wpa_supplicant/events.c

   1 /*
   2  * WPA Supplicant - Driver event processing
   3  * Copyright (c) 2003-2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "rsn_supp/wpa.h"
  20 #include "eloop.h"
  21 #include "config.h"
  22 #include "l2_packet/l2_packet.h"
  23 #include "wpa_supplicant_i.h"
  24 #include "driver_i.h"
  25 #include "pcsc_funcs.h"
  26 #include "rsn_supp/preauth.h"
  27 #include "rsn_supp/pmksa_cache.h"
  28 #include "common/wpa_ctrl.h"
  29 #include "eap_peer/eap.h"
  30 #include "ap/hostapd.h"
  31 #include "p2p/p2p.h"
  32 #include "notify.h"
  33 #include "common/ieee802_11_defs.h"
  34 #include "common/ieee802_11_common.h"
  35 #include "blacklist.h"
  36 #include "wpas_glue.h"
  37 #include "wps_supplicant.h"
  38 #include "ibss_rsn.h"
  39 #include "sme.h"
  40 #include "p2p_supplicant.h"
  41 #include "bgscan.h"
  42 #include "ap.h"
  43 #include "bss.h"
  44 #include "mlme.h"
  45 #include "scan.h"
  46
  47
  48 static int wpa_supplicant_select_config(struct wpa_supplicant *wpa_s)
  49 {
  50         struct wpa_ssid *ssid, *old_ssid;
  51
  52         if (wpa_s->conf->ap_scan == 1 && wpa_s->current_ssid)
  53                 return 0;
  54
  55         wpa_printf(MSG_DEBUG, "Select network based on association "
  56                    "information");
  57         ssid = wpa_supplicant_get_ssid(wpa_s);
  58         if (ssid == NULL) {
  59                 wpa_printf(MSG_INFO, "No network configuration found for the "
  60                            "current AP");
  61                 return -1;
  62         }
  63
  64         if (ssid->disabled) {
  65                 wpa_printf(MSG_DEBUG, "Selected network is disabled");
  66                 return -1;
  67         }
  68
  69         wpa_printf(MSG_DEBUG, "Network configuration found for the current "
  70                    "AP");
  71         if (ssid->key_mgmt & (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_IEEE8021X |
  72                               WPA_KEY_MGMT_WPA_NONE |
  73                               WPA_KEY_MGMT_FT_PSK | WPA_KEY_MGMT_FT_IEEE8021X |
  74                               WPA_KEY_MGMT_PSK_SHA256 |
  75                               WPA_KEY_MGMT_IEEE8021X_SHA256)) {
  76                 u8 wpa_ie[80];
  77                 size_t wpa_ie_len = sizeof(wpa_ie);
  78                 wpa_supplicant_set_suites(wpa_s, NULL, ssid,
  79                                           wpa_ie, &wpa_ie_len);
  80         } else {
  81                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
  82         }
  83
  84         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid)
  85                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
  86         old_ssid = wpa_s->current_ssid;
  87         wpa_s->current_ssid = ssid;
  88         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
  89         wpa_supplicant_initiate_eapol(wpa_s);
  90         if (old_ssid != wpa_s->current_ssid)
  91                 wpas_notify_network_changed(wpa_s);
  92
  93         return 0;
  94 }
  95
  96
  97 static void wpa_supplicant_stop_countermeasures(void *eloop_ctx,
  98                                                 void *sock_ctx)
  99 {
 100         struct wpa_supplicant *wpa_s = eloop_ctx;
 101
 102         if (wpa_s->countermeasures) {
 103                 wpa_s->countermeasures = 0;
 104                 wpa_drv_set_countermeasures(wpa_s, 0);
 105                 wpa_msg(wpa_s, MSG_INFO, "WPA: TKIP countermeasures stopped");
 106                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 107         }
 108 }
 109
 110
 111 void wpa_supplicant_mark_disassoc(struct wpa_supplicant *wpa_s)
 112 {
 113         int bssid_changed;
 114
 115         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED)
 116                 return;
 117
 118         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 119         bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
 120         os_memset(wpa_s->bssid, 0, ETH_ALEN);
 121         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
 122         wpa_s->current_bss = NULL;
 123         if (bssid_changed)
 124                 wpas_notify_bssid_changed(wpa_s);
 125
 126         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
 127         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
 128         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt))
 129                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 130         wpa_s->ap_ies_from_associnfo = 0;
 131 }
 132
 133
 134 static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s)
 135 {
 136         struct wpa_ie_data ie;
 137         int pmksa_set = -1;
 138         size_t i;
 139
 140         if (wpa_sm_parse_own_wpa_ie(wpa_s->wpa, &ie) < 0 ||
 141             ie.pmkid == NULL)
 142                 return;
 143
 144         for (i = 0; i < ie.num_pmkid; i++) {
 145                 pmksa_set = pmksa_cache_set_current(wpa_s->wpa,
 146                                                     ie.pmkid + i * PMKID_LEN,
 147                                                     NULL, NULL, 0);
 148                 if (pmksa_set == 0) {
 149                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
 150                         break;
 151                 }
 152         }
 153
 154         wpa_printf(MSG_DEBUG, "RSN: PMKID from assoc IE %sfound from PMKSA "
 155                    "cache", pmksa_set == 0 ? "" : "not ");
 156 }
 157
 158
 159 static void wpa_supplicant_event_pmkid_candidate(struct wpa_supplicant *wpa_s,
 160                                                  union wpa_event_data *data)
 161 {
 162         if (data == NULL) {
 163                 wpa_printf(MSG_DEBUG, "RSN: No data in PMKID candidate event");
 164                 return;
 165         }
 166         wpa_printf(MSG_DEBUG, "RSN: PMKID candidate event - bssid=" MACSTR
 167                    " index=%d preauth=%d",
 168                    MAC2STR(data->pmkid_candidate.bssid),
 169                    data->pmkid_candidate.index,
 170                    data->pmkid_candidate.preauth);
 171
 172         pmksa_candidate_add(wpa_s->wpa, data->pmkid_candidate.bssid,
 173                             data->pmkid_candidate.index,
 174                             data->pmkid_candidate.preauth);
 175 }
 176
 177
 178 static int wpa_supplicant_dynamic_keys(struct wpa_supplicant *wpa_s)
 179 {
 180         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 181             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 182                 return 0;
 183
 184 #ifdef IEEE8021X_EAPOL
 185         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 186             wpa_s->current_ssid &&
 187             !(wpa_s->current_ssid->eapol_flags &
 188               (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 189                EAPOL_FLAG_REQUIRE_KEY_BROADCAST))) {
 190                 /* IEEE 802.1X, but not using dynamic WEP keys (i.e., either
 191                  * plaintext or static WEP keys). */
 192                 return 0;
 193         }
 194 #endif /* IEEE8021X_EAPOL */
 195
 196         return 1;
 197 }
 198
 199
 200 /**
 201  * wpa_supplicant_scard_init - Initialize SIM/USIM access with PC/SC
 202  * @wpa_s: pointer to wpa_supplicant data
 203  * @ssid: Configuration data for the network
 204  * Returns: 0 on success, -1 on failure
 205  *
 206  * This function is called when starting authentication with a network that is
 207  * configured to use PC/SC for SIM/USIM access (EAP-SIM or EAP-AKA).
