wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548 }
 549
 550
 551 /**
 552  * wpa_clear_keys - Clear keys configured for the driver
 553  * @wpa_s: Pointer to wpa_supplicant data
 554  * @addr: Previously used BSSID or %NULL if not available
 555  *
 556  * This function clears the encryption keys that has been previously configured
 557  * for the driver.
 558  */
 559 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 560 {
 561         int i, max;
 562
 563 #ifdef CONFIG_IEEE80211W
 564         max = 6;
 565 #else /* CONFIG_IEEE80211W */
 566         max = 4;
 567 #endif /* CONFIG_IEEE80211W */
 568
 569         /* MLME-DELETEKEYS.request */
 570         for (i = 0; i < max; i++) {
 571                 if (wpa_s->keys_cleared & BIT(i))
 572                         continue;
 573                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 574                                 NULL, 0);
 575         }
 576         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 577             !is_zero_ether_addr(addr)) {
 578                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 579                                 0);
 580                 /* MLME-SETPROTECTION.request(None) */
 581                 wpa_drv_mlme_setprotection(
 582                         wpa_s, addr,
 583                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 584                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 585         }
 586         wpa_s->keys_cleared = (u32) -1;
 587 }
 588
 589
 590 /**
 591  * wpa_supplicant_state_txt - Get the connection state name as a text string
 592  * @state: State (wpa_state; WPA_*)
 593  * Returns: The state name as a printable text string
 594  */
 595 const char * wpa_supplicant_state_txt(enum wpa_states state)
 596 {
 597         switch (state) {
 598         case WPA_DISCONNECTED:
 599                 return "DISCONNECTED";
 600         case WPA_INACTIVE:
 601                 return "INACTIVE";
 602         case WPA_INTERFACE_DISABLED:
 603                 return "INTERFACE_DISABLED";
 604         case WPA_SCANNING:
 605                 return "SCANNING";
 606         case WPA_AUTHENTICATING:
 607                 return "AUTHENTICATING";
 608         case WPA_ASSOCIATING:
 609                 return "ASSOCIATING";
 610         case WPA_ASSOCIATED:
 611                 return "ASSOCIATED";
 612         case WPA_4WAY_HANDSHAKE:
 613                 return "4WAY_HANDSHAKE";
 614         case WPA_GROUP_HANDSHAKE:
 615                 return "GROUP_HANDSHAKE";
 616         case WPA_COMPLETED:
 617                 return "COMPLETED";
 618         default:
 619                 return "UNKNOWN";
 620         }
 621 }
 622
 623
 624 #ifdef CONFIG_BGSCAN
 625
 626 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 627 {
 628         const char *name;
 629
 630         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 631                 name = wpa_s->current_ssid->bgscan;
 632         else
 633                 name = wpa_s->conf->bgscan;
 634         if (name == NULL || name[0] == '\0')
 635                 return;
 636         if (wpas_driver_bss_selection(wpa_s))
 637                 return;
 638         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 639                 return;
 640 #ifdef CONFIG_P2P
 641         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 642                 return;
 643 #endif /* CONFIG_P2P */
 644
 645         bgscan_deinit(wpa_s);
 646         if (wpa_s->current_ssid) {
 647                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 648                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 649                                 "bgscan");
 650                         /*
 651                          * Live without bgscan; it is only used as a roaming
 652                          * optimization, so the initial connection is not
 653                          * affected.
 654                          */
 655                 } else {
 656                         struct wpa_scan_results *scan_res;
 657                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 658                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 659                                                                    0);
 660                         if (scan_res) {
 661                                 bgscan_notify_scan(wpa_s, scan_res);
 662                                 wpa_scan_results_free(scan_res);
 663                         }
 664                 }
 665         } else
 666                 wpa_s->bgscan_ssid = NULL;
 667 }
 668
 669
 670 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 671 {
 672         if (wpa_s->bgscan_ssid != NULL) {
 673                 bgscan_deinit(wpa_s);
 674                 wpa_s->bgscan_ssid = NULL;
 675         }
 676 }
 677
 678 #endif /* CONFIG_BGSCAN */
 679
 680
 681 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (autoscan_init(wpa_s, 0))
 684                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 685 }
 686
 687
 688 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 689 {
 690         autoscan_deinit(wpa_s);
 691 }
 692
 693
 694 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 697             wpa_s->wpa_state == WPA_SCANNING) {
 698                 autoscan_deinit(wpa_s);
 699                 wpa_supplicant_start_autoscan(wpa_s);
 700         }
 701 }
 702
 703
 704 /**
 705  * wpa_supplicant_set_state - Set current connection state
 706  * @wpa_s: Pointer to wpa_supplicant data
 707  * @state: The new connection state
 708  *
 709  * This function is called whenever the connection state changes, e.g.,
 710  * association is completed for WPA/WPA2 4-Way Handshake is started.
 711  */
 712 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 713                               enum wpa_states state)
 714 {
 715         enum wpa_states old_state = wpa_s->wpa_state;
 716
 717         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 718                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 719                 wpa_supplicant_state_txt(state));
 720
 721         if (state == WPA_INTERFACE_DISABLED) {
 722                 /* Assure normal scan when interface is restored */
 723                 wpa_s->normal_scans = 0;
 724         }
 725
 726         if (state == WPA_COMPLETED) {
 727                 wpas_connect_work_done(wpa_s);
 728                 /* Reinitialize normal_scan counter */
 729                 wpa_s->normal_scans = 0;
 730         }
 731
 732 #ifdef CONFIG_P2P
 733         /*
 734          * P2PS client has to reply to Probe Request frames received on the
 735          * group operating channel. Enable Probe Request frame reporting for
 736          * P2P connected client in case p2p_cli_probe configuration property is
 737          * set to 1.
 738          */
 739         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 740             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 741             wpa_s->current_ssid->p2p_group) {
 742                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 743                         wpa_dbg(wpa_s, MSG_DEBUG,
 744                                 "P2P: Enable CLI Probe Request RX reporting");
 745                         wpa_s->p2p_cli_probe =
 746                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 747                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 748                         wpa_dbg(wpa_s, MSG_DEBUG,
 749                                 "P2P: Disable CLI Probe Request RX reporting");
 750                         wpa_s->p2p_cli_probe = 0;
 751                         wpa_drv_probe_req_report(wpa_s, 0);
 752                 }
 753         }
 754 #endif /* CONFIG_P2P */
 755
 756         if (state != WPA_SCANNING)
 757                 wpa_supplicant_notify_scanning(wpa_s, 0);
 758
 759         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 760                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 761 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 762                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 763                         MACSTR " completed [id=%d id_str=%s]",
 764                         MAC2STR(wpa_s->bssid),
 765                         ssid ? ssid->id : -1,
 766                         ssid && ssid->id_str ? ssid->id_str : "");
 767 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 768                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 769                 wpa_blacklist_clear(wpa_s);
 770                 wpa_s->extra_blacklist_count = 0;
 771                 wpa_s->new_connection = 0;
 772                 wpa_drv_set_operstate(wpa_s, 1);
 773 #ifndef IEEE8021X_EAPOL
 774                 wpa_drv_set_supp_port(wpa_s, 1);
 775 #endif /* IEEE8021X_EAPOL */
 776                 wpa_s->after_wps = 0;
 777                 wpa_s->known_wps_freq = 0;
 778                 wpas_p2p_completed(wpa_s);
 779
 780                 sme_sched_obss_scan(wpa_s, 1);
 781         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 782                    state == WPA_ASSOCIATED) {
 783                 wpa_s->new_connection = 1;
 784                 wpa_drv_set_operstate(wpa_s, 0);
 785 #ifndef IEEE8021X_EAPOL
 786                 wpa_drv_set_supp_port(wpa_s, 0);
 787 #endif /* IEEE8021X_EAPOL */
 788                 sme_sched_obss_scan(wpa_s, 0);
 789         }
 790         wpa_s->wpa_state = state;
 791
 792 #ifdef CONFIG_BGSCAN
 793         if (state == WPA_COMPLETED)
 794                 wpa_supplicant_start_bgscan(wpa_s);
 795         else if (state < WPA_ASSOCIATED)
 796                 wpa_supplicant_stop_bgscan(wpa_s);
 797 #endif /* CONFIG_BGSCAN */
 798
 799         if (state == WPA_AUTHENTICATING)
 800                 wpa_supplicant_stop_autoscan(wpa_s);
 801
 802         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 803                 wpa_supplicant_start_autoscan(wpa_s);
 804
 805         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 806                 wmm_ac_notify_disassoc(wpa_s);
 807
 808         if (wpa_s->wpa_state != old_state) {
 809                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 810
 811                 /*
 812                  * Notify the P2P Device interface about a state change in one
 813                  * of the interfaces.
 814                  */
 815                 wpas_p2p_indicate_state_change(wpa_s);
 816
 817                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 818                     old_state == WPA_COMPLETED)
 819                         wpas_notify_auth_changed(wpa_s);
 820         }
 821 }
 822
 823
 824 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 825 {
 826         int pending = 0;
 827 #ifdef CONFIG_WPS
 828         struct wpa_supplicant *wpa_s = global->ifaces;
 829         while (wpa_s) {
 830                 struct wpa_supplicant *next = wpa_s->next;
 831                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 832                         pending = 1;
 833 #ifdef CONFIG_P2P
 834                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 835                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 836                         wpas_p2p_disconnect(wpa_s);
 837 #endif /* CONFIG_P2P */
 838                 wpa_s = next;
 839         }
 840 #endif /* CONFIG_WPS */
 841         if (pending)
 842                 return;
 843         eloop_terminate();
 844 }
 845
 846
 847 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 848 {
 849         struct wpa_global *global = signal_ctx;
 850         wpa_supplicant_terminate_proc(global);
 851 }
 852
 853
 854 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 855 {
 856         enum wpa_states old_state = wpa_s->wpa_state;
 857
 858         wpa_s->pairwise_cipher = 0;
 859         wpa_s->group_cipher = 0;
 860         wpa_s->mgmt_group_cipher = 0;
 861         wpa_s->key_mgmt = 0;
 862         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 863                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 864
 865         if (wpa_s->wpa_state != old_state)
 866                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 867 }
 868
 869
 870 /**
 871  * wpa_supplicant_reload_configuration - Reload configuration data
 872  * @wpa_s: Pointer to wpa_supplicant data
 873  * Returns: 0 on success or -1 if configuration parsing failed
 874  *
 875  * This function can be used to request that the configuration data is reloaded
 876  * (e.g., after configuration file change). This function is reloading
 877  * configuration only for one interface, so this may need to be called multiple
 878  * times if %wpa_supplicant is controlling multiple interfaces and all
 879  * interfaces need reconfiguration.
 880  */
 881 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 882 {
 883         struct wpa_config *conf;
 884         int reconf_ctrl;
 885         int old_ap_scan;
 886
 887         if (wpa_s->confname == NULL)
 888                 return -1;
 889         conf = wpa_config_read(wpa_s->confname, NULL);
 890         if (conf == NULL) {
 891                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 892                         "file '%s' - exiting", wpa_s->confname);
 893                 return -1;
 894         }
 895         wpa_config_read(wpa_s->confanother, conf);
 896
 897         conf->changed_parameters = (unsigned int) -1;
 898
 899         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 900                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 901                     os_strcmp(conf->ctrl_interface,
 902                               wpa_s->conf->ctrl_interface) != 0);
 903
 904         if (reconf_ctrl && wpa_s->ctrl_iface) {
 905                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 906                 wpa_s->ctrl_iface = NULL;
 907         }
 908
 909         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 910         if (wpa_s->current_ssid) {
 911                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 912                         wpa_s->own_disconnect_req = 1;
 913                 wpa_supplicant_deauthenticate(wpa_s,
 914                                               WLAN_REASON_DEAUTH_LEAVING);
 915         }
 916
 917         /*
 918          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 919          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 920          */
 921         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 922                 /*
 923                  * Clear forced success to clear EAP state for next
 924                  * authentication.
 925                  */
 926                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 927         }
 928         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 929         wpa_sm_set_config(wpa_s->wpa, NULL);
 930         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 931         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 932         rsn_preauth_deinit(wpa_s->wpa);
 933
 934         old_ap_scan = wpa_s->conf->ap_scan;
 935         wpa_config_free(wpa_s->conf);
 936         wpa_s->conf = conf;
 937         if (old_ap_scan != wpa_s->conf->ap_scan)
 938                 wpas_notify_ap_scan_changed(wpa_s);
 939
 940         if (reconf_ctrl)
 941                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 942
 943         wpa_supplicant_update_config(wpa_s);
 944
 945         wpa_supplicant_clear_status(wpa_s);
 946         if (wpa_supplicant_enabled_networks(wpa_s)) {
 947                 wpa_s->reassociate = 1;
 948                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 949         }
 950         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 951         return 0;
 952 }
 953
 954
 955 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 956 {
 957         struct wpa_global *global = signal_ctx;
 958         struct wpa_supplicant *wpa_s;
 959         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 960                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 961                         sig);
 962                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 963                         wpa_supplicant_terminate_proc(global);
 964                 }
 965         }
 966
 967         if (wpa_debug_reopen_file() < 0) {
 968                 /* Ignore errors since we cannot really do much to fix this */
 969                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 970         }
 971 }
 972
 973
 974 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 975                                          struct wpa_ssid *ssid,
 976                                          struct wpa_ie_data *ie)
 977 {
 978         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 979         if (ret) {
 980                 if (ret == -2) {
 981                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 982                                 "from association info");
 983                 }
 984                 return -1;
 985         }
 986
 987         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 988                 "cipher suites");
 989         if (!(ie->group_cipher & ssid->group_cipher)) {
 990                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 991                         "cipher 0x%x (mask 0x%x) - reject",
 992                         ie->group_cipher, ssid->group_cipher);
 993                 return -1;
 994         }
 995         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 996                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 997                         "cipher 0x%x (mask 0x%x) - reject",
 998                         ie->pairwise_cipher, ssid->pairwise_cipher);
 999                 return -1;
1000         }
1001         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1002                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1003                         "management 0x%x (mask 0x%x) - reject",
1004                         ie->key_mgmt, ssid->key_mgmt);
1005                 return -1;
1006         }
1007
1008 #ifdef CONFIG_IEEE80211W
1009         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1010             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1011                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1012                         "that does not support management frame protection - "
1013                         "reject");
1014                 return -1;
1015         }
1016 #endif /* CONFIG_IEEE80211W */
1017
1018         return 0;
1019 }
1020
1021
1022 /**
1023  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1024  * @wpa_s: Pointer to wpa_supplicant data
1025  * @bss: Scan results for the selected BSS, or %NULL if not available
1026  * @ssid: Configuration data for the selected network
1027  * @wpa_ie: Buffer for the WPA/RSN IE
1028  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1029  * used buffer length in case the functions returns success.
1030  * Returns: 0 on success or -1 on failure
1031  *
1032  * This function is used to configure authentication and encryption parameters
1033  * based on the network configuration and scan result for the selected BSS (if
1034  * available).
