wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548
 549         wpa_s->sched_scan_plans_num = 0;
 550         os_free(wpa_s->sched_scan_plans);
 551         wpa_s->sched_scan_plans = NULL;
 552 }
 553
 554
 555 /**
 556  * wpa_clear_keys - Clear keys configured for the driver
 557  * @wpa_s: Pointer to wpa_supplicant data
 558  * @addr: Previously used BSSID or %NULL if not available
 559  *
 560  * This function clears the encryption keys that has been previously configured
 561  * for the driver.
 562  */
 563 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 564 {
 565         int i, max;
 566
 567 #ifdef CONFIG_IEEE80211W
 568         max = 6;
 569 #else /* CONFIG_IEEE80211W */
 570         max = 4;
 571 #endif /* CONFIG_IEEE80211W */
 572
 573         /* MLME-DELETEKEYS.request */
 574         for (i = 0; i < max; i++) {
 575                 if (wpa_s->keys_cleared & BIT(i))
 576                         continue;
 577                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 578                                 NULL, 0);
 579         }
 580         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 581             !is_zero_ether_addr(addr)) {
 582                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 583                                 0);
 584                 /* MLME-SETPROTECTION.request(None) */
 585                 wpa_drv_mlme_setprotection(
 586                         wpa_s, addr,
 587                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 588                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 589         }
 590         wpa_s->keys_cleared = (u32) -1;
 591 }
 592
 593
 594 /**
 595  * wpa_supplicant_state_txt - Get the connection state name as a text string
 596  * @state: State (wpa_state; WPA_*)
 597  * Returns: The state name as a printable text string
 598  */
 599 const char * wpa_supplicant_state_txt(enum wpa_states state)
 600 {
 601         switch (state) {
 602         case WPA_DISCONNECTED:
 603                 return "DISCONNECTED";
 604         case WPA_INACTIVE:
 605                 return "INACTIVE";
 606         case WPA_INTERFACE_DISABLED:
 607                 return "INTERFACE_DISABLED";
 608         case WPA_SCANNING:
 609                 return "SCANNING";
 610         case WPA_AUTHENTICATING:
 611                 return "AUTHENTICATING";
 612         case WPA_ASSOCIATING:
 613                 return "ASSOCIATING";
 614         case WPA_ASSOCIATED:
 615                 return "ASSOCIATED";
 616         case WPA_4WAY_HANDSHAKE:
 617                 return "4WAY_HANDSHAKE";
 618         case WPA_GROUP_HANDSHAKE:
 619                 return "GROUP_HANDSHAKE";
 620         case WPA_COMPLETED:
 621                 return "COMPLETED";
 622         default:
 623                 return "UNKNOWN";
 624         }
 625 }
 626
 627
 628 #ifdef CONFIG_BGSCAN
 629
 630 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 631 {
 632         const char *name;
 633
 634         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 635                 name = wpa_s->current_ssid->bgscan;
 636         else
 637                 name = wpa_s->conf->bgscan;
 638         if (name == NULL || name[0] == '\0')
 639                 return;
 640         if (wpas_driver_bss_selection(wpa_s))
 641                 return;
 642         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 643                 return;
 644 #ifdef CONFIG_P2P
 645         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 646                 return;
 647 #endif /* CONFIG_P2P */
 648
 649         bgscan_deinit(wpa_s);
 650         if (wpa_s->current_ssid) {
 651                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 652                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 653                                 "bgscan");
 654                         /*
 655                          * Live without bgscan; it is only used as a roaming
 656                          * optimization, so the initial connection is not
 657                          * affected.
 658                          */
 659                 } else {
 660                         struct wpa_scan_results *scan_res;
 661                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 662                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 663                                                                    0);
 664                         if (scan_res) {
 665                                 bgscan_notify_scan(wpa_s, scan_res);
 666                                 wpa_scan_results_free(scan_res);
 667                         }
 668                 }
 669         } else
 670                 wpa_s->bgscan_ssid = NULL;
 671 }
 672
 673
 674 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 675 {
 676         if (wpa_s->bgscan_ssid != NULL) {
 677                 bgscan_deinit(wpa_s);
 678                 wpa_s->bgscan_ssid = NULL;
 679         }
 680 }
 681
 682 #endif /* CONFIG_BGSCAN */
 683
 684
 685 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 686 {
 687         if (autoscan_init(wpa_s, 0))
 688                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 689 }
 690
 691
 692 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 693 {
 694         autoscan_deinit(wpa_s);
 695 }
 696
 697
 698 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 699 {
 700         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 701             wpa_s->wpa_state == WPA_SCANNING) {
 702                 autoscan_deinit(wpa_s);
 703                 wpa_supplicant_start_autoscan(wpa_s);
 704         }
 705 }
 706
 707
 708 /**
 709  * wpa_supplicant_set_state - Set current connection state
 710  * @wpa_s: Pointer to wpa_supplicant data
 711  * @state: The new connection state
 712  *
 713  * This function is called whenever the connection state changes, e.g.,
 714  * association is completed for WPA/WPA2 4-Way Handshake is started.
 715  */
 716 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 717                               enum wpa_states state)
 718 {
 719         enum wpa_states old_state = wpa_s->wpa_state;
 720
 721         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 722                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 723                 wpa_supplicant_state_txt(state));
 724
 725         if (state == WPA_INTERFACE_DISABLED) {
 726                 /* Assure normal scan when interface is restored */
 727                 wpa_s->normal_scans = 0;
 728         }
 729
 730         if (state == WPA_COMPLETED) {
 731                 wpas_connect_work_done(wpa_s);
 732                 /* Reinitialize normal_scan counter */
 733                 wpa_s->normal_scans = 0;
 734         }
 735
 736 #ifdef CONFIG_P2P
 737         /*
 738          * P2PS client has to reply to Probe Request frames received on the
 739          * group operating channel. Enable Probe Request frame reporting for
 740          * P2P connected client in case p2p_cli_probe configuration property is
 741          * set to 1.
 742          */
 743         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 744             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 745             wpa_s->current_ssid->p2p_group) {
 746                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 747                         wpa_dbg(wpa_s, MSG_DEBUG,
 748                                 "P2P: Enable CLI Probe Request RX reporting");
 749                         wpa_s->p2p_cli_probe =
 750                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 751                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 752                         wpa_dbg(wpa_s, MSG_DEBUG,
 753                                 "P2P: Disable CLI Probe Request RX reporting");
 754                         wpa_s->p2p_cli_probe = 0;
 755                         wpa_drv_probe_req_report(wpa_s, 0);
 756                 }
 757         }
 758 #endif /* CONFIG_P2P */
 759
 760         if (state != WPA_SCANNING)
 761                 wpa_supplicant_notify_scanning(wpa_s, 0);
 762
 763         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 764                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 765 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 766                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 767                         MACSTR " completed [id=%d id_str=%s]",
 768                         MAC2STR(wpa_s->bssid),
 769                         ssid ? ssid->id : -1,
 770                         ssid && ssid->id_str ? ssid->id_str : "");
 771 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 772                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 773                 wpa_blacklist_clear(wpa_s);
 774                 wpa_s->extra_blacklist_count = 0;
 775                 wpa_s->new_connection = 0;
 776                 wpa_drv_set_operstate(wpa_s, 1);
 777 #ifndef IEEE8021X_EAPOL
 778                 wpa_drv_set_supp_port(wpa_s, 1);
 779 #endif /* IEEE8021X_EAPOL */
 780                 wpa_s->after_wps = 0;
 781                 wpa_s->known_wps_freq = 0;
 782                 wpas_p2p_completed(wpa_s);
 783
 784                 sme_sched_obss_scan(wpa_s, 1);
 785         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 786                    state == WPA_ASSOCIATED) {
 787                 wpa_s->new_connection = 1;
 788                 wpa_drv_set_operstate(wpa_s, 0);
 789 #ifndef IEEE8021X_EAPOL
 790                 wpa_drv_set_supp_port(wpa_s, 0);
 791 #endif /* IEEE8021X_EAPOL */
 792                 sme_sched_obss_scan(wpa_s, 0);
 793         }
 794         wpa_s->wpa_state = state;
 795
 796 #ifdef CONFIG_BGSCAN
 797         if (state == WPA_COMPLETED)
 798                 wpa_supplicant_start_bgscan(wpa_s);
 799         else if (state < WPA_ASSOCIATED)
 800                 wpa_supplicant_stop_bgscan(wpa_s);
 801 #endif /* CONFIG_BGSCAN */
 802
 803         if (state == WPA_AUTHENTICATING)
 804                 wpa_supplicant_stop_autoscan(wpa_s);
 805
 806         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 807                 wpa_supplicant_start_autoscan(wpa_s);
 808
 809         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 810                 wmm_ac_notify_disassoc(wpa_s);
 811
 812         if (wpa_s->wpa_state != old_state) {
 813                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 814
 815                 /*
 816                  * Notify the P2P Device interface about a state change in one
 817                  * of the interfaces.
 818                  */
 819                 wpas_p2p_indicate_state_change(wpa_s);
 820
 821                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 822                     old_state == WPA_COMPLETED)
 823                         wpas_notify_auth_changed(wpa_s);
 824         }
 825 }
 826
 827
 828 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 829 {
 830         int pending = 0;
 831 #ifdef CONFIG_WPS
 832         struct wpa_supplicant *wpa_s = global->ifaces;
 833         while (wpa_s) {
 834                 struct wpa_supplicant *next = wpa_s->next;
 835                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 836                         pending = 1;
 837 #ifdef CONFIG_P2P
 838                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 839                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 840                         wpas_p2p_disconnect(wpa_s);
 841 #endif /* CONFIG_P2P */
 842                 wpa_s = next;
 843         }
 844 #endif /* CONFIG_WPS */
 845         if (pending)
 846                 return;
 847         eloop_terminate();
 848 }
 849
 850
 851 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 852 {
 853         struct wpa_global *global = signal_ctx;
 854         wpa_supplicant_terminate_proc(global);
 855 }
 856
 857
 858 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 859 {
 860         enum wpa_states old_state = wpa_s->wpa_state;
 861
 862         wpa_s->pairwise_cipher = 0;
 863         wpa_s->group_cipher = 0;
 864         wpa_s->mgmt_group_cipher = 0;
 865         wpa_s->key_mgmt = 0;
 866         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 867                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 868
 869         if (wpa_s->wpa_state != old_state)
 870                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 871 }
 872
 873
 874 /**
 875  * wpa_supplicant_reload_configuration - Reload configuration data
 876  * @wpa_s: Pointer to wpa_supplicant data
 877  * Returns: 0 on success or -1 if configuration parsing failed
 878  *
 879  * This function can be used to request that the configuration data is reloaded
 880  * (e.g., after configuration file change). This function is reloading
 881  * configuration only for one interface, so this may need to be called multiple
 882  * times if %wpa_supplicant is controlling multiple interfaces and all
 883  * interfaces need reconfiguration.
 884  */
 885 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 886 {
 887         struct wpa_config *conf;
 888         int reconf_ctrl;
 889         int old_ap_scan;
 890
 891         if (wpa_s->confname == NULL)
 892                 return -1;
 893         conf = wpa_config_read(wpa_s->confname, NULL);
 894         if (conf == NULL) {
 895                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 896                         "file '%s' - exiting", wpa_s->confname);
 897                 return -1;
 898         }
 899         wpa_config_read(wpa_s->confanother, conf);
 900
 901         conf->changed_parameters = (unsigned int) -1;
 902
 903         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 904                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 905                     os_strcmp(conf->ctrl_interface,
 906                               wpa_s->conf->ctrl_interface) != 0);
 907
 908         if (reconf_ctrl && wpa_s->ctrl_iface) {
 909                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 910                 wpa_s->ctrl_iface = NULL;
 911         }
 912
 913         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 914         if (wpa_s->current_ssid) {
 915                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 916                         wpa_s->own_disconnect_req = 1;
 917                 wpa_supplicant_deauthenticate(wpa_s,
 918                                               WLAN_REASON_DEAUTH_LEAVING);
 919         }
 920
 921         /*
 922          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 923          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 924          */
 925         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 926                 /*
 927                  * Clear forced success to clear EAP state for next
 928                  * authentication.
 929                  */
 930                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 931         }
 932         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 933         wpa_sm_set_config(wpa_s->wpa, NULL);
 934         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 935         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 936         rsn_preauth_deinit(wpa_s->wpa);
 937
 938         old_ap_scan = wpa_s->conf->ap_scan;
 939         wpa_config_free(wpa_s->conf);
 940         wpa_s->conf = conf;
 941         if (old_ap_scan != wpa_s->conf->ap_scan)
 942                 wpas_notify_ap_scan_changed(wpa_s);
 943
 944         if (reconf_ctrl)
 945                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 946
 947         wpa_supplicant_update_config(wpa_s);
 948
 949         wpa_supplicant_clear_status(wpa_s);
 950         if (wpa_supplicant_enabled_networks(wpa_s)) {
 951                 wpa_s->reassociate = 1;
 952                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 953         }
 954         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 955         return 0;
 956 }
 957
 958
 959 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 960 {
 961         struct wpa_global *global = signal_ctx;
 962         struct wpa_supplicant *wpa_s;
 963         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 964                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 965                         sig);
 966                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 967                         wpa_supplicant_terminate_proc(global);
 968                 }
 969         }
 970
 971         if (wpa_debug_reopen_file() < 0) {
 972                 /* Ignore errors since we cannot really do much to fix this */
 973                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 974         }
 975 }
 976
 977
 978 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 979                                          struct wpa_ssid *ssid,
 980                                          struct wpa_ie_data *ie)
 981 {
 982         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 983         if (ret) {
 984                 if (ret == -2) {
 985                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 986                                 "from association info");
 987                 }
 988                 return -1;
 989         }
 990
 991         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 992                 "cipher suites");
 993         if (!(ie->group_cipher & ssid->group_cipher)) {
 994                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 995                         "cipher 0x%x (mask 0x%x) - reject",
 996                         ie->group_cipher, ssid->group_cipher);
 997                 return -1;
 998         }
 999         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1000                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1001                         "cipher 0x%x (mask 0x%x) - reject",
1002                         ie->pairwise_cipher, ssid->pairwise_cipher);
1003                 return -1;
1004         }
1005         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1007                         "management 0x%x (mask 0x%x) - reject",
1008                         ie->key_mgmt, ssid->key_mgmt);
1009                 return -1;
1010         }
1011
1012 #ifdef CONFIG_IEEE80211W
1013         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1014             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1015                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1016                         "that does not support management frame protection - "
1017                         "reject");
1018                 return -1;
1019         }
1020 #endif /* CONFIG_IEEE80211W */
1021
1022         return 0;
1023 }
1024
1025
1026 /**
1027  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1028  * @wpa_s: Pointer to wpa_supplicant data
1029  * @bss: Scan results for the selected BSS, or %NULL if not available
1030  * @ssid: Configuration data for the selected network
1031  * @wpa_ie: Buffer for the WPA/RSN IE
1032  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1033  * used buffer length in case the functions returns success.
1034  * Returns: 0 on success or -1 on failure
1035  *
1036  * This function is used to configure authentication and encryption parameters
1037  * based on the network configuration and scan result for the selected BSS (if
1038  * available).