 208  */
 209 int wpa_supplicant_scard_init(struct wpa_supplicant *wpa_s,
 210                               struct wpa_ssid *ssid)
 211 {
 212 #ifdef IEEE8021X_EAPOL
 213         int aka = 0, sim = 0, type;
 214
 215         if (ssid->eap.pcsc == NULL || wpa_s->scard != NULL)
 216                 return 0;
 217
 218         if (ssid->eap.eap_methods == NULL) {
 219                 sim = 1;
 220                 aka = 1;
 221         } else {
 222                 struct eap_method_type *eap = ssid->eap.eap_methods;
 223                 while (eap->vendor != EAP_VENDOR_IETF ||
 224                        eap->method != EAP_TYPE_NONE) {
 225                         if (eap->vendor == EAP_VENDOR_IETF) {
 226                                 if (eap->method == EAP_TYPE_SIM)
 227                                         sim = 1;
 228                                 else if (eap->method == EAP_TYPE_AKA)
 229                                         aka = 1;
 230                         }
 231                         eap++;
 232                 }
 233         }
 234
 235         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_SIM) == NULL)
 236                 sim = 0;
 237         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_AKA) == NULL)
 238                 aka = 0;
 239
 240         if (!sim && !aka) {
 241                 wpa_printf(MSG_DEBUG, "Selected network is configured to use "
 242                            "SIM, but neither EAP-SIM nor EAP-AKA are enabled");
 243                 return 0;
 244         }
 245
 246         wpa_printf(MSG_DEBUG, "Selected network is configured to use SIM "
 247                    "(sim=%d aka=%d) - initialize PCSC", sim, aka);
 248         if (sim && aka)
 249                 type = SCARD_TRY_BOTH;
 250         else if (aka)
 251                 type = SCARD_USIM_ONLY;
 252         else
 253                 type = SCARD_GSM_SIM_ONLY;
 254
 255         wpa_s->scard = scard_init(type);
 256         if (wpa_s->scard == NULL) {
 257                 wpa_printf(MSG_WARNING, "Failed to initialize SIM "
 258                            "(pcsc-lite)");
 259                 return -1;
 260         }
 261         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
 262         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
 263 #endif /* IEEE8021X_EAPOL */
 264
 265         return 0;
 266 }
 267
 268
 269 #ifndef CONFIG_NO_SCAN_PROCESSING
 270 static int wpa_supplicant_match_privacy(struct wpa_scan_res *bss,
 271                                         struct wpa_ssid *ssid)
 272 {
 273         int i, privacy = 0;
 274
 275         if (ssid->mixed_cell)
 276                 return 1;
 277
 278 #ifdef CONFIG_WPS
 279         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 280                 return 1;
 281 #endif /* CONFIG_WPS */
 282
 283         for (i = 0; i < NUM_WEP_KEYS; i++) {
 284                 if (ssid->wep_key_len[i]) {
 285                         privacy = 1;
 286                         break;
 287                 }
 288         }
 289 #ifdef IEEE8021X_EAPOL
 290         if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
 291             ssid->eapol_flags & (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 292                                  EAPOL_FLAG_REQUIRE_KEY_BROADCAST))
 293                 privacy = 1;
 294 #endif /* IEEE8021X_EAPOL */
 295
 296         if (bss->caps & IEEE80211_CAP_PRIVACY)
 297                 return privacy;
 298         return !privacy;
 299 }
 300
 301
 302 static int wpa_supplicant_ssid_bss_match(struct wpa_supplicant *wpa_s,
 303                                          struct wpa_ssid *ssid,
 304                                          struct wpa_scan_res *bss)
 305 {
 306         struct wpa_ie_data ie;
 307         int proto_match = 0;
 308         const u8 *rsn_ie, *wpa_ie;
 309         int ret;
 310
 311         ret = wpas_wps_ssid_bss_match(wpa_s, ssid, bss);
 312         if (ret >= 0)
 313                 return ret;
 314
 315         rsn_ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 316         while ((ssid->proto & WPA_PROTO_RSN) && rsn_ie) {
 317                 proto_match++;
 318
 319                 if (wpa_parse_wpa_ie(rsn_ie, 2 + rsn_ie[1], &ie)) {
 320                         wpa_printf(MSG_DEBUG, "   skip RSN IE - parse failed");
 321                         break;
 322                 }
 323                 if (!(ie.proto & ssid->proto)) {
 324                         wpa_printf(MSG_DEBUG, "   skip RSN IE - proto "
 325                                    "mismatch");
 326                         break;
 327                 }
 328
 329                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 330                         wpa_printf(MSG_DEBUG, "   skip RSN IE - PTK cipher "
 331                                    "mismatch");
 332                         break;
 333                 }
 334
 335                 if (!(ie.group_cipher & ssid->group_cipher)) {
 336                         wpa_printf(MSG_DEBUG, "   skip RSN IE - GTK cipher "
 337                                    "mismatch");
 338                         break;
 339                 }
 340
 341                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 342                         wpa_printf(MSG_DEBUG, "   skip RSN IE - key mgmt "
 343                                    "mismatch");
 344                         break;
 345                 }
 346
 347 #ifdef CONFIG_IEEE80211W
 348                 if (!(ie.capabilities & WPA_CAPABILITY_MFPC) &&
 349                     ssid->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
 350                         wpa_printf(MSG_DEBUG, "   skip RSN IE - no mgmt frame "
 351                                    "protection");
 352                         break;
 353                 }
 354 #endif /* CONFIG_IEEE80211W */
 355
 356                 wpa_printf(MSG_DEBUG, "   selected based on RSN IE");
 357                 return 1;
 358         }
 359
 360         wpa_ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 361         while ((ssid->proto & WPA_PROTO_WPA) && wpa_ie) {
 362                 proto_match++;
 363
 364                 if (wpa_parse_wpa_ie(wpa_ie, 2 + wpa_ie[1], &ie)) {
 365                         wpa_printf(MSG_DEBUG, "   skip WPA IE - parse failed");
 366                         break;
 367                 }
 368                 if (!(ie.proto & ssid->proto)) {
 369                         wpa_printf(MSG_DEBUG, "   skip WPA IE - proto "
 370                                    "mismatch");
 371                         break;
 372                 }
 373
 374                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 375                         wpa_printf(MSG_DEBUG, "   skip WPA IE - PTK cipher "
 376                                    "mismatch");
 377                         break;
 378                 }
 379
 380                 if (!(ie.group_cipher & ssid->group_cipher)) {
 381                         wpa_printf(MSG_DEBUG, "   skip WPA IE - GTK cipher "
 382                                    "mismatch");
 383                         break;
 384                 }
 385
 386                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 387                         wpa_printf(MSG_DEBUG, "   skip WPA IE - key mgmt "
 388                                    "mismatch");
 389                         break;
 390                 }
 391
 392                 wpa_printf(MSG_DEBUG, "   selected based on WPA IE");
 393                 return 1;
 394         }
 395
 396         if (proto_match == 0)
 397                 wpa_printf(MSG_DEBUG, "   skip - no WPA/RSN proto match");
 398
 399         return 0;
 400 }
 401
 402
 403 static int freq_allowed(int *freqs, int freq)
 404 {
 405         int i;
 406
 407         if (freqs == NULL)
 408                 return 1;
 409
 410         for (i = 0; freqs[i]; i++)
 411                 if (freqs[i] == freq)
 412                         return 1;
 413         return 0;
 414 }
 415
 416
 417 static struct wpa_ssid * wpa_scan_res_match(struct wpa_supplicant *wpa_s,
 418                                             int i, struct wpa_scan_res *bss,
 419                                             struct wpa_ssid *group)
 420 {
 421         const u8 *ssid_;
 422         u8 wpa_ie_len, rsn_ie_len, ssid_len;
 423         int wpa;
 424         struct wpa_blacklist *e;
 425         const u8 *ie;
 426         struct wpa_ssid *ssid;
 427
 428         ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 429         ssid_ = ie ? ie + 2 : (u8 *) "";
 430         ssid_len = ie ? ie[1] : 0;
 431
 432         ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 433         wpa_ie_len = ie ? ie[1] : 0;
 434
 435         ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 436         rsn_ie_len = ie ? ie[1] : 0;
 437
 438         wpa_printf(MSG_DEBUG, "%d: " MACSTR " ssid='%s' "
 439                    "wpa_ie_len=%u rsn_ie_len=%u caps=0x%x level=%d%s",
 440                    i, MAC2STR(bss->bssid), wpa_ssid_txt(ssid_, ssid_len),
 441                    wpa_ie_len, rsn_ie_len, bss->caps, bss->level,
 442                    wpa_scan_get_vendor_ie(bss, WPS_IE_VENDOR_TYPE) ?
 443                    " wps" : "");
 444
 445         e = wpa_blacklist_get(wpa_s, bss->bssid);
 446         if (e && e->count > 1) {
 447                 wpa_printf(MSG_DEBUG, "   skip - blacklisted");
 448                 return 0;
 449         }
 450
 451         if (ssid_len == 0) {
 452                 wpa_printf(MSG_DEBUG, "   skip - SSID not known");
 453                 return 0;
 454         }
 455
 456         wpa = wpa_ie_len > 0 || rsn_ie_len > 0;
 457
 458         for (ssid = group; ssid; ssid = ssid->pnext) {
 459                 int check_ssid = wpa ? 1 : (ssid->ssid_len != 0);
 460
 461                 if (ssid->disabled) {
 462                         wpa_printf(MSG_DEBUG, "   skip - disabled");
 463                         continue;
 464                 }
 465
 466 #ifdef CONFIG_WPS
 467                 if ((ssid->key_mgmt & WPA_KEY_MGMT_WPS) && e && e->count > 0) {
 468                         wpa_printf(MSG_DEBUG, "   skip - blacklisted (WPS)");
 469                         continue;
 470                 }
 471
 472                 if (wpa && ssid->ssid_len == 0 &&
 473                     wpas_wps_ssid_wildcard_ok(wpa_s, ssid, bss))
 474                         check_ssid = 0;
 475
 476                 if (!wpa && (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
 477                         /* Only allow wildcard SSID match if an AP
 478                          * advertises active WPS operation that matches
 479                          * with our mode. */
 480                         check_ssid = 1;
 481                         if (ssid->ssid_len == 0 &&
 482                             wpas_wps_ssid_wildcard_ok(wpa_s, ssid, bss))
 483                                 check_ssid = 0;
 484                 }
 485 #endif /* CONFIG_WPS */
 486
 487                 if (check_ssid &&
 488                     (ssid_len != ssid->ssid_len ||
 489                      os_memcmp(ssid_, ssid->ssid, ssid_len) != 0)) {
 490                         wpa_printf(MSG_DEBUG, "   skip - SSID mismatch");
 491                         continue;
 492                 }
 493
 494                 if (ssid->bssid_set &&
 495                     os_memcmp(bss->bssid, ssid->bssid, ETH_ALEN) != 0) {
 496                         wpa_printf(MSG_DEBUG, "   skip - BSSID mismatch");
 497                         continue;
 498                 }
 499
 500                 if (wpa && !wpa_supplicant_ssid_bss_match(wpa_s, ssid, bss))
 501                         continue;
 502
 503                 if (!wpa &&
 504                     !(ssid->key_mgmt & WPA_KEY_MGMT_NONE) &&
 505                     !(ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
 506                     !(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)) {
 507                         wpa_printf(MSG_DEBUG, "   skip - non-WPA network not "
 508                                    "allowed");
 509                         continue;
 510                 }
 511
 512                 if (!wpa && !wpa_supplicant_match_privacy(bss, ssid)) {
 513                         wpa_printf(MSG_DEBUG, "   skip - privacy mismatch");
 514                         continue;
 515                 }
 516
 517                 if (!wpa && (bss->caps & IEEE80211_CAP_IBSS)) {
 518                         wpa_printf(MSG_DEBUG, "   skip - IBSS (adhoc) "
 519                                    "network");
 520                         continue;
 521                 }
 522
 523                 if (!freq_allowed(ssid->freq_list, bss->freq)) {
 524                         wpa_printf(MSG_DEBUG, "   skip - frequency not "
 525                                    "allowed");
 526                         continue;
 527                 }
 528
 529 #ifdef CONFIG_P2P
 530                 /*
 531                  * TODO: skip the AP if its P2P IE has Group Formation
 532                  * bit set in the P2P Group Capability Bitmap and we
 533                  * are not in Group Formation with that device.
