wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "blacklist.h"
  39 #include "wpas_glue.h"
  40 #include "wps_supplicant.h"
  41 #include "ibss_rsn.h"
  42 #include "sme.h"
  43 #include "gas_query.h"
  44 #include "ap.h"
  45 #include "p2p_supplicant.h"
  46 #include "wifi_display.h"
  47 #include "notify.h"
  48 #include "bgscan.h"
  49 #include "autoscan.h"
  50 #include "bss.h"
  51 #include "scan.h"
  52 #include "offchannel.h"
  53 #include "hs20_supplicant.h"
  54 #include "wnm_sta.h"
  55 #include "wpas_kay.h"
  56 #include "mesh.h"
  57
  58 const char *wpa_supplicant_version =
  59 "wpa_supplicant v" VERSION_STR "\n"
  60 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  61
  62 const char *wpa_supplicant_license =
  63 "This software may be distributed under the terms of the BSD license.\n"
  64 "See README for more details.\n"
  65 #ifdef EAP_TLS_OPENSSL
  66 "\nThis product includes software developed by the OpenSSL Project\n"
  67 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  68 #endif /* EAP_TLS_OPENSSL */
  69 ;
  70
  71 #ifndef CONFIG_NO_STDOUT_DEBUG
  72 /* Long text divided into parts in order to fit in C89 strings size limits. */
  73 const char *wpa_supplicant_full_license1 =
  74 "";
  75 const char *wpa_supplicant_full_license2 =
  76 "This software may be distributed under the terms of the BSD license.\n"
  77 "\n"
  78 "Redistribution and use in source and binary forms, with or without\n"
  79 "modification, are permitted provided that the following conditions are\n"
  80 "met:\n"
  81 "\n";
  82 const char *wpa_supplicant_full_license3 =
  83 "1. Redistributions of source code must retain the above copyright\n"
  84 "   notice, this list of conditions and the following disclaimer.\n"
  85 "\n"
  86 "2. Redistributions in binary form must reproduce the above copyright\n"
  87 "   notice, this list of conditions and the following disclaimer in the\n"
  88 "   documentation and/or other materials provided with the distribution.\n"
  89 "\n";
  90 const char *wpa_supplicant_full_license4 =
  91 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  92 "   names of its contributors may be used to endorse or promote products\n"
  93 "   derived from this software without specific prior written permission.\n"
  94 "\n"
  95 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  96 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  97 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  98 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
  99 const char *wpa_supplicant_full_license5 =
 100 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 101 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 102 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 103 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 104 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 105 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 106 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 107 "\n";
 108 #endif /* CONFIG_NO_STDOUT_DEBUG */
 109
 110 /* Configure default/group WEP keys for static WEP */
 111 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 112 {
 113         int i, set = 0;
 114
 115         for (i = 0; i < NUM_WEP_KEYS; i++) {
 116                 if (ssid->wep_key_len[i] == 0)
 117                         continue;
 118
 119                 set = 1;
 120                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 121                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 122                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 123         }
 124
 125         return set;
 126 }
 127
 128
 129 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 130                                     struct wpa_ssid *ssid)
 131 {
 132         u8 key[32];
 133         size_t keylen;
 134         enum wpa_alg alg;
 135         u8 seq[6] = { 0 };
 136         int ret;
 137
 138         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 139          * sending unicast and multicast packets. */
 140
 141         if (ssid->mode != WPAS_MODE_IBSS) {
 142                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 143                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 144                 return -1;
 145         }
 146
 147         if (!ssid->psk_set) {
 148                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 149                         "WPA-None");
 150                 return -1;
 151         }
 152
 153         switch (wpa_s->group_cipher) {
 154         case WPA_CIPHER_CCMP:
 155                 os_memcpy(key, ssid->psk, 16);
 156                 keylen = 16;
 157                 alg = WPA_ALG_CCMP;
 158                 break;
 159         case WPA_CIPHER_GCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_GCMP;
 163                 break;
 164         case WPA_CIPHER_TKIP:
 165                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 166                 os_memcpy(key, ssid->psk, 16 + 8);
 167                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 168                 keylen = 32;
 169                 alg = WPA_ALG_TKIP;
 170                 break;
 171         default:
 172                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 173                         "WPA-None", wpa_s->group_cipher);
 174                 return -1;
 175         }
 176
 177         /* TODO: should actually remember the previously used seq#, both for TX
 178          * and RX from each STA.. */
 179
 180         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 181         os_memset(key, 0, sizeof(key));
 182         return ret;
 183 }
 184
 185
 186 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 187 {
 188         struct wpa_supplicant *wpa_s = eloop_ctx;
 189         const u8 *bssid = wpa_s->bssid;
 190         if (is_zero_ether_addr(bssid))
 191                 bssid = wpa_s->pending_bssid;
 192         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 193                 MAC2STR(bssid));
 194         wpa_blacklist_add(wpa_s, bssid);
 195         wpa_sm_notify_disassoc(wpa_s->wpa);
 196         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 197         wpa_s->reassociate = 1;
 198
 199         /*
 200          * If we timed out, the AP or the local radio may be busy.
 201          * So, wait a second until scanning again.
 202          */
 203         wpa_supplicant_req_scan(wpa_s, 1, 0);
 204 }
 205
 206
 207 /**
 208  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 209  * @wpa_s: Pointer to wpa_supplicant data
 210  * @sec: Number of seconds after which to time out authentication
 211  * @usec: Number of microseconds after which to time out authentication
 212  *
 213  * This function is used to schedule a timeout for the current authentication
 214  * attempt.
 215  */
 216 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 217                                      int sec, int usec)
 218 {
 219         if (wpa_s->conf->ap_scan == 0 &&
 220             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 221                 return;
 222
 223         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 224                 "%d usec", sec, usec);
 225         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 226         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 227 }
 228
 229
 230 /**
 231  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 232  * @wpa_s: Pointer to wpa_supplicant data
 233  *
 234  * This function is used to cancel authentication timeout scheduled with
 235  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 236  * been completed.
 237  */
 238 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 239 {
 240         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 241         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 242         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 243 }
 244
 245
 246 /**
 247  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 248  * @wpa_s: Pointer to wpa_supplicant data
 249  *
 250  * This function is used to configure EAPOL state machine based on the selected
 251  * authentication mode.
 252  */
 253 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 254 {
 255 #ifdef IEEE8021X_EAPOL
 256         struct eapol_config eapol_conf;
 257         struct wpa_ssid *ssid = wpa_s->current_ssid;
 258
 259 #ifdef CONFIG_IBSS_RSN
 260         if (ssid->mode == WPAS_MODE_IBSS &&
 261             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 263                 /*
 264                  * RSN IBSS authentication is per-STA and we can disable the
 265                  * per-BSSID EAPOL authentication.
 266                  */
 267                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 268                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 269                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 270                 return;
 271         }
 272 #endif /* CONFIG_IBSS_RSN */
 273
 274         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 275         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 276
 277         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 278             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 279                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 280         else
 281                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 282
 283         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 284         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 285                 eapol_conf.accept_802_1x_keys = 1;
 286                 eapol_conf.required_keys = 0;
 287                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 288                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 289                 }
 290                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 291                         eapol_conf.required_keys |=
 292                                 EAPOL_REQUIRE_KEY_BROADCAST;
 293                 }
 294
 295                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 296                         eapol_conf.required_keys = 0;
 297         }
 298         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 299         eapol_conf.workaround = ssid->eap_workaround;
 300         eapol_conf.eap_disabled =
 301                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 302                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 304         eapol_conf.external_sim = wpa_s->conf->external_sim;
 305
 306 #ifdef CONFIG_WPS
 307         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 308                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 309                 if (wpa_s->current_bss) {
 310                         struct wpabuf *ie;
 311                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 312                                                          WPS_IE_VENDOR_TYPE);
 313                         if (ie) {
 314                                 if (wps_is_20(ie))
 315                                         eapol_conf.wps |=
 316                                                 EAPOL_PEER_IS_WPS20_AP;
 317                                 wpabuf_free(ie);
 318                         }
 319                 }
 320         }
 321 #endif /* CONFIG_WPS */
 322
 323         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 324
 325         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 326 #endif /* IEEE8021X_EAPOL */
 327 }
 328
 329
 330 /**
 331  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 332  * @wpa_s: Pointer to wpa_supplicant data
 333  * @ssid: Configuration data for the network
 334  *
 335  * This function is used to configure WPA state machine and related parameters
 336  * to a mode where WPA is not enabled. This is called as part of the
 337  * authentication configuration when the selected network does not use WPA.
