wpa_supplicant/events.c

   1 /*
   2  * WPA Supplicant - Driver event processing
   3  * Copyright (c) 2003-2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "rsn_supp/wpa.h"
  20 #include "eloop.h"
  21 #include "config.h"
  22 #include "l2_packet/l2_packet.h"
  23 #include "wpa_supplicant_i.h"
  24 #include "driver_i.h"
  25 #include "pcsc_funcs.h"
  26 #include "rsn_supp/preauth.h"
  27 #include "rsn_supp/pmksa_cache.h"
  28 #include "common/wpa_ctrl.h"
  29 #include "eap_peer/eap.h"
  30 #include "ap/hostapd.h"
  31 #include "notify.h"
  32 #include "common/ieee802_11_defs.h"
  33 #include "blacklist.h"
  34 #include "wpas_glue.h"
  35 #include "wps_supplicant.h"
  36 #include "ibss_rsn.h"
  37 #include "sme.h"
  38 #include "bgscan.h"
  39 #include "ap.h"
  40 #include "bss.h"
  41 #include "mlme.h"
  42 #include "scan.h"
  43
  44
  45 static int wpa_supplicant_select_config(struct wpa_supplicant *wpa_s)
  46 {
  47         struct wpa_ssid *ssid, *old_ssid;
  48
  49         if (wpa_s->conf->ap_scan == 1 && wpa_s->current_ssid)
  50                 return 0;
  51
  52         wpa_printf(MSG_DEBUG, "Select network based on association "
  53                    "information");
  54         ssid = wpa_supplicant_get_ssid(wpa_s);
  55         if (ssid == NULL) {
  56                 wpa_printf(MSG_INFO, "No network configuration found for the "
  57                            "current AP");
  58                 return -1;
  59         }
  60
  61         if (ssid->disabled) {
  62                 wpa_printf(MSG_DEBUG, "Selected network is disabled");
  63                 return -1;
  64         }
  65
  66         wpa_printf(MSG_DEBUG, "Network configuration found for the current "
  67                    "AP");
  68         if (ssid->key_mgmt & (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_IEEE8021X |
  69                               WPA_KEY_MGMT_WPA_NONE |
  70                               WPA_KEY_MGMT_FT_PSK | WPA_KEY_MGMT_FT_IEEE8021X |
  71                               WPA_KEY_MGMT_PSK_SHA256 |
  72                               WPA_KEY_MGMT_IEEE8021X_SHA256)) {
  73                 u8 wpa_ie[80];
  74                 size_t wpa_ie_len = sizeof(wpa_ie);
  75                 wpa_supplicant_set_suites(wpa_s, NULL, ssid,
  76                                           wpa_ie, &wpa_ie_len);
  77         } else {
  78                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
  79         }
  80
  81         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid)
  82                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
  83         old_ssid = wpa_s->current_ssid;
  84         wpa_s->current_ssid = ssid;
  85         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
  86         wpa_supplicant_initiate_eapol(wpa_s);
  87         if (old_ssid != wpa_s->current_ssid)
  88                 wpas_notify_network_changed(wpa_s);
  89
  90         return 0;
  91 }
  92
  93
  94 static void wpa_supplicant_stop_countermeasures(void *eloop_ctx,
  95                                                 void *sock_ctx)
  96 {
  97         struct wpa_supplicant *wpa_s = eloop_ctx;
  98
  99         if (wpa_s->countermeasures) {
 100                 wpa_s->countermeasures = 0;
 101                 wpa_drv_set_countermeasures(wpa_s, 0);
 102                 wpa_msg(wpa_s, MSG_INFO, "WPA: TKIP countermeasures stopped");
 103                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 104         }
 105 }
 106
 107
 108 void wpa_supplicant_mark_disassoc(struct wpa_supplicant *wpa_s)
 109 {
 110         int bssid_changed;
 111
 112         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 113         bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
 114         os_memset(wpa_s->bssid, 0, ETH_ALEN);
 115         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
 116         wpa_s->current_bss = NULL;
 117         if (bssid_changed)
 118                 wpas_notify_bssid_changed(wpa_s);
 119
 120         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
 121         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
 122         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt))
 123                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 124         wpa_s->ap_ies_from_associnfo = 0;
 125 }
 126
 127
 128 static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s)
 129 {
 130         struct wpa_ie_data ie;
 131         int pmksa_set = -1;
 132         size_t i;
 133
 134         if (wpa_sm_parse_own_wpa_ie(wpa_s->wpa, &ie) < 0 ||
 135             ie.pmkid == NULL)
 136                 return;
 137
 138         for (i = 0; i < ie.num_pmkid; i++) {
 139                 pmksa_set = pmksa_cache_set_current(wpa_s->wpa,
 140                                                     ie.pmkid + i * PMKID_LEN,
 141                                                     NULL, NULL, 0);
 142                 if (pmksa_set == 0) {
 143                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
 144                         break;
 145                 }
 146         }
 147
 148         wpa_printf(MSG_DEBUG, "RSN: PMKID from assoc IE %sfound from PMKSA "
 149                    "cache", pmksa_set == 0 ? "" : "not ");
 150 }
 151
 152
 153 static void wpa_supplicant_event_pmkid_candidate(struct wpa_supplicant *wpa_s,
 154                                                  union wpa_event_data *data)
 155 {
 156         if (data == NULL) {
 157                 wpa_printf(MSG_DEBUG, "RSN: No data in PMKID candidate event");
 158                 return;
 159         }
 160         wpa_printf(MSG_DEBUG, "RSN: PMKID candidate event - bssid=" MACSTR
 161                    " index=%d preauth=%d",
 162                    MAC2STR(data->pmkid_candidate.bssid),
 163                    data->pmkid_candidate.index,
 164                    data->pmkid_candidate.preauth);
 165
 166         pmksa_candidate_add(wpa_s->wpa, data->pmkid_candidate.bssid,
 167                             data->pmkid_candidate.index,
 168                             data->pmkid_candidate.preauth);
 169 }
 170
 171
 172 static int wpa_supplicant_dynamic_keys(struct wpa_supplicant *wpa_s)
 173 {
 174         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 175             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 176                 return 0;
 177
 178 #ifdef IEEE8021X_EAPOL
 179         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 180             wpa_s->current_ssid &&
 181             !(wpa_s->current_ssid->eapol_flags &
 182               (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 183                EAPOL_FLAG_REQUIRE_KEY_BROADCAST))) {
 184                 /* IEEE 802.1X, but not using dynamic WEP keys (i.e., either
 185                  * plaintext or static WEP keys). */
 186                 return 0;
 187         }
 188 #endif /* IEEE8021X_EAPOL */
 189
 190         return 1;
 191 }
 192
 193
 194 /**
 195  * wpa_supplicant_scard_init - Initialize SIM/USIM access with PC/SC
 196  * @wpa_s: pointer to wpa_supplicant data
 197  * @ssid: Configuration data for the network
 198  * Returns: 0 on success, -1 on failure
 199  *
 200  * This function is called when starting authentication with a network that is
 201  * configured to use PC/SC for SIM/USIM access (EAP-SIM or EAP-AKA).
