wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         wpas_wps_deinit(wpa_s);
 460
 461         wpabuf_free(wpa_s->pending_eapol_rx);
 462         wpa_s->pending_eapol_rx = NULL;
 463
 464 #ifdef CONFIG_IBSS_RSN
 465         ibss_rsn_deinit(wpa_s->ibss_rsn);
 466         wpa_s->ibss_rsn = NULL;
 467 #endif /* CONFIG_IBSS_RSN */
 468
 469         sme_deinit(wpa_s);
 470
 471 #ifdef CONFIG_AP
 472         wpa_supplicant_ap_deinit(wpa_s);
 473 #endif /* CONFIG_AP */
 474
 475         wpas_p2p_deinit(wpa_s);
 476
 477 #ifdef CONFIG_OFFCHANNEL
 478         offchannel_deinit(wpa_s);
 479 #endif /* CONFIG_OFFCHANNEL */
 480
 481         wpa_supplicant_cancel_sched_scan(wpa_s);
 482
 483         os_free(wpa_s->next_scan_freqs);
 484         wpa_s->next_scan_freqs = NULL;
 485
 486         os_free(wpa_s->manual_scan_freqs);
 487         wpa_s->manual_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_sched_scan_freqs);
 490         wpa_s->manual_sched_scan_freqs = NULL;
 491
 492         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 493
 494         gas_query_deinit(wpa_s->gas);
 495         wpa_s->gas = NULL;
 496
 497         free_hw_features(wpa_s);
 498
 499         ieee802_1x_dealloc_kay_sm(wpa_s);
 500
 501         os_free(wpa_s->bssid_filter);
 502         wpa_s->bssid_filter = NULL;
 503
 504         os_free(wpa_s->disallow_aps_bssid);
 505         wpa_s->disallow_aps_bssid = NULL;
 506         os_free(wpa_s->disallow_aps_ssid);
 507         wpa_s->disallow_aps_ssid = NULL;
 508
 509         wnm_bss_keep_alive_deinit(wpa_s);
 510 #ifdef CONFIG_WNM
 511         wnm_deallocate_memory(wpa_s);
 512 #endif /* CONFIG_WNM */
 513
 514         ext_password_deinit(wpa_s->ext_pw);
 515         wpa_s->ext_pw = NULL;
 516
 517         wpabuf_free(wpa_s->last_gas_resp);
 518         wpa_s->last_gas_resp = NULL;
 519         wpabuf_free(wpa_s->prev_gas_resp);
 520         wpa_s->prev_gas_resp = NULL;
 521
 522         os_free(wpa_s->last_scan_res);
 523         wpa_s->last_scan_res = NULL;
 524
 525 #ifdef CONFIG_HS20
 526         hs20_deinit(wpa_s);
 527 #endif /* CONFIG_HS20 */
 528
 529         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 530                 wpabuf_free(wpa_s->vendor_elem[i]);
 531                 wpa_s->vendor_elem[i] = NULL;
 532         }
 533
 534         wmm_ac_notify_disassoc(wpa_s);
 535 }
 536
 537
 538 /**
 539  * wpa_clear_keys - Clear keys configured for the driver
 540  * @wpa_s: Pointer to wpa_supplicant data
 541  * @addr: Previously used BSSID or %NULL if not available
 542  *
 543  * This function clears the encryption keys that has been previously configured
 544  * for the driver.
 545  */
 546 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 547 {
 548         int i, max;
 549
 550 #ifdef CONFIG_IEEE80211W
 551         max = 6;
 552 #else /* CONFIG_IEEE80211W */
 553         max = 4;
 554 #endif /* CONFIG_IEEE80211W */
 555
 556         /* MLME-DELETEKEYS.request */
 557         for (i = 0; i < max; i++) {
 558                 if (wpa_s->keys_cleared & BIT(i))
 559                         continue;
 560                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 561                                 NULL, 0);
 562         }
 563         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 564             !is_zero_ether_addr(addr)) {
 565                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 566                                 0);
 567                 /* MLME-SETPROTECTION.request(None) */
 568                 wpa_drv_mlme_setprotection(
 569                         wpa_s, addr,
 570                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 571                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 572         }
 573         wpa_s->keys_cleared = (u32) -1;
 574 }
 575
 576
 577 /**
 578  * wpa_supplicant_state_txt - Get the connection state name as a text string
 579  * @state: State (wpa_state; WPA_*)
 580  * Returns: The state name as a printable text string
 581  */
 582 const char * wpa_supplicant_state_txt(enum wpa_states state)
 583 {
 584         switch (state) {
 585         case WPA_DISCONNECTED:
 586                 return "DISCONNECTED";
 587         case WPA_INACTIVE:
 588                 return "INACTIVE";
 589         case WPA_INTERFACE_DISABLED:
 590                 return "INTERFACE_DISABLED";
 591         case WPA_SCANNING:
 592                 return "SCANNING";
 593         case WPA_AUTHENTICATING:
 594                 return "AUTHENTICATING";
 595         case WPA_ASSOCIATING:
 596                 return "ASSOCIATING";
 597         case WPA_ASSOCIATED:
 598                 return "ASSOCIATED";
 599         case WPA_4WAY_HANDSHAKE:
 600                 return "4WAY_HANDSHAKE";
 601         case WPA_GROUP_HANDSHAKE:
 602                 return "GROUP_HANDSHAKE";
 603         case WPA_COMPLETED:
 604                 return "COMPLETED";
 605         default:
 606                 return "UNKNOWN";
 607         }
 608 }
 609
 610
 611 #ifdef CONFIG_BGSCAN
 612
 613 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 614 {
 615         const char *name;
 616
 617         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 618                 name = wpa_s->current_ssid->bgscan;
 619         else
 620                 name = wpa_s->conf->bgscan;
 621         if (name == NULL || name[0] == '\0')
 622                 return;
 623         if (wpas_driver_bss_selection(wpa_s))
 624                 return;
 625         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 626                 return;
 627 #ifdef CONFIG_P2P
 628         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 629                 return;
 630 #endif /* CONFIG_P2P */
 631
 632         bgscan_deinit(wpa_s);
 633         if (wpa_s->current_ssid) {
 634                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 635                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 636                                 "bgscan");
 637                         /*
 638                          * Live without bgscan; it is only used as a roaming
 639                          * optimization, so the initial connection is not
 640                          * affected.
 641                          */
 642                 } else {
 643                         struct wpa_scan_results *scan_res;
 644                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 645                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 646                                                                    0);
 647                         if (scan_res) {
 648                                 bgscan_notify_scan(wpa_s, scan_res);
 649                                 wpa_scan_results_free(scan_res);
 650                         }
 651                 }
 652         } else
 653                 wpa_s->bgscan_ssid = NULL;
 654 }
 655
 656
 657 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 658 {
 659         if (wpa_s->bgscan_ssid != NULL) {
 660                 bgscan_deinit(wpa_s);
 661                 wpa_s->bgscan_ssid = NULL;
 662         }
 663 }
 664
 665 #endif /* CONFIG_BGSCAN */
 666
 667
 668 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 669 {
 670         if (autoscan_init(wpa_s, 0))
 671                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 672 }
 673
 674
 675 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 676 {
 677         autoscan_deinit(wpa_s);
 678 }
 679
 680
 681 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 684             wpa_s->wpa_state == WPA_SCANNING) {
 685                 autoscan_deinit(wpa_s);
 686                 wpa_supplicant_start_autoscan(wpa_s);
 687         }
 688 }
 689
 690
 691 /**
 692  * wpa_supplicant_set_state - Set current connection state
 693  * @wpa_s: Pointer to wpa_supplicant data
 694  * @state: The new connection state
 695  *
 696  * This function is called whenever the connection state changes, e.g.,
 697  * association is completed for WPA/WPA2 4-Way Handshake is started.
 698  */
 699 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 700                               enum wpa_states state)
 701 {
 702         enum wpa_states old_state = wpa_s->wpa_state;
 703
 704         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 705                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 706                 wpa_supplicant_state_txt(state));
 707
 708         if (state == WPA_INTERFACE_DISABLED) {
 709                 /* Assure normal scan when interface is restored */
 710                 wpa_s->normal_scans = 0;
 711         }
 712
 713         if (state == WPA_COMPLETED) {
 714                 wpas_connect_work_done(wpa_s);
 715                 /* Reinitialize normal_scan counter */
 716                 wpa_s->normal_scans = 0;
 717         }
 718
 719         if (state != WPA_SCANNING)
 720                 wpa_supplicant_notify_scanning(wpa_s, 0);
 721
 722         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 723                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 724 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 725                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 726                         MACSTR " completed [id=%d id_str=%s]",
 727                         MAC2STR(wpa_s->bssid),
 728                         ssid ? ssid->id : -1,
 729                         ssid && ssid->id_str ? ssid->id_str : "");
 730 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 731                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 732                 wpa_s->extra_blacklist_count = 0;
 733                 wpa_s->new_connection = 0;
 734                 wpa_drv_set_operstate(wpa_s, 1);
 735 #ifndef IEEE8021X_EAPOL
 736                 wpa_drv_set_supp_port(wpa_s, 1);
 737 #endif /* IEEE8021X_EAPOL */
 738                 wpa_s->after_wps = 0;
 739                 wpa_s->known_wps_freq = 0;
 740                 wpas_p2p_completed(wpa_s);
 741
 742                 sme_sched_obss_scan(wpa_s, 1);
 743         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 744                    state == WPA_ASSOCIATED) {
 745                 wpa_s->new_connection = 1;
 746                 wpa_drv_set_operstate(wpa_s, 0);
 747 #ifndef IEEE8021X_EAPOL
 748                 wpa_drv_set_supp_port(wpa_s, 0);
 749 #endif /* IEEE8021X_EAPOL */
 750                 sme_sched_obss_scan(wpa_s, 0);
 751         }
 752         wpa_s->wpa_state = state;
 753
 754 #ifdef CONFIG_BGSCAN
 755         if (state == WPA_COMPLETED)
 756                 wpa_supplicant_start_bgscan(wpa_s);
 757         else if (state < WPA_ASSOCIATED)
 758                 wpa_supplicant_stop_bgscan(wpa_s);
 759 #endif /* CONFIG_BGSCAN */
 760
 761         if (state == WPA_AUTHENTICATING)
 762                 wpa_supplicant_stop_autoscan(wpa_s);
 763
 764         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 765                 wpa_supplicant_start_autoscan(wpa_s);
 766
 767         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 768                 wmm_ac_notify_disassoc(wpa_s);
 769
 770         if (wpa_s->wpa_state != old_state) {
 771                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 772
 773                 /*
 774                  * Notify the P2P Device interface about a state change in one
 775                  * of the interfaces.
 776                  */
 777                 wpas_p2p_indicate_state_change(wpa_s);
 778
 779                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 780                     old_state == WPA_COMPLETED)
 781                         wpas_notify_auth_changed(wpa_s);
 782         }
 783 }
 784
 785
 786 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 787 {
 788         int pending = 0;
 789 #ifdef CONFIG_WPS
 790         struct wpa_supplicant *wpa_s = global->ifaces;
 791         while (wpa_s) {
 792                 struct wpa_supplicant *next = wpa_s->next;
 793                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 794                         pending = 1;
 795 #ifdef CONFIG_P2P
 796                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 797                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 798                         wpas_p2p_disconnect(wpa_s);
 799 #endif /* CONFIG_P2P */
 800                 wpa_s = next;
 801         }
 802 #endif /* CONFIG_WPS */
 803         if (pending)
 804                 return;
 805         eloop_terminate();
 806 }
 807
 808
 809 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 810 {
 811         struct wpa_global *global = signal_ctx;
 812         wpa_supplicant_terminate_proc(global);
 813 }
 814
 815
 816 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 817 {
 818         enum wpa_states old_state = wpa_s->wpa_state;
 819
 820         wpa_s->pairwise_cipher = 0;
 821         wpa_s->group_cipher = 0;
 822         wpa_s->mgmt_group_cipher = 0;
 823         wpa_s->key_mgmt = 0;
 824         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 825                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 826
 827         if (wpa_s->wpa_state != old_state)
 828                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 829 }
 830
 831
 832 /**
 833  * wpa_supplicant_reload_configuration - Reload configuration data
 834  * @wpa_s: Pointer to wpa_supplicant data
 835  * Returns: 0 on success or -1 if configuration parsing failed
 836  *
 837  * This function can be used to request that the configuration data is reloaded
 838  * (e.g., after configuration file change). This function is reloading
 839  * configuration only for one interface, so this may need to be called multiple
 840  * times if %wpa_supplicant is controlling multiple interfaces and all
 841  * interfaces need reconfiguration.
 842  */
 843 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 844 {
 845         struct wpa_config *conf;
 846         int reconf_ctrl;
 847         int old_ap_scan;
 848
 849         if (wpa_s->confname == NULL)
 850                 return -1;
 851         conf = wpa_config_read(wpa_s->confname, NULL);
 852         if (conf == NULL) {
 853                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 854                         "file '%s' - exiting", wpa_s->confname);
 855                 return -1;
 856         }
 857         wpa_config_read(wpa_s->confanother, conf);
 858
 859         conf->changed_parameters = (unsigned int) -1;
 860
 861         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 862                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 863                     os_strcmp(conf->ctrl_interface,
 864                               wpa_s->conf->ctrl_interface) != 0);
 865
 866         if (reconf_ctrl && wpa_s->ctrl_iface) {
 867                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 868                 wpa_s->ctrl_iface = NULL;
 869         }
 870
 871         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 872         if (wpa_s->current_ssid) {
 873                 wpa_supplicant_deauthenticate(wpa_s,
 874                                               WLAN_REASON_DEAUTH_LEAVING);
 875         }
 876
 877         /*
 878          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 879          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 880          */
 881         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 882                 /*
 883                  * Clear forced success to clear EAP state for next
 884                  * authentication.
 885                  */
 886                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 887         }
 888         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 889         wpa_sm_set_config(wpa_s->wpa, NULL);
 890         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 891         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 892         rsn_preauth_deinit(wpa_s->wpa);
 893
 894         old_ap_scan = wpa_s->conf->ap_scan;
 895         wpa_config_free(wpa_s->conf);
 896         wpa_s->conf = conf;
 897         if (old_ap_scan != wpa_s->conf->ap_scan)
 898                 wpas_notify_ap_scan_changed(wpa_s);
 899
 900         if (reconf_ctrl)
 901                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 902
 903         wpa_supplicant_update_config(wpa_s);
 904
 905         wpa_supplicant_clear_status(wpa_s);
 906         if (wpa_supplicant_enabled_networks(wpa_s)) {
 907                 wpa_s->reassociate = 1;
 908                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 909         }
 910         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 911         return 0;
 912 }
 913
 914
 915 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 916 {
 917         struct wpa_global *global = signal_ctx;
 918         struct wpa_supplicant *wpa_s;
 919         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 920                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 921                         sig);
 922                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 923                         wpa_supplicant_terminate_proc(global);
 924                 }
 925         }
 926 }
 927
 928
 929 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 930                                          struct wpa_ssid *ssid,
 931                                          struct wpa_ie_data *ie)
 932 {
 933         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 934         if (ret) {
 935                 if (ret == -2) {
 936                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 937                                 "from association info");
 938                 }
 939                 return -1;
 940         }
 941
 942         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 943                 "cipher suites");
 944         if (!(ie->group_cipher & ssid->group_cipher)) {
 945                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 946                         "cipher 0x%x (mask 0x%x) - reject",
 947                         ie->group_cipher, ssid->group_cipher);
 948                 return -1;
 949         }
 950         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 951                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 952                         "cipher 0x%x (mask 0x%x) - reject",
 953                         ie->pairwise_cipher, ssid->pairwise_cipher);
 954                 return -1;
 955         }
 956         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 957                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 958                         "management 0x%x (mask 0x%x) - reject",
 959                         ie->key_mgmt, ssid->key_mgmt);
 960                 return -1;
 961         }
 962
 963 #ifdef CONFIG_IEEE80211W
 964         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 965             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
 966                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 967                         "that does not support management frame protection - "
 968                         "reject");
 969                 return -1;
 970         }
 971 #endif /* CONFIG_IEEE80211W */
 972
 973         return 0;
 974 }
 975
 976
 977 /**
 978  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 979  * @wpa_s: Pointer to wpa_supplicant data
 980  * @bss: Scan results for the selected BSS, or %NULL if not available
 981  * @ssid: Configuration data for the selected network
 982  * @wpa_ie: Buffer for the WPA/RSN IE
 983  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 984  * used buffer length in case the functions returns success.
 985  * Returns: 0 on success or -1 on failure
 986  *
 987  * This function is used to configure authentication and encryption parameters
 988  * based on the network configuration and scan result for the selected BSS (if
 989  * available).
