Add SHA384 and SHA512 implementations from LibTomCrypt library
[mech_eap.git] / wpa_supplicant / wnm_sta.c
1 /*
2  * wpa_supplicant - WNM
3  * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ieee802_11_common.h"
14 #include "common/wpa_ctrl.h"
15 #include "rsn_supp/wpa.h"
16 #include "wpa_supplicant_i.h"
17 #include "driver_i.h"
18 #include "scan.h"
19 #include "ctrl_iface.h"
20 #include "bss.h"
21 #include "wnm_sta.h"
22 #include "hs20_supplicant.h"
23
24 #define MAX_TFS_IE_LEN  1024
25 #define WNM_MAX_NEIGHBOR_REPORT 10
26
27
28 /* get the TFS IE from driver */
29 static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
30                                    u16 *buf_len, enum wnm_oper oper)
31 {
32         wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
33
34         return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
35 }
36
37
38 /* set the TFS IE to driver */
39 static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
40                                    const u8 *addr, const u8 *buf, u16 buf_len,
41                                    enum wnm_oper oper)
42 {
43         u16 len = buf_len;
44
45         wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
46
47         return wpa_drv_wnm_oper(wpa_s, oper, addr, (u8 *) buf, &len);
48 }
49
50
51 /* MLME-SLEEPMODE.request */
52 int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
53                                  u8 action, u16 intval, struct wpabuf *tfs_req)
54 {
55         struct ieee80211_mgmt *mgmt;
56         int res;
57         size_t len;
58         struct wnm_sleep_element *wnmsleep_ie;
59         u8 *wnmtfs_ie;
60         u8 wnmsleep_ie_len;
61         u16 wnmtfs_ie_len;  /* possibly multiple IE(s) */
62         enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
63                 WNM_SLEEP_TFS_REQ_IE_NONE;
64
65         wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
66                    "action=%s to " MACSTR,
67                    action == 0 ? "enter" : "exit",
68                    MAC2STR(wpa_s->bssid));
69
70         /* WNM-Sleep Mode IE */
71         wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
72         wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
73         if (wnmsleep_ie == NULL)
74                 return -1;
75         wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
76         wnmsleep_ie->len = wnmsleep_ie_len - 2;
77         wnmsleep_ie->action_type = action;
78         wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
79         wnmsleep_ie->intval = host_to_le16(intval);
80         wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
81                     (u8 *) wnmsleep_ie, wnmsleep_ie_len);
82
83         /* TFS IE(s) */
84         if (tfs_req) {
85                 wnmtfs_ie_len = wpabuf_len(tfs_req);
86                 wnmtfs_ie = os_malloc(wnmtfs_ie_len);
87                 if (wnmtfs_ie == NULL) {
88                         os_free(wnmsleep_ie);
89                         return -1;
90                 }
91                 os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
92         } else {
93                 wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
94                 if (wnmtfs_ie == NULL) {
95                         os_free(wnmsleep_ie);
96                         return -1;
97                 }
98                 if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
99                                             tfs_oper)) {
100                         wnmtfs_ie_len = 0;
101                         os_free(wnmtfs_ie);
102                         wnmtfs_ie = NULL;
103                 }
104         }
105         wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
106                     (u8 *) wnmtfs_ie, wnmtfs_ie_len);
107
108         mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
109         if (mgmt == NULL) {
110                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
111                            "WNM-Sleep Request action frame");
112                 os_free(wnmsleep_ie);
113                 os_free(wnmtfs_ie);
114                 return -1;
115         }
116
117         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
118         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
119         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
120         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
121                                            WLAN_FC_STYPE_ACTION);
122         mgmt->u.action.category = WLAN_ACTION_WNM;
123         mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
124         mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
125         os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
126                   wnmsleep_ie_len);
127         /* copy TFS IE here */
128         if (wnmtfs_ie_len > 0) {
129                 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
130                           wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
131         }
132
133         len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
134                 wnmtfs_ie_len;
135
136         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
137                                   wpa_s->own_addr, wpa_s->bssid,
138                                   &mgmt->u.action.category, len, 0);
139         if (res < 0)
140                 wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
141                            "(action=%d, intval=%d)", action, intval);
142         else
143                 wpa_s->wnmsleep_used = 1;
144
145         os_free(wnmsleep_ie);
146         os_free(wnmtfs_ie);
147         os_free(mgmt);
148
149         return res;
150 }
151
152
153 static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
154                                          const u8 *tfsresp_ie_start,
155                                          const u8 *tfsresp_ie_end)
156 {
157         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
158                          wpa_s->bssid, NULL, NULL);
159         /* remove GTK/IGTK ?? */
160
161         /* set the TFS Resp IE(s) */
162         if (tfsresp_ie_start && tfsresp_ie_end &&
163             tfsresp_ie_end - tfsresp_ie_start >= 0) {
164                 u16 tfsresp_ie_len;
165                 tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