 338  */
 339 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 340                                        struct wpa_ssid *ssid)
 341 {
 342         int i;
 343
 344         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 345                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 346         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 347                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 348         else
 349                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 350         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 351         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 353         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 354         wpa_s->group_cipher = WPA_CIPHER_NONE;
 355         wpa_s->mgmt_group_cipher = 0;
 356
 357         for (i = 0; i < NUM_WEP_KEYS; i++) {
 358                 if (ssid->wep_key_len[i] > 5) {
 359                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 360                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 361                         break;
 362                 } else if (ssid->wep_key_len[i] > 0) {
 363                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 364                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 365                         break;
 366                 }
 367         }
 368
 369         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 372                          wpa_s->pairwise_cipher);
 373         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 374 #ifdef CONFIG_IEEE80211W
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 376                          wpa_s->mgmt_group_cipher);
 377 #endif /* CONFIG_IEEE80211W */
 378
 379         pmksa_cache_clear_current(wpa_s->wpa);
 380 }
 381
 382
 383 void free_hw_features(struct wpa_supplicant *wpa_s)
 384 {
 385         int i;
 386         if (wpa_s->hw.modes == NULL)
 387                 return;
 388
 389         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 390                 os_free(wpa_s->hw.modes[i].channels);
 391                 os_free(wpa_s->hw.modes[i].rates);
 392         }
 393
 394         os_free(wpa_s->hw.modes);
 395         wpa_s->hw.modes = NULL;
 396 }
 397
 398
 399 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 400 {
 401         int i;
 402
 403         bgscan_deinit(wpa_s);
 404         autoscan_deinit(wpa_s);
 405         scard_deinit(wpa_s->scard);
 406         wpa_s->scard = NULL;
 407         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 408         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 409         l2_packet_deinit(wpa_s->l2);
 410         wpa_s->l2 = NULL;
 411         if (wpa_s->l2_br) {
 412                 l2_packet_deinit(wpa_s->l2_br);
 413                 wpa_s->l2_br = NULL;
 414         }
 415 #ifdef CONFIG_TESTING_OPTIONS
 416         l2_packet_deinit(wpa_s->l2_test);
 417         wpa_s->l2_test = NULL;
 418 #endif /* CONFIG_TESTING_OPTIONS */
 419
 420         if (wpa_s->conf != NULL) {
 421                 struct wpa_ssid *ssid;
 422                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 423                         wpas_notify_network_removed(wpa_s, ssid);
 424         }
 425
 426         os_free(wpa_s->confname);
 427         wpa_s->confname = NULL;
 428
 429         os_free(wpa_s->confanother);
 430         wpa_s->confanother = NULL;
 431
 432         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 433         eapol_sm_deinit(wpa_s->eapol);
 434         wpa_s->eapol = NULL;
 435
 436         rsn_preauth_deinit(wpa_s->wpa);
 437
 438 #ifdef CONFIG_TDLS
 439         wpa_tdls_deinit(wpa_s->wpa);
 440 #endif /* CONFIG_TDLS */
 441
 442         wmm_ac_clear_saved_tspecs(wpa_s);
 443         pmksa_candidate_free(wpa_s->wpa);
 444         wpa_sm_deinit(wpa_s->wpa);
 445         wpa_s->wpa = NULL;
 446         wpa_blacklist_clear(wpa_s);
 447
 448         wpa_bss_deinit(wpa_s);
 449
 450         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 451         wpa_supplicant_cancel_scan(wpa_s);
 452         wpa_supplicant_cancel_auth_timeout(wpa_s);
 453         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 454 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 455         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 456                              wpa_s, NULL);
 457 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 458
 459         wpas_wps_deinit(wpa_s);
 460
 461         wpabuf_free(wpa_s->pending_eapol_rx);
 462         wpa_s->pending_eapol_rx = NULL;
 463
 464 #ifdef CONFIG_IBSS_RSN
 465         ibss_rsn_deinit(wpa_s->ibss_rsn);
 466         wpa_s->ibss_rsn = NULL;
 467 #endif /* CONFIG_IBSS_RSN */
 468
 469         sme_deinit(wpa_s);
 470
 471 #ifdef CONFIG_AP
 472         wpa_supplicant_ap_deinit(wpa_s);
 473 #endif /* CONFIG_AP */
 474
 475         wpas_p2p_deinit(wpa_s);
 476
 477 #ifdef CONFIG_OFFCHANNEL
 478         offchannel_deinit(wpa_s);
 479 #endif /* CONFIG_OFFCHANNEL */
 480
 481         wpa_supplicant_cancel_sched_scan(wpa_s);
 482
 483         os_free(wpa_s->next_scan_freqs);
 484         wpa_s->next_scan_freqs = NULL;
 485
 486         os_free(wpa_s->manual_scan_freqs);
 487         wpa_s->manual_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_sched_scan_freqs);
 490         wpa_s->manual_sched_scan_freqs = NULL;
 491
 492         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 493
 494         gas_query_deinit(wpa_s->gas);
 495         wpa_s->gas = NULL;
 496
 497         free_hw_features(wpa_s);
 498
 499         ieee802_1x_dealloc_kay_sm(wpa_s);
 500
 501         os_free(wpa_s->bssid_filter);
 502         wpa_s->bssid_filter = NULL;
 503
 504         os_free(wpa_s->disallow_aps_bssid);
 505         wpa_s->disallow_aps_bssid = NULL;
 506         os_free(wpa_s->disallow_aps_ssid);
 507         wpa_s->disallow_aps_ssid = NULL;
 508
 509         wnm_bss_keep_alive_deinit(wpa_s);
 510 #ifdef CONFIG_WNM
 511         wnm_deallocate_memory(wpa_s);
 512 #endif /* CONFIG_WNM */
 513
 514         ext_password_deinit(wpa_s->ext_pw);
 515         wpa_s->ext_pw = NULL;
 516
 517         wpabuf_free(wpa_s->last_gas_resp);
 518         wpa_s->last_gas_resp = NULL;
 519         wpabuf_free(wpa_s->prev_gas_resp);
 520         wpa_s->prev_gas_resp = NULL;
 521
 522         os_free(wpa_s->last_scan_res);
 523         wpa_s->last_scan_res = NULL;
 524
 525 #ifdef CONFIG_HS20
 526         hs20_deinit(wpa_s);
 527 #endif /* CONFIG_HS20 */
 528
 529         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 530                 wpabuf_free(wpa_s->vendor_elem[i]);
 531                 wpa_s->vendor_elem[i] = NULL;
 532         }
 533
 534         wmm_ac_notify_disassoc(wpa_s);
 535 }
 536
 537
 538 /**
 539  * wpa_clear_keys - Clear keys configured for the driver
 540  * @wpa_s: Pointer to wpa_supplicant data
 541  * @addr: Previously used BSSID or %NULL if not available
 542  *
 543  * This function clears the encryption keys that has been previously configured
 544  * for the driver.
 545  */
 546 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 547 {
 548         int i, max;
 549
 550 #ifdef CONFIG_IEEE80211W
 551         max = 6;
 552 #else /* CONFIG_IEEE80211W */
 553         max = 4;
 554 #endif /* CONFIG_IEEE80211W */
 555
 556         /* MLME-DELETEKEYS.request */
 557         for (i = 0; i < max; i++) {
 558                 if (wpa_s->keys_cleared & BIT(i))
 559                         continue;
 560                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 561                                 NULL, 0);
 562         }
 563         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 564             !is_zero_ether_addr(addr)) {
 565                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 566                                 0);
 567                 /* MLME-SETPROTECTION.request(None) */
 568                 wpa_drv_mlme_setprotection(
 569                         wpa_s, addr,
 570                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 571                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 572         }
 573         wpa_s->keys_cleared = (u32) -1;
 574 }
 575
 576
 577 /**
 578  * wpa_supplicant_state_txt - Get the connection state name as a text string
 579  * @state: State (wpa_state; WPA_*)
 580  * Returns: The state name as a printable text string
 581  */
 582 const char * wpa_supplicant_state_txt(enum wpa_states state)
 583 {
 584         switch (state) {
 585         case WPA_DISCONNECTED:
 586                 return "DISCONNECTED";
 587         case WPA_INACTIVE:
 588                 return "INACTIVE";
 589         case WPA_INTERFACE_DISABLED:
 590                 return "INTERFACE_DISABLED";
 591         case WPA_SCANNING:
 592                 return "SCANNING";
 593         case WPA_AUTHENTICATING:
 594                 return "AUTHENTICATING";
 595         case WPA_ASSOCIATING:
 596                 return "ASSOCIATING";
 597         case WPA_ASSOCIATED:
 598                 return "ASSOCIATED";
 599         case WPA_4WAY_HANDSHAKE:
 600                 return "4WAY_HANDSHAKE";
 601         case WPA_GROUP_HANDSHAKE:
 602                 return "GROUP_HANDSHAKE";
 603         case WPA_COMPLETED:
 604                 return "COMPLETED";
 605         default:
 606                 return "UNKNOWN";
 607         }
 608 }
 609
 610
 611 #ifdef CONFIG_BGSCAN
 612
 613 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 614 {
 615         const char *name;
 616
 617         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 618                 name = wpa_s->current_ssid->bgscan;
 619         else
 620                 name = wpa_s->conf->bgscan;
 621         if (name == NULL || name[0] == '\0')
 622                 return;
 623         if (wpas_driver_bss_selection(wpa_s))
 624                 return;
 625         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 626                 return;
 627 #ifdef CONFIG_P2P
 628         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 629                 return;
 630 #endif /* CONFIG_P2P */
 631
 632         bgscan_deinit(wpa_s);
 633         if (wpa_s->current_ssid) {
 634                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 635                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 636                                 "bgscan");
 637                         /*
 638                          * Live without bgscan; it is only used as a roaming
 639                          * optimization, so the initial connection is not
 640                          * affected.