 534                  */
 535 #endif /* CONFIG_P2P */
 536
 537                 /* Matching configuration found */
 538                 return ssid;
 539         }
 540
 541         /* No matching configuration found */
 542         return 0;
 543 }
 544
 545
 546 static struct wpa_bss *
 547 wpa_supplicant_select_bss(struct wpa_supplicant *wpa_s,
 548                           struct wpa_scan_results *scan_res,
 549                           struct wpa_ssid *group,
 550                           struct wpa_ssid **selected_ssid)
 551 {
 552         size_t i;
 553
 554         wpa_printf(MSG_DEBUG, "Selecting BSS from priority group %d",
 555                    group->priority);
 556
 557         for (i = 0; i < scan_res->num; i++) {
 558                 struct wpa_scan_res *bss = scan_res->res[i];
 559                 const u8 *ie, *ssid;
 560                 u8 ssid_len;
 561
 562                 *selected_ssid = wpa_scan_res_match(wpa_s, i, bss, group);
 563                 if (!*selected_ssid)
 564                         continue;
 565
 566                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 567                 ssid = ie ? ie + 2 : (u8 *) "";
 568                 ssid_len = ie ? ie[1] : 0;
 569
 570                 wpa_printf(MSG_DEBUG, "   selected BSS " MACSTR " ssid='%s'",
 571                            MAC2STR(bss->bssid), wpa_ssid_txt(ssid, ssid_len));
 572                 return wpa_bss_get(wpa_s, bss->bssid, ssid, ssid_len);
 573         }
 574
 575         return NULL;
 576 }
 577
 578
 579 static struct wpa_bss *
 580 wpa_supplicant_pick_network(struct wpa_supplicant *wpa_s,
 581                             struct wpa_scan_results *scan_res,
 582                             struct wpa_ssid **selected_ssid)
 583 {
 584         struct wpa_bss *selected = NULL;
 585         int prio;
 586
 587         while (selected == NULL) {
 588                 for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 589                         selected = wpa_supplicant_select_bss(
 590                                 wpa_s, scan_res, wpa_s->conf->pssid[prio],
 591                                 selected_ssid);
 592                         if (selected)
 593                                 break;
 594                 }
 595
 596                 if (selected == NULL && wpa_s->blacklist) {
 597                         wpa_printf(MSG_DEBUG, "No APs found - clear blacklist "
 598                                    "and try again");
 599                         wpa_blacklist_clear(wpa_s);
 600                         wpa_s->blacklist_cleared++;
 601                 } else if (selected == NULL)
 602                         break;
 603         }
 604
 605         return selected;
 606 }
 607
 608
 609 static void wpa_supplicant_req_new_scan(struct wpa_supplicant *wpa_s,
 610                                         int timeout_sec, int timeout_usec)
 611 {
 612         if (!wpa_supplicant_enabled_networks(wpa_s->conf)) {
 613                 /*
 614                  * No networks are enabled; short-circuit request so
 615                  * we don't wait timeout seconds before transitioning
 616                  * to INACTIVE state.
 617                  */
 618                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 619                 return;
 620         }
 621         wpa_supplicant_req_scan(wpa_s, timeout_sec, timeout_usec);
 622 }
 623
 624
 625 void wpa_supplicant_connect(struct wpa_supplicant *wpa_s,
 626                             struct wpa_bss *selected,
 627                             struct wpa_ssid *ssid)
 628 {
 629         if (wpas_wps_scan_pbc_overlap(wpa_s, selected, ssid)) {
 630                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_OVERLAP
 631                         "PBC session overlap");
 632 #ifdef CONFIG_P2P
 633                 if (wpas_p2p_notif_pbc_overlap(wpa_s) == 1)
 634                         return;
 635 #endif /* CONFIG_P2P */
 636
 637 #ifdef CONFIG_WPS
 638                 wpas_wps_cancel(wpa_s);
 639 #endif /* CONFIG_WPS */
 640                 return;
 641         }
 642
 643         /*
 644          * Do not trigger new association unless the BSSID has changed or if
 645          * reassociation is requested. If we are in process of associating with
 646          * the selected BSSID, do not trigger new attempt.
 647          */
 648         if (wpa_s->reassociate ||
 649             (os_memcmp(selected->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
 650              (wpa_s->wpa_state != WPA_ASSOCIATING ||
 651               os_memcmp(selected->bssid, wpa_s->pending_bssid, ETH_ALEN) !=
 652               0))) {
 653                 if (wpa_supplicant_scard_init(wpa_s, ssid)) {
 654                         wpa_supplicant_req_new_scan(wpa_s, 10, 0);
 655                         return;
 656                 }
 657                 wpa_supplicant_associate(wpa_s, selected, ssid);
 658         } else {
 659                 wpa_printf(MSG_DEBUG, "Already associated with the selected "
 660                            "AP");
 661         }
 662 }
 663
 664
 665 static struct wpa_ssid *
 666 wpa_supplicant_pick_new_network(struct wpa_supplicant *wpa_s)
 667 {
 668         int prio;
 669         struct wpa_ssid *ssid;
 670
 671         for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 672                 for (ssid = wpa_s->conf->pssid[prio]; ssid; ssid = ssid->pnext)
 673                 {
 674                         if (ssid->disabled)
 675                                 continue;
 676                         if (ssid->mode == IEEE80211_MODE_IBSS ||
 677                             ssid->mode == IEEE80211_MODE_AP)
 678                                 return ssid;
 679                 }
 680         }
 681         return NULL;
 682 }
 683
 684
 685 /* TODO: move the rsn_preauth_scan_result*() to be called from notify.c based
 686  * on BSS added and BSS changed events */
 687 static void wpa_supplicant_rsn_preauth_scan_results(
 688         struct wpa_supplicant *wpa_s, struct wpa_scan_results *scan_res)
 689 {
 690         int i;
 691
 692         if (rsn_preauth_scan_results(wpa_s->wpa) < 0)
 693                 return;
 694
 695         for (i = scan_res->num - 1; i >= 0; i--) {
 696                 const u8 *ssid, *rsn;
 697                 struct wpa_scan_res *r;
 698
 699                 r = scan_res->res[i];
 700
 701                 ssid = wpa_scan_get_ie(r, WLAN_EID_SSID);
 702                 if (ssid == NULL)
 703                         continue;
 704
 705                 rsn = wpa_scan_get_ie(r, WLAN_EID_RSN);
 706                 if (rsn == NULL)
 707                         continue;
 708
 709                 rsn_preauth_scan_result(wpa_s->wpa, r->bssid, ssid, rsn);
 710         }
 711
 712 }
 713
 714
 715 static int wpa_supplicant_need_to_roam(struct wpa_supplicant *wpa_s,
 716                                        struct wpa_bss *selected,
 717                                        struct wpa_ssid *ssid,
 718                                        struct wpa_scan_results *scan_res)
 719 {
 720         size_t i;
 721         struct wpa_scan_res *current_bss = NULL;
 722         int min_diff;
 723
 724         if (wpa_s->reassociate)
 725                 return 1; /* explicit request to reassociate */
 726         if (wpa_s->wpa_state < WPA_ASSOCIATED)
 727                 return 1; /* we are not associated; continue */
 728         if (wpa_s->current_ssid == NULL)
 729                 return 1; /* unknown current SSID */
 730         if (wpa_s->current_ssid != ssid)
 731                 return 1; /* different network block */
 732
 733         for (i = 0; i < scan_res->num; i++) {
 734                 struct wpa_scan_res *res = scan_res->res[i];
 735                 const u8 *ie;
 736                 if (os_memcmp(res->bssid, wpa_s->bssid, ETH_ALEN) != 0)
 737                         continue;
 738
 739                 ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
 740                 if (ie == NULL)
 741                         continue;
 742                 if (ie[1] != wpa_s->current_ssid->ssid_len ||
 743                     os_memcmp(ie + 2, wpa_s->current_ssid->ssid, ie[1]) != 0)
 744                         continue;
 745                 current_bss = res;
 746                 break;
 747         }
 748
 749         if (!current_bss)
 750                 return 1; /* current BSS not seen in scan results */
 751
 752         wpa_printf(MSG_DEBUG, "Considering within-ESS reassociation");
 753         wpa_printf(MSG_DEBUG, "Current BSS: " MACSTR " level=%d",
 754                    MAC2STR(current_bss->bssid), current_bss->level);
 755         wpa_printf(MSG_DEBUG, "Selected BSS: " MACSTR " level=%d",
 756                    MAC2STR(selected->bssid), selected->level);
 757
 758         if (wpa_s->current_ssid->bssid_set &&
 759             os_memcmp(selected->bssid, wpa_s->current_ssid->bssid, ETH_ALEN) ==
 760             0) {
 761                 wpa_printf(MSG_DEBUG, "Allow reassociation - selected BSS has "
 762                            "preferred BSSID");
 763                 return 1;
 764         }
 765
 766         min_diff = 2;
 767         if (current_bss->level < 0) {
 768                 if (current_bss->level < -85)
 769                         min_diff = 1;
 770                 else if (current_bss->level < -80)
 771                         min_diff = 2;
 772                 else if (current_bss->level < -75)
 773                         min_diff = 3;
 774                 else if (current_bss->level < -70)
 775                         min_diff = 4;
 776                 else
 777                         min_diff = 5;
 778         }
 779         if (abs(current_bss->level - selected->level) < min_diff) {