1039  */
1040 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1041                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1042                               u8 *wpa_ie, size_t *wpa_ie_len)
1043 {
1044         struct wpa_ie_data ie;
1045         int sel, proto;
1046         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1047
1048         if (bss) {
1049                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1050                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1051                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1052         } else
1053                 bss_wpa = bss_rsn = bss_osen = NULL;
1054
1055         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1056             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1057             (ie.group_cipher & ssid->group_cipher) &&
1058             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1059             (ie.key_mgmt & ssid->key_mgmt)) {
1060                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1061                 proto = WPA_PROTO_RSN;
1062         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1063                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1064                    (ie.group_cipher & ssid->group_cipher) &&
1065                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1066                    (ie.key_mgmt & ssid->key_mgmt)) {
1067                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1068                 proto = WPA_PROTO_WPA;
1069 #ifdef CONFIG_HS20
1070         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1071                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1072                 /* TODO: parse OSEN element */
1073                 os_memset(&ie, 0, sizeof(ie));
1074                 ie.group_cipher = WPA_CIPHER_CCMP;
1075                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1076                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1077                 proto = WPA_PROTO_OSEN;
1078 #endif /* CONFIG_HS20 */
1079         } else if (bss) {
1080                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1081                 wpa_dbg(wpa_s, MSG_DEBUG,
1082                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1083                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1084                         ssid->key_mgmt);
1085                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1086                         MAC2STR(bss->bssid),
1087                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1088                         bss_wpa ? " WPA" : "",
1089                         bss_rsn ? " RSN" : "",
1090                         bss_osen ? " OSEN" : "");
1091                 if (bss_rsn) {
1092                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1093                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1094                                 wpa_dbg(wpa_s, MSG_DEBUG,
1095                                         "Could not parse RSN element");
1096                         } else {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1099                                         ie.pairwise_cipher, ie.group_cipher,
1100                                         ie.key_mgmt);
1101                         }
1102                 }
1103                 if (bss_wpa) {
1104                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1105                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1106                                 wpa_dbg(wpa_s, MSG_DEBUG,
1107                                         "Could not parse WPA element");
1108                         } else {
1109                                 wpa_dbg(wpa_s, MSG_DEBUG,
1110                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1111                                         ie.pairwise_cipher, ie.group_cipher,
1112                                         ie.key_mgmt);
1113                         }
1114                 }
1115                 return -1;
1116         } else {
1117                 if (ssid->proto & WPA_PROTO_OSEN)
1118                         proto = WPA_PROTO_OSEN;
1119                 else if (ssid->proto & WPA_PROTO_RSN)
1120                         proto = WPA_PROTO_RSN;
1121                 else
1122                         proto = WPA_PROTO_WPA;
1123                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1124                         os_memset(&ie, 0, sizeof(ie));
1125                         ie.group_cipher = ssid->group_cipher;
1126                         ie.pairwise_cipher = ssid->pairwise_cipher;
1127                         ie.key_mgmt = ssid->key_mgmt;
1128 #ifdef CONFIG_IEEE80211W
1129                         ie.mgmt_group_cipher =
1130                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1131                                 WPA_CIPHER_AES_128_CMAC : 0;
1132 #endif /* CONFIG_IEEE80211W */
1133                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1134                                 "based on configuration");
1135                 } else
1136                         proto = ie.proto;
1137         }
1138
1139         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1140                 "pairwise %d key_mgmt %d proto %d",
1141                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1142 #ifdef CONFIG_IEEE80211W
1143         if (ssid->ieee80211w) {
1144                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1145                         ie.mgmt_group_cipher);
1146         }
1147 #endif /* CONFIG_IEEE80211W */
1148
1149         wpa_s->wpa_proto = proto;
1150         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1151         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1152                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1153
1154         if (bss || !wpa_s->ap_ies_from_associnfo) {
1155                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1156                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1157                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1158                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1159                         return -1;
1160         }
1161
1162 #ifdef CONFIG_NO_WPA
1163         wpa_s->group_cipher = WPA_CIPHER_NONE;
1164         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1165 #else /* CONFIG_NO_WPA */
1166         sel = ie.group_cipher & ssid->group_cipher;
1167         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1168         if (wpa_s->group_cipher < 0) {
1169                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1170                         "cipher");
1171                 return -1;
1172         }
1173         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1174                 wpa_cipher_txt(wpa_s->group_cipher));
1175
1176         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1177         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1178         if (wpa_s->pairwise_cipher < 0) {
1179                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1180                         "cipher");
1181                 return -1;
1182         }
1183         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1184                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1185 #endif /* CONFIG_NO_WPA */
1186
1187         sel = ie.key_mgmt & ssid->key_mgmt;
1188 #ifdef CONFIG_SAE
1189         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1190                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1191 #endif /* CONFIG_SAE */
1192         if (0) {
1193 #ifdef CONFIG_SUITEB192
1194         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1195                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1196                 wpa_dbg(wpa_s, MSG_DEBUG,
1197                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1198 #endif /* CONFIG_SUITEB192 */
1199 #ifdef CONFIG_SUITEB
1200         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1202                 wpa_dbg(wpa_s, MSG_DEBUG,
1203                         "WPA: using KEY_MGMT 802.1X with Suite B");
1204 #endif /* CONFIG_SUITEB */
1205 #ifdef CONFIG_IEEE80211R
1206         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1207                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1208                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1209         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1210                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1211                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1212 #endif /* CONFIG_IEEE80211R */
1213 #ifdef CONFIG_SAE
1214         } else if (sel & WPA_KEY_MGMT_SAE) {
1215                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1217         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1220 #endif /* CONFIG_SAE */
1221 #ifdef CONFIG_IEEE80211W
1222         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1223                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG,
1225                         "WPA: using KEY_MGMT 802.1X with SHA256");
1226         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1227                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1228                 wpa_dbg(wpa_s, MSG_DEBUG,
1229                         "WPA: using KEY_MGMT PSK with SHA256");
1230 #endif /* CONFIG_IEEE80211W */
1231         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1232                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1233                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1234         } else if (sel & WPA_KEY_MGMT_PSK) {
1235                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1236                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1237         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1240 #ifdef CONFIG_HS20
1241         } else if (sel & WPA_KEY_MGMT_OSEN) {
1242                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1243                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1244 #endif /* CONFIG_HS20 */
1245         } else {
1246                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1247                         "authenticated key management type");
1248                 return -1;
1249         }
1250
1251         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1252         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1253                          wpa_s->pairwise_cipher);
1254         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1255
1256 #ifdef CONFIG_IEEE80211W
1257         sel = ie.mgmt_group_cipher;
1258         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1259             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1260                 sel = 0;
1261         if (sel & WPA_CIPHER_AES_128_CMAC) {
1262                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264                         "AES-128-CMAC");
1265         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1266                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268                         "BIP-GMAC-128");
1269         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1270                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1271                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272                         "BIP-GMAC-256");
1273         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1274                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1275                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1276                         "BIP-CMAC-256");
1277         } else {
1278                 wpa_s->mgmt_group_cipher = 0;
1279                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1280         }
1281         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1282                          wpa_s->mgmt_group_cipher);
1283         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1284                          wpas_get_ssid_pmf(wpa_s, ssid));
1285 #endif /* CONFIG_IEEE80211W */
1286
1287         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1288                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1289                 return -1;
1290         }
1291
1292         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1293                 int psk_set = 0;
1294
1295                 if (ssid->psk_set) {
1296                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1297                         psk_set = 1;
1298                 }
1299 #ifndef CONFIG_NO_PBKDF2
1300                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1301                     ssid->passphrase) {
1302                         u8 psk[PMK_LEN];
1303                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1304                                     4096, psk, PMK_LEN);
1305                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1306                                         psk, PMK_LEN);
1307                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1308                         psk_set = 1;
1309                         os_memset(psk, 0, sizeof(psk));
1310                 }
1311 #endif /* CONFIG_NO_PBKDF2 */
1312 #ifdef CONFIG_EXT_PASSWORD
1313                 if (ssid->ext_psk) {
1314                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1315                                                              ssid->ext_psk);
1316                         char pw_str[64 + 1];
1317                         u8 psk[PMK_LEN];
1318
1319                         if (pw == NULL) {
1320                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1321                                         "found from external storage");
1322                                 return -1;
1323                         }
1324
1325                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1326                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1327                                         "PSK length %d in external storage",
1328                                         (int) wpabuf_len(pw));
1329                                 ext_password_free(pw);
1330                                 return -1;
1331                         }
1332
1333                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1334                         pw_str[wpabuf_len(pw)] = '\0';
1335
1336 #ifndef CONFIG_NO_PBKDF2
1337                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1338                         {
1339                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1340                                             4096, psk, PMK_LEN);
1341                                 os_memset(pw_str, 0, sizeof(pw_str));
1342                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1343                                                 "external passphrase)",
1344                                                 psk, PMK_LEN);
1345                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1346                                 psk_set = 1;
1347                                 os_memset(psk, 0, sizeof(psk));
1348                         } else
1349 #endif /* CONFIG_NO_PBKDF2 */
1350                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1351                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1352                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1353                                                 "Invalid PSK hex string");
1354                                         os_memset(pw_str, 0, sizeof(pw_str));
1355                                         ext_password_free(pw);
1356                                         return -1;
1357                                 }
1358                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1359                                 psk_set = 1;
1360                                 os_memset(psk, 0, sizeof(psk));
1361                         } else {
1362                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1363                                         "PSK available");
1364                                 os_memset(pw_str, 0, sizeof(pw_str));
1365                                 ext_password_free(pw);
1366                                 return -1;
1367                         }
1368
1369                         os_memset(pw_str, 0, sizeof(pw_str));
1370                         ext_password_free(pw);
1371                 }
1372 #endif /* CONFIG_EXT_PASSWORD */
1373
1374                 if (!psk_set) {
1375                         wpa_msg(wpa_s, MSG_INFO,
1376                                 "No PSK available for association");
1377                         return -1;
1378                 }
1379         } else
1380                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1381
1382         return 0;
1383 }
1384
1385
1386 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1387 {
1388         *pos = 0x00;
1389
1390         switch (idx) {
1391         case 0: /* Bits 0-7 */
1392                 break;
1393         case 1: /* Bits 8-15 */
1394                 break;
1395         case 2: /* Bits 16-23 */
1396 #ifdef CONFIG_WNM
1397                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1398                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1399 #endif /* CONFIG_WNM */
1400                 break;
1401         case 3: /* Bits 24-31 */
1402 #ifdef CONFIG_WNM
1403                 *pos |= 0x02; /* Bit 25 - SSID List */
1404 #endif /* CONFIG_WNM */
1405 #ifdef CONFIG_INTERWORKING
1406                 if (wpa_s->conf->interworking)
1407                         *pos |= 0x80; /* Bit 31 - Interworking */
1408 #endif /* CONFIG_INTERWORKING */
1409                 break;
1410         case 4: /* Bits 32-39 */
1411 #ifdef CONFIG_INTERWORKING
1412                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1413                         *pos |= 0x01; /* Bit 32 - QoS Map */
1414 #endif /* CONFIG_INTERWORKING */
1415                 break;
1416         case 5: /* Bits 40-47 */
1417 #ifdef CONFIG_HS20
1418                 if (wpa_s->conf->hs20)
1419                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1420 #endif /* CONFIG_HS20 */
1421                 break;
1422         case 6: /* Bits 48-55 */
1423                 break;
1424         }
1425 }
1426
1427
1428 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1429 {
1430         u8 *pos = buf;
1431         u8 len = 6, i;
1432
1433         if (len < wpa_s->extended_capa_len)
1434                 len = wpa_s->extended_capa_len;
1435         if (buflen < (size_t) len + 2) {
1436                 wpa_printf(MSG_INFO,
1437                            "Not enough room for building extended capabilities element");
1438                 return -1;
1439         }
1440
1441         *pos++ = WLAN_EID_EXT_CAPAB;
1442         *pos++ = len;
1443         for (i = 0; i < len; i++, pos++) {
1444                 wpas_ext_capab_byte(wpa_s, pos, i);
1445
1446                 if (i < wpa_s->extended_capa_len) {
1447                         *pos &= ~wpa_s->extended_capa_mask[i];
1448                         *pos |= wpa_s->extended_capa[i];
1449                 }
1450         }
1451
1452         while (len > 0 && buf[1 + len] == 0) {
1453                 len--;
1454                 buf[1] = len;
1455         }
1456         if (len == 0)
1457                 return 0;
1458
1459         return 2 + len;
1460 }
1461
1462
1463 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1464                           struct wpa_bss *test_bss)
1465 {
1466         struct wpa_bss *bss;
1467
1468         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1469                 if (bss == test_bss)
1470                         return 1;
1471         }
1472
1473         return 0;
1474 }
1475
1476
1477 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1478                            struct wpa_ssid *test_ssid)
1479 {
1480         struct wpa_ssid *ssid;
1481
1482         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1483                 if (ssid == test_ssid)
1484                         return 1;
1485         }
1486
1487         return 0;
1488 }
1489
1490
1491 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1492                         struct wpa_ssid *test_ssid)
1493 {
1494         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1495                 return 0;
1496
1497         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1498 }
1499
1500
1501 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1502 {
1503         if (cwork == NULL)
1504                 return;
1505         os_free(cwork);
1506 }
1507
1508
1509 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1510 {
1511         struct wpa_connect_work *cwork;
1512         struct wpa_radio_work *work = wpa_s->connect_work;
1513
1514         if (!work)
1515                 return;
1516
1517         wpa_s->connect_work = NULL;
1518         cwork = work->ctx;
1519         work->ctx = NULL;
1520         wpas_connect_work_free(cwork);
1521         radio_work_done(work);
1522 }
1523
1524
1525 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1526 {
1527         struct os_reltime now;
1528         u8 addr[ETH_ALEN];
1529
1530         os_get_reltime(&now);
1531         if (wpa_s->last_mac_addr_style == style &&
1532             wpa_s->last_mac_addr_change.sec != 0 &&
1533             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1534                                 wpa_s->conf->rand_addr_lifetime)) {
1535                 wpa_msg(wpa_s, MSG_DEBUG,
1536                         "Previously selected random MAC address has not yet expired");
1537                 return 0;
1538         }
1539
1540         switch (style) {
1541         case 1:
1542                 if (random_mac_addr(addr) < 0)
1543                         return -1;
1544                 break;
1545         case 2:
1546                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1547                 if (random_mac_addr_keep_oui(addr) < 0)
1548                         return -1;
1549                 break;
1550         default:
1551                 return -1;
1552         }
1553
1554         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1555                 wpa_msg(wpa_s, MSG_INFO,
1556                         "Failed to set random MAC address");
1557                 return -1;
1558         }
1559
1560         os_get_reltime(&wpa_s->last_mac_addr_change);
1561         wpa_s->mac_addr_changed = 1;
1562         wpa_s->last_mac_addr_style = style;
1563
1564         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1565                 wpa_msg(wpa_s, MSG_INFO,
1566                         "Could not update MAC address information");
1567                 return -1;
1568         }
1569
1570         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1571                 MAC2STR(addr));
1572
1573         return 0;
1574 }
1575
1576
1577 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1578 {
1579         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1580             !wpa_s->conf->preassoc_mac_addr)
1581                 return 0;
1582
1583         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1584 }
1585
1586
1587 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1588
1589 /**
1590  * wpa_supplicant_associate - Request association
1591  * @wpa_s: Pointer to wpa_supplicant data
1592  * @bss: Scan results for the selected BSS, or %NULL if not available
1593  * @ssid: Configuration data for the selected network
1594  *
1595  * This function is used to request %wpa_supplicant to associate with a BSS.
1596  */
1597 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1598                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1599 {
1600         struct wpa_connect_work *cwork;
1601         int rand_style;
1602
1603         wpa_s->own_disconnect_req = 0;
1604
1605         /*
1606          * If we are starting a new connection, any previously pending EAPOL
1607          * RX cannot be valid anymore.
1608          */
1609         wpabuf_free(wpa_s->pending_eapol_rx);
1610         wpa_s->pending_eapol_rx = NULL;
1611
1612         if (ssid->mac_addr == -1)
1613                 rand_style = wpa_s->conf->mac_addr;
1614         else
1615                 rand_style = ssid->mac_addr;
1616
1617         wmm_ac_clear_saved_tspecs(wpa_s);
1618         wpa_s->reassoc_same_bss = 0;
1619
1620         if (wpa_s->last_ssid == ssid) {
1621                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1622                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1623                         wmm_ac_save_tspecs(wpa_s);
1624                         wpa_s->reassoc_same_bss = 1;
1625                 }
1626         } else if (rand_style > 0) {
1627                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1628                         return;
1629                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1630         } else if (wpa_s->mac_addr_changed) {
1631                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1632                         wpa_msg(wpa_s, MSG_INFO,
1633                                 "Could not restore permanent MAC address");
1634                         return;
1635                 }
1636                 wpa_s->mac_addr_changed = 0;
1637                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1638                         wpa_msg(wpa_s, MSG_INFO,
1639                                 "Could not update MAC address information");
1640                         return;
1641                 }
1642                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1643         }
1644         wpa_s->last_ssid = ssid;
1645
1646 #ifdef CONFIG_IBSS_RSN
1647         ibss_rsn_deinit(wpa_s->ibss_rsn);
1648         wpa_s->ibss_rsn = NULL;
1649 #endif /* CONFIG_IBSS_RSN */
1650
1651         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1652             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1653 #ifdef CONFIG_AP
1654                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1655                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1656                                 "mode");
1657                         return;
1658                 }
1659                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1660                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1661                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1662                                 wpas_p2p_ap_setup_failed(wpa_s);
1663                         return;
1664                 }
1665                 wpa_s->current_bss = bss;
1666 #else /* CONFIG_AP */
1667                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1668                         "the build");
1669 #endif /* CONFIG_AP */
1670                 return;
1671         }
1672
1673         if (ssid->mode == WPAS_MODE_MESH) {
1674 #ifdef CONFIG_MESH
1675                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1676                         wpa_msg(wpa_s, MSG_INFO,
1677                                 "Driver does not support mesh mode");
1678                         return;
1679                 }
1680                 if (bss)
1681                         ssid->frequency = bss->freq;
1682                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1683                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1684                         return;
1685                 }
1686                 wpa_s->current_bss = bss;
1687                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1688                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1689                         ssid->id);
1690 #else /* CONFIG_MESH */
1691                 wpa_msg(wpa_s, MSG_ERROR,
1692                         "mesh mode support not included in the build");
1693 #endif /* CONFIG_MESH */
1694                 return;
1695         }
1696
1697 #ifdef CONFIG_TDLS
1698         if (bss)
1699                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1700                                 bss->ie_len);
1701 #endif /* CONFIG_TDLS */
1702
1703         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1704             ssid->mode == IEEE80211_MODE_INFRA) {
1705                 sme_authenticate(wpa_s, bss, ssid);
1706                 return;
1707         }
1708
1709         if (wpa_s->connect_work) {
1710                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1711                 return;
1712         }
1713
1714         if (radio_work_pending(wpa_s, "connect")) {
1715                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1716                 return;
1717         }
1718
1719         wpas_abort_ongoing_scan(wpa_s);
1720
1721         cwork = os_zalloc(sizeof(*cwork));
1722         if (cwork == NULL)
1723                 return;
1724
1725         cwork->bss = bss;
1726         cwork->ssid = ssid;
1727
1728         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1729                            wpas_start_assoc_cb, cwork) < 0) {
1730                 os_free(cwork);
1731         }
1732 }
1733
1734
1735 static int bss_is_ibss(struct wpa_bss *bss)
1736 {
1737         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1738                 IEEE80211_CAP_IBSS;
1739 }
1740
1741
1742 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1743                             const struct wpa_ssid *ssid)
1744 {
1745         enum hostapd_hw_mode hw_mode;
1746         struct hostapd_hw_modes *mode = NULL;
1747         u8 channel;
1748         int i;
1749
1750 #ifdef CONFIG_HT_OVERRIDES
1751         if (ssid->disable_ht)
1752                 return 0;
1753 #endif /* CONFIG_HT_OVERRIDES */
1754
1755         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1756         if (hw_mode == NUM_HOSTAPD_MODES)
1757                 return 0;
1758         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1759                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1760                         mode = &wpa_s->hw.modes[i];
1761                         break;
1762                 }
1763         }
1764
1765         if (!mode)
1766                 return 0;
1767
1768         return mode->vht_capab != 0;
1769 }
1770
1771
1772 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1773                           const struct wpa_ssid *ssid,
1774                           struct hostapd_freq_params *freq)
1775 {
1776         enum hostapd_hw_mode hw_mode;
1777         struct hostapd_hw_modes *mode = NULL;
1778         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1779                            184, 192 };
1780         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1781         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1782         u8 channel;
1783         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1784         unsigned int j, k;
1785         struct hostapd_freq_params vht_freq;
1786         int chwidth, seg0, seg1;
1787         u32 vht_caps = 0;
1788
1789         freq->freq = ssid->frequency;
1790
1791         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1792                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1793
1794                 if (ssid->mode != WPAS_MODE_IBSS)
1795                         break;
1796
1797                 /* Don't adjust control freq in case of fixed_freq */
1798                 if (ssid->fixed_freq)
1799                         break;
1800
1801                 if (!bss_is_ibss(bss))
1802                         continue;
1803
1804                 if (ssid->ssid_len == bss->ssid_len &&
1805                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1806                         wpa_printf(MSG_DEBUG,
1807                                    "IBSS already found in scan results, adjust control freq: %d",
1808                                    bss->freq);
1809                         freq->freq = bss->freq;
1810                         obss_scan = 0;
1811                         break;
1812                 }
1813         }
1814
1815         /* For IBSS check HT_IBSS flag */
1816         if (ssid->mode == WPAS_MODE_IBSS &&
1817             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1818                 return;
1819
1820         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1821             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1822             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1823                 wpa_printf(MSG_DEBUG,
1824                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1825                 return;
1826         }
1827
1828         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1829         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1830                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1831                         mode = &wpa_s->hw.modes[i];
1832                         break;
1833                 }
1834         }
1835
1836         if (!mode)
1837                 return;
1838
1839         freq->ht_enabled = ht_supported(mode);
1840         if (!freq->ht_enabled)
1841                 return;
1842
1843         /* Setup higher BW only for 5 GHz */
1844         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1845                 return;
1846
1847         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1848                 pri_chan = &mode->channels[chan_idx];
1849                 if (pri_chan->chan == channel)
1850                         break;
1851                 pri_chan = NULL;
1852         }
1853         if (!pri_chan)
1854                 return;
1855
1856         /* Check primary channel flags */
1857         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1858                 return;
1859
1860         /* Check/setup HT40+/HT40- */
1861         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1862                 if (ht40plus[j] == channel) {
1863                         ht40 = 1;
1864                         break;
1865                 }
1866         }
1867
1868         /* Find secondary channel */
1869         for (i = 0; i < mode->num_channels; i++) {
1870                 sec_chan = &mode->channels[i];
1871                 if (sec_chan->chan == channel + ht40 * 4)
1872                         break;
1873                 sec_chan = NULL;
1874         }
1875         if (!sec_chan)
1876                 return;
1877
1878         /* Check secondary channel flags */
1879         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1880                 return;
1881
1882         freq->channel = pri_chan->chan;
1883
1884         switch (ht40) {
1885         case -1:
1886                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1887                         return;
1888                 freq->sec_channel_offset = -1;
1889                 break;
1890         case 1:
1891                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1892                         return;
1893                 freq->sec_channel_offset = 1;
1894                 break;
1895         default:
1896                 break;
1897         }
1898
1899         if (freq->sec_channel_offset && obss_scan) {
1900                 struct wpa_scan_results *scan_res;
1901
1902                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1903                 if (scan_res == NULL) {
1904                         /* Back to HT20 */
1905                         freq->sec_channel_offset = 0;
1906                         return;
1907                 }
1908
1909                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1910                                      sec_chan->chan);
1911                 switch (res) {
1912                 case 0:
1913                         /* Back to HT20 */
1914                         freq->sec_channel_offset = 0;
1915                         break;
1916                 case 1:
1917                         /* Configuration allowed */
1918                         break;
1919                 case 2:
1920                         /* Switch pri/sec channels */
1921                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1922                         freq->sec_channel_offset = -freq->sec_channel_offset;
1923                         freq->channel = sec_chan->chan;
1924                         break;
1925                 default:
1926                         freq->sec_channel_offset = 0;
1927                         break;
1928                 }
1929
1930                 wpa_scan_results_free(scan_res);
1931         }
1932
1933         wpa_printf(MSG_DEBUG,
1934                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1935                    freq->channel, freq->sec_channel_offset);
1936
1937         if (!drv_supports_vht(wpa_s, ssid))
1938                 return;
1939
1940         /* For IBSS check VHT_IBSS flag */
1941         if (ssid->mode == WPAS_MODE_IBSS &&
1942             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1943                 return;
1944
1945         vht_freq = *freq;
1946
1947         vht_freq.vht_enabled = vht_supported(mode);
1948         if (!vht_freq.vht_enabled)
1949                 return;
1950
1951         /* setup center_freq1, bandwidth */
1952         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1953                 if (freq->channel >= vht80[j] &&
1954                     freq->channel < vht80[j] + 16)
1955                         break;
1956         }
1957
1958         if (j == ARRAY_SIZE(vht80))
1959                 return;
1960
1961         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1962                 struct hostapd_channel_data *chan;
1963
1964                 chan = hw_get_channel_chan(mode, i, NULL);
1965                 if (!chan)
1966                         return;
1967
1968                 /* Back to HT configuration if channel not usable */
1969                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1970                         return;
1971         }
1972
1973         chwidth = VHT_CHANWIDTH_80MHZ;
1974         seg0 = vht80[j] + 6;
1975         seg1 = 0;
1976
1977         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
1978                 /* setup center_freq2, bandwidth */
1979                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
1980                         /* Only accept 80 MHz segments separated by a gap */
1981                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
1982                                 continue;
1983                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
1984                                 struct hostapd_channel_data *chan;
1985
1986                                 chan = hw_get_channel_chan(mode, i, NULL);
1987                                 if (!chan)
1988                                         continue;
1989
1990                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
1991                                                   HOSTAPD_CHAN_NO_IR |
1992                                                   HOSTAPD_CHAN_RADAR))
1993                                         continue;
1994
1995                                 /* Found a suitable second segment for 80+80 */
1996                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
1997                                 vht_caps |=
1998                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1999                                 seg1 = vht80[k] + 6;
2000                         }
2001
2002                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2003                                 break;
2004                 }
2005         }
2006
2007         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2008                                     freq->channel, freq->ht_enabled,
2009                                     vht_freq.vht_enabled,
2010                                     freq->sec_channel_offset,
2011                                     chwidth, seg0, seg1, vht_caps) != 0)
2012                 return;
2013
2014         *freq = vht_freq;
2015
2016         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2017                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2018 }
2019
2020
2021 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2022 {
2023         struct wpa_connect_work *cwork = work->ctx;
2024         struct wpa_bss *bss = cwork->bss;
2025         struct wpa_ssid *ssid = cwork->ssid;
2026         struct wpa_supplicant *wpa_s = work->wpa_s;
2027         u8 wpa_ie[200];
2028         size_t wpa_ie_len;
2029         int use_crypt, ret, i, bssid_changed;
2030         int algs = WPA_AUTH_ALG_OPEN;
2031         unsigned int cipher_pairwise, cipher_group;
2032         struct wpa_driver_associate_params params;
2033         int wep_keys_set = 0;
2034         int assoc_failed = 0;
2035         struct wpa_ssid *old_ssid;
2036 #ifdef CONFIG_HT_OVERRIDES
2037         struct ieee80211_ht_capabilities htcaps;
2038         struct ieee80211_ht_capabilities htcaps_mask;
2039 #endif /* CONFIG_HT_OVERRIDES */
2040 #ifdef CONFIG_VHT_OVERRIDES
2041        struct ieee80211_vht_capabilities vhtcaps;
2042        struct ieee80211_vht_capabilities vhtcaps_mask;
2043 #endif /* CONFIG_VHT_OVERRIDES */
2044
2045         if (deinit) {
2046                 if (work->started) {
2047                         wpa_s->connect_work = NULL;
2048
2049                         /* cancel possible auth. timeout */
2050                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2051                                              NULL);
2052                 }
2053                 wpas_connect_work_free(cwork);
2054                 return;
2055         }
2056
2057         wpa_s->connect_work = work;
2058
2059         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2060             wpas_network_disabled(wpa_s, ssid)) {
2061                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2062                 wpas_connect_work_done(wpa_s);
2063                 return;
2064         }
2065
2066         os_memset(&params, 0, sizeof(params));
2067         wpa_s->reassociate = 0;
2068         wpa_s->eap_expected_failure = 0;
2069         if (bss &&
2070             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2071 #ifdef CONFIG_IEEE80211R
2072                 const u8 *ie, *md = NULL;
2073 #endif /* CONFIG_IEEE80211R */
2074                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2075                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2076                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2077                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2078                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2079                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2080                 if (bssid_changed)
2081                         wpas_notify_bssid_changed(wpa_s);
2082 #ifdef CONFIG_IEEE80211R
2083                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2084                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2085                         md = ie + 2;
2086                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2087                 if (md) {
2088                         /* Prepare for the next transition */
2089                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2090                 }
2091 #endif /* CONFIG_IEEE80211R */
2092 #ifdef CONFIG_WPS
2093         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2094                    wpa_s->conf->ap_scan == 2 &&
2095                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2096                 /* Use ap_scan==1 style network selection to find the network
2097                  */
2098                 wpas_connect_work_done(wpa_s);
2099                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2100                 wpa_s->reassociate = 1;
2101                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2102                 return;
2103 #endif /* CONFIG_WPS */
2104         } else {
2105                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2106                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2107                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2108         }
2109         if (!wpa_s->pno)
2110                 wpa_supplicant_cancel_sched_scan(wpa_s);
2111
2112         wpa_supplicant_cancel_scan(wpa_s);
2113
2114         /* Starting new association, so clear the possibly used WPA IE from the
2115          * previous association. */
2116         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2117
2118 #ifdef IEEE8021X_EAPOL
2119         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2120                 if (ssid->leap) {
2121                         if (ssid->non_leap == 0)
2122                                 algs = WPA_AUTH_ALG_LEAP;
2123                         else
2124                                 algs |= WPA_AUTH_ALG_LEAP;
2125                 }
2126         }
2127 #endif /* IEEE8021X_EAPOL */
2128         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2129         if (ssid->auth_alg) {
2130                 algs = ssid->auth_alg;
2131                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2132                         "0x%x", algs);
2133         }
2134
2135         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2136                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2137             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2138                 int try_opportunistic;
2139                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2140                                      wpa_s->conf->okc :
2141                                      ssid->proactive_key_caching) &&
2142                         (ssid->proto & WPA_PROTO_RSN);
2143                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2144                                             ssid, try_opportunistic) == 0)
2145                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2146                 wpa_ie_len = sizeof(wpa_ie);
2147                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2148                                               wpa_ie, &wpa_ie_len)) {
2149                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2150                                 "key management and encryption suites");
2151                         wpas_connect_work_done(wpa_s);
2152                         return;
2153                 }
2154         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2155                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2156                 /*
2157                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2158                  * use non-WPA since the scan results did not indicate that the
2159                  * AP is using WPA or WPA2.
