_update_permission("SP", S_IRWXU | S_IRWXG);
-	android_update_permission(fname, S_IRWXU | S_IRWXG);
-
-	snprintf(fname, fname_len, "SP/%s/pps.xml", fqdn);
-
-	if (os_file_exists(fname)) {
-		wpa_printf(MSG_INFO, "PPS file '%s' exists - reject addMO",
-			   fname);
-		write_result(ctx, "PPS file '%s' exists - reject addMO",
-			     fname);
-		free(fqdn);
-		return -2;
-	}
-	wpa_printf(MSG_INFO, "Using PPS file: %s", fname);
-
-	str = xml_node_get_text(ctx->xml, add_mo);
-	if (str == NULL) {
-		wpa_printf(MSG_INFO, "Could not extract MO text");
-		free(fqdn);
-		return -1;
-	}
-	wpa_printf(MSG_DEBUG, "[hs20] addMO text: '%s'", str);
-
-	tnds = xml_node_from_buf(ctx->xml, str);
-	xml_node_get_text_free(ctx->xml, str);
-	if (tnds == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] Could not parse addMO text");
-		free(fqdn);
-		return -1;
-	}
-
-	mo = tnds_to_mo(ctx->xml, tnds);
-	if (mo == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] Could not parse addMO TNDS text");
-		free(fqdn);
-		return -1;
-	}
-
-	debug_dump_node(ctx, "Parsed TNDS", mo);
-
-	name = xml_node_get_localname(ctx->xml, mo);
-	if (os_strcasecmp(name, "PerProviderSubscription") != 0) {
-		wpa_printf(MSG_INFO, "[hs20] Unexpected PPS MO root node name '%s'",
-			   name);
-		free(fqdn);
-		return -1;
-	}
-
-	cert = get_child_node(ctx->xml, mo,
-			      "Credential/DigitalCertificate/"
-			      "CertSHA256Fingerprint");
-	if (cert && process_est_cert(ctx, cert, fqdn) < 0) {
-		xml_node_free(ctx->xml, mo);
-		free(fqdn);
-		return -1;
-	}
-	free(fqdn);
-
-	if (node_to_file(ctx->xml, fname, mo) < 0) {
-		wpa_printf(MSG_INFO, "Could not write MO to file");
-		xml_node_free(ctx->xml, mo);
-		return -1;
-	}
-	xml_node_free(ctx->xml, mo);
-
-	wpa_printf(MSG_INFO, "A new PPS MO added as '%s'", fname);
-	write_summary(ctx, "A new PPS MO added as '%s'", fname);
-
-	ret = download_trust_roots(ctx, fname);
-	if (ret < 0) {
-		wpa_printf(MSG_INFO, "Remove invalid PPS MO file");
-		write_summary(ctx, "Remove invalid PPS MO file");
-		unlink(fname);
-	}
-
-	return ret;
-}
-
-
-int update_pps_file(struct hs20_osu_client *ctx, const char *pps_fname,
-		    xml_node_t *pps)
-{
-	char *str;
-	FILE *f;
-	char backup[300];
-
-	if (ctx->client_cert_present) {
-		xml_node_t *cert;
-		cert = get_child_node(ctx->xml, pps,
-				      "Credential/DigitalCertificate/"
-				      "CertSHA256Fingerprint");
-		if (cert && os_file_exists("Cert/est_cert.der") &&
-		    process_est_cert(ctx, cert, ctx->fqdn) < 0) {
-			wpa_printf(MSG_INFO, "EST certificate update processing failed on PPS MO update");
-			return -1;
-		}
-	}
-
-	wpa_printf(MSG_INFO, "Updating PPS MO %s", pps_fname);
-
-	str = xml_node_to_str(ctx->xml, pps);
-	if (str == NULL) {
-		wpa_printf(MSG_ERROR, "No node found");
-		return -1;
-	}
-	wpa_printf(MSG_MSGDUMP, "[hs20] Updated PPS: '%s'", str);
-
-	snprintf(backup, sizeof(backup), "%s.bak", pps_fname);
-	rename(pps_fname, backup);
-	f = fopen(pps_fname, "w");
-	if (f == NULL) {
-		wpa_printf(MSG_INFO, "Could not write PPS");
-		rename(backup, pps_fname);
-		free(str);
-		return -1;
-	}
-	fprintf(f, "%s\n", str);
-	fclose(f);
-
-	free(str);
-
-	return 0;
-}
-
-
-void get_user_pw(struct hs20_osu_client *ctx, xml_node_t *pps,
-		 const char *alt_loc, char **user, char **pw)
-{
-	xml_node_t *node;
-
-	node = get_child_node(ctx->xml, pps,
-			      "Credential/UsernamePassword/Username");
-	if (node)
-		*user = xml_node_get_text(ctx->xml, node);
-
-	node = get_child_node(ctx->xml, pps,
-			      "Credential/UsernamePassword/Password");
-	if (node)
-		*pw = xml_node_get_base64_text(ctx->xml, node, NULL);
-
-	node = get_child_node(ctx->xml, pps, alt_loc);
-	if (node) {
-		xml_node_t *a;
-		a = get_node(ctx->xml, node, "Username");
-		if (a) {
-			xml_node_get_text_free(ctx->xml, *user);
-			*user = xml_node_get_text(ctx->xml, a);
-			wpa_printf(MSG_INFO, "Use OSU username '%s'", *user);
-		}
-
-		a = get_node(ctx->xml, node, "Password");
-		if (a) {
-			free(*pw);
-			*pw = xml_node_get_base64_text(ctx->xml, a, NULL);
-			wpa_printf(MSG_INFO, "Use OSU password");
-		}
-	}
-}
-
-
 /* Remove old credentials based on HomeSP/FQDN */
 static void remove_sp_creds(struct hs20_osu_client *ctx, const char *fqdn)
 {
@@ -1874,14 +1297,13 @@
 			wpa_printf(MSG_INFO, "Failed to set provisioning_sp");
 		wpa_printf(MSG_INFO, "credential localname: '%s'", name);
 		set_pps_credential(ctx, id, child, fqdn);
-		ctx->pps_cred_set = 1;
 	}
 
 	xml_node_get_text_free(ctx->xml, update_identifier);
 }
 
 
-void cmd_set_pps(struct hs20_osu_client *ctx, const char *pps_fname)
+static void cmd_set_pps(struct hs20_osu_client *ctx, const char *pps_fname)
 {
 	xml_node_t *pps;
 	const char *fqdn;
@@ -1988,1167 +1410,20 @@
 }
 
 
-struct osu_icon {
-	int id;
-	char lang[4];
-	char mime_type[256];
-	char filename[256];
-};
-
-struct osu_data {
-	char bssid[20];
-	char url[256];
-	unsigned int methods;
-	char osu_ssid[33];
-	char osu_ssid2[33];
-	char osu_nai[256];
-	char osu_nai2[256];
-	struct osu_lang_text friendly_name[MAX_OSU_VALS];
-	size_t friendly_name_count;
-	struct osu_lang_text serv_desc[MAX_OSU_VALS];
-	size_t serv_desc_count;
-	struct osu_icon icon[MAX_OSU_VALS];
-	size_t icon_count;
-};
-
-
-static struct osu_data * parse_osu_providers(const char *fname, size_t *count)
-{
-	FILE *f;
-	char buf[1000];
-	struct osu_data *osu = NULL, *last = NULL;
-	size_t osu_count = 0;
-	char *pos, *end;
-	int res;
-
-	f = fopen(fname, "r");
-	if (f == NULL) {
-		wpa_printf(MSG_ERROR, "Could not open %s", fname);
-		return NULL;
-	}
-
-	while (fgets(buf, sizeof(buf), f)) {
-		pos = strchr(buf, '\n');
-		if (pos)
-			*pos = '\0';
-
-		if (strncmp(buf, "OSU-PROVIDER ", 13) == 0) {
-			last = realloc(osu, (osu_count + 1) * sizeof(*osu));
-			if (last == NULL)
-				break;
-			osu = last;
-			last = &osu[osu_count++];
-			memset(last, 0, sizeof(*last));
-			res = os_snprintf(last->bssid, sizeof(last->bssid),
-					  "%s", buf + 13);
-			if (os_snprintf_error(sizeof(last->bssid), res))
-				break;
-			continue;
-		}
-		if (!last)
-			continue;
-
-		if (strncmp(buf, "uri=", 4) == 0) {
-			res = os_snprintf(last->url, sizeof(last->url),
-					  "%s", buf + 4);
-			if (os_snprintf_error(sizeof(last->url), res))
-				break;
-			continue;
-		}
-
-		if (strncmp(buf, "methods=", 8) == 0) {
-			last->methods = strtol(buf + 8, NULL, 16);
-			continue;
-		}
-
-		if (strncmp(buf, "osu_ssid=", 9) == 0) {
-			res = os_snprintf(last->osu_ssid,
-					  sizeof(last->osu_ssid),
-					  "%s", buf + 9);
-			if (os_snprintf_error(sizeof(last->osu_ssid), res))
-				break;
-			continue;
-		}
-
-		if (strncmp(buf, "osu_ssid2=", 10) == 0) {
-			res = os_snprintf(last->osu_ssid2,
-					  sizeof(last->osu_ssid2),
-					  "%s", buf + 10);
-			if (os_snprintf_error(sizeof(last->osu_ssid2), res))
-				break;
-			continue;
-		}
-
-		if (os_strncmp(buf, "osu_nai=", 8) == 0) {
-			res = os_snprintf(last->osu_nai, sizeof(last->osu_nai),
-					  "%s", buf + 8);
-			if (os_snprintf_error(sizeof(last->osu_nai), res))
-				break;
-			continue;
-		}
-
-		if (os_strncmp(buf, "osu_nai2=", 9) == 0) {
-			res = os_snprintf(last->osu_nai2,
-					  sizeof(last->osu_nai2),
-					  "%s", buf + 9);
-			if (os_snprintf_error(sizeof(last->osu_nai2), res))
-				break;
-			continue;
-		}
-
-		if (strncmp(buf, "friendly_name=", 14) == 0) {
-			struct osu_lang_text *txt;
-			if (last->friendly_name_count == MAX_OSU_VALS)
-				continue;
-			pos = strchr(buf + 14, ':');
-			if (pos == NULL)
-				continue;
-			*pos++ = '\0';
-			txt = &last->friendly_name[last->friendly_name_count++];
-			res = os_snprintf(txt->lang, sizeof(txt->lang),
-					  "%s", buf + 14);
-			if (os_snprintf_error(sizeof(txt->lang), res))
-				break;
-			res = os_snprintf(txt->text, sizeof(txt->text),
-					  "%s", pos);
-			if (os_snprintf_error(sizeof(txt->text), res))
-				break;
-		}
-
-		if (strncmp(buf, "desc=", 5) == 0) {
-			struct osu_lang_text *txt;
-			if (last->serv_desc_count == MAX_OSU_VALS)
-				continue;
-			pos = strchr(buf + 5, ':');
-			if (pos == NULL)
-				continue;
-			*pos++ = '\0';
-			txt = &last->serv_desc[last->serv_desc_count++];
-			res = os_snprintf(txt->lang, sizeof(txt->lang),
-					  "%s", buf + 5);
-			if (os_snprintf_error(sizeof(txt->lang), res))
-				break;
-			res = os_snprintf(txt->text, sizeof(txt->text),
-					  "%s", pos);
-			if (os_snprintf_error(sizeof(txt->text), res))
-				break;
-		}
-
-		if (strncmp(buf, "icon=", 5) == 0) {
-			struct osu_icon *icon;
-			if (last->icon_count == MAX_OSU_VALS)
-				continue;
-			icon = &last->icon[last->icon_count++];
-			icon->id = atoi(buf + 5);
-			pos = strchr(buf, ':');
-			if (pos == NULL)
-				continue;
-			pos = strchr(pos + 1, ':');
-			if (pos == NULL)
-				continue;
-			pos = strchr(pos + 1, ':');
-			if (pos == NULL)
-				continue;
-			pos++;
-			end = strchr(pos, ':');
-			if (!end)
-				continue;
-			*end = '\0';
-			res = os_snprintf(icon->lang, sizeof(icon->lang),
-					  "%s", pos);
-			if (os_snprintf_error(sizeof(icon->lang), res))
-				break;
-			pos = end + 1;
-
-			end = strchr(pos, ':');
-			if (end)
-				*end = '\0';
-			res = os_snprintf(icon->mime_type,
-					  sizeof(icon->mime_type), "%s", pos);
-			if (os_snprintf_error(sizeof(icon->mime_type), res))
-				break;
-			if (!end)
-				continue;
-			pos = end + 1;
-
-			end = strchr(pos, ':');
-			if (end)
-				*end = '\0';
-			res = os_snprintf(icon->filename,
-					  sizeof(icon->filename), "%s", pos);
-			if (os_snprintf_error(sizeof(icon->filename), res))
-				break;
-			continue;
-		}
-	}
-
-	fclose(f);
-
-	*count = osu_count;
-	return osu;
-}
-
-
-static int osu_connect(struct hs20_osu_client *ctx, const char *bssid,
-		       const char *ssid, const char *ssid2, const char *url,
-		       unsigned int methods, int no_prod_assoc,
-		       const char *osu_nai, const char *osu_nai2)
-{
-	int id;
-	const char *ifname = ctx->ifname;
-	char buf[200];
-	struct wpa_ctrl *mon;
-	int res;
-
-	if (ssid2 && ssid2[0] == '\0')
-		ssid2 = NULL;
-
-	if (ctx->osu_ssid) {
-		if (os_strcmp(ssid, ctx->osu_ssid) == 0) {
-			wpa_printf(MSG_DEBUG,
-				   "Enforced OSU SSID matches ANQP info");
-			ssid2 = NULL;
-		} else if (ssid2 && os_strcmp(ssid2, ctx->osu_ssid) == 0) {
-			wpa_printf(MSG_DEBUG,
-				   "Enforced OSU SSID matches RSN[OSEN] info");
-			ssid = ssid2;
-		} else {
-			wpa_printf(MSG_INFO, "Enforced OSU SSID did not match");
-			write_summary(ctx, "Enforced OSU SSID did not match");
-			return -1;
-		}
-	}
-
-	id = add_network(ifname);
-	if (id < 0)
-		return -1;
-	if (set_network_quoted(ifname, id, "ssid", ssid) < 0)
-		return -1;
-	if (ssid2)
-		osu_nai = osu_nai2;
-	if (osu_nai && os_strlen(osu_nai) > 0) {
-		char dir[255], fname[300];
-		if (getcwd(dir, sizeof(dir)) == NULL)
-			return -1;
-		os_snprintf(fname, sizeof(fname), "%s/osu-ca.pem", dir);
-
-		if (ssid2 && set_network_quoted(ifname, id, "ssid", ssid2) < 0)
-			return -1;
-
-		if (set_network(ifname, id, "proto", "OSEN") < 0 ||
-		    set_network(ifname, id, "key_mgmt", "OSEN") < 0 ||
-		    set_network(ifname, id, "pairwise", "CCMP") < 0 ||
-		    set_network(ifname, id, "group", "GTK_NOT_USED CCMP") < 0 ||
-		    set_network(ifname, id, "eap", "WFA-UNAUTH-TLS") < 0 ||
-		    set_network(ifname, id, "ocsp", "2") < 0 ||
-		    set_network_quoted(ifname, id, "identity", osu_nai) < 0 ||
-		    set_network_quoted(ifname, id, "ca_cert", fname) < 0)
-			return -1;
-	} else if (ssid2) {
-		wpa_printf(MSG_INFO, "No OSU_NAI set for RSN[OSEN]");
-		write_summary(ctx, "No OSU_NAI set for RSN[OSEN]");
-		return -1;
-	} else {
-		if (set_network(ifname, id, "key_mgmt", "NONE") < 0)
-			return -1;
-	}
-
-	mon = open_wpa_mon(ifname);
-	if (mon == NULL)
-		return -1;
-
-	wpa_printf(MSG_INFO, "Associate with OSU SSID");
-	write_summary(ctx, "Associate with OSU SSID");
-	snprintf(buf, sizeof(buf), "SELECT_NETWORK %d", id);
-	if (wpa_command(ifname, buf) < 0)
-		return -1;
-
-	res = get_wpa_cli_event(mon, "CTRL-EVENT-CONNECTED",
-				buf, sizeof(buf));
-
-	wpa_ctrl_detach(mon);
-	wpa_ctrl_close(mon);
-
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "Could not connect to OSU network");
-		write_summary(ctx, "Could not connect to OSU network");
-		wpa_printf(MSG_INFO, "Remove OSU network connection");
-		snprintf(buf, sizeof(buf), "REMOVE_NETWORK %d", id);
-		wpa_command(ifname, buf);
-		return -1;
-	}
-
-	write_summary(ctx, "Waiting for IP address for subscription registration");
-	if (wait_ip_addr(ifname, 15) < 0) {
-		wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
-	}
-
-	if (no_prod_assoc) {
-		if (res < 0)
-			return -1;
-		wpa_printf(MSG_INFO, "No production connection used for testing purposes");
-		write_summary(ctx, "No production connection used for testing purposes");
-		return 0;
-	}
-
-	ctx->no_reconnect = 1;
-	if (methods & 0x02) {
-		wpa_printf(MSG_DEBUG, "Calling cmd_prov from osu_connect");
-		res = cmd_prov(ctx, url);
-	} else if (methods & 0x01) {
-		wpa_printf(MSG_DEBUG,
-			   "Calling cmd_oma_dm_prov from osu_connect");
-		res = cmd_oma_dm_prov(ctx, url);
-	}
-
-	wpa_printf(MSG_INFO, "Remove OSU network connection");
-	write_summary(ctx, "Remove OSU network connection");
-	snprintf(buf, sizeof(buf), "REMOVE_NETWORK %d", id);
-	wpa_command(ifname, buf);
-
-	if (res < 0)
-		return -1;
-
-	wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
-	write_summary(ctx, "Requesting reconnection with updated configuration");
-	if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0) {
-		wpa_printf(MSG_INFO, "Failed to request wpa_supplicant to reconnect");
-		write_summary(ctx, "Failed to request wpa_supplicant to reconnect");
-		return -1;
-	}
-
-	return 0;
-}
-
-
-static int cmd_osu_select(struct hs20_osu_client *ctx, const char *dir,
-			  int connect, int no_prod_assoc,
-			  const char *friendly_name)
-{
-	char fname[255];
-	FILE *f;
-	struct osu_data *osu = NULL, *last = NULL;
-	size_t osu_count = 0, i, j;
-	int ret;
-
-	write_summary(ctx, "OSU provider selection");
-
-	if (dir == NULL) {
-		wpa_printf(MSG_INFO, "Missing dir parameter to osu_select");
-		return -1;
-	}
-
-	snprintf(fname, sizeof(fname), "%s/osu-providers.txt", dir);
-	osu = parse_osu_providers(fname, &osu_count);
-	if (osu == NULL) {
-		wpa_printf(MSG_INFO, "Could not find any OSU providers from %s",
-			   fname);
-		write_result(ctx, "No OSU providers available");
-		return -1;
-	}
-
-	if (friendly_name) {
-		for (i = 0; i < osu_count; i++) {
-			last = &osu[i];
-			for (j = 0; j < last->friendly_name_count; j++) {
-				if (os_strcmp(last->friendly_name[j].text,
-					      friendly_name) == 0)
-					break;
-			}
-			if (j < last->friendly_name_count)
-				break;
-		}
-		if (i == osu_count) {
-			wpa_printf(MSG_INFO, "Requested operator friendly name '%s' not found in the list of available providers",
-				   friendly_name);
-			write_summary(ctx, "Requested operator friendly name '%s' not found in the list of available providers",
-				      friendly_name);
-			free(osu);
-			return -1;
-		}
-
-		wpa_printf(MSG_INFO, "OSU Provider selected based on requested operator friendly name '%s'",
-			   friendly_name);
-		write_summary(ctx, "OSU Provider selected based on requested operator friendly name '%s'",
-			      friendly_name);
-		ret = i + 1;
-		goto selected;
-	}
-
-	snprintf(fname, sizeof(fname), "%s/osu-providers.html", dir);
-	f = fopen(fname, "w");
-	if (f == NULL) {
-		wpa_printf(MSG_INFO, "Could not open %s", fname);
-		free(osu);
-		return -1;
-	}
-
-	fprintf(f, "<html><head>"
-		"<meta http-equiv=\"Content-type\" content=\"text/html; "
-		"charset=utf-8\"<title>Select service operator</title>"
-		"</head><body><h1>Select service operator</h1>\n");
-
-	if (osu_count == 0)
-		fprintf(f, "No online signup available\n");
-
-	for (i = 0; i < osu_count; i++) {
-		last = &osu[i];
-#ifdef ANDROID
-		fprintf(f, "<p>\n"
-			"<a href=\"http://localhost:12345/osu/%d\">"
-			"<table><tr><td>", (int) i + 1);
-#else /* ANDROID */
-		fprintf(f, "<p>\n"
-			"<a href=\"osu://%d\">"
-			"<table><tr><td>", (int) i + 1);
-#endif /* ANDROID */
-		for (j = 0; j < last->icon_count; j++) {
-			fprintf(f, "<img src=\"osu-icon-%d.%s\">\n",
-				last->icon[j].id,
-				strcasecmp(last->icon[j].mime_type,
-					   "image/png") == 0 ? "png" : "icon");
-		}
-		fprintf(f, "<td>");
-		for (j = 0; j < last->friendly_name_count; j++) {
-			fprintf(f, "<small>[%s]</small> %s<br>\n",
-				last->friendly_name[j].lang,
-				last->friendly_name[j].text);
-		}
-		fprintf(f, "<tr><td colspan=2>");
-		for (j = 0; j < last->serv_desc_count; j++) {
-			fprintf(f, "<small>[%s]</small> %s<br>\n",
-				last->serv_desc[j].lang,
-				last->serv_desc[j].text);
-		}
-		fprintf(f, "</table></a><br><small>BSSID: %s<br>\n"
-			"SSID: %s<br>\n",
-			last->bssid, last->osu_ssid);
-		if (last->osu_ssid2[0])
-			fprintf(f, "SSID2: %s<br>\n", last->osu_ssid2);
-		if (last->osu_nai[0])
-			fprintf(f, "NAI: %s<br>\n", last->osu_nai);
-		if (last->osu_nai2[0])
-			fprintf(f, "NAI2: %s<br>\n", last->osu_nai2);
-		fprintf(f, "URL: %s<br>\n"
-			"methods:%s%s<br>\n"
-			"</small></p>\n",
-			last->url,
-			last->methods & 0x01 ? " OMA-DM" : "",
-			last->methods & 0x02 ? " SOAP-XML-SPP" : "");
-	}
-
-	fprintf(f, "</body></html>\n");
-
-	fclose(f);
-
-	snprintf(fname, sizeof(fname), "file://%s/osu-providers.html", dir);
-	write_summary(ctx, "Start web browser with OSU provider selection page");
-	ret = hs20_web_browser(fname, 0);
-
-selected:
-	if (ret > 0 && (size_t) ret <= osu_count) {
-		char *data;
-		size_t data_len;
-
-		wpa_printf(MSG_INFO, "Selected OSU id=%d", ret);
-		last = &osu[ret - 1];
-		ret = 0;
-		wpa_printf(MSG_INFO, "BSSID: %s", last->bssid);
-		wpa_printf(MSG_INFO, "SSID: %s", last->osu_ssid);
-		if (last->osu_ssid2[0])
-			wpa_printf(MSG_INFO, "SSID2: %s", last->osu_ssid2);
-		wpa_printf(MSG_INFO, "URL: %s", last->url);
-		write_summary(ctx, "Selected OSU provider id=%d BSSID=%s SSID=%s URL=%s",
-			      ret, last->bssid, last->osu_ssid, last->url);
-
-		ctx->friendly_name_count = last->friendly_name_count;
-		for (j = 0; j < last->friendly_name_count; j++) {
-			wpa_printf(MSG_INFO, "FRIENDLY_NAME: [%s]%s",
-				   last->friendly_name[j].lang,
-				   last->friendly_name[j].text);
-			os_strlcpy(ctx->friendly_name[j].lang,
-				   last->friendly_name[j].lang,
-				   sizeof(ctx->friendly_name[j].lang));
-			os_strlcpy(ctx->friendly_name[j].text,
-				   last->friendly_name[j].text,
-				   sizeof(ctx->friendly_name[j].text));
-		}
-
-		ctx->icon_count = last->icon_count;
-		for (j = 0; j < last->icon_count; j++) {
-			char fname[256];
-
-			os_snprintf(fname, sizeof(fname), "%s/osu-icon-%d.%s",
-				    dir, last->icon[j].id,
-				    strcasecmp(last->icon[j].mime_type,
-					       "image/png") == 0 ?
-				    "png" : "icon");
-			wpa_printf(MSG_INFO, "ICON: %s (%s)",
-				   fname, last->icon[j].filename);
-			os_strlcpy(ctx->icon_filename[j],
-				   last->icon[j].filename,
-				   sizeof(ctx->icon_filename[j]));
-
-			data = os_readfile(fname, &data_len);
-			if (data) {
-				sha256_vector(1, (const u8 **) &data, &data_len,
-					      ctx->icon_hash[j]);
-				os_free(data);
-			}
-		}
-
-		if (connect == 2) {
-			if (last->methods & 0x02) {
-				wpa_printf(MSG_DEBUG,
-					   "Calling cmd_prov from cmd_osu_select");
-				ret = cmd_prov(ctx, last->url);
-			} else if (last->methods & 0x01) {
-				wpa_printf(MSG_DEBUG,
-					   "Calling cmd_oma_dm_prov from cmd_osu_select");
-				ret = cmd_oma_dm_prov(ctx, last->url);
-			} else {
-				wpa_printf(MSG_DEBUG,
-					   "No supported OSU provisioning method");
-				ret = -1;
-			}
-		} else if (connect) {
-			ret = osu_connect(ctx, last->bssid, last->osu_ssid,
-					  last->osu_ssid2,
-					  last->url, last->methods,
-					  no_prod_assoc, last->osu_nai,
-					  last->osu_nai2);
-		}
-	} else
-		ret = -1;
-
-	free(osu);
-
-	return ret;
-}
-
-
-static int cmd_signup(struct hs20_osu_client *ctx, int no_prod_assoc,
-		      const char *friendly_name)
-{
-	char dir[255];
-	char fname[300], buf[400];
-	struct wpa_ctrl *mon;
-	const char *ifname;
-	int res;
-
-	ifname = ctx->ifname;
-
-	if (getcwd(dir, sizeof(dir)) == NULL)
-		return -1;
-
-	snprintf(fname, sizeof(fname), "%s/osu-info", dir);
-	if (mkdir(fname, S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH) < 0 &&
-	    errno != EEXIST) {
-		wpa_printf(MSG_INFO, "mkdir(%s) failed: %s",
-			   fname, strerror(errno));
-		return -1;
-	}
-
-	android_update_permission(fname, S_IRWXU | S_IRWXG | S_IROTH | S_IXOTH);
-
-	snprintf(buf, sizeof(buf), "SET osu_dir %s", fname);
-	if (wpa_command(ifname, buf) < 0) {
-		wpa_printf(MSG_INFO, "Failed to configure osu_dir to wpa_supplicant");
-		return -1;
-	}
-
-	mon = open_wpa_mon(ifname);
-	if (mon == NULL)
-		return -1;
-
-	wpa_printf(MSG_INFO, "Starting OSU fetch");
-	write_summary(ctx, "Starting OSU provider information fetch");
-	if (wpa_command(ifname, "FETCH_OSU") < 0) {
-		wpa_printf(MSG_INFO, "Could not start OSU fetch");
-		wpa_ctrl_detach(mon);
-		wpa_ctrl_close(mon);
-		return -1;
-	}
-	res = get_wpa_cli_event(mon, "OSU provider fetch completed",
-				buf, sizeof(buf));
-
-	wpa_ctrl_detach(mon);
-	wpa_ctrl_close(mon);
-
-	if (res < 0) {
-		wpa_printf(MSG_INFO, "OSU fetch did not complete");
-		write_summary(ctx, "OSU fetch did not complete");
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "OSU provider fetch completed");
-
-	return cmd_osu_select(ctx, fname, 1, no_prod_assoc, friendly_name);
-}
-
-
-static int cmd_sub_rem(struct hs20_osu_client *ctx, const char *address,
-		       const char *pps_fname, const char *ca_fname)
-{
-	xml_node_t *pps, *node;
-	char pps_fname_buf[300];
-	char ca_fname_buf[200];
-	char *cred_username = NULL;
-	char *cred_password = NULL;
-	char *sub_rem_uri = NULL;
-	char client_cert_buf[200];
-	char *client_cert = NULL;
-	char client_key_buf[200];
-	char *client_key = NULL;
-	int spp;
-
-	wpa_printf(MSG_INFO, "Subscription remediation requested with Server URL: %s",
-		   address);
-
-	if (!pps_fname) {
-		char buf[256];
-		wpa_printf(MSG_INFO, "Determining PPS file based on Home SP information");
-		if (os_strncmp(address, "fqdn=", 5) == 0) {
-			wpa_printf(MSG_INFO, "Use requested FQDN from command line");
-			os_snprintf(buf, sizeof(buf), "%s", address + 5);
-			address = NULL;
-		} else if (get_wpa_status(ctx->ifname, "provisioning_sp", buf,
-					  sizeof(buf)) < 0) {
-			wpa_printf(MSG_INFO, "Could not get provisioning Home SP FQDN from wpa_supplicant");
-			return -1;
-		}
-		os_free(ctx->fqdn);
-		ctx->fqdn = os_strdup(buf);
-		if (ctx->fqdn == NULL)
-			return -1;
-		wpa_printf(MSG_INFO, "Home SP FQDN for current credential: %s",
-			   buf);
-		os_snprintf(pps_fname_buf, sizeof(pps_fname_buf),
-			    "SP/%s/pps.xml", ctx->fqdn);
-		pps_fname = pps_fname_buf;
-
-		os_snprintf(ca_fname_buf, sizeof(ca_fname_buf), "SP/%s/ca.pem",
-			    ctx->fqdn);
-		ca_fname = ca_fname_buf;
-	}
-
-	if (!os_file_exists(pps_fname)) {
-		wpa_printf(MSG_INFO, "PPS file '%s' does not exist or is not accessible",
-			   pps_fname);
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "Using PPS file: %s", pps_fname);
-
-	if (ca_fname && !os_file_exists(ca_fname)) {
-		wpa_printf(MSG_INFO, "CA file '%s' does not exist or is not accessible",
-			   ca_fname);
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "Using server trust root: %s", ca_fname);
-	ctx->ca_fname = ca_fname;
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "Could not read PPS MO");
-		return -1;
-	}
-
-	if (!ctx->fqdn) {
-		char *tmp;
-		node = get_child_node(ctx->xml, pps, "HomeSP/FQDN");
-		if (node == NULL) {
-			wpa_printf(MSG_INFO, "No HomeSP/FQDN found from PPS");
-			return -1;
-		}
-		tmp = xml_node_get_text(ctx->xml, node);
-		if (tmp == NULL) {
-			wpa_printf(MSG_INFO, "No HomeSP/FQDN text found from PPS");
-			return -1;
-		}
-		ctx->fqdn = os_strdup(tmp);
-		xml_node_get_text_free(ctx->xml, tmp);
-		if (!ctx->fqdn) {
-			wpa_printf(MSG_INFO, "No FQDN known");
-			return -1;
-		}
-	}
-
-	node = get_child_node(ctx->xml, pps,
-			      "SubscriptionUpdate/UpdateMethod");
-	if (node) {
-		char *tmp;
-		tmp = xml_node_get_text(ctx->xml, node);
-		if (tmp && os_strcasecmp(tmp, "OMA-DM-ClientInitiated") == 0)
-			spp = 0;
-		else
-			spp = 1;
-	} else {
-		wpa_printf(MSG_INFO, "No UpdateMethod specified - assume SPP");
-		spp = 1;
-	}
-
-	get_user_pw(ctx, pps, "SubscriptionUpdate/UsernamePassword",
-		    &cred_username, &cred_password);
-	if (cred_username)
-		wpa_printf(MSG_INFO, "Using username: %s", cred_username);
-	if (cred_password)
-		wpa_printf(MSG_DEBUG, "Using password: %s", cred_password);
-
-	if (cred_username == NULL && cred_password == NULL &&
-	    get_child_node(ctx->xml, pps, "Credential/DigitalCertificate")) {
-		wpa_printf(MSG_INFO, "Using client certificate");
-		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
-			    "SP/%s/client-cert.pem", ctx->fqdn);
-		client_cert = client_cert_buf;
-		os_snprintf(client_key_buf, sizeof(client_key_buf),
-			    "SP/%s/client-key.pem", ctx->fqdn);
-		client_key = client_key_buf;
-		ctx->client_cert_present = 1;
-	}
-
-	node = get_child_node(ctx->xml, pps, "SubscriptionUpdate/URI");
-	if (node) {
-		sub_rem_uri = xml_node_get_text(ctx->xml, node);
-		if (sub_rem_uri &&
-		    (!address || os_strcmp(address, sub_rem_uri) != 0)) {
-			wpa_printf(MSG_INFO, "Override sub rem URI based on PPS: %s",
-				   sub_rem_uri);
-			address = sub_rem_uri;
-		}
-	}
-	if (!address) {
-		wpa_printf(MSG_INFO, "Server URL not known");
-		return -1;
-	}
-
-	write_summary(ctx, "Wait for IP address for subscriptiom remediation");
-	wpa_printf(MSG_INFO, "Wait for IP address before starting subscription remediation");
-
-	if (wait_ip_addr(ctx->ifname, 15) < 0) {
-		wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
-	}
-
-	if (spp)
-		spp_sub_rem(ctx, address, pps_fname,
-			    client_cert, client_key,
-			    cred_username, cred_password, pps);
-	else
-		oma_dm_sub_rem(ctx, address, pps_fname,
-			       client_cert, client_key,
-			       cred_username, cred_password, pps);
-
-	xml_node_get_text_free(ctx->xml, sub_rem_uri);
-	xml_node_get_text_free(ctx->xml, cred_username);
-	str_clear_free(cred_password);
-	xml_node_free(ctx->xml, pps);
-	return 0;
-}
-
-
-static int cmd_pol_upd(struct hs20_osu_client *ctx, const char *address,
-		       const char *pps_fname, const char *ca_fname)
-{
-	xml_node_t *pps;
-	xml_node_t *node;
-	char pps_fname_buf[300];
-	char ca_fname_buf[200];
-	char *uri = NULL;
-	char *cred_username = NULL;
-	char *cred_password = NULL;
-	char client_cert_buf[200];
-	char *client_cert = NULL;
-	char client_key_buf[200];
-	char *client_key = NULL;
-	int spp;
-
-	wpa_printf(MSG_INFO, "Policy update requested");
-
-	if (!pps_fname) {
-		char buf[256];
-		int res;
-
-		wpa_printf(MSG_INFO, "Determining PPS file based on Home SP information");
-		if (address && os_strncmp(address, "fqdn=", 5) == 0) {
-			wpa_printf(MSG_INFO, "Use requested FQDN from command line");
-			os_snprintf(buf, sizeof(buf), "%s", address + 5);
-			address = NULL;
-		} else if (get_wpa_status(ctx->ifname, "provisioning_sp", buf,
-					  sizeof(buf)) < 0) {
-			wpa_printf(MSG_INFO, "Could not get provisioning Home SP FQDN from wpa_supplicant");
-			return -1;
-		}
-		os_free(ctx->fqdn);
-		ctx->fqdn = os_strdup(buf);
-		if (ctx->fqdn == NULL)
-			return -1;
-		wpa_printf(MSG_INFO, "Home SP FQDN for current credential: %s",
-			   buf);
-		os_snprintf(pps_fname_buf, sizeof(pps_fname_buf),
-			    "SP/%s/pps.xml", ctx->fqdn);
-		pps_fname = pps_fname_buf;
-
-		res = os_snprintf(ca_fname_buf, sizeof(ca_fname_buf),
-				  "SP/%s/ca.pem", buf);
-		if (os_snprintf_error(sizeof(ca_fname_buf), res)) {
-			os_free(ctx->fqdn);
-			ctx->fqdn = NULL;
-			return -1;
-		}
-		ca_fname = ca_fname_buf;
-	}
-
-	if (!os_file_exists(pps_fname)) {