 990  */
 991 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 992                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 993                               u8 *wpa_ie, size_t *wpa_ie_len)
 994 {
 995         struct wpa_ie_data ie;
 996         int sel, proto;
 997         const u8 *bss_wpa, *bss_rsn, *bss_osen;
 998
 999         if (bss) {
1000                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1001                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1002                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1003         } else
1004                 bss_wpa = bss_rsn = bss_osen = NULL;
1005
1006         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1007             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1008             (ie.group_cipher & ssid->group_cipher) &&
1009             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1010             (ie.key_mgmt & ssid->key_mgmt)) {
1011                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1012                 proto = WPA_PROTO_RSN;
1013         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1014                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1015                    (ie.group_cipher & ssid->group_cipher) &&
1016                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1017                    (ie.key_mgmt & ssid->key_mgmt)) {
1018                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1019                 proto = WPA_PROTO_WPA;
1020 #ifdef CONFIG_HS20
1021         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1022                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1023                 /* TODO: parse OSEN element */
1024                 os_memset(&ie, 0, sizeof(ie));
1025                 ie.group_cipher = WPA_CIPHER_CCMP;
1026                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1027                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1028                 proto = WPA_PROTO_OSEN;
1029 #endif /* CONFIG_HS20 */
1030         } else if (bss) {
1031                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1032                 wpa_dbg(wpa_s, MSG_DEBUG,
1033                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1034                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1035                         ssid->key_mgmt);
1036                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1037                         MAC2STR(bss->bssid),
1038                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1039                         bss_wpa ? " WPA" : "",
1040                         bss_rsn ? " RSN" : "",
1041                         bss_osen ? " OSEN" : "");
1042                 if (bss_rsn) {
1043                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1044                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1045                                 wpa_dbg(wpa_s, MSG_DEBUG,
1046                                         "Could not parse RSN element");
1047                         } else {
1048                                 wpa_dbg(wpa_s, MSG_DEBUG,
1049                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1050                                         ie.pairwise_cipher, ie.group_cipher,
1051                                         ie.key_mgmt);
1052                         }
1053                 }
1054                 if (bss_wpa) {
1055                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1056                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1057                                 wpa_dbg(wpa_s, MSG_DEBUG,
1058                                         "Could not parse WPA element");
1059                         } else {
1060                                 wpa_dbg(wpa_s, MSG_DEBUG,
1061                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1062                                         ie.pairwise_cipher, ie.group_cipher,
1063                                         ie.key_mgmt);
1064                         }
1065                 }
1066                 return -1;
1067         } else {
1068                 if (ssid->proto & WPA_PROTO_OSEN)
1069                         proto = WPA_PROTO_OSEN;
1070                 else if (ssid->proto & WPA_PROTO_RSN)
1071                         proto = WPA_PROTO_RSN;
1072                 else
1073                         proto = WPA_PROTO_WPA;
1074                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1075                         os_memset(&ie, 0, sizeof(ie));
1076                         ie.group_cipher = ssid->group_cipher;
1077                         ie.pairwise_cipher = ssid->pairwise_cipher;
1078                         ie.key_mgmt = ssid->key_mgmt;
1079 #ifdef CONFIG_IEEE80211W
1080                         ie.mgmt_group_cipher =
1081                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1082                                 WPA_CIPHER_AES_128_CMAC : 0;
1083 #endif /* CONFIG_IEEE80211W */
1084                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1085                                 "based on configuration");
1086                 } else
1087                         proto = ie.proto;
1088         }
1089
1090         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1091                 "pairwise %d key_mgmt %d proto %d",
1092                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1093 #ifdef CONFIG_IEEE80211W
1094         if (ssid->ieee80211w) {
1095                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1096                         ie.mgmt_group_cipher);
1097         }
1098 #endif /* CONFIG_IEEE80211W */
1099
1100         wpa_s->wpa_proto = proto;
1101         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1102         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1103                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1104
1105         if (bss || !wpa_s->ap_ies_from_associnfo) {
1106                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1107                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1108                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1109                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1110                         return -1;
1111         }
1112
1113         sel = ie.group_cipher & ssid->group_cipher;
1114         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1115         if (wpa_s->group_cipher < 0) {
1116                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1117                         "cipher");
1118                 return -1;
1119         }
1120         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1121                 wpa_cipher_txt(wpa_s->group_cipher));
1122
1123         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1124         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1125         if (wpa_s->pairwise_cipher < 0) {
1126                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1127                         "cipher");
1128                 return -1;
1129         }
1130         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1131                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1132
1133         sel = ie.key_mgmt & ssid->key_mgmt;
1134 #ifdef CONFIG_SAE
1135         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1136                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1137 #endif /* CONFIG_SAE */
1138         if (0) {
1139 #ifdef CONFIG_SUITEB192
1140         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1141                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1142                 wpa_dbg(wpa_s, MSG_DEBUG,
1143                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1144 #endif /* CONFIG_SUITEB192 */
1145 #ifdef CONFIG_SUITEB
1146         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1147                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1148                 wpa_dbg(wpa_s, MSG_DEBUG,
1149                         "WPA: using KEY_MGMT 802.1X with Suite B");
1150 #endif /* CONFIG_SUITEB */
1151 #ifdef CONFIG_IEEE80211R
1152         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1153                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1154                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1155         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1156                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1157                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1158 #endif /* CONFIG_IEEE80211R */
1159 #ifdef CONFIG_SAE
1160         } else if (sel & WPA_KEY_MGMT_SAE) {
1161                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1162                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1163         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1164                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1165                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1166 #endif /* CONFIG_SAE */
1167 #ifdef CONFIG_IEEE80211W
1168         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1169                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1170                 wpa_dbg(wpa_s, MSG_DEBUG,
1171                         "WPA: using KEY_MGMT 802.1X with SHA256");
1172         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1173                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1174                 wpa_dbg(wpa_s, MSG_DEBUG,
1175                         "WPA: using KEY_MGMT PSK with SHA256");
1176 #endif /* CONFIG_IEEE80211W */
1177         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1178                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1179                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1180         } else if (sel & WPA_KEY_MGMT_PSK) {
1181                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1182                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1183         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1184                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1185                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1186 #ifdef CONFIG_HS20
1187         } else if (sel & WPA_KEY_MGMT_OSEN) {
1188                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1189                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1190 #endif /* CONFIG_HS20 */
1191         } else {
1192                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1193                         "authenticated key management type");
1194                 return -1;
1195         }
1196
1197         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1198         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1199                          wpa_s->pairwise_cipher);
1200         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1201
1202 #ifdef CONFIG_IEEE80211W
1203         sel = ie.mgmt_group_cipher;
1204         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1205             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1206                 sel = 0;
1207         if (sel & WPA_CIPHER_AES_128_CMAC) {
1208                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1209                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1210                         "AES-128-CMAC");
1211         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1212                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1213                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1214                         "BIP-GMAC-128");
1215         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1216                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1217                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1218                         "BIP-GMAC-256");
1219         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1220                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1221                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1222                         "BIP-CMAC-256");
1223         } else {
1224                 wpa_s->mgmt_group_cipher = 0;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1226         }
1227         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1228                          wpa_s->mgmt_group_cipher);
1229         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1230                          wpas_get_ssid_pmf(wpa_s, ssid));
1231 #endif /* CONFIG_IEEE80211W */
1232
1233         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1234                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1235                 return -1;
1236         }
1237
1238         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1239                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1240 #ifndef CONFIG_NO_PBKDF2
1241                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1242                     ssid->passphrase) {
1243                         u8 psk[PMK_LEN];
1244                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1245                                     4096, psk, PMK_LEN);
1246                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1247                                         psk, PMK_LEN);
1248                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1249                         os_memset(psk, 0, sizeof(psk));
1250                 }
1251 #endif /* CONFIG_NO_PBKDF2 */
1252 #ifdef CONFIG_EXT_PASSWORD
1253                 if (ssid->ext_psk) {
1254                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1255                                                              ssid->ext_psk);
1256                         char pw_str[64 + 1];
1257                         u8 psk[PMK_LEN];
1258
1259                         if (pw == NULL) {
1260                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1261                                         "found from external storage");
1262                                 return -1;
1263                         }
1264
1265                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1266                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1267                                         "PSK length %d in external storage",
1268                                         (int) wpabuf_len(pw));
1269                                 ext_password_free(pw);
1270                                 return -1;
1271                         }
1272
1273                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1274                         pw_str[wpabuf_len(pw)] = '\0';
1275
1276 #ifndef CONFIG_NO_PBKDF2
1277                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1278                         {
1279                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1280                                             4096, psk, PMK_LEN);
1281                                 os_memset(pw_str, 0, sizeof(pw_str));
1282                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1283                                                 "external passphrase)",
1284                                                 psk, PMK_LEN);
1285                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1286                                 os_memset(psk, 0, sizeof(psk));
1287                         } else
1288 #endif /* CONFIG_NO_PBKDF2 */
1289                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1290                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1291                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1292                                                 "Invalid PSK hex string");
1293                                         os_memset(pw_str, 0, sizeof(pw_str));
1294                                         ext_password_free(pw);
1295                                         return -1;
1296                                 }
1297                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1298                                 os_memset(psk, 0, sizeof(psk));
1299                         } else {
1300                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1301                                         "PSK available");
1302                                 os_memset(pw_str, 0, sizeof(pw_str));
1303                                 ext_password_free(pw);
1304                                 return -1;
1305                         }
1306
1307                         os_memset(pw_str, 0, sizeof(pw_str));
1308                         ext_password_free(pw);
1309                 }
1310 #endif /* CONFIG_EXT_PASSWORD */
1311         } else
1312                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1313
1314         return 0;
1315 }
1316
1317
1318 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1319 {
1320         *pos = 0x00;
1321
1322         switch (idx) {
1323         case 0: /* Bits 0-7 */
1324                 break;
1325         case 1: /* Bits 8-15 */
1326                 break;
1327         case 2: /* Bits 16-23 */
1328 #ifdef CONFIG_WNM
1329                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1330                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1331 #endif /* CONFIG_WNM */
1332                 break;
1333         case 3: /* Bits 24-31 */
1334 #ifdef CONFIG_WNM
1335                 *pos |= 0x02; /* Bit 25 - SSID List */
1336 #endif /* CONFIG_WNM */
1337 #ifdef CONFIG_INTERWORKING
1338                 if (wpa_s->conf->interworking)
1339                         *pos |= 0x80; /* Bit 31 - Interworking */
1340 #endif /* CONFIG_INTERWORKING */
1341                 break;
1342         case 4: /* Bits 32-39 */
1343 #ifdef CONFIG_INTERWORKING
1344                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1345                         *pos |= 0x01; /* Bit 32 - QoS Map */
1346 #endif /* CONFIG_INTERWORKING */
1347                 break;
1348         case 5: /* Bits 40-47 */
1349 #ifdef CONFIG_HS20
1350                 if (wpa_s->conf->hs20)
1351                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1352 #endif /* CONFIG_HS20 */
1353                 break;
1354         case 6: /* Bits 48-55 */
1355                 break;
1356         }
1357 }
1358
1359
1360 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1361 {
1362         u8 *pos = buf;
1363         u8 len = 6, i;
1364
1365         if (len < wpa_s->extended_capa_len)
1366                 len = wpa_s->extended_capa_len;
1367         if (buflen < (size_t) len + 2) {
1368                 wpa_printf(MSG_INFO,
1369                            "Not enough room for building extended capabilities element");
1370                 return -1;
1371         }
1372
1373         *pos++ = WLAN_EID_EXT_CAPAB;
1374         *pos++ = len;
1375         for (i = 0; i < len; i++, pos++) {
1376                 wpas_ext_capab_byte(wpa_s, pos, i);
1377
1378                 if (i < wpa_s->extended_capa_len) {
1379                         *pos &= ~wpa_s->extended_capa_mask[i];
1380                         *pos |= wpa_s->extended_capa[i];
1381                 }
1382         }
1383
1384         while (len > 0 && buf[1 + len] == 0) {
1385                 len--;
1386                 buf[1] = len;
1387         }
1388         if (len == 0)
1389                 return 0;
1390
1391         return 2 + len;
1392 }
1393
1394
1395 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1396                           struct wpa_bss *test_bss)
1397 {
1398         struct wpa_bss *bss;
1399
1400         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1401                 if (bss == test_bss)
1402                         return 1;
1403         }
1404
1405         return 0;
1406 }
1407
1408
1409 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1410                            struct wpa_ssid *test_ssid)
1411 {
1412         struct wpa_ssid *ssid;
1413
1414         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1415                 if (ssid == test_ssid)
1416                         return 1;
1417         }
1418
1419         return 0;
1420 }
1421
1422
1423 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1424                         struct wpa_ssid *test_ssid)
1425 {
1426         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1427                 return 0;
1428
1429         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1430 }
1431
1432
1433 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1434 {
1435         if (cwork == NULL)
1436                 return;
1437         os_free(cwork);
1438 }
1439
1440
1441 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1442 {
1443         struct wpa_connect_work *cwork;
1444         struct wpa_radio_work *work = wpa_s->connect_work;
1445
1446         if (!work)
1447                 return;
1448
1449         wpa_s->connect_work = NULL;
1450         cwork = work->ctx;
1451         work->ctx = NULL;
1452         wpas_connect_work_free(cwork);
1453         radio_work_done(work);
1454 }
1455
1456
1457 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1458 {
1459         struct os_reltime now;
1460         u8 addr[ETH_ALEN];
1461
1462         os_get_reltime(&now);
1463         if (wpa_s->last_mac_addr_style == style &&
1464             wpa_s->last_mac_addr_change.sec != 0 &&
1465             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1466                                 wpa_s->conf->rand_addr_lifetime)) {
1467                 wpa_msg(wpa_s, MSG_DEBUG,
1468                         "Previously selected random MAC address has not yet expired");
1469                 return 0;
1470         }
1471
1472         switch (style) {
1473         case 1:
1474                 if (random_mac_addr(addr) < 0)
1475                         return -1;
1476                 break;
1477         case 2:
1478                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1479                 if (random_mac_addr_keep_oui(addr) < 0)
1480                         return -1;
1481                 break;
1482         default:
1483                 return -1;
1484         }
1485
1486         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1487                 wpa_msg(wpa_s, MSG_INFO,
1488                         "Failed to set random MAC address");
1489                 return -1;
1490         }
1491
1492         os_get_reltime(&wpa_s->last_mac_addr_change);
1493         wpa_s->mac_addr_changed = 1;
1494         wpa_s->last_mac_addr_style = style;
1495
1496         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1497                 wpa_msg(wpa_s, MSG_INFO,
1498                         "Could not update MAC address information");
1499                 return -1;
1500         }
1501
1502         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1503                 MAC2STR(addr));
1504
1505         return 0;
1506 }
1507
1508
1509 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1510 {
1511         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1512             !wpa_s->conf->preassoc_mac_addr)
1513                 return 0;
1514
1515         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1516 }
1517
1518
1519 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1520
1521 /**
1522  * wpa_supplicant_associate - Request association
1523  * @wpa_s: Pointer to wpa_supplicant data
1524  * @bss: Scan results for the selected BSS, or %NULL if not available
1525  * @ssid: Configuration data for the selected network
1526  *
1527  * This function is used to request %wpa_supplicant to associate with a BSS.
