wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         wpas_wps_deinit(wpa_s);
 460
 461         wpabuf_free(wpa_s->pending_eapol_rx);
 462         wpa_s->pending_eapol_rx = NULL;
 463
 464 #ifdef CONFIG_IBSS_RSN
 465         ibss_rsn_deinit(wpa_s->ibss_rsn);
 466         wpa_s->ibss_rsn = NULL;
 467 #endif /* CONFIG_IBSS_RSN */
 468
 469         sme_deinit(wpa_s);
 470
 471 #ifdef CONFIG_AP
 472         wpa_supplicant_ap_deinit(wpa_s);
 473 #endif /* CONFIG_AP */
 474
 475         wpas_p2p_deinit(wpa_s);
 476
 477 #ifdef CONFIG_OFFCHANNEL
 478         offchannel_deinit(wpa_s);
 479 #endif /* CONFIG_OFFCHANNEL */
 480
 481         wpa_supplicant_cancel_sched_scan(wpa_s);
 482
 483         os_free(wpa_s->next_scan_freqs);
 484         wpa_s->next_scan_freqs = NULL;
 485
 486         os_free(wpa_s->manual_scan_freqs);
 487         wpa_s->manual_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_sched_scan_freqs);
 490         wpa_s->manual_sched_scan_freqs = NULL;
 491
 492         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 493
 494         gas_query_deinit(wpa_s->gas);
 495         wpa_s->gas = NULL;
 496
 497         free_hw_features(wpa_s);
 498
 499         ieee802_1x_dealloc_kay_sm(wpa_s);
 500
 501         os_free(wpa_s->bssid_filter);
 502         wpa_s->bssid_filter = NULL;
 503
 504         os_free(wpa_s->disallow_aps_bssid);
 505         wpa_s->disallow_aps_bssid = NULL;
 506         os_free(wpa_s->disallow_aps_ssid);
 507         wpa_s->disallow_aps_ssid = NULL;
 508
 509         wnm_bss_keep_alive_deinit(wpa_s);
 510 #ifdef CONFIG_WNM
 511         wnm_deallocate_memory(wpa_s);
 512 #endif /* CONFIG_WNM */
 513
 514         ext_password_deinit(wpa_s->ext_pw);
 515         wpa_s->ext_pw = NULL;
 516
 517         wpabuf_free(wpa_s->last_gas_resp);
 518         wpa_s->last_gas_resp = NULL;
 519         wpabuf_free(wpa_s->prev_gas_resp);
 520         wpa_s->prev_gas_resp = NULL;
 521
 522         os_free(wpa_s->last_scan_res);
 523         wpa_s->last_scan_res = NULL;
 524
 525 #ifdef CONFIG_HS20
 526         hs20_deinit(wpa_s);
 527 #endif /* CONFIG_HS20 */
 528
 529         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 530                 wpabuf_free(wpa_s->vendor_elem[i]);
 531                 wpa_s->vendor_elem[i] = NULL;
 532         }
 533
 534         wmm_ac_notify_disassoc(wpa_s);
 535 }
 536
 537
 538 /**
 539  * wpa_clear_keys - Clear keys configured for the driver
 540  * @wpa_s: Pointer to wpa_supplicant data
 541  * @addr: Previously used BSSID or %NULL if not available
 542  *
 543  * This function clears the encryption keys that has been previously configured
 544  * for the driver.
 545  */
 546 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 547 {
 548         int i, max;
 549
 550 #ifdef CONFIG_IEEE80211W
 551         max = 6;
 552 #else /* CONFIG_IEEE80211W */
 553         max = 4;
 554 #endif /* CONFIG_IEEE80211W */
 555
 556         /* MLME-DELETEKEYS.request */
 557         for (i = 0; i < max; i++) {
 558                 if (wpa_s->keys_cleared & BIT(i))
 559                         continue;
 560                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 561                                 NULL, 0);
 562         }
 563         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 564             !is_zero_ether_addr(addr)) {
 565                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 566                                 0);
 567                 /* MLME-SETPROTECTION.request(None) */
 568                 wpa_drv_mlme_setprotection(
 569                         wpa_s, addr,
 570                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 571                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 572         }
 573         wpa_s->keys_cleared = (u32) -1;
 574 }
 575
 576
 577 /**
 578  * wpa_supplicant_state_txt - Get the connection state name as a text string
 579  * @state: State (wpa_state; WPA_*)
 580  * Returns: The state name as a printable text string
 581  */
 582 const char * wpa_supplicant_state_txt(enum wpa_states state)
 583 {
 584         switch (state) {
 585         case WPA_DISCONNECTED:
 586                 return "DISCONNECTED";
 587         case WPA_INACTIVE:
 588                 return "INACTIVE";
 589         case WPA_INTERFACE_DISABLED:
 590                 return "INTERFACE_DISABLED";
 591         case WPA_SCANNING:
 592                 return "SCANNING";
 593         case WPA_AUTHENTICATING:
 594                 return "AUTHENTICATING";
 595         case WPA_ASSOCIATING:
 596                 return "ASSOCIATING";
 597         case WPA_ASSOCIATED:
 598                 return "ASSOCIATED";
 599         case WPA_4WAY_HANDSHAKE:
 600                 return "4WAY_HANDSHAKE";
 601         case WPA_GROUP_HANDSHAKE:
 602                 return "GROUP_HANDSHAKE";
 603         case WPA_COMPLETED:
 604                 return "COMPLETED";
 605         default:
 606                 return "UNKNOWN";
 607         }
 608 }
 609
 610
 611 #ifdef CONFIG_BGSCAN
 612
 613 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 614 {
 615         const char *name;
 616
 617         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 618                 name = wpa_s->current_ssid->bgscan;
 619         else
 620                 name = wpa_s->conf->bgscan;
 621         if (name == NULL || name[0] == '\0')
 622                 return;
 623         if (wpas_driver_bss_selection(wpa_s))
 624                 return;
 625         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 626                 return;
 627 #ifdef CONFIG_P2P
 628         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 629                 return;
 630 #endif /* CONFIG_P2P */
 631
 632         bgscan_deinit(wpa_s);
 633         if (wpa_s->current_ssid) {
 634                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 635                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 636                                 "bgscan");
 637                         /*
 638                          * Live without bgscan; it is only used as a roaming
 639                          * optimization, so the initial connection is not
 640                          * affected.
 641                          */
 642                 } else {
 643                         struct wpa_scan_results *scan_res;
 644                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 645                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 646                                                                    0);
 647                         if (scan_res) {
 648                                 bgscan_notify_scan(wpa_s, scan_res);
 649                                 wpa_scan_results_free(scan_res);
 650                         }
 651                 }
 652         } else
 653                 wpa_s->bgscan_ssid = NULL;
 654 }
 655
 656
 657 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 658 {
 659         if (wpa_s->bgscan_ssid != NULL) {
 660                 bgscan_deinit(wpa_s);
 661                 wpa_s->bgscan_ssid = NULL;
 662         }
 663 }
 664
 665 #endif /* CONFIG_BGSCAN */
 666
 667
 668 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 669 {
 670         if (autoscan_init(wpa_s, 0))
 671                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 672 }
 673
 674
 675 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 676 {
 677         autoscan_deinit(wpa_s);
 678 }
 679
 680
 681 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 684             wpa_s->wpa_state == WPA_SCANNING) {
 685                 autoscan_deinit(wpa_s);
 686                 wpa_supplicant_start_autoscan(wpa_s);
 687         }
 688 }
 689
 690
 691 /**
 692  * wpa_supplicant_set_state - Set current connection state
 693  * @wpa_s: Pointer to wpa_supplicant data
 694  * @state: The new connection state
 695  *
 696  * This function is called whenever the connection state changes, e.g.,
 697  * association is completed for WPA/WPA2 4-Way Handshake is started.
 698  */
 699 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 700                               enum wpa_states state)
 701 {
 702         enum wpa_states old_state = wpa_s->wpa_state;
 703
 704         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 705                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 706                 wpa_supplicant_state_txt(state));
 707
 708         if (state == WPA_INTERFACE_DISABLED) {
 709                 /* Assure normal scan when interface is restored */
 710                 wpa_s->normal_scans = 0;
 711         }
 712
 713         if (state == WPA_COMPLETED) {
 714                 wpas_connect_work_done(wpa_s);
 715                 /* Reinitialize normal_scan counter */
 716                 wpa_s->normal_scans = 0;
 717         }
 718
 719         if (state != WPA_SCANNING)
 720                 wpa_supplicant_notify_scanning(wpa_s, 0);
 721
 722         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 723                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 724 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 725                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 726                         MACSTR " completed [id=%d id_str=%s]",
 727                         MAC2STR(wpa_s->bssid),
 728                         ssid ? ssid->id : -1,
 729                         ssid && ssid->id_str ? ssid->id_str : "");
 730 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 731                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 732                 wpa_s->extra_blacklist_count = 0;
 733                 wpa_s->new_connection = 0;
 734                 wpa_drv_set_operstate(wpa_s, 1);
 735 #ifndef IEEE8021X_EAPOL
 736                 wpa_drv_set_supp_port(wpa_s, 1);
 737 #endif /* IEEE8021X_EAPOL */
 738                 wpa_s->after_wps = 0;
 739                 wpa_s->known_wps_freq = 0;
 740                 wpas_p2p_completed(wpa_s);
 741
 742                 sme_sched_obss_scan(wpa_s, 1);
 743         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 744                    state == WPA_ASSOCIATED) {
 745                 wpa_s->new_connection = 1;
 746                 wpa_drv_set_operstate(wpa_s, 0);
 747 #ifndef IEEE8021X_EAPOL
 748                 wpa_drv_set_supp_port(wpa_s, 0);
 749 #endif /* IEEE8021X_EAPOL */
 750                 sme_sched_obss_scan(wpa_s, 0);
 751         }
 752         wpa_s->wpa_state = state;
 753
 754 #ifdef CONFIG_BGSCAN
 755         if (state == WPA_COMPLETED)
 756                 wpa_supplicant_start_bgscan(wpa_s);
 757         else if (state < WPA_ASSOCIATED)
 758                 wpa_supplicant_stop_bgscan(wpa_s);
 759 #endif /* CONFIG_BGSCAN */
 760
 761         if (state == WPA_AUTHENTICATING)
 762                 wpa_supplicant_stop_autoscan(wpa_s);
 763
 764         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 765                 wpa_supplicant_start_autoscan(wpa_s);
 766
 767         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 768                 wmm_ac_notify_disassoc(wpa_s);
 769
 770         if (wpa_s->wpa_state != old_state) {
 771                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 772
 773                 /*
 774                  * Notify the P2P Device interface about a state change in one
 775                  * of the interfaces.
 776                  */
 777                 wpas_p2p_indicate_state_change(wpa_s);
 778
 779                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 780                     old_state == WPA_COMPLETED)
 781                         wpas_notify_auth_changed(wpa_s);
 782         }
 783 }
 784
 785
 786 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 787 {
 788         int pending = 0;
 789 #ifdef CONFIG_WPS
 790         struct wpa_supplicant *wpa_s = global->ifaces;
 791         while (wpa_s) {
 792                 struct wpa_supplicant *next = wpa_s->next;
 793                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 794                         pending = 1;
 795 #ifdef CONFIG_P2P
 796                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 797                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 798                         wpas_p2p_disconnect(wpa_s);
 799 #endif /* CONFIG_P2P */
 800                 wpa_s = next;
 801         }
 802 #endif /* CONFIG_WPS */
 803         if (pending)
 804                 return;
 805         eloop_terminate();
 806 }
 807
 808
 809 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 810 {
 811         struct wpa_global *global = signal_ctx;
 812         wpa_supplicant_terminate_proc(global);
 813 }
 814
 815
 816 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 817 {
 818         enum wpa_states old_state = wpa_s->wpa_state;
 819
 820         wpa_s->pairwise_cipher = 0;
 821         wpa_s->group_cipher = 0;
 822         wpa_s->mgmt_group_cipher = 0;
 823         wpa_s->key_mgmt = 0;
 824         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 825                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 826
 827         if (wpa_s->wpa_state != old_state)
 828                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 829 }
 830
 831
 832 /**
 833  * wpa_supplicant_reload_configuration - Reload configuration data
 834  * @wpa_s: Pointer to wpa_supplicant data
 835  * Returns: 0 on success or -1 if configuration parsing failed
 836  *
 837  * This function can be used to request that the configuration data is reloaded
 838  * (e.g., after configuration file change). This function is reloading
 839  * configuration only for one interface, so this may need to be called multiple
 840  * times if %wpa_supplicant is controlling multiple interfaces and all
 841  * interfaces need reconfiguration.
 842  */
 843 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 844 {
 845         struct wpa_config *conf;
 846         int reconf_ctrl;
 847         int old_ap_scan;
 848
 849         if (wpa_s->confname == NULL)
 850                 return -1;
 851         conf = wpa_config_read(wpa_s->confname, NULL);
 852         if (conf == NULL) {
 853                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 854                         "file '%s' - exiting", wpa_s->confname);
 855                 return -1;
 856         }
 857         wpa_config_read(wpa_s->confanother, conf);
 858
 859         conf->changed_parameters = (unsigned int) -1;
 860
 861         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 862                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 863                     os_strcmp(conf->ctrl_interface,
 864                               wpa_s->conf->ctrl_interface) != 0);
 865
 866         if (reconf_ctrl && wpa_s->ctrl_iface) {
 867                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 868                 wpa_s->ctrl_iface = NULL;
 869         }
 870
 871         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 872         if (wpa_s->current_ssid) {
 873                 wpa_supplicant_deauthenticate(wpa_s,
 874                                               WLAN_REASON_DEAUTH_LEAVING);
 875         }
 876
 877         /*
 878          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 879          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 880          */
 881         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 882                 /*
 883                  * Clear forced success to clear EAP state for next
 884                  * authentication.
 885                  */
 886                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 887         }
 888         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 889         wpa_sm_set_config(wpa_s->wpa, NULL);
 890         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 891         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 892         rsn_preauth_deinit(wpa_s->wpa);
 893
 894         old_ap_scan = wpa_s->conf->ap_scan;
 895         wpa_config_free(wpa_s->conf);
 896         wpa_s->conf = conf;
 897         if (old_ap_scan != wpa_s->conf->ap_scan)
 898                 wpas_notify_ap_scan_changed(wpa_s);
 899
 900         if (reconf_ctrl)
 901                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 902
 903         wpa_supplicant_update_config(wpa_s);
 904
 905         wpa_supplicant_clear_status(wpa_s);
 906         if (wpa_supplicant_enabled_networks(wpa_s)) {
 907                 wpa_s->reassociate = 1;
 908                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 909         }
 910         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 911         return 0;
 912 }
 913
 914
 915 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 916 {
 917         struct wpa_global *global = signal_ctx;
 918         struct wpa_supplicant *wpa_s;
 919         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 920                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 921                         sig);
 922                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 923                         wpa_supplicant_terminate_proc(global);
 924                 }
 925         }
 926 }
 927
 928
 929 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 930                                          struct wpa_ssid *ssid,
 931                                          struct wpa_ie_data *ie)
 932 {
 933         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 934         if (ret) {
 935                 if (ret == -2) {
 936                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 937                                 "from association info");
 938                 }
 939                 return -1;
 940         }
 941
 942         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 943                 "cipher suites");
 944         if (!(ie->group_cipher & ssid->group_cipher)) {
 945                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 946                         "cipher 0x%x (mask 0x%x) - reject",
 947                         ie->group_cipher, ssid->group_cipher);
 948                 return -1;
 949         }
 950         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 951                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 952                         "cipher 0x%x (mask 0x%x) - reject",
 953                         ie->pairwise_cipher, ssid->pairwise_cipher);
 954                 return -1;
 955         }
 956         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 957                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 958                         "management 0x%x (mask 0x%x) - reject",
 959                         ie->key_mgmt, ssid->key_mgmt);
 960                 return -1;
 961         }
 962
 963 #ifdef CONFIG_IEEE80211W
 964         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 965             (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
 966              wpa_s->conf->pmf : ssid->ieee80211w) ==
 967             MGMT_FRAME_PROTECTION_REQUIRED) {
 968                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 969                         "that does not support management frame protection - "
 970                         "reject");
 971                 return -1;
 972         }
 973 #endif /* CONFIG_IEEE80211W */
 974
 975         return 0;
 976 }
 977
 978
 979 /**
 980  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 981  * @wpa_s: Pointer to wpa_supplicant data
 982  * @bss: Scan results for the selected BSS, or %NULL if not available
 983  * @ssid: Configuration data for the selected network
 984  * @wpa_ie: Buffer for the WPA/RSN IE
 985  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 986  * used buffer length in case the functions returns success.
 987  * Returns: 0 on success or -1 on failure
 988  *
 989  * This function is used to configure authentication and encryption parameters
 990  * based on the network configuration and scan result for the selected BSS (if
 991  * available).