166                         tfsresp_ie_start;
167                 wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
168                 /* pass the TFS Resp IE(s) to driver for processing */
169                 if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
170                                             tfsresp_ie_start,
171                                             tfsresp_ie_len,
172                                             WNM_SLEEP_TFS_RESP_IE_SET))
173                         wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
174         }
175 }
176
177
178 static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
179                                         const u8 *frm, u16 key_len_total)
180 {
181         u8 *ptr, *end;
182         u8 gtk_len;
183
184         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM,  wpa_s->bssid,
185                          NULL, NULL);
186
187         /* Install GTK/IGTK */
188
189         /* point to key data field */
190         ptr = (u8 *) frm + 1 + 2;
191         end = ptr + key_len_total;
192         wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
193
194         if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
195                 wpa_msg(wpa_s, MSG_INFO,
196                         "WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
197                 return;
198         }
199
200         while (end - ptr > 1) {
201                 if (2 + ptr[1] > end - ptr) {
202                         wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
203                                    "length");
204                         if (end > ptr) {
205                                 wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
206                                             ptr, end - ptr);
207                         }
208                         break;
209                 }
210                 if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
211                         if (ptr[1] < 11 + 5) {
212                                 wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
213                                            "subelem");
214                                 break;
215                         }
216                         gtk_len = *(ptr + 4);
217                         if (ptr[1] < 11 + gtk_len ||
218                             gtk_len < 5 || gtk_len > 32) {
219                                 wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
220                                            "subelem");
221                                 break;
222                         }
223                         wpa_wnmsleep_install_key(
224                                 wpa_s->wpa,
225                                 WNM_SLEEP_SUBELEM_GTK,
226                                 ptr);
227                         ptr += 13 + gtk_len;
228 #ifdef CONFIG_IEEE80211W
229                 } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
230                         if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
231                                 wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
232                                            "subelem");
233                                 break;
234                         }
235                         wpa_wnmsleep_install_key(wpa_s->wpa,
236                                                  WNM_SLEEP_SUBELEM_IGTK, ptr);
237                         ptr += 10 + WPA_IGTK_LEN;
238 #endif /* CONFIG_IEEE80211W */
239                 } else
240                         break; /* skip the loop */
241         }
242 }
243
244
245 static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
246                                         const u8 *frm, int len)
247 {
248         /*
249          * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data |
250          * WNM-Sleep Mode IE | TFS Response IE
251          */
252         const u8 *pos = frm; /* point to payload after the action field */
253         u16 key_len_total;
254         struct wnm_sleep_element *wnmsleep_ie = NULL;
255         /* multiple TFS Resp IE (assuming consecutive) */
256         const u8 *tfsresp_ie_start = NULL;
257         const u8 *tfsresp_ie_end = NULL;
258         size_t left;
259
260         if (!wpa_s->wnmsleep_used) {
261                 wpa_printf(MSG_DEBUG,
262                            "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
263                 return;
264         }
265
266         if (len < 3)
267                 return;
268         key_len_total = WPA_GET_LE16(frm + 1);
269
270         wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d",
271                    frm[0], key_len_total);
272         left = len - 3;
273         if (key_len_total > left) {
274                 wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
275                 return;
276         }
277         pos += 3 + key_len_total;
278         while (pos - frm + 1 < len) {
279                 u8 ie_len = *(pos + 1);
280                 if (2 + ie_len > frm + len - pos) {
281                         wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
282                         break;
283                 }
284                 wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
285                 if (*pos == WLAN_EID_WNMSLEEP && ie_len >= 4)
286                         wnmsleep_ie = (struct wnm_sleep_element *) pos;
287                 else if (*pos == WLAN_EID_TFS_RESP) {
288                         if (!tfsresp_ie_start)
289                                 tfsresp_ie_start = pos;
290                         tfsresp_ie_end = pos;
291                 } else
292                         wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
293                 pos += ie_len + 2;
294         }
295
296         if (!wnmsleep_ie) {
297                 wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
298                 return;
299         }
300
301         if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
302             wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
303                 wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
304                            "frame (action=%d, intval=%d)",
305                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