2160                  */
2161                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2162                 wpa_ie_len = 0;
2163                 wpa_s->wpa_proto = 0;
2164         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2165                 wpa_ie_len = sizeof(wpa_ie);
2166                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2167                                               wpa_ie, &wpa_ie_len)) {
2168                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2169                                 "key management and encryption suites (no "
2170                                 "scan results)");
2171                         wpas_connect_work_done(wpa_s);
2172                         return;
2173                 }
2174 #ifdef CONFIG_WPS
2175         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2176                 struct wpabuf *wps_ie;
2177                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2178                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2179                         wpa_ie_len = wpabuf_len(wps_ie);
2180                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2181                 } else
2182                         wpa_ie_len = 0;
2183                 wpabuf_free(wps_ie);
2184                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2185                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2186                         params.wps = WPS_MODE_PRIVACY;
2187                 else
2188                         params.wps = WPS_MODE_OPEN;
2189                 wpa_s->wpa_proto = 0;
2190 #endif /* CONFIG_WPS */
2191         } else {
2192                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2193                 wpa_ie_len = 0;
2194                 wpa_s->wpa_proto = 0;
2195         }
2196
2197 #ifdef CONFIG_P2P
2198         if (wpa_s->global->p2p) {
2199                 u8 *pos;
2200                 size_t len;
2201                 int res;
2202                 pos = wpa_ie + wpa_ie_len;
2203                 len = sizeof(wpa_ie) - wpa_ie_len;
2204                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2205                                             ssid->p2p_group);
2206                 if (res >= 0)
2207                         wpa_ie_len += res;
2208         }
2209
2210         wpa_s->cross_connect_disallowed = 0;
2211         if (bss) {
2212                 struct wpabuf *p2p;
2213                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2214                 if (p2p) {
2215                         wpa_s->cross_connect_disallowed =
2216                                 p2p_get_cross_connect_disallowed(p2p);
2217                         wpabuf_free(p2p);
2218                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2219                                 "connection",
2220                                 wpa_s->cross_connect_disallowed ?
2221                                 "disallows" : "allows");
2222                 }
2223         }
2224
2225         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2226 #endif /* CONFIG_P2P */
2227
2228 #ifdef CONFIG_HS20
2229         if (is_hs20_network(wpa_s, ssid, bss)) {
2230                 struct wpabuf *hs20;
2231                 hs20 = wpabuf_alloc(20);
2232                 if (hs20) {
2233                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2234                         size_t len;
2235
2236                         wpas_hs20_add_indication(hs20, pps_mo_id);
2237                         len = sizeof(wpa_ie) - wpa_ie_len;
2238                         if (wpabuf_len(hs20) <= len) {
2239                                 os_memcpy(wpa_ie + wpa_ie_len,
2240                                           wpabuf_head(hs20), wpabuf_len(hs20));
2241                                 wpa_ie_len += wpabuf_len(hs20);
2242                         }
2243                         wpabuf_free(hs20);
2244                 }
2245         }
2246 #endif /* CONFIG_HS20 */
2247
2248         /*
2249          * Workaround: Add Extended Capabilities element only if the AP
2250          * included this element in Beacon/Probe Response frames. Some older
2251          * APs seem to have interoperability issues if this element is
2252          * included, so while the standard may require us to include the
2253          * element in all cases, it is justifiable to skip it to avoid
2254          * interoperability issues.
2255          */
2256         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2257                 u8 ext_capab[18];
2258                 int ext_capab_len;
2259                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2260                                                      sizeof(ext_capab));
2261                 if (ext_capab_len > 0) {
2262                         u8 *pos = wpa_ie;
2263                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2264                                 pos += 2 + pos[1];
2265                         os_memmove(pos + ext_capab_len, pos,
2266                                    wpa_ie_len - (pos - wpa_ie));
2267                         wpa_ie_len += ext_capab_len;
2268                         os_memcpy(pos, ext_capab, ext_capab_len);
2269                 }
2270         }
2271
2272         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2273                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2274                 size_t len;
2275
2276                 len = sizeof(wpa_ie) - wpa_ie_len;
2277                 if (wpabuf_len(buf) <= len) {
2278                         os_memcpy(wpa_ie + wpa_ie_len,
2279                                   wpabuf_head(buf), wpabuf_len(buf));
2280                         wpa_ie_len += wpabuf_len(buf);
2281                 }
2282         }
2283
2284 #ifdef CONFIG_FST
2285         if (wpa_s->fst_ies) {
2286                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2287
2288                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2289                         os_memcpy(wpa_ie + wpa_ie_len,
2290                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2291                         wpa_ie_len += fst_ies_len;
2292                 }
2293         }
2294 #endif /* CONFIG_FST */
2295
2296         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2297         use_crypt = 1;
2298         cipher_pairwise = wpa_s->pairwise_cipher;
2299         cipher_group = wpa_s->group_cipher;
2300         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2301             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2302                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2303                         use_crypt = 0;
2304                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2305                         use_crypt = 1;
2306                         wep_keys_set = 1;
2307                 }
2308         }
2309         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2310                 use_crypt = 0;
2311
2312 #ifdef IEEE8021X_EAPOL
2313         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2314                 if ((ssid->eapol_flags &
2315                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2316                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2317                     !wep_keys_set) {
2318                         use_crypt = 0;
2319                 } else {
2320                         /* Assume that dynamic WEP-104 keys will be used and
2321                          * set cipher suites in order for drivers to expect
2322                          * encryption. */
2323                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2324                 }
2325         }
2326 #endif /* IEEE8021X_EAPOL */
2327
2328         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2329                 /* Set the key before (and later after) association */
2330                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2331         }
2332
2333         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2334         if (bss) {
2335                 params.ssid = bss->ssid;
2336                 params.ssid_len = bss->ssid_len;
2337                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2338                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2339                                    MACSTR " freq=%u MHz based on scan results "
2340                                    "(bssid_set=%d)",
2341                                    MAC2STR(bss->bssid), bss->freq,
2342                                    ssid->bssid_set);
2343                         params.bssid = bss->bssid;
2344                         params.freq.freq = bss->freq;
2345                 }
2346                 params.bssid_hint = bss->bssid;
2347                 params.freq_hint = bss->freq;
2348         } else {
2349                 params.ssid = ssid->ssid;
2350                 params.ssid_len = ssid->ssid_len;
2351         }
2352
2353         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2354             wpa_s->conf->ap_scan == 2) {
2355                 params.bssid = ssid->bssid;
2356                 params.fixed_bssid = 1;
2357         }
2358
2359         /* Initial frequency for IBSS/mesh */
2360         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2361             ssid->frequency > 0 && params.freq.freq == 0)
2362                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2363
2364         if (ssid->mode == WPAS_MODE_IBSS) {
2365                 params.fixed_freq = ssid->fixed_freq;
2366                 if (ssid->beacon_int)
2367                         params.beacon_int = ssid->beacon_int;
2368                 else
2369                         params.beacon_int = wpa_s->conf->beacon_int;
2370         }
2371
2372         params.wpa_ie = wpa_ie;
2373         params.wpa_ie_len = wpa_ie_len;
2374         params.pairwise_suite = cipher_pairwise;
2375         params.group_suite = cipher_group;
2376         params.key_mgmt_suite = wpa_s->key_mgmt;
2377         params.wpa_proto = wpa_s->wpa_proto;
2378         params.auth_alg = algs;
2379         params.mode = ssid->mode;
2380         params.bg_scan_period = ssid->bg_scan_period;
2381         for (i = 0; i < NUM_WEP_KEYS; i++) {
2382                 if (ssid->wep_key_len[i])
2383                         params.wep_key[i] = ssid->wep_key[i];
2384                 params.wep_key_len[i] = ssid->wep_key_len[i];
2385         }
2386         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2387
2388         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2389             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2390              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2391                 params.passphrase = ssid->passphrase;
2392                 if (ssid->psk_set)
2393                         params.psk = ssid->psk;
2394         }
2395
2396         if (wpa_s->conf->key_mgmt_offload) {
2397                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2398                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2399                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2400                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2401                         params.req_key_mgmt_offload =
2402                                 ssid->proactive_key_caching < 0 ?
2403                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2404                 else
2405                         params.req_key_mgmt_offload = 1;
2406
2407                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2408                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2409                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2410                     ssid->psk_set)
2411                         params.psk = ssid->psk;
2412         }
2413
2414         params.drop_unencrypted = use_crypt;
2415
2416 #ifdef CONFIG_IEEE80211W
2417         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2418         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2419                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2420                 struct wpa_ie_data ie;
2421                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2422                     ie.capabilities &
2423                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2424                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2425                                 "MFP: require MFP");
2426                         params.mgmt_frame_protection =
2427                                 MGMT_FRAME_PROTECTION_REQUIRED;
2428                 }
2429         }
2430 #endif /* CONFIG_IEEE80211W */
2431
2432         params.p2p = ssid->p2p_group;
2433
2434         if (wpa_s->parent->set_sta_uapsd)
2435                 params.uapsd = wpa_s->parent->sta_uapsd;
2436         else
2437                 params.uapsd = -1;
2438
2439 #ifdef CONFIG_HT_OVERRIDES
2440         os_memset(&htcaps, 0, sizeof(htcaps));
2441         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2442         params.htcaps = (u8 *) &htcaps;
2443         params.htcaps_mask = (u8 *) &htcaps_mask;
2444         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2445 #endif /* CONFIG_HT_OVERRIDES */
2446 #ifdef CONFIG_VHT_OVERRIDES
2447         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2448         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2449         params.vhtcaps = &vhtcaps;
2450         params.vhtcaps_mask = &vhtcaps_mask;
2451         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2452 #endif /* CONFIG_VHT_OVERRIDES */
2453
2454 #ifdef CONFIG_P2P
2455         /*
2456          * If multi-channel concurrency is not supported, check for any
2457          * frequency conflict. In case of any frequency conflict, remove the
2458          * least prioritized connection.
2459          */
2460         if (wpa_s->num_multichan_concurrent < 2) {
2461                 int freq, num;
2462                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2463                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2464                         wpa_printf(MSG_DEBUG,
2465                                    "Assoc conflicting freq found (%d != %d)",
2466                                    freq, params.freq.freq);
2467                         if (wpas_p2p_handle_frequency_conflicts(
2468                                     wpa_s, params.freq.freq, ssid) < 0) {
2469                                 wpas_connect_work_done(wpa_s);
2470                                 return;
2471                         }
2472                 }
2473         }
2474 #endif /* CONFIG_P2P */
2475
2476         ret = wpa_drv_associate(wpa_s, &params);
2477         if (ret < 0) {
2478                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2479                         "failed");
2480                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2481                         /*
2482                          * The driver is known to mean what is saying, so we
2483                          * can stop right here; the association will not
2484                          * succeed.
2485                          */
2486                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2487                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2488                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2489                         return;
2490                 }
2491                 /* try to continue anyway; new association will be tried again
2492                  * after timeout */
2493                 assoc_failed = 1;
2494         }
2495
2496         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2497                 /* Set the key after the association just in case association
2498                  * cleared the previously configured key. */
2499                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2500                 /* No need to timeout authentication since there is no key
2501                  * management. */
2502                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2503                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2504 #ifdef CONFIG_IBSS_RSN
2505         } else if (ssid->mode == WPAS_MODE_IBSS &&
2506                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2507                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2508                 /*
2509                  * RSN IBSS authentication is per-STA and we can disable the
2510                  * per-BSSID authentication.
2511                  */
2512                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2513 #endif /* CONFIG_IBSS_RSN */
2514         } else {
2515                 /* Timeout for IEEE 802.11 authentication and association */
2516                 int timeout = 60;
2517
2518                 if (assoc_failed) {
2519                         /* give IBSS a bit more time */
2520                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2521                 } else if (wpa_s->conf->ap_scan == 1) {
2522                         /* give IBSS a bit more time */
2523                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2524                 }
2525                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2526         }
2527
2528         if (wep_keys_set &&
2529             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2530                 /* Set static WEP keys again */
2531                 wpa_set_wep_keys(wpa_s, ssid);
2532         }
2533
2534         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2535                 /*
2536                  * Do not allow EAP session resumption between different
2537                  * network configurations.
2538                  */
2539                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2540         }
2541         old_ssid = wpa_s->current_ssid;
2542         wpa_s->current_ssid = ssid;
2543         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2544                 wpa_s->current_bss = bss;
2545         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2546         wpa_supplicant_initiate_eapol(wpa_s);
2547         if (old_ssid != wpa_s->current_ssid)
2548                 wpas_notify_network_changed(wpa_s);
2549 }
2550
2551
2552 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2553                                             const u8 *addr)
2554 {
2555         struct wpa_ssid *old_ssid;
2556
2557         wpas_connect_work_done(wpa_s);
2558         wpa_clear_keys(wpa_s, addr);
2559         old_ssid = wpa_s->current_ssid;
2560         wpa_supplicant_mark_disassoc(wpa_s);
2561         wpa_sm_set_config(wpa_s->wpa, NULL);
2562         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2563         if (old_ssid != wpa_s->current_ssid)
2564                 wpas_notify_network_changed(wpa_s);
2565         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2566 }
2567
2568
2569 /**
2570  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2571  * @wpa_s: Pointer to wpa_supplicant data
2572  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2573  *
2574  * This function is used to request %wpa_supplicant to deauthenticate from the
2575  * current AP.
2576  */
2577 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2578                                    int reason_code)
2579 {
2580         u8 *addr = NULL;
2581         union wpa_event_data event;
2582         int zero_addr = 0;
2583
2584         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2585                 " pending_bssid=" MACSTR " reason=%d state=%s",
2586                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2587                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2588
2589         if (!is_zero_ether_addr(wpa_s->bssid))
2590                 addr = wpa_s->bssid;
2591         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2592                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2593                   wpa_s->wpa_state == WPA_ASSOCIATING))
2594                 addr = wpa_s->pending_bssid;
2595         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2596                 /*
2597                  * When using driver-based BSS selection, we may not know the
2598                  * BSSID with which we are currently trying to associate. We
2599                  * need to notify the driver of this disconnection even in such
2600                  * a case, so use the all zeros address here.
2601                  */
2602                 addr = wpa_s->bssid;
2603                 zero_addr = 1;
2604         }
2605
2606 #ifdef CONFIG_TDLS
2607         wpa_tdls_teardown_peers(wpa_s->wpa);
2608 #endif /* CONFIG_TDLS */
2609
2610 #ifdef CONFIG_MESH
2611         if (wpa_s->ifmsh) {
2612                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2613                         wpa_s->ifname);
2614                 wpa_supplicant_leave_mesh(wpa_s);
2615         }
2616 #endif /* CONFIG_MESH */
2617
2618         if (addr) {
2619                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2620                 os_memset(&event, 0, sizeof(event));
2621                 event.deauth_info.reason_code = (u16) reason_code;
2622                 event.deauth_info.locally_generated = 1;
2623                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2624                 if (zero_addr)
2625                         addr = NULL;
2626         }
2627
2628         wpa_supplicant_clear_connection(wpa_s, addr);
2629 }
2630
2631 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2632                                               struct wpa_ssid *ssid)
2633 {
2634         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2635                 return;
2636
2637         ssid->disabled = 0;
2638         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2639         wpas_notify_network_enabled_changed(wpa_s, ssid);
2640
2641         /*
2642          * Try to reassociate since there is no current configuration and a new
2643          * network was made available.