 202  */
 203 int wpa_supplicant_scard_init(struct wpa_supplicant *wpa_s,
 204                               struct wpa_ssid *ssid)
 205 {
 206 #ifdef IEEE8021X_EAPOL
 207         int aka = 0, sim = 0, type;
 208
 209         if (ssid->eap.pcsc == NULL || wpa_s->scard != NULL)
 210                 return 0;
 211
 212         if (ssid->eap.eap_methods == NULL) {
 213                 sim = 1;
 214                 aka = 1;
 215         } else {
 216                 struct eap_method_type *eap = ssid->eap.eap_methods;
 217                 while (eap->vendor != EAP_VENDOR_IETF ||
 218                        eap->method != EAP_TYPE_NONE) {
 219                         if (eap->vendor == EAP_VENDOR_IETF) {
 220                                 if (eap->method == EAP_TYPE_SIM)
 221                                         sim = 1;
 222                                 else if (eap->method == EAP_TYPE_AKA)
 223                                         aka = 1;
 224                         }
 225                         eap++;
 226                 }
 227         }
 228
 229         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_SIM) == NULL)
 230                 sim = 0;
 231         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_AKA) == NULL)
 232                 aka = 0;
 233
 234         if (!sim && !aka) {
 235                 wpa_printf(MSG_DEBUG, "Selected network is configured to use "
 236                            "SIM, but neither EAP-SIM nor EAP-AKA are enabled");
 237                 return 0;
 238         }
 239
 240         wpa_printf(MSG_DEBUG, "Selected network is configured to use SIM "
 241                    "(sim=%d aka=%d) - initialize PCSC", sim, aka);
 242         if (sim && aka)
 243                 type = SCARD_TRY_BOTH;
 244         else if (aka)
 245                 type = SCARD_USIM_ONLY;
 246         else
 247                 type = SCARD_GSM_SIM_ONLY;
 248
 249         wpa_s->scard = scard_init(type);
 250         if (wpa_s->scard == NULL) {
 251                 wpa_printf(MSG_WARNING, "Failed to initialize SIM "
 252                            "(pcsc-lite)");
 253                 return -1;
 254         }
 255         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
 256         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
 257 #endif /* IEEE8021X_EAPOL */
 258
 259         return 0;
 260 }
 261
 262
 263 #ifndef CONFIG_NO_SCAN_PROCESSING
 264 static int wpa_supplicant_match_privacy(struct wpa_scan_res *bss,
 265                                         struct wpa_ssid *ssid)
 266 {
 267         int i, privacy = 0;
 268
 269         if (ssid->mixed_cell)
 270                 return 1;
 271
 272 #ifdef CONFIG_WPS
 273         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 274                 return 1;
 275 #endif /* CONFIG_WPS */
 276
 277         for (i = 0; i < NUM_WEP_KEYS; i++) {
 278                 if (ssid->wep_key_len[i]) {
 279                         privacy = 1;
 280                         break;
 281                 }
 282         }
 283 #ifdef IEEE8021X_EAPOL
 284         if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
 285             ssid->eapol_flags & (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 286                                  EAPOL_FLAG_REQUIRE_KEY_BROADCAST))
 287                 privacy = 1;
 288 #endif /* IEEE8021X_EAPOL */
 289
 290         if (bss->caps & IEEE80211_CAP_PRIVACY)
 291                 return privacy;
 292         return !privacy;
 293 }
 294
 295
 296 static int wpa_supplicant_ssid_bss_match(struct wpa_supplicant *wpa_s,
 297                                          struct wpa_ssid *ssid,
 298                                          struct wpa_scan_res *bss)
 299 {
 300         struct wpa_ie_data ie;
 301         int proto_match = 0;
 302         const u8 *rsn_ie, *wpa_ie;
 303         int ret;
 304
 305         ret = wpas_wps_ssid_bss_match(wpa_s, ssid, bss);
 306         if (ret >= 0)
 307                 return ret;
 308
 309         rsn_ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 310         while ((ssid->proto & WPA_PROTO_RSN) && rsn_ie) {
 311                 proto_match++;
 312
 313                 if (wpa_parse_wpa_ie(rsn_ie, 2 + rsn_ie[1], &ie)) {
 314                         wpa_printf(MSG_DEBUG, "   skip RSN IE - parse failed");
 315                         break;
 316                 }
 317                 if (!(ie.proto & ssid->proto)) {
 318                         wpa_printf(MSG_DEBUG, "   skip RSN IE - proto "
 319                                    "mismatch");
 320                         break;
 321                 }
 322
 323                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 324                         wpa_printf(MSG_DEBUG, "   skip RSN IE - PTK cipher "
 325                                    "mismatch");
 326                         break;
 327                 }
 328
 329                 if (!(ie.group_cipher & ssid->group_cipher)) {
 330                         wpa_printf(MSG_DEBUG, "   skip RSN IE - GTK cipher "
 331                                    "mismatch");
 332                         break;
 333                 }
 334
 335                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 336                         wpa_printf(MSG_DEBUG, "   skip RSN IE - key mgmt "
 337                                    "mismatch");
 338                         break;
 339                 }
 340
 341 #ifdef CONFIG_IEEE80211W
 342                 if (!(ie.capabilities & WPA_CAPABILITY_MFPC) &&
 343                     ssid->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
 344                         wpa_printf(MSG_DEBUG, "   skip RSN IE - no mgmt frame "
 345                                    "protection");
 346                         break;
 347                 }
 348 #endif /* CONFIG_IEEE80211W */
 349
 350                 wpa_printf(MSG_DEBUG, "   selected based on RSN IE");
 351                 return 1;
 352         }
 353
 354         wpa_ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 355         while ((ssid->proto & WPA_PROTO_WPA) && wpa_ie) {
 356                 proto_match++;
 357
 358                 if (wpa_parse_wpa_ie(wpa_ie, 2 + wpa_ie[1], &ie)) {
 359                         wpa_printf(MSG_DEBUG, "   skip WPA IE - parse failed");
 360                         break;
 361                 }
 362                 if (!(ie.proto & ssid->proto)) {
 363                         wpa_printf(MSG_DEBUG, "   skip WPA IE - proto "
 364                                    "mismatch");
 365                         break;
 366                 }
 367
 368                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 369                         wpa_printf(MSG_DEBUG, "   skip WPA IE - PTK cipher "
 370                                    "mismatch");
 371                         break;
 372                 }
 373
 374                 if (!(ie.group_cipher & ssid->group_cipher)) {
 375                         wpa_printf(MSG_DEBUG, "   skip WPA IE - GTK cipher "
 376                                    "mismatch");
 377                         break;
 378                 }
 379
 380                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 381                         wpa_printf(MSG_DEBUG, "   skip WPA IE - key mgmt "
 382                                    "mismatch");
 383                         break;
 384                 }
 385
 386                 wpa_printf(MSG_DEBUG, "   selected based on WPA IE");
 387                 return 1;
 388         }
 389
 390         if (proto_match == 0)
 391                 wpa_printf(MSG_DEBUG, "   skip - no WPA/RSN proto match");
 392
 393         return 0;
 394 }
 395
 396
 397 static struct wpa_bss *
 398 wpa_supplicant_select_bss_wpa(struct wpa_supplicant *wpa_s,
 399                               struct wpa_scan_results *scan_res,
 400                               struct wpa_ssid *group,
 401                               struct wpa_ssid **selected_ssid)
 402 {
 403         struct wpa_ssid *ssid;
 404         struct wpa_scan_res *bss;
 405         size_t i;
 406         struct wpa_blacklist *e;
 407         const u8 *ie;
 408
 409         wpa_printf(MSG_DEBUG, "Try to find WPA-enabled AP");
 410         for (i = 0; i < scan_res->num; i++) {
 411                 const u8 *ssid_;
 412                 u8 wpa_ie_len, rsn_ie_len, ssid_len;
 413                 bss = scan_res->res[i];
 414
 415                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 416                 ssid_ = ie ? ie + 2 : (u8 *) "";
 417                 ssid_len = ie ? ie[1] : 0;
 418
 419                 ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 420                 wpa_ie_len = ie ? ie[1] : 0;
 421
 422                 ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 423                 rsn_ie_len = ie ? ie[1] : 0;
 424
 425                 wpa_printf(MSG_DEBUG, "%d: " MACSTR " ssid='%s' "
 426                            "wpa_ie_len=%u rsn_ie_len=%u caps=0x%x",
 427                            (int) i, MAC2STR(bss->bssid),
 428                            wpa_ssid_txt(ssid_, ssid_len),
 429                            wpa_ie_len, rsn_ie_len, bss->caps);
 430
 431                 e = wpa_blacklist_get(wpa_s, bss->bssid);
 432                 if (e && e->count > 1) {
 433                         wpa_printf(MSG_DEBUG, "   skip - blacklisted");
 434                         continue;
 435                 }
 436
 437                 if (ssid_len == 0) {
 438                         wpa_printf(MSG_DEBUG, "   skip - SSID not known");
 439                         continue;
 440                 }
 441
 442                 if (wpa_ie_len == 0 && rsn_ie_len == 0) {
 443                         wpa_printf(MSG_DEBUG, "   skip - no WPA/RSN IE");
 444                         continue;
 445                 }
 446
 447                 for (ssid = group; ssid; ssid = ssid->pnext) {
 448                         int check_ssid = 1;
 449
 450                         if (ssid->disabled) {
 451                                 wpa_printf(MSG_DEBUG, "   skip - disabled");
 452                                 continue;
 453                         }
 454
 455 #ifdef CONFIG_WPS
 456                         if (ssid->ssid_len == 0 &&