 641                          */
 642                 } else {
 643                         struct wpa_scan_results *scan_res;
 644                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 645                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 646                                                                    0);
 647                         if (scan_res) {
 648                                 bgscan_notify_scan(wpa_s, scan_res);
 649                                 wpa_scan_results_free(scan_res);
 650                         }
 651                 }
 652         } else
 653                 wpa_s->bgscan_ssid = NULL;
 654 }
 655
 656
 657 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 658 {
 659         if (wpa_s->bgscan_ssid != NULL) {
 660                 bgscan_deinit(wpa_s);
 661                 wpa_s->bgscan_ssid = NULL;
 662         }
 663 }
 664
 665 #endif /* CONFIG_BGSCAN */
 666
 667
 668 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 669 {
 670         if (autoscan_init(wpa_s, 0))
 671                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 672 }
 673
 674
 675 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 676 {
 677         autoscan_deinit(wpa_s);
 678 }
 679
 680
 681 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 684             wpa_s->wpa_state == WPA_SCANNING) {
 685                 autoscan_deinit(wpa_s);
 686                 wpa_supplicant_start_autoscan(wpa_s);
 687         }
 688 }
 689
 690
 691 /**
 692  * wpa_supplicant_set_state - Set current connection state
 693  * @wpa_s: Pointer to wpa_supplicant data
 694  * @state: The new connection state
 695  *
 696  * This function is called whenever the connection state changes, e.g.,
 697  * association is completed for WPA/WPA2 4-Way Handshake is started.
 698  */
 699 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 700                               enum wpa_states state)
 701 {
 702         enum wpa_states old_state = wpa_s->wpa_state;
 703
 704         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 705                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 706                 wpa_supplicant_state_txt(state));
 707
 708         if (state == WPA_INTERFACE_DISABLED) {
 709                 /* Assure normal scan when interface is restored */
 710                 wpa_s->normal_scans = 0;
 711         }
 712
 713         if (state == WPA_COMPLETED) {
 714                 wpas_connect_work_done(wpa_s);
 715                 /* Reinitialize normal_scan counter */
 716                 wpa_s->normal_scans = 0;
 717         }
 718
 719         if (state != WPA_SCANNING)
 720                 wpa_supplicant_notify_scanning(wpa_s, 0);
 721
 722         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 723                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 724 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 725                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 726                         MACSTR " completed [id=%d id_str=%s]",
 727                         MAC2STR(wpa_s->bssid),
 728                         ssid ? ssid->id : -1,
 729                         ssid && ssid->id_str ? ssid->id_str : "");
 730 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 731                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 732                 wpa_s->extra_blacklist_count = 0;
 733                 wpa_s->new_connection = 0;
 734                 wpa_drv_set_operstate(wpa_s, 1);
 735 #ifndef IEEE8021X_EAPOL
 736                 wpa_drv_set_supp_port(wpa_s, 1);
 737 #endif /* IEEE8021X_EAPOL */
 738                 wpa_s->after_wps = 0;
 739                 wpa_s->known_wps_freq = 0;
 740                 wpas_p2p_completed(wpa_s);
 741
 742                 sme_sched_obss_scan(wpa_s, 1);
 743         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 744                    state == WPA_ASSOCIATED) {
 745                 wpa_s->new_connection = 1;
 746                 wpa_drv_set_operstate(wpa_s, 0);
 747 #ifndef IEEE8021X_EAPOL
 748                 wpa_drv_set_supp_port(wpa_s, 0);
 749 #endif /* IEEE8021X_EAPOL */
 750                 sme_sched_obss_scan(wpa_s, 0);
 751         }
 752         wpa_s->wpa_state = state;
 753
 754 #ifdef CONFIG_BGSCAN
 755         if (state == WPA_COMPLETED)
 756                 wpa_supplicant_start_bgscan(wpa_s);
 757         else if (state < WPA_ASSOCIATED)
 758                 wpa_supplicant_stop_bgscan(wpa_s);
 759 #endif /* CONFIG_BGSCAN */
 760
 761         if (state == WPA_AUTHENTICATING)
 762                 wpa_supplicant_stop_autoscan(wpa_s);
 763
 764         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 765                 wpa_supplicant_start_autoscan(wpa_s);
 766
 767         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 768                 wmm_ac_notify_disassoc(wpa_s);
 769
 770         if (wpa_s->wpa_state != old_state) {
 771                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 772
 773                 /*
 774                  * Notify the P2P Device interface about a state change in one
 775                  * of the interfaces.
 776                  */
 777                 wpas_p2p_indicate_state_change(wpa_s);
 778
 779                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 780                     old_state == WPA_COMPLETED)
 781                         wpas_notify_auth_changed(wpa_s);
 782         }
 783 }
 784
 785
 786 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 787 {
 788         int pending = 0;
 789 #ifdef CONFIG_WPS
 790         struct wpa_supplicant *wpa_s = global->ifaces;
 791         while (wpa_s) {
 792                 struct wpa_supplicant *next = wpa_s->next;
 793                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 794                         pending = 1;
 795 #ifdef CONFIG_P2P
 796                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 797                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 798                         wpas_p2p_disconnect(wpa_s);
 799 #endif /* CONFIG_P2P */
 800                 wpa_s = next;
 801         }
 802 #endif /* CONFIG_WPS */
 803         if (pending)
 804                 return;
 805         eloop_terminate();
 806 }
 807
 808
 809 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 810 {
 811         struct wpa_global *global = signal_ctx;
 812         wpa_supplicant_terminate_proc(global);
 813 }
 814
 815
 816 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 817 {
 818         enum wpa_states old_state = wpa_s->wpa_state;
 819
 820         wpa_s->pairwise_cipher = 0;
 821         wpa_s->group_cipher = 0;
 822         wpa_s->mgmt_group_cipher = 0;
 823         wpa_s->key_mgmt = 0;
 824         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 825                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 826
 827         if (wpa_s->wpa_state != old_state)
 828                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 829 }
 830
 831
 832 /**
 833  * wpa_supplicant_reload_configuration - Reload configuration data
 834  * @wpa_s: Pointer to wpa_supplicant data
 835  * Returns: 0 on success or -1 if configuration parsing failed
 836  *
 837  * This function can be used to request that the configuration data is reloaded
 838  * (e.g., after configuration file change). This function is reloading
 839  * configuration only for one interface, so this may need to be called multiple
 840  * times if %wpa_supplicant is controlling multiple interfaces and all
 841  * interfaces need reconfiguration.
 842  */
 843 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 844 {
 845         struct wpa_config *conf;
 846         int reconf_ctrl;
 847         int old_ap_scan;
 848
 849         if (wpa_s->confname == NULL)
 850                 return -1;
 851         conf = wpa_config_read(wpa_s->confname, NULL);
 852         if (conf == NULL) {
 853                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 854                         "file '%s' - exiting", wpa_s->confname);
 855                 return -1;
 856         }
 857         wpa_config_read(wpa_s->confanother, conf);
 858
 859         conf->changed_parameters = (unsigned int) -1;
 860
 861         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 862                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 863                     os_strcmp(conf->ctrl_interface,
 864                               wpa_s->conf->ctrl_interface) != 0);
 865
 866         if (reconf_ctrl && wpa_s->ctrl_iface) {
 867                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 868                 wpa_s->ctrl_iface = NULL;
 869         }
 870
 871         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 872         if (wpa_s->current_ssid) {
 873                 wpa_supplicant_deauthenticate(wpa_s,
 874                                               WLAN_REASON_DEAUTH_LEAVING);
 875         }
 876
 877         /*
 878          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 879          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 880          */
 881         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 882                 /*
 883                  * Clear forced success to clear EAP state for next
 884                  * authentication.