-		wpa_printf(MSG_INFO, "PPS file '%s' does not exist or is not accessible",
-			   pps_fname);
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "Using PPS file: %s", pps_fname);
-
-	if (ca_fname && !os_file_exists(ca_fname)) {
-		wpa_printf(MSG_INFO, "CA file '%s' does not exist or is not accessible",
-			   ca_fname);
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "Using server trust root: %s", ca_fname);
-	ctx->ca_fname = ca_fname;
-
-	pps = node_from_file(ctx->xml, pps_fname);
-	if (pps == NULL) {
-		wpa_printf(MSG_INFO, "Could not read PPS MO");
-		return -1;
-	}
-
-	if (!ctx->fqdn) {
-		char *tmp;
-		node = get_child_node(ctx->xml, pps, "HomeSP/FQDN");
-		if (node == NULL) {
-			wpa_printf(MSG_INFO, "No HomeSP/FQDN found from PPS");
-			return -1;
-		}
-		tmp = xml_node_get_text(ctx->xml, node);
-		if (tmp == NULL) {
-			wpa_printf(MSG_INFO, "No HomeSP/FQDN text found from PPS");
-			return -1;
-		}
-		ctx->fqdn = os_strdup(tmp);
-		xml_node_get_text_free(ctx->xml, tmp);
-		if (!ctx->fqdn) {
-			wpa_printf(MSG_INFO, "No FQDN known");
-			return -1;
-		}
-	}
-
-	node = get_child_node(ctx->xml, pps,
-			      "Policy/PolicyUpdate/UpdateMethod");
-	if (node) {
-		char *tmp;
-		tmp = xml_node_get_text(ctx->xml, node);
-		if (tmp && os_strcasecmp(tmp, "OMA-DM-ClientInitiated") == 0)
-			spp = 0;
-		else
-			spp = 1;
-	} else {
-		wpa_printf(MSG_INFO, "No UpdateMethod specified - assume SPP");
-		spp = 1;
-	}
-
-	get_user_pw(ctx, pps, "Policy/PolicyUpdate/UsernamePassword",
-		    &cred_username, &cred_password);
-	if (cred_username)
-		wpa_printf(MSG_INFO, "Using username: %s", cred_username);
-	if (cred_password)
-		wpa_printf(MSG_DEBUG, "Using password: %s", cred_password);
-
-	if (cred_username == NULL && cred_password == NULL &&
-	    get_child_node(ctx->xml, pps, "Credential/DigitalCertificate")) {
-		wpa_printf(MSG_INFO, "Using client certificate");
-		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
-			    "SP/%s/client-cert.pem", ctx->fqdn);
-		client_cert = client_cert_buf;
-		os_snprintf(client_key_buf, sizeof(client_key_buf),
-			    "SP/%s/client-key.pem", ctx->fqdn);
-		client_key = client_key_buf;
-	}
-
-	if (!address) {
-		node = get_child_node(ctx->xml, pps, "Policy/PolicyUpdate/URI");
-		if (node) {
-			uri = xml_node_get_text(ctx->xml, node);
-			wpa_printf(MSG_INFO, "URI based on PPS: %s", uri);
-			address = uri;
-		}
-	}
-	if (!address) {
-		wpa_printf(MSG_INFO, "Server URL not known");
-		return -1;
-	}
-
-	if (spp)
-		spp_pol_upd(ctx, address, pps_fname,
-			    client_cert, client_key,
-			    cred_username, cred_password, pps);
-	else
-		oma_dm_pol_upd(ctx, address, pps_fname,
-			       client_cert, client_key,
-			       cred_username, cred_password, pps);
-
-	xml_node_get_text_free(ctx->xml, uri);
-	xml_node_get_text_free(ctx->xml, cred_username);
-	str_clear_free(cred_password);
-	xml_node_free(ctx->xml, pps);
-
-	return 0;
-}
-
-
-static char * get_hostname(const char *url)
-{
-	const char *pos, *end, *end2;
-	char *ret;
-
-	if (url == NULL)
-		return NULL;
-
-	pos = os_strchr(url, '/');
-	if (pos == NULL)
-		return NULL;
-	pos++;
-	if (*pos != '/')
-		return NULL;
-	pos++;
-
-	end = os_strchr(pos, '/');
-	end2 = os_strchr(pos, ':');
-	if ((end && end2 && end2 < end) || (!end && end2))
-		end = end2;
-	if (end)
-		end--;
-	else {
-		end = pos;
-		while (*end)
-			end++;
-		if (end > pos)
-			end--;
-	}
-
-	ret = os_malloc(end - pos + 2);
-	if (ret == NULL)
-		return NULL;
-
-	os_memcpy(ret, pos, end - pos + 1);
-	ret[end - pos + 1] = '\0';
-
-	return ret;
-}
-
-
-static int osu_cert_cb(void *_ctx, struct http_cert *cert)
-{
-	struct hs20_osu_client *ctx = _ctx;
-	size_t i, j;
-	int found;
-	char *host = NULL;
-
-	wpa_printf(MSG_INFO, "osu_cert_cb(osu_cert_validation=%d, url=%s server_url=%s)",
-		   !ctx->no_osu_cert_validation, cert->url ? cert->url : "N/A",
-		   ctx->server_url);
-
-	if (ctx->no_osu_cert_validation && cert->url)
-		host = get_hostname(cert->url);
-	else
-		host = get_hostname(ctx->server_url);
-
-	if (!ctx->no_osu_cert_validation) {
-		for (i = 0; i < ctx->server_dnsname_count; i++)
-			os_free(ctx->server_dnsname[i]);
-		os_free(ctx->server_dnsname);
-		ctx->server_dnsname = os_calloc(cert->num_dnsname,
-						sizeof(char *));
-		ctx->server_dnsname_count = 0;
-	}
-
-	found = 0;
-	for (i = 0; i < cert->num_dnsname; i++) {
-		if (!ctx->no_osu_cert_validation && ctx->server_dnsname) {
-			ctx->server_dnsname[ctx->server_dnsname_count] =
-				os_strdup(cert->dnsname[i]);
-			if (ctx->server_dnsname[ctx->server_dnsname_count])
-				ctx->server_dnsname_count++;
-		}
-		if (host && os_strcasecmp(host, cert->dnsname[i]) == 0)
-			found = 1;
-		wpa_printf(MSG_INFO, "dNSName '%s'", cert->dnsname[i]);
-	}
-
-	if (host && !found) {
-		wpa_printf(MSG_INFO, "Server name from URL (%s) did not match any dNSName - abort connection",
-			   host);
-		write_result(ctx, "Server name from URL (%s) did not match any dNSName - abort connection",
-			     host);
-		os_free(host);
-		return -1;
-	}
-
-	os_free(host);
-
-	for (i = 0; i < cert->num_othername; i++) {
-		if (os_strcmp(cert->othername[i].oid,
-			      "1.3.6.1.4.1.40808.1.1.1") == 0) {
-			wpa_hexdump_ascii(MSG_INFO,
-					  "id-wfa-hotspot-friendlyName",
-					  cert->othername[i].data,
-					  cert->othername[i].len);
-		}
-	}
-
-	for (j = 0; !ctx->no_osu_cert_validation &&
-		     j < ctx->friendly_name_count; j++) {
-		int found = 0;
-		for (i = 0; i < cert->num_othername; i++) {
-			if (os_strcmp(cert->othername[i].oid,
-				      "1.3.6.1.4.1.40808.1.1.1") != 0)
-				continue;
-			if (cert->othername[i].len < 3)
-				continue;
-			if (os_strncasecmp((char *) cert->othername[i].data,
-					   ctx->friendly_name[j].lang, 3) != 0)
-				continue;
-			if (os_strncmp((char *) cert->othername[i].data + 3,
-				       ctx->friendly_name[j].text,
-				       cert->othername[i].len - 3) == 0) {
-				found = 1;
-				break;
-			}
-		}
-
-		if (!found) {
-			wpa_printf(MSG_INFO, "No friendly name match found for '[%s]%s'",
-				   ctx->friendly_name[j].lang,
-				   ctx->friendly_name[j].text);
-			write_result(ctx, "No friendly name match found for '[%s]%s'",
-				     ctx->friendly_name[j].lang,
-				     ctx->friendly_name[j].text);
-			return -1;
-		}
-	}
-
-	for (i = 0; i < cert->num_logo; i++) {
-		struct http_logo *logo = &cert->logo[i];
-
-		wpa_printf(MSG_INFO, "logo hash alg %s uri '%s'",
-			   logo->alg_oid, logo->uri);
-		wpa_hexdump_ascii(MSG_INFO, "hashValue",
-				  logo->hash, logo->hash_len);
-	}
-
-	for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
-		int found = 0;
-		char *name = ctx->icon_filename[j];
-		size_t name_len = os_strlen(name);
-
-		wpa_printf(MSG_INFO,
-			   "[%zu] Looking for icon file name '%s' match",
-			   j, name);
-		for (i = 0; i < cert->num_logo; i++) {
-			struct http_logo *logo = &cert->logo[i];
-			size_t uri_len = os_strlen(logo->uri);
-			char *pos;
-
-			wpa_printf(MSG_INFO,
-				   "[%zu] Comparing to '%s' uri_len=%d name_len=%d",
-				   i, logo->uri, (int) uri_len, (int) name_len);
-			if (uri_len < 1 + name_len) {
-				wpa_printf(MSG_INFO, "URI Length is too short");
-				continue;
-			}
-			pos = &logo->uri[uri_len - name_len - 1];
-			if (*pos != '/')
-				continue;
-			pos++;
-			if (os_strcmp(pos, name) == 0) {
-				found = 1;
-				break;
-			}
-		}
-
-		if (!found) {
-			wpa_printf(MSG_INFO, "No icon filename match found for '%s'",
-				   name);
-			write_result(ctx,
-				     "No icon filename match found for '%s'",
-				     name);
-			return -1;
-		}
-	}
-
-	for (j = 0; !ctx->no_osu_cert_validation && j < ctx->icon_count; j++) {
-		int found = 0;
-
-		for (i = 0; i < cert->num_logo; i++) {
-			struct http_logo *logo = &cert->logo[i];
-
-			if (logo->hash_len != 32) {
-				wpa_printf(MSG_INFO,
-					   "[%zu][%zu] Icon hash length invalid (should be 32): %d",
-					   j, i, (int) logo->hash_len);
-				continue;
-			}
-			if (os_memcmp(logo->hash, ctx->icon_hash[j], 32) == 0) {
-				found = 1;
-				break;
-			}
-
-			wpa_printf(MSG_DEBUG,
-				   "[%zu][%zu] Icon hash did not match", j, i);
-			wpa_hexdump_ascii(MSG_DEBUG, "logo->hash",
-					  logo->hash, 32);
-			wpa_hexdump_ascii(MSG_DEBUG, "ctx->icon_hash[j]",
-					  ctx->icon_hash[j], 32);
-		}
-
-		if (!found) {
-			wpa_printf(MSG_INFO,
-				   "No icon hash match (by hash) found");
-			write_result(ctx,
-				     "No icon hash match (by hash) found");
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-
 static int init_ctx(struct hs20_osu_client *ctx)
 {
-	xml_node_t *devinfo, *devid;
-
 	os_memset(ctx, 0, sizeof(*ctx));
 	ctx->ifname = "wlan0";
 	ctx->xml = xml_node_init_ctx(ctx, NULL);
 	if (ctx->xml == NULL)
 		return -1;
 
-	devinfo = node_from_file(ctx->xml, "devinfo.xml");
-	if (devinfo) {
-		devid = get_node(ctx->xml, devinfo, "DevId");
-		if (devid) {
-			char *tmp = xml_node_get_text(ctx->xml, devid);
-
-			if (tmp) {
-				ctx->devid = os_strdup(tmp);
-				xml_node_get_text_free(ctx->xml, tmp);
-			}
-		}
-		xml_node_free(ctx->xml, devinfo);
-	}
-
 	ctx->http = http_init_ctx(ctx, ctx->xml);
 	if (ctx->http == NULL) {
 		xml_node_deinit_ctx(ctx->xml);
 		return -1;
 	}
 	http_ocsp_set(ctx->http, 2);
-	http_set_cert_cb(ctx->http, osu_cert_cb, ctx);
 
 	return 0;
 }
@@ -3156,17 +1431,8 @@
 
 static void deinit_ctx(struct hs20_osu_client *ctx)
 {
-	size_t i;
-
 	http_deinit_ctx(ctx->http);
 	xml_node_deinit_ctx(ctx->xml);
-	os_free(ctx->fqdn);
-	os_free(ctx->server_url);
-	os_free(ctx->devid);
-
-	for (i = 0; i < ctx->server_dnsname_count; i++)
-		os_free(ctx->server_dnsname[i]);
-	os_free(ctx->server_dnsname);
 }
 
 
@@ -3209,19 +1475,8 @@
 	       "- from_tnds <XML MO in TNDS format> <XML MO>\n"
 	       "- set_pps <PerProviderSubscription XML file name>\n"
 	       "- get_fqdn <PerProviderSubscription XML file name>\n"
-	       "- pol_upd [Server URL] [PPS] [CA cert]\n"
-	       "- sub_rem <Server URL> [PPS] [CA cert]\n"
-	       "- prov <Server URL> [CA cert]\n"
-	       "- oma_dm_prov <Server URL> [CA cert]\n"
-	       "- sim_prov <Server URL> [CA cert]\n"
-	       "- oma_dm_sim_prov <Server URL> [CA cert]\n"
-	       "- signup [CA cert]\n"
-	       "- dl_osu_ca <PPS> <CA file>\n"
-	       "- dl_polupd_ca <PPS> <CA file>\n"
 	       "- dl_aaa_ca <PPS> <CA file>\n"
-	       "- browser <URL>\n"
-	       "- parse_cert <X.509 certificate (DER)>\n"
-	       "- osu_select <OSU info directory> [CA cert]\n");
+	       "- browser <URL>\n");
 }
 
 
@@ -3230,8 +1485,6 @@
 	struct hs20_osu_client ctx;
 	int c;
 	int ret = 0;
-	int no_prod_assoc = 0;
-	const char *friendly_name = NULL;
 	const char *wpa_debug_file_path = NULL;
 	extern char *wpas_ctrl_path;
 	extern int wpa_debug_level;
@@ -3242,7 +1495,7 @@
 		return -1;
 
 	for (;;) {
-		c = getopt(argc, argv, "df:hKNo:O:qr:s:S:tTw:x:");
+		c = getopt(argc, argv, "df:hKqr:s:S:tTw:");
 		if (c < 0)
 			break;
 		switch (c) {
@@ -3256,15 +1509,6 @@
 		case 'K':
 			wpa_debug_show_keys++;
 			break;
-		case 'N':
-			no_prod_assoc = 1;
-			break;
-		case 'o':
-			ctx.osu_ssid = optarg;
-			break;
-		case 'O':
-			friendly_name = optarg;
-			break;
 		case 'q':
 			wpa_debug_level++;
 			break;
@@ -3286,9 +1530,6 @@
 		case 'w':
 			wpas_ctrl_path = optarg;
 			break;
-		case 'x':
-			spp_xsd_fname = optarg;
-			break;
 		case 'h':
 		default:
 			usage();
@@ -3335,62 +1576,12 @@
 			exit(0);
 		}
 		cmd_from_tnds(&ctx, argv[optind + 1], argv[optind + 2]);
-	} else if (strcmp(argv[optind], "sub_rem") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ret = cmd_sub_rem(&ctx, argv[optind + 1],
-				  argc > optind + 2 ? argv[optind + 2] : NULL,
-				  argc > optind + 3 ? argv[optind + 3] : NULL);
-	} else if (strcmp(argv[optind], "pol_upd") == 0) {
-		ret = cmd_pol_upd(&ctx,
-				  argc > optind + 1 ? argv[optind + 1] : NULL,
-				  argc > optind + 2 ? argv[optind + 2] : NULL,
-				  argc > optind + 3 ? argv[optind + 3] : NULL);
-	} else if (strcmp(argv[optind], "prov") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ctx.ca_fname = argv[optind + 2];
-		wpa_printf(MSG_DEBUG, "Calling cmd_prov from main");
-		cmd_prov(&ctx, argv[optind + 1]);
-	} else if (strcmp(argv[optind], "sim_prov") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ctx.ca_fname = argv[optind + 2];
-		cmd_sim_prov(&ctx, argv[optind + 1]);
-	} else if (strcmp(argv[optind], "dl_osu_ca") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		cmd_dl_osu_ca(&ctx, argv[optind + 1], argv[optind + 2]);
-	} else if (strcmp(argv[optind], "dl_polupd_ca") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		cmd_dl_polupd_ca(&ctx, argv[optind + 1], argv[optind + 2]);
 	} else if (strcmp(argv[optind], "dl_aaa_ca") == 0) {
 		if (argc - optind < 2) {
 			usage();
 			exit(0);
 		}
 		cmd_dl_aaa_ca(&ctx, argv[optind + 1], argv[optind + 2]);
-	} else if (strcmp(argv[optind], "osu_select") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ctx.ca_fname = argc > optind + 2 ? argv[optind + 2] : NULL;
-		cmd_osu_select(&ctx, argv[optind + 1], 2, 1, NULL);
-	} else if (strcmp(argv[optind], "signup") == 0) {
-		ctx.ca_fname = argc > optind + 1 ? argv[optind + 1] : NULL;
-		ret = cmd_signup(&ctx, no_prod_assoc, friendly_name);
 	} else if (strcmp(argv[optind], "set_pps") == 0) {
 		if (argc - optind < 2) {
 			usage();
@@ -3403,42 +1594,6 @@
 			exit(0);
 		}
 		ret = cmd_get_fqdn(&ctx, argv[optind + 1]);
-	} else if (strcmp(argv[optind], "oma_dm_prov") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ctx.ca_fname = argv[optind + 2];
-		cmd_oma_dm_prov(&ctx, argv[optind + 1]);
-	} else if (strcmp(argv[optind], "oma_dm_sim_prov") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		ctx.ca_fname = argv[optind + 2];
-		if (cmd_oma_dm_sim_prov(&ctx, argv[optind + 1]) < 0) {
-			write_summary(&ctx, "Failed to complete OMA DM SIM provisioning");
-			return -1;
-		}
-	} else if (strcmp(argv[optind], "oma_dm_add") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		cmd_oma_dm_add(&ctx, argv[optind + 1], argv[optind + 2]);
-	} else if (strcmp(argv[optind], "oma_dm_replace") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		cmd_oma_dm_replace(&ctx, argv[optind + 1], argv[optind + 2]);
-	} else if (strcmp(argv[optind], "est_csr") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-		mkdir("Cert", S_IRWXU);
-		est_build_csr(&ctx, argv[optind + 1]);
 	} else if (strcmp(argv[optind], "browser") == 0) {
 		int ret;
 
@@ -3451,15 +1606,6 @@
 			   argv[optind + 1]);
 		ret = hs20_web_browser(argv[optind + 1], ctx.ignore_tls);
 		wpa_printf(MSG_INFO, "Web browser result: %d", ret);
-	} else if (strcmp(argv[optind], "parse_cert") == 0) {
-		if (argc - optind < 2) {
-			usage();
-			exit(0);
-		}
-
-		wpa_debug_level = MSG_MSGDUMP;
-		http_parse_x509_certificate(ctx.http, argv[optind + 1]);
-		wpa_debug_level = MSG_INFO;
 	} else {
 		wpa_printf(MSG_INFO, "Unknown command '%s'", argv[optind]);
 	}
diff --git a/hs20/client/osu_client.h b/hs20/client/osu_client.h
index 9b45b03..3bfbb0d 100644
--- a/hs20/client/osu_client.h
+++ b/hs20/client/osu_client.h
@@ -9,113 +9,16 @@
 #ifndef OSU_CLIENT_H
 #define OSU_CLIENT_H
 
-#define SPP_NS_URI "http://www.wi-fi.org/specifications/hotspot2dot0/v1.0/spp"
-
-#define URN_OMA_DM_DEVINFO "urn:oma:mo:oma-dm-devinfo:1.0"
-#define URN_OMA_DM_DEVDETAIL "urn:oma:mo:oma-dm-devdetail:1.0"
-#define URN_HS20_DEVDETAIL_EXT "urn:wfa:mo-ext:hotspot2dot0-devdetail-ext:1.0"
-#define URN_HS20_PPS "urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0"
-
-
-#define MAX_OSU_VALS 10
-
-struct osu_lang_text {
-	char lang[4];
-	char text[253];
-};
-
 struct hs20_osu_client {
 	struct xml_node_ctx *xml;
 	struct http_ctx *http;
-	int no_reconnect;
-	char pps_fname[300];
-	char *devid;
 	const char *result_file;
 	const char *summary_file;
 	const char *ifname;
-	const char *ca_fname;
-	int no_osu_cert_validation; /* for EST operations */
-	char *fqdn;
-	char *server_url;
-	struct osu_lang_text friendly_name[MAX_OSU_VALS];
-	size_t friendly_name_count;
-	size_t icon_count;
-	char icon_filename[MAX_OSU_VALS][256];
-	u8 icon_hash[MAX_OSU_VALS][32];
-	int pps_cred_set;
-	int pps_updated;
-	int client_cert_present;
-	char **server_dnsname;
-	size_t server_dnsname_count;
-	const char *osu_ssid; /* Enforced OSU_SSID for testing purposes */
 #define WORKAROUND_OCSP_OPTIONAL 0x00000001
 	unsigned long int workarounds;
 	int ignore_tls; /* whether to ignore TLS validation issues with HTTPS
 			 * server certificate */
 };
 
-
-/* osu_client.c */
-
-void write_result(struct hs20_osu_client *ctx, const char *fmt, ...)
-	__attribute__ ((format (printf, 2, 3)));
-void write_summary(struct hs20_osu_client *ctx, const char *fmt, ...)
-	__attribute__ ((format (printf, 2, 3)));
-
-void debug_dump_node(struct hs20_osu_client *ctx, const char *title,
-		     xml_node_t *node);
-int osu_get_certificate(struct hs20_osu_client *ctx, xml_node_t *getcert);
-int hs20_add_pps_mo(struct hs20_osu_client *ctx, const char *uri,
-		    xml_node_t *add_mo, char *fname, size_t fname_len);
-void get_user_pw(struct hs20_osu_client *ctx, xml_node_t *pps,
-		 const char *alt_loc, char **user, char **pw);
-int update_pps_file(struct hs20_osu_client *ctx, const char *pps_fname,
-		    xml_node_t *pps);
-void cmd_set_pps(struct hs20_osu_client *ctx, const char *pps_fname);
-
-
-/* spp_client.c */
-
-void spp_sub_rem(struct hs20_osu_client *ctx, const char *address,
-		 const char *pps_fname,
-		 const char *client_cert, const char *client_key,
-		 const char *cred_username, const char *cred_password,
-		 xml_node_t *pps);
-void spp_pol_upd(struct hs20_osu_client *ctx, const char *address,
-		 const char *pps_fname,
-		 const char *client_cert, const char *client_key,
-		 const char *cred_username, const char *cred_password,
-		 xml_node_t *pps);
-int cmd_prov(struct hs20_osu_client *ctx, const char *url);
-int cmd_sim_prov(struct hs20_osu_client *ctx, const char *url);
-
-
-/* oma_dm_client.c */
-
-int cmd_oma_dm_prov(struct hs20_osu_client *ctx, const char *url);
-int cmd_oma_dm_sim_prov(struct hs20_osu_client *ctx, const char *url);
-void oma_dm_sub_rem(struct hs20_osu_client *ctx, const char *address,
-		    const char *pps_fname,
-		    const char *client_cert, const char *client_key,
-		    const char *cred_username, const char *cred_password,
-		    xml_node_t *pps);
-void oma_dm_pol_upd(struct hs20_osu_client *ctx, const char *address,
-		    const char *pps_fname,
-		    const char *client_cert, const char *client_key,
-		    const char *cred_username, const char *cred_password,
-		    xml_node_t *pps);
-void cmd_oma_dm_sub_rem(struct hs20_osu_client *ctx, const char *address,
-			const char *pps_fname);
-void cmd_oma_dm_add(struct hs20_osu_client *ctx, const char *pps_fname,
-		    const char *add_fname);
-void cmd_oma_dm_replace(struct hs20_osu_client *ctx, const char *pps_fname,
-			const char *replace_fname);
-
-/* est.c */
-
-int est_load_cacerts(struct hs20_osu_client *ctx, const char *url);
-int est_build_csr(struct hs20_osu_client *ctx, const char *url);
-int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
-		      const char *user, const char *pw);
-
 #endif /* OSU_CLIENT_H */
diff --git a/hs20/client/spp_client.c b/hs20/client/spp_client.c
deleted file mode 100644
index 194518e..0000000
--- a/hs20/client/spp_client.c
+++ /dev/null
@@ -1,1003 +0,0 @@
-/*
- * Hotspot 2.0 SPP client
- * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include "includes.h"
-#include <sys/stat.h>
-
-#include "common.h"
-#include "browser.h"
-#include "wpa_ctrl.h"
-#include "wpa_helpers.h"
-#include "xml-utils.h"
-#include "http-utils.h"
-#include "utils/base64.h"
-#include "crypto/crypto.h"
-#include "crypto/sha256.h"
-#include "osu_client.h"
-
-
-extern const char *spp_xsd_fname;
-
-static int hs20_spp_update_response(struct hs20_osu_client *ctx,
-				    const char *session_id,
-				    const char *spp_status,
-				    const char *error_code);
-static void hs20_policy_update_complete(
-	struct hs20_osu_client *ctx, const char *pps_fname);
-
-
-static char * get_spp_attr_value(struct xml_node_ctx *ctx, xml_node_t *node,
-				 char *attr_name)
-{
-	return xml_node_get_attr_value_ns(ctx, node, SPP_NS_URI, attr_name);
-}
-
-
-static int hs20_spp_validate(struct hs20_osu_client *ctx, xml_node_t *node,
-			     const char *expected_name)
-{
-	struct xml_node_ctx *xctx = ctx->xml;
-	const char *name;
-	char *err;
-	int ret;
-
-	if (!xml_node_is_element(xctx, node))
-		return -1;
-
-	name = xml_node_get_localname(xctx, node);
-	if (name == NULL)
-		return -1;
-
-	if (strcmp(expected_name, name) != 0) {
-		wpa_printf(MSG_INFO, "Unexpected SOAP method name '%s' (expected '%s')",
-			   name, expected_name);
-		write_summary(ctx, "Unexpected SOAP method name '%s' (expected '%s')",
-			      name, expected_name);
-		return -1;
-	}
-
-	ret = xml_validate(xctx, node, spp_xsd_fname, &err);
-	if (ret < 0) {
-		wpa_printf(MSG_INFO, "XML schema validation error(s)\n%s", err);
-		write_summary(ctx, "SPP XML schema validation failed");
-		os_free(err);
-	}
-	return ret;
-}
-
-
-static void add_mo_container(struct xml_node_ctx *ctx, xml_namespace_t *ns,
-			     xml_node_t *parent, const char *urn,
-			     const char *fname)
-{
-	xml_node_t *node;
-	xml_node_t *fnode, *tnds;
-	char *str;
-
-	errno = 0;
-	fnode = node_from_file(ctx, fname);
-	if (!fnode) {
-		wpa_printf(MSG_ERROR,
-			   "Failed to create XML node from file: %s, possible error: %s",
-			   fname, strerror(errno));
-		return;
-	}
-	tnds = mo_to_tnds(ctx, fnode, 0, urn, "syncml:dmddf1.2");
-	xml_node_free(ctx, fnode);
-	if (!tnds)
-		return;
-
-	str = xml_node_to_str(ctx, tnds);
-	xml_node_free(ctx, tnds);
-	if (str == NULL)
-		return;
-
-	node = xml_node_create_text(ctx, parent, ns, "moContainer", str);
-	if (node)
-		xml_node_add_attr(ctx, node, ns, "moURN", urn);
-	os_free(str);
-}
-
-
-static xml_node_t * build_spp_post_dev_data(struct hs20_osu_client *ctx,
-					    xml_namespace_t **ret_ns,
-					    const char *session_id,
-					    const char *reason)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node;
-
-	write_summary(ctx, "Building sppPostDevData requestReason='%s'",
-		      reason);
-	spp_node = xml_node_create_root(ctx->xml, SPP_NS_URI, "spp", &ns,
-					"sppPostDevData");
-	if (spp_node == NULL)
-		return NULL;
-	if (ret_ns)
-		*ret_ns = ns;
-
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppVersion", "1.0");
-	xml_node_add_attr(ctx->xml, spp_node, NULL, "requestReason", reason);
-	if (session_id)
-		xml_node_add_attr(ctx->xml, spp_node, ns, "sessionID",
-				  session_id);
-	xml_node_add_attr(ctx->xml, spp_node, NULL, "redirectURI",
-			  "http://localhost:12345/");
-
-	xml_node_create_text(ctx->xml, spp_node, ns, "supportedSPPVersions",
-			     "1.0");
-	xml_node_create_text(ctx->xml, spp_node, ns, "supportedMOList",
-			     URN_HS20_PPS " " URN_OMA_DM_DEVINFO " "
-			     URN_OMA_DM_DEVDETAIL " " URN_HS20_DEVDETAIL_EXT);
-
-	add_mo_container(ctx->xml, ns, spp_node, URN_OMA_DM_DEVINFO,
-			 "devinfo.xml");
-	add_mo_container(ctx->xml, ns, spp_node, URN_OMA_DM_DEVDETAIL,
-			 "devdetail.xml");
-
-	return spp_node;
-}
-
-
-static int process_update_node(struct hs20_osu_client *ctx, xml_node_t *pps,
-			       xml_node_t *update)
-{
-	xml_node_t *node, *parent, *tnds, *unode;
-	char *str;
-	const char *name;
-	char *uri, *pos;
-	char *cdata, *cdata_end;
-	size_t fqdn_len;
-
-	wpa_printf(MSG_INFO, "Processing updateNode");
-	debug_dump_node(ctx, "updateNode", update);
-
-	uri = get_spp_attr_value(ctx->xml, update, "managementTreeURI");
-	if (uri == NULL) {
-		wpa_printf(MSG_INFO, "No managementTreeURI present");
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "managementTreeUri: '%s'", uri);
-
-	name = os_strrchr(uri, '/');
-	if (name == NULL) {
-		wpa_printf(MSG_INFO, "Unexpected URI");
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	name++;
-	wpa_printf(MSG_INFO, "Update interior node: '%s'", name);
-
-	str = xml_node_get_text(ctx->xml, update);
-	if (str == NULL) {
-		wpa_printf(MSG_INFO, "Could not extract MO text");
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	wpa_printf(MSG_DEBUG, "[hs20] nodeContainer text: '%s'", str);
-	cdata = strstr(str, "<![CDATA[");
-	cdata_end = strstr(str, "]]>");
-	if (cdata && cdata_end && cdata_end > cdata &&
-	    cdata < strstr(str, "MgmtTree") &&
-	    cdata_end > strstr(str, "/MgmtTree")) {
-		char *tmp;
-		wpa_printf(MSG_DEBUG, "[hs20] Removing extra CDATA container");
-		tmp = strdup(cdata + 9);
-		if (tmp) {
-			cdata_end = strstr(tmp, "]]>");
-			if (cdata_end)
-				*cdata_end = '\0';
-			wpa_printf(MSG_DEBUG, "[hs20] nodeContainer text with CDATA container removed: '%s'",
-				   tmp);
-			tnds = xml_node_from_buf(ctx->xml, tmp);
-			free(tmp);
-		} else
-			tnds = NULL;
-	} else
-		tnds = xml_node_from_buf(ctx->xml, str);
-	xml_node_get_text_free(ctx->xml, str);
-	if (tnds == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] Could not parse nodeContainer text");
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-
-	unode = tnds_to_mo(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (unode == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] Could not parse nodeContainer TNDS text");
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-
-	debug_dump_node(ctx, "Parsed TNDS", unode);
-
-	if (get_node_uri(ctx->xml, unode, name) == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] %s node not found", name);
-		xml_node_free(ctx->xml, unode);
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-
-	if (os_strncasecmp(uri, "./Wi-Fi/", 8) != 0) {
-		wpa_printf(MSG_INFO, "Do not allow update outside ./Wi-Fi");
-		xml_node_free(ctx->xml, unode);
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	pos = uri + 8;
-
-	if (ctx->fqdn == NULL) {
-		wpa_printf(MSG_INFO, "FQDN not known");
-		xml_node_free(ctx->xml, unode);
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	fqdn_len = os_strlen(ctx->fqdn);
-	if (os_strncasecmp(pos, ctx->fqdn, fqdn_len) != 0 ||
-	    pos[fqdn_len] != '/') {
-		wpa_printf(MSG_INFO, "Do not allow update outside ./Wi-Fi/%s",
-			   ctx->fqdn);
-		xml_node_free(ctx->xml, unode);
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	pos += fqdn_len + 1;
-
-	if (os_strncasecmp(pos, "PerProviderSubscription/", 24) != 0) {
-		wpa_printf(MSG_INFO, "Do not allow update outside ./Wi-Fi/%s/PerProviderSubscription",
-			   ctx->fqdn);
-		xml_node_free(ctx->xml, unode);
-		xml_node_get_attr_value_free(ctx->xml, uri);
-		return -1;
-	}
-	pos += 24;
-
-	wpa_printf(MSG_INFO, "Update command for PPS node %s", pos);
-
-	node = get_node(ctx->xml, pps, pos);
-	if (node) {
-		parent = xml_node_get_parent(ctx->xml, node);
-		xml_node_detach(ctx->xml, node);
-		wpa_printf(MSG_INFO, "Replace '%s' node", name);
-	} else {
-		char *pos2;
-		pos2 = os_strrchr(pos, '/');
-		if (pos2 == NULL) {
-			parent = pps;
-		} else {
-			*pos2 = '\0';
-			parent = get_node(ctx->xml, pps, pos);
-		}
-		if (parent == NULL) {
-			wpa_printf(MSG_INFO, "Could not find parent %s", pos);
-			xml_node_free(ctx->xml, unode);
-			xml_node_get_attr_value_free(ctx->xml, uri);
-			return -1;
-		}
-		wpa_printf(MSG_INFO, "Add '%s' node", name);
-	}
-	xml_node_add_child(ctx->xml, parent, unode);
-
-	xml_node_get_attr_value_free(ctx->xml, uri);
-
-	return 0;
-}
-
-
-static int update_pps(struct hs20_osu_client *ctx, xml_node_t *update,
-		      const char *pps_fname, xml_node_t *pps)
-{
-	wpa_printf(MSG_INFO, "Updating PPS based on updateNode element(s)");
-	xml_node_for_each_sibling(ctx->xml, update) {
-		xml_node_for_each_check(ctx->xml, update);
-		if (process_update_node(ctx, pps, update) < 0)
-			return -1;
-	}
-
-	return update_pps_file(ctx, pps_fname, pps);
-}
-
-
-static void hs20_sub_rem_complete(struct hs20_osu_client *ctx,
-				  const char *pps_fname)
-{
-	/*
-	 * Update wpa_supplicant credentials and reconnect using updated
-	 * information.
