wpa_supplicant/interworking.c

   1 /*
   2  * Interworking (IEEE 802.11u)
   3  * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "common/ieee802_11_defs.h"
  13 #include "common/gas.h"
  14 #include "common/wpa_ctrl.h"
  15 #include "utils/pcsc_funcs.h"
  16 #include "utils/eloop.h"
  17 #include "drivers/driver.h"
  18 #include "eap_common/eap_defs.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_methods.h"
  21 #include "eapol_supp/eapol_supp_sm.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "config.h"
  24 #include "config_ssid.h"
  25 #include "bss.h"
  26 #include "scan.h"
  27 #include "notify.h"
  28 #include "gas_query.h"
  29 #include "hs20_supplicant.h"
  30 #include "interworking.h"
  31
  32
  33 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  34 #define INTERWORKING_3GPP
  35 #else
  36 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  37 #define INTERWORKING_3GPP
  38 #else
  39 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  40 #define INTERWORKING_3GPP
  41 #endif
  42 #endif
  43 #endif
  44
  45 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  46 static struct wpa_cred * interworking_credentials_available_realm(
  47         struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  48 static struct wpa_cred * interworking_credentials_available_3gpp(
  49         struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
  50
  51
  52 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  53 {
  54         if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  55                 wpa_supplicant_cancel_sched_scan(wpa_s);
  56                 wpa_supplicant_deauthenticate(wpa_s,
  57                                               WLAN_REASON_DEAUTH_LEAVING);
  58         }
  59         wpa_s->disconnected = 0;
  60         wpa_s->reassociate = 1;
  61
  62         if (wpa_supplicant_fast_associate(wpa_s) >= 0)
  63                 return;
  64
  65         wpa_supplicant_req_scan(wpa_s, 0, 0);
  66 }
  67
  68
  69 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  70                                       struct wpabuf *extra)
  71 {
  72         struct wpabuf *buf;
  73         size_t i;
  74         u8 *len_pos;
  75
  76         buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
  77                                          (extra ? wpabuf_len(extra) : 0));
  78         if (buf == NULL)
  79                 return NULL;
  80
  81         len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
  82         for (i = 0; i < num_ids; i++)
  83                 wpabuf_put_le16(buf, info_ids[i]);
  84         gas_anqp_set_element_len(buf, len_pos);
  85         if (extra)
  86                 wpabuf_put_buf(buf, extra);
  87
  88         gas_anqp_set_len(buf);
  89
  90         return buf;
  91 }
  92
  93
  94 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
  95                                       u8 dialog_token,
  96                                       enum gas_query_result result,
  97                                       const struct wpabuf *adv_proto,
  98                                       const struct wpabuf *resp,
  99                                       u16 status_code)
 100 {
 101         struct wpa_supplicant *wpa_s = ctx;
 102
 103         anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
 104                      status_code);
 105         interworking_next_anqp_fetch(wpa_s);
 106 }
 107
 108
 109 static int cred_with_roaming_consortium(struct wpa_supplicant *wpa_s)
 110 {
 111         struct wpa_cred *cred;
 112
 113         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 114                 if (cred->roaming_consortium_len)
 115                         return 1;
 116                 if (cred->required_roaming_consortium_len)
 117                         return 1;
 118         }
 119         return 0;
 120 }
 121
 122
 123 static int cred_with_3gpp(struct wpa_supplicant *wpa_s)
 124 {
 125         struct wpa_cred *cred;
 126
 127         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 128                 if (cred->pcsc || cred->imsi)
 129                         return 1;
 130         }
 131         return 0;
 132 }
 133
 134
 135 static int cred_with_nai_realm(struct wpa_supplicant *wpa_s)
 136 {
 137         struct wpa_cred *cred;
 138
 139         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 140                 if (cred->pcsc || cred->imsi)
 141                         continue;
 142                 if (!cred->eap_method)
 143                         return 1;
 144                 if (cred->realm && cred->roaming_consortium_len == 0)
 145                         return 1;
 146         }
 147         return 0;
 148 }
 149
 150
 151 static int cred_with_domain(struct wpa_supplicant *wpa_s)
 152 {
 153         struct wpa_cred *cred;
 154
 155         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 156                 if (cred->domain || cred->pcsc || cred->imsi)
 157                         return 1;
 158         }
 159         return 0;
 160 }
 161
 162
 163 static int additional_roaming_consortiums(struct wpa_bss *bss)
 164 {
 165         const u8 *ie;
 166         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
 167         if (ie == NULL || ie[1] == 0)
 168                 return 0;
 169         return ie[2]; /* Number of ANQP OIs */
 170 }
 171
 172
 173 static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
 174 {
 175         struct wpa_supplicant *wpa_s = eloop_ctx;
 176         interworking_next_anqp_fetch(wpa_s);
 177 }
 178
 179
 180 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
 181                                       struct wpa_bss *bss)
 182 {
 183         struct wpabuf *buf;
 184         int ret = 0;
 185         int res;
 186         u16 info_ids[8];
 187         size_t num_info_ids = 0;
 188         struct wpabuf *extra = NULL;
 189         int all = wpa_s->fetch_all_anqp;
 190
 191         wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
 192                    MAC2STR(bss->bssid));
 193         wpa_s->interworking_gas_bss = bss;
 194
 195         info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
 196         if (all) {
 197                 info_ids[num_info_ids++] = ANQP_VENUE_NAME;
 198                 info_ids[num_info_ids++] = ANQP_NETWORK_AUTH_TYPE;
 199         }
 200         if (all || (cred_with_roaming_consortium(wpa_s) &&
 201                     additional_roaming_consortiums(bss)))
 202                 info_ids[num_info_ids++] = ANQP_ROAMING_CONSORTIUM;
 203         if (all)
 204                 info_ids[num_info_ids++] = ANQP_IP_ADDR_TYPE_AVAILABILITY;
 205         if (all || cred_with_nai_realm(wpa_s))
 206                 info_ids[num_info_ids++] = ANQP_NAI_REALM;
 207         if (all || cred_with_3gpp(wpa_s))
 208                 info_ids[num_info_ids++] = ANQP_3GPP_CELLULAR_NETWORK;
 209         if (all || cred_with_domain(wpa_s))
 210                 info_ids[num_info_ids++] = ANQP_DOMAIN_NAME;
 211         wpa_hexdump(MSG_DEBUG, "Interworking: ANQP Query info",
 212                     (u8 *) info_ids, num_info_ids * 2);
 213
 214 #ifdef CONFIG_HS20
 215         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
 216                 u8 *len_pos;
 217
 218                 extra = wpabuf_alloc(100);
 219                 if (!extra)
 220                         return -1;
 221
 222                 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
 223                 wpabuf_put_be24(extra, OUI_WFA);
 224                 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
 225                 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
 226                 wpabuf_put_u8(extra, 0); /* Reserved */
 227                 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
 228                 if (all) {
 229                         wpabuf_put_u8(extra,
 230                                       HS20_STYPE_OPERATOR_FRIENDLY_NAME);
 231                         wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
 232                         wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
 233                         wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
 234                 }
 235                 gas_anqp_set_element_len(extra, len_pos);
 236         }
 237 #endif /* CONFIG_HS20 */
 238
 239         buf = anqp_build_req(info_ids, num_info_ids, extra);
 240         wpabuf_free(extra);
 241         if (buf == NULL)
 242                 return -1;
 243
 244         res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, buf,
 245                             interworking_anqp_resp_cb, wpa_s);
 246         if (res < 0) {
 247                 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
 248                 wpabuf_free(buf);
 249                 ret = -1;
 250                 eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
 251                                        NULL);
 252         } else
 253                 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
 254                            "%u", res);
 255
 256         return ret;
 257 }
 258
 259
 260 struct nai_realm_eap {
 261         u8 method;
 262         u8 inner_method;
 263         enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
 264         u8 cred_type;
 265         u8 tunneled_cred_type;
 266 };
 267
 268 struct nai_realm {
 269         u8 encoding;
 270         char *realm;
 271         u8 eap_count;
 272         struct nai_realm_eap *eap;
 273 };
 274
 275
 276 static void nai_realm_free(struct nai_realm *realms, u16 count)
 277 {
 278         u16 i;
 279
 280         if (realms == NULL)
 281                 return;
 282         for (i = 0; i < count; i++) {
 283                 os_free(realms[i].eap);
 284                 os_free(realms[i].realm);
 285         }
 286         os_free(realms);
 287 }
 288
 289
 290 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
 291                                       const u8 *end)
 292 {
 293         u8 elen, auth_count, a;
 294         const u8 *e_end;
 295
 296         if (pos + 3 > end) {
 297                 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
 298                 return NULL;
 299         }
 300
 301         elen = *pos++;
 302         if (pos + elen > end || elen < 2) {
 303                 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
 304                 return NULL;
 305         }
 306         e_end = pos + elen;
 307         e->method = *pos++;
 308         auth_count = *pos++;
 309         wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
 310                    elen, e->method, auth_count);
 311
 312         for (a = 0; a < auth_count; a++) {
 313                 u8 id, len;
 314
 315                 if (pos + 2 > end || pos + 2 + pos[1] > end) {
 316                         wpa_printf(MSG_DEBUG, "No room for Authentication "
 317                                    "Parameter subfield");
 318                         return NULL;
 319                 }
 320
 321                 id = *pos++;
 322                 len = *pos++;
 323
 324                 switch (id) {
 325                 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
 326                         if (len < 1)
 327                                 break;
 328                         e->inner_non_eap = *pos;