 885                  */
 886                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 887         }
 888         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 889         wpa_sm_set_config(wpa_s->wpa, NULL);
 890         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 891         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 892         rsn_preauth_deinit(wpa_s->wpa);
 893
 894         old_ap_scan = wpa_s->conf->ap_scan;
 895         wpa_config_free(wpa_s->conf);
 896         wpa_s->conf = conf;
 897         if (old_ap_scan != wpa_s->conf->ap_scan)
 898                 wpas_notify_ap_scan_changed(wpa_s);
 899
 900         if (reconf_ctrl)
 901                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 902
 903         wpa_supplicant_update_config(wpa_s);
 904
 905         wpa_supplicant_clear_status(wpa_s);
 906         if (wpa_supplicant_enabled_networks(wpa_s)) {
 907                 wpa_s->reassociate = 1;
 908                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 909         }
 910         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 911         return 0;
 912 }
 913
 914
 915 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 916 {
 917         struct wpa_global *global = signal_ctx;
 918         struct wpa_supplicant *wpa_s;
 919         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 920                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 921                         sig);
 922                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 923                         wpa_supplicant_terminate_proc(global);
 924                 }
 925         }
 926 }
 927
 928
 929 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 930                                          struct wpa_ssid *ssid,
 931                                          struct wpa_ie_data *ie)
 932 {
 933         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 934         if (ret) {
 935                 if (ret == -2) {
 936                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 937                                 "from association info");
 938                 }
 939                 return -1;
 940         }
 941
 942         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 943                 "cipher suites");
 944         if (!(ie->group_cipher & ssid->group_cipher)) {
 945                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 946                         "cipher 0x%x (mask 0x%x) - reject",
 947                         ie->group_cipher, ssid->group_cipher);
 948                 return -1;
 949         }
 950         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 951                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 952                         "cipher 0x%x (mask 0x%x) - reject",
 953                         ie->pairwise_cipher, ssid->pairwise_cipher);
 954                 return -1;
 955         }
 956         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 957                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 958                         "management 0x%x (mask 0x%x) - reject",
 959                         ie->key_mgmt, ssid->key_mgmt);
 960                 return -1;
 961         }
 962
 963 #ifdef CONFIG_IEEE80211W
 964         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
 965             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
 966                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
 967                         "that does not support management frame protection - "
 968                         "reject");
 969                 return -1;
 970         }
 971 #endif /* CONFIG_IEEE80211W */
 972
 973         return 0;
 974 }
 975
 976
 977 /**
 978  * wpa_supplicant_set_suites - Set authentication and encryption parameters
 979  * @wpa_s: Pointer to wpa_supplicant data
 980  * @bss: Scan results for the selected BSS, or %NULL if not available
 981  * @ssid: Configuration data for the selected network
 982  * @wpa_ie: Buffer for the WPA/RSN IE
 983  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
 984  * used buffer length in case the functions returns success.
 985  * Returns: 0 on success or -1 on failure
 986  *
 987  * This function is used to configure authentication and encryption parameters
 988  * based on the network configuration and scan result for the selected BSS (if
 989  * available).
 990  */
 991 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
 992                               struct wpa_bss *bss, struct wpa_ssid *ssid,
 993                               u8 *wpa_ie, size_t *wpa_ie_len)
 994 {
 995         struct wpa_ie_data ie;
 996         int sel, proto;
 997         const u8 *bss_wpa, *bss_rsn, *bss_osen;
 998
 999         if (bss) {
1000                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1001                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1002                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1003         } else
1004                 bss_wpa = bss_rsn = bss_osen = NULL;
1005
1006         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1007             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1008             (ie.group_cipher & ssid->group_cipher) &&
1009             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1010             (ie.key_mgmt & ssid->key_mgmt)) {
1011                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1012                 proto = WPA_PROTO_RSN;
1013         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1014                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1015                    (ie.group_cipher & ssid->group_cipher) &&
1016                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1017                    (ie.key_mgmt & ssid->key_mgmt)) {
1018                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1019                 proto = WPA_PROTO_WPA;
1020 #ifdef CONFIG_HS20
1021         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1022                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1023                 /* TODO: parse OSEN element */
1024                 os_memset(&ie, 0, sizeof(ie));
1025                 ie.group_cipher = WPA_CIPHER_CCMP;
1026                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1027                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1028                 proto = WPA_PROTO_OSEN;
1029 #endif /* CONFIG_HS20 */
1030         } else if (bss) {
1031                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1032                 wpa_dbg(wpa_s, MSG_DEBUG,
1033                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1034                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1035                         ssid->key_mgmt);
1036                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1037                         MAC2STR(bss->bssid),
1038                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1039                         bss_wpa ? " WPA" : "",
1040                         bss_rsn ? " RSN" : "",
1041                         bss_osen ? " OSEN" : "");
1042                 if (bss_rsn) {
1043                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1044                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1045                                 wpa_dbg(wpa_s, MSG_DEBUG,
1046                                         "Could not parse RSN element");
1047                         } else {
1048                                 wpa_dbg(wpa_s, MSG_DEBUG,
1049                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1050                                         ie.pairwise_cipher, ie.group_cipher,
1051                                         ie.key_mgmt);
1052                         }
1053                 }
1054                 if (bss_wpa) {
1055                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1056                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1057                                 wpa_dbg(wpa_s, MSG_DEBUG,
1058                                         "Could not parse WPA element");
1059                         } else {
1060                                 wpa_dbg(wpa_s, MSG_DEBUG,
1061                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1062                                         ie.pairwise_cipher, ie.group_cipher,
1063                                         ie.key_mgmt);
1064                         }
1065                 }
1066                 return -1;
1067         } else {
1068                 if (ssid->proto & WPA_PROTO_OSEN)
1069                         proto = WPA_PROTO_OSEN;
1070                 else if (ssid->proto & WPA_PROTO_RSN)
1071                         proto = WPA_PROTO_RSN;
1072                 else
1073                         proto = WPA_PROTO_WPA;
1074                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1075                         os_memset(&ie, 0, sizeof(ie));
1076                         ie.group_cipher = ssid->group_cipher;
1077                         ie.pairwise_cipher = ssid->pairwise_cipher;
1078                         ie.key_mgmt = ssid->key_mgmt;
1079 #ifdef CONFIG_IEEE80211W
1080                         ie.mgmt_group_cipher =
1081                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1082                                 WPA_CIPHER_AES_128_CMAC : 0;
1083 #endif /* CONFIG_IEEE80211W */
1084                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1085                                 "based on configuration");
1086                 } else
1087                         proto = ie.proto;
1088         }
1089
1090         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1091                 "pairwise %d key_mgmt %d proto %d",
1092                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1093 #ifdef CONFIG_IEEE80211W
1094         if (ssid->ieee80211w) {
1095                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1096                         ie.mgmt_group_cipher);
1097         }
1098 #endif /* CONFIG_IEEE80211W */
1099
1100         wpa_s->wpa_proto = proto;
1101         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1102         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1103                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1104
1105         if (bss || !wpa_s->ap_ies_from_associnfo) {
1106                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1107                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1108                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1109                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1110                         return -1;
1111         }
1112
1113         sel = ie.group_cipher & ssid->group_cipher;
1114         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1115         if (wpa_s->group_cipher < 0) {
1116                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1117                         "cipher");
1118                 return -1;
1119         }
1120         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1121                 wpa_cipher_txt(wpa_s->group_cipher));
1122
1123         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1124         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1125         if (wpa_s->pairwise_cipher < 0) {
1126                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1127                         "cipher");
1128                 return -1;
1129         }
1130         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1131                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1132
1133         sel = ie.key_mgmt & ssid->key_mgmt;
1134 #ifdef CONFIG_SAE
1135         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1136                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1137 #endif /* CONFIG_SAE */
1138         if (0) {
1139 #ifdef CONFIG_SUITEB192
1140         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1141                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1142                 wpa_dbg(wpa_s, MSG_DEBUG,
1143                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1144 #endif /* CONFIG_SUITEB192 */
1145 #ifdef CONFIG_SUITEB
1146         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1147                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1148                 wpa_dbg(wpa_s, MSG_DEBUG,
1149                         "WPA: using KEY_MGMT 802.1X with Suite B");
1150 #endif /* CONFIG_SUITEB */
1151 #ifdef CONFIG_IEEE80211R
1152         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1153                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1154                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1155         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1156                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1157                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1158 #endif /* CONFIG_IEEE80211R */
1159 #ifdef CONFIG_SAE
1160         } else if (sel & WPA_KEY_MGMT_SAE) {
1161                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1162                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1163         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1164                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1165                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1166 #endif /* CONFIG_SAE */
1167 #ifdef CONFIG_IEEE80211W
1168         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1169                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1170                 wpa_dbg(wpa_s, MSG_DEBUG,
1171                         "WPA: using KEY_MGMT 802.1X with SHA256");
1172         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1173                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1174                 wpa_dbg(wpa_s, MSG_DEBUG,
1175                         "WPA: using KEY_MGMT PSK with SHA256");