2644          */
2645         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2646                 wpa_s->reassociate = 1;
2647 }
2648
2649
2650 /**
2651  * wpa_supplicant_enable_network - Mark a configured network as enabled
2652  * @wpa_s: wpa_supplicant structure for a network interface
2653  * @ssid: wpa_ssid structure for a configured network or %NULL
2654  *
2655  * Enables the specified network or all networks if no network specified.
2656  */
2657 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2658                                    struct wpa_ssid *ssid)
2659 {
2660         if (ssid == NULL) {
2661                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2662                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2663         } else
2664                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2665
2666         if (wpa_s->reassociate && !wpa_s->disconnected &&
2667             (!wpa_s->current_ssid ||
2668              wpa_s->wpa_state == WPA_DISCONNECTED ||
2669              wpa_s->wpa_state == WPA_SCANNING)) {
2670                 if (wpa_s->sched_scanning) {
2671                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2672                                    "new network to scan filters");
2673                         wpa_supplicant_cancel_sched_scan(wpa_s);
2674                 }
2675
2676                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2677                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2678                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2679                 }
2680         }
2681 }
2682
2683
2684 /**
2685  * wpa_supplicant_disable_network - Mark a configured network as disabled
2686  * @wpa_s: wpa_supplicant structure for a network interface
2687  * @ssid: wpa_ssid structure for a configured network or %NULL
2688  *
2689  * Disables the specified network or all networks if no network specified.
2690  */
2691 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2692                                     struct wpa_ssid *ssid)
2693 {
2694         struct wpa_ssid *other_ssid;
2695         int was_disabled;
2696
2697         if (ssid == NULL) {
2698                 if (wpa_s->sched_scanning)
2699                         wpa_supplicant_cancel_sched_scan(wpa_s);
2700
2701                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2702                      other_ssid = other_ssid->next) {
2703                         was_disabled = other_ssid->disabled;
2704                         if (was_disabled == 2)
2705                                 continue; /* do not change persistent P2P group
2706                                            * data */
2707
2708                         other_ssid->disabled = 1;
2709
2710                         if (was_disabled != other_ssid->disabled)
2711                                 wpas_notify_network_enabled_changed(
2712                                         wpa_s, other_ssid);
2713                 }
2714                 if (wpa_s->current_ssid)
2715                         wpa_supplicant_deauthenticate(
2716                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2717         } else if (ssid->disabled != 2) {
2718                 if (ssid == wpa_s->current_ssid)
2719                         wpa_supplicant_deauthenticate(
2720                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2721
2722                 was_disabled = ssid->disabled;
2723
2724                 ssid->disabled = 1;
2725
2726                 if (was_disabled != ssid->disabled) {
2727                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2728                         if (wpa_s->sched_scanning) {
2729                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2730                                            "to remove network from filters");
2731                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2732                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2733                         }
2734                 }
2735         }
2736 }
2737
2738
2739 /**
2740  * wpa_supplicant_select_network - Attempt association with a network
2741  * @wpa_s: wpa_supplicant structure for a network interface
2742  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2743  */
2744 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2745                                    struct wpa_ssid *ssid)
2746 {
2747
2748         struct wpa_ssid *other_ssid;
2749         int disconnected = 0;
2750
2751         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2752                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2753                         wpa_s->own_disconnect_req = 1;
2754                 wpa_supplicant_deauthenticate(
2755                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2756                 disconnected = 1;
2757         }
2758
2759         if (ssid)
2760                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2761
2762         /*
2763          * Mark all other networks disabled or mark all networks enabled if no
2764          * network specified.
2765          */
2766         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2767              other_ssid = other_ssid->next) {
2768                 int was_disabled = other_ssid->disabled;
2769                 if (was_disabled == 2)
2770                         continue; /* do not change persistent P2P group data */
2771
2772                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2773                 if (was_disabled && !other_ssid->disabled)
2774                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2775
2776                 if (was_disabled != other_ssid->disabled)
2777                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2778         }
2779
2780         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2781             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2782                 /* We are already associated with the selected network */
2783                 wpa_printf(MSG_DEBUG, "Already associated with the "
2784                            "selected network - do nothing");
2785                 return;
2786         }
2787
2788         if (ssid) {
2789                 wpa_s->current_ssid = ssid;
2790                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2791                 wpa_s->connect_without_scan =
2792                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2793
2794                 /*
2795                  * Don't optimize next scan freqs since a new ESS has been
2796                  * selected.
2797                  */
2798                 os_free(wpa_s->next_scan_freqs);
2799                 wpa_s->next_scan_freqs = NULL;
2800         } else {
2801                 wpa_s->connect_without_scan = NULL;
2802         }
2803
2804         wpa_s->disconnected = 0;
2805         wpa_s->reassociate = 1;
2806
2807         if (wpa_s->connect_without_scan ||
2808             wpa_supplicant_fast_associate(wpa_s) != 1) {
2809                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2810                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2811         }
2812
2813         if (ssid)
2814                 wpas_notify_network_selected(wpa_s, ssid);
2815 }
2816
2817
2818 /**
2819  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2820  * @wpa_s: wpa_supplicant structure for a network interface
2821  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2822  * @pkcs11_module_path: PKCS #11 module path or NULL
2823  * Returns: 0 on success; -1 on failure
2824  *
2825  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2826  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2827  * module path fails the paths will be reset to the default value (NULL).
2828  */
2829 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2830                                            const char *pkcs11_engine_path,
2831                                            const char *pkcs11_module_path)
2832 {
2833         char *pkcs11_engine_path_copy = NULL;
2834         char *pkcs11_module_path_copy = NULL;
2835
2836         if (pkcs11_engine_path != NULL) {
2837                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2838                 if (pkcs11_engine_path_copy == NULL)
2839                         return -1;
2840         }
2841         if (pkcs11_module_path != NULL) {
2842                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2843                 if (pkcs11_module_path_copy == NULL) {
2844                         os_free(pkcs11_engine_path_copy);
2845                         return -1;
2846                 }
2847         }
2848
2849         os_free(wpa_s->conf->pkcs11_engine_path);
2850         os_free(wpa_s->conf->pkcs11_module_path);
2851         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2852         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2853
2854         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2855         eapol_sm_deinit(wpa_s->eapol);
2856         wpa_s->eapol = NULL;
2857         if (wpa_supplicant_init_eapol(wpa_s)) {
2858                 /* Error -> Reset paths to the default value (NULL) once. */
2859                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2860                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2861                                                                NULL);
2862
2863                 return -1;
2864         }
2865         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2866
2867         return 0;
2868 }
2869
2870
2871 /**
2872  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2873  * @wpa_s: wpa_supplicant structure for a network interface
2874  * @ap_scan: AP scan mode
2875  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2876  *
2877  */
2878 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2879 {
2880
2881         int old_ap_scan;
2882
2883         if (ap_scan < 0 || ap_scan > 2)
2884                 return -1;
2885
2886         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2887                 wpa_printf(MSG_INFO,
2888                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2889         }
2890
2891 #ifdef ANDROID
2892         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2893             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2894             wpa_s->wpa_state < WPA_COMPLETED) {
2895                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2896                            "associating", wpa_s->conf->ap_scan, ap_scan);
2897                 return 0;
2898         }
2899 #endif /* ANDROID */
2900
2901         old_ap_scan = wpa_s->conf->ap_scan;
2902         wpa_s->conf->ap_scan = ap_scan;
2903
2904         if (old_ap_scan != wpa_s->conf->ap_scan)
2905                 wpas_notify_ap_scan_changed(wpa_s);
2906
2907         return 0;
2908 }
2909
2910
2911 /**
2912  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2913  * @wpa_s: wpa_supplicant structure for a network interface
2914  * @expire_age: Expiration age in seconds
2915  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2916  *
2917  */
2918 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2919                                           unsigned int bss_expire_age)
2920 {
2921         if (bss_expire_age < 10) {
2922                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2923                         bss_expire_age);
2924                 return -1;
2925         }
2926         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2927                 bss_expire_age);
2928         wpa_s->conf->bss_expiration_age = bss_expire_age;
2929
2930         return 0;
2931 }
2932
2933
2934 /**
2935  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2936  * @wpa_s: wpa_supplicant structure for a network interface
2937  * @expire_count: number of scans after which an unseen BSS is reclaimed
2938  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2939  *
2940  */
2941 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2942                                             unsigned int bss_expire_count)
2943 {
2944         if (bss_expire_count < 1) {
2945                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2946                         bss_expire_count);
2947                 return -1;
2948         }
2949         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2950                 bss_expire_count);
2951         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2952
2953         return 0;
2954 }
2955
2956
2957 /**
2958  * wpa_supplicant_set_scan_interval - Set scan interval
2959  * @wpa_s: wpa_supplicant structure for a network interface
2960  * @scan_interval: scan interval in seconds
2961  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2962  *
2963  */
2964 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2965                                      int scan_interval)
2966 {
2967         if (scan_interval < 0) {
2968                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2969                         scan_interval);
2970                 return -1;
2971         }
2972         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2973                 scan_interval);
2974         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2975
2976         return 0;
2977 }
2978
2979
2980 /**
2981  * wpa_supplicant_set_debug_params - Set global debug params
2982  * @global: wpa_global structure
2983  * @debug_level: debug level
2984  * @debug_timestamp: determines if show timestamp in debug data
2985  * @debug_show_keys: determines if show keys in debug data
2986  * Returns: 0 if succeed or -1 if debug_level has wrong value
2987  */
2988 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2989                                     int debug_timestamp, int debug_show_keys)
2990 {
2991
2992         int old_level, old_timestamp, old_show_keys;
2993
2994         /* check for allowed debuglevels */
2995         if (debug_level != MSG_EXCESSIVE &&
2996             debug_level != MSG_MSGDUMP &&
2997             debug_level != MSG_DEBUG &&
2998             debug_level != MSG_INFO &&
2999             debug_level != MSG_WARNING &&
3000             debug_level != MSG_ERROR)
3001                 return -1;
3002
3003         old_level = wpa_debug_level;
3004         old_timestamp = wpa_debug_timestamp;
3005         old_show_keys = wpa_debug_show_keys;
3006
3007         wpa_debug_level = debug_level;
3008         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3009         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3010
3011         if (wpa_debug_level != old_level)
3012                 wpas_notify_debug_level_changed(global);
3013         if (wpa_debug_timestamp != old_timestamp)
3014                 wpas_notify_debug_timestamp_changed(global);
3015         if (wpa_debug_show_keys != old_show_keys)
3016                 wpas_notify_debug_show_keys_changed(global);
3017
3018         return 0;
3019 }
3020
3021
3022 /**
3023  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3024  * @wpa_s: Pointer to wpa_supplicant data
3025  * Returns: A pointer to the current network structure or %NULL on failure
3026  */
3027 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3028 {
3029         struct wpa_ssid *entry;
3030         u8 ssid[SSID_MAX_LEN];
3031         int res;
3032         size_t ssid_len;
3033         u8 bssid[ETH_ALEN];
3034         int wired;
3035
3036         res = wpa_drv_get_ssid(wpa_s, ssid);
3037         if (res < 0) {
3038                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3039                         "driver");
3040                 return NULL;
3041         }
3042         ssid_len = res;
3043
3044         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3045                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3046                         "driver");
3047                 return NULL;
3048         }
3049
3050         wired = wpa_s->conf->ap_scan == 0 &&
3051                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3052
3053         entry = wpa_s->conf->ssid;
3054         while (entry) {
3055                 if (!wpas_network_disabled(wpa_s, entry) &&
3056                     ((ssid_len == entry->ssid_len &&
3057                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3058                     (!entry->bssid_set ||
3059                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3060                         return entry;
3061 #ifdef CONFIG_WPS
3062                 if (!wpas_network_disabled(wpa_s, entry) &&
3063                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3064                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3065                     (!entry->bssid_set ||
3066                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3067                         return entry;
3068 #endif /* CONFIG_WPS */
3069
3070                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3071                     entry->ssid_len == 0 &&
3072                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3073                         return entry;
3074
3075                 entry = entry->next;
3076         }
3077
3078         return NULL;
3079 }
3080
3081
3082 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3083 {
3084         struct wpa_global *global = wpa_s->global;
3085
3086         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3087                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3088                 if (global->drv_priv[i] == NULL) {
3089                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3090                                    "'%s'", wpa_drivers[i]->name);
3091                         return -1;
3092                 }
3093         }
3094
3095         wpa_s->driver = wpa_drivers[i];
3096         wpa_s->global_drv_priv = global->drv_priv[i];
3097
3098         return 0;
3099 }
3100
3101
3102 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3103                                      const char *name)
3104 {
3105         int i;
3106         size_t len;
3107         const char *pos, *driver = name;
3108
3109         if (wpa_s == NULL)
3110                 return -1;
3111
3112         if (wpa_drivers[0] == NULL) {
3113                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3114                         "wpa_supplicant");
3115                 return -1;
3116         }
3117
3118         if (name == NULL) {
3119                 /* default to first driver in the list */
3120                 return select_driver(wpa_s, 0);
3121         }
3122
3123         do {
3124                 pos = os_strchr(driver, ',');
3125                 if (pos)
3126                         len = pos - driver;
3127                 else
3128                         len = os_strlen(driver);
3129
3130                 for (i = 0; wpa_drivers[i]; i++) {
3131                         if (os_strlen(wpa_drivers[i]->name) == len &&
3132                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3133                             0) {
3134                                 /* First driver that succeeds wins */
3135                                 if (select_driver(wpa_s, i) == 0)
3136                                         return 0;
3137                         }
3138                 }
3139
3140                 driver = pos + 1;
3141         } while (pos);
3142
3143         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3144         return -1;
3145 }
3146
3147
3148 /**
3149  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3150  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3151  *      with struct wpa_driver_ops::init()
3152  * @src_addr: Source address of the EAPOL frame
3153  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3154  * @len: Length of the EAPOL data
3155  *
3156  * This function is called for each received EAPOL frame. Most driver
3157  * interfaces rely on more generic OS mechanism for receiving frames through
3158  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3159  * take care of received EAPOL frames and deliver them to the core supplicant
3160  * code by calling this function.
3161  */
3162 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3163                              const u8 *buf, size_t len)
3164 {
3165         struct wpa_supplicant *wpa_s = ctx;
3166
3167         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3168         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3169
3170 #ifdef CONFIG_PEERKEY
3171         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3172             wpa_s->current_ssid->peerkey &&
3173             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3174             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3175                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3176                 return;
3177         }
3178 #endif /* CONFIG_PEERKEY */
3179
3180         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3181             (wpa_s->last_eapol_matches_bssid &&
3182 #ifdef CONFIG_AP
3183              !wpa_s->ap_iface &&
3184 #endif /* CONFIG_AP */
3185              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3186                 /*
3187                  * There is possible race condition between receiving the
3188                  * association event and the EAPOL frame since they are coming
3189                  * through different paths from the driver. In order to avoid
3190                  * issues in trying to process the EAPOL frame before receiving
3191                  * association information, lets queue it for processing until
3192                  * the association event is received. This may also be needed in
3193                  * driver-based roaming case, so also use src_addr != BSSID as a
3194                  * trigger if we have previously confirmed that the
3195                  * Authenticator uses BSSID as the src_addr (which is not the
3196                  * case with wired IEEE 802.1X).
3197                  */
3198                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3199                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3200                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3201                         MAC2STR(wpa_s->bssid));
3202                 wpabuf_free(wpa_s->pending_eapol_rx);
3203                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3204                 if (wpa_s->pending_eapol_rx) {
3205                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3206                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3207                                   ETH_ALEN);
3208                 }
3209                 return;
3210         }
3211
3212         wpa_s->last_eapol_matches_bssid =
3213                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3214
3215 #ifdef CONFIG_AP
3216         if (wpa_s->ap_iface) {
3217                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3218                 return;
3219         }
3220 #endif /* CONFIG_AP */
3221
3222         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3223                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3224                         "no key management is configured");
3225                 return;
3226         }
3227
3228         if (wpa_s->eapol_received == 0 &&
3229             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3230              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3231              wpa_s->wpa_state != WPA_COMPLETED) &&
3232             (wpa_s->current_ssid == NULL ||
3233              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3234                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3235                 int timeout = 10;
3236
3237                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3238                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3239                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3240                         /* Use longer timeout for IEEE 802.1X/EAP */
3241                         timeout = 70;
3242                 }
3243
3244 #ifdef CONFIG_WPS
3245                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3246                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3247                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3248                         /*
3249                          * Use shorter timeout if going through WPS AP iteration
3250                          * for PIN config method with an AP that does not
3251                          * advertise Selected Registrar.
3252                          */
3253                         struct wpabuf *wps_ie;
3254
3255                         wps_ie = wpa_bss_get_vendor_ie_multi(
3256                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3257                         if (wps_ie &&
3258                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3259                                 timeout = 10;
3260                         wpabuf_free(wps_ie);
3261                 }
3262 #endif /* CONFIG_WPS */
3263
3264                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3265         }
3266         wpa_s->eapol_received++;
3267
3268         if (wpa_s->countermeasures) {
3269                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3270                         "EAPOL packet");
3271                 return;
3272         }
3273
3274 #ifdef CONFIG_IBSS_RSN
3275         if (wpa_s->current_ssid &&
3276             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3277                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3278                 return;
3279         }
3280 #endif /* CONFIG_IBSS_RSN */
3281
3282         /* Source address of the incoming EAPOL frame could be compared to the
3283          * current BSSID. However, it is possible that a centralized
3284          * Authenticator could be using another MAC address than the BSSID of
3285          * an AP, so just allow any address to be used for now. The replies are
3286          * still sent to the current BSSID (if available), though. */
3287
3288         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3289         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3290             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3291                 return;
3292         wpa_drv_poll(wpa_s);
3293         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3294                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3295         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3296                 /*
3297                  * Set portValid = TRUE here since we are going to skip 4-way
3298                  * handshake processing which would normally set portValid. We
3299                  * need this to allow the EAPOL state machines to be completed
3300                  * without going through EAPOL-Key handshake.
3301                  */
3302                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3303         }
3304 }
3305
3306
3307 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3308 {
3309         if ((!wpa_s->p2p_mgmt ||
3310              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3311             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3312                 l2_packet_deinit(wpa_s->l2);
3313                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3314                                            wpa_drv_get_mac_addr(wpa_s),
3315                                            ETH_P_EAPOL,
3316                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3317                 if (wpa_s->l2 == NULL)
3318                         return -1;
3319         } else {
3320                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3321                 if (addr)
3322                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3323         }
3324
3325         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3326                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3327                 return -1;
3328         }
3329
3330         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3331
3332         return 0;
3333 }
3334
3335
3336 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3337                                            const u8 *buf, size_t len)
3338 {
3339         struct wpa_supplicant *wpa_s = ctx;
3340         const struct l2_ethhdr *eth;
3341
3342         if (len < sizeof(*eth))
3343                 return;
3344         eth = (const struct l2_ethhdr *) buf;
3345
3346         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3347             !(eth->h_dest[0] & 0x01)) {
3348                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3349                         " (bridge - not for this interface - ignore)",
3350                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3351                 return;
3352         }
3353
3354         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3355                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3356         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3357                                 len - sizeof(*eth));
3358 }
3359
3360
3361 /**
3362  * wpa_supplicant_driver_init - Initialize driver interface parameters
3363  * @wpa_s: Pointer to wpa_supplicant data
3364  * Returns: 0 on success, -1 on failure
3365  *
3366  * This function is called to initialize driver interface parameters.
3367  * wpa_drv_init() must have been called before this function to initialize the
3368  * driver interface.