1528  */
1529 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1530                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1531 {
1532         struct wpa_connect_work *cwork;
1533         int rand_style;
1534
1535         if (ssid->mac_addr == -1)
1536                 rand_style = wpa_s->conf->mac_addr;
1537         else
1538                 rand_style = ssid->mac_addr;
1539
1540         wmm_ac_clear_saved_tspecs(wpa_s);
1541         wpa_s->reassoc_same_bss = 0;
1542
1543         if (wpa_s->last_ssid == ssid) {
1544                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1545                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1546                         wmm_ac_save_tspecs(wpa_s);
1547                         wpa_s->reassoc_same_bss = 1;
1548                 }
1549         } else if (rand_style > 0) {
1550                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1551                         return;
1552                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1553         } else if (wpa_s->mac_addr_changed) {
1554                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1555                         wpa_msg(wpa_s, MSG_INFO,
1556                                 "Could not restore permanent MAC address");
1557                         return;
1558                 }
1559                 wpa_s->mac_addr_changed = 0;
1560                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1561                         wpa_msg(wpa_s, MSG_INFO,
1562                                 "Could not update MAC address information");
1563                         return;
1564                 }
1565                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1566         }
1567         wpa_s->last_ssid = ssid;
1568
1569 #ifdef CONFIG_IBSS_RSN
1570         ibss_rsn_deinit(wpa_s->ibss_rsn);
1571         wpa_s->ibss_rsn = NULL;
1572 #endif /* CONFIG_IBSS_RSN */
1573
1574         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1575             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1576 #ifdef CONFIG_AP
1577                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1578                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1579                                 "mode");
1580                         return;
1581                 }
1582                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1583                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1584                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1585                                 wpas_p2p_ap_setup_failed(wpa_s);
1586                         return;
1587                 }
1588                 wpa_s->current_bss = bss;
1589 #else /* CONFIG_AP */
1590                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1591                         "the build");
1592 #endif /* CONFIG_AP */
1593                 return;
1594         }
1595
1596         if (ssid->mode == WPAS_MODE_MESH) {
1597 #ifdef CONFIG_MESH
1598                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1599                         wpa_msg(wpa_s, MSG_INFO,
1600                                 "Driver does not support mesh mode");
1601                         return;
1602                 }
1603                 if (bss)
1604                         ssid->frequency = bss->freq;
1605                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1606                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1607                         return;
1608                 }
1609                 wpa_s->current_bss = bss;
1610                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1611                              "ssid=\"%s\" id=%d",
1612                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1613                              ssid->id);
1614 #else /* CONFIG_MESH */
1615                 wpa_msg(wpa_s, MSG_ERROR,
1616                         "mesh mode support not included in the build");
1617 #endif /* CONFIG_MESH */
1618                 return;
1619         }
1620
1621 #ifdef CONFIG_TDLS
1622         if (bss)
1623                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1624                                 bss->ie_len);
1625 #endif /* CONFIG_TDLS */
1626
1627         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1628             ssid->mode == IEEE80211_MODE_INFRA) {
1629                 sme_authenticate(wpa_s, bss, ssid);
1630                 return;
1631         }
1632
1633         if (wpa_s->connect_work) {
1634                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1635                 return;
1636         }
1637
1638         if (radio_work_pending(wpa_s, "connect")) {
1639                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1640                 return;
1641         }
1642
1643         cwork = os_zalloc(sizeof(*cwork));
1644         if (cwork == NULL)
1645                 return;
1646
1647         cwork->bss = bss;
1648         cwork->ssid = ssid;
1649
1650         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1651                            wpas_start_assoc_cb, cwork) < 0) {
1652                 os_free(cwork);
1653         }
1654 }
1655
1656
1657 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1658                           const struct wpa_ssid *ssid,
1659                           struct hostapd_freq_params *freq)
1660 {
1661         enum hostapd_hw_mode hw_mode;
1662         struct hostapd_hw_modes *mode = NULL;
1663         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1664                            184, 192 };
1665         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1666         u8 channel;
1667         int i, chan_idx, ht40 = -1, res;
1668         unsigned int j;
1669
1670         freq->freq = ssid->frequency;
1671
1672         /* For IBSS check HT_IBSS flag */
1673         if (ssid->mode == WPAS_MODE_IBSS &&
1674             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1675                 return;
1676
1677         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1678             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1679             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1680                 wpa_printf(MSG_DEBUG,
1681                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1682                 return;
1683         }
1684
1685         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1686         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1687                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1688                         mode = &wpa_s->hw.modes[i];
1689                         break;
1690                 }
1691         }
1692
1693         if (!mode)
1694                 return;
1695
1696         freq->ht_enabled = ht_supported(mode);
1697         if (!freq->ht_enabled)
1698                 return;
1699
1700         /* Setup higher BW only for 5 GHz */
1701         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1702                 return;
1703
1704         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1705                 pri_chan = &mode->channels[chan_idx];
1706                 if (pri_chan->chan == channel)
1707                         break;
1708                 pri_chan = NULL;
1709         }
1710         if (!pri_chan)
1711                 return;
1712
1713         /* Check primary channel flags */
1714         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1715                 return;
1716
1717         /* Check/setup HT40+/HT40- */
1718         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1719                 if (ht40plus[j] == channel) {
1720                         ht40 = 1;
1721                         break;
1722                 }
1723         }
1724
1725         /* Find secondary channel */
1726         for (i = 0; i < mode->num_channels; i++) {
1727                 sec_chan = &mode->channels[i];
1728                 if (sec_chan->chan == channel + ht40 * 4)
1729                         break;
1730                 sec_chan = NULL;
1731         }
1732         if (!sec_chan)
1733                 return;
1734
1735         /* Check secondary channel flags */
1736         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1737                 return;
1738
1739         freq->channel = pri_chan->chan;
1740
1741         switch (ht40) {
1742         case -1:
1743                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1744                         return;
1745                 freq->sec_channel_offset = -1;
1746                 break;
1747         case 1:
1748                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1749                         return;
1750                 freq->sec_channel_offset = 1;
1751                 break;
1752         default:
1753                 break;
1754         }
1755
1756         if (freq->sec_channel_offset) {
1757                 struct wpa_scan_results *scan_res;
1758
1759                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1760                 if (scan_res == NULL) {
1761                         /* Back to HT20 */
1762                         freq->sec_channel_offset = 0;
1763                         return;
1764                 }
1765
1766                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1767                                      sec_chan->chan);
1768                 switch (res) {
1769                 case 0:
1770                         /* Back to HT20 */
1771                         freq->sec_channel_offset = 0;
1772                         break;
1773                 case 1:
1774                         /* Configuration allowed */
1775                         break;
1776                 case 2:
1777                         /* Switch pri/sec channels */
1778                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1779                         freq->sec_channel_offset = -freq->sec_channel_offset;
1780                         freq->channel = sec_chan->chan;
1781                         break;
1782                 default:
1783                         freq->sec_channel_offset = 0;
1784                         break;
1785                 }
1786
1787                 wpa_scan_results_free(scan_res);
1788         }
1789
1790         wpa_printf(MSG_DEBUG,
1791                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1792                    freq->channel, freq->sec_channel_offset);
1793 }
1794
1795
1796 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1797 {
1798         struct wpa_connect_work *cwork = work->ctx;
1799         struct wpa_bss *bss = cwork->bss;
1800         struct wpa_ssid *ssid = cwork->ssid;
1801         struct wpa_supplicant *wpa_s = work->wpa_s;
1802         u8 wpa_ie[200];
1803         size_t wpa_ie_len;
1804         int use_crypt, ret, i, bssid_changed;
1805         int algs = WPA_AUTH_ALG_OPEN;
1806         unsigned int cipher_pairwise, cipher_group;
1807         struct wpa_driver_associate_params params;
1808         int wep_keys_set = 0;
1809         int assoc_failed = 0;
1810         struct wpa_ssid *old_ssid;
1811 #ifdef CONFIG_HT_OVERRIDES
1812         struct ieee80211_ht_capabilities htcaps;
1813         struct ieee80211_ht_capabilities htcaps_mask;
1814 #endif /* CONFIG_HT_OVERRIDES */
1815 #ifdef CONFIG_VHT_OVERRIDES
1816        struct ieee80211_vht_capabilities vhtcaps;
1817        struct ieee80211_vht_capabilities vhtcaps_mask;
1818 #endif /* CONFIG_VHT_OVERRIDES */
1819
1820         if (deinit) {
1821                 if (work->started) {
1822                         wpa_s->connect_work = NULL;
1823
1824                         /* cancel possible auth. timeout */
1825                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1826                                              NULL);
1827                 }
1828                 wpas_connect_work_free(cwork);
1829                 return;
1830         }
1831
1832         wpa_s->connect_work = work;
1833
1834         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1835                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1836                 wpas_connect_work_done(wpa_s);
1837                 return;
1838         }
1839
1840         os_memset(&params, 0, sizeof(params));
1841         wpa_s->reassociate = 0;
1842         wpa_s->eap_expected_failure = 0;
1843         if (bss &&
1844             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1845 #ifdef CONFIG_IEEE80211R
1846                 const u8 *ie, *md = NULL;
1847 #endif /* CONFIG_IEEE80211R */
1848                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1849                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1850                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1851                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1852                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1853                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1854                 if (bssid_changed)
1855                         wpas_notify_bssid_changed(wpa_s);
1856 #ifdef CONFIG_IEEE80211R
1857                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1858                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1859                         md = ie + 2;
1860                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1861                 if (md) {
1862                         /* Prepare for the next transition */
1863                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1864                 }
1865 #endif /* CONFIG_IEEE80211R */
1866 #ifdef CONFIG_WPS
1867         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1868                    wpa_s->conf->ap_scan == 2 &&
1869                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1870                 /* Use ap_scan==1 style network selection to find the network
1871                  */
1872                 wpas_connect_work_done(wpa_s);
1873                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1874                 wpa_s->reassociate = 1;
1875                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1876                 return;
1877 #endif /* CONFIG_WPS */
1878         } else {
1879                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1880                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1881                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1882         }
1883         wpa_supplicant_cancel_sched_scan(wpa_s);
1884         wpa_supplicant_cancel_scan(wpa_s);
1885
1886         /* Starting new association, so clear the possibly used WPA IE from the
1887          * previous association. */
1888         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1889
1890 #ifdef IEEE8021X_EAPOL
1891         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1892                 if (ssid->leap) {
1893                         if (ssid->non_leap == 0)
1894                                 algs = WPA_AUTH_ALG_LEAP;
1895                         else
1896                                 algs |= WPA_AUTH_ALG_LEAP;
1897                 }
1898         }
1899 #endif /* IEEE8021X_EAPOL */
1900         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1901         if (ssid->auth_alg) {
1902                 algs = ssid->auth_alg;
1903                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1904                         "0x%x", algs);
1905         }
1906
1907         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1908                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1909             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1910                 int try_opportunistic;
1911                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1912                                      wpa_s->conf->okc :
1913                                      ssid->proactive_key_caching) &&
1914                         (ssid->proto & WPA_PROTO_RSN);
1915                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1916                                             ssid, try_opportunistic) == 0)
1917                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
1918                 wpa_ie_len = sizeof(wpa_ie);
1919                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1920                                               wpa_ie, &wpa_ie_len)) {
1921                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1922                                 "key management and encryption suites");
1923                         wpas_connect_work_done(wpa_s);
1924                         return;
1925                 }
1926         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1927                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1928                 /*
1929                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1930                  * use non-WPA since the scan results did not indicate that the
1931                  * AP is using WPA or WPA2.
1932                  */
1933                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1934                 wpa_ie_len = 0;
1935                 wpa_s->wpa_proto = 0;
1936         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1937                 wpa_ie_len = sizeof(wpa_ie);
1938                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1939                                               wpa_ie, &wpa_ie_len)) {
1940                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1941                                 "key management and encryption suites (no "
1942                                 "scan results)");
1943                         wpas_connect_work_done(wpa_s);
1944                         return;
1945                 }
1946 #ifdef CONFIG_WPS
1947         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1948                 struct wpabuf *wps_ie;
1949                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1950                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1951                         wpa_ie_len = wpabuf_len(wps_ie);
1952                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1953                 } else
1954                         wpa_ie_len = 0;
1955                 wpabuf_free(wps_ie);
1956                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1957                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1958                         params.wps = WPS_MODE_PRIVACY;
1959                 else
1960                         params.wps = WPS_MODE_OPEN;
1961                 wpa_s->wpa_proto = 0;
1962 #endif /* CONFIG_WPS */
1963         } else {
1964                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1965                 wpa_ie_len = 0;
1966                 wpa_s->wpa_proto = 0;
1967         }
1968
1969 #ifdef CONFIG_P2P
1970         if (wpa_s->global->p2p) {
1971                 u8 *pos;
1972                 size_t len;
1973                 int res;
1974                 pos = wpa_ie + wpa_ie_len;
1975                 len = sizeof(wpa_ie) - wpa_ie_len;
1976                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1977                                             ssid->p2p_group);
1978                 if (res >= 0)
1979                         wpa_ie_len += res;
1980         }
1981
1982         wpa_s->cross_connect_disallowed = 0;
1983         if (bss) {
1984                 struct wpabuf *p2p;
1985                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
1986                 if (p2p) {
1987                         wpa_s->cross_connect_disallowed =
1988                                 p2p_get_cross_connect_disallowed(p2p);
1989                         wpabuf_free(p2p);
1990                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
1991                                 "connection",
1992                                 wpa_s->cross_connect_disallowed ?
1993                                 "disallows" : "allows");
1994                 }
1995         }
1996
1997         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
1998 #endif /* CONFIG_P2P */
1999
2000 #ifdef CONFIG_HS20
2001         if (is_hs20_network(wpa_s, ssid, bss)) {
2002                 struct wpabuf *hs20;
2003                 hs20 = wpabuf_alloc(20);
2004                 if (hs20) {
2005                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2006                         size_t len;
2007
2008                         wpas_hs20_add_indication(hs20, pps_mo_id);
2009                         len = sizeof(wpa_ie) - wpa_ie_len;
2010                         if (wpabuf_len(hs20) <= len) {
2011                                 os_memcpy(wpa_ie + wpa_ie_len,
2012                                           wpabuf_head(hs20), wpabuf_len(hs20));
2013                                 wpa_ie_len += wpabuf_len(hs20);
2014                         }
2015                         wpabuf_free(hs20);
2016                 }
2017         }
2018 #endif /* CONFIG_HS20 */
2019
2020         /*
2021          * Workaround: Add Extended Capabilities element only if the AP
2022          * included this element in Beacon/Probe Response frames. Some older
2023          * APs seem to have interoperability issues if this element is
2024          * included, so while the standard may require us to include the
2025          * element in all cases, it is justifiable to skip it to avoid
2026          * interoperability issues.
2027          */
2028         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2029                 u8 ext_capab[18];
2030                 int ext_capab_len;
2031                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2032                                                      sizeof(ext_capab));
2033                 if (ext_capab_len > 0) {
2034                         u8 *pos = wpa_ie;
2035                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2036                                 pos += 2 + pos[1];
2037                         os_memmove(pos + ext_capab_len, pos,
2038                                    wpa_ie_len - (pos - wpa_ie));
2039                         wpa_ie_len += ext_capab_len;
2040                         os_memcpy(pos, ext_capab, ext_capab_len);
2041                 }
2042         }
2043
2044         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2045                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2046                 size_t len;
2047
2048                 len = sizeof(wpa_ie) - wpa_ie_len;
2049                 if (wpabuf_len(buf) <= len) {
2050                         os_memcpy(wpa_ie + wpa_ie_len,
2051                                   wpabuf_head(buf), wpabuf_len(buf));
2052                         wpa_ie_len += wpabuf_len(buf);
2053                 }
2054         }
2055
2056         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2057         use_crypt = 1;
2058         cipher_pairwise = wpa_s->pairwise_cipher;
2059         cipher_group = wpa_s->group_cipher;
2060         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2061             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2062                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2063                         use_crypt = 0;
2064                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2065                         use_crypt = 1;
2066                         wep_keys_set = 1;
2067                 }
2068         }
2069         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2070                 use_crypt = 0;
2071
2072 #ifdef IEEE8021X_EAPOL
2073         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2074                 if ((ssid->eapol_flags &
2075                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2076                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2077                     !wep_keys_set) {
2078                         use_crypt = 0;
2079                 } else {
2080                         /* Assume that dynamic WEP-104 keys will be used and
2081                          * set cipher suites in order for drivers to expect
2082                          * encryption. */
2083                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2084                 }
2085         }
2086 #endif /* IEEE8021X_EAPOL */
2087
2088         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2089                 /* Set the key before (and later after) association */
2090                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2091         }
2092
2093         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2094         if (bss) {
2095                 params.ssid = bss->ssid;
2096                 params.ssid_len = bss->ssid_len;
2097                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2098                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2099                                    MACSTR " freq=%u MHz based on scan results "
2100                                    "(bssid_set=%d)",
2101                                    MAC2STR(bss->bssid), bss->freq,
2102                                    ssid->bssid_set);
2103                         params.bssid = bss->bssid;
2104                         params.freq.freq = bss->freq;
2105                 }
2106                 params.bssid_hint = bss->bssid;
2107                 params.freq_hint = bss->freq;
2108         } else {
2109                 params.ssid = ssid->ssid;
2110                 params.ssid_len = ssid->ssid_len;
2111         }
2112
2113         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2114             wpa_s->conf->ap_scan == 2) {
2115                 params.bssid = ssid->bssid;
2116                 params.fixed_bssid = 1;
2117         }
2118
2119         /* Initial frequency for IBSS/mesh */
2120         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2121             ssid->frequency > 0 && params.freq.freq == 0)
2122                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2123
2124         if (ssid->mode == WPAS_MODE_IBSS) {
2125                 if (ssid->beacon_int)
2126                         params.beacon_int = ssid->beacon_int;
2127                 else
2128                         params.beacon_int = wpa_s->conf->beacon_int;
2129         }
2130
2131         params.wpa_ie = wpa_ie;
2132         params.wpa_ie_len = wpa_ie_len;
2133         params.pairwise_suite = cipher_pairwise;
2134         params.group_suite = cipher_group;
2135         params.key_mgmt_suite = wpa_s->key_mgmt;
2136         params.wpa_proto = wpa_s->wpa_proto;
2137         params.auth_alg = algs;
2138         params.mode = ssid->mode;
2139         params.bg_scan_period = ssid->bg_scan_period;
2140         for (i = 0; i < NUM_WEP_KEYS; i++) {
2141                 if (ssid->wep_key_len[i])
2142                         params.wep_key[i] = ssid->wep_key[i];
2143                 params.wep_key_len[i] = ssid->wep_key_len[i];
2144         }
2145         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2146
2147         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2148             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2149              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2150                 params.passphrase = ssid->passphrase;
2151                 if (ssid->psk_set)
2152                         params.psk = ssid->psk;
2153         }
2154
2155         if (wpa_s->conf->key_mgmt_offload) {
2156                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2157                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2158                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2159                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2160                         params.req_key_mgmt_offload =
2161                                 ssid->proactive_key_caching < 0 ?
2162                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2163                 else
2164                         params.req_key_mgmt_offload = 1;
2165
2166                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2167                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2168                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2169                     ssid->psk_set)
2170                         params.psk = ssid->psk;
2171         }
2172
2173         params.drop_unencrypted = use_crypt;
2174
2175 #ifdef CONFIG_IEEE80211W
2176         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2177         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2178                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2179                 struct wpa_ie_data ie;
2180                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2181                     ie.capabilities &
2182                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2183                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2184                                 "MFP: require MFP");
2185                         params.mgmt_frame_protection =
2186                                 MGMT_FRAME_PROTECTION_REQUIRED;
2187                 }
2188         }
2189 #endif /* CONFIG_IEEE80211W */
2190
2191         params.p2p = ssid->p2p_group;
2192
2193         if (wpa_s->parent->set_sta_uapsd)
2194                 params.uapsd = wpa_s->parent->sta_uapsd;
2195         else
2196                 params.uapsd = -1;
2197
2198 #ifdef CONFIG_HT_OVERRIDES
2199         os_memset(&htcaps, 0, sizeof(htcaps));
2200         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2201         params.htcaps = (u8 *) &htcaps;
2202         params.htcaps_mask = (u8 *) &htcaps_mask;
2203         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2204 #endif /* CONFIG_HT_OVERRIDES */
2205 #ifdef CONFIG_VHT_OVERRIDES
2206         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2207         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2208         params.vhtcaps = &vhtcaps;
2209         params.vhtcaps_mask = &vhtcaps_mask;
2210         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2211 #endif /* CONFIG_VHT_OVERRIDES */
2212
2213 #ifdef CONFIG_P2P
2214         /*
2215          * If multi-channel concurrency is not supported, check for any
2216          * frequency conflict. In case of any frequency conflict, remove the
2217          * least prioritized connection.
2218          */
2219         if (wpa_s->num_multichan_concurrent < 2) {
2220                 int freq, num;
2221                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2222                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2223                         wpa_printf(MSG_DEBUG,
2224                                    "Assoc conflicting freq found (%d != %d)",
2225                                    freq, params.freq.freq);
2226                         if (wpas_p2p_handle_frequency_conflicts(
2227                                     wpa_s, params.freq.freq, ssid) < 0) {
2228                                 wpas_connect_work_done(wpa_s);
2229                                 return;
2230                         }
2231                 }
2232         }
2233 #endif /* CONFIG_P2P */
2234
2235         ret = wpa_drv_associate(wpa_s, &params);
2236         if (ret < 0) {
2237                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2238                         "failed");
2239                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2240                         /*
2241                          * The driver is known to mean what is saying, so we
2242                          * can stop right here; the association will not
2243                          * succeed.