 329                         if (e->method != EAP_TYPE_TTLS)
 330                                 break;
 331                         switch (*pos) {
 332                         case NAI_REALM_INNER_NON_EAP_PAP:
 333                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
 334                                 break;
 335                         case NAI_REALM_INNER_NON_EAP_CHAP:
 336                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
 337                                 break;
 338                         case NAI_REALM_INNER_NON_EAP_MSCHAP:
 339                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
 340                                 break;
 341                         case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
 342                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
 343                                 break;
 344                         }
 345                         break;
 346                 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
 347                         if (len < 1)
 348                                 break;
 349                         e->inner_method = *pos;
 350                         wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
 351                                    e->inner_method);
 352                         break;
 353                 case NAI_REALM_EAP_AUTH_CRED_TYPE:
 354                         if (len < 1)
 355                                 break;
 356                         e->cred_type = *pos;
 357                         wpa_printf(MSG_DEBUG, "Credential Type: %u",
 358                                    e->cred_type);
 359                         break;
 360                 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
 361                         if (len < 1)
 362                                 break;
 363                         e->tunneled_cred_type = *pos;
 364                         wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
 365                                    "Type: %u", e->tunneled_cred_type);
 366                         break;
 367                 default:
 368                         wpa_printf(MSG_DEBUG, "Unsupported Authentication "
 369                                    "Parameter: id=%u len=%u", id, len);
 370                         wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
 371                                     "Value", pos, len);
 372                         break;
 373                 }
 374
 375                 pos += len;
 376         }
 377
 378         return e_end;
 379 }
 380
 381
 382 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
 383                                         const u8 *end)
 384 {
 385         u16 len;
 386         const u8 *f_end;
 387         u8 realm_len, e;
 388
 389         if (end - pos < 4) {
 390                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 391                            "fixed fields");
 392                 return NULL;
 393         }
 394
 395         len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
 396         pos += 2;
 397         if (pos + len > end || len < 3) {
 398                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 399                            "(len=%u; left=%u)",
 400                            len, (unsigned int) (end - pos));
 401                 return NULL;
 402         }
 403         f_end = pos + len;
 404
 405         r->encoding = *pos++;
 406         realm_len = *pos++;
 407         if (pos + realm_len > f_end) {
 408                 wpa_printf(MSG_DEBUG, "No room for NAI Realm "
 409                            "(len=%u; left=%u)",
 410                            realm_len, (unsigned int) (f_end - pos));
 411                 return NULL;
 412         }
 413         wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
 414         r->realm = dup_binstr(pos, realm_len);
 415         if (r->realm == NULL)
 416                 return NULL;
 417         pos += realm_len;
 418
 419         if (pos + 1 > f_end) {
 420                 wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
 421                 return NULL;
 422         }
 423         r->eap_count = *pos++;
 424         wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
 425         if (pos + r->eap_count * 3 > f_end) {
 426                 wpa_printf(MSG_DEBUG, "No room for EAP Methods");
 427                 return NULL;
 428         }
 429         r->eap = os_calloc(r->eap_count, sizeof(struct nai_realm_eap));
 430         if (r->eap == NULL)
 431                 return NULL;
 432
 433         for (e = 0; e < r->eap_count; e++) {
 434                 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
 435                 if (pos == NULL)
 436                         return NULL;
 437         }
 438
 439         return f_end;
 440 }
 441
 442
 443 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
 444 {
 445         struct nai_realm *realm;
 446         const u8 *pos, *end;
 447         u16 i, num;
 448
 449         if (anqp == NULL || wpabuf_len(anqp) < 2)
 450                 return NULL;
 451
 452         pos = wpabuf_head_u8(anqp);
 453         end = pos + wpabuf_len(anqp);
 454         num = WPA_GET_LE16(pos);
 455         wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
 456         pos += 2;
 457
 458         if (num * 5 > end - pos) {
 459                 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
 460                            "enough data (%u octets) for that many realms",
 461                            num, (unsigned int) (end - pos));
 462                 return NULL;
 463         }
 464
 465         realm = os_calloc(num, sizeof(struct nai_realm));
 466         if (realm == NULL)
 467                 return NULL;
 468
 469         for (i = 0; i < num; i++) {
 470                 pos = nai_realm_parse_realm(&realm[i], pos, end);
 471                 if (pos == NULL) {
 472                         nai_realm_free(realm, num);
 473                         return NULL;
 474                 }
 475         }
 476
 477         *count = num;
 478         return realm;
 479 }
 480
 481
 482 static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
 483 {
 484         char *tmp, *pos, *end;
 485         int match = 0;
 486
 487         if (realm->realm == NULL || home_realm == NULL)
 488                 return 0;
 489
 490         if (os_strchr(realm->realm, ';') == NULL)
 491                 return os_strcasecmp(realm->realm, home_realm) == 0;
 492
 493         tmp = os_strdup(realm->realm);
 494         if (tmp == NULL)
 495                 return 0;
 496
 497         pos = tmp;
 498         while (*pos) {
 499                 end = os_strchr(pos, ';');
 500                 if (end)
 501                         *end = '\0';
 502                 if (os_strcasecmp(pos, home_realm) == 0) {
 503                         match = 1;
 504                         break;
 505                 }
 506                 if (end == NULL)
 507                         break;
 508                 pos = end + 1;
 509         }
 510
 511         os_free(tmp);
 512
 513         return match;
 514 }
 515
 516
 517 static int nai_realm_cred_username(struct nai_realm_eap *eap)
 518 {
 519         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
 520                 return 0; /* method not supported */
 521
 522         if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP) {
 523                 /* Only tunneled methods with username/password supported */
 524                 return 0;
 525         }
 526
 527         if (eap->method == EAP_TYPE_PEAP) {
 528                 if (eap->inner_method &&
 529                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
 530                         return 0;
 531                 if (!eap->inner_method &&
 532                     eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL)
 533                         return 0;
 534         }
 535
 536         if (eap->method == EAP_TYPE_TTLS) {
 537                 if (eap->inner_method == 0 && eap->inner_non_eap == 0)
 538                         return 1; /* Assume TTLS/MSCHAPv2 is used */
 539                 if (eap->inner_method &&
 540                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
 541                         return 0;
 542                 if (eap->inner_non_eap &&
 543                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
 544                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
 545                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
 546                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2)
 547                         return 0;
 548         }
 549
 550         if (eap->inner_method &&
 551             eap->inner_method != EAP_TYPE_GTC &&
 552             eap->inner_method != EAP_TYPE_MSCHAPV2)
 553                 return 0;
 554
 555         return 1;
 556 }
 557
 558
 559 static int nai_realm_cred_cert(struct nai_realm_eap *eap)
 560 {
 561         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
 562                 return 0; /* method not supported */
 563
 564         if (eap->method != EAP_TYPE_TLS) {
 565                 /* Only EAP-TLS supported for credential authentication */
 566                 return 0;
 567         }
 568
 569         return 1;
 570 }
 571
 572
 573 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred,
 574                                                  struct nai_realm *realm)
 575 {
 576         u8 e;
 577
 578         if (cred == NULL ||
 579             cred->username == NULL ||
 580             cred->username[0] == '\0' ||
 581             ((cred->password == NULL ||
 582               cred->password[0] == '\0') &&
 583              (cred->private_key == NULL ||
 584               cred->private_key[0] == '\0')))
 585                 return NULL;
 586
 587         for (e = 0; e < realm->eap_count; e++) {
 588                 struct nai_realm_eap *eap = &realm->eap[e];
 589                 if (cred->password && cred->password[0] &&
 590                     nai_realm_cred_username(eap))
 591                         return eap;
 592                 if (cred->private_key && cred->private_key[0] &&
 593                     nai_realm_cred_cert(eap))
 594                         return eap;
 595         }
 596
 597         return NULL;
 598 }
 599
 600
 601 #ifdef INTERWORKING_3GPP
 602
 603 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
 604 {
 605         u8 plmn[3], plmn2[3];
 606         const u8 *pos, *end;
 607         u8 udhl;
 608
 609         /*
 610          * See Annex A of 3GPP TS 24.234 v8.1.0 for description. The network
 611          * operator is allowed to include only two digits of the MNC, so allow
 612          * matches based on both two and three digit MNC assumptions. Since some
 613          * SIM/USIM cards may not expose MNC length conveniently, we may be
 614          * provided the default MNC length 3 here and as such, checking with MNC
 615          * length 2 is justifiable even though 3GPP TS 24.234 does not mention
 616          * that case. Anyway, MCC/MNC pair where both 2 and 3 digit MNC is used
 617          * with otherwise matching values would not be good idea in general, so
 618          * this should not result in selecting incorrect networks.