-	 */
-	wpa_printf(MSG_INFO, "Updating wpa_supplicant credentials");
-	cmd_set_pps(ctx, pps_fname);
-
-	if (ctx->no_reconnect)
-		return;
-
-	wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
-	if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0)
-		wpa_printf(MSG_ERROR, "Failed to request wpa_supplicant to reconnect");
-}
-
-
-static xml_node_t * hs20_spp_upload_mo(struct hs20_osu_client *ctx,
-				       xml_node_t *cmd,
-				       const char *session_id,
-				       const char *pps_fname)
-{
-	xml_namespace_t *ns;
-	xml_node_t *node, *ret_node;
-	char *urn;
-
-	urn = get_spp_attr_value(ctx->xml, cmd, "moURN");
-	if (!urn) {
-		wpa_printf(MSG_INFO, "No URN included");
-		return NULL;
-	}
-	wpa_printf(MSG_INFO, "Upload MO request - URN=%s", urn);
-	if (strcasecmp(urn, URN_HS20_PPS) != 0) {
-		wpa_printf(MSG_INFO, "Unsupported moURN");
-		xml_node_get_attr_value_free(ctx->xml, urn);
-		return NULL;
-	}
-	xml_node_get_attr_value_free(ctx->xml, urn);
-
-	if (!pps_fname) {
-		wpa_printf(MSG_INFO, "PPS file name no known");
-		return NULL;
-	}
-
-	node = build_spp_post_dev_data(ctx, &ns, session_id,
-				       "MO upload");
-	if (node == NULL)
-		return NULL;
-	add_mo_container(ctx->xml, ns, node, URN_HS20_PPS, pps_fname);
-
-	ret_node = soap_send_receive(ctx->http, node);
-	if (ret_node == NULL)
-		return NULL;
-
-	debug_dump_node(ctx, "Received response to MO upload", ret_node);
-
-	if (hs20_spp_validate(ctx, ret_node, "sppPostDevDataResponse") < 0) {
-		wpa_printf(MSG_INFO, "SPP validation failed");
-		xml_node_free(ctx->xml, ret_node);
-		return NULL;
-	}
-
-	return ret_node;
-}
-
-
-static int hs20_add_mo(struct hs20_osu_client *ctx, xml_node_t *add_mo,
-		       char *fname, size_t fname_len)
-{
-	char *uri, *urn;
-	int ret;
-
-	debug_dump_node(ctx, "Received addMO", add_mo);
-
-	urn = get_spp_attr_value(ctx->xml, add_mo, "moURN");
-	if (urn == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] No moURN in addMO");
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "addMO - moURN: '%s'", urn);
-	if (strcasecmp(urn, URN_HS20_PPS) != 0) {
-		wpa_printf(MSG_INFO, "[hs20] Unsupported MO in addMO");
-		xml_node_get_attr_value_free(ctx->xml, urn);
-		return -1;
-	}
-	xml_node_get_attr_value_free(ctx->xml, urn);
-
-	uri = get_spp_attr_value(ctx->xml, add_mo, "managementTreeURI");
-	if (uri == NULL) {
-		wpa_printf(MSG_INFO, "[hs20] No managementTreeURI in addMO");
-		return -1;
-	}
-	wpa_printf(MSG_INFO, "addMO - managementTreeURI: '%s'", uri);
-
-	ret = hs20_add_pps_mo(ctx, uri, add_mo, fname, fname_len);
-	xml_node_get_attr_value_free(ctx->xml, uri);
-	return ret;
-}
-
-
-static int process_spp_user_input_response(struct hs20_osu_client *ctx,
-					   const char *session_id,
-					   xml_node_t *add_mo)
-{
-	int ret;
-	char fname[300];
-
-	debug_dump_node(ctx, "addMO", add_mo);
-
-	wpa_printf(MSG_INFO, "Subscription registration completed");
-
-	if (hs20_add_mo(ctx, add_mo, fname, sizeof(fname)) < 0) {
-		wpa_printf(MSG_INFO, "Could not add MO");
-		ret = hs20_spp_update_response(
-			ctx, session_id,
-			"Error occurred",
-			"MO addition or update failed");
-		return 0;
-	}
-
-	ret = hs20_spp_update_response(ctx, session_id, "OK", NULL);
-	if (ret == 0)
-		hs20_sub_rem_complete(ctx, fname);
-
-	return 0;
-}
-
-
-static xml_node_t * hs20_spp_user_input_completed(struct hs20_osu_client *ctx,
-						    const char *session_id)
-{
-	xml_node_t *node, *ret_node;
-
-	node = build_spp_post_dev_data(ctx, NULL, session_id,
-				       "User input completed");
-	if (node == NULL)
-		return NULL;
-
-	ret_node = soap_send_receive(ctx->http, node);
-	if (!ret_node) {
-		if (soap_reinit_client(ctx->http) < 0)
-			return NULL;
-		wpa_printf(MSG_INFO, "Try to finish with re-opened connection");
-		node = build_spp_post_dev_data(ctx, NULL, session_id,
-					       "User input completed");
-		if (node == NULL)
-			return NULL;
-		ret_node = soap_send_receive(ctx->http, node);
-		if (ret_node == NULL)
-			return NULL;
-		wpa_printf(MSG_INFO, "Continue with new connection");
-	}
-
-	if (hs20_spp_validate(ctx, ret_node, "sppPostDevDataResponse") < 0) {
-		wpa_printf(MSG_INFO, "SPP validation failed");
-		xml_node_free(ctx->xml, ret_node);
-		return NULL;
-	}
-
-	return ret_node;
-}
-
-
-static xml_node_t * hs20_spp_get_certificate(struct hs20_osu_client *ctx,
-					     xml_node_t *cmd,
-					     const char *session_id,
-					     const char *pps_fname)
-{
-	xml_namespace_t *ns;
-	xml_node_t *node, *ret_node;
-	int res;
-
-	wpa_printf(MSG_INFO, "Client certificate enrollment");
-
-	res = osu_get_certificate(ctx, cmd);
-	if (res < 0)
-		wpa_printf(MSG_INFO, "EST simpleEnroll failed");
-
-	node = build_spp_post_dev_data(ctx, &ns, session_id,
-				       res == 0 ?
-				       "Certificate enrollment completed" :
-				       "Certificate enrollment failed");
-	if (node == NULL)
-		return NULL;
-
-	ret_node = soap_send_receive(ctx->http, node);
-	if (ret_node == NULL)
-		return NULL;
-
-	debug_dump_node(ctx, "Received response to certificate enrollment "
-			"completed", ret_node);
-
-	if (hs20_spp_validate(ctx, ret_node, "sppPostDevDataResponse") < 0) {
-		wpa_printf(MSG_INFO, "SPP validation failed");
-		xml_node_free(ctx->xml, ret_node);
-		return NULL;
-	}
-
-	return ret_node;
-}
-
-
-static int hs20_spp_exec(struct hs20_osu_client *ctx, xml_node_t *exec,
-			 const char *session_id, const char *pps_fname,
-			 xml_node_t *pps, xml_node_t **ret_node)
-{
-	xml_node_t *cmd;
-	const char *name;
-	char *uri;
-	char *id = strdup(session_id);
-
-	if (id == NULL)
-		return -1;
-
-	*ret_node = NULL;
-
-	debug_dump_node(ctx, "exec", exec);
-
-	xml_node_for_each_child(ctx->xml, cmd, exec) {
-		xml_node_for_each_check(ctx->xml, cmd);
-		break;
-	}
-	if (!cmd) {
-		wpa_printf(MSG_INFO, "exec command element not found (cmd=%p)",
-			   cmd);
-		free(id);
-		return -1;
-	}
-
-	name = xml_node_get_localname(ctx->xml, cmd);
-
-	if (strcasecmp(name, "launchBrowserToURI") == 0) {
-		int res;
-		uri = xml_node_get_text(ctx->xml, cmd);
-		if (!uri) {
-			wpa_printf(MSG_INFO, "No URI found");
-			free(id);
-			return -1;
-		}
-		wpa_printf(MSG_INFO, "Launch browser to URI '%s'", uri);
-		write_summary(ctx, "Launch browser to URI '%s'", uri);
-		res = hs20_web_browser(uri, 1);
-		xml_node_get_text_free(ctx->xml, uri);
-		if (res > 0) {
-			wpa_printf(MSG_INFO, "User response in browser completed successfully - sessionid='%s'",
-				   id);
-			write_summary(ctx, "User response in browser completed successfully");
-			*ret_node = hs20_spp_user_input_completed(ctx, id);
-			free(id);
-			return *ret_node ? 0 : -1;
-		} else {
-			wpa_printf(MSG_INFO, "Failed to receive user response");
-			write_summary(ctx, "Failed to receive user response");
-			hs20_spp_update_response(
-				ctx, id, "Error occurred", "Other");
-			free(id);
-			return -1;
-		}
-	}
-
-	if (strcasecmp(name, "uploadMO") == 0) {
-		if (pps_fname == NULL)
-			return -1;
-		*ret_node = hs20_spp_upload_mo(ctx, cmd, id,
-					       pps_fname);
-		free(id);
-		return *ret_node ? 0 : -1;
-	}
-
-	if (strcasecmp(name, "getCertificate") == 0) {
-		*ret_node = hs20_spp_get_certificate(ctx, cmd, id,
-						     pps_fname);
-		free(id);
-		return *ret_node ? 0 : -1;
-	}
-
-	wpa_printf(MSG_INFO, "Unsupported exec command: '%s'", name);
-	free(id);
-	return -1;
-}
-
-
-enum spp_post_dev_data_use {
-	SPP_SUBSCRIPTION_REMEDIATION,
-	SPP_POLICY_UPDATE,
-	SPP_SUBSCRIPTION_REGISTRATION,
-};
-
-static void process_spp_post_dev_data_response(
-	struct hs20_osu_client *ctx,
-	enum spp_post_dev_data_use use, xml_node_t *node,
-	const char *pps_fname, xml_node_t *pps)
-{
-	xml_node_t *child;
-	char *status = NULL;
-	xml_node_t *update = NULL, *exec = NULL, *add_mo = NULL, *no_mo = NULL;
-	char *session_id = NULL;
-
-	debug_dump_node(ctx, "sppPostDevDataResponse node", node);
-
-	status = get_spp_attr_value(ctx->xml, node, "sppStatus");
-	if (status == NULL) {
-		wpa_printf(MSG_INFO, "No sppStatus attribute");
-		goto out;
-	}
-	write_summary(ctx, "Received sppPostDevDataResponse sppStatus='%s'",
-		      status);
-
-	session_id = get_spp_attr_value(ctx->xml, node, "sessionID");
-	if (session_id == NULL) {
-		wpa_printf(MSG_INFO, "No sessionID attribute");
-		goto out;
-	}
-
-	wpa_printf(MSG_INFO, "[hs20] sppPostDevDataResponse - sppStatus: '%s'  sessionID: '%s'",
-		   status, session_id);
-
-	xml_node_for_each_child(ctx->xml, child, node) {
-		const char *name;
-		xml_node_for_each_check(ctx->xml, child);
-		debug_dump_node(ctx, "child", child);
-		name = xml_node_get_localname(ctx->xml, child);
-		wpa_printf(MSG_INFO, "localname: '%s'", name);
-		if (!update && strcasecmp(name, "updateNode") == 0)
-			update = child;
-		if (!exec && strcasecmp(name, "exec") == 0)
-			exec = child;
-		if (!add_mo && strcasecmp(name, "addMO") == 0)
-			add_mo = child;
-		if (!no_mo && strcasecmp(name, "noMOUpdate") == 0)
-			no_mo = child;
-	}
-
-	if (use == SPP_SUBSCRIPTION_REMEDIATION &&
-	    strcasecmp(status,
-		       "Remediation complete, request sppUpdateResponse") == 0)
-	{
-		int res, ret;
-		if (!update && !no_mo) {
-			wpa_printf(MSG_INFO, "No updateNode or noMOUpdate element");
-			goto out;
-		}
-		wpa_printf(MSG_INFO, "Subscription remediation completed");
-		res = update_pps(ctx, update, pps_fname, pps);
-		if (res < 0)
-			wpa_printf(MSG_INFO, "Failed to update PPS MO");
-		ret = hs20_spp_update_response(
-			ctx, session_id,
-			res < 0 ? "Error occurred" : "OK",
-			res < 0 ? "MO addition or update failed" : NULL);
-		if (res == 0 && ret == 0)
-			hs20_sub_rem_complete(ctx, pps_fname);
-		goto out;
-	}
-
-	if (use == SPP_SUBSCRIPTION_REMEDIATION &&
-	    strcasecmp(status, "Exchange complete, release TLS connection") ==
-	    0) {
-		if (!no_mo) {
-			wpa_printf(MSG_INFO, "No noMOUpdate element");
-			goto out;
-		}
-		wpa_printf(MSG_INFO, "Subscription remediation completed (no MO update)");
-		goto out;
-	}
-
-	if (use == SPP_POLICY_UPDATE &&
-	    strcasecmp(status, "Update complete, request sppUpdateResponse") ==
-	    0) {
-		int res, ret;
-		wpa_printf(MSG_INFO, "Policy update received - update PPS");
-		res = update_pps(ctx, update, pps_fname, pps);
-		ret = hs20_spp_update_response(
-			ctx, session_id,
-			res < 0 ? "Error occurred" : "OK",
-			res < 0 ? "MO addition or update failed" : NULL);
-		if (res == 0 && ret == 0)
-			hs20_policy_update_complete(ctx, pps_fname);
-		goto out;
-	}
-
-	if (use == SPP_SUBSCRIPTION_REGISTRATION &&
-	    strcasecmp(status, "Provisioning complete, request "
-		       "sppUpdateResponse")  == 0) {
-		if (!add_mo) {
-			wpa_printf(MSG_INFO, "No addMO element - not sure what to do next");
-			goto out;
-		}
-		process_spp_user_input_response(ctx, session_id, add_mo);
-		node = NULL;
-		goto out;
-	}
-
-	if (strcasecmp(status, "No update available at this time") == 0) {
-		wpa_printf(MSG_INFO, "No update available at this time");
-		goto out;
-	}
-
-	if (strcasecmp(status, "OK") == 0) {
-		int res;
-		xml_node_t *ret;
-
-		if (!exec) {
-			wpa_printf(MSG_INFO, "No exec element - not sure what to do next");
-			goto out;
-		}
-		res = hs20_spp_exec(ctx, exec, session_id,
-				    pps_fname, pps, &ret);
-		/* xml_node_free(ctx->xml, node); */
-		node = NULL;
-		if (res == 0 && ret)
-			process_spp_post_dev_data_response(ctx, use,
-							   ret, pps_fname, pps);
-		goto out;
-	}
-
-	if (strcasecmp(status, "Error occurred") == 0) {
-		xml_node_t *err;
-		char *code = NULL;
-		err = get_node(ctx->xml, node, "sppError");
-		if (err)
-			code = xml_node_get_attr_value(ctx->xml, err,
-						       "errorCode");
-		wpa_printf(MSG_INFO, "Error occurred - errorCode=%s",
-			   code ? code : "N/A");
-		xml_node_get_attr_value_free(ctx->xml, code);
-		goto out;
-	}
-
-	wpa_printf(MSG_INFO,
-		   "[hs20] Unsupported sppPostDevDataResponse sppStatus '%s'",
-		   status);
-out:
-	xml_node_get_attr_value_free(ctx->xml, status);
-	xml_node_get_attr_value_free(ctx->xml, session_id);
-	xml_node_free(ctx->xml, node);
-}
-
-
-static int spp_post_dev_data(struct hs20_osu_client *ctx,
-			     enum spp_post_dev_data_use use,
-			     const char *reason,
-			     const char *pps_fname, xml_node_t *pps)
-{
-	xml_node_t *payload;
-	xml_node_t *ret_node;
-
-	payload = build_spp_post_dev_data(ctx, NULL, NULL, reason);
-	if (payload == NULL)
-		return -1;
-
-	ret_node = soap_send_receive(ctx->http, payload);
-	if (!ret_node) {
-		const char *err = http_get_err(ctx->http);
-		if (err) {
-			wpa_printf(MSG_INFO, "HTTP error: %s", err);
-			write_result(ctx, "HTTP error: %s", err);
-		} else {
-			write_summary(ctx, "Failed to send SOAP message");
-		}
-		return -1;
-	}
-
-	if (hs20_spp_validate(ctx, ret_node, "sppPostDevDataResponse") < 0) {
-		wpa_printf(MSG_INFO, "SPP validation failed");
-		xml_node_free(ctx->xml, ret_node);
-		return -1;
-	}
-
-	process_spp_post_dev_data_response(ctx, use, ret_node,
-					   pps_fname, pps);
-	return 0;
-}
-
-
-void spp_sub_rem(struct hs20_osu_client *ctx, const char *address,
-		 const char *pps_fname,
-		 const char *client_cert, const char *client_key,
-		 const char *cred_username, const char *cred_password,
-		 xml_node_t *pps)
-{
-	wpa_printf(MSG_INFO, "SPP subscription remediation");
-	write_summary(ctx, "SPP subscription remediation");
-
-	os_free(ctx->server_url);
-	ctx->server_url = os_strdup(address);
-
-	if (soap_init_client(ctx->http, address, ctx->ca_fname,
-			     cred_username, cred_password, client_cert,
-			     client_key) == 0) {
-		spp_post_dev_data(ctx, SPP_SUBSCRIPTION_REMEDIATION,
-				  "Subscription remediation", pps_fname, pps);
-	}
-}
-
-
-static void hs20_policy_update_complete(struct hs20_osu_client *ctx,
-					const char *pps_fname)
-{
-	wpa_printf(MSG_INFO, "Policy update completed");
-
-	/*
-	 * Update wpa_supplicant credentials and reconnect using updated
-	 * information.
-	 */
-	wpa_printf(MSG_INFO, "Updating wpa_supplicant credentials");
-	cmd_set_pps(ctx, pps_fname);
-
-	wpa_printf(MSG_INFO, "Requesting reconnection with updated configuration");
-	if (wpa_command(ctx->ifname, "INTERWORKING_SELECT auto") < 0)
-		wpa_printf(MSG_ERROR, "Failed to request wpa_supplicant to reconnect");
-}
-
-
-static int process_spp_exchange_complete(struct hs20_osu_client *ctx,
-					 xml_node_t *node)
-{
-	char *status, *session_id;
-
-	debug_dump_node(ctx, "sppExchangeComplete", node);
-
-	status = get_spp_attr_value(ctx->xml, node, "sppStatus");
-	if (status == NULL) {
-		wpa_printf(MSG_INFO, "No sppStatus attribute");
-		return -1;
-	}
-	write_summary(ctx, "Received sppExchangeComplete sppStatus='%s'",
-		      status);
-
-	session_id = get_spp_attr_value(ctx->xml, node, "sessionID");
-	if (session_id == NULL) {
-		wpa_printf(MSG_INFO, "No sessionID attribute");
-		xml_node_get_attr_value_free(ctx->xml, status);
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "[hs20] sppStatus: '%s'  sessionID: '%s'",
-		   status, session_id);
-	xml_node_get_attr_value_free(ctx->xml, session_id);
-
-	if (strcasecmp(status, "Exchange complete, release TLS connection") ==
-	    0) {
-		xml_node_get_attr_value_free(ctx->xml, status);
-		return 0;
-	}
-
-	wpa_printf(MSG_INFO, "Unexpected sppStatus '%s'", status);
-	write_summary(ctx, "Unexpected sppStatus '%s'", status);
-	xml_node_get_attr_value_free(ctx->xml, status);
-	return -1;
-}
-
-
-static xml_node_t * build_spp_update_response(struct hs20_osu_client *ctx,
-					      const char *session_id,
-					      const char *spp_status,
-					      const char *error_code)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *node;
-
-	spp_node = xml_node_create_root(ctx->xml, SPP_NS_URI, "spp", &ns,
-					"sppUpdateResponse");
-	if (spp_node == NULL)
-		return NULL;
-
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppVersion", "1.0");
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sessionID", session_id);
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppStatus", spp_status);
-
-	if (error_code) {
-		node = xml_node_create(ctx->xml, spp_node, ns, "sppError");
-		if (node)
-			xml_node_add_attr(ctx->xml, node, NULL, "errorCode",
-					  error_code);
-	}
-
-	return spp_node;
-}
-
-
-static int hs20_spp_update_response(struct hs20_osu_client *ctx,
-				    const char *session_id,
-				    const char *spp_status,
-				    const char *error_code)
-{
-	xml_node_t *node, *ret_node;
-	int ret;
-
-	write_summary(ctx, "Building sppUpdateResponse sppStatus='%s' error_code='%s'",
-		      spp_status, error_code);
-	node = build_spp_update_response(ctx, session_id, spp_status,
-					 error_code);
-	if (node == NULL)
-		return -1;
-	ret_node = soap_send_receive(ctx->http, node);
-	if (!ret_node) {
-		if (soap_reinit_client(ctx->http) < 0)
-			return -1;
-		wpa_printf(MSG_INFO, "Try to finish with re-opened connection");
-		node = build_spp_update_response(ctx, session_id, spp_status,
-						 error_code);
-		if (node == NULL)
-			return -1;
-		ret_node = soap_send_receive(ctx->http, node);
-		if (ret_node == NULL)
-			return -1;
-		wpa_printf(MSG_INFO, "Continue with new connection");
-	}
-
-	if (hs20_spp_validate(ctx, ret_node, "sppExchangeComplete") < 0) {
-		wpa_printf(MSG_INFO, "SPP validation failed");
-		xml_node_free(ctx->xml, ret_node);
-		return -1;
-	}
-
-	ret = process_spp_exchange_complete(ctx, ret_node);
-	xml_node_free(ctx->xml, ret_node);
-	return ret;
-}
-
-
-void spp_pol_upd(struct hs20_osu_client *ctx, const char *address,
-		 const char *pps_fname,
-		 const char *client_cert, const char *client_key,
-		 const char *cred_username, const char *cred_password,
-		 xml_node_t *pps)
-{
-	wpa_printf(MSG_INFO, "SPP policy update");
-	write_summary(ctx, "SPP policy update");
-
-	os_free(ctx->server_url);
-	ctx->server_url = os_strdup(address);
-
-	if (soap_init_client(ctx->http, address, ctx->ca_fname, cred_username,
-			     cred_password, client_cert, client_key) == 0) {
-		spp_post_dev_data(ctx, SPP_POLICY_UPDATE, "Policy update",
-				  pps_fname, pps);
-	}
-}
-
-
-int cmd_prov(struct hs20_osu_client *ctx, const char *url)
-{
-	unlink("Cert/est_cert.der");
-	unlink("Cert/est_cert.pem");
-
-	if (url == NULL) {
-		wpa_printf(MSG_INFO, "Invalid prov command (missing URL)");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO,
-		   "Credential provisioning requested - URL: %s ca_fname: %s",
-		   url, ctx->ca_fname ? ctx->ca_fname : "N/A");
-
-	os_free(ctx->server_url);
-	ctx->server_url = os_strdup(url);
-
-	if (soap_init_client(ctx->http, url, ctx->ca_fname, NULL, NULL, NULL,
-			     NULL) < 0)
-		return -1;
-	spp_post_dev_data(ctx, SPP_SUBSCRIPTION_REGISTRATION,
-			  "Subscription registration", NULL, NULL);
-
-	return ctx->pps_cred_set ? 0 : -1;
-}
-
-
-int cmd_sim_prov(struct hs20_osu_client *ctx, const char *url)
-{
-	if (url == NULL) {
-		wpa_printf(MSG_INFO, "Invalid prov command (missing URL)");
-		return -1;
-	}
-
-	wpa_printf(MSG_INFO, "SIM provisioning requested");
-
-	os_free(ctx->server_url);
-	ctx->server_url = os_strdup(url);
-
-	wpa_printf(MSG_INFO, "Wait for IP address before starting SIM provisioning");
-
-	if (wait_ip_addr(ctx->ifname, 15) < 0) {
-		wpa_printf(MSG_INFO, "Could not get IP address for WLAN - try connection anyway");
-	}
-
-	if (soap_init_client(ctx->http, url, ctx->ca_fname, NULL, NULL, NULL,
-			     NULL) < 0)
-		return -1;
-	spp_post_dev_data(ctx, SPP_SUBSCRIPTION_REGISTRATION,
-			  "Subscription provisioning", NULL, NULL);
-
-	return ctx->pps_cred_set ? 0 : -1;
-}
diff --git a/hs20/server/.gitignore b/hs20/server/.gitignore
deleted file mode 100644
index fecb096..0000000
--- a/hs20/server/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-hs20_spp_server
diff --git a/hs20/server/Makefile b/hs20/server/Makefile
deleted file mode 100644
index 0cab6d6..0000000
--- a/hs20/server/Makefile
+++ /dev/null
@@ -1,42 +0,0 @@
-ALL=hs20_spp_server
-
-include ../../src/build.rules
-
-CFLAGS += -I../../src
-CFLAGS += -I../../src/utils
-CFLAGS += -I../../src/crypto
-
-LIBS += -lsqlite3
-
-# Using glibc < 2.17 requires -lrt for clock_gettime()
-LIBS += -lrt
-
-ifndef CONFIG_NO_GITVER
-# Add VERSION_STR postfix for builds from a git repository
-ifeq ($(wildcard ../../.git),../../.git)
-GITVER := $(shell git describe --dirty=+)
-ifneq ($(GITVER),)
-CFLAGS += -DGIT_VERSION_STR_POSTFIX=\"-$(GITVER)\"
-endif
-endif
-endif
-
-OBJS=spp_server.o
-OBJS += hs20_spp_server.o
-OBJS += ../../src/utils/xml-utils.o
-OBJS += ../../src/utils/base64.o
-OBJS += ../../src/utils/common.o
-OBJS += ../../src/utils/os_unix.o
-OBJS += ../../src/utils/wpa_debug.o
-OBJS += ../../src/crypto/md5-internal.o
-CFLAGS += $(shell xml2-config --cflags)
-LIBS += $(shell xml2-config --libs)
-OBJS += ../../src/utils/xml_libxml2.o
-
-_OBJS_VAR := OBJS
-include ../../src/objs.mk
-hs20_spp_server: $(OBJS)
-	$(LDO) $(LDFLAGS) -o hs20_spp_server $(OBJS) $(LIBS)
-
-clean: common-clean
-	rm -f core *~
diff --git a/hs20/server/ca/clean.sh b/hs20/server/ca/clean.sh
deleted file mode 100755
index c72dcbd..0000000
--- a/hs20/server/ca/clean.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-for i in server-client server server-revoked user ocsp; do
-    rm -f $i.csr $i.key $i.pem
-done
-
-rm -f openssl.cnf.tmp
-if [ -d demoCA ]; then
-    rm -r demoCA
-fi
-rm -f ca.pem logo.asn1 logo.der server.der ocsp-server-cache.der
-rm -f my-openssl.cnf my-openssl-root.cnf
-#rm -r rootCA
diff --git a/hs20/server/ca/est-csrattrs.cnf b/hs20/server/ca/est-csrattrs.cnf
deleted file mode 100644
index b50ea00..0000000
--- a/hs20/server/ca/est-csrattrs.cnf
+++ /dev/null
@@ -1,17 +0,0 @@
-asn1 = SEQUENCE:attrs
-
-[attrs]
-#oid1 = OID:challengePassword
-attr1 = SEQUENCE:extreq
-oid2 = OID:sha256WithRSAEncryption
-
-[extreq]
-oid = OID:extensionRequest
-vals = SET:extreqvals
-
-[extreqvals]
-
-oid1 = OID:macAddress
-#oid2 = OID:imei
-#oid3 = OID:meid
-#oid4 = OID:DevId
diff --git a/hs20/server/ca/est-csrattrs.sh b/hs20/server/ca/est-csrattrs.sh
deleted file mode 100644
index 0b73a04..0000000
--- a/hs20/server/ca/est-csrattrs.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-openssl asn1parse -genconf est-csrattrs.cnf -out est-csrattrs.der -oid hs20.oid
-base64 est-csrattrs.der > est-attrs.b64
diff --git a/hs20/server/ca/hs20.oid b/hs20/server/ca/hs20.oid
deleted file mode 100644
index a829ff2..0000000
--- a/hs20/server/ca/hs20.oid
+++ /dev/null
@@ -1,7 +0,0 @@
-1.3.6.1.1.1.1.22 macAddress
-1.2.840.113549.1.9.14 extensionRequest
-1.3.6.1.4.1.40808.1.1.1 id-wfa-hotspot-friendlyName
-1.3.6.1.4.1.40808.1.1.2 id-kp-HS2.0Auth
-1.3.6.1.4.1.40808.1.1.3 imei
-1.3.6.1.4.1.40808.1.1.4 meid
-1.3.6.1.4.1.40808.1.1.5 DevId
diff --git a/hs20/server/ca/ocsp-req.sh b/hs20/server/ca/ocsp-req.sh
deleted file mode 100644
index 931a206..0000000
--- a/hs20/server/ca/ocsp-req.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-for i in *.pem; do
-    echo "===[ $i ]==================="
-    openssl ocsp -text -CAfile ca.pem -verify_other demoCA/cacert.pem -trust_other -issuer demoCA/cacert.pem -cert $i -url http://localhost:8888/
-
-#    openssl ocsp -text -CAfile rootCA/cacert.pem -issuer demoCA/cacert.pem -cert $i -url http://localhost:8888/
-
-#    openssl ocsp -text -CAfile rootCA/cacert.pem -verify_other demoCA/cacert.pem -trust_other -issuer demoCA/cacert.pem -cert $i -url http://localhost:8888/
-#    openssl ocsp -text -CAfile rootCA/cacert.pem -VAfile ca.pem -trust_other -issuer demoCA/cacert.pem -cert $i -url http://localhost:8888/
-done
diff --git a/hs20/server/ca/ocsp-responder-ica.sh b/hs20/server/ca/ocsp-responder-ica.sh
deleted file mode 100644
index 116c6e1..0000000
--- a/hs20/server/ca/ocsp-responder-ica.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-openssl ocsp -index demoCA/index.txt -port 8888 -nmin 5 -rsigner demoCA/cacert.pem -rkey demoCA/private/cakey-plain.pem -CA demoCA/cacert.pem -resp_no_certs -text
diff --git a/hs20/server/ca/ocsp-responder.sh b/hs20/server/ca/ocsp-responder.sh
deleted file mode 100644
index 620947d..0000000
--- a/hs20/server/ca/ocsp-responder.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-openssl ocsp -index demoCA/index.txt -port 8888 -nmin 5 -rsigner ocsp.pem -rkey ocsp.key -CA demoCA/cacert.pem -text -ignore_err
diff --git a/hs20/server/ca/ocsp-update-cache.sh b/hs20/server/ca/ocsp-update-cache.sh
deleted file mode 100644
index f2b2325..0000000
--- a/hs20/server/ca/ocsp-update-cache.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-# NOTE: You may need to replace 'localhost' with your OCSP server hostname.
-openssl ocsp \
-	-no_nonce \
-	-CAfile ca.pem \
-	-verify_other demoCA/cacert.pem \
-	-issuer demoCA/cacert.pem \
-	-cert server.pem \
-	-url http://localhost:8888/ \
-	-respout ocsp-server-cache.der
diff --git a/hs20/server/ca/openssl-root.cnf b/hs20/server/ca/openssl-root.cnf
deleted file mode 100644
index 5bc50be..0000000
--- a/hs20/server/ca/openssl-root.cnf
+++ /dev/null
@@ -1,125 +0,0 @@
-# OpenSSL configuration file for Hotspot 2.0 PKI (Root CA)
-
-HOME			= .
-RANDFILE		= $ENV::HOME/.rnd
-oid_section		= new_oids
-
-[ new_oids ]
-
-#logotypeoid=1.3.6.1.5.5.7.1.12
-
-####################################################################
-[ ca ]
-default_ca	= CA_default		# The default ca section
-
-####################################################################
-[ CA_default ]
-
-dir		= ./rootCA		# Where everything is kept
-certs		= $dir/certs		# Where the issued certs are kept
-crl_dir		= $dir/crl		# Where the issued crl are kept
-database	= $dir/index.txt	# database index file.
-#unique_subject	= no			# Set to 'no' to allow creation of
-					# several certificates with same subject
-new_certs_dir	= $dir/newcerts		# default place for new certs.
-
-certificate	= $dir/cacert.pem 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
-crlnumber	= $dir/crlnumber	# the current crl number
-					# must be commented out to leave a V1 CRL
-crl		= $dir/crl.pem 		# The current CRL
-private_key	= $dir/private/cakey.pem# The private key
-RANDFILE	= $dir/private/.rand	# private random number file
-
-x509_extensions	= usr_cert		# The extentions to add to the cert
-
-name_opt 	= ca_default		# Subject Name options
-cert_opt 	= ca_default		# Certificate field options
-
-default_days	= 365			# how long to certify for
-default_crl_days= 30			# how long before next CRL
-default_md	= default		# use public key default MD
-preserve	= no			# keep passed DN ordering
-
-policy		= policy_match
-
-# For the CA policy
-[ policy_match ]
-countryName		= match
-stateOrProvinceName	= optional
-organizationName	= match
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-[ policy_anything ]
-countryName		= optional
-stateOrProvinceName	= optional
-localityName		= optional
-organizationName	= optional
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-####################################################################
-[ req ]
-default_bits		= 2048
-default_keyfile 	= privkey.pem
-distinguished_name	= req_distinguished_name
-attributes		= req_attributes
-x509_extensions	= v3_ca	# The extentions to add to the self signed cert
-
-input_password = @PASSWORD@
-output_password = @PASSWORD@
-
-string_mask = utf8only
-
-[ req_distinguished_name ]
-countryName			= Country Name (2 letter code)
-countryName_default		= US
-countryName_min			= 2
-countryName_max			= 2
-
-localityName			= Locality Name (eg, city)
-localityName_default		= Tuusula
-
-0.organizationName		= Organization Name (eg, company)
-0.organizationName_default	= WFA Hotspot 2.0
-
-##organizationalUnitName		= Organizational Unit Name (eg, section)
-#organizationalUnitName_default	=
-#@OU@
-
-commonName			= Common Name (e.g. server FQDN or YOUR name)
-#@CN@
-commonName_max			= 64
-
-emailAddress			= Email Address
-emailAddress_max		= 64
-
-[ req_attributes ]
-
-[ v3_req ]
-
-# Extensions to add to a certificate request
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-subjectAltName=DNS:example.com,DNS:another.example.com
-
-[ v3_ca ]
-
-# Hotspot 2.0 PKI requirements
-subjectKeyIdentifier=hash
-basicConstraints = critical,CA:true
-keyUsage = critical, cRLSign, keyCertSign
-
-[ crl_ext ]
-
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-
-[ v3_OCSP ]
-
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = OCSPSigning
diff --git a/hs20/server/ca/openssl.cnf b/hs20/server/ca/openssl.cnf
deleted file mode 100644
index 6141013..0000000
--- a/hs20/server/ca/openssl.cnf
+++ /dev/null
@@ -1,200 +0,0 @@
-# OpenSSL configuration file for Hotspot 2.0 PKI (Intermediate CA)
-
-HOME			= .
-RANDFILE		= $ENV::HOME/.rnd
-oid_section		= new_oids
-
-[ new_oids ]
-
-#logotypeoid=1.3.6.1.5.5.7.1.12
-
-####################################################################
-[ ca ]
-default_ca	= CA_default		# The default ca section
-
-####################################################################
-[ CA_default ]
-
-dir		= ./demoCA		# Where everything is kept
-certs		= $dir/certs		# Where the issued certs are kept
-crl_dir		= $dir/crl		# Where the issued crl are kept
-database	= $dir/index.txt	# database index file.
-#unique_subject	= no			# Set to 'no' to allow creation of
-					# several certificates with same subject
-new_certs_dir	= $dir/newcerts		# default place for new certs.