1176 #endif /* CONFIG_IEEE80211W */
1177         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1178                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1179                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1180         } else if (sel & WPA_KEY_MGMT_PSK) {
1181                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1182                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1183         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1184                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1185                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1186 #ifdef CONFIG_HS20
1187         } else if (sel & WPA_KEY_MGMT_OSEN) {
1188                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1189                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1190 #endif /* CONFIG_HS20 */
1191         } else {
1192                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1193                         "authenticated key management type");
1194                 return -1;
1195         }
1196
1197         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1198         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1199                          wpa_s->pairwise_cipher);
1200         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1201
1202 #ifdef CONFIG_IEEE80211W
1203         sel = ie.mgmt_group_cipher;
1204         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1205             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1206                 sel = 0;
1207         if (sel & WPA_CIPHER_AES_128_CMAC) {
1208                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1209                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1210                         "AES-128-CMAC");
1211         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1212                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1213                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1214                         "BIP-GMAC-128");
1215         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1216                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1217                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1218                         "BIP-GMAC-256");
1219         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1220                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1221                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1222                         "BIP-CMAC-256");
1223         } else {
1224                 wpa_s->mgmt_group_cipher = 0;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1226         }
1227         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1228                          wpa_s->mgmt_group_cipher);
1229         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1230                          wpas_get_ssid_pmf(wpa_s, ssid));
1231 #endif /* CONFIG_IEEE80211W */
1232
1233         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1234                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1235                 return -1;
1236         }
1237
1238         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1239                 wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1240 #ifndef CONFIG_NO_PBKDF2
1241                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1242                     ssid->passphrase) {
1243                         u8 psk[PMK_LEN];
1244                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1245                                     4096, psk, PMK_LEN);
1246                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1247                                         psk, PMK_LEN);
1248                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1249                         os_memset(psk, 0, sizeof(psk));
1250                 }
1251 #endif /* CONFIG_NO_PBKDF2 */
1252 #ifdef CONFIG_EXT_PASSWORD
1253                 if (ssid->ext_psk) {
1254                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1255                                                              ssid->ext_psk);
1256                         char pw_str[64 + 1];
1257                         u8 psk[PMK_LEN];
1258
1259                         if (pw == NULL) {
1260                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1261                                         "found from external storage");
1262                                 return -1;
1263                         }
1264
1265                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1266                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1267                                         "PSK length %d in external storage",
1268                                         (int) wpabuf_len(pw));
1269                                 ext_password_free(pw);
1270                                 return -1;
1271                         }
1272
1273                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1274                         pw_str[wpabuf_len(pw)] = '\0';
1275
1276 #ifndef CONFIG_NO_PBKDF2
1277                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1278                         {
1279                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1280                                             4096, psk, PMK_LEN);
1281                                 os_memset(pw_str, 0, sizeof(pw_str));
1282                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1283                                                 "external passphrase)",
1284                                                 psk, PMK_LEN);
1285                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1286                                 os_memset(psk, 0, sizeof(psk));
1287                         } else
1288 #endif /* CONFIG_NO_PBKDF2 */
1289                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1290                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1291                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1292                                                 "Invalid PSK hex string");
1293                                         os_memset(pw_str, 0, sizeof(pw_str));
1294                                         ext_password_free(pw);
1295                                         return -1;
1296                                 }
1297                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1298                                 os_memset(psk, 0, sizeof(psk));
1299                         } else {
1300                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1301                                         "PSK available");
1302                                 os_memset(pw_str, 0, sizeof(pw_str));
1303                                 ext_password_free(pw);
1304                                 return -1;
1305                         }
1306
1307                         os_memset(pw_str, 0, sizeof(pw_str));
1308                         ext_password_free(pw);
1309                 }
1310 #endif /* CONFIG_EXT_PASSWORD */
1311         } else
1312                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1313
1314         return 0;
1315 }
1316
1317
1318 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1319 {
1320         *pos = 0x00;
1321
1322         switch (idx) {
1323         case 0: /* Bits 0-7 */
1324                 break;
1325         case 1: /* Bits 8-15 */
1326                 break;
1327         case 2: /* Bits 16-23 */
1328 #ifdef CONFIG_WNM
1329                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1330                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1331 #endif /* CONFIG_WNM */
1332                 break;
1333         case 3: /* Bits 24-31 */
1334 #ifdef CONFIG_WNM
1335                 *pos |= 0x02; /* Bit 25 - SSID List */
1336 #endif /* CONFIG_WNM */
1337 #ifdef CONFIG_INTERWORKING
1338                 if (wpa_s->conf->interworking)
1339                         *pos |= 0x80; /* Bit 31 - Interworking */
1340 #endif /* CONFIG_INTERWORKING */
1341                 break;
1342         case 4: /* Bits 32-39 */
1343 #ifdef CONFIG_INTERWORKING
1344                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1345                         *pos |= 0x01; /* Bit 32 - QoS Map */
1346 #endif /* CONFIG_INTERWORKING */
1347                 break;
1348         case 5: /* Bits 40-47 */
1349 #ifdef CONFIG_HS20
1350                 if (wpa_s->conf->hs20)
1351                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1352 #endif /* CONFIG_HS20 */
1353                 break;
1354         case 6: /* Bits 48-55 */
1355                 break;
1356         }
1357 }
1358
1359
1360 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1361 {
1362         u8 *pos = buf;
1363         u8 len = 6, i;
1364
1365         if (len < wpa_s->extended_capa_len)
1366                 len = wpa_s->extended_capa_len;
1367         if (buflen < (size_t) len + 2) {
1368                 wpa_printf(MSG_INFO,
1369                            "Not enough room for building extended capabilities element");
1370                 return -1;
1371         }
1372
1373         *pos++ = WLAN_EID_EXT_CAPAB;
1374         *pos++ = len;
1375         for (i = 0; i < len; i++, pos++) {
1376                 wpas_ext_capab_byte(wpa_s, pos, i);
1377
1378                 if (i < wpa_s->extended_capa_len) {
1379                         *pos &= ~wpa_s->extended_capa_mask[i];
1380                         *pos |= wpa_s->extended_capa[i];
1381                 }
1382         }
1383
1384         while (len > 0 && buf[1 + len] == 0) {
1385                 len--;
1386                 buf[1] = len;
1387         }
1388         if (len == 0)
1389                 return 0;
1390
1391         return 2 + len;
1392 }
1393
1394
1395 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1396                           struct wpa_bss *test_bss)
1397 {
1398         struct wpa_bss *bss;
1399
1400         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1401                 if (bss == test_bss)
1402                         return 1;
1403         }
1404
1405         return 0;
1406 }
1407
1408
1409 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1410                            struct wpa_ssid *test_ssid)
1411 {
1412         struct wpa_ssid *ssid;
1413
1414         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1415                 if (ssid == test_ssid)
1416                         return 1;
1417         }
1418
1419         return 0;
1420 }
1421
1422
1423 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1424                         struct wpa_ssid *test_ssid)
1425 {
1426         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1427                 return 0;
1428
1429         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1430 }
1431
1432
1433 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1434 {
1435         if (cwork == NULL)
1436                 return;
1437         os_free(cwork);
1438 }
1439
1440
1441 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1442 {
1443         struct wpa_connect_work *cwork;
1444         struct wpa_radio_work *work = wpa_s->connect_work;
1445
1446         if (!work)
1447                 return;
1448
1449         wpa_s->connect_work = NULL;
1450         cwork = work->ctx;
1451         work->ctx = NULL;
1452         wpas_connect_work_free(cwork);
1453         radio_work_done(work);
1454 }
1455
1456
1457 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1458 {
1459         struct os_reltime now;
1460         u8 addr[ETH_ALEN];
1461
1462         os_get_reltime(&now);
1463         if (wpa_s->last_mac_addr_style == style &&
1464             wpa_s->last_mac_addr_change.sec != 0 &&
1465             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1466                                 wpa_s->conf->rand_addr_lifetime)) {
1467                 wpa_msg(wpa_s, MSG_DEBUG,
1468                         "Previously selected random MAC address has not yet expired");
1469                 return 0;
1470         }
1471
1472         switch (style) {
1473         case 1:
1474                 if (random_mac_addr(addr) < 0)
1475                         return -1;
1476                 break;
1477         case 2:
1478                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1479                 if (random_mac_addr_keep_oui(addr) < 0)
1480                         return -1;
1481                 break;
1482         default:
1483                 return -1;
1484         }
1485
1486         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1487                 wpa_msg(wpa_s, MSG_INFO,
1488                         "Failed to set random MAC address");
1489                 return -1;
1490         }
1491
1492         os_get_reltime(&wpa_s->last_mac_addr_change);
1493         wpa_s->mac_addr_changed = 1;
1494         wpa_s->last_mac_addr_style = style;
1495
1496         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1497                 wpa_msg(wpa_s, MSG_INFO,
1498                         "Could not update MAC address information");
1499                 return -1;
1500         }
1501
1502         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1503                 MAC2STR(addr));
1504
1505         return 0;
1506 }
1507
1508
1509 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1510 {
1511         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1512             !wpa_s->conf->preassoc_mac_addr)
1513                 return 0;
1514
1515         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1516 }
1517
1518
1519 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1520
1521 /**
1522  * wpa_supplicant_associate - Request association
1523  * @wpa_s: Pointer to wpa_supplicant data
1524  * @bss: Scan results for the selected BSS, or %NULL if not available
1525  * @ssid: Configuration data for the selected network
1526  *
1527  * This function is used to request %wpa_supplicant to associate with a BSS.