 992  */
 993 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 994                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 995                               u8 *wpa_ie, size_t *wpa_ie_len)
 996 {
 997         struct wpa_ie_data ie;
 998         int sel, proto;
 999         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1000
1001         if (bss) {
1002                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1003                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1004                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1005         } else
1006                 bss_wpa = bss_rsn = bss_osen = NULL;
1007
1008         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1009             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1010             (ie.group_cipher & ssid->group_cipher) &&
1011             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1012             (ie.key_mgmt & ssid->key_mgmt)) {
1013                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1014                 proto = WPA_PROTO_RSN;
1015         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1016                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1017                    (ie.group_cipher & ssid->group_cipher) &&
1018                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1019                    (ie.key_mgmt & ssid->key_mgmt)) {
1020                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1021                 proto = WPA_PROTO_WPA;
1022 #ifdef CONFIG_HS20
1023         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1024                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1025                 /* TODO: parse OSEN element */
1026                 os_memset(&ie, 0, sizeof(ie));
1027                 ie.group_cipher = WPA_CIPHER_CCMP;
1028                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1029                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1030                 proto = WPA_PROTO_OSEN;
1031 #endif /* CONFIG_HS20 */
1032         } else if (bss) {
1033                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1034                 wpa_dbg(wpa_s, MSG_DEBUG,
1035                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1036                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1037                         ssid->key_mgmt);
1038                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1039                         MAC2STR(bss->bssid),
1040                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1041                         bss_wpa ? " WPA" : "",
1042                         bss_rsn ? " RSN" : "",
1043                         bss_osen ? " OSEN" : "");
1044                 if (bss_rsn) {
1045                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1046                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1047                                 wpa_dbg(wpa_s, MSG_DEBUG,
1048                                         "Could not parse RSN element");
1049                         } else {
1050                                 wpa_dbg(wpa_s, MSG_DEBUG,
1051                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1052                                         ie.pairwise_cipher, ie.group_cipher,
1053                                         ie.key_mgmt);
1054                         }
1055                 }
1056                 if (bss_wpa) {
1057                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1058                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1059                                 wpa_dbg(wpa_s, MSG_DEBUG,
1060                                         "Could not parse WPA element");
1061                         } else {
1062                                 wpa_dbg(wpa_s, MSG_DEBUG,
1063                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1064                                         ie.pairwise_cipher, ie.group_cipher,
1065                                         ie.key_mgmt);
1066                         }
1067                 }
1068                 return -1;
1069         } else {
1070                 if (ssid->proto & WPA_PROTO_OSEN)
1071                         proto = WPA_PROTO_OSEN;
1072                 else if (ssid->proto & WPA_PROTO_RSN)
1073                         proto = WPA_PROTO_RSN;
1074                 else
1075                         proto = WPA_PROTO_WPA;
1076                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1077                         os_memset(&ie, 0, sizeof(ie));
1078                         ie.group_cipher = ssid->group_cipher;
1079                         ie.pairwise_cipher = ssid->pairwise_cipher;
1080                         ie.key_mgmt = ssid->key_mgmt;
1081 #ifdef CONFIG_IEEE80211W
1082                         ie.mgmt_group_cipher =
1083                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1084                                 WPA_CIPHER_AES_128_CMAC : 0;
1085 #endif /* CONFIG_IEEE80211W */
1086                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1087                                 "based on configuration");
1088                 } else
1089                         proto = ie.proto;
1090         }
1091
1092         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1093                 "pairwise %d key_mgmt %d proto %d",
1094                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1095 #ifdef CONFIG_IEEE80211W
1096         if (ssid->ieee80211w) {
1097                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1098                         ie.mgmt_group_cipher);
1099         }
1100 #endif /* CONFIG_IEEE80211W */
1101
1102         wpa_s->wpa_proto = proto;
1103         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1104         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1105                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1106
1107         if (bss || !wpa_s->ap_ies_from_associnfo) {
1108                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1109                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1110                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1111                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1112                         return -1;
1113         }
1114
1115         sel = ie.group_cipher & ssid->group_cipher;
1116         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1117         if (wpa_s->group_cipher < 0) {
1118                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1119                         "cipher");
1120                 return -1;
1121         }
1122         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1123                 wpa_cipher_txt(wpa_s->group_cipher));
1124
1125         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1126         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1127         if (wpa_s->pairwise_cipher < 0) {
1128                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1129                         "cipher");
1130                 return -1;
1131         }
1132         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1133                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1134
1135         sel = ie.key_mgmt & ssid->key_mgmt;
1136 #ifdef CONFIG_SAE
1137         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1138                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1139 #endif /* CONFIG_SAE */
1140         if (0) {
1141         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1142                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1143                 wpa_dbg(wpa_s, MSG_DEBUG,
1144                         "WPA: using KEY_MGMT 802.1X with Suite B");
1145 #ifdef CONFIG_IEEE80211R
1146         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1147                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1148                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1149         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1150                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1151                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1152 #endif /* CONFIG_IEEE80211R */
1153 #ifdef CONFIG_SAE
1154         } else if (sel & WPA_KEY_MGMT_SAE) {
1155                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1156                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1157         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1158                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1159                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1160 #endif /* CONFIG_SAE */
1161 #ifdef CONFIG_IEEE80211W
1162         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1163                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1164                 wpa_dbg(wpa_s, MSG_DEBUG,
1165                         "WPA: using KEY_MGMT 802.1X with SHA256");
1166         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1167                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1168                 wpa_dbg(wpa_s, MSG_DEBUG,
1169                         "WPA: using KEY_MGMT PSK with SHA256");
1170 #endif /* CONFIG_IEEE80211W */
1171         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1172                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1173                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1174         } else if (sel & WPA_KEY_MGMT_PSK) {
1175                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1176                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1177         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1178                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1179                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1180 #ifdef CONFIG_HS20
1181         } else if (sel & WPA_KEY_MGMT_OSEN) {
1182                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1183                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1184 #endif /* CONFIG_HS20 */
1185         } else {
1186                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1187                         "authenticated key management type");
1188                 return -1;
1189         }
1190
1191         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1192         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1193                          wpa_s->pairwise_cipher);
1194         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1195
1196 #ifdef CONFIG_IEEE80211W
1197         sel = ie.mgmt_group_cipher;
1198         if ((ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1199              wpa_s->conf->pmf : ssid->ieee80211w) == NO_MGMT_FRAME_PROTECTION ||
1200             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1201                 sel = 0;
1202         if (sel & WPA_CIPHER_AES_128_CMAC) {
1203                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1204                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1205                         "AES-128-CMAC");
1206         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1207                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1208                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1209                         "BIP-GMAC-128");
1210         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1211                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1212                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1213                         "BIP-GMAC-256");
1214         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1215                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1216                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1217                         "BIP-CMAC-256");
1218         } else {
1219                 wpa_s->mgmt_group_cipher = 0;
1220                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1221         }
1222         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1223                          wpa_s->mgmt_group_cipher);
1224         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1225                          (ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
1226                           wpa_s->conf->pmf : ssid->ieee80211w));
1227 #endif /* CONFIG_IEEE80211W */
1228
1229         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1230                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1231                 return -1;
1232         }
1233
1234         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1235                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1236 #ifndef CONFIG_NO_PBKDF2
1237                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1238                     ssid->passphrase) {
1239                         u8 psk[PMK_LEN];
1240                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1241                                     4096, psk, PMK_LEN);
1242                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1243                                         psk, PMK_LEN);
1244                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1245                         os_memset(psk, 0, sizeof(psk));
1246                 }
1247 #endif /* CONFIG_NO_PBKDF2 */
1248 #ifdef CONFIG_EXT_PASSWORD
1249                 if (ssid->ext_psk) {
1250                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1251                                                              ssid->ext_psk);
1252                         char pw_str[64 + 1];
1253                         u8 psk[PMK_LEN];
1254
1255                         if (pw == NULL) {
1256                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1257                                         "found from external storage");
1258                                 return -1;
1259                         }
1260
1261                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1262                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1263                                         "PSK length %d in external storage",
1264                                         (int) wpabuf_len(pw));
1265                                 ext_password_free(pw);
1266                                 return -1;
1267                         }
1268
1269                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1270                         pw_str[wpabuf_len(pw)] = '\0';
1271
1272 #ifndef CONFIG_NO_PBKDF2
1273                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1274                         {
1275                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1276                                             4096, psk, PMK_LEN);
1277                                 os_memset(pw_str, 0, sizeof(pw_str));
1278                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1279                                                 "external passphrase)",
1280                                                 psk, PMK_LEN);
1281                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1282                                 os_memset(psk, 0, sizeof(psk));
1283                         } else
1284 #endif /* CONFIG_NO_PBKDF2 */
1285                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1286                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1287                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1288                                                 "Invalid PSK hex string");
1289                                         os_memset(pw_str, 0, sizeof(pw_str));
1290                                         ext_password_free(pw);
1291                                         return -1;
1292                                 }
1293                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1294                                 os_memset(psk, 0, sizeof(psk));
1295                         } else {
1296                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1297                                         "PSK available");
1298                                 os_memset(pw_str, 0, sizeof(pw_str));
1299                                 ext_password_free(pw);
1300                                 return -1;
1301                         }
1302
1303                         os_memset(pw_str, 0, sizeof(pw_str));
1304                         ext_password_free(pw);
1305                 }
1306 #endif /* CONFIG_EXT_PASSWORD */
1307         } else
1308                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1309
1310         return 0;
1311 }
1312
1313
1314 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1315 {
1316         *pos = 0x00;
1317
1318         switch (idx) {
1319         case 0: /* Bits 0-7 */
1320                 break;
1321         case 1: /* Bits 8-15 */
1322                 break;
1323         case 2: /* Bits 16-23 */
1324 #ifdef CONFIG_WNM
1325                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1326                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1327 #endif /* CONFIG_WNM */
1328                 break;
1329         case 3: /* Bits 24-31 */
1330 #ifdef CONFIG_WNM
1331                 *pos |= 0x02; /* Bit 25 - SSID List */
1332 #endif /* CONFIG_WNM */
1333 #ifdef CONFIG_INTERWORKING
1334                 if (wpa_s->conf->interworking)
1335                         *pos |= 0x80; /* Bit 31 - Interworking */
1336 #endif /* CONFIG_INTERWORKING */
1337                 break;
1338         case 4: /* Bits 32-39 */
1339 #ifdef CONFIG_INTERWORKING
1340                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1341                         *pos |= 0x01; /* Bit 32 - QoS Map */
1342 #endif /* CONFIG_INTERWORKING */
1343                 break;
1344         case 5: /* Bits 40-47 */
1345 #ifdef CONFIG_HS20
1346                 if (wpa_s->conf->hs20)
1347                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1348 #endif /* CONFIG_HS20 */
1349                 break;
1350         case 6: /* Bits 48-55 */
1351                 break;
1352         }
1353 }
1354
1355
1356 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1357 {
1358         u8 *pos = buf;
1359         u8 len = 6, i;
1360
1361         if (len < wpa_s->extended_capa_len)
1362                 len = wpa_s->extended_capa_len;
1363         if (buflen < (size_t) len + 2) {
1364                 wpa_printf(MSG_INFO,
1365                            "Not enough room for building extended capabilities element");
1366                 return -1;
1367         }
1368
1369         *pos++ = WLAN_EID_EXT_CAPAB;
1370         *pos++ = len;
1371         for (i = 0; i < len; i++, pos++) {
1372                 wpas_ext_capab_byte(wpa_s, pos, i);
1373
1374                 if (i < wpa_s->extended_capa_len) {
1375                         *pos &= ~wpa_s->extended_capa_mask[i];
1376                         *pos |= wpa_s->extended_capa[i];
1377                 }
1378         }
1379
1380         while (len > 0 && buf[1 + len] == 0) {
1381                 len--;
1382                 buf[1] = len;
1383         }
1384         if (len == 0)
1385                 return 0;
1386
1387         return 2 + len;
1388 }
1389
1390
1391 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1392                           struct wpa_bss *test_bss)
1393 {
1394         struct wpa_bss *bss;
1395
1396         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1397                 if (bss == test_bss)
1398                         return 1;
1399         }
1400
1401         return 0;
1402 }
1403
1404
1405 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1406                            struct wpa_ssid *test_ssid)
1407 {
1408         struct wpa_ssid *ssid;
1409
1410         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1411                 if (ssid == test_ssid)
1412                         return 1;
1413         }
1414
1415         return 0;
1416 }
1417
1418
1419 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1420                         struct wpa_ssid *test_ssid)
1421 {
1422         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1423                 return 0;
1424
1425         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1426 }
1427
1428
1429 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1430 {
1431         if (cwork == NULL)
1432                 return;
1433         os_free(cwork);
1434 }
1435
1436
1437 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1438 {
1439         struct wpa_connect_work *cwork;
1440         struct wpa_radio_work *work = wpa_s->connect_work;
1441
1442         if (!work)
1443                 return;
1444
1445         wpa_s->connect_work = NULL;
1446         cwork = work->ctx;
1447         work->ctx = NULL;
1448         wpas_connect_work_free(cwork);
1449         radio_work_done(work);
1450 }
1451
1452
1453 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1454 {
1455         struct os_reltime now;
1456         u8 addr[ETH_ALEN];
1457
1458         os_get_reltime(&now);
1459         if (wpa_s->last_mac_addr_style == style &&
1460             wpa_s->last_mac_addr_change.sec != 0 &&
1461             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1462                                 wpa_s->conf->rand_addr_lifetime)) {
1463                 wpa_msg(wpa_s, MSG_DEBUG,
1464                         "Previously selected random MAC address has not yet expired");
1465                 return 0;
1466         }
1467
1468         switch (style) {
1469         case 1:
1470                 if (random_mac_addr(addr) < 0)
1471                         return -1;
1472                 break;
1473         case 2:
1474                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1475                 if (random_mac_addr_keep_oui(addr) < 0)
1476                         return -1;
1477                 break;
1478         default:
1479                 return -1;
1480         }
1481
1482         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1483                 wpa_msg(wpa_s, MSG_INFO,
1484                         "Failed to set random MAC address");
1485                 return -1;
1486         }
1487
1488         os_get_reltime(&wpa_s->last_mac_addr_change);
1489         wpa_s->mac_addr_changed = 1;
1490         wpa_s->last_mac_addr_style = style;
1491
1492         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1493                 wpa_msg(wpa_s, MSG_INFO,
1494                         "Could not update MAC address information");
1495                 return -1;
1496         }
1497
1498         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1499                 MAC2STR(addr));
1500
1501         return 0;
1502 }
1503
1504
1505 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1506 {
1507         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1508             !wpa_s->conf->preassoc_mac_addr)
1509                 return 0;
1510
1511         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1512 }
1513
1514
1515 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1516
1517 /**
1518  * wpa_supplicant_associate - Request association
1519  * @wpa_s: Pointer to wpa_supplicant data
1520  * @bss: Scan results for the selected BSS, or %NULL if not available
1521  * @ssid: Configuration data for the selected network
1522  *
1523  * This function is used to request %wpa_supplicant to associate with a BSS.