-
-certificate	= $dir/cacert.pem 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
-crlnumber	= $dir/crlnumber	# the current crl number
-					# must be commented out to leave a V1 CRL
-crl		= $dir/crl.pem 		# The current CRL
-private_key	= $dir/private/cakey.pem# The private key
-RANDFILE	= $dir/private/.rand	# private random number file
-
-x509_extensions	= ext_client		# The extentions to add to the cert
-
-name_opt 	= ca_default		# Subject Name options
-cert_opt 	= ca_default		# Certificate field options
-
-# Extension copying option: use with caution.
-copy_extensions = copy
-
-default_days	= 365			# how long to certify for
-default_crl_days= 30			# how long before next CRL
-default_md	= default		# use public key default MD
-preserve	= no			# keep passed DN ordering
-
-policy		= policy_match
-
-# For the CA policy
-[ policy_match ]
-countryName		= supplied
-stateOrProvinceName	= optional
-organizationName	= supplied
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-[ policy_osu_server ]
-countryName		= match
-stateOrProvinceName	= optional
-organizationName	= match
-organizationalUnitName	= supplied
-commonName		= supplied
-emailAddress		= optional
-
-[ policy_anything ]
-countryName		= optional
-stateOrProvinceName	= optional
-localityName		= optional
-organizationName	= optional
-organizationalUnitName	= optional
-commonName		= supplied
-emailAddress		= optional
-
-####################################################################
-[ req ]
-default_bits		= 2048
-default_keyfile 	= privkey.pem
-distinguished_name	= req_distinguished_name
-attributes		= req_attributes
-x509_extensions	= v3_ca	# The extentions to add to the self signed cert
-
-input_password = @PASSWORD@
-output_password = @PASSWORD@
-
-string_mask = utf8only
-
-[ req_distinguished_name ]
-countryName			= Country Name (2 letter code)
-countryName_default		= FI
-countryName_min			= 2
-countryName_max			= 2
-
-localityName			= Locality Name (eg, city)
-localityName_default		= Tuusula
-
-0.organizationName		= Organization Name (eg, company)
-0.organizationName_default	= @DOMAIN@
-
-##organizationalUnitName		= Organizational Unit Name (eg, section)
-#organizationalUnitName_default	=
-#@OU@
-
-commonName			= Common Name (e.g. server FQDN or YOUR name)
-#@CN@
-commonName_max			= 64
-
-emailAddress			= Email Address
-emailAddress_max		= 64
-
-[ req_attributes ]
-
-[ v3_ca ]
-
-# Hotspot 2.0 PKI requirements
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid:always,issuer
-basicConstraints = critical, CA:true, pathlen:0
-keyUsage = critical, cRLSign, keyCertSign
-authorityInfoAccess = OCSP;URI:@OCSP_URI@
-# For SP intermediate CA
-#subjectAltName=critical,otherName:1.3.6.1.4.1.40808.1.1.1;UTF8String:engExample OSU
-#nameConstraints=permitted;DNS:.@DOMAIN@
-#1.3.6.1.5.5.7.1.12=ASN1:SEQUENCE:LogotypeExtn
-
-[ v3_osu_server ]
-
-basicConstraints = critical, CA:true, pathlen:0
-keyUsage = critical, keyEncipherment
-#@ALTNAME@
-
-#logotypeoid=ASN1:SEQUENCE:LogotypeExtn
-1.3.6.1.5.5.7.1.12=ASN1:SEQUENCE:LogotypeExtn
-[LogotypeExtn]
-communityLogos=EXP:0,SEQUENCE:LogotypeInfo
-[LogotypeInfo]
-# note: implicit tag converted to explicit for CHOICE
-direct=EXP:0,SEQUENCE:LogotypeData
-[LogotypeData]
-image=SEQUENCE:LogotypeImage
-[LogotypeImage]
-imageDetails=SEQUENCE:LogotypeDetails
-imageInfo=SEQUENCE:LogotypeImageInfo
-[LogotypeDetails]
-mediaType=IA5STRING:image/png
-logotypeHash=SEQUENCE:HashAlgAndValues
-logotypeURI=SEQUENCE:URI
-[HashAlgAndValues]
-value1=SEQUENCE:HashAlgAndValueSHA256
-#value2=SEQUENCE:HashAlgAndValueSHA1
-[HashAlgAndValueSHA256]
-hashAlg=SEQUENCE:sha256_alg
-hashValue=FORMAT:HEX,OCTETSTRING:@LOGO_HASH256@
-[HashAlgAndValueSHA1]
-hashAlg=SEQUENCE:sha1_alg
-hashValue=FORMAT:HEX,OCTETSTRING:@LOGO_HASH1@
-[sha256_alg]
-algorithm=OID:sha256
-[sha1_alg]
-algorithm=OID:sha1
-[URI]
-uri=IA5STRING:@LOGO_URI@
-[LogotypeImageInfo]
-# default value color(1), component optional
-#type=IMP:0,INTEGER:1
-fileSize=INTEGER:7549
-xSize=INTEGER:128
-ySize=INTEGER:80
-language=IMP:4,IA5STRING:zxx
-
-[ crl_ext ]
-
-# issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always
-
-[ v3_OCSP ]
-
-basicConstraints = CA:FALSE
-keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-extendedKeyUsage = OCSPSigning
-
-[ ext_client ]
-
-basicConstraints=CA:FALSE
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-authorityInfoAccess = OCSP;URI:@OCSP_URI@
-#@ALTNAME@
-extendedKeyUsage = clientAuth
-
-[ ext_server ]
-
-# Hotspot 2.0 PKI requirements
-basicConstraints=critical, CA:FALSE
-subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer
-authorityInfoAccess = OCSP;URI:@OCSP_URI@
-#@ALTNAME@
-extendedKeyUsage = critical, serverAuth
-keyUsage = critical, keyEncipherment
diff --git a/hs20/server/ca/setup.sh b/hs20/server/ca/setup.sh
deleted file mode 100755
index 78abccc..0000000
--- a/hs20/server/ca/setup.sh
+++ /dev/null
@@ -1,209 +0,0 @@
-#!/bin/sh
-
-if [ -z "$OPENSSL" ]; then
-    OPENSSL=openssl
-fi
-export OPENSSL_CONF=$PWD/openssl.cnf
-PASS=whatever
-if [ -z "$DOMAIN" ]; then
-    DOMAIN=w1.fi
-fi
-COMPANY=w1.fi
-OPER_ENG="engw1.fi TESTING USE"
-OPER_FI="finw1.fi TESTIKÄYTTÖ"
-CNR="Hotspot 2.0 Trust Root CA - 99"
-CNO="ocsp.$DOMAIN"
-CNV="osu-revoked.$DOMAIN"
-CNOC="osu-client.$DOMAIN"
-OSU_SERVER_HOSTNAME="osu.$DOMAIN"
-DEBUG=0
-OCSP_URI="http://$CNO:8888/"
-LOGO_URI="http://osu.w1.fi/w1fi_logo.png"
-LOGO_HASH256="4532f7ec36424381617c03c6ce87b55a51d6e7177ffafda243cebf280a68954d"
-LOGO_HASH1="5e1d5085676eede6b02da14d31c523ec20ffba0b"
-
-# Command line overrides
-USAGE=$( cat <<EOF
-Usage:\n
-# -c:  Company name, used to generate Subject name CN for Intermediate CA\n
-# -C:  Subject name CN of the Root CA ($CNR)\n
-# -D:  Enable debugging (set -x, etc)\n
-# -g:  Logo sha1 hash ($LOGO_HASH1)\n
-# -G:  Logo sha256 hash ($LOGO_HASH256)\n
-# -h:  Show this help message\n
-# -l:  Logo URI ($LOGO_URI)\n
-# -m:  Domain ($DOMAIN)\n
-# -o:  Subject name CN for OSU-Client Server ($CNOC)\n
-# -O:  Subject name CN for OCSP Server ($CNO)\n
-# -p:  passphrase for private keys ($PASS)\n
-# -r:  Operator-english ($OPER_ENG)\n
-# -R:  Operator-finish ($OPER_FI)\n
-# -S:  OSU Server name ($OSU_SERVER_HOSTNAME)\n
-# -u:  OCSP-URI ($OCSP_URI)\n
-# -V:  Subject name CN for OSU-Revoked Server ($CNV)\n
-EOF
-)
-
-while getopts "c:C:Dg:G:l:m:o:O:p:r:R:S:u:V:h" flag
-  do
-  case $flag in
-      c) COMPANY=$OPTARG;;
-      C) CNR=$OPTARG;;
-      D) DEBUG=1;;
-      g) LOGO_HASH1=$OPTARG;;
-      G) LOGO_HASH256=$OPTARG;;
-      h) echo -e $USAGE; exit 0;;
-      l) LOGO_URI=$OPTARG;;
-      m) DOMAIN=$OPTARG;;
-      o) CNOC=$OPTARG;;
-      O) CNO=$OPTARG;;
-      p) PASS=$OPTARG;;
-      r) OPER_ENG=$OPTARG;;
-      R) OPER_FI=$OPTARG;;
-      S) OSU_SERVER_HOSTNAME=$OPTARG;;
-      u) OCSP_URI=$OPTARG;;
-      V) CNV=$OPTARG;;
-      *) echo "Unknown flag: $flag"; echo -e $USAGE; exit 1;;
-  esac
-done
-
-fail()
-{
-    echo "$*"
-    exit 1
-}
-
-echo
-echo "---[ Root CA ]----------------------------------------------------------"
-echo
-
-if [ $DEBUG = 1 ]
-then
-    set -x
-fi
-
-# Set the passphrase and some other common config accordingly.
-cat openssl-root.cnf | sed "s/@PASSWORD@/$PASS/" \
- > my-openssl-root.cnf
-
-cat openssl.cnf | sed "s/@PASSWORD@/$PASS/" |
-sed "s,@OCSP_URI@,$OCSP_URI," |
-sed "s,@LOGO_URI@,$LOGO_URI," |
-sed "s,@LOGO_HASH1@,$LOGO_HASH1," |
-sed "s,@LOGO_HASH256@,$LOGO_HASH256," |
-sed "s/@DOMAIN@/$DOMAIN/" \
- > my-openssl.cnf
-
-
-cat my-openssl-root.cnf | sed "s/#@CN@/commonName_default = $CNR/" > openssl.cnf.tmp
-mkdir -p rootCA/certs rootCA/crl rootCA/newcerts rootCA/private
-touch rootCA/index.txt
-if [ -e rootCA/private/cakey.pem ]; then
-    echo " * Use existing Root CA"
-else
-    echo " * Generate Root CA private key"
-    $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:4096 -keyout rootCA/private/cakey.pem -out rootCA/careq.pem || fail "Failed to generate Root CA private key"
-    echo " * Sign Root CA certificate"
-    $OPENSSL ca -config openssl.cnf.tmp -md sha256 -create_serial -out rootCA/cacert.pem -days 10957 -batch -keyfile rootCA/private/cakey.pem -passin pass:$PASS -selfsign -extensions v3_ca -outdir rootCA/newcerts -infiles rootCA/careq.pem || fail "Failed to sign Root CA certificate"
-    $OPENSSL x509 -in rootCA/cacert.pem -out rootCA/cacert.der -outform DER || fail "Failed to create rootCA DER"
-    sha256sum rootCA/cacert.der > rootCA/cacert.fingerprint || fail "Failed to create rootCA fingerprint"
-fi
-if [ ! -e rootCA/crlnumber ]; then
-    echo 00 > rootCA/crlnumber
-fi
-
-echo
-echo "---[ Intermediate CA ]--------------------------------------------------"
-echo
-
-cat my-openssl.cnf | sed "s/#@CN@/commonName_default = $COMPANY Hotspot 2.0 Intermediate CA/" > openssl.cnf.tmp
-mkdir -p demoCA/certs demoCA/crl demoCA/newcerts demoCA/private
-touch demoCA/index.txt
-if [ -e demoCA/private/cakey.pem ]; then
-    echo " * Use existing Intermediate CA"
-else
-    echo " * Generate Intermediate CA private key"
-    $OPENSSL req -config openssl.cnf.tmp -batch -new -newkey rsa:2048 -keyout demoCA/private/cakey.pem -out demoCA/careq.pem || fail "Failed to generate Intermediate CA private key"
-    echo " * Sign Intermediate CA certificate"
-    $OPENSSL ca -config openssl.cnf.tmp -md sha256 -create_serial -out demoCA/cacert.pem -days 3652 -batch -keyfile rootCA/private/cakey.pem -cert rootCA/cacert.pem -passin pass:$PASS -extensions v3_ca -infiles demoCA/careq.pem || fail "Failed to sign Intermediate CA certificate"
-    # horrible from security view point, but for testing purposes since OCSP responder does not seem to support -passin
-    openssl rsa -in demoCA/private/cakey.pem -out demoCA/private/cakey-plain.pem -passin pass:$PASS
-    $OPENSSL x509 -in demoCA/cacert.pem -out demoCA/cacert.der -outform DER || fail "Failed to create demoCA DER."
-    sha256sum demoCA/cacert.der > demoCA/cacert.fingerprint || fail "Failed to create demoCA fingerprint"
-fi
-if [ ! -e demoCA/crlnumber ]; then
-    echo 00 > demoCA/crlnumber
-fi
-
-echo
-echo "OCSP responder"
-echo
-
-cat my-openssl.cnf | sed "s/#@CN@/commonName_default = $CNO/" > openssl.cnf.tmp
-$OPENSSL req -config $PWD/openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -out ocsp.csr -keyout ocsp.key -extensions v3_OCSP
-$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -md sha256 -keyfile demoCA/private/cakey.pem -passin pass:$PASS -in ocsp.csr -out ocsp.pem -days 730 -extensions v3_OCSP || fail "Could not generate ocsp.pem"
-
-echo
-echo "---[ Server - to be revoked ] ------------------------------------------"
-echo
-
-cat my-openssl.cnf | sed "s/#@CN@/commonName_default = $CNV/" > openssl.cnf.tmp
-$OPENSSL req -config $PWD/openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -out server-revoked.csr -keyout server-revoked.key
-$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -md sha256 -in server-revoked.csr -out server-revoked.pem -key $PASS -days 730 -extensions ext_server
-$OPENSSL ca -revoke server-revoked.pem -key $PASS
-
-echo
-echo "---[ Server - with client ext key use ] ---------------------------------"
-echo "---[ Only used for negative-testing for OSU-client implementation ] -----"
-echo
-
-cat my-openssl.cnf | sed "s/#@CN@/commonName_default = $CNOC/" > openssl.cnf.tmp
-$OPENSSL req -config $PWD/openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -out server-client.csr -keyout server-client.key || fail "Could not create server-client.key"
-$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -md sha256 -in server-client.csr -out server-client.pem -key $PASS -days 730 -extensions ext_client || fail "Could not create server-client.pem"
-
-echo
-echo "---[ User ]-------------------------------------------------------------"
-echo
-
-cat my-openssl.cnf | sed "s/#@CN@/commonName_default = User/" > openssl.cnf.tmp
-$OPENSSL req -config $PWD/openssl.cnf.tmp -batch -new -newkey rsa:2048 -nodes -out user.csr -keyout user.key || fail "Could not create user.key"
-$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -md sha256 -in user.csr -out user.pem -key $PASS -days 730 -extensions ext_client || fail "Could not create user.pem"
-
-echo
-echo "---[ Server ]-----------------------------------------------------------"
-echo
-
-ALT="DNS:$OSU_SERVER_HOSTNAME"
-ALT="$ALT,otherName:1.3.6.1.4.1.40808.1.1.1;UTF8String:$OPER_ENG"
-ALT="$ALT,otherName:1.3.6.1.4.1.40808.1.1.1;UTF8String:$OPER_FI"
-
-cat my-openssl.cnf |
-	sed "s/#@CN@/commonName_default = $OSU_SERVER_HOSTNAME/" |
-	sed "s/^##organizationalUnitName/organizationalUnitName/" |
-	sed "s/#@OU@/organizationalUnitName_default = Hotspot 2.0 Online Sign Up Server/" |
-	sed "s/#@ALTNAME@/subjectAltName=critical,$ALT/" \
-	> openssl.cnf.tmp
-echo $OPENSSL req -config $PWD/openssl.cnf.tmp -batch -sha256 -new -newkey rsa:2048 -nodes -out server.csr -keyout server.key -reqexts v3_osu_server
-$OPENSSL req -config $PWD/openssl.cnf.tmp -batch -sha256 -new -newkey rsa:2048 -nodes -out server.csr -keyout server.key -reqexts v3_osu_server || fail "Failed to generate server request"
-$OPENSSL ca -config $PWD/openssl.cnf.tmp -batch -md sha256 -in server.csr -out server.pem -key $PASS -days 730 -extensions ext_server -policy policy_osu_server || fail "Failed to sign server certificate"
-
-#dump logotype details for debugging
-$OPENSSL x509 -in server.pem -out server.der -outform DER
-openssl asn1parse -in server.der -inform DER | grep HEX | tail -1 | sed 's/.*://' | xxd -r -p > logo.der
-openssl asn1parse -in logo.der -inform DER > logo.asn1
-
-
-echo
-echo "---[ CRL ]---------------------------------------------------------------"
-echo
-
-$OPENSSL ca -config $PWD/my-openssl.cnf -gencrl -md sha256 -out demoCA/crl/crl.pem -passin pass:$PASS
-
-echo
-echo "---[ Verify ]------------------------------------------------------------"
-echo
-
-$OPENSSL verify -CAfile rootCA/cacert.pem demoCA/cacert.pem
-$OPENSSL verify -CAfile rootCA/cacert.pem -untrusted demoCA/cacert.pem *.pem
-
-cat rootCA/cacert.pem demoCA/cacert.pem > ca.pem
diff --git a/hs20/server/ca/w1fi_logo.png b/hs20/server/ca/w1fi_logo.png
deleted file mode 100644
index ac7c259..0000000
--- a/hs20/server/ca/w1fi_logo.png
+++ /dev/null
Binary files differ
diff --git a/hs20/server/hs20-osu-server.txt b/hs20/server/hs20-osu-server.txt
deleted file mode 100644
index 22478ad..0000000
--- a/hs20/server/hs20-osu-server.txt
+++ /dev/null
@@ -1,262 +0,0 @@
-Hotspot 2.0 OSU server
-======================
-
-The information in this document is based on the assumption that Ubuntu
-16.04 server (64-bit) distribution is used and the web server is
-Apache2. Neither of these are requirements for the installation, but if
-other combinations are used, the package names and configuration
-parameters may need to be adjusted.
-
-NOTE: This implementation and the example configuration here is meant
-only for testing purposes in a lab environment. This design is not
-secure to be installed in a publicly available Internet server without
-considerable amount of modification and review for security issues.
-
-
-Build dependencies
-------------------
-
-Ubuntu 16.04 server
-- default installation
-- upgraded to latest package versions
-  sudo apt-get update
-  sudo apt-get upgrade
-
-Packages needed for running the service:
-  sudo apt-get install sqlite3
-  sudo apt-get install apache2
-  sudo apt-get install php-sqlite3 php-xml libapache2-mod-php
-
-Additional packages needed for building the components:
-  sudo apt-get install build-essential
-  sudo apt-get install libsqlite3-dev
-  sudo apt-get install libssl-dev
-  sudo apt-get install libxml2-dev
-
-
-Installation location
----------------------
-
-Select a location for the installation root directory. The example here
-assumes /home/user/hs20-server to be used, but this can be changed by
-editing couple of files as indicated below.
-
-sudo mkdir -p /home/user/hs20-server
-sudo chown $USER /home/user/hs20-server
-mkdir -p /home/user/hs20-server/spp
-mkdir -p /home/user/hs20-server/AS
-
-
-Build
------
-
-# hostapd as RADIUS server
-cd hostapd
-
-#example build configuration
-cat > .config <<EOF
-CONFIG_DRIVER_NONE=y
-CONFIG_PKCS12=y
-CONFIG_RADIUS_SERVER=y
-CONFIG_EAP=y
-CONFIG_EAP_TLS=y
-CONFIG_EAP_MSCHAPV2=y
-CONFIG_EAP_PEAP=y
-CONFIG_EAP_GTC=y
-CONFIG_EAP_TTLS=y
-CONFIG_EAP_SIM=y
-CONFIG_EAP_AKA=y
-CONFIG_EAP_AKA_PRIME=y
-CONFIG_SQLITE=y
-CONFIG_HS20=y
-EOF
-
-make hostapd hlr_auc_gw
-cp hostapd hlr_auc_gw /home/user/hs20-server/AS
-
-# build hs20_spp_server
-cd ../hs20/server
-make clean
-make
-cp hs20_spp_server /home/user/hs20-server/spp
-# prepare database (web server user/group needs to have write access)
-mkdir -p /home/user/hs20-server/AS/DB
-sudo chgrp www-data /home/user/hs20-server/AS/DB
-sudo chmod g+w /home/user/hs20-server/AS/DB
-sqlite3 /home/user/hs20-server/AS/DB/eap_user.db < sql.txt
-sudo chgrp www-data /home/user/hs20-server/AS/DB/eap_user.db
-sudo chmod g+w /home/user/hs20-server/AS/DB/eap_user.db
-# add example configuration (note: need to update URLs to match the system)
-sqlite3 /home/user/hs20-server/AS/DB/eap_user.db < sql-example.txt
-
-# copy PHP scripts
-# Modify config.php if different installation directory is used.
-# Modify PHP scripts to get the desired behavior for user interaction (or use
-# the examples as-is for initial testing).
-cp -r www /home/user/hs20-server
-
-# Create /home/user/hs20-server/terms-and-conditions file (HTML segment to be
-# inserted within the BODY section of the page).
-cat > /home/user/hs20-server/terms-and-conditions <<EOF
-<P>Terms and conditions..</P>
-EOF
-
-# Build local keys and certs
-cd ca
-# Display help options.
-./setup.sh -h
-
-# Remove old keys, fill in appropriate values, and generate your keys.
-# For instance:
-./clean.sh
-rm -fr rootCA"
-old_hostname=myserver.local
-./setup.sh -C "Hotspot 2.0 Trust Root CA - CT" \
-   -o $old_hostname-osu-client \
-   -O $old_hostname-oscp -p lanforge -S $old_hostname \
-   -V $old_hostname-osu-revoked \
-   -m local -u http://$old_hostname:8888/
-
-# Configure subscription policies
-mkdir -p /home/user/hs20-server/spp/policy
-cat > /home/user/hs20-server/spp/policy/default.xml <<EOF
-<Policy>
-	<PolicyUpdate>
-		<UpdateInterval>30</UpdateInterval>
-		<UpdateMethod>ClientInitiated</UpdateMethod>
-		<Restriction>Unrestricted</Restriction>
-		<URI>https://policy-server.osu.example.com/hs20/spp.php</URI>
-	</PolicyUpdate>
-</Policy>
-EOF
-
-
-# Install Hotspot 2.0 SPP and OMA DM XML schema/DTD files
-
-# XML schema for SPP
-# Copy the latest XML schema into /home/user/hs20-server/spp/spp.xsd
-
-# OMA DM Device Description Framework DTD
-# Copy into /home/user/hs20-server/spp/dm_ddf-v1_2.dtd
-# http://www.openmobilealliance.org/tech/DTD/dm_ddf-v1_2.dtd
-
-
-# Configure RADIUS authentication service
-# Note: Change the URL to match the setup
-# Note: Install AAA server key/certificate and root CA in Key directory
-
-cat > /home/user/hs20-server/AS/as-sql.conf <<EOF
-driver=none
-radius_server_clients=as.radius_clients
-eap_server=1
-eap_user_file=sqlite:DB/eap_user.db
-ca_cert=Key/ca.pem
-server_cert=Key/server.pem
-private_key=Key/server.key
-private_key_passwd=passphrase
-eap_sim_db=unix:/tmp/hlr_auc_gw.sock db=eap_sim.db
-subscr_remediation_url=https://subscription-server.osu.example.com/hs20/spp.php
-EOF
-
-# Set RADIUS passphrase for the APs
-# Note: Modify to match the setup
-cat > /home/user/hs20-server/AS/as.radius_clients <<EOF
-0.0.0.0/0	radius
-EOF
-
-
-Start RADIUS authentication server
-----------------------------------
-
-cd /home/user/hs20-server/AS
-./hostapd -B as-sql.conf
-
-
-OSEN RADIUS server configuration notes
-
-The OSEN RADIUS server config file should have the 'ocsp_stapling_response'
-configuration in it. For example:
-
-# hostapd-radius config for the radius used by the OSEN AP
-interface=eth0#0
-driver=none
-logger_syslog=-1
-logger_syslog_level=2
-logger_stdout=-1
-logger_stdout_level=2
-ctrl_interface=/var/run/hostapd
-ctrl_interface_group=0
-eap_server=1
-eap_user_file=/home/user/hs20-server/AS/hostapd-osen.eap_user
-server_id=ben-ota-2-osen
-radius_server_auth_port=1811
-radius_server_clients=/home/user/hs20-server/AS/hostap.radius_clients
-
-ca_cert=/home/user/hs20-server/ca/ca.pem
-server_cert=/home/user/hs20-server/ca/server.pem
-private_key=/home/user/hs20-server/ca/server.key
-private_key_passwd=whatever
-
-ocsp_stapling_response=/home/user/hs20-server/ca/ocsp-server-cache.der
-
-The /home/user/hs20-server/AS/hostapd-osen.eap_user file should look
-similar to this, and should coorelate with the osu_nai entry in
-the non-OSEN VAP config file.  For instance:
-
-# cat hostapd-osen.eap_user
-# For OSEN authentication (Hotspot 2.0 Release 2)
-"osen@w1.fi"      WFA-UNAUTH-TLS
-
-
-# Run OCSP server:
-cd /home/user/hs20-server/ca
-./ocsp-responder.sh&
-
-# Update cache (This should be run periodically)
-./ocsp-update-cache.sh
-
-
-Configure web server
---------------------
-
-Edit /etc/apache2/sites-available/default-ssl
-
-Add following block just before "SSL Engine Switch" line":
-
-        Alias /hs20/ "/home/user/hs20-server/www/"
-        <Directory "/home/user/hs20-server/www/">
-                Options Indexes MultiViews FollowSymLinks
-                AllowOverride None
-		Require all granted
-		SSLOptions +StdEnvVars
-        </Directory>
-
-Update SSL configuration to use the OSU server certificate/key.
-They keys and certs are called 'server.key' and 'server.pem' from
-ca/setup.sh.
-
-To support subscription remediation using client certificates, set
-"SSLVerifyClient optional" and configure the trust root CA(s) for the
-client certificates with SSLCACertificateFile.
-
-Enable default-ssl site and restart Apache2:
-  sudo a2ensite default-ssl
-  sudo a2enmod ssl
-  sudo service apache2 restart
-
-
-Management UI
--------------
-
-The sample PHP scripts include a management UI for testing
-purposes. That is available at https://<server>/hs20/users.php
-
-
-AP configuration
-----------------
-
-APs can now be configured to use the OSU server as the RADIUS
-authentication server. In addition, the OSU Provider List ANQP element
-should be configured to use the SPP (SOAP+XML) option and with the
-following Server URL:
-https://<server>/hs20/spp.php/signup?realm=example.com
diff --git a/hs20/server/hs20_spp_server.c b/hs20/server/hs20_spp_server.c
deleted file mode 100644
index 347c40a..0000000
--- a/hs20/server/hs20_spp_server.c
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Hotspot 2.0 SPP server - standalone version
- * Copyright (c) 2012-2013, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include "includes.h"
-#include <time.h>
-#include <sqlite3.h>
-
-#include "common.h"
-#include "common/version.h"
-#include "xml-utils.h"
-#include "spp_server.h"
-
-
-static void write_timestamp(FILE *f)
-{
-	time_t t;
-	struct tm *tm;
-
-	time(&t);
-	tm = localtime(&t);
-
-	fprintf(f, "%04u-%02u-%02u %02u:%02u:%02u ",
-		tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
-		tm->tm_hour, tm->tm_min, tm->tm_sec);
-}
-
-
-void debug_print(struct hs20_svc *ctx, int print, const char *fmt, ...)