 619          */
 620         /* Match with 3 digit MNC */
 621         plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 622         plmn[1] = (imsi[2] - '0') | ((imsi[5] - '0') << 4);
 623         plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 624         /* Match with 2 digit MNC */
 625         plmn2[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 626         plmn2[1] = (imsi[2] - '0') | 0xf0;
 627         plmn2[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 628
 629         if (anqp == NULL)
 630                 return 0;
 631         pos = wpabuf_head_u8(anqp);
 632         end = pos + wpabuf_len(anqp);
 633         if (pos + 2 > end)
 634                 return 0;
 635         if (*pos != 0) {
 636                 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
 637                 return 0;
 638         }
 639         pos++;
 640         udhl = *pos++;
 641         if (pos + udhl > end) {
 642                 wpa_printf(MSG_DEBUG, "Invalid UDHL");
 643                 return 0;
 644         }
 645         end = pos + udhl;
 646
 647         wpa_printf(MSG_DEBUG, "Interworking: Matching against MCC/MNC alternatives: %02x:%02x:%02x or %02x:%02x:%02x (IMSI %s, MNC length %d)",
 648                    plmn[0], plmn[1], plmn[2], plmn2[0], plmn2[1], plmn2[2],
 649                    imsi, mnc_len);
 650
 651         while (pos + 2 <= end) {
 652                 u8 iei, len;
 653                 const u8 *l_end;
 654                 iei = *pos++;
 655                 len = *pos++ & 0x7f;
 656                 if (pos + len > end)
 657                         break;
 658                 l_end = pos + len;
 659
 660                 if (iei == 0 && len > 0) {
 661                         /* PLMN List */
 662                         u8 num, i;
 663                         wpa_hexdump(MSG_DEBUG, "Interworking: PLMN List information element",
 664                                     pos, len);
 665                         num = *pos++;
 666                         for (i = 0; i < num; i++) {
 667                                 if (pos + 3 > l_end)
 668                                         break;
 669                                 if (os_memcmp(pos, plmn, 3) == 0 ||
 670                                     os_memcmp(pos, plmn2, 3) == 0)
 671                                         return 1; /* Found matching PLMN */
 672                                 pos += 3;
 673                         }
 674                 } else {
 675                         wpa_hexdump(MSG_DEBUG, "Interworking: Unrecognized 3GPP information element",
 676                                     pos, len);
 677                 }
 678
 679                 pos = l_end;
 680         }
 681
 682         return 0;
 683 }
 684
 685
 686 static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
 687                           size_t mnc_len, char prefix)
 688 {
 689         const char *sep, *msin;
 690         char *end, *pos;
 691         size_t msin_len, plmn_len;
 692
 693         /*
 694          * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
 695          * Root NAI:
 696          * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
 697          * <MNC> is zero-padded to three digits in case two-digit MNC is used
 698          */
 699
 700         if (imsi == NULL || os_strlen(imsi) > 16) {
 701                 wpa_printf(MSG_DEBUG, "No valid IMSI available");
 702                 return -1;
 703         }
 704         sep = os_strchr(imsi, '-');
 705         if (sep) {
 706                 plmn_len = sep - imsi;
 707                 msin = sep + 1;
 708         } else if (mnc_len && os_strlen(imsi) >= 3 + mnc_len) {
 709                 plmn_len = 3 + mnc_len;
 710                 msin = imsi + plmn_len;
 711         } else
 712                 return -1;
 713         if (plmn_len != 5 && plmn_len != 6)
 714                 return -1;
 715         msin_len = os_strlen(msin);
 716
 717         pos = nai;
 718         end = nai + nai_len;
 719         if (prefix)
 720                 *pos++ = prefix;
 721         os_memcpy(pos, imsi, plmn_len);
 722         pos += plmn_len;
 723         os_memcpy(pos, msin, msin_len);
 724         pos += msin_len;
 725         pos += os_snprintf(pos, end - pos, "@wlan.mnc");
 726         if (plmn_len == 5) {
 727                 *pos++ = '0';
 728                 *pos++ = imsi[3];
 729                 *pos++ = imsi[4];
 730         } else {
 731                 *pos++ = imsi[3];
 732                 *pos++ = imsi[4];
 733                 *pos++ = imsi[5];
 734         }
 735         pos += os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
 736                            imsi[0], imsi[1], imsi[2]);
 737
 738         return 0;
 739 }
 740
 741
 742 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 743 {
 744         char nai[100];
 745         if (build_root_nai(nai, sizeof(nai), imsi, 0, prefix) < 0)
 746                 return -1;
 747         return wpa_config_set_quoted(ssid, "identity", nai);
 748 }
 749
 750 #endif /* INTERWORKING_3GPP */
 751
 752
 753 static int already_connected(struct wpa_supplicant *wpa_s,
 754                              struct wpa_cred *cred, struct wpa_bss *bss)
 755 {
 756         struct wpa_ssid *ssid;
 757
 758         if (wpa_s->wpa_state < WPA_ASSOCIATED || wpa_s->current_ssid == NULL)
 759                 return 0;
 760
 761         ssid = wpa_s->current_ssid;
 762         if (ssid->parent_cred != cred)
 763                 return 0;
 764
 765         if (ssid->ssid_len != bss->ssid_len ||
 766             os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) != 0)
 767                 return 0;
 768
 769         return 1;
 770 }
 771
 772
 773 static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
 774                                         struct wpa_ssid *ssid)
 775 {
 776         if (wpa_config_set(ssid, "key_mgmt",
 777                            wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
 778                            "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP", 0) < 0)
 779                 return -1;
 780         if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
 781                 return -1;
 782         if (wpa_config_set(ssid, "pairwise", "CCMP", 0) < 0)
 783                 return -1;
 784         return 0;
 785 }
 786
 787
 788 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
 789                                      struct wpa_cred *cred,
 790                                      struct wpa_bss *bss)
 791 {
 792 #ifdef INTERWORKING_3GPP
 793         struct wpa_ssid *ssid;
 794         const u8 *ie;
 795         int eap_type;
 796         int res;
 797         char prefix;
 798
 799         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
 800                 return -1;
 801
 802         ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
 803         if (ie == NULL)
 804                 return -1;
 805         wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " (3GPP)",
 806                    MAC2STR(bss->bssid));
 807
 808         if (already_connected(wpa_s, cred, bss)) {
 809                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
 810                         MAC2STR(bss->bssid));
 811                 return 0;
 812         }
 813
 814         ssid = wpa_config_add_network(wpa_s->conf);
 815         if (ssid == NULL)
 816                 return -1;
 817         ssid->parent_cred = cred;
 818
 819         wpas_notify_network_added(wpa_s, ssid);
 820         wpa_config_set_network_defaults(ssid);
 821         ssid->priority = cred->priority;
 822         ssid->temporary = 1;
 823         ssid->ssid = os_zalloc(ie[1] + 1);
 824         if (ssid->ssid == NULL)
 825                 goto fail;
 826         os_memcpy(ssid->ssid, ie + 2, ie[1]);
 827         ssid->ssid_len = ie[1];
 828
 829         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
 830                 goto fail;
 831
 832         eap_type = EAP_TYPE_SIM;
 833         if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
 834                 eap_type = EAP_TYPE_AKA;
 835         if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
 836                 if (cred->eap_method[0].method == EAP_TYPE_SIM ||
 837                     cred->eap_method[0].method == EAP_TYPE_AKA ||
 838                     cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
 839                         eap_type = cred->eap_method[0].method;
 840         }
 841
 842         switch (eap_type) {
 843         case EAP_TYPE_SIM:
 844                 prefix = '1';
 845                 res = wpa_config_set(ssid, "eap", "SIM", 0);
 846                 break;
 847         case EAP_TYPE_AKA:
 848                 prefix = '0';
 849                 res = wpa_config_set(ssid, "eap", "AKA", 0);
 850                 break;
 851         case EAP_TYPE_AKA_PRIME:
 852                 prefix = '6';
 853                 res = wpa_config_set(ssid, "eap", "AKA'", 0);
 854                 break;
 855         default:
 856                 res = -1;
 857                 break;
 858         }
 859         if (res < 0) {
 860                 wpa_printf(MSG_DEBUG, "Selected EAP method (%d) not supported",
 861                            eap_type);
 862                 goto fail;
 863         }
 864
 865         if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
 866                 wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
 867                 goto fail;
 868         }
 869
 870         if (cred->milenage && cred->milenage[0]) {
 871                 if (wpa_config_set_quoted(ssid, "password",
 872                                           cred->milenage) < 0)
 873                         goto fail;
 874         } else if (cred->pcsc) {
 875                 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
 876                         goto fail;
 877                 if (wpa_s->conf->pcsc_pin &&
 878                     wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
 879                     < 0)
 880                         goto fail;
 881         }
 882
 883         if (cred->password && cred->password[0] &&
 884             wpa_config_set_quoted(ssid, "password", cred->password) < 0)
 885                 goto fail;
 886
 887         wpa_config_update_prio_list(wpa_s->conf);
 888         interworking_reconnect(wpa_s);
 889
 890         return 0;
 891
 892 fail:
 893         wpas_notify_network_removed(wpa_s, ssid);
 894         wpa_config_remove_network(wpa_s->conf, ssid->id);
 895 #endif /* INTERWORKING_3GPP */
 896         return -1;
 897 }
 898
 899
 900 static int roaming_consortium_element_match(const u8 *ie, const u8 *rc_id,
 901                                             size_t rc_len)
 902 {
 903         const u8 *pos, *end;
 904         u8 lens;
 905
 906         if (ie == NULL)
 907                 return 0;
 908
 909         pos = ie + 2;
 910         end = ie + 2 + ie[1];
 911
 912         /* Roaming Consortium element:
 913          * Number of ANQP OIs
 914          * OI #1 and #2 lengths
 915          * OI #1, [OI #2], [OI #3]
 916          */
 917
 918         if (pos + 2 > end)
 919                 return 0;
 920
 921         pos++; /* skip Number of ANQP OIs */
 922         lens = *pos++;
 923         if (pos + (lens & 0x0f) + (lens >> 4) > end)
 924                 return 0;
 925
 926         if ((lens & 0x0f) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
 927                 return 1;
 928         pos += lens & 0x0f;
 929
 930         if ((lens >> 4) == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
 931                 return 1;
 932         pos += lens >> 4;
 933
 934         if (pos < end && (size_t) (end - pos) == rc_len &&
 935             os_memcmp(pos, rc_id, rc_len) == 0)
 936                 return 1;
 937
 938         return 0;
 939 }
 940
 941