1528  */
1529 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1530                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1531 {
1532         struct wpa_connect_work *cwork;
1533         int rand_style;
1534
1535         if (ssid->mac_addr == -1)
1536                 rand_style = wpa_s->conf->mac_addr;
1537         else
1538                 rand_style = ssid->mac_addr;
1539
1540         wmm_ac_clear_saved_tspecs(wpa_s);
1541         wpa_s->reassoc_same_bss = 0;
1542
1543         if (wpa_s->last_ssid == ssid) {
1544                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1545                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1546                         wmm_ac_save_tspecs(wpa_s);
1547                         wpa_s->reassoc_same_bss = 1;
1548                 }
1549         } else if (rand_style > 0) {
1550                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1551                         return;
1552                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1553         } else if (wpa_s->mac_addr_changed) {
1554                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1555                         wpa_msg(wpa_s, MSG_INFO,
1556                                 "Could not restore permanent MAC address");
1557                         return;
1558                 }
1559                 wpa_s->mac_addr_changed = 0;
1560                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1561                         wpa_msg(wpa_s, MSG_INFO,
1562                                 "Could not update MAC address information");
1563                         return;
1564                 }
1565                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1566         }
1567         wpa_s->last_ssid = ssid;
1568
1569 #ifdef CONFIG_IBSS_RSN
1570         ibss_rsn_deinit(wpa_s->ibss_rsn);
1571         wpa_s->ibss_rsn = NULL;
1572 #endif /* CONFIG_IBSS_RSN */
1573
1574         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1575             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1576 #ifdef CONFIG_AP
1577                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1578                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1579                                 "mode");
1580                         return;
1581                 }
1582                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1583                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1584                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1585                                 wpas_p2p_ap_setup_failed(wpa_s);
1586                         return;
1587                 }
1588                 wpa_s->current_bss = bss;
1589 #else /* CONFIG_AP */
1590                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1591                         "the build");
1592 #endif /* CONFIG_AP */
1593                 return;
1594         }
1595
1596         if (ssid->mode == WPAS_MODE_MESH) {
1597 #ifdef CONFIG_MESH
1598                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1599                         wpa_msg(wpa_s, MSG_INFO,
1600                                 "Driver does not support mesh mode");
1601                         return;
1602                 }
1603                 if (bss)
1604                         ssid->frequency = bss->freq;
1605                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1606                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1607                         return;
1608                 }
1609                 wpa_s->current_bss = bss;
1610                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1611                              "ssid=\"%s\" id=%d",
1612                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1613                              ssid->id);
1614 #else /* CONFIG_MESH */
1615                 wpa_msg(wpa_s, MSG_ERROR,
1616                         "mesh mode support not included in the build");
1617 #endif /* CONFIG_MESH */
1618                 return;
1619         }
1620
1621 #ifdef CONFIG_TDLS
1622         if (bss)
1623                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1624                                 bss->ie_len);
1625 #endif /* CONFIG_TDLS */
1626
1627         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1628             ssid->mode == IEEE80211_MODE_INFRA) {
1629                 sme_authenticate(wpa_s, bss, ssid);
1630                 return;
1631         }
1632
1633         if (wpa_s->connect_work) {
1634                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1635                 return;
1636         }
1637
1638         if (radio_work_pending(wpa_s, "connect")) {
1639                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1640                 return;
1641         }
1642
1643         cwork = os_zalloc(sizeof(*cwork));
1644         if (cwork == NULL)
1645                 return;
1646
1647         cwork->bss = bss;
1648         cwork->ssid = ssid;
1649
1650         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1651                            wpas_start_assoc_cb, cwork) < 0) {
1652                 os_free(cwork);
1653         }
1654 }
1655
1656
1657 static int bss_is_ibss(struct wpa_bss *bss)
1658 {
1659         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1660                 IEEE80211_CAP_IBSS;
1661 }
1662
1663
1664 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1665                           const struct wpa_ssid *ssid,
1666                           struct hostapd_freq_params *freq)
1667 {
1668         enum hostapd_hw_mode hw_mode;
1669         struct hostapd_hw_modes *mode = NULL;
1670         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1671                            184, 192 };
1672         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1673         u8 channel;
1674         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1675         unsigned int j;
1676
1677         freq->freq = ssid->frequency;
1678
1679         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1680                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1681
1682                 if (ssid->mode != WPAS_MODE_IBSS)
1683                         break;
1684
1685                 /* Don't adjust control freq in case of fixed_freq */
1686                 if (ssid->fixed_freq)
1687                         break;
1688
1689                 if (!bss_is_ibss(bss))
1690                         continue;
1691
1692                 if (ssid->ssid_len == bss->ssid_len &&
1693                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1694                         wpa_printf(MSG_DEBUG,
1695                                    "IBSS already found in scan results, adjust control freq: %d",
1696                                    bss->freq);
1697                         freq->freq = bss->freq;
1698                         obss_scan = 0;
1699                         break;
1700                 }
1701         }
1702
1703         /* For IBSS check HT_IBSS flag */
1704         if (ssid->mode == WPAS_MODE_IBSS &&
1705             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1706                 return;
1707
1708         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1709             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1710             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1711                 wpa_printf(MSG_DEBUG,
1712                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1713                 return;
1714         }
1715
1716         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1717         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1718                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1719                         mode = &wpa_s->hw.modes[i];
1720                         break;
1721                 }
1722         }
1723
1724         if (!mode)
1725                 return;
1726
1727         freq->ht_enabled = ht_supported(mode);
1728         if (!freq->ht_enabled)
1729                 return;
1730
1731         /* Setup higher BW only for 5 GHz */
1732         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1733                 return;
1734
1735         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1736                 pri_chan = &mode->channels[chan_idx];
1737                 if (pri_chan->chan == channel)
1738                         break;
1739                 pri_chan = NULL;
1740         }
1741         if (!pri_chan)
1742                 return;
1743
1744         /* Check primary channel flags */
1745         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1746                 return;
1747
1748         /* Check/setup HT40+/HT40- */
1749         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1750                 if (ht40plus[j] == channel) {
1751                         ht40 = 1;
1752                         break;
1753                 }
1754         }
1755
1756         /* Find secondary channel */
1757         for (i = 0; i < mode->num_channels; i++) {
1758                 sec_chan = &mode->channels[i];
1759                 if (sec_chan->chan == channel + ht40 * 4)
1760                         break;
1761                 sec_chan = NULL;
1762         }
1763         if (!sec_chan)
1764                 return;
1765
1766         /* Check secondary channel flags */
1767         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1768                 return;
1769
1770         freq->channel = pri_chan->chan;
1771
1772         switch (ht40) {
1773         case -1:
1774                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1775                         return;
1776                 freq->sec_channel_offset = -1;
1777                 break;
1778         case 1:
1779                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1780                         return;
1781                 freq->sec_channel_offset = 1;
1782                 break;
1783         default:
1784                 break;
1785         }
1786
1787         if (freq->sec_channel_offset && obss_scan) {
1788                 struct wpa_scan_results *scan_res;
1789
1790                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1791                 if (scan_res == NULL) {
1792                         /* Back to HT20 */
1793                         freq->sec_channel_offset = 0;
1794                         return;
1795                 }
1796
1797                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1798                                      sec_chan->chan);
1799                 switch (res) {
1800                 case 0:
1801                         /* Back to HT20 */
1802                         freq->sec_channel_offset = 0;
1803                         break;
1804                 case 1:
1805                         /* Configuration allowed */
1806                         break;
1807                 case 2:
1808                         /* Switch pri/sec channels */
1809                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1810                         freq->sec_channel_offset = -freq->sec_channel_offset;
1811                         freq->channel = sec_chan->chan;
1812                         break;
1813                 default:
1814                         freq->sec_channel_offset = 0;