3369  */
3370 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3371 {
3372         static int interface_count = 0;
3373
3374         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3375                 return -1;
3376
3377         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3378                 MAC2STR(wpa_s->own_addr));
3379         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3380         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3381
3382         if (wpa_s->bridge_ifname[0]) {
3383                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3384                         "interface '%s'", wpa_s->bridge_ifname);
3385                 wpa_s->l2_br = l2_packet_init_bridge(
3386                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3387                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3388                 if (wpa_s->l2_br == NULL) {
3389                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3390                                 "connection for the bridge interface '%s'",
3391                                 wpa_s->bridge_ifname);
3392                         return -1;
3393                 }
3394         }
3395
3396         if (wpa_s->conf->ap_scan == 2 &&
3397             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3398                 wpa_printf(MSG_INFO,
3399                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3400         }
3401
3402         wpa_clear_keys(wpa_s, NULL);
3403
3404         /* Make sure that TKIP countermeasures are not left enabled (could
3405          * happen if wpa_supplicant is killed during countermeasures. */
3406         wpa_drv_set_countermeasures(wpa_s, 0);
3407
3408         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3409         wpa_drv_flush_pmkid(wpa_s);
3410
3411         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3412         wpa_s->prev_scan_wildcard = 0;
3413
3414         if (wpa_supplicant_enabled_networks(wpa_s)) {
3415                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3416                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3417                         interface_count = 0;
3418                 }
3419 #ifndef ANDROID
3420                 if (!wpa_s->p2p_mgmt &&
3421                     wpa_supplicant_delayed_sched_scan(wpa_s,
3422                                                       interface_count % 3,
3423                                                       100000))
3424                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3425                                                 100000);
3426 #endif /* ANDROID */
3427                 interface_count++;
3428         } else
3429                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3430
3431         return 0;
3432 }
3433
3434
3435 static int wpa_supplicant_daemon(const char *pid_file)
3436 {
3437         wpa_printf(MSG_DEBUG, "Daemonize..");
3438         return os_daemonize(pid_file);
3439 }
3440
3441
3442 static struct wpa_supplicant *
3443 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3444 {
3445         struct wpa_supplicant *wpa_s;
3446
3447         wpa_s = os_zalloc(sizeof(*wpa_s));
3448         if (wpa_s == NULL)
3449                 return NULL;
3450         wpa_s->scan_req = INITIAL_SCAN_REQ;
3451         wpa_s->scan_interval = 5;
3452         wpa_s->new_connection = 1;
3453         wpa_s->parent = parent ? parent : wpa_s;
3454         wpa_s->sched_scanning = 0;
3455
3456         return wpa_s;
3457 }
3458
3459
3460 #ifdef CONFIG_HT_OVERRIDES
3461
3462 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3463                              struct ieee80211_ht_capabilities *htcaps,
3464                              struct ieee80211_ht_capabilities *htcaps_mask,
3465                              const char *ht_mcs)
3466 {
3467         /* parse ht_mcs into hex array */
3468         int i;
3469         const char *tmp = ht_mcs;
3470         char *end = NULL;
3471
3472         /* If ht_mcs is null, do not set anything */
3473         if (!ht_mcs)
3474                 return 0;
3475
3476         /* This is what we are setting in the kernel */
3477         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3478
3479         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3480
3481         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3482                 errno = 0;
3483                 long v = strtol(tmp, &end, 16);
3484                 if (errno == 0) {
3485                         wpa_msg(wpa_s, MSG_DEBUG,
3486                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3487                                 i, v, end, tmp);
3488                         if (end == tmp)
3489                                 break;
3490
3491                         htcaps->supported_mcs_set[i] = v;
3492                         tmp = end;
3493                 } else {
3494                         wpa_msg(wpa_s, MSG_ERROR,
3495                                 "Failed to parse ht-mcs: %s, error: %s\n",
3496                                 ht_mcs, strerror(errno));
3497                         return -1;
3498                 }
3499         }
3500
3501         /*
3502          * If we were able to parse any values, then set mask for the MCS set.
3503          */
3504         if (i) {
3505                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3506                           IEEE80211_HT_MCS_MASK_LEN - 1);
3507                 /* skip the 3 reserved bits */
3508                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3509                         0x1f;
3510         }
3511
3512         return 0;
3513 }
3514
3515
3516 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3517                                  struct ieee80211_ht_capabilities *htcaps,
3518                                  struct ieee80211_ht_capabilities *htcaps_mask,
3519                                  int disabled)
3520 {
3521         le16 msk;
3522
3523         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3524
3525         if (disabled == -1)
3526                 return 0;
3527
3528         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3529         htcaps_mask->ht_capabilities_info |= msk;
3530         if (disabled)
3531                 htcaps->ht_capabilities_info &= msk;
3532         else
3533                 htcaps->ht_capabilities_info |= msk;
3534
3535         return 0;
3536 }
3537
3538
3539 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3540                                 struct ieee80211_ht_capabilities *htcaps,
3541                                 struct ieee80211_ht_capabilities *htcaps_mask,
3542                                 int factor)
3543 {
3544         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3545
3546         if (factor == -1)
3547                 return 0;
3548
3549         if (factor < 0 || factor > 3) {
3550                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3551                         "Must be 0-3 or -1", factor);
3552                 return -EINVAL;
3553         }
3554
3555         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3556         htcaps->a_mpdu_params &= ~0x3;
3557         htcaps->a_mpdu_params |= factor & 0x3;
3558
3559         return 0;
3560 }
3561
3562
3563 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3564                                  struct ieee80211_ht_capabilities *htcaps,
3565                                  struct ieee80211_ht_capabilities *htcaps_mask,
3566                                  int density)
3567 {
3568         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3569
3570         if (density == -1)
3571                 return 0;
3572
3573         if (density < 0 || density > 7) {
3574                 wpa_msg(wpa_s, MSG_ERROR,
3575                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3576                         density);
3577                 return -EINVAL;
3578         }
3579
3580         htcaps_mask->a_mpdu_params |= 0x1C;
3581         htcaps->a_mpdu_params &= ~(0x1C);
3582         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3583
3584         return 0;
3585 }
3586
3587
3588 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3589                                 struct ieee80211_ht_capabilities *htcaps,
3590                                 struct ieee80211_ht_capabilities *htcaps_mask,
3591                                 int disabled)
3592 {
3593         /* Masking these out disables HT40 */
3594         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3595                                 HT_CAP_INFO_SHORT_GI40MHZ);
3596
3597         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3598
3599         if (disabled)
3600                 htcaps->ht_capabilities_info &= ~msk;
3601         else
3602                 htcaps->ht_capabilities_info |= msk;
3603
3604         htcaps_mask->ht_capabilities_info |= msk;
3605
3606         return 0;
3607 }
3608
3609
3610 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3611                                struct ieee80211_ht_capabilities *htcaps,
3612                                struct ieee80211_ht_capabilities *htcaps_mask,
3613                                int disabled)
3614 {
3615         /* Masking these out disables SGI */
3616         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3617                                 HT_CAP_INFO_SHORT_GI40MHZ);
3618
3619         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3620
3621         if (disabled)
3622                 htcaps->ht_capabilities_info &= ~msk;
3623         else
3624                 htcaps->ht_capabilities_info |= msk;
3625
3626         htcaps_mask->ht_capabilities_info |= msk;
3627
3628         return 0;
3629 }
3630
3631
3632 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3633                                struct ieee80211_ht_capabilities *htcaps,
3634                                struct ieee80211_ht_capabilities *htcaps_mask,
3635                                int disabled)
3636 {
3637         /* Masking these out disables LDPC */
3638         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3639
3640         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3641
3642         if (disabled)
3643                 htcaps->ht_capabilities_info &= ~msk;
3644         else
3645                 htcaps->ht_capabilities_info |= msk;
3646
3647         htcaps_mask->ht_capabilities_info |= msk;
3648
3649         return 0;
3650 }
3651
3652
3653 void wpa_supplicant_apply_ht_overrides(
3654         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3655         struct wpa_driver_associate_params *params)
3656 {
3657         struct ieee80211_ht_capabilities *htcaps;
3658         struct ieee80211_ht_capabilities *htcaps_mask;
3659
3660         if (!ssid)
3661                 return;
3662
3663         params->disable_ht = ssid->disable_ht;
3664         if (!params->htcaps || !params->htcaps_mask)
3665                 return;
3666
3667         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3668         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3669         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3670         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3671                               ssid->disable_max_amsdu);
3672         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3673         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3674         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3675         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3676         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3677
3678         if (ssid->ht40_intolerant) {
3679                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3680                 htcaps->ht_capabilities_info |= bit;
3681                 htcaps_mask->ht_capabilities_info |= bit;
3682         }
3683 }
3684
3685 #endif /* CONFIG_HT_OVERRIDES */
3686
3687
3688 #ifdef CONFIG_VHT_OVERRIDES
3689 void wpa_supplicant_apply_vht_overrides(
3690         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3691         struct wpa_driver_associate_params *params)
3692 {
3693         struct ieee80211_vht_capabilities *vhtcaps;
3694         struct ieee80211_vht_capabilities *vhtcaps_mask;
3695
3696         if (!ssid)
3697                 return;
3698
3699         params->disable_vht = ssid->disable_vht;
3700
3701         vhtcaps = (void *) params->vhtcaps;
3702         vhtcaps_mask = (void *) params->vhtcaps_mask;
3703
3704         if (!vhtcaps || !vhtcaps_mask)
3705                 return;
3706
3707         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3708         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3709
3710 #ifdef CONFIG_HT_OVERRIDES
3711         /* if max ampdu is <= 3, we have to make the HT cap the same */
3712         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3713                 int max_ampdu;
3714
3715                 max_ampdu = (ssid->vht_capa &
3716                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3717                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3718
3719                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3720                 wpa_set_ampdu_factor(wpa_s,
3721                                      (void *) params->htcaps,
3722                                      (void *) params->htcaps_mask,
3723                                      max_ampdu);
3724         }
3725 #endif /* CONFIG_HT_OVERRIDES */
3726
3727 #define OVERRIDE_MCS(i)                                                 \
3728         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3729                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3730                         3 << 2 * (i - 1);                               \
3731                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3732                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3733         }                                                               \
3734         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3735                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3736                         3 << 2 * (i - 1);                               \
3737                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3738                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3739         }
3740
3741         OVERRIDE_MCS(1);
3742         OVERRIDE_MCS(2);
3743         OVERRIDE_MCS(3);
3744         OVERRIDE_MCS(4);
3745         OVERRIDE_MCS(5);
3746         OVERRIDE_MCS(6);
3747         OVERRIDE_MCS(7);
3748         OVERRIDE_MCS(8);
3749 }
3750 #endif /* CONFIG_VHT_OVERRIDES */
3751
3752
3753 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3754 {
3755 #ifdef PCSC_FUNCS
3756         size_t len;
3757
3758         if (!wpa_s->conf->pcsc_reader)
3759                 return 0;
3760
3761         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3762         if (!wpa_s->scard)
3763                 return 1;
3764
3765         if (wpa_s->conf->pcsc_pin &&
3766             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3767                 scard_deinit(wpa_s->scard);
3768                 wpa_s->scard = NULL;
3769                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3770                 return -1;
3771         }
3772
3773         len = sizeof(wpa_s->imsi) - 1;
3774         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3775                 scard_deinit(wpa_s->scard);
3776                 wpa_s->scard = NULL;
3777                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3778                 return -1;
3779         }
3780         wpa_s->imsi[len] = '\0';
3781
3782         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3783
3784         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3785                    wpa_s->imsi, wpa_s->mnc_len);
3786
3787         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3788         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3789 #endif /* PCSC_FUNCS */
3790
3791         return 0;
3792 }
3793
3794
3795 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3796 {
3797         char *val, *pos;
3798
3799         ext_password_deinit(wpa_s->ext_pw);
3800         wpa_s->ext_pw = NULL;
3801         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3802
3803         if (!wpa_s->conf->ext_password_backend)
3804                 return 0;
3805
3806         val = os_strdup(wpa_s->conf->ext_password_backend);
3807         if (val == NULL)
3808                 return -1;
3809         pos = os_strchr(val, ':');
3810         if (pos)
3811                 *pos++ = '\0';
3812
3813         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3814
3815         wpa_s->ext_pw = ext_password_init(val, pos);
3816         os_free(val);
3817         if (wpa_s->ext_pw == NULL) {
3818                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3819                 return -1;
3820         }
3821         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3822
3823         return 0;
3824 }
3825
3826
3827 #ifdef CONFIG_FST
3828
3829 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3830 {
3831         struct wpa_supplicant *wpa_s = ctx;
3832
3833         return (is_zero_ether_addr(wpa_s->bssid) ||
3834                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3835 }
3836
3837
3838 static void wpas_fst_get_channel_info_cb(void *ctx,
3839                                          enum hostapd_hw_mode *hw_mode,
3840                                          u8 *channel)
3841 {
3842         struct wpa_supplicant *wpa_s = ctx;
3843
3844         if (wpa_s->current_bss) {
3845                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3846                                                   channel);
3847         } else if (wpa_s->hw.num_modes) {
3848                 *hw_mode = wpa_s->hw.modes[0].mode;
3849         } else {
3850                 WPA_ASSERT(0);
3851                 *hw_mode = 0;
3852         }
3853 }
3854
3855
3856 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3857 {
3858         struct wpa_supplicant *wpa_s = ctx;
3859
3860         *modes = wpa_s->hw.modes;
3861         return wpa_s->hw.num_modes;
3862 }
3863
3864
3865 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3866 {
3867         struct wpa_supplicant *wpa_s = ctx;
3868
3869         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3870         wpa_s->fst_ies = fst_ies;
3871 }
3872
3873
3874 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3875 {
3876         struct wpa_supplicant *wpa_s = ctx;
3877
3878         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3879         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3880                                           wpa_s->own_addr, wpa_s->bssid,
3881                                           wpabuf_head(data), wpabuf_len(data),
3882                                    0);
3883 }
3884
3885
3886 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3887 {
3888         struct wpa_supplicant *wpa_s = ctx;
3889
3890         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3891         return wpa_s->received_mb_ies;
3892 }
3893
3894
3895 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3896                                      const u8 *buf, size_t size)
3897 {
3898         struct wpa_supplicant *wpa_s = ctx;
3899         struct mb_ies_info info;
3900
3901         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3902
3903         if (!mb_ies_info_by_ies(&info, buf, size)) {
3904                 wpabuf_free(wpa_s->received_mb_ies);
3905                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3906         }
3907 }
3908
3909
3910 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3911                                    Boolean mb_only)
3912 {
3913         struct wpa_supplicant *wpa_s = ctx;
3914
3915         *get_ctx = NULL;
3916         if (!is_zero_ether_addr(wpa_s->bssid))
3917                 return (wpa_s->received_mb_ies || !mb_only) ?
3918                         wpa_s->bssid : NULL;
3919         return NULL;
3920 }
3921
3922
3923 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3924                                   Boolean mb_only)
3925 {
3926         return NULL;
3927 }
3928
3929 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3930                                        struct fst_wpa_obj *iface_obj)
3931 {
3932         iface_obj->ctx              = wpa_s;
3933         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3934         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3935         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3936         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3937         iface_obj->send_action      = wpas_fst_send_action_cb;
3938         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3939         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3940         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3941         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3942 }
3943 #endif /* CONFIG_FST */
3944
3945 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3946                                     const struct wpa_driver_capa *capa)
3947 {
3948         struct wowlan_triggers *triggers;
3949         int ret = 0;
3950
3951         if (!wpa_s->conf->wowlan_triggers)
3952                 return 0;
3953
3954         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3955         if (triggers) {
3956                 ret = wpa_drv_wowlan(wpa_s, triggers);
3957                 os_free(triggers);
3958         }
3959         return ret;
3960 }
3961
3962
3963 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3964 {
3965         if (freq < 3000)
3966                 return BAND_2_4_GHZ;
3967         if (freq > 50000)
3968                 return BAND_60_GHZ;
3969         return BAND_5_GHZ;
3970 }
3971
3972
3973 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3974                                    const int *freqs)
3975 {
3976         int i;
3977         unsigned int band = 0;
3978
3979         if (freqs) {
3980                 /* freqs are specified for the radio work */
3981                 for (i = 0; freqs[i]; i++)
3982                         band |= wpas_freq_to_band(freqs[i]);
3983         } else {
3984                 /*
3985                  * freqs are not specified, implies all
3986                  * the supported freqs by HW
3987                  */
3988                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3989                         if (wpa_s->hw.modes[i].num_channels != 0) {
3990                                 if (wpa_s->hw.modes[i].mode ==
3991                                     HOSTAPD_MODE_IEEE80211B ||
3992                                     wpa_s->hw.modes[i].mode ==
3993                                     HOSTAPD_MODE_IEEE80211G)
3994                                         band |= BAND_2_4_GHZ;
3995                                 else if (wpa_s->hw.modes[i].mode ==
3996                                          HOSTAPD_MODE_IEEE80211A)
3997                                         band |= BAND_5_GHZ;
3998                                 else if (wpa_s->hw.modes[i].mode ==
3999                                          HOSTAPD_MODE_IEEE80211AD)
4000                                         band |= BAND_60_GHZ;
4001                                 else if (wpa_s->hw.modes[i].mode ==
4002                                          HOSTAPD_MODE_IEEE80211ANY)
4003                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4004                                                 BAND_60_GHZ;
4005                         }
4006                 }
4007         }
4008
4009         return band;
4010 }
4011
4012
4013 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4014                                               const char *rn)
4015 {
4016         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4017         struct wpa_radio *radio;
4018
4019         while (rn && iface) {
4020                 radio = iface->radio;
4021                 if (radio && os_strcmp(rn, radio->name) == 0) {
4022                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4023                                    wpa_s->ifname, rn);
4024                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4025                         return radio;
4026                 }
4027
4028                 iface = iface->next;
4029         }
4030
4031         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4032                    wpa_s->ifname, rn ? rn : "N/A");
4033         radio = os_zalloc(sizeof(*radio));
4034         if (radio == NULL)
4035                 return NULL;
4036
4037         if (rn)
4038                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4039         dl_list_init(&radio->ifaces);
4040         dl_list_init(&radio->work);
4041         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4042
4043         return radio;
4044 }
4045
4046
4047 static void radio_work_free(struct wpa_radio_work *work)
4048 {
4049         if (work->wpa_s->scan_work == work) {
4050                 /* This should not really happen. */
4051                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4052                         work->type, work, work->started);
4053                 work->wpa_s->scan_work = NULL;
4054         }
4055
4056 #ifdef CONFIG_P2P
4057         if (work->wpa_s->p2p_scan_work == work) {
4058                 /* This should not really happen. */
4059                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4060                         work->type, work, work->started);
4061                 work->wpa_s->p2p_scan_work = NULL;
4062         }
4063 #endif /* CONFIG_P2P */
4064
4065         if (work->started) {
4066                 work->wpa_s->radio->num_active_works--;
4067                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4068                         "radio_work_free('%s'@%p: num_active_works --> %u",
4069                         work->type, work,
4070                         work->wpa_s->radio->num_active_works);
4071         }
4072
4073         dl_list_del(&work->list);
4074         os_free(work);
4075 }
4076
4077
4078 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4079 {
4080         struct wpa_radio_work *active_work = NULL;
4081         struct wpa_radio_work *tmp;
4082
4083         /* Get the active work to know the type and band. */
4084         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4085                 if (tmp->started) {
4086                         active_work = tmp;
4087                         break;
4088                 }
4089         }
4090
4091         if (!active_work) {
4092                 /* No active work, start one */
4093                 radio->num_active_works = 0;
4094                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4095                                  list) {
4096                         if (os_strcmp(tmp->type, "scan") == 0 &&
4097                             radio->external_scan_running &&
4098                             (((struct wpa_driver_scan_params *)
4099                               tmp->ctx)->only_new_results ||
4100                              tmp->wpa_s->clear_driver_scan_cache))
4101                                 continue;
4102                         return tmp;
4103                 }
4104                 return NULL;
4105         }
4106
4107         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4108             os_strcmp(active_work->type, "connect") == 0) {
4109                 /*
4110                  * If the active work is either connect or sme-connect,
4111                  * do not parallelize them with other radio works.
4112                  */
4113                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4114                         "Do not parallelize radio work with %s",
4115                         active_work->type);
4116                 return NULL;
4117         }
4118
4119         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4120                 if (tmp->started)
4121                         continue;
4122
4123                 /*
4124                  * If connect or sme-connect are enqueued, parallelize only
4125                  * those operations ahead of them in the queue.
4126                  */
4127                 if (os_strcmp(tmp->type, "connect") == 0 ||
4128                     os_strcmp(tmp->type, "sme-connect") == 0)
4129                         break;
4130
4131                 /*
4132                  * Check that the radio works are distinct and
4133                  * on different bands.
4134                  */
4135                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4136                     (active_work->bands != tmp->bands)) {
4137                         /*
4138                          * If a scan has to be scheduled through nl80211 scan
4139                          * interface and if an external scan is already running,
4140                          * do not schedule the scan since it is likely to get
4141                          * rejected by kernel.