 942 static int roaming_consortium_anqp_match(const struct wpabuf *anqp,
 943                                          const u8 *rc_id, size_t rc_len)
 944 {
 945         const u8 *pos, *end;
 946         u8 len;
 947
 948         if (anqp == NULL)
 949                 return 0;
 950
 951         pos = wpabuf_head(anqp);
 952         end = pos + wpabuf_len(anqp);
 953
 954         /* Set of <OI Length, OI> duples */
 955         while (pos < end) {
 956                 len = *pos++;
 957                 if (pos + len > end)
 958                         break;
 959                 if (len == rc_len && os_memcmp(pos, rc_id, rc_len) == 0)
 960                         return 1;
 961                 pos += len;
 962         }
 963
 964         return 0;
 965 }
 966
 967
 968 static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
 969                                     const u8 *rc_id, size_t rc_len)
 970 {
 971         return roaming_consortium_element_match(ie, rc_id, rc_len) ||
 972                 roaming_consortium_anqp_match(anqp, rc_id, rc_len);
 973 }
 974
 975
 976 static int cred_no_required_oi_match(struct wpa_cred *cred, struct wpa_bss *bss)
 977 {
 978         const u8 *ie;
 979
 980         if (cred->required_roaming_consortium_len == 0)
 981                 return 0;
 982
 983         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
 984
 985         if (ie == NULL &&
 986             (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
 987                 return 1;
 988
 989         return !roaming_consortium_match(ie,
 990                                          bss->anqp ?
 991                                          bss->anqp->roaming_consortium : NULL,
 992                                          cred->required_roaming_consortium,
 993                                          cred->required_roaming_consortium_len);
 994 }
 995
 996
 997 static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
 998 {
 999         size_t i;
1000
1001         if (!cred->excluded_ssid)
1002                 return 0;
1003
1004         for (i = 0; i < cred->num_excluded_ssid; i++) {
1005                 struct excluded_ssid *e = &cred->excluded_ssid[i];
1006                 if (bss->ssid_len == e->ssid_len &&
1007                     os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
1008                         return 1;
1009         }
1010
1011         return 0;
1012 }
1013
1014
1015 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
1016         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1017 {
1018         struct wpa_cred *cred, *selected = NULL;
1019         const u8 *ie;
1020
1021         ie = wpa_bss_get_ie(bss, WLAN_EID_ROAMING_CONSORTIUM);
1022
1023         if (ie == NULL &&
1024             (bss->anqp == NULL || bss->anqp->roaming_consortium == NULL))
1025                 return NULL;
1026
1027         if (wpa_s->conf->cred == NULL)
1028                 return NULL;
1029
1030         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1031                 if (cred->roaming_consortium_len == 0)
1032                         continue;
1033
1034                 if (!roaming_consortium_match(ie,
1035                                               bss->anqp ?
1036                                               bss->anqp->roaming_consortium :
1037                                               NULL,
1038                                               cred->roaming_consortium,
1039                                               cred->roaming_consortium_len))
1040                         continue;
1041
1042                 if (cred_excluded_ssid(cred, bss))
1043                         continue;
1044                 if (cred_no_required_oi_match(cred, bss))
1045                         continue;
1046
1047                 if (selected == NULL ||
1048                     selected->priority < cred->priority)
1049                         selected = cred;
1050         }
1051
1052         return selected;
1053 }
1054
1055
1056 static int interworking_set_eap_params(struct wpa_ssid *ssid,
1057                                        struct wpa_cred *cred, int ttls)
1058 {
1059         if (cred->eap_method) {
1060                 ttls = cred->eap_method->vendor == EAP_VENDOR_IETF &&
1061                         cred->eap_method->method == EAP_TYPE_TTLS;
1062
1063                 os_free(ssid->eap.eap_methods);
1064                 ssid->eap.eap_methods =
1065                         os_malloc(sizeof(struct eap_method_type) * 2);
1066                 if (ssid->eap.eap_methods == NULL)
1067                         return -1;
1068                 os_memcpy(ssid->eap.eap_methods, cred->eap_method,
1069                           sizeof(*cred->eap_method));
1070                 ssid->eap.eap_methods[1].vendor = EAP_VENDOR_IETF;
1071                 ssid->eap.eap_methods[1].method = EAP_TYPE_NONE;
1072         }
1073
1074         if (ttls && cred->username && cred->username[0]) {
1075                 const char *pos;
1076                 char *anon;
1077                 /* Use anonymous NAI in Phase 1 */
1078                 pos = os_strchr(cred->username, '@');
1079                 if (pos) {
1080                         size_t buflen = 9 + os_strlen(pos) + 1;
1081                         anon = os_malloc(buflen);
1082                         if (anon == NULL)
1083                                 return -1;
1084                         os_snprintf(anon, buflen, "anonymous%s", pos);
1085                 } else if (cred->realm) {
1086                         size_t buflen = 10 + os_strlen(cred->realm) + 1;
1087                         anon = os_malloc(buflen);
1088                         if (anon == NULL)
1089                                 return -1;
1090                         os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
1091                 } else {
1092                         anon = os_strdup("anonymous");
1093                         if (anon == NULL)
1094                                 return -1;
1095                 }
1096                 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
1097                     0) {
1098                         os_free(anon);
1099                         return -1;
1100                 }
1101                 os_free(anon);
1102         }
1103
1104         if (cred->username && cred->username[0] &&
1105             wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
1106                 return -1;
1107
1108         if (cred->password && cred->password[0]) {
1109                 if (cred->ext_password &&
1110                     wpa_config_set(ssid, "password", cred->password, 0) < 0)
1111                         return -1;
1112                 if (!cred->ext_password &&
1113                     wpa_config_set_quoted(ssid, "password", cred->password) <
1114                     0)
1115                         return -1;
1116         }
1117
1118         if (cred->client_cert && cred->client_cert[0] &&
1119             wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
1120                 return -1;
1121
1122 #ifdef ANDROID
1123         if (cred->private_key &&
1124             os_strncmp(cred->private_key, "keystore://", 11) == 0) {
1125                 /* Use OpenSSL engine configuration for Android keystore */
1126                 if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
1127                     wpa_config_set_quoted(ssid, "key_id",
1128                                           cred->private_key + 11) < 0 ||
1129                     wpa_config_set(ssid, "engine", "1", 0) < 0)
1130                         return -1;
1131         } else
1132 #endif /* ANDROID */
1133         if (cred->private_key && cred->private_key[0] &&
1134             wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
1135                 return -1;
1136
1137         if (cred->private_key_passwd && cred->private_key_passwd[0] &&
1138             wpa_config_set_quoted(ssid, "private_key_passwd",
1139                                   cred->private_key_passwd) < 0)
1140                 return -1;
1141
1142         if (cred->phase1) {
1143                 os_free(ssid->eap.phase1);
1144                 ssid->eap.phase1 = os_strdup(cred->phase1);
1145         }
1146         if (cred->phase2) {
1147                 os_free(ssid->eap.phase2);
1148                 ssid->eap.phase2 = os_strdup(cred->phase2);
1149         }
1150
1151         if (cred->ca_cert && cred->ca_cert[0] &&
1152             wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
1153                 return -1;
1154
1155         if (cred->domain_suffix_match && cred->domain_suffix_match[0] &&
1156             wpa_config_set_quoted(ssid, "domain_suffix_match",
1157                                   cred->domain_suffix_match) < 0)
1158                 return -1;
1159
1160         return 0;
1161 }
1162
1163
1164 static int interworking_connect_roaming_consortium(
1165         struct wpa_supplicant *wpa_s, struct wpa_cred *cred,
1166         struct wpa_bss *bss, const u8 *ssid_ie)
1167 {
1168         struct wpa_ssid *ssid;
1169
1170         wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " based on "
1171                    "roaming consortium match", MAC2STR(bss->bssid));
1172
1173         if (already_connected(wpa_s, cred, bss)) {
1174                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1175                         MAC2STR(bss->bssid));
1176                 return 0;
1177         }
1178
1179         ssid = wpa_config_add_network(wpa_s->conf);
1180         if (ssid == NULL)
1181                 return -1;
1182         ssid->parent_cred = cred;
1183         wpas_notify_network_added(wpa_s, ssid);
1184         wpa_config_set_network_defaults(ssid);
1185         ssid->priority = cred->priority;
1186         ssid->temporary = 1;
1187         ssid->ssid = os_zalloc(ssid_ie[1] + 1);
1188         if (ssid->ssid == NULL)
1189                 goto fail;
1190         os_memcpy(ssid->ssid, ssid_ie + 2, ssid_ie[1]);
1191         ssid->ssid_len = ssid_ie[1];
1192
1193         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1194                 goto fail;
1195
1196         if (cred->eap_method == NULL) {
1197                 wpa_printf(MSG_DEBUG, "Interworking: No EAP method set for "
1198                            "credential using roaming consortium");
1199                 goto fail;
1200         }
1201
1202         if (interworking_set_eap_params(
1203                     ssid, cred,
1204                     cred->eap_method->vendor == EAP_VENDOR_IETF &&
1205                     cred->eap_method->method == EAP_TYPE_TTLS) < 0)
1206                 goto fail;
1207
1208         wpa_config_update_prio_list(wpa_s->conf);
1209         interworking_reconnect(wpa_s);
1210
1211         return 0;
1212
1213 fail:
1214         wpas_notify_network_removed(wpa_s, ssid);
1215         wpa_config_remove_network(wpa_s->conf, ssid->id);
1216         return -1;
1217 }
1218
1219
1220 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1221 {
1222         struct wpa_cred *cred, *cred_rc, *cred_3gpp;
1223         struct wpa_ssid *ssid;
1224         struct nai_realm *realm;
1225         struct nai_realm_eap *eap = NULL;
1226         u16 count, i;
1227         char buf[100];
1228         const u8 *ie;
1229
1230         if (wpa_s->conf->cred == NULL || bss == NULL)
1231                 return -1;
1232         ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
1233         if (ie == NULL || ie[1] == 0) {
1234                 wpa_printf(MSG_DEBUG, "Interworking: No SSID known for "
1235                            MACSTR, MAC2STR(bss->bssid));
1236                 return -1;
1237         }
1238
1239         if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
1240                 /*
1241                  * We currently support only HS 2.0 networks and those are
1242                  * required to use WPA2-Enterprise.