 780                 wpa_printf(MSG_DEBUG, "Skip roam - too small difference in "
 781                            "signal level");
 782                 return 0;
 783         }
 784
 785         return 1;
 786 }
 787
 788
 789 static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s,
 790                                               union wpa_event_data *data)
 791 {
 792         struct wpa_bss *selected;
 793         struct wpa_ssid *ssid = NULL;
 794         struct wpa_scan_results *scan_res;
 795         int ap = 0;
 796
 797 #ifdef CONFIG_AP
 798         if (wpa_s->ap_iface)
 799                 ap = 1;
 800 #endif /* CONFIG_AP */
 801
 802         wpa_supplicant_notify_scanning(wpa_s, 0);
 803
 804         scan_res = wpa_supplicant_get_scan_results(wpa_s,
 805                                                    data ? &data->scan_info :
 806                                                    NULL, 1);
 807         if (scan_res == NULL) {
 808                 if (wpa_s->conf->ap_scan == 2 || ap)
 809                         return;
 810                 wpa_printf(MSG_DEBUG, "Failed to get scan results - try "
 811                            "scanning again");
 812                 wpa_supplicant_req_new_scan(wpa_s, 1, 0);
 813                 return;
 814         }
 815
 816         if (wpa_s->scan_res_handler) {
 817                 wpa_s->scan_res_handler(wpa_s, scan_res);
 818                 wpa_s->scan_res_handler = NULL;
 819                 wpa_scan_results_free(scan_res);
 820                 return;
 821         }
 822
 823         if (ap) {
 824                 wpa_printf(MSG_DEBUG, "Ignore scan results in AP mode");
 825                 wpa_scan_results_free(scan_res);
 826                 return;
 827         }
 828
 829         wpa_printf(MSG_DEBUG, "New scan results available");
 830         wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
 831         wpas_notify_scan_results(wpa_s);
 832
 833         wpas_notify_scan_done(wpa_s, 1);
 834
 835         if ((wpa_s->conf->ap_scan == 2 && !wpas_wps_searching(wpa_s))) {
 836                 wpa_scan_results_free(scan_res);
 837                 return;
 838         }
 839
 840         if (wpa_s->disconnected) {
 841                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 842                 wpa_scan_results_free(scan_res);
 843                 return;
 844         }
 845
 846         if (bgscan_notify_scan(wpa_s, scan_res) == 1) {
 847                 wpa_scan_results_free(scan_res);
 848                 return;
 849         }
 850
 851         wpa_supplicant_rsn_preauth_scan_results(wpa_s, scan_res);
 852
 853         selected = wpa_supplicant_pick_network(wpa_s, scan_res, &ssid);
 854
 855         if (selected) {
 856                 int skip;
 857                 skip = !wpa_supplicant_need_to_roam(wpa_s, selected, ssid,
 858                                                     scan_res);
 859                 wpa_scan_results_free(scan_res);
 860                 if (skip)
 861                         return;
 862                 wpa_supplicant_connect(wpa_s, selected, ssid);
 863         } else {
 864                 wpa_scan_results_free(scan_res);
 865                 wpa_printf(MSG_DEBUG, "No suitable network found");
 866                 ssid = wpa_supplicant_pick_new_network(wpa_s);
 867                 if (ssid) {
 868                         wpa_printf(MSG_DEBUG, "Setup a new network");
 869                         wpa_supplicant_associate(wpa_s, NULL, ssid);
 870                 } else {
 871                         int timeout_sec = 5;
 872                         int timeout_usec = 0;
 873 #ifdef CONFIG_P2P
 874                         if (wpa_s->p2p_in_provisioning) {
 875                                 /*
 876                                  * Use shorter wait during P2P Provisioning
 877                                  * state to speed up group formation.
 878                                  */
 879                                 timeout_sec = 0;
 880                                 timeout_usec = 250000;
 881                         }
 882 #endif /* CONFIG_P2P */
 883                         wpa_supplicant_req_new_scan(wpa_s, timeout_sec,
 884                                                     timeout_usec);
 885                 }
 886         }
 887 }
 888 #endif /* CONFIG_NO_SCAN_PROCESSING */
 889
 890
 891 static int wpa_supplicant_event_associnfo(struct wpa_supplicant *wpa_s,
 892                                           union wpa_event_data *data)
 893 {
 894         int l, len, found = 0, wpa_found, rsn_found;
 895         const u8 *p;
 896
 897         wpa_printf(MSG_DEBUG, "Association info event");
 898         if (data->assoc_info.req_ies)
 899                 wpa_hexdump(MSG_DEBUG, "req_ies", data->assoc_info.req_ies,
 900                             data->assoc_info.req_ies_len);
 901         if (data->assoc_info.resp_ies)
 902                 wpa_hexdump(MSG_DEBUG, "resp_ies", data->assoc_info.resp_ies,
 903                             data->assoc_info.resp_ies_len);
 904         if (data->assoc_info.beacon_ies)
 905                 wpa_hexdump(MSG_DEBUG, "beacon_ies",
 906                             data->assoc_info.beacon_ies,
 907                             data->assoc_info.beacon_ies_len);
 908         if (data->assoc_info.freq)
 909                 wpa_printf(MSG_DEBUG, "freq=%u MHz", data->assoc_info.freq);
 910
 911         p = data->assoc_info.req_ies;
 912         l = data->assoc_info.req_ies_len;
 913
 914         /* Go through the IEs and make a copy of the WPA/RSN IE, if present. */
 915         while (p && l >= 2) {
 916                 len = p[1] + 2;
 917                 if (len > l) {
 918                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
 919                                     p, l);
 920                         break;
 921                 }
 922                 if ((p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
 923                      (os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0)) ||
 924                     (p[0] == WLAN_EID_RSN && p[1] >= 2)) {
 925                         if (wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, p, len))
 926                                 break;
 927                         found = 1;
 928                         wpa_find_assoc_pmkid(wpa_s);
 929                         break;
 930                 }
 931                 l -= len;
 932                 p += len;
 933         }
 934         if (!found && data->assoc_info.req_ies)
 935                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 936
 937 #ifdef CONFIG_IEEE80211R
 938 #ifdef CONFIG_SME
 939         if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FT) {
 940                 u8 bssid[ETH_ALEN];
 941                 if (wpa_drv_get_bssid(wpa_s, bssid) < 0 ||
 942                     wpa_ft_validate_reassoc_resp(wpa_s->wpa,
 943                                                  data->assoc_info.resp_ies,
 944                                                  data->assoc_info.resp_ies_len,
 945                                                  bssid) < 0) {
 946                         wpa_printf(MSG_DEBUG, "FT: Validation of "
 947                                    "Reassociation Response failed");
 948                         wpa_supplicant_deauthenticate(
 949                                 wpa_s, WLAN_REASON_INVALID_IE);
 950                         return -1;
 951                 }
 952         }
 953
 954         p = data->assoc_info.resp_ies;
 955         l = data->assoc_info.resp_ies_len;
 956
 957 #ifdef CONFIG_WPS_STRICT
 958         if (wpa_s->current_ssid &&
 959             wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_WPS) {
 960                 struct wpabuf *wps;
 961                 wps = ieee802_11_vendor_ie_concat(p, l, WPS_IE_VENDOR_TYPE);
 962                 if (wps == NULL) {
 963                         wpa_printf(MSG_INFO, "WPS-STRICT: AP did not include "
 964                                    "WPS IE in (Re)Association Response");
 965                         return -1;
 966                 }
 967
 968                 if (wps_validate_assoc_resp(wps) < 0) {
 969                         wpabuf_free(wps);
 970                         wpa_supplicant_deauthenticate(
 971                                 wpa_s, WLAN_REASON_INVALID_IE);
 972                         return -1;
 973                 }
 974                 wpabuf_free(wps);
 975         }
 976 #endif /* CONFIG_WPS_STRICT */
 977
 978         /* Go through the IEs and make a copy of the MDIE, if present. */
 979         while (p && l >= 2) {
 980                 len = p[1] + 2;
 981                 if (len > l) {
 982                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
 983                                     p, l);
 984                         break;
 985                 }
 986                 if (p[0] == WLAN_EID_MOBILITY_DOMAIN &&
 987                     p[1] >= MOBILITY_DOMAIN_ID_LEN) {
 988                         wpa_s->sme.ft_used = 1;
 989                         os_memcpy(wpa_s->sme.mobility_domain, p + 2,
 990                                   MOBILITY_DOMAIN_ID_LEN);
 991                         break;
 992                 }
 993                 l -= len;
 994                 p += len;
 995         }
 996 #endif /* CONFIG_SME */
 997
 998         wpa_sm_set_ft_params(wpa_s->wpa, data->assoc_info.resp_ies,
 999                              data->assoc_info.resp_ies_len);
1000 #endif /* CONFIG_IEEE80211R */
1001
1002         /* WPA/RSN IE from Beacon/ProbeResp */
1003         p = data->assoc_info.beacon_ies;
1004         l = data->assoc_info.beacon_ies_len;
1005
1006         /* Go through the IEs and make a copy of the WPA/RSN IEs, if present.