306                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
307                         wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
308                                                      tfsresp_ie_end);
309                 } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
310                         wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
311                 }
312         } else {
313                 wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
314                            "(action=%d, intval=%d)",
315                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
316                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
317                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
318                                          wpa_s->bssid, NULL, NULL);
319                 else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
320                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
321                                          wpa_s->bssid, NULL, NULL);
322         }
323 }
324
325
326 void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
327 {
328         int i;
329
330         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
331                 os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot);
332                 os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
333         }
334
335         wpa_s->wnm_num_neighbor_report = 0;
336         os_free(wpa_s->wnm_neighbor_report_elements);
337         wpa_s->wnm_neighbor_report_elements = NULL;
338 }
339
340
341 static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
342                                            u8 id, u8 elen, const u8 *pos)
343 {
344         switch (id) {
345         case WNM_NEIGHBOR_TSF:
346                 if (elen < 2 + 2) {
347                         wpa_printf(MSG_DEBUG, "WNM: Too short TSF");
348                         break;
349                 }
350                 rep->tsf_offset = WPA_GET_LE16(pos);
351                 rep->beacon_int = WPA_GET_LE16(pos + 2);
352                 rep->tsf_present = 1;
353                 break;
354         case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING:
355                 if (elen < 2) {
356                         wpa_printf(MSG_DEBUG, "WNM: Too short condensed "
357                                    "country string");
358                         break;
359                 }
360                 os_memcpy(rep->country, pos, 2);
361                 rep->country_present = 1;
362                 break;
363         case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE:
364                 if (elen < 1) {
365                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition "
366                                    "candidate");
367                         break;
368                 }
369                 rep->preference = pos[0];
370                 rep->preference_present = 1;
371                 break;
372         case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
373                 rep->bss_term_tsf = WPA_GET_LE64(pos);
374                 rep->bss_term_dur = WPA_GET_LE16(pos + 8);
375                 rep->bss_term_present = 1;
376                 break;
377         case WNM_NEIGHBOR_BEARING:
378                 if (elen < 8) {
379                         wpa_printf(MSG_DEBUG, "WNM: Too short neighbor "
380                                    "bearing");
381                         break;
382                 }
383                 rep->bearing = WPA_GET_LE16(pos);
384                 rep->distance = WPA_GET_LE32(pos + 2);
385                 rep->rel_height = WPA_GET_LE16(pos + 2 + 4);
386                 rep->bearing_present = 1;
387                 break;
388         case WNM_NEIGHBOR_MEASUREMENT_PILOT:
389                 if (elen < 1) {
390                         wpa_printf(MSG_DEBUG, "WNM: Too short measurement "
391                                    "pilot");
392                         break;
393                 }
394                 os_free(rep->meas_pilot);
395                 rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot));
396                 if (rep->meas_pilot == NULL)
397                         break;
398                 rep->meas_pilot->measurement_pilot = pos[0];
399                 rep->meas_pilot->subelem_len = elen - 1;
400                 os_memcpy(rep->meas_pilot->subelems, pos + 1, elen - 1);
401                 break;
402         case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES:
403                 if (elen < 5) {
404                         wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled "
405                                    "capabilities");
406                         break;
407                 }
408                 os_memcpy(rep->rm_capab, pos, 5);
409                 rep->rm_capab_present = 1;
410                 break;
411         case WNM_NEIGHBOR_MULTIPLE_BSSID:
412                 if (elen < 1) {
413                         wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID");
414                         break;
415                 }
416                 os_free(rep->mul_bssid);
417                 rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid));
418                 if (rep->mul_bssid == NULL)
419                         break;
420                 rep->mul_bssid->max_bssid_indicator = pos[0];
421                 rep->mul_bssid->subelem_len = elen - 1;
422                 os_memcpy(rep->mul_bssid->subelems, pos + 1, elen - 1);
423                 break;
424         }
425 }
426
427
428 static int wnm_nei_get_chan(struct wpa_supplicant *wpa_s, u8 op_class, u8 chan)
429 {
430         struct wpa_bss *bss = wpa_s->current_bss;
431         const char *country = NULL;
432
433         if (bss) {
434                 const u8 *elem = wpa_bss_get_ie(bss, WLAN_EID_COUNTRY);
435
436                 if (elem && elem[1] >= 2)
437                         country = (const char *) (elem + 2);
438         }
439
440         return ieee80211_chan_to_freq(country, op_class, chan);
441 }
442
443
444 static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
445                                       const u8 *pos, u8 len,
446                                       struct neighbor_report *rep)