-{
-	va_list ap;
-
-	if (ctx->debug_log == NULL)
-		return;
-
-	write_timestamp(ctx->debug_log);
-	va_start(ap, fmt);
-	vfprintf(ctx->debug_log, fmt, ap);
-	va_end(ap);
-
-	fprintf(ctx->debug_log, "\n");
-}
-
-
-void debug_dump_node(struct hs20_svc *ctx, const char *title, xml_node_t *node)
-{
-	char *str;
-
-	if (ctx->debug_log == NULL)
-		return;
-	str = xml_node_to_str(ctx->xml, node);
-	if (str == NULL)
-		return;
-
-	write_timestamp(ctx->debug_log);
-	fprintf(ctx->debug_log, "%s: '%s'\n", title, str);
-	os_free(str);
-}
-
-
-static int process(struct hs20_svc *ctx)
-{
-	int dmacc = 0;
-	xml_node_t *soap, *spp, *resp;
-	char *user, *realm, *post, *str;
-
-	ctx->addr = getenv("HS20ADDR");
-	if (ctx->addr)
-		debug_print(ctx, 1, "Connection from %s", ctx->addr);
-	ctx->test = getenv("HS20TEST");
-	if (ctx->test)
-		debug_print(ctx, 1, "Requested test functionality: %s",
-			    ctx->test);
-
-	user = getenv("HS20USER");
-	if (user && strlen(user) == 0)
-		user = NULL;
-	realm = getenv("HS20REALM");
-	if (realm == NULL) {
-		debug_print(ctx, 1, "HS20REALM not set");
-		return -1;
-	}
-	post = getenv("HS20POST");
-	if (post == NULL) {
-		debug_print(ctx, 1, "HS20POST not set");
-		return -1;
-	}
-
-	ctx->imsi = getenv("HS20IMSI");
-	if (ctx->imsi)
-		debug_print(ctx, 1, "IMSI %s", ctx->imsi);
-
-	ctx->eap_method = getenv("HS20EAPMETHOD");
-	if (ctx->eap_method)
-		debug_print(ctx, 1, "EAP method %s", ctx->eap_method);
-
-	ctx->id_hash = getenv("HS20IDHASH");
-	if (ctx->id_hash)
-		debug_print(ctx, 1, "ID-HASH %s", ctx->id_hash);
-
-	soap = xml_node_from_buf(ctx->xml, post);
-	if (soap == NULL) {
-		debug_print(ctx, 1, "Could not parse SOAP data");
-		return -1;
-	}
-	debug_dump_node(ctx, "Received SOAP message", soap);
-	spp = soap_get_body(ctx->xml, soap);
-	if (spp == NULL) {
-		debug_print(ctx, 1, "Could not get SPP message");
-		xml_node_free(ctx->xml, soap);
-		return -1;
-	}
-	debug_dump_node(ctx, "Received SPP message", spp);
-
-	resp = hs20_spp_server_process(ctx, spp, user, realm, dmacc);
-	xml_node_free(ctx->xml, soap);
-	if (resp == NULL && user == NULL) {
-		debug_print(ctx, 1, "Request HTTP authentication");
-		return 2; /* Request authentication */
-	}
-	if (resp == NULL) {
-		debug_print(ctx, 1, "No response");
-		return -1;
-	}
-
-	soap = soap_build_envelope(ctx->xml, resp);
-	if (soap == NULL) {
-		debug_print(ctx, 1, "SOAP envelope building failed");
-		return -1;
-	}
-	str = xml_node_to_str(ctx->xml, soap);
-	xml_node_free(ctx->xml, soap);
-	if (str == NULL) {
-		debug_print(ctx, 1, "Could not get node string");
-		return -1;
-	}
-	printf("%s", str);
-	free(str);
-
-	return 0;
-}
-
-
-static void usage(void)
-{
-	printf("usage:\n"
-	       "hs20_spp_server -r<root directory> [-f<debug log>]\n");
-}
-
-
-int main(int argc, char *argv[])
-{
-	struct hs20_svc ctx;
-	int ret;
-
-	os_memset(&ctx, 0, sizeof(ctx));
-	for (;;) {
-		int c = getopt(argc, argv, "f:r:v");
-		if (c < 0)
-			break;
-		switch (c) {
-		case 'f':
-			if (ctx.debug_log)
-				break;
-			ctx.debug_log = fopen(optarg, "a");
-			if (ctx.debug_log == NULL) {
-				printf("Could not write to %s\n", optarg);
-				return -1;
-			}
-			break;
-		case 'r':
-			ctx.root_dir = optarg;
-			break;
-		case 'v':
-			printf("hs20_spp_server v%s\n", VERSION_STR);
-			return 0;
-		default:
-			usage();
-			return -1;
-		}
-	}
-	if (ctx.root_dir == NULL) {
-		usage();
-		return -1;
-	}
-	ctx.xml = xml_node_init_ctx(&ctx, NULL);
-	if (ctx.xml == NULL)
-		return -1;
-	if (hs20_spp_server_init(&ctx) < 0) {
-		xml_node_deinit_ctx(ctx.xml);
-		return -1;
-	}
-
-	ret = process(&ctx);
-	debug_print(&ctx, 1, "process() --> %d", ret);
-
-	xml_node_deinit_ctx(ctx.xml);
-	hs20_spp_server_deinit(&ctx);
-	if (ctx.debug_log)
-		fclose(ctx.debug_log);
-
-	return ret;
-}
diff --git a/hs20/server/spp_server.c b/hs20/server/spp_server.c
deleted file mode 100644
index 72694be..0000000
--- a/hs20/server/spp_server.c
+++ /dev/null
@@ -1,2936 +0,0 @@
-/*
- * Hotspot 2.0 SPP server
- * Copyright (c) 2012-2013, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <ctype.h>
-#include <time.h>
-#include <errno.h>
-#include <sqlite3.h>
-
-#include "common.h"
-#include "base64.h"
-#include "md5_i.h"
-#include "xml-utils.h"
-#include "spp_server.h"
-
-
-#define SPP_NS_URI "http://www.wi-fi.org/specifications/hotspot2dot0/v1.0/spp"
-
-#define URN_OMA_DM_DEVINFO "urn:oma:mo:oma-dm-devinfo:1.0"
-#define URN_OMA_DM_DEVDETAIL "urn:oma:mo:oma-dm-devdetail:1.0"
-#define URN_OMA_DM_DMACC "urn:oma:mo:oma-dm-dmacc:1.0"
-#define URN_HS20_PPS "urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0"
-
-
-/* TODO: timeout to expire sessions */
-
-enum hs20_session_operation {
-	NO_OPERATION,
-	UPDATE_PASSWORD,
-	CONTINUE_SUBSCRIPTION_REMEDIATION,
-	CONTINUE_POLICY_UPDATE,
-	USER_REMEDIATION,
-	SUBSCRIPTION_REGISTRATION,
-	POLICY_REMEDIATION,
-	POLICY_UPDATE,
-	FREE_REMEDIATION,
-	CLEAR_REMEDIATION,
-	CERT_REENROLL,
-};
-
-
-static char * db_get_session_val(struct hs20_svc *ctx, const char *user,
-				 const char *realm, const char *session_id,
-				 const char *field);
-static char * db_get_osu_config_val(struct hs20_svc *ctx, const char *realm,
-				    const char *field);
-static xml_node_t * build_policy(struct hs20_svc *ctx, const char *user,
-				 const char *realm, int use_dmacc);
-static xml_node_t * spp_exec_get_certificate(struct hs20_svc *ctx,
-					     const char *session_id,
-					     const char *user,
-					     const char *realm,
-					     int add_est_user);
-
-
-static int db_add_session(struct hs20_svc *ctx,
-			  const char *user, const char *realm,
-			  const char *sessionid, const char *pw,
-			  const char *redirect_uri,
-			  enum hs20_session_operation operation,
-			  const u8 *mac_addr)
-{
-	char *sql;
-	int ret = 0;
-	char addr[20];
-
-	if (mac_addr)
-		snprintf(addr, sizeof(addr), MACSTR, MAC2STR(mac_addr));
-	else
-		addr[0] = '\0';
-	sql = sqlite3_mprintf("INSERT INTO sessions(timestamp,id,user,realm,"
-			      "operation,password,redirect_uri,mac_addr,test) "
-			      "VALUES "
-			      "(strftime('%%Y-%%m-%%d %%H:%%M:%%f','now'),"
-			      "%Q,%Q,%Q,%d,%Q,%Q,%Q,%Q)",
-			      sessionid, user ? user : "", realm ? realm : "",
-			      operation, pw ? pw : "",
-			      redirect_uri ? redirect_uri : "",
-			      addr, ctx->test);
-	if (sql == NULL)
-		return -1;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session entry into sqlite "
-			    "database: %s", sqlite3_errmsg(ctx->db));
-		ret = -1;
-	}
-	sqlite3_free(sql);
-	return ret;
-}
-
-
-static void db_update_session_password(struct hs20_svc *ctx, const char *user,
-				       const char *realm, const char *sessionid,
-				       const char *pw)
-{
-	char *sql;
-
-	sql = sqlite3_mprintf("UPDATE sessions SET password=%Q WHERE id=%Q AND "
-			      "user=%Q AND realm=%Q",
-			      pw, sessionid, user, realm);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to update session password: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_update_session_machine_managed(struct hs20_svc *ctx,
-					      const char *user,
-					      const char *realm,
-					      const char *sessionid,
-					      const int pw_mm)
-{
-	char *sql;
-
-	sql = sqlite3_mprintf("UPDATE sessions SET machine_managed=%Q WHERE id=%Q AND user=%Q AND realm=%Q",
-			      pw_mm ? "1" : "0", sessionid, user, realm);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1,
-			    "Failed to update session machine_managed: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_pps(struct hs20_svc *ctx, const char *user,
-			       const char *realm, const char *sessionid,
-			       xml_node_t *node)
-{
-	char *str;
-	char *sql;
-
-	str = xml_node_to_str(ctx->xml, node);
-	if (str == NULL)
-		return;
-	sql = sqlite3_mprintf("UPDATE sessions SET pps=%Q WHERE id=%Q AND "
-			      "user=%Q AND realm=%Q",
-			      str, sessionid, user, realm);
-	free(str);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session pps: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_devinfo(struct hs20_svc *ctx, const char *sessionid,
-				   xml_node_t *node)
-{
-	char *str;
-	char *sql;
-
-	str = xml_node_to_str(ctx->xml, node);
-	if (str == NULL)
-		return;
-	sql = sqlite3_mprintf("UPDATE sessions SET devinfo=%Q WHERE id=%Q",
-			      str, sessionid);
-	free(str);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session devinfo: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_devdetail(struct hs20_svc *ctx,
-				     const char *sessionid,
-				     xml_node_t *node)
-{
-	char *str;
-	char *sql;
-
-	str = xml_node_to_str(ctx->xml, node);
-	if (str == NULL)
-		return;
-	sql = sqlite3_mprintf("UPDATE sessions SET devdetail=%Q WHERE id=%Q",
-			      str, sessionid);
-	free(str);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session devdetail: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_dmacc(struct hs20_svc *ctx, const char *sessionid,
-				 const char *username, const char *password)
-{
-	char *sql;
-
-	sql = sqlite3_mprintf("UPDATE sessions SET osu_user=%Q, osu_password=%Q WHERE id=%Q",
-			      username, password, sessionid);
-	if (!sql)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session DMAcc: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_eap_method(struct hs20_svc *ctx,
-				      const char *sessionid,
-				      const char *method)
-{
-	char *sql;
-
-	sql = sqlite3_mprintf("UPDATE sessions SET eap_method=%Q WHERE id=%Q",
-			      method, sessionid);
-	if (!sql)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session EAP method: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_add_session_id_hash(struct hs20_svc *ctx, const char *sessionid,
-				   const char *id_hash)
-{
-	char *sql;
-
-	sql = sqlite3_mprintf("UPDATE sessions SET mobile_identifier_hash=%Q WHERE id=%Q",
-			      id_hash, sessionid);
-	if (!sql)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add session ID hash: %s",
-			    sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_remove_session(struct hs20_svc *ctx,
-			      const char *user, const char *realm,
-			      const char *sessionid)
-{
-	char *sql;
-
-	if (user == NULL || realm == NULL) {
-		sql = sqlite3_mprintf("DELETE FROM sessions WHERE "
-				      "id=%Q", sessionid);
-	} else {
-		sql = sqlite3_mprintf("DELETE FROM sessions WHERE "
-				      "user=%Q AND realm=%Q AND id=%Q",
-				      user, realm, sessionid);
-	}
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to delete session entry from "
-			    "sqlite database: %s", sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void hs20_eventlog(struct hs20_svc *ctx,
-			  const char *user, const char *realm,
-			  const char *sessionid, const char *notes,
-			  const char *dump)
-{
-	char *sql;
-	char *user_buf = NULL, *realm_buf = NULL;
-
-	debug_print(ctx, 1, "eventlog: %s", notes);
-
-	if (user == NULL) {
-		user_buf = db_get_session_val(ctx, NULL, NULL, sessionid,
-					      "user");
-		user = user_buf;
-		realm_buf = db_get_session_val(ctx, NULL, NULL, sessionid,
-					       "realm");
-		realm = realm_buf;
-	}
-
-	sql = sqlite3_mprintf("INSERT INTO eventlog"
-			      "(user,realm,sessionid,timestamp,notes,dump,addr)"
-			      " VALUES (%Q,%Q,%Q,"
-			      "strftime('%%Y-%%m-%%d %%H:%%M:%%f','now'),"
-			      "%Q,%Q,%Q)",
-			      user, realm, sessionid, notes,
-			      dump ? dump : "", ctx->addr ? ctx->addr : "");
-	free(user_buf);
-	free(realm_buf);
-	if (sql == NULL)
-		return;
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add eventlog entry into sqlite "
-			    "database: %s", sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void hs20_eventlog_node(struct hs20_svc *ctx,
-			       const char *user, const char *realm,
-			       const char *sessionid, const char *notes,
-			       xml_node_t *node)
-{
-	char *str;
-
-	if (node)
-		str = xml_node_to_str(ctx->xml, node);
-	else
-		str = NULL;
-	hs20_eventlog(ctx, user, realm, sessionid, notes, str);
-	free(str);
-}
-
-
-static void db_update_mo_str(struct hs20_svc *ctx, const char *user,
-			     const char *realm, const char *name,
-			     const char *str)
-{
-	char *sql;
-	if (user == NULL || realm == NULL || name == NULL)
-		return;
-	sql = sqlite3_mprintf("UPDATE users SET %s=%Q WHERE identity=%Q AND realm=%Q AND (phase2=1 OR methods='TLS')",
-			      name, str, user, realm);
-	if (sql == NULL)
-		return;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to update user MO entry in sqlite "
-			    "database: %s", sqlite3_errmsg(ctx->db));
-	}
-	sqlite3_free(sql);
-}
-
-
-static void db_update_mo(struct hs20_svc *ctx, const char *user,
-			 const char *realm, const char *name, xml_node_t *mo)
-{
-	char *str;
-
-	str = xml_node_to_str(ctx->xml, mo);
-	if (str == NULL)
-		return;
-
-	db_update_mo_str(ctx, user, realm, name, str);
-	free(str);
-}
-
-
-static void add_text_node(struct hs20_svc *ctx, xml_node_t *parent,
-			  const char *name, const char *value)
-{
-	xml_node_create_text(ctx->xml, parent, NULL, name, value ? value : "");
-}
-
-
-static void add_text_node_conf(struct hs20_svc *ctx, const char *realm,
-			       xml_node_t *parent, const char *name,
-			       const char *field)
-{
-	char *val;
-	val = db_get_osu_config_val(ctx, realm, field);
-	xml_node_create_text(ctx->xml, parent, NULL, name, val ? val : "");
-	os_free(val);
-}
-
-
-static void add_text_node_conf_corrupt(struct hs20_svc *ctx, const char *realm,
-				       xml_node_t *parent, const char *name,
-				       const char *field)
-{
-	char *val;
-
-	val = db_get_osu_config_val(ctx, realm, field);
-	if (val) {
-		size_t len;
-
-		len = os_strlen(val);
-		if (len > 0) {
-			if (val[len - 1] == '0')
-				val[len - 1] = '1';
-			else
-				val[len - 1] = '0';
-		}
-	}
-	xml_node_create_text(ctx->xml, parent, NULL, name, val ? val : "");
-	os_free(val);
-}
-
-
-static int new_password(char *buf, int buflen)
-{
-	int i;
-
-	if (buflen < 1)
-		return -1;
-	buf[buflen - 1] = '\0';
-	if (os_get_random((unsigned char *) buf, buflen - 1) < 0)
-		return -1;
-
-	for (i = 0; i < buflen - 1; i++) {
-		unsigned char val = buf[i];
-		val %= 2 * 26 + 10;
-		if (val < 26)
-			buf[i] = 'a' + val;
-		else if (val < 2 * 26)
-			buf[i] = 'A' + val - 26;
-		else
-			buf[i] = '0' + val - 2 * 26;
-	}
-
-	return 0;
-}
-
-
-struct get_db_field_data {
-	const char *field;
-	char *value;
-};
-
-
-static int get_db_field(void *ctx, int argc, char *argv[], char *col[])
-{
-	struct get_db_field_data *data = ctx;
-	int i;
-
-	for (i = 0; i < argc; i++) {
-		if (os_strcmp(col[i], data->field) == 0 && argv[i]) {
-			os_free(data->value);
-			data->value = os_strdup(argv[i]);
-			break;
-		}
-	}
-
-	return 0;
-}
-
-
-static char * db_get_val(struct hs20_svc *ctx, const char *user,
-			 const char *realm, const char *field, int dmacc)
-{
-	char *cmd;
-	struct get_db_field_data data;
-
-	cmd = sqlite3_mprintf("SELECT %s FROM users WHERE %s=%Q AND realm=%Q AND (phase2=1 OR methods='TLS')",
-			      field, dmacc ? "osu_user" : "identity",
-			      user, realm);
-	if (cmd == NULL)
-		return NULL;
-	memset(&data, 0, sizeof(data));
-	data.field = field;
-	if (sqlite3_exec(ctx->db, cmd, get_db_field, &data, NULL) != SQLITE_OK)
-	{
-		debug_print(ctx, 1, "Could not find user '%s'", user);
-		sqlite3_free(cmd);
-		return NULL;
-	}
-	sqlite3_free(cmd);
-
-	debug_print(ctx, 1, "DB: user='%s' realm='%s' field='%s' dmacc=%d --> "
-		    "value='%s'", user, realm, field, dmacc, data.value);
-
-	return data.value;
-}
-
-
-static int db_update_val(struct hs20_svc *ctx, const char *user,
-			 const char *realm, const char *field,
-			 const char *val, int dmacc)
-{
-	char *cmd;
-	int ret;
-
-	cmd = sqlite3_mprintf("UPDATE users SET %s=%Q WHERE %s=%Q AND realm=%Q AND (phase2=1 OR methods='TLS')",
-			      field, val, dmacc ? "osu_user" : "identity", user,
-			      realm);
-	if (cmd == NULL)
-		return -1;
-	debug_print(ctx, 1, "DB: %s", cmd);
-	if (sqlite3_exec(ctx->db, cmd, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1,
-			    "Failed to update user in sqlite database: %s",
-			    sqlite3_errmsg(ctx->db));
-		ret = -1;
-	} else {
-		debug_print(ctx, 1,
-			    "DB: user='%s' realm='%s' field='%s' set to '%s'",
-			    user, realm, field, val);
-		ret = 0;
-	}
-	sqlite3_free(cmd);
-
-	return ret;
-}
-
-
-static char * db_get_session_val(struct hs20_svc *ctx, const char *user,
-				 const char *realm, const char *session_id,
-				 const char *field)
-{
-	char *cmd;
-	struct get_db_field_data data;
-
-	if (user == NULL || realm == NULL) {
-		cmd = sqlite3_mprintf("SELECT %s FROM sessions WHERE "
-				      "id=%Q", field, session_id);
-	} else {
-		cmd = sqlite3_mprintf("SELECT %s FROM sessions WHERE "
-				      "user=%Q AND realm=%Q AND id=%Q",
-				      field, user, realm, session_id);
-	}
-	if (cmd == NULL)
-		return NULL;
-	debug_print(ctx, 1, "DB: %s", cmd);
-	memset(&data, 0, sizeof(data));
-	data.field = field;
-	if (sqlite3_exec(ctx->db, cmd, get_db_field, &data, NULL) != SQLITE_OK)
-	{
-		debug_print(ctx, 1, "DB: Could not find session %s: %s",
-			    session_id, sqlite3_errmsg(ctx->db));
-		sqlite3_free(cmd);
-		return NULL;
-	}
-	sqlite3_free(cmd);
-
-	debug_print(ctx, 1, "DB: return '%s'", data.value);
-	return data.value;
-}
-
-
-static int update_password(struct hs20_svc *ctx, const char *user,
-			   const char *realm, const char *pw, int dmacc)
-{
-	char *cmd;
-
-	cmd = sqlite3_mprintf("UPDATE users SET password=%Q, "
-			      "remediation='' "
-			      "WHERE %s=%Q AND phase2=1",
-			      pw, dmacc ? "osu_user" : "identity",
-			      user);
-	if (cmd == NULL)
-		return -1;
-	debug_print(ctx, 1, "DB: %s", cmd);
-	if (sqlite3_exec(ctx->db, cmd, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to update database for user '%s'",
-			    user);
-	}
-	sqlite3_free(cmd);
-
-	return 0;
-}
-
-
-static int clear_remediation(struct hs20_svc *ctx, const char *user,
-			     const char *realm, int dmacc)
-{
-	char *cmd;
-
-	cmd = sqlite3_mprintf("UPDATE users SET remediation='' WHERE %s=%Q",
-			      dmacc ? "osu_user" : "identity",
-			      user);
-	if (cmd == NULL)
-		return -1;
-	debug_print(ctx, 1, "DB: %s", cmd);
-	if (sqlite3_exec(ctx->db, cmd, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to update database for user '%s'",
-			    user);
-	}
-	sqlite3_free(cmd);
-
-	return 0;
-}
-
-
-static int add_eap_ttls(struct hs20_svc *ctx, xml_node_t *parent)
-{
-	xml_node_t *node;
-
-	node = xml_node_create(ctx->xml, parent, NULL, "EAPMethod");
-	if (node == NULL)
-		return -1;
-
-	add_text_node(ctx, node, "EAPType", "21");
-	add_text_node(ctx, node, "InnerMethod", "MS-CHAP-V2");
-
-	return 0;
-}
-
-
-static xml_node_t * build_username_password(struct hs20_svc *ctx,
-					    xml_node_t *parent,
-					    const char *user, const char *pw)
-{
-	xml_node_t *node;
-	char *b64;
-	size_t len;
-
-	node = xml_node_create(ctx->xml, parent, NULL, "UsernamePassword");
-	if (node == NULL)
-		return NULL;
-
-	add_text_node(ctx, node, "Username", user);
-
-	b64 = base64_encode(pw, strlen(pw), NULL);
-	if (b64 == NULL)
-		return NULL;
-	len = os_strlen(b64);
-	if (len > 0 && b64[len - 1] == '\n')
-		b64[len - 1] = '\0';
-	add_text_node(ctx, node, "Password", b64);
-	free(b64);
-
-	return node;
-}
-
-
-static int add_username_password(struct hs20_svc *ctx, xml_node_t *cred,
-				 const char *user, const char *pw,
-				 int machine_managed)
-{
-	xml_node_t *node;
-
-	node = build_username_password(ctx, cred, user, pw);
-	if (node == NULL)
-		return -1;
-
-	add_text_node(ctx, node, "MachineManaged",
-		      machine_managed ? "TRUE" : "FALSE");
-	add_text_node(ctx, node, "SoftTokenApp", "");
-	add_eap_ttls(ctx, node);
-
-	return 0;
-}
-
-
-static void add_creation_date(struct hs20_svc *ctx, xml_node_t *cred)
-{
-	char str[30];
-	time_t now;
-	struct tm tm;
-
-	time(&now);
-	gmtime_r(&now, &tm);
-	snprintf(str, sizeof(str), "%04u-%02u-%02uT%02u:%02u:%02uZ",
-		 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
-		 tm.tm_hour, tm.tm_min, tm.tm_sec);
-	xml_node_create_text(ctx->xml, cred, NULL, "CreationDate", str);
-}
-
-
-static xml_node_t * build_credential_pw(struct hs20_svc *ctx,
-					const char *user, const char *realm,
-					const char *pw, int machine_managed)
-{
-	xml_node_t *cred;
-
-	cred = xml_node_create_root(ctx->xml, NULL, NULL, NULL, "Credential");
-	if (cred == NULL) {
-		debug_print(ctx, 1, "Failed to create Credential node");
-		return NULL;
-	}
-	add_creation_date(ctx, cred);
-	if (add_username_password(ctx, cred, user, pw, machine_managed) < 0) {
-		xml_node_free(ctx->xml, cred);
-		return NULL;
-	}
-	add_text_node(ctx, cred, "Realm", realm);
-
-	return cred;
-}
-
-
-static xml_node_t * build_credential(struct hs20_svc *ctx,
-				     const char *user, const char *realm,
-				     char *new_pw, size_t new_pw_len)
-{
-	if (new_password(new_pw, new_pw_len) < 0)
-		return NULL;
-	debug_print(ctx, 1, "Update password to '%s'", new_pw);
-	return build_credential_pw(ctx, user, realm, new_pw, 1);
-}
-
-
-static xml_node_t * build_credential_cert(struct hs20_svc *ctx,
-					  const char *user, const char *realm,
-					  const char *cert_fingerprint)
-{
-	xml_node_t *cred, *cert;
-
-	cred = xml_node_create_root(ctx->xml, NULL, NULL, NULL, "Credential");
-	if (cred == NULL) {
-		debug_print(ctx, 1, "Failed to create Credential node");
-		return NULL;
-	}
-	add_creation_date(ctx, cred);
-	cert = xml_node_create(ctx->xml, cred, NULL, "DigitalCertificate");
-	add_text_node(ctx, cert, "CertificateType", "x509v3");
-	add_text_node(ctx, cert, "CertSHA256Fingerprint", cert_fingerprint);
-	add_text_node(ctx, cred, "Realm", realm);
-
-	return cred;
-}
-
-
-static xml_node_t * build_post_dev_data_response(struct hs20_svc *ctx,
-						 xml_namespace_t **ret_ns,
-						 const char *session_id,
-						 const char *status,
-						 const char *error_code)
-{
-	xml_node_t *spp_node = NULL;
-	xml_namespace_t *ns;
-
-	spp_node = xml_node_create_root(ctx->xml, SPP_NS_URI, "spp", &ns,
-					"sppPostDevDataResponse");
-	if (spp_node == NULL)
-		return NULL;
-	if (ret_ns)
-		*ret_ns = ns;
-
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppVersion", "1.0");
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sessionID", session_id);
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppStatus", status);
-
-	if (error_code) {
-		xml_node_t *node;
-		node = xml_node_create(ctx->xml, spp_node, ns, "sppError");
-		if (node)
-			xml_node_add_attr(ctx->xml, node, NULL, "errorCode",
-					  error_code);
-	}
-
-	return spp_node;
-}
-
-
-static int add_update_node(struct hs20_svc *ctx, xml_node_t *spp_node,
-			   xml_namespace_t *ns, const char *uri,
-			   xml_node_t *upd_node)
-{
-	xml_node_t *node, *tnds;
-	char *str;
-
-	tnds = mo_to_tnds(ctx->xml, upd_node, 0, NULL, NULL);
-	if (!tnds)
-		return -1;
-
-	str = xml_node_to_str(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (str == NULL)
-		return -1;
-	node = xml_node_create_text(ctx->xml, spp_node, ns, "updateNode", str);
-	free(str);
-
-	xml_node_add_attr(ctx->xml, node, ns, "managementTreeURI", uri);
-
-	return 0;
-}
-
-
-static xml_node_t * read_subrem_file(struct hs20_svc *ctx,
-				     const char *subrem_id,
-				     char *uri, size_t uri_size)
-{
-	char fname[200];
-	char *buf, *buf2, *pos;
-	size_t len;
-	xml_node_t *node;
-
-	os_snprintf(fname, sizeof(fname), "%s/spp/subrem/%s",
-		    ctx->root_dir, subrem_id);
-	debug_print(ctx, 1, "Use subrem file %s", fname);
-
-	buf = os_readfile(fname, &len);
-	if (!buf)
-		return NULL;
-	buf2 = os_realloc(buf, len + 1);
-	if (!buf2) {
-		os_free(buf);
-		return NULL;
-	}
-	buf = buf2;
-	buf[len] = '\0';
-
-	pos = os_strchr(buf, '\n');
-	if (!pos) {
-		os_free(buf);
-		return NULL;
-	}
-	*pos++ = '\0';
-	os_strlcpy(uri, buf, uri_size);
-
-	node = xml_node_from_buf(ctx->xml, pos);
-	os_free(buf);
-
-	return node;
-}
-
-
-static xml_node_t * build_sub_rem_resp(struct hs20_svc *ctx,
-				       const char *user, const char *realm,
-				       const char *session_id,
-				       int machine_rem, int dmacc)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *cred;
-	char buf[400];
-	char new_pw[33];
-	char *status;
-	char *cert;
-
-	cert = db_get_val(ctx, user, realm, "cert", dmacc);
-	if (cert && cert[0] == '\0') {
-		os_free(cert);
-		cert = NULL;
-	}
-	if (cert) {
-		char *subrem;
-
-		/* No change needed in PPS MO unless specifically asked to */
-		cred = NULL;
-		buf[0] = '\0';
-
-		subrem = db_get_val(ctx, user, realm, "subrem", dmacc);
-		if (subrem && subrem[0]) {
-			cred = read_subrem_file(ctx, subrem, buf, sizeof(buf));
-			if (!cred) {
-				debug_print(ctx, 1,
-					    "Could not create updateNode from subrem file");
-				os_free(subrem);
-				os_free(cert);
-				return NULL;
-			}
-		}
-		os_free(subrem);
-	} else {
-		char *real_user = NULL;
-		char *pw;
-
-		if (dmacc) {
-			real_user = db_get_val(ctx, user, realm, "identity",
-					       dmacc);
-			if (!real_user) {
-				debug_print(ctx, 1,
-					    "Could not find user identity for dmacc user '%s'",
-					    user);
-				return NULL;
-			}
-		}
-
-		pw = db_get_session_val(ctx, user, realm, session_id,
-					"password");
-		if (pw && pw[0]) {
-			debug_print(ctx, 1, "New password from the user: '%s'",
-				    pw);
-			snprintf(new_pw, sizeof(new_pw), "%s", pw);
-			free(pw);
-			cred = build_credential_pw(ctx,
-						   real_user ? real_user : user,
-						   realm, new_pw, 0);
-		} else {
-			cred = build_credential(ctx,
-						real_user ? real_user : user,
-						realm, new_pw, sizeof(new_pw));
-		}
-
-		free(real_user);
-		if (!cred) {
-			debug_print(ctx, 1, "Could not build credential");
-			os_free(cert);
-			return NULL;
-		}
-
-		snprintf(buf, sizeof(buf),
-			 "./Wi-Fi/%s/PerProviderSubscription/Cred01/Credential",
-			 realm);
-	}
-
-	status = "Remediation complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL) {
-		debug_print(ctx, 1, "Could not build sppPostDevDataResponse");
-		os_free(cert);
-		return NULL;
-	}
-
-	if ((cred && add_update_node(ctx, spp_node, ns, buf, cred) < 0) ||
-	    (!cred && !xml_node_create(ctx->xml, spp_node, ns, "noMOUpdate"))) {
-		debug_print(ctx, 1, "Could not add update node");
-		xml_node_free(ctx->xml, spp_node);
-		os_free(cert);
-		return NULL;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   machine_rem ? "machine remediation" :
-			   "user remediation", cred);
-	xml_node_free(ctx->xml, cred);
-
-	if (cert) {
-		debug_print(ctx, 1, "Request DB remediation clearing on success notification (certificate credential)");
-		db_add_session(ctx, user, realm, session_id, NULL, NULL,
-			       CLEAR_REMEDIATION, NULL);
-	} else {
-		debug_print(ctx, 1, "Request DB password update on success "
-			    "notification");
-		db_add_session(ctx, user, realm, session_id, new_pw, NULL,
-			       UPDATE_PASSWORD, NULL);
-	}
-	os_free(cert);
-
-	return spp_node;
-}
-
-
-static xml_node_t * machine_remediation(struct hs20_svc *ctx,
-					const char *user,
-					const char *realm,
-					const char *session_id, int dmacc)
-{
-	return build_sub_rem_resp(ctx, user, realm, session_id, 1, dmacc);
-}
-
-
-static xml_node_t * cert_reenroll(struct hs20_svc *ctx,
-				  const char *user,
-				  const char *realm,
-				  const char *session_id)
-{
-	db_add_session(ctx, user, realm, session_id, NULL, NULL,
-		       CERT_REENROLL, NULL);
-	return spp_exec_get_certificate(ctx, session_id, user, realm, 0);
-}
-
-
-static xml_node_t * policy_remediation(struct hs20_svc *ctx,
-				       const char *user, const char *realm,
-				       const char *session_id, int dmacc)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *policy;
-	char buf[400];
-	const char *status;
-
-	hs20_eventlog(ctx, user, realm, session_id,
-		      "requires policy remediation", NULL);
-
-	db_add_session(ctx, user, realm, session_id, NULL, NULL,
-		       POLICY_REMEDIATION, NULL);
-
-	policy = build_policy(ctx, user, realm, dmacc);
-	if (!policy) {
-		return build_post_dev_data_response(
-			ctx, NULL, session_id,
-			"No update available at this time", NULL);
-	}
-
-	status = "Remediation complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	snprintf(buf, sizeof(buf),
-		 "./Wi-Fi/%s/PerProviderSubscription/Cred01/Policy",
-		 realm);
-
-	if (add_update_node(ctx, spp_node, ns, buf, policy) < 0) {
-		xml_node_free(ctx->xml, spp_node);
-		xml_node_free(ctx->xml, policy);
-		return NULL;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "policy update (sub rem)", policy);
-	xml_node_free(ctx->xml, policy);
-
-	return spp_node;
-}
-
-
-static xml_node_t * browser_remediation(struct hs20_svc *ctx,
-					const char *session_id,
-					const char *redirect_uri,
-					const char *uri)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *exec_node;
-
-	if (redirect_uri == NULL) {
-		debug_print(ctx, 1, "Missing redirectURI attribute for user "
-			    "remediation");
-		return NULL;
-	}
-	debug_print(ctx, 1, "redirectURI %s", redirect_uri);
-
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, "OK",
-		NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	exec_node = xml_node_create(ctx->xml, spp_node, ns, "exec");
-	xml_node_create_text(ctx->xml, exec_node, ns, "launchBrowserToURI",
-			     uri);
-	return spp_node;
-}
-
-
-static xml_node_t * user_remediation(struct hs20_svc *ctx, const char *user,
-				     const char *realm, const char *session_id,
-				     const char *redirect_uri)
-{
-	char uri[300], *val;
-
-	hs20_eventlog(ctx, user, realm, session_id,
-		      "requires user remediation", NULL);
-	val = db_get_osu_config_val(ctx, realm, "remediation_url");
-	if (val == NULL)
-		return NULL;
-
-	db_add_session(ctx, user, realm, session_id, NULL, redirect_uri,
-		       USER_REMEDIATION, NULL);
-
-	snprintf(uri, sizeof(uri), "%s%s", val, session_id);
-	os_free(val);
-	return browser_remediation(ctx, session_id, redirect_uri, uri);
-}
-
-
-static xml_node_t * free_remediation(struct hs20_svc *ctx,
-				     const char *user, const char *realm,
-				     const char *session_id,
-				     const char *redirect_uri)
-{
-	char uri[300], *val;
-
-	hs20_eventlog(ctx, user, realm, session_id,
-		      "requires free/public account remediation", NULL);
-	val = db_get_osu_config_val(ctx, realm, "free_remediation_url");
-	if (val == NULL)
-		return NULL;
-
-	db_add_session(ctx, user, realm, session_id, NULL, redirect_uri,
-		       FREE_REMEDIATION, NULL);
-
-	snprintf(uri, sizeof(uri), "%s%s", val, session_id);
-	os_free(val);
-	return browser_remediation(ctx, session_id, redirect_uri, uri);
-}
-
-
-static xml_node_t * no_sub_rem(struct hs20_svc *ctx,
-			       const char *user, const char *realm,
-			       const char *session_id)
-{
-	const char *status;
-
-	hs20_eventlog(ctx, user, realm, session_id,
-		      "no subscription mediation available", NULL);
-
-	status = "No update available at this time";
-	return build_post_dev_data_response(ctx, NULL, session_id, status,
-					    NULL);
-}
-
-
-static xml_node_t * hs20_subscription_remediation(struct hs20_svc *ctx,
-						  const char *user,
-						  const char *realm,
-						  const char *session_id,
-						  int dmacc,
-						  const char *redirect_uri)
-{
-	char *type, *identity;
-	xml_node_t *ret;
-	char *free_account;
-
-	identity = db_get_val(ctx, user, realm, "identity", dmacc);
-	if (identity == NULL || strlen(identity) == 0) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "user not found in database for remediation",
-			      NULL);
-		os_free(identity);
-		return build_post_dev_data_response(ctx, NULL, session_id,
-						    "Error occurred",
-						    "Not found");
-	}
-	os_free(identity);
-
-	free_account = db_get_osu_config_val(ctx, realm, "free_account");
-	if (free_account && strcmp(free_account, user) == 0) {
-		free(free_account);
-		return no_sub_rem(ctx, user, realm, session_id);
-	}
-	free(free_account);
-
-	type = db_get_val(ctx, user, realm, "remediation", dmacc);
-	if (type && strcmp(type, "free") != 0) {
-		char *val;
-		int shared = 0;
-		val = db_get_val(ctx, user, realm, "shared", dmacc);
-		if (val)
-			shared = atoi(val);
-		free(val);
-		if (shared) {
-			free(type);
-			return no_sub_rem(ctx, user, realm, session_id);
-		}
-	}
-	if (type && strcmp(type, "user") == 0)
-		ret = user_remediation(ctx, user, realm, session_id,
-				       redirect_uri);
-	else if (type && strcmp(type, "free") == 0)
-		ret = free_remediation(ctx, user, realm, session_id,
-				       redirect_uri);
-	else if (type && strcmp(type, "policy") == 0)
-		ret = policy_remediation(ctx, user, realm, session_id, dmacc);
-	else if (type && strcmp(type, "machine") == 0)
