wpa_supplicant/events.c

   1 /*
   2  * WPA Supplicant - Driver event processing
   3  * Copyright (c) 2003-2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "rsn_supp/wpa.h"
  20 #include "eloop.h"
  21 #include "config.h"
  22 #include "l2_packet/l2_packet.h"
  23 #include "wpa_supplicant_i.h"
  24 #include "driver_i.h"
  25 #include "pcsc_funcs.h"
  26 #include "rsn_supp/preauth.h"
  27 #include "rsn_supp/pmksa_cache.h"
  28 #include "common/wpa_ctrl.h"
  29 #include "eap_peer/eap.h"
  30 #include "ap/hostapd.h"
  31 #include "notify.h"
  32 #include "common/ieee802_11_defs.h"
  33 #include "blacklist.h"
  34 #include "wpas_glue.h"
  35 #include "wps_supplicant.h"
  36 #include "ibss_rsn.h"
  37 #include "sme.h"
  38 #include "bgscan.h"
  39 #include "ap.h"
  40 #include "bss.h"
  41 #include "mlme.h"
  42 #include "scan.h"
  43
  44
  45 static int wpa_supplicant_select_config(struct wpa_supplicant *wpa_s)
  46 {
  47         struct wpa_ssid *ssid, *old_ssid;
  48
  49         if (wpa_s->conf->ap_scan == 1 && wpa_s->current_ssid)
  50                 return 0;
  51
  52         wpa_printf(MSG_DEBUG, "Select network based on association "
  53                    "information");
  54         ssid = wpa_supplicant_get_ssid(wpa_s);
  55         if (ssid == NULL) {
  56                 wpa_printf(MSG_INFO, "No network configuration found for the "
  57                            "current AP");
  58                 return -1;
  59         }
  60
  61         if (ssid->disabled) {
  62                 wpa_printf(MSG_DEBUG, "Selected network is disabled");
  63                 return -1;
  64         }
  65
  66         wpa_printf(MSG_DEBUG, "Network configuration found for the current "
  67                    "AP");
  68         if (ssid->key_mgmt & (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_IEEE8021X |
  69                               WPA_KEY_MGMT_WPA_NONE |
  70                               WPA_KEY_MGMT_FT_PSK | WPA_KEY_MGMT_FT_IEEE8021X |
  71                               WPA_KEY_MGMT_PSK_SHA256 |
  72                               WPA_KEY_MGMT_IEEE8021X_SHA256)) {
  73                 u8 wpa_ie[80];
  74                 size_t wpa_ie_len = sizeof(wpa_ie);
  75                 wpa_supplicant_set_suites(wpa_s, NULL, ssid,
  76                                           wpa_ie, &wpa_ie_len);
  77         } else {
  78                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
  79         }
  80
  81         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid)
  82                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
  83         old_ssid = wpa_s->current_ssid;
  84         wpa_s->current_ssid = ssid;
  85         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
  86         wpa_supplicant_initiate_eapol(wpa_s);
  87         if (old_ssid != wpa_s->current_ssid)
  88                 wpas_notify_network_changed(wpa_s);
  89
  90         return 0;
  91 }
  92
  93
  94 static void wpa_supplicant_stop_countermeasures(void *eloop_ctx,
  95                                                 void *sock_ctx)
  96 {
  97         struct wpa_supplicant *wpa_s = eloop_ctx;
  98
  99         if (wpa_s->countermeasures) {
 100                 wpa_s->countermeasures = 0;
 101                 wpa_drv_set_countermeasures(wpa_s, 0);
 102                 wpa_msg(wpa_s, MSG_INFO, "WPA: TKIP countermeasures stopped");
 103                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 104         }
 105 }
 106
 107
 108 void wpa_supplicant_mark_disassoc(struct wpa_supplicant *wpa_s)
 109 {
 110         int bssid_changed;
 111
 112         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 113         bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
 114         os_memset(wpa_s->bssid, 0, ETH_ALEN);
 115         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
 116         wpa_s->current_bss = NULL;
 117         if (bssid_changed)
 118                 wpas_notify_bssid_changed(wpa_s);
 119
 120         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
 121         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
 122         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt))
 123                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 124         wpa_s->ap_ies_from_associnfo = 0;
 125 }
 126
 127
 128 static void wpa_find_assoc_pmkid(struct wpa_supplicant *wpa_s)
 129 {
 130         struct wpa_ie_data ie;
 131         int pmksa_set = -1;
 132         size_t i;
 133
 134         if (wpa_sm_parse_own_wpa_ie(wpa_s->wpa, &ie) < 0 ||
 135             ie.pmkid == NULL)
 136                 return;
 137
 138         for (i = 0; i < ie.num_pmkid; i++) {
 139                 pmksa_set = pmksa_cache_set_current(wpa_s->wpa,
 140                                                     ie.pmkid + i * PMKID_LEN,
 141                                                     NULL, NULL, 0);
 142                 if (pmksa_set == 0) {
 143                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
 144                         break;
 145                 }
 146         }
 147
 148         wpa_printf(MSG_DEBUG, "RSN: PMKID from assoc IE %sfound from PMKSA "
 149                    "cache", pmksa_set == 0 ? "" : "not ");
 150 }
 151
 152
 153 static void wpa_supplicant_event_pmkid_candidate(struct wpa_supplicant *wpa_s,
 154                                                  union wpa_event_data *data)
 155 {
 156         if (data == NULL) {
 157                 wpa_printf(MSG_DEBUG, "RSN: No data in PMKID candidate event");
 158                 return;
 159         }
 160         wpa_printf(MSG_DEBUG, "RSN: PMKID candidate event - bssid=" MACSTR
 161                    " index=%d preauth=%d",
 162                    MAC2STR(data->pmkid_candidate.bssid),
 163                    data->pmkid_candidate.index,
 164                    data->pmkid_candidate.preauth);
 165
 166         pmksa_candidate_add(wpa_s->wpa, data->pmkid_candidate.bssid,
 167                             data->pmkid_candidate.index,
 168                             data->pmkid_candidate.preauth);
 169 }
 170
 171
 172 static int wpa_supplicant_dynamic_keys(struct wpa_supplicant *wpa_s)
 173 {
 174         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 175             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 176                 return 0;
 177
 178 #ifdef IEEE8021X_EAPOL
 179         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 180             wpa_s->current_ssid &&
 181             !(wpa_s->current_ssid->eapol_flags &
 182               (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 183                EAPOL_FLAG_REQUIRE_KEY_BROADCAST))) {
 184                 /* IEEE 802.1X, but not using dynamic WEP keys (i.e., either
 185                  * plaintext or static WEP keys). */
 186                 return 0;
 187         }
 188 #endif /* IEEE8021X_EAPOL */
 189
 190         return 1;
 191 }
 192
 193
 194 /**
 195  * wpa_supplicant_scard_init - Initialize SIM/USIM access with PC/SC
 196  * @wpa_s: pointer to wpa_supplicant data
 197  * @ssid: Configuration data for the network
 198  * Returns: 0 on success, -1 on failure
 199  *
 200  * This function is called when starting authentication with a network that is
 201  * configured to use PC/SC for SIM/USIM access (EAP-SIM or EAP-AKA).