1815                         break;
1816                 }
1817
1818                 wpa_scan_results_free(scan_res);
1819         }
1820
1821         wpa_printf(MSG_DEBUG,
1822                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1823                    freq->channel, freq->sec_channel_offset);
1824 }
1825
1826
1827 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1828 {
1829         struct wpa_connect_work *cwork = work->ctx;
1830         struct wpa_bss *bss = cwork->bss;
1831         struct wpa_ssid *ssid = cwork->ssid;
1832         struct wpa_supplicant *wpa_s = work->wpa_s;
1833         u8 wpa_ie[200];
1834         size_t wpa_ie_len;
1835         int use_crypt, ret, i, bssid_changed;
1836         int algs = WPA_AUTH_ALG_OPEN;
1837         unsigned int cipher_pairwise, cipher_group;
1838         struct wpa_driver_associate_params params;
1839         int wep_keys_set = 0;
1840         int assoc_failed = 0;
1841         struct wpa_ssid *old_ssid;
1842 #ifdef CONFIG_HT_OVERRIDES
1843         struct ieee80211_ht_capabilities htcaps;
1844         struct ieee80211_ht_capabilities htcaps_mask;
1845 #endif /* CONFIG_HT_OVERRIDES */
1846 #ifdef CONFIG_VHT_OVERRIDES
1847        struct ieee80211_vht_capabilities vhtcaps;
1848        struct ieee80211_vht_capabilities vhtcaps_mask;
1849 #endif /* CONFIG_VHT_OVERRIDES */
1850
1851         if (deinit) {
1852                 if (work->started) {
1853                         wpa_s->connect_work = NULL;
1854
1855                         /* cancel possible auth. timeout */
1856                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1857                                              NULL);
1858                 }
1859                 wpas_connect_work_free(cwork);
1860                 return;
1861         }
1862
1863         wpa_s->connect_work = work;
1864
1865         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid)) {
1866                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1867                 wpas_connect_work_done(wpa_s);
1868                 return;
1869         }
1870
1871         os_memset(&params, 0, sizeof(params));
1872         wpa_s->reassociate = 0;
1873         wpa_s->eap_expected_failure = 0;
1874         if (bss &&
1875             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1876 #ifdef CONFIG_IEEE80211R
1877                 const u8 *ie, *md = NULL;
1878 #endif /* CONFIG_IEEE80211R */
1879                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1880                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1881                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1882                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1883                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1884                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1885                 if (bssid_changed)
1886                         wpas_notify_bssid_changed(wpa_s);
1887 #ifdef CONFIG_IEEE80211R
1888                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1889                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1890                         md = ie + 2;
1891                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
1892                 if (md) {
1893                         /* Prepare for the next transition */
1894                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
1895                 }
1896 #endif /* CONFIG_IEEE80211R */
1897 #ifdef CONFIG_WPS
1898         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
1899                    wpa_s->conf->ap_scan == 2 &&
1900                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
1901                 /* Use ap_scan==1 style network selection to find the network
1902                  */
1903                 wpas_connect_work_done(wpa_s);
1904                 wpa_s->scan_req = MANUAL_SCAN_REQ;
1905                 wpa_s->reassociate = 1;
1906                 wpa_supplicant_req_scan(wpa_s, 0, 0);
1907                 return;
1908 #endif /* CONFIG_WPS */
1909         } else {
1910                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
1911                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1912                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
1913         }
1914         wpa_supplicant_cancel_sched_scan(wpa_s);
1915         wpa_supplicant_cancel_scan(wpa_s);
1916
1917         /* Starting new association, so clear the possibly used WPA IE from the
1918          * previous association. */
1919         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
1920
1921 #ifdef IEEE8021X_EAPOL
1922         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
1923                 if (ssid->leap) {
1924                         if (ssid->non_leap == 0)
1925                                 algs = WPA_AUTH_ALG_LEAP;
1926                         else
1927                                 algs |= WPA_AUTH_ALG_LEAP;
1928                 }
1929         }
1930 #endif /* IEEE8021X_EAPOL */
1931         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
1932         if (ssid->auth_alg) {
1933                 algs = ssid->auth_alg;
1934                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
1935                         "0x%x", algs);
1936         }
1937
1938         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
1939                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
1940             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
1941                 int try_opportunistic;
1942                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
1943                                      wpa_s->conf->okc :
1944                                      ssid->proactive_key_caching) &&
1945                         (ssid->proto & WPA_PROTO_RSN);
1946                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
1947                                             ssid, try_opportunistic) == 0)
1948                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
1949                 wpa_ie_len = sizeof(wpa_ie);
1950                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
1951                                               wpa_ie, &wpa_ie_len)) {
1952                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1953                                 "key management and encryption suites");
1954                         wpas_connect_work_done(wpa_s);
1955                         return;
1956                 }
1957         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
1958                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
1959                 /*
1960                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
1961                  * use non-WPA since the scan results did not indicate that the
1962                  * AP is using WPA or WPA2.
1963                  */
1964                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1965                 wpa_ie_len = 0;
1966                 wpa_s->wpa_proto = 0;
1967         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
1968                 wpa_ie_len = sizeof(wpa_ie);
1969                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
1970                                               wpa_ie, &wpa_ie_len)) {
1971                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
1972                                 "key management and encryption suites (no "
1973                                 "scan results)");
1974                         wpas_connect_work_done(wpa_s);
1975                         return;
1976                 }
1977 #ifdef CONFIG_WPS
1978         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
1979                 struct wpabuf *wps_ie;
1980                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
1981                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
1982                         wpa_ie_len = wpabuf_len(wps_ie);
1983                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
1984                 } else
1985                         wpa_ie_len = 0;
1986                 wpabuf_free(wps_ie);
1987                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1988                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
1989                         params.wps = WPS_MODE_PRIVACY;
1990                 else
1991                         params.wps = WPS_MODE_OPEN;
1992                 wpa_s->wpa_proto = 0;
1993 #endif /* CONFIG_WPS */
1994         } else {
1995                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
1996                 wpa_ie_len = 0;
1997                 wpa_s->wpa_proto = 0;
1998         }
1999
2000 #ifdef CONFIG_P2P
2001         if (wpa_s->global->p2p) {
2002                 u8 *pos;
2003                 size_t len;
2004                 int res;
2005                 pos = wpa_ie + wpa_ie_len;
2006                 len = sizeof(wpa_ie) - wpa_ie_len;
2007                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2008                                             ssid->p2p_group);
2009                 if (res >= 0)
2010                         wpa_ie_len += res;
2011         }
2012
2013         wpa_s->cross_connect_disallowed = 0;
2014         if (bss) {
2015                 struct wpabuf *p2p;
2016                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2017                 if (p2p) {
2018                         wpa_s->cross_connect_disallowed =
2019                                 p2p_get_cross_connect_disallowed(p2p);
2020                         wpabuf_free(p2p);
2021                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2022                                 "connection",
2023                                 wpa_s->cross_connect_disallowed ?
2024                                 "disallows" : "allows");
2025                 }
2026         }
2027
2028         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2029 #endif /* CONFIG_P2P */
2030
2031 #ifdef CONFIG_HS20
2032         if (is_hs20_network(wpa_s, ssid, bss)) {
2033                 struct wpabuf *hs20;
2034                 hs20 = wpabuf_alloc(20);
2035                 if (hs20) {
2036                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2037                         size_t len;
2038
2039                         wpas_hs20_add_indication(hs20, pps_mo_id);
2040                         len = sizeof(wpa_ie) - wpa_ie_len;
2041                         if (wpabuf_len(hs20) <= len) {
2042                                 os_memcpy(wpa_ie + wpa_ie_len,
2043                                           wpabuf_head(hs20), wpabuf_len(hs20));
2044                                 wpa_ie_len += wpabuf_len(hs20);
2045                         }
2046                         wpabuf_free(hs20);
2047                 }
2048         }
2049 #endif /* CONFIG_HS20 */
2050
2051         /*
2052          * Workaround: Add Extended Capabilities element only if the AP
2053          * included this element in Beacon/Probe Response frames. Some older
2054          * APs seem to have interoperability issues if this element is
2055          * included, so while the standard may require us to include the
2056          * element in all cases, it is justifiable to skip it to avoid
2057          * interoperability issues.