 457                             wpas_wps_ssid_wildcard_ok(wpa_s, ssid, bss))
 458                                 check_ssid = 0;
 459 #endif /* CONFIG_WPS */
 460
 461                         if (check_ssid &&
 462                             (ssid_len != ssid->ssid_len ||
 463                              os_memcmp(ssid_, ssid->ssid, ssid_len) != 0)) {
 464                                 wpa_printf(MSG_DEBUG, "   skip - "
 465                                            "SSID mismatch");
 466                                 continue;
 467                         }
 468
 469                         if (ssid->bssid_set &&
 470                             os_memcmp(bss->bssid, ssid->bssid, ETH_ALEN) != 0)
 471                         {
 472                                 wpa_printf(MSG_DEBUG, "   skip - "
 473                                            "BSSID mismatch");
 474                                 continue;
 475                         }
 476
 477                         if (!wpa_supplicant_ssid_bss_match(wpa_s, ssid, bss))
 478                                 continue;
 479
 480                         wpa_printf(MSG_DEBUG, "   selected WPA AP "
 481                                    MACSTR " ssid='%s'",
 482                                    MAC2STR(bss->bssid),
 483                                    wpa_ssid_txt(ssid_, ssid_len));
 484                         *selected_ssid = ssid;
 485                         return wpa_bss_get(wpa_s, bss->bssid, ssid_, ssid_len);
 486                 }
 487         }
 488
 489         return NULL;
 490 }
 491
 492
 493 static struct wpa_bss *
 494 wpa_supplicant_select_bss_non_wpa(struct wpa_supplicant *wpa_s,
 495                                   struct wpa_scan_results *scan_res,
 496                                   struct wpa_ssid *group,
 497                                   struct wpa_ssid **selected_ssid)
 498 {
 499         struct wpa_ssid *ssid;
 500         struct wpa_scan_res *bss;
 501         size_t i;
 502         struct wpa_blacklist *e;
 503         const u8 *ie;
 504
 505         wpa_printf(MSG_DEBUG, "Try to find non-WPA AP");
 506         for (i = 0; i < scan_res->num; i++) {
 507                 const u8 *ssid_;
 508                 u8 wpa_ie_len, rsn_ie_len, ssid_len;
 509                 bss = scan_res->res[i];
 510
 511                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 512                 ssid_ = ie ? ie + 2 : (u8 *) "";
 513                 ssid_len = ie ? ie[1] : 0;
 514
 515                 ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 516                 wpa_ie_len = ie ? ie[1] : 0;
 517
 518                 ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 519                 rsn_ie_len = ie ? ie[1] : 0;
 520
 521                 wpa_printf(MSG_DEBUG, "%d: " MACSTR " ssid='%s' "
 522                            "wpa_ie_len=%u rsn_ie_len=%u caps=0x%x",
 523                            (int) i, MAC2STR(bss->bssid),
 524                            wpa_ssid_txt(ssid_, ssid_len),
 525                            wpa_ie_len, rsn_ie_len, bss->caps);
 526
 527                 e = wpa_blacklist_get(wpa_s, bss->bssid);
 528                 if (e && e->count > 1) {
 529                         wpa_printf(MSG_DEBUG, "   skip - blacklisted");
 530                         continue;
 531                 }
 532
 533                 if (ssid_len == 0) {
 534                         wpa_printf(MSG_DEBUG, "   skip - SSID not known");
 535                         continue;
 536                 }
 537
 538                 for (ssid = group; ssid; ssid = ssid->pnext) {
 539                         int check_ssid = ssid->ssid_len != 0;
 540
 541                         if (ssid->disabled) {
 542                                 wpa_printf(MSG_DEBUG, "   skip - disabled");
 543                                 continue;
 544                         }
 545
 546 #ifdef CONFIG_WPS
 547                         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 548                                 /* Only allow wildcard SSID match if an AP
 549                                  * advertises active WPS operation that matches
 550                                  * with our mode. */
 551                                 check_ssid = 1;
 552                                 if (ssid->ssid_len == 0 &&
 553                                     wpas_wps_ssid_wildcard_ok(wpa_s, ssid,
 554                                                               bss))
 555                                         check_ssid = 0;
 556                         }
 557 #endif /* CONFIG_WPS */
 558
 559                         if (check_ssid &&
 560                             (ssid_len != ssid->ssid_len ||
 561                              os_memcmp(ssid_, ssid->ssid, ssid_len) != 0)) {
 562                                 wpa_printf(MSG_DEBUG, "   skip - "
 563                                            "SSID mismatch");
 564                                 continue;
 565                         }
 566
 567                         if (ssid->bssid_set &&
 568                             os_memcmp(bss->bssid, ssid->bssid, ETH_ALEN) != 0)
 569                         {
 570                                 wpa_printf(MSG_DEBUG, "   skip - "
 571                                            "BSSID mismatch");
 572                                 continue;
 573                         }
 574
 575                         if (!(ssid->key_mgmt & WPA_KEY_MGMT_NONE) &&
 576                             !(ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
 577                             !(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA))
 578                         {
 579                                 wpa_printf(MSG_DEBUG, "   skip - "
 580                                            "non-WPA network not allowed");
 581                                 continue;
 582                         }
 583
 584                         if ((ssid->key_mgmt &
 585                              (WPA_KEY_MGMT_IEEE8021X | WPA_KEY_MGMT_PSK |
 586                               WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK |
 587                               WPA_KEY_MGMT_IEEE8021X_SHA256 |
 588                               WPA_KEY_MGMT_PSK_SHA256)) &&
 589                             (wpa_ie_len != 0 || rsn_ie_len != 0)) {
 590                                 wpa_printf(MSG_DEBUG, "   skip - "
 591                                            "WPA network");
 592                                 continue;
 593                         }
 594
 595                         if (!wpa_supplicant_match_privacy(bss, ssid)) {
 596                                 wpa_printf(MSG_DEBUG, "   skip - "
 597                                            "privacy mismatch");
 598                                 continue;
 599                         }
 600
 601                         if (bss->caps & IEEE80211_CAP_IBSS) {
 602                                 wpa_printf(MSG_DEBUG, "   skip - "
 603                                            "IBSS (adhoc) network");
 604                                 continue;
 605                         }
 606
 607                         wpa_printf(MSG_DEBUG, "   selected non-WPA AP "
 608                                    MACSTR " ssid='%s'",
 609                                    MAC2STR(bss->bssid),
 610                                    wpa_ssid_txt(ssid_, ssid_len));
 611                         *selected_ssid = ssid;
 612                         return wpa_bss_get(wpa_s, bss->bssid, ssid_, ssid_len);
 613                 }
 614         }
 615
 616         return NULL;
 617 }
 618
 619
 620 static struct wpa_bss *
 621 wpa_supplicant_select_bss(struct wpa_supplicant *wpa_s,
 622                           struct wpa_scan_results *scan_res,
 623                           struct wpa_ssid *group,
 624                           struct wpa_ssid **selected_ssid)
 625 {
 626         struct wpa_bss *selected;
 627
 628         wpa_printf(MSG_DEBUG, "Selecting BSS from priority group %d",
 629                    group->priority);
 630
 631         /* First, try to find WPA-enabled AP */
 632         selected = wpa_supplicant_select_bss_wpa(wpa_s, scan_res, group,
 633                                                  selected_ssid);
 634         if (selected)
 635                 return selected;
 636
 637         /* If no WPA-enabled AP found, try to find non-WPA AP, if configuration
 638          * allows this. */
 639         return wpa_supplicant_select_bss_non_wpa(wpa_s, scan_res, group,
 640                                                  selected_ssid);
 641 }
 642
 643
 644 static struct wpa_bss *
 645 wpa_supplicant_pick_network(struct wpa_supplicant *wpa_s,
 646                             struct wpa_scan_results *scan_res,
 647                             struct wpa_ssid **selected_ssid)
 648 {
 649         struct wpa_bss *selected = NULL;
 650         int prio;
 651
 652         while (selected == NULL) {
 653                 for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 654                         selected = wpa_supplicant_select_bss(
 655                                 wpa_s, scan_res, wpa_s->conf->pssid[prio],
 656                                 selected_ssid);
 657                         if (selected)
 658                                 break;
 659                 }
 660
 661                 if (selected == NULL && wpa_s->blacklist) {
 662                         wpa_printf(MSG_DEBUG, "No APs found - clear blacklist "
 663                                    "and try again");
 664                         wpa_blacklist_clear(wpa_s);
 665                         wpa_s->blacklist_cleared++;
 666                 } else if (selected == NULL)
 667                         break;
 668         }
 669
 670         return selected;
 671 }
 672
 673
 674 static void wpa_supplicant_req_new_scan(struct wpa_supplicant *wpa_s,
 675                                         int timeout)
 676 {
 677         if (wpa_s->scan_res_tried == 1 && wpa_s->conf->ap_scan == 1) {
 678                 /*
 679                  * Quick recovery if the initial scan results were not
 680                  * complete when fetched before the first scan request.