1243                  */
1244                 wpa_printf(MSG_DEBUG, "Interworking: Network does not use "
1245                            "RSN");
1246                 return -1;
1247         }
1248
1249         cred_rc = interworking_credentials_available_roaming_consortium(wpa_s,
1250                                                                         bss);
1251         if (cred_rc) {
1252                 wpa_printf(MSG_DEBUG, "Interworking: Highest roaming "
1253                            "consortium matching credential priority %d",
1254                            cred_rc->priority);
1255         }
1256
1257         cred = interworking_credentials_available_realm(wpa_s, bss);
1258         if (cred) {
1259                 wpa_printf(MSG_DEBUG, "Interworking: Highest NAI Realm list "
1260                            "matching credential priority %d",
1261                            cred->priority);
1262         }
1263
1264         cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss);
1265         if (cred_3gpp) {
1266                 wpa_printf(MSG_DEBUG, "Interworking: Highest 3GPP matching "
1267                            "credential priority %d", cred_3gpp->priority);
1268         }
1269
1270         if (cred_rc &&
1271             (cred == NULL || cred_rc->priority >= cred->priority) &&
1272             (cred_3gpp == NULL || cred_rc->priority >= cred_3gpp->priority))
1273                 return interworking_connect_roaming_consortium(wpa_s, cred_rc,
1274                                                                bss, ie);
1275
1276         if (cred_3gpp &&
1277             (cred == NULL || cred_3gpp->priority >= cred->priority)) {
1278                 return interworking_connect_3gpp(wpa_s, cred_3gpp, bss);
1279         }
1280
1281         if (cred == NULL) {
1282                 wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
1283                            "found for " MACSTR, MAC2STR(bss->bssid));
1284                 return -1;
1285         }
1286
1287         realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
1288                                 &count);
1289         if (realm == NULL) {
1290                 wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
1291                            "Realm list from " MACSTR, MAC2STR(bss->bssid));
1292                 return -1;
1293         }
1294
1295         for (i = 0; i < count; i++) {
1296                 if (!nai_realm_match(&realm[i], cred->realm))
1297                         continue;
1298                 eap = nai_realm_find_eap(cred, &realm[i]);
1299                 if (eap)
1300                         break;
1301         }
1302
1303         if (!eap) {
1304                 wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
1305                            "and EAP method found for " MACSTR,
1306                            MAC2STR(bss->bssid));
1307                 nai_realm_free(realm, count);
1308                 return -1;
1309         }
1310
1311         wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR,
1312                    MAC2STR(bss->bssid));
1313
1314         if (already_connected(wpa_s, cred, bss)) {
1315                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_ALREADY_CONNECTED MACSTR,
1316                         MAC2STR(bss->bssid));
1317                 nai_realm_free(realm, count);
1318                 return 0;
1319         }
1320
1321         ssid = wpa_config_add_network(wpa_s->conf);
1322         if (ssid == NULL) {
1323                 nai_realm_free(realm, count);
1324                 return -1;
1325         }
1326         ssid->parent_cred = cred;
1327         wpas_notify_network_added(wpa_s, ssid);
1328         wpa_config_set_network_defaults(ssid);
1329         ssid->priority = cred->priority;
1330         ssid->temporary = 1;
1331         ssid->ssid = os_zalloc(ie[1] + 1);
1332         if (ssid->ssid == NULL)
1333                 goto fail;
1334         os_memcpy(ssid->ssid, ie + 2, ie[1]);
1335         ssid->ssid_len = ie[1];
1336
1337         if (interworking_set_hs20_params(wpa_s, ssid) < 0)
1338                 goto fail;
1339
1340         if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
1341                                                      eap->method), 0) < 0)
1342                 goto fail;
1343
1344         switch (eap->method) {
1345         case EAP_TYPE_TTLS:
1346                 if (eap->inner_method) {
1347                         os_snprintf(buf, sizeof(buf), "\"autheap=%s\"",
1348                                     eap_get_name(EAP_VENDOR_IETF,
1349                                                  eap->inner_method));
1350                         if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1351                                 goto fail;
1352                         break;
1353                 }
1354                 switch (eap->inner_non_eap) {
1355                 case NAI_REALM_INNER_NON_EAP_PAP:
1356                         if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
1357                             0)
1358                                 goto fail;
1359                         break;
1360                 case NAI_REALM_INNER_NON_EAP_CHAP:
1361                         if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
1362                             < 0)
1363                                 goto fail;
1364                         break;
1365                 case NAI_REALM_INNER_NON_EAP_MSCHAP:
1366                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
1367                                            0) < 0)
1368                                 goto fail;
1369                         break;
1370                 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
1371                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1372                                            0) < 0)
1373                                 goto fail;
1374                         break;
1375                 default:
1376                         /* EAP params were not set - assume TTLS/MSCHAPv2 */
1377                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
1378                                            0) < 0)
1379                                 goto fail;
1380                         break;
1381                 }
1382                 break;
1383         case EAP_TYPE_PEAP:
1384                 os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
1385                             eap_get_name(EAP_VENDOR_IETF,
1386                                          eap->inner_method ?