-		ret = machine_remediation(ctx, user, realm, session_id, dmacc);
-	else if (type && strcmp(type, "reenroll") == 0)
-		ret = cert_reenroll(ctx, user, realm, session_id);
-	else
-		ret = no_sub_rem(ctx, user, realm, session_id);
-	free(type);
-
-	return ret;
-}
-
-
-static xml_node_t * read_policy_file(struct hs20_svc *ctx,
-				     const char *policy_id)
-{
-	char fname[200];
-
-	snprintf(fname, sizeof(fname), "%s/spp/policy/%s.xml",
-		 ctx->root_dir, policy_id);
-	debug_print(ctx, 1, "Use policy file %s", fname);
-
-	return node_from_file(ctx->xml, fname);
-}
-
-
-static void update_policy_update_uri(struct hs20_svc *ctx, const char *realm,
-				     xml_node_t *policy)
-{
-	xml_node_t *node;
-	char *url;
-
-	node = get_node_uri(ctx->xml, policy, "Policy/PolicyUpdate/URI");
-	if (!node)
-		return;
-
-	url = db_get_osu_config_val(ctx, realm, "policy_url");
-	if (!url)
-		return;
-	xml_node_set_text(ctx->xml, node, url);
-	free(url);
-}
-
-
-static xml_node_t * build_policy(struct hs20_svc *ctx, const char *user,
-				 const char *realm, int use_dmacc)
-{
-	char *policy_id;
-	xml_node_t *policy, *node;
-
-	policy_id = db_get_val(ctx, user, realm, "policy", use_dmacc);
-	if (policy_id == NULL || strlen(policy_id) == 0) {
-		free(policy_id);
-		policy_id = strdup("default");
-		if (policy_id == NULL)
-			return NULL;
-	}
-	policy = read_policy_file(ctx, policy_id);
-	free(policy_id);
-	if (policy == NULL)
-		return NULL;
-
-	update_policy_update_uri(ctx, realm, policy);
-
-	node = get_node_uri(ctx->xml, policy, "Policy/PolicyUpdate");
-	if (node && use_dmacc) {
-		char *pw;
-		pw = db_get_val(ctx, user, realm, "osu_password", use_dmacc);
-		if (pw == NULL ||
-		    build_username_password(ctx, node, user, pw) == NULL) {
-			debug_print(ctx, 1, "Failed to add Policy/PolicyUpdate/"
-				    "UsernamePassword");
-			free(pw);
-			xml_node_free(ctx->xml, policy);
-			return NULL;
-		}
-		free(pw);
-	}
-
-	return policy;
-}
-
-
-static xml_node_t * hs20_policy_update(struct hs20_svc *ctx,
-				       const char *user, const char *realm,
-				       const char *session_id, int dmacc)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node;
-	xml_node_t *policy;
-	char buf[400];
-	const char *status;
-	char *identity;
-
-	identity = db_get_val(ctx, user, realm, "identity", dmacc);
-	if (identity == NULL || strlen(identity) == 0) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "user not found in database for policy update",
-			      NULL);
-		os_free(identity);
-		return build_post_dev_data_response(ctx, NULL, session_id,
-						    "Error occurred",
-						    "Not found");
-	}
-	os_free(identity);
-
-	policy = build_policy(ctx, user, realm, dmacc);
-	if (!policy) {
-		return build_post_dev_data_response(
-			ctx, NULL, session_id,
-			"No update available at this time", NULL);
-	}
-
-	db_add_session(ctx, user, realm, session_id, NULL, NULL, POLICY_UPDATE,
-		       NULL);
-
-	status = "Update complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	snprintf(buf, sizeof(buf),
-		 "./Wi-Fi/%s/PerProviderSubscription/Cred01/Policy",
-		 realm);
-
-	if (add_update_node(ctx, spp_node, ns, buf, policy) < 0) {
-		xml_node_free(ctx->xml, spp_node);
-		xml_node_free(ctx->xml, policy);
-		return NULL;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id, "policy update",
-			   policy);
-	xml_node_free(ctx->xml, policy);
-
-	return spp_node;
-}
-
-
-static xml_node_t * spp_get_mo(struct hs20_svc *ctx, xml_node_t *node,
-			       const char *urn, int *valid, char **ret_err)
-{
-	xml_node_t *child, *tnds, *mo;
-	const char *name;
-	char *mo_urn;
-	char *str;
-	char fname[200];
-
-	*valid = -1;
-	if (ret_err)
-		*ret_err = NULL;
-
-	xml_node_for_each_child(ctx->xml, child, node) {
-		xml_node_for_each_check(ctx->xml, child);
-		name = xml_node_get_localname(ctx->xml, child);
-		if (strcmp(name, "moContainer") != 0)
-			continue;
-		mo_urn = xml_node_get_attr_value_ns(ctx->xml, child, SPP_NS_URI,
-						    "moURN");
-		if (strcasecmp(urn, mo_urn) == 0) {
-			xml_node_get_attr_value_free(ctx->xml, mo_urn);
-			break;
-		}
-		xml_node_get_attr_value_free(ctx->xml, mo_urn);
-	}
-
-	if (child == NULL)
-		return NULL;
-
-	debug_print(ctx, 1, "moContainer text for %s", urn);
-	debug_dump_node(ctx, "moContainer", child);
-
-	str = xml_node_get_text(ctx->xml, child);
-	debug_print(ctx, 1, "moContainer payload: '%s'", str);
-	tnds = xml_node_from_buf(ctx->xml, str);
-	xml_node_get_text_free(ctx->xml, str);
-	if (tnds == NULL) {
-		debug_print(ctx, 1, "could not parse moContainer text");
-		return NULL;
-	}
-
-	snprintf(fname, sizeof(fname), "%s/spp/dm_ddf-v1_2.dtd", ctx->root_dir);
-	if (xml_validate_dtd(ctx->xml, tnds, fname, ret_err) == 0)
-		*valid = 1;
-	else if (ret_err && *ret_err &&
-		 os_strcmp(*ret_err, "No declaration for attribute xmlns of element MgmtTree\n") == 0) {
-		free(*ret_err);
-		debug_print(ctx, 1, "Ignore OMA-DM DDF DTD validation error for MgmtTree namespace declaration with xmlns attribute");
-		*ret_err = NULL;
-		*valid = 1;
-	} else
-		*valid = 0;
-
-	mo = tnds_to_mo(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (mo == NULL) {
-		debug_print(ctx, 1, "invalid moContainer for %s", urn);
-	}
-
-	return mo;
-}
-
-
-static xml_node_t * spp_exec_upload_mo(struct hs20_svc *ctx,
-				       const char *session_id, const char *urn)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *node, *exec_node;
-
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, "OK",
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	exec_node = xml_node_create(ctx->xml, spp_node, ns, "exec");
-
-	node = xml_node_create(ctx->xml, exec_node, ns, "uploadMO");
-	xml_node_add_attr(ctx->xml, node, ns, "moURN", urn);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_subscription_registration(struct hs20_svc *ctx,
-						   const char *realm,
-						   const char *session_id,
-						   const char *redirect_uri,
-						   const u8 *mac_addr)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *exec_node;
-	char uri[300], *val;
-
-	if (db_add_session(ctx, NULL, realm, session_id, NULL, redirect_uri,
-			   SUBSCRIPTION_REGISTRATION, mac_addr) < 0)
-		return NULL;
-	val = db_get_osu_config_val(ctx, realm, "signup_url");
-	if (!val) {
-		hs20_eventlog(ctx, NULL, realm, session_id,
-			      "signup_url not configured in osu_config", NULL);
-		return NULL;
-	}
-
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, "OK",
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	exec_node = xml_node_create(ctx->xml, spp_node, ns, "exec");
-
-	snprintf(uri, sizeof(uri), "%s%s", val, session_id);
-	os_free(val);
-	xml_node_create_text(ctx->xml, exec_node, ns, "launchBrowserToURI",
-			     uri);
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_user_input_remediation(struct hs20_svc *ctx,
-						const char *user,
-						const char *realm, int dmacc,
-						const char *session_id)
-{
-	return build_sub_rem_resp(ctx, user, realm, session_id, 0, dmacc);
-}
-
-
-static char * db_get_osu_config_val(struct hs20_svc *ctx, const char *realm,
-				    const char *field)
-{
-	char *cmd;
-	struct get_db_field_data data;
-
-	cmd = sqlite3_mprintf("SELECT value FROM osu_config WHERE realm=%Q AND "
-			      "field=%Q", realm, field);
-	if (cmd == NULL)
-		return NULL;
-	debug_print(ctx, 1, "DB: %s", cmd);
-	memset(&data, 0, sizeof(data));
-	data.field = "value";
-	if (sqlite3_exec(ctx->db, cmd, get_db_field, &data, NULL) != SQLITE_OK)
-	{
-		debug_print(ctx, 1, "DB: Could not find osu_config %s: %s",
-			    realm, sqlite3_errmsg(ctx->db));
-		sqlite3_free(cmd);
-		return NULL;
-	}
-	sqlite3_free(cmd);
-
-	debug_print(ctx, 1, "DB: return '%s'", data.value);
-	return data.value;
-}
-
-
-static xml_node_t * build_pps(struct hs20_svc *ctx,
-			      const char *user, const char *realm,
-			      const char *pw, const char *cert,
-			      int machine_managed, const char *test,
-			      const char *imsi, const char *dmacc_username,
-			      const char *dmacc_password,
-			      xml_node_t *policy_node)
-{
-	xml_node_t *pps, *c, *trust, *aaa, *aaa1, *upd, *homesp, *p;
-	xml_node_t *cred, *eap, *userpw;
-
-	pps = xml_node_create_root(ctx->xml, NULL, NULL, NULL,
-				   "PerProviderSubscription");
-	if (!pps) {
-		xml_node_free(ctx->xml, policy_node);
-		return NULL;
-	}
-
-	add_text_node(ctx, pps, "UpdateIdentifier", "1");
-
-	c = xml_node_create(ctx->xml, pps, NULL, "Cred01");
-
-	add_text_node(ctx, c, "CredentialPriority", "1");
-
-	if (imsi)
-		goto skip_aaa_trust_root;
-	aaa = xml_node_create(ctx->xml, c, NULL, "AAAServerTrustRoot");
-	aaa1 = xml_node_create(ctx->xml, aaa, NULL, "AAA1");
-	add_text_node_conf(ctx, realm, aaa1, "CertURL",
-			   "aaa_trust_root_cert_url");
-	if (test && os_strcmp(test, "corrupt_aaa_hash") == 0) {
-		debug_print(ctx, 1,
-			    "TEST: Corrupt PPS/Cred*/AAAServerTrustRoot/Root*/CertSHA256FingerPrint");
-		add_text_node_conf_corrupt(ctx, realm, aaa1,
-					   "CertSHA256Fingerprint",
-					   "aaa_trust_root_cert_fingerprint");
-	} else {
-		add_text_node_conf(ctx, realm, aaa1, "CertSHA256Fingerprint",
-				   "aaa_trust_root_cert_fingerprint");
-	}
-
-	if (test && os_strcmp(test, "corrupt_polupd_hash") == 0) {
-		debug_print(ctx, 1,
-			    "TEST: Corrupt PPS/Cred*/Policy/PolicyUpdate/Trustroot/CertSHA256FingerPrint");
-		p = xml_node_create(ctx->xml, c, NULL, "Policy");
-		upd = xml_node_create(ctx->xml, p, NULL, "PolicyUpdate");
-		add_text_node(ctx, upd, "UpdateInterval", "30");
-		add_text_node(ctx, upd, "UpdateMethod", "SPP-ClientInitiated");
-		add_text_node(ctx, upd, "Restriction", "Unrestricted");
-		add_text_node_conf(ctx, realm, upd, "URI", "policy_url");
-		trust = xml_node_create(ctx->xml, upd, NULL, "TrustRoot");
-		add_text_node_conf(ctx, realm, trust, "CertURL",
-				   "policy_trust_root_cert_url");
-		add_text_node_conf_corrupt(ctx, realm, trust,
-					   "CertSHA256Fingerprint",
-					   "policy_trust_root_cert_fingerprint");
-	}
-skip_aaa_trust_root:
-
-	upd = xml_node_create(ctx->xml, c, NULL, "SubscriptionUpdate");
-	add_text_node(ctx, upd, "UpdateInterval", "4294967295");
-	add_text_node(ctx, upd, "UpdateMethod", "SPP-ClientInitiated");
-	add_text_node(ctx, upd, "Restriction", "HomeSP");
-	add_text_node_conf(ctx, realm, upd, "URI", "spp_http_auth_url");
-	trust = xml_node_create(ctx->xml, upd, NULL, "TrustRoot");
-	add_text_node_conf(ctx, realm, trust, "CertURL", "trust_root_cert_url");
-	if (test && os_strcmp(test, "corrupt_subrem_hash") == 0) {
-		debug_print(ctx, 1,
-			    "TEST: Corrupt PPS/Cred*/SubscriptionUpdate/Trustroot/CertSHA256FingerPrint");
-		add_text_node_conf_corrupt(ctx, realm, trust,
-					   "CertSHA256Fingerprint",
-					   "trust_root_cert_fingerprint");
-	} else {
-		add_text_node_conf(ctx, realm, trust, "CertSHA256Fingerprint",
-				   "trust_root_cert_fingerprint");
-	}
-
-	if (dmacc_username &&
-	    !build_username_password(ctx, upd, dmacc_username,
-				     dmacc_password)) {
-		xml_node_free(ctx->xml, pps);
-		xml_node_free(ctx->xml, policy_node);
-		return NULL;
-	}
-
-	if (policy_node)
-		xml_node_add_child(ctx->xml, c, policy_node);
-
-	homesp = xml_node_create(ctx->xml, c, NULL, "HomeSP");
-	add_text_node_conf(ctx, realm, homesp, "FriendlyName", "friendly_name");
-	add_text_node_conf(ctx, realm, homesp, "FQDN", "fqdn");
-
-	xml_node_create(ctx->xml, c, NULL, "SubscriptionParameters");
-
-	cred = xml_node_create(ctx->xml, c, NULL, "Credential");
-	add_creation_date(ctx, cred);
-	if (imsi) {
-		xml_node_t *sim;
-		const char *type = "18"; /* default to EAP-SIM */
-
-		sim = xml_node_create(ctx->xml, cred, NULL, "SIM");
-		add_text_node(ctx, sim, "IMSI", imsi);
-		if (ctx->eap_method && os_strcmp(ctx->eap_method, "AKA") == 0)
-			type = "23";
-		else if (ctx->eap_method &&
-			 os_strcmp(ctx->eap_method, "AKA'") == 0)
-			type = "50";
-		add_text_node(ctx, sim, "EAPType", type);
-	} else if (cert) {
-		xml_node_t *dc;
-		dc = xml_node_create(ctx->xml, cred, NULL,
-				     "DigitalCertificate");
-		add_text_node(ctx, dc, "CertificateType", "x509v3");
-		add_text_node(ctx, dc, "CertSHA256Fingerprint", cert);
-	} else {
-		userpw = build_username_password(ctx, cred, user, pw);
-		add_text_node(ctx, userpw, "MachineManaged",
-			      machine_managed ? "TRUE" : "FALSE");
-		eap = xml_node_create(ctx->xml, userpw, NULL, "EAPMethod");
-		add_text_node(ctx, eap, "EAPType", "21");
-		add_text_node(ctx, eap, "InnerMethod", "MS-CHAP-V2");
-	}
-	add_text_node(ctx, cred, "Realm", realm);
-
-	return pps;
-}
-
-
-static xml_node_t * spp_exec_get_certificate(struct hs20_svc *ctx,
-					     const char *session_id,
-					     const char *user,
-					     const char *realm,
-					     int add_est_user)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *enroll, *exec_node;
-	char *val;
-	char password[11];
-	char *b64;
-
-	if (add_est_user && new_password(password, sizeof(password)) < 0)
-		return NULL;
-
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, "OK",
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	exec_node = xml_node_create(ctx->xml, spp_node, ns, "exec");
-
-	enroll = xml_node_create(ctx->xml, exec_node, ns, "getCertificate");
-	xml_node_add_attr(ctx->xml, enroll, NULL, "enrollmentProtocol", "EST");
-
-	val = db_get_osu_config_val(ctx, realm, "est_url");
-	xml_node_create_text(ctx->xml, enroll, ns, "enrollmentServerURI",
-			     val ? val : "");
-	os_free(val);
-
-	if (!add_est_user)
-		return spp_node;
-
-	xml_node_create_text(ctx->xml, enroll, ns, "estUserID", user);
-
-	b64 = base64_encode(password, strlen(password), NULL);
-	if (b64 == NULL) {
-		xml_node_free(ctx->xml, spp_node);
-		return NULL;
-	}
-	xml_node_create_text(ctx->xml, enroll, ns, "estPassword", b64);
-	free(b64);
-
-	db_update_session_password(ctx, user, realm, session_id, password);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_user_input_registration(struct hs20_svc *ctx,
-						 const char *session_id,
-						 int enrollment_done)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *node = NULL;
-	xml_node_t *pps, *tnds;
-	char buf[400];
-	char *str;
-	char *user, *realm, *pw, *type, *mm, *test;
-	const char *status;
-	int cert = 0;
-	int machine_managed = 0;
-	char *fingerprint;
-
-	user = db_get_session_val(ctx, NULL, NULL, session_id, "user");
-	realm = db_get_session_val(ctx, NULL, NULL, session_id, "realm");
-	pw = db_get_session_val(ctx, NULL, NULL, session_id, "password");
-
-	if (!user || !realm || !pw) {
-		debug_print(ctx, 1, "Could not find session info from DB for "
-			    "the new subscription");
-		free(user);
-		free(realm);
-		free(pw);
-		return NULL;
-	}
-
-	mm = db_get_session_val(ctx, NULL, NULL, session_id, "machine_managed");
-	if (mm && atoi(mm))
-		machine_managed = 1;
-	free(mm);
-
-	type = db_get_session_val(ctx, NULL, NULL, session_id, "type");
-	if (type && strcmp(type, "cert") == 0)
-		cert = 1;
-	free(type);
-
-	if (cert && !enrollment_done) {
-		xml_node_t *ret;
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "request client certificate enrollment", NULL);
-		ret = spp_exec_get_certificate(ctx, session_id, user, realm, 1);
-		free(user);
-		free(realm);
-		free(pw);
-		return ret;
-	}
-
-	if (!cert && strlen(pw) == 0) {
-		machine_managed = 1;
-		free(pw);
-		pw = malloc(11);
-		if (pw == NULL || new_password(pw, 11) < 0) {
-			free(user);
-			free(realm);
-			free(pw);
-			return NULL;
-		}
-	}
-
-	status = "Provisioning complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	fingerprint = db_get_session_val(ctx, NULL, NULL, session_id, "cert");
-	test = db_get_session_val(ctx, NULL, NULL, session_id, "test");
-	if (test)
-		debug_print(ctx, 1, "TEST: Requested special behavior: %s",
-			    test);
-	pps = build_pps(ctx, user, realm, pw,
-			fingerprint ? fingerprint : NULL, machine_managed,
-			test, NULL, NULL, NULL, NULL);
-	free(fingerprint);
-	free(test);
-	if (!pps) {
-		xml_node_free(ctx->xml, spp_node);
-		free(user);
-		free(realm);
-		free(pw);
-		return NULL;
-	}
-
-	debug_print(ctx, 1, "Request DB subscription registration on success "
-		    "notification");
-	if (machine_managed) {
-		db_update_session_password(ctx, user, realm, session_id, pw);
-		db_update_session_machine_managed(ctx, user, realm, session_id,
-						  machine_managed);
-	}
-	db_add_session_pps(ctx, user, realm, session_id, pps);
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "new subscription", pps);
-	free(user);
-	free(pw);
-
-	tnds = mo_to_tnds(ctx->xml, pps, 0, URN_HS20_PPS, NULL);
-	xml_node_free(ctx->xml, pps);
-	if (!tnds) {
-		xml_node_free(ctx->xml, spp_node);
-		free(realm);
-		return NULL;
-	}
-
-	str = xml_node_to_str(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (str == NULL) {
-		xml_node_free(ctx->xml, spp_node);
-		free(realm);
-		return NULL;
-	}
-
-	node = xml_node_create_text(ctx->xml, spp_node, ns, "addMO", str);
-	free(str);
-	snprintf(buf, sizeof(buf), "./Wi-Fi/%s/PerProviderSubscription", realm);
-	free(realm);
-	xml_node_add_attr(ctx->xml, node, ns, "managementTreeURI", buf);
-	xml_node_add_attr(ctx->xml, node, ns, "moURN", URN_HS20_PPS);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_user_input_free_remediation(struct hs20_svc *ctx,
-						     const char *user,
-						     const char *realm,
-						     const char *session_id)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node;
-	xml_node_t *cred;
-	char buf[400];
-	char *status;
-	char *free_account, *pw;
-
-	free_account = db_get_osu_config_val(ctx, realm, "free_account");
-	if (free_account == NULL)
-		return NULL;
-	pw = db_get_val(ctx, free_account, realm, "password", 0);
-	if (pw == NULL) {
-		free(free_account);
-		return NULL;
-	}
-
-	cred = build_credential_pw(ctx, free_account, realm, pw, 1);
-	free(free_account);
-	free(pw);
-	if (!cred) {
-		xml_node_free(ctx->xml, cred);
-		return NULL;
-	}
-
-	status = "Remediation complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-
-	snprintf(buf, sizeof(buf),
-		 "./Wi-Fi/%s/PerProviderSubscription/Cred01/Credential",
-		 realm);
-
-	if (add_update_node(ctx, spp_node, ns, buf, cred) < 0) {
-		xml_node_free(ctx->xml, spp_node);
-		return NULL;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "free/public remediation", cred);
-	xml_node_free(ctx->xml, cred);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_user_input_complete(struct hs20_svc *ctx,
-					     const char *user,
-					     const char *realm, int dmacc,
-					     const char *session_id)
-{
-	char *val;
-	enum hs20_session_operation oper;
-
-	val = db_get_session_val(ctx, user, realm, session_id, "operation");
-	if (val == NULL) {
-		debug_print(ctx, 1, "No session %s found to continue",
-			    session_id);
-		return NULL;
-	}
-	oper = atoi(val);
-	free(val);
-
-	if (oper == USER_REMEDIATION) {
-		return hs20_user_input_remediation(ctx, user, realm, dmacc,
-						   session_id);
-	}
-
-	if (oper == FREE_REMEDIATION) {
-		return hs20_user_input_free_remediation(ctx, user, realm,
-							session_id);
-	}
-
-	if (oper == SUBSCRIPTION_REGISTRATION) {
-		return hs20_user_input_registration(ctx, session_id, 0);
-	}
-
-	debug_print(ctx, 1, "User session %s not in state for user input "
-		    "completion", session_id);
-	return NULL;
-}
-
-
-static xml_node_t * hs20_cert_reenroll_complete(struct hs20_svc *ctx,
-						 const char *session_id)
-{
-	char *user, *realm, *cert;
-	char *status;
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *cred;
-	char buf[400];
-
-	user = db_get_session_val(ctx, NULL, NULL, session_id, "user");
-	realm = db_get_session_val(ctx, NULL, NULL, session_id, "realm");
-	cert = db_get_session_val(ctx, NULL, NULL, session_id, "cert");
-	if (!user || !realm || !cert) {
-		debug_print(ctx, 1,
-			    "Could not find session info from DB for certificate reenrollment");
-		free(user);
-		free(realm);
-		free(cert);
-		return NULL;
-	}
-
-	cred = build_credential_cert(ctx, user, realm, cert);
-	if (!cred) {
-		debug_print(ctx, 1, "Could not build credential");
-		free(user);
-		free(realm);
-		free(cert);
-		return NULL;
-	}
-
-	status = "Remediation complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL) {
-		debug_print(ctx, 1, "Could not build sppPostDevDataResponse");
-		free(user);
-		free(realm);
-		free(cert);
-		xml_node_free(ctx->xml, cred);
-		return NULL;
-	}
-
-	snprintf(buf, sizeof(buf),
-		 "./Wi-Fi/%s/PerProviderSubscription/Cred01/Credential",
-		 realm);
-
-	if (add_update_node(ctx, spp_node, ns, buf, cred) < 0) {
-		debug_print(ctx, 1, "Could not add update node");
-		xml_node_free(ctx->xml, spp_node);
-		free(user);
-		free(realm);
-		free(cert);
-		return NULL;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "certificate reenrollment", cred);
-	xml_node_free(ctx->xml, cred);
-
-	free(user);
-	free(realm);
-	free(cert);
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_cert_enroll_completed(struct hs20_svc *ctx,
-					       const char *user,
-					       const char *realm, int dmacc,
-					       const char *session_id)
-{
-	char *val;
-	enum hs20_session_operation oper;
-
-	val = db_get_session_val(ctx, NULL, NULL, session_id, "operation");
-	if (val == NULL) {
-		debug_print(ctx, 1, "No session %s found to continue",
-			    session_id);
-		return NULL;
-	}
-	oper = atoi(val);
-	free(val);
-
-	if (oper == SUBSCRIPTION_REGISTRATION)
-		return hs20_user_input_registration(ctx, session_id, 1);
-	if (oper == CERT_REENROLL)
-		return hs20_cert_reenroll_complete(ctx, session_id);
-
-	debug_print(ctx, 1, "User session %s not in state for certificate "
-		    "enrollment completion", session_id);
-	return NULL;
-}
-
-
-static xml_node_t * hs20_cert_enroll_failed(struct hs20_svc *ctx,
-					    const char *user,
-					    const char *realm, int dmacc,
-					    const char *session_id)
-{
-	char *val;
-	enum hs20_session_operation oper;
-	xml_node_t *spp_node, *node;
-	char *status;
-	xml_namespace_t *ns;
-
-	val = db_get_session_val(ctx, user, realm, session_id, "operation");
-	if (val == NULL) {
-		debug_print(ctx, 1, "No session %s found to continue",
-			    session_id);
-		return NULL;
-	}
-	oper = atoi(val);
-	free(val);
-
-	if (oper != SUBSCRIPTION_REGISTRATION) {
-		debug_print(ctx, 1, "User session %s not in state for "
-			    "enrollment failure", session_id);
-		return NULL;
-	}
-
-	status = "Error occurred";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (spp_node == NULL)
-		return NULL;
-	node = xml_node_create(ctx->xml, spp_node, ns, "sppError");
-	xml_node_add_attr(ctx->xml, node, NULL, "errorCode",
-			  "Credentials cannot be provisioned at this time");
-	db_remove_session(ctx, user, realm, session_id);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_sim_provisioning(struct hs20_svc *ctx,
-					  const char *user,
-					  const char *realm, int dmacc,
-					  const char *session_id)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *node = NULL;
-	xml_node_t *pps, *tnds;
-	char buf[400];
-	char *str;
-	const char *status;
-	char dmacc_username[32];
-	char dmacc_password[32];
-	char *policy;
-	xml_node_t *policy_node = NULL;
-
-	if (!ctx->imsi) {
-		debug_print(ctx, 1, "IMSI not available for SIM provisioning");
-		return NULL;
-	}
-
-	if (new_password(dmacc_username, sizeof(dmacc_username)) < 0 ||
-	    new_password(dmacc_password, sizeof(dmacc_password)) < 0) {
-		debug_print(ctx, 1,
-			    "Failed to generate DMAcc username/password");
-		return NULL;
-	}
-
-	status = "Provisioning complete, request sppUpdateResponse";
-	spp_node = build_post_dev_data_response(ctx, &ns, session_id, status,
-						NULL);
-	if (!spp_node)
-		return NULL;
-
-	policy = db_get_osu_config_val(ctx, realm, "sim_policy");
-	if (policy) {
-		policy_node = read_policy_file(ctx, policy);
-		os_free(policy);
-		if (!policy_node) {
-			xml_node_free(ctx->xml, spp_node);
-			return NULL;
-		}
-		update_policy_update_uri(ctx, realm, policy_node);
-		node = get_node_uri(ctx->xml, policy_node,
-				    "Policy/PolicyUpdate");
-		if (node)
-			build_username_password(ctx, node, dmacc_username,
-						dmacc_password);
-	}
-
-	pps = build_pps(ctx, NULL, realm, NULL, NULL, 0, NULL, ctx->imsi,
-			dmacc_username, dmacc_password, policy_node);
-	if (!pps) {
-		xml_node_free(ctx->xml, spp_node);
-		return NULL;
-	}
-
-	debug_print(ctx, 1,
-		    "Request DB subscription registration on success notification");
-	if (!user || !user[0])
-		user = ctx->imsi;
-	db_add_session(ctx, user, realm, session_id, NULL, NULL,
-		       SUBSCRIPTION_REGISTRATION, NULL);
-	db_add_session_dmacc(ctx, session_id, dmacc_username, dmacc_password);
-	if (ctx->eap_method)
-		db_add_session_eap_method(ctx, session_id, ctx->eap_method);
-	if (ctx->id_hash)
-		db_add_session_id_hash(ctx, session_id, ctx->id_hash);
-	db_add_session_pps(ctx, user, realm, session_id, pps);
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "new subscription", pps);
-
-	tnds = mo_to_tnds(ctx->xml, pps, 0, URN_HS20_PPS, NULL);
-	xml_node_free(ctx->xml, pps);
-	if (!tnds) {
-		xml_node_free(ctx->xml, spp_node);
-		return NULL;
-	}
-
-	str = xml_node_to_str(ctx->xml, tnds);
-	xml_node_free(ctx->xml, tnds);
-	if (!str) {
-		xml_node_free(ctx->xml, spp_node);
-		return NULL;
-	}
-
-	node = xml_node_create_text(ctx->xml, spp_node, ns, "addMO", str);
-	free(str);
-	snprintf(buf, sizeof(buf), "./Wi-Fi/%s/PerProviderSubscription", realm);
-	xml_node_add_attr(ctx->xml, node, ns, "managementTreeURI", buf);
-	xml_node_add_attr(ctx->xml, node, ns, "moURN", URN_HS20_PPS);
-
-	return spp_node;
-}
-
-
-static xml_node_t * hs20_spp_post_dev_data(struct hs20_svc *ctx,
-					   xml_node_t *node,
-					   const char *user,
-					   const char *realm,
-					   const char *session_id,
-					   int dmacc)
-{
-	const char *req_reason;
-	char *redirect_uri = NULL;
-	char *req_reason_buf = NULL;
-	char str[200];
-	xml_node_t *ret = NULL, *devinfo = NULL, *devdetail = NULL;
-	xml_node_t *mo, *macaddr;
-	char *version;
-	int valid;
-	char *supp, *pos;
-	char *err;
-	u8 wifi_mac_addr[ETH_ALEN];
-
-	version = xml_node_get_attr_value_ns(ctx->xml, node, SPP_NS_URI,
-					     "sppVersion");
-	if (version == NULL || strstr(version, "1.0") == NULL) {
-		ret = build_post_dev_data_response(
-			ctx, NULL, session_id, "Error occurred",
-			"SPP version not supported");
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "Unsupported sppVersion", ret);
-		xml_node_get_attr_value_free(ctx->xml, version);
-		return ret;
-	}
-	xml_node_get_attr_value_free(ctx->xml, version);
-
-	mo = get_node(ctx->xml, node, "supportedMOList");
-	if (mo == NULL) {
-		ret = build_post_dev_data_response(
-			ctx, NULL, session_id, "Error occurred",
-			"Other");
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "No supportedMOList element", ret);
-		return ret;
-	}
-	supp = xml_node_get_text(ctx->xml, mo);
-	for (pos = supp; pos && *pos; pos++)
-		*pos = tolower(*pos);
-	if (supp == NULL ||
-	    strstr(supp, URN_OMA_DM_DEVINFO) == NULL ||
-	    strstr(supp, URN_OMA_DM_DEVDETAIL) == NULL ||
-	    strstr(supp, URN_HS20_PPS) == NULL) {
-		xml_node_get_text_free(ctx->xml, supp);
-		ret = build_post_dev_data_response(
-			ctx, NULL, session_id, "Error occurred",
-			"One or more mandatory MOs not supported");
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "Unsupported MOs", ret);
-		return ret;
-	}
-	xml_node_get_text_free(ctx->xml, supp);
-
-	req_reason_buf = xml_node_get_attr_value(ctx->xml, node,
-						 "requestReason");
-	if (req_reason_buf == NULL) {
-		debug_print(ctx, 1, "No requestReason attribute");
-		return NULL;
-	}
-	req_reason = req_reason_buf;
-
-	redirect_uri = xml_node_get_attr_value(ctx->xml, node, "redirectURI");
-
-	debug_print(ctx, 1, "requestReason: %s  sessionID: %s  redirectURI: %s",
-		    req_reason, session_id, redirect_uri);
-	snprintf(str, sizeof(str), "sppPostDevData: requestReason=%s",
-		 req_reason);
-	hs20_eventlog(ctx, user, realm, session_id, str, NULL);
-
-	devinfo = spp_get_mo(ctx, node, URN_OMA_DM_DEVINFO, &valid, &err);
-	if (devinfo == NULL) {
-		ret = build_post_dev_data_response(ctx, NULL, session_id,
-						   "Error occurred", "Other");
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "No DevInfo moContainer in sppPostDevData",
-				   ret);
-		os_free(err);
-		goto out;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "Received DevInfo MO", devinfo);
-	if (valid == 0) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "OMA-DM DDF DTD validation errors in DevInfo MO",
-			      err);
-		ret = build_post_dev_data_response(ctx, NULL, session_id,
-						   "Error occurred", "Other");
-		os_free(err);
-		goto out;
-	}
-	os_free(err);
-	if (user)
-		db_update_mo(ctx, user, realm, "devinfo", devinfo);
-
-	devdetail = spp_get_mo(ctx, node, URN_OMA_DM_DEVDETAIL, &valid, &err);
-	if (devdetail == NULL) {
-		ret = build_post_dev_data_response(ctx, NULL, session_id,
-						   "Error occurred", "Other");
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "No DevDetail moContainer in sppPostDevData",
-				   ret);
-		os_free(err);
-		goto out;
-	}
-
-	hs20_eventlog_node(ctx, user, realm, session_id,
-			   "Received DevDetail MO", devdetail);
-	if (valid == 0) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "OMA-DM DDF DTD validation errors "
-			      "in DevDetail MO", err);
-		ret = build_post_dev_data_response(ctx, NULL, session_id,
-						   "Error occurred", "Other");
-		os_free(err);
-		goto out;
-	}
-	os_free(err);
-
-	os_memset(wifi_mac_addr, 0, ETH_ALEN);
-	macaddr = get_node(ctx->xml, devdetail,
-			   "Ext/org.wi-fi/Wi-Fi/Wi-FiMACAddress");
-	if (macaddr) {
-		char *addr, buf[50];
-
-		addr = xml_node_get_text(ctx->xml, macaddr);
-		if (addr && hwaddr_compact_aton(addr, wifi_mac_addr) == 0) {
-			snprintf(buf, sizeof(buf), "DevDetail MAC address: "
-				 MACSTR, MAC2STR(wifi_mac_addr));
-			hs20_eventlog(ctx, user, realm, session_id, buf, NULL);
-			xml_node_get_text_free(ctx->xml, addr);
-		} else {
-			hs20_eventlog(ctx, user, realm, session_id,
-				      "Could not extract MAC address from DevDetail",
-				      NULL);
-		}
-	} else {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "No MAC address in DevDetail", NULL);
-	}
-
-	if (user)
-		db_update_mo(ctx, user, realm, "devdetail", devdetail);
-
-	if (user)
-		mo = spp_get_mo(ctx, node, URN_HS20_PPS, &valid, &err);
-	else {
-		mo = NULL;
-		err = NULL;
-	}
-	if (user && mo) {
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "Received PPS MO", mo);
-		if (valid == 0) {
-			hs20_eventlog(ctx, user, realm, session_id,
-				      "OMA-DM DDF DTD validation errors "
-				      "in PPS MO", err);
-			xml_node_get_attr_value_free(ctx->xml, redirect_uri);
-			os_free(err);
-			return build_post_dev_data_response(
-				ctx, NULL, session_id,
-				"Error occurred", "Other");
-		}
-		db_update_mo(ctx, user, realm, "pps", mo);
-		db_update_val(ctx, user, realm, "fetch_pps", "0", dmacc);
-		xml_node_free(ctx->xml, mo);
-	}
-	os_free(err);
-
-	if (user && !mo) {
-		char *fetch;
-		int fetch_pps;
-
-		fetch = db_get_val(ctx, user, realm, "fetch_pps", dmacc);
-		fetch_pps = fetch ? atoi(fetch) : 0;
-		free(fetch);
-
-		if (fetch_pps) {
-			enum hs20_session_operation oper;
-			if (strcasecmp(req_reason, "Subscription remediation")
-			    == 0)
-				oper = CONTINUE_SUBSCRIPTION_REMEDIATION;
-			else if (strcasecmp(req_reason, "Policy update") == 0)
-				oper = CONTINUE_POLICY_UPDATE;
-			else
-				oper = NO_OPERATION;
-			if (db_add_session(ctx, user, realm, session_id, NULL,
-					   NULL, oper, NULL) < 0)
-				goto out;
-
-			ret = spp_exec_upload_mo(ctx, session_id,
-						 URN_HS20_PPS);
-			hs20_eventlog_node(ctx, user, realm, session_id,
-					   "request PPS MO upload",
-					   ret);
-			goto out;
-		}
-	}
-
-	if (user && strcasecmp(req_reason, "MO upload") == 0) {
-		char *val = db_get_session_val(ctx, user, realm, session_id,
-					       "operation");
-		enum hs20_session_operation oper;
-		if (!val) {
-			debug_print(ctx, 1, "No session %s found to continue",
-				    session_id);
-			goto out;
-		}
-		oper = atoi(val);
-		free(val);
-		if (oper == CONTINUE_SUBSCRIPTION_REMEDIATION)
-			req_reason = "Subscription remediation";
-		else if (oper == CONTINUE_POLICY_UPDATE)
-			req_reason = "Policy update";
-		else {
-			debug_print(ctx, 1,
-				    "No pending operation in session %s",
-				    session_id);
-			goto out;
-		}
-	}
-
-	if (strcasecmp(req_reason, "Subscription registration") == 0) {
-		ret = hs20_subscription_registration(ctx, realm, session_id,
-						     redirect_uri,
-						     wifi_mac_addr);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "subscription registration response",
-				   ret);