 681                  */
 682                 wpa_s->scan_res_tried++;
 683                 timeout = 0;
 684         } else if (!wpa_supplicant_enabled_networks(wpa_s->conf)) {
 685                 /*
 686                  * No networks are enabled; short-circuit request so
 687                  * we don't wait timeout seconds before transitioning
 688                  * to INACTIVE state.
 689                  */
 690                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 691                 return;
 692         }
 693         wpa_supplicant_req_scan(wpa_s, timeout, 0);
 694 }
 695
 696
 697 static void wpa_supplicant_connect(struct wpa_supplicant *wpa_s,
 698                                    struct wpa_bss *selected,
 699                                    struct wpa_ssid *ssid)
 700 {
 701         if (wpas_wps_scan_pbc_overlap(wpa_s, selected, ssid)) {
 702                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_OVERLAP
 703                         "PBC session overlap");
 704                 wpa_supplicant_req_new_scan(wpa_s, 10);
 705                 return;
 706         }
 707
 708         /*
 709          * Do not trigger new association unless the BSSID has changed or if
 710          * reassociation is requested. If we are in process of associating with
 711          * the selected BSSID, do not trigger new attempt.
 712          */
 713         if (wpa_s->reassociate ||
 714             (os_memcmp(selected->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
 715              (wpa_s->wpa_state != WPA_ASSOCIATING ||
 716               os_memcmp(selected->bssid, wpa_s->pending_bssid, ETH_ALEN) !=
 717               0))) {
 718                 if (wpa_supplicant_scard_init(wpa_s, ssid)) {
 719                         wpa_supplicant_req_new_scan(wpa_s, 10);
 720                         return;
 721                 }
 722                 wpa_supplicant_associate(wpa_s, selected, ssid);
 723         } else {
 724                 wpa_printf(MSG_DEBUG, "Already associated with the selected "
 725                            "AP");
 726         }
 727 }
 728
 729
 730 static struct wpa_ssid *
 731 wpa_supplicant_pick_new_network(struct wpa_supplicant *wpa_s)
 732 {
 733         int prio;
 734         struct wpa_ssid *ssid;
 735
 736         for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 737                 for (ssid = wpa_s->conf->pssid[prio]; ssid; ssid = ssid->pnext)
 738                 {
 739                         if (ssid->disabled)
 740                                 continue;
 741                         if (ssid->mode == IEEE80211_MODE_IBSS ||
 742                             ssid->mode == IEEE80211_MODE_AP)
 743                                 return ssid;
 744                 }
 745         }
 746         return NULL;
 747 }
 748
 749
 750 /* TODO: move the rsn_preauth_scan_result*() to be called from notify.c based
 751  * on BSS added and BSS changed events */
 752 static void wpa_supplicant_rsn_preauth_scan_results(
 753         struct wpa_supplicant *wpa_s, struct wpa_scan_results *scan_res)
 754 {
 755         int i;
 756
 757         if (rsn_preauth_scan_results(wpa_s->wpa) < 0)
 758                 return;
 759
 760         for (i = scan_res->num - 1; i >= 0; i--) {
 761                 const u8 *ssid, *rsn;
 762                 struct wpa_scan_res *r;
 763
 764                 r = scan_res->res[i];
 765
 766                 ssid = wpa_scan_get_ie(r, WLAN_EID_SSID);
 767                 if (ssid == NULL)
 768                         continue;
 769
 770                 rsn = wpa_scan_get_ie(r, WLAN_EID_RSN);
 771                 if (rsn == NULL)
 772                         continue;
 773
 774                 rsn_preauth_scan_result(wpa_s->wpa, r->bssid, ssid, rsn);
 775         }
 776
 777 }
 778
 779
 780 static int wpa_supplicant_need_to_roam(struct wpa_supplicant *wpa_s,
 781                                        struct wpa_bss *selected,
 782                                        struct wpa_ssid *ssid,
 783                                        struct wpa_scan_results *scan_res)
 784 {
 785         size_t i;
 786         struct wpa_scan_res *current_bss = NULL;
 787         int min_diff;
 788
 789         if (wpa_s->reassociate)
 790                 return 1; /* explicit request to reassociate */
 791         if (wpa_s->wpa_state < WPA_ASSOCIATED)
 792                 return 1; /* we are not associated; continue */
 793         if (wpa_s->current_ssid == NULL)
 794                 return 1; /* unknown current SSID */
 795         if (wpa_s->current_ssid != ssid)
 796                 return 1; /* different network block */
 797
 798         for (i = 0; i < scan_res->num; i++) {
 799                 struct wpa_scan_res *res = scan_res->res[i];
 800                 const u8 *ie;
 801                 if (os_memcmp(res->bssid, wpa_s->bssid, ETH_ALEN) != 0)
 802                         continue;
 803
 804                 ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
 805                 if (ie == NULL)
 806                         continue;
 807                 if (ie[1] != wpa_s->current_ssid->ssid_len ||
 808                     os_memcmp(ie + 2, wpa_s->current_ssid->ssid, ie[1]) != 0)
 809                         continue;
 810                 current_bss = res;
 811                 break;
 812         }
 813
 814         if (!current_bss)
 815                 return 1; /* current BSS not seen in scan results */
 816
 817         wpa_printf(MSG_DEBUG, "Considering within-ESS reassociation");
 818         wpa_printf(MSG_DEBUG, "Current BSS: " MACSTR " level=%d",
 819                    MAC2STR(current_bss->bssid), current_bss->level);
 820         wpa_printf(MSG_DEBUG, "Selected BSS: " MACSTR " level=%d",
 821                    MAC2STR(selected->bssid), selected->level);
 822
 823         min_diff = 2;
 824         if (current_bss->level < 0) {
 825                 if (current_bss->level < -85)
 826                         min_diff = 1;
 827                 else if (current_bss->level < -80)
 828                         min_diff = 2;
 829                 else if (current_bss->level < -75)
 830                         min_diff = 3;
 831                 else if (current_bss->level < -70)
 832                         min_diff = 4;
 833                 else
 834                         min_diff = 5;
 835         }
 836         if (abs(current_bss->level - selected->level) < min_diff) {
 837                 wpa_printf(MSG_DEBUG, "Skip roam - too small difference in "
 838                            "signal level");
 839                 return 0;
 840         }
 841
 842         return 1;
 843 }
 844
 845
 846 static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s,
 847                                               union wpa_event_data *data)
 848 {
 849         struct wpa_bss *selected;
 850         struct wpa_ssid *ssid = NULL;
 851         struct wpa_scan_results *scan_res;
 852
 853         wpa_supplicant_notify_scanning(wpa_s, 0);
 854
 855         scan_res = wpa_supplicant_get_scan_results(wpa_s,
 856                                                    data ? &data->scan_info :
 857                                                    NULL, 1);
 858         if (scan_res == NULL) {
 859                 if (wpa_s->conf->ap_scan == 2)
 860                         return;
 861                 wpa_printf(MSG_DEBUG, "Failed to get scan results - try "
 862                            "scanning again");
 863                 wpa_supplicant_req_new_scan(wpa_s, 1);
 864                 return;
 865         }
 866
 867         /*
 868          * Don't post the results if this was the initial cached
 869          * and there were no results.