1035  */
1036 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1037                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1038                               u8 *wpa_ie, size_t *wpa_ie_len)
1039 {
1040         struct wpa_ie_data ie;
1041         int sel, proto;
1042         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1043
1044         if (bss) {
1045                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1046                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1047                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1048         } else
1049                 bss_wpa = bss_rsn = bss_osen = NULL;
1050
1051         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1052             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1053             (ie.group_cipher & ssid->group_cipher) &&
1054             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1055             (ie.key_mgmt & ssid->key_mgmt)) {
1056                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1057                 proto = WPA_PROTO_RSN;
1058         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1059                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1060                    (ie.group_cipher & ssid->group_cipher) &&
1061                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1062                    (ie.key_mgmt & ssid->key_mgmt)) {
1063                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1064                 proto = WPA_PROTO_WPA;
1065 #ifdef CONFIG_HS20
1066         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1067                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1068                 /* TODO: parse OSEN element */
1069                 os_memset(&ie, 0, sizeof(ie));
1070                 ie.group_cipher = WPA_CIPHER_CCMP;
1071                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1072                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1073                 proto = WPA_PROTO_OSEN;
1074 #endif /* CONFIG_HS20 */
1075         } else if (bss) {
1076                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1077                 wpa_dbg(wpa_s, MSG_DEBUG,
1078                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1079                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1080                         ssid->key_mgmt);
1081                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1082                         MAC2STR(bss->bssid),
1083                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1084                         bss_wpa ? " WPA" : "",
1085                         bss_rsn ? " RSN" : "",
1086                         bss_osen ? " OSEN" : "");
1087                 if (bss_rsn) {
1088                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1089                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1090                                 wpa_dbg(wpa_s, MSG_DEBUG,
1091                                         "Could not parse RSN element");
1092                         } else {
1093                                 wpa_dbg(wpa_s, MSG_DEBUG,
1094                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1095                                         ie.pairwise_cipher, ie.group_cipher,
1096                                         ie.key_mgmt);
1097                         }
1098                 }
1099                 if (bss_wpa) {
1100                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1101                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1102                                 wpa_dbg(wpa_s, MSG_DEBUG,
1103                                         "Could not parse WPA element");
1104                         } else {
1105                                 wpa_dbg(wpa_s, MSG_DEBUG,
1106                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1107                                         ie.pairwise_cipher, ie.group_cipher,
1108                                         ie.key_mgmt);
1109                         }
1110                 }
1111                 return -1;
1112         } else {
1113                 if (ssid->proto & WPA_PROTO_OSEN)
1114                         proto = WPA_PROTO_OSEN;
1115                 else if (ssid->proto & WPA_PROTO_RSN)
1116                         proto = WPA_PROTO_RSN;
1117                 else
1118                         proto = WPA_PROTO_WPA;
1119                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1120                         os_memset(&ie, 0, sizeof(ie));
1121                         ie.group_cipher = ssid->group_cipher;
1122                         ie.pairwise_cipher = ssid->pairwise_cipher;
1123                         ie.key_mgmt = ssid->key_mgmt;
1124 #ifdef CONFIG_IEEE80211W
1125                         ie.mgmt_group_cipher =
1126                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1127                                 WPA_CIPHER_AES_128_CMAC : 0;
1128 #endif /* CONFIG_IEEE80211W */
1129                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1130                                 "based on configuration");
1131                 } else
1132                         proto = ie.proto;
1133         }
1134
1135         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1136                 "pairwise %d key_mgmt %d proto %d",
1137                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1138 #ifdef CONFIG_IEEE80211W
1139         if (ssid->ieee80211w) {
1140                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1141                         ie.mgmt_group_cipher);
1142         }
1143 #endif /* CONFIG_IEEE80211W */
1144
1145         wpa_s->wpa_proto = proto;
1146         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1147         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1148                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1149
1150         if (bss || !wpa_s->ap_ies_from_associnfo) {
1151                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1152                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1153                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1154                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1155                         return -1;
1156         }
1157
1158 #ifdef CONFIG_NO_WPA
1159         wpa_s->group_cipher = WPA_CIPHER_NONE;
1160         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1161 #else /* CONFIG_NO_WPA */
1162         sel = ie.group_cipher & ssid->group_cipher;
1163         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1164         if (wpa_s->group_cipher < 0) {
1165                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1166                         "cipher");
1167                 return -1;
1168         }
1169         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1170                 wpa_cipher_txt(wpa_s->group_cipher));
1171
1172         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1173         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1174         if (wpa_s->pairwise_cipher < 0) {
1175                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1176                         "cipher");
1177                 return -1;
1178         }
1179         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1180                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1181 #endif /* CONFIG_NO_WPA */
1182
1183         sel = ie.key_mgmt & ssid->key_mgmt;
1184 #ifdef CONFIG_SAE
1185         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1186                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1187 #endif /* CONFIG_SAE */
1188         if (0) {
1189 #ifdef CONFIG_SUITEB192
1190         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1191                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1192                 wpa_dbg(wpa_s, MSG_DEBUG,
1193                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1194 #endif /* CONFIG_SUITEB192 */
1195 #ifdef CONFIG_SUITEB
1196         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1197                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1198                 wpa_dbg(wpa_s, MSG_DEBUG,
1199                         "WPA: using KEY_MGMT 802.1X with Suite B");
1200 #endif /* CONFIG_SUITEB */
1201 #ifdef CONFIG_IEEE80211R
1202         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1203                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1204                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1205         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1206                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1207                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1208 #endif /* CONFIG_IEEE80211R */
1209 #ifdef CONFIG_SAE
1210         } else if (sel & WPA_KEY_MGMT_SAE) {
1211                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1212                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1213         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1214                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1215                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1216 #endif /* CONFIG_SAE */
1217 #ifdef CONFIG_IEEE80211W
1218         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1219                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1220                 wpa_dbg(wpa_s, MSG_DEBUG,
1221                         "WPA: using KEY_MGMT 802.1X with SHA256");
1222         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1223                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1224                 wpa_dbg(wpa_s, MSG_DEBUG,
1225                         "WPA: using KEY_MGMT PSK with SHA256");
1226 #endif /* CONFIG_IEEE80211W */
1227         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1228                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1229                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1230         } else if (sel & WPA_KEY_MGMT_PSK) {
1231                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1232                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1233         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1234                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1235                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1236 #ifdef CONFIG_HS20
1237         } else if (sel & WPA_KEY_MGMT_OSEN) {
1238                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1239                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1240 #endif /* CONFIG_HS20 */
1241         } else {
1242                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1243                         "authenticated key management type");
1244                 return -1;
1245         }
1246
1247         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1248         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1249                          wpa_s->pairwise_cipher);
1250         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1251
1252 #ifdef CONFIG_IEEE80211W
1253         sel = ie.mgmt_group_cipher;
1254         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1255             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1256                 sel = 0;
1257         if (sel & WPA_CIPHER_AES_128_CMAC) {
1258                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1259                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1260                         "AES-128-CMAC");
1261         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1262                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1264                         "BIP-GMAC-128");
1265         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1266                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1268                         "BIP-GMAC-256");
1269         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1270                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1271                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1272                         "BIP-CMAC-256");
1273         } else {
1274                 wpa_s->mgmt_group_cipher = 0;
1275                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1276         }
1277         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1278                          wpa_s->mgmt_group_cipher);
1279         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1280                          wpas_get_ssid_pmf(wpa_s, ssid));
1281 #endif /* CONFIG_IEEE80211W */
1282
1283         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1284                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1285                 return -1;
1286         }
1287
1288         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1289                 int psk_set = 0;
1290
1291                 if (ssid->psk_set) {
1292                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1293                         psk_set = 1;
1294                 }
1295 #ifndef CONFIG_NO_PBKDF2
1296                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1297                     ssid->passphrase) {
1298                         u8 psk[PMK_LEN];
1299                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1300                                     4096, psk, PMK_LEN);
1301                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1302                                         psk, PMK_LEN);
1303                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1304                         psk_set = 1;
1305                         os_memset(psk, 0, sizeof(psk));
1306                 }
1307 #endif /* CONFIG_NO_PBKDF2 */
1308 #ifdef CONFIG_EXT_PASSWORD
1309                 if (ssid->ext_psk) {
1310                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1311                                                              ssid->ext_psk);
1312                         char pw_str[64 + 1];
1313                         u8 psk[PMK_LEN];
1314
1315                         if (pw == NULL) {
1316                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1317                                         "found from external storage");
1318                                 return -1;
1319                         }
1320
1321                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1322                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1323                                         "PSK length %d in external storage",
1324                                         (int) wpabuf_len(pw));
1325                                 ext_password_free(pw);
1326                                 return -1;
1327                         }
1328
1329                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1330                         pw_str[wpabuf_len(pw)] = '\0';
1331
1332 #ifndef CONFIG_NO_PBKDF2
1333                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1334                         {
1335                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1336                                             4096, psk, PMK_LEN);
1337                                 os_memset(pw_str, 0, sizeof(pw_str));
1338                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1339                                                 "external passphrase)",
1340                                                 psk, PMK_LEN);
1341                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1342                                 psk_set = 1;
1343                                 os_memset(psk, 0, sizeof(psk));
1344                         } else
1345 #endif /* CONFIG_NO_PBKDF2 */
1346                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1347                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1348                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1349                                                 "Invalid PSK hex string");
1350                                         os_memset(pw_str, 0, sizeof(pw_str));
1351                                         ext_password_free(pw);
1352                                         return -1;
1353                                 }
1354                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1355                                 psk_set = 1;
1356                                 os_memset(psk, 0, sizeof(psk));
1357                         } else {
1358                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1359                                         "PSK available");
1360                                 os_memset(pw_str, 0, sizeof(pw_str));
1361                                 ext_password_free(pw);
1362                                 return -1;
1363                         }
1364
1365                         os_memset(pw_str, 0, sizeof(pw_str));
1366                         ext_password_free(pw);
1367                 }
1368 #endif /* CONFIG_EXT_PASSWORD */
1369
1370                 if (!psk_set) {
1371                         wpa_msg(wpa_s, MSG_INFO,
1372                                 "No PSK available for association");
1373                         return -1;
1374                 }
1375         } else
1376                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1377
1378         return 0;
1379 }
1380
1381
1382 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1383 {
1384         *pos = 0x00;
1385
1386         switch (idx) {
1387         case 0: /* Bits 0-7 */
1388                 break;
1389         case 1: /* Bits 8-15 */
1390                 break;
1391         case 2: /* Bits 16-23 */
1392 #ifdef CONFIG_WNM
1393                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1394                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1395 #endif /* CONFIG_WNM */
1396                 break;
1397         case 3: /* Bits 24-31 */
1398 #ifdef CONFIG_WNM
1399                 *pos |= 0x02; /* Bit 25 - SSID List */
1400 #endif /* CONFIG_WNM */
1401 #ifdef CONFIG_INTERWORKING
1402                 if (wpa_s->conf->interworking)
1403                         *pos |= 0x80; /* Bit 31 - Interworking */
1404 #endif /* CONFIG_INTERWORKING */
1405                 break;
1406         case 4: /* Bits 32-39 */
1407 #ifdef CONFIG_INTERWORKING
1408                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1409                         *pos |= 0x01; /* Bit 32 - QoS Map */
1410 #endif /* CONFIG_INTERWORKING */
1411                 break;
1412         case 5: /* Bits 40-47 */
1413 #ifdef CONFIG_HS20
1414                 if (wpa_s->conf->hs20)
1415                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1416 #endif /* CONFIG_HS20 */
1417                 break;
1418         case 6: /* Bits 48-55 */
1419                 break;
1420         }
1421 }
1422
1423
1424 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1425 {
1426         u8 *pos = buf;
1427         u8 len = 6, i;
1428
1429         if (len < wpa_s->extended_capa_len)
1430                 len = wpa_s->extended_capa_len;
1431         if (buflen < (size_t) len + 2) {
1432                 wpa_printf(MSG_INFO,
1433                            "Not enough room for building extended capabilities element");
1434                 return -1;
1435         }
1436
1437         *pos++ = WLAN_EID_EXT_CAPAB;
1438         *pos++ = len;
1439         for (i = 0; i < len; i++, pos++) {
1440                 wpas_ext_capab_byte(wpa_s, pos, i);
1441
1442                 if (i < wpa_s->extended_capa_len) {
1443                         *pos &= ~wpa_s->extended_capa_mask[i];
1444                         *pos |= wpa_s->extended_capa[i];
1445                 }
1446         }
1447
1448         while (len > 0 && buf[1 + len] == 0) {
1449                 len--;
1450                 buf[1] = len;
1451         }
1452         if (len == 0)
1453                 return 0;
1454
1455         return 2 + len;
1456 }
1457
1458
1459 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1460                           struct wpa_bss *test_bss)
1461 {
1462         struct wpa_bss *bss;
1463
1464         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1465                 if (bss == test_bss)
1466                         return 1;
1467         }
1468
1469         return 0;
1470 }
1471
1472
1473 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1474                            struct wpa_ssid *test_ssid)
1475 {
1476         struct wpa_ssid *ssid;
1477
1478         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1479                 if (ssid == test_ssid)
1480                         return 1;
1481         }
1482
1483         return 0;
1484 }
1485
1486
1487 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1488                         struct wpa_ssid *test_ssid)
1489 {
1490         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1491                 return 0;
1492
1493         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1494 }
1495
1496
1497 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1498 {
1499         if (cwork == NULL)
1500                 return;
1501         os_free(cwork);
1502 }
1503
1504
1505 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1506 {
1507         struct wpa_connect_work *cwork;
1508         struct wpa_radio_work *work = wpa_s->connect_work;
1509
1510         if (!work)
1511                 return;
1512
1513         wpa_s->connect_work = NULL;
1514         cwork = work->ctx;
1515         work->ctx = NULL;
1516         wpas_connect_work_free(cwork);
1517         radio_work_done(work);
1518 }
1519
1520
1521 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1522 {
1523         struct os_reltime now;
1524         u8 addr[ETH_ALEN];
1525
1526         os_get_reltime(&now);
1527         if (wpa_s->last_mac_addr_style == style &&
1528             wpa_s->last_mac_addr_change.sec != 0 &&
1529             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1530                                 wpa_s->conf->rand_addr_lifetime)) {
1531                 wpa_msg(wpa_s, MSG_DEBUG,
1532                         "Previously selected random MAC address has not yet expired");
1533                 return 0;
1534         }
1535
1536         switch (style) {
1537         case 1:
1538                 if (random_mac_addr(addr) < 0)
1539                         return -1;
1540                 break;
1541         case 2:
1542                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1543                 if (random_mac_addr_keep_oui(addr) < 0)
1544                         return -1;
1545                 break;
1546         default:
1547                 return -1;
1548         }
1549
1550         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1551                 wpa_msg(wpa_s, MSG_INFO,
1552                         "Failed to set random MAC address");
1553                 return -1;
1554         }
1555
1556         os_get_reltime(&wpa_s->last_mac_addr_change);
1557         wpa_s->mac_addr_changed = 1;
1558         wpa_s->last_mac_addr_style = style;
1559
1560         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1561                 wpa_msg(wpa_s, MSG_INFO,
1562                         "Could not update MAC address information");
1563                 return -1;
1564         }
1565
1566         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1567                 MAC2STR(addr));
1568
1569         return 0;
1570 }
1571
1572
1573 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1574 {
1575         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1576             !wpa_s->conf->preassoc_mac_addr)
1577                 return 0;
1578
1579         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1580 }
1581
1582
1583 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1584
1585 /**
1586  * wpa_supplicant_associate - Request association
1587  * @wpa_s: Pointer to wpa_supplicant data
1588  * @bss: Scan results for the selected BSS, or %NULL if not available
1589  * @ssid: Configuration data for the selected network
1590  *
1591  * This function is used to request %wpa_supplicant to associate with a BSS.
1592  */
1593 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1594                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1595 {
1596         struct wpa_connect_work *cwork;
1597         int rand_style;
1598
1599         wpa_s->own_disconnect_req = 0;
1600
1601         if (ssid->mac_addr == -1)
1602                 rand_style = wpa_s->conf->mac_addr;
1603         else
1604                 rand_style = ssid->mac_addr;
1605
1606         wmm_ac_clear_saved_tspecs(wpa_s);
1607         wpa_s->reassoc_same_bss = 0;
1608
1609         if (wpa_s->last_ssid == ssid) {
1610                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1611                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1612                         wmm_ac_save_tspecs(wpa_s);
1613                         wpa_s->reassoc_same_bss = 1;
1614                 }
1615         } else if (rand_style > 0) {
1616                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1617                         return;
1618                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1619         } else if (wpa_s->mac_addr_changed) {
1620                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1621                         wpa_msg(wpa_s, MSG_INFO,
1622                                 "Could not restore permanent MAC address");
1623                         return;
1624                 }
1625                 wpa_s->mac_addr_changed = 0;
1626                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1627                         wpa_msg(wpa_s, MSG_INFO,
1628                                 "Could not update MAC address information");
1629                         return;
1630                 }
1631                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1632         }
1633         wpa_s->last_ssid = ssid;
1634
1635 #ifdef CONFIG_IBSS_RSN
1636         ibss_rsn_deinit(wpa_s->ibss_rsn);
1637         wpa_s->ibss_rsn = NULL;
1638 #endif /* CONFIG_IBSS_RSN */
1639
1640         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1641             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1642 #ifdef CONFIG_AP
1643                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1644                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1645                                 "mode");
1646                         return;
1647                 }
1648                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1649                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1650                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1651                                 wpas_p2p_ap_setup_failed(wpa_s);
1652                         return;
1653                 }
1654                 wpa_s->current_bss = bss;
1655 #else /* CONFIG_AP */
1656                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1657                         "the build");
1658 #endif /* CONFIG_AP */
1659                 return;
1660         }
1661
1662         if (ssid->mode == WPAS_MODE_MESH) {
1663 #ifdef CONFIG_MESH
1664                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1665                         wpa_msg(wpa_s, MSG_INFO,
1666                                 "Driver does not support mesh mode");
1667                         return;
1668                 }
1669                 if (bss)
1670                         ssid->frequency = bss->freq;
1671                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1672                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1673                         return;
1674                 }
1675                 wpa_s->current_bss = bss;
1676                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1677                              "ssid=\"%s\" id=%d",
1678                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1679                              ssid->id);
1680 #else /* CONFIG_MESH */
1681                 wpa_msg(wpa_s, MSG_ERROR,
1682                         "mesh mode support not included in the build");
1683 #endif /* CONFIG_MESH */
1684                 return;
1685         }
1686
1687 #ifdef CONFIG_TDLS
1688         if (bss)
1689                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1690                                 bss->ie_len);
1691 #endif /* CONFIG_TDLS */
1692
1693         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1694             ssid->mode == IEEE80211_MODE_INFRA) {
1695                 sme_authenticate(wpa_s, bss, ssid);
1696                 return;
1697         }
1698
1699         if (wpa_s->connect_work) {
1700                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1701                 return;
1702         }
1703
1704         if (radio_work_pending(wpa_s, "connect")) {
1705                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1706                 return;
1707         }
1708
1709         cwork = os_zalloc(sizeof(*cwork));
1710         if (cwork == NULL)
1711                 return;
1712
1713         cwork->bss = bss;
1714         cwork->ssid = ssid;
1715
1716         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1717                            wpas_start_assoc_cb, cwork) < 0) {
1718                 os_free(cwork);
1719         }
1720 }
1721
1722
1723 static int bss_is_ibss(struct wpa_bss *bss)
1724 {
1725         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1726                 IEEE80211_CAP_IBSS;
1727 }
1728
1729
1730 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1731                             const struct wpa_ssid *ssid)
1732 {
1733         enum hostapd_hw_mode hw_mode;
1734         struct hostapd_hw_modes *mode = NULL;
1735         u8 channel;
1736         int i;
1737
1738 #ifdef CONFIG_HT_OVERRIDES
1739         if (ssid->disable_ht)
1740                 return 0;
1741 #endif /* CONFIG_HT_OVERRIDES */
1742
1743         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1744         if (hw_mode == NUM_HOSTAPD_MODES)
1745                 return 0;
1746         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1747                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1748                         mode = &wpa_s->hw.modes[i];
1749                         break;
1750                 }
1751         }
1752
1753         if (!mode)
1754                 return 0;
1755
1756         return mode->vht_capab != 0;
1757 }
1758
1759
1760 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1761                           const struct wpa_ssid *ssid,
1762                           struct hostapd_freq_params *freq)
1763 {
1764         enum hostapd_hw_mode hw_mode;
1765         struct hostapd_hw_modes *mode = NULL;
1766         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1767                            184, 192 };
1768         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1769         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1770         u8 channel;
1771         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1772         unsigned int j;
1773         struct hostapd_freq_params vht_freq;
1774
1775         freq->freq = ssid->frequency;
1776
1777         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1778                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1779
1780                 if (ssid->mode != WPAS_MODE_IBSS)
1781                         break;
1782
1783                 /* Don't adjust control freq in case of fixed_freq */
1784                 if (ssid->fixed_freq)
1785                         break;
1786
1787                 if (!bss_is_ibss(bss))
1788                         continue;
1789
1790                 if (ssid->ssid_len == bss->ssid_len &&
1791                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1792                         wpa_printf(MSG_DEBUG,
1793                                    "IBSS already found in scan results, adjust control freq: %d",
1794                                    bss->freq);
1795                         freq->freq = bss->freq;
1796                         obss_scan = 0;
1797                         break;
1798                 }
1799         }
1800
1801         /* For IBSS check HT_IBSS flag */
1802         if (ssid->mode == WPAS_MODE_IBSS &&
1803             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1804                 return;
1805
1806         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1807             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1808             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1809                 wpa_printf(MSG_DEBUG,
1810                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1811                 return;
1812         }
1813
1814         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1815         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1816                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1817                         mode = &wpa_s->hw.modes[i];
1818                         break;
1819                 }
1820         }
1821
1822         if (!mode)
1823                 return;
1824
1825         freq->ht_enabled = ht_supported(mode);
1826         if (!freq->ht_enabled)
1827                 return;
1828
1829         /* Setup higher BW only for 5 GHz */
1830         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1831                 return;
1832
1833         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1834                 pri_chan = &mode->channels[chan_idx];
1835                 if (pri_chan->chan == channel)
1836                         break;
1837                 pri_chan = NULL;
1838         }
1839         if (!pri_chan)
1840                 return;
1841
1842         /* Check primary channel flags */
1843         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1844                 return;
1845
1846         /* Check/setup HT40+/HT40- */
1847         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1848                 if (ht40plus[j] == channel) {
1849                         ht40 = 1;
1850                         break;
1851                 }
1852         }
1853
1854         /* Find secondary channel */
1855         for (i = 0; i < mode->num_channels; i++) {
1856                 sec_chan = &mode->channels[i];
1857                 if (sec_chan->chan == channel + ht40 * 4)
1858                         break;
1859                 sec_chan = NULL;
1860         }
1861         if (!sec_chan)
1862                 return;
1863
1864         /* Check secondary channel flags */
1865         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1866                 return;
1867
1868         freq->channel = pri_chan->chan;
1869
1870         switch (ht40) {
1871         case -1:
1872                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1873                         return;
1874                 freq->sec_channel_offset = -1;
1875                 break;
1876         case 1:
1877                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1878                         return;
1879                 freq->sec_channel_offset = 1;
1880                 break;
1881         default:
1882                 break;
1883         }
1884
1885         if (freq->sec_channel_offset && obss_scan) {
1886                 struct wpa_scan_results *scan_res;
1887
1888                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1889                 if (scan_res == NULL) {
1890                         /* Back to HT20 */
1891                         freq->sec_channel_offset = 0;
1892                         return;
1893                 }
1894
1895                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1896                                      sec_chan->chan);
1897                 switch (res) {
1898                 case 0:
1899                         /* Back to HT20 */
1900                         freq->sec_channel_offset = 0;
1901                         break;
1902                 case 1:
1903                         /* Configuration allowed */
1904                         break;
1905                 case 2:
1906                         /* Switch pri/sec channels */
1907                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1908                         freq->sec_channel_offset = -freq->sec_channel_offset;
1909                         freq->channel = sec_chan->chan;
1910                         break;
1911                 default:
1912                         freq->sec_channel_offset = 0;
1913                         break;
1914                 }
1915
1916                 wpa_scan_results_free(scan_res);
1917         }
1918
1919         wpa_printf(MSG_DEBUG,
1920                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1921                    freq->channel, freq->sec_channel_offset);
1922
1923         if (!drv_supports_vht(wpa_s, ssid))
1924                 return;
1925
1926         /* For IBSS check VHT_IBSS flag */
1927         if (ssid->mode == WPAS_MODE_IBSS &&
1928             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1929                 return;
1930
1931         vht_freq = *freq;
1932
1933         vht_freq.vht_enabled = vht_supported(mode);
1934         if (!vht_freq.vht_enabled)
1935                 return;
1936
1937         /* setup center_freq1, bandwidth */
1938         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1939                 if (freq->channel >= vht80[j] &&
1940                     freq->channel < vht80[j] + 16)
1941                         break;
1942         }
1943
1944         if (j == ARRAY_SIZE(vht80))
1945                 return;
1946
1947         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1948                 struct hostapd_channel_data *chan;
1949
1950                 chan = hw_get_channel_chan(mode, i, NULL);
1951                 if (!chan)
1952                         return;
1953
1954                 /* Back to HT configuration if channel not usable */
1955                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1956                         return;
1957         }
1958
1959         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
1960                                     freq->channel, freq->ht_enabled,
1961                                     vht_freq.vht_enabled,
1962                                     freq->sec_channel_offset,
1963                                     VHT_CHANWIDTH_80MHZ,
1964                                     vht80[j] + 6, 0, 0) != 0)
1965                 return;
1966
1967         *freq = vht_freq;
1968
1969         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
1970                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
1971 }
1972
1973
1974 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1975 {
1976         struct wpa_connect_work *cwork = work->ctx;
1977         struct wpa_bss *bss = cwork->bss;
1978         struct wpa_ssid *ssid = cwork->ssid;
1979         struct wpa_supplicant *wpa_s = work->wpa_s;
1980         u8 wpa_ie[200];
1981         size_t wpa_ie_len;
1982         int use_crypt, ret, i, bssid_changed;
1983         int algs = WPA_AUTH_ALG_OPEN;
1984         unsigned int cipher_pairwise, cipher_group;
1985         struct wpa_driver_associate_params params;
1986         int wep_keys_set = 0;
1987         int assoc_failed = 0;
1988         struct wpa_ssid *old_ssid;
1989 #ifdef CONFIG_HT_OVERRIDES
1990         struct ieee80211_ht_capabilities htcaps;
1991         struct ieee80211_ht_capabilities htcaps_mask;
1992 #endif /* CONFIG_HT_OVERRIDES */
1993 #ifdef CONFIG_VHT_OVERRIDES
1994        struct ieee80211_vht_capabilities vhtcaps;
1995        struct ieee80211_vht_capabilities vhtcaps_mask;
1996 #endif /* CONFIG_VHT_OVERRIDES */
1997
1998         if (deinit) {
1999                 if (work->started) {
2000                         wpa_s->connect_work = NULL;
2001
2002                         /* cancel possible auth. timeout */
2003                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2004                                              NULL);
2005                 }
2006                 wpas_connect_work_free(cwork);
2007                 return;
2008         }
2009
2010         wpa_s->connect_work = work;
2011
2012         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2013             wpas_network_disabled(wpa_s, ssid)) {
2014                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2015                 wpas_connect_work_done(wpa_s);
2016                 return;
2017         }
2018
2019         os_memset(&params, 0, sizeof(params));
2020         wpa_s->reassociate = 0;
2021         wpa_s->eap_expected_failure = 0;
2022         if (bss &&
2023             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2024 #ifdef CONFIG_IEEE80211R
2025                 const u8 *ie, *md = NULL;
2026 #endif /* CONFIG_IEEE80211R */
2027                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2028                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2029                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2030                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2031                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2032                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2033                 if (bssid_changed)
2034                         wpas_notify_bssid_changed(wpa_s);
2035 #ifdef CONFIG_IEEE80211R
2036                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2037                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2038                         md = ie + 2;
2039                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2040                 if (md) {
2041                         /* Prepare for the next transition */
2042                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2043                 }
2044 #endif /* CONFIG_IEEE80211R */
2045 #ifdef CONFIG_WPS
2046         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2047                    wpa_s->conf->ap_scan == 2 &&
2048                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2049                 /* Use ap_scan==1 style network selection to find the network
2050                  */
2051                 wpas_connect_work_done(wpa_s);
2052                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2053                 wpa_s->reassociate = 1;
2054                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2055                 return;
2056 #endif /* CONFIG_WPS */
2057         } else {
2058                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2059                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2060                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2061         }
2062         if (!wpa_s->pno)
2063                 wpa_supplicant_cancel_sched_scan(wpa_s);
2064
2065         wpa_supplicant_cancel_scan(wpa_s);
2066
2067         /* Starting new association, so clear the possibly used WPA IE from the
2068          * previous association. */
2069         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2070
2071 #ifdef IEEE8021X_EAPOL
2072         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2073                 if (ssid->leap) {
2074                         if (ssid->non_leap == 0)
2075                                 algs = WPA_AUTH_ALG_LEAP;
2076                         else
2077                                 algs |= WPA_AUTH_ALG_LEAP;
2078                 }
2079         }
2080 #endif /* IEEE8021X_EAPOL */
2081         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2082         if (ssid->auth_alg) {
2083                 algs = ssid->auth_alg;
2084                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2085                         "0x%x", algs);
2086         }
2087
2088         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2089                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2090             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2091                 int try_opportunistic;
2092                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2093                                      wpa_s->conf->okc :
2094                                      ssid->proactive_key_caching) &&
2095                         (ssid->proto & WPA_PROTO_RSN);
2096                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2097                                             ssid, try_opportunistic) == 0)
2098                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2099                 wpa_ie_len = sizeof(wpa_ie);
2100                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2101                                               wpa_ie, &wpa_ie_len)) {
2102                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2103                                 "key management and encryption suites");
2104                         wpas_connect_work_done(wpa_s);
2105                         return;
2106                 }
2107         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2108                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2109                 /*
2110                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2111                  * use non-WPA since the scan results did not indicate that the
2112                  * AP is using WPA or WPA2.