 202  */
 203 int wpa_supplicant_scard_init(struct wpa_supplicant *wpa_s,
 204                               struct wpa_ssid *ssid)
 205 {
 206 #ifdef IEEE8021X_EAPOL
 207         int aka = 0, sim = 0, type;
 208
 209         if (ssid->eap.pcsc == NULL || wpa_s->scard != NULL)
 210                 return 0;
 211
 212         if (ssid->eap.eap_methods == NULL) {
 213                 sim = 1;
 214                 aka = 1;
 215         } else {
 216                 struct eap_method_type *eap = ssid->eap.eap_methods;
 217                 while (eap->vendor != EAP_VENDOR_IETF ||
 218                        eap->method != EAP_TYPE_NONE) {
 219                         if (eap->vendor == EAP_VENDOR_IETF) {
 220                                 if (eap->method == EAP_TYPE_SIM)
 221                                         sim = 1;
 222                                 else if (eap->method == EAP_TYPE_AKA)
 223                                         aka = 1;
 224                         }
 225                         eap++;
 226                 }
 227         }
 228
 229         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_SIM) == NULL)
 230                 sim = 0;
 231         if (eap_peer_get_eap_method(EAP_VENDOR_IETF, EAP_TYPE_AKA) == NULL)
 232                 aka = 0;
 233
 234         if (!sim && !aka) {
 235                 wpa_printf(MSG_DEBUG, "Selected network is configured to use "
 236                            "SIM, but neither EAP-SIM nor EAP-AKA are enabled");
 237                 return 0;
 238         }
 239
 240         wpa_printf(MSG_DEBUG, "Selected network is configured to use SIM "
 241                    "(sim=%d aka=%d) - initialize PCSC", sim, aka);
 242         if (sim && aka)
 243                 type = SCARD_TRY_BOTH;
 244         else if (aka)
 245                 type = SCARD_USIM_ONLY;
 246         else
 247                 type = SCARD_GSM_SIM_ONLY;
 248
 249         wpa_s->scard = scard_init(type);
 250         if (wpa_s->scard == NULL) {
 251                 wpa_printf(MSG_WARNING, "Failed to initialize SIM "
 252                            "(pcsc-lite)");
 253                 return -1;
 254         }
 255         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
 256         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
 257 #endif /* IEEE8021X_EAPOL */
 258
 259         return 0;
 260 }
 261
 262
 263 #ifndef CONFIG_NO_SCAN_PROCESSING
 264 static int wpa_supplicant_match_privacy(struct wpa_scan_res *bss,
 265                                         struct wpa_ssid *ssid)
 266 {
 267         int i, privacy = 0;
 268
 269         if (ssid->mixed_cell)
 270                 return 1;
 271
 272 #ifdef CONFIG_WPS
 273         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 274                 return 1;
 275 #endif /* CONFIG_WPS */
 276
 277         for (i = 0; i < NUM_WEP_KEYS; i++) {
 278                 if (ssid->wep_key_len[i]) {
 279                         privacy = 1;
 280                         break;
 281                 }
 282         }
 283 #ifdef IEEE8021X_EAPOL
 284         if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
 285             ssid->eapol_flags & (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
 286                                  EAPOL_FLAG_REQUIRE_KEY_BROADCAST))
 287                 privacy = 1;
 288 #endif /* IEEE8021X_EAPOL */
 289
 290         if (bss->caps & IEEE80211_CAP_PRIVACY)
 291                 return privacy;
 292         return !privacy;
 293 }
 294
 295
 296 static int wpa_supplicant_ssid_bss_match(struct wpa_supplicant *wpa_s,
 297                                          struct wpa_ssid *ssid,
 298                                          struct wpa_scan_res *bss)
 299 {
 300         struct wpa_ie_data ie;
 301         int proto_match = 0;
 302         const u8 *rsn_ie, *wpa_ie;
 303         int ret;
 304
 305         ret = wpas_wps_ssid_bss_match(wpa_s, ssid, bss);
 306         if (ret >= 0)
 307                 return ret;
 308
 309         rsn_ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 310         while ((ssid->proto & WPA_PROTO_RSN) && rsn_ie) {
 311                 proto_match++;
 312
 313                 if (wpa_parse_wpa_ie(rsn_ie, 2 + rsn_ie[1], &ie)) {
 314                         wpa_printf(MSG_DEBUG, "   skip RSN IE - parse failed");
 315                         break;
 316                 }
 317                 if (!(ie.proto & ssid->proto)) {
 318                         wpa_printf(MSG_DEBUG, "   skip RSN IE - proto "
 319                                    "mismatch");
 320                         break;
 321                 }
 322
 323                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 324                         wpa_printf(MSG_DEBUG, "   skip RSN IE - PTK cipher "
 325                                    "mismatch");
 326                         break;
 327                 }
 328
 329                 if (!(ie.group_cipher & ssid->group_cipher)) {
 330                         wpa_printf(MSG_DEBUG, "   skip RSN IE - GTK cipher "
 331                                    "mismatch");
 332                         break;
 333                 }
 334
 335                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 336                         wpa_printf(MSG_DEBUG, "   skip RSN IE - key mgmt "
 337                                    "mismatch");
 338                         break;
 339                 }
 340
 341 #ifdef CONFIG_IEEE80211W
 342                 if (!(ie.capabilities & WPA_CAPABILITY_MFPC) &&
 343                     ssid->ieee80211w == MGMT_FRAME_PROTECTION_REQUIRED) {
 344                         wpa_printf(MSG_DEBUG, "   skip RSN IE - no mgmt frame "
 345                                    "protection");
 346                         break;
 347                 }
 348 #endif /* CONFIG_IEEE80211W */
 349
 350                 wpa_printf(MSG_DEBUG, "   selected based on RSN IE");
 351                 return 1;
 352         }
 353
 354         wpa_ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 355         while ((ssid->proto & WPA_PROTO_WPA) && wpa_ie) {
 356                 proto_match++;
 357
 358                 if (wpa_parse_wpa_ie(wpa_ie, 2 + wpa_ie[1], &ie)) {
 359                         wpa_printf(MSG_DEBUG, "   skip WPA IE - parse failed");
 360                         break;
 361                 }
 362                 if (!(ie.proto & ssid->proto)) {
 363                         wpa_printf(MSG_DEBUG, "   skip WPA IE - proto "
 364                                    "mismatch");
 365                         break;
 366                 }
 367
 368                 if (!(ie.pairwise_cipher & ssid->pairwise_cipher)) {
 369                         wpa_printf(MSG_DEBUG, "   skip WPA IE - PTK cipher "
 370                                    "mismatch");
 371                         break;
 372                 }
 373
 374                 if (!(ie.group_cipher & ssid->group_cipher)) {
 375                         wpa_printf(MSG_DEBUG, "   skip WPA IE - GTK cipher "
 376                                    "mismatch");
 377                         break;
 378                 }
 379
 380                 if (!(ie.key_mgmt & ssid->key_mgmt)) {
 381                         wpa_printf(MSG_DEBUG, "   skip WPA IE - key mgmt "
 382                                    "mismatch");
 383                         break;
 384                 }
 385
 386                 wpa_printf(MSG_DEBUG, "   selected based on WPA IE");
 387                 return 1;
 388         }
 389
 390         if (proto_match == 0)
 391                 wpa_printf(MSG_DEBUG, "   skip - no WPA/RSN proto match");
 392
 393         return 0;
 394 }
 395
 396
 397 static struct wpa_bss *
 398 wpa_supplicant_select_bss_wpa(struct wpa_supplicant *wpa_s,
 399                               struct wpa_scan_results *scan_res,
 400                               struct wpa_ssid *group,
 401                               struct wpa_ssid **selected_ssid)
 402 {
 403         struct wpa_ssid *ssid;
 404         struct wpa_scan_res *bss;
 405         size_t i;
 406         struct wpa_blacklist *e;
 407         const u8 *ie;
 408
 409         wpa_printf(MSG_DEBUG, "Try to find WPA-enabled AP");
 410         for (i = 0; i < scan_res->num; i++) {
 411                 const u8 *ssid_;
 412                 u8 wpa_ie_len, rsn_ie_len, ssid_len;
 413                 bss = scan_res->res[i];
 414
 415                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 416                 ssid_ = ie ? ie + 2 : (u8 *) "";
 417                 ssid_len = ie ? ie[1] : 0;
 418
 419                 ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 420                 wpa_ie_len = ie ? ie[1] : 0;
 421
 422                 ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 423                 rsn_ie_len = ie ? ie[1] : 0;
 424
 425                 wpa_printf(MSG_DEBUG, "%d: " MACSTR " ssid='%s' "
 426                            "wpa_ie_len=%u rsn_ie_len=%u caps=0x%x",
 427                            (int) i, MAC2STR(bss->bssid),
 428                            wpa_ssid_txt(ssid_, ssid_len),
 429                            wpa_ie_len, rsn_ie_len, bss->caps);
 430
 431                 e = wpa_blacklist_get(wpa_s, bss->bssid);
 432                 if (e && e->count > 1) {
 433                         wpa_printf(MSG_DEBUG, "   skip - blacklisted");
 434                         continue;
 435                 }
 436
 437                 if (ssid_len == 0) {
 438                         wpa_printf(MSG_DEBUG, "   skip - SSID not known");
 439                         continue;
 440                 }
 441
 442                 if (wpa_ie_len == 0 && rsn_ie_len == 0) {
 443                         wpa_printf(MSG_DEBUG, "   skip - no WPA/RSN IE");
 444                         continue;
 445                 }
 446
 447                 for (ssid = group; ssid; ssid = ssid->pnext) {
 448                         int check_ssid = 1;
 449
 450                         if (ssid->disabled) {
 451                                 wpa_printf(MSG_DEBUG, "   skip - disabled");
 452                                 continue;
 453                         }
 454
 455 #ifdef CONFIG_WPS
 456                         if (ssid->ssid_len == 0 &&