1387                                          eap->inner_method :
1388                                          EAP_TYPE_MSCHAPV2));
1389                 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
1390                         goto fail;
1391                 break;
1392         case EAP_TYPE_TLS:
1393                 break;
1394         }
1395
1396         if (interworking_set_eap_params(ssid, cred,
1397                                         eap->method == EAP_TYPE_TTLS) < 0)
1398                 goto fail;
1399
1400         nai_realm_free(realm, count);
1401
1402         wpa_config_update_prio_list(wpa_s->conf);
1403         interworking_reconnect(wpa_s);
1404
1405         return 0;
1406
1407 fail:
1408         wpas_notify_network_removed(wpa_s, ssid);
1409         wpa_config_remove_network(wpa_s->conf, ssid->id);
1410         nai_realm_free(realm, count);
1411         return -1;
1412 }
1413
1414
1415 static struct wpa_cred * interworking_credentials_available_3gpp(
1416         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1417 {
1418         struct wpa_cred *selected = NULL;
1419 #ifdef INTERWORKING_3GPP
1420         struct wpa_cred *cred;
1421         int ret;
1422
1423         if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
1424                 return NULL;
1425
1426 #ifdef CONFIG_EAP_PROXY
1427         if (!wpa_s->imsi[0]) {
1428                 size_t len;
1429                 wpa_printf(MSG_DEBUG, "Interworking: IMSI not available - try to read again through eap_proxy");
1430                 wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol,
1431                                                              wpa_s->imsi,
1432                                                              &len);
1433                 if (wpa_s->mnc_len > 0) {
1434                         wpa_s->imsi[len] = '\0';
1435                         wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
1436                                    wpa_s->imsi, wpa_s->mnc_len);
1437                 } else {
1438                         wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
1439                 }
1440         }
1441 #endif /* CONFIG_EAP_PROXY */
1442
1443         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1444                 char *sep;
1445                 const char *imsi;
1446                 int mnc_len;
1447                 char imsi_buf[16];
1448                 size_t msin_len;
1449
1450 #ifdef PCSC_FUNCS
1451                 if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
1452                     wpa_s->imsi[0]) {
1453                         imsi = wpa_s->imsi;
1454                         mnc_len = wpa_s->mnc_len;
1455                         goto compare;
1456                 }
1457 #endif /* PCSC_FUNCS */
1458 #ifdef CONFIG_EAP_PROXY
1459                 if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
1460                         imsi = wpa_s->imsi;
1461                         mnc_len = wpa_s->mnc_len;
1462                         goto compare;
1463                 }
1464 #endif /* CONFIG_EAP_PROXY */
1465
1466                 if (cred->imsi == NULL || !cred->imsi[0] ||
1467                     (!wpa_s->conf->external_sim &&
1468                      (cred->milenage == NULL || !cred->milenage[0])))
1469                         continue;
1470
1471                 sep = os_strchr(cred->imsi, '-');
1472                 if (sep == NULL ||
1473                     (sep - cred->imsi != 5 && sep - cred->imsi != 6))
1474                         continue;
1475                 mnc_len = sep - cred->imsi - 3;
1476                 os_memcpy(imsi_buf, cred->imsi, 3 + mnc_len);
1477                 sep++;
1478                 msin_len = os_strlen(cred->imsi);
1479                 if (3 + mnc_len + msin_len >= sizeof(imsi_buf) - 1)
1480                         msin_len = sizeof(imsi_buf) - 3 - mnc_len - 1;
1481                 os_memcpy(&imsi_buf[3 + mnc_len], sep, msin_len);
1482                 imsi_buf[3 + mnc_len + msin_len] = '\0';
1483                 imsi = imsi_buf;
1484
1485 #if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
1486         compare:
1487 #endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
1488                 wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
1489                            MACSTR, MAC2STR(bss->bssid));
1490                 ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
1491                 wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
1492                 if (ret) {
1493                         if (cred_excluded_ssid(cred, bss))
1494                                 continue;
1495                         if (cred_no_required_oi_match(cred, bss))
1496                                 continue;
1497                         if (selected == NULL ||
1498                             selected->priority < cred->priority)
1499                                 selected = cred;
1500                 }
1501         }
1502 #endif /* INTERWORKING_3GPP */
1503         return selected;
1504 }
1505
1506
1507 static struct wpa_cred * interworking_credentials_available_realm(
1508         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1509 {
1510         struct wpa_cred *cred, *selected = NULL;
1511         struct nai_realm *realm;
1512         u16 count, i;
1513
1514         if (bss->anqp == NULL || bss->anqp->nai_realm == NULL)
1515                 return NULL;
1516
1517         if (wpa_s->conf->cred == NULL)
1518                 return NULL;
1519
1520         wpa_printf(MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
1521                    MACSTR, MAC2STR(bss->bssid));
1522         realm = nai_realm_parse(bss->anqp->nai_realm, &count);
1523         if (realm == NULL) {
1524                 wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
1525                            "Realm list from " MACSTR, MAC2STR(bss->bssid));
1526                 return NULL;
1527         }
1528
1529         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1530                 if (cred->realm == NULL)
1531                         continue;
1532
1533                 for (i = 0; i < count; i++) {
1534                         if (!nai_realm_match(&realm[i], cred->realm))
1535                                 continue;
1536                         if (nai_realm_find_eap(cred, &realm[i])) {
1537                                 if (cred_excluded_ssid(cred, bss))
1538                                         continue;
1539                                 if (cred_no_required_oi_match(cred, bss))
1540                                         continue;
1541                                 if (selected == NULL ||
1542                                     selected->priority < cred->priority)
1543                                         selected = cred;
1544                                 break;
1545                         }
1546                 }
1547         }
1548
1549         nai_realm_free(realm, count);
1550
1551         return selected;
1552 }
1553
1554
1555 static struct wpa_cred * interworking_credentials_available(
1556         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1557 {
1558         struct wpa_cred *cred, *cred2;
1559
1560         cred = interworking_credentials_available_realm(wpa_s, bss);
1561         cred2 = interworking_credentials_available_3gpp(wpa_s, bss);
1562         if (cred && cred2 && cred2->priority >= cred->priority)
1563                 cred = cred2;
1564         if (!cred)
1565                 cred = cred2;
1566
1567         cred2 = interworking_credentials_available_roaming_consortium(wpa_s,
1568                                                                       bss);
1569         if (cred && cred2 && cred2->priority >= cred->priority)
1570                 cred = cred2;
1571         if (!cred)
1572                 cred = cred2;
1573
1574         return cred;
1575 }
1576
1577
1578 static int domain_name_list_contains(struct wpabuf *domain_names,
1579                                      const char *domain)
1580 {
1581         const u8 *pos, *end;
1582         size_t len;
1583
1584         len = os_strlen(domain);
1585         pos = wpabuf_head(domain_names);
1586         end = pos + wpabuf_len(domain_names);
1587
1588         while (pos + 1 < end) {
1589                 if (pos + 1 + pos[0] > end)
1590                         break;
1591
1592                 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
1593                                   pos + 1, pos[0]);
1594                 if (pos[0] == len &&
1595                     os_strncasecmp(domain, (const char *) (pos + 1), len) == 0)
1596                         return 1;
1597
1598                 pos += 1 + pos[0];
1599         }
1600
1601         return 0;
1602 }
1603
1604
1605 int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
1606                               struct wpa_cred *cred,
1607                               struct wpabuf *domain_names)
1608 {
1609         size_t i;
1610         int ret = -1;
1611 #ifdef INTERWORKING_3GPP
1612         char nai[100], *realm;
1613
1614         char *imsi = NULL;
1615         int mnc_len = 0;
1616         if (cred->imsi)
1617                 imsi = cred->imsi;
1618 #ifdef CONFIG_PCSC
1619         else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
1620                  wpa_s->scard && wpa_s->imsi[0]) {
1621                 imsi = wpa_s->imsi;
1622                 mnc_len = wpa_s->mnc_len;
1623         }
1624 #endif /* CONFIG_PCSC */
1625 #ifdef CONFIG_EAP_PROXY
1626         else if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
1627                 imsi = wpa_s->imsi;
1628                 mnc_len = wpa_s->mnc_len;
1629         }
1630 #endif /* CONFIG_EAP_PROXY */
1631         if (domain_names &&
1632             imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
1633                 realm = os_strchr(nai, '@');
1634                 if (realm)
1635                         realm++;
1636                 wpa_printf(MSG_DEBUG, "Interworking: Search for match "
1637                            "with SIM/USIM domain %s", realm);
1638                 if (realm &&
1639                     domain_name_list_contains(domain_names, realm))
1640                         return 1;
1641                 if (realm)
1642                         ret = 0;
1643         }
1644 #endif /* INTERWORKING_3GPP */
1645
1646         if (domain_names == NULL || cred->domain == NULL)
1647                 return ret;
1648
1649         for (i = 0; i < cred->num_domain; i++) {
1650                 wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
1651                            "home SP FQDN %s", cred->domain[i]);
1652                 if (domain_name_list_contains(domain_names, cred->domain[i]))
1653                         return 1;
1654         }
1655
1656         return 0;
1657 }
1658
1659
1660 static int interworking_home_sp(struct wpa_supplicant *wpa_s,
1661                                 struct wpabuf *domain_names)
1662 {
1663         struct wpa_cred *cred;
1664
1665         if (domain_names == NULL || wpa_s->conf->cred == NULL)
1666                 return -1;
1667
1668         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1669                 int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
1670                 if (res)
1671                         return res;
1672         }
1673
1674         return 0;
1675 }
1676
1677
1678 static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
1679 {
1680         struct wpa_bss *bss;
1681         struct wpa_ssid *ssid;
1682
1683         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1684                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1685                         if (wpas_network_disabled(wpa_s, ssid) ||
1686                             ssid->mode != WPAS_MODE_INFRA)
1687                                 continue;
1688                         if (ssid->ssid_len != bss->ssid_len ||
1689                             os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
1690                             0)
1691                                 continue;
1692                         /*
1693                          * TODO: Consider more accurate matching of security
1694                          * configuration similarly to what is done in events.c
1695                          */
1696                         return 1;
1697                 }
1698         }
1699
1700         return 0;
1701 }
1702
1703
1704 static void interworking_select_network(struct wpa_supplicant *wpa_s)
1705 {
1706         struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
1707         int selected_prio = -999999, selected_home_prio = -999999;
1708         unsigned int count = 0;
1709         const char *type;
1710         int res;
1711         struct wpa_cred *cred;
1712
1713         wpa_s->network_select = 0;
1714
1715         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1716                 cred = interworking_credentials_available(wpa_s, bss);
1717                 if (!cred)
1718                         continue;
1719                 if (!wpa_bss_get_ie(bss, WLAN_EID_RSN)) {
1720                         /*
1721                          * We currently support only HS 2.0 networks and those
1722                          * are required to use WPA2-Enterprise.