2113                  */
2114                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2115                 wpa_ie_len = 0;
2116                 wpa_s->wpa_proto = 0;
2117         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2118                 wpa_ie_len = sizeof(wpa_ie);
2119                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2120                                               wpa_ie, &wpa_ie_len)) {
2121                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2122                                 "key management and encryption suites (no "
2123                                 "scan results)");
2124                         wpas_connect_work_done(wpa_s);
2125                         return;
2126                 }
2127 #ifdef CONFIG_WPS
2128         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2129                 struct wpabuf *wps_ie;
2130                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2131                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2132                         wpa_ie_len = wpabuf_len(wps_ie);
2133                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2134                 } else
2135                         wpa_ie_len = 0;
2136                 wpabuf_free(wps_ie);
2137                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2138                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2139                         params.wps = WPS_MODE_PRIVACY;
2140                 else
2141                         params.wps = WPS_MODE_OPEN;
2142                 wpa_s->wpa_proto = 0;
2143 #endif /* CONFIG_WPS */
2144         } else {
2145                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2146                 wpa_ie_len = 0;
2147                 wpa_s->wpa_proto = 0;
2148         }
2149
2150 #ifdef CONFIG_P2P
2151         if (wpa_s->global->p2p) {
2152                 u8 *pos;
2153                 size_t len;
2154                 int res;
2155                 pos = wpa_ie + wpa_ie_len;
2156                 len = sizeof(wpa_ie) - wpa_ie_len;
2157                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2158                                             ssid->p2p_group);
2159                 if (res >= 0)
2160                         wpa_ie_len += res;
2161         }
2162
2163         wpa_s->cross_connect_disallowed = 0;
2164         if (bss) {
2165                 struct wpabuf *p2p;
2166                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2167                 if (p2p) {
2168                         wpa_s->cross_connect_disallowed =
2169                                 p2p_get_cross_connect_disallowed(p2p);
2170                         wpabuf_free(p2p);
2171                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2172                                 "connection",
2173                                 wpa_s->cross_connect_disallowed ?
2174                                 "disallows" : "allows");
2175                 }
2176         }
2177
2178         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2179 #endif /* CONFIG_P2P */
2180
2181 #ifdef CONFIG_HS20
2182         if (is_hs20_network(wpa_s, ssid, bss)) {
2183                 struct wpabuf *hs20;
2184                 hs20 = wpabuf_alloc(20);
2185                 if (hs20) {
2186                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2187                         size_t len;
2188
2189                         wpas_hs20_add_indication(hs20, pps_mo_id);
2190                         len = sizeof(wpa_ie) - wpa_ie_len;
2191                         if (wpabuf_len(hs20) <= len) {
2192                                 os_memcpy(wpa_ie + wpa_ie_len,
2193                                           wpabuf_head(hs20), wpabuf_len(hs20));
2194                                 wpa_ie_len += wpabuf_len(hs20);
2195                         }
2196                         wpabuf_free(hs20);
2197                 }
2198         }
2199 #endif /* CONFIG_HS20 */
2200
2201         /*
2202          * Workaround: Add Extended Capabilities element only if the AP
2203          * included this element in Beacon/Probe Response frames. Some older
2204          * APs seem to have interoperability issues if this element is
2205          * included, so while the standard may require us to include the
2206          * element in all cases, it is justifiable to skip it to avoid
2207          * interoperability issues.
2208          */
2209         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2210                 u8 ext_capab[18];
2211                 int ext_capab_len;
2212                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2213                                                      sizeof(ext_capab));
2214                 if (ext_capab_len > 0) {
2215                         u8 *pos = wpa_ie;
2216                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2217                                 pos += 2 + pos[1];
2218                         os_memmove(pos + ext_capab_len, pos,
2219                                    wpa_ie_len - (pos - wpa_ie));
2220                         wpa_ie_len += ext_capab_len;
2221                         os_memcpy(pos, ext_capab, ext_capab_len);
2222                 }
2223         }
2224
2225         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2226                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2227                 size_t len;
2228
2229                 len = sizeof(wpa_ie) - wpa_ie_len;
2230                 if (wpabuf_len(buf) <= len) {
2231                         os_memcpy(wpa_ie + wpa_ie_len,
2232                                   wpabuf_head(buf), wpabuf_len(buf));
2233                         wpa_ie_len += wpabuf_len(buf);
2234                 }
2235         }
2236
2237 #ifdef CONFIG_FST
2238         if (wpa_s->fst_ies) {
2239                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2240
2241                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2242                         os_memcpy(wpa_ie + wpa_ie_len,
2243                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2244                         wpa_ie_len += fst_ies_len;
2245                 }
2246         }
2247 #endif /* CONFIG_FST */
2248
2249         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2250         use_crypt = 1;
2251         cipher_pairwise = wpa_s->pairwise_cipher;
2252         cipher_group = wpa_s->group_cipher;
2253         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2254             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2255                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2256                         use_crypt = 0;
2257                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2258                         use_crypt = 1;
2259                         wep_keys_set = 1;
2260                 }
2261         }
2262         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2263                 use_crypt = 0;
2264
2265 #ifdef IEEE8021X_EAPOL
2266         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2267                 if ((ssid->eapol_flags &
2268                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2269                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2270                     !wep_keys_set) {
2271                         use_crypt = 0;
2272                 } else {
2273                         /* Assume that dynamic WEP-104 keys will be used and
2274                          * set cipher suites in order for drivers to expect
2275                          * encryption. */
2276                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2277                 }
2278         }
2279 #endif /* IEEE8021X_EAPOL */
2280
2281         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2282                 /* Set the key before (and later after) association */
2283                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2284         }
2285
2286         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2287         if (bss) {
2288                 params.ssid = bss->ssid;
2289                 params.ssid_len = bss->ssid_len;
2290                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2291                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2292                                    MACSTR " freq=%u MHz based on scan results "
2293                                    "(bssid_set=%d)",
2294                                    MAC2STR(bss->bssid), bss->freq,
2295                                    ssid->bssid_set);
2296                         params.bssid = bss->bssid;
2297                         params.freq.freq = bss->freq;
2298                 }
2299                 params.bssid_hint = bss->bssid;
2300                 params.freq_hint = bss->freq;
2301         } else {
2302                 params.ssid = ssid->ssid;
2303                 params.ssid_len = ssid->ssid_len;
2304         }
2305
2306         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2307             wpa_s->conf->ap_scan == 2) {
2308                 params.bssid = ssid->bssid;
2309                 params.fixed_bssid = 1;
2310         }
2311
2312         /* Initial frequency for IBSS/mesh */
2313         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2314             ssid->frequency > 0 && params.freq.freq == 0)
2315                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2316
2317         if (ssid->mode == WPAS_MODE_IBSS) {
2318                 params.fixed_freq = ssid->fixed_freq;
2319                 if (ssid->beacon_int)
2320                         params.beacon_int = ssid->beacon_int;
2321                 else
2322                         params.beacon_int = wpa_s->conf->beacon_int;
2323         }
2324
2325         params.wpa_ie = wpa_ie;
2326         params.wpa_ie_len = wpa_ie_len;
2327         params.pairwise_suite = cipher_pairwise;
2328         params.group_suite = cipher_group;
2329         params.key_mgmt_suite = wpa_s->key_mgmt;
2330         params.wpa_proto = wpa_s->wpa_proto;
2331         params.auth_alg = algs;
2332         params.mode = ssid->mode;
2333         params.bg_scan_period = ssid->bg_scan_period;
2334         for (i = 0; i < NUM_WEP_KEYS; i++) {
2335                 if (ssid->wep_key_len[i])
2336                         params.wep_key[i] = ssid->wep_key[i];
2337                 params.wep_key_len[i] = ssid->wep_key_len[i];
2338         }
2339         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2340
2341         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2342             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2343              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2344                 params.passphrase = ssid->passphrase;
2345                 if (ssid->psk_set)
2346                         params.psk = ssid->psk;
2347         }
2348
2349         if (wpa_s->conf->key_mgmt_offload) {
2350                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2351                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2352                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2353                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2354                         params.req_key_mgmt_offload =
2355                                 ssid->proactive_key_caching < 0 ?
2356                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2357                 else
2358                         params.req_key_mgmt_offload = 1;
2359
2360                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2361                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2362                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2363                     ssid->psk_set)
2364                         params.psk = ssid->psk;
2365         }
2366
2367         params.drop_unencrypted = use_crypt;
2368
2369 #ifdef CONFIG_IEEE80211W
2370         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2371         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2372                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2373                 struct wpa_ie_data ie;
2374                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2375                     ie.capabilities &
2376                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2377                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2378                                 "MFP: require MFP");
2379                         params.mgmt_frame_protection =
2380                                 MGMT_FRAME_PROTECTION_REQUIRED;
2381                 }
2382         }
2383 #endif /* CONFIG_IEEE80211W */
2384
2385         params.p2p = ssid->p2p_group;
2386
2387         if (wpa_s->parent->set_sta_uapsd)
2388                 params.uapsd = wpa_s->parent->sta_uapsd;
2389         else
2390                 params.uapsd = -1;
2391
2392 #ifdef CONFIG_HT_OVERRIDES
2393         os_memset(&htcaps, 0, sizeof(htcaps));
2394         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2395         params.htcaps = (u8 *) &htcaps;
2396         params.htcaps_mask = (u8 *) &htcaps_mask;
2397         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2398 #endif /* CONFIG_HT_OVERRIDES */
2399 #ifdef CONFIG_VHT_OVERRIDES
2400         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2401         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2402         params.vhtcaps = &vhtcaps;
2403         params.vhtcaps_mask = &vhtcaps_mask;
2404         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2405 #endif /* CONFIG_VHT_OVERRIDES */
2406
2407 #ifdef CONFIG_P2P
2408         /*
2409          * If multi-channel concurrency is not supported, check for any
2410          * frequency conflict. In case of any frequency conflict, remove the
2411          * least prioritized connection.
2412          */
2413         if (wpa_s->num_multichan_concurrent < 2) {
2414                 int freq, num;
2415                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2416                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2417                         wpa_printf(MSG_DEBUG,
2418                                    "Assoc conflicting freq found (%d != %d)",
2419                                    freq, params.freq.freq);
2420                         if (wpas_p2p_handle_frequency_conflicts(
2421                                     wpa_s, params.freq.freq, ssid) < 0) {
2422                                 wpas_connect_work_done(wpa_s);
2423                                 return;
2424                         }
2425                 }
2426         }
2427 #endif /* CONFIG_P2P */
2428
2429         ret = wpa_drv_associate(wpa_s, &params);
2430         if (ret < 0) {
2431                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2432                         "failed");
2433                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2434                         /*
2435                          * The driver is known to mean what is saying, so we
2436                          * can stop right here; the association will not
2437                          * succeed.
2438                          */
2439                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2440                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2441                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2442                         return;
2443                 }
2444                 /* try to continue anyway; new association will be tried again
2445                  * after timeout */
2446                 assoc_failed = 1;
2447         }
2448
2449         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2450                 /* Set the key after the association just in case association
2451                  * cleared the previously configured key. */
2452                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2453                 /* No need to timeout authentication since there is no key
2454                  * management. */
2455                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2456                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2457 #ifdef CONFIG_IBSS_RSN
2458         } else if (ssid->mode == WPAS_MODE_IBSS &&
2459                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2460                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2461                 /*
2462                  * RSN IBSS authentication is per-STA and we can disable the
2463                  * per-BSSID authentication.
2464                  */
2465                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2466 #endif /* CONFIG_IBSS_RSN */
2467         } else {
2468                 /* Timeout for IEEE 802.11 authentication and association */
2469                 int timeout = 60;
2470
2471                 if (assoc_failed) {
2472                         /* give IBSS a bit more time */
2473                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2474                 } else if (wpa_s->conf->ap_scan == 1) {
2475                         /* give IBSS a bit more time */
2476                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2477                 }
2478                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2479         }
2480
2481         if (wep_keys_set &&
2482             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2483                 /* Set static WEP keys again */
2484                 wpa_set_wep_keys(wpa_s, ssid);
2485         }
2486
2487         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2488                 /*
2489                  * Do not allow EAP session resumption between different
2490                  * network configurations.
2491                  */
2492                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2493         }
2494         old_ssid = wpa_s->current_ssid;
2495         wpa_s->current_ssid = ssid;
2496         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2497                 wpa_s->current_bss = bss;
2498         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2499         wpa_supplicant_initiate_eapol(wpa_s);
2500         if (old_ssid != wpa_s->current_ssid)
2501                 wpas_notify_network_changed(wpa_s);
2502 }
2503
2504
2505 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2506                                             const u8 *addr)
2507 {
2508         struct wpa_ssid *old_ssid;
2509
2510         wpas_connect_work_done(wpa_s);
2511         wpa_clear_keys(wpa_s, addr);
2512         old_ssid = wpa_s->current_ssid;
2513         wpa_supplicant_mark_disassoc(wpa_s);
2514         wpa_sm_set_config(wpa_s->wpa, NULL);
2515         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2516         if (old_ssid != wpa_s->current_ssid)
2517                 wpas_notify_network_changed(wpa_s);
2518         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2519 }
2520
2521
2522 /**
2523  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2524  * @wpa_s: Pointer to wpa_supplicant data
2525  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2526  *
2527  * This function is used to request %wpa_supplicant to deauthenticate from the
2528  * current AP.
2529  */
2530 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2531                                    int reason_code)
2532 {
2533         u8 *addr = NULL;
2534         union wpa_event_data event;
2535         int zero_addr = 0;
2536
2537         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2538                 " pending_bssid=" MACSTR " reason=%d state=%s",
2539                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2540                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2541
2542         if (!is_zero_ether_addr(wpa_s->bssid))
2543                 addr = wpa_s->bssid;
2544         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2545                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2546                   wpa_s->wpa_state == WPA_ASSOCIATING))
2547                 addr = wpa_s->pending_bssid;
2548         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2549                 /*
2550                  * When using driver-based BSS selection, we may not know the
2551                  * BSSID with which we are currently trying to associate. We
2552                  * need to notify the driver of this disconnection even in such
2553                  * a case, so use the all zeros address here.