1524  */
1525 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1526                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1527 {
1528         struct wpa_connect_work *cwork;
1529         int rand_style;
1530
1531         if (ssid->mac_addr == -1)
1532                 rand_style = wpa_s->conf->mac_addr;
1533         else
1534                 rand_style = ssid->mac_addr;
1535
1536         wmm_ac_clear_saved_tspecs(wpa_s);
1537         wpa_s->reassoc_same_bss = 0;
1538
1539         if (wpa_s->last_ssid == ssid) {
1540                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1541                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1542                         wmm_ac_save_tspecs(wpa_s);
1543                         wpa_s->reassoc_same_bss = 1;
1544                 }
1545         } else if (rand_style > 0) {
1546                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1547                         return;
1548                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1549         } else if (wpa_s->mac_addr_changed) {
1550                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1551                         wpa_msg(wpa_s, MSG_INFO,
1552                                 "Could not restore permanent MAC address");
1553                         return;
1554                 }
1555                 wpa_s->mac_addr_changed = 0;
1556                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1557                         wpa_msg(wpa_s, MSG_INFO,
1558                                 "Could not update MAC address information");
1559                         return;
1560                 }
1561                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1562         }
1563         wpa_s->last_ssid = ssid;
1564
1565 #ifdef CONFIG_IBSS_RSN
1566         ibss_rsn_deinit(wpa_s->ibss_rsn);
1567         wpa_s->ibss_rsn = NULL;
1568 #endif /* CONFIG_IBSS_RSN */
1569
1570         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1571             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1572 #ifdef CONFIG_AP
1573                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1574                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1575                                 "mode");
1576                         return;
1577                 }
1578                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1579                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1580                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1581                                 wpas_p2p_ap_setup_failed(wpa_s);
1582                         return;
1583                 }
1584                 wpa_s->current_bss = bss;
1585 #else /* CONFIG_AP */
1586                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1587                         "the build");
1588 #endif /* CONFIG_AP */
1589                 return;
1590         }
1591
1592         if (ssid->mode == WPAS_MODE_MESH) {
1593 #ifdef CONFIG_MESH
1594                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1595                         wpa_msg(wpa_s, MSG_INFO,
1596                                 "Driver does not support mesh mode");
1597                         return;
1598                 }
1599                 if (bss)
1600                         ssid->frequency = bss->freq;
1601                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1602                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1603                         return;
1604                 }
1605                 wpa_s->current_bss = bss;
1606                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1607                              "ssid=\"%s\" id=%d",
1608                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1609                              ssid->id);
1610 #else /* CONFIG_MESH */
1611                 wpa_msg(wpa_s, MSG_ERROR,
1612                         "mesh mode support not included in the build");
1613 #endif /* CONFIG_MESH */
1614                 return;
1615         }
1616
1617 #ifdef CONFIG_TDLS
1618         if (bss)
1619                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1620                                 bss->ie_len);
1621 #endif /* CONFIG_TDLS */
1622
1623         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1624             ssid->mode == IEEE80211_MODE_INFRA) {
1625                 sme_authenticate(wpa_s, bss, ssid);
1626                 return;
1627         }
1628
1629         if (wpa_s->connect_work) {
1630                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1631                 return;
1632         }
1633
1634         if (radio_work_pending(wpa_s, "connect")) {
1635                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1636                 return;
1637         }
1638
1639         cwork = os_zalloc(sizeof(*cwork));
1640         if (cwork == NULL)
1641                 return;
1642
1643         cwork->bss = bss;
1644         cwork->ssid = ssid;
1645
1646         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1647                            wpas_start_assoc_cb, cwork) < 0) {
1648                 os_free(cwork);
1649         }
1650 }
1651
1652
1653 static void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1654                                  const struct wpa_ssid *ssid,
1655                                  struct hostapd_freq_params *freq)
1656 {
1657         enum hostapd_hw_mode hw_mode;
1658         struct hostapd_hw_modes *mode = NULL;
1659         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1660                            184, 192 };
1661         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1662         u8 channel;
1663         int i, chan_idx, ht40 = -1, res;
1664         unsigned int j;
1665
1666         freq->freq = ssid->frequency;
1667
1668         /* For IBSS check HT_IBSS flag */
1669         if (ssid->mode == WPAS_MODE_IBSS &&
1670             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1671                 return;
1672
1673         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1674         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1675                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1676                         mode = &wpa_s->hw.modes[i];
1677                         break;
1678                 }
1679         }
1680
1681         if (!mode)
1682                 return;
1683
1684         freq->ht_enabled = ht_supported(mode);
1685         if (!freq->ht_enabled)
1686                 return;
1687
1688         /* Setup higher BW only for 5 GHz */
1689         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1690                 return;
1691
1692         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1693                 pri_chan = &mode->channels[chan_idx];
1694                 if (pri_chan->chan == channel)
1695                         break;
1696                 pri_chan = NULL;
1697         }
1698         if (!pri_chan)
1699                 return;
1700
1701         /* Check primary channel flags */
1702         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1703                 return;
1704
1705         /* Check/setup HT40+/HT40- */
1706         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1707                 if (ht40plus[j] == channel) {
1708                         ht40 = 1;
1709                         break;
1710                 }
1711         }
1712
1713         /* Find secondary channel */
1714         for (i = 0; i < mode->num_channels; i++) {
1715                 sec_chan = &mode->channels[i];
1716                 if (sec_chan->chan == channel + ht40 * 4)
1717                         break;
1718                 sec_chan = NULL;
1719         }
1720         if (!sec_chan)
1721                 return;
1722
1723         /* Check secondary channel flags */
1724         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1725                 return;
1726
1727         freq->channel = pri_chan->chan;
1728
1729         switch (ht40) {
1730         case -1:
1731                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1732                         return;
1733                 freq->sec_channel_offset = -1;
1734                 break;
1735         case 1:
1736                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1737                         return;
1738                 freq->sec_channel_offset = 1;
1739                 break;
1740         default:
1741                 break;
1742         }
1743
1744         if (freq->sec_channel_offset) {
1745                 struct wpa_scan_results *scan_res;
1746
1747                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1748                 if (scan_res == NULL) {
1749                         /* Back to HT20 */
1750                         freq->sec_channel_offset = 0;
1751                         return;
1752                 }
1753
1754                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1755                                      sec_chan->chan);
1756                 switch (res) {
1757                 case 0:
1758                         /* Back to HT20 */
1759                         freq->sec_channel_offset = 0;
1760                         break;
1761                 case 1:
1762                         /* Configuration allowed */
1763                         break;
1764                 case 2:
1765                         /* Switch pri/sec channels */
1766                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1767                         freq->sec_channel_offset = -freq->sec_channel_offset;
1768                         freq->channel = sec_chan->chan;
1769                         break;
1770                 default:
1771                         freq->sec_channel_offset = 0;
1772                         break;
1773                 }
1774
1775                 wpa_scan_results_free(scan_res);
1776         }
1777
1778         wpa_printf(MSG_DEBUG,
1779                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1780                    freq->channel, freq->sec_channel_offset);
1781 }
1782
1783
1784 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1785 {
1786         struct wpa_connect_work *cwork = work->ctx;
1787         struct wpa_bss *bss = cwork->bss;
1788         struct wpa_ssid *ssid = cwork->ssid;
1789         struct wpa_supplicant *wpa_s = work->wpa_s;
1790         u8 wpa_ie[200];
1791         size_t wpa_ie_len;
1792         int use_crypt, ret, i, bssid_changed;
1793         int algs = WPA_AUTH_ALG_OPEN;
1794         unsigned int cipher_pairwise, cipher_group;
1795         struct wpa_driver_associate_params params;
1796         int wep_keys_set = 0;
1797         int assoc_failed = 0;
1798         struct wpa_ssid *old_ssid;
1799 #ifdef CONFIG_HT_OVERRIDES
1800         struct ieee80211_ht_capabilities htcaps;
1801         struct ieee80211_ht_capabilities htcaps_mask;
1802 #endif /* CONFIG_HT_OVERRIDES */
1803 #ifdef CONFIG_VHT_OVERRIDES
1804        struct ieee80211_vht_capabilities vhtcaps;
1805        struct ieee80211_vht_capabilities vhtcaps_mask;
1806 #endif /* CONFIG_VHT_OVERRIDES */
1807
1808         if (deinit) {
1809                 if (work->started) {
1810                         wpa_s->connect_work = NULL;
1811
1812                         /* cancel possible auth. timeout */
1813                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1814                                              NULL);
1815                 }
1816                 wpas_connect_work_free(cwork);
1817                 return;
1818         }
1819
1820         wpa_s->connect_work = work;
1821
1822         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1823                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1824                 wpas_connect_work_done(wpa_s);
1825                 return;
1826         }
1827
1828         os_memset(&params, 0, sizeof(params));
1829         wpa_s->reassociate = 0;
1830         wpa_s->eap_expected_failure = 0;
1831         if (bss &&
1832             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1833 #ifdef CONFIG_IEEE80211R
1834                 const u8 *ie, *md = NULL;
1835 #endif /* CONFIG_IEEE80211R */
1836                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1837                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1838                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1839                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1840                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1841                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1842                 if (bssid_changed)
1843                         wpas_notify_bssid_changed(wpa_s);
1844 #ifdef CONFIG_IEEE80211R
1845                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1846                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1847                         md = ie + 2;
1848                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1849                 if (md) {
1850                         /* Prepare for the next transition */
1851                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1852                 }
1853 #endif /* CONFIG_IEEE80211R */
1854 #ifdef CONFIG_WPS
1855         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1856                    wpa_s->conf->ap_scan == 2 &&
1857                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1858                 /* Use ap_scan==1 style network selection to find the network
1859                  */
1860                 wpas_connect_work_done(wpa_s);
1861                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1862                 wpa_s->reassociate = 1;
1863                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1864                 return;
1865 #endif /* CONFIG_WPS */
1866         } else {
1867                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1868                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1869                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1870         }
1871         wpa_supplicant_cancel_sched_scan(wpa_s);
1872         wpa_supplicant_cancel_scan(wpa_s);
1873
1874         /* Starting new association, so clear the possibly used WPA IE from the
1875          * previous association. */
1876         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1877
1878 #ifdef IEEE8021X_EAPOL
1879         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1880                 if (ssid->leap) {
1881                         if (ssid->non_leap == 0)
1882                                 algs = WPA_AUTH_ALG_LEAP;
1883                         else
1884                                 algs |= WPA_AUTH_ALG_LEAP;
1885                 }
1886         }
1887 #endif /* IEEE8021X_EAPOL */
1888         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1889         if (ssid->auth_alg) {
1890                 algs = ssid->auth_alg;
1891                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1892                         "0x%x", algs);
1893         }
1894
1895         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1896                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1897             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1898                 int try_opportunistic;
1899                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1900                                      wpa_s->conf->okc :
1901                                      ssid->proactive_key_caching) &&
1902                         (ssid->proto & WPA_PROTO_RSN);
1903                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1904                                             ssid, try_opportunistic) == 0)
1905                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol, 1);
1906                 wpa_ie_len = sizeof(wpa_ie);
1907                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1908                                               wpa_ie, &wpa_ie_len)) {
1909                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1910                                 "key management and encryption suites");
1911                         wpas_connect_work_done(wpa_s);
1912                         return;
1913                 }
1914         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1915                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1916                 /*
1917                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1918                  * use non-WPA since the scan results did not indicate that the
1919                  * AP is using WPA or WPA2.
1920                  */
1921                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1922                 wpa_ie_len = 0;
1923                 wpa_s->wpa_proto = 0;
1924         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1925                 wpa_ie_len = sizeof(wpa_ie);
1926                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1927                                               wpa_ie, &wpa_ie_len)) {
1928                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1929                                 "key management and encryption suites (no "
1930                                 "scan results)");
1931                         wpas_connect_work_done(wpa_s);
1932                         return;
1933                 }
1934 #ifdef CONFIG_WPS
1935         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1936                 struct wpabuf *wps_ie;
1937                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1938                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1939                         wpa_ie_len = wpabuf_len(wps_ie);
1940                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1941                 } else
1942                         wpa_ie_len = 0;
1943                 wpabuf_free(wps_ie);
1944                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1945                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1946                         params.wps = WPS_MODE_PRIVACY;
1947                 else
1948                         params.wps = WPS_MODE_OPEN;
1949                 wpa_s->wpa_proto = 0;
1950 #endif /* CONFIG_WPS */
1951         } else {
1952                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1953                 wpa_ie_len = 0;
1954                 wpa_s->wpa_proto = 0;
1955         }
1956
1957 #ifdef CONFIG_P2P
1958         if (wpa_s->global->p2p) {
1959                 u8 *pos;
1960                 size_t len;
1961                 int res;
1962                 pos = wpa_ie + wpa_ie_len;
1963                 len = sizeof(wpa_ie) - wpa_ie_len;
1964                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
1965                                             ssid->p2p_group);
1966                 if (res >= 0)
1967                         wpa_ie_len += res;
1968         }
1969
1970         wpa_s->cross_connect_disallowed = 0;
1971         if (bss) {
1972                 struct wpabuf *p2p;
1973                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
1974                 if (p2p) {
1975                         wpa_s->cross_connect_disallowed =
1976                                 p2p_get_cross_connect_disallowed(p2p);
1977                         wpabuf_free(p2p);
1978                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
1979                                 "connection",
1980                                 wpa_s->cross_connect_disallowed ?
1981                                 "disallows" : "allows");
1982                 }
1983         }
1984
1985         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
1986 #endif /* CONFIG_P2P */
1987
1988 #ifdef CONFIG_HS20
1989         if (is_hs20_network(wpa_s, ssid, bss)) {
1990                 struct wpabuf *hs20;
1991                 hs20 = wpabuf_alloc(20);
1992                 if (hs20) {
1993                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
1994                         size_t len;
1995
1996                         wpas_hs20_add_indication(hs20, pps_mo_id);
1997                         len = sizeof(wpa_ie) - wpa_ie_len;
1998                         if (wpabuf_len(hs20) <= len) {
1999                                 os_memcpy(wpa_ie + wpa_ie_len,
2000                                           wpabuf_head(hs20), wpabuf_len(hs20));
2001                                 wpa_ie_len += wpabuf_len(hs20);
2002                         }
2003                         wpabuf_free(hs20);
2004                 }
2005         }
2006 #endif /* CONFIG_HS20 */
2007
2008         /*
2009          * Workaround: Add Extended Capabilities element only if the AP
2010          * included this element in Beacon/Probe Response frames. Some older
2011          * APs seem to have interoperability issues if this element is
2012          * included, so while the standard may require us to include the
2013          * element in all cases, it is justifiable to skip it to avoid
2014          * interoperability issues.
2015          */
2016         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2017                 u8 ext_capab[18];
2018                 int ext_capab_len;
2019                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2020                                                      sizeof(ext_capab));
2021                 if (ext_capab_len > 0) {
2022                         u8 *pos = wpa_ie;
2023                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2024                                 pos += 2 + pos[1];
2025                         os_memmove(pos + ext_capab_len, pos,
2026                                    wpa_ie_len - (pos - wpa_ie));
2027                         wpa_ie_len += ext_capab_len;
2028                         os_memcpy(pos, ext_capab, ext_capab_len);
2029                 }
2030         }
2031
2032         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2033         use_crypt = 1;
2034         cipher_pairwise = wpa_s->pairwise_cipher;
2035         cipher_group = wpa_s->group_cipher;
2036         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2037             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2038                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2039                         use_crypt = 0;
2040                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2041                         use_crypt = 1;
2042                         wep_keys_set = 1;
2043                 }
2044         }
2045         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2046                 use_crypt = 0;
2047
2048 #ifdef IEEE8021X_EAPOL
2049         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2050                 if ((ssid->eapol_flags &
2051                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2052                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2053                     !wep_keys_set) {
2054                         use_crypt = 0;
2055                 } else {
2056                         /* Assume that dynamic WEP-104 keys will be used and
2057                          * set cipher suites in order for drivers to expect
2058                          * encryption. */
2059                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2060                 }
2061         }
2062 #endif /* IEEE8021X_EAPOL */
2063
2064         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2065                 /* Set the key before (and later after) association */
2066                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2067         }
2068
2069         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2070         if (bss) {
2071                 params.ssid = bss->ssid;
2072                 params.ssid_len = bss->ssid_len;
2073                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2074                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2075                                    MACSTR " freq=%u MHz based on scan results "
2076                                    "(bssid_set=%d)",
2077                                    MAC2STR(bss->bssid), bss->freq,
2078                                    ssid->bssid_set);
2079                         params.bssid = bss->bssid;
2080                         params.freq.freq = bss->freq;
2081                 }
2082                 params.bssid_hint = bss->bssid;
2083                 params.freq_hint = bss->freq;
2084         } else {
2085                 params.ssid = ssid->ssid;
2086                 params.ssid_len = ssid->ssid_len;
2087         }
2088
2089         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2090             wpa_s->conf->ap_scan == 2) {
2091                 params.bssid = ssid->bssid;
2092                 params.fixed_bssid = 1;
2093         }
2094
2095         /* Initial frequency for IBSS/mesh */
2096         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2097             ssid->frequency > 0 && params.freq.freq == 0)
2098                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2099
2100         if (ssid->mode == WPAS_MODE_IBSS) {
2101                 if (ssid->beacon_int)
2102                         params.beacon_int = ssid->beacon_int;
2103                 else
2104                         params.beacon_int = wpa_s->conf->beacon_int;
2105         }
2106
2107         params.wpa_ie = wpa_ie;
2108         params.wpa_ie_len = wpa_ie_len;
2109         params.pairwise_suite = cipher_pairwise;
2110         params.group_suite = cipher_group;
2111         params.key_mgmt_suite = wpa_s->key_mgmt;
2112         params.wpa_proto = wpa_s->wpa_proto;
2113         params.auth_alg = algs;
2114         params.mode = ssid->mode;
2115         params.bg_scan_period = ssid->bg_scan_period;
2116         for (i = 0; i < NUM_WEP_KEYS; i++) {
2117                 if (ssid->wep_key_len[i])
2118                         params.wep_key[i] = ssid->wep_key[i];
2119                 params.wep_key_len[i] = ssid->wep_key_len[i];
2120         }
2121         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2122
2123         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2124             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2125              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2126                 params.passphrase = ssid->passphrase;
2127                 if (ssid->psk_set)
2128                         params.psk = ssid->psk;
2129         }
2130
2131         if (wpa_s->conf->key_mgmt_offload) {
2132                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2133                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2134                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B)
2135                         params.req_key_mgmt_offload =
2136                                 ssid->proactive_key_caching < 0 ?
2137                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2138                 else
2139                         params.req_key_mgmt_offload = 1;
2140
2141                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2142                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2143                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2144                     ssid->psk_set)
2145                         params.psk = ssid->psk;
2146         }
2147
2148         params.drop_unencrypted = use_crypt;
2149
2150 #ifdef CONFIG_IEEE80211W
2151         params.mgmt_frame_protection =
2152                 ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT ?
2153                 wpa_s->conf->pmf : ssid->ieee80211w;
2154         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2155                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2156                 struct wpa_ie_data ie;
2157                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2158                     ie.capabilities &
2159                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2160                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2161                                 "MFP: require MFP");
2162                         params.mgmt_frame_protection =
2163                                 MGMT_FRAME_PROTECTION_REQUIRED;
2164                 }
2165         }
2166 #endif /* CONFIG_IEEE80211W */
2167
2168         params.p2p = ssid->p2p_group;
2169
2170         if (wpa_s->parent->set_sta_uapsd)
2171                 params.uapsd = wpa_s->parent->sta_uapsd;
2172         else
2173                 params.uapsd = -1;
2174
2175 #ifdef CONFIG_HT_OVERRIDES
2176         os_memset(&htcaps, 0, sizeof(htcaps));
2177         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2178         params.htcaps = (u8 *) &htcaps;
2179         params.htcaps_mask = (u8 *) &htcaps_mask;
2180         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2181 #endif /* CONFIG_HT_OVERRIDES */
2182 #ifdef CONFIG_VHT_OVERRIDES
2183         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2184         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2185         params.vhtcaps = &vhtcaps;
2186         params.vhtcaps_mask = &vhtcaps_mask;
2187         wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
2188 #endif /* CONFIG_VHT_OVERRIDES */
2189
2190 #ifdef CONFIG_P2P
2191         /*
2192          * If multi-channel concurrency is not supported, check for any
2193          * frequency conflict. In case of any frequency conflict, remove the
2194          * least prioritized connection.
2195          */
2196         if (wpa_s->num_multichan_concurrent < 2) {
2197                 int freq, num;
2198                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2199                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2200                         wpa_printf(MSG_DEBUG,
2201                                    "Assoc conflicting freq found (%d != %d)",
2202                                    freq, params.freq.freq);
2203                         if (wpas_p2p_handle_frequency_conflicts(
2204                                     wpa_s, params.freq.freq, ssid) < 0) {
2205                                 wpas_connect_work_done(wpa_s);
2206                                 return;
2207                         }
2208                 }
2209         }
2210 #endif /* CONFIG_P2P */
2211
2212         ret = wpa_drv_associate(wpa_s, &params);
2213         if (ret < 0) {
2214                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2215                         "failed");
2216                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2217                         /*
2218                          * The driver is known to mean what is saying, so we
2219                          * can stop right here; the association will not
2220                          * succeed.