2244                          */
2245                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2246                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2247                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2248                         return;
2249                 }
2250                 /* try to continue anyway; new association will be tried again
2251                  * after timeout */
2252                 assoc_failed = 1;
2253         }
2254
2255         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2256                 /* Set the key after the association just in case association
2257                  * cleared the previously configured key. */
2258                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2259                 /* No need to timeout authentication since there is no key
2260                  * management. */
2261                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2262                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2263 #ifdef CONFIG_IBSS_RSN
2264         } else if (ssid->mode == WPAS_MODE_IBSS &&
2265                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2266                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2267                 /*
2268                  * RSN IBSS authentication is per-STA and we can disable the
2269                  * per-BSSID authentication.
2270                  */
2271                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2272 #endif /* CONFIG_IBSS_RSN */
2273         } else {
2274                 /* Timeout for IEEE 802.11 authentication and association */
2275                 int timeout = 60;
2276
2277                 if (assoc_failed) {
2278                         /* give IBSS a bit more time */
2279                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2280                 } else if (wpa_s->conf->ap_scan == 1) {
2281                         /* give IBSS a bit more time */
2282                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2283                 }
2284                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2285         }
2286
2287         if (wep_keys_set &&
2288             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2289                 /* Set static WEP keys again */
2290                 wpa_set_wep_keys(wpa_s, ssid);
2291         }
2292
2293         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2294                 /*
2295                  * Do not allow EAP session resumption between different
2296                  * network configurations.
2297                  */
2298                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2299         }
2300         old_ssid = wpa_s->current_ssid;
2301         wpa_s->current_ssid = ssid;
2302         wpa_s->current_bss = bss;
2303         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2304         wpa_supplicant_initiate_eapol(wpa_s);
2305         if (old_ssid != wpa_s->current_ssid)
2306                 wpas_notify_network_changed(wpa_s);
2307 }
2308
2309
2310 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2311                                             const u8 *addr)
2312 {
2313         struct wpa_ssid *old_ssid;
2314
2315         wpas_connect_work_done(wpa_s);
2316         wpa_clear_keys(wpa_s, addr);
2317         old_ssid = wpa_s->current_ssid;
2318         wpa_supplicant_mark_disassoc(wpa_s);
2319         wpa_sm_set_config(wpa_s->wpa, NULL);
2320         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2321         if (old_ssid != wpa_s->current_ssid)
2322                 wpas_notify_network_changed(wpa_s);
2323         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2324 }
2325
2326
2327 /**
2328  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2329  * @wpa_s: Pointer to wpa_supplicant data
2330  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2331  *
2332  * This function is used to request %wpa_supplicant to deauthenticate from the
2333  * current AP.
2334  */
2335 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2336                                    int reason_code)
2337 {
2338         u8 *addr = NULL;
2339         union wpa_event_data event;
2340         int zero_addr = 0;
2341
2342         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2343                 " pending_bssid=" MACSTR " reason=%d state=%s",
2344                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2345                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2346
2347         if (!is_zero_ether_addr(wpa_s->bssid))
2348                 addr = wpa_s->bssid;
2349         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2350                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2351                   wpa_s->wpa_state == WPA_ASSOCIATING))
2352                 addr = wpa_s->pending_bssid;
2353         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2354                 /*
2355                  * When using driver-based BSS selection, we may not know the
2356                  * BSSID with which we are currently trying to associate. We
2357                  * need to notify the driver of this disconnection even in such
2358                  * a case, so use the all zeros address here.
2359                  */
2360                 addr = wpa_s->bssid;
2361                 zero_addr = 1;
2362         }
2363
2364 #ifdef CONFIG_TDLS
2365         wpa_tdls_teardown_peers(wpa_s->wpa);
2366 #endif /* CONFIG_TDLS */
2367
2368 #ifdef CONFIG_MESH
2369         if (wpa_s->ifmsh) {
2370                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2371                              wpa_s->ifname);
2372                 wpa_supplicant_leave_mesh(wpa_s);
2373         }
2374 #endif /* CONFIG_MESH */
2375
2376         if (addr) {
2377                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2378                 os_memset(&event, 0, sizeof(event));
2379                 event.deauth_info.reason_code = (u16) reason_code;
2380                 event.deauth_info.locally_generated = 1;
2381                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2382                 if (zero_addr)
2383                         addr = NULL;
2384         }
2385
2386         wpa_supplicant_clear_connection(wpa_s, addr);
2387 }
2388
2389 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2390                                               struct wpa_ssid *ssid)
2391 {
2392         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2393                 return;
2394
2395         ssid->disabled = 0;
2396         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2397         wpas_notify_network_enabled_changed(wpa_s, ssid);
2398
2399         /*
2400          * Try to reassociate since there is no current configuration and a new
2401          * network was made available.
2402          */
2403         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2404                 wpa_s->reassociate = 1;
2405 }
2406
2407
2408 /**
2409  * wpa_supplicant_enable_network - Mark a configured network as enabled
2410  * @wpa_s: wpa_supplicant structure for a network interface
2411  * @ssid: wpa_ssid structure for a configured network or %NULL
2412  *
2413  * Enables the specified network or all networks if no network specified.
2414  */
2415 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2416                                    struct wpa_ssid *ssid)
2417 {
2418         if (ssid == NULL) {
2419                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2420                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2421         } else
2422                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2423
2424         if (wpa_s->reassociate && !wpa_s->disconnected) {
2425                 if (wpa_s->sched_scanning) {
2426                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2427                                    "new network to scan filters");
2428                         wpa_supplicant_cancel_sched_scan(wpa_s);
2429                 }
2430
2431                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2432                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2433         }
2434 }
2435
2436
2437 /**
2438  * wpa_supplicant_disable_network - Mark a configured network as disabled
2439  * @wpa_s: wpa_supplicant structure for a network interface
2440  * @ssid: wpa_ssid structure for a configured network or %NULL
2441  *
2442  * Disables the specified network or all networks if no network specified.
2443  */
2444 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2445                                     struct wpa_ssid *ssid)
2446 {
2447         struct wpa_ssid *other_ssid;
2448         int was_disabled;
2449
2450         if (ssid == NULL) {
2451                 if (wpa_s->sched_scanning)
2452                         wpa_supplicant_cancel_sched_scan(wpa_s);
2453
2454                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2455                      other_ssid = other_ssid->next) {
2456                         was_disabled = other_ssid->disabled;
2457                         if (was_disabled == 2)
2458                                 continue; /* do not change persistent P2P group
2459                                            * data */
2460
2461                         other_ssid->disabled = 1;
2462
2463                         if (was_disabled != other_ssid->disabled)
2464                                 wpas_notify_network_enabled_changed(
2465                                         wpa_s, other_ssid);
2466                 }
2467                 if (wpa_s->current_ssid)
2468                         wpa_supplicant_deauthenticate(
2469                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2470         } else if (ssid->disabled != 2) {
2471                 if (ssid == wpa_s->current_ssid)
2472                         wpa_supplicant_deauthenticate(
2473                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2474
2475                 was_disabled = ssid->disabled;
2476
2477                 ssid->disabled = 1;
2478
2479                 if (was_disabled != ssid->disabled) {
2480                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2481                         if (wpa_s->sched_scanning) {
2482                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2483                                            "to remove network from filters");
2484                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2485                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2486                         }
2487                 }
2488         }
2489 }
2490
2491
2492 /**
2493  * wpa_supplicant_select_network - Attempt association with a network
2494  * @wpa_s: wpa_supplicant structure for a network interface
2495  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2496  */
2497 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2498                                    struct wpa_ssid *ssid)
2499 {
2500
2501         struct wpa_ssid *other_ssid;
2502         int disconnected = 0;
2503
2504         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2505                 wpa_supplicant_deauthenticate(
2506                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2507                 disconnected = 1;
2508         }
2509
2510         if (ssid)
2511                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2512
2513         /*
2514          * Mark all other networks disabled or mark all networks enabled if no
2515          * network specified.
2516          */
2517         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2518              other_ssid = other_ssid->next) {
2519                 int was_disabled = other_ssid->disabled;
2520                 if (was_disabled == 2)
2521                         continue; /* do not change persistent P2P group data */
2522
2523                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2524                 if (was_disabled && !other_ssid->disabled)
2525                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2526
2527                 if (was_disabled != other_ssid->disabled)
2528                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2529         }
2530
2531         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2532                 /* We are already associated with the selected network */
2533                 wpa_printf(MSG_DEBUG, "Already associated with the "
2534                            "selected network - do nothing");
2535                 return;
2536         }
2537
2538         if (ssid) {
2539                 wpa_s->current_ssid = ssid;
2540                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2541                 wpa_s->connect_without_scan =
2542                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2543         } else {
2544                 wpa_s->connect_without_scan = NULL;
2545         }
2546
2547         wpa_s->disconnected = 0;
2548         wpa_s->reassociate = 1;
2549
2550         if (wpa_s->connect_without_scan ||
2551             wpa_supplicant_fast_associate(wpa_s) != 1)
2552                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2553
2554         if (ssid)
2555                 wpas_notify_network_selected(wpa_s, ssid);
2556 }
2557
2558
2559 /**
2560  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2561  * @wpa_s: wpa_supplicant structure for a network interface
2562  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2563  * @pkcs11_module_path: PKCS #11 module path or NULL
2564  * Returns: 0 on success; -1 on failure
2565  *
2566  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2567  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2568  * module path fails the paths will be reset to the default value (NULL).
2569  */
2570 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2571                                            const char *pkcs11_engine_path,
2572                                            const char *pkcs11_module_path)
2573 {
2574         char *pkcs11_engine_path_copy = NULL;
2575         char *pkcs11_module_path_copy = NULL;
2576
2577         if (pkcs11_engine_path != NULL) {
2578                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2579                 if (pkcs11_engine_path_copy == NULL)
2580                         return -1;
2581         }
2582         if (pkcs11_module_path != NULL) {
2583                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2584                 if (pkcs11_module_path_copy == NULL) {
2585                         os_free(pkcs11_engine_path_copy);
2586                         return -1;
2587                 }
2588         }
2589
2590         os_free(wpa_s->conf->pkcs11_engine_path);
2591         os_free(wpa_s->conf->pkcs11_module_path);
2592         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2593         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2594
2595         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2596         eapol_sm_deinit(wpa_s->eapol);
2597         wpa_s->eapol = NULL;
2598         if (wpa_supplicant_init_eapol(wpa_s)) {
2599                 /* Error -> Reset paths to the default value (NULL) once. */
2600                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2601                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2602                                                                NULL);
2603
2604                 return -1;
2605         }
2606         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2607
2608         return 0;
2609 }
2610
2611
2612 /**
2613  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2614  * @wpa_s: wpa_supplicant structure for a network interface
2615  * @ap_scan: AP scan mode
2616  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2617  *
2618  */
2619 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2620 {
2621
2622         int old_ap_scan;
2623
2624         if (ap_scan < 0 || ap_scan > 2)
2625                 return -1;
2626
2627 #ifdef ANDROID
2628         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2629             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2630             wpa_s->wpa_state < WPA_COMPLETED) {
2631                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2632                            "associating", wpa_s->conf->ap_scan, ap_scan);
2633                 return 0;
2634         }
2635 #endif /* ANDROID */
2636
2637         old_ap_scan = wpa_s->conf->ap_scan;
2638         wpa_s->conf->ap_scan = ap_scan;
2639
2640         if (old_ap_scan != wpa_s->conf->ap_scan)
2641                 wpas_notify_ap_scan_changed(wpa_s);
2642
2643         return 0;
2644 }
2645
2646
2647 /**
2648  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2649  * @wpa_s: wpa_supplicant structure for a network interface
2650  * @expire_age: Expiration age in seconds
2651  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2652  *
2653  */
2654 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2655                                           unsigned int bss_expire_age)
2656 {
2657         if (bss_expire_age < 10) {
2658                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2659                         bss_expire_age);
2660                 return -1;
2661         }
2662         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2663                 bss_expire_age);
2664         wpa_s->conf->bss_expiration_age = bss_expire_age;
2665
2666         return 0;
2667 }
2668
2669
2670 /**
2671  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2672  * @wpa_s: wpa_supplicant structure for a network interface
2673  * @expire_count: number of scans after which an unseen BSS is reclaimed
2674  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2675  *
2676  */
2677 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2678                                             unsigned int bss_expire_count)
2679 {
2680         if (bss_expire_count < 1) {
2681                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2682                         bss_expire_count);
2683                 return -1;
2684         }
2685         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2686                 bss_expire_count);
2687         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2688
2689         return 0;
2690 }
2691
2692
2693 /**
2694  * wpa_supplicant_set_scan_interval - Set scan interval
2695  * @wpa_s: wpa_supplicant structure for a network interface
2696  * @scan_interval: scan interval in seconds
2697  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2698  *
2699  */
2700 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2701                                      int scan_interval)
2702 {
2703         if (scan_interval < 0) {
2704                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2705                         scan_interval);
2706                 return -1;
2707         }
2708         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2709                 scan_interval);
2710         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2711
2712         return 0;
2713 }
2714
2715
2716 /**
2717  * wpa_supplicant_set_debug_params - Set global debug params
2718  * @global: wpa_global structure
2719  * @debug_level: debug level
2720  * @debug_timestamp: determines if show timestamp in debug data
2721  * @debug_show_keys: determines if show keys in debug data
2722  * Returns: 0 if succeed or -1 if debug_level has wrong value
2723  */
2724 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2725                                     int debug_timestamp, int debug_show_keys)
2726 {
2727
2728         int old_level, old_timestamp, old_show_keys;
2729
2730         /* check for allowed debuglevels */
2731         if (debug_level != MSG_EXCESSIVE &&
2732             debug_level != MSG_MSGDUMP &&
2733             debug_level != MSG_DEBUG &&
2734             debug_level != MSG_INFO &&
2735             debug_level != MSG_WARNING &&
2736             debug_level != MSG_ERROR)
2737                 return -1;
2738
2739         old_level = wpa_debug_level;
2740         old_timestamp = wpa_debug_timestamp;
2741         old_show_keys = wpa_debug_show_keys;
2742
2743         wpa_debug_level = debug_level;
2744         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2745         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2746
2747         if (wpa_debug_level != old_level)
2748                 wpas_notify_debug_level_changed(global);
2749         if (wpa_debug_timestamp != old_timestamp)
2750                 wpas_notify_debug_timestamp_changed(global);
2751         if (wpa_debug_show_keys != old_show_keys)
2752                 wpas_notify_debug_show_keys_changed(global);
2753
2754         return 0;
2755 }
2756
2757
2758 /**
2759  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2760  * @wpa_s: Pointer to wpa_supplicant data
2761  * Returns: A pointer to the current network structure or %NULL on failure
2762  */
2763 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2764 {
2765         struct wpa_ssid *entry;
2766         u8 ssid[MAX_SSID_LEN];
2767         int res;
2768         size_t ssid_len;
2769         u8 bssid[ETH_ALEN];
2770         int wired;
2771
2772         res = wpa_drv_get_ssid(wpa_s, ssid);
2773         if (res < 0) {
2774                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2775                         "driver");
2776                 return NULL;
2777         }
2778         ssid_len = res;
2779
2780         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2781                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2782                         "driver");
2783                 return NULL;
2784         }
2785
2786         wired = wpa_s->conf->ap_scan == 0 &&
2787                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2788
2789         entry = wpa_s->conf->ssid;
2790         while (entry) {
2791                 if (!wpas_network_disabled(wpa_s, entry) &&
2792                     ((ssid_len == entry->ssid_len &&
2793                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2794                     (!entry->bssid_set ||
2795                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2796                         return entry;
2797 #ifdef CONFIG_WPS
2798                 if (!wpas_network_disabled(wpa_s, entry) &&
2799                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2800                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2801                     (!entry->bssid_set ||
2802                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2803                         return entry;
2804 #endif /* CONFIG_WPS */
2805
2806                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2807                     entry->ssid_len == 0 &&
2808                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2809                         return entry;
2810
2811                 entry = entry->next;
2812         }
2813
2814         return NULL;
2815 }
2816
2817
2818 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2819 {
2820         struct wpa_global *global = wpa_s->global;
2821
2822         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2823                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2824                 if (global->drv_priv[i] == NULL) {
2825                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2826                                    "'%s'", wpa_drivers[i]->name);
2827                         return -1;
2828                 }
2829         }
2830
2831         wpa_s->driver = wpa_drivers[i];
2832         wpa_s->global_drv_priv = global->drv_priv[i];
2833
2834         return 0;
2835 }
2836
2837
2838 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2839                                      const char *name)
2840 {
2841         int i;
2842         size_t len;
2843         const char *pos, *driver = name;
2844
2845         if (wpa_s == NULL)
2846                 return -1;
2847
2848         if (wpa_drivers[0] == NULL) {
2849                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2850                         "wpa_supplicant");
2851                 return -1;
2852         }
2853
2854         if (name == NULL) {
2855                 /* default to first driver in the list */
2856                 return select_driver(wpa_s, 0);
2857         }
2858
2859         do {
2860                 pos = os_strchr(driver, ',');
2861                 if (pos)
2862                         len = pos - driver;
2863                 else
2864                         len = os_strlen(driver);
2865
2866                 for (i = 0; wpa_drivers[i]; i++) {
2867                         if (os_strlen(wpa_drivers[i]->name) == len &&
2868                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2869                             0) {
2870                                 /* First driver that succeeds wins */
2871                                 if (select_driver(wpa_s, i) == 0)
2872                                         return 0;
2873                         }
2874                 }
2875
2876                 driver = pos + 1;
2877         } while (pos);
2878
2879         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2880         return -1;
2881 }
2882
2883
2884 /**
2885  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2886  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2887  *      with struct wpa_driver_ops::init()
2888  * @src_addr: Source address of the EAPOL frame
2889  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2890  * @len: Length of the EAPOL data
2891  *
2892  * This function is called for each received EAPOL frame. Most driver
2893  * interfaces rely on more generic OS mechanism for receiving frames through
2894  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2895  * take care of received EAPOL frames and deliver them to the core supplicant
2896  * code by calling this function.