1007          */
1008         wpa_found = rsn_found = 0;
1009         while (p && l >= 2) {
1010                 len = p[1] + 2;
1011                 if (len > l) {
1012                         wpa_hexdump(MSG_DEBUG, "Truncated IE in beacon_ies",
1013                                     p, l);
1014                         break;
1015                 }
1016                 if (!wpa_found &&
1017                     p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
1018                     os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0) {
1019                         wpa_found = 1;
1020                         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, p, len);
1021                 }
1022
1023                 if (!rsn_found &&
1024                     p[0] == WLAN_EID_RSN && p[1] >= 2) {
1025                         rsn_found = 1;
1026                         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, p, len);
1027                 }
1028
1029                 l -= len;
1030                 p += len;
1031         }
1032
1033         if (!wpa_found && data->assoc_info.beacon_ies)
1034                 wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
1035         if (!rsn_found && data->assoc_info.beacon_ies)
1036                 wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
1037         if (wpa_found || rsn_found)
1038                 wpa_s->ap_ies_from_associnfo = 1;
1039
1040         wpa_s->assoc_freq = data->assoc_info.freq;
1041
1042         return 0;
1043 }
1044
1045
1046 static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
1047                                        union wpa_event_data *data)
1048 {
1049         u8 bssid[ETH_ALEN];
1050         int ft_completed;
1051         int bssid_changed;
1052         struct wpa_driver_capa capa;
1053
1054 #ifdef CONFIG_AP
1055         if (wpa_s->ap_iface) {
1056                 hostapd_notif_assoc(wpa_s->ap_iface->bss[0],
1057                                     data->assoc_info.addr,
1058                                     data->assoc_info.req_ies,
1059                                     data->assoc_info.req_ies_len);
1060                 return;
1061         }
1062 #endif /* CONFIG_AP */
1063
1064         ft_completed = wpa_ft_is_completed(wpa_s->wpa);
1065         if (data && wpa_supplicant_event_associnfo(wpa_s, data) < 0)
1066                 return;
1067
1068         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATED);
1069         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME)
1070                 os_memcpy(bssid, wpa_s->bssid, ETH_ALEN);
1071         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME) ||
1072             (wpa_drv_get_bssid(wpa_s, bssid) >= 0 &&
1073              os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)) {
1074                 wpa_msg(wpa_s, MSG_DEBUG, "Associated to a new BSS: BSSID="
1075                         MACSTR, MAC2STR(bssid));
1076                 bssid_changed = os_memcmp(wpa_s->bssid, bssid, ETH_ALEN);
1077                 os_memcpy(wpa_s->bssid, bssid, ETH_ALEN);
1078                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1079                 if (bssid_changed)
1080                         wpas_notify_bssid_changed(wpa_s);
1081
1082                 if (wpa_supplicant_dynamic_keys(wpa_s) && !ft_completed) {
1083                         wpa_clear_keys(wpa_s, bssid);
1084                 }
1085                 if (wpa_supplicant_select_config(wpa_s) < 0) {
1086                         wpa_supplicant_disassociate(
1087                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
1088                         return;
1089                 }
1090                 if (wpa_s->current_ssid) {
1091                         struct wpa_bss *bss = NULL;
1092                         struct wpa_ssid *ssid = wpa_s->current_ssid;
1093                         if (ssid->ssid_len > 0)
1094                                 bss = wpa_bss_get(wpa_s, bssid,
1095                                                   ssid->ssid, ssid->ssid_len);
1096                         if (!bss)
1097                                 bss = wpa_bss_get_bssid(wpa_s, bssid);
1098                         if (bss)
1099                                 wpa_s->current_bss = bss;
1100                 }
1101         }
1102
1103 #ifdef CONFIG_SME
1104         os_memcpy(wpa_s->sme.prev_bssid, bssid, ETH_ALEN);
1105         wpa_s->sme.prev_bssid_set = 1;
1106 #endif /* CONFIG_SME */
1107
1108         wpa_msg(wpa_s, MSG_INFO, "Associated with " MACSTR, MAC2STR(bssid));
1109         if (wpa_s->current_ssid) {
1110                 /* When using scanning (ap_scan=1), SIM PC/SC interface can be
1111                  * initialized before association, but for other modes,
1112                  * initialize PC/SC here, if the current configuration needs
1113                  * smartcard or SIM/USIM. */
1114                 wpa_supplicant_scard_init(wpa_s, wpa_s->current_ssid);
1115         }
1116         wpa_sm_notify_assoc(wpa_s->wpa, bssid);
1117         if (wpa_s->l2)
1118                 l2_packet_notify_auth_start(wpa_s->l2);
1119
1120         /*
1121          * Set portEnabled first to FALSE in order to get EAP state machine out
1122          * of the SUCCESS state and eapSuccess cleared. Without this, EAPOL PAE
1123          * state machine may transit to AUTHENTICATING state based on obsolete
1124          * eapSuccess and then trigger BE_AUTH to SUCCESS and PAE to
1125          * AUTHENTICATED without ever giving chance to EAP state machine to
1126          * reset the state.
1127          */
1128         if (!ft_completed) {
1129                 eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
1130                 eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
1131         }
1132         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) || ft_completed)
1133                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
1134         /* 802.1X::portControl = Auto */
1135         eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE);
1136         wpa_s->eapol_received = 0;
1137         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1138             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE ||
1139             (wpa_s->current_ssid &&
1140              wpa_s->current_ssid->mode == IEEE80211_MODE_IBSS)) {
1141                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1142                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1143         } else if (!ft_completed) {
1144                 /* Timeout for receiving the first EAPOL packet */
1145                 wpa_supplicant_req_auth_timeout(wpa_s, 10, 0);
1146         }
1147         wpa_supplicant_cancel_scan(wpa_s);
1148
1149         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
1150             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1151                 /*
1152                  * We are done; the driver will take care of RSN 4-way
1153                  * handshake.
1154                  */
1155                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1156                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1157                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
1158                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
1159         }
1160
1161         if (wpa_s->pending_eapol_rx) {
1162                 struct os_time now, age;
1163                 os_get_time(&now);
1164                 os_time_sub(&now, &wpa_s->pending_eapol_rx_time, &age);
1165                 if (age.sec == 0 && age.usec < 100000 &&
1166                     os_memcmp(wpa_s->pending_eapol_rx_src, bssid, ETH_ALEN) ==
1167                     0) {
1168                         wpa_printf(MSG_DEBUG, "Process pending EAPOL frame "
1169                                    "that was received just before association "
1170                                    "notification");
1171                         wpa_supplicant_rx_eapol(
1172                                 wpa_s, wpa_s->pending_eapol_rx_src,
1173                                 wpabuf_head(wpa_s->pending_eapol_rx),
1174                                 wpabuf_len(wpa_s->pending_eapol_rx));
1175                 }
1176                 wpabuf_free(wpa_s->pending_eapol_rx);
1177                 wpa_s->pending_eapol_rx = NULL;
1178         }
1179
1180 #ifdef CONFIG_BGSCAN
1181         if (wpa_s->current_ssid != wpa_s->bgscan_ssid) {
1182                 bgscan_deinit(wpa_s);
1183                 if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan) {
1184                         if (bgscan_init(wpa_s, wpa_s->current_ssid)) {
1185                                 wpa_printf(MSG_DEBUG, "Failed to initialize "
1186                                            "bgscan");
1187                                 /*
1188                                  * Live without bgscan; it is only used as a
1189                                  * roaming optimization, so the initial
1190                                  * connection is not affected.
1191                                  */
1192                         } else
1193                                 wpa_s->bgscan_ssid = wpa_s->current_ssid;
1194                 } else
1195                         wpa_s->bgscan_ssid = NULL;
1196         }
1197 #endif /* CONFIG_BGSCAN */
1198
1199         if ((wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1200              wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
1201             wpa_s->current_ssid && wpa_drv_get_capa(wpa_s, &capa) == 0 &&
1202             capa.flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE) {
1203                 /* Set static WEP keys again */
1204                 wpa_set_wep_keys(wpa_s, wpa_s->current_ssid);
1205         }
1206 }
1207
1208
1209 static void wpa_supplicant_event_disassoc(struct wpa_supplicant *wpa_s,
1210                                           u16 reason_code)
1211 {
1212         const u8 *bssid;
1213 #ifdef CONFIG_SME
1214         int authenticating;
1215         u8 prev_pending_bssid[ETH_ALEN];
1216
1217         authenticating = wpa_s->wpa_state == WPA_AUTHENTICATING;
1218         os_memcpy(prev_pending_bssid, wpa_s->pending_bssid, ETH_ALEN);
1219 #endif /* CONFIG_SME */
1220
1221         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
1222                 /*
1223                  * At least Host AP driver and a Prism3 card seemed to be
1224                  * generating streams of disconnected events when configuring
1225                  * IBSS for WPA-None. Ignore them for now.