2221                          */
2222                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2223                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2224                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2225                         return;
2226                 }
2227                 /* try to continue anyway; new association will be tried again
2228                  * after timeout */
2229                 assoc_failed = 1;
2230         }
2231
2232         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2233                 /* Set the key after the association just in case association
2234                  * cleared the previously configured key. */
2235                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2236                 /* No need to timeout authentication since there is no key
2237                  * management. */
2238                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2239                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2240 #ifdef CONFIG_IBSS_RSN
2241         } else if (ssid->mode == WPAS_MODE_IBSS &&
2242                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2243                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2244                 /*
2245                  * RSN IBSS authentication is per-STA and we can disable the
2246                  * per-BSSID authentication.
2247                  */
2248                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2249 #endif /* CONFIG_IBSS_RSN */
2250         } else {
2251                 /* Timeout for IEEE 802.11 authentication and association */
2252                 int timeout = 60;
2253
2254                 if (assoc_failed) {
2255                         /* give IBSS a bit more time */
2256                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2257                 } else if (wpa_s->conf->ap_scan == 1) {
2258                         /* give IBSS a bit more time */
2259                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2260                 }
2261                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2262         }
2263
2264         if (wep_keys_set &&
2265             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2266                 /* Set static WEP keys again */
2267                 wpa_set_wep_keys(wpa_s, ssid);
2268         }
2269
2270         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2271                 /*
2272                  * Do not allow EAP session resumption between different
2273                  * network configurations.
2274                  */
2275                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2276         }
2277         old_ssid = wpa_s->current_ssid;
2278         wpa_s->current_ssid = ssid;
2279         wpa_s->current_bss = bss;
2280         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2281         wpa_supplicant_initiate_eapol(wpa_s);
2282         if (old_ssid != wpa_s->current_ssid)
2283                 wpas_notify_network_changed(wpa_s);
2284 }
2285
2286
2287 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2288                                             const u8 *addr)
2289 {
2290         struct wpa_ssid *old_ssid;
2291
2292         wpas_connect_work_done(wpa_s);
2293         wpa_clear_keys(wpa_s, addr);
2294         old_ssid = wpa_s->current_ssid;
2295         wpa_supplicant_mark_disassoc(wpa_s);
2296         wpa_sm_set_config(wpa_s->wpa, NULL);
2297         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2298         if (old_ssid != wpa_s->current_ssid)
2299                 wpas_notify_network_changed(wpa_s);
2300         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2301 }
2302
2303
2304 /**
2305  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2306  * @wpa_s: Pointer to wpa_supplicant data
2307  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2308  *
2309  * This function is used to request %wpa_supplicant to deauthenticate from the
2310  * current AP.
2311  */
2312 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2313                                    int reason_code)
2314 {
2315         u8 *addr = NULL;
2316         union wpa_event_data event;
2317         int zero_addr = 0;
2318
2319         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2320                 " pending_bssid=" MACSTR " reason=%d state=%s",
2321                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2322                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2323
2324         if (!is_zero_ether_addr(wpa_s->bssid))
2325                 addr = wpa_s->bssid;
2326         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2327                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2328                   wpa_s->wpa_state == WPA_ASSOCIATING))
2329                 addr = wpa_s->pending_bssid;
2330         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2331                 /*
2332                  * When using driver-based BSS selection, we may not know the
2333                  * BSSID with which we are currently trying to associate. We
2334                  * need to notify the driver of this disconnection even in such
2335                  * a case, so use the all zeros address here.
2336                  */
2337                 addr = wpa_s->bssid;
2338                 zero_addr = 1;
2339         }
2340
2341 #ifdef CONFIG_TDLS
2342         wpa_tdls_teardown_peers(wpa_s->wpa);
2343 #endif /* CONFIG_TDLS */
2344
2345 #ifdef CONFIG_MESH
2346         if (wpa_s->ifmsh) {
2347                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2348                              wpa_s->ifname);
2349                 wpa_supplicant_leave_mesh(wpa_s);
2350         }
2351 #endif /* CONFIG_MESH */
2352
2353         if (addr) {
2354                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2355                 os_memset(&event, 0, sizeof(event));
2356                 event.deauth_info.reason_code = (u16) reason_code;
2357                 event.deauth_info.locally_generated = 1;
2358                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2359                 if (zero_addr)
2360                         addr = NULL;
2361         }
2362
2363         wpa_supplicant_clear_connection(wpa_s, addr);
2364 }
2365
2366 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2367                                               struct wpa_ssid *ssid)
2368 {
2369         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2370                 return;
2371
2372         ssid->disabled = 0;
2373         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2374         wpas_notify_network_enabled_changed(wpa_s, ssid);
2375
2376         /*
2377          * Try to reassociate since there is no current configuration and a new
2378          * network was made available.
2379          */
2380         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2381                 wpa_s->reassociate = 1;
2382 }
2383
2384
2385 /**
2386  * wpa_supplicant_enable_network - Mark a configured network as enabled
2387  * @wpa_s: wpa_supplicant structure for a network interface
2388  * @ssid: wpa_ssid structure for a configured network or %NULL
2389  *
2390  * Enables the specified network or all networks if no network specified.
2391  */
2392 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2393                                    struct wpa_ssid *ssid)
2394 {
2395         if (ssid == NULL) {
2396                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2397                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2398         } else
2399                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2400
2401         if (wpa_s->reassociate && !wpa_s->disconnected) {
2402                 if (wpa_s->sched_scanning) {
2403                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2404                                    "new network to scan filters");
2405                         wpa_supplicant_cancel_sched_scan(wpa_s);
2406                 }
2407
2408                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2409                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2410         }
2411 }
2412
2413
2414 /**
2415  * wpa_supplicant_disable_network - Mark a configured network as disabled
2416  * @wpa_s: wpa_supplicant structure for a network interface
2417  * @ssid: wpa_ssid structure for a configured network or %NULL
2418  *
2419  * Disables the specified network or all networks if no network specified.
2420  */
2421 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2422                                     struct wpa_ssid *ssid)
2423 {
2424         struct wpa_ssid *other_ssid;
2425         int was_disabled;
2426
2427         if (ssid == NULL) {
2428                 if (wpa_s->sched_scanning)
2429                         wpa_supplicant_cancel_sched_scan(wpa_s);
2430
2431                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2432                      other_ssid = other_ssid->next) {
2433                         was_disabled = other_ssid->disabled;
2434                         if (was_disabled == 2)
2435                                 continue; /* do not change persistent P2P group
2436                                            * data */
2437
2438                         other_ssid->disabled = 1;
2439
2440                         if (was_disabled != other_ssid->disabled)
2441                                 wpas_notify_network_enabled_changed(
2442                                         wpa_s, other_ssid);
2443                 }
2444                 if (wpa_s->current_ssid)
2445                         wpa_supplicant_deauthenticate(
2446                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2447         } else if (ssid->disabled != 2) {
2448                 if (ssid == wpa_s->current_ssid)
2449                         wpa_supplicant_deauthenticate(
2450                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2451
2452                 was_disabled = ssid->disabled;
2453
2454                 ssid->disabled = 1;
2455
2456                 if (was_disabled != ssid->disabled) {
2457                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2458                         if (wpa_s->sched_scanning) {
2459                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2460                                            "to remove network from filters");
2461                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2462                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2463                         }
2464                 }
2465         }
2466 }
2467
2468
2469 /**
2470  * wpa_supplicant_select_network - Attempt association with a network
2471  * @wpa_s: wpa_supplicant structure for a network interface
2472  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2473  */
2474 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2475                                    struct wpa_ssid *ssid)
2476 {
2477
2478         struct wpa_ssid *other_ssid;
2479         int disconnected = 0;
2480
2481         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2482                 wpa_supplicant_deauthenticate(
2483                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2484                 disconnected = 1;
2485         }
2486
2487         if (ssid)
2488                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2489
2490         /*
2491          * Mark all other networks disabled or mark all networks enabled if no
2492          * network specified.
2493          */
2494         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2495              other_ssid = other_ssid->next) {
2496                 int was_disabled = other_ssid->disabled;
2497                 if (was_disabled == 2)
2498                         continue; /* do not change persistent P2P group data */
2499
2500                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2501                 if (was_disabled && !other_ssid->disabled)
2502                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2503
2504                 if (was_disabled != other_ssid->disabled)
2505                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2506         }
2507
2508         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2509                 /* We are already associated with the selected network */
2510                 wpa_printf(MSG_DEBUG, "Already associated with the "
2511                            "selected network - do nothing");
2512                 return;
2513         }
2514
2515         if (ssid) {
2516                 wpa_s->current_ssid = ssid;
2517                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2518                 wpa_s->connect_without_scan =
2519                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2520         } else {
2521                 wpa_s->connect_without_scan = NULL;
2522         }
2523
2524         wpa_s->disconnected = 0;
2525         wpa_s->reassociate = 1;
2526
2527         if (wpa_s->connect_without_scan ||
2528             wpa_supplicant_fast_associate(wpa_s) != 1)
2529                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2530
2531         if (ssid)
2532                 wpas_notify_network_selected(wpa_s, ssid);
2533 }
2534
2535
2536 /**
2537  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2538  * @wpa_s: wpa_supplicant structure for a network interface
2539  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2540  * @pkcs11_module_path: PKCS #11 module path or NULL
2541  * Returns: 0 on success; -1 on failure
2542  *
2543  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2544  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2545  * module path fails the paths will be reset to the default value (NULL).
2546  */
2547 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2548                                            const char *pkcs11_engine_path,
2549                                            const char *pkcs11_module_path)
2550 {
2551         char *pkcs11_engine_path_copy = NULL;
2552         char *pkcs11_module_path_copy = NULL;
2553
2554         if (pkcs11_engine_path != NULL) {
2555                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2556                 if (pkcs11_engine_path_copy == NULL)
2557                         return -1;
2558         }
2559         if (pkcs11_module_path != NULL) {
2560                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2561                 if (pkcs11_module_path_copy == NULL) {
2562                         os_free(pkcs11_engine_path_copy);
2563                         return -1;
2564                 }
2565         }
2566
2567         os_free(wpa_s->conf->pkcs11_engine_path);
2568         os_free(wpa_s->conf->pkcs11_module_path);
2569         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2570         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2571
2572         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2573         eapol_sm_deinit(wpa_s->eapol);
2574         wpa_s->eapol = NULL;
2575         if (wpa_supplicant_init_eapol(wpa_s)) {
2576                 /* Error -> Reset paths to the default value (NULL) once. */
2577                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2578                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2579                                                                NULL);
2580
2581                 return -1;
2582         }
2583         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2584
2585         return 0;
2586 }
2587
2588
2589 /**
2590  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2591  * @wpa_s: wpa_supplicant structure for a network interface
2592  * @ap_scan: AP scan mode
2593  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2594  *
2595  */
2596 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2597 {
2598
2599         int old_ap_scan;
2600
2601         if (ap_scan < 0 || ap_scan > 2)
2602                 return -1;
2603
2604 #ifdef ANDROID
2605         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2606             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2607             wpa_s->wpa_state < WPA_COMPLETED) {
2608                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2609                            "associating", wpa_s->conf->ap_scan, ap_scan);
2610                 return 0;
2611         }
2612 #endif /* ANDROID */
2613
2614         old_ap_scan = wpa_s->conf->ap_scan;
2615         wpa_s->conf->ap_scan = ap_scan;
2616
2617         if (old_ap_scan != wpa_s->conf->ap_scan)
2618                 wpas_notify_ap_scan_changed(wpa_s);
2619
2620         return 0;
2621 }
2622
2623
2624 /**
2625  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2626  * @wpa_s: wpa_supplicant structure for a network interface
2627  * @expire_age: Expiration age in seconds
2628  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2629  *
2630  */
2631 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2632                                           unsigned int bss_expire_age)
2633 {
2634         if (bss_expire_age < 10) {
2635                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2636                         bss_expire_age);
2637                 return -1;
2638         }
2639         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2640                 bss_expire_age);
2641         wpa_s->conf->bss_expiration_age = bss_expire_age;
2642
2643         return 0;
2644 }
2645
2646
2647 /**
2648  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2649  * @wpa_s: wpa_supplicant structure for a network interface
2650  * @expire_count: number of scans after which an unseen BSS is reclaimed
2651  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2652  *
2653  */
2654 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2655                                             unsigned int bss_expire_count)
2656 {
2657         if (bss_expire_count < 1) {
2658                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2659                         bss_expire_count);
2660                 return -1;
2661         }
2662         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2663                 bss_expire_count);
2664         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2665
2666         return 0;
2667 }
2668
2669
2670 /**
2671  * wpa_supplicant_set_scan_interval - Set scan interval
2672  * @wpa_s: wpa_supplicant structure for a network interface
2673  * @scan_interval: scan interval in seconds
2674  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2675  *
2676  */
2677 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2678                                      int scan_interval)
2679 {
2680         if (scan_interval < 0) {
2681                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2682                         scan_interval);
2683                 return -1;
2684         }
2685         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2686                 scan_interval);
2687         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2688
2689         return 0;
2690 }
2691
2692
2693 /**
2694  * wpa_supplicant_set_debug_params - Set global debug params
2695  * @global: wpa_global structure
2696  * @debug_level: debug level
2697  * @debug_timestamp: determines if show timestamp in debug data
2698  * @debug_show_keys: determines if show keys in debug data
2699  * Returns: 0 if succeed or -1 if debug_level has wrong value
2700  */
2701 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2702                                     int debug_timestamp, int debug_show_keys)
2703 {
2704
2705         int old_level, old_timestamp, old_show_keys;
2706
2707         /* check for allowed debuglevels */
2708         if (debug_level != MSG_EXCESSIVE &&
2709             debug_level != MSG_MSGDUMP &&
2710             debug_level != MSG_DEBUG &&
2711             debug_level != MSG_INFO &&
2712             debug_level != MSG_WARNING &&
2713             debug_level != MSG_ERROR)
2714                 return -1;
2715
2716         old_level = wpa_debug_level;
2717         old_timestamp = wpa_debug_timestamp;
2718         old_show_keys = wpa_debug_show_keys;
2719
2720         wpa_debug_level = debug_level;
2721         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2722         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2723
2724         if (wpa_debug_level != old_level)
2725                 wpas_notify_debug_level_changed(global);
2726         if (wpa_debug_timestamp != old_timestamp)
2727                 wpas_notify_debug_timestamp_changed(global);
2728         if (wpa_debug_show_keys != old_show_keys)
2729                 wpas_notify_debug_show_keys_changed(global);
2730
2731         return 0;
2732 }
2733
2734
2735 /**
2736  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2737  * @wpa_s: Pointer to wpa_supplicant data
2738  * Returns: A pointer to the current network structure or %NULL on failure
2739  */
2740 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2741 {
2742         struct wpa_ssid *entry;
2743         u8 ssid[MAX_SSID_LEN];
2744         int res;
2745         size_t ssid_len;
2746         u8 bssid[ETH_ALEN];
2747         int wired;
2748
2749         res = wpa_drv_get_ssid(wpa_s, ssid);
2750         if (res < 0) {
2751                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2752                         "driver");
2753                 return NULL;
2754         }
2755         ssid_len = res;
2756
2757         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2758                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2759                         "driver");
2760                 return NULL;
2761         }
2762
2763         wired = wpa_s->conf->ap_scan == 0 &&
2764                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2765
2766         entry = wpa_s->conf->ssid;
2767         while (entry) {
2768                 if (!wpas_network_disabled(wpa_s, entry) &&
2769                     ((ssid_len == entry->ssid_len &&
2770                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2771                     (!entry->bssid_set ||
2772                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2773                         return entry;
2774 #ifdef CONFIG_WPS
2775                 if (!wpas_network_disabled(wpa_s, entry) &&
2776                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2777                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2778                     (!entry->bssid_set ||
2779                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2780                         return entry;
2781 #endif /* CONFIG_WPS */
2782
2783                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2784                     entry->ssid_len == 0 &&
2785                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2786                         return entry;
2787
2788                 entry = entry->next;
2789         }
2790
2791         return NULL;
2792 }
2793
2794
2795 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2796 {
2797         struct wpa_global *global = wpa_s->global;
2798
2799         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2800                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2801                 if (global->drv_priv[i] == NULL) {
2802                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2803                                    "'%s'", wpa_drivers[i]->name);
2804                         return -1;
2805                 }
2806         }
2807
2808         wpa_s->driver = wpa_drivers[i];
2809         wpa_s->global_drv_priv = global->drv_priv[i];
2810
2811         return 0;
2812 }
2813
2814
2815 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2816                                      const char *name)
2817 {
2818         int i;
2819         size_t len;
2820         const char *pos, *driver = name;
2821
2822         if (wpa_s == NULL)
2823                 return -1;
2824
2825         if (wpa_drivers[0] == NULL) {
2826                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2827                         "wpa_supplicant");
2828                 return -1;
2829         }
2830
2831         if (name == NULL) {
2832                 /* default to first driver in the list */
2833                 return select_driver(wpa_s, 0);
2834         }
2835
2836         do {
2837                 pos = os_strchr(driver, ',');
2838                 if (pos)
2839                         len = pos - driver;
2840                 else
2841                         len = os_strlen(driver);
2842
2843                 for (i = 0; wpa_drivers[i]; i++) {
2844                         if (os_strlen(wpa_drivers[i]->name) == len &&
2845                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2846                             0) {
2847                                 /* First driver that succeeds wins */
2848                                 if (select_driver(wpa_s, i) == 0)
2849                                         return 0;
2850                         }
2851                 }
2852
2853                 driver = pos + 1;
2854         } while (pos);
2855
2856         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2857         return -1;
2858 }
2859
2860
2861 /**
2862  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2863  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2864  *      with struct wpa_driver_ops::init()
2865  * @src_addr: Source address of the EAPOL frame
2866  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2867  * @len: Length of the EAPOL data
2868  *
2869  * This function is called for each received EAPOL frame. Most driver
2870  * interfaces rely on more generic OS mechanism for receiving frames through
2871  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2872  * take care of received EAPOL frames and deliver them to the core supplicant
2873  * code by calling this function.