4142                          */
4143                         if (os_strcmp(tmp->type, "scan") == 0 &&
4144                             radio->external_scan_running &&
4145                             (((struct wpa_driver_scan_params *)
4146                               tmp->ctx)->only_new_results ||
4147                              tmp->wpa_s->clear_driver_scan_cache))
4148                                 continue;
4149
4150                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4151                                 "active_work:%s new_work:%s",
4152                                 active_work->type, tmp->type);
4153                         return tmp;
4154                 }
4155         }
4156
4157         /* Did not find a radio work to schedule in parallel. */
4158         return NULL;
4159 }
4160
4161
4162 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4163 {
4164         struct wpa_radio *radio = eloop_ctx;
4165         struct wpa_radio_work *work;
4166         struct os_reltime now, diff;
4167         struct wpa_supplicant *wpa_s;
4168
4169         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4170         if (work == NULL) {
4171                 radio->num_active_works = 0;
4172                 return;
4173         }
4174
4175         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4176                               radio_list);
4177
4178         if (!(wpa_s &&
4179               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4180                 if (work->started)
4181                         return; /* already started and still in progress */
4182
4183                 if (wpa_s && wpa_s->radio->external_scan_running) {
4184                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4185                         return;
4186                 }
4187         } else {
4188                 work = NULL;
4189                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4190                         /* get the work to schedule next */
4191                         work = radio_work_get_next_work(radio);
4192                 }
4193                 if (!work)
4194                         return;
4195         }
4196
4197         wpa_s = work->wpa_s;
4198         os_get_reltime(&now);
4199         os_reltime_sub(&now, &work->time, &diff);
4200         wpa_dbg(wpa_s, MSG_DEBUG,
4201                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4202                 work->type, work, diff.sec, diff.usec);
4203         work->started = 1;
4204         work->time = now;
4205         radio->num_active_works++;
4206
4207         work->cb(work, 0);
4208
4209         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4210             radio->num_active_works < MAX_ACTIVE_WORKS)
4211                 radio_work_check_next(wpa_s);
4212 }
4213
4214
4215 /*
4216  * This function removes both started and pending radio works running on
4217  * the provided interface's radio.
4218  * Prior to the removal of the radio work, its callback (cb) is called with
4219  * deinit set to be 1. Each work's callback is responsible for clearing its
4220  * internal data and restoring to a correct state.
4221  * @wpa_s: wpa_supplicant data
4222  * @type: type of works to be removed
4223  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4224  * this interface's works.
4225  */
4226 void radio_remove_works(struct wpa_supplicant *wpa_s,
4227                         const char *type, int remove_all)
4228 {
4229         struct wpa_radio_work *work, *tmp;
4230         struct wpa_radio *radio = wpa_s->radio;
4231
4232         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4233                               list) {
4234                 if (type && os_strcmp(type, work->type) != 0)
4235                         continue;
4236
4237                 /* skip other ifaces' works */
4238                 if (!remove_all && work->wpa_s != wpa_s)
4239                         continue;
4240
4241                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4242                         work->type, work, work->started ? " (started)" : "");
4243                 work->cb(work, 1);
4244                 radio_work_free(work);
4245         }
4246
4247         /* in case we removed the started work */
4248         radio_work_check_next(wpa_s);
4249 }
4250
4251
4252 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4253 {
4254         struct wpa_radio *radio = wpa_s->radio;
4255
4256         if (!radio)
4257                 return;
4258
4259         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4260                    wpa_s->ifname, radio->name);
4261         dl_list_del(&wpa_s->radio_list);
4262         radio_remove_works(wpa_s, NULL, 0);
4263         wpa_s->radio = NULL;
4264         if (!dl_list_empty(&radio->ifaces))
4265                 return; /* Interfaces remain for this radio */
4266
4267         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4268         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4269         os_free(radio);
4270 }
4271
4272
4273 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4274 {
4275         struct wpa_radio *radio = wpa_s->radio;
4276
4277         if (dl_list_empty(&radio->work))
4278                 return;
4279         if (wpa_s->ext_work_in_progress) {
4280                 wpa_printf(MSG_DEBUG,
4281                            "External radio work in progress - delay start of pending item");
4282                 return;
4283         }
4284         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4285         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4286 }
4287
4288
4289 /**
4290  * radio_add_work - Add a radio work item
4291  * @wpa_s: Pointer to wpa_supplicant data
4292  * @freq: Frequency of the offchannel operation in MHz or 0
4293  * @type: Unique identifier for each type of work
4294  * @next: Force as the next work to be executed
4295  * @cb: Callback function for indicating when radio is available
4296  * @ctx: Context pointer for the work (work->ctx in cb())
4297  * Returns: 0 on success, -1 on failure
4298  *
4299  * This function is used to request time for an operation that requires
4300  * exclusive radio control. Once the radio is available, the registered callback
4301  * function will be called. radio_work_done() must be called once the exclusive
4302  * radio operation has been completed, so that the radio is freed for other
4303  * operations. The special case of deinit=1 is used to free the context data
4304  * during interface removal. That does not allow the callback function to start
4305  * the radio operation, i.e., it must free any resources allocated for the radio
4306  * work and return.
4307  *
4308  * The @freq parameter can be used to indicate a single channel on which the
4309  * offchannel operation will occur. This may allow multiple radio work
4310  * operations to be performed in parallel if they apply for the same channel.
4311  * Setting this to 0 indicates that the work item may use multiple channels or
4312  * requires exclusive control of the radio.
4313  */
4314 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4315                    const char *type, int next,
4316                    void (*cb)(struct wpa_radio_work *work, int deinit),
4317                    void *ctx)
4318 {
4319         struct wpa_radio *radio = wpa_s->radio;
4320         struct wpa_radio_work *work;
4321         int was_empty;
4322
4323         work = os_zalloc(sizeof(*work));
4324         if (work == NULL)
4325                 return -1;
4326         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4327         os_get_reltime(&work->time);
4328         work->freq = freq;
4329         work->type = type;
4330         work->wpa_s = wpa_s;
4331         work->cb = cb;
4332         work->ctx = ctx;
4333
4334         if (freq)
4335                 work->bands = wpas_freq_to_band(freq);
4336         else if (os_strcmp(type, "scan") == 0 ||
4337                  os_strcmp(type, "p2p-scan") == 0)
4338                 work->bands = wpas_get_bands(wpa_s,
4339                                              ((struct wpa_driver_scan_params *)
4340                                               ctx)->freqs);
4341         else
4342                 work->bands = wpas_get_bands(wpa_s, NULL);
4343
4344         was_empty = dl_list_empty(&wpa_s->radio->work);
4345         if (next)
4346                 dl_list_add(&wpa_s->radio->work, &work->list);
4347         else
4348                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4349         if (was_empty) {
4350                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4351                 radio_work_check_next(wpa_s);
4352         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4353                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4354                 wpa_dbg(wpa_s, MSG_DEBUG,
4355                         "Try to schedule a radio work (num_active_works=%u)",
4356                         radio->num_active_works);
4357                 radio_work_check_next(wpa_s);
4358         }
4359
4360         return 0;
4361 }
4362
4363
4364 /**
4365  * radio_work_done - Indicate that a radio work item has been completed
4366  * @work: Completed work
4367  *
4368  * This function is called once the callback function registered with
4369  * radio_add_work() has completed its work.
4370  */
4371 void radio_work_done(struct wpa_radio_work *work)
4372 {
4373         struct wpa_supplicant *wpa_s = work->wpa_s;
4374         struct os_reltime now, diff;
4375         unsigned int started = work->started;
4376
4377         os_get_reltime(&now);
4378         os_reltime_sub(&now, &work->time, &diff);
4379         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4380                 work->type, work, started ? "done" : "canceled",
4381                 diff.sec, diff.usec);
4382         radio_work_free(work);
4383         if (started)
4384                 radio_work_check_next(wpa_s);
4385 }
4386
4387
4388 struct wpa_radio_work *
4389 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4390 {
4391         struct wpa_radio_work *work;
4392         struct wpa_radio *radio = wpa_s->radio;
4393
4394         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4395                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4396                         return work;
4397         }
4398
4399         return NULL;
4400 }
4401
4402
4403 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4404                             struct wpa_interface *iface)
4405 {
4406         const char *ifname, *driver, *rn;
4407
4408         driver = iface->driver;
4409 next_driver:
4410         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4411                 return -1;
4412
4413         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4414         if (wpa_s->drv_priv == NULL) {
4415                 const char *pos;
4416                 pos = driver ? os_strchr(driver, ',') : NULL;
4417                 if (pos) {
4418                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4419                                 "driver interface - try next driver wrapper");
4420                         driver = pos + 1;
4421                         goto next_driver;
4422                 }
4423                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4424                         "interface");
4425                 return -1;
4426         }
4427         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4428                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4429                         "driver_param '%s'", wpa_s->conf->driver_param);
4430                 return -1;
4431         }
4432
4433         ifname = wpa_drv_get_ifname(wpa_s);
4434         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4435                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4436                         "interface name with '%s'", ifname);
4437                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4438         }
4439
4440         rn = wpa_driver_get_radio_name(wpa_s);
4441         if (rn && rn[0] == '\0')
4442                 rn = NULL;
4443
4444         wpa_s->radio = radio_add_interface(wpa_s, rn);
4445         if (wpa_s->radio == NULL)
4446                 return -1;
4447
4448         return 0;
4449 }
4450
4451
4452 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4453                                      struct wpa_interface *iface)
4454 {
4455         struct wpa_driver_capa capa;
4456         int capa_res;
4457
4458         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4459                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4460                    iface->confname ? iface->confname : "N/A",
4461                    iface->driver ? iface->driver : "default",
4462                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4463                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4464
4465         if (iface->confname) {
4466 #ifdef CONFIG_BACKEND_FILE
4467                 wpa_s->confname = os_rel2abs_path(iface->confname);
4468                 if (wpa_s->confname == NULL) {
4469                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4470                                    "for configuration file '%s'.",
4471                                    iface->confname);
4472                         return -1;
4473                 }
4474                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4475                            iface->confname, wpa_s->confname);
4476 #else /* CONFIG_BACKEND_FILE */
4477                 wpa_s->confname = os_strdup(iface->confname);
4478 #endif /* CONFIG_BACKEND_FILE */
4479                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4480                 if (wpa_s->conf == NULL) {
4481                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4482                                    "configuration '%s'.", wpa_s->confname);
4483                         return -1;
4484                 }
4485                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4486                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4487
4488                 /*
4489                  * Override ctrl_interface and driver_param if set on command
4490                  * line.
4491                  */
4492                 if (iface->ctrl_interface) {
4493                         os_free(wpa_s->conf->ctrl_interface);
4494                         wpa_s->conf->ctrl_interface =
4495                                 os_strdup(iface->ctrl_interface);
4496                 }
4497
4498                 if (iface->driver_param) {
4499                         os_free(wpa_s->conf->driver_param);
4500                         wpa_s->conf->driver_param =
4501                                 os_strdup(iface->driver_param);
4502                 }
4503
4504                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4505                         os_free(wpa_s->conf->ctrl_interface);
4506                         wpa_s->conf->ctrl_interface = NULL;
4507                 }
4508         } else
4509                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4510                                                      iface->driver_param);
4511
4512         if (wpa_s->conf == NULL) {
4513                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4514                 return -1;
4515         }
4516
4517         if (iface->ifname == NULL) {
4518                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4519                 return -1;
4520         }
4521         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4522                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4523                            iface->ifname);
4524                 return -1;
4525         }
4526         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4527
4528         if (iface->bridge_ifname) {
4529                 if (os_strlen(iface->bridge_ifname) >=
4530                     sizeof(wpa_s->bridge_ifname)) {
4531                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4532                                    "name '%s'.", iface->bridge_ifname);
4533                         return -1;
4534                 }
4535                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4536                            sizeof(wpa_s->bridge_ifname));
4537         }
4538
4539         /* RSNA Supplicant Key Management - INITIALIZE */
4540         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4541         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4542
4543         /* Initialize driver interface and register driver event handler before
4544          * L2 receive handler so that association events are processed before
4545          * EAPOL-Key packets if both become available for the same select()
4546          * call. */
4547         if (wpas_init_driver(wpa_s, iface) < 0)
4548                 return -1;
4549
4550         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4551                 return -1;
4552
4553         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4554                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4555                           NULL);
4556         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4557
4558         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4559             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4560                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4561                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4562                         "dot11RSNAConfigPMKLifetime");
4563                 return -1;
4564         }
4565
4566         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4567             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4568                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4569                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4570                         "dot11RSNAConfigPMKReauthThreshold");
4571                 return -1;
4572         }
4573
4574         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4575             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4576                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4577                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4578                         "dot11RSNAConfigSATimeout");
4579                 return -1;
4580         }
4581
4582         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4583                                                       &wpa_s->hw.num_modes,
4584                                                       &wpa_s->hw.flags);
4585         if (wpa_s->hw.modes) {
4586                 u16 i;
4587
4588                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4589                         if (wpa_s->hw.modes[i].vht_capab) {
4590                                 wpa_s->hw_capab = CAPAB_VHT;
4591                                 break;
4592                         }
4593
4594                         if (wpa_s->hw.modes[i].ht_capab &
4595                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4596                                 wpa_s->hw_capab = CAPAB_HT40;
4597                         else if (wpa_s->hw.modes[i].ht_capab &&
4598                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4599                                 wpa_s->hw_capab = CAPAB_HT;
4600                 }
4601         }
4602
4603         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4604         if (capa_res == 0) {
4605                 wpa_s->drv_capa_known = 1;
4606                 wpa_s->drv_flags = capa.flags;
4607                 wpa_s->drv_enc = capa.enc;
4608                 wpa_s->drv_smps_modes = capa.smps_modes;
4609                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4610                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4611                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4612                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4613                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4614                 wpa_s->max_sched_scan_plan_interval =
4615                         capa.max_sched_scan_plan_interval;
4616                 wpa_s->max_sched_scan_plan_iterations =
4617                         capa.max_sched_scan_plan_iterations;
4618                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4619                 wpa_s->max_match_sets = capa.max_match_sets;
4620                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4621                 wpa_s->max_stations = capa.max_stations;
4622                 wpa_s->extended_capa = capa.extended_capa;
4623                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4624                 wpa_s->extended_capa_len = capa.extended_capa_len;
4625                 wpa_s->num_multichan_concurrent =
4626                         capa.num_multichan_concurrent;
4627                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4628
4629                 if (capa.mac_addr_rand_scan_supported)
4630                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4631                 if (wpa_s->sched_scan_supported &&
4632                     capa.mac_addr_rand_sched_scan_supported)
4633                         wpa_s->mac_addr_rand_supported |=
4634                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4635         }
4636         if (wpa_s->max_remain_on_chan == 0)
4637                 wpa_s->max_remain_on_chan = 1000;
4638
4639         /*
4640          * Only take p2p_mgmt parameters when P2P Device is supported.
4641          * Doing it here as it determines whether l2_packet_init() will be done
4642          * during wpa_supplicant_driver_init().
4643          */
4644         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4645                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4646         else
4647                 iface->p2p_mgmt = 1;
4648
4649         if (wpa_s->num_multichan_concurrent == 0)
4650                 wpa_s->num_multichan_concurrent = 1;
4651
4652         if (wpa_supplicant_driver_init(wpa_s) < 0)
4653                 return -1;
4654
4655 #ifdef CONFIG_TDLS
4656         if ((!iface->p2p_mgmt ||
4657              !(wpa_s->drv_flags &
4658                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4659             wpa_tdls_init(wpa_s->wpa))
4660                 return -1;
4661 #endif /* CONFIG_TDLS */
4662
4663         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4664             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4665                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4666                 return -1;
4667         }
4668
4669 #ifdef CONFIG_FST
4670         if (wpa_s->conf->fst_group_id) {
4671                 struct fst_iface_cfg cfg;
4672                 struct fst_wpa_obj iface_obj;
4673
4674                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4675                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4676                            sizeof(cfg.group_id));
4677                 cfg.priority = wpa_s->conf->fst_priority;
4678                 cfg.llt = wpa_s->conf->fst_llt;
4679
4680                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4681                                         &iface_obj, &cfg);
4682                 if (!wpa_s->fst) {
4683                         wpa_msg(wpa_s, MSG_ERROR,
4684                                 "FST: Cannot attach iface %s to group %s",
4685                                 wpa_s->ifname, cfg.group_id);
4686                         return -1;
4687                 }
4688         }
4689 #endif /* CONFIG_FST */
4690
4691         if (wpas_wps_init(wpa_s))
4692                 return -1;
4693
4694         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4695                 return -1;
4696         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4697
4698         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4699         if (wpa_s->ctrl_iface == NULL) {
4700                 wpa_printf(MSG_ERROR,
4701                            "Failed to initialize control interface '%s'.\n"
4702                            "You may have another wpa_supplicant process "
4703                            "already running or the file was\n"
4704                            "left by an unclean termination of wpa_supplicant "
4705                            "in which case you will need\n"
4706                            "to manually remove this file before starting "
4707                            "wpa_supplicant again.\n",
4708                            wpa_s->conf->ctrl_interface);
4709                 return -1;
4710         }
4711
4712         wpa_s->gas = gas_query_init(wpa_s);
4713         if (wpa_s->gas == NULL) {
4714                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4715                 return -1;
4716         }
4717
4718         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4719                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4720                 return -1;
4721         }
4722
4723         if (wpa_bss_init(wpa_s) < 0)
4724                 return -1;
4725
4726         /*
4727          * Set Wake-on-WLAN triggers, if configured.
4728          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4729          * have effect anyway when the interface is down).
4730          */
4731         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4732                 return -1;
4733
4734 #ifdef CONFIG_EAP_PROXY
4735 {
4736         size_t len;
4737         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4738                                                      &len);
4739         if (wpa_s->mnc_len > 0) {
4740                 wpa_s->imsi[len] = '\0';
4741                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4742                            wpa_s->imsi, wpa_s->mnc_len);
4743         } else {
4744                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4745         }
4746 }
4747 #endif /* CONFIG_EAP_PROXY */
4748
4749         if (pcsc_reader_init(wpa_s) < 0)
4750                 return -1;
4751
4752         if (wpas_init_ext_pw(wpa_s) < 0)
4753                 return -1;
4754
4755         wpas_rrm_reset(wpa_s);
4756
4757         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4758
4759 #ifdef CONFIG_HS20
4760         hs20_init(wpa_s);
4761 #endif /* CONFIG_HS20 */
4762
4763         return 0;
4764 }
4765
4766
4767 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4768                                         int notify, int terminate)
4769 {
4770         struct wpa_global *global = wpa_s->global;
4771         struct wpa_supplicant *iface, *prev;
4772
4773         if (wpa_s == wpa_s->parent)
4774                 wpas_p2p_group_remove(wpa_s, "*");
4775
4776         iface = global->ifaces;
4777         while (iface) {
4778                 if (iface == wpa_s || iface->parent != wpa_s) {
4779                         iface = iface->next;
4780                         continue;
4781                 }
4782                 wpa_printf(MSG_DEBUG,
4783                            "Remove remaining child interface %s from parent %s",
4784                            iface->ifname, wpa_s->ifname);
4785                 prev = iface;
4786                 iface = iface->next;
4787                 wpa_supplicant_remove_iface(global, prev, terminate);
4788         }
4789
4790         wpa_s->disconnected = 1;
4791         if (wpa_s->drv_priv) {
4792                 wpa_supplicant_deauthenticate(wpa_s,
4793                                               WLAN_REASON_DEAUTH_LEAVING);
4794
4795                 wpa_drv_set_countermeasures(wpa_s, 0);
4796                 wpa_clear_keys(wpa_s, NULL);
4797         }
4798
4799         wpa_supplicant_cleanup(wpa_s);
4800         wpas_p2p_deinit_iface(wpa_s);
4801
4802         wpas_ctrl_radio_work_flush(wpa_s);
4803         radio_remove_interface(wpa_s);
4804
4805 #ifdef CONFIG_FST
4806         if (wpa_s->fst) {
4807                 fst_detach(wpa_s->fst);
4808                 wpa_s->fst = NULL;
4809         }
4810         if (wpa_s->received_mb_ies) {
4811                 wpabuf_free(wpa_s->received_mb_ies);
4812                 wpa_s->received_mb_ies = NULL;
4813         }
4814 #endif /* CONFIG_FST */
4815
4816         if (wpa_s->drv_priv)
4817                 wpa_drv_deinit(wpa_s);
4818
4819         if (notify)
4820                 wpas_notify_iface_removed(wpa_s);
4821
4822         if (terminate)
4823                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4824
4825         if (wpa_s->ctrl_iface) {
4826                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4827                 wpa_s->ctrl_iface = NULL;
4828         }
4829
4830 #ifdef CONFIG_MESH
4831         if (wpa_s->ifmsh) {
4832                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4833                 wpa_s->ifmsh = NULL;
4834         }
4835 #endif /* CONFIG_MESH */
4836
4837         if (wpa_s->conf != NULL) {
4838                 wpa_config_free(wpa_s->conf);
4839                 wpa_s->conf = NULL;
4840         }
4841
4842         os_free(wpa_s->ssids_from_scan_req);
4843
4844         os_free(wpa_s);
4845 }
4846
4847
4848 /**
4849  * wpa_supplicant_add_iface - Add a new network interface
4850  * @global: Pointer to global data from wpa_supplicant_init()
4851  * @iface: Interface configuration options
4852  * @parent: Parent interface or %NULL to assign new interface as parent
4853  * Returns: Pointer to the created interface or %NULL on failure
4854  *
4855  * This function is used to add new network interfaces for %wpa_supplicant.