 870          */
 871         if (wpa_s->scan_res_tried == 1 && wpa_s->conf->ap_scan == 1 &&
 872             scan_res->num == 0) {
 873                 wpa_msg(wpa_s, MSG_DEBUG, "Cached scan results are "
 874                         "empty - not posting");
 875         } else {
 876                 wpa_printf(MSG_DEBUG, "New scan results available");
 877                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
 878                 wpas_notify_scan_results(wpa_s);
 879         }
 880
 881         wpas_notify_scan_done(wpa_s, 1);
 882
 883         if ((wpa_s->conf->ap_scan == 2 && !wpas_wps_searching(wpa_s))) {
 884                 wpa_scan_results_free(scan_res);
 885                 return;
 886         }
 887
 888         if (wpa_s->disconnected) {
 889                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 890                 wpa_scan_results_free(scan_res);
 891                 return;
 892         }
 893
 894         if (bgscan_notify_scan(wpa_s) == 1) {
 895                 wpa_scan_results_free(scan_res);
 896                 return;
 897         }
 898
 899         wpa_supplicant_rsn_preauth_scan_results(wpa_s, scan_res);
 900
 901         selected = wpa_supplicant_pick_network(wpa_s, scan_res, &ssid);
 902
 903         if (selected) {
 904                 int skip;
 905                 skip = !wpa_supplicant_need_to_roam(wpa_s, selected, ssid,
 906                                                     scan_res);
 907                 wpa_scan_results_free(scan_res);
 908                 if (skip)
 909                         return;
 910                 wpa_supplicant_connect(wpa_s, selected, ssid);
 911         } else {
 912                 wpa_scan_results_free(scan_res);
 913                 wpa_printf(MSG_DEBUG, "No suitable network found");
 914                 ssid = wpa_supplicant_pick_new_network(wpa_s);
 915                 if (ssid) {
 916                         wpa_printf(MSG_DEBUG, "Setup a new network");
 917                         wpa_supplicant_associate(wpa_s, NULL, ssid);
 918                 } else
 919                         wpa_supplicant_req_new_scan(wpa_s, 5);
 920         }
 921 }
 922 #endif /* CONFIG_NO_SCAN_PROCESSING */
 923
 924
 925 #ifdef CONFIG_IEEE80211R
 926 static void wpa_assoc_set_ft_params(struct wpa_supplicant *wpa_s,
 927                                     const u8 *ftie, const u8 *mdie)
 928 {
 929         const u8 *mobility_domain = NULL;
 930         const u8 *r0kh_id = NULL;
 931         size_t r0kh_id_len = 0;
 932         const u8 *r1kh_id = NULL;
 933         struct rsn_ftie *hdr;
 934         const u8 *pos, *end;
 935
 936         if (mdie == NULL || ftie == NULL)
 937                 return;
 938
 939         if (mdie[1] >= MOBILITY_DOMAIN_ID_LEN) {
 940                 mobility_domain = mdie + 2;
 941 #ifdef CONFIG_SME
 942                 wpa_s->sme.ft_used = 1;
 943                 os_memcpy(wpa_s->sme.mobility_domain, mobility_domain, 2);
 944 #endif /* CONFIG_SME */
 945         }
 946         if (ftie[1] >= sizeof(struct rsn_ftie)) {
 947                 end = ftie + 2 + ftie[1];
 948                 hdr = (struct rsn_ftie *) (ftie + 2);
 949                 pos = (const u8 *) (hdr + 1);
 950                 while (pos + 1 < end) {
 951                         if (pos + 2 + pos[1] > end)
 952                                 break;
 953                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
 954                             pos[1] == FT_R1KH_ID_LEN)
 955                                 r1kh_id = pos + 2;
 956                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
 957                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
 958                                 r0kh_id = pos + 2;
 959                                 r0kh_id_len = pos[1];
 960                         }
 961                         pos += 2 + pos[1];
 962                 }
 963         }
 964         wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
 965                              r0kh_id_len, r1kh_id);
 966 }
 967 #endif /* CONFIG_IEEE80211R */
 968
 969 static void wpa_supplicant_event_associnfo(struct wpa_supplicant *wpa_s,
 970                                            union wpa_event_data *data)
 971 {
 972         int l, len, found = 0, wpa_found, rsn_found;
 973         const u8 *p;
 974 #ifdef CONFIG_IEEE80211R
 975         const u8 *mdie = NULL, *ftie = NULL;
 976 #endif /* CONFIG_IEEE80211R */
 977
 978         wpa_printf(MSG_DEBUG, "Association info event");
 979         if (data->assoc_info.req_ies)
 980                 wpa_hexdump(MSG_DEBUG, "req_ies", data->assoc_info.req_ies,
 981                             data->assoc_info.req_ies_len);
 982         if (data->assoc_info.resp_ies)
 983                 wpa_hexdump(MSG_DEBUG, "resp_ies", data->assoc_info.resp_ies,
 984                             data->assoc_info.resp_ies_len);
 985         if (data->assoc_info.beacon_ies)
 986                 wpa_hexdump(MSG_DEBUG, "beacon_ies",
 987                             data->assoc_info.beacon_ies,
 988                             data->assoc_info.beacon_ies_len);
 989         if (data->assoc_info.freq)
 990                 wpa_printf(MSG_DEBUG, "freq=%u MHz", data->assoc_info.freq);
 991
 992         p = data->assoc_info.req_ies;
 993         l = data->assoc_info.req_ies_len;
 994
 995         /* Go through the IEs and make a copy of the WPA/RSN IE, if present. */
 996         while (p && l >= 2) {
 997                 len = p[1] + 2;
 998                 if (len > l) {
 999                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
1000                                     p, l);
1001                         break;
1002                 }
1003                 if ((p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
1004                      (os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0)) ||
1005                     (p[0] == WLAN_EID_RSN && p[1] >= 2)) {
1006                         if (wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, p, len))
1007                                 break;
1008                         found = 1;
1009                         wpa_find_assoc_pmkid(wpa_s);
1010                         break;
1011                 }
1012                 l -= len;
1013                 p += len;
1014         }
1015         if (!found && data->assoc_info.req_ies)
1016                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1017
1018 #ifdef CONFIG_IEEE80211R
1019         p = data->assoc_info.resp_ies;
1020         l = data->assoc_info.resp_ies_len;
1021
1022         /* Go through the IEs and make a copy of the FT/MD IE, if present. */
1023         while (p && l >= 2) {
1024                 len = p[1] + 2;
1025                 if (len > l) {
1026                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
1027                                     p, l);
1028                         break;
1029                 }
1030                 if (p[0] == WLAN_EID_FAST_BSS_TRANSITION)
1031                         ftie = p;
1032                 else if (p[0] == WLAN_EID_MOBILITY_DOMAIN)
1033                         mdie = p;
1034                 l -= len;
1035                 p += len;
1036         }
1037
1038         wpa_assoc_set_ft_params(wpa_s, ftie, mdie);
1039 #endif /* CONFIG_IEEE80211R */
1040
1041         /* WPA/RSN IE from Beacon/ProbeResp */
1042         p = data->assoc_info.beacon_ies;
1043         l = data->assoc_info.beacon_ies_len;
1044
1045         /* Go through the IEs and make a copy of the WPA/RSN IEs, if present.