447 {
448         u8 left = len;
449
450         if (left < 13) {
451                 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report");
452                 return;
453         }
454
455         os_memcpy(rep->bssid, pos, ETH_ALEN);
456         rep->bssid_info = WPA_GET_LE32(pos + ETH_ALEN);
457         rep->regulatory_class = *(pos + 10);
458         rep->channel_number = *(pos + 11);
459         rep->phy_type = *(pos + 12);
460
461         pos += 13;
462         left -= 13;
463
464         while (left >= 2) {
465                 u8 id, elen;
466
467                 id = *pos++;
468                 elen = *pos++;
469                 wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
470                 left -= 2;
471                 if (elen > left) {
472                         wpa_printf(MSG_DEBUG,
473                                    "WNM: Truncated neighbor report subelement");
474                         break;
475                 }
476                 wnm_parse_neighbor_report_elem(rep, id, elen, pos);
477                 left -= elen;
478                 pos += elen;
479         }
480
481         rep->freq = wnm_nei_get_chan(wpa_s, rep->regulatory_class,
482                                      rep->channel_number);
483 }
484
485
486 static struct wpa_bss *
487 compare_scan_neighbor_results(struct wpa_supplicant *wpa_s)
488 {
489
490         u8 i;
491         struct wpa_bss *bss = wpa_s->current_bss;
492         struct wpa_bss *target;
493
494         if (!bss)
495                 return 0;
496
497         wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d",
498                    MAC2STR(wpa_s->bssid), bss->level);
499
500         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
501                 struct neighbor_report *nei;
502
503                 nei = &wpa_s->wnm_neighbor_report_elements[i];
504                 if (nei->preference_present && nei->preference == 0) {
505                         wpa_printf(MSG_DEBUG, "Skip excluded BSS " MACSTR,
506                                    MAC2STR(nei->bssid));
507                         continue;
508                 }
509
510                 target = wpa_bss_get_bssid(wpa_s, nei->bssid);
511                 if (!target) {
512                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
513                                    " (pref %d) not found in scan results",
514                                    MAC2STR(nei->bssid),
515                                    nei->preference_present ? nei->preference :
516                                    -1);
517                         continue;
518                 }
519
520                 if (bss->ssid_len != target->ssid_len ||
521                     os_memcmp(bss->ssid, target->ssid, bss->ssid_len) != 0) {
522                         /*
523                          * TODO: Could consider allowing transition to another
524                          * ESS if PMF was enabled for the association.
525                          */
526                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
527                                    " (pref %d) in different ESS",
528                                    MAC2STR(nei->bssid),
529                                    nei->preference_present ? nei->preference :
530                                    -1);
531                         continue;
532                 }
533
534                 if (target->level < bss->level && target->level < -80) {
535                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
536                                    " (pref %d) does not have sufficient signal level (%d)",
537                                    MAC2STR(nei->bssid),
538                                    nei->preference_present ? nei->preference :
539                                    -1,
540                                    target->level);
541                         continue;
542                 }
543
544                 wpa_printf(MSG_DEBUG,
545                            "WNM: Found an acceptable preferred transition candidate BSS "
546                            MACSTR " (RSSI %d)",
547                            MAC2STR(nei->bssid), target->level);
548                 return target;
549         }
550
551         return NULL;
552 }
553
554
555 static void wnm_send_bss_transition_mgmt_resp(
556         struct wpa_supplicant *wpa_s, u8 dialog_token,
557         enum bss_trans_mgmt_status_code status, u8 delay,
558         const u8 *target_bssid)
559 {
560         u8 buf[1000], *pos;
561         struct ieee80211_mgmt *mgmt;
562         size_t len;
563         int res;
564
565         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response "
566                    "to " MACSTR " dialog_token=%u status=%u delay=%d",
567                    MAC2STR(wpa_s->bssid), dialog_token, status, delay);
568         if (!wpa_s->current_bss) {
569                 wpa_printf(MSG_DEBUG,
570                            "WNM: Current BSS not known - drop response");
571                 return;
572         }
573
574         mgmt = (struct ieee80211_mgmt *) buf;
575         os_memset(&buf, 0, sizeof(buf));
576         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
577         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
578         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
579         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
580                                            WLAN_FC_STYPE_ACTION);
581         mgmt->u.action.category = WLAN_ACTION_WNM;
582         mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP;
583         mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token;
584         mgmt->u.action.u.bss_tm_resp.status_code = status;
585         mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay;
586         pos = mgmt->u.action.u.bss_tm_resp.variable;
587         if (target_bssid) {
588                 os_memcpy(pos, target_bssid, ETH_ALEN);
589                 pos += ETH_ALEN;
590         } else if (status == WNM_BSS_TM_ACCEPT) {
591                 /*
592                  * P802.11-REVmc clarifies that the Target BSSID field is always
593                  * present when status code is zero, so use a fake value here if
594                  * no BSSID is yet known.