2874  */
2875 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2876                              const u8 *buf, size_t len)
2877 {
2878         struct wpa_supplicant *wpa_s = ctx;
2879
2880         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2881         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2882
2883 #ifdef CONFIG_PEERKEY
2884         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2885             wpa_s->current_ssid->peerkey &&
2886             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2887             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2888                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2889                 return;
2890         }
2891 #endif /* CONFIG_PEERKEY */
2892
2893         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2894             (wpa_s->last_eapol_matches_bssid &&
2895 #ifdef CONFIG_AP
2896              !wpa_s->ap_iface &&
2897 #endif /* CONFIG_AP */
2898              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2899                 /*
2900                  * There is possible race condition between receiving the
2901                  * association event and the EAPOL frame since they are coming
2902                  * through different paths from the driver. In order to avoid
2903                  * issues in trying to process the EAPOL frame before receiving
2904                  * association information, lets queue it for processing until
2905                  * the association event is received. This may also be needed in
2906                  * driver-based roaming case, so also use src_addr != BSSID as a
2907                  * trigger if we have previously confirmed that the
2908                  * Authenticator uses BSSID as the src_addr (which is not the
2909                  * case with wired IEEE 802.1X).
2910                  */
2911                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2912                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2913                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2914                         MAC2STR(wpa_s->bssid));
2915                 wpabuf_free(wpa_s->pending_eapol_rx);
2916                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2917                 if (wpa_s->pending_eapol_rx) {
2918                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2919                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2920                                   ETH_ALEN);
2921                 }
2922                 return;
2923         }
2924
2925         wpa_s->last_eapol_matches_bssid =
2926                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2927
2928 #ifdef CONFIG_AP
2929         if (wpa_s->ap_iface) {
2930                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2931                 return;
2932         }
2933 #endif /* CONFIG_AP */
2934
2935         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2936                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2937                         "no key management is configured");
2938                 return;
2939         }
2940
2941         if (wpa_s->eapol_received == 0 &&
2942             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2943              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2944              wpa_s->wpa_state != WPA_COMPLETED) &&
2945             (wpa_s->current_ssid == NULL ||
2946              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
2947                 /* Timeout for completing IEEE 802.1X and WPA authentication */
2948                 wpa_supplicant_req_auth_timeout(
2949                         wpa_s,
2950                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
2951                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
2952                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
2953                         70 : 10, 0);
2954         }
2955         wpa_s->eapol_received++;
2956
2957         if (wpa_s->countermeasures) {
2958                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
2959                         "EAPOL packet");
2960                 return;
2961         }
2962
2963 #ifdef CONFIG_IBSS_RSN
2964         if (wpa_s->current_ssid &&
2965             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
2966                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
2967                 return;
2968         }
2969 #endif /* CONFIG_IBSS_RSN */
2970
2971         /* Source address of the incoming EAPOL frame could be compared to the
2972          * current BSSID. However, it is possible that a centralized
2973          * Authenticator could be using another MAC address than the BSSID of
2974          * an AP, so just allow any address to be used for now. The replies are
2975          * still sent to the current BSSID (if available), though. */
2976
2977         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
2978         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
2979             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
2980                 return;
2981         wpa_drv_poll(wpa_s);
2982         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
2983                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
2984         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
2985                 /*
2986                  * Set portValid = TRUE here since we are going to skip 4-way
2987                  * handshake processing which would normally set portValid. We
2988                  * need this to allow the EAPOL state machines to be completed
2989                  * without going through EAPOL-Key handshake.
2990                  */
2991                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
2992         }
2993 }
2994
2995
2996 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
2997 {
2998         if ((!wpa_s->p2p_mgmt ||
2999              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3000             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3001                 l2_packet_deinit(wpa_s->l2);
3002                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3003                                            wpa_drv_get_mac_addr(wpa_s),
3004                                            ETH_P_EAPOL,
3005                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3006                 if (wpa_s->l2 == NULL)
3007                         return -1;
3008         } else {
3009                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3010                 if (addr)
3011                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3012         }
3013
3014         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3015                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3016                 return -1;
3017         }
3018
3019         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3020
3021         return 0;
3022 }
3023
3024
3025 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3026                                            const u8 *buf, size_t len)
3027 {
3028         struct wpa_supplicant *wpa_s = ctx;
3029         const struct l2_ethhdr *eth;
3030
3031         if (len < sizeof(*eth))
3032                 return;
3033         eth = (const struct l2_ethhdr *) buf;
3034
3035         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3036             !(eth->h_dest[0] & 0x01)) {
3037                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3038                         " (bridge - not for this interface - ignore)",
3039                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3040                 return;
3041         }
3042
3043         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3044                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3045         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3046                                 len - sizeof(*eth));
3047 }
3048
3049
3050 /**
3051  * wpa_supplicant_driver_init - Initialize driver interface parameters
3052  * @wpa_s: Pointer to wpa_supplicant data
3053  * Returns: 0 on success, -1 on failure
3054  *
3055  * This function is called to initialize driver interface parameters.
3056  * wpa_drv_init() must have been called before this function to initialize the
3057  * driver interface.
3058  */
3059 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3060 {
3061         static int interface_count = 0;
3062
3063         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3064                 return -1;
3065
3066         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3067                 MAC2STR(wpa_s->own_addr));
3068         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3069         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3070
3071         if (wpa_s->bridge_ifname[0]) {
3072                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3073                         "interface '%s'", wpa_s->bridge_ifname);
3074                 wpa_s->l2_br = l2_packet_init(wpa_s->bridge_ifname,
3075                                               wpa_s->own_addr,
3076                                               ETH_P_EAPOL,
3077                                               wpa_supplicant_rx_eapol_bridge,
3078                                               wpa_s, 1);
3079                 if (wpa_s->l2_br == NULL) {
3080                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3081                                 "connection for the bridge interface '%s'",
3082                                 wpa_s->bridge_ifname);
3083                         return -1;
3084                 }
3085         }
3086
3087         wpa_clear_keys(wpa_s, NULL);
3088
3089         /* Make sure that TKIP countermeasures are not left enabled (could
3090          * happen if wpa_supplicant is killed during countermeasures. */
3091         wpa_drv_set_countermeasures(wpa_s, 0);
3092
3093         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3094         wpa_drv_flush_pmkid(wpa_s);
3095
3096         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3097         wpa_s->prev_scan_wildcard = 0;
3098
3099         if (wpa_supplicant_enabled_networks(wpa_s)) {
3100                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3101                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3102                         interface_count = 0;
3103                 }
3104 #ifndef ANDROID
3105                 if (!wpa_s->p2p_mgmt &&
3106                     wpa_supplicant_delayed_sched_scan(wpa_s,
3107                                                       interface_count % 3,
3108                                                       100000))
3109                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3110                                                 100000);
3111 #endif /* ANDROID */
3112                 interface_count++;
3113         } else
3114                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3115
3116         return 0;
3117 }
3118
3119
3120 static int wpa_supplicant_daemon(const char *pid_file)
3121 {
3122         wpa_printf(MSG_DEBUG, "Daemonize..");
3123         return os_daemonize(pid_file);
3124 }
3125
3126
3127 static struct wpa_supplicant * wpa_supplicant_alloc(void)
3128 {
3129         struct wpa_supplicant *wpa_s;
3130
3131         wpa_s = os_zalloc(sizeof(*wpa_s));
3132         if (wpa_s == NULL)
3133                 return NULL;
3134         wpa_s->scan_req = INITIAL_SCAN_REQ;
3135         wpa_s->scan_interval = 5;
3136         wpa_s->new_connection = 1;
3137         wpa_s->parent = wpa_s;
3138         wpa_s->sched_scanning = 0;
3139
3140         return wpa_s;
3141 }
3142
3143
3144 #ifdef CONFIG_HT_OVERRIDES
3145
3146 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3147                              struct ieee80211_ht_capabilities *htcaps,
3148                              struct ieee80211_ht_capabilities *htcaps_mask,
3149                              const char *ht_mcs)
3150 {
3151         /* parse ht_mcs into hex array */
3152         int i;
3153         const char *tmp = ht_mcs;
3154         char *end = NULL;
3155
3156         /* If ht_mcs is null, do not set anything */
3157         if (!ht_mcs)
3158                 return 0;
3159
3160         /* This is what we are setting in the kernel */
3161         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3162
3163         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3164
3165         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3166                 errno = 0;
3167                 long v = strtol(tmp, &end, 16);
3168                 if (errno == 0) {
3169                         wpa_msg(wpa_s, MSG_DEBUG,
3170                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3171                                 i, v, end, tmp);
3172                         if (end == tmp)
3173                                 break;
3174
3175                         htcaps->supported_mcs_set[i] = v;
3176                         tmp = end;
3177                 } else {
3178                         wpa_msg(wpa_s, MSG_ERROR,
3179                                 "Failed to parse ht-mcs: %s, error: %s\n",
3180                                 ht_mcs, strerror(errno));
3181                         return -1;
3182                 }
3183         }
3184
3185         /*
3186          * If we were able to parse any values, then set mask for the MCS set.
3187          */
3188         if (i) {
3189                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3190                           IEEE80211_HT_MCS_MASK_LEN - 1);
3191                 /* skip the 3 reserved bits */
3192                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3193                         0x1f;
3194         }
3195
3196         return 0;
3197 }
3198
3199
3200 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3201                                  struct ieee80211_ht_capabilities *htcaps,
3202                                  struct ieee80211_ht_capabilities *htcaps_mask,
3203                                  int disabled)
3204 {
3205         le16 msk;
3206
3207         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3208
3209         if (disabled == -1)
3210                 return 0;
3211
3212         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3213         htcaps_mask->ht_capabilities_info |= msk;
3214         if (disabled)
3215                 htcaps->ht_capabilities_info &= msk;
3216         else
3217                 htcaps->ht_capabilities_info |= msk;
3218
3219         return 0;
3220 }
3221
3222
3223 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3224                                 struct ieee80211_ht_capabilities *htcaps,
3225                                 struct ieee80211_ht_capabilities *htcaps_mask,
3226                                 int factor)
3227 {
3228         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3229
3230         if (factor == -1)
3231                 return 0;
3232
3233         if (factor < 0 || factor > 3) {
3234                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3235                         "Must be 0-3 or -1", factor);
3236                 return -EINVAL;
3237         }
3238
3239         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3240         htcaps->a_mpdu_params &= ~0x3;
3241         htcaps->a_mpdu_params |= factor & 0x3;
3242
3243         return 0;
3244 }
3245
3246
3247 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3248                                  struct ieee80211_ht_capabilities *htcaps,
3249                                  struct ieee80211_ht_capabilities *htcaps_mask,
3250                                  int density)
3251 {
3252         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3253
3254         if (density == -1)
3255                 return 0;
3256
3257         if (density < 0 || density > 7) {
3258                 wpa_msg(wpa_s, MSG_ERROR,
3259                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3260                         density);
3261                 return -EINVAL;
3262         }
3263
3264         htcaps_mask->a_mpdu_params |= 0x1C;
3265         htcaps->a_mpdu_params &= ~(0x1C);
3266         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3267
3268         return 0;
3269 }
3270
3271
3272 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3273                                 struct ieee80211_ht_capabilities *htcaps,
3274                                 struct ieee80211_ht_capabilities *htcaps_mask,
3275                                 int disabled)
3276 {
3277         /* Masking these out disables HT40 */
3278         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3279                                 HT_CAP_INFO_SHORT_GI40MHZ);
3280
3281         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3282
3283         if (disabled)
3284                 htcaps->ht_capabilities_info &= ~msk;
3285         else
3286                 htcaps->ht_capabilities_info |= msk;
3287
3288         htcaps_mask->ht_capabilities_info |= msk;
3289
3290         return 0;
3291 }
3292
3293
3294 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3295                                struct ieee80211_ht_capabilities *htcaps,
3296                                struct ieee80211_ht_capabilities *htcaps_mask,
3297                                int disabled)
3298 {
3299         /* Masking these out disables SGI */
3300         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3301                                 HT_CAP_INFO_SHORT_GI40MHZ);
3302
3303         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3304
3305         if (disabled)
3306                 htcaps->ht_capabilities_info &= ~msk;
3307         else
3308                 htcaps->ht_capabilities_info |= msk;
3309
3310         htcaps_mask->ht_capabilities_info |= msk;
3311
3312         return 0;
3313 }
3314
3315
3316 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3317                                struct ieee80211_ht_capabilities *htcaps,
3318                                struct ieee80211_ht_capabilities *htcaps_mask,
3319                                int disabled)
3320 {
3321         /* Masking these out disables LDPC */
3322         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3323
3324         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3325
3326         if (disabled)
3327                 htcaps->ht_capabilities_info &= ~msk;
3328         else
3329                 htcaps->ht_capabilities_info |= msk;
3330
3331         htcaps_mask->ht_capabilities_info |= msk;
3332
3333         return 0;
3334 }
3335
3336
3337 void wpa_supplicant_apply_ht_overrides(
3338         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3339         struct wpa_driver_associate_params *params)
3340 {
3341         struct ieee80211_ht_capabilities *htcaps;
3342         struct ieee80211_ht_capabilities *htcaps_mask;
3343
3344         if (!ssid)
3345                 return;
3346
3347         params->disable_ht = ssid->disable_ht;
3348         if (!params->htcaps || !params->htcaps_mask)
3349                 return;
3350
3351         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3352         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3353         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3354         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3355                               ssid->disable_max_amsdu);
3356         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3357         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3358         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3359         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3360         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3361
3362         if (ssid->ht40_intolerant) {
3363                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3364                 htcaps->ht_capabilities_info |= bit;
3365                 htcaps_mask->ht_capabilities_info |= bit;
3366         }
3367 }
3368
3369 #endif /* CONFIG_HT_OVERRIDES */
3370
3371
3372 #ifdef CONFIG_VHT_OVERRIDES
3373 void wpa_supplicant_apply_vht_overrides(
3374         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3375         struct wpa_driver_associate_params *params)
3376 {
3377         struct ieee80211_vht_capabilities *vhtcaps;
3378         struct ieee80211_vht_capabilities *vhtcaps_mask;
3379
3380         if (!ssid)
3381                 return;
3382
3383         params->disable_vht = ssid->disable_vht;
3384
3385         vhtcaps = (void *) params->vhtcaps;
3386         vhtcaps_mask = (void *) params->vhtcaps_mask;
3387
3388         if (!vhtcaps || !vhtcaps_mask)
3389                 return;
3390
3391         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3392         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3393
3394 #ifdef CONFIG_HT_OVERRIDES
3395         /* if max ampdu is <= 3, we have to make the HT cap the same */
3396         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3397                 int max_ampdu;
3398
3399                 max_ampdu = (ssid->vht_capa &
3400                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3401                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3402
3403                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3404                 wpa_set_ampdu_factor(wpa_s,
3405                                      (void *) params->htcaps,
3406                                      (void *) params->htcaps_mask,
3407                                      max_ampdu);
3408         }
3409 #endif /* CONFIG_HT_OVERRIDES */
3410
3411 #define OVERRIDE_MCS(i)                                                 \
3412         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3413                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3414                         3 << 2 * (i - 1);                               \
3415                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3416                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3417         }                                                               \
3418         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3419                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3420                         3 << 2 * (i - 1);                               \
3421                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3422                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3423         }
3424
3425         OVERRIDE_MCS(1);
3426         OVERRIDE_MCS(2);
3427         OVERRIDE_MCS(3);
3428         OVERRIDE_MCS(4);
3429         OVERRIDE_MCS(5);
3430         OVERRIDE_MCS(6);
3431         OVERRIDE_MCS(7);
3432         OVERRIDE_MCS(8);
3433 }
3434 #endif /* CONFIG_VHT_OVERRIDES */
3435
3436
3437 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3438 {
3439 #ifdef PCSC_FUNCS
3440         size_t len;
3441
3442         if (!wpa_s->conf->pcsc_reader)
3443                 return 0;
3444
3445         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3446         if (!wpa_s->scard)
3447                 return 1;
3448
3449         if (wpa_s->conf->pcsc_pin &&
3450             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3451                 scard_deinit(wpa_s->scard);
3452                 wpa_s->scard = NULL;
3453                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3454                 return -1;
3455         }
3456
3457         len = sizeof(wpa_s->imsi) - 1;
3458         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3459                 scard_deinit(wpa_s->scard);
3460                 wpa_s->scard = NULL;
3461                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3462                 return -1;
3463         }
3464         wpa_s->imsi[len] = '\0';
3465
3466         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3467
3468         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3469                    wpa_s->imsi, wpa_s->mnc_len);
3470
3471         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3472         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3473 #endif /* PCSC_FUNCS */
3474
3475         return 0;
3476 }
3477
3478
3479 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3480 {
3481         char *val, *pos;
3482
3483         ext_password_deinit(wpa_s->ext_pw);
3484         wpa_s->ext_pw = NULL;
3485         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3486
3487         if (!wpa_s->conf->ext_password_backend)
3488                 return 0;
3489
3490         val = os_strdup(wpa_s->conf->ext_password_backend);
3491         if (val == NULL)
3492                 return -1;
3493         pos = os_strchr(val, ':');
3494         if (pos)
3495                 *pos++ = '\0';
3496
3497         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3498
3499         wpa_s->ext_pw = ext_password_init(val, pos);
3500         os_free(val);
3501         if (wpa_s->ext_pw == NULL) {
3502                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3503                 return -1;
3504         }
3505         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3506
3507         return 0;
3508 }
3509
3510
3511 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3512                                     const struct wpa_driver_capa *capa)
3513 {
3514         struct wowlan_triggers *triggers;
3515         int ret = 0;
3516
3517         if (!wpa_s->conf->wowlan_triggers)
3518                 return 0;
3519
3520         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3521         if (triggers) {
3522                 ret = wpa_drv_wowlan(wpa_s, triggers);
3523                 os_free(triggers);
3524         }
3525         return ret;
3526 }
3527
3528
3529 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3530                                               const char *rn)
3531 {
3532         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3533         struct wpa_radio *radio;
3534
3535         while (rn && iface) {
3536                 radio = iface->radio;
3537                 if (radio && os_strcmp(rn, radio->name) == 0) {
3538                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3539                                    wpa_s->ifname, rn);
3540                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3541                         return radio;
3542                 }
3543
3544                 iface = iface->next;
3545         }
3546
3547         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3548                    wpa_s->ifname, rn ? rn : "N/A");
3549         radio = os_zalloc(sizeof(*radio));
3550         if (radio == NULL)
3551                 return NULL;
3552
3553         if (rn)
3554                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3555         dl_list_init(&radio->ifaces);
3556         dl_list_init(&radio->work);
3557         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3558
3559         return radio;
3560 }
3561
3562
3563 static void radio_work_free(struct wpa_radio_work *work)
3564 {
3565         if (work->wpa_s->scan_work == work) {
3566                 /* This should not really happen. */
3567                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3568                         work->type, work, work->started);
3569                 work->wpa_s->scan_work = NULL;
3570         }
3571
3572 #ifdef CONFIG_P2P
3573         if (work->wpa_s->p2p_scan_work == work) {
3574                 /* This should not really happen. */
3575                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3576                         work->type, work, work->started);
3577                 work->wpa_s->p2p_scan_work = NULL;
3578         }
3579 #endif /* CONFIG_P2P */
3580
3581         dl_list_del(&work->list);
3582         os_free(work);
3583 }
3584
3585
3586 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3587 {
3588         struct wpa_radio *radio = eloop_ctx;
3589         struct wpa_radio_work *work;
3590         struct os_reltime now, diff;
3591         struct wpa_supplicant *wpa_s;
3592
3593         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3594         if (work == NULL)
3595                 return;
3596
3597         if (work->started)
3598                 return; /* already started and still in progress */
3599
3600         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3601                               radio_list);
3602         if (wpa_s && wpa_s->external_scan_running) {
3603                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3604                 return;
3605         }
3606
3607         os_get_reltime(&now);
3608         os_reltime_sub(&now, &work->time, &diff);
3609         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3610                 work->type, work, diff.sec, diff.usec);
3611         work->started = 1;
3612         work->time = now;
3613         work->cb(work, 0);
3614 }
3615
3616
3617 /*
3618  * This function removes both started and pending radio works running on
3619  * the provided interface's radio.