2554                  */
2555                 addr = wpa_s->bssid;
2556                 zero_addr = 1;
2557         }
2558
2559 #ifdef CONFIG_TDLS
2560         wpa_tdls_teardown_peers(wpa_s->wpa);
2561 #endif /* CONFIG_TDLS */
2562
2563 #ifdef CONFIG_MESH
2564         if (wpa_s->ifmsh) {
2565                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2566                              wpa_s->ifname);
2567                 wpa_supplicant_leave_mesh(wpa_s);
2568         }
2569 #endif /* CONFIG_MESH */
2570
2571         if (addr) {
2572                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2573                 os_memset(&event, 0, sizeof(event));
2574                 event.deauth_info.reason_code = (u16) reason_code;
2575                 event.deauth_info.locally_generated = 1;
2576                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2577                 if (zero_addr)
2578                         addr = NULL;
2579         }
2580
2581         wpa_supplicant_clear_connection(wpa_s, addr);
2582 }
2583
2584 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2585                                               struct wpa_ssid *ssid)
2586 {
2587         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2588                 return;
2589
2590         ssid->disabled = 0;
2591         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2592         wpas_notify_network_enabled_changed(wpa_s, ssid);
2593
2594         /*
2595          * Try to reassociate since there is no current configuration and a new
2596          * network was made available.
2597          */
2598         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2599                 wpa_s->reassociate = 1;
2600 }
2601
2602
2603 /**
2604  * wpa_supplicant_enable_network - Mark a configured network as enabled
2605  * @wpa_s: wpa_supplicant structure for a network interface
2606  * @ssid: wpa_ssid structure for a configured network or %NULL
2607  *
2608  * Enables the specified network or all networks if no network specified.
2609  */
2610 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2611                                    struct wpa_ssid *ssid)
2612 {
2613         if (ssid == NULL) {
2614                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2615                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2616         } else
2617                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2618
2619         if (wpa_s->reassociate && !wpa_s->disconnected &&
2620             (!wpa_s->current_ssid ||
2621              wpa_s->wpa_state == WPA_DISCONNECTED ||
2622              wpa_s->wpa_state == WPA_SCANNING)) {
2623                 if (wpa_s->sched_scanning) {
2624                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2625                                    "new network to scan filters");
2626                         wpa_supplicant_cancel_sched_scan(wpa_s);
2627                 }
2628
2629                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2630                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2631                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2632                 }
2633         }
2634 }
2635
2636
2637 /**
2638  * wpa_supplicant_disable_network - Mark a configured network as disabled
2639  * @wpa_s: wpa_supplicant structure for a network interface
2640  * @ssid: wpa_ssid structure for a configured network or %NULL
2641  *
2642  * Disables the specified network or all networks if no network specified.
2643  */
2644 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2645                                     struct wpa_ssid *ssid)
2646 {
2647         struct wpa_ssid *other_ssid;
2648         int was_disabled;
2649
2650         if (ssid == NULL) {
2651                 if (wpa_s->sched_scanning)
2652                         wpa_supplicant_cancel_sched_scan(wpa_s);
2653
2654                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2655                      other_ssid = other_ssid->next) {
2656                         was_disabled = other_ssid->disabled;
2657                         if (was_disabled == 2)
2658                                 continue; /* do not change persistent P2P group
2659                                            * data */
2660
2661                         other_ssid->disabled = 1;
2662
2663                         if (was_disabled != other_ssid->disabled)
2664                                 wpas_notify_network_enabled_changed(
2665                                         wpa_s, other_ssid);
2666                 }
2667                 if (wpa_s->current_ssid)
2668                         wpa_supplicant_deauthenticate(
2669                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2670         } else if (ssid->disabled != 2) {
2671                 if (ssid == wpa_s->current_ssid)
2672                         wpa_supplicant_deauthenticate(
2673                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2674
2675                 was_disabled = ssid->disabled;
2676
2677                 ssid->disabled = 1;
2678
2679                 if (was_disabled != ssid->disabled) {
2680                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2681                         if (wpa_s->sched_scanning) {
2682                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2683                                            "to remove network from filters");
2684                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2685                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2686                         }
2687                 }
2688         }
2689 }
2690
2691
2692 /**
2693  * wpa_supplicant_select_network - Attempt association with a network
2694  * @wpa_s: wpa_supplicant structure for a network interface
2695  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2696  */
2697 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2698                                    struct wpa_ssid *ssid)
2699 {
2700
2701         struct wpa_ssid *other_ssid;
2702         int disconnected = 0;
2703
2704         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2705                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2706                         wpa_s->own_disconnect_req = 1;
2707                 wpa_supplicant_deauthenticate(
2708                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2709                 disconnected = 1;
2710         }
2711
2712         if (ssid)
2713                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2714
2715         /*
2716          * Mark all other networks disabled or mark all networks enabled if no
2717          * network specified.
2718          */
2719         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2720              other_ssid = other_ssid->next) {
2721                 int was_disabled = other_ssid->disabled;
2722                 if (was_disabled == 2)
2723                         continue; /* do not change persistent P2P group data */
2724
2725                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2726                 if (was_disabled && !other_ssid->disabled)
2727                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2728
2729                 if (was_disabled != other_ssid->disabled)
2730                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2731         }
2732
2733         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2734             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2735                 /* We are already associated with the selected network */
2736                 wpa_printf(MSG_DEBUG, "Already associated with the "
2737                            "selected network - do nothing");
2738                 return;
2739         }
2740
2741         if (ssid) {
2742                 wpa_s->current_ssid = ssid;
2743                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2744                 wpa_s->connect_without_scan =
2745                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2746
2747                 /*
2748                  * Don't optimize next scan freqs since a new ESS has been
2749                  * selected.
2750                  */
2751                 os_free(wpa_s->next_scan_freqs);
2752                 wpa_s->next_scan_freqs = NULL;
2753         } else {
2754                 wpa_s->connect_without_scan = NULL;
2755         }
2756
2757         wpa_s->disconnected = 0;
2758         wpa_s->reassociate = 1;
2759
2760         if (wpa_s->connect_without_scan ||
2761             wpa_supplicant_fast_associate(wpa_s) != 1) {
2762                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2763                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2764         }
2765
2766         if (ssid)
2767                 wpas_notify_network_selected(wpa_s, ssid);
2768 }
2769
2770
2771 /**
2772  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2773  * @wpa_s: wpa_supplicant structure for a network interface
2774  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2775  * @pkcs11_module_path: PKCS #11 module path or NULL
2776  * Returns: 0 on success; -1 on failure
2777  *
2778  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2779  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2780  * module path fails the paths will be reset to the default value (NULL).
2781  */
2782 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2783                                            const char *pkcs11_engine_path,
2784                                            const char *pkcs11_module_path)
2785 {
2786         char *pkcs11_engine_path_copy = NULL;
2787         char *pkcs11_module_path_copy = NULL;
2788
2789         if (pkcs11_engine_path != NULL) {
2790                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2791                 if (pkcs11_engine_path_copy == NULL)
2792                         return -1;
2793         }
2794         if (pkcs11_module_path != NULL) {
2795                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2796                 if (pkcs11_module_path_copy == NULL) {
2797                         os_free(pkcs11_engine_path_copy);
2798                         return -1;
2799                 }
2800         }
2801
2802         os_free(wpa_s->conf->pkcs11_engine_path);
2803         os_free(wpa_s->conf->pkcs11_module_path);
2804         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2805         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2806
2807         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2808         eapol_sm_deinit(wpa_s->eapol);
2809         wpa_s->eapol = NULL;
2810         if (wpa_supplicant_init_eapol(wpa_s)) {
2811                 /* Error -> Reset paths to the default value (NULL) once. */
2812                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2813                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2814                                                                NULL);
2815
2816                 return -1;
2817         }
2818         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2819
2820         return 0;
2821 }
2822
2823
2824 /**
2825  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2826  * @wpa_s: wpa_supplicant structure for a network interface
2827  * @ap_scan: AP scan mode
2828  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2829  *
2830  */
2831 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2832 {
2833
2834         int old_ap_scan;
2835
2836         if (ap_scan < 0 || ap_scan > 2)
2837                 return -1;
2838
2839         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2840                 wpa_printf(MSG_INFO,
2841                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2842         }
2843
2844 #ifdef ANDROID
2845         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2846             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2847             wpa_s->wpa_state < WPA_COMPLETED) {
2848                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2849                            "associating", wpa_s->conf->ap_scan, ap_scan);
2850                 return 0;
2851         }
2852 #endif /* ANDROID */
2853
2854         old_ap_scan = wpa_s->conf->ap_scan;
2855         wpa_s->conf->ap_scan = ap_scan;
2856
2857         if (old_ap_scan != wpa_s->conf->ap_scan)
2858                 wpas_notify_ap_scan_changed(wpa_s);
2859
2860         return 0;
2861 }
2862
2863
2864 /**
2865  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2866  * @wpa_s: wpa_supplicant structure for a network interface
2867  * @expire_age: Expiration age in seconds
2868  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2869  *
2870  */
2871 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2872                                           unsigned int bss_expire_age)
2873 {
2874         if (bss_expire_age < 10) {
2875                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2876                         bss_expire_age);
2877                 return -1;
2878         }
2879         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2880                 bss_expire_age);
2881         wpa_s->conf->bss_expiration_age = bss_expire_age;
2882
2883         return 0;
2884 }
2885
2886
2887 /**
2888  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2889  * @wpa_s: wpa_supplicant structure for a network interface
2890  * @expire_count: number of scans after which an unseen BSS is reclaimed
2891  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2892  *
2893  */
2894 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2895                                             unsigned int bss_expire_count)
2896 {
2897         if (bss_expire_count < 1) {
2898                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2899                         bss_expire_count);
2900                 return -1;
2901         }
2902         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2903                 bss_expire_count);
2904         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2905
2906         return 0;
2907 }
2908
2909
2910 /**
2911  * wpa_supplicant_set_scan_interval - Set scan interval
2912  * @wpa_s: wpa_supplicant structure for a network interface
2913  * @scan_interval: scan interval in seconds
2914  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2915  *
2916  */
2917 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2918                                      int scan_interval)
2919 {
2920         if (scan_interval < 0) {
2921                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2922                         scan_interval);
2923                 return -1;
2924         }
2925         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2926                 scan_interval);
2927         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2928
2929         return 0;
2930 }
2931
2932
2933 /**
2934  * wpa_supplicant_set_debug_params - Set global debug params
2935  * @global: wpa_global structure
2936  * @debug_level: debug level
2937  * @debug_timestamp: determines if show timestamp in debug data
2938  * @debug_show_keys: determines if show keys in debug data
2939  * Returns: 0 if succeed or -1 if debug_level has wrong value
2940  */
2941 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2942                                     int debug_timestamp, int debug_show_keys)
2943 {
2944
2945         int old_level, old_timestamp, old_show_keys;
2946
2947         /* check for allowed debuglevels */
2948         if (debug_level != MSG_EXCESSIVE &&
2949             debug_level != MSG_MSGDUMP &&
2950             debug_level != MSG_DEBUG &&
2951             debug_level != MSG_INFO &&
2952             debug_level != MSG_WARNING &&
2953             debug_level != MSG_ERROR)
2954                 return -1;
2955
2956         old_level = wpa_debug_level;
2957         old_timestamp = wpa_debug_timestamp;
2958         old_show_keys = wpa_debug_show_keys;
2959
2960         wpa_debug_level = debug_level;
2961         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2962         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2963
2964         if (wpa_debug_level != old_level)
2965                 wpas_notify_debug_level_changed(global);
2966         if (wpa_debug_timestamp != old_timestamp)
2967                 wpas_notify_debug_timestamp_changed(global);
2968         if (wpa_debug_show_keys != old_show_keys)
2969                 wpas_notify_debug_show_keys_changed(global);
2970
2971         return 0;
2972 }
2973
2974
2975 /**
2976  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2977  * @wpa_s: Pointer to wpa_supplicant data
2978  * Returns: A pointer to the current network structure or %NULL on failure
2979  */
2980 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2981 {
2982         struct wpa_ssid *entry;
2983         u8 ssid[SSID_MAX_LEN];
2984         int res;
2985         size_t ssid_len;
2986         u8 bssid[ETH_ALEN];
2987         int wired;
2988
2989         res = wpa_drv_get_ssid(wpa_s, ssid);
2990         if (res < 0) {
2991                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2992                         "driver");
2993                 return NULL;
2994         }
2995         ssid_len = res;
2996
2997         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2998                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2999                         "driver");
3000                 return NULL;
3001         }
3002
3003         wired = wpa_s->conf->ap_scan == 0 &&
3004                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3005
3006         entry = wpa_s->conf->ssid;
3007         while (entry) {
3008                 if (!wpas_network_disabled(wpa_s, entry) &&
3009                     ((ssid_len == entry->ssid_len &&
3010                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3011                     (!entry->bssid_set ||
3012                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3013                         return entry;
3014 #ifdef CONFIG_WPS
3015                 if (!wpas_network_disabled(wpa_s, entry) &&
3016                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3017                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3018                     (!entry->bssid_set ||
3019                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3020                         return entry;
3021 #endif /* CONFIG_WPS */
3022
3023                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3024                     entry->ssid_len == 0 &&
3025                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3026                         return entry;
3027
3028                 entry = entry->next;
3029         }
3030
3031         return NULL;
3032 }
3033
3034
3035 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3036 {
3037         struct wpa_global *global = wpa_s->global;
3038
3039         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3040                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3041                 if (global->drv_priv[i] == NULL) {
3042                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3043                                    "'%s'", wpa_drivers[i]->name);
3044                         return -1;
3045                 }
3046         }
3047
3048         wpa_s->driver = wpa_drivers[i];
3049         wpa_s->global_drv_priv = global->drv_priv[i];
3050
3051         return 0;
3052 }
3053
3054
3055 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3056                                      const char *name)
3057 {
3058         int i;
3059         size_t len;
3060         const char *pos, *driver = name;
3061
3062         if (wpa_s == NULL)
3063                 return -1;
3064
3065         if (wpa_drivers[0] == NULL) {
3066                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3067                         "wpa_supplicant");
3068                 return -1;
3069         }
3070
3071         if (name == NULL) {
3072                 /* default to first driver in the list */
3073                 return select_driver(wpa_s, 0);
3074         }
3075
3076         do {
3077                 pos = os_strchr(driver, ',');
3078                 if (pos)
3079                         len = pos - driver;
3080                 else
3081                         len = os_strlen(driver);
3082
3083                 for (i = 0; wpa_drivers[i]; i++) {
3084                         if (os_strlen(wpa_drivers[i]->name) == len &&
3085                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3086                             0) {
3087                                 /* First driver that succeeds wins */
3088                                 if (select_driver(wpa_s, i) == 0)
3089                                         return 0;
3090                         }
3091                 }
3092
3093                 driver = pos + 1;
3094         } while (pos);
3095
3096         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3097         return -1;
3098 }
3099
3100
3101 /**
3102  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3103  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3104  *      with struct wpa_driver_ops::init()
3105  * @src_addr: Source address of the EAPOL frame
3106  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3107  * @len: Length of the EAPOL data
3108  *
3109  * This function is called for each received EAPOL frame. Most driver
3110  * interfaces rely on more generic OS mechanism for receiving frames through
3111  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3112  * take care of received EAPOL frames and deliver them to the core supplicant
3113  * code by calling this function.
3114  */
3115 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3116                              const u8 *buf, size_t len)
3117 {
3118         struct wpa_supplicant *wpa_s = ctx;
3119
3120         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3121         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3122
3123 #ifdef CONFIG_PEERKEY
3124         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3125             wpa_s->current_ssid->peerkey &&
3126             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3127             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3128                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3129                 return;
3130         }
3131 #endif /* CONFIG_PEERKEY */
3132
3133         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3134             (wpa_s->last_eapol_matches_bssid &&
3135 #ifdef CONFIG_AP
3136              !wpa_s->ap_iface &&
3137 #endif /* CONFIG_AP */
3138              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3139                 /*
3140                  * There is possible race condition between receiving the
3141                  * association event and the EAPOL frame since they are coming
3142                  * through different paths from the driver. In order to avoid
3143                  * issues in trying to process the EAPOL frame before receiving
3144                  * association information, lets queue it for processing until
3145                  * the association event is received. This may also be needed in
3146                  * driver-based roaming case, so also use src_addr != BSSID as a
3147                  * trigger if we have previously confirmed that the
3148                  * Authenticator uses BSSID as the src_addr (which is not the
3149                  * case with wired IEEE 802.1X).
3150                  */
3151                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3152                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3153                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3154                         MAC2STR(wpa_s->bssid));
3155                 wpabuf_free(wpa_s->pending_eapol_rx);
3156                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3157                 if (wpa_s->pending_eapol_rx) {
3158                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3159                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3160                                   ETH_ALEN);
3161                 }
3162                 return;
3163         }
3164
3165         wpa_s->last_eapol_matches_bssid =
3166                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3167
3168 #ifdef CONFIG_AP
3169         if (wpa_s->ap_iface) {
3170                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3171                 return;
3172         }
3173 #endif /* CONFIG_AP */
3174
3175         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3176                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3177                         "no key management is configured");
3178                 return;
3179         }
3180
3181         if (wpa_s->eapol_received == 0 &&
3182             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3183              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3184              wpa_s->wpa_state != WPA_COMPLETED) &&
3185             (wpa_s->current_ssid == NULL ||
3186              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3187                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3188                 int timeout = 10;
3189
3190                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3191                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3192                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3193                         /* Use longer timeout for IEEE 802.1X/EAP */
3194                         timeout = 70;
3195                 }
3196
3197 #ifdef CONFIG_WPS
3198                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3199                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3200                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3201                         /*
3202                          * Use shorter timeout if going through WPS AP iteration
3203                          * for PIN config method with an AP that does not
3204                          * advertise Selected Registrar.
3205                          */
3206                         struct wpabuf *wps_ie;
3207
3208                         wps_ie = wpa_bss_get_vendor_ie_multi(
3209                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3210                         if (wps_ie &&
3211                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3212                                 timeout = 10;
3213                         wpabuf_free(wps_ie);
3214                 }
3215 #endif /* CONFIG_WPS */
3216
3217                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3218         }
3219         wpa_s->eapol_received++;
3220
3221         if (wpa_s->countermeasures) {
3222                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3223                         "EAPOL packet");
3224                 return;
3225         }
3226
3227 #ifdef CONFIG_IBSS_RSN
3228         if (wpa_s->current_ssid &&
3229             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3230                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3231                 return;
3232         }
3233 #endif /* CONFIG_IBSS_RSN */
3234
3235         /* Source address of the incoming EAPOL frame could be compared to the
3236          * current BSSID. However, it is possible that a centralized
3237          * Authenticator could be using another MAC address than the BSSID of
3238          * an AP, so just allow any address to be used for now. The replies are
3239          * still sent to the current BSSID (if available), though. */
3240
3241         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3242         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3243             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3244                 return;
3245         wpa_drv_poll(wpa_s);
3246         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3247                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3248         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3249                 /*
3250                  * Set portValid = TRUE here since we are going to skip 4-way
3251                  * handshake processing which would normally set portValid. We
3252                  * need this to allow the EAPOL state machines to be completed
3253                  * without going through EAPOL-Key handshake.
3254                  */
3255                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3256         }
3257 }
3258
3259
3260 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3261 {
3262         if ((!wpa_s->p2p_mgmt ||
3263              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3264             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3265                 l2_packet_deinit(wpa_s->l2);
3266                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3267                                            wpa_drv_get_mac_addr(wpa_s),
3268                                            ETH_P_EAPOL,
3269                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3270                 if (wpa_s->l2 == NULL)
3271                         return -1;
3272         } else {
3273                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3274                 if (addr)
3275                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3276         }
3277
3278         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3279                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3280                 return -1;
3281         }
3282
3283         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3284
3285         return 0;
3286 }
3287
3288
3289 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3290                                            const u8 *buf, size_t len)
3291 {
3292         struct wpa_supplicant *wpa_s = ctx;
3293         const struct l2_ethhdr *eth;
3294
3295         if (len < sizeof(*eth))
3296                 return;
3297         eth = (const struct l2_ethhdr *) buf;
3298
3299         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3300             !(eth->h_dest[0] & 0x01)) {
3301                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3302                         " (bridge - not for this interface - ignore)",
3303                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3304                 return;
3305         }
3306
3307         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3308                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3309         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3310                                 len - sizeof(*eth));
3311 }
3312
3313
3314 /**
3315  * wpa_supplicant_driver_init - Initialize driver interface parameters
3316  * @wpa_s: Pointer to wpa_supplicant data
3317  * Returns: 0 on success, -1 on failure
3318  *
3319  * This function is called to initialize driver interface parameters.