595                  */
596                 os_memset(pos, 0, ETH_ALEN);
597                 pos += ETH_ALEN;
598         }
599
600         len = pos - (u8 *) &mgmt->u.action.category;
601
602         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
603                                   wpa_s->own_addr, wpa_s->bssid,
604                                   &mgmt->u.action.category, len, 0);
605         if (res < 0) {
606                 wpa_printf(MSG_DEBUG,
607                            "WNM: Failed to send BSS Transition Management Response");
608         }
609 }
610
611
612 int wnm_scan_process(struct wpa_supplicant *wpa_s, int reply_on_fail)
613 {
614         struct wpa_bss *bss;
615         struct wpa_ssid *ssid = wpa_s->current_ssid;
616         enum bss_trans_mgmt_status_code status = WNM_BSS_TM_REJECT_UNSPECIFIED;
617
618         if (!wpa_s->wnm_neighbor_report_elements)
619                 return 0;
620
621         if (os_reltime_before(&wpa_s->wnm_cand_valid_until,
622                               &wpa_s->scan_trigger_time)) {
623                 wpa_printf(MSG_DEBUG, "WNM: Previously stored BSS transition candidate list is not valid anymore - drop it");
624                 wnm_deallocate_memory(wpa_s);
625                 return 0;
626         }
627
628         if (!wpa_s->current_bss ||
629             os_memcmp(wpa_s->wnm_cand_from_bss, wpa_s->current_bss->bssid,
630                       ETH_ALEN) != 0) {
631                 wpa_printf(MSG_DEBUG, "WNM: Stored BSS transition candidate list not from the current BSS - ignore it");
632                 return 0;
633         }
634
635         /* Compare the Neighbor Report and scan results */
636         bss = compare_scan_neighbor_results(wpa_s);
637         if (!bss) {
638                 wpa_printf(MSG_DEBUG, "WNM: No BSS transition candidate match found");
639                 status = WNM_BSS_TM_REJECT_NO_SUITABLE_CANDIDATES;
640                 goto send_bss_resp_fail;
641         }
642
643         /* Associate to the network */
644         /* Send the BSS Management Response - Accept */
645         if (wpa_s->wnm_reply) {
646                 wpa_s->wnm_reply = 0;
647                 wnm_send_bss_transition_mgmt_resp(wpa_s,
648                                                   wpa_s->wnm_dialog_token,
649                                                   WNM_BSS_TM_ACCEPT,
650                                                   0, bss->bssid);
651         }
652
653         if (bss == wpa_s->current_bss) {
654                 wpa_printf(MSG_DEBUG,
655                            "WNM: Already associated with the preferred candidate");
656                 wnm_deallocate_memory(wpa_s);
657                 return 1;
658         }
659
660         wpa_s->reassociate = 1;
661         wpa_supplicant_connect(wpa_s, bss, ssid);
662         wnm_deallocate_memory(wpa_s);
663         return 1;
664
665 send_bss_resp_fail:
666         if (!reply_on_fail)
667                 return 0;
668
669         /* Send reject response for all the failures */
670
671         if (wpa_s->wnm_reply) {
672                 wpa_s->wnm_reply = 0;
673                 wnm_send_bss_transition_mgmt_resp(wpa_s,
674                                                   wpa_s->wnm_dialog_token,
675                                                   status, 0, NULL);
676         }
677         wnm_deallocate_memory(wpa_s);
678
679         return 0;
680 }
681
682
683 static int cand_pref_compar(const void *a, const void *b)
684 {
685         const struct neighbor_report *aa = a;
686         const struct neighbor_report *bb = b;
687
688         if (!aa->preference_present && !bb->preference_present)
689                 return 0;
690         if (!aa->preference_present)
691                 return 1;
692         if (!bb->preference_present)
693                 return -1;
694         if (bb->preference > aa->preference)
695                 return 1;
696         if (bb->preference < aa->preference)
697                 return -1;
698         return 0;
699 }
700
701
702 static void wnm_sort_cand_list(struct wpa_supplicant *wpa_s)
703 {
704         if (!wpa_s->wnm_neighbor_report_elements)
705                 return;
706         qsort(wpa_s->wnm_neighbor_report_elements,
707               wpa_s->wnm_num_neighbor_report, sizeof(struct neighbor_report),
708               cand_pref_compar);
709 }
710
711
712 static void wnm_dump_cand_list(struct wpa_supplicant *wpa_s)
713 {
714         unsigned int i;
715
716         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Candidate List");
717         if (!wpa_s->wnm_neighbor_report_elements)
718                 return;
719         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
720                 struct neighbor_report *nei;
721
722                 nei = &wpa_s->wnm_neighbor_report_elements[i];
723                 wpa_printf(MSG_DEBUG, "%u: " MACSTR
724                            " info=0x%x op_class=%u chan=%u phy=%u pref=%d freq=%d",
725                            i, MAC2STR(nei->bssid), nei->bssid_info,
726                            nei->regulatory_class,
727                            nei->channel_number, nei->phy_type,
728                            nei->preference_present ? nei->preference : -1,
729                            nei->freq);
730         }
731 }
732
733
734 static int chan_supported(struct wpa_supplicant *wpa_s, int freq)
735 {
736         unsigned int i;
737
738         for (i = 0; i < wpa_s->hw.num_modes; i++) {
739                 struct hostapd_hw_modes *mode = &wpa_s->hw.modes[i];
740                 int j;
741
742                 for (j = 0; j < mode->num_channels; j++) {
743                         struct hostapd_channel_data *chan;
744
745                         chan = &mode->channels[j];
746                         if (chan->freq == freq &&
747                             !(chan->flag & HOSTAPD_CHAN_DISABLED))
748                                 return 1;
749                 }
750         }
751
752         return 0;
753 }
754
755