2897  */
2898 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2899                              const u8 *buf, size_t len)
2900 {
2901         struct wpa_supplicant *wpa_s = ctx;
2902
2903         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2904         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2905
2906 #ifdef CONFIG_PEERKEY
2907         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2908             wpa_s->current_ssid->peerkey &&
2909             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2910             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2911                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2912                 return;
2913         }
2914 #endif /* CONFIG_PEERKEY */
2915
2916         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2917             (wpa_s->last_eapol_matches_bssid &&
2918 #ifdef CONFIG_AP
2919              !wpa_s->ap_iface &&
2920 #endif /* CONFIG_AP */
2921              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2922                 /*
2923                  * There is possible race condition between receiving the
2924                  * association event and the EAPOL frame since they are coming
2925                  * through different paths from the driver. In order to avoid
2926                  * issues in trying to process the EAPOL frame before receiving
2927                  * association information, lets queue it for processing until
2928                  * the association event is received. This may also be needed in
2929                  * driver-based roaming case, so also use src_addr != BSSID as a
2930                  * trigger if we have previously confirmed that the
2931                  * Authenticator uses BSSID as the src_addr (which is not the
2932                  * case with wired IEEE 802.1X).
2933                  */
2934                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2935                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2936                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2937                         MAC2STR(wpa_s->bssid));
2938                 wpabuf_free(wpa_s->pending_eapol_rx);
2939                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2940                 if (wpa_s->pending_eapol_rx) {
2941                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2942                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2943                                   ETH_ALEN);
2944                 }
2945                 return;
2946         }
2947
2948         wpa_s->last_eapol_matches_bssid =
2949                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2950
2951 #ifdef CONFIG_AP
2952         if (wpa_s->ap_iface) {
2953                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2954                 return;
2955         }
2956 #endif /* CONFIG_AP */
2957
2958         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2959                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2960                         "no key management is configured");
2961                 return;
2962         }
2963
2964         if (wpa_s->eapol_received == 0 &&
2965             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2966              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2967              wpa_s->wpa_state != WPA_COMPLETED) &&
2968             (wpa_s->current_ssid == NULL ||
2969              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
2970                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2971                 wpa_supplicant_req_auth_timeout(
2972                         wpa_s,
2973                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2974                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
2975                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
2976                         70 : 10, 0);
2977         }
2978         wpa_s->eapol_received++;
2979
2980         if (wpa_s->countermeasures) {
2981                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
2982                         "EAPOL packet");
2983                 return;
2984         }
2985
2986 #ifdef CONFIG_IBSS_RSN
2987         if (wpa_s->current_ssid &&
2988             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
2989                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
2990                 return;
2991         }
2992 #endif /* CONFIG_IBSS_RSN */
2993
2994         /* Source address of the incoming EAPOL frame could be compared to the
2995          * current BSSID. However, it is possible that a centralized
2996          * Authenticator could be using another MAC address than the BSSID of
2997          * an AP, so just allow any address to be used for now. The replies are
2998          * still sent to the current BSSID (if available), though. */
2999
3000         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3001         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3002             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3003                 return;
3004         wpa_drv_poll(wpa_s);
3005         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3006                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3007         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3008                 /*
3009                  * Set portValid = TRUE here since we are going to skip 4-way
3010                  * handshake processing which would normally set portValid. We
3011                  * need this to allow the EAPOL state machines to be completed
3012                  * without going through EAPOL-Key handshake.
3013                  */
3014                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3015         }
3016 }
3017
3018
3019 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3020 {
3021         if ((!wpa_s->p2p_mgmt ||
3022              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3023             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3024                 l2_packet_deinit(wpa_s->l2);
3025                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3026                                            wpa_drv_get_mac_addr(wpa_s),
3027                                            ETH_P_EAPOL,
3028                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3029                 if (wpa_s->l2 == NULL)
3030                         return -1;
3031         } else {
3032                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3033                 if (addr)
3034                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3035         }
3036
3037         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3038                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3039                 return -1;
3040         }
3041
3042         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3043
3044         return 0;
3045 }
3046
3047
3048 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3049                                            const u8 *buf, size_t len)
3050 {
3051         struct wpa_supplicant *wpa_s = ctx;
3052         const struct l2_ethhdr *eth;
3053
3054         if (len < sizeof(*eth))
3055                 return;
3056         eth = (const struct l2_ethhdr *) buf;
3057
3058         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3059             !(eth->h_dest[0] & 0x01)) {
3060                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3061                         " (bridge - not for this interface - ignore)",
3062                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3063                 return;
3064         }
3065
3066         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3067                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3068         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3069                                 len - sizeof(*eth));
3070 }
3071
3072
3073 /**
3074  * wpa_supplicant_driver_init - Initialize driver interface parameters
3075  * @wpa_s: Pointer to wpa_supplicant data
3076  * Returns: 0 on success, -1 on failure
3077  *
3078  * This function is called to initialize driver interface parameters.
3079  * wpa_drv_init() must have been called before this function to initialize the
3080  * driver interface.
3081  */
3082 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3083 {
3084         static int interface_count = 0;
3085
3086         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3087                 return -1;
3088
3089         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3090                 MAC2STR(wpa_s->own_addr));
3091         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3092         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3093
3094         if (wpa_s->bridge_ifname[0]) {
3095                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3096                         "interface '%s'", wpa_s->bridge_ifname);
3097                 wpa_s->l2_br = l2_packet_init_bridge(
3098                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3099                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3100                 if (wpa_s->l2_br == NULL) {
3101                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3102                                 "connection for the bridge interface '%s'",
3103                                 wpa_s->bridge_ifname);
3104                         return -1;
3105                 }
3106         }
3107
3108         wpa_clear_keys(wpa_s, NULL);
3109
3110         /* Make sure that TKIP countermeasures are not left enabled (could
3111          * happen if wpa_supplicant is killed during countermeasures. */
3112         wpa_drv_set_countermeasures(wpa_s, 0);
3113
3114         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3115         wpa_drv_flush_pmkid(wpa_s);
3116
3117         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3118         wpa_s->prev_scan_wildcard = 0;
3119
3120         if (wpa_supplicant_enabled_networks(wpa_s)) {
3121                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3122                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3123                         interface_count = 0;
3124                 }
3125 #ifndef ANDROID
3126                 if (!wpa_s->p2p_mgmt &&
3127                     wpa_supplicant_delayed_sched_scan(wpa_s,
3128                                                       interface_count % 3,
3129                                                       100000))
3130                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3131                                                 100000);
3132 #endif /* ANDROID */
3133                 interface_count++;
3134         } else
3135                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3136
3137         return 0;
3138 }
3139
3140
3141 static int wpa_supplicant_daemon(const char *pid_file)
3142 {
3143         wpa_printf(MSG_DEBUG, "Daemonize..");
3144         return os_daemonize(pid_file);
3145 }
3146
3147
3148 static struct wpa_supplicant * wpa_supplicant_alloc(void)
3149 {
3150         struct wpa_supplicant *wpa_s;
3151
3152         wpa_s = os_zalloc(sizeof(*wpa_s));
3153         if (wpa_s == NULL)
3154                 return NULL;
3155         wpa_s->scan_req = INITIAL_SCAN_REQ;
3156         wpa_s->scan_interval = 5;
3157         wpa_s->new_connection = 1;
3158         wpa_s->parent = wpa_s;
3159         wpa_s->sched_scanning = 0;
3160
3161         return wpa_s;
3162 }
3163
3164
3165 #ifdef CONFIG_HT_OVERRIDES
3166
3167 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3168                              struct ieee80211_ht_capabilities *htcaps,
3169                              struct ieee80211_ht_capabilities *htcaps_mask,
3170                              const char *ht_mcs)
3171 {
3172         /* parse ht_mcs into hex array */
3173         int i;
3174         const char *tmp = ht_mcs;
3175         char *end = NULL;
3176
3177         /* If ht_mcs is null, do not set anything */
3178         if (!ht_mcs)
3179                 return 0;
3180
3181         /* This is what we are setting in the kernel */
3182         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3183
3184         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3185
3186         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3187                 errno = 0;
3188                 long v = strtol(tmp, &end, 16);
3189                 if (errno == 0) {
3190                         wpa_msg(wpa_s, MSG_DEBUG,
3191                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3192                                 i, v, end, tmp);
3193                         if (end == tmp)
3194                                 break;
3195
3196                         htcaps->supported_mcs_set[i] = v;
3197                         tmp = end;
3198                 } else {
3199                         wpa_msg(wpa_s, MSG_ERROR,
3200                                 "Failed to parse ht-mcs: %s, error: %s\n",
3201                                 ht_mcs, strerror(errno));
3202                         return -1;
3203                 }
3204         }
3205
3206         /*
3207          * If we were able to parse any values, then set mask for the MCS set.
3208          */
3209         if (i) {
3210                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3211                           IEEE80211_HT_MCS_MASK_LEN - 1);
3212                 /* skip the 3 reserved bits */
3213                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3214                         0x1f;
3215         }
3216
3217         return 0;
3218 }
3219
3220
3221 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3222                                  struct ieee80211_ht_capabilities *htcaps,
3223                                  struct ieee80211_ht_capabilities *htcaps_mask,
3224                                  int disabled)
3225 {
3226         le16 msk;
3227
3228         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3229
3230         if (disabled == -1)
3231                 return 0;
3232
3233         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3234         htcaps_mask->ht_capabilities_info |= msk;
3235         if (disabled)
3236                 htcaps->ht_capabilities_info &= msk;
3237         else
3238                 htcaps->ht_capabilities_info |= msk;
3239
3240         return 0;
3241 }
3242
3243
3244 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3245                                 struct ieee80211_ht_capabilities *htcaps,
3246                                 struct ieee80211_ht_capabilities *htcaps_mask,
3247                                 int factor)
3248 {
3249         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3250
3251         if (factor == -1)
3252                 return 0;
3253
3254         if (factor < 0 || factor > 3) {
3255                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3256                         "Must be 0-3 or -1", factor);
3257                 return -EINVAL;
3258         }
3259
3260         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3261         htcaps->a_mpdu_params &= ~0x3;
3262         htcaps->a_mpdu_params |= factor & 0x3;
3263
3264         return 0;
3265 }
3266
3267
3268 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3269                                  struct ieee80211_ht_capabilities *htcaps,
3270                                  struct ieee80211_ht_capabilities *htcaps_mask,
3271                                  int density)
3272 {
3273         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3274
3275         if (density == -1)
3276                 return 0;
3277
3278         if (density < 0 || density > 7) {
3279                 wpa_msg(wpa_s, MSG_ERROR,
3280                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3281                         density);
3282                 return -EINVAL;
3283         }
3284
3285         htcaps_mask->a_mpdu_params |= 0x1C;
3286         htcaps->a_mpdu_params &= ~(0x1C);
3287         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3288
3289         return 0;
3290 }
3291
3292
3293 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3294                                 struct ieee80211_ht_capabilities *htcaps,
3295                                 struct ieee80211_ht_capabilities *htcaps_mask,
3296                                 int disabled)
3297 {
3298         /* Masking these out disables HT40 */
3299         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3300                                 HT_CAP_INFO_SHORT_GI40MHZ);
3301
3302         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3303
3304         if (disabled)
3305                 htcaps->ht_capabilities_info &= ~msk;
3306         else
3307                 htcaps->ht_capabilities_info |= msk;
3308
3309         htcaps_mask->ht_capabilities_info |= msk;
3310
3311         return 0;
3312 }
3313
3314
3315 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3316                                struct ieee80211_ht_capabilities *htcaps,
3317                                struct ieee80211_ht_capabilities *htcaps_mask,
3318                                int disabled)
3319 {
3320         /* Masking these out disables SGI */
3321         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3322                                 HT_CAP_INFO_SHORT_GI40MHZ);
3323
3324         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3325
3326         if (disabled)
3327                 htcaps->ht_capabilities_info &= ~msk;
3328         else
3329                 htcaps->ht_capabilities_info |= msk;
3330
3331         htcaps_mask->ht_capabilities_info |= msk;
3332
3333         return 0;
3334 }
3335
3336
3337 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3338                                struct ieee80211_ht_capabilities *htcaps,
3339                                struct ieee80211_ht_capabilities *htcaps_mask,
3340                                int disabled)
3341 {
3342         /* Masking these out disables LDPC */
3343         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3344
3345         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3346
3347         if (disabled)
3348                 htcaps->ht_capabilities_info &= ~msk;
3349         else
3350                 htcaps->ht_capabilities_info |= msk;
3351
3352         htcaps_mask->ht_capabilities_info |= msk;
3353
3354         return 0;
3355 }
3356
3357
3358 void wpa_supplicant_apply_ht_overrides(
3359         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3360         struct wpa_driver_associate_params *params)
3361 {
3362         struct ieee80211_ht_capabilities *htcaps;
3363         struct ieee80211_ht_capabilities *htcaps_mask;
3364
3365         if (!ssid)
3366                 return;
3367
3368         params->disable_ht = ssid->disable_ht;
3369         if (!params->htcaps || !params->htcaps_mask)
3370                 return;
3371
3372         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3373         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3374         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3375         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3376                               ssid->disable_max_amsdu);
3377         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3378         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3379         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3380         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3381         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3382
3383         if (ssid->ht40_intolerant) {
3384                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3385                 htcaps->ht_capabilities_info |= bit;
3386                 htcaps_mask->ht_capabilities_info |= bit;
3387         }
3388 }
3389
3390 #endif /* CONFIG_HT_OVERRIDES */
3391
3392
3393 #ifdef CONFIG_VHT_OVERRIDES
3394 void wpa_supplicant_apply_vht_overrides(
3395         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3396         struct wpa_driver_associate_params *params)
3397 {
3398         struct ieee80211_vht_capabilities *vhtcaps;
3399         struct ieee80211_vht_capabilities *vhtcaps_mask;
3400
3401         if (!ssid)
3402                 return;
3403
3404         params->disable_vht = ssid->disable_vht;
3405
3406         vhtcaps = (void *) params->vhtcaps;
3407         vhtcaps_mask = (void *) params->vhtcaps_mask;
3408
3409         if (!vhtcaps || !vhtcaps_mask)
3410                 return;
3411
3412         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3413         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3414
3415 #ifdef CONFIG_HT_OVERRIDES
3416         /* if max ampdu is <= 3, we have to make the HT cap the same */
3417         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3418                 int max_ampdu;
3419
3420                 max_ampdu = (ssid->vht_capa &
3421                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3422                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3423
3424                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3425                 wpa_set_ampdu_factor(wpa_s,
3426                                      (void *) params->htcaps,
3427                                      (void *) params->htcaps_mask,
3428                                      max_ampdu);
3429         }
3430 #endif /* CONFIG_HT_OVERRIDES */
3431
3432 #define OVERRIDE_MCS(i)                                                 \
3433         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3434                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3435                         3 << 2 * (i - 1);                               \
3436                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3437                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3438         }                                                               \
3439         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3440                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3441                         3 << 2 * (i - 1);                               \
3442                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3443                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3444         }
3445
3446         OVERRIDE_MCS(1);
3447         OVERRIDE_MCS(2);
3448         OVERRIDE_MCS(3);
3449         OVERRIDE_MCS(4);
3450         OVERRIDE_MCS(5);
3451         OVERRIDE_MCS(6);
3452         OVERRIDE_MCS(7);
3453         OVERRIDE_MCS(8);
3454 }
3455 #endif /* CONFIG_VHT_OVERRIDES */
3456
3457
3458 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3459 {
3460 #ifdef PCSC_FUNCS
3461         size_t len;
3462
3463         if (!wpa_s->conf->pcsc_reader)
3464                 return 0;
3465
3466         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3467         if (!wpa_s->scard)
3468                 return 1;
3469
3470         if (wpa_s->conf->pcsc_pin &&
3471             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3472                 scard_deinit(wpa_s->scard);
3473                 wpa_s->scard = NULL;
3474                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3475                 return -1;
3476         }
3477
3478         len = sizeof(wpa_s->imsi) - 1;
3479         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3480                 scard_deinit(wpa_s->scard);
3481                 wpa_s->scard = NULL;
3482                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3483                 return -1;
3484         }
3485         wpa_s->imsi[len] = '\0';
3486
3487         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3488
3489         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3490                    wpa_s->imsi, wpa_s->mnc_len);
3491
3492         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3493         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3494 #endif /* PCSC_FUNCS */
3495
3496         return 0;
3497 }
3498
3499
3500 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3501 {
3502         char *val, *pos;
3503
3504         ext_password_deinit(wpa_s->ext_pw);
3505         wpa_s->ext_pw = NULL;
3506         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3507
3508         if (!wpa_s->conf->ext_password_backend)
3509                 return 0;
3510
3511         val = os_strdup(wpa_s->conf->ext_password_backend);
3512         if (val == NULL)
3513                 return -1;
3514         pos = os_strchr(val, ':');
3515         if (pos)
3516                 *pos++ = '\0';
3517
3518         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3519
3520         wpa_s->ext_pw = ext_password_init(val, pos);
3521         os_free(val);
3522         if (wpa_s->ext_pw == NULL) {
3523                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3524                 return -1;
3525         }
3526         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3527
3528         return 0;
3529 }
3530
3531
3532 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3533                                     const struct wpa_driver_capa *capa)
3534 {
3535         struct wowlan_triggers *triggers;
3536         int ret = 0;
3537
3538         if (!wpa_s->conf->wowlan_triggers)
3539                 return 0;
3540
3541         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3542         if (triggers) {
3543                 ret = wpa_drv_wowlan(wpa_s, triggers);
3544                 os_free(triggers);
3545         }
3546         return ret;
3547 }
3548
3549
3550 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3551                                               const char *rn)
3552 {
3553         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3554         struct wpa_radio *radio;
3555
3556         while (rn && iface) {
3557                 radio = iface->radio;
3558                 if (radio && os_strcmp(rn, radio->name) == 0) {
3559                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3560                                    wpa_s->ifname, rn);
3561                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3562                         return radio;
3563                 }
3564
3565                 iface = iface->next;
3566         }
3567
3568         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3569                    wpa_s->ifname, rn ? rn : "N/A");
3570         radio = os_zalloc(sizeof(*radio));
3571         if (radio == NULL)
3572                 return NULL;
3573
3574         if (rn)
3575                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3576         dl_list_init(&radio->ifaces);
3577         dl_list_init(&radio->work);
3578         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3579
3580         return radio;
3581 }
3582
3583
3584 static void radio_work_free(struct wpa_radio_work *work)
3585 {
3586         if (work->wpa_s->scan_work == work) {
3587                 /* This should not really happen. */
3588                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3589                         work->type, work, work->started);
3590                 work->wpa_s->scan_work = NULL;
3591         }
3592
3593 #ifdef CONFIG_P2P
3594         if (work->wpa_s->p2p_scan_work == work) {
3595                 /* This should not really happen. */
3596                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3597                         work->type, work, work->started);
3598                 work->wpa_s->p2p_scan_work = NULL;
3599         }
3600 #endif /* CONFIG_P2P */
3601
3602         dl_list_del(&work->list);
3603         os_free(work);
3604 }
3605
3606
3607 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3608 {
3609         struct wpa_radio *radio = eloop_ctx;
3610         struct wpa_radio_work *work;
3611         struct os_reltime now, diff;
3612         struct wpa_supplicant *wpa_s;
3613
3614         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3615         if (work == NULL)
3616                 return;
3617
3618         if (work->started)
3619                 return; /* already started and still in progress */
3620
3621         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3622                               radio_list);
3623         if (wpa_s && wpa_s->radio->external_scan_running) {
3624                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3625                 return;
3626         }
3627
3628         os_get_reltime(&now);
3629         os_reltime_sub(&now, &work->time, &diff);
3630         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3631                 work->type, work, diff.sec, diff.usec);
3632         work->started = 1;
3633         work->time = now;
3634         work->cb(work, 0);
3635 }
3636
3637
3638 /*
3639  * This function removes both started and pending radio works running on
3640  * the provided interface's radio.