1046          */
1047         wpa_found = rsn_found = 0;
1048         while (p && l >= 2) {
1049                 len = p[1] + 2;
1050                 if (len > l) {
1051                         wpa_hexdump(MSG_DEBUG, "Truncated IE in beacon_ies",
1052                                     p, l);
1053                         break;
1054                 }
1055                 if (!wpa_found &&
1056                     p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
1057                     os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0) {
1058                         wpa_found = 1;
1059                         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, p, len);
1060                 }
1061
1062                 if (!rsn_found &&
1063                     p[0] == WLAN_EID_RSN && p[1] >= 2) {
1064                         rsn_found = 1;
1065                         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, p, len);
1066                 }
1067
1068                 l -= len;
1069                 p += len;
1070         }
1071
1072         if (!wpa_found && data->assoc_info.beacon_ies)
1073                 wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
1074         if (!rsn_found && data->assoc_info.beacon_ies)
1075                 wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
1076         if (wpa_found || rsn_found)
1077                 wpa_s->ap_ies_from_associnfo = 1;
1078
1079         wpa_s->assoc_freq = data->assoc_info.freq;
1080 }
1081
1082
1083 static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
1084                                        union wpa_event_data *data)
1085 {
1086         u8 bssid[ETH_ALEN];
1087         int ft_completed;
1088         int bssid_changed;
1089         struct wpa_driver_capa capa;
1090
1091 #ifdef CONFIG_AP
1092         if (wpa_s->ap_iface) {
1093                 hostapd_notif_assoc(wpa_s->ap_iface->bss[0],
1094                                     data->assoc_info.addr,
1095                                     data->assoc_info.req_ies,
1096                                     data->assoc_info.req_ies_len);
1097                 return;
1098         }
1099 #endif /* CONFIG_AP */
1100
1101         ft_completed = wpa_ft_is_completed(wpa_s->wpa);
1102         if (data)
1103                 wpa_supplicant_event_associnfo(wpa_s, data);
1104
1105         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATED);
1106         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME)
1107                 os_memcpy(bssid, wpa_s->bssid, ETH_ALEN);
1108         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME) ||
1109             (wpa_drv_get_bssid(wpa_s, bssid) >= 0 &&
1110              os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)) {
1111                 wpa_msg(wpa_s, MSG_DEBUG, "Associated to a new BSS: BSSID="
1112                         MACSTR, MAC2STR(bssid));
1113                 bssid_changed = os_memcmp(wpa_s->bssid, bssid, ETH_ALEN);
1114                 os_memcpy(wpa_s->bssid, bssid, ETH_ALEN);
1115                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1116                 if (bssid_changed)
1117                         wpas_notify_bssid_changed(wpa_s);
1118
1119                 if (wpa_supplicant_dynamic_keys(wpa_s) && !ft_completed) {
1120                         wpa_clear_keys(wpa_s, bssid);
1121                 }
1122                 if (wpa_supplicant_select_config(wpa_s) < 0) {
1123                         wpa_supplicant_disassociate(
1124                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
1125                         return;
1126                 }
1127                 if (wpa_s->current_ssid) {
1128                         struct wpa_bss *bss = NULL;
1129                         struct wpa_ssid *ssid = wpa_s->current_ssid;
1130                         if (ssid->ssid_len > 0)
1131                                 bss = wpa_bss_get(wpa_s, bssid,
1132                                                   ssid->ssid, ssid->ssid_len);
1133                         if (!bss)
1134                                 bss = wpa_bss_get_bssid(wpa_s, bssid);
1135                         if (bss)
1136                                 wpa_s->current_bss = bss;
1137                 }
1138         }
1139
1140 #ifdef CONFIG_SME
1141         os_memcpy(wpa_s->sme.prev_bssid, bssid, ETH_ALEN);
1142         wpa_s->sme.prev_bssid_set = 1;
1143 #endif /* CONFIG_SME */
1144
1145         wpa_msg(wpa_s, MSG_INFO, "Associated with " MACSTR, MAC2STR(bssid));
1146         if (wpa_s->current_ssid) {
1147                 /* When using scanning (ap_scan=1), SIM PC/SC interface can be
1148                  * initialized before association, but for other modes,
1149                  * initialize PC/SC here, if the current configuration needs
1150                  * smartcard or SIM/USIM. */
1151                 wpa_supplicant_scard_init(wpa_s, wpa_s->current_ssid);
1152         }
1153         wpa_sm_notify_assoc(wpa_s->wpa, bssid);
1154         l2_packet_notify_auth_start(wpa_s->l2);
1155
1156         /*
1157          * Set portEnabled first to FALSE in order to get EAP state machine out
1158          * of the SUCCESS state and eapSuccess cleared. Without this, EAPOL PAE
1159          * state machine may transit to AUTHENTICATING state based on obsolete
1160          * eapSuccess and then trigger BE_AUTH to SUCCESS and PAE to
1161          * AUTHENTICATED without ever giving chance to EAP state machine to
1162          * reset the state.
1163          */
1164         if (!ft_completed) {
1165                 eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
1166                 eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
1167         }
1168         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) || ft_completed)
1169                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
1170         /* 802.1X::portControl = Auto */
1171         eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE);
1172         wpa_s->eapol_received = 0;
1173         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1174             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE ||
1175             (wpa_s->current_ssid &&
1176              wpa_s->current_ssid->mode == IEEE80211_MODE_IBSS)) {
1177                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1178                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1179         } else if (!ft_completed) {
1180                 /* Timeout for receiving the first EAPOL packet */
1181                 wpa_supplicant_req_auth_timeout(wpa_s, 10, 0);
1182         }
1183         wpa_supplicant_cancel_scan(wpa_s);
1184
1185         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
1186             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1187                 /*
1188                  * We are done; the driver will take care of RSN 4-way
1189                  * handshake.
1190                  */
1191                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1192                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1193                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
1194                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
1195         }
1196
1197         if (wpa_s->pending_eapol_rx) {
1198                 struct os_time now, age;
1199                 os_get_time(&now);
1200                 os_time_sub(&now, &wpa_s->pending_eapol_rx_time, &age);
1201                 if (age.sec == 0 && age.usec < 100000 &&
1202                     os_memcmp(wpa_s->pending_eapol_rx_src, bssid, ETH_ALEN) ==
1203                     0) {
1204                         wpa_printf(MSG_DEBUG, "Process pending EAPOL frame "
1205                                    "that was received just before association "
1206                                    "notification");
1207                         wpa_supplicant_rx_eapol(
1208                                 wpa_s, wpa_s->pending_eapol_rx_src,
1209                                 wpabuf_head(wpa_s->pending_eapol_rx),
1210                                 wpabuf_len(wpa_s->pending_eapol_rx));
1211                 }
1212                 wpabuf_free(wpa_s->pending_eapol_rx);
1213                 wpa_s->pending_eapol_rx = NULL;
1214         }
1215
1216 #ifdef CONFIG_BGSCAN
1217         if (wpa_s->current_ssid != wpa_s->bgscan_ssid) {
1218                 bgscan_deinit(wpa_s);
1219                 if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan) {
1220                         if (bgscan_init(wpa_s, wpa_s->current_ssid)) {
1221                                 wpa_printf(MSG_DEBUG, "Failed to initialize "
1222                                            "bgscan");
1223                                 /*
1224                                  * Live without bgscan; it is only used as a
1225                                  * roaming optimization, so the initial
1226                                  * connection is not affected.
1227                                  */
1228                         } else
1229                                 wpa_s->bgscan_ssid = wpa_s->current_ssid;
1230                 } else
1231                         wpa_s->bgscan_ssid = NULL;
1232         }
1233 #endif /* CONFIG_BGSCAN */
1234
1235         if ((wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1236              wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
1237             wpa_s->current_ssid && wpa_drv_get_capa(wpa_s, &capa) == 0 &&
1238             capa.flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE) {
1239                 /* Set static WEP keys again */
1240                 wpa_set_wep_keys(wpa_s, wpa_s->current_ssid);
1241         }
1242 }
1243
1244
1245 static void wpa_supplicant_event_disassoc(struct wpa_supplicant *wpa_s)
1246 {
1247         const u8 *bssid;
1248 #ifdef CONFIG_SME
1249         int authenticating;
1250         u8 prev_pending_bssid[ETH_ALEN];
1251
1252         authenticating = wpa_s->wpa_state == WPA_AUTHENTICATING;
1253         os_memcpy(prev_pending_bssid, wpa_s->pending_bssid, ETH_ALEN);
1254 #endif /* CONFIG_SME */
1255
1256         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
1257                 /*
1258                  * At least Host AP driver and a Prism3 card seemed to be
1259                  * generating streams of disconnected events when configuring
1260                  * IBSS for WPA-None. Ignore them for now.