756 static void wnm_set_scan_freqs(struct wpa_supplicant *wpa_s)
757 {
758         int *freqs;
759         int num_freqs = 0;
760         unsigned int i;
761
762         if (!wpa_s->wnm_neighbor_report_elements)
763                 return;
764
765         if (wpa_s->hw.modes == NULL)
766                 return;
767
768         os_free(wpa_s->next_scan_freqs);
769         wpa_s->next_scan_freqs = NULL;
770
771         freqs = os_calloc(wpa_s->wnm_num_neighbor_report + 1, sizeof(int));
772         if (freqs == NULL)
773                 return;
774
775         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
776                 struct neighbor_report *nei;
777
778                 nei = &wpa_s->wnm_neighbor_report_elements[i];
779                 if (nei->freq <= 0) {
780                         wpa_printf(MSG_DEBUG,
781                                    "WNM: Unknown neighbor operating frequency for "
782                                    MACSTR " - scan all channels",
783                                    MAC2STR(nei->bssid));
784                         os_free(freqs);
785                         return;
786                 }
787                 if (chan_supported(wpa_s, nei->freq))
788                         add_freq(freqs, &num_freqs, nei->freq);
789         }
790
791         if (num_freqs == 0) {
792                 os_free(freqs);
793                 return;
794         }
795
796         wpa_printf(MSG_DEBUG,
797                    "WNM: Scan %d frequencies based on transition candidate list",
798                    num_freqs);
799         wpa_s->next_scan_freqs = freqs;
800 }
801
802
803 static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
804                                              const u8 *pos, const u8 *end,
805                                              int reply)
806 {
807         unsigned int beacon_int;
808         u8 valid_int;
809
810         if (end - pos < 5)
811                 return;
812
813         if (wpa_s->current_bss)
814                 beacon_int = wpa_s->current_bss->beacon_int;
815         else
816                 beacon_int = 100; /* best guess */
817
818         wpa_s->wnm_dialog_token = pos[0];
819         wpa_s->wnm_mode = pos[1];
820         wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2);
821         valid_int = pos[4];
822         wpa_s->wnm_reply = reply;
823
824         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: "
825                    "dialog_token=%u request_mode=0x%x "
826                    "disassoc_timer=%u validity_interval=%u",
827                    wpa_s->wnm_dialog_token, wpa_s->wnm_mode,
828                    wpa_s->wnm_dissoc_timer, valid_int);
829
830         pos += 5;
831
832         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
833                 if (end - pos < 12) {
834                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request");
835                         return;
836                 }
837                 os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12);
838                 pos += 12; /* BSS Termination Duration */
839         }
840
841         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) {
842                 char url[256];
843
844                 if (end - pos < 1 || 1 + pos[0] > end - pos) {
845                         wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition "
846                                    "Management Request (URL)");
847                         return;
848                 }
849                 os_memcpy(url, pos + 1, pos[0]);
850                 url[pos[0]] = '\0';
851                 pos += 1 + pos[0];
852
853                 wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s",
854                         wpa_sm_pmf_enabled(wpa_s->wpa),
855                         wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url);
856         }
857
858         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
859                 wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - "
860                         "Disassociation Timer %u", wpa_s->wnm_dissoc_timer);
861                 if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) {
862                         /* TODO: mark current BSS less preferred for
863                          * selection */
864                         wpa_printf(MSG_DEBUG, "Trying to find another BSS");
865                         wpa_supplicant_req_scan(wpa_s, 0, 0);
866                 }
867         }
868
869         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) {
870                 unsigned int valid_ms;
871
872                 wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
873                 wnm_deallocate_memory(wpa_s);
874                 wpa_s->wnm_neighbor_report_elements = os_calloc(
875                         WNM_MAX_NEIGHBOR_REPORT,
876                         sizeof(struct neighbor_report));
877                 if (wpa_s->wnm_neighbor_report_elements == NULL)
878                         return;
879
880                 while (end - pos >= 2 &&
881                        wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT)
882                 {
883                         u8 tag = *pos++;
884                         u8 len = *pos++;
885
886                         wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u",
887                                    tag);
888                         if (len > end - pos) {
889                                 wpa_printf(MSG_DEBUG, "WNM: Truncated request");
890                                 return;
891                         }
892                         if (tag == WLAN_EID_NEIGHBOR_REPORT) {
893                                 struct neighbor_report *rep;
894                                 rep = &wpa_s->wnm_neighbor_report_elements[
895                                         wpa_s->wnm_num_neighbor_report];
896                                 wnm_parse_neighbor_report(wpa_s, pos, len, rep);
897                         }
898