 457                             wpas_wps_ssid_wildcard_ok(wpa_s, ssid, bss))
 458                                 check_ssid = 0;
 459 #endif /* CONFIG_WPS */
 460
 461                         if (check_ssid &&
 462                             (ssid_len != ssid->ssid_len ||
 463                              os_memcmp(ssid_, ssid->ssid, ssid_len) != 0)) {
 464                                 wpa_printf(MSG_DEBUG, "   skip - "
 465                                            "SSID mismatch");
 466                                 continue;
 467                         }
 468
 469                         if (ssid->bssid_set &&
 470                             os_memcmp(bss->bssid, ssid->bssid, ETH_ALEN) != 0)
 471                         {
 472                                 wpa_printf(MSG_DEBUG, "   skip - "
 473                                            "BSSID mismatch");
 474                                 continue;
 475                         }
 476
 477                         if (!wpa_supplicant_ssid_bss_match(wpa_s, ssid, bss))
 478                                 continue;
 479
 480                         wpa_printf(MSG_DEBUG, "   selected WPA AP "
 481                                    MACSTR " ssid='%s'",
 482                                    MAC2STR(bss->bssid),
 483                                    wpa_ssid_txt(ssid_, ssid_len));
 484                         *selected_ssid = ssid;
 485                         return wpa_bss_get(wpa_s, bss->bssid, ssid_, ssid_len);
 486                 }
 487         }
 488
 489         return NULL;
 490 }
 491
 492
 493 static struct wpa_bss *
 494 wpa_supplicant_select_bss_non_wpa(struct wpa_supplicant *wpa_s,
 495                                   struct wpa_scan_results *scan_res,
 496                                   struct wpa_ssid *group,
 497                                   struct wpa_ssid **selected_ssid)
 498 {
 499         struct wpa_ssid *ssid;
 500         struct wpa_scan_res *bss;
 501         size_t i;
 502         struct wpa_blacklist *e;
 503         const u8 *ie;
 504
 505         wpa_printf(MSG_DEBUG, "Try to find non-WPA AP");
 506         for (i = 0; i < scan_res->num; i++) {
 507                 const u8 *ssid_;
 508                 u8 wpa_ie_len, rsn_ie_len, ssid_len;
 509                 bss = scan_res->res[i];
 510
 511                 ie = wpa_scan_get_ie(bss, WLAN_EID_SSID);
 512                 ssid_ = ie ? ie + 2 : (u8 *) "";
 513                 ssid_len = ie ? ie[1] : 0;
 514
 515                 ie = wpa_scan_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
 516                 wpa_ie_len = ie ? ie[1] : 0;
 517
 518                 ie = wpa_scan_get_ie(bss, WLAN_EID_RSN);
 519                 rsn_ie_len = ie ? ie[1] : 0;
 520
 521                 wpa_printf(MSG_DEBUG, "%d: " MACSTR " ssid='%s' "
 522                            "wpa_ie_len=%u rsn_ie_len=%u caps=0x%x",
 523                            (int) i, MAC2STR(bss->bssid),
 524                            wpa_ssid_txt(ssid_, ssid_len),
 525                            wpa_ie_len, rsn_ie_len, bss->caps);
 526
 527                 e = wpa_blacklist_get(wpa_s, bss->bssid);
 528                 if (e && e->count > 1) {
 529                         wpa_printf(MSG_DEBUG, "   skip - blacklisted");
 530                         continue;
 531                 }
 532
 533                 if (ssid_len == 0) {
 534                         wpa_printf(MSG_DEBUG, "   skip - SSID not known");
 535                         continue;
 536                 }
 537
 538                 for (ssid = group; ssid; ssid = ssid->pnext) {
 539                         int check_ssid = ssid->ssid_len != 0;
 540
 541                         if (ssid->disabled) {
 542                                 wpa_printf(MSG_DEBUG, "   skip - disabled");
 543                                 continue;
 544                         }
 545
 546 #ifdef CONFIG_WPS
 547                         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
 548                                 /* Only allow wildcard SSID match if an AP
 549                                  * advertises active WPS operation that matches
 550                                  * with our mode. */
 551                                 check_ssid = 1;
 552                                 if (ssid->ssid_len == 0 &&
 553                                     wpas_wps_ssid_wildcard_ok(wpa_s, ssid,
 554                                                               bss))
 555                                         check_ssid = 0;
 556                         }
 557 #endif /* CONFIG_WPS */
 558
 559                         if (check_ssid &&
 560                             (ssid_len != ssid->ssid_len ||
 561                              os_memcmp(ssid_, ssid->ssid, ssid_len) != 0)) {
 562                                 wpa_printf(MSG_DEBUG, "   skip - "
 563                                            "SSID mismatch");
 564                                 continue;
 565                         }
 566
 567                         if (ssid->bssid_set &&
 568                             os_memcmp(bss->bssid, ssid->bssid, ETH_ALEN) != 0)
 569                         {
 570                                 wpa_printf(MSG_DEBUG, "   skip - "
 571                                            "BSSID mismatch");
 572                                 continue;
 573                         }
 574
 575                         if (!(ssid->key_mgmt & WPA_KEY_MGMT_NONE) &&
 576                             !(ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
 577                             !(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA))
 578                         {
 579                                 wpa_printf(MSG_DEBUG, "   skip - "
 580                                            "non-WPA network not allowed");
 581                                 continue;
 582                         }
 583
 584                         if ((ssid->key_mgmt &
 585                              (WPA_KEY_MGMT_IEEE8021X | WPA_KEY_MGMT_PSK |
 586                               WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK |
 587                               WPA_KEY_MGMT_IEEE8021X_SHA256 |
 588                               WPA_KEY_MGMT_PSK_SHA256)) &&
 589                             (wpa_ie_len != 0 || rsn_ie_len != 0)) {
 590                                 wpa_printf(MSG_DEBUG, "   skip - "
 591                                            "WPA network");
 592                                 continue;
 593                         }
 594
 595                         if (!wpa_supplicant_match_privacy(bss, ssid)) {
 596                                 wpa_printf(MSG_DEBUG, "   skip - "
 597                                            "privacy mismatch");
 598                                 continue;
 599                         }
 600
 601                         if (bss->caps & IEEE80211_CAP_IBSS) {
 602                                 wpa_printf(MSG_DEBUG, "   skip - "
 603                                            "IBSS (adhoc) network");
 604                                 continue;
 605                         }
 606
 607                         wpa_printf(MSG_DEBUG, "   selected non-WPA AP "
 608                                    MACSTR " ssid='%s'",
 609                                    MAC2STR(bss->bssid),
 610                                    wpa_ssid_txt(ssid_, ssid_len));
 611                         *selected_ssid = ssid;
 612                         return wpa_bss_get(wpa_s, bss->bssid, ssid_, ssid_len);
 613                 }
 614         }
 615
 616         return NULL;
 617 }
 618
 619
 620 static struct wpa_bss *
 621 wpa_supplicant_select_bss(struct wpa_supplicant *wpa_s,
 622                           struct wpa_scan_results *scan_res,
 623                           struct wpa_ssid *group,
 624                           struct wpa_ssid **selected_ssid)
 625 {
 626         struct wpa_bss *selected;
 627
 628         wpa_printf(MSG_DEBUG, "Selecting BSS from priority group %d",
 629                    group->priority);
 630
 631         /* First, try to find WPA-enabled AP */
 632         selected = wpa_supplicant_select_bss_wpa(wpa_s, scan_res, group,
 633                                                  selected_ssid);
 634         if (selected)
 635                 return selected;
 636
 637         /* If no WPA-enabled AP found, try to find non-WPA AP, if configuration
 638          * allows this. */
 639         return wpa_supplicant_select_bss_non_wpa(wpa_s, scan_res, group,
 640                                                  selected_ssid);
 641 }
 642
 643
 644 static struct wpa_bss *
 645 wpa_supplicant_pick_network(struct wpa_supplicant *wpa_s,
 646                             struct wpa_scan_results *scan_res,
 647                             struct wpa_ssid **selected_ssid)
 648 {
 649         struct wpa_bss *selected = NULL;
 650         int prio;
 651
 652         while (selected == NULL) {
 653                 for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 654                         selected = wpa_supplicant_select_bss(
 655                                 wpa_s, scan_res, wpa_s->conf->pssid[prio],
 656                                 selected_ssid);
 657                         if (selected)
 658                                 break;
 659                 }
 660
 661                 if (selected == NULL && wpa_s->blacklist) {
 662                         wpa_printf(MSG_DEBUG, "No APs found - clear blacklist "
 663                                    "and try again");
 664                         wpa_blacklist_clear(wpa_s);
 665                         wpa_s->blacklist_cleared++;
 666                 } else if (selected == NULL)
 667                         break;
 668         }
 669
 670         return selected;
 671 }
 672
 673
 674 static void wpa_supplicant_req_new_scan(struct wpa_supplicant *wpa_s,
 675                                         int timeout)
 676 {
 677         if (wpa_s->scan_res_tried == 1 && wpa_s->conf->ap_scan == 1) {
 678                 /*
 679                  * Quick recovery if the initial scan results were not
 680                  * complete when fetched before the first scan request.