-		goto out;
-	}
-	if (user && strcasecmp(req_reason, "Subscription remediation") == 0) {
-		ret = hs20_subscription_remediation(ctx, user, realm,
-						    session_id, dmacc,
-						    redirect_uri);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "subscription remediation response",
-				   ret);
-		goto out;
-	}
-	if (user && strcasecmp(req_reason, "Policy update") == 0) {
-		ret = hs20_policy_update(ctx, user, realm, session_id, dmacc);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "policy update response",
-				   ret);
-		goto out;
-	}
-
-	if (strcasecmp(req_reason, "User input completed") == 0) {
-		db_add_session_devinfo(ctx, session_id, devinfo);
-		db_add_session_devdetail(ctx, session_id, devdetail);
-		ret = hs20_user_input_complete(ctx, user, realm, dmacc,
-					       session_id);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "user input completed response", ret);
-		goto out;
-	}
-
-	if (strcasecmp(req_reason, "Certificate enrollment completed") == 0) {
-		ret = hs20_cert_enroll_completed(ctx, user, realm, dmacc,
-						 session_id);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "certificate enrollment response", ret);
-		goto out;
-	}
-
-	if (strcasecmp(req_reason, "Certificate enrollment failed") == 0) {
-		ret = hs20_cert_enroll_failed(ctx, user, realm, dmacc,
-					      session_id);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "certificate enrollment failed response",
-				   ret);
-		goto out;
-	}
-
-	if (strcasecmp(req_reason, "Subscription provisioning") == 0) {
-		ret = hs20_sim_provisioning(ctx, user, realm, dmacc,
-					    session_id);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "subscription provisioning response",
-				   ret);
-		goto out;
-	}
-
-	debug_print(ctx, 1, "Unsupported requestReason '%s' user '%s'",
-		    req_reason, user);
-out:
-	xml_node_get_attr_value_free(ctx->xml, req_reason_buf);
-	xml_node_get_attr_value_free(ctx->xml, redirect_uri);
-	if (devinfo)
-		xml_node_free(ctx->xml, devinfo);
-	if (devdetail)
-		xml_node_free(ctx->xml, devdetail);
-	return ret;
-}
-
-
-static xml_node_t * build_spp_exchange_complete(struct hs20_svc *ctx,
-						const char *session_id,
-						const char *status,
-						const char *error_code)
-{
-	xml_namespace_t *ns;
-	xml_node_t *spp_node, *node;
-
-	spp_node = xml_node_create_root(ctx->xml, SPP_NS_URI, "spp", &ns,
-					"sppExchangeComplete");
-
-
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppVersion", "1.0");
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sessionID", session_id);
-	xml_node_add_attr(ctx->xml, spp_node, ns, "sppStatus", status);
-
-	if (error_code) {
-		node = xml_node_create(ctx->xml, spp_node, ns, "sppError");
-		xml_node_add_attr(ctx->xml, node, NULL, "errorCode",
-				  error_code);
-	}
-
-	return spp_node;
-}
-
-
-static int add_subscription(struct hs20_svc *ctx, const char *session_id)
-{
-	char *user, *realm, *pw, *pw_mm, *pps, *str;
-	char *osu_user, *osu_password, *eap_method;
-	char *policy = NULL;
-	char *sql;
-	int ret = -1;
-	char *free_account;
-	int free_acc;
-	char *type;
-	int cert = 0;
-	char *cert_pem, *fingerprint;
-	const char *method;
-
-	user = db_get_session_val(ctx, NULL, NULL, session_id, "user");
-	realm = db_get_session_val(ctx, NULL, NULL, session_id, "realm");
-	pw = db_get_session_val(ctx, NULL, NULL, session_id, "password");
-	pw_mm = db_get_session_val(ctx, NULL, NULL, session_id,
-				   "machine_managed");
-	pps = db_get_session_val(ctx, NULL, NULL, session_id, "pps");
-	cert_pem = db_get_session_val(ctx, NULL, NULL, session_id, "cert_pem");
-	fingerprint = db_get_session_val(ctx, NULL, NULL, session_id, "cert");
-	type = db_get_session_val(ctx, NULL, NULL, session_id, "type");
-	if (type && strcmp(type, "cert") == 0)
-		cert = 1;
-	free(type);
-	osu_user = db_get_session_val(ctx, NULL, NULL, session_id, "osu_user");
-	osu_password = db_get_session_val(ctx, NULL, NULL, session_id,
-					  "osu_password");
-	eap_method = db_get_session_val(ctx, NULL, NULL, session_id,
-					"eap_method");
-
-	if (!user || !realm || !pw) {
-		debug_print(ctx, 1, "Could not find session info from DB for "
-			    "the new subscription");
-		goto out;
-	}
-
-	free_account = db_get_osu_config_val(ctx, realm, "free_account");
-	free_acc = free_account && strcmp(free_account, user) == 0;
-	free(free_account);
-
-	policy = db_get_osu_config_val(ctx, realm, "sim_policy");
-
-	debug_print(ctx, 1,
-		    "New subscription: user='%s' realm='%s' free_acc=%d",
-		    user, realm, free_acc);
-	debug_print(ctx, 1, "New subscription: pps='%s'", pps);
-
-	sql = sqlite3_mprintf("UPDATE eventlog SET user=%Q, realm=%Q WHERE "
-			      "sessionid=%Q AND (user='' OR user IS NULL)",
-			      user, realm, session_id);
-	if (sql) {
-		debug_print(ctx, 1, "DB: %s", sql);
-		if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-			debug_print(ctx, 1, "Failed to update eventlog in "
-				    "sqlite database: %s",
-				    sqlite3_errmsg(ctx->db));
-		}
-		sqlite3_free(sql);
-	}
-
-	if (free_acc) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "completed shared free account registration",
-			      NULL);
-		ret = 0;
-		goto out;
-	}
-
-	str = db_get_session_val(ctx, NULL, NULL, session_id, "mac_addr");
-
-	if (eap_method && eap_method[0])
-		method = eap_method;
-	else
-		method = cert ? "TLS" : "TTLS-MSCHAPV2";
-	sql = sqlite3_mprintf("INSERT INTO users(identity,realm,phase2,methods,cert,cert_pem,machine_managed,mac_addr,osu_user,osu_password,policy) VALUES (%Q,%Q,%d,%Q,%Q,%Q,%d,%Q,%Q,%Q,%Q)",
-			      user, realm, cert ? 0 : 1,
-			      method,
-			      fingerprint ? fingerprint : "",
-			      cert_pem ? cert_pem : "",
-			      pw_mm && atoi(pw_mm) ? 1 : 0,
-			      str ? str : "",
-			      osu_user ? osu_user : "",
-			      osu_password ? osu_password : "",
-			      policy ? policy : "");
-	free(str);
-	if (sql == NULL)
-		goto out;
-	debug_print(ctx, 1, "DB: %s", sql);
-	if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) != SQLITE_OK) {
-		debug_print(ctx, 1, "Failed to add user in sqlite database: %s",
-			    sqlite3_errmsg(ctx->db));
-		sqlite3_free(sql);
-		goto out;
-	}
-	sqlite3_free(sql);
-
-	if (cert)
-		ret = 0;
-	else
-		ret = update_password(ctx, user, realm, pw, 0);
-	if (ret < 0) {
-		sql = sqlite3_mprintf("DELETE FROM users WHERE identity=%Q AND realm=%Q AND (phase2=1 OR methods='TLS')",
-				      user, realm);
-		if (sql) {
-			debug_print(ctx, 1, "DB: %s", sql);
-			sqlite3_exec(ctx->db, sql, NULL, NULL, NULL);
-			sqlite3_free(sql);
-		}
-	}
-
-	if (pps)
-		db_update_mo_str(ctx, user, realm, "pps", pps);
-
-	str = db_get_session_val(ctx, NULL, NULL, session_id, "devinfo");
-	if (str) {
-		db_update_mo_str(ctx, user, realm, "devinfo", str);
-		free(str);
-	}
-
-	str = db_get_session_val(ctx, NULL, NULL, session_id, "devdetail");
-	if (str) {
-		db_update_mo_str(ctx, user, realm, "devdetail", str);
-		free(str);
-	}
-
-	if (cert && user) {
-		const char *serialnum;
-
-		str = db_get_session_val(ctx, NULL, NULL, session_id,
-					 "mac_addr");
-
-		if (os_strncmp(user, "cert-", 5) == 0)
-			serialnum = user + 5;
-		else
-			serialnum = "";
-		sql = sqlite3_mprintf("INSERT OR REPLACE INTO cert_enroll (mac_addr,user,realm,serialnum) VALUES(%Q,%Q,%Q,%Q)",
-				      str ? str : "", user, realm ? realm : "",
-				      serialnum);
-		free(str);
-		if (sql) {
-			debug_print(ctx, 1, "DB: %s", sql);
-			if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) !=
-			    SQLITE_OK) {
-				debug_print(ctx, 1,
-					    "Failed to add cert_enroll entry into sqlite database: %s",
-					    sqlite3_errmsg(ctx->db));
-			}
-			sqlite3_free(sql);
-		}
-	}
-
-	str = db_get_session_val(ctx, NULL, NULL, session_id,
-				 "mobile_identifier_hash");
-	if (str) {
-		sql = sqlite3_mprintf("DELETE FROM sim_provisioning WHERE mobile_identifier_hash=%Q",
-				      str);
-		if (sql) {
-			debug_print(ctx, 1, "DB: %s", sql);
-			if (sqlite3_exec(ctx->db, sql, NULL, NULL, NULL) !=
-			    SQLITE_OK) {
-				debug_print(ctx, 1,
-					    "Failed to delete pending sim_provisioning entry: %s",
-					    sqlite3_errmsg(ctx->db));
-			}
-			sqlite3_free(sql);
-		}
-		os_free(str);
-	}
-
-	if (ret == 0) {
-		hs20_eventlog(ctx, user, realm, session_id,
-			      "completed subscription registration", NULL);
-	}
-
-out:
-	free(user);
-	free(realm);
-	free(pw);
-	free(pw_mm);
-	free(pps);
-	free(cert_pem);
-	free(fingerprint);
-	free(osu_user);
-	free(osu_password);
-	free(eap_method);
-	os_free(policy);
-	return ret;
-}
-
-
-static xml_node_t * hs20_spp_update_response(struct hs20_svc *ctx,
-					     xml_node_t *node,
-					     const char *user,
-					     const char *realm,
-					     const char *session_id,
-					     int dmacc)
-{
-	char *status;
-	xml_node_t *ret;
-	char *val;
-	enum hs20_session_operation oper;
-
-	status = xml_node_get_attr_value_ns(ctx->xml, node, SPP_NS_URI,
-					    "sppStatus");
-	if (status == NULL) {
-		debug_print(ctx, 1, "No sppStatus attribute");
-		return NULL;
-	}
-
-	debug_print(ctx, 1, "sppUpdateResponse: sppStatus: %s  sessionID: %s",
-		    status, session_id);
-
-	val = db_get_session_val(ctx, NULL, NULL, session_id, "operation");
-	if (!val) {
-		debug_print(ctx, 1,
-			    "No session active for sessionID: %s",
-			    session_id);
-		oper = NO_OPERATION;
-	} else
-		oper = atoi(val);
-
-	if (strcasecmp(status, "OK") == 0) {
-		char *new_pw = NULL;
-
-		xml_node_get_attr_value_free(ctx->xml, status);
-
-		if (oper == USER_REMEDIATION) {
-			new_pw = db_get_session_val(ctx, user, realm,
-						    session_id, "password");
-			if (new_pw == NULL || strlen(new_pw) == 0) {
-				free(new_pw);
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id, "No password "
-						   "had been assigned for "
-						   "session", ret);
-				db_remove_session(ctx, user, realm, session_id);
-				return ret;
-			}
-			oper = UPDATE_PASSWORD;
-		}
-		if (oper == UPDATE_PASSWORD) {
-			if (!new_pw) {
-				new_pw = db_get_session_val(ctx, user, realm,
-							    session_id,
-							    "password");
-				if (!new_pw) {
-					db_remove_session(ctx, user, realm,
-							  session_id);
-					return NULL;
-				}
-			}
-			debug_print(ctx, 1, "Update user '%s' password in DB",
-				    user);
-			if (update_password(ctx, user, realm, new_pw, dmacc) <
-			    0) {
-				debug_print(ctx, 1, "Failed to update user "
-					    "'%s' password in DB", user);
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id, "Failed to "
-						   "update database", ret);
-				db_remove_session(ctx, user, realm, session_id);
-				return ret;
-			}
-			hs20_eventlog(ctx, user, realm,
-				      session_id, "Updated user password "
-				      "in database", NULL);
-		}
-		if (oper == CLEAR_REMEDIATION) {
-			debug_print(ctx, 1,
-				    "Clear remediation requirement for user '%s' in DB",
-				    user);
-			if (clear_remediation(ctx, user, realm, dmacc) < 0) {
-				debug_print(ctx, 1,
-					    "Failed to clear remediation requirement for user '%s' in DB",
-					    user);
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id,
-						   "Failed to update database",
-						   ret);
-				db_remove_session(ctx, user, realm, session_id);
-				return ret;
-			}
-			hs20_eventlog(ctx, user, realm,
-				      session_id,
-				      "Cleared remediation requirement in database",
-				      NULL);
-		}
-		if (oper == SUBSCRIPTION_REGISTRATION) {
-			if (add_subscription(ctx, session_id) < 0) {
-				debug_print(ctx, 1, "Failed to add "
-					    "subscription into DB");
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id, "Failed to "
-						   "update database", ret);
-				db_remove_session(ctx, user, realm, session_id);
-				return ret;
-			}
-		}
-		if (oper == POLICY_REMEDIATION || oper == POLICY_UPDATE) {
-			char *val;
-			val = db_get_val(ctx, user, realm, "remediation",
-					 dmacc);
-			if (val && strcmp(val, "policy") == 0)
-				db_update_val(ctx, user, realm, "remediation",
-					      "", dmacc);
-			free(val);
-		}
-		if (oper == POLICY_UPDATE)
-			db_update_val(ctx, user, realm, "polupd_done", "1",
-				      dmacc);
-		if (oper == CERT_REENROLL) {
-			char *new_user;
-			char event[200];
-
-			new_user = db_get_session_val(ctx, NULL, NULL,
-						      session_id, "user");
-			if (!new_user) {
-				debug_print(ctx, 1,
-					    "Failed to find new user name (cert-serialnum)");
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id,
-						   "Failed to find new user name (cert reenroll)",
-						   ret);
-				db_remove_session(ctx, NULL, NULL, session_id);
-				return ret;
-			}
-
-			debug_print(ctx, 1,
-				    "Update certificate user entry to use the new serial number (old=%s new=%s)",
-				    user, new_user);
-			os_snprintf(event, sizeof(event), "renamed user to: %s",
-				    new_user);
-			hs20_eventlog(ctx, user, realm, session_id, event,
-				      NULL);
-
-			if (db_update_val(ctx, user, realm, "identity",
-					  new_user, 0) < 0 ||
-			    db_update_val(ctx, new_user, realm, "remediation",
-					  "", 0) < 0) {
-				debug_print(ctx, 1,
-					    "Failed to update user name (cert-serialnum)");
-				ret = build_spp_exchange_complete(
-					ctx, session_id, "Error occurred",
-					"Other");
-				hs20_eventlog_node(ctx, user, realm,
-						   session_id,
-						   "Failed to update user name (cert reenroll)",
-						   ret);
-				db_remove_session(ctx, NULL, NULL, session_id);
-				os_free(new_user);
-				return ret;
-			}
-
-			os_free(new_user);
-		}
-		ret = build_spp_exchange_complete(
-			ctx, session_id,
-			"Exchange complete, release TLS connection", NULL);
-		hs20_eventlog_node(ctx, user, realm, session_id,
-				   "Exchange completed", ret);
-		db_remove_session(ctx, NULL, NULL, session_id);
-		return ret;
-	}
-
-	ret = build_spp_exchange_complete(ctx, session_id, "Error occurred",
-					  "Other");
-	hs20_eventlog_node(ctx, user, realm, session_id, "Error occurred", ret);
-	db_remove_session(ctx, user, realm, session_id);
-	xml_node_get_attr_value_free(ctx->xml, status);
-	return ret;
-}
-
-
-#define SPP_SESSION_ID_LEN 16
-
-static char * gen_spp_session_id(void)
-{
-	FILE *f;
-	int i;
-	char *session;
-
-	session = os_malloc(SPP_SESSION_ID_LEN * 2 + 1);
-	if (session == NULL)
-		return NULL;
-
-	f = fopen("/dev/urandom", "r");
-	if (f == NULL) {
-		os_free(session);
-		return NULL;
-	}
-	for (i = 0; i < SPP_SESSION_ID_LEN; i++)
-		os_snprintf(session + i * 2, 3, "%02x", fgetc(f));
-
-	fclose(f);
-	return session;
-}
-
-xml_node_t * hs20_spp_server_process(struct hs20_svc *ctx, xml_node_t *node,
-				     const char *auth_user,
-				     const char *auth_realm, int dmacc)
-{
-	xml_node_t *ret = NULL;
-	char *session_id;
-	const char *op_name;
-	char *xml_err;
-	char fname[200];
-
-	debug_dump_node(ctx, "received request", node);
-
-	if (!dmacc && auth_user && auth_realm) {
-		char *real;
-		real = db_get_val(ctx, auth_user, auth_realm, "identity", 0);
-		if (!real) {
-			real = db_get_val(ctx, auth_user, auth_realm,
-					  "identity", 1);
-			if (real)
-				dmacc = 1;
-		}
-		os_free(real);
-	}
-
-	snprintf(fname, sizeof(fname), "%s/spp/spp.xsd", ctx->root_dir);
-	if (xml_validate(ctx->xml, node, fname, &xml_err) < 0) {
-		/*
-		 * We may not be able to extract the sessionID from invalid
-		 * input, but well, we can try.
-		 */
-		session_id = xml_node_get_attr_value_ns(ctx->xml, node,
-							SPP_NS_URI,
-							"sessionID");
-		debug_print(ctx, 1,
-			    "SPP message failed validation, xsd file: %s  xml-error: %s",
-			    fname, xml_err);
-		hs20_eventlog_node(ctx, auth_user, auth_realm, session_id,
-				   "SPP message failed validation", node);
-		hs20_eventlog(ctx, auth_user, auth_realm, session_id,
-			      "Validation errors", xml_err);
-		os_free(xml_err);
-		xml_node_get_attr_value_free(ctx->xml, session_id);
-		/* TODO: what to return here? */
-		ret = xml_node_create_root(ctx->xml, NULL, NULL, NULL,
-					   "SppValidationError");
-		return ret;
-	}
-
-	session_id = xml_node_get_attr_value_ns(ctx->xml, node, SPP_NS_URI,
-						"sessionID");
-	if (session_id) {
-		char *tmp;
-		debug_print(ctx, 1, "Received sessionID %s", session_id);
-		tmp = os_strdup(session_id);
-		xml_node_get_attr_value_free(ctx->xml, session_id);
-		if (tmp == NULL)
-			return NULL;
-		session_id = tmp;
-	} else {
-		session_id = gen_spp_session_id();
-		if (session_id == NULL) {
-			debug_print(ctx, 1, "Failed to generate sessionID");
-			return NULL;
-		}
-		debug_print(ctx, 1, "Generated sessionID %s", session_id);
-	}
-
-	op_name = xml_node_get_localname(ctx->xml, node);
-	if (op_name == NULL) {
-		debug_print(ctx, 1, "Could not get op_name");
-		return NULL;
-	}
-
-	if (strcmp(op_name, "sppPostDevData") == 0) {
-		hs20_eventlog_node(ctx, auth_user, auth_realm, session_id,
-				   "sppPostDevData received and validated",
-				   node);
-		ret = hs20_spp_post_dev_data(ctx, node, auth_user, auth_realm,
-					     session_id, dmacc);
-	} else if (strcmp(op_name, "sppUpdateResponse") == 0) {
-		hs20_eventlog_node(ctx, auth_user, auth_realm, session_id,
-				   "sppUpdateResponse received and validated",
-				   node);
-		ret = hs20_spp_update_response(ctx, node, auth_user,
-					       auth_realm, session_id, dmacc);
-	} else {
-		hs20_eventlog_node(ctx, auth_user, auth_realm, session_id,
-				   "Unsupported SPP message received and "
-				   "validated", node);
-		debug_print(ctx, 1, "Unsupported operation '%s'", op_name);
-		/* TODO: what to return here? */
-		ret = xml_node_create_root(ctx->xml, NULL, NULL, NULL,
-					   "SppUnknownCommandError");
-	}
-	os_free(session_id);
-
-	if (ret == NULL) {
-		/* TODO: what to return here? */
-		ret = xml_node_create_root(ctx->xml, NULL, NULL, NULL,
-					   "SppInternalError");
-	}
-
-	return ret;
-}
-
-
-int hs20_spp_server_init(struct hs20_svc *ctx)
-{
-	char fname[200];
-	ctx->db = NULL;
-	snprintf(fname, sizeof(fname), "%s/AS/DB/eap_user.db", ctx->root_dir);
-	if (sqlite3_open(fname, &ctx->db)) {
-		printf("Failed to open sqlite database: %s\n",
-		       sqlite3_errmsg(ctx->db));
-		sqlite3_close(ctx->db);
-		return -1;
-	}
-
-	return 0;
-}
-
-
-void hs20_spp_server_deinit(struct hs20_svc *ctx)
-{
-	sqlite3_close(ctx->db);
-	ctx->db = NULL;
-}
diff --git a/hs20/server/spp_server.h b/hs20/server/spp_server.h
deleted file mode 100644
index 421974c..0000000
--- a/hs20/server/spp_server.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Hotspot 2.0 SPP server
- * Copyright (c) 2012-2013, Qualcomm Atheros, Inc.
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#ifndef SPP_SERVER_H
-#define SPP_SERVER_H
-
-struct hs20_svc {
-	const void *ctx;
-	struct xml_node_ctx *xml;
-	char *root_dir;
-	FILE *debug_log;
-	sqlite3 *db;
-	const char *addr;
-	const char *test;
-	const char *imsi;
-	const char *eap_method;
-	const char *id_hash;
-};
-
-
-void debug_print(struct hs20_svc *ctx, int print, const char *fmt, ...)
-	__attribute__ ((format (printf, 3, 4)));
-void debug_dump_node(struct hs20_svc *ctx, const char *title, xml_node_t *node);
-
-xml_node_t * hs20_spp_server_process(struct hs20_svc *ctx, xml_node_t *node,
-				     const char *auth_user,
-				     const char *auth_realm, int dmacc);
-int hs20_spp_server_init(struct hs20_svc *ctx);
-void hs20_spp_server_deinit(struct hs20_svc *ctx);
-
-#endif /* SPP_SERVER_H */
diff --git a/hs20/server/sql-example.txt b/hs20/server/sql-example.txt
deleted file mode 100644
index 20dcf2f..0000000
--- a/hs20/server/sql-example.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','fqdn','example.com');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','friendly_name','Example Operator');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','spp_http_auth_url','https://subscription-server.osu.example.com/hs20/spp.php?realm=example.com');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','trust_root_cert_url','https://osu-server.osu.example.com/hs20/files/spp-root-ca.der');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','trust_root_cert_fingerprint','5b393a9246865569485c2605c3304e48212b449367858299beba9384c4cf4647');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','aaa_trust_root_cert_url','https://osu-server.osu.example.com/hs20/files/aaa-root-ca.der');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','aaa_trust_root_cert_fingerprint','5b393a9246865569485c2605c3304e48212b449367858299beba9384c4cf4647');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','free_account','free');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','policy_url','https://subscription-server.osu.example.com/hs20/spp.php?realm=example.com');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','remediation_url','https://subscription-server.osu.example.com/hs20/remediation.php?session_id=');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','free_remediation_url','https://subscription-server.osu.example.com/hs20/free-remediation.php?session_id=');
-INSERT INTO osu_config(realm,field,value) VALUES('example.com','signup_url','https://subscription-server.osu.example.com/hs20/signup.php?session_id=');
-
-
-INSERT INTO users(identity,realm,methods,password,phase2,shared) VALUES('free','example.com','TTLS-MSCHAPV2','free',1,1);
-
-INSERT INTO wildcards(identity,methods) VALUES('','TTLS,TLS');
diff --git a/hs20/server/sql.txt b/hs20/server/sql.txt
deleted file mode 100644
index 2cc6ede..0000000
--- a/hs20/server/sql.txt
+++ /dev/null
@@ -1,108 +0,0 @@
-CREATE TABLE eventlog(
-	user TEXT,
-	realm TEXT,
-	sessionid TEXT COLLATE NOCASE,
-	timestamp TEXT,
-	notes TEXT,
-	dump TEXT,
-	addr TEXT
-);
-
-CREATE TABLE sessions(
-	timestamp TEXT,
-	id TEXT COLLATE NOCASE,
-	user TEXT,
-	realm TEXT,
-	password TEXT,
-	machine_managed BOOLEAN,
-	operation INTEGER,
-	type TEXT,
-	pps TEXT,
-	redirect_uri TEXT,
-	devinfo TEXT,
-	devdetail TEXT,
-	cert TEXT,
-	cert_pem TEXT,
-	mac_addr TEXT,
-	osu_user TEXT,
-	osu_password TEXT,
-	eap_method TEXT,
-	mobile_identifier_hash TEXT,
-	test TEXT
-);
-
-CREATE index sessions_id_index ON sessions(id);
-
-CREATE TABLE osu_config(
-       realm TEXT,
-       field TEXT,
-       value TEXT
-);
-
-CREATE TABLE users(
-	identity TEXT PRIMARY KEY,
-	methods TEXT,
-	password TEXT,
-	machine_managed BOOLEAN,
-	remediation TEXT,
-	phase2 INTEGER,
-	realm TEXT,
-	policy TEXT,
-	devinfo TEXT,
-	devdetail TEXT,
-	pps TEXT,
-	fetch_pps INTEGER,
-	osu_user TEXT,
-	osu_password TEXT,
-	shared INTEGER,
-	cert TEXT,
-	cert_pem TEXT,
-	t_c_timestamp INTEGER,
-	mac_addr TEXT,
-	last_msk TEXT,
-	polupd_done TEXT,
-	subrem TEXT
-);
-
-CREATE TABLE wildcards(
-	identity TEXT PRIMARY KEY,
-	methods TEXT
-);
-
-CREATE TABLE authlog(
-	timestamp TEXT,
-	session TEXT,
-	nas_ip TEXT,
-	username TEXT,
-	note TEXT
-);
-
-CREATE TABLE pending_tc(
-	mac_addr TEXT PRIMARY KEY,
-	identity TEXT
-);
-
-CREATE TABLE current_sessions(
-	mac_addr TEXT PRIMARY KEY,
-	identity TEXT,
-	start_time TEXT,
-	nas TEXT,
-	hs20_t_c_filtering BOOLEAN,
-	waiting_coa_ack BOOLEAN,
-	coa_ack_received BOOLEAN
-);
-
-CREATE TABLE cert_enroll(
-	mac_addr TEXT PRIMARY KEY,
-	user TEXT,
-	realm TEXT,
-	serialnum TEXT
-);
-
-CREATE TABLE sim_provisioning(
-	mobile_identifier_hash TEXT PRIMARY KEY,
-	imsi TEXT,
-	mac_addr TEXT,
-	eap_method TEXT,
-	timestamp TEXT
-);
diff --git a/hs20/server/www/add-free.php b/hs20/server/www/add-free.php
deleted file mode 100644
index 1efc655..0000000
--- a/hs20/server/www/add-free.php
+++ /dev/null
@@ -1,50 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_POST["id"]))
-  $id = preg_replace("/[^a-fA-F0-9]/", "", $_POST["id"]);
-else
-  die("Missing session id");
-if (strlen($id) < 32)
-  die("Invalid session id");
-
-$row = $db->query("SELECT rowid,* FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-
-$uri = $row['redirect_uri'];
-$rowid = $row['rowid'];
-$realm = $row['realm'];
-
-$row = $db->query("SELECT value FROM osu_config WHERE realm='$realm' AND field='free_account'")->fetch();
-if (!$row || strlen($row['value']) == 0) {
-  die("Free account disabled");
-}
-
-$user = $row['value'];
-
-$row = $db->query("SELECT password FROM users WHERE identity='$user' AND realm='$realm'")->fetch();
-if (!$row)
-  die("Free account not found");
-
-$pw = $row['password'];
-
-if (!$db->exec("UPDATE sessions SET user='$user', password='$pw', realm='$realm', machine_managed='1' WHERE rowid=$rowid")) {
-  die("Failed to update session database");
-}
-
-$db->exec("INSERT INTO eventlog(user,realm,sessionid,timestamp,notes) " .
-	"VALUES ('$user', '$realm', '$id', " .
-	"strftime('%Y-%m-%d %H:%M:%f','now'), " .
-	"'completed user input response for a new PPS MO')");
-
-header("Location: $uri", true, 302);
-
-?>
diff --git a/hs20/server/www/add-mo.php b/hs20/server/www/add-mo.php
deleted file mode 100644
index a3b4513..0000000
--- a/hs20/server/www/add-mo.php
+++ /dev/null
@@ -1,56 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_POST["id"]))
-  $id = preg_replace("/[^a-fA-F0-9]/", "", $_POST["id"]);
-else
-  die("Missing session id");
-
-$user = $_POST["user"];
-$pw = $_POST["password"];
-if (strlen($id) < 32 || !isset($user) || !isset($pw)) {
-  die("Invalid POST data");
-}
-
-if (strlen($user) < 1 || strncasecmp($user, "cert-", 5) == 0) {
-  echo "<html><body><p><red>Invalid username</red></p>\n";
-  echo "<a href=\"signup.php?session_id=$id\">Try again</a>\n";
-  echo "</body></html>\n";
-  exit;
-}
-
-$row = $db->query("SELECT rowid,* FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-$realm = $row['realm'];
-
-$userrow = $db->query("SELECT identity FROM users WHERE identity='$user' AND realm='$realm'")->fetch();
-if ($userrow) {
-  echo "<html><body><p><red>Selected username is not available</red></p>\n";
-  echo "<a href=\"signup.php?session_id=$id\">Try again</a>\n";
-  echo "</body></html>\n";
-  exit;
-}
-
-$uri = $row['redirect_uri'];
-$rowid = $row['rowid'];
-
-if (!$db->exec("UPDATE sessions SET user='$user', password='$pw', realm='$realm', type='password' WHERE rowid=$rowid")) {
-  die("Failed to update session database");
-}
-
-$db->exec("INSERT INTO eventlog(user,realm,sessionid,timestamp,notes) " .
-	"VALUES ('$user', '$realm', '$id', " .
-	"strftime('%Y-%m-%d %H:%M:%f','now'), " .
-	"'completed user input response for a new PPS MO')");
-
-header("Location: $uri", true, 302);
-
-?>
diff --git a/hs20/server/www/cert-enroll.php b/hs20/server/www/cert-enroll.php
deleted file mode 100644
index f023ca5..0000000
--- a/hs20/server/www/cert-enroll.php
+++ /dev/null
@@ -1,39 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_GET["id"]))
-  $id = preg_replace("/[^a-fA-F0-9]/", "", $_GET["id"]);
-else
-  die("Missing session id");
-if (strlen($id) < 32)
-  die("Invalid session id");
-
-$row = $db->query("SELECT rowid,* FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-
-$uri = $row['redirect_uri'];
-$rowid = $row['rowid'];
-$realm = $row['realm'];
-
-$user = sha1(mt_rand());
-
-if (!$db->exec("UPDATE sessions SET user='$user', type='cert' WHERE rowid=$rowid")) {
-  die("Failed to update session database");
-}
-
-$db->exec("INSERT INTO eventlog(user,realm,sessionid,timestamp,notes) " .
-	"VALUES ('', '$realm', '$id', " .
-	"strftime('%Y-%m-%d %H:%M:%f','now'), " .
-	"'completed user input response for client certificate enrollment')");
-
-header("Location: $uri", true, 302);
-
-?>
diff --git a/hs20/server/www/config.php b/hs20/server/www/config.php
deleted file mode 100644
index 4272b10..0000000
--- a/hs20/server/www/config.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php
-$osu_root = "/home/user/hs20-server";
-$osu_db = "sqlite:$osu_root/AS/DB/eap_user.db";
-$t_c_file = "$osu_root/terms-and-conditions";
-$t_c_timestamp = 123456789;
-$hostapd_ctrl = "udg:///home/user/hs20-server/AS/ctrl/as"
-?>
diff --git a/hs20/server/www/est.php b/hs20/server/www/est.php
deleted file mode 100644
index b7fb260..0000000
--- a/hs20/server/www/est.php
+++ /dev/null
@@ -1,232 +0,0 @@
-<?php
-
-require('config.php');
-
-$params = explode("/", $_SERVER["PATH_INFO"], 3);
-$realm = $params[1];
-$cmd = $params[2];
-$method = $_SERVER["REQUEST_METHOD"];
-
-unset($user);
-unset($rowid);
-
-$db = new PDO($osu_db);
-if (!$db) {
-  error_log("EST: Could not access database");
-  die("Could not access database");
-}
-
-if (!empty($_SERVER['PHP_AUTH_DIGEST'])) {
-  $needed = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1,
-		  'uri'=>1, 'response'=>1);
-  $data = array();
-  $keys = implode('|', array_keys($needed));
-  preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@',
-		 $_SERVER['PHP_AUTH_DIGEST'], $matches, PREG_SET_ORDER);
-  foreach ($matches as $m) {
-    $data[$m[1]] = $m[3] ? $m[3] : $m[4];
-    unset($needed[$m[1]]);
-  }
-  if ($needed) {
-    error_log("EST: Missing auth parameter");
-    die('Authentication failed');
-  }
-  $user = $data['username'];
-  if (strlen($user) < 1) {
-    error_log("EST: Empty username");
-    die('Authentication failed');
-  }
-
-  $sql = "SELECT rowid,password,operation FROM sessions " .
-    "WHERE user='$user' AND realm='$realm'";
-  $q = $db->query($sql);
-  if (!$q) {
-    error_log("EST: Session not found for user=$user realm=$realm");
-    die("Session not found");
-  }
-  $row = $q->fetch();
-  if (!$row) {
-    error_log("EST: Session fetch failed for user=$user realm=$realm");
-    die('Session not found');
-  }
-  $rowid = $row['rowid'];
-
-  $oper = $row['operation'];
-  if ($oper != '5') {
-    error_log("EST: Unexpected operation $oper for user=$user realm=$realm");
-    die("Session not found");
-  }
-  $pw = $row['password'];
-  if (strlen($pw) < 1) {
-    error_log("EST: Empty password for user=$user realm=$realm");
-    die('Authentication failed');
-  }
-
-  $A1 = md5($user . ':' . $realm . ':' . $pw);
-  $A2 = md5($method . ':' . $data['uri']);
-  $resp = md5($A1 . ':' . $data['nonce'] . ':' . $data['nc'] . ':' .
-	      $data['cnonce'] . ':' . $data['qop'] . ':' . $A2);
-  if ($data['response'] != $resp) {
-    error_log("EST: Incorrect authentication response for user=$user realm=$realm");
-    die('Authentication failed');
-  }
-} else if (isset($_SERVER["SSL_CLIENT_VERIFY"]) &&
-	   $_SERVER["SSL_CLIENT_VERIFY"] == "SUCCESS" &&
-	   isset($_SERVER["SSL_CLIENT_M_SERIAL"])) {
-  $user = "cert-" . $_SERVER["SSL_CLIENT_M_SERIAL"];
-  $sql = "SELECT rowid,password,operation FROM sessions " .
-    "WHERE user='$user' AND realm='$realm'";
-  $q = $db->query($sql);
-  if (!$q) {
-    error_log("EST: Session not found for user=$user realm=$realm");
-    die("Session not found");
-  }
-  $row = $q->fetch();
-  if (!$row) {
-    error_log("EST: Session fetch failed for user=$user realm=$realm");
-    die('Session not found');
-  }
-  $rowid = $row['rowid'];
-
-  $oper = $row['operation'];
-  if ($oper != '10') {
-    error_log("EST: Unexpected operation $oper for user=$user realm=$realm");
-    die("Session not found");
-  }
-}
-
-
-if ($method == "GET" && $cmd == "cacerts") {
-  $fname = "$osu_root/est/$realm-cacerts.pkcs7";
-  if (!file_exists($fname)) {
-    error_log("EST: cacerts - unknown realm $realm");
-    die("Unknown realm");
-  }
-
-  header("Content-Transfer-Encoding: base64");
-  header("Content-Type: application/pkcs7-mime");
-
-  $data = file_get_contents($fname);
-  echo wordwrap(base64_encode($data), 72, "\n", true);
-  echo "\n";
-  error_log("EST: cacerts");
-} else if ($method == "GET" && $cmd == "csrattrs") {
-  header("Content-Transfer-Encoding: base64");
-  header("Content-Type: application/csrattrs");
-  readfile("$osu_root/est/est-attrs.b64");
-  error_log("EST: csrattrs");
-} else if ($method == "POST" &&
-           ($cmd == "simpleenroll" || $cmd == "simplereenroll")) {
-  $reenroll = $cmd == "simplereenroll";
-  if (!$reenroll && (!isset($user) || strlen($user) == 0)) {
-    header('HTTP/1.1 401 Unauthorized');
-    header('WWW-Authenticate: Digest realm="'.$realm.
-	   '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
-    error_log("EST: simpleenroll - require authentication");
-    die('Authentication required');
-  }
-  if ($reenroll &&
-      (!isset($user) ||
-       !isset($_SERVER["SSL_CLIENT_VERIFY"]) ||
-       $_SERVER["SSL_CLIENT_VERIFY"] != "SUCCESS")) {
-    header('HTTP/1.1 403 Forbidden');
-    error_log("EST: simplereenroll - require certificate authentication");
-    die('Authentication required');
-  }
-  if (!isset($_SERVER["CONTENT_TYPE"])) {
-    error_log("EST: simpleenroll without Content-Type");
-    die("Missing Content-Type");
-  }
-  if (!stristr($_SERVER["CONTENT_TYPE"], "application/pkcs10")) {
-    error_log("EST: simpleenroll - unexpected Content-Type: " .