899                         pos += len;
900                         wpa_s->wnm_num_neighbor_report++;
901                 }
902                 wnm_sort_cand_list(wpa_s);
903                 wnm_dump_cand_list(wpa_s);
904                 valid_ms = valid_int * beacon_int * 128 / 125;
905                 wpa_printf(MSG_DEBUG, "WNM: Candidate list valid for %u ms",
906                            valid_ms);
907                 os_get_reltime(&wpa_s->wnm_cand_valid_until);
908                 wpa_s->wnm_cand_valid_until.sec += valid_ms / 1000;
909                 wpa_s->wnm_cand_valid_until.usec += (valid_ms % 1000) * 1000;
910                 wpa_s->wnm_cand_valid_until.sec +=
911                         wpa_s->wnm_cand_valid_until.usec / 1000000;
912                 wpa_s->wnm_cand_valid_until.usec %= 1000000;
913                 os_memcpy(wpa_s->wnm_cand_from_bss, wpa_s->bssid, ETH_ALEN);
914
915                 if (wpa_s->last_scan_res_used > 0) {
916                         struct os_reltime now;
917
918                         os_get_reltime(&now);
919                         if (!os_reltime_expired(&now, &wpa_s->last_scan, 10)) {
920                                 wpa_printf(MSG_DEBUG,
921                                            "WNM: Try to use recent scan results");
922                                 if (wnm_scan_process(wpa_s, 0) > 0)
923                                         return;
924                                 wpa_printf(MSG_DEBUG,
925                                            "WNM: No match in previous scan results - try a new scan");
926                         }
927                 }
928
929                 wnm_set_scan_freqs(wpa_s);
930                 wpa_supplicant_req_scan(wpa_s, 0, 0);
931         } else if (reply) {
932                 enum bss_trans_mgmt_status_code status;
933                 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT)
934                         status = WNM_BSS_TM_ACCEPT;
935                 else {
936                         wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates");
937                         status = WNM_BSS_TM_REJECT_UNSPECIFIED;
938                 }
939                 wnm_send_bss_transition_mgmt_resp(wpa_s,
940                                                   wpa_s->wnm_dialog_token,
941                                                   status, 0, NULL);
942         }
943 }
944
945
946 int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s,
947                                        u8 query_reason)
948 {
949         u8 buf[1000], *pos;
950         struct ieee80211_mgmt *mgmt;
951         size_t len;
952         int ret;
953
954         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to "
955                    MACSTR " query_reason=%u",
956                    MAC2STR(wpa_s->bssid), query_reason);
957
958         mgmt = (struct ieee80211_mgmt *) buf;
959         os_memset(&buf, 0, sizeof(buf));
960         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
961         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
962         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
963         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
964                                            WLAN_FC_STYPE_ACTION);
965         mgmt->u.action.category = WLAN_ACTION_WNM;
966         mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY;
967         mgmt->u.action.u.bss_tm_query.dialog_token = 1;
968         mgmt->u.action.u.bss_tm_query.query_reason = query_reason;
969         pos = mgmt->u.action.u.bss_tm_query.variable;
970
971         len = pos - (u8 *) &mgmt->u.action.category;
972
973         ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
974                                   wpa_s->own_addr, wpa_s->bssid,
975                                   &mgmt->u.action.category, len, 0);
976
977         return ret;
978 }
979
980
981 static void ieee802_11_rx_wnm_notif_req_wfa(struct wpa_supplicant *wpa_s,
982                                             const u8 *sa, const u8 *data,
983                                             int len)
984 {
985         const u8 *pos, *end, *next;
986         u8 ie, ie_len;
987
988         pos = data;
989         end = data + len;
990
991         while (end - pos > 1) {
992                 ie = *pos++;
993                 ie_len = *pos++;
994                 wpa_printf(MSG_DEBUG, "WNM: WFA subelement %u len %u",
995                            ie, ie_len);
996                 if (ie_len > end - pos) {
997                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for "
998                                    "subelement");
999                         break;
1000                 }
1001                 next = pos + ie_len;
1002                 if (ie_len < 4) {
1003                         pos = next;
1004                         continue;
1005                 }
1006                 wpa_printf(MSG_DEBUG, "WNM: Subelement OUI %06x type %u",
1007                            WPA_GET_BE24(pos), pos[3]);
1008
1009 #ifdef CONFIG_HS20
1010                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 &&
1011                     WPA_GET_BE24(pos) == OUI_WFA &&
1012                     pos[3] == HS20_WNM_SUB_REM_NEEDED) {
1013                         /* Subscription Remediation subelement */
1014                         const u8 *ie_end;
1015                         u8 url_len;
1016                         char *url;
1017                         u8 osu_method;
1018
1019                         wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation "
1020                                    "subelement");
1021                         ie_end = pos + ie_len;
1022                         pos += 4;
1023                         url_len = *pos++;
1024                         if (url_len == 0) {
1025                                 wpa_printf(MSG_DEBUG, "WNM: No Server URL included");
1026                                 url = NULL;
1027                                 osu_method = 1;