4856  * This can be called before wpa_supplicant_run() to add interfaces before the
4857  * main event loop has been started. In addition, new interfaces can be added
4858  * dynamically while %wpa_supplicant is already running. This could happen,
4859  * e.g., when a hotplug network adapter is inserted.
4860  */
4861 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4862                                                  struct wpa_interface *iface,
4863                                                  struct wpa_supplicant *parent)
4864 {
4865         struct wpa_supplicant *wpa_s;
4866         struct wpa_interface t_iface;
4867         struct wpa_ssid *ssid;
4868
4869         if (global == NULL || iface == NULL)
4870                 return NULL;
4871
4872         wpa_s = wpa_supplicant_alloc(parent);
4873         if (wpa_s == NULL)
4874                 return NULL;
4875
4876         wpa_s->global = global;
4877
4878         t_iface = *iface;
4879         if (global->params.override_driver) {
4880                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4881                            "('%s' -> '%s')",
4882                            iface->driver, global->params.override_driver);
4883                 t_iface.driver = global->params.override_driver;
4884         }
4885         if (global->params.override_ctrl_interface) {
4886                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4887                            "ctrl_interface ('%s' -> '%s')",
4888                            iface->ctrl_interface,
4889                            global->params.override_ctrl_interface);
4890                 t_iface.ctrl_interface =
4891                         global->params.override_ctrl_interface;
4892         }
4893         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4894                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4895                            iface->ifname);
4896                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4897                 return NULL;
4898         }
4899
4900         if (iface->p2p_mgmt == 0) {
4901                 /* Notify the control interfaces about new iface */
4902                 if (wpas_notify_iface_added(wpa_s)) {
4903                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4904                         return NULL;
4905                 }
4906
4907                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4908                         wpas_notify_network_added(wpa_s, ssid);
4909         }
4910
4911         wpa_s->next = global->ifaces;
4912         global->ifaces = wpa_s;
4913
4914         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4915         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4916
4917 #ifdef CONFIG_P2P
4918         if (wpa_s->global->p2p == NULL &&
4919             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4920             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4921             wpas_p2p_add_p2pdev_interface(
4922                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4923                 wpa_printf(MSG_INFO,
4924                            "P2P: Failed to enable P2P Device interface");
4925                 /* Try to continue without. P2P will be disabled. */
4926         }
4927 #endif /* CONFIG_P2P */
4928
4929         return wpa_s;
4930 }
4931
4932
4933 /**
4934  * wpa_supplicant_remove_iface - Remove a network interface
4935  * @global: Pointer to global data from wpa_supplicant_init()
4936  * @wpa_s: Pointer to the network interface to be removed
4937  * Returns: 0 if interface was removed, -1 if interface was not found
4938  *
4939  * This function can be used to dynamically remove network interfaces from
4940  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4941  * addition, this function is used to remove all remaining interfaces when
4942  * %wpa_supplicant is terminated.
4943  */
4944 int wpa_supplicant_remove_iface(struct wpa_global *global,
4945                                 struct wpa_supplicant *wpa_s,
4946                                 int terminate)
4947 {
4948         struct wpa_supplicant *prev;
4949 #ifdef CONFIG_MESH
4950         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4951         char *ifname = NULL;
4952 #endif /* CONFIG_MESH */
4953
4954         /* Remove interface from the global list of interfaces */
4955         prev = global->ifaces;
4956         if (prev == wpa_s) {
4957                 global->ifaces = wpa_s->next;
4958         } else {
4959                 while (prev && prev->next != wpa_s)
4960                         prev = prev->next;
4961                 if (prev == NULL)
4962                         return -1;
4963                 prev->next = wpa_s->next;
4964         }
4965
4966         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4967
4968 #ifdef CONFIG_MESH
4969         if (mesh_if_created) {
4970                 ifname = os_strdup(wpa_s->ifname);
4971                 if (ifname == NULL) {
4972                         wpa_dbg(wpa_s, MSG_ERROR,
4973                                 "mesh: Failed to malloc ifname");
4974                         return -1;
4975                 }
4976         }
4977 #endif /* CONFIG_MESH */
4978
4979         if (global->p2p_group_formation == wpa_s)
4980                 global->p2p_group_formation = NULL;
4981         if (global->p2p_invite_group == wpa_s)
4982                 global->p2p_invite_group = NULL;
4983         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4984
4985 #ifdef CONFIG_MESH
4986         if (mesh_if_created) {
4987                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4988                 os_free(ifname);
4989         }
4990 #endif /* CONFIG_MESH */
4991
4992         return 0;
4993 }
4994
4995
4996 /**
4997  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4998  * @wpa_s: Pointer to the network interface
4999  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5000  */
5001 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5002 {
5003         const char *eapol_method;
5004
5005         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5006             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5007                 return "NO-EAP";
5008         }
5009
5010         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5011         if (eapol_method == NULL)
5012                 return "UNKNOWN-EAP";
5013
5014         return eapol_method;
5015 }
5016
5017
5018 /**
5019  * wpa_supplicant_get_iface - Get a new network interface
5020  * @global: Pointer to global data from wpa_supplicant_init()
5021  * @ifname: Interface name
5022  * Returns: Pointer to the interface or %NULL if not found
5023  */
5024 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5025                                                  const char *ifname)
5026 {
5027         struct wpa_supplicant *wpa_s;
5028
5029         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5030                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5031                         return wpa_s;
5032         }
5033         return NULL;
5034 }
5035
5036
5037 #ifndef CONFIG_NO_WPA_MSG
5038 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5039 {
5040         struct wpa_supplicant *wpa_s = ctx;
5041         if (wpa_s == NULL)
5042                 return NULL;
5043         return wpa_s->ifname;
5044 }
5045 #endif /* CONFIG_NO_WPA_MSG */
5046
5047
5048 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5049 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5050 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5051
5052 /* Periodic cleanup tasks */
5053 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5054 {
5055         struct wpa_global *global = eloop_ctx;
5056         struct wpa_supplicant *wpa_s;
5057
5058         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5059                                wpas_periodic, global, NULL);
5060
5061 #ifdef CONFIG_P2P
5062         if (global->p2p)
5063                 p2p_expire_peers(global->p2p);
5064 #endif /* CONFIG_P2P */
5065
5066         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5067                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5068 #ifdef CONFIG_AP
5069                 ap_periodic(wpa_s);
5070 #endif /* CONFIG_AP */
5071         }
5072 }
5073
5074
5075 /**
5076  * wpa_supplicant_init - Initialize %wpa_supplicant
5077  * @params: Parameters for %wpa_supplicant
5078  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5079  *
5080  * This function is used to initialize %wpa_supplicant. After successful
5081  * initialization, the returned data pointer can be used to add and remove
5082  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5083  */
5084 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5085 {
5086         struct wpa_global *global;
5087         int ret, i;
5088
5089         if (params == NULL)
5090                 return NULL;
5091
5092 #ifdef CONFIG_DRIVER_NDIS
5093         {
5094                 void driver_ndis_init_ops(void);
5095                 driver_ndis_init_ops();
5096         }
5097 #endif /* CONFIG_DRIVER_NDIS */
5098
5099 #ifndef CONFIG_NO_WPA_MSG
5100         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5101 #endif /* CONFIG_NO_WPA_MSG */
5102
5103         if (params->wpa_debug_file_path)
5104                 wpa_debug_open_file(params->wpa_debug_file_path);
5105         else
5106                 wpa_debug_setup_stdout();
5107         if (params->wpa_debug_syslog)
5108                 wpa_debug_open_syslog();
5109         if (params->wpa_debug_tracing) {
5110                 ret = wpa_debug_open_linux_tracing();
5111                 if (ret) {
5112                         wpa_printf(MSG_ERROR,
5113                                    "Failed to enable trace logging");
5114                         return NULL;
5115                 }
5116         }
5117
5118         ret = eap_register_methods();
5119         if (ret) {
5120                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5121                 if (ret == -2)
5122                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5123                                    "the same EAP type.");
5124                 return NULL;
5125         }
5126
5127         global = os_zalloc(sizeof(*global));
5128         if (global == NULL)
5129                 return NULL;
5130         dl_list_init(&global->p2p_srv_bonjour);
5131         dl_list_init(&global->p2p_srv_upnp);
5132         global->params.daemonize = params->daemonize;
5133         global->params.wait_for_monitor = params->wait_for_monitor;
5134         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5135         if (params->pid_file)
5136                 global->params.pid_file = os_strdup(params->pid_file);
5137         if (params->ctrl_interface)
5138                 global->params.ctrl_interface =
5139                         os_strdup(params->ctrl_interface);
5140         if (params->ctrl_interface_group)
5141                 global->params.ctrl_interface_group =
5142                         os_strdup(params->ctrl_interface_group);
5143         if (params->override_driver)
5144                 global->params.override_driver =
5145                         os_strdup(params->override_driver);
5146         if (params->override_ctrl_interface)
5147                 global->params.override_ctrl_interface =
5148                         os_strdup(params->override_ctrl_interface);
5149 #ifdef CONFIG_P2P
5150         if (params->conf_p2p_dev)
5151                 global->params.conf_p2p_dev =
5152                         os_strdup(params->conf_p2p_dev);
5153 #endif /* CONFIG_P2P */
5154         wpa_debug_level = global->params.wpa_debug_level =
5155                 params->wpa_debug_level;
5156         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5157                 params->wpa_debug_show_keys;
5158         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5159                 params->wpa_debug_timestamp;
5160
5161         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5162
5163         if (eloop_init()) {
5164                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5165                 wpa_supplicant_deinit(global);
5166                 return NULL;
5167         }
5168
5169         random_init(params->entropy_file);
5170
5171         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5172         if (global->ctrl_iface == NULL) {
5173                 wpa_supplicant_deinit(global);
5174                 return NULL;
5175         }
5176
5177         if (wpas_notify_supplicant_initialized(global)) {
5178                 wpa_supplicant_deinit(global);
5179                 return NULL;
5180         }
5181
5182         for (i = 0; wpa_drivers[i]; i++)
5183                 global->drv_count++;
5184         if (global->drv_count == 0) {
5185                 wpa_printf(MSG_ERROR, "No drivers enabled");
5186                 wpa_supplicant_deinit(global);
5187                 return NULL;
5188         }
5189         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5190         if (global->drv_priv == NULL) {
5191                 wpa_supplicant_deinit(global);
5192                 return NULL;
5193         }
5194
5195 #ifdef CONFIG_WIFI_DISPLAY
5196         if (wifi_display_init(global) < 0) {
5197                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5198                 wpa_supplicant_deinit(global);
5199                 return NULL;
5200         }
5201 #endif /* CONFIG_WIFI_DISPLAY */
5202
5203         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5204                                wpas_periodic, global, NULL);
5205
5206         return global;
5207 }
5208
5209
5210 /**
5211  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5212  * @global: Pointer to global data from wpa_supplicant_init()
5213  * Returns: 0 after successful event loop run, -1 on failure
5214  *
5215  * This function starts the main event loop and continues running as long as
5216  * there are any remaining events. In most cases, this function is running as
5217  * long as the %wpa_supplicant process in still in use.
5218  */
5219 int wpa_supplicant_run(struct wpa_global *global)
5220 {
5221         struct wpa_supplicant *wpa_s;
5222
5223         if (global->params.daemonize &&
5224             wpa_supplicant_daemon(global->params.pid_file))
5225                 return -1;
5226
5227         if (global->params.wait_for_monitor) {
5228                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5229                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5230                                 wpa_supplicant_ctrl_iface_wait(
5231                                         wpa_s->ctrl_iface);
5232         }
5233
5234         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5235         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5236
5237         eloop_run();
5238
5239         return 0;
5240 }
5241
5242
5243 /**
5244  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5245  * @global: Pointer to global data from wpa_supplicant_init()
5246  *
5247  * This function is called to deinitialize %wpa_supplicant and to free all
5248  * allocated resources. Remaining network interfaces will also be removed.
5249  */
5250 void wpa_supplicant_deinit(struct wpa_global *global)
5251 {
5252         int i;
5253
5254         if (global == NULL)
5255                 return;
5256
5257         eloop_cancel_timeout(wpas_periodic, global, NULL);
5258
5259 #ifdef CONFIG_WIFI_DISPLAY
5260         wifi_display_deinit(global);
5261 #endif /* CONFIG_WIFI_DISPLAY */
5262
5263         while (global->ifaces)
5264                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5265
5266         if (global->ctrl_iface)
5267                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5268
5269         wpas_notify_supplicant_deinitialized(global);
5270
5271         eap_peer_unregister_methods();
5272 #ifdef CONFIG_AP
5273         eap_server_unregister_methods();
5274 #endif /* CONFIG_AP */
5275
5276         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5277                 if (!global->drv_priv[i])
5278                         continue;
5279                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5280         }
5281         os_free(global->drv_priv);
5282
5283         random_deinit();
5284
5285         eloop_destroy();
5286
5287         if (global->params.pid_file) {
5288                 os_daemonize_terminate(global->params.pid_file);
5289                 os_free(global->params.pid_file);
5290         }
5291         os_free(global->params.ctrl_interface);
5292         os_free(global->params.ctrl_interface_group);
5293         os_free(global->params.override_driver);
5294         os_free(global->params.override_ctrl_interface);
5295 #ifdef CONFIG_P2P
5296         os_free(global->params.conf_p2p_dev);
5297 #endif /* CONFIG_P2P */
5298
5299         os_free(global->p2p_disallow_freq.range);
5300         os_free(global->p2p_go_avoid_freq.range);
5301         os_free(global->add_psk);
5302
5303         os_free(global);
5304         wpa_debug_close_syslog();
5305         wpa_debug_close_file();
5306         wpa_debug_close_linux_tracing();
5307 }
5308
5309
5310 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5311 {
5312         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5313             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5314                 char country[3];
5315                 country[0] = wpa_s->conf->country[0];
5316                 country[1] = wpa_s->conf->country[1];
5317                 country[2] = '\0';
5318                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5319                         wpa_printf(MSG_ERROR, "Failed to set country code "
5320                                    "'%s'", country);
5321                 }
5322         }
5323
5324         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5325                 wpas_init_ext_pw(wpa_s);
5326
5327         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5328                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5329
5330 #ifdef CONFIG_WPS
5331         wpas_wps_update_config(wpa_s);
5332 #endif /* CONFIG_WPS */
5333         wpas_p2p_update_config(wpa_s);
5334         wpa_s->conf->changed_parameters = 0;
5335 }
5336
5337
5338 void add_freq(int *freqs, int *num_freqs, int freq)
5339 {
5340         int i;
5341
5342         for (i = 0; i < *num_freqs; i++) {
5343                 if (freqs[i] == freq)
5344                         return;
5345         }
5346
5347         freqs[*num_freqs] = freq;
5348         (*num_freqs)++;
5349 }
5350
5351
5352 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5353 {
5354         struct wpa_bss *bss, *cbss;
5355         const int max_freqs = 10;
5356         int *freqs;
5357         int num_freqs = 0;
5358
5359         freqs = os_calloc(max_freqs + 1, sizeof(int));
5360         if (freqs == NULL)
5361                 return NULL;
5362
5363         cbss = wpa_s->current_bss;
5364
5365         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5366                 if (bss == cbss)
5367                         continue;
5368                 if (bss->ssid_len == cbss->ssid_len &&
5369                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5370                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5371                         add_freq(freqs, &num_freqs, bss->freq);
5372                         if (num_freqs == max_freqs)
5373                                 break;
5374                 }
5375         }
5376
5377         if (num_freqs == 0) {
5378                 os_free(freqs);
5379                 freqs = NULL;
5380         }
5381
5382         return freqs;
5383 }
5384
5385
5386 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5387 {
5388         int timeout;
5389         int count;
5390         int *freqs = NULL;
5391
5392         wpas_connect_work_done(wpa_s);
5393
5394         /*
5395          * Remove possible authentication timeout since the connection failed.
5396          */
5397         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5398
5399         /*
5400          * There is no point in blacklisting the AP if this event is
5401          * generated based on local request to disconnect.
5402          */
5403         if (wpa_s->own_disconnect_req) {
5404                 wpa_s->own_disconnect_req = 0;
5405                 wpa_dbg(wpa_s, MSG_DEBUG,
5406                         "Ignore connection failure due to local request to disconnect");
5407                 return;
5408         }
5409         if (wpa_s->disconnected) {
5410                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5411                         "indication since interface has been put into "
5412                         "disconnected state");
5413                 return;
5414         }
5415
5416         /*
5417          * Add the failed BSSID into the blacklist and speed up next scan
5418          * attempt if there could be other APs that could accept association.
5419          * The current blacklist count indicates how many times we have tried
5420          * connecting to this AP and multiple attempts mean that other APs are
5421          * either not available or has already been tried, so that we can start
5422          * increasing the delay here to avoid constant scanning.
5423          */
5424         count = wpa_blacklist_add(wpa_s, bssid);
5425         if (count == 1 && wpa_s->current_bss) {
5426                 /*
5427                  * This BSS was not in the blacklist before. If there is
5428                  * another BSS available for the same ESS, we should try that
5429                  * next. Otherwise, we may as well try this one once more
5430                  * before allowing other, likely worse, ESSes to be considered.
5431                  */
5432                 freqs = get_bss_freqs_in_ess(wpa_s);
5433                 if (freqs) {
5434                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5435                                 "has been seen; try it next");
5436                         wpa_blacklist_add(wpa_s, bssid);
5437                         /*
5438                          * On the next scan, go through only the known channels
5439                          * used in this ESS based on previous scans to speed up
5440                          * common load balancing use case.
5441                          */
5442                         os_free(wpa_s->next_scan_freqs);
5443                         wpa_s->next_scan_freqs = freqs;
5444                 }
5445         }
5446
5447         /*
5448          * Add previous failure count in case the temporary blacklist was
5449          * cleared due to no other BSSes being available.
5450          */
5451         count += wpa_s->extra_blacklist_count;
5452
5453         if (count > 3 && wpa_s->current_ssid) {
5454                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5455                            "consider temporary network disabling");
5456                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5457         }
5458
5459         switch (count) {
5460         case 1:
5461                 timeout = 100;
5462                 break;
5463         case 2:
5464                 timeout = 500;
5465                 break;
5466         case 3:
5467                 timeout = 1000;
5468                 break;
5469         case 4:
5470                 timeout = 5000;
5471                 break;
5472         default:
5473                 timeout = 10000;
5474                 break;
5475         }
5476
5477         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5478                 "ms", count, timeout);
5479
5480         /*
5481          * TODO: if more than one possible AP is available in scan results,
5482          * could try the other ones before requesting a new scan.