1226                  */
1227                 wpa_printf(MSG_DEBUG, "Disconnect event - ignore in "
1228                            "IBSS/WPA-None mode");
1229                 return;
1230         }
1231
1232         if (wpa_s->wpa_state == WPA_4WAY_HANDSHAKE &&
1233             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1234                 wpa_msg(wpa_s, MSG_INFO, "WPA: 4-Way Handshake failed - "
1235                         "pre-shared key may be incorrect");
1236         }
1237         if (!wpa_s->auto_reconnect_disabled ||
1238             wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
1239                 wpa_printf(MSG_DEBUG, "WPA: Auto connect enabled: try to "
1240                            "reconnect (wps=%d)",
1241                            wpa_s->key_mgmt == WPA_KEY_MGMT_WPS);
1242                 if (wpa_s->wpa_state >= WPA_ASSOCIATING)
1243                         wpa_supplicant_req_scan(wpa_s, 0, 100000);
1244         } else {
1245                 wpa_printf(MSG_DEBUG, "WPA: Auto connect disabled: do not try "
1246                            "to re-connect");
1247                 wpa_s->reassociate = 0;
1248                 wpa_s->disconnected = 1;
1249         }
1250         bssid = wpa_s->bssid;
1251         if (is_zero_ether_addr(bssid))
1252                 bssid = wpa_s->pending_bssid;
1253         wpa_blacklist_add(wpa_s, bssid);
1254         wpa_sm_notify_disassoc(wpa_s->wpa);
1255         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
1256                 " reason=%d",
1257                 MAC2STR(bssid), reason_code);
1258         if (wpa_supplicant_dynamic_keys(wpa_s)) {
1259                 wpa_printf(MSG_DEBUG, "Disconnect event - remove keys");
1260                 wpa_s->keys_cleared = 0;
1261                 wpa_clear_keys(wpa_s, wpa_s->bssid);
1262         }
1263         wpa_supplicant_mark_disassoc(wpa_s);
1264         bgscan_deinit(wpa_s);
1265         wpa_s->bgscan_ssid = NULL;
1266 #ifdef CONFIG_SME
1267         if (authenticating &&
1268             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)) {
1269                 /*
1270                  * mac80211-workaround to force deauth on failed auth cmd,
1271                  * requires us to remain in authenticating state to allow the
1272                  * second authentication attempt to be continued properly.
1273                  */
1274                 wpa_printf(MSG_DEBUG, "SME: Allow pending authentication to "
1275                            "proceed after disconnection event");
1276                 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1277                 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
1278         }
1279 #endif /* CONFIG_SME */
1280 }
1281
1282
1283 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1284 static void wpa_supplicant_delayed_mic_error_report(void *eloop_ctx,
1285                                                     void *sock_ctx)
1286 {
1287         struct wpa_supplicant *wpa_s = eloop_ctx;
1288
1289         if (!wpa_s->pending_mic_error_report)
1290                 return;
1291
1292         wpa_printf(MSG_DEBUG, "WPA: Sending pending MIC error report");
1293         wpa_sm_key_request(wpa_s->wpa, 1, wpa_s->pending_mic_error_pairwise);
1294         wpa_s->pending_mic_error_report = 0;
1295 }
1296 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1297
1298
1299 static void
1300 wpa_supplicant_event_michael_mic_failure(struct wpa_supplicant *wpa_s,
1301                                          union wpa_event_data *data)
1302 {
1303         int pairwise;
1304         struct os_time t;
1305
1306         wpa_msg(wpa_s, MSG_WARNING, "Michael MIC failure detected");
1307         pairwise = (data && data->michael_mic_failure.unicast);
1308         os_get_time(&t);
1309         if ((wpa_s->last_michael_mic_error &&
1310              t.sec - wpa_s->last_michael_mic_error <= 60) ||
1311             wpa_s->pending_mic_error_report) {
1312                 if (wpa_s->pending_mic_error_report) {
1313                         /*
1314                          * Send the pending MIC error report immediately since
1315                          * we are going to start countermeasures and AP better
1316                          * do the same.
1317                          */
1318                         wpa_sm_key_request(wpa_s->wpa, 1,
1319                                            wpa_s->pending_mic_error_pairwise);
1320                 }
1321
1322                 /* Send the new MIC error report immediately since we are going
1323                  * to start countermeasures and AP better do the same.
1324                  */
1325                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1326
1327                 /* initialize countermeasures */
1328                 wpa_s->countermeasures = 1;
1329                 wpa_msg(wpa_s, MSG_WARNING, "TKIP countermeasures started");
1330
1331                 /*
1332                  * Need to wait for completion of request frame. We do not get
1333                  * any callback for the message completion, so just wait a
1334                  * short while and hope for the best. */
1335                 os_sleep(0, 10000);
1336
1337                 wpa_drv_set_countermeasures(wpa_s, 1);
1338                 wpa_supplicant_deauthenticate(wpa_s,
1339                                               WLAN_REASON_MICHAEL_MIC_FAILURE);
1340                 eloop_cancel_timeout(wpa_supplicant_stop_countermeasures,
1341                                      wpa_s, NULL);
1342                 eloop_register_timeout(60, 0,
1343                                        wpa_supplicant_stop_countermeasures,
1344                                        wpa_s, NULL);
1345                 /* TODO: mark the AP rejected for 60 second. STA is
1346                  * allowed to associate with another AP.. */
1347         } else {
1348 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1349                 if (wpa_s->mic_errors_seen) {
1350                         /*
1351                          * Reduce the effectiveness of Michael MIC error
1352                          * reports as a means for attacking against TKIP if
1353                          * more than one MIC failure is noticed with the same
1354                          * PTK. We delay the transmission of the reports by a
1355                          * random time between 0 and 60 seconds in order to
1356                          * force the attacker wait 60 seconds before getting
1357                          * the information on whether a frame resulted in a MIC
1358                          * failure.
1359                          */
1360                         u8 rval[4];
1361                         int sec;
1362
1363                         if (os_get_random(rval, sizeof(rval)) < 0)
1364                                 sec = os_random() % 60;
1365                         else
1366                                 sec = WPA_GET_BE32(rval) % 60;
1367                         wpa_printf(MSG_DEBUG, "WPA: Delay MIC error report %d "
1368                                    "seconds", sec);
1369                         wpa_s->pending_mic_error_report = 1;
1370                         wpa_s->pending_mic_error_pairwise = pairwise;
1371                         eloop_cancel_timeout(
1372                                 wpa_supplicant_delayed_mic_error_report,
1373                                 wpa_s, NULL);
1374                         eloop_register_timeout(
1375                                 sec, os_random() % 1000000,
1376                                 wpa_supplicant_delayed_mic_error_report,
1377                                 wpa_s, NULL);
1378                 } else {
1379                         wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1380                 }
1381 #else /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1382                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1383 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1384         }
1385         wpa_s->last_michael_mic_error = t.sec;
1386         wpa_s->mic_errors_seen++;
1387 }
1388
1389
1390 #ifdef CONFIG_TERMINATE_ONLASTIF
1391 static int any_interfaces(struct wpa_supplicant *head)
1392 {
1393         struct wpa_supplicant *wpa_s;
1394
1395         for (wpa_s = head; wpa_s != NULL; wpa_s = wpa_s->next)
1396                 if (!wpa_s->interface_removed)
1397                         return 1;
1398         return 0;
1399 }
1400 #endif /* CONFIG_TERMINATE_ONLASTIF */
1401
1402
1403 static void
1404 wpa_supplicant_event_interface_status(struct wpa_supplicant *wpa_s,
1405                                       union wpa_event_data *data)
1406 {
1407         if (os_strcmp(wpa_s->ifname, data->interface_status.ifname) != 0)
1408                 return;
1409
1410         switch (data->interface_status.ievent) {
1411         case EVENT_INTERFACE_ADDED:
1412                 if (!wpa_s->interface_removed)
1413                         break;
1414                 wpa_s->interface_removed = 0;
1415                 wpa_printf(MSG_DEBUG, "Configured interface was added.");
1416                 if (wpa_supplicant_driver_init(wpa_s) < 0) {
1417                         wpa_printf(MSG_INFO, "Failed to initialize the driver "
1418                                    "after interface was added.");
1419                 }
1420                 break;
1421         case EVENT_INTERFACE_REMOVED:
1422                 wpa_printf(MSG_DEBUG, "Configured interface was removed.");
1423                 wpa_s->interface_removed = 1;
1424                 wpa_supplicant_mark_disassoc(wpa_s);
1425                 l2_packet_deinit(wpa_s->l2);
1426                 wpa_s->l2 = NULL;
1427 #ifdef CONFIG_TERMINATE_ONLASTIF
1428                 /* check if last interface */
1429                 if (!any_interfaces(wpa_s->global->ifaces))
1430                         eloop_terminate();
1431 #endif /* CONFIG_TERMINATE_ONLASTIF */
1432                 break;
1433         }
1434 }
1435
1436
1437 #ifdef CONFIG_PEERKEY
1438 static void
1439 wpa_supplicant_event_stkstart(struct wpa_supplicant *wpa_s,
1440                               union wpa_event_data *data)
1441 {
1442         if (data == NULL)
1443                 return;
1444         wpa_sm_stkstart(wpa_s->wpa, data->stkstart.peer);
1445 }
1446 #endif /* CONFIG_PEERKEY */
1447
1448
1449 #ifdef CONFIG_IEEE80211R
1450 static void
1451 wpa_supplicant_event_ft_response(struct wpa_supplicant *wpa_s,
1452                                  union wpa_event_data *data)
1453 {
1454         if (data == NULL)
1455                 return;
1456