3620  * Prior to the removal of the radio work, its callback (cb) is called with
3621  * deinit set to be 1. Each work's callback is responsible for clearing its
3622  * internal data and restoring to a correct state.
3623  * @wpa_s: wpa_supplicant data
3624  * @type: type of works to be removed
3625  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3626  * this interface's works.
3627  */
3628 void radio_remove_works(struct wpa_supplicant *wpa_s,
3629                         const char *type, int remove_all)
3630 {
3631         struct wpa_radio_work *work, *tmp;
3632         struct wpa_radio *radio = wpa_s->radio;
3633
3634         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3635                               list) {
3636                 if (type && os_strcmp(type, work->type) != 0)
3637                         continue;
3638
3639                 /* skip other ifaces' works */
3640                 if (!remove_all && work->wpa_s != wpa_s)
3641                         continue;
3642
3643                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3644                         work->type, work, work->started ? " (started)" : "");
3645                 work->cb(work, 1);
3646                 radio_work_free(work);
3647         }
3648
3649         /* in case we removed the started work */
3650         radio_work_check_next(wpa_s);
3651 }
3652
3653
3654 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3655 {
3656         struct wpa_radio *radio = wpa_s->radio;
3657
3658         if (!radio)
3659                 return;
3660
3661         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3662                    wpa_s->ifname, radio->name);
3663         dl_list_del(&wpa_s->radio_list);
3664         radio_remove_works(wpa_s, NULL, 0);
3665         wpa_s->radio = NULL;
3666         if (!dl_list_empty(&radio->ifaces))
3667                 return; /* Interfaces remain for this radio */
3668
3669         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3670         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3671         os_free(radio);
3672 }
3673
3674
3675 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3676 {
3677         struct wpa_radio *radio = wpa_s->radio;
3678
3679         if (dl_list_empty(&radio->work))
3680                 return;
3681         if (wpa_s->ext_work_in_progress) {
3682                 wpa_printf(MSG_DEBUG,
3683                            "External radio work in progress - delay start of pending item");
3684                 return;
3685         }
3686         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3687         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3688 }
3689
3690
3691 /**
3692  * radio_add_work - Add a radio work item
3693  * @wpa_s: Pointer to wpa_supplicant data
3694  * @freq: Frequency of the offchannel operation in MHz or 0
3695  * @type: Unique identifier for each type of work
3696  * @next: Force as the next work to be executed
3697  * @cb: Callback function for indicating when radio is available
3698  * @ctx: Context pointer for the work (work->ctx in cb())
3699  * Returns: 0 on success, -1 on failure
3700  *
3701  * This function is used to request time for an operation that requires
3702  * exclusive radio control. Once the radio is available, the registered callback
3703  * function will be called. radio_work_done() must be called once the exclusive
3704  * radio operation has been completed, so that the radio is freed for other
3705  * operations. The special case of deinit=1 is used to free the context data
3706  * during interface removal. That does not allow the callback function to start
3707  * the radio operation, i.e., it must free any resources allocated for the radio
3708  * work and return.
3709  *
3710  * The @freq parameter can be used to indicate a single channel on which the
3711  * offchannel operation will occur. This may allow multiple radio work
3712  * operations to be performed in parallel if they apply for the same channel.
3713  * Setting this to 0 indicates that the work item may use multiple channels or
3714  * requires exclusive control of the radio.
3715  */
3716 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3717                    const char *type, int next,
3718                    void (*cb)(struct wpa_radio_work *work, int deinit),
3719                    void *ctx)
3720 {
3721         struct wpa_radio_work *work;
3722         int was_empty;
3723
3724         work = os_zalloc(sizeof(*work));
3725         if (work == NULL)
3726                 return -1;
3727         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3728         os_get_reltime(&work->time);
3729         work->freq = freq;
3730         work->type = type;
3731         work->wpa_s = wpa_s;
3732         work->cb = cb;
3733         work->ctx = ctx;
3734
3735         was_empty = dl_list_empty(&wpa_s->radio->work);
3736         if (next)
3737                 dl_list_add(&wpa_s->radio->work, &work->list);
3738         else
3739                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3740         if (was_empty) {
3741                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3742                 radio_work_check_next(wpa_s);
3743         }
3744
3745         return 0;
3746 }
3747
3748
3749 /**
3750  * radio_work_done - Indicate that a radio work item has been completed
3751  * @work: Completed work
3752  *
3753  * This function is called once the callback function registered with
3754  * radio_add_work() has completed its work.
3755  */
3756 void radio_work_done(struct wpa_radio_work *work)
3757 {
3758         struct wpa_supplicant *wpa_s = work->wpa_s;
3759         struct os_reltime now, diff;
3760         unsigned int started = work->started;
3761
3762         os_get_reltime(&now);
3763         os_reltime_sub(&now, &work->time, &diff);
3764         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3765                 work->type, work, started ? "done" : "canceled",
3766                 diff.sec, diff.usec);
3767         radio_work_free(work);
3768         if (started)
3769                 radio_work_check_next(wpa_s);
3770 }
3771
3772
3773 struct wpa_radio_work *
3774 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3775 {
3776         struct wpa_radio_work *work;
3777         struct wpa_radio *radio = wpa_s->radio;
3778
3779         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3780                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3781                         return work;
3782         }
3783
3784         return NULL;
3785 }
3786
3787
3788 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3789                             struct wpa_interface *iface)
3790 {
3791         const char *ifname, *driver, *rn;
3792
3793         driver = iface->driver;
3794 next_driver:
3795         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3796                 return -1;
3797
3798         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3799         if (wpa_s->drv_priv == NULL) {
3800                 const char *pos;
3801                 pos = driver ? os_strchr(driver, ',') : NULL;
3802                 if (pos) {
3803                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3804                                 "driver interface - try next driver wrapper");
3805                         driver = pos + 1;
3806                         goto next_driver;
3807                 }
3808                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3809                         "interface");
3810                 return -1;
3811         }
3812         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3813                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3814                         "driver_param '%s'", wpa_s->conf->driver_param);
3815                 return -1;
3816         }
3817
3818         ifname = wpa_drv_get_ifname(wpa_s);
3819         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3820                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3821                         "interface name with '%s'", ifname);
3822                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3823         }
3824
3825         rn = wpa_driver_get_radio_name(wpa_s);
3826         if (rn && rn[0] == '\0')
3827                 rn = NULL;
3828
3829         wpa_s->radio = radio_add_interface(wpa_s, rn);
3830         if (wpa_s->radio == NULL)
3831                 return -1;
3832
3833         return 0;
3834 }
3835
3836
3837 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3838                                      struct wpa_interface *iface)
3839 {
3840         struct wpa_driver_capa capa;
3841         int capa_res;
3842
3843         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3844                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3845                    iface->confname ? iface->confname : "N/A",
3846                    iface->driver ? iface->driver : "default",
3847                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3848                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3849
3850         if (iface->confname) {
3851 #ifdef CONFIG_BACKEND_FILE
3852                 wpa_s->confname = os_rel2abs_path(iface->confname);
3853                 if (wpa_s->confname == NULL) {
3854                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3855                                    "for configuration file '%s'.",
3856                                    iface->confname);
3857                         return -1;
3858                 }
3859                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3860                            iface->confname, wpa_s->confname);
3861 #else /* CONFIG_BACKEND_FILE */
3862                 wpa_s->confname = os_strdup(iface->confname);
3863 #endif /* CONFIG_BACKEND_FILE */
3864                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3865                 if (wpa_s->conf == NULL) {
3866                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3867                                    "configuration '%s'.", wpa_s->confname);
3868                         return -1;
3869                 }
3870                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3871                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3872
3873                 /*
3874                  * Override ctrl_interface and driver_param if set on command
3875                  * line.
3876                  */
3877                 if (iface->ctrl_interface) {
3878                         os_free(wpa_s->conf->ctrl_interface);
3879                         wpa_s->conf->ctrl_interface =
3880                                 os_strdup(iface->ctrl_interface);
3881                 }
3882
3883                 if (iface->driver_param) {
3884                         os_free(wpa_s->conf->driver_param);
3885                         wpa_s->conf->driver_param =
3886                                 os_strdup(iface->driver_param);
3887                 }
3888
3889                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3890                         os_free(wpa_s->conf->ctrl_interface);
3891                         wpa_s->conf->ctrl_interface = NULL;
3892                 }
3893         } else
3894                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3895                                                      iface->driver_param);
3896
3897         if (wpa_s->conf == NULL) {
3898                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3899                 return -1;
3900         }
3901
3902         if (iface->ifname == NULL) {
3903                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3904                 return -1;
3905         }
3906         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3907                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3908                            iface->ifname);
3909                 return -1;
3910         }
3911         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3912
3913         if (iface->bridge_ifname) {
3914                 if (os_strlen(iface->bridge_ifname) >=
3915                     sizeof(wpa_s->bridge_ifname)) {
3916                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3917                                    "name '%s'.", iface->bridge_ifname);
3918                         return -1;
3919                 }
3920                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3921                            sizeof(wpa_s->bridge_ifname));
3922         }
3923
3924         /* RSNA Supplicant Key Management - INITIALIZE */
3925         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3926         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3927
3928         /* Initialize driver interface and register driver event handler before
3929          * L2 receive handler so that association events are processed before
3930          * EAPOL-Key packets if both become available for the same select()
3931          * call. */
3932         if (wpas_init_driver(wpa_s, iface) < 0)
3933                 return -1;
3934
3935         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3936                 return -1;
3937
3938         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3939                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3940                           NULL);
3941         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3942
3943         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3944             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3945                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3946                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3947                         "dot11RSNAConfigPMKLifetime");
3948                 return -1;
3949         }
3950
3951         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
3952             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
3953                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
3954                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3955                         "dot11RSNAConfigPMKReauthThreshold");
3956                 return -1;
3957         }
3958
3959         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
3960             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
3961                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
3962                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
3963                         "dot11RSNAConfigSATimeout");
3964                 return -1;
3965         }
3966
3967         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
3968                                                       &wpa_s->hw.num_modes,
3969                                                       &wpa_s->hw.flags);
3970
3971         capa_res = wpa_drv_get_capa(wpa_s, &capa);
3972         if (capa_res == 0) {
3973                 wpa_s->drv_capa_known = 1;
3974                 wpa_s->drv_flags = capa.flags;
3975                 wpa_s->drv_enc = capa.enc;
3976                 wpa_s->drv_smps_modes = capa.smps_modes;
3977                 wpa_s->drv_rrm_flags = capa.rrm_flags;
3978                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
3979                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
3980                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
3981                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
3982                 wpa_s->max_match_sets = capa.max_match_sets;
3983                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
3984                 wpa_s->max_stations = capa.max_stations;
3985                 wpa_s->extended_capa = capa.extended_capa;
3986                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
3987                 wpa_s->extended_capa_len = capa.extended_capa_len;
3988                 wpa_s->num_multichan_concurrent =
3989                         capa.num_multichan_concurrent;
3990                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
3991
3992                 if (capa.mac_addr_rand_scan_supported)
3993                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
3994                 if (wpa_s->sched_scan_supported &&
3995                     capa.mac_addr_rand_sched_scan_supported)
3996                         wpa_s->mac_addr_rand_supported |=
3997                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
3998         }
3999         if (wpa_s->max_remain_on_chan == 0)
4000                 wpa_s->max_remain_on_chan = 1000;
4001
4002         /*
4003          * Only take p2p_mgmt parameters when P2P Device is supported.
4004          * Doing it here as it determines whether l2_packet_init() will be done
4005          * during wpa_supplicant_driver_init().
4006          */
4007         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4008                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4009         else
4010                 iface->p2p_mgmt = 1;
4011
4012         if (wpa_s->num_multichan_concurrent == 0)
4013                 wpa_s->num_multichan_concurrent = 1;
4014
4015         if (wpa_supplicant_driver_init(wpa_s) < 0)
4016                 return -1;
4017
4018 #ifdef CONFIG_TDLS
4019         if ((!iface->p2p_mgmt ||
4020              !(wpa_s->drv_flags &
4021                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4022             wpa_tdls_init(wpa_s->wpa))
4023                 return -1;
4024 #endif /* CONFIG_TDLS */
4025
4026         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4027             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4028                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4029                 return -1;
4030         }
4031
4032         if (wpas_wps_init(wpa_s))
4033                 return -1;
4034
4035         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4036                 return -1;
4037         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4038
4039         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4040         if (wpa_s->ctrl_iface == NULL) {
4041                 wpa_printf(MSG_ERROR,
4042                            "Failed to initialize control interface '%s'.\n"
4043                            "You may have another wpa_supplicant process "
4044                            "already running or the file was\n"
4045                            "left by an unclean termination of wpa_supplicant "
4046                            "in which case you will need\n"
4047                            "to manually remove this file before starting "
4048                            "wpa_supplicant again.\n",
4049                            wpa_s->conf->ctrl_interface);
4050                 return -1;
4051         }
4052
4053         wpa_s->gas = gas_query_init(wpa_s);
4054         if (wpa_s->gas == NULL) {
4055                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4056                 return -1;
4057         }
4058
4059         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4060                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4061                 return -1;
4062         }
4063
4064         if (wpa_bss_init(wpa_s) < 0)
4065                 return -1;
4066
4067         /*
4068          * Set Wake-on-WLAN triggers, if configured.
4069          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4070          * have effect anyway when the interface is down).
4071          */
4072         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4073                 return -1;
4074
4075 #ifdef CONFIG_EAP_PROXY
4076 {
4077         size_t len;
4078         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4079                                                      &len);
4080         if (wpa_s->mnc_len > 0) {
4081                 wpa_s->imsi[len] = '\0';
4082                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4083                            wpa_s->imsi, wpa_s->mnc_len);
4084         } else {
4085                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4086         }
4087 }
4088 #endif /* CONFIG_EAP_PROXY */
4089
4090         if (pcsc_reader_init(wpa_s) < 0)
4091                 return -1;
4092
4093         if (wpas_init_ext_pw(wpa_s) < 0)
4094                 return -1;
4095
4096         wpas_rrm_reset(wpa_s);
4097
4098         return 0;
4099 }
4100
4101
4102 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4103                                         int notify, int terminate)
4104 {
4105         struct wpa_global *global = wpa_s->global;
4106         struct wpa_supplicant *iface, *prev;
4107
4108         if (wpa_s == wpa_s->parent)
4109                 wpas_p2p_group_remove(wpa_s, "*");
4110
4111         iface = global->ifaces;
4112         while (iface) {
4113                 if (iface == wpa_s || iface->parent != wpa_s) {
4114                         iface = iface->next;
4115                         continue;
4116                 }
4117                 wpa_printf(MSG_DEBUG,
4118                            "Remove remaining child interface %s from parent %s",
4119                            iface->ifname, wpa_s->ifname);
4120                 prev = iface;
4121                 iface = iface->next;
4122                 wpa_supplicant_remove_iface(global, prev, terminate);
4123         }
4124
4125         wpa_s->disconnected = 1;
4126         if (wpa_s->drv_priv) {
4127                 wpa_supplicant_deauthenticate(wpa_s,
4128                                               WLAN_REASON_DEAUTH_LEAVING);
4129
4130                 wpa_drv_set_countermeasures(wpa_s, 0);
4131                 wpa_clear_keys(wpa_s, NULL);
4132         }
4133
4134         wpa_supplicant_cleanup(wpa_s);
4135         wpas_p2p_deinit_iface(wpa_s);
4136
4137         wpas_ctrl_radio_work_flush(wpa_s);
4138         radio_remove_interface(wpa_s);
4139
4140         if (wpa_s->drv_priv)
4141                 wpa_drv_deinit(wpa_s);
4142
4143         if (notify)
4144                 wpas_notify_iface_removed(wpa_s);
4145
4146         if (terminate)
4147                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4148
4149         if (wpa_s->ctrl_iface) {
4150                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4151                 wpa_s->ctrl_iface = NULL;
4152         }
4153
4154 #ifdef CONFIG_MESH
4155         if (wpa_s->ifmsh) {
4156                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4157                 wpa_s->ifmsh = NULL;
4158         }
4159 #endif /* CONFIG_MESH */
4160
4161         if (wpa_s->conf != NULL) {
4162                 wpa_config_free(wpa_s->conf);
4163                 wpa_s->conf = NULL;
4164         }
4165
4166         os_free(wpa_s);
4167 }
4168
4169
4170 /**
4171  * wpa_supplicant_add_iface - Add a new network interface
4172  * @global: Pointer to global data from wpa_supplicant_init()
4173  * @iface: Interface configuration options
4174  * Returns: Pointer to the created interface or %NULL on failure
4175  *
4176  * This function is used to add new network interfaces for %wpa_supplicant.