1723                          */
1724                         wpa_printf(MSG_DEBUG, "Interworking: Credential match "
1725                                    "with " MACSTR " but network does not use "
1726                                    "RSN", MAC2STR(bss->bssid));
1727                         continue;
1728                 }
1729                 count++;
1730                 res = interworking_home_sp(wpa_s, bss->anqp ?
1731                                            bss->anqp->domain_name : NULL);
1732                 if (res > 0)
1733                         type = "home";
1734                 else if (res == 0)
1735                         type = "roaming";
1736                 else
1737                         type = "unknown";
1738                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_AP MACSTR " type=%s",
1739                         MAC2STR(bss->bssid), type);
1740                 if (wpa_s->auto_select ||
1741                     (wpa_s->conf->auto_interworking &&
1742                      wpa_s->auto_network_select)) {
1743                         if (selected == NULL ||
1744                             cred->priority > selected_prio) {
1745                                 selected = bss;
1746                                 selected_prio = cred->priority;
1747                         }
1748                         if (res > 0 &&
1749                             (selected_home == NULL ||
1750                              cred->priority > selected_home_prio)) {
1751                                 selected_home = bss;
1752                                 selected_home_prio = cred->priority;
1753                         }
1754                 }
1755         }
1756
1757         if (selected_home && selected_home != selected &&
1758             selected_home_prio >= selected_prio) {
1759                 /* Prefer network operated by the Home SP */
1760                 selected = selected_home;
1761         }
1762
1763         if (count == 0) {
1764                 /*
1765                  * No matching network was found based on configured
1766                  * credentials. Check whether any of the enabled network blocks
1767                  * have matching APs.
1768                  */
1769                 if (interworking_find_network_match(wpa_s)) {
1770                         wpa_printf(MSG_DEBUG, "Interworking: Possible BSS "
1771                                    "match for enabled network configurations");
1772                         if (wpa_s->auto_select)
1773                                 interworking_reconnect(wpa_s);
1774                         return;
1775                 }
1776
1777                 if (wpa_s->auto_network_select) {
1778                         wpa_printf(MSG_DEBUG, "Interworking: Continue "
1779                                    "scanning after ANQP fetch");
1780                         wpa_supplicant_req_scan(wpa_s, wpa_s->scan_interval,
1781                                                 0);
1782                         return;
1783                 }
1784
1785                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
1786                         "with matching credentials found");
1787         }
1788
1789         if (selected)
1790                 interworking_connect(wpa_s, selected);
1791 }
1792
1793
1794 static struct wpa_bss_anqp *
1795 interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1796 {
1797         struct wpa_bss *other;
1798
1799         if (is_zero_ether_addr(bss->hessid))
1800                 return NULL; /* Cannot be in the same homegenous ESS */
1801
1802         dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
1803                 if (other == bss)
1804                         continue;
1805                 if (other->anqp == NULL)
1806                         continue;
1807                 if (other->anqp->roaming_consortium == NULL &&
1808                     other->anqp->nai_realm == NULL &&
1809                     other->anqp->anqp_3gpp == NULL &&
1810                     other->anqp->domain_name == NULL)
1811                         continue;
1812                 if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
1813                         continue;
1814                 if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
1815                         continue;
1816                 if (bss->ssid_len != other->ssid_len ||
1817                     os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
1818                         continue;
1819
1820                 wpa_printf(MSG_DEBUG, "Interworking: Share ANQP data with "
1821                            "already fetched BSSID " MACSTR " and " MACSTR,
1822                            MAC2STR(other->bssid), MAC2STR(bss->bssid));
1823                 other->anqp->users++;
1824                 return other->anqp;
1825         }
1826
1827         return NULL;
1828 }
1829
1830
1831 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
1832 {
1833         struct wpa_bss *bss;
1834         int found = 0;
1835         const u8 *ie;
1836
1837         if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress)
1838                 return;
1839
1840         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1841                 if (!(bss->caps & IEEE80211_CAP_ESS))
1842                         continue;
1843                 ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
1844                 if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
1845                         continue; /* AP does not support Interworking */
1846
1847                 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
1848                         if (bss->anqp == NULL) {
1849                                 bss->anqp = interworking_match_anqp_info(wpa_s,
1850                                                                          bss);
1851                                 if (bss->anqp) {
1852                                         /* Shared data already fetched */
1853                                         continue;
1854                                 }
1855                                 bss->anqp = wpa_bss_anqp_alloc();
1856                                 if (bss->anqp == NULL)
1857                                         break;
1858                         }
1859                         found++;
1860                         bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
1861                         wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
1862                                 MACSTR, MAC2STR(bss->bssid));
1863                         interworking_anqp_send_req(wpa_s, bss);
1864                         break;
1865                 }
1866         }
1867
1868         if (found == 0) {
1869                 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
1870                 wpa_s->fetch_anqp_in_progress = 0;
1871                 if (wpa_s->network_select)
1872                         interworking_select_network(wpa_s);
1873         }
1874 }
1875
1876
1877 void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
1878 {
1879         struct wpa_bss *bss;
1880
1881         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
1882                 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
1883
1884         wpa_s->fetch_anqp_in_progress = 1;
1885         interworking_next_anqp_fetch(wpa_s);
1886 }
1887
1888
1889 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
1890 {
1891         if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
1892                 return 0;
1893
1894         wpa_s->network_select = 0;
1895         wpa_s->fetch_all_anqp = 1;
1896
1897         interworking_start_fetch_anqp(wpa_s);
1898
1899         return 0;
1900 }
1901
1902
1903 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
1904 {
1905         if (!wpa_s->fetch_anqp_in_progress)
1906                 return;
1907
1908         wpa_s->fetch_anqp_in_progress = 0;
1909 }
1910
1911
1912 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
1913                   u16 info_ids[], size_t num_ids)
1914 {
1915         struct wpabuf *buf;
1916         int ret = 0;
1917         int freq;
1918         struct wpa_bss *bss;
1919         int res;
1920
1921         freq = wpa_s->assoc_freq;
1922         bss = wpa_bss_get_bssid(wpa_s, dst);
1923         if (bss) {
1924                 wpa_bss_anqp_unshare_alloc(bss);
1925                 freq = bss->freq;
1926         }
1927         if (freq <= 0)
1928                 return -1;
1929
1930         wpa_printf(MSG_DEBUG, "ANQP: Query Request to " MACSTR " for %u id(s)",
1931                    MAC2STR(dst), (unsigned int) num_ids);
1932
1933         buf = anqp_build_req(info_ids, num_ids, NULL);
1934         if (buf == NULL)
1935                 return -1;
1936
1937         res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
1938         if (res < 0) {
1939                 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
1940                 wpabuf_free(buf);
1941                 ret = -1;
1942         } else
1943                 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
1944                            "%u", res);
1945
1946         return ret;
1947 }
1948
1949
1950 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
1951                                             struct wpa_bss *bss, const u8 *sa,
1952                                             u16 info_id,
1953                                             const u8 *data, size_t slen)
1954 {
1955         const u8 *pos = data;
1956         struct wpa_bss_anqp *anqp = NULL;
1957 #ifdef CONFIG_HS20
1958         u8 type;
1959 #endif /* CONFIG_HS20 */
1960
1961         if (bss)
1962                 anqp = bss->anqp;
1963
1964         switch (info_id) {
1965         case ANQP_CAPABILITY_LIST:
1966                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1967                         " ANQP Capability list", MAC2STR(sa));
1968                 break;
1969         case ANQP_VENUE_NAME:
1970                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1971                         " Venue Name", MAC2STR(sa));
1972                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
1973                 if (anqp) {
1974                         wpabuf_free(anqp->venue_name);
1975                         anqp->venue_name = wpabuf_alloc_copy(pos, slen);
1976                 }
1977                 break;
1978         case ANQP_NETWORK_AUTH_TYPE:
1979                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1980                         " Network Authentication Type information",
1981                         MAC2STR(sa));
1982                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
1983                                   "Type", pos, slen);
1984                 if (anqp) {
1985                         wpabuf_free(anqp->network_auth_type);
1986                         anqp->network_auth_type = wpabuf_alloc_copy(pos, slen);
1987                 }