3641  * Prior to the removal of the radio work, its callback (cb) is called with
3642  * deinit set to be 1. Each work's callback is responsible for clearing its
3643  * internal data and restoring to a correct state.
3644  * @wpa_s: wpa_supplicant data
3645  * @type: type of works to be removed
3646  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3647  * this interface's works.
3648  */
3649 void radio_remove_works(struct wpa_supplicant *wpa_s,
3650                         const char *type, int remove_all)
3651 {
3652         struct wpa_radio_work *work, *tmp;
3653         struct wpa_radio *radio = wpa_s->radio;
3654
3655         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3656                               list) {
3657                 if (type && os_strcmp(type, work->type) != 0)
3658                         continue;
3659
3660                 /* skip other ifaces' works */
3661                 if (!remove_all && work->wpa_s != wpa_s)
3662                         continue;
3663
3664                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3665                         work->type, work, work->started ? " (started)" : "");
3666                 work->cb(work, 1);
3667                 radio_work_free(work);
3668         }
3669
3670         /* in case we removed the started work */
3671         radio_work_check_next(wpa_s);
3672 }
3673
3674
3675 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3676 {
3677         struct wpa_radio *radio = wpa_s->radio;
3678
3679         if (!radio)
3680                 return;
3681
3682         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3683                    wpa_s->ifname, radio->name);
3684         dl_list_del(&wpa_s->radio_list);
3685         radio_remove_works(wpa_s, NULL, 0);
3686         wpa_s->radio = NULL;
3687         if (!dl_list_empty(&radio->ifaces))
3688                 return; /* Interfaces remain for this radio */
3689
3690         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3691         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3692         os_free(radio);
3693 }
3694
3695
3696 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3697 {
3698         struct wpa_radio *radio = wpa_s->radio;
3699
3700         if (dl_list_empty(&radio->work))
3701                 return;
3702         if (wpa_s->ext_work_in_progress) {
3703                 wpa_printf(MSG_DEBUG,
3704                            "External radio work in progress - delay start of pending item");
3705                 return;
3706         }
3707         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3708         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3709 }
3710
3711
3712 /**
3713  * radio_add_work - Add a radio work item
3714  * @wpa_s: Pointer to wpa_supplicant data
3715  * @freq: Frequency of the offchannel operation in MHz or 0
3716  * @type: Unique identifier for each type of work
3717  * @next: Force as the next work to be executed
3718  * @cb: Callback function for indicating when radio is available
3719  * @ctx: Context pointer for the work (work->ctx in cb())
3720  * Returns: 0 on success, -1 on failure
3721  *
3722  * This function is used to request time for an operation that requires
3723  * exclusive radio control. Once the radio is available, the registered callback
3724  * function will be called. radio_work_done() must be called once the exclusive
3725  * radio operation has been completed, so that the radio is freed for other
3726  * operations. The special case of deinit=1 is used to free the context data
3727  * during interface removal. That does not allow the callback function to start
3728  * the radio operation, i.e., it must free any resources allocated for the radio
3729  * work and return.
3730  *
3731  * The @freq parameter can be used to indicate a single channel on which the
3732  * offchannel operation will occur. This may allow multiple radio work
3733  * operations to be performed in parallel if they apply for the same channel.
3734  * Setting this to 0 indicates that the work item may use multiple channels or
3735  * requires exclusive control of the radio.
3736  */
3737 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3738                    const char *type, int next,
3739                    void (*cb)(struct wpa_radio_work *work, int deinit),
3740                    void *ctx)
3741 {
3742         struct wpa_radio_work *work;
3743         int was_empty;
3744
3745         work = os_zalloc(sizeof(*work));
3746         if (work == NULL)
3747                 return -1;
3748         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3749         os_get_reltime(&work->time);
3750         work->freq = freq;
3751         work->type = type;
3752         work->wpa_s = wpa_s;
3753         work->cb = cb;
3754         work->ctx = ctx;
3755
3756         was_empty = dl_list_empty(&wpa_s->radio->work);
3757         if (next)
3758                 dl_list_add(&wpa_s->radio->work, &work->list);
3759         else
3760                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3761         if (was_empty) {
3762                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3763                 radio_work_check_next(wpa_s);
3764         }
3765
3766         return 0;
3767 }
3768
3769
3770 /**
3771  * radio_work_done - Indicate that a radio work item has been completed
3772  * @work: Completed work
3773  *
3774  * This function is called once the callback function registered with
3775  * radio_add_work() has completed its work.
3776  */
3777 void radio_work_done(struct wpa_radio_work *work)
3778 {
3779         struct wpa_supplicant *wpa_s = work->wpa_s;
3780         struct os_reltime now, diff;
3781         unsigned int started = work->started;
3782
3783         os_get_reltime(&now);
3784         os_reltime_sub(&now, &work->time, &diff);
3785         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3786                 work->type, work, started ? "done" : "canceled",
3787                 diff.sec, diff.usec);
3788         radio_work_free(work);
3789         if (started)
3790                 radio_work_check_next(wpa_s);
3791 }
3792
3793
3794 struct wpa_radio_work *
3795 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3796 {
3797         struct wpa_radio_work *work;
3798         struct wpa_radio *radio = wpa_s->radio;
3799
3800         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3801                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3802                         return work;
3803         }
3804
3805         return NULL;
3806 }
3807
3808
3809 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3810                             struct wpa_interface *iface)
3811 {
3812         const char *ifname, *driver, *rn;
3813
3814         driver = iface->driver;
3815 next_driver:
3816         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3817                 return -1;
3818
3819         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3820         if (wpa_s->drv_priv == NULL) {
3821                 const char *pos;
3822                 pos = driver ? os_strchr(driver, ',') : NULL;
3823                 if (pos) {
3824                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3825                                 "driver interface - try next driver wrapper");
3826                         driver = pos + 1;
3827                         goto next_driver;
3828                 }
3829                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3830                         "interface");
3831                 return -1;
3832         }
3833         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3834                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3835                         "driver_param '%s'", wpa_s->conf->driver_param);
3836                 return -1;
3837         }
3838
3839         ifname = wpa_drv_get_ifname(wpa_s);
3840         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3841                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3842                         "interface name with '%s'", ifname);
3843                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3844         }
3845
3846         rn = wpa_driver_get_radio_name(wpa_s);
3847         if (rn && rn[0] == '\0')
3848                 rn = NULL;
3849
3850         wpa_s->radio = radio_add_interface(wpa_s, rn);
3851         if (wpa_s->radio == NULL)
3852                 return -1;
3853
3854         return 0;
3855 }
3856
3857
3858 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3859                                      struct wpa_interface *iface)
3860 {
3861         struct wpa_driver_capa capa;
3862         int capa_res;
3863
3864         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3865                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3866                    iface->confname ? iface->confname : "N/A",
3867                    iface->driver ? iface->driver : "default",
3868                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3869                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3870
3871         if (iface->confname) {
3872 #ifdef CONFIG_BACKEND_FILE
3873                 wpa_s->confname = os_rel2abs_path(iface->confname);
3874                 if (wpa_s->confname == NULL) {
3875                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3876                                    "for configuration file '%s'.",
3877                                    iface->confname);
3878                         return -1;
3879                 }
3880                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3881                            iface->confname, wpa_s->confname);
3882 #else /* CONFIG_BACKEND_FILE */
3883                 wpa_s->confname = os_strdup(iface->confname);
3884 #endif /* CONFIG_BACKEND_FILE */
3885                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3886                 if (wpa_s->conf == NULL) {
3887                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3888                                    "configuration '%s'.", wpa_s->confname);
3889                         return -1;
3890                 }
3891                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3892                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3893
3894                 /*
3895                  * Override ctrl_interface and driver_param if set on command
3896                  * line.
3897                  */
3898                 if (iface->ctrl_interface) {
3899                         os_free(wpa_s->conf->ctrl_interface);
3900                         wpa_s->conf->ctrl_interface =
3901                                 os_strdup(iface->ctrl_interface);
3902                 }
3903
3904                 if (iface->driver_param) {
3905                         os_free(wpa_s->conf->driver_param);
3906                         wpa_s->conf->driver_param =
3907                                 os_strdup(iface->driver_param);
3908                 }
3909
3910                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3911                         os_free(wpa_s->conf->ctrl_interface);
3912                         wpa_s->conf->ctrl_interface = NULL;
3913                 }
3914         } else
3915                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3916                                                      iface->driver_param);
3917
3918         if (wpa_s->conf == NULL) {
3919                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3920                 return -1;
3921         }
3922
3923         if (iface->ifname == NULL) {
3924                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3925                 return -1;
3926         }
3927         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3928                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3929                            iface->ifname);
3930                 return -1;
3931         }
3932         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3933
3934         if (iface->bridge_ifname) {
3935                 if (os_strlen(iface->bridge_ifname) >=
3936                     sizeof(wpa_s->bridge_ifname)) {
3937                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3938                                    "name '%s'.", iface->bridge_ifname);
3939                         return -1;
3940                 }
3941                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3942                            sizeof(wpa_s->bridge_ifname));
3943         }
3944
3945         /* RSNA Supplicant Key Management - INITIALIZE */
3946         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3947         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3948
3949         /* Initialize driver interface and register driver event handler before
3950          * L2 receive handler so that association events are processed before
3951          * EAPOL-Key packets if both become available for the same select()
3952          * call. */
3953         if (wpas_init_driver(wpa_s, iface) < 0)
3954                 return -1;
3955
3956         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3957                 return -1;
3958
3959         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3960                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3961                           NULL);
3962         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3963
3964         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3965             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3966                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3967                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3968                         "dot11RSNAConfigPMKLifetime");
3969                 return -1;
3970         }
3971
3972         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
3973             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
3974                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
3975                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3976                         "dot11RSNAConfigPMKReauthThreshold");
3977                 return -1;
3978         }
3979
3980         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
3981             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
3982                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
3983                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3984                         "dot11RSNAConfigSATimeout");
3985                 return -1;
3986         }
3987
3988         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
3989                                                       &wpa_s->hw.num_modes,
3990                                                       &wpa_s->hw.flags);
3991
3992         capa_res = wpa_drv_get_capa(wpa_s, &capa);
3993         if (capa_res == 0) {
3994                 wpa_s->drv_capa_known = 1;
3995                 wpa_s->drv_flags = capa.flags;
3996                 wpa_s->drv_enc = capa.enc;
3997                 wpa_s->drv_smps_modes = capa.smps_modes;
3998                 wpa_s->drv_rrm_flags = capa.rrm_flags;
3999                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4000                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4001                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4002                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4003                 wpa_s->max_match_sets = capa.max_match_sets;
4004                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4005                 wpa_s->max_stations = capa.max_stations;
4006                 wpa_s->extended_capa = capa.extended_capa;
4007                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4008                 wpa_s->extended_capa_len = capa.extended_capa_len;
4009                 wpa_s->num_multichan_concurrent =
4010                         capa.num_multichan_concurrent;
4011                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4012
4013                 if (capa.mac_addr_rand_scan_supported)
4014                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4015                 if (wpa_s->sched_scan_supported &&
4016                     capa.mac_addr_rand_sched_scan_supported)
4017                         wpa_s->mac_addr_rand_supported |=
4018                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4019         }
4020         if (wpa_s->max_remain_on_chan == 0)
4021                 wpa_s->max_remain_on_chan = 1000;
4022
4023         /*
4024          * Only take p2p_mgmt parameters when P2P Device is supported.
4025          * Doing it here as it determines whether l2_packet_init() will be done
4026          * during wpa_supplicant_driver_init().
4027          */
4028         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4029                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4030         else
4031                 iface->p2p_mgmt = 1;
4032
4033         if (wpa_s->num_multichan_concurrent == 0)
4034                 wpa_s->num_multichan_concurrent = 1;
4035
4036         if (wpa_supplicant_driver_init(wpa_s) < 0)
4037                 return -1;
4038
4039 #ifdef CONFIG_TDLS
4040         if ((!iface->p2p_mgmt ||
4041              !(wpa_s->drv_flags &
4042                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4043             wpa_tdls_init(wpa_s->wpa))
4044                 return -1;
4045 #endif /* CONFIG_TDLS */
4046
4047         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4048             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4049                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4050                 return -1;
4051         }
4052
4053         if (wpas_wps_init(wpa_s))
4054                 return -1;
4055
4056         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4057                 return -1;
4058         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4059
4060         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4061         if (wpa_s->ctrl_iface == NULL) {
4062                 wpa_printf(MSG_ERROR,
4063                            "Failed to initialize control interface '%s'.\n"
4064                            "You may have another wpa_supplicant process "
4065                            "already running or the file was\n"
4066                            "left by an unclean termination of wpa_supplicant "
4067                            "in which case you will need\n"
4068                            "to manually remove this file before starting "
4069                            "wpa_supplicant again.\n",
4070                            wpa_s->conf->ctrl_interface);
4071                 return -1;
4072         }
4073
4074         wpa_s->gas = gas_query_init(wpa_s);
4075         if (wpa_s->gas == NULL) {
4076                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4077                 return -1;
4078         }
4079
4080         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4081                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4082                 return -1;
4083         }
4084
4085         if (wpa_bss_init(wpa_s) < 0)
4086                 return -1;
4087
4088         /*
4089          * Set Wake-on-WLAN triggers, if configured.
4090          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4091          * have effect anyway when the interface is down).
4092          */
4093         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4094                 return -1;
4095
4096 #ifdef CONFIG_EAP_PROXY
4097 {
4098         size_t len;
4099         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4100                                                      &len);
4101         if (wpa_s->mnc_len > 0) {
4102                 wpa_s->imsi[len] = '\0';
4103                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4104                            wpa_s->imsi, wpa_s->mnc_len);
4105         } else {
4106                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4107         }
4108 }
4109 #endif /* CONFIG_EAP_PROXY */
4110
4111         if (pcsc_reader_init(wpa_s) < 0)
4112                 return -1;
4113
4114         if (wpas_init_ext_pw(wpa_s) < 0)
4115                 return -1;
4116
4117         wpas_rrm_reset(wpa_s);
4118
4119         return 0;
4120 }
4121
4122
4123 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4124                                         int notify, int terminate)
4125 {
4126         struct wpa_global *global = wpa_s->global;
4127         struct wpa_supplicant *iface, *prev;
4128
4129         if (wpa_s == wpa_s->parent)
4130                 wpas_p2p_group_remove(wpa_s, "*");
4131
4132         iface = global->ifaces;
4133         while (iface) {
4134                 if (iface == wpa_s || iface->parent != wpa_s) {
4135                         iface = iface->next;
4136                         continue;
4137                 }
4138                 wpa_printf(MSG_DEBUG,
4139                            "Remove remaining child interface %s from parent %s",
4140                            iface->ifname, wpa_s->ifname);
4141                 prev = iface;
4142                 iface = iface->next;
4143                 wpa_supplicant_remove_iface(global, prev, terminate);
4144         }
4145
4146         wpa_s->disconnected = 1;
4147         if (wpa_s->drv_priv) {
4148                 wpa_supplicant_deauthenticate(wpa_s,
4149                                               WLAN_REASON_DEAUTH_LEAVING);
4150
4151                 wpa_drv_set_countermeasures(wpa_s, 0);
4152                 wpa_clear_keys(wpa_s, NULL);
4153         }
4154
4155         wpa_supplicant_cleanup(wpa_s);
4156         wpas_p2p_deinit_iface(wpa_s);
4157
4158         wpas_ctrl_radio_work_flush(wpa_s);
4159         radio_remove_interface(wpa_s);
4160
4161         if (wpa_s->drv_priv)
4162                 wpa_drv_deinit(wpa_s);
4163
4164         if (notify)
4165                 wpas_notify_iface_removed(wpa_s);
4166
4167         if (terminate)
4168                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4169
4170         if (wpa_s->ctrl_iface) {
4171                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4172                 wpa_s->ctrl_iface = NULL;
4173         }
4174
4175 #ifdef CONFIG_MESH
4176         if (wpa_s->ifmsh) {
4177                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4178                 wpa_s->ifmsh = NULL;
4179         }
4180 #endif /* CONFIG_MESH */
4181
4182         if (wpa_s->conf != NULL) {
4183                 wpa_config_free(wpa_s->conf);
4184                 wpa_s->conf = NULL;
4185         }
4186
4187         os_free(wpa_s);
4188 }
4189
4190
4191 /**
4192  * wpa_supplicant_add_iface - Add a new network interface
4193  * @global: Pointer to global data from wpa_supplicant_init()
4194  * @iface: Interface configuration options
4195  * Returns: Pointer to the created interface or %NULL on failure
4196  *
4197  * This function is used to add new network interfaces for %wpa_supplicant.