4177  * This can be called before wpa_supplicant_run() to add interfaces before the
4178  * main event loop has been started. In addition, new interfaces can be added
4179  * dynamically while %wpa_supplicant is already running. This could happen,
4180  * e.g., when a hotplug network adapter is inserted.
4181  */
4182 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4183                                                  struct wpa_interface *iface)
4184 {
4185         struct wpa_supplicant *wpa_s;
4186         struct wpa_interface t_iface;
4187         struct wpa_ssid *ssid;
4188
4189         if (global == NULL || iface == NULL)
4190                 return NULL;
4191
4192         wpa_s = wpa_supplicant_alloc();
4193         if (wpa_s == NULL)
4194                 return NULL;
4195
4196         wpa_s->global = global;
4197
4198         t_iface = *iface;
4199         if (global->params.override_driver) {
4200                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4201                            "('%s' -> '%s')",
4202                            iface->driver, global->params.override_driver);
4203                 t_iface.driver = global->params.override_driver;
4204         }
4205         if (global->params.override_ctrl_interface) {
4206                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4207                            "ctrl_interface ('%s' -> '%s')",
4208                            iface->ctrl_interface,
4209                            global->params.override_ctrl_interface);
4210                 t_iface.ctrl_interface =
4211                         global->params.override_ctrl_interface;
4212         }
4213         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4214                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4215                            iface->ifname);
4216                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4217                 return NULL;
4218         }
4219
4220         if (iface->p2p_mgmt == 0) {
4221                 /* Notify the control interfaces about new iface */
4222                 if (wpas_notify_iface_added(wpa_s)) {
4223                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4224                         return NULL;
4225                 }
4226
4227                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4228                         wpas_notify_network_added(wpa_s, ssid);
4229         }
4230
4231         wpa_s->next = global->ifaces;
4232         global->ifaces = wpa_s;
4233
4234         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4235         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4236
4237 #ifdef CONFIG_P2P
4238         if (wpa_s->global->p2p == NULL &&
4239             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4240             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4241                 wpa_printf(MSG_INFO,
4242                            "P2P: Failed to enable P2P Device interface");
4243                 /* Try to continue without. P2P will be disabled. */
4244         }
4245 #endif /* CONFIG_P2P */
4246
4247         return wpa_s;
4248 }
4249
4250
4251 /**
4252  * wpa_supplicant_remove_iface - Remove a network interface
4253  * @global: Pointer to global data from wpa_supplicant_init()
4254  * @wpa_s: Pointer to the network interface to be removed
4255  * Returns: 0 if interface was removed, -1 if interface was not found
4256  *
4257  * This function can be used to dynamically remove network interfaces from
4258  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4259  * addition, this function is used to remove all remaining interfaces when
4260  * %wpa_supplicant is terminated.
4261  */
4262 int wpa_supplicant_remove_iface(struct wpa_global *global,
4263                                 struct wpa_supplicant *wpa_s,
4264                                 int terminate)
4265 {
4266         struct wpa_supplicant *prev;
4267 #ifdef CONFIG_MESH
4268         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4269         char *ifname = NULL;
4270 #endif /* CONFIG_MESH */
4271
4272         /* Remove interface from the global list of interfaces */
4273         prev = global->ifaces;
4274         if (prev == wpa_s) {
4275                 global->ifaces = wpa_s->next;
4276         } else {
4277                 while (prev && prev->next != wpa_s)
4278                         prev = prev->next;
4279                 if (prev == NULL)
4280                         return -1;
4281                 prev->next = wpa_s->next;
4282         }
4283
4284         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4285
4286 #ifdef CONFIG_MESH
4287         if (mesh_if_created) {
4288                 ifname = os_strdup(wpa_s->ifname);
4289                 if (ifname == NULL) {
4290                         wpa_dbg(wpa_s, MSG_ERROR,
4291                                 "mesh: Failed to malloc ifname");
4292                         return -1;
4293                 }
4294         }
4295 #endif /* CONFIG_MESH */
4296
4297         if (global->p2p_group_formation == wpa_s)
4298                 global->p2p_group_formation = NULL;
4299         if (global->p2p_invite_group == wpa_s)
4300                 global->p2p_invite_group = NULL;
4301         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4302
4303 #ifdef CONFIG_MESH
4304         if (mesh_if_created) {
4305                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4306                 os_free(ifname);
4307         }
4308 #endif /* CONFIG_MESH */
4309
4310         return 0;
4311 }
4312
4313
4314 /**
4315  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4316  * @wpa_s: Pointer to the network interface
4317  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4318  */
4319 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4320 {
4321         const char *eapol_method;
4322
4323         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4324             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4325                 return "NO-EAP";
4326         }
4327
4328         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4329         if (eapol_method == NULL)
4330                 return "UNKNOWN-EAP";
4331
4332         return eapol_method;
4333 }
4334
4335
4336 /**
4337  * wpa_supplicant_get_iface - Get a new network interface
4338  * @global: Pointer to global data from wpa_supplicant_init()
4339  * @ifname: Interface name
4340  * Returns: Pointer to the interface or %NULL if not found
4341  */
4342 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4343                                                  const char *ifname)
4344 {
4345         struct wpa_supplicant *wpa_s;
4346
4347         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4348                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4349                         return wpa_s;
4350         }
4351         return NULL;
4352 }
4353
4354
4355 #ifndef CONFIG_NO_WPA_MSG
4356 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4357 {
4358         struct wpa_supplicant *wpa_s = ctx;
4359         if (wpa_s == NULL)
4360                 return NULL;
4361         return wpa_s->ifname;
4362 }
4363 #endif /* CONFIG_NO_WPA_MSG */
4364
4365
4366 /**
4367  * wpa_supplicant_init - Initialize %wpa_supplicant
4368  * @params: Parameters for %wpa_supplicant
4369  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4370  *
4371  * This function is used to initialize %wpa_supplicant. After successful
4372  * initialization, the returned data pointer can be used to add and remove
4373  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4374  */
4375 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4376 {
4377         struct wpa_global *global;
4378         int ret, i;
4379
4380         if (params == NULL)
4381                 return NULL;
4382
4383 #ifdef CONFIG_DRIVER_NDIS
4384         {
4385                 void driver_ndis_init_ops(void);
4386                 driver_ndis_init_ops();
4387         }
4388 #endif /* CONFIG_DRIVER_NDIS */
4389
4390 #ifndef CONFIG_NO_WPA_MSG
4391         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4392 #endif /* CONFIG_NO_WPA_MSG */
4393
4394         if (params->wpa_debug_file_path)
4395                 wpa_debug_open_file(params->wpa_debug_file_path);
4396         else
4397                 wpa_debug_setup_stdout();
4398         if (params->wpa_debug_syslog)
4399                 wpa_debug_open_syslog();
4400         if (params->wpa_debug_tracing) {
4401                 ret = wpa_debug_open_linux_tracing();
4402                 if (ret) {
4403                         wpa_printf(MSG_ERROR,
4404                                    "Failed to enable trace logging");
4405                         return NULL;
4406                 }
4407         }
4408
4409         ret = eap_register_methods();
4410         if (ret) {
4411                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4412                 if (ret == -2)
4413                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4414                                    "the same EAP type.");
4415                 return NULL;
4416         }
4417
4418         global = os_zalloc(sizeof(*global));
4419         if (global == NULL)
4420                 return NULL;
4421         dl_list_init(&global->p2p_srv_bonjour);
4422         dl_list_init(&global->p2p_srv_upnp);
4423         global->params.daemonize = params->daemonize;
4424         global->params.wait_for_monitor = params->wait_for_monitor;
4425         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4426         if (params->pid_file)
4427                 global->params.pid_file = os_strdup(params->pid_file);
4428         if (params->ctrl_interface)
4429                 global->params.ctrl_interface =
4430                         os_strdup(params->ctrl_interface);
4431         if (params->ctrl_interface_group)
4432                 global->params.ctrl_interface_group =
4433                         os_strdup(params->ctrl_interface_group);
4434         if (params->override_driver)
4435                 global->params.override_driver =
4436                         os_strdup(params->override_driver);
4437         if (params->override_ctrl_interface)
4438                 global->params.override_ctrl_interface =
4439                         os_strdup(params->override_ctrl_interface);
4440         wpa_debug_level = global->params.wpa_debug_level =
4441                 params->wpa_debug_level;
4442         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4443                 params->wpa_debug_show_keys;
4444         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4445                 params->wpa_debug_timestamp;
4446
4447         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4448
4449         if (eloop_init()) {
4450                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4451                 wpa_supplicant_deinit(global);
4452                 return NULL;
4453         }
4454
4455         random_init(params->entropy_file);
4456
4457         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4458         if (global->ctrl_iface == NULL) {
4459                 wpa_supplicant_deinit(global);
4460                 return NULL;
4461         }
4462
4463         if (wpas_notify_supplicant_initialized(global)) {
4464                 wpa_supplicant_deinit(global);
4465                 return NULL;
4466         }
4467
4468         for (i = 0; wpa_drivers[i]; i++)
4469                 global->drv_count++;
4470         if (global->drv_count == 0) {
4471                 wpa_printf(MSG_ERROR, "No drivers enabled");
4472                 wpa_supplicant_deinit(global);
4473                 return NULL;
4474         }
4475         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4476         if (global->drv_priv == NULL) {
4477                 wpa_supplicant_deinit(global);
4478                 return NULL;
4479         }
4480
4481 #ifdef CONFIG_WIFI_DISPLAY
4482         if (wifi_display_init(global) < 0) {
4483                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4484                 wpa_supplicant_deinit(global);
4485                 return NULL;
4486         }
4487 #endif /* CONFIG_WIFI_DISPLAY */
4488
4489         return global;
4490 }
4491
4492
4493 /**
4494  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4495  * @global: Pointer to global data from wpa_supplicant_init()
4496  * Returns: 0 after successful event loop run, -1 on failure
4497  *
4498  * This function starts the main event loop and continues running as long as
4499  * there are any remaining events. In most cases, this function is running as
4500  * long as the %wpa_supplicant process in still in use.
4501  */
4502 int wpa_supplicant_run(struct wpa_global *global)
4503 {
4504         struct wpa_supplicant *wpa_s;
4505
4506         if (global->params.daemonize &&
4507             wpa_supplicant_daemon(global->params.pid_file))
4508                 return -1;
4509
4510         if (global->params.wait_for_monitor) {
4511                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4512                         if (wpa_s->ctrl_iface)
4513                                 wpa_supplicant_ctrl_iface_wait(
4514                                         wpa_s->ctrl_iface);
4515         }
4516
4517         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4518         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4519
4520         eloop_run();
4521
4522         return 0;
4523 }
4524
4525
4526 /**
4527  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4528  * @global: Pointer to global data from wpa_supplicant_init()
4529  *
4530  * This function is called to deinitialize %wpa_supplicant and to free all
4531  * allocated resources. Remaining network interfaces will also be removed.
4532  */
4533 void wpa_supplicant_deinit(struct wpa_global *global)
4534 {
4535         int i;
4536
4537         if (global == NULL)
4538                 return;
4539
4540 #ifdef CONFIG_WIFI_DISPLAY
4541         wifi_display_deinit(global);
4542 #endif /* CONFIG_WIFI_DISPLAY */
4543
4544         while (global->ifaces)
4545                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4546
4547         if (global->ctrl_iface)
4548                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4549
4550         wpas_notify_supplicant_deinitialized(global);
4551
4552         eap_peer_unregister_methods();
4553 #ifdef CONFIG_AP
4554         eap_server_unregister_methods();
4555 #endif /* CONFIG_AP */
4556
4557         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4558                 if (!global->drv_priv[i])
4559                         continue;
4560                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4561         }
4562         os_free(global->drv_priv);
4563
4564         random_deinit();
4565
4566         eloop_destroy();
4567
4568         if (global->params.pid_file) {
4569                 os_daemonize_terminate(global->params.pid_file);
4570                 os_free(global->params.pid_file);
4571         }
4572         os_free(global->params.ctrl_interface);
4573         os_free(global->params.ctrl_interface_group);
4574         os_free(global->params.override_driver);
4575         os_free(global->params.override_ctrl_interface);
4576
4577         os_free(global->p2p_disallow_freq.range);
4578         os_free(global->p2p_go_avoid_freq.range);
4579         os_free(global->add_psk);
4580
4581         os_free(global);
4582         wpa_debug_close_syslog();
4583         wpa_debug_close_file();
4584         wpa_debug_close_linux_tracing();
4585 }
4586
4587
4588 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4589 {
4590         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4591             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4592                 char country[3];
4593                 country[0] = wpa_s->conf->country[0];
4594                 country[1] = wpa_s->conf->country[1];
4595                 country[2] = '\0';
4596                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4597                         wpa_printf(MSG_ERROR, "Failed to set country code "
4598                                    "'%s'", country);
4599                 }
4600         }
4601
4602         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4603                 wpas_init_ext_pw(wpa_s);
4604
4605 #ifdef CONFIG_WPS
4606         wpas_wps_update_config(wpa_s);
4607 #endif /* CONFIG_WPS */
4608         wpas_p2p_update_config(wpa_s);
4609         wpa_s->conf->changed_parameters = 0;
4610 }
4611
4612
4613 void add_freq(int *freqs, int *num_freqs, int freq)
4614 {
4615         int i;
4616
4617         for (i = 0; i < *num_freqs; i++) {
4618                 if (freqs[i] == freq)
4619                         return;
4620         }
4621
4622         freqs[*num_freqs] = freq;
4623         (*num_freqs)++;
4624 }
4625
4626
4627 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4628 {
4629         struct wpa_bss *bss, *cbss;
4630         const int max_freqs = 10;
4631         int *freqs;
4632         int num_freqs = 0;
4633
4634         freqs = os_calloc(max_freqs + 1, sizeof(int));
4635         if (freqs == NULL)
4636                 return NULL;
4637
4638         cbss = wpa_s->current_bss;
4639
4640         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4641                 if (bss == cbss)
4642                         continue;
4643                 if (bss->ssid_len == cbss->ssid_len &&
4644                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4645                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4646                         add_freq(freqs, &num_freqs, bss->freq);
4647                         if (num_freqs == max_freqs)
4648                                 break;
4649                 }
4650         }
4651
4652         if (num_freqs == 0) {
4653                 os_free(freqs);
4654                 freqs = NULL;
4655         }
4656
4657         return freqs;
4658 }
4659
4660
4661 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4662 {
4663         int timeout;
4664         int count;
4665         int *freqs = NULL;
4666
4667         wpas_connect_work_done(wpa_s);
4668
4669         /*
4670          * Remove possible authentication timeout since the connection failed.
4671          */
4672         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4673
4674         if (wpa_s->disconnected) {
4675                 /*
4676                  * There is no point in blacklisting the AP if this event is
4677                  * generated based on local request to disconnect.
4678                  */
4679                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4680                         "indication since interface has been put into "
4681                         "disconnected state");
4682                 return;
4683         }
4684
4685         /*
4686          * Add the failed BSSID into the blacklist and speed up next scan
4687          * attempt if there could be other APs that could accept association.
4688          * The current blacklist count indicates how many times we have tried
4689          * connecting to this AP and multiple attempts mean that other APs are
4690          * either not available or has already been tried, so that we can start
4691          * increasing the delay here to avoid constant scanning.
4692          */
4693         count = wpa_blacklist_add(wpa_s, bssid);
4694         if (count == 1 && wpa_s->current_bss) {
4695                 /*
4696                  * This BSS was not in the blacklist before. If there is
4697                  * another BSS available for the same ESS, we should try that
4698                  * next. Otherwise, we may as well try this one once more
4699                  * before allowing other, likely worse, ESSes to be considered.
4700                  */
4701                 freqs = get_bss_freqs_in_ess(wpa_s);
4702                 if (freqs) {
4703                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4704                                 "has been seen; try it next");
4705                         wpa_blacklist_add(wpa_s, bssid);
4706                         /*
4707                          * On the next scan, go through only the known channels
4708                          * used in this ESS based on previous scans to speed up
4709                          * common load balancing use case.
4710                          */
4711                         os_free(wpa_s->next_scan_freqs);
4712                         wpa_s->next_scan_freqs = freqs;
4713                 }
4714         }
4715
4716         /*
4717          * Add previous failure count in case the temporary blacklist was
4718          * cleared due to no other BSSes being available.
4719          */
4720         count += wpa_s->extra_blacklist_count;
4721
4722         if (count > 3 && wpa_s->current_ssid) {
4723                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4724                            "consider temporary network disabling");
4725                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4726         }
4727
4728         switch (count) {
4729         case 1:
4730                 timeout = 100;
4731                 break;
4732         case 2:
4733                 timeout = 500;
4734                 break;
4735         case 3:
4736                 timeout = 1000;
4737                 break;
4738         case 4:
4739                 timeout = 5000;
4740                 break;
4741         default:
4742                 timeout = 10000;
4743                 break;
4744         }
4745
4746         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4747                 "ms", count, timeout);
4748
4749         /*
4750          * TODO: if more than one possible AP is available in scan results,
4751          * could try the other ones before requesting a new scan.