3320  * wpa_drv_init() must have been called before this function to initialize the
3321  * driver interface.
3322  */
3323 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3324 {
3325         static int interface_count = 0;
3326
3327         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3328                 return -1;
3329
3330         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3331                 MAC2STR(wpa_s->own_addr));
3332         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3333         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3334
3335         if (wpa_s->bridge_ifname[0]) {
3336                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3337                         "interface '%s'", wpa_s->bridge_ifname);
3338                 wpa_s->l2_br = l2_packet_init_bridge(
3339                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3340                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3341                 if (wpa_s->l2_br == NULL) {
3342                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3343                                 "connection for the bridge interface '%s'",
3344                                 wpa_s->bridge_ifname);
3345                         return -1;
3346                 }
3347         }
3348
3349         if (wpa_s->conf->ap_scan == 2 &&
3350             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3351                 wpa_printf(MSG_INFO,
3352                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3353         }
3354
3355         wpa_clear_keys(wpa_s, NULL);
3356
3357         /* Make sure that TKIP countermeasures are not left enabled (could
3358          * happen if wpa_supplicant is killed during countermeasures. */
3359         wpa_drv_set_countermeasures(wpa_s, 0);
3360
3361         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3362         wpa_drv_flush_pmkid(wpa_s);
3363
3364         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3365         wpa_s->prev_scan_wildcard = 0;
3366
3367         if (wpa_supplicant_enabled_networks(wpa_s)) {
3368                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3369                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3370                         interface_count = 0;
3371                 }
3372 #ifndef ANDROID
3373                 if (!wpa_s->p2p_mgmt &&
3374                     wpa_supplicant_delayed_sched_scan(wpa_s,
3375                                                       interface_count % 3,
3376                                                       100000))
3377                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3378                                                 100000);
3379 #endif /* ANDROID */
3380                 interface_count++;
3381         } else
3382                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3383
3384         return 0;
3385 }
3386
3387
3388 static int wpa_supplicant_daemon(const char *pid_file)
3389 {
3390         wpa_printf(MSG_DEBUG, "Daemonize..");
3391         return os_daemonize(pid_file);
3392 }
3393
3394
3395 static struct wpa_supplicant *
3396 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3397 {
3398         struct wpa_supplicant *wpa_s;
3399
3400         wpa_s = os_zalloc(sizeof(*wpa_s));
3401         if (wpa_s == NULL)
3402                 return NULL;
3403         wpa_s->scan_req = INITIAL_SCAN_REQ;
3404         wpa_s->scan_interval = 5;
3405         wpa_s->new_connection = 1;
3406         wpa_s->parent = parent ? parent : wpa_s;
3407         wpa_s->sched_scanning = 0;
3408
3409         return wpa_s;
3410 }
3411
3412
3413 #ifdef CONFIG_HT_OVERRIDES
3414
3415 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3416                              struct ieee80211_ht_capabilities *htcaps,
3417                              struct ieee80211_ht_capabilities *htcaps_mask,
3418                              const char *ht_mcs)
3419 {
3420         /* parse ht_mcs into hex array */
3421         int i;
3422         const char *tmp = ht_mcs;
3423         char *end = NULL;
3424
3425         /* If ht_mcs is null, do not set anything */
3426         if (!ht_mcs)
3427                 return 0;
3428
3429         /* This is what we are setting in the kernel */
3430         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3431
3432         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3433
3434         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3435                 errno = 0;
3436                 long v = strtol(tmp, &end, 16);
3437                 if (errno == 0) {
3438                         wpa_msg(wpa_s, MSG_DEBUG,
3439                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3440                                 i, v, end, tmp);
3441                         if (end == tmp)
3442                                 break;
3443
3444                         htcaps->supported_mcs_set[i] = v;
3445                         tmp = end;
3446                 } else {
3447                         wpa_msg(wpa_s, MSG_ERROR,
3448                                 "Failed to parse ht-mcs: %s, error: %s\n",
3449                                 ht_mcs, strerror(errno));
3450                         return -1;
3451                 }
3452         }
3453
3454         /*
3455          * If we were able to parse any values, then set mask for the MCS set.
3456          */
3457         if (i) {
3458                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3459                           IEEE80211_HT_MCS_MASK_LEN - 1);
3460                 /* skip the 3 reserved bits */
3461                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3462                         0x1f;
3463         }
3464
3465         return 0;
3466 }
3467
3468
3469 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3470                                  struct ieee80211_ht_capabilities *htcaps,
3471                                  struct ieee80211_ht_capabilities *htcaps_mask,
3472                                  int disabled)
3473 {
3474         le16 msk;
3475
3476         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3477
3478         if (disabled == -1)
3479                 return 0;
3480
3481         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3482         htcaps_mask->ht_capabilities_info |= msk;
3483         if (disabled)
3484                 htcaps->ht_capabilities_info &= msk;
3485         else
3486                 htcaps->ht_capabilities_info |= msk;
3487
3488         return 0;
3489 }
3490
3491
3492 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3493                                 struct ieee80211_ht_capabilities *htcaps,
3494                                 struct ieee80211_ht_capabilities *htcaps_mask,
3495                                 int factor)
3496 {
3497         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3498
3499         if (factor == -1)
3500                 return 0;
3501
3502         if (factor < 0 || factor > 3) {
3503                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3504                         "Must be 0-3 or -1", factor);
3505                 return -EINVAL;
3506         }
3507
3508         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3509         htcaps->a_mpdu_params &= ~0x3;
3510         htcaps->a_mpdu_params |= factor & 0x3;
3511
3512         return 0;
3513 }
3514
3515
3516 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3517                                  struct ieee80211_ht_capabilities *htcaps,
3518                                  struct ieee80211_ht_capabilities *htcaps_mask,
3519                                  int density)
3520 {
3521         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3522
3523         if (density == -1)
3524                 return 0;
3525
3526         if (density < 0 || density > 7) {
3527                 wpa_msg(wpa_s, MSG_ERROR,
3528                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3529                         density);
3530                 return -EINVAL;
3531         }
3532
3533         htcaps_mask->a_mpdu_params |= 0x1C;
3534         htcaps->a_mpdu_params &= ~(0x1C);
3535         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3536
3537         return 0;
3538 }
3539
3540
3541 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3542                                 struct ieee80211_ht_capabilities *htcaps,
3543                                 struct ieee80211_ht_capabilities *htcaps_mask,
3544                                 int disabled)
3545 {
3546         /* Masking these out disables HT40 */
3547         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3548                                 HT_CAP_INFO_SHORT_GI40MHZ);
3549
3550         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3551
3552         if (disabled)
3553                 htcaps->ht_capabilities_info &= ~msk;
3554         else
3555                 htcaps->ht_capabilities_info |= msk;
3556
3557         htcaps_mask->ht_capabilities_info |= msk;
3558
3559         return 0;
3560 }
3561
3562
3563 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3564                                struct ieee80211_ht_capabilities *htcaps,
3565                                struct ieee80211_ht_capabilities *htcaps_mask,
3566                                int disabled)
3567 {
3568         /* Masking these out disables SGI */
3569         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3570                                 HT_CAP_INFO_SHORT_GI40MHZ);
3571
3572         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3573
3574         if (disabled)
3575                 htcaps->ht_capabilities_info &= ~msk;
3576         else
3577                 htcaps->ht_capabilities_info |= msk;
3578
3579         htcaps_mask->ht_capabilities_info |= msk;
3580
3581         return 0;
3582 }
3583
3584
3585 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3586                                struct ieee80211_ht_capabilities *htcaps,
3587                                struct ieee80211_ht_capabilities *htcaps_mask,
3588                                int disabled)
3589 {
3590         /* Masking these out disables LDPC */
3591         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3592
3593         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3594
3595         if (disabled)
3596                 htcaps->ht_capabilities_info &= ~msk;
3597         else
3598                 htcaps->ht_capabilities_info |= msk;
3599
3600         htcaps_mask->ht_capabilities_info |= msk;
3601
3602         return 0;
3603 }
3604
3605
3606 void wpa_supplicant_apply_ht_overrides(
3607         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3608         struct wpa_driver_associate_params *params)
3609 {
3610         struct ieee80211_ht_capabilities *htcaps;
3611         struct ieee80211_ht_capabilities *htcaps_mask;
3612
3613         if (!ssid)
3614                 return;
3615
3616         params->disable_ht = ssid->disable_ht;
3617         if (!params->htcaps || !params->htcaps_mask)
3618                 return;
3619
3620         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3621         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3622         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3623         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3624                               ssid->disable_max_amsdu);
3625         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3626         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3627         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3628         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3629         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3630
3631         if (ssid->ht40_intolerant) {
3632                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3633                 htcaps->ht_capabilities_info |= bit;
3634                 htcaps_mask->ht_capabilities_info |= bit;
3635         }
3636 }
3637
3638 #endif /* CONFIG_HT_OVERRIDES */
3639
3640
3641 #ifdef CONFIG_VHT_OVERRIDES
3642 void wpa_supplicant_apply_vht_overrides(
3643         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3644         struct wpa_driver_associate_params *params)
3645 {
3646         struct ieee80211_vht_capabilities *vhtcaps;
3647         struct ieee80211_vht_capabilities *vhtcaps_mask;
3648
3649         if (!ssid)
3650                 return;
3651
3652         params->disable_vht = ssid->disable_vht;
3653
3654         vhtcaps = (void *) params->vhtcaps;
3655         vhtcaps_mask = (void *) params->vhtcaps_mask;
3656
3657         if (!vhtcaps || !vhtcaps_mask)
3658                 return;
3659
3660         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3661         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3662
3663 #ifdef CONFIG_HT_OVERRIDES
3664         /* if max ampdu is <= 3, we have to make the HT cap the same */
3665         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3666                 int max_ampdu;
3667
3668                 max_ampdu = (ssid->vht_capa &
3669                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3670                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3671
3672                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3673                 wpa_set_ampdu_factor(wpa_s,
3674                                      (void *) params->htcaps,
3675                                      (void *) params->htcaps_mask,
3676                                      max_ampdu);
3677         }
3678 #endif /* CONFIG_HT_OVERRIDES */
3679
3680 #define OVERRIDE_MCS(i)                                                 \
3681         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3682                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3683                         3 << 2 * (i - 1);                               \
3684                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3685                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3686         }                                                               \
3687         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3688                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3689                         3 << 2 * (i - 1);                               \
3690                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3691                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3692         }
3693
3694         OVERRIDE_MCS(1);
3695         OVERRIDE_MCS(2);
3696         OVERRIDE_MCS(3);
3697         OVERRIDE_MCS(4);
3698         OVERRIDE_MCS(5);
3699         OVERRIDE_MCS(6);
3700         OVERRIDE_MCS(7);
3701         OVERRIDE_MCS(8);
3702 }
3703 #endif /* CONFIG_VHT_OVERRIDES */
3704
3705
3706 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3707 {
3708 #ifdef PCSC_FUNCS
3709         size_t len;
3710
3711         if (!wpa_s->conf->pcsc_reader)
3712                 return 0;
3713
3714         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3715         if (!wpa_s->scard)
3716                 return 1;
3717
3718         if (wpa_s->conf->pcsc_pin &&
3719             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3720                 scard_deinit(wpa_s->scard);
3721                 wpa_s->scard = NULL;
3722                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3723                 return -1;
3724         }
3725
3726         len = sizeof(wpa_s->imsi) - 1;
3727         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3728                 scard_deinit(wpa_s->scard);
3729                 wpa_s->scard = NULL;
3730                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3731                 return -1;
3732         }
3733         wpa_s->imsi[len] = '\0';
3734
3735         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3736
3737         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3738                    wpa_s->imsi, wpa_s->mnc_len);
3739
3740         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3741         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3742 #endif /* PCSC_FUNCS */
3743
3744         return 0;
3745 }
3746
3747
3748 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3749 {
3750         char *val, *pos;
3751
3752         ext_password_deinit(wpa_s->ext_pw);
3753         wpa_s->ext_pw = NULL;
3754         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3755
3756         if (!wpa_s->conf->ext_password_backend)
3757                 return 0;
3758
3759         val = os_strdup(wpa_s->conf->ext_password_backend);
3760         if (val == NULL)
3761                 return -1;
3762         pos = os_strchr(val, ':');
3763         if (pos)
3764                 *pos++ = '\0';
3765
3766         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3767
3768         wpa_s->ext_pw = ext_password_init(val, pos);
3769         os_free(val);
3770         if (wpa_s->ext_pw == NULL) {
3771                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3772                 return -1;
3773         }
3774         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3775
3776         return 0;
3777 }
3778
3779
3780 #ifdef CONFIG_FST
3781
3782 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3783 {
3784         struct wpa_supplicant *wpa_s = ctx;
3785
3786         return (is_zero_ether_addr(wpa_s->bssid) ||
3787                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3788 }
3789
3790
3791 static void wpas_fst_get_channel_info_cb(void *ctx,
3792                                          enum hostapd_hw_mode *hw_mode,
3793                                          u8 *channel)
3794 {
3795         struct wpa_supplicant *wpa_s = ctx;
3796
3797         if (wpa_s->current_bss) {
3798                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3799                                                   channel);
3800         } else if (wpa_s->hw.num_modes) {
3801                 *hw_mode = wpa_s->hw.modes[0].mode;
3802         } else {
3803                 WPA_ASSERT(0);
3804                 *hw_mode = 0;
3805         }
3806 }
3807
3808
3809 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3810 {
3811         struct wpa_supplicant *wpa_s = ctx;
3812
3813         *modes = wpa_s->hw.modes;
3814         return wpa_s->hw.num_modes;
3815 }
3816
3817
3818 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3819 {
3820         struct wpa_supplicant *wpa_s = ctx;
3821
3822         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3823         wpa_s->fst_ies = fst_ies;
3824 }
3825
3826
3827 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3828 {
3829         struct wpa_supplicant *wpa_s = ctx;
3830
3831         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3832         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3833                                           wpa_s->own_addr, wpa_s->bssid,
3834                                           wpabuf_head(data), wpabuf_len(data),
3835                                    0);
3836 }
3837
3838
3839 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3840 {
3841         struct wpa_supplicant *wpa_s = ctx;
3842
3843         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3844         return wpa_s->received_mb_ies;
3845 }
3846
3847
3848 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3849                                      const u8 *buf, size_t size)
3850 {
3851         struct wpa_supplicant *wpa_s = ctx;
3852         struct mb_ies_info info;
3853
3854         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3855
3856         if (!mb_ies_info_by_ies(&info, buf, size)) {
3857                 wpabuf_free(wpa_s->received_mb_ies);
3858                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3859         }
3860 }
3861
3862
3863 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3864                                    Boolean mb_only)
3865 {
3866         struct wpa_supplicant *wpa_s = ctx;
3867
3868         *get_ctx = NULL;
3869         if (!is_zero_ether_addr(wpa_s->bssid))
3870                 return (wpa_s->received_mb_ies || !mb_only) ?
3871                         wpa_s->bssid : NULL;
3872         return NULL;
3873 }
3874
3875
3876 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3877                                   Boolean mb_only)
3878 {
3879         return NULL;
3880 }
3881
3882 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3883                                        struct fst_wpa_obj *iface_obj)
3884 {
3885         iface_obj->ctx              = wpa_s;
3886         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3887         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3888         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3889         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3890         iface_obj->send_action      = wpas_fst_send_action_cb;
3891         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3892         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3893         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3894         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3895 }
3896 #endif /* CONFIG_FST */
3897
3898 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3899                                     const struct wpa_driver_capa *capa)
3900 {
3901         struct wowlan_triggers *triggers;
3902         int ret = 0;
3903
3904         if (!wpa_s->conf->wowlan_triggers)
3905                 return 0;
3906
3907         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3908         if (triggers) {
3909                 ret = wpa_drv_wowlan(wpa_s, triggers);
3910                 os_free(triggers);
3911         }
3912         return ret;
3913 }
3914
3915
3916 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3917 {
3918         if (freq < 3000)
3919                 return BAND_2_4_GHZ;
3920         if (freq > 50000)
3921                 return BAND_60_GHZ;
3922         return BAND_5_GHZ;
3923 }
3924
3925
3926 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3927                                    const int *freqs)
3928 {
3929         int i;
3930         unsigned int band = 0;
3931
3932         if (freqs) {
3933                 /* freqs are specified for the radio work */
3934                 for (i = 0; freqs[i]; i++)
3935                         band |= wpas_freq_to_band(freqs[i]);
3936         } else {
3937                 /*
3938                  * freqs are not specified, implies all
3939                  * the supported freqs by HW
3940                  */
3941                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3942                         if (wpa_s->hw.modes[i].num_channels != 0) {
3943                                 if (wpa_s->hw.modes[i].mode ==
3944                                     HOSTAPD_MODE_IEEE80211B ||
3945                                     wpa_s->hw.modes[i].mode ==
3946                                     HOSTAPD_MODE_IEEE80211G)
3947                                         band |= BAND_2_4_GHZ;
3948                                 else if (wpa_s->hw.modes[i].mode ==
3949                                          HOSTAPD_MODE_IEEE80211A)
3950                                         band |= BAND_5_GHZ;
3951                                 else if (wpa_s->hw.modes[i].mode ==
3952                                          HOSTAPD_MODE_IEEE80211AD)
3953                                         band |= BAND_60_GHZ;
3954                                 else if (wpa_s->hw.modes[i].mode ==
3955                                          HOSTAPD_MODE_IEEE80211ANY)
3956                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
3957                                                 BAND_60_GHZ;
3958                         }
3959                 }
3960         }
3961
3962         return band;
3963 }
3964
3965
3966 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3967                                               const char *rn)
3968 {
3969         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3970         struct wpa_radio *radio;
3971
3972         while (rn && iface) {
3973                 radio = iface->radio;
3974                 if (radio && os_strcmp(rn, radio->name) == 0) {
3975                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3976                                    wpa_s->ifname, rn);
3977                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3978                         return radio;
3979                 }
3980
3981                 iface = iface->next;
3982         }
3983
3984         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3985                    wpa_s->ifname, rn ? rn : "N/A");
3986         radio = os_zalloc(sizeof(*radio));
3987         if (radio == NULL)
3988                 return NULL;
3989
3990         if (rn)
3991                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3992         dl_list_init(&radio->ifaces);
3993         dl_list_init(&radio->work);
3994         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3995
3996         return radio;
3997 }
3998
3999
4000 static void radio_work_free(struct wpa_radio_work *work)
4001 {
4002         if (work->wpa_s->scan_work == work) {
4003                 /* This should not really happen. */
4004                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4005                         work->type, work, work->started);
4006                 work->wpa_s->scan_work = NULL;
4007         }
4008
4009 #ifdef CONFIG_P2P
4010         if (work->wpa_s->p2p_scan_work == work) {
4011                 /* This should not really happen. */
4012                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4013                         work->type, work, work->started);
4014                 work->wpa_s->p2p_scan_work = NULL;
4015         }
4016 #endif /* CONFIG_P2P */
4017
4018         if (work->started) {
4019                 work->wpa_s->radio->num_active_works--;
4020                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4021                         "radio_work_free('%s'@%p: num_active_works --> %u",
4022                         work->type, work,
4023                         work->wpa_s->radio->num_active_works);
4024         }
4025
4026         dl_list_del(&work->list);
4027         os_free(work);
4028 }
4029
4030
4031 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4032 {
4033         struct wpa_radio_work *active_work = NULL;
4034         struct wpa_radio_work *tmp;
4035
4036         /* Get the active work to know the type and band. */
4037         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4038                 if (tmp->started) {
4039                         active_work = tmp;
4040                         break;
4041                 }
4042         }
4043
4044         if (!active_work) {
4045                 /* No active work, start one */
4046                 radio->num_active_works = 0;
4047                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4048                                  list) {
4049                         if (os_strcmp(tmp->type, "scan") == 0 &&
4050                             radio->external_scan_running &&
4051                             (((struct wpa_driver_scan_params *)
4052                               tmp->ctx)->only_new_results ||
4053                              tmp->wpa_s->clear_driver_scan_cache))
4054                                 continue;
4055                         return tmp;
4056                 }
4057                 return NULL;
4058         }
4059
4060         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4061             os_strcmp(active_work->type, "connect") == 0) {
4062                 /*
4063                  * If the active work is either connect or sme-connect,
4064                  * do not parallelize them with other radio works.