 681                  */
 682                 wpa_s->scan_res_tried++;
 683                 timeout = 0;
 684         } else if (!wpa_supplicant_enabled_networks(wpa_s->conf)) {
 685                 /*
 686                  * No networks are enabled; short-circuit request so
 687                  * we don't wait timeout seconds before transitioning
 688                  * to INACTIVE state.
 689                  */
 690                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 691                 return;
 692         }
 693         wpa_supplicant_req_scan(wpa_s, timeout, 0);
 694 }
 695
 696
 697 static void wpa_supplicant_connect(struct wpa_supplicant *wpa_s,
 698                                    struct wpa_bss *selected,
 699                                    struct wpa_ssid *ssid)
 700 {
 701         if (wpas_wps_scan_pbc_overlap(wpa_s, selected, ssid)) {
 702                 wpa_msg(wpa_s, MSG_INFO, WPS_EVENT_OVERLAP
 703                         "PBC session overlap");
 704                 wpa_supplicant_req_new_scan(wpa_s, 10);
 705                 return;
 706         }
 707
 708         /*
 709          * Do not trigger new association unless the BSSID has changed or if
 710          * reassociation is requested. If we are in process of associating with
 711          * the selected BSSID, do not trigger new attempt.
 712          */
 713         if (wpa_s->reassociate ||
 714             (os_memcmp(selected->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
 715              (wpa_s->wpa_state != WPA_ASSOCIATING ||
 716               os_memcmp(selected->bssid, wpa_s->pending_bssid, ETH_ALEN) !=
 717               0))) {
 718                 if (wpa_supplicant_scard_init(wpa_s, ssid)) {
 719                         wpa_supplicant_req_new_scan(wpa_s, 10);
 720                         return;
 721                 }
 722                 wpa_supplicant_associate(wpa_s, selected, ssid);
 723         } else {
 724                 wpa_printf(MSG_DEBUG, "Already associated with the selected "
 725                            "AP");
 726         }
 727 }
 728
 729
 730 static struct wpa_ssid *
 731 wpa_supplicant_pick_new_network(struct wpa_supplicant *wpa_s)
 732 {
 733         int prio;
 734         struct wpa_ssid *ssid;
 735
 736         for (prio = 0; prio < wpa_s->conf->num_prio; prio++) {
 737                 for (ssid = wpa_s->conf->pssid[prio]; ssid; ssid = ssid->pnext)
 738                 {
 739                         if (ssid->disabled)
 740                                 continue;
 741                         if (ssid->mode == IEEE80211_MODE_IBSS ||
 742                             ssid->mode == IEEE80211_MODE_AP)
 743                                 return ssid;
 744                 }
 745         }
 746         return NULL;
 747 }
 748
 749
 750 /* TODO: move the rsn_preauth_scan_result*() to be called from notify.c based
 751  * on BSS added and BSS changed events */
 752 static void wpa_supplicant_rsn_preauth_scan_results(
 753         struct wpa_supplicant *wpa_s, struct wpa_scan_results *scan_res)
 754 {
 755         int i;
 756
 757         if (rsn_preauth_scan_results(wpa_s->wpa) < 0)
 758                 return;
 759
 760         for (i = scan_res->num - 1; i >= 0; i--) {
 761                 const u8 *ssid, *rsn;
 762                 struct wpa_scan_res *r;
 763
 764                 r = scan_res->res[i];
 765
 766                 ssid = wpa_scan_get_ie(r, WLAN_EID_SSID);
 767                 if (ssid == NULL)
 768                         continue;
 769
 770                 rsn = wpa_scan_get_ie(r, WLAN_EID_RSN);
 771                 if (rsn == NULL)
 772                         continue;
 773
 774                 rsn_preauth_scan_result(wpa_s->wpa, r->bssid, ssid, rsn);
 775         }
 776
 777 }
 778
 779
 780 static int wpa_supplicant_need_to_roam(struct wpa_supplicant *wpa_s,
 781                                        struct wpa_bss *selected,
 782                                        struct wpa_ssid *ssid,
 783                                        struct wpa_scan_results *scan_res)
 784 {
 785         size_t i;
 786         struct wpa_scan_res *current_bss = NULL;
 787         int min_diff;
 788
 789         if (wpa_s->reassociate)
 790                 return 1; /* explicit request to reassociate */
 791         if (wpa_s->wpa_state < WPA_ASSOCIATED)
 792                 return 1; /* we are not associated; continue */
 793         if (wpa_s->current_ssid == NULL)
 794                 return 1; /* unknown current SSID */
 795         if (wpa_s->current_ssid != ssid)
 796                 return 1; /* different network block */
 797
 798         for (i = 0; i < scan_res->num; i++) {
 799                 struct wpa_scan_res *res = scan_res->res[i];
 800                 const u8 *ie;
 801                 if (os_memcmp(res->bssid, wpa_s->bssid, ETH_ALEN) != 0)
 802                         continue;
 803
 804                 ie = wpa_scan_get_ie(res, WLAN_EID_SSID);
 805                 if (ie == NULL)
 806                         continue;
 807                 if (ie[1] != wpa_s->current_ssid->ssid_len ||
 808                     os_memcmp(ie + 2, wpa_s->current_ssid->ssid, ie[1]) != 0)
 809                         continue;
 810                 current_bss = res;
 811                 break;
 812         }
 813
 814         if (!current_bss)
 815                 return 1; /* current BSS not seen in scan results */
 816
 817         wpa_printf(MSG_DEBUG, "Considering within-ESS reassociation");
 818         wpa_printf(MSG_DEBUG, "Current BSS: " MACSTR " level=%d",
 819                    MAC2STR(current_bss->bssid), current_bss->level);
 820         wpa_printf(MSG_DEBUG, "Selected BSS: " MACSTR " level=%d",
 821                    MAC2STR(selected->bssid), selected->level);
 822
 823         if (wpa_s->current_ssid->bssid_set &&
 824             os_memcmp(selected->bssid, wpa_s->current_ssid->bssid, ETH_ALEN) ==
 825             0) {
 826                 wpa_printf(MSG_DEBUG, "Allow reassociation - selected BSS has "
 827                            "preferred BSSID");
 828                 return 1;
 829         }
 830
 831         min_diff = 2;
 832         if (current_bss->level < 0) {
 833                 if (current_bss->level < -85)
 834                         min_diff = 1;
 835                 else if (current_bss->level < -80)
 836                         min_diff = 2;
 837                 else if (current_bss->level < -75)
 838                         min_diff = 3;
 839                 else if (current_bss->level < -70)
 840                         min_diff = 4;
 841                 else
 842                         min_diff = 5;
 843         }
 844         if (abs(current_bss->level - selected->level) < min_diff) {
 845                 wpa_printf(MSG_DEBUG, "Skip roam - too small difference in "
 846                            "signal level");
 847                 return 0;
 848         }
 849
 850         return 1;
 851 }
 852
 853
 854 static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s,
 855                                               union wpa_event_data *data)
 856 {
 857         struct wpa_bss *selected;
 858         struct wpa_ssid *ssid = NULL;
 859         struct wpa_scan_results *scan_res;
 860
 861         wpa_supplicant_notify_scanning(wpa_s, 0);
 862
 863         scan_res = wpa_supplicant_get_scan_results(wpa_s,
 864                                                    data ? &data->scan_info :
 865                                                    NULL, 1);
 866         if (scan_res == NULL) {
 867                 if (wpa_s->conf->ap_scan == 2)
 868                         return;
 869                 wpa_printf(MSG_DEBUG, "Failed to get scan results - try "
 870                            "scanning again");
 871                 wpa_supplicant_req_new_scan(wpa_s, 1);
 872                 return;
 873         }
 874
 875         /*
 876          * Don't post the results if this was the initial cached
 877          * and there were no results.