4752          */
4753         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4754                                 1000 * (timeout % 1000));
4755 }
4756
4757
4758 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4759 {
4760         return wpa_s->conf->ap_scan == 2 ||
4761                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4762 }
4763
4764
4765 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4766 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4767                                               struct wpa_ssid *ssid,
4768                                               const char *field,
4769                                               const char *value)
4770 {
4771 #ifdef IEEE8021X_EAPOL
4772         struct eap_peer_config *eap = &ssid->eap;
4773
4774         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4775         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4776                               (const u8 *) value, os_strlen(value));
4777
4778         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4779         case WPA_CTRL_REQ_EAP_IDENTITY:
4780                 os_free(eap->identity);
4781                 eap->identity = (u8 *) os_strdup(value);
4782                 eap->identity_len = os_strlen(value);
4783                 eap->pending_req_identity = 0;
4784                 if (ssid == wpa_s->current_ssid)
4785                         wpa_s->reassociate = 1;
4786                 break;
4787         case WPA_CTRL_REQ_EAP_PASSWORD:
4788                 bin_clear_free(eap->password, eap->password_len);
4789                 eap->password = (u8 *) os_strdup(value);
4790                 eap->password_len = os_strlen(value);
4791                 eap->pending_req_password = 0;
4792                 if (ssid == wpa_s->current_ssid)
4793                         wpa_s->reassociate = 1;
4794                 break;
4795         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4796                 bin_clear_free(eap->new_password, eap->new_password_len);
4797                 eap->new_password = (u8 *) os_strdup(value);
4798                 eap->new_password_len = os_strlen(value);
4799                 eap->pending_req_new_password = 0;
4800                 if (ssid == wpa_s->current_ssid)
4801                         wpa_s->reassociate = 1;
4802                 break;
4803         case WPA_CTRL_REQ_EAP_PIN:
4804                 str_clear_free(eap->pin);
4805                 eap->pin = os_strdup(value);
4806                 eap->pending_req_pin = 0;
4807                 if (ssid == wpa_s->current_ssid)
4808                         wpa_s->reassociate = 1;
4809                 break;
4810         case WPA_CTRL_REQ_EAP_OTP:
4811                 bin_clear_free(eap->otp, eap->otp_len);
4812                 eap->otp = (u8 *) os_strdup(value);
4813                 eap->otp_len = os_strlen(value);
4814                 os_free(eap->pending_req_otp);
4815                 eap->pending_req_otp = NULL;
4816                 eap->pending_req_otp_len = 0;
4817                 break;
4818         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4819                 str_clear_free(eap->private_key_passwd);
4820                 eap->private_key_passwd = os_strdup(value);
4821                 eap->pending_req_passphrase = 0;
4822                 if (ssid == wpa_s->current_ssid)
4823                         wpa_s->reassociate = 1;
4824                 break;
4825         case WPA_CTRL_REQ_SIM:
4826                 str_clear_free(eap->external_sim_resp);
4827                 eap->external_sim_resp = os_strdup(value);
4828                 break;
4829         default:
4830                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4831                 return -1;
4832         }
4833
4834         return 0;
4835 #else /* IEEE8021X_EAPOL */
4836         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4837         return -1;
4838 #endif /* IEEE8021X_EAPOL */
4839 }
4840 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4841
4842
4843 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4844 {
4845         int i;
4846         unsigned int drv_enc;
4847
4848         if (ssid == NULL)
4849                 return 1;
4850
4851         if (ssid->disabled)
4852                 return 1;
4853
4854         if (wpa_s && wpa_s->drv_capa_known)
4855                 drv_enc = wpa_s->drv_enc;
4856         else
4857                 drv_enc = (unsigned int) -1;
4858
4859         for (i = 0; i < NUM_WEP_KEYS; i++) {
4860                 size_t len = ssid->wep_key_len[i];
4861                 if (len == 0)
4862                         continue;
4863                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4864                         continue;
4865                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4866                         continue;
4867                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4868                         continue;
4869                 return 1; /* invalid WEP key */
4870         }
4871
4872         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4873             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4874                 return 1;
4875
4876         return 0;
4877 }
4878
4879
4880 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4881 {
4882         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4883                 return 1;
4884         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4885                 return 0;
4886         return -1;
4887 }
4888
4889
4890 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4891 {
4892         struct wpa_ssid *ssid = wpa_s->current_ssid;
4893         int dur;
4894         struct os_reltime now;
4895
4896         if (ssid == NULL) {
4897                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4898                            "SSID block");
4899                 return;
4900         }
4901
4902         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4903                 return;
4904
4905         ssid->auth_failures++;
4906
4907 #ifdef CONFIG_P2P
4908         if (ssid->p2p_group &&
4909             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4910                 /*
4911                  * Skip the wait time since there is a short timeout on the
4912                  * connection to a P2P group.
4913                  */
4914                 return;
4915         }
4916 #endif /* CONFIG_P2P */
4917
4918         if (ssid->auth_failures > 50)
4919                 dur = 300;
4920         else if (ssid->auth_failures > 10)
4921                 dur = 120;
4922         else if (ssid->auth_failures > 5)
4923                 dur = 90;
4924         else if (ssid->auth_failures > 3)
4925                 dur = 60;
4926         else if (ssid->auth_failures > 2)
4927                 dur = 30;
4928         else if (ssid->auth_failures > 1)
4929                 dur = 20;
4930         else
4931                 dur = 10;
4932
4933         if (ssid->auth_failures > 1 &&
4934             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
4935                 dur += os_random() % (ssid->auth_failures * 10);
4936
4937         os_get_reltime(&now);
4938         if (now.sec + dur <= ssid->disabled_until.sec)
4939                 return;
4940
4941         ssid->disabled_until.sec = now.sec + dur;
4942
4943         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
4944                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
4945                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
4946                 ssid->auth_failures, dur, reason);
4947 }
4948
4949
4950 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
4951                               struct wpa_ssid *ssid, int clear_failures)
4952 {
4953         if (ssid == NULL)
4954                 return;
4955
4956         if (ssid->disabled_until.sec) {
4957                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
4958                         "id=%d ssid=\"%s\"",
4959                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
4960         }
4961         ssid->disabled_until.sec = 0;
4962         ssid->disabled_until.usec = 0;
4963         if (clear_failures)
4964                 ssid->auth_failures = 0;
4965 }
4966
4967
4968 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
4969 {
4970         size_t i;
4971
4972         if (wpa_s->disallow_aps_bssid == NULL)
4973                 return 0;
4974
4975         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
4976                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
4977                               bssid, ETH_ALEN) == 0)
4978                         return 1;
4979         }
4980
4981         return 0;
4982 }
4983
4984
4985 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
4986                     size_t ssid_len)
4987 {
4988         size_t i;
4989
4990         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
4991                 return 0;
4992
4993         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
4994                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
4995                 if (ssid_len == s->ssid_len &&
4996                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
4997                         return 1;
4998         }
4999
5000         return 0;
5001 }
5002
5003
5004 /**
5005  * wpas_request_connection - Request a new connection
5006  * @wpa_s: Pointer to the network interface
5007  *
5008  * This function is used to request a new connection to be found. It will mark
5009  * the interface to allow reassociation and request a new scan to find a
5010  * suitable network to connect to.
5011  */
5012 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5013 {
5014         wpa_s->normal_scans = 0;
5015         wpa_s->scan_req = NORMAL_SCAN_REQ;
5016         wpa_supplicant_reinit_autoscan(wpa_s);
5017         wpa_s->extra_blacklist_count = 0;
5018         wpa_s->disconnected = 0;
5019         wpa_s->reassociate = 1;
5020
5021         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5022                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5023 }
5024
5025
5026 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5027                     struct wpa_used_freq_data *freqs_data,
5028                     unsigned int len)
5029 {
5030         unsigned int i;
5031
5032         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5033                 len, title);
5034         for (i = 0; i < len; i++) {
5035                 struct wpa_used_freq_data *cur = &freqs_data[i];
5036                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5037                         i, cur->freq, cur->flags);
5038         }
5039 }
5040
5041
5042 /*
5043  * Find the operating frequencies of any of the virtual interfaces that
5044  * are using the same radio as the current interface, and in addition, get
5045  * information about the interface types that are using the frequency.
5046  */
5047 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5048                                 struct wpa_used_freq_data *freqs_data,
5049                                 unsigned int len)
5050 {
5051         struct wpa_supplicant *ifs;
5052         u8 bssid[ETH_ALEN];
5053         int freq;
5054         unsigned int idx = 0, i;
5055
5056         wpa_dbg(wpa_s, MSG_DEBUG,
5057                 "Determining shared radio frequencies (max len %u)", len);
5058         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5059
5060         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5061                          radio_list) {
5062                 if (idx == len)
5063                         break;
5064
5065                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5066                         continue;
5067
5068                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5069                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5070                         freq = ifs->current_ssid->frequency;
5071                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5072                         freq = ifs->assoc_freq;
5073                 else
5074                         continue;
5075
5076                 /* Hold only distinct freqs */
5077                 for (i = 0; i < idx; i++)
5078                         if (freqs_data[i].freq == freq)
5079                                 break;
5080
5081                 if (i == idx)
5082                         freqs_data[idx++].freq = freq;
5083
5084                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5085                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5086                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5087                                 WPA_FREQ_USED_BY_INFRA_STATION;
5088                 }
5089         }
5090
5091         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5092         return idx;
5093 }
5094
5095
5096 /*
5097  * Find the operating frequencies of any of the virtual interfaces that
5098  * are using the same radio as the current interface.
5099  */
5100 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5101                            int *freq_array, unsigned int len)
5102 {
5103         struct wpa_used_freq_data *freqs_data;
5104         int num, i;
5105
5106         os_memset(freq_array, 0, sizeof(int) * len);
5107
5108         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5109         if (!freqs_data)
5110                 return -1;
5111
5112         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5113         for (i = 0; i < num; i++)
5114                 freq_array[i] = freqs_data[i].freq;
5115
5116         os_free(freqs_data);
5117
5118         return num;
5119 }
5120
5121
5122 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5123 {
5124         struct rrm_data *rrm = data;
5125
5126         if (!rrm->notify_neighbor_rep) {
5127                 wpa_printf(MSG_ERROR,
5128                            "RRM: Unexpected neighbor report timeout");
5129                 return;
5130         }
5131
5132         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5133         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5134
5135         rrm->notify_neighbor_rep = NULL;
5136         rrm->neighbor_rep_cb_ctx = NULL;
5137 }
5138
5139
5140 /*
5141  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5142  * @wpa_s: Pointer to wpa_supplicant
5143  */
5144 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5145 {
5146         wpa_s->rrm.rrm_used = 0;
5147
5148         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5149                              NULL);
5150         if (wpa_s->rrm.notify_neighbor_rep)
5151                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5152         wpa_s->rrm.next_neighbor_rep_token = 1;
5153 }
5154
5155
5156 /*
5157  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5158  * @wpa_s: Pointer to wpa_supplicant
5159  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5160  * @report_len: Length of neighbor report buffer
5161  */
5162 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5163                                    const u8 *report, size_t report_len)
5164 {
5165         struct wpabuf *neighbor_rep;
5166
5167         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5168         if (report_len < 1)
5169                 return;
5170
5171         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5172                 wpa_printf(MSG_DEBUG,
5173                            "RRM: Discarding neighbor report with token %d (expected %d)",
5174                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5175                 return;
5176         }
5177
5178         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5179                              NULL);
5180
5181         if (!wpa_s->rrm.notify_neighbor_rep) {
5182                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5183                 return;
5184         }
5185
5186         /* skipping the first byte, which is only an id (dialog token) */
5187         neighbor_rep = wpabuf_alloc(report_len - 1);
5188         if (neighbor_rep == NULL)
5189                 return;
5190         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5191         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5192                    report[0]);
5193         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5194                                        neighbor_rep);
5195         wpa_s->rrm.notify_neighbor_rep = NULL;
5196         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5197 }
5198
5199
5200 /**
5201  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5202  * @wpa_s: Pointer to wpa_supplicant
5203  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5204  *        is sent in the request.
5205  * @cb: Callback function to be called once the requested report arrives, or
5206  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5207  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5208  *      the requester's responsibility to free it.
5209  *      In the latter case NULL will be sent in 'neighbor_rep'.
5210  * @cb_ctx: Context value to send the callback function
5211  * Returns: 0 in case of success, negative error code otherwise
5212  *
5213  * In case there is a previous request which has not been answered yet, the
5214  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5215  * Request must contain a callback function.
5216  */
5217 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5218                                        const struct wpa_ssid *ssid,
5219                                        void (*cb)(void *ctx,
5220                                                   struct wpabuf *neighbor_rep),
5221                                        void *cb_ctx)
5222 {
5223         struct wpabuf *buf;
5224         const u8 *rrm_ie;
5225
5226         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5227                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5228                 return -ENOTCONN;
5229         }
5230
5231         if (!wpa_s->rrm.rrm_used) {
5232                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5233                 return -EOPNOTSUPP;
5234         }
5235
5236         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5237                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5238         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5239             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5240                 wpa_printf(MSG_DEBUG,
5241                            "RRM: No network support for Neighbor Report.");
5242                 return -EOPNOTSUPP;
5243         }
5244
5245         if (!cb) {
5246                 wpa_printf(MSG_DEBUG,
5247                            "RRM: Neighbor Report request must provide a callback.");
5248                 return -EINVAL;
5249         }
5250
5251         /* Refuse if there's a live request */
5252         if (wpa_s->rrm.notify_neighbor_rep) {
5253                 wpa_printf(MSG_DEBUG,
5254                            "RRM: Currently handling previous Neighbor Report.");
5255                 return -EBUSY;
5256         }
5257
5258         /* 3 = action category + action code + dialog token */
5259         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5260         if (buf == NULL) {
5261                 wpa_printf(MSG_DEBUG,
5262                            "RRM: Failed to allocate Neighbor Report Request");
5263                 return -ENOMEM;
5264         }
5265
5266         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5267                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5268                    wpa_s->rrm.next_neighbor_rep_token);
5269
5270         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5271         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5272         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5273         if (ssid) {
5274                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5275                 wpabuf_put_u8(buf, ssid->ssid_len);
5276                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5277         }
5278
5279         wpa_s->rrm.next_neighbor_rep_token++;
5280
5281         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5282                                 wpa_s->own_addr, wpa_s->bssid,
5283                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5284                 wpa_printf(MSG_DEBUG,
5285                            "RRM: Failed to send Neighbor Report Request");
5286                 wpabuf_free(buf);
5287                 return -ECANCELED;
5288         }
5289
5290         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5291         wpa_s->rrm.notify_neighbor_rep = cb;
5292         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5293                                wpas_rrm_neighbor_rep_timeout_handler,
5294                                &wpa_s->rrm, NULL);
5295
5296         wpabuf_free(buf);
5297         return 0;
5298 }
5299
5300
5301 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5302                                               const u8 *src,
5303                                               const u8 *frame, size_t len,
5304                                               int rssi)
5305 {
5306         struct wpabuf *buf;
5307         const struct rrm_link_measurement_request *req;
5308         struct rrm_link_measurement_report report;
5309
5310         if (wpa_s->wpa_state != WPA_COMPLETED) {
5311                 wpa_printf(MSG_INFO,
5312                            "RRM: Ignoring link measurement request. Not associated");
5313                 return;
5314         }
5315
5316         if (!wpa_s->rrm.rrm_used) {
5317                 wpa_printf(MSG_INFO,
5318                            "RRM: Ignoring link measurement request. Not RRM network");
5319                 return;
5320         }
5321
5322         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5323                 wpa_printf(MSG_INFO,
5324                            "RRM: Measurement report failed. TX power insertion not supported");
5325                 return;
5326         }
5327
5328         req = (const struct rrm_link_measurement_request *) frame;
5329         if (len < sizeof(*req)) {
5330                 wpa_printf(MSG_INFO,
5331                            "RRM: Link measurement report failed. Request too short");
5332                 return;
5333         }
5334
5335         os_memset(&report, 0, sizeof(report));
5336         report.tpc.eid = WLAN_EID_TPC_REPORT;
5337         report.tpc.len = 2;
5338         report.rsni = 255; /* 255 indicates that RSNI is not available */
5339         report.dialog_token = req->dialog_token;
5340
5341         /*
5342          * It's possible to estimate RCPI based on RSSI in dBm. This
5343          * calculation will not reflect the correct value for high rates,
5344          * but it's good enough for Action frames which are transmitted
5345          * with up to 24 Mbps rates.
5346          */
5347         if (!rssi)
5348                 report.rcpi = 255; /* not available */
5349         else if (rssi < -110)
5350                 report.rcpi = 0;
5351         else if (rssi > 0)
5352                 report.rcpi = 220;
5353         else
5354                 report.rcpi = (rssi + 110) * 2;
5355
5356         /* action_category + action_code */
5357         buf = wpabuf_alloc(2 + sizeof(report));
5358         if (buf == NULL) {
5359                 wpa_printf(MSG_ERROR,
5360                            "RRM: Link measurement report failed. Buffer allocation failed");
5361                 return;
5362         }
5363
5364         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5365         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5366         wpabuf_put_data(buf, &report, sizeof(report));
5367         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5368                     wpabuf_head(buf), wpabuf_len(buf));
5369
5370         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5371                                 wpa_s->own_addr, wpa_s->bssid,
5372                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5373                 wpa_printf(MSG_ERROR,
5374                            "RRM: Link measurement report failed. Send action failed");
5375         }
5376         wpabuf_free(buf);
5377 }