4198  * This can be called before wpa_supplicant_run() to add interfaces before the
4199  * main event loop has been started. In addition, new interfaces can be added
4200  * dynamically while %wpa_supplicant is already running. This could happen,
4201  * e.g., when a hotplug network adapter is inserted.
4202  */
4203 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4204                                                  struct wpa_interface *iface)
4205 {
4206         struct wpa_supplicant *wpa_s;
4207         struct wpa_interface t_iface;
4208         struct wpa_ssid *ssid;
4209
4210         if (global == NULL || iface == NULL)
4211                 return NULL;
4212
4213         wpa_s = wpa_supplicant_alloc();
4214         if (wpa_s == NULL)
4215                 return NULL;
4216
4217         wpa_s->global = global;
4218
4219         t_iface = *iface;
4220         if (global->params.override_driver) {
4221                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4222                            "('%s' -> '%s')",
4223                            iface->driver, global->params.override_driver);
4224                 t_iface.driver = global->params.override_driver;
4225         }
4226         if (global->params.override_ctrl_interface) {
4227                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4228                            "ctrl_interface ('%s' -> '%s')",
4229                            iface->ctrl_interface,
4230                            global->params.override_ctrl_interface);
4231                 t_iface.ctrl_interface =
4232                         global->params.override_ctrl_interface;
4233         }
4234         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4235                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4236                            iface->ifname);
4237                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4238                 return NULL;
4239         }
4240
4241         if (iface->p2p_mgmt == 0) {
4242                 /* Notify the control interfaces about new iface */
4243                 if (wpas_notify_iface_added(wpa_s)) {
4244                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4245                         return NULL;
4246                 }
4247
4248                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4249                         wpas_notify_network_added(wpa_s, ssid);
4250         }
4251
4252         wpa_s->next = global->ifaces;
4253         global->ifaces = wpa_s;
4254
4255         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4256         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4257
4258 #ifdef CONFIG_P2P
4259         if (wpa_s->global->p2p == NULL &&
4260             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4261             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4262                 wpa_printf(MSG_INFO,
4263                            "P2P: Failed to enable P2P Device interface");
4264                 /* Try to continue without. P2P will be disabled. */
4265         }
4266 #endif /* CONFIG_P2P */
4267
4268         return wpa_s;
4269 }
4270
4271
4272 /**
4273  * wpa_supplicant_remove_iface - Remove a network interface
4274  * @global: Pointer to global data from wpa_supplicant_init()
4275  * @wpa_s: Pointer to the network interface to be removed
4276  * Returns: 0 if interface was removed, -1 if interface was not found
4277  *
4278  * This function can be used to dynamically remove network interfaces from
4279  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4280  * addition, this function is used to remove all remaining interfaces when
4281  * %wpa_supplicant is terminated.
4282  */
4283 int wpa_supplicant_remove_iface(struct wpa_global *global,
4284                                 struct wpa_supplicant *wpa_s,
4285                                 int terminate)
4286 {
4287         struct wpa_supplicant *prev;
4288 #ifdef CONFIG_MESH
4289         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4290         char *ifname = NULL;
4291 #endif /* CONFIG_MESH */
4292
4293         /* Remove interface from the global list of interfaces */
4294         prev = global->ifaces;
4295         if (prev == wpa_s) {
4296                 global->ifaces = wpa_s->next;
4297         } else {
4298                 while (prev && prev->next != wpa_s)
4299                         prev = prev->next;
4300                 if (prev == NULL)
4301                         return -1;
4302                 prev->next = wpa_s->next;
4303         }
4304
4305         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4306
4307 #ifdef CONFIG_MESH
4308         if (mesh_if_created) {
4309                 ifname = os_strdup(wpa_s->ifname);
4310                 if (ifname == NULL) {
4311                         wpa_dbg(wpa_s, MSG_ERROR,
4312                                 "mesh: Failed to malloc ifname");
4313                         return -1;
4314                 }
4315         }
4316 #endif /* CONFIG_MESH */
4317
4318         if (global->p2p_group_formation == wpa_s)
4319                 global->p2p_group_formation = NULL;
4320         if (global->p2p_invite_group == wpa_s)
4321                 global->p2p_invite_group = NULL;
4322         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4323
4324 #ifdef CONFIG_MESH
4325         if (mesh_if_created) {
4326                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4327                 os_free(ifname);
4328         }
4329 #endif /* CONFIG_MESH */
4330
4331         return 0;
4332 }
4333
4334
4335 /**
4336  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4337  * @wpa_s: Pointer to the network interface
4338  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4339  */
4340 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4341 {
4342         const char *eapol_method;
4343
4344         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4345             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4346                 return "NO-EAP";
4347         }
4348
4349         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4350         if (eapol_method == NULL)
4351                 return "UNKNOWN-EAP";
4352
4353         return eapol_method;
4354 }
4355
4356
4357 /**
4358  * wpa_supplicant_get_iface - Get a new network interface
4359  * @global: Pointer to global data from wpa_supplicant_init()
4360  * @ifname: Interface name
4361  * Returns: Pointer to the interface or %NULL if not found
4362  */
4363 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4364                                                  const char *ifname)
4365 {
4366         struct wpa_supplicant *wpa_s;
4367
4368         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4369                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4370                         return wpa_s;
4371         }
4372         return NULL;
4373 }
4374
4375
4376 #ifndef CONFIG_NO_WPA_MSG
4377 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4378 {
4379         struct wpa_supplicant *wpa_s = ctx;
4380         if (wpa_s == NULL)
4381                 return NULL;
4382         return wpa_s->ifname;
4383 }
4384 #endif /* CONFIG_NO_WPA_MSG */
4385
4386
4387 /**
4388  * wpa_supplicant_init - Initialize %wpa_supplicant
4389  * @params: Parameters for %wpa_supplicant
4390  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4391  *
4392  * This function is used to initialize %wpa_supplicant. After successful
4393  * initialization, the returned data pointer can be used to add and remove
4394  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4395  */
4396 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4397 {
4398         struct wpa_global *global;
4399         int ret, i;
4400
4401         if (params == NULL)
4402                 return NULL;
4403
4404 #ifdef CONFIG_DRIVER_NDIS
4405         {
4406                 void driver_ndis_init_ops(void);
4407                 driver_ndis_init_ops();
4408         }
4409 #endif /* CONFIG_DRIVER_NDIS */
4410
4411 #ifndef CONFIG_NO_WPA_MSG
4412         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4413 #endif /* CONFIG_NO_WPA_MSG */
4414
4415         if (params->wpa_debug_file_path)
4416                 wpa_debug_open_file(params->wpa_debug_file_path);
4417         else
4418                 wpa_debug_setup_stdout();
4419         if (params->wpa_debug_syslog)
4420                 wpa_debug_open_syslog();
4421         if (params->wpa_debug_tracing) {
4422                 ret = wpa_debug_open_linux_tracing();
4423                 if (ret) {
4424                         wpa_printf(MSG_ERROR,
4425                                    "Failed to enable trace logging");
4426                         return NULL;
4427                 }
4428         }
4429
4430         ret = eap_register_methods();
4431         if (ret) {
4432                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4433                 if (ret == -2)
4434                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4435                                    "the same EAP type.");
4436                 return NULL;
4437         }
4438
4439         global = os_zalloc(sizeof(*global));
4440         if (global == NULL)
4441                 return NULL;
4442         dl_list_init(&global->p2p_srv_bonjour);
4443         dl_list_init(&global->p2p_srv_upnp);
4444         global->params.daemonize = params->daemonize;
4445         global->params.wait_for_monitor = params->wait_for_monitor;
4446         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4447         if (params->pid_file)
4448                 global->params.pid_file = os_strdup(params->pid_file);
4449         if (params->ctrl_interface)
4450                 global->params.ctrl_interface =
4451                         os_strdup(params->ctrl_interface);
4452         if (params->ctrl_interface_group)
4453                 global->params.ctrl_interface_group =
4454                         os_strdup(params->ctrl_interface_group);
4455         if (params->override_driver)
4456                 global->params.override_driver =
4457                         os_strdup(params->override_driver);
4458         if (params->override_ctrl_interface)
4459                 global->params.override_ctrl_interface =
4460                         os_strdup(params->override_ctrl_interface);
4461         wpa_debug_level = global->params.wpa_debug_level =
4462                 params->wpa_debug_level;
4463         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4464                 params->wpa_debug_show_keys;
4465         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4466                 params->wpa_debug_timestamp;
4467
4468         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4469
4470         if (eloop_init()) {
4471                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4472                 wpa_supplicant_deinit(global);
4473                 return NULL;
4474         }
4475
4476         random_init(params->entropy_file);
4477
4478         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4479         if (global->ctrl_iface == NULL) {
4480                 wpa_supplicant_deinit(global);
4481                 return NULL;
4482         }
4483
4484         if (wpas_notify_supplicant_initialized(global)) {
4485                 wpa_supplicant_deinit(global);
4486                 return NULL;
4487         }
4488
4489         for (i = 0; wpa_drivers[i]; i++)
4490                 global->drv_count++;
4491         if (global->drv_count == 0) {
4492                 wpa_printf(MSG_ERROR, "No drivers enabled");
4493                 wpa_supplicant_deinit(global);
4494                 return NULL;
4495         }
4496         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4497         if (global->drv_priv == NULL) {
4498                 wpa_supplicant_deinit(global);
4499                 return NULL;
4500         }
4501
4502 #ifdef CONFIG_WIFI_DISPLAY
4503         if (wifi_display_init(global) < 0) {
4504                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4505                 wpa_supplicant_deinit(global);
4506                 return NULL;
4507         }
4508 #endif /* CONFIG_WIFI_DISPLAY */
4509
4510         return global;
4511 }
4512
4513
4514 /**
4515  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4516  * @global: Pointer to global data from wpa_supplicant_init()
4517  * Returns: 0 after successful event loop run, -1 on failure
4518  *
4519  * This function starts the main event loop and continues running as long as
4520  * there are any remaining events. In most cases, this function is running as
4521  * long as the %wpa_supplicant process in still in use.
4522  */
4523 int wpa_supplicant_run(struct wpa_global *global)
4524 {
4525         struct wpa_supplicant *wpa_s;
4526
4527         if (global->params.daemonize &&
4528             wpa_supplicant_daemon(global->params.pid_file))
4529                 return -1;
4530
4531         if (global->params.wait_for_monitor) {
4532                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4533                         if (wpa_s->ctrl_iface)
4534                                 wpa_supplicant_ctrl_iface_wait(
4535                                         wpa_s->ctrl_iface);
4536         }
4537
4538         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4539         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4540
4541         eloop_run();
4542
4543         return 0;
4544 }
4545
4546
4547 /**
4548  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4549  * @global: Pointer to global data from wpa_supplicant_init()
4550  *
4551  * This function is called to deinitialize %wpa_supplicant and to free all
4552  * allocated resources. Remaining network interfaces will also be removed.
4553  */
4554 void wpa_supplicant_deinit(struct wpa_global *global)
4555 {
4556         int i;
4557
4558         if (global == NULL)
4559                 return;
4560
4561 #ifdef CONFIG_WIFI_DISPLAY
4562         wifi_display_deinit(global);
4563 #endif /* CONFIG_WIFI_DISPLAY */
4564
4565         while (global->ifaces)
4566                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4567
4568         if (global->ctrl_iface)
4569                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4570
4571         wpas_notify_supplicant_deinitialized(global);
4572
4573         eap_peer_unregister_methods();
4574 #ifdef CONFIG_AP
4575         eap_server_unregister_methods();
4576 #endif /* CONFIG_AP */
4577
4578         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4579                 if (!global->drv_priv[i])
4580                         continue;
4581                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4582         }
4583         os_free(global->drv_priv);
4584
4585         random_deinit();
4586
4587         eloop_destroy();
4588
4589         if (global->params.pid_file) {
4590                 os_daemonize_terminate(global->params.pid_file);
4591                 os_free(global->params.pid_file);
4592         }
4593         os_free(global->params.ctrl_interface);
4594         os_free(global->params.ctrl_interface_group);
4595         os_free(global->params.override_driver);
4596         os_free(global->params.override_ctrl_interface);
4597
4598         os_free(global->p2p_disallow_freq.range);
4599         os_free(global->p2p_go_avoid_freq.range);
4600         os_free(global->add_psk);
4601
4602         os_free(global);
4603         wpa_debug_close_syslog();
4604         wpa_debug_close_file();
4605         wpa_debug_close_linux_tracing();
4606 }
4607
4608
4609 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4610 {
4611         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4612             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4613                 char country[3];
4614                 country[0] = wpa_s->conf->country[0];
4615                 country[1] = wpa_s->conf->country[1];
4616                 country[2] = '\0';
4617                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4618                         wpa_printf(MSG_ERROR, "Failed to set country code "
4619                                    "'%s'", country);
4620                 }
4621         }
4622
4623         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4624                 wpas_init_ext_pw(wpa_s);
4625
4626 #ifdef CONFIG_WPS
4627         wpas_wps_update_config(wpa_s);
4628 #endif /* CONFIG_WPS */
4629         wpas_p2p_update_config(wpa_s);
4630         wpa_s->conf->changed_parameters = 0;
4631 }
4632
4633
4634 void add_freq(int *freqs, int *num_freqs, int freq)
4635 {
4636         int i;
4637
4638         for (i = 0; i < *num_freqs; i++) {
4639                 if (freqs[i] == freq)
4640                         return;
4641         }
4642
4643         freqs[*num_freqs] = freq;
4644         (*num_freqs)++;
4645 }
4646
4647
4648 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4649 {
4650         struct wpa_bss *bss, *cbss;
4651         const int max_freqs = 10;
4652         int *freqs;
4653         int num_freqs = 0;
4654
4655         freqs = os_calloc(max_freqs + 1, sizeof(int));
4656         if (freqs == NULL)
4657                 return NULL;
4658
4659         cbss = wpa_s->current_bss;
4660
4661         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4662                 if (bss == cbss)
4663                         continue;
4664                 if (bss->ssid_len == cbss->ssid_len &&
4665                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4666                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4667                         add_freq(freqs, &num_freqs, bss->freq);
4668                         if (num_freqs == max_freqs)
4669                                 break;
4670                 }
4671         }
4672
4673         if (num_freqs == 0) {
4674                 os_free(freqs);
4675                 freqs = NULL;
4676         }
4677
4678         return freqs;
4679 }
4680
4681
4682 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4683 {
4684         int timeout;
4685         int count;
4686         int *freqs = NULL;
4687
4688         wpas_connect_work_done(wpa_s);
4689
4690         /*
4691          * Remove possible authentication timeout since the connection failed.
4692          */
4693         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4694
4695         if (wpa_s->disconnected) {
4696                 /*
4697                  * There is no point in blacklisting the AP if this event is
4698                  * generated based on local request to disconnect.
4699                  */
4700                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4701                         "indication since interface has been put into "
4702                         "disconnected state");
4703                 return;
4704         }
4705
4706         /*
4707          * Add the failed BSSID into the blacklist and speed up next scan
4708          * attempt if there could be other APs that could accept association.
4709          * The current blacklist count indicates how many times we have tried
4710          * connecting to this AP and multiple attempts mean that other APs are
4711          * either not available or has already been tried, so that we can start
4712          * increasing the delay here to avoid constant scanning.
4713          */
4714         count = wpa_blacklist_add(wpa_s, bssid);
4715         if (count == 1 && wpa_s->current_bss) {
4716                 /*
4717                  * This BSS was not in the blacklist before. If there is
4718                  * another BSS available for the same ESS, we should try that
4719                  * next. Otherwise, we may as well try this one once more
4720                  * before allowing other, likely worse, ESSes to be considered.
4721                  */
4722                 freqs = get_bss_freqs_in_ess(wpa_s);
4723                 if (freqs) {
4724                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4725                                 "has been seen; try it next");
4726                         wpa_blacklist_add(wpa_s, bssid);
4727                         /*
4728                          * On the next scan, go through only the known channels
4729                          * used in this ESS based on previous scans to speed up
4730                          * common load balancing use case.
4731                          */
4732                         os_free(wpa_s->next_scan_freqs);
4733                         wpa_s->next_scan_freqs = freqs;
4734                 }
4735         }
4736
4737         /*
4738          * Add previous failure count in case the temporary blacklist was
4739          * cleared due to no other BSSes being available.
4740          */
4741         count += wpa_s->extra_blacklist_count;
4742
4743         if (count > 3 && wpa_s->current_ssid) {
4744                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4745                            "consider temporary network disabling");
4746                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4747         }
4748
4749         switch (count) {
4750         case 1:
4751                 timeout = 100;
4752                 break;
4753         case 2:
4754                 timeout = 500;
4755                 break;
4756         case 3:
4757                 timeout = 1000;
4758                 break;
4759         case 4:
4760                 timeout = 5000;
4761                 break;
4762         default:
4763                 timeout = 10000;
4764                 break;
4765         }
4766
4767         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4768                 "ms", count, timeout);
4769
4770         /*
4771          * TODO: if more than one possible AP is available in scan results,
4772          * could try the other ones before requesting a new scan.