1028                         } else {
1029                                 if (url_len + 1 > ie_end - pos) {
1030                                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)",
1031                                                    url_len,
1032                                                    (int) (ie_end - pos));
1033                                         break;
1034                                 }
1035                                 url = os_malloc(url_len + 1);
1036                                 if (url == NULL)
1037                                         break;
1038                                 os_memcpy(url, pos, url_len);
1039                                 url[url_len] = '\0';
1040                                 osu_method = pos[url_len];
1041                         }
1042                         hs20_rx_subscription_remediation(wpa_s, url,
1043                                                          osu_method);
1044                         os_free(url);
1045                         pos = next;
1046                         continue;
1047                 }
1048
1049                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 &&
1050                     WPA_GET_BE24(pos) == OUI_WFA &&
1051                     pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) {
1052                         const u8 *ie_end;
1053                         u8 url_len;
1054                         char *url;
1055                         u8 code;
1056                         u16 reauth_delay;
1057
1058                         ie_end = pos + ie_len;
1059                         pos += 4;
1060                         code = *pos++;
1061                         reauth_delay = WPA_GET_LE16(pos);
1062                         pos += 2;
1063                         url_len = *pos++;
1064                         wpa_printf(MSG_DEBUG, "WNM: HS 2.0 Deauthentication "
1065                                    "Imminent - Reason Code %u   "
1066                                    "Re-Auth Delay %u  URL Length %u",
1067                                    code, reauth_delay, url_len);
1068                         if (url_len > ie_end - pos)
1069                                 break;
1070                         url = os_malloc(url_len + 1);
1071                         if (url == NULL)
1072                                 break;
1073                         os_memcpy(url, pos, url_len);
1074                         url[url_len] = '\0';
1075                         hs20_rx_deauth_imminent_notice(wpa_s, code,
1076                                                        reauth_delay, url);
1077                         os_free(url);
1078                         pos = next;
1079                         continue;
1080                 }
1081 #endif /* CONFIG_HS20 */
1082
1083                 pos = next;
1084         }
1085 }
1086
1087
1088 static void ieee802_11_rx_wnm_notif_req(struct wpa_supplicant *wpa_s,
1089                                         const u8 *sa, const u8 *frm, int len)
1090 {
1091         const u8 *pos, *end;
1092         u8 dialog_token, type;
1093
1094         /* Dialog Token [1] | Type [1] | Subelements */
1095
1096         if (len < 2 || sa == NULL)
1097                 return;
1098         end = frm + len;
1099         pos = frm;
1100         dialog_token = *pos++;
1101         type = *pos++;
1102
1103         wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Received WNM-Notification Request "
1104                 "(dialog_token %u type %u sa " MACSTR ")",
1105                 dialog_token, type, MAC2STR(sa));
1106         wpa_hexdump(MSG_DEBUG, "WNM-Notification Request subelements",
1107                     pos, end - pos);
1108
1109         if (wpa_s->wpa_state != WPA_COMPLETED ||
1110             os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) {
1111                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: WNM-Notification frame not "
1112                         "from our AP - ignore it");
1113                 return;
1114         }
1115
1116         switch (type) {
1117         case 1:
1118                 ieee802_11_rx_wnm_notif_req_wfa(wpa_s, sa, pos, end - pos);
1119                 break;
1120         default:
1121                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Ignore unknown "
1122                         "WNM-Notification type %u", type);
1123                 break;
1124         }
1125 }
1126
1127
1128 void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
1129                               const struct ieee80211_mgmt *mgmt, size_t len)
1130 {
1131         const u8 *pos, *end;
1132         u8 act;
1133
1134         if (len < IEEE80211_HDRLEN + 2)
1135                 return;
1136
1137         pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
1138         act = *pos++;
1139         end = ((const u8 *) mgmt) + len;
1140
1141         wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR,
1142                    act, MAC2STR(mgmt->sa));
1143         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
1144             os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1145                 wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action "
1146                            "frame");
1147                 return;
1148         }
1149
1150         switch (act) {
1151         case WNM_BSS_TRANS_MGMT_REQ:
1152                 ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end,
1153                                                  !(mgmt->da[0] & 0x01));
1154                 break;
1155         case WNM_SLEEP_MODE_RESP:
1156                 ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos);
1157                 break;
1158         case WNM_NOTIFICATION_REQ:
1159                 ieee802_11_rx_wnm_notif_req(wpa_s, mgmt->sa, pos, end - pos);
1160                 break;
1161         default:
1162                 wpa_printf(MSG_ERROR, "WNM: Unknown request");
1163                 break;
1164         }
1165 }