-	      $_SERVER["CONTENT_TYPE"]);
-    die("Unexpected Content-Type");
-  }
-
-  $data = file_get_contents("php://input");
-  error_log("EST: simpleenroll - POST data from php://input: " . $data);
-  $req = base64_decode($data);
-  if ($req == FALSE) {
-    error_log("EST: simpleenroll - Invalid base64-encoded PKCS#10 data");
-    die("Invalid base64-encoded PKCS#10 data");
-  }
-  $cadir = "$osu_root/est";
-  $reqfile = "$cadir/tmp/cert-req.pkcs10";
-  $f = fopen($reqfile, "wb");
-  fwrite($f, $req);
-  fclose($f);
-
-  $req_pem = "$reqfile.pem";
-  if (file_exists($req_pem))
-    unlink($req_pem);
-  exec("openssl req -in $reqfile -inform DER -out $req_pem -outform PEM");
-  if (!file_exists($req_pem)) {
-    error_log("EST: simpleenroll - Failed to parse certificate request");
-    die("Failed to parse certificate request");
-  }
-
-  /* FIX: validate request and add HS 2.0 extensions to cert */
-  $cert_pem = "$cadir/tmp/req-signed.pem";
-  if (file_exists($cert_pem))
-    unlink($cert_pem);
-  exec("openssl x509 -req -in $req_pem -CAkey $cadir/cakey.pem -out $cert_pem -CA $cadir/cacert.pem -CAserial $cadir/serial -days 365 -text");
-  if (!file_exists($cert_pem)) {
-    error_log("EST: simpleenroll - Failed to sign certificate");
-    die("Failed to sign certificate");
-  }
-
-  $cert = file_get_contents($cert_pem);
-  $handle = popen("openssl x509 -in $cert_pem -serial -noout", "r");
-  $serial = fread($handle, 200);
-  pclose($handle);
-  $pattern = "/serial=(?P<snhex>[0-9a-fA-F:]*)/m";
-  preg_match($pattern, $serial, $matches);
-  if (!isset($matches['snhex']) || strlen($matches['snhex']) < 1) {
-    error_log("EST: simpleenroll - Could not get serial number");
-    die("Could not get serial number");
-  }
-  $sn = str_replace(":", "", strtoupper($matches['snhex']));
-
-  $user = "cert-$sn";
-  error_log("EST: user = $user");
-
-  $cert_der = "$cadir/tmp/req-signed.der";
-  if (file_exists($cert_der))
-    unlink($cert_der);
-  exec("openssl x509 -in $cert_pem -inform PEM -out $cert_der -outform DER");
-  if (!file_exists($cert_der)) {
-    error_log("EST: simpleenroll - Failed to convert certificate");
-    die("Failed to convert certificate");
-  }
-  $der = file_get_contents($cert_der);
-  $fingerprint = hash("sha256", $der);
-  error_log("EST: sha256(DER cert): $fingerprint");
-
-  $pkcs7 = "$cadir/tmp/est-client.pkcs7";
-  if (file_exists($pkcs7))
-    unlink($pkcs7);
-  exec("openssl crl2pkcs7 -nocrl -certfile $cert_pem -out $pkcs7 -outform DER");
-  if (!file_exists($pkcs7)) {
-    error_log("EST: simpleenroll - Failed to prepare PKCS#7 file");
-    die("Failed to prepare PKCS#7 file");
-  }
-
-  if (!$db->exec("UPDATE sessions SET user='$user', cert='$fingerprint', cert_pem='$cert' WHERE rowid=$rowid")) {
-    error_log("EST: simpleenroll - Failed to update session database");
-    die("Failed to update session database");
-  }
-
-  header("Content-Transfer-Encoding: base64");
-  header("Content-Type: application/pkcs7-mime");
-
-  $data = file_get_contents($pkcs7);
-  $resp = wordwrap(base64_encode($data), 72, "\n", true);
-  echo $resp . "\n";
-  error_log("EST: simpleenroll - PKCS#7 response: " . $resp);
-} else {
-  header("HTTP/1.0 404 Not Found");
-  error_log("EST: Unexpected method or path");
-  die("Unexpected method or path");
-}
-
-?>
diff --git a/hs20/server/www/free-remediation.php b/hs20/server/www/free-remediation.php
deleted file mode 100644
index 5648b30..0000000
--- a/hs20/server/www/free-remediation.php
+++ /dev/null
@@ -1,19 +0,0 @@
-<html>
-<head>
-<title>Hotspot 2.0 - public and free hotspot - remediation</title>
-</head>
-<body>
-
-<h3>Hotspot 2.0 - public and free hotspot</h3>
-
-<p>Terms and conditions have changed. You need to accept the new terms
-to continue using this network.</p>
-
-<p>Terms and conditions..</p>
-
-<?php
-echo "<a href=\"redirect.php?id=" . $_GET["session_id"] . "\">Accept</a><br>\n";
-?>
-
-</body>
-</html>
diff --git a/hs20/server/www/free.php b/hs20/server/www/free.php
deleted file mode 100644
index 8195069..0000000
--- a/hs20/server/www/free.php
+++ /dev/null
@@ -1,23 +0,0 @@
-<html>
-<head>
-<title>Hotspot 2.0 - public and free hotspot</title>
-</head>
-<body>
-
-<?php
-
-$id = $_GET["session_id"];
-
-echo "<h3>Hotspot 2.0 - public and free hotspot</h3>\n";
-
-echo "<form action=\"add-free.php\" method=\"POST\">\n";
-echo "<input type=\"hidden\" name=\"id\" value=\"$id\">\n";
-
-?>
-
-<p>Terms and conditions..</p>
-<input type="submit" value="Accept">
-</form>
-
-</body>
-</html>
diff --git a/hs20/server/www/redirect.php b/hs20/server/www/redirect.php
deleted file mode 100644
index 8fc9cd6..0000000
--- a/hs20/server/www/redirect.php
+++ /dev/null
@@ -1,32 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_GET["id"]))
-	$id = preg_replace("/[^a-fA-F0-9]/", "", $_GET["id"]);
-else
-	$id = 0;
-
-$row = $db->query("SELECT rowid,* FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-
-$uri = $row['redirect_uri'];
-
-header("Location: $uri", true, 302);
-
-$user = $row['user'];
-$realm = $row['realm'];
-
-$db->exec("INSERT INTO eventlog(user,realm,sessionid,timestamp,notes) " .
-	  "VALUES ('$user', '$realm', '$id', " .
-	  "strftime('%Y-%m-%d %H:%M:%f','now'), " .
-	  "'redirected after user input')");
-
-?>
diff --git a/hs20/server/www/remediation-pw.php b/hs20/server/www/remediation-pw.php
deleted file mode 100644
index 76fdccb..0000000
--- a/hs20/server/www/remediation-pw.php
+++ /dev/null
@@ -1,41 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_POST["id"]))
-  $id = preg_replace("/[^a-fA-F0-9]/", "", $_POST["id"]);
-else
-  die("Missing session id");
-
-$pw = $_POST["password"];
-if (strlen($id) < 32 || !isset($pw)) {
-  die("Invalid POST data");
-}
-
-$row = $db->query("SELECT rowid,* FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-$user = $row['user'];
-$realm = $row['realm'];
-
-$uri = $row['redirect_uri'];
-$rowid = $row['rowid'];
-
-if (!$db->exec("UPDATE sessions SET password='$pw' WHERE rowid=$rowid")) {
-  die("Failed to update session database");
-}
-
-$db->exec("INSERT INTO eventlog(user,realm,sessionid,timestamp,notes) " .
-	"VALUES ('$user', '$realm', '$id', " .
-	"strftime('%Y-%m-%d %H:%M:%f','now'), " .
-	"'completed user input response for subscription remediation')");
-
-header("Location: $uri", true, 302);
-
-?>
diff --git a/hs20/server/www/remediation.php b/hs20/server/www/remediation.php
deleted file mode 100644
index 3628065..0000000
--- a/hs20/server/www/remediation.php
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-<title>Hotspot 2.0 subscription remediation</title>
-</head>
-<body>
-
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_GET["session_id"]))
-	$id = preg_replace("/[^a-fA-F0-9]/", "", $_GET["session_id"]);
-else
-	$id = 0;
-echo "SessionID: " . $id . "<br>\n";
-
-$row = $db->query("SELECT * FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found");
-}
-
-$username = $row['user'];
-echo "User: " . $username . "@" . $row['realm'] . "<br>\n";
-
-$user = $db->query("SELECT machine_managed,methods FROM users WHERE identity='$username'")->fetch();
-if ($user == false) {
-   die("User not found");
-}
-
-echo "<hr><br>\n";
-
-$cert = $user['methods'] == "TLS" || strncmp($username, "cert-", 5) == 0;
-
-if ($cert) {
-   echo "<a href=\"redirect.php?id=" . $_GET["session_id"] . "\">Complete user subscription remediation</a><br>\n";
-} else if ($user['machine_managed'] == "1") {
-   echo "<a href=\"redirect.php?id=" . $_GET["session_id"] . "\">Complete user subscription remediation</a><br>\n";
-   echo "This will provide a new machine-generated password.<br>\n";
-} else {
-   echo "<form action=\"remediation-pw.php\" method=\"POST\">\n";
-   echo "<input type=\"hidden\" name=\"id\" value=\"$id\">\n";
-   echo "New password: <input type=\"password\" name=\"password\"><br>\n";
-   echo "<input type=\"submit\" value=\"Change password\">\n";
-   echo "</form>\n";
-}
-
-?>
-
-</body>
-</html>
diff --git a/hs20/server/www/signup.php b/hs20/server/www/signup.php
deleted file mode 100644
index 80a9d40..0000000
--- a/hs20/server/www/signup.php
+++ /dev/null
@@ -1,59 +0,0 @@
-<html>
-<head>
-<title>Hotspot 2.0 signup</title>
-</head>
-<body>
-
-<?php
-
-$id = $_GET["session_id"];
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-$row = $db->query("SELECT realm,test FROM sessions WHERE id='$id'")->fetch();
-if ($row == false) {
-   die("Session not found for id: $id");
-}
-$realm = $row['realm'];
-$test = $row['test'];
-
-if (strlen($test) > 0) {
-  echo "<p style=\"color:#FF0000\">Special test functionality: $test</red></big></p>\n";
-}
-
-echo "<h3>Sign up for a subscription - $realm</h3>\n";
-
-echo "<p>This page can be used to select between three different types of subscriptions for testing purposes.</p>\n";
-
-echo "<h4>Option 1 - shared free access credential</h4>\n";
-
-$row = $db->query("SELECT value FROM osu_config WHERE realm='$realm' AND field='free_account'")->fetch();
-if ($row && strlen($row['value']) > 0) {
-  echo "<p><a href=\"free.php?session_id=$id\">Sign up for free access</a></p>\n";
-}
-
-echo "<h4>Option 2 - username/password credential</h4>\n";
-
-echo "<form action=\"add-mo.php\" method=\"POST\">\n";
-echo "<input type=\"hidden\" name=\"id\" value=\"$id\">\n";
-?>
-Select a username and password. Leave password empty to get automatically
-generated and machine managed password.<br>
-Username: <input type="text" name="user"><br>
-Password: <input type="password" name="password"><br>
-<input type="submit" value="Complete subscription registration">
-</form>
-
-<?php
-echo "<h4>Option 3 - client certificate credential</h4>\n";
-
-echo "<p><a href=\"cert-enroll.php?id=$id\">Enroll a client certificate</a></p>\n"
-?>
-
-</body>
-</html>
diff --git a/hs20/server/www/spp.php b/hs20/server/www/spp.php
deleted file mode 100644
index c56d3d6..0000000
--- a/hs20/server/www/spp.php
+++ /dev/null
@@ -1,168 +0,0 @@
-<?php
-
-require('config.php');
-
-if (!stristr($_SERVER["CONTENT_TYPE"], "application/soap+xml")) {
-  error_log("spp.php - Unexpected Content-Type " . $_SERVER["CONTENT_TYPE"]);
-  die("Unexpected Content-Type");
-}
-
-if ($_SERVER["REQUEST_METHOD"] != "POST") {
-  error_log("spp.php - Unexpected method " . $_SERVER["REQUEST_METHOD"]);
-  die("Unexpected method");
-}
-
-if (isset($_GET["realm"])) {
-  $realm = $_GET["realm"];
-  $realm = PREG_REPLACE("/[^0-9a-zA-Z\.\-]/i", '', $realm);
-} else {
-  error_log("spp.php - Realm not specified");
-  die("Realm not specified");
-}
-
-if (isset($_GET["test"]))
-  $test = PREG_REPLACE("/[^0-9a-zA-Z\_\-]/i", '', $_GET["test"]);
-else
-  $test = "";
-
-unset($user);
-putenv("HS20CERT");
-
-if (!empty($_SERVER['PHP_AUTH_DIGEST'])) {
-  $needed = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1,
-		  'uri'=>1, 'response'=>1);
-  $data = array();
-  $keys = implode('|', array_keys($needed));
-  preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@',
-		 $_SERVER['PHP_AUTH_DIGEST'], $matches, PREG_SET_ORDER);
-  foreach ($matches as $m) {
-    $data[$m[1]] = $m[3] ? $m[3] : $m[4];
-    unset($needed[$m[1]]);
-  }
-  if ($needed) {
-    error_log("spp.php - Authentication failed - missing: " . print_r($needed));
-    die('Authentication failed');
-  }
-  $user = $data['username'];
-  if (strlen($user) < 1) {
-    error_log("spp.php - Authentication failed - empty username");
-    die('Authentication failed');
-  }
-
-
-  $db = new PDO($osu_db);
-  if (!$db) {
-    error_log("spp.php - Could not access database");
-    die("Could not access database");
-  }
-  $row = $db->query("SELECT password FROM users " .
-		    "WHERE identity='$user' AND realm='$realm'")->fetch();
-  if (!$row) {
-    $row = $db->query("SELECT osu_password FROM users " .
-		      "WHERE osu_user='$user' AND realm='$realm'")->fetch();
-    $pw = $row['osu_password'];
-  } else
-    $pw = $row['password'];
-  if (!$row) {
-    error_log("spp.php - Authentication failed - user '$user' not found");
-    die('Authentication failed');
-  }
-  if (strlen($pw) < 1) {
-    error_log("spp.php - Authentication failed - empty password");
-    die('Authentication failed');
-  }
-
-  $A1 = md5($user . ':' . $realm . ':' . $pw);
-  $A2 = md5($_SERVER['REQUEST_METHOD'] . ':' . $data['uri']);
-  $resp = md5($A1 . ':' . $data['nonce'] . ':' . $data['nc'] . ':' .
-	      $data['cnonce'] . ':' . $data['qop'] . ':' . $A2);
-  if ($data['response'] != $resp) {
-    error_log("Authentication failure - response mismatch");
-    die('Authentication failed');
-  }
-} else if (isset($_SERVER["SSL_CLIENT_VERIFY"]) &&
-	   $_SERVER["SSL_CLIENT_VERIFY"] == "SUCCESS" &&
-	   isset($_SERVER["SSL_CLIENT_M_SERIAL"])) {
-  $user = "cert-" . $_SERVER["SSL_CLIENT_M_SERIAL"];
-  putenv("HS20CERT=yes");
-} else if (isset($_GET["hotspot2dot0-mobile-identifier-hash"])) {
-  $id_hash = $_GET["hotspot2dot0-mobile-identifier-hash"];
-  $id_hash = PREG_REPLACE("/[^0-9a-h]/i", '', $id_hash);
-
-  $db = new PDO($osu_db);
-  if (!$db) {
-    error_log("spp.php - Could not access database");
-    die("Could not access database");
-  }
-
-  $row = $db->query("SELECT * FROM sim_provisioning " .
-		    "WHERE mobile_identifier_hash='$id_hash'")->fetch();
-  if (!$row) {
-    error_log("spp.php - SIM provisioning failed - mobile_identifier_hash not found");
-    die('SIM provisioning failed - mobile_identifier_hash not found');
-  }
-
-  $imsi = $row['imsi'];
-  $mac_addr = $row['mac_addr'];
-  $eap_method = $row['eap_method'];
-
-  $row = $db->query("SELECT COUNT(*) FROM osu_config " .
-		    "WHERE realm='$realm'")->fetch();
-  if (!$row || intval($row[0]) < 1) {
-    error_log("spp.php - SIM provisioning failed - realm $realm not found");
-    die('SIM provisioning failed');
-  }
-
-  error_log("spp.php - SIM provisioning for IMSI $imsi");
-  putenv("HS20SIMPROV=yes");
-  putenv("HS20IMSI=$imsi");
-  putenv("HS20MACADDR=$mac_addr");
-  putenv("HS20EAPMETHOD=$eap_method");
-  putenv("HS20IDHASH=$id_hash");
-} else if (!isset($_SERVER["PATH_INFO"]) ||
-	   $_SERVER["PATH_INFO"] != "/signup") {
-  header('HTTP/1.1 401 Unauthorized');
-  header('WWW-Authenticate: Digest realm="'.$realm.
-	 '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
-  error_log("spp.php - Authentication required (not signup)");
-  die('Authentication required (not signup)');
-}
-
-
-if (isset($user) && strlen($user) > 0)
-  putenv("HS20USER=$user");
-else
-  putenv("HS20USER");
-
-putenv("HS20REALM=$realm");
-$postdata = file_get_contents("php://input");
-putenv("HS20POST=$postdata");
-$addr = $_SERVER["REMOTE_ADDR"];
-putenv("HS20ADDR=$addr");
-putenv("HS20TEST=$test");
-
-$last = exec("$osu_root/spp/hs20_spp_server -r$osu_root -f/tmp/hs20_spp_server.log", $output, $ret);
-
-if ($ret == 2) {
-  if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
-    header('HTTP/1.1 401 Unauthorized');
-    header('WWW-Authenticate: Digest realm="'.$realm.
-           '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
-    error_log("spp.php - Authentication required (ret 2)");
-    die('Authentication required');
-  } else {
-    error_log("spp.php - Unexpected authentication error");
-    die("Unexpected authentication error");
-  }
-}
-if ($ret != 0) {
-  error_log("spp.php - Failed to process SPP request");
-  die("Failed to process SPP request");
-}
-//error_log("spp.php: Response: " . implode($output));
-
-header("Content-Type: application/soap+xml");
-
-echo implode($output);
-
-?>
diff --git a/hs20/server/www/terms.php b/hs20/server/www/terms.php
deleted file mode 100644
index acba23e..0000000
--- a/hs20/server/www/terms.php
+++ /dev/null
@@ -1,87 +0,0 @@
-<?php
-
-require('config.php');
-
-function print_header()
-{
-   echo "<html>\n";
-   echo "<head><title>HS 2.0 Terms and Conditions</title></head>\n";
-   echo "<body>\n";
-}
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (!isset($_GET["addr"])) {
-   die("Missing addr parameter");
-}
-$addr = $_GET["addr"];
-
-$accept = isset($_GET["accept"]) && $_GET["accept"] == "yes";
-
-$res = $db->prepare("SELECT identity FROM pending_tc WHERE mac_addr=?");
-$res->execute(array($addr));
-$row = $res->fetch();
-if (!$row) {
-   die("No pending session for the specified MAC address");
-}
-$identity = $row[0];
-
-if (!$accept) {
-   print_header();
-
-   echo "<p>Accept the following terms and conditions by clicking here: <a href=\"terms.php?addr=$addr&accept=yes\">Accept</a></p>\n<hr>\n";
-   readfile($t_c_file);
-} else {
-   $res = $db->prepare("UPDATE users SET t_c_timestamp=? WHERE identity=?");
-   if (!$res->execute(array($t_c_timestamp, $identity))) {
-      die("Failed to update user account.");
-   }
-
-   $res = $db->prepare("DELETE FROM pending_tc WHERE mac_addr=?");
-   $res->execute(array($addr));
-
-   $fp = fsockopen($hostapd_ctrl);
-   if (!$fp) {
-      die("Could not connect to hostapd(AS)");
-   }
-
-   fwrite($fp, "DAC_REQUEST coa $addr t_c_clear");
-   fclose($fp);
-
-   $waiting = true;
-   $ack = false;
-   for ($i = 1; $i <= 10; $i++) {
-      $res = $db->prepare("SELECT waiting_coa_ack,coa_ack_received FROM current_sessions WHERE mac_addr=?");
-      $res->execute(array($addr));
-      $row = $res->fetch();
-      if (!$row) {
-         die("No current session for the specified MAC address");
-      }
-      if (strlen($row[0]) > 0)
-            $waiting = $row[0] == 1;
-      if (strlen($row[1]) > 0)
-            $ack = $row[1] == 1;
-      $res->closeCursor();
-      if (!$waiting)
-         break;
-      sleep(1);
-   }
-   if ($ack) {
-      header('X-WFA-Hotspot20-Filtering: removed');
-      print_header();
-      echo "<p>Terms and conditions were accepted.</p>\n";
-
-      echo "<P>Filtering disabled.</P>\n";
-   } else {
-      print_header();
-      echo "<P>Failed to disable filtering.</P>\n";
-   }
-}
-
-?>
-
-</body>
-</html>
diff --git a/hs20/server/www/users.php b/hs20/server/www/users.php
deleted file mode 100644
index 2bd5552..0000000
--- a/hs20/server/www/users.php
+++ /dev/null
@@ -1,377 +0,0 @@
-<?php
-
-require('config.php');
-
-$db = new PDO($osu_db);
-if (!$db) {
-   die($sqliteerror);
-}
-
-if (isset($_GET["id"])) {
-	$id = $_GET["id"];
-	if (!is_numeric($id))
-		$id = 0;
-} else
-	$id = 0;
-if (isset($_GET["cmd"]))
-	$cmd = $_GET["cmd"];
-else
-	$cmd = '';
-
-if ($cmd == 'eventlog' && $id > 0) {
-	$row = $db->query("SELECT dump FROM eventlog WHERE rowid=$id")->fetch();
-	$dump = $row['dump'];
-	if ($dump[0] == '<') {
-	  header("Content-type: text/xml");
-	  echo "<?xml version=\"1.0\"?>\n";
-	  echo $dump;
-	} else {
-	  header("Content-type: text/plain");
-	  echo $dump;
-	}
-	exit;
-}
-
-if ($cmd == 'mo' && $id > 0) {
-	$mo = $_GET["mo"];
-	if (!isset($mo))
-		exit;
-	if ($mo != "devinfo" && $mo != "devdetail" && $mo != "pps")
-		exit;
-	$row = $db->query("SELECT $mo FROM users WHERE rowid=$id")->fetch();
-	header("Content-type: text/xml");
-	echo "<?xml version=\"1.0\"?>\n";
-	echo $row[$mo];
-	exit;
-}
-
-if ($cmd == 'cert' && $id > 0) {
-	$row = $db->query("SELECT cert_pem FROM users WHERE rowid=$id")->fetch();
-	header("Content-type: text/plain");
-	echo $row['cert_pem'];
-	exit;
-}
-
-?>
-
-<html>
-<head><title>HS 2.0 users</title></head>
-<body>
-
-<?php
-
-if ($cmd == 'subrem-clear' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='' WHERE rowid=$id");
-}
-if ($cmd == 'subrem-add-user' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='user' WHERE rowid=$id");
-}
-if ($cmd == 'subrem-add-machine' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='machine' WHERE rowid=$id");
-}
-if ($cmd == 'subrem-add-reenroll' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='reenroll' WHERE rowid=$id");
-}
-if ($cmd == 'subrem-add-policy' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='policy' WHERE rowid=$id");
-}
-if ($cmd == 'subrem-add-free' && $id > 0) {
-	$db->exec("UPDATE users SET remediation='free' WHERE rowid=$id");
-}
-if ($cmd == 'fetch-pps-on' && $id > 0) {
-	$db->exec("UPDATE users SET fetch_pps=1 WHERE rowid=$id");
-}
-if ($cmd == 'fetch-pps-off' && $id > 0) {
-	$db->exec("UPDATE users SET fetch_pps=0 WHERE rowid=$id");
-}
-if ($cmd == 'reset-pw' && $id > 0) {
-	$db->exec("UPDATE users SET password='ChangeMe' WHERE rowid=$id");
-}
-if ($cmd == "policy" && $id > 0 && isset($_GET["policy"])) {
-	$policy = $_GET["policy"];
-	if ($policy == "no-policy" ||
-	    is_readable("$osu_root/spp/policy/$policy.xml")) {
-		$db->exec("UPDATE users SET policy='$policy' WHERE rowid=$id");
-	}
-}
-if ($cmd == "account-type" && $id > 0 && isset($_GET["type"])) {
-	$type = $_GET["type"];
-	if ($type == "shared")
-		$db->exec("UPDATE users SET shared=1 WHERE rowid=$id");
-	if ($type == "default")
-		$db->exec("UPDATE users SET shared=0 WHERE rowid=$id");
-}
-
-if ($cmd == "set-osu-cred" && $id > 0) {
-  $osu_user = $_POST["osu_user"];
-  $osu_password = $_POST["osu_password"];
-  if (strlen($osu_user) == 0)
-    $osu_password = "";
-  $db->exec("UPDATE users SET osu_user='$osu_user', osu_password='$osu_password' WHERE rowid=$id");
-}
-
-if ($cmd == 'clear-t-c' && $id > 0) {
-	$db->exec("UPDATE users SET t_c_timestamp=NULL WHERE rowid=$id");
-}
-
-$dump = 0;
-
-if ($id > 0) {
-
-if (isset($_GET["dump"])) {
-	$dump = $_GET["dump"];
-	if (!is_numeric($dump))
-		$dump = 0;
-} else
-	$dump = 0;
-
-echo "[<a href=\"users.php\">All users</a>] ";
-if ($dump == 0)
-	echo "[<a href=\"users.php?id=$id&dump=1\">Include debug dump</a>] ";
-else
-	echo "[<a href=\"users.php?id=$id\">Without debug dump</a>] ";
-echo "<br>\n";
-
-$row = $db->query("SELECT rowid,* FROM users WHERE rowid=$id")->fetch();
-
-echo "<H3>" . $row['identity'] . "@" . $row['realm'] . "</H3>\n";
-
-echo "MO: ";
-if (strlen($row['devinfo']) > 0) {
-	echo "[<a href=\"users.php?cmd=mo&id=$id&mo=devinfo\">DevInfo</a>]\n";
-}
-if (strlen($row['devdetail']) > 0) {
-	echo "[<a href=\"users.php?cmd=mo&id=$id&mo=devdetail\">DevDetail</a>]\n";
-}
-if (strlen($row['pps']) > 0) {
-	echo "[<a href=\"users.php?cmd=mo&id=$id&mo=pps\">PPS</a>]\n";
-}
-if (strlen($row['cert_pem']) > 0) {
-	echo "[<a href=\"users.php?cmd=cert&id=$id\">Certificate</a>]\n";
-}
-echo "<BR>\n";
-
-echo "Fetch PPS MO: ";
-if ($row['fetch_pps'] == "1") {
-	echo "On next connection " .
-		"[<a href=\"users.php?cmd=fetch-pps-off&id=$id\">" .
-		"do not fetch</a>]<br>\n";
-} else {
-	echo "Do not fetch " .
-		"[<a href=\"users.php?cmd=fetch-pps-on&id=$id\">" .
-		"request fetch</a>]<br>\n";
-}
-
-$cert = $row['cert'];
-if (strlen($cert) > 0) {
-  echo "Certificate fingerprint: $cert<br>\n";
-}
-
-echo "Remediation: ";
-$rem = $row['remediation'];
-if ($rem == "") {
-	echo "Not required";
-	echo " [<a href=\"users.php?cmd=subrem-add-user&id=" .
-		   $row['rowid'] . "\">add:user</a>]";
-	echo " [<a href=\"users.php?cmd=subrem-add-machine&id=" .
-		   $row['rowid'] . "\">add:machine</a>]";
-	if ($row['methods'] == 'TLS') {
-		echo " [<a href=\"users.php?cmd=subrem-add-reenroll&id=" .
-			   $row['rowid'] . "\">add:reenroll</a>]";
-	}
-	echo " [<a href=\"users.php?cmd=subrem-add-policy&id=" .
-		   $row['rowid'] . "\">add:policy</a>]";
-	echo " [<a href=\"users.php?cmd=subrem-add-free&id=" .
-		   $row['rowid'] . "\">add:free</a>]";
-} else if ($rem == "user") {
-	echo "User [<a href=\"users.php?cmd=subrem-clear&id=" .
-		       $row['rowid'] . "\">clear</a>]";
-} else if ($rem == "policy") {
-	echo "Policy [<a href=\"users.php?cmd=subrem-clear&id=" .
-		       $row['rowid'] . "\">clear</a>]";
-} else if ($rem == "free") {
-	echo "Free [<a href=\"users.php?cmd=subrem-clear&id=" .
-		       $row['rowid'] . "\">clear</a>]";
-} else if ($rem == "reenroll") {
-	echo "Reenroll [<a href=\"users.php?cmd=subrem-clear&id=" .
-		       $row['rowid'] . "\">clear</a>]";
-} else  {
-	echo "Machine [<a href=\"users.php?cmd=subrem-clear&id=" .
-			  $row['rowid'] . "\">clear</a>]";
-}
-echo "<br>\n";
-
-if (strncmp($row['identity'], "cert-", 5) != 0)
-   echo "Machine managed: " . ($row['machine_managed'] == "1" ? "TRUE" : "FALSE") . "<br>\n";
-
-echo "<form>Policy: <select name=\"policy\" " .
-	"onChange=\"window.location='users.php?cmd=policy&id=" .
-	$row['rowid'] . "&policy=' + this.value;\">\n";
-echo "<option value=\"" . $row['policy'] . "\" selected>" . $row['policy'] .
-      "</option>\n";
-$files = scandir("$osu_root/spp/policy");
-foreach ($files as $file) {
-	if (!preg_match("/.xml$/", $file))
-		continue;
-	if ($file == $row['policy'] . ".xml")
-		continue;
-	$p = substr($file, 0, -4);
-	echo "<option value=\"$p\">$p</option>\n";
-}
-echo "<option value=\"no-policy\">no policy</option>\n";
-echo "</select></form>\n";
-
-echo "<form>Account type: <select name=\"type\" " .
-	"onChange=\"window.location='users.php?cmd=account-type&id=" .
-	$row['rowid'] . "&type=' + this.value;\">\n";
-if ($row['shared'] > 0) {
-  $default_sel = "";
-  $shared_sel = " selected";
-} else {
-  $default_sel = " selected";
-  $shared_sel = "";
-}
-echo "<option value=\"default\"$default_sel>default</option>\n";
-echo "<option value=\"shared\"$shared_sel>shared</option>\n";
-echo "</select></form>\n";
-
-echo "Phase 2 method(s): " . $row['methods'] . "<br>\n";
-
-echo "<br>\n";
-echo "<a href=\"users.php?cmd=reset-pw&id=" .
-	 $row['rowid'] . "\">Reset AAA password</a><br>\n";
-
-echo "<br>\n";
-echo "<form action=\"users.php?cmd=set-osu-cred&id=" . $row['rowid'] .
-  "\" method=\"POST\">\n";
-echo "OSU credentials (if username empty, AAA credentials are used):<br>\n";
-echo "username: <input type=\"text\" name=\"osu_user\" value=\"" .
-  $row['osu_user'] . "\">\n";
-echo "password: <input type=\"password\" name=\"osu_password\">\n";
-echo "<input type=\"submit\" value=\"Set OSU credentials\">\n";
-echo "</form>\n";
-
-if (strlen($row['t_c_timestamp']) > 0) {
-	echo "<br>\n";
-	echo "<a href=\"users.php?cmd=clear-t-c&id=" .
-		$row['rowid'] .
-		"\">Clear Terms and Conditions acceptance</a><br>\n";
-}
-
-echo "<hr>\n";
-
-$user = $row['identity'];
-$osu_user = $row['osu_user'];
-$realm = $row['realm'];
-}
-
-if ($id > 0 || ($id == 0 && $cmd == 'eventlog')) {
-
-  if ($id == 0) {
-    echo "[<a href=\"users.php\">All users</a>] ";
-    echo "<br>\n";
-  }
-
-echo "<table border=1>\n";
-echo "<tr>";
-if ($id == 0) {
-  echo "<th>user<th>realm";
-}
-echo "<th>time<th>address<th>sessionID<th>notes";
-if ($dump > 0)
-	echo "<th>dump";
-echo "\n";
-if (isset($_GET["limit"])) {
-	$limit = $_GET["limit"];
-	if (!is_numeric($limit))
-		$limit = 20;
-} else
-	$limit = 20;
-if ($id == 0)
-  $res = $db->query("SELECT rowid,* FROM eventlog ORDER BY timestamp DESC LIMIT $limit");
-else if (strlen($osu_user) > 0)
-  $res = $db->query("SELECT rowid,* FROM eventlog WHERE (user='$user' OR user='$osu_user') AND realm='$realm' ORDER BY timestamp DESC LIMIT $limit");
-else
-  $res = $db->query("SELECT rowid,* FROM eventlog WHERE user='$user' AND realm='$realm' ORDER BY timestamp DESC LIMIT $limit");
-foreach ($res as $row) {
-	echo "<tr>";
-	if ($id == 0) {
-	  echo "<td>" . $row['user'] . "\n";
-	  echo "<td>" . $row['realm'] . "\n";
-	}
-	echo "<td>" . $row['timestamp'] . "\n";
-	echo "<td>" . $row['addr'] . "\n";
-	echo "<td>" . $row['sessionid'] . "\n";
-	echo "<td>" . $row['notes'] . "\n";
-	$d = $row['dump'];
-	if (strlen($d) > 0) {
-		echo "[<a href=\"users.php?cmd=eventlog&id=" . $row['rowid'] .
-		  "\">";
-		if ($d[0] == '<')
-		  echo "XML";
-		else
-		  echo "txt";
-		echo "</a>]\n";
-		if ($dump > 0)
-			echo "<td>" . htmlspecialchars($d) . "\n";
-	}
-}
-echo "</table>\n";
-
-}
-
-
-if ($id == 0 && $cmd != 'eventlog') {
-
-echo "[<a href=\"users.php?cmd=eventlog&limit=50\">Eventlog</a>] ";
-echo "<br>\n";
-
-echo "<table border=1 cellspacing=0 cellpadding=0>\n";
-echo "<tr><th>User<th>Realm<th><small>Remediation</small><th>Policy<th><small>Account type</small><th><small>Phase 2 method(s)</small><th>DevId<th>MAC Address<th>T&C\n";
-
-$res = $db->query('SELECT rowid,* FROM users WHERE (phase2=1 OR methods=\'TLS\') ORDER BY identity');
-foreach ($res as $row) {
-	echo "<tr><td><a href=\"users.php?id=" . $row['rowid'] . "\"> " .
-	    $row['identity'] . " </a>";
-	echo "<td>" . $row['realm'];
-	$rem = $row['remediation'];
-	echo "<td>";
-	if ($rem == "") {
-		echo "-";
-	} else if ($rem == "user") {
-		echo "User";
-	} else if ($rem == "policy") {
-		echo "Policy";
-	} else if ($rem == "free") {
-		echo "Free";
-	} else if ($rem == "reenroll") {
-		echo "Reenroll";
-	} else  {
-		echo "Machine";
-	}
-	echo "<td>" . $row['policy'];
-	if ($row['shared'] > 0)
-	  echo "<td>shared";
-	else
-	  echo "<td>default";
-	echo "<td><small>" . $row['methods'] . "</small>";
-	echo "<td>";
-	$xml = xml_parser_create();
-	xml_parse_into_struct($xml, $row['devinfo'], $devinfo);
-	foreach($devinfo as $k) {
-	  if ($k['tag'] == 'DEVID') {
-	    echo "<small>" . $k['value'] . "</small>";
-	    break;
-	  }
-	}
-	echo "<td><small>" . $row['mac_addr'] . "</small>";
-	echo "<td><small>" . $row['t_c_timestamp'] . "</small>";
-	echo "\n";
-}
-echo "</table>\n";
-
-}
-
-?>
-
-</html>