4773          */
4774         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4775                                 1000 * (timeout % 1000));
4776 }
4777
4778
4779 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4780 {
4781         return wpa_s->conf->ap_scan == 2 ||
4782                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4783 }
4784
4785
4786 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4787 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4788                                               struct wpa_ssid *ssid,
4789                                               const char *field,
4790                                               const char *value)
4791 {
4792 #ifdef IEEE8021X_EAPOL
4793         struct eap_peer_config *eap = &ssid->eap;
4794
4795         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4796         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4797                               (const u8 *) value, os_strlen(value));
4798
4799         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4800         case WPA_CTRL_REQ_EAP_IDENTITY:
4801                 os_free(eap->identity);
4802                 eap->identity = (u8 *) os_strdup(value);
4803                 eap->identity_len = os_strlen(value);
4804                 eap->pending_req_identity = 0;
4805                 if (ssid == wpa_s->current_ssid)
4806                         wpa_s->reassociate = 1;
4807                 break;
4808         case WPA_CTRL_REQ_EAP_PASSWORD:
4809                 bin_clear_free(eap->password, eap->password_len);
4810                 eap->password = (u8 *) os_strdup(value);
4811                 eap->password_len = os_strlen(value);
4812                 eap->pending_req_password = 0;
4813                 if (ssid == wpa_s->current_ssid)
4814                         wpa_s->reassociate = 1;
4815                 break;
4816         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4817                 bin_clear_free(eap->new_password, eap->new_password_len);
4818                 eap->new_password = (u8 *) os_strdup(value);
4819                 eap->new_password_len = os_strlen(value);
4820                 eap->pending_req_new_password = 0;
4821                 if (ssid == wpa_s->current_ssid)
4822                         wpa_s->reassociate = 1;
4823                 break;
4824         case WPA_CTRL_REQ_EAP_PIN:
4825                 str_clear_free(eap->pin);
4826                 eap->pin = os_strdup(value);
4827                 eap->pending_req_pin = 0;
4828                 if (ssid == wpa_s->current_ssid)
4829                         wpa_s->reassociate = 1;
4830                 break;
4831         case WPA_CTRL_REQ_EAP_OTP:
4832                 bin_clear_free(eap->otp, eap->otp_len);
4833                 eap->otp = (u8 *) os_strdup(value);
4834                 eap->otp_len = os_strlen(value);
4835                 os_free(eap->pending_req_otp);
4836                 eap->pending_req_otp = NULL;
4837                 eap->pending_req_otp_len = 0;
4838                 break;
4839         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4840                 str_clear_free(eap->private_key_passwd);
4841                 eap->private_key_passwd = os_strdup(value);
4842                 eap->pending_req_passphrase = 0;
4843                 if (ssid == wpa_s->current_ssid)
4844                         wpa_s->reassociate = 1;
4845                 break;
4846         case WPA_CTRL_REQ_SIM:
4847                 str_clear_free(eap->external_sim_resp);
4848                 eap->external_sim_resp = os_strdup(value);
4849                 break;
4850         default:
4851                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4852                 return -1;
4853         }
4854
4855         return 0;
4856 #else /* IEEE8021X_EAPOL */
4857         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4858         return -1;
4859 #endif /* IEEE8021X_EAPOL */
4860 }
4861 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4862
4863
4864 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4865 {
4866         int i;
4867         unsigned int drv_enc;
4868
4869         if (ssid == NULL)
4870                 return 1;
4871
4872         if (ssid->disabled)
4873                 return 1;
4874
4875         if (wpa_s && wpa_s->drv_capa_known)
4876                 drv_enc = wpa_s->drv_enc;
4877         else
4878                 drv_enc = (unsigned int) -1;
4879
4880         for (i = 0; i < NUM_WEP_KEYS; i++) {
4881                 size_t len = ssid->wep_key_len[i];
4882                 if (len == 0)
4883                         continue;
4884                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4885                         continue;
4886                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4887                         continue;
4888                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4889                         continue;
4890                 return 1; /* invalid WEP key */
4891         }
4892
4893         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4894             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4895                 return 1;
4896
4897         return 0;
4898 }
4899
4900
4901 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4902 {
4903 #ifdef CONFIG_IEEE80211W
4904         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
4905                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
4906                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
4907                         /*
4908                          * Driver does not support BIP -- ignore pmf=1 default
4909                          * since the connection with PMF would fail and the
4910                          * configuration does not require PMF to be enabled.
4911                          */
4912                         return NO_MGMT_FRAME_PROTECTION;
4913                 }
4914
4915                 return wpa_s->conf->pmf;
4916         }
4917
4918         return ssid->ieee80211w;
4919 #else /* CONFIG_IEEE80211W */
4920         return NO_MGMT_FRAME_PROTECTION;
4921 #endif /* CONFIG_IEEE80211W */
4922 }
4923
4924
4925 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4926 {
4927         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4928                 return 1;
4929         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4930                 return 0;
4931         return -1;
4932 }
4933
4934
4935 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4936 {
4937         struct wpa_ssid *ssid = wpa_s->current_ssid;
4938         int dur;
4939         struct os_reltime now;
4940
4941         if (ssid == NULL) {
4942                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4943                            "SSID block");
4944                 return;
4945         }
4946
4947         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4948                 return;
4949
4950         ssid->auth_failures++;
4951
4952 #ifdef CONFIG_P2P
4953         if (ssid->p2p_group &&
4954             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4955                 /*
4956                  * Skip the wait time since there is a short timeout on the
4957                  * connection to a P2P group.
4958                  */
4959                 return;
4960         }
4961 #endif /* CONFIG_P2P */
4962
4963         if (ssid->auth_failures > 50)
4964                 dur = 300;
4965         else if (ssid->auth_failures > 10)
4966                 dur = 120;
4967         else if (ssid->auth_failures > 5)
4968                 dur = 90;
4969         else if (ssid->auth_failures > 3)
4970                 dur = 60;
4971         else if (ssid->auth_failures > 2)
4972                 dur = 30;
4973         else if (ssid->auth_failures > 1)
4974                 dur = 20;
4975         else
4976                 dur = 10;
4977
4978         if (ssid->auth_failures > 1 &&
4979             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
4980                 dur += os_random() % (ssid->auth_failures * 10);
4981
4982         os_get_reltime(&now);
4983         if (now.sec + dur <= ssid->disabled_until.sec)
4984                 return;
4985
4986         ssid->disabled_until.sec = now.sec + dur;
4987
4988         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
4989                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
4990                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
4991                 ssid->auth_failures, dur, reason);
4992 }
4993
4994
4995 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
4996                               struct wpa_ssid *ssid, int clear_failures)
4997 {
4998         if (ssid == NULL)
4999                 return;
5000
5001         if (ssid->disabled_until.sec) {
5002                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5003                         "id=%d ssid=\"%s\"",
5004                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5005         }
5006         ssid->disabled_until.sec = 0;
5007         ssid->disabled_until.usec = 0;
5008         if (clear_failures)
5009                 ssid->auth_failures = 0;
5010 }
5011
5012
5013 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5014 {
5015         size_t i;
5016
5017         if (wpa_s->disallow_aps_bssid == NULL)
5018                 return 0;
5019
5020         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5021                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5022                               bssid, ETH_ALEN) == 0)
5023                         return 1;
5024         }
5025
5026         return 0;
5027 }
5028
5029
5030 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5031                     size_t ssid_len)
5032 {
5033         size_t i;
5034
5035         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5036                 return 0;
5037
5038         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5039                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5040                 if (ssid_len == s->ssid_len &&
5041                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5042                         return 1;
5043         }
5044
5045         return 0;
5046 }
5047
5048
5049 /**
5050  * wpas_request_connection - Request a new connection
5051  * @wpa_s: Pointer to the network interface
5052  *
5053  * This function is used to request a new connection to be found. It will mark
5054  * the interface to allow reassociation and request a new scan to find a
5055  * suitable network to connect to.
5056  */
5057 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5058 {
5059         wpa_s->normal_scans = 0;
5060         wpa_s->scan_req = NORMAL_SCAN_REQ;
5061         wpa_supplicant_reinit_autoscan(wpa_s);
5062         wpa_s->extra_blacklist_count = 0;
5063         wpa_s->disconnected = 0;
5064         wpa_s->reassociate = 1;
5065
5066         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5067                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5068         else
5069                 wpa_s->reattach = 0;
5070 }
5071
5072
5073 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5074                     struct wpa_used_freq_data *freqs_data,
5075                     unsigned int len)
5076 {
5077         unsigned int i;
5078
5079         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5080                 len, title);
5081         for (i = 0; i < len; i++) {
5082                 struct wpa_used_freq_data *cur = &freqs_data[i];
5083                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5084                         i, cur->freq, cur->flags);
5085         }
5086 }
5087
5088
5089 /*
5090  * Find the operating frequencies of any of the virtual interfaces that
5091  * are using the same radio as the current interface, and in addition, get
5092  * information about the interface types that are using the frequency.
5093  */
5094 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5095                                 struct wpa_used_freq_data *freqs_data,
5096                                 unsigned int len)
5097 {
5098         struct wpa_supplicant *ifs;
5099         u8 bssid[ETH_ALEN];
5100         int freq;
5101         unsigned int idx = 0, i;
5102
5103         wpa_dbg(wpa_s, MSG_DEBUG,
5104                 "Determining shared radio frequencies (max len %u)", len);
5105         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5106
5107         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5108                          radio_list) {
5109                 if (idx == len)
5110                         break;
5111
5112                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5113                         continue;
5114
5115                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5116                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5117                         freq = ifs->current_ssid->frequency;
5118                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5119                         freq = ifs->assoc_freq;
5120                 else
5121                         continue;
5122
5123                 /* Hold only distinct freqs */
5124                 for (i = 0; i < idx; i++)
5125                         if (freqs_data[i].freq == freq)
5126                                 break;
5127
5128                 if (i == idx)
5129                         freqs_data[idx++].freq = freq;
5130
5131                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5132                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5133                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5134                                 WPA_FREQ_USED_BY_INFRA_STATION;
5135                 }
5136         }
5137
5138         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5139         return idx;
5140 }
5141
5142
5143 /*
5144  * Find the operating frequencies of any of the virtual interfaces that
5145  * are using the same radio as the current interface.
5146  */
5147 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5148                            int *freq_array, unsigned int len)
5149 {
5150         struct wpa_used_freq_data *freqs_data;
5151         int num, i;
5152
5153         os_memset(freq_array, 0, sizeof(int) * len);
5154
5155         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5156         if (!freqs_data)
5157                 return -1;
5158
5159         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5160         for (i = 0; i < num; i++)
5161                 freq_array[i] = freqs_data[i].freq;
5162
5163         os_free(freqs_data);
5164
5165         return num;
5166 }
5167
5168
5169 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5170 {
5171         struct rrm_data *rrm = data;
5172
5173         if (!rrm->notify_neighbor_rep) {
5174                 wpa_printf(MSG_ERROR,
5175                            "RRM: Unexpected neighbor report timeout");
5176                 return;
5177         }
5178
5179         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5180         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5181
5182         rrm->notify_neighbor_rep = NULL;
5183         rrm->neighbor_rep_cb_ctx = NULL;
5184 }
5185
5186
5187 /*
5188  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5189  * @wpa_s: Pointer to wpa_supplicant
5190  */
5191 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5192 {
5193         wpa_s->rrm.rrm_used = 0;
5194
5195         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5196                              NULL);
5197         if (wpa_s->rrm.notify_neighbor_rep)
5198                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5199         wpa_s->rrm.next_neighbor_rep_token = 1;
5200 }
5201
5202
5203 /*
5204  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5205  * @wpa_s: Pointer to wpa_supplicant
5206  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5207  * @report_len: Length of neighbor report buffer
5208  */
5209 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5210                                    const u8 *report, size_t report_len)
5211 {
5212         struct wpabuf *neighbor_rep;
5213
5214         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5215         if (report_len < 1)
5216                 return;
5217
5218         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5219                 wpa_printf(MSG_DEBUG,
5220                            "RRM: Discarding neighbor report with token %d (expected %d)",
5221                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5222                 return;
5223         }
5224
5225         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5226                              NULL);
5227
5228         if (!wpa_s->rrm.notify_neighbor_rep) {
5229                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5230                 return;
5231         }
5232
5233         /* skipping the first byte, which is only an id (dialog token) */
5234         neighbor_rep = wpabuf_alloc(report_len - 1);
5235         if (neighbor_rep == NULL)
5236                 return;
5237         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5238         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5239                    report[0]);
5240         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5241                                        neighbor_rep);
5242         wpa_s->rrm.notify_neighbor_rep = NULL;
5243         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5244 }
5245
5246
5247 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5248 /* Workaround different, undefined for Windows, error codes used here */
5249 #define ENOTCONN -1
5250 #define EOPNOTSUPP -1
5251 #define ECANCELED -1
5252 #endif
5253
5254 /**
5255  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5256  * @wpa_s: Pointer to wpa_supplicant
5257  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5258  *        is sent in the request.
5259  * @cb: Callback function to be called once the requested report arrives, or
5260  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5261  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5262  *      the requester's responsibility to free it.
5263  *      In the latter case NULL will be sent in 'neighbor_rep'.
5264  * @cb_ctx: Context value to send the callback function
5265  * Returns: 0 in case of success, negative error code otherwise
5266  *
5267  * In case there is a previous request which has not been answered yet, the
5268  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5269  * Request must contain a callback function.
5270  */
5271 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5272                                        const struct wpa_ssid *ssid,
5273                                        void (*cb)(void *ctx,
5274                                                   struct wpabuf *neighbor_rep),
5275                                        void *cb_ctx)
5276 {
5277         struct wpabuf *buf;
5278         const u8 *rrm_ie;
5279
5280         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5281                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5282                 return -ENOTCONN;
5283         }
5284
5285         if (!wpa_s->rrm.rrm_used) {
5286                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5287                 return -EOPNOTSUPP;
5288         }
5289
5290         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5291                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5292         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5293             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5294                 wpa_printf(MSG_DEBUG,
5295                            "RRM: No network support for Neighbor Report.");
5296                 return -EOPNOTSUPP;
5297         }
5298
5299         if (!cb) {
5300                 wpa_printf(MSG_DEBUG,
5301                            "RRM: Neighbor Report request must provide a callback.");
5302                 return -EINVAL;
5303         }
5304
5305         /* Refuse if there's a live request */
5306         if (wpa_s->rrm.notify_neighbor_rep) {
5307                 wpa_printf(MSG_DEBUG,
5308                            "RRM: Currently handling previous Neighbor Report.");
5309                 return -EBUSY;
5310         }
5311
5312         /* 3 = action category + action code + dialog token */
5313         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5314         if (buf == NULL) {
5315                 wpa_printf(MSG_DEBUG,
5316                            "RRM: Failed to allocate Neighbor Report Request");
5317                 return -ENOMEM;
5318         }
5319
5320         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5321                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5322                    wpa_s->rrm.next_neighbor_rep_token);
5323
5324         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5325         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5326         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5327         if (ssid) {
5328                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5329                 wpabuf_put_u8(buf, ssid->ssid_len);
5330                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5331         }
5332
5333         wpa_s->rrm.next_neighbor_rep_token++;
5334
5335         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5336                                 wpa_s->own_addr, wpa_s->bssid,
5337                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5338                 wpa_printf(MSG_DEBUG,
5339                            "RRM: Failed to send Neighbor Report Request");
5340                 wpabuf_free(buf);
5341                 return -ECANCELED;
5342         }
5343
5344         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5345         wpa_s->rrm.notify_neighbor_rep = cb;
5346         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5347                                wpas_rrm_neighbor_rep_timeout_handler,
5348                                &wpa_s->rrm, NULL);
5349
5350         wpabuf_free(buf);
5351         return 0;
5352 }
5353
5354
5355 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5356                                               const u8 *src,
5357                                               const u8 *frame, size_t len,
5358                                               int rssi)
5359 {
5360         struct wpabuf *buf;
5361         const struct rrm_link_measurement_request *req;
5362         struct rrm_link_measurement_report report;
5363
5364         if (wpa_s->wpa_state != WPA_COMPLETED) {
5365                 wpa_printf(MSG_INFO,
5366                            "RRM: Ignoring link measurement request. Not associated");
5367                 return;
5368         }
5369
5370         if (!wpa_s->rrm.rrm_used) {
5371                 wpa_printf(MSG_INFO,
5372                            "RRM: Ignoring link measurement request. Not RRM network");
5373                 return;
5374         }
5375
5376         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5377                 wpa_printf(MSG_INFO,
5378                            "RRM: Measurement report failed. TX power insertion not supported");
5379                 return;
5380         }
5381
5382         req = (const struct rrm_link_measurement_request *) frame;
5383         if (len < sizeof(*req)) {
5384                 wpa_printf(MSG_INFO,
5385                            "RRM: Link measurement report failed. Request too short");
5386                 return;
5387         }
5388
5389         os_memset(&report, 0, sizeof(report));
5390         report.tpc.eid = WLAN_EID_TPC_REPORT;
5391         report.tpc.len = 2;
5392         report.rsni = 255; /* 255 indicates that RSNI is not available */
5393         report.dialog_token = req->dialog_token;
5394
5395         /*
5396          * It's possible to estimate RCPI based on RSSI in dBm. This
5397          * calculation will not reflect the correct value for high rates,
5398          * but it's good enough for Action frames which are transmitted
5399          * with up to 24 Mbps rates.
5400          */
5401         if (!rssi)
5402                 report.rcpi = 255; /* not available */
5403         else if (rssi < -110)
5404                 report.rcpi = 0;
5405         else if (rssi > 0)
5406                 report.rcpi = 220;
5407         else
5408                 report.rcpi = (rssi + 110) * 2;
5409
5410         /* action_category + action_code */
5411         buf = wpabuf_alloc(2 + sizeof(report));
5412         if (buf == NULL) {
5413                 wpa_printf(MSG_ERROR,
5414                            "RRM: Link measurement report failed. Buffer allocation failed");
5415                 return;
5416         }
5417
5418         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5419         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5420         wpabuf_put_data(buf, &report, sizeof(report));
5421         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5422                     wpabuf_head(buf), wpabuf_len(buf));
5423
5424         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5425                                 wpa_s->own_addr, wpa_s->bssid,
5426                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5427                 wpa_printf(MSG_ERROR,
5428                            "RRM: Link measurement report failed. Send action failed");
5429         }
5430         wpabuf_free(buf);
5431 }