4065                  */
4066                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4067                         "Do not parallelize radio work with %s",
4068                         active_work->type);
4069                 return NULL;
4070         }
4071
4072         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4073                 if (tmp->started)
4074                         continue;
4075
4076                 /*
4077                  * If connect or sme-connect are enqueued, parallelize only
4078                  * those operations ahead of them in the queue.
4079                  */
4080                 if (os_strcmp(tmp->type, "connect") == 0 ||
4081                     os_strcmp(tmp->type, "sme-connect") == 0)
4082                         break;
4083
4084                 /*
4085                  * Check that the radio works are distinct and
4086                  * on different bands.
4087                  */
4088                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4089                     (active_work->bands != tmp->bands)) {
4090                         /*
4091                          * If a scan has to be scheduled through nl80211 scan
4092                          * interface and if an external scan is already running,
4093                          * do not schedule the scan since it is likely to get
4094                          * rejected by kernel.
4095                          */
4096                         if (os_strcmp(tmp->type, "scan") == 0 &&
4097                             radio->external_scan_running &&
4098                             (((struct wpa_driver_scan_params *)
4099                               tmp->ctx)->only_new_results ||
4100                              tmp->wpa_s->clear_driver_scan_cache))
4101                                 continue;
4102
4103                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4104                                 "active_work:%s new_work:%s",
4105                                 active_work->type, tmp->type);
4106                         return tmp;
4107                 }
4108         }
4109
4110         /* Did not find a radio work to schedule in parallel. */
4111         return NULL;
4112 }
4113
4114
4115 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4116 {
4117         struct wpa_radio *radio = eloop_ctx;
4118         struct wpa_radio_work *work;
4119         struct os_reltime now, diff;
4120         struct wpa_supplicant *wpa_s;
4121
4122         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4123         if (work == NULL) {
4124                 radio->num_active_works = 0;
4125                 return;
4126         }
4127
4128         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4129                               radio_list);
4130
4131         if (!(wpa_s &&
4132               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4133                 if (work->started)
4134                         return; /* already started and still in progress */
4135
4136                 if (wpa_s && wpa_s->radio->external_scan_running) {
4137                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4138                         return;
4139                 }
4140         } else {
4141                 work = NULL;
4142                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4143                         /* get the work to schedule next */
4144                         work = radio_work_get_next_work(radio);
4145                 }
4146                 if (!work)
4147                         return;
4148         }
4149
4150         wpa_s = work->wpa_s;
4151         os_get_reltime(&now);
4152         os_reltime_sub(&now, &work->time, &diff);
4153         wpa_dbg(wpa_s, MSG_DEBUG,
4154                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4155                 work->type, work, diff.sec, diff.usec);
4156         work->started = 1;
4157         work->time = now;
4158         radio->num_active_works++;
4159
4160         work->cb(work, 0);
4161
4162         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4163             radio->num_active_works < MAX_ACTIVE_WORKS)
4164                 radio_work_check_next(wpa_s);
4165 }
4166
4167
4168 /*
4169  * This function removes both started and pending radio works running on
4170  * the provided interface's radio.
4171  * Prior to the removal of the radio work, its callback (cb) is called with
4172  * deinit set to be 1. Each work's callback is responsible for clearing its
4173  * internal data and restoring to a correct state.
4174  * @wpa_s: wpa_supplicant data
4175  * @type: type of works to be removed
4176  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4177  * this interface's works.
4178  */
4179 void radio_remove_works(struct wpa_supplicant *wpa_s,
4180                         const char *type, int remove_all)
4181 {
4182         struct wpa_radio_work *work, *tmp;
4183         struct wpa_radio *radio = wpa_s->radio;
4184
4185         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4186                               list) {
4187                 if (type && os_strcmp(type, work->type) != 0)
4188                         continue;
4189
4190                 /* skip other ifaces' works */
4191                 if (!remove_all && work->wpa_s != wpa_s)
4192                         continue;
4193
4194                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4195                         work->type, work, work->started ? " (started)" : "");
4196                 work->cb(work, 1);
4197                 radio_work_free(work);
4198         }
4199
4200         /* in case we removed the started work */
4201         radio_work_check_next(wpa_s);
4202 }
4203
4204
4205 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4206 {
4207         struct wpa_radio *radio = wpa_s->radio;
4208
4209         if (!radio)
4210                 return;
4211
4212         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4213                    wpa_s->ifname, radio->name);
4214         dl_list_del(&wpa_s->radio_list);
4215         radio_remove_works(wpa_s, NULL, 0);
4216         wpa_s->radio = NULL;
4217         if (!dl_list_empty(&radio->ifaces))
4218                 return; /* Interfaces remain for this radio */
4219
4220         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4221         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4222         os_free(radio);
4223 }
4224
4225
4226 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4227 {
4228         struct wpa_radio *radio = wpa_s->radio;
4229
4230         if (dl_list_empty(&radio->work))
4231                 return;
4232         if (wpa_s->ext_work_in_progress) {
4233                 wpa_printf(MSG_DEBUG,
4234                            "External radio work in progress - delay start of pending item");
4235                 return;
4236         }
4237         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4238         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4239 }
4240
4241
4242 /**
4243  * radio_add_work - Add a radio work item
4244  * @wpa_s: Pointer to wpa_supplicant data
4245  * @freq: Frequency of the offchannel operation in MHz or 0
4246  * @type: Unique identifier for each type of work
4247  * @next: Force as the next work to be executed
4248  * @cb: Callback function for indicating when radio is available
4249  * @ctx: Context pointer for the work (work->ctx in cb())
4250  * Returns: 0 on success, -1 on failure
4251  *
4252  * This function is used to request time for an operation that requires
4253  * exclusive radio control. Once the radio is available, the registered callback
4254  * function will be called. radio_work_done() must be called once the exclusive
4255  * radio operation has been completed, so that the radio is freed for other
4256  * operations. The special case of deinit=1 is used to free the context data
4257  * during interface removal. That does not allow the callback function to start
4258  * the radio operation, i.e., it must free any resources allocated for the radio
4259  * work and return.
4260  *
4261  * The @freq parameter can be used to indicate a single channel on which the
4262  * offchannel operation will occur. This may allow multiple radio work
4263  * operations to be performed in parallel if they apply for the same channel.
4264  * Setting this to 0 indicates that the work item may use multiple channels or
4265  * requires exclusive control of the radio.
4266  */
4267 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4268                    const char *type, int next,
4269                    void (*cb)(struct wpa_radio_work *work, int deinit),
4270                    void *ctx)
4271 {
4272         struct wpa_radio *radio = wpa_s->radio;
4273         struct wpa_radio_work *work;
4274         int was_empty;
4275
4276         work = os_zalloc(sizeof(*work));
4277         if (work == NULL)
4278                 return -1;
4279         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4280         os_get_reltime(&work->time);
4281         work->freq = freq;
4282         work->type = type;
4283         work->wpa_s = wpa_s;
4284         work->cb = cb;
4285         work->ctx = ctx;
4286
4287         if (freq)
4288                 work->bands = wpas_freq_to_band(freq);
4289         else if (os_strcmp(type, "scan") == 0 ||
4290                  os_strcmp(type, "p2p-scan") == 0)
4291                 work->bands = wpas_get_bands(wpa_s,
4292                                              ((struct wpa_driver_scan_params *)
4293                                               ctx)->freqs);
4294         else
4295                 work->bands = wpas_get_bands(wpa_s, NULL);
4296
4297         was_empty = dl_list_empty(&wpa_s->radio->work);
4298         if (next)
4299                 dl_list_add(&wpa_s->radio->work, &work->list);
4300         else
4301                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4302         if (was_empty) {
4303                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4304                 radio_work_check_next(wpa_s);
4305         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4306                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4307                 wpa_dbg(wpa_s, MSG_DEBUG,
4308                         "Try to schedule a radio work (num_active_works=%u)",
4309                         radio->num_active_works);
4310                 radio_work_check_next(wpa_s);
4311         }
4312
4313         return 0;
4314 }
4315
4316
4317 /**
4318  * radio_work_done - Indicate that a radio work item has been completed
4319  * @work: Completed work
4320  *
4321  * This function is called once the callback function registered with
4322  * radio_add_work() has completed its work.
4323  */
4324 void radio_work_done(struct wpa_radio_work *work)
4325 {
4326         struct wpa_supplicant *wpa_s = work->wpa_s;
4327         struct os_reltime now, diff;
4328         unsigned int started = work->started;
4329
4330         os_get_reltime(&now);
4331         os_reltime_sub(&now, &work->time, &diff);
4332         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4333                 work->type, work, started ? "done" : "canceled",
4334                 diff.sec, diff.usec);
4335         radio_work_free(work);
4336         if (started)
4337                 radio_work_check_next(wpa_s);
4338 }
4339
4340
4341 struct wpa_radio_work *
4342 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4343 {
4344         struct wpa_radio_work *work;
4345         struct wpa_radio *radio = wpa_s->radio;
4346
4347         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4348                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4349                         return work;
4350         }
4351
4352         return NULL;
4353 }
4354
4355
4356 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4357                             struct wpa_interface *iface)
4358 {
4359         const char *ifname, *driver, *rn;
4360
4361         driver = iface->driver;
4362 next_driver:
4363         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4364                 return -1;
4365
4366         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4367         if (wpa_s->drv_priv == NULL) {
4368                 const char *pos;
4369                 pos = driver ? os_strchr(driver, ',') : NULL;
4370                 if (pos) {
4371                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4372                                 "driver interface - try next driver wrapper");
4373                         driver = pos + 1;
4374                         goto next_driver;
4375                 }
4376                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4377                         "interface");
4378                 return -1;
4379         }
4380         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4381                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4382                         "driver_param '%s'", wpa_s->conf->driver_param);
4383                 return -1;
4384         }
4385
4386         ifname = wpa_drv_get_ifname(wpa_s);
4387         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4388                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4389                         "interface name with '%s'", ifname);
4390                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4391         }
4392
4393         rn = wpa_driver_get_radio_name(wpa_s);
4394         if (rn && rn[0] == '\0')
4395                 rn = NULL;
4396
4397         wpa_s->radio = radio_add_interface(wpa_s, rn);
4398         if (wpa_s->radio == NULL)
4399                 return -1;
4400
4401         return 0;
4402 }
4403
4404
4405 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4406                                      struct wpa_interface *iface)
4407 {
4408         struct wpa_driver_capa capa;
4409         int capa_res;
4410
4411         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4412                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4413                    iface->confname ? iface->confname : "N/A",
4414                    iface->driver ? iface->driver : "default",
4415                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4416                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4417
4418         if (iface->confname) {
4419 #ifdef CONFIG_BACKEND_FILE
4420                 wpa_s->confname = os_rel2abs_path(iface->confname);
4421                 if (wpa_s->confname == NULL) {
4422                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4423                                    "for configuration file '%s'.",
4424                                    iface->confname);
4425                         return -1;
4426                 }
4427                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4428                            iface->confname, wpa_s->confname);
4429 #else /* CONFIG_BACKEND_FILE */
4430                 wpa_s->confname = os_strdup(iface->confname);
4431 #endif /* CONFIG_BACKEND_FILE */
4432                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4433                 if (wpa_s->conf == NULL) {
4434                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4435                                    "configuration '%s'.", wpa_s->confname);
4436                         return -1;
4437                 }
4438                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4439                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4440
4441                 /*
4442                  * Override ctrl_interface and driver_param if set on command
4443                  * line.
4444                  */
4445                 if (iface->ctrl_interface) {
4446                         os_free(wpa_s->conf->ctrl_interface);
4447                         wpa_s->conf->ctrl_interface =
4448                                 os_strdup(iface->ctrl_interface);
4449                 }
4450
4451                 if (iface->driver_param) {
4452                         os_free(wpa_s->conf->driver_param);
4453                         wpa_s->conf->driver_param =
4454                                 os_strdup(iface->driver_param);
4455                 }
4456
4457                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4458                         os_free(wpa_s->conf->ctrl_interface);
4459                         wpa_s->conf->ctrl_interface = NULL;
4460                 }
4461         } else
4462                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4463                                                      iface->driver_param);
4464
4465         if (wpa_s->conf == NULL) {
4466                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4467                 return -1;
4468         }
4469
4470         if (iface->ifname == NULL) {
4471                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4472                 return -1;
4473         }
4474         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4475                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4476                            iface->ifname);
4477                 return -1;
4478         }
4479         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4480
4481         if (iface->bridge_ifname) {
4482                 if (os_strlen(iface->bridge_ifname) >=
4483                     sizeof(wpa_s->bridge_ifname)) {
4484                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4485                                    "name '%s'.", iface->bridge_ifname);
4486                         return -1;
4487                 }
4488                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4489                            sizeof(wpa_s->bridge_ifname));
4490         }
4491
4492         /* RSNA Supplicant Key Management - INITIALIZE */
4493         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4494         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4495
4496         /* Initialize driver interface and register driver event handler before
4497          * L2 receive handler so that association events are processed before
4498          * EAPOL-Key packets if both become available for the same select()
4499          * call. */
4500         if (wpas_init_driver(wpa_s, iface) < 0)
4501                 return -1;
4502
4503         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4504                 return -1;
4505
4506         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4507                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4508                           NULL);
4509         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4510
4511         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4512             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4513                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4514                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4515                         "dot11RSNAConfigPMKLifetime");
4516                 return -1;
4517         }
4518
4519         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4520             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4521                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4522                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4523                         "dot11RSNAConfigPMKReauthThreshold");
4524                 return -1;
4525         }
4526
4527         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4528             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4529                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4530                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4531                         "dot11RSNAConfigSATimeout");
4532                 return -1;
4533         }
4534
4535         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4536                                                       &wpa_s->hw.num_modes,
4537                                                       &wpa_s->hw.flags);
4538         if (wpa_s->hw.modes) {
4539                 u16 i;
4540
4541                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4542                         if (wpa_s->hw.modes[i].vht_capab) {
4543                                 wpa_s->hw_capab = CAPAB_VHT;
4544                                 break;
4545                         }
4546
4547                         if (wpa_s->hw.modes[i].ht_capab &
4548                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4549                                 wpa_s->hw_capab = CAPAB_HT40;
4550                         else if (wpa_s->hw.modes[i].ht_capab &&
4551                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4552                                 wpa_s->hw_capab = CAPAB_HT;
4553                 }
4554         }
4555
4556         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4557         if (capa_res == 0) {
4558                 wpa_s->drv_capa_known = 1;
4559                 wpa_s->drv_flags = capa.flags;
4560                 wpa_s->drv_enc = capa.enc;
4561                 wpa_s->drv_smps_modes = capa.smps_modes;
4562                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4563                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4564                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4565                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4566                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4567                 wpa_s->max_match_sets = capa.max_match_sets;
4568                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4569                 wpa_s->max_stations = capa.max_stations;
4570                 wpa_s->extended_capa = capa.extended_capa;
4571                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4572                 wpa_s->extended_capa_len = capa.extended_capa_len;
4573                 wpa_s->num_multichan_concurrent =
4574                         capa.num_multichan_concurrent;
4575                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4576
4577                 if (capa.mac_addr_rand_scan_supported)
4578                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4579                 if (wpa_s->sched_scan_supported &&
4580                     capa.mac_addr_rand_sched_scan_supported)
4581                         wpa_s->mac_addr_rand_supported |=
4582                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4583         }
4584         if (wpa_s->max_remain_on_chan == 0)
4585                 wpa_s->max_remain_on_chan = 1000;
4586
4587         /*
4588          * Only take p2p_mgmt parameters when P2P Device is supported.
4589          * Doing it here as it determines whether l2_packet_init() will be done
4590          * during wpa_supplicant_driver_init().
4591          */
4592         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4593                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4594         else
4595                 iface->p2p_mgmt = 1;
4596
4597         if (wpa_s->num_multichan_concurrent == 0)
4598                 wpa_s->num_multichan_concurrent = 1;
4599
4600         if (wpa_supplicant_driver_init(wpa_s) < 0)
4601                 return -1;
4602
4603 #ifdef CONFIG_TDLS
4604         if ((!iface->p2p_mgmt ||
4605              !(wpa_s->drv_flags &
4606                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4607             wpa_tdls_init(wpa_s->wpa))
4608                 return -1;
4609 #endif /* CONFIG_TDLS */
4610
4611         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4612             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4613                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4614                 return -1;
4615         }
4616
4617 #ifdef CONFIG_FST
4618         if (wpa_s->conf->fst_group_id) {
4619                 struct fst_iface_cfg cfg;
4620                 struct fst_wpa_obj iface_obj;
4621
4622                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4623                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4624                            sizeof(cfg.group_id));
4625                 cfg.priority = wpa_s->conf->fst_priority;
4626                 cfg.llt = wpa_s->conf->fst_llt;
4627
4628                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4629                                         &iface_obj, &cfg);
4630                 if (!wpa_s->fst) {
4631                         wpa_msg(wpa_s, MSG_ERROR,
4632                                 "FST: Cannot attach iface %s to group %s",
4633                                 wpa_s->ifname, cfg.group_id);
4634                         return -1;
4635                 }
4636         }
4637 #endif /* CONFIG_FST */
4638
4639         if (wpas_wps_init(wpa_s))
4640                 return -1;
4641
4642         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4643                 return -1;
4644         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4645
4646         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4647         if (wpa_s->ctrl_iface == NULL) {
4648                 wpa_printf(MSG_ERROR,
4649                            "Failed to initialize control interface '%s'.\n"
4650                            "You may have another wpa_supplicant process "
4651                            "already running or the file was\n"
4652                            "left by an unclean termination of wpa_supplicant "
4653                            "in which case you will need\n"
4654                            "to manually remove this file before starting "
4655                            "wpa_supplicant again.\n",
4656                            wpa_s->conf->ctrl_interface);
4657                 return -1;
4658         }
4659
4660         wpa_s->gas = gas_query_init(wpa_s);
4661         if (wpa_s->gas == NULL) {
4662                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4663                 return -1;
4664         }
4665
4666         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4667                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4668                 return -1;
4669         }
4670
4671         if (wpa_bss_init(wpa_s) < 0)
4672                 return -1;
4673
4674         /*
4675          * Set Wake-on-WLAN triggers, if configured.
4676          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4677          * have effect anyway when the interface is down).