 878          */
 879         if (wpa_s->scan_res_tried == 1 && wpa_s->conf->ap_scan == 1 &&
 880             scan_res->num == 0) {
 881                 wpa_msg(wpa_s, MSG_DEBUG, "Cached scan results are "
 882                         "empty - not posting");
 883         } else {
 884                 wpa_printf(MSG_DEBUG, "New scan results available");
 885                 wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
 886                 wpas_notify_scan_results(wpa_s);
 887         }
 888
 889         wpas_notify_scan_done(wpa_s, 1);
 890
 891         if ((wpa_s->conf->ap_scan == 2 && !wpas_wps_searching(wpa_s))) {
 892                 wpa_scan_results_free(scan_res);
 893                 return;
 894         }
 895
 896         if (wpa_s->disconnected) {
 897                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 898                 wpa_scan_results_free(scan_res);
 899                 return;
 900         }
 901
 902         if (bgscan_notify_scan(wpa_s) == 1) {
 903                 wpa_scan_results_free(scan_res);
 904                 return;
 905         }
 906
 907         wpa_supplicant_rsn_preauth_scan_results(wpa_s, scan_res);
 908
 909         selected = wpa_supplicant_pick_network(wpa_s, scan_res, &ssid);
 910
 911         if (selected) {
 912                 int skip;
 913                 skip = !wpa_supplicant_need_to_roam(wpa_s, selected, ssid,
 914                                                     scan_res);
 915                 wpa_scan_results_free(scan_res);
 916                 if (skip)
 917                         return;
 918                 wpa_supplicant_connect(wpa_s, selected, ssid);
 919         } else {
 920                 wpa_scan_results_free(scan_res);
 921                 wpa_printf(MSG_DEBUG, "No suitable network found");
 922                 ssid = wpa_supplicant_pick_new_network(wpa_s);
 923                 if (ssid) {
 924                         wpa_printf(MSG_DEBUG, "Setup a new network");
 925                         wpa_supplicant_associate(wpa_s, NULL, ssid);
 926                 } else
 927                         wpa_supplicant_req_new_scan(wpa_s, 5);
 928         }
 929 }
 930 #endif /* CONFIG_NO_SCAN_PROCESSING */
 931
 932
 933 #ifdef CONFIG_IEEE80211R
 934 static void wpa_assoc_set_ft_params(struct wpa_supplicant *wpa_s,
 935                                     const u8 *ftie, const u8 *mdie)
 936 {
 937         const u8 *mobility_domain = NULL;
 938         const u8 *r0kh_id = NULL;
 939         size_t r0kh_id_len = 0;
 940         const u8 *r1kh_id = NULL;
 941         struct rsn_ftie *hdr;
 942         const u8 *pos, *end;
 943
 944         if (mdie == NULL || ftie == NULL)
 945                 return;
 946
 947         if (mdie[1] >= MOBILITY_DOMAIN_ID_LEN) {
 948                 mobility_domain = mdie + 2;
 949 #ifdef CONFIG_SME
 950                 wpa_s->sme.ft_used = 1;
 951                 os_memcpy(wpa_s->sme.mobility_domain, mobility_domain, 2);
 952 #endif /* CONFIG_SME */
 953         }
 954         if (ftie[1] >= sizeof(struct rsn_ftie)) {
 955                 end = ftie + 2 + ftie[1];
 956                 hdr = (struct rsn_ftie *) (ftie + 2);
 957                 pos = (const u8 *) (hdr + 1);
 958                 while (pos + 1 < end) {
 959                         if (pos + 2 + pos[1] > end)
 960                                 break;
 961                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
 962                             pos[1] == FT_R1KH_ID_LEN)
 963                                 r1kh_id = pos + 2;
 964                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
 965                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
 966                                 r0kh_id = pos + 2;
 967                                 r0kh_id_len = pos[1];
 968                         }
 969                         pos += 2 + pos[1];
 970                 }
 971         }
 972         wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
 973                              r0kh_id_len, r1kh_id);
 974 }
 975 #endif /* CONFIG_IEEE80211R */
 976
 977 static void wpa_supplicant_event_associnfo(struct wpa_supplicant *wpa_s,
 978                                            union wpa_event_data *data)
 979 {
 980         int l, len, found = 0, wpa_found, rsn_found;
 981         const u8 *p;
 982 #ifdef CONFIG_IEEE80211R
 983         const u8 *mdie = NULL, *ftie = NULL;
 984 #endif /* CONFIG_IEEE80211R */
 985
 986         wpa_printf(MSG_DEBUG, "Association info event");
 987         if (data->assoc_info.req_ies)
 988                 wpa_hexdump(MSG_DEBUG, "req_ies", data->assoc_info.req_ies,
 989                             data->assoc_info.req_ies_len);
 990         if (data->assoc_info.resp_ies)
 991                 wpa_hexdump(MSG_DEBUG, "resp_ies", data->assoc_info.resp_ies,
 992                             data->assoc_info.resp_ies_len);
 993         if (data->assoc_info.beacon_ies)
 994                 wpa_hexdump(MSG_DEBUG, "beacon_ies",
 995                             data->assoc_info.beacon_ies,
 996                             data->assoc_info.beacon_ies_len);
 997         if (data->assoc_info.freq)
 998                 wpa_printf(MSG_DEBUG, "freq=%u MHz", data->assoc_info.freq);
 999
1000         p = data->assoc_info.req_ies;
1001         l = data->assoc_info.req_ies_len;
1002
1003         /* Go through the IEs and make a copy of the WPA/RSN IE, if present. */
1004         while (p && l >= 2) {
1005                 len = p[1] + 2;
1006                 if (len > l) {
1007                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
1008                                     p, l);
1009                         break;
1010                 }
1011                 if ((p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
1012                      (os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0)) ||
1013                     (p[0] == WLAN_EID_RSN && p[1] >= 2)) {
1014                         if (wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, p, len))
1015                                 break;
1016                         found = 1;
1017                         wpa_find_assoc_pmkid(wpa_s);
1018                         break;
1019                 }
1020                 l -= len;
1021                 p += len;
1022         }
1023         if (!found && data->assoc_info.req_ies)
1024                 wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1025
1026 #ifdef CONFIG_IEEE80211R
1027         p = data->assoc_info.resp_ies;
1028         l = data->assoc_info.resp_ies_len;
1029
1030         /* Go through the IEs and make a copy of the FT/MD IE, if present. */
1031         while (p && l >= 2) {
1032                 len = p[1] + 2;
1033                 if (len > l) {
1034                         wpa_hexdump(MSG_DEBUG, "Truncated IE in assoc_info",
1035                                     p, l);
1036                         break;
1037                 }
1038                 if (p[0] == WLAN_EID_FAST_BSS_TRANSITION)
1039                         ftie = p;
1040                 else if (p[0] == WLAN_EID_MOBILITY_DOMAIN)
1041                         mdie = p;
1042                 l -= len;
1043                 p += len;
1044         }
1045
1046         wpa_assoc_set_ft_params(wpa_s, ftie, mdie);
1047 #endif /* CONFIG_IEEE80211R */
1048
1049         /* WPA/RSN IE from Beacon/ProbeResp */
1050         p = data->assoc_info.beacon_ies;
1051         l = data->assoc_info.beacon_ies_len;
1052
1053         /* Go through the IEs and make a copy of the WPA/RSN IEs, if present.