5483          */
5484         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5485                                 1000 * (timeout % 1000));
5486 }
5487
5488
5489 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5490 {
5491         return wpa_s->conf->ap_scan == 2 ||
5492                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5493 }
5494
5495
5496 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5497 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5498                                               struct wpa_ssid *ssid,
5499                                               const char *field,
5500                                               const char *value)
5501 {
5502 #ifdef IEEE8021X_EAPOL
5503         struct eap_peer_config *eap = &ssid->eap;
5504
5505         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5506         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5507                               (const u8 *) value, os_strlen(value));
5508
5509         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5510         case WPA_CTRL_REQ_EAP_IDENTITY:
5511                 os_free(eap->identity);
5512                 eap->identity = (u8 *) os_strdup(value);
5513                 eap->identity_len = os_strlen(value);
5514                 eap->pending_req_identity = 0;
5515                 if (ssid == wpa_s->current_ssid)
5516                         wpa_s->reassociate = 1;
5517                 break;
5518         case WPA_CTRL_REQ_EAP_PASSWORD:
5519                 bin_clear_free(eap->password, eap->password_len);
5520                 eap->password = (u8 *) os_strdup(value);
5521                 eap->password_len = os_strlen(value);
5522                 eap->pending_req_password = 0;
5523                 if (ssid == wpa_s->current_ssid)
5524                         wpa_s->reassociate = 1;
5525                 break;
5526         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5527                 bin_clear_free(eap->new_password, eap->new_password_len);
5528                 eap->new_password = (u8 *) os_strdup(value);
5529                 eap->new_password_len = os_strlen(value);
5530                 eap->pending_req_new_password = 0;
5531                 if (ssid == wpa_s->current_ssid)
5532                         wpa_s->reassociate = 1;
5533                 break;
5534         case WPA_CTRL_REQ_EAP_PIN:
5535                 str_clear_free(eap->pin);
5536                 eap->pin = os_strdup(value);
5537                 eap->pending_req_pin = 0;
5538                 if (ssid == wpa_s->current_ssid)
5539                         wpa_s->reassociate = 1;
5540                 break;
5541         case WPA_CTRL_REQ_EAP_OTP:
5542                 bin_clear_free(eap->otp, eap->otp_len);
5543                 eap->otp = (u8 *) os_strdup(value);
5544                 eap->otp_len = os_strlen(value);
5545                 os_free(eap->pending_req_otp);
5546                 eap->pending_req_otp = NULL;
5547                 eap->pending_req_otp_len = 0;
5548                 break;
5549         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5550                 str_clear_free(eap->private_key_passwd);
5551                 eap->private_key_passwd = os_strdup(value);
5552                 eap->pending_req_passphrase = 0;
5553                 if (ssid == wpa_s->current_ssid)
5554                         wpa_s->reassociate = 1;
5555                 break;
5556         case WPA_CTRL_REQ_SIM:
5557                 str_clear_free(eap->external_sim_resp);
5558                 eap->external_sim_resp = os_strdup(value);
5559                 break;
5560         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5561                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5562                         return -1;
5563                 ssid->mem_only_psk = 1;
5564                 if (ssid->passphrase)
5565                         wpa_config_update_psk(ssid);
5566                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5567                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5568                 break;
5569         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5570                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5571                         return -1;
5572                 if (os_strcmp(value, "good") == 0)
5573                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5574                 else if (os_strcmp(value, "bad") == 0)
5575                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5576                 else
5577                         return -1;
5578                 break;
5579         default:
5580                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5581                 return -1;
5582         }
5583
5584         return 0;
5585 #else /* IEEE8021X_EAPOL */
5586         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5587         return -1;
5588 #endif /* IEEE8021X_EAPOL */
5589 }
5590 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5591
5592
5593 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5594 {
5595         int i;
5596         unsigned int drv_enc;
5597
5598         if (wpa_s->p2p_mgmt)
5599                 return 1; /* no normal network profiles on p2p_mgmt interface */
5600
5601         if (ssid == NULL)
5602                 return 1;
5603
5604         if (ssid->disabled)
5605                 return 1;
5606
5607         if (wpa_s->drv_capa_known)
5608                 drv_enc = wpa_s->drv_enc;
5609         else
5610                 drv_enc = (unsigned int) -1;
5611
5612         for (i = 0; i < NUM_WEP_KEYS; i++) {
5613                 size_t len = ssid->wep_key_len[i];
5614                 if (len == 0)
5615                         continue;
5616                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5617                         continue;
5618                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5619                         continue;
5620                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5621                         continue;
5622                 return 1; /* invalid WEP key */
5623         }
5624
5625         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5626             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5627             !ssid->mem_only_psk)
5628                 return 1;
5629
5630         return 0;
5631 }
5632
5633
5634 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5635 {
5636 #ifdef CONFIG_IEEE80211W
5637         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5638                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5639                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5640                         /*
5641                          * Driver does not support BIP -- ignore pmf=1 default
5642                          * since the connection with PMF would fail and the
5643                          * configuration does not require PMF to be enabled.
5644                          */
5645                         return NO_MGMT_FRAME_PROTECTION;
5646                 }
5647
5648                 return wpa_s->conf->pmf;
5649         }
5650
5651         return ssid->ieee80211w;
5652 #else /* CONFIG_IEEE80211W */
5653         return NO_MGMT_FRAME_PROTECTION;
5654 #endif /* CONFIG_IEEE80211W */
5655 }
5656
5657
5658 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5659 {
5660         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5661                 return 1;
5662         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5663                 return 0;
5664         return -1;
5665 }
5666
5667
5668 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5669 {
5670         struct wpa_ssid *ssid = wpa_s->current_ssid;
5671         int dur;
5672         struct os_reltime now;
5673
5674         if (ssid == NULL) {
5675                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5676                            "SSID block");
5677                 return;
5678         }
5679
5680         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5681                 return;
5682
5683         ssid->auth_failures++;
5684
5685 #ifdef CONFIG_P2P
5686         if (ssid->p2p_group &&
5687             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5688                 /*
5689                  * Skip the wait time since there is a short timeout on the
5690                  * connection to a P2P group.
5691                  */
5692                 return;
5693         }
5694 #endif /* CONFIG_P2P */
5695
5696         if (ssid->auth_failures > 50)
5697                 dur = 300;
5698         else if (ssid->auth_failures > 10)
5699                 dur = 120;
5700         else if (ssid->auth_failures > 5)
5701                 dur = 90;
5702         else if (ssid->auth_failures > 3)
5703                 dur = 60;
5704         else if (ssid->auth_failures > 2)
5705                 dur = 30;
5706         else if (ssid->auth_failures > 1)
5707                 dur = 20;
5708         else
5709                 dur = 10;
5710
5711         if (ssid->auth_failures > 1 &&
5712             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5713                 dur += os_random() % (ssid->auth_failures * 10);
5714
5715         os_get_reltime(&now);
5716         if (now.sec + dur <= ssid->disabled_until.sec)
5717                 return;
5718
5719         ssid->disabled_until.sec = now.sec + dur;
5720
5721         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5722                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5723                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5724                 ssid->auth_failures, dur, reason);
5725 }
5726
5727
5728 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5729                               struct wpa_ssid *ssid, int clear_failures)
5730 {
5731         if (ssid == NULL)
5732                 return;
5733
5734         if (ssid->disabled_until.sec) {
5735                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5736                         "id=%d ssid=\"%s\"",
5737                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5738         }
5739         ssid->disabled_until.sec = 0;
5740         ssid->disabled_until.usec = 0;
5741         if (clear_failures)
5742                 ssid->auth_failures = 0;
5743 }
5744
5745
5746 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5747 {
5748         size_t i;
5749
5750         if (wpa_s->disallow_aps_bssid == NULL)
5751                 return 0;
5752
5753         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5754                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5755                               bssid, ETH_ALEN) == 0)
5756                         return 1;
5757         }
5758
5759         return 0;
5760 }
5761
5762
5763 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5764                     size_t ssid_len)
5765 {
5766         size_t i;
5767
5768         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5769                 return 0;
5770
5771         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5772                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5773                 if (ssid_len == s->ssid_len &&
5774                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5775                         return 1;
5776         }
5777
5778         return 0;
5779 }
5780
5781
5782 /**
5783  * wpas_request_connection - Request a new connection
5784  * @wpa_s: Pointer to the network interface
5785  *
5786  * This function is used to request a new connection to be found. It will mark
5787  * the interface to allow reassociation and request a new scan to find a
5788  * suitable network to connect to.
5789  */
5790 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5791 {
5792         wpa_s->normal_scans = 0;
5793         wpa_s->scan_req = NORMAL_SCAN_REQ;
5794         wpa_supplicant_reinit_autoscan(wpa_s);
5795         wpa_s->extra_blacklist_count = 0;
5796         wpa_s->disconnected = 0;
5797         wpa_s->reassociate = 1;
5798
5799         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5800                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5801         else
5802                 wpa_s->reattach = 0;
5803 }
5804
5805
5806 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5807                     struct wpa_used_freq_data *freqs_data,
5808                     unsigned int len)
5809 {
5810         unsigned int i;
5811
5812         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5813                 len, title);
5814         for (i = 0; i < len; i++) {
5815                 struct wpa_used_freq_data *cur = &freqs_data[i];
5816                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5817                         i, cur->freq, cur->flags);
5818         }
5819 }
5820
5821
5822 /*
5823  * Find the operating frequencies of any of the virtual interfaces that
5824  * are using the same radio as the current interface, and in addition, get
5825  * information about the interface types that are using the frequency.
5826  */
5827 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5828                                 struct wpa_used_freq_data *freqs_data,
5829                                 unsigned int len)
5830 {
5831         struct wpa_supplicant *ifs;
5832         u8 bssid[ETH_ALEN];
5833         int freq;
5834         unsigned int idx = 0, i;
5835
5836         wpa_dbg(wpa_s, MSG_DEBUG,
5837                 "Determining shared radio frequencies (max len %u)", len);
5838         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5839
5840         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5841                          radio_list) {
5842                 if (idx == len)
5843                         break;
5844
5845                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5846                         continue;
5847
5848                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5849                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5850                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5851                         freq = ifs->current_ssid->frequency;
5852                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5853                         freq = ifs->assoc_freq;
5854                 else
5855                         continue;
5856
5857                 /* Hold only distinct freqs */
5858                 for (i = 0; i < idx; i++)
5859                         if (freqs_data[i].freq == freq)
5860                                 break;
5861
5862                 if (i == idx)
5863                         freqs_data[idx++].freq = freq;
5864
5865                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5866                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5867                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5868                                 WPA_FREQ_USED_BY_INFRA_STATION;
5869                 }
5870         }
5871
5872         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5873         return idx;
5874 }
5875
5876
5877 /*
5878  * Find the operating frequencies of any of the virtual interfaces that
5879  * are using the same radio as the current interface.
5880  */
5881 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5882                            int *freq_array, unsigned int len)
5883 {
5884         struct wpa_used_freq_data *freqs_data;
5885         int num, i;
5886
5887         os_memset(freq_array, 0, sizeof(int) * len);
5888
5889         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5890         if (!freqs_data)
5891                 return -1;
5892
5893         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5894         for (i = 0; i < num; i++)
5895                 freq_array[i] = freqs_data[i].freq;
5896
5897         os_free(freqs_data);
5898
5899         return num;
5900 }
5901
5902
5903 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5904 {
5905         struct rrm_data *rrm = data;
5906
5907         if (!rrm->notify_neighbor_rep) {
5908                 wpa_printf(MSG_ERROR,
5909                            "RRM: Unexpected neighbor report timeout");
5910                 return;
5911         }
5912
5913         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5914         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5915
5916         rrm->notify_neighbor_rep = NULL;
5917         rrm->neighbor_rep_cb_ctx = NULL;
5918 }
5919
5920
5921 /*
5922  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5923  * @wpa_s: Pointer to wpa_supplicant
5924  */
5925 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5926 {
5927         wpa_s->rrm.rrm_used = 0;
5928
5929         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5930                              NULL);
5931         if (wpa_s->rrm.notify_neighbor_rep)
5932                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5933         wpa_s->rrm.next_neighbor_rep_token = 1;
5934 }
5935
5936
5937 /*
5938  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5939  * @wpa_s: Pointer to wpa_supplicant
5940  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5941  * @report_len: Length of neighbor report buffer
5942  */
5943 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5944                                    const u8 *report, size_t report_len)
5945 {
5946         struct wpabuf *neighbor_rep;
5947
5948         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5949         if (report_len < 1)
5950                 return;
5951
5952         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5953                 wpa_printf(MSG_DEBUG,
5954                            "RRM: Discarding neighbor report with token %d (expected %d)",
5955                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5956                 return;
5957         }
5958
5959         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5960                              NULL);
5961
5962         if (!wpa_s->rrm.notify_neighbor_rep) {
5963                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5964                 return;
5965         }
5966
5967         /* skipping the first byte, which is only an id (dialog token) */
5968         neighbor_rep = wpabuf_alloc(report_len - 1);
5969         if (neighbor_rep == NULL)
5970                 return;
5971         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5972         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5973                    report[0]);
5974         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5975                                        neighbor_rep);
5976         wpa_s->rrm.notify_neighbor_rep = NULL;
5977         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5978 }
5979
5980
5981 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5982 /* Workaround different, undefined for Windows, error codes used here */
5983 #define ENOTCONN -1
5984 #define EOPNOTSUPP -1
5985 #define ECANCELED -1
5986 #endif
5987
5988 /**
5989  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5990  * @wpa_s: Pointer to wpa_supplicant
5991  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5992  *        is sent in the request.
5993  * @cb: Callback function to be called once the requested report arrives, or
5994  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5995  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5996  *      the requester's responsibility to free it.
5997  *      In the latter case NULL will be sent in 'neighbor_rep'.
5998  * @cb_ctx: Context value to send the callback function
5999  * Returns: 0 in case of success, negative error code otherwise
6000  *
6001  * In case there is a previous request which has not been answered yet, the
6002  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6003  * Request must contain a callback function.
6004  */
6005 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6006                                        const struct wpa_ssid *ssid,
6007                                        void (*cb)(void *ctx,
6008                                                   struct wpabuf *neighbor_rep),
6009                                        void *cb_ctx)
6010 {
6011         struct wpabuf *buf;
6012         const u8 *rrm_ie;
6013
6014         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6015                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6016                 return -ENOTCONN;
6017         }
6018
6019         if (!wpa_s->rrm.rrm_used) {
6020                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6021                 return -EOPNOTSUPP;
6022         }
6023
6024         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6025                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6026         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6027             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6028                 wpa_printf(MSG_DEBUG,
6029                            "RRM: No network support for Neighbor Report.");
6030                 return -EOPNOTSUPP;
6031         }
6032
6033         if (!cb) {
6034                 wpa_printf(MSG_DEBUG,
6035                            "RRM: Neighbor Report request must provide a callback.");
6036                 return -EINVAL;
6037         }
6038
6039         /* Refuse if there's a live request */
6040         if (wpa_s->rrm.notify_neighbor_rep) {
6041                 wpa_printf(MSG_DEBUG,
6042                            "RRM: Currently handling previous Neighbor Report.");
6043                 return -EBUSY;
6044         }
6045
6046         /* 3 = action category + action code + dialog token */
6047         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6048         if (buf == NULL) {
6049                 wpa_printf(MSG_DEBUG,
6050                            "RRM: Failed to allocate Neighbor Report Request");
6051                 return -ENOMEM;
6052         }
6053
6054         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6055                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6056                    wpa_s->rrm.next_neighbor_rep_token);
6057
6058         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6059         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6060         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6061         if (ssid) {
6062                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6063                 wpabuf_put_u8(buf, ssid->ssid_len);
6064                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6065         }
6066
6067         wpa_s->rrm.next_neighbor_rep_token++;
6068
6069         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6070                                 wpa_s->own_addr, wpa_s->bssid,
6071                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6072                 wpa_printf(MSG_DEBUG,
6073                            "RRM: Failed to send Neighbor Report Request");
6074                 wpabuf_free(buf);
6075                 return -ECANCELED;
6076         }
6077
6078         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6079         wpa_s->rrm.notify_neighbor_rep = cb;
6080         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6081                                wpas_rrm_neighbor_rep_timeout_handler,
6082                                &wpa_s->rrm, NULL);
6083
6084         wpabuf_free(buf);
6085         return 0;
6086 }
6087
6088
6089 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6090                                               const u8 *src,
6091                                               const u8 *frame, size_t len,
6092                                               int rssi)
6093 {
6094         struct wpabuf *buf;
6095         const struct rrm_link_measurement_request *req;
6096         struct rrm_link_measurement_report report;
6097
6098         if (wpa_s->wpa_state != WPA_COMPLETED) {
6099                 wpa_printf(MSG_INFO,
6100                            "RRM: Ignoring link measurement request. Not associated");
6101                 return;
6102         }
6103
6104         if (!wpa_s->rrm.rrm_used) {
6105                 wpa_printf(MSG_INFO,
6106                            "RRM: Ignoring link measurement request. Not RRM network");
6107                 return;
6108         }
6109
6110         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6111                 wpa_printf(MSG_INFO,
6112                            "RRM: Measurement report failed. TX power insertion not supported");
6113                 return;
6114         }
6115
6116         req = (const struct rrm_link_measurement_request *) frame;
6117         if (len < sizeof(*req)) {
6118                 wpa_printf(MSG_INFO,
6119                            "RRM: Link measurement report failed. Request too short");
6120                 return;
6121         }
6122
6123         os_memset(&report, 0, sizeof(report));
6124         report.tpc.eid = WLAN_EID_TPC_REPORT;
6125         report.tpc.len = 2;
6126         report.rsni = 255; /* 255 indicates that RSNI is not available */
6127         report.dialog_token = req->dialog_token;
6128
6129         /*
6130          * It's possible to estimate RCPI based on RSSI in dBm. This
6131          * calculation will not reflect the correct value for high rates,
6132          * but it's good enough for Action frames which are transmitted
6133          * with up to 24 Mbps rates.
6134          */
6135         if (!rssi)
6136                 report.rcpi = 255; /* not available */
6137         else if (rssi < -110)
6138                 report.rcpi = 0;
6139         else if (rssi > 0)
6140                 report.rcpi = 220;
6141         else
6142                 report.rcpi = (rssi + 110) * 2;
6143
6144         /* action_category + action_code */
6145         buf = wpabuf_alloc(2 + sizeof(report));
6146         if (buf == NULL) {
6147                 wpa_printf(MSG_ERROR,
6148                            "RRM: Link measurement report failed. Buffer allocation failed");
6149                 return;
6150         }
6151
6152         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6153         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6154         wpabuf_put_data(buf, &report, sizeof(report));
6155         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6156                     wpabuf_head(buf), wpabuf_len(buf));
6157
6158         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6159                                 wpa_s->own_addr, wpa_s->bssid,
6160                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6161                 wpa_printf(MSG_ERROR,
6162                            "RRM: Link measurement report failed. Send action failed");
6163         }
6164         wpabuf_free(buf);
6165 }
6166
6167
6168 struct wpa_supplicant *
6169 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6170 {
6171         switch (frame) {
6172 #ifdef CONFIG_P2P
6173         case VENDOR_ELEM_PROBE_REQ_P2P:
6174         case VENDOR_ELEM_PROBE_RESP_P2P:
6175         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6176         case VENDOR_ELEM_BEACON_P2P_GO:
6177         case VENDOR_ELEM_P2P_PD_REQ:
6178         case VENDOR_ELEM_P2P_PD_RESP:
6179         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6180         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6181         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6182         case VENDOR_ELEM_P2P_INV_REQ:
6183         case VENDOR_ELEM_P2P_INV_RESP:
6184         case VENDOR_ELEM_P2P_ASSOC_REQ:
6185         case VENDOR_ELEM_P2P_ASSOC_RESP:
6186                 return wpa_s->parent;
6187 #endif /* CONFIG_P2P */
6188         default:
6189                 return wpa_s;
6190         }
6191 }
6192
6193
6194 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6195 {
6196         unsigned int i;
6197         char buf[30];
6198
6199         wpa_printf(MSG_DEBUG, "Update vendor elements");
6200
6201         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6202                 if (wpa_s->vendor_elem[i]) {
6203                         int res;
6204
6205                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6206                         if (!os_snprintf_error(sizeof(buf), res)) {
6207                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6208                                                 wpa_s->vendor_elem[i]);
6209                         }
6210                 }
6211         }
6212
6213 #ifdef CONFIG_P2P
6214         if (wpa_s->parent == wpa_s &&
6215             wpa_s->global->p2p &&
6216             !wpa_s->global->p2p_disabled)
6217                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6218 #endif /* CONFIG_P2P */
6219 }
6220
6221
6222 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6223                             const u8 *elem, size_t len)
6224 {
6225         u8 *ie, *end;
6226
6227         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6228         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6229
6230         for (; ie + 1 < end; ie += 2 + ie[1]) {
6231                 if (ie + len > end)
6232                         break;
6233                 if (os_memcmp(ie, elem, len) != 0)
6234                         continue;
6235
6236                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6237                         wpabuf_free(wpa_s->vendor_elem[frame]);
6238                         wpa_s->vendor_elem[frame] = NULL;
6239                 } else {
6240                         os_memmove(ie, ie + len, end - (ie + len));
6241                         wpa_s->vendor_elem[frame]->used -= len;
6242                 }
6243                 wpas_vendor_elem_update(wpa_s);
6244                 return 0;
6245         }
6246
6247         return -1;
6248 }