4678          */
4679         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4680                 return -1;
4681
4682 #ifdef CONFIG_EAP_PROXY
4683 {
4684         size_t len;
4685         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4686                                                      &len);
4687         if (wpa_s->mnc_len > 0) {
4688                 wpa_s->imsi[len] = '\0';
4689                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4690                            wpa_s->imsi, wpa_s->mnc_len);
4691         } else {
4692                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4693         }
4694 }
4695 #endif /* CONFIG_EAP_PROXY */
4696
4697         if (pcsc_reader_init(wpa_s) < 0)
4698                 return -1;
4699
4700         if (wpas_init_ext_pw(wpa_s) < 0)
4701                 return -1;
4702
4703         wpas_rrm_reset(wpa_s);
4704
4705         return 0;
4706 }
4707
4708
4709 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4710                                         int notify, int terminate)
4711 {
4712         struct wpa_global *global = wpa_s->global;
4713         struct wpa_supplicant *iface, *prev;
4714
4715         if (wpa_s == wpa_s->parent)
4716                 wpas_p2p_group_remove(wpa_s, "*");
4717
4718         iface = global->ifaces;
4719         while (iface) {
4720                 if (iface == wpa_s || iface->parent != wpa_s) {
4721                         iface = iface->next;
4722                         continue;
4723                 }
4724                 wpa_printf(MSG_DEBUG,
4725                            "Remove remaining child interface %s from parent %s",
4726                            iface->ifname, wpa_s->ifname);
4727                 prev = iface;
4728                 iface = iface->next;
4729                 wpa_supplicant_remove_iface(global, prev, terminate);
4730         }
4731
4732         wpa_s->disconnected = 1;
4733         if (wpa_s->drv_priv) {
4734                 wpa_supplicant_deauthenticate(wpa_s,
4735                                               WLAN_REASON_DEAUTH_LEAVING);
4736
4737                 wpa_drv_set_countermeasures(wpa_s, 0);
4738                 wpa_clear_keys(wpa_s, NULL);
4739         }
4740
4741         wpa_supplicant_cleanup(wpa_s);
4742         wpas_p2p_deinit_iface(wpa_s);
4743
4744         wpas_ctrl_radio_work_flush(wpa_s);
4745         radio_remove_interface(wpa_s);
4746
4747 #ifdef CONFIG_FST
4748         if (wpa_s->fst) {
4749                 fst_detach(wpa_s->fst);
4750                 wpa_s->fst = NULL;
4751         }
4752         if (wpa_s->received_mb_ies) {
4753                 wpabuf_free(wpa_s->received_mb_ies);
4754                 wpa_s->received_mb_ies = NULL;
4755         }
4756 #endif /* CONFIG_FST */
4757
4758         if (wpa_s->drv_priv)
4759                 wpa_drv_deinit(wpa_s);
4760
4761         if (notify)
4762                 wpas_notify_iface_removed(wpa_s);
4763
4764         if (terminate)
4765                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4766
4767         if (wpa_s->ctrl_iface) {
4768                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4769                 wpa_s->ctrl_iface = NULL;
4770         }
4771
4772 #ifdef CONFIG_MESH
4773         if (wpa_s->ifmsh) {
4774                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4775                 wpa_s->ifmsh = NULL;
4776         }
4777 #endif /* CONFIG_MESH */
4778
4779         if (wpa_s->conf != NULL) {
4780                 wpa_config_free(wpa_s->conf);
4781                 wpa_s->conf = NULL;
4782         }
4783
4784         os_free(wpa_s->ssids_from_scan_req);
4785
4786         os_free(wpa_s);
4787 }
4788
4789
4790 /**
4791  * wpa_supplicant_add_iface - Add a new network interface
4792  * @global: Pointer to global data from wpa_supplicant_init()
4793  * @iface: Interface configuration options
4794  * @parent: Parent interface or %NULL to assign new interface as parent
4795  * Returns: Pointer to the created interface or %NULL on failure
4796  *
4797  * This function is used to add new network interfaces for %wpa_supplicant.
4798  * This can be called before wpa_supplicant_run() to add interfaces before the
4799  * main event loop has been started. In addition, new interfaces can be added
4800  * dynamically while %wpa_supplicant is already running. This could happen,
4801  * e.g., when a hotplug network adapter is inserted.
4802  */
4803 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4804                                                  struct wpa_interface *iface,
4805                                                  struct wpa_supplicant *parent)
4806 {
4807         struct wpa_supplicant *wpa_s;
4808         struct wpa_interface t_iface;
4809         struct wpa_ssid *ssid;
4810
4811         if (global == NULL || iface == NULL)
4812                 return NULL;
4813
4814         wpa_s = wpa_supplicant_alloc(parent);
4815         if (wpa_s == NULL)
4816                 return NULL;
4817
4818         wpa_s->global = global;
4819
4820         t_iface = *iface;
4821         if (global->params.override_driver) {
4822                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4823                            "('%s' -> '%s')",
4824                            iface->driver, global->params.override_driver);
4825                 t_iface.driver = global->params.override_driver;
4826         }
4827         if (global->params.override_ctrl_interface) {
4828                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4829                            "ctrl_interface ('%s' -> '%s')",
4830                            iface->ctrl_interface,
4831                            global->params.override_ctrl_interface);
4832                 t_iface.ctrl_interface =
4833                         global->params.override_ctrl_interface;
4834         }
4835         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4836                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4837                            iface->ifname);
4838                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4839                 return NULL;
4840         }
4841
4842         if (iface->p2p_mgmt == 0) {
4843                 /* Notify the control interfaces about new iface */
4844                 if (wpas_notify_iface_added(wpa_s)) {
4845                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4846                         return NULL;
4847                 }
4848
4849                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4850                         wpas_notify_network_added(wpa_s, ssid);
4851         }
4852
4853         wpa_s->next = global->ifaces;
4854         global->ifaces = wpa_s;
4855
4856         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4857         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4858
4859 #ifdef CONFIG_P2P
4860         if (wpa_s->global->p2p == NULL &&
4861             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4862             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4863             wpas_p2p_add_p2pdev_interface(
4864                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4865                 wpa_printf(MSG_INFO,
4866                            "P2P: Failed to enable P2P Device interface");
4867                 /* Try to continue without. P2P will be disabled. */
4868         }
4869 #endif /* CONFIG_P2P */
4870
4871         return wpa_s;
4872 }
4873
4874
4875 /**
4876  * wpa_supplicant_remove_iface - Remove a network interface
4877  * @global: Pointer to global data from wpa_supplicant_init()
4878  * @wpa_s: Pointer to the network interface to be removed
4879  * Returns: 0 if interface was removed, -1 if interface was not found
4880  *
4881  * This function can be used to dynamically remove network interfaces from
4882  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4883  * addition, this function is used to remove all remaining interfaces when
4884  * %wpa_supplicant is terminated.
4885  */
4886 int wpa_supplicant_remove_iface(struct wpa_global *global,
4887                                 struct wpa_supplicant *wpa_s,
4888                                 int terminate)
4889 {
4890         struct wpa_supplicant *prev;
4891 #ifdef CONFIG_MESH
4892         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4893         char *ifname = NULL;
4894 #endif /* CONFIG_MESH */
4895
4896         /* Remove interface from the global list of interfaces */
4897         prev = global->ifaces;
4898         if (prev == wpa_s) {
4899                 global->ifaces = wpa_s->next;
4900         } else {
4901                 while (prev && prev->next != wpa_s)
4902                         prev = prev->next;
4903                 if (prev == NULL)
4904                         return -1;
4905                 prev->next = wpa_s->next;
4906         }
4907
4908         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4909
4910 #ifdef CONFIG_MESH
4911         if (mesh_if_created) {
4912                 ifname = os_strdup(wpa_s->ifname);
4913                 if (ifname == NULL) {
4914                         wpa_dbg(wpa_s, MSG_ERROR,
4915                                 "mesh: Failed to malloc ifname");
4916                         return -1;
4917                 }
4918         }
4919 #endif /* CONFIG_MESH */
4920
4921         if (global->p2p_group_formation == wpa_s)
4922                 global->p2p_group_formation = NULL;
4923         if (global->p2p_invite_group == wpa_s)
4924                 global->p2p_invite_group = NULL;
4925         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4926
4927 #ifdef CONFIG_MESH
4928         if (mesh_if_created) {
4929                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4930                 os_free(ifname);
4931         }
4932 #endif /* CONFIG_MESH */
4933
4934         return 0;
4935 }
4936
4937
4938 /**
4939  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4940  * @wpa_s: Pointer to the network interface
4941  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4942  */
4943 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4944 {
4945         const char *eapol_method;
4946
4947         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4948             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4949                 return "NO-EAP";
4950         }
4951
4952         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4953         if (eapol_method == NULL)
4954                 return "UNKNOWN-EAP";
4955
4956         return eapol_method;
4957 }
4958
4959
4960 /**
4961  * wpa_supplicant_get_iface - Get a new network interface
4962  * @global: Pointer to global data from wpa_supplicant_init()
4963  * @ifname: Interface name
4964  * Returns: Pointer to the interface or %NULL if not found
4965  */
4966 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4967                                                  const char *ifname)
4968 {
4969         struct wpa_supplicant *wpa_s;
4970
4971         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4972                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4973                         return wpa_s;
4974         }
4975         return NULL;
4976 }
4977
4978
4979 #ifndef CONFIG_NO_WPA_MSG
4980 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4981 {
4982         struct wpa_supplicant *wpa_s = ctx;
4983         if (wpa_s == NULL)
4984                 return NULL;
4985         return wpa_s->ifname;
4986 }
4987 #endif /* CONFIG_NO_WPA_MSG */
4988
4989
4990 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
4991 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
4992 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
4993
4994 /* Periodic cleanup tasks */
4995 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
4996 {
4997         struct wpa_global *global = eloop_ctx;
4998         struct wpa_supplicant *wpa_s;
4999
5000         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5001                                wpas_periodic, global, NULL);
5002
5003 #ifdef CONFIG_P2P
5004         if (global->p2p)
5005                 p2p_expire_peers(global->p2p);
5006 #endif /* CONFIG_P2P */
5007
5008         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5009                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5010 #ifdef CONFIG_AP
5011                 ap_periodic(wpa_s);
5012 #endif /* CONFIG_AP */
5013         }
5014 }
5015
5016
5017 /**
5018  * wpa_supplicant_init - Initialize %wpa_supplicant
5019  * @params: Parameters for %wpa_supplicant
5020  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5021  *
5022  * This function is used to initialize %wpa_supplicant. After successful
5023  * initialization, the returned data pointer can be used to add and remove
5024  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5025  */
5026 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5027 {
5028         struct wpa_global *global;
5029         int ret, i;
5030
5031         if (params == NULL)
5032                 return NULL;
5033
5034 #ifdef CONFIG_DRIVER_NDIS
5035         {
5036                 void driver_ndis_init_ops(void);
5037                 driver_ndis_init_ops();
5038         }
5039 #endif /* CONFIG_DRIVER_NDIS */
5040
5041 #ifndef CONFIG_NO_WPA_MSG
5042         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5043 #endif /* CONFIG_NO_WPA_MSG */
5044
5045         if (params->wpa_debug_file_path)
5046                 wpa_debug_open_file(params->wpa_debug_file_path);
5047         else
5048                 wpa_debug_setup_stdout();
5049         if (params->wpa_debug_syslog)
5050                 wpa_debug_open_syslog();
5051         if (params->wpa_debug_tracing) {
5052                 ret = wpa_debug_open_linux_tracing();
5053                 if (ret) {
5054                         wpa_printf(MSG_ERROR,
5055                                    "Failed to enable trace logging");
5056                         return NULL;
5057                 }
5058         }
5059
5060         ret = eap_register_methods();
5061         if (ret) {
5062                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5063                 if (ret == -2)
5064                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5065                                    "the same EAP type.");
5066                 return NULL;
5067         }
5068
5069         global = os_zalloc(sizeof(*global));
5070         if (global == NULL)
5071                 return NULL;
5072         dl_list_init(&global->p2p_srv_bonjour);
5073         dl_list_init(&global->p2p_srv_upnp);
5074         global->params.daemonize = params->daemonize;
5075         global->params.wait_for_monitor = params->wait_for_monitor;
5076         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5077         if (params->pid_file)
5078                 global->params.pid_file = os_strdup(params->pid_file);
5079         if (params->ctrl_interface)
5080                 global->params.ctrl_interface =
5081                         os_strdup(params->ctrl_interface);
5082         if (params->ctrl_interface_group)
5083                 global->params.ctrl_interface_group =
5084                         os_strdup(params->ctrl_interface_group);
5085         if (params->override_driver)
5086                 global->params.override_driver =
5087                         os_strdup(params->override_driver);
5088         if (params->override_ctrl_interface)
5089                 global->params.override_ctrl_interface =
5090                         os_strdup(params->override_ctrl_interface);
5091 #ifdef CONFIG_P2P
5092         if (params->conf_p2p_dev)
5093                 global->params.conf_p2p_dev =
5094                         os_strdup(params->conf_p2p_dev);
5095 #endif /* CONFIG_P2P */
5096         wpa_debug_level = global->params.wpa_debug_level =
5097                 params->wpa_debug_level;
5098         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5099                 params->wpa_debug_show_keys;
5100         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5101                 params->wpa_debug_timestamp;
5102
5103         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5104
5105         if (eloop_init()) {
5106                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5107                 wpa_supplicant_deinit(global);
5108                 return NULL;
5109         }
5110
5111         random_init(params->entropy_file);
5112
5113         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5114         if (global->ctrl_iface == NULL) {
5115                 wpa_supplicant_deinit(global);
5116                 return NULL;
5117         }
5118
5119         if (wpas_notify_supplicant_initialized(global)) {
5120                 wpa_supplicant_deinit(global);
5121                 return NULL;
5122         }
5123
5124         for (i = 0; wpa_drivers[i]; i++)
5125                 global->drv_count++;
5126         if (global->drv_count == 0) {
5127                 wpa_printf(MSG_ERROR, "No drivers enabled");
5128                 wpa_supplicant_deinit(global);
5129                 return NULL;
5130         }
5131         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5132         if (global->drv_priv == NULL) {
5133                 wpa_supplicant_deinit(global);
5134                 return NULL;
5135         }
5136
5137 #ifdef CONFIG_WIFI_DISPLAY
5138         if (wifi_display_init(global) < 0) {
5139                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5140                 wpa_supplicant_deinit(global);
5141                 return NULL;
5142         }
5143 #endif /* CONFIG_WIFI_DISPLAY */
5144
5145         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5146                                wpas_periodic, global, NULL);
5147
5148         return global;
5149 }
5150
5151
5152 /**
5153  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5154  * @global: Pointer to global data from wpa_supplicant_init()
5155  * Returns: 0 after successful event loop run, -1 on failure
5156  *
5157  * This function starts the main event loop and continues running as long as
5158  * there are any remaining events. In most cases, this function is running as
5159  * long as the %wpa_supplicant process in still in use.
5160  */
5161 int wpa_supplicant_run(struct wpa_global *global)
5162 {
5163         struct wpa_supplicant *wpa_s;
5164
5165         if (global->params.daemonize &&
5166             wpa_supplicant_daemon(global->params.pid_file))
5167                 return -1;
5168
5169         if (global->params.wait_for_monitor) {
5170                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5171                         if (wpa_s->ctrl_iface)
5172                                 wpa_supplicant_ctrl_iface_wait(
5173                                         wpa_s->ctrl_iface);
5174         }
5175
5176         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5177         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5178
5179         eloop_run();
5180
5181         return 0;
5182 }
5183
5184
5185 /**
5186  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5187  * @global: Pointer to global data from wpa_supplicant_init()
5188  *
5189  * This function is called to deinitialize %wpa_supplicant and to free all
5190  * allocated resources. Remaining network interfaces will also be removed.
5191  */
5192 void wpa_supplicant_deinit(struct wpa_global *global)
5193 {
5194         int i;
5195
5196         if (global == NULL)
5197                 return;
5198
5199         eloop_cancel_timeout(wpas_periodic, global, NULL);
5200
5201 #ifdef CONFIG_WIFI_DISPLAY
5202         wifi_display_deinit(global);
5203 #endif /* CONFIG_WIFI_DISPLAY */
5204
5205         while (global->ifaces)
5206                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5207
5208         if (global->ctrl_iface)
5209                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5210
5211         wpas_notify_supplicant_deinitialized(global);
5212
5213         eap_peer_unregister_methods();
5214 #ifdef CONFIG_AP
5215         eap_server_unregister_methods();
5216 #endif /* CONFIG_AP */
5217
5218         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5219                 if (!global->drv_priv[i])
5220                         continue;
5221                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5222         }
5223         os_free(global->drv_priv);
5224
5225         random_deinit();
5226
5227         eloop_destroy();
5228
5229         if (global->params.pid_file) {
5230                 os_daemonize_terminate(global->params.pid_file);
5231                 os_free(global->params.pid_file);
5232         }
5233         os_free(global->params.ctrl_interface);
5234         os_free(global->params.ctrl_interface_group);
5235         os_free(global->params.override_driver);
5236         os_free(global->params.override_ctrl_interface);
5237 #ifdef CONFIG_P2P
5238         os_free(global->params.conf_p2p_dev);
5239 #endif /* CONFIG_P2P */
5240
5241         os_free(global->p2p_disallow_freq.range);
5242         os_free(global->p2p_go_avoid_freq.range);
5243         os_free(global->add_psk);
5244
5245         os_free(global);
5246         wpa_debug_close_syslog();
5247         wpa_debug_close_file();
5248         wpa_debug_close_linux_tracing();
5249 }
5250
5251
5252 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5253 {
5254         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5255             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5256                 char country[3];
5257                 country[0] = wpa_s->conf->country[0];
5258                 country[1] = wpa_s->conf->country[1];
5259                 country[2] = '\0';
5260                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5261                         wpa_printf(MSG_ERROR, "Failed to set country code "
5262                                    "'%s'", country);
5263                 }
5264         }
5265
5266         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5267                 wpas_init_ext_pw(wpa_s);
5268
5269 #ifdef CONFIG_WPS
5270         wpas_wps_update_config(wpa_s);
5271 #endif /* CONFIG_WPS */
5272         wpas_p2p_update_config(wpa_s);
5273         wpa_s->conf->changed_parameters = 0;
5274 }
5275
5276
5277 void add_freq(int *freqs, int *num_freqs, int freq)
5278 {
5279         int i;
5280
5281         for (i = 0; i < *num_freqs; i++) {
5282                 if (freqs[i] == freq)
5283                         return;
5284         }
5285
5286         freqs[*num_freqs] = freq;
5287         (*num_freqs)++;
5288 }
5289
5290
5291 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5292 {
5293         struct wpa_bss *bss, *cbss;
5294         const int max_freqs = 10;
5295         int *freqs;
5296         int num_freqs = 0;
5297
5298         freqs = os_calloc(max_freqs + 1, sizeof(int));
5299         if (freqs == NULL)
5300                 return NULL;
5301
5302         cbss = wpa_s->current_bss;
5303
5304         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5305                 if (bss == cbss)
5306                         continue;
5307                 if (bss->ssid_len == cbss->ssid_len &&
5308                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5309                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5310                         add_freq(freqs, &num_freqs, bss->freq);
5311                         if (num_freqs == max_freqs)
5312                                 break;
5313                 }
5314         }
5315
5316         if (num_freqs == 0) {
5317                 os_free(freqs);
5318                 freqs = NULL;
5319         }
5320
5321         return freqs;
5322 }
5323
5324
5325 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5326 {
5327         int timeout;
5328         int count;
5329         int *freqs = NULL;
5330
5331         wpas_connect_work_done(wpa_s);
5332
5333         /*
5334          * Remove possible authentication timeout since the connection failed.
5335          */
5336         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5337
5338         /*
5339          * There is no point in blacklisting the AP if this event is
5340          * generated based on local request to disconnect.
5341          */
5342         if (wpa_s->own_disconnect_req) {
5343                 wpa_s->own_disconnect_req = 0;
5344                 wpa_dbg(wpa_s, MSG_DEBUG,
5345                         "Ignore connection failure due to local request to disconnect");
5346                 return;
5347         }
5348         if (wpa_s->disconnected) {
5349                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5350                         "indication since interface has been put into "
5351                         "disconnected state");
5352                 return;
5353         }
5354
5355         /*
5356          * Add the failed BSSID into the blacklist and speed up next scan
5357          * attempt if there could be other APs that could accept association.
5358          * The current blacklist count indicates how many times we have tried
5359          * connecting to this AP and multiple attempts mean that other APs are
5360          * either not available or has already been tried, so that we can start
5361          * increasing the delay here to avoid constant scanning.
5362          */
5363         count = wpa_blacklist_add(wpa_s, bssid);
5364         if (count == 1 && wpa_s->current_bss) {
5365                 /*
5366                  * This BSS was not in the blacklist before. If there is
5367                  * another BSS available for the same ESS, we should try that
5368                  * next. Otherwise, we may as well try this one once more
5369                  * before allowing other, likely worse, ESSes to be considered.
5370                  */
5371                 freqs = get_bss_freqs_in_ess(wpa_s);
5372                 if (freqs) {
5373                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5374                                 "has been seen; try it next");
5375                         wpa_blacklist_add(wpa_s, bssid);
5376                         /*
5377                          * On the next scan, go through only the known channels
5378                          * used in this ESS based on previous scans to speed up
5379                          * common load balancing use case.