1054          */
1055         wpa_found = rsn_found = 0;
1056         while (p && l >= 2) {
1057                 len = p[1] + 2;
1058                 if (len > l) {
1059                         wpa_hexdump(MSG_DEBUG, "Truncated IE in beacon_ies",
1060                                     p, l);
1061                         break;
1062                 }
1063                 if (!wpa_found &&
1064                     p[0] == WLAN_EID_VENDOR_SPECIFIC && p[1] >= 6 &&
1065                     os_memcmp(&p[2], "\x00\x50\xF2\x01\x01\x00", 6) == 0) {
1066                         wpa_found = 1;
1067                         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, p, len);
1068                 }
1069
1070                 if (!rsn_found &&
1071                     p[0] == WLAN_EID_RSN && p[1] >= 2) {
1072                         rsn_found = 1;
1073                         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, p, len);
1074                 }
1075
1076                 l -= len;
1077                 p += len;
1078         }
1079
1080         if (!wpa_found && data->assoc_info.beacon_ies)
1081                 wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
1082         if (!rsn_found && data->assoc_info.beacon_ies)
1083                 wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
1084         if (wpa_found || rsn_found)
1085                 wpa_s->ap_ies_from_associnfo = 1;
1086
1087         wpa_s->assoc_freq = data->assoc_info.freq;
1088 }
1089
1090
1091 static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
1092                                        union wpa_event_data *data)
1093 {
1094         u8 bssid[ETH_ALEN];
1095         int ft_completed;
1096         int bssid_changed;
1097         struct wpa_driver_capa capa;
1098
1099 #ifdef CONFIG_AP
1100         if (wpa_s->ap_iface) {
1101                 hostapd_notif_assoc(wpa_s->ap_iface->bss[0],
1102                                     data->assoc_info.addr,
1103                                     data->assoc_info.req_ies,
1104                                     data->assoc_info.req_ies_len);
1105                 return;
1106         }
1107 #endif /* CONFIG_AP */
1108
1109         ft_completed = wpa_ft_is_completed(wpa_s->wpa);
1110         if (data)
1111                 wpa_supplicant_event_associnfo(wpa_s, data);
1112
1113         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATED);
1114         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME)
1115                 os_memcpy(bssid, wpa_s->bssid, ETH_ALEN);
1116         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME) ||
1117             (wpa_drv_get_bssid(wpa_s, bssid) >= 0 &&
1118              os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)) {
1119                 wpa_msg(wpa_s, MSG_DEBUG, "Associated to a new BSS: BSSID="
1120                         MACSTR, MAC2STR(bssid));
1121                 bssid_changed = os_memcmp(wpa_s->bssid, bssid, ETH_ALEN);
1122                 os_memcpy(wpa_s->bssid, bssid, ETH_ALEN);
1123                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1124                 if (bssid_changed)
1125                         wpas_notify_bssid_changed(wpa_s);
1126
1127                 if (wpa_supplicant_dynamic_keys(wpa_s) && !ft_completed) {
1128                         wpa_clear_keys(wpa_s, bssid);
1129                 }
1130                 if (wpa_supplicant_select_config(wpa_s) < 0) {
1131                         wpa_supplicant_disassociate(
1132                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
1133                         return;
1134                 }
1135                 if (wpa_s->current_ssid) {
1136                         struct wpa_bss *bss = NULL;
1137                         struct wpa_ssid *ssid = wpa_s->current_ssid;
1138                         if (ssid->ssid_len > 0)
1139                                 bss = wpa_bss_get(wpa_s, bssid,
1140                                                   ssid->ssid, ssid->ssid_len);
1141                         if (!bss)
1142                                 bss = wpa_bss_get_bssid(wpa_s, bssid);
1143                         if (bss)
1144                                 wpa_s->current_bss = bss;
1145                 }
1146         }
1147
1148 #ifdef CONFIG_SME
1149         os_memcpy(wpa_s->sme.prev_bssid, bssid, ETH_ALEN);
1150         wpa_s->sme.prev_bssid_set = 1;
1151 #endif /* CONFIG_SME */
1152
1153         wpa_msg(wpa_s, MSG_INFO, "Associated with " MACSTR, MAC2STR(bssid));
1154         if (wpa_s->current_ssid) {
1155                 /* When using scanning (ap_scan=1), SIM PC/SC interface can be
1156                  * initialized before association, but for other modes,
1157                  * initialize PC/SC here, if the current configuration needs
1158                  * smartcard or SIM/USIM. */
1159                 wpa_supplicant_scard_init(wpa_s, wpa_s->current_ssid);
1160         }
1161         wpa_sm_notify_assoc(wpa_s->wpa, bssid);
1162         l2_packet_notify_auth_start(wpa_s->l2);
1163
1164         /*
1165          * Set portEnabled first to FALSE in order to get EAP state machine out
1166          * of the SUCCESS state and eapSuccess cleared. Without this, EAPOL PAE
1167          * state machine may transit to AUTHENTICATING state based on obsolete
1168          * eapSuccess and then trigger BE_AUTH to SUCCESS and PAE to
1169          * AUTHENTICATED without ever giving chance to EAP state machine to
1170          * reset the state.
1171          */
1172         if (!ft_completed) {
1173                 eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
1174                 eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
1175         }
1176         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) || ft_completed)
1177                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
1178         /* 802.1X::portControl = Auto */
1179         eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE);
1180         wpa_s->eapol_received = 0;
1181         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1182             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE ||
1183             (wpa_s->current_ssid &&
1184              wpa_s->current_ssid->mode == IEEE80211_MODE_IBSS)) {
1185                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1186                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1187         } else if (!ft_completed) {
1188                 /* Timeout for receiving the first EAPOL packet */
1189                 wpa_supplicant_req_auth_timeout(wpa_s, 10, 0);
1190         }
1191         wpa_supplicant_cancel_scan(wpa_s);
1192
1193         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
1194             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1195                 /*
1196                  * We are done; the driver will take care of RSN 4-way
1197                  * handshake.
1198                  */
1199                 wpa_supplicant_cancel_auth_timeout(wpa_s);
1200                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
1201                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
1202                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
1203         }
1204
1205         if (wpa_s->pending_eapol_rx) {
1206                 struct os_time now, age;
1207                 os_get_time(&now);
1208                 os_time_sub(&now, &wpa_s->pending_eapol_rx_time, &age);
1209                 if (age.sec == 0 && age.usec < 100000 &&
1210                     os_memcmp(wpa_s->pending_eapol_rx_src, bssid, ETH_ALEN) ==
1211                     0) {
1212                         wpa_printf(MSG_DEBUG, "Process pending EAPOL frame "
1213                                    "that was received just before association "
1214                                    "notification");
1215                         wpa_supplicant_rx_eapol(
1216                                 wpa_s, wpa_s->pending_eapol_rx_src,
1217                                 wpabuf_head(wpa_s->pending_eapol_rx),
1218                                 wpabuf_len(wpa_s->pending_eapol_rx));
1219                 }
1220                 wpabuf_free(wpa_s->pending_eapol_rx);
1221                 wpa_s->pending_eapol_rx = NULL;
1222         }
1223
1224 #ifdef CONFIG_BGSCAN
1225         if (wpa_s->current_ssid != wpa_s->bgscan_ssid) {
1226                 bgscan_deinit(wpa_s);
1227                 if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan) {
1228                         if (bgscan_init(wpa_s, wpa_s->current_ssid)) {
1229                                 wpa_printf(MSG_DEBUG, "Failed to initialize "
1230                                            "bgscan");
1231                                 /*
1232                                  * Live without bgscan; it is only used as a
1233                                  * roaming optimization, so the initial
1234                                  * connection is not affected.