1988                 break;
1989         case ANQP_ROAMING_CONSORTIUM:
1990                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1991                         " Roaming Consortium list", MAC2STR(sa));
1992                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
1993                                   pos, slen);
1994                 if (anqp) {
1995                         wpabuf_free(anqp->roaming_consortium);
1996                         anqp->roaming_consortium = wpabuf_alloc_copy(pos, slen);
1997                 }
1998                 break;
1999         case ANQP_IP_ADDR_TYPE_AVAILABILITY:
2000                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
2001                         " IP Address Type Availability information",
2002                         MAC2STR(sa));
2003                 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
2004                             pos, slen);
2005                 if (anqp) {
2006                         wpabuf_free(anqp->ip_addr_type_availability);
2007                         anqp->ip_addr_type_availability =
2008                                 wpabuf_alloc_copy(pos, slen);
2009                 }
2010                 break;
2011         case ANQP_NAI_REALM:
2012                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
2013                         " NAI Realm list", MAC2STR(sa));
2014                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
2015                 if (anqp) {
2016                         wpabuf_free(anqp->nai_realm);
2017                         anqp->nai_realm = wpabuf_alloc_copy(pos, slen);
2018                 }
2019                 break;
2020         case ANQP_3GPP_CELLULAR_NETWORK:
2021                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
2022                         " 3GPP Cellular Network information", MAC2STR(sa));
2023                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
2024                                   pos, slen);
2025                 if (anqp) {
2026                         wpabuf_free(anqp->anqp_3gpp);
2027                         anqp->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
2028                 }
2029                 break;
2030         case ANQP_DOMAIN_NAME:
2031                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
2032                         " Domain Name list", MAC2STR(sa));
2033                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
2034                 if (anqp) {
2035                         wpabuf_free(anqp->domain_name);
2036                         anqp->domain_name = wpabuf_alloc_copy(pos, slen);
2037                 }
2038                 break;
2039         case ANQP_VENDOR_SPECIFIC:
2040                 if (slen < 3)
2041                         return;
2042
2043                 switch (WPA_GET_BE24(pos)) {
2044 #ifdef CONFIG_HS20
2045                 case OUI_WFA:
2046                         pos += 3;
2047                         slen -= 3;
2048
2049                         if (slen < 1)
2050                                 return;
2051                         type = *pos++;
2052                         slen--;
2053
2054                         switch (type) {
2055                         case HS20_ANQP_OUI_TYPE:
2056                                 hs20_parse_rx_hs20_anqp_resp(wpa_s, sa, pos,
2057                                                              slen);
2058                                 break;
2059                         default:
2060                                 wpa_printf(MSG_DEBUG, "HS20: Unsupported ANQP "
2061                                            "vendor type %u", type);
2062                                 break;
2063                         }
2064                         break;
2065 #endif /* CONFIG_HS20 */
2066                 default:
2067                         wpa_printf(MSG_DEBUG, "Interworking: Unsupported "
2068                                    "vendor-specific ANQP OUI %06x",
2069                                    WPA_GET_BE24(pos));
2070                         return;
2071                 }
2072                 break;
2073         default:
2074                 wpa_printf(MSG_DEBUG, "Interworking: Unsupported ANQP Info ID "
2075                            "%u", info_id);
2076                 break;
2077         }
2078 }
2079
2080
2081 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
2082                   enum gas_query_result result,
2083                   const struct wpabuf *adv_proto,
2084                   const struct wpabuf *resp, u16 status_code)
2085 {
2086         struct wpa_supplicant *wpa_s = ctx;
2087         const u8 *pos;
2088         const u8 *end;
2089         u16 info_id;
2090         u16 slen;
2091         struct wpa_bss *bss = NULL, *tmp;
2092
2093         if (result != GAS_QUERY_SUCCESS)
2094                 return;
2095
2096         pos = wpabuf_head(adv_proto);
2097         if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
2098             pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
2099                 wpa_printf(MSG_DEBUG, "ANQP: Unexpected Advertisement "
2100                            "Protocol in response");
2101                 return;
2102         }
2103
2104         /*
2105          * If possible, select the BSS entry based on which BSS entry was used
2106          * for the request. This can help in cases where multiple BSS entries
2107          * may exist for the same AP.
2108          */
2109         dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
2110                 if (tmp == wpa_s->interworking_gas_bss &&
2111                     os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
2112                         bss = tmp;
2113                         break;
2114                 }
2115         }
2116         if (bss == NULL)
2117                 bss = wpa_bss_get_bssid(wpa_s, dst);
2118
2119         pos = wpabuf_head(resp);
2120         end = pos + wpabuf_len(resp);
2121
2122         while (pos < end) {
2123                 if (pos + 4 > end) {
2124                         wpa_printf(MSG_DEBUG, "ANQP: Invalid element");
2125                         break;
2126                 }
2127                 info_id = WPA_GET_LE16(pos);
2128                 pos += 2;
2129                 slen = WPA_GET_LE16(pos);
2130                 pos += 2;
2131                 if (pos + slen > end) {
2132                         wpa_printf(MSG_DEBUG, "ANQP: Invalid element length "
2133                                    "for Info ID %u", info_id);
2134                         break;
2135                 }
2136                 interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
2137                                                 slen);
2138                 pos += slen;
2139         }
2140 }
2141
2142
2143 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
2144                                           struct wpa_scan_results *scan_res)
2145 {
2146         wpa_printf(MSG_DEBUG, "Interworking: Scan results available - start "
2147                    "ANQP fetch");
2148         interworking_start_fetch_anqp(wpa_s);
2149 }
2150
2151
2152 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select)
2153 {
2154         interworking_stop_fetch_anqp(wpa_s);
2155         wpa_s->network_select = 1;
2156         wpa_s->auto_network_select = 0;
2157         wpa_s->auto_select = !!auto_select;
2158         wpa_s->fetch_all_anqp = 0;
2159         wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
2160                    "selection");
2161         wpa_s->scan_res_handler = interworking_scan_res_handler;
2162         wpa_s->normal_scans = 0;
2163         wpa_s->scan_req = MANUAL_SCAN_REQ;
2164         wpa_s->after_wps = 0;
2165         wpa_s->known_wps_freq = 0;
2166         wpa_supplicant_req_scan(wpa_s, 0, 0);
2167
2168         return 0;
2169 }
2170
2171
2172 static void gas_resp_cb(void *ctx, const u8 *addr, u8 dialog_token,
2173                         enum gas_query_result result,
2174                         const struct wpabuf *adv_proto,
2175                         const struct wpabuf *resp, u16 status_code)
2176 {
2177         struct wpa_supplicant *wpa_s = ctx;
2178
2179         wpa_msg(wpa_s, MSG_INFO, GAS_RESPONSE_INFO "addr=" MACSTR
2180                 " dialog_token=%d status_code=%d resp_len=%d",
2181                 MAC2STR(addr), dialog_token, status_code,
2182                 resp ? (int) wpabuf_len(resp) : -1);
2183         if (!resp)
2184                 return;
2185
2186         wpabuf_free(wpa_s->last_gas_resp);
2187         wpa_s->last_gas_resp = wpabuf_dup(resp);
2188         if (wpa_s->last_gas_resp == NULL)
2189                 return;
2190         os_memcpy(wpa_s->last_gas_addr, addr, ETH_ALEN);
2191         wpa_s->last_gas_dialog_token = dialog_token;
2192 }
2193
2194
2195 int gas_send_request(struct wpa_supplicant *wpa_s, const u8 *dst,
2196                      const struct wpabuf *adv_proto,
2197                      const struct wpabuf *query)
2198 {
2199         struct wpabuf *buf;
2200         int ret = 0;
2201         int freq;
2202         struct wpa_bss *bss;
2203         int res;
2204         size_t len;
2205         u8 query_resp_len_limit = 0, pame_bi = 0;
2206
2207         freq = wpa_s->assoc_freq;
2208         bss = wpa_bss_get_bssid(wpa_s, dst);
2209         if (bss)
2210                 freq = bss->freq;
2211         if (freq <= 0)
2212                 return -1;
2213
2214         wpa_printf(MSG_DEBUG, "GAS request to " MACSTR " (freq %d MHz)",
2215                    MAC2STR(dst), freq);
2216         wpa_hexdump_buf(MSG_DEBUG, "Advertisement Protocol ID", adv_proto);
2217         wpa_hexdump_buf(MSG_DEBUG, "GAS Query", query);
2218
2219         len = 3 + wpabuf_len(adv_proto) + 2;
2220         if (query)
2221                 len += wpabuf_len(query);
2222         buf = gas_build_initial_req(0, len);
2223         if (buf == NULL)
2224                 return -1;
2225
2226         /* Advertisement Protocol IE */
2227         wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO);
2228         wpabuf_put_u8(buf, 1 + wpabuf_len(adv_proto)); /* Length */
2229         wpabuf_put_u8(buf, (query_resp_len_limit & 0x7f) |
2230                       (pame_bi ? 0x80 : 0));
2231         wpabuf_put_buf(buf, adv_proto);
2232
2233         /* GAS Query */
2234         if (query) {
2235                 wpabuf_put_le16(buf, wpabuf_len(query));
2236                 wpabuf_put_buf(buf, query);
2237         } else
2238                 wpabuf_put_le16(buf, 0);
2239
2240         res = gas_query_req(wpa_s->gas, dst, freq, buf, gas_resp_cb, wpa_s);
2241         if (res < 0) {
2242                 wpa_printf(MSG_DEBUG, "GAS: Failed to send Query Request");
2243                 wpabuf_free(buf);
2244                 ret = -1;
2245         } else
2246                 wpa_printf(MSG_DEBUG, "GAS: Query started with dialog token "
2247                            "%u", res);
2248
2249         return ret;
2250 }