1457         if (wpa_ft_process_response(wpa_s->wpa, data->ft_ies.ies,
1458                                     data->ft_ies.ies_len,
1459                                     data->ft_ies.ft_action,
1460                                     data->ft_ies.target_ap,
1461                                     data->ft_ies.ric_ies,
1462                                     data->ft_ies.ric_ies_len) < 0) {
1463                 /* TODO: prevent MLME/driver from trying to associate? */
1464         }
1465 }
1466 #endif /* CONFIG_IEEE80211R */
1467
1468
1469 #ifdef CONFIG_IBSS_RSN
1470 static void wpa_supplicant_event_ibss_rsn_start(struct wpa_supplicant *wpa_s,
1471                                                 union wpa_event_data *data)
1472 {
1473         if (data == NULL)
1474                 return;
1475         ibss_rsn_start(wpa_s->ibss_rsn, data->ibss_rsn_start.peer);
1476 }
1477 #endif /* CONFIG_IBSS_RSN */
1478
1479
1480 #ifdef CONFIG_IEEE80211R
1481 static void ft_rx_action(struct wpa_supplicant *wpa_s, const u8 *data,
1482                          size_t len)
1483 {
1484         const u8 *sta_addr, *target_ap_addr;
1485         u16 status;
1486
1487         wpa_hexdump(MSG_MSGDUMP, "FT: RX Action", data, len);
1488         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME))
1489                 return; /* only SME case supported for now */
1490         if (len < 1 + 2 * ETH_ALEN + 2)
1491                 return;
1492         if (data[0] != 2)
1493                 return; /* Only FT Action Response is supported for now */
1494         sta_addr = data + 1;
1495         target_ap_addr = data + 1 + ETH_ALEN;
1496         status = WPA_GET_LE16(data + 1 + 2 * ETH_ALEN);
1497         wpa_printf(MSG_DEBUG, "FT: Received FT Action Response: STA " MACSTR
1498                    " TargetAP " MACSTR " status %u",
1499                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1500
1501         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1502                 wpa_printf(MSG_DEBUG, "FT: Foreign STA Address " MACSTR
1503                            " in FT Action Response", MAC2STR(sta_addr));
1504                 return;
1505         }
1506
1507         if (status) {
1508                 wpa_printf(MSG_DEBUG, "FT: FT Action Response indicates "
1509                            "failure (status code %d)", status);
1510                 /* TODO: report error to FT code(?) */
1511                 return;
1512         }
1513
1514         if (wpa_ft_process_response(wpa_s->wpa, data + 1 + 2 * ETH_ALEN + 2,
1515                                     len - (1 + 2 * ETH_ALEN + 2), 1,
1516                                     target_ap_addr, NULL, 0) < 0)
1517                 return;
1518
1519 #ifdef CONFIG_SME
1520         {
1521                 struct wpa_bss *bss;
1522                 bss = wpa_bss_get_bssid(wpa_s, target_ap_addr);
1523                 if (bss)
1524                         wpa_s->sme.freq = bss->freq;
1525                 wpa_s->sme.auth_alg = WPA_AUTH_ALG_FT;
1526                 sme_associate(wpa_s, WPAS_MODE_INFRA, target_ap_addr,
1527                               WLAN_AUTH_FT);
1528         }
1529 #endif /* CONFIG_SME */
1530 }
1531 #endif /* CONFIG_IEEE80211R */
1532
1533
1534 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
1535                           union wpa_event_data *data)
1536 {
1537         struct wpa_supplicant *wpa_s = ctx;
1538         u16 reason_code = 0;
1539
1540         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED &&
1541             event != EVENT_INTERFACE_ENABLED &&
1542             event != EVENT_INTERFACE_STATUS) {
1543                 wpa_printf(MSG_DEBUG, "Ignore event %d while interface is "
1544                            "disabled", event);
1545                 return;
1546         }
1547
1548         wpa_printf(MSG_DEBUG, "Event %d received on interface %s",
1549                    event, wpa_s->ifname);
1550
1551         switch (event) {
1552         case EVENT_AUTH:
1553                 sme_event_auth(wpa_s, data);
1554                 break;
1555         case EVENT_ASSOC:
1556                 wpa_supplicant_event_assoc(wpa_s, data);
1557                 break;
1558         case EVENT_DISASSOC:
1559                 wpa_printf(MSG_DEBUG, "Disassociation notification");
1560                 if (data) {
1561                         wpa_printf(MSG_DEBUG, " * reason %u",
1562                                    data->disassoc_info.reason_code);
1563                         if (data->disassoc_info.addr)
1564                                 wpa_printf(MSG_DEBUG, " * address " MACSTR,
1565                                            MAC2STR(data->disassoc_info.addr));
1566                 }
1567 #ifdef CONFIG_AP
1568                 if (wpa_s->ap_iface && data && data->disassoc_info.addr) {
1569                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1570                                                data->disassoc_info.addr);
1571                         break;
1572                 }
1573 #endif /* CONFIG_AP */
1574                 if (data) {
1575                         reason_code = data->disassoc_info.reason_code;
1576                         wpa_hexdump(MSG_DEBUG, "Disassociation frame IE(s)",
1577                                     data->disassoc_info.ie,
1578                                     data->disassoc_info.ie_len);
1579 #ifdef CONFIG_P2P
1580                         wpas_p2p_disassoc_notif(
1581                                 wpa_s, data->disassoc_info.addr, reason_code,
1582                                 data->disassoc_info.ie,
1583                                 data->disassoc_info.ie_len);
1584 #endif /* CONFIG_P2P */
1585                 }
1586                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
1587                         sme_event_disassoc(wpa_s, data);
1588                 /* fall through */
1589         case EVENT_DEAUTH:
1590                 if (event == EVENT_DEAUTH) {
1591                         wpa_printf(MSG_DEBUG, "Deauthentication notification");
1592                         if (data) {
1593                                 reason_code = data->deauth_info.reason_code;
1594                                 wpa_printf(MSG_DEBUG, " * reason %u",
1595                                            data->deauth_info.reason_code);
1596                                 if (data->deauth_info.addr) {
1597                                         wpa_printf(MSG_DEBUG, " * address "
1598                                                    MACSTR,
1599                                                    MAC2STR(data->deauth_info.
1600                                                            addr));
1601                                 }
1602                                 wpa_hexdump(MSG_DEBUG,
1603                                             "Deauthentication frame IE(s)",
1604                                             data->deauth_info.ie,
1605                                             data->deauth_info.ie_len);
1606 #ifdef CONFIG_P2P
1607                                 wpas_p2p_deauth_notif(
1608                                         wpa_s, data->deauth_info.addr,
1609                                         reason_code,
1610                                         data->deauth_info.ie,
1611                                         data->deauth_info.ie_len);
1612 #endif /* CONFIG_P2P */
1613                         }
1614                 }
1615 #ifdef CONFIG_AP
1616                 if (wpa_s->ap_iface && data && data->deauth_info.addr) {
1617                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1618                                                data->deauth_info.addr);
1619                         break;
1620                 }
1621 #endif /* CONFIG_AP */
1622                 wpa_supplicant_event_disassoc(wpa_s, reason_code);
1623                 break;
1624         case EVENT_MICHAEL_MIC_FAILURE:
1625                 wpa_supplicant_event_michael_mic_failure(wpa_s, data);
1626                 break;
1627 #ifndef CONFIG_NO_SCAN_PROCESSING
1628         case EVENT_SCAN_RESULTS:
1629                 wpa_supplicant_event_scan_results(wpa_s, data);
1630                 break;
1631 #endif /* CONFIG_NO_SCAN_PROCESSING */
1632         case EVENT_ASSOCINFO:
1633                 wpa_supplicant_event_associnfo(wpa_s, data);
1634                 break;
1635         case EVENT_INTERFACE_STATUS:
1636                 wpa_supplicant_event_interface_status(wpa_s, data);
1637                 break;
1638         case EVENT_PMKID_CANDIDATE:
1639                 wpa_supplicant_event_pmkid_candidate(wpa_s, data);
1640                 break;
1641 #ifdef CONFIG_PEERKEY
1642         case EVENT_STKSTART:
1643                 wpa_supplicant_event_stkstart(wpa_s, data);
1644                 break;
1645 #endif /* CONFIG_PEERKEY */
1646 #ifdef CONFIG_IEEE80211R
1647         case EVENT_FT_RESPONSE:
1648                 wpa_supplicant_event_ft_response(wpa_s, data);
1649                 break;
1650 #endif /* CONFIG_IEEE80211R */
1651 #ifdef CONFIG_IBSS_RSN
1652         case EVENT_IBSS_RSN_START:
1653                 wpa_supplicant_event_ibss_rsn_start(wpa_s, data);
1654                 break;
1655 #endif /* CONFIG_IBSS_RSN */
1656         case EVENT_ASSOC_REJECT:
1657                 sme_event_assoc_reject(wpa_s, data);
1658                 break;
1659         case EVENT_AUTH_TIMED_OUT:
1660                 sme_event_auth_timed_out(wpa_s, data);
1661                 break;
1662         case EVENT_ASSOC_TIMED_OUT:
1663                 sme_event_assoc_timed_out(wpa_s, data);
1664                 break;
1665 #ifdef CONFIG_AP
1666         case EVENT_TX_STATUS:
1667                 wpa_printf(MSG_DEBUG, "EVENT_TX_STATUS on %s dst=" MACSTR
1668                            " type=%d stype=%d pending_dst=" MACSTR,
1669                            wpa_s->ifname, MAC2STR(data->tx_status.dst),
1670                            data->tx_status.type, data->tx_status.stype,
1671                            MAC2STR(wpa_s->parent->pending_action_dst));
1672                 if (wpa_s->ap_iface == NULL) {
1673 #ifdef CONFIG_P2P
1674                         if (data->tx_status.type == WLAN_FC_TYPE_MGMT &&
1675                             data->tx_status.stype == WLAN_FC_STYPE_ACTION)
1676                                 wpas_send_action_tx_status(
1677                                         wpa_s, data->tx_status.dst,
1678                                         data->tx_status.data,
1679                                         data->tx_status.data_len,
1680                                         data->tx_status.ack ?