1235                                  */
1236                         } else
1237                                 wpa_s->bgscan_ssid = wpa_s->current_ssid;
1238                 } else
1239                         wpa_s->bgscan_ssid = NULL;
1240         }
1241 #endif /* CONFIG_BGSCAN */
1242
1243         if ((wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
1244              wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
1245             wpa_s->current_ssid && wpa_drv_get_capa(wpa_s, &capa) == 0 &&
1246             capa.flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE) {
1247                 /* Set static WEP keys again */
1248                 wpa_set_wep_keys(wpa_s, wpa_s->current_ssid);
1249         }
1250 }
1251
1252
1253 static void wpa_supplicant_event_disassoc(struct wpa_supplicant *wpa_s)
1254 {
1255         const u8 *bssid;
1256 #ifdef CONFIG_SME
1257         int authenticating;
1258         u8 prev_pending_bssid[ETH_ALEN];
1259
1260         authenticating = wpa_s->wpa_state == WPA_AUTHENTICATING;
1261         os_memcpy(prev_pending_bssid, wpa_s->pending_bssid, ETH_ALEN);
1262 #endif /* CONFIG_SME */
1263
1264         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
1265                 /*
1266                  * At least Host AP driver and a Prism3 card seemed to be
1267                  * generating streams of disconnected events when configuring
1268                  * IBSS for WPA-None. Ignore them for now.
1269                  */
1270                 wpa_printf(MSG_DEBUG, "Disconnect event - ignore in "
1271                            "IBSS/WPA-None mode");
1272                 return;
1273         }
1274
1275         if (wpa_s->wpa_state == WPA_4WAY_HANDSHAKE &&
1276             wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
1277                 wpa_msg(wpa_s, MSG_INFO, "WPA: 4-Way Handshake failed - "
1278                         "pre-shared key may be incorrect");
1279         }
1280         if (wpa_s->wpa_state >= WPA_ASSOCIATED)
1281                 wpa_supplicant_req_scan(wpa_s, 0, 100000);
1282         bssid = wpa_s->bssid;
1283         if (is_zero_ether_addr(bssid))
1284                 bssid = wpa_s->pending_bssid;
1285         wpa_blacklist_add(wpa_s, bssid);
1286         wpa_sm_notify_disassoc(wpa_s->wpa);
1287         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "- Disconnect event - "
1288                 "remove keys");
1289         if (wpa_supplicant_dynamic_keys(wpa_s)) {
1290                 wpa_s->keys_cleared = 0;
1291                 wpa_clear_keys(wpa_s, wpa_s->bssid);
1292         }
1293         wpa_supplicant_mark_disassoc(wpa_s);
1294         bgscan_deinit(wpa_s);
1295 #ifdef CONFIG_SME
1296         if (authenticating &&
1297             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)) {
1298                 /*
1299                  * mac80211-workaround to force deauth on failed auth cmd,
1300                  * requires us to remain in authenticating state to allow the
1301                  * second authentication attempt to be continued properly.
1302                  */
1303                 wpa_printf(MSG_DEBUG, "SME: Allow pending authentication to "
1304                            "proceed after disconnection event");
1305                 wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
1306                 os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
1307         }
1308 #endif /* CONFIG_SME */
1309 }
1310
1311
1312 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1313 static void wpa_supplicant_delayed_mic_error_report(void *eloop_ctx,
1314                                                     void *sock_ctx)
1315 {
1316         struct wpa_supplicant *wpa_s = eloop_ctx;
1317
1318         if (!wpa_s->pending_mic_error_report)
1319                 return;
1320
1321         wpa_printf(MSG_DEBUG, "WPA: Sending pending MIC error report");
1322         wpa_sm_key_request(wpa_s->wpa, 1, wpa_s->pending_mic_error_pairwise);
1323         wpa_s->pending_mic_error_report = 0;
1324 }
1325 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1326
1327
1328 static void
1329 wpa_supplicant_event_michael_mic_failure(struct wpa_supplicant *wpa_s,
1330                                          union wpa_event_data *data)
1331 {
1332         int pairwise;
1333         struct os_time t;
1334
1335         wpa_msg(wpa_s, MSG_WARNING, "Michael MIC failure detected");
1336         pairwise = (data && data->michael_mic_failure.unicast);
1337         os_get_time(&t);
1338         if ((wpa_s->last_michael_mic_error &&
1339              t.sec - wpa_s->last_michael_mic_error <= 60) ||
1340             wpa_s->pending_mic_error_report) {
1341                 if (wpa_s->pending_mic_error_report) {
1342                         /*
1343                          * Send the pending MIC error report immediately since
1344                          * we are going to start countermeasures and AP better
1345                          * do the same.
1346                          */
1347                         wpa_sm_key_request(wpa_s->wpa, 1,
1348                                            wpa_s->pending_mic_error_pairwise);
1349                 }
1350
1351                 /* Send the new MIC error report immediately since we are going
1352                  * to start countermeasures and AP better do the same.
1353                  */
1354                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1355
1356                 /* initialize countermeasures */
1357                 wpa_s->countermeasures = 1;
1358                 wpa_msg(wpa_s, MSG_WARNING, "TKIP countermeasures started");
1359
1360                 /*
1361                  * Need to wait for completion of request frame. We do not get
1362                  * any callback for the message completion, so just wait a
1363                  * short while and hope for the best. */
1364                 os_sleep(0, 10000);
1365
1366                 wpa_drv_set_countermeasures(wpa_s, 1);
1367                 wpa_supplicant_deauthenticate(wpa_s,
1368                                               WLAN_REASON_MICHAEL_MIC_FAILURE);
1369                 eloop_cancel_timeout(wpa_supplicant_stop_countermeasures,
1370                                      wpa_s, NULL);
1371                 eloop_register_timeout(60, 0,
1372                                        wpa_supplicant_stop_countermeasures,
1373                                        wpa_s, NULL);
1374                 /* TODO: mark the AP rejected for 60 second. STA is
1375                  * allowed to associate with another AP.. */
1376         } else {
1377 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
1378                 if (wpa_s->mic_errors_seen) {
1379                         /*
1380                          * Reduce the effectiveness of Michael MIC error
1381                          * reports as a means for attacking against TKIP if
1382                          * more than one MIC failure is noticed with the same
1383                          * PTK. We delay the transmission of the reports by a
1384                          * random time between 0 and 60 seconds in order to
1385                          * force the attacker wait 60 seconds before getting
1386                          * the information on whether a frame resulted in a MIC
1387                          * failure.