1261                  */
1262                 wpa_printf(MSG_DEBUG, "Disconnect event - ignore in "
1263                            "IBSS/WPA-None mode");
1264                 return;
1265         }
1266
1267         if (wpa_s->wpa_state == WPA_4WAY_HANDSHAKE &&
1268             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1269                 wpa_msg(wpa_s, MSG_INFO, "WPA: 4-Way Handshake failed - "
1270                         "pre-shared key may be incorrect");
1271         }
1272         if (wpa_s->wpa_state >= WPA_ASSOCIATED)
1273                 wpa_supplicant_req_scan(wpa_s, 0, 100000);
1274         bssid = wpa_s->bssid;
1275         if (is_zero_ether_addr(bssid))
1276                 bssid = wpa_s->pending_bssid;
1277         wpa_blacklist_add(wpa_s, bssid);
1278         wpa_sm_notify_disassoc(wpa_s->wpa);
1279         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "- Disconnect event - "
1280                 "remove keys");
1281         if (wpa_supplicant_dynamic_keys(wpa_s)) {
1282                 wpa_s->keys_cleared = 0;
1283                 wpa_clear_keys(wpa_s, wpa_s->bssid);
1284         }
1285         wpa_supplicant_mark_disassoc(wpa_s);
1286         bgscan_deinit(wpa_s);
1287 #ifdef CONFIG_SME
1288         if (authenticating &&
1289             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)) {
1290                 /*
1291                  * mac80211-workaround to force deauth on failed auth cmd,
1292                  * requires us to remain in authenticating state to allow the
1293                  * second authentication attempt to be continued properly.
1294                  */
1295                 wpa_printf(MSG_DEBUG, "SME: Allow pending authentication to "
1296                            "proceed after disconnection event");
1297                 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1298                 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
1299         }
1300 #endif /* CONFIG_SME */
1301 }
1302
1303
1304 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1305 static void wpa_supplicant_delayed_mic_error_report(void *eloop_ctx,
1306                                                     void *sock_ctx)
1307 {
1308         struct wpa_supplicant *wpa_s = eloop_ctx;
1309
1310         if (!wpa_s->pending_mic_error_report)
1311                 return;
1312
1313         wpa_printf(MSG_DEBUG, "WPA: Sending pending MIC error report");
1314         wpa_sm_key_request(wpa_s->wpa, 1, wpa_s->pending_mic_error_pairwise);
1315         wpa_s->pending_mic_error_report = 0;
1316 }
1317 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1318
1319
1320 static void
1321 wpa_supplicant_event_michael_mic_failure(struct wpa_supplicant *wpa_s,
1322                                          union wpa_event_data *data)
1323 {
1324         int pairwise;
1325         struct os_time t;
1326
1327         wpa_msg(wpa_s, MSG_WARNING, "Michael MIC failure detected");
1328         pairwise = (data && data->michael_mic_failure.unicast);
1329         os_get_time(&t);
1330         if ((wpa_s->last_michael_mic_error &&
1331              t.sec - wpa_s->last_michael_mic_error <= 60) ||
1332             wpa_s->pending_mic_error_report) {
1333                 if (wpa_s->pending_mic_error_report) {
1334                         /*
1335                          * Send the pending MIC error report immediately since
1336                          * we are going to start countermeasures and AP better
1337                          * do the same.
1338                          */
1339                         wpa_sm_key_request(wpa_s->wpa, 1,
1340                                            wpa_s->pending_mic_error_pairwise);
1341                 }
1342
1343                 /* Send the new MIC error report immediately since we are going
1344                  * to start countermeasures and AP better do the same.
1345                  */
1346                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1347
1348                 /* initialize countermeasures */
1349                 wpa_s->countermeasures = 1;
1350                 wpa_msg(wpa_s, MSG_WARNING, "TKIP countermeasures started");
1351
1352                 /*
1353                  * Need to wait for completion of request frame. We do not get
1354                  * any callback for the message completion, so just wait a
1355                  * short while and hope for the best. */
1356                 os_sleep(0, 10000);
1357
1358                 wpa_drv_set_countermeasures(wpa_s, 1);
1359                 wpa_supplicant_deauthenticate(wpa_s,
1360                                               WLAN_REASON_MICHAEL_MIC_FAILURE);
1361                 eloop_cancel_timeout(wpa_supplicant_stop_countermeasures,
1362                                      wpa_s, NULL);
1363                 eloop_register_timeout(60, 0,
1364                                        wpa_supplicant_stop_countermeasures,
1365                                        wpa_s, NULL);
1366                 /* TODO: mark the AP rejected for 60 second. STA is
1367                  * allowed to associate with another AP.. */
1368         } else {
1369 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1370                 if (wpa_s->mic_errors_seen) {
1371                         /*
1372                          * Reduce the effectiveness of Michael MIC error
1373                          * reports as a means for attacking against TKIP if
1374                          * more than one MIC failure is noticed with the same
1375                          * PTK. We delay the transmission of the reports by a
1376                          * random time between 0 and 60 seconds in order to
1377                          * force the attacker wait 60 seconds before getting
1378                          * the information on whether a frame resulted in a MIC
1379                          * failure.
1380                          */
1381                         u8 rval[4];
1382                         int sec;
1383
1384                         if (os_get_random(rval, sizeof(rval)) < 0)
1385                                 sec = os_random() % 60;
1386                         else
1387                                 sec = WPA_GET_BE32(rval) % 60;
1388                         wpa_printf(MSG_DEBUG, "WPA: Delay MIC error report %d "
1389                                    "seconds", sec);
1390                         wpa_s->pending_mic_error_report = 1;
1391                         wpa_s->pending_mic_error_pairwise = pairwise;
1392                         eloop_cancel_timeout(
1393                                 wpa_supplicant_delayed_mic_error_report,
1394                                 wpa_s, NULL);
1395                         eloop_register_timeout(
1396                                 sec, os_random() % 1000000,
1397                                 wpa_supplicant_delayed_mic_error_report,
1398                                 wpa_s, NULL);
1399                 } else {
1400                         wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1401                 }
1402 #else /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1403                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1404 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1405         }
1406         wpa_s->last_michael_mic_error = t.sec;
1407         wpa_s->mic_errors_seen++;
1408 }
1409
1410
1411 #ifdef CONFIG_TERMINATE_ONLASTIF
1412 static int any_interfaces(struct wpa_supplicant *head)
1413 {
1414         struct wpa_supplicant *wpa_s;
1415
1416         for (wpa_s = head; wpa_s != NULL; wpa_s = wpa_s->next)
1417                 if (!wpa_s->interface_removed)
1418                         return 1;
1419         return 0;
1420 }
1421 #endif /* CONFIG_TERMINATE_ONLASTIF */
1422
1423
1424 static void
1425 wpa_supplicant_event_interface_status(struct wpa_supplicant *wpa_s,
1426                                       union wpa_event_data *data)
1427 {
1428         if (os_strcmp(wpa_s->ifname, data->interface_status.ifname) != 0)
1429                 return;
1430
1431         switch (data->interface_status.ievent) {
1432         case EVENT_INTERFACE_ADDED:
1433                 if (!wpa_s->interface_removed)
1434                         break;
1435                 wpa_s->interface_removed = 0;