1681                                         P2P_SEND_ACTION_SUCCESS :
1682                                         P2P_SEND_ACTION_NO_ACK);
1683 #endif /* CONFIG_P2P */
1684                         break;
1685                 }
1686 #ifdef CONFIG_P2P
1687                 /*
1688                  * Catch TX status events for Action frames we sent via group
1689                  * interface in GO mode.
1690                  */
1691                 if (data->tx_status.type == WLAN_FC_TYPE_MGMT &&
1692                     data->tx_status.stype == WLAN_FC_STYPE_ACTION &&
1693                     os_memcmp(wpa_s->parent->pending_action_dst,
1694                               data->tx_status.dst, ETH_ALEN) == 0) {
1695                         wpas_send_action_tx_status(
1696                                 wpa_s->parent, data->tx_status.dst,
1697                                 data->tx_status.data,
1698                                 data->tx_status.data_len,
1699                                 data->tx_status.ack);
1700                         break;
1701                 }
1702 #endif /* CONFIG_P2P */
1703                 switch (data->tx_status.type) {
1704                 case WLAN_FC_TYPE_MGMT:
1705                         ap_mgmt_tx_cb(wpa_s, data->tx_status.data,
1706                                       data->tx_status.data_len,
1707                                       data->tx_status.stype,
1708                                       data->tx_status.ack);
1709                         break;
1710                 case WLAN_FC_TYPE_DATA:
1711                         ap_tx_status(wpa_s, data->tx_status.dst,
1712                                      data->tx_status.data,
1713                                      data->tx_status.data_len,
1714                                      data->tx_status.ack);
1715                         break;
1716                 }
1717                 break;
1718         case EVENT_RX_FROM_UNKNOWN:
1719                 if (wpa_s->ap_iface == NULL)
1720                         break;
1721                 ap_rx_from_unknown_sta(wpa_s, data->rx_from_unknown.frame,
1722                                        data->rx_from_unknown.len);
1723                 break;
1724         case EVENT_RX_MGMT:
1725                 if (wpa_s->ap_iface == NULL) {
1726 #ifdef CONFIG_P2P
1727                         u16 fc, stype;
1728                         const struct ieee80211_mgmt *mgmt;
1729                         mgmt = (const struct ieee80211_mgmt *)
1730                                 data->rx_mgmt.frame;
1731                         fc = le_to_host16(mgmt->frame_control);
1732                         stype = WLAN_FC_GET_STYPE(fc);
1733                         if (stype == WLAN_FC_STYPE_PROBE_REQ &&
1734                             data->rx_mgmt.frame_len > 24) {
1735                                 const u8 *src = mgmt->sa;
1736                                 const u8 *ie = mgmt->u.probe_req.variable;
1737                                 size_t ie_len = data->rx_mgmt.frame_len -
1738                                         (mgmt->u.probe_req.variable -
1739                                          data->rx_mgmt.frame);
1740                                 wpas_p2p_probe_req_rx(wpa_s, src, ie, ie_len);
1741                                 break;
1742                         }
1743 #endif /* CONFIG_P2P */
1744                         wpa_printf(MSG_DEBUG, "AP: ignore received management "
1745                                    "frame in non-AP mode");
1746                         break;
1747                 }
1748                 ap_mgmt_rx(wpa_s, &data->rx_mgmt);
1749                 break;
1750 #endif /* CONFIG_AP */
1751         case EVENT_RX_ACTION:
1752                 wpa_printf(MSG_DEBUG, "Received Action frame: SA=" MACSTR
1753                            " Category=%u DataLen=%d freq=%d MHz",
1754                            MAC2STR(data->rx_action.sa),
1755                            data->rx_action.category, (int) data->rx_action.len,
1756                            data->rx_action.freq);
1757 #ifdef CONFIG_IEEE80211R
1758                 if (data->rx_action.category == WLAN_ACTION_FT) {
1759                         ft_rx_action(wpa_s, data->rx_action.data,
1760                                      data->rx_action.len);
1761                         break;
1762                 }
1763 #endif /* CONFIG_IEEE80211R */
1764 #ifdef CONFIG_P2P
1765                 wpas_p2p_rx_action(wpa_s, data->rx_action.da,
1766                                    data->rx_action.sa,
1767                                    data->rx_action.bssid,
1768                                    data->rx_action.category,
1769                                    data->rx_action.data,
1770                                    data->rx_action.len, data->rx_action.freq);
1771 #endif /* CONFIG_P2P */
1772                 break;
1773 #ifdef CONFIG_P2P
1774         case EVENT_REMAIN_ON_CHANNEL:
1775                 wpas_p2p_remain_on_channel_cb(
1776                         wpa_s, data->remain_on_channel.freq,
1777                         data->remain_on_channel.duration);
1778                 break;
1779         case EVENT_CANCEL_REMAIN_ON_CHANNEL:
1780                 wpas_p2p_cancel_remain_on_channel_cb(
1781                         wpa_s, data->remain_on_channel.freq);
1782                 break;
1783         case EVENT_RX_PROBE_REQ:
1784                 wpas_p2p_probe_req_rx(wpa_s, data->rx_probe_req.sa,
1785                                       data->rx_probe_req.ie,
1786                                       data->rx_probe_req.ie_len);
1787                 break;
1788 #endif /* CONFIG_P2P */
1789 #ifdef CONFIG_CLIENT_MLME
1790         case EVENT_MLME_RX: {
1791                 struct ieee80211_rx_status rx_status;
1792                 os_memset(&rx_status, 0, sizeof(rx_status));
1793                 rx_status.freq = data->mlme_rx.freq;
1794                 rx_status.channel = data->mlme_rx.channel;
1795                 rx_status.ssi = data->mlme_rx.ssi;
1796                 ieee80211_sta_rx(wpa_s, data->mlme_rx.buf, data->mlme_rx.len,
1797                                  &rx_status);
1798                 break;
1799         }
1800 #endif /* CONFIG_CLIENT_MLME */
1801         case EVENT_EAPOL_RX:
1802                 wpa_supplicant_rx_eapol(wpa_s, data->eapol_rx.src,
1803                                         data->eapol_rx.data,
1804                                         data->eapol_rx.data_len);
1805                 break;
1806         case EVENT_SIGNAL_CHANGE:
1807                 bgscan_notify_signal_change(
1808                         wpa_s, data->signal_change.above_threshold,
1809                         data->signal_change.current_signal,
1810                         data->signal_change.current_noise,
1811                         data->signal_change.current_txrate);
1812                 break;
1813         case EVENT_INTERFACE_ENABLED:
1814                 wpa_printf(MSG_DEBUG, "Interface was enabled");
1815                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
1816 #ifdef CONFIG_AP
1817                         if (!wpa_s->ap_iface) {
1818                                 wpa_supplicant_set_state(wpa_s,
1819                                                          WPA_DISCONNECTED);
1820                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1821                         } else
1822                                 wpa_supplicant_set_state(wpa_s,
1823                                                          WPA_COMPLETED);
1824 #else /* CONFIG_AP */
1825                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1826                         wpa_supplicant_req_scan(wpa_s, 0, 0);
1827 #endif /* CONFIG_AP */
1828                 }
1829                 break;
1830         case EVENT_INTERFACE_DISABLED:
1831                 wpa_printf(MSG_DEBUG, "Interface was disabled");
1832                 wpa_supplicant_mark_disassoc(wpa_s);
1833                 wpa_supplicant_set_state(wpa_s, WPA_INTERFACE_DISABLED);
1834                 break;
1835         case EVENT_CHANNEL_LIST_CHANGED:
1836 #ifdef CONFIG_P2P
1837                 wpas_p2p_update_channel_list(wpa_s);
1838 #endif /* CONFIG_P2P */
1839                 break;
1840         default:
1841                 wpa_printf(MSG_INFO, "Unknown event %d", event);
1842                 break;
1843         }
1844 }