1388                          */
1389                         u8 rval[4];
1390                         int sec;
1391
1392                         if (os_get_random(rval, sizeof(rval)) < 0)
1393                                 sec = os_random() % 60;
1394                         else
1395                                 sec = WPA_GET_BE32(rval) % 60;
1396                         wpa_printf(MSG_DEBUG, "WPA: Delay MIC error report %d "
1397                                    "seconds", sec);
1398                         wpa_s->pending_mic_error_report = 1;
1399                         wpa_s->pending_mic_error_pairwise = pairwise;
1400                         eloop_cancel_timeout(
1401                                 wpa_supplicant_delayed_mic_error_report,
1402                                 wpa_s, NULL);
1403                         eloop_register_timeout(
1404                                 sec, os_random() % 1000000,
1405                                 wpa_supplicant_delayed_mic_error_report,
1406                                 wpa_s, NULL);
1407                 } else {
1408                         wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1409                 }
1410 #else /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1411                 wpa_sm_key_request(wpa_s->wpa, 1, pairwise);
1412 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
1413         }
1414         wpa_s->last_michael_mic_error = t.sec;
1415         wpa_s->mic_errors_seen++;
1416 }
1417
1418
1419 #ifdef CONFIG_TERMINATE_ONLASTIF
1420 static int any_interfaces(struct wpa_supplicant *head)
1421 {
1422         struct wpa_supplicant *wpa_s;
1423
1424         for (wpa_s = head; wpa_s != NULL; wpa_s = wpa_s->next)
1425                 if (!wpa_s->interface_removed)
1426                         return 1;
1427         return 0;
1428 }
1429 #endif /* CONFIG_TERMINATE_ONLASTIF */
1430
1431
1432 static void
1433 wpa_supplicant_event_interface_status(struct wpa_supplicant *wpa_s,
1434                                       union wpa_event_data *data)
1435 {
1436         if (os_strcmp(wpa_s->ifname, data->interface_status.ifname) != 0)
1437                 return;
1438
1439         switch (data->interface_status.ievent) {
1440         case EVENT_INTERFACE_ADDED:
1441                 if (!wpa_s->interface_removed)
1442                         break;
1443                 wpa_s->interface_removed = 0;
1444                 wpa_printf(MSG_DEBUG, "Configured interface was added.");
1445                 if (wpa_supplicant_driver_init(wpa_s) < 0) {
1446                         wpa_printf(MSG_INFO, "Failed to initialize the driver "
1447                                    "after interface was added.");
1448                 }
1449                 break;
1450         case EVENT_INTERFACE_REMOVED:
1451                 wpa_printf(MSG_DEBUG, "Configured interface was removed.");
1452                 wpa_s->interface_removed = 1;
1453                 wpa_supplicant_mark_disassoc(wpa_s);
1454                 l2_packet_deinit(wpa_s->l2);
1455                 wpa_s->l2 = NULL;
1456 #ifdef CONFIG_TERMINATE_ONLASTIF
1457                 /* check if last interface */
1458                 if (!any_interfaces(wpa_s->global->ifaces))
1459                         eloop_terminate();
1460 #endif /* CONFIG_TERMINATE_ONLASTIF */
1461                 break;
1462         }
1463 }
1464
1465
1466 #ifdef CONFIG_PEERKEY
1467 static void
1468 wpa_supplicant_event_stkstart(struct wpa_supplicant *wpa_s,
1469                               union wpa_event_data *data)
1470 {
1471         if (data == NULL)
1472                 return;
1473         wpa_sm_stkstart(wpa_s->wpa, data->stkstart.peer);
1474 }
1475 #endif /* CONFIG_PEERKEY */
1476
1477
1478 #ifdef CONFIG_IEEE80211R
1479 static void
1480 wpa_supplicant_event_ft_response(struct wpa_supplicant *wpa_s,
1481                                  union wpa_event_data *data)
1482 {
1483         if (data == NULL)
1484                 return;
1485
1486         if (wpa_ft_process_response(wpa_s->wpa, data->ft_ies.ies,
1487                                     data->ft_ies.ies_len,
1488                                     data->ft_ies.ft_action,
1489                                     data->ft_ies.target_ap,
1490                                     data->ft_ies.ric_ies,
1491                                     data->ft_ies.ric_ies_len) < 0) {
1492                 /* TODO: prevent MLME/driver from trying to associate? */
1493         }
1494 }
1495 #endif /* CONFIG_IEEE80211R */
1496
1497
1498 #ifdef CONFIG_IBSS_RSN
1499 static void wpa_supplicant_event_ibss_rsn_start(struct wpa_supplicant *wpa_s,
1500                                                 union wpa_event_data *data)
1501 {
1502         if (data == NULL)
1503                 return;
1504         ibss_rsn_start(wpa_s->ibss_rsn, data->ibss_rsn_start.peer);
1505 }
1506 #endif /* CONFIG_IBSS_RSN */
1507
1508
1509 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
1510                           union wpa_event_data *data)
1511 {
1512         struct wpa_supplicant *wpa_s = ctx;
1513
1514         switch (event) {
1515         case EVENT_AUTH:
1516                 sme_event_auth(wpa_s, data);
1517                 break;
1518         case EVENT_ASSOC:
1519                 wpa_supplicant_event_assoc(wpa_s, data);
1520                 break;
1521         case EVENT_DISASSOC:
1522                 wpa_printf(MSG_DEBUG, "Disassociation notification");
1523 #ifdef CONFIG_AP
1524                 if (wpa_s->ap_iface && data) {
1525                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1526                                                data->disassoc_info.addr);
1527                         break;
1528                 }
1529 #endif /* CONFIG_AP */
1530                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME)
1531                         sme_event_disassoc(wpa_s, data);
1532                 /* fall through */
1533         case EVENT_DEAUTH:
1534                 if (event == EVENT_DEAUTH)
1535                         wpa_printf(MSG_DEBUG, "Deauthentication notification");
1536 #ifdef CONFIG_AP
1537                 if (wpa_s->ap_iface && data) {
1538                         hostapd_notif_disassoc(wpa_s->ap_iface->bss[0],
1539                                                data->deauth_info.addr);
1540                         break;
1541                 }
1542 #endif /* CONFIG_AP */
1543                 wpa_supplicant_event_disassoc(wpa_s);
1544                 break;
1545         case EVENT_MICHAEL_MIC_FAILURE:
1546                 wpa_supplicant_event_michael_mic_failure(wpa_s, data);
1547                 break;
1548 #ifndef CONFIG_NO_SCAN_PROCESSING
1549         case EVENT_SCAN_RESULTS:
1550                 wpa_supplicant_event_scan_results(wpa_s, data);
1551                 break;
1552 #endif /* CONFIG_NO_SCAN_PROCESSING */
1553         case EVENT_ASSOCINFO:
1554                 wpa_supplicant_event_associnfo(wpa_s, data);
1555                 break;
1556         case EVENT_INTERFACE_STATUS:
1557                 wpa_supplicant_event_interface_status(wpa_s, data);
1558                 break;
1559         case EVENT_PMKID_CANDIDATE:
1560                 wpa_supplicant_event_pmkid_candidate(wpa_s, data);
1561                 break;
1562 #ifdef CONFIG_PEERKEY
1563         case EVENT_STKSTART:
1564                 wpa_supplicant_event_stkstart(wpa_s, data);
1565                 break;
1566 #endif /* CONFIG_PEERKEY */
1567 #ifdef CONFIG_IEEE80211R
1568         case EVENT_FT_RESPONSE:
1569                 wpa_supplicant_event_ft_response(wpa_s, data);
1570                 break;
1571 #endif /* CONFIG_IEEE80211R */
1572 #ifdef CONFIG_IBSS_RSN
1573         case EVENT_IBSS_RSN_START:
1574                 wpa_supplicant_event_ibss_rsn_start(wpa_s, data);
1575                 break;
1576 #endif /* CONFIG_IBSS_RSN */
1577         case EVENT_ASSOC_REJECT:
1578                 sme_event_assoc_reject(wpa_s, data);
1579                 break;
1580         case EVENT_AUTH_TIMED_OUT:
1581                 sme_event_auth_timed_out(wpa_s, data);
1582                 break;
1583         case EVENT_ASSOC_TIMED_OUT:
1584                 sme_event_assoc_timed_out(wpa_s, data);
1585                 break;
1586 #ifdef CONFIG_AP
1587         case EVENT_TX_STATUS:
1588                 if (wpa_s->ap_iface == NULL)
1589                         break;
1590                 switch (data->tx_status.type) {
1591                 case WLAN_FC_TYPE_MGMT:
1592                         ap_mgmt_tx_cb(wpa_s, data->tx_status.data,
1593                                       data->tx_status.data_len,
1594                                       data->tx_status.stype,
1595                                       data->tx_status.ack);
1596                         break;
1597                 case WLAN_FC_TYPE_DATA:
1598                         ap_tx_status(wpa_s, data->tx_status.dst,
1599                                      data->tx_status.data,
1600                                      data->tx_status.data_len,
1601                                      data->tx_status.ack);
1602                         break;
1603                 }
1604                 break;
1605         case EVENT_RX_FROM_UNKNOWN:
1606                 if (wpa_s->ap_iface == NULL)
1607                         break;
1608                 ap_rx_from_unknown_sta(wpa_s, data->rx_from_unknown.frame,
1609                                        data->rx_from_unknown.len);
1610                 break;
1611         case EVENT_RX_MGMT:
1612                 if (wpa_s->ap_iface == NULL)
1613                         break;
1614                 ap_mgmt_rx(wpa_s, &data->rx_mgmt);
1615                 break;
1616 #endif /* CONFIG_AP */
1617 #ifdef CONFIG_CLIENT_MLME
1618         case EVENT_MLME_RX: {
1619                 struct ieee80211_rx_status rx_status;
1620                 os_memset(&rx_status, 0, sizeof(rx_status));
1621                 rx_status.freq = data->mlme_rx.freq;
1622                 rx_status.channel = data->mlme_rx.channel;
1623                 rx_status.ssi = data->mlme_rx.ssi;
1624                 ieee80211_sta_rx(wpa_s, data->mlme_rx.buf, data->mlme_rx.len,
1625                                  &rx_status);
1626                 break;
1627         }
1628 #endif /* CONFIG_CLIENT_MLME */
1629         case EVENT_EAPOL_RX:
1630                 wpa_supplicant_rx_eapol(wpa_s, data->eapol_rx.src,
1631                                         data->eapol_rx.data,
1632                                         data->eapol_rx.data_len);
1633                 break;
1634         default:
1635                 wpa_printf(MSG_INFO, "Unknown event %d", event);
1636                 break;
1637         }
1638 }