1436                 wpa_printf(MSG_DEBUG, "Configured interface was added.");
1437                 if (wpa_supplicant_driver_init(wpa_s) < 0) {
1438                         wpa_printf(MSG_INFO, "Failed to initialize the driver "
1439                                    "after interface was added.");
1440                 }
1441                 break;
1442         case EVENT_INTERFACE_REMOVED:
1443                 wpa_printf(MSG_DEBUG, "Configured interface was removed.");
1444                 wpa_s->interface_removed = 1;
1445                 wpa_supplicant_mark_disassoc(wpa_s);
1446                 l2_packet_deinit(wpa_s->l2);
1447                 wpa_s->l2 = NULL;
1448 #ifdef CONFIG_TERMINATE_ONLASTIF
1449                 /* check if last interface */
1450                 if (!any_interfaces(wpa_s->global->ifaces))
1451                         eloop_terminate();
1452 #endif /* CONFIG_TERMINATE_ONLASTIF */
1453                 break;
1454         }
1455 }
1456
1457
1458 #ifdef CONFIG_PEERKEY
1459 static void
1460 wpa_supplicant_event_stkstart(struct wpa_supplicant *wpa_s,
1461                               union wpa_event_data *data)
1462 {
1463         if (data == NULL)
1464                 return;
1465         wpa_sm_stkstart(wpa_s->wpa, data->stkstart.peer);
1466 }
1467 #endif /* CONFIG_PEERKEY */
1468
1469
1470 #ifdef CONFIG_IEEE80211R
1471 static void
1472 wpa_supplicant_event_ft_response(struct wpa_supplicant *wpa_s,
1473                                  union wpa_event_data *data)
1474 {
1475         if (data == NULL)
1476                 return;
1477
1478         if (wpa_ft_process_response(wpa_s->wpa, data->ft_ies.ies,
1479                                     data->ft_ies.ies_len,
1480                                     data->ft_ies.ft_action,
1481                                     data->ft_ies.target_ap,
1482                                     data->ft_ies.ric_ies,
1483                                     data->ft_ies.ric_ies_len) < 0) {
1484                 /* TODO: prevent MLME/driver from trying to associate? */
1485         }
1486 }
1487 #endif /* CONFIG_IEEE80211R */
1488
1489
1490 #ifdef CONFIG_IBSS_RSN
1491 static void wpa_supplicant_event_ibss_rsn_start(struct wpa_supplicant *wpa_s,
1492                                                 union wpa_event_data *data)
1493 {
1494         if (data == NULL)
1495                 return;
1496         ibss_rsn_start(wpa_s->ibss_rsn, data->ibss_rsn_start.peer);
1497 }
1498 #endif /* CONFIG_IBSS_RSN */
1499
1500
1501 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
1502                           union wpa_event_data *data)
1503 {
1504         struct wpa_supplicant *wpa_s = ctx;
1505
1506         switch (event) {
1507         case EVENT_AUTH:
1508                 sme_event_auth(wpa_s, data);
1509                 break;
1510         case EVENT_ASSOC:
1511                 wpa_supplicant_event_assoc(wpa_s, data);
1512                 break;
1513         case EVENT_DISASSOC:
1514                 wpa_printf(MSG_DEBUG, "Disassociation notification");
1515 #ifdef CONFIG_AP
1516                 if (wpa_s->ap_iface && data) {
1517                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1518                                                data->disassoc_info.addr);
1519                         break;
1520                 }
1521 #endif /* CONFIG_AP */
1522                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
1523                         sme_event_disassoc(wpa_s, data);
1524                 /* fall through */
1525         case EVENT_DEAUTH:
1526                 if (event == EVENT_DEAUTH)
1527                         wpa_printf(MSG_DEBUG, "Deauthentication notification");
1528 #ifdef CONFIG_AP
1529                 if (wpa_s->ap_iface && data) {
1530                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1531                                                data->deauth_info.addr);
1532                         break;
1533                 }
1534 #endif /* CONFIG_AP */
1535                 wpa_supplicant_event_disassoc(wpa_s);
1536                 break;
1537         case EVENT_MICHAEL_MIC_FAILURE:
1538                 wpa_supplicant_event_michael_mic_failure(wpa_s, data);
1539                 break;
1540 #ifndef CONFIG_NO_SCAN_PROCESSING
1541         case EVENT_SCAN_RESULTS:
1542                 wpa_supplicant_event_scan_results(wpa_s, data);
1543                 break;
1544 #endif /* CONFIG_NO_SCAN_PROCESSING */
1545         case EVENT_ASSOCINFO:
1546                 wpa_supplicant_event_associnfo(wpa_s, data);
1547                 break;
1548         case EVENT_INTERFACE_STATUS:
1549                 wpa_supplicant_event_interface_status(wpa_s, data);
1550                 break;
1551         case EVENT_PMKID_CANDIDATE:
1552                 wpa_supplicant_event_pmkid_candidate(wpa_s, data);
1553                 break;
1554 #ifdef CONFIG_PEERKEY
1555         case EVENT_STKSTART:
1556                 wpa_supplicant_event_stkstart(wpa_s, data);
1557                 break;
1558 #endif /* CONFIG_PEERKEY */
1559 #ifdef CONFIG_IEEE80211R
1560         case EVENT_FT_RESPONSE:
1561                 wpa_supplicant_event_ft_response(wpa_s, data);
1562                 break;
1563 #endif /* CONFIG_IEEE80211R */
1564 #ifdef CONFIG_IBSS_RSN
1565         case EVENT_IBSS_RSN_START:
1566                 wpa_supplicant_event_ibss_rsn_start(wpa_s, data);
1567                 break;
1568 #endif /* CONFIG_IBSS_RSN */
1569         case EVENT_ASSOC_REJECT:
1570                 sme_event_assoc_reject(wpa_s, data);
1571                 break;
1572         case EVENT_AUTH_TIMED_OUT:
1573                 sme_event_auth_timed_out(wpa_s, data);
1574                 break;
1575         case EVENT_ASSOC_TIMED_OUT:
1576                 sme_event_assoc_timed_out(wpa_s, data);
1577                 break;
1578 #ifdef CONFIG_AP
1579         case EVENT_TX_STATUS:
1580                 if (wpa_s->ap_iface == NULL)
1581                         break;
1582                 switch (data->tx_status.type) {
1583                 case WLAN_FC_TYPE_MGMT:
1584                         ap_mgmt_tx_cb(wpa_s, data->tx_status.data,
1585                                       data->tx_status.data_len,
1586                                       data->tx_status.stype,
1587                                       data->tx_status.ack);
1588                         break;
1589                 case WLAN_FC_TYPE_DATA:
1590                         ap_tx_status(wpa_s, data->tx_status.dst,
1591                                      data->tx_status.data,
1592                                      data->tx_status.data_len,
1593                                      data->tx_status.ack);
1594                         break;
1595                 }
1596                 break;
1597         case EVENT_RX_FROM_UNKNOWN:
1598                 if (wpa_s->ap_iface == NULL)
1599                         break;
1600                 ap_rx_from_unknown_sta(wpa_s, data->rx_from_unknown.frame,
1601                                        data->rx_from_unknown.len);
1602                 break;
1603         case EVENT_RX_MGMT:
1604                 if (wpa_s->ap_iface == NULL)
1605                         break;
1606                 ap_mgmt_rx(wpa_s, &data->rx_mgmt);
1607                 break;
1608 #endif /* CONFIG_AP */
1609 #ifdef CONFIG_CLIENT_MLME
1610         case EVENT_MLME_RX: {
1611                 struct ieee80211_rx_status rx_status;
1612                 os_memset(&rx_status, 0, sizeof(rx_status));
1613                 rx_status.freq = data->mlme_rx.freq;
1614                 rx_status.channel = data->mlme_rx.channel;
1615                 rx_status.ssi = data->mlme_rx.ssi;
1616                 ieee80211_sta_rx(wpa_s, data->mlme_rx.buf, data->mlme_rx.len,
1617                                  &rx_status);
1618                 break;
1619         }
1620 #endif /* CONFIG_CLIENT_MLME */
1621         case EVENT_EAPOL_RX:
1622                 wpa_supplicant_rx_eapol(wpa_s, data->eapol_rx.src,
1623                                         data->eapol_rx.data,
1624                                         data->eapol_rx.data_len);
1625                 break;
1626         default:
1627                 wpa_printf(MSG_INFO, "Unknown event %d", event);
1628                 break;
1629         }
1630 }