5380                          */
5381                         os_free(wpa_s->next_scan_freqs);
5382                         wpa_s->next_scan_freqs = freqs;
5383                 }
5384         }
5385
5386         /*
5387          * Add previous failure count in case the temporary blacklist was
5388          * cleared due to no other BSSes being available.
5389          */
5390         count += wpa_s->extra_blacklist_count;
5391
5392         if (count > 3 && wpa_s->current_ssid) {
5393                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5394                            "consider temporary network disabling");
5395                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5396         }
5397
5398         switch (count) {
5399         case 1:
5400                 timeout = 100;
5401                 break;
5402         case 2:
5403                 timeout = 500;
5404                 break;
5405         case 3:
5406                 timeout = 1000;
5407                 break;
5408         case 4:
5409                 timeout = 5000;
5410                 break;
5411         default:
5412                 timeout = 10000;
5413                 break;
5414         }
5415
5416         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5417                 "ms", count, timeout);
5418
5419         /*
5420          * TODO: if more than one possible AP is available in scan results,
5421          * could try the other ones before requesting a new scan.
5422          */
5423         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5424                                 1000 * (timeout % 1000));
5425 }
5426
5427
5428 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5429 {
5430         return wpa_s->conf->ap_scan == 2 ||
5431                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5432 }
5433
5434
5435 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5436 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5437                                               struct wpa_ssid *ssid,
5438                                               const char *field,
5439                                               const char *value)
5440 {
5441 #ifdef IEEE8021X_EAPOL
5442         struct eap_peer_config *eap = &ssid->eap;
5443
5444         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5445         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5446                               (const u8 *) value, os_strlen(value));
5447
5448         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5449         case WPA_CTRL_REQ_EAP_IDENTITY:
5450                 os_free(eap->identity);
5451                 eap->identity = (u8 *) os_strdup(value);
5452                 eap->identity_len = os_strlen(value);
5453                 eap->pending_req_identity = 0;
5454                 if (ssid == wpa_s->current_ssid)
5455                         wpa_s->reassociate = 1;
5456                 break;
5457         case WPA_CTRL_REQ_EAP_PASSWORD:
5458                 bin_clear_free(eap->password, eap->password_len);
5459                 eap->password = (u8 *) os_strdup(value);
5460                 eap->password_len = os_strlen(value);
5461                 eap->pending_req_password = 0;
5462                 if (ssid == wpa_s->current_ssid)
5463                         wpa_s->reassociate = 1;
5464                 break;
5465         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5466                 bin_clear_free(eap->new_password, eap->new_password_len);
5467                 eap->new_password = (u8 *) os_strdup(value);
5468                 eap->new_password_len = os_strlen(value);
5469                 eap->pending_req_new_password = 0;
5470                 if (ssid == wpa_s->current_ssid)
5471                         wpa_s->reassociate = 1;
5472                 break;
5473         case WPA_CTRL_REQ_EAP_PIN:
5474                 str_clear_free(eap->pin);
5475                 eap->pin = os_strdup(value);
5476                 eap->pending_req_pin = 0;
5477                 if (ssid == wpa_s->current_ssid)
5478                         wpa_s->reassociate = 1;
5479                 break;
5480         case WPA_CTRL_REQ_EAP_OTP:
5481                 bin_clear_free(eap->otp, eap->otp_len);
5482                 eap->otp = (u8 *) os_strdup(value);
5483                 eap->otp_len = os_strlen(value);
5484                 os_free(eap->pending_req_otp);
5485                 eap->pending_req_otp = NULL;
5486                 eap->pending_req_otp_len = 0;
5487                 break;
5488         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5489                 str_clear_free(eap->private_key_passwd);
5490                 eap->private_key_passwd = os_strdup(value);
5491                 eap->pending_req_passphrase = 0;
5492                 if (ssid == wpa_s->current_ssid)
5493                         wpa_s->reassociate = 1;
5494                 break;
5495         case WPA_CTRL_REQ_SIM:
5496                 str_clear_free(eap->external_sim_resp);
5497                 eap->external_sim_resp = os_strdup(value);
5498                 break;
5499         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5500                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5501                         return -1;
5502                 ssid->mem_only_psk = 1;
5503                 if (ssid->passphrase)
5504                         wpa_config_update_psk(ssid);
5505                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5506                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5507                 break;
5508         default:
5509                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5510                 return -1;
5511         }
5512
5513         return 0;
5514 #else /* IEEE8021X_EAPOL */
5515         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5516         return -1;
5517 #endif /* IEEE8021X_EAPOL */
5518 }
5519 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5520
5521
5522 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5523 {
5524         int i;
5525         unsigned int drv_enc;
5526
5527         if (wpa_s->p2p_mgmt)
5528                 return 1; /* no normal network profiles on p2p_mgmt interface */
5529
5530         if (ssid == NULL)
5531                 return 1;
5532
5533         if (ssid->disabled)
5534                 return 1;
5535
5536         if (wpa_s->drv_capa_known)
5537                 drv_enc = wpa_s->drv_enc;
5538         else
5539                 drv_enc = (unsigned int) -1;
5540
5541         for (i = 0; i < NUM_WEP_KEYS; i++) {
5542                 size_t len = ssid->wep_key_len[i];
5543                 if (len == 0)
5544                         continue;
5545                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5546                         continue;
5547                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5548                         continue;
5549                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5550                         continue;
5551                 return 1; /* invalid WEP key */
5552         }
5553
5554         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5555             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5556             !ssid->mem_only_psk)
5557                 return 1;
5558
5559         return 0;
5560 }
5561
5562
5563 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5564 {
5565 #ifdef CONFIG_IEEE80211W
5566         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5567                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5568                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5569                         /*
5570                          * Driver does not support BIP -- ignore pmf=1 default
5571                          * since the connection with PMF would fail and the
5572                          * configuration does not require PMF to be enabled.
5573                          */
5574                         return NO_MGMT_FRAME_PROTECTION;
5575                 }
5576
5577                 return wpa_s->conf->pmf;
5578         }
5579
5580         return ssid->ieee80211w;
5581 #else /* CONFIG_IEEE80211W */
5582         return NO_MGMT_FRAME_PROTECTION;
5583 #endif /* CONFIG_IEEE80211W */
5584 }
5585
5586
5587 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5588 {
5589         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5590                 return 1;
5591         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5592                 return 0;
5593         return -1;
5594 }
5595
5596
5597 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5598 {
5599         struct wpa_ssid *ssid = wpa_s->current_ssid;
5600         int dur;
5601         struct os_reltime now;
5602
5603         if (ssid == NULL) {
5604                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5605                            "SSID block");
5606                 return;
5607         }
5608
5609         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5610                 return;
5611
5612         ssid->auth_failures++;
5613
5614 #ifdef CONFIG_P2P
5615         if (ssid->p2p_group &&
5616             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5617                 /*
5618                  * Skip the wait time since there is a short timeout on the
5619                  * connection to a P2P group.
5620                  */
5621                 return;
5622         }
5623 #endif /* CONFIG_P2P */
5624
5625         if (ssid->auth_failures > 50)
5626                 dur = 300;
5627         else if (ssid->auth_failures > 10)
5628                 dur = 120;
5629         else if (ssid->auth_failures > 5)
5630                 dur = 90;
5631         else if (ssid->auth_failures > 3)
5632                 dur = 60;
5633         else if (ssid->auth_failures > 2)
5634                 dur = 30;
5635         else if (ssid->auth_failures > 1)
5636                 dur = 20;
5637         else
5638                 dur = 10;
5639
5640         if (ssid->auth_failures > 1 &&
5641             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5642                 dur += os_random() % (ssid->auth_failures * 10);
5643
5644         os_get_reltime(&now);
5645         if (now.sec + dur <= ssid->disabled_until.sec)
5646                 return;
5647
5648         ssid->disabled_until.sec = now.sec + dur;
5649
5650         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5651                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5652                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5653                 ssid->auth_failures, dur, reason);
5654 }
5655
5656
5657 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5658                               struct wpa_ssid *ssid, int clear_failures)
5659 {
5660         if (ssid == NULL)
5661                 return;
5662
5663         if (ssid->disabled_until.sec) {
5664                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5665                         "id=%d ssid=\"%s\"",
5666                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5667         }
5668         ssid->disabled_until.sec = 0;
5669         ssid->disabled_until.usec = 0;
5670         if (clear_failures)
5671                 ssid->auth_failures = 0;
5672 }
5673
5674
5675 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5676 {
5677         size_t i;
5678
5679         if (wpa_s->disallow_aps_bssid == NULL)
5680                 return 0;
5681
5682         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5683                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5684                               bssid, ETH_ALEN) == 0)
5685                         return 1;
5686         }
5687
5688         return 0;
5689 }
5690
5691
5692 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5693                     size_t ssid_len)
5694 {
5695         size_t i;
5696
5697         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5698                 return 0;
5699
5700         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5701                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5702                 if (ssid_len == s->ssid_len &&
5703                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5704                         return 1;
5705         }
5706
5707         return 0;
5708 }
5709
5710
5711 /**
5712  * wpas_request_connection - Request a new connection
5713  * @wpa_s: Pointer to the network interface
5714  *
5715  * This function is used to request a new connection to be found. It will mark
5716  * the interface to allow reassociation and request a new scan to find a
5717  * suitable network to connect to.
5718  */
5719 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5720 {
5721         wpa_s->normal_scans = 0;
5722         wpa_s->scan_req = NORMAL_SCAN_REQ;
5723         wpa_supplicant_reinit_autoscan(wpa_s);
5724         wpa_s->extra_blacklist_count = 0;
5725         wpa_s->disconnected = 0;
5726         wpa_s->reassociate = 1;
5727
5728         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5729                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5730         else
5731                 wpa_s->reattach = 0;
5732 }
5733
5734
5735 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5736                     struct wpa_used_freq_data *freqs_data,
5737                     unsigned int len)
5738 {
5739         unsigned int i;
5740
5741         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5742                 len, title);
5743         for (i = 0; i < len; i++) {
5744                 struct wpa_used_freq_data *cur = &freqs_data[i];
5745                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5746                         i, cur->freq, cur->flags);
5747         }
5748 }
5749
5750
5751 /*
5752  * Find the operating frequencies of any of the virtual interfaces that
5753  * are using the same radio as the current interface, and in addition, get
5754  * information about the interface types that are using the frequency.
5755  */
5756 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5757                                 struct wpa_used_freq_data *freqs_data,
5758                                 unsigned int len)
5759 {
5760         struct wpa_supplicant *ifs;
5761         u8 bssid[ETH_ALEN];
5762         int freq;
5763         unsigned int idx = 0, i;
5764
5765         wpa_dbg(wpa_s, MSG_DEBUG,
5766                 "Determining shared radio frequencies (max len %u)", len);
5767         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5768
5769         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5770                          radio_list) {
5771                 if (idx == len)
5772                         break;
5773
5774                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5775                         continue;
5776
5777                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5778                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5779                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5780                         freq = ifs->current_ssid->frequency;
5781                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5782                         freq = ifs->assoc_freq;
5783                 else
5784                         continue;
5785
5786                 /* Hold only distinct freqs */
5787                 for (i = 0; i < idx; i++)
5788                         if (freqs_data[i].freq == freq)
5789                                 break;
5790
5791                 if (i == idx)
5792                         freqs_data[idx++].freq = freq;
5793
5794                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5795                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5796                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5797                                 WPA_FREQ_USED_BY_INFRA_STATION;
5798                 }
5799         }
5800
5801         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5802         return idx;
5803 }
5804
5805
5806 /*
5807  * Find the operating frequencies of any of the virtual interfaces that
5808  * are using the same radio as the current interface.
5809  */
5810 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5811                            int *freq_array, unsigned int len)
5812 {
5813         struct wpa_used_freq_data *freqs_data;
5814         int num, i;
5815
5816         os_memset(freq_array, 0, sizeof(int) * len);
5817
5818         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5819         if (!freqs_data)
5820                 return -1;
5821
5822         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5823         for (i = 0; i < num; i++)
5824                 freq_array[i] = freqs_data[i].freq;
5825
5826         os_free(freqs_data);
5827
5828         return num;
5829 }
5830
5831
5832 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5833 {
5834         struct rrm_data *rrm = data;
5835
5836         if (!rrm->notify_neighbor_rep) {
5837                 wpa_printf(MSG_ERROR,
5838                            "RRM: Unexpected neighbor report timeout");
5839                 return;
5840         }
5841
5842         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5843         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5844
5845         rrm->notify_neighbor_rep = NULL;
5846         rrm->neighbor_rep_cb_ctx = NULL;
5847 }
5848
5849
5850 /*
5851  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5852  * @wpa_s: Pointer to wpa_supplicant
5853  */
5854 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5855 {
5856         wpa_s->rrm.rrm_used = 0;
5857
5858         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5859                              NULL);
5860         if (wpa_s->rrm.notify_neighbor_rep)
5861                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5862         wpa_s->rrm.next_neighbor_rep_token = 1;
5863 }
5864
5865
5866 /*
5867  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5868  * @wpa_s: Pointer to wpa_supplicant
5869  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5870  * @report_len: Length of neighbor report buffer
5871  */
5872 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5873                                    const u8 *report, size_t report_len)
5874 {
5875         struct wpabuf *neighbor_rep;
5876
5877         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5878         if (report_len < 1)
5879                 return;
5880
5881         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5882                 wpa_printf(MSG_DEBUG,
5883                            "RRM: Discarding neighbor report with token %d (expected %d)",
5884                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5885                 return;
5886         }
5887
5888         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5889                              NULL);
5890
5891         if (!wpa_s->rrm.notify_neighbor_rep) {
5892                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5893                 return;
5894         }
5895
5896         /* skipping the first byte, which is only an id (dialog token) */
5897         neighbor_rep = wpabuf_alloc(report_len - 1);
5898         if (neighbor_rep == NULL)
5899                 return;
5900         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5901         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5902                    report[0]);
5903         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5904                                        neighbor_rep);
5905         wpa_s->rrm.notify_neighbor_rep = NULL;
5906         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5907 }
5908
5909
5910 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5911 /* Workaround different, undefined for Windows, error codes used here */
5912 #define ENOTCONN -1
5913 #define EOPNOTSUPP -1
5914 #define ECANCELED -1
5915 #endif
5916
5917 /**
5918  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5919  * @wpa_s: Pointer to wpa_supplicant
5920  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5921  *        is sent in the request.
5922  * @cb: Callback function to be called once the requested report arrives, or
5923  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5924  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5925  *      the requester's responsibility to free it.
5926  *      In the latter case NULL will be sent in 'neighbor_rep'.
5927  * @cb_ctx: Context value to send the callback function
5928  * Returns: 0 in case of success, negative error code otherwise
5929  *
5930  * In case there is a previous request which has not been answered yet, the
5931  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5932  * Request must contain a callback function.
5933  */
5934 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5935                                        const struct wpa_ssid *ssid,
5936                                        void (*cb)(void *ctx,
5937                                                   struct wpabuf *neighbor_rep),
5938                                        void *cb_ctx)
5939 {
5940         struct wpabuf *buf;
5941         const u8 *rrm_ie;
5942
5943         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5944                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5945                 return -ENOTCONN;
5946         }
5947
5948         if (!wpa_s->rrm.rrm_used) {
5949                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5950                 return -EOPNOTSUPP;
5951         }
5952
5953         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5954                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5955         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5956             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5957                 wpa_printf(MSG_DEBUG,
5958                            "RRM: No network support for Neighbor Report.");
5959                 return -EOPNOTSUPP;
5960         }
5961
5962         if (!cb) {
5963                 wpa_printf(MSG_DEBUG,
5964                            "RRM: Neighbor Report request must provide a callback.");
5965                 return -EINVAL;
5966         }
5967
5968         /* Refuse if there's a live request */
5969         if (wpa_s->rrm.notify_neighbor_rep) {
5970                 wpa_printf(MSG_DEBUG,
5971                            "RRM: Currently handling previous Neighbor Report.");
5972                 return -EBUSY;
5973         }
5974
5975         /* 3 = action category + action code + dialog token */
5976         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5977         if (buf == NULL) {
5978                 wpa_printf(MSG_DEBUG,
5979                            "RRM: Failed to allocate Neighbor Report Request");
5980                 return -ENOMEM;
5981         }
5982
5983         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5984                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5985                    wpa_s->rrm.next_neighbor_rep_token);
5986
5987         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5988         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5989         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5990         if (ssid) {
5991                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5992                 wpabuf_put_u8(buf, ssid->ssid_len);
5993                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5994         }
5995
5996         wpa_s->rrm.next_neighbor_rep_token++;
5997
5998         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5999                                 wpa_s->own_addr, wpa_s->bssid,
6000                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6001                 wpa_printf(MSG_DEBUG,
6002                            "RRM: Failed to send Neighbor Report Request");
6003                 wpabuf_free(buf);
6004                 return -ECANCELED;
6005         }
6006
6007         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6008         wpa_s->rrm.notify_neighbor_rep = cb;
6009         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6010                                wpas_rrm_neighbor_rep_timeout_handler,
6011                                &wpa_s->rrm, NULL);
6012
6013         wpabuf_free(buf);
6014         return 0;
6015 }
6016
6017
6018 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6019                                               const u8 *src,
6020                                               const u8 *frame, size_t len,
6021                                               int rssi)
6022 {
6023         struct wpabuf *buf;
6024         const struct rrm_link_measurement_request *req;
6025         struct rrm_link_measurement_report report;
6026
6027         if (wpa_s->wpa_state != WPA_COMPLETED) {
6028                 wpa_printf(MSG_INFO,
6029                            "RRM: Ignoring link measurement request. Not associated");
6030                 return;
6031         }
6032
6033         if (!wpa_s->rrm.rrm_used) {
6034                 wpa_printf(MSG_INFO,
6035                            "RRM: Ignoring link measurement request. Not RRM network");
6036                 return;
6037         }
6038
6039         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6040                 wpa_printf(MSG_INFO,
6041                            "RRM: Measurement report failed. TX power insertion not supported");
6042                 return;
6043         }
6044
6045         req = (const struct rrm_link_measurement_request *) frame;
6046         if (len < sizeof(*req)) {
6047                 wpa_printf(MSG_INFO,
6048                            "RRM: Link measurement report failed. Request too short");
6049                 return;
6050         }
6051
6052         os_memset(&report, 0, sizeof(report));
6053         report.tpc.eid = WLAN_EID_TPC_REPORT;
6054         report.tpc.len = 2;
6055         report.rsni = 255; /* 255 indicates that RSNI is not available */
6056         report.dialog_token = req->dialog_token;
6057
6058         /*
6059          * It's possible to estimate RCPI based on RSSI in dBm. This
6060          * calculation will not reflect the correct value for high rates,
6061          * but it's good enough for Action frames which are transmitted
6062          * with up to 24 Mbps rates.
6063          */
6064         if (!rssi)
6065                 report.rcpi = 255; /* not available */
6066         else if (rssi < -110)
6067                 report.rcpi = 0;
6068         else if (rssi > 0)
6069                 report.rcpi = 220;
6070         else
6071                 report.rcpi = (rssi + 110) * 2;
6072
6073         /* action_category + action_code */
6074         buf = wpabuf_alloc(2 + sizeof(report));
6075         if (buf == NULL) {
6076                 wpa_printf(MSG_ERROR,
6077                            "RRM: Link measurement report failed. Buffer allocation failed");
6078                 return;
6079         }
6080
6081         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6082         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6083         wpabuf_put_data(buf, &report, sizeof(report));
6084         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6085                     wpabuf_head(buf), wpabuf_len(buf));
6086
6087         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6088                                 wpa_s->own_addr, wpa_s->bssid,
6089                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6090                 wpa_printf(MSG_ERROR,
6091                            "RRM: Link measurement report failed. Send action failed");
6092         }
6093         wpabuf_free(buf);
6094 }