2058          */
2059         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2060                 u8 ext_capab[18];
2061                 int ext_capab_len;
2062                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2063                                                      sizeof(ext_capab));
2064                 if (ext_capab_len > 0) {
2065                         u8 *pos = wpa_ie;
2066                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2067                                 pos += 2 + pos[1];
2068                         os_memmove(pos + ext_capab_len, pos,
2069                                    wpa_ie_len - (pos - wpa_ie));
2070                         wpa_ie_len += ext_capab_len;
2071                         os_memcpy(pos, ext_capab, ext_capab_len);
2072                 }
2073         }
2074
2075         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2076                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2077                 size_t len;
2078
2079                 len = sizeof(wpa_ie) - wpa_ie_len;
2080                 if (wpabuf_len(buf) <= len) {
2081                         os_memcpy(wpa_ie + wpa_ie_len,
2082                                   wpabuf_head(buf), wpabuf_len(buf));
2083                         wpa_ie_len += wpabuf_len(buf);
2084                 }
2085         }
2086
2087         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2088         use_crypt = 1;
2089         cipher_pairwise = wpa_s->pairwise_cipher;
2090         cipher_group = wpa_s->group_cipher;
2091         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2092             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2093                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2094                         use_crypt = 0;
2095                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2096                         use_crypt = 1;
2097                         wep_keys_set = 1;
2098                 }
2099         }
2100         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2101                 use_crypt = 0;
2102
2103 #ifdef IEEE8021X_EAPOL
2104         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2105                 if ((ssid->eapol_flags &
2106                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2107                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2108                     !wep_keys_set) {
2109                         use_crypt = 0;
2110                 } else {
2111                         /* Assume that dynamic WEP-104 keys will be used and
2112                          * set cipher suites in order for drivers to expect
2113                          * encryption. */
2114                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2115                 }
2116         }
2117 #endif /* IEEE8021X_EAPOL */
2118
2119         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2120                 /* Set the key before (and later after) association */
2121                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2122         }
2123
2124         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2125         if (bss) {
2126                 params.ssid = bss->ssid;
2127                 params.ssid_len = bss->ssid_len;
2128                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2129                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2130                                    MACSTR " freq=%u MHz based on scan results "
2131                                    "(bssid_set=%d)",
2132                                    MAC2STR(bss->bssid), bss->freq,
2133                                    ssid->bssid_set);
2134                         params.bssid = bss->bssid;
2135                         params.freq.freq = bss->freq;
2136                 }
2137                 params.bssid_hint = bss->bssid;
2138                 params.freq_hint = bss->freq;
2139         } else {
2140                 params.ssid = ssid->ssid;
2141                 params.ssid_len = ssid->ssid_len;
2142         }
2143
2144         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2145             wpa_s->conf->ap_scan == 2) {
2146                 params.bssid = ssid->bssid;
2147                 params.fixed_bssid = 1;
2148         }
2149
2150         /* Initial frequency for IBSS/mesh */
2151         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2152             ssid->frequency > 0 && params.freq.freq == 0)
2153                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2154
2155         if (ssid->mode == WPAS_MODE_IBSS) {
2156                 params.fixed_freq = ssid->fixed_freq;
2157                 if (ssid->beacon_int)
2158                         params.beacon_int = ssid->beacon_int;
2159                 else
2160                         params.beacon_int = wpa_s->conf->beacon_int;
2161         }
2162
2163         params.wpa_ie = wpa_ie;
2164         params.wpa_ie_len = wpa_ie_len;
2165         params.pairwise_suite = cipher_pairwise;
2166         params.group_suite = cipher_group;
2167         params.key_mgmt_suite = wpa_s->key_mgmt;
2168         params.wpa_proto = wpa_s->wpa_proto;
2169         params.auth_alg = algs;
2170         params.mode = ssid->mode;
2171         params.bg_scan_period = ssid->bg_scan_period;
2172         for (i = 0; i < NUM_WEP_KEYS; i++) {
2173                 if (ssid->wep_key_len[i])
2174                         params.wep_key[i] = ssid->wep_key[i];
2175                 params.wep_key_len[i] = ssid->wep_key_len[i];
2176         }
2177         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2178
2179         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2180             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2181              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2182                 params.passphrase = ssid->passphrase;
2183                 if (ssid->psk_set)
2184                         params.psk = ssid->psk;
2185         }
2186
2187         if (wpa_s->conf->key_mgmt_offload) {
2188                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2189                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2190                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2191                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2192                         params.req_key_mgmt_offload =
2193                                 ssid->proactive_key_caching < 0 ?
2194                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2195                 else
2196                         params.req_key_mgmt_offload = 1;
2197
2198                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2199                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2200                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2201                     ssid->psk_set)
2202                         params.psk = ssid->psk;
2203         }
2204
2205         params.drop_unencrypted = use_crypt;
2206
2207 #ifdef CONFIG_IEEE80211W
2208         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2209         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2210                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2211                 struct wpa_ie_data ie;
2212                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2213                     ie.capabilities &
2214                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2215                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2216                                 "MFP: require MFP");
2217                         params.mgmt_frame_protection =
2218                                 MGMT_FRAME_PROTECTION_REQUIRED;
2219                 }
2220         }
2221 #endif /* CONFIG_IEEE80211W */
2222
2223         params.p2p = ssid->p2p_group;
2224
2225         if (wpa_s->parent->set_sta_uapsd)
2226                 params.uapsd = wpa_s->parent->sta_uapsd;
2227         else
2228                 params.uapsd = -1;
2229
2230 #ifdef CONFIG_HT_OVERRIDES
2231         os_memset(&htcaps, 0, sizeof(htcaps));
2232         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2233         params.htcaps = (u8 *) &htcaps;
2234         params.htcaps_mask = (u8 *) &htcaps_mask;
2235         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2236 #endif /* CONFIG_HT_OVERRIDES */
2237 #ifdef CONFIG_VHT_OVERRIDES
2238         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2239         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2240         params.vhtcaps = &vhtcaps;
2241         params.vhtcaps_mask = &vhtcaps_mask;
2242         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2243 #endif /* CONFIG_VHT_OVERRIDES */
2244
2245 #ifdef CONFIG_P2P
2246         /*
2247          * If multi-channel concurrency is not supported, check for any
2248          * frequency conflict. In case of any frequency conflict, remove the
2249          * least prioritized connection.
2250          */
2251         if (wpa_s->num_multichan_concurrent < 2) {
2252                 int freq, num;
2253                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2254                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2255                         wpa_printf(MSG_DEBUG,
2256                                    "Assoc conflicting freq found (%d != %d)",
2257                                    freq, params.freq.freq);
2258                         if (wpas_p2p_handle_frequency_conflicts(
2259                                     wpa_s, params.freq.freq, ssid) < 0) {
2260                                 wpas_connect_work_done(wpa_s);
2261                                 return;
2262                         }
2263                 }
2264         }
2265 #endif /* CONFIG_P2P */
2266
2267         ret = wpa_drv_associate(wpa_s, &params);
2268         if (ret < 0) {
2269                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2270                         "failed");
2271                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2272                         /*
2273                          * The driver is known to mean what is saying, so we
2274                          * can stop right here; the association will not
2275                          * succeed.
2276                          */
2277                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2278                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2279                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2280                         return;
2281                 }
2282                 /* try to continue anyway; new association will be tried again
2283                  * after timeout */
2284                 assoc_failed = 1;
2285         }
2286
2287         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2288                 /* Set the key after the association just in case association
2289                  * cleared the previously configured key. */
2290                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2291                 /* No need to timeout authentication since there is no key
2292                  * management. */
2293                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2294                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2295 #ifdef CONFIG_IBSS_RSN
2296         } else if (ssid->mode == WPAS_MODE_IBSS &&
2297                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2298                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2299                 /*
2300                  * RSN IBSS authentication is per-STA and we can disable the
2301                  * per-BSSID authentication.
2302                  */
2303                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2304 #endif /* CONFIG_IBSS_RSN */
2305         } else {
2306                 /* Timeout for IEEE 802.11 authentication and association */
2307                 int timeout = 60;
2308
2309                 if (assoc_failed) {
2310                         /* give IBSS a bit more time */
2311                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2312                 } else if (wpa_s->conf->ap_scan == 1) {
2313                         /* give IBSS a bit more time */
2314                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2315                 }
2316                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2317         }
2318
2319         if (wep_keys_set &&
2320             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2321                 /* Set static WEP keys again */
2322                 wpa_set_wep_keys(wpa_s, ssid);
2323         }
2324
2325         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2326                 /*
2327                  * Do not allow EAP session resumption between different
2328                  * network configurations.
2329                  */
2330                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2331         }
2332         old_ssid = wpa_s->current_ssid;
2333         wpa_s->current_ssid = ssid;
2334         wpa_s->current_bss = bss;
2335         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2336         wpa_supplicant_initiate_eapol(wpa_s);
2337         if (old_ssid != wpa_s->current_ssid)
2338                 wpas_notify_network_changed(wpa_s);
2339 }
2340
2341
2342 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2343                                             const u8 *addr)
2344 {
2345         struct wpa_ssid *old_ssid;
2346
2347         wpas_connect_work_done(wpa_s);
2348         wpa_clear_keys(wpa_s, addr);
2349         old_ssid = wpa_s->current_ssid;
2350         wpa_supplicant_mark_disassoc(wpa_s);
2351         wpa_sm_set_config(wpa_s->wpa, NULL);
2352         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2353         if (old_ssid != wpa_s->current_ssid)
2354                 wpas_notify_network_changed(wpa_s);
2355         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2356 }
2357
2358
2359 /**
2360  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2361  * @wpa_s: Pointer to wpa_supplicant data
2362  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2363  *
2364  * This function is used to request %wpa_supplicant to deauthenticate from the
2365  * current AP.
2366  */
2367 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2368                                    int reason_code)
2369 {
2370         u8 *addr = NULL;
2371         union wpa_event_data event;
2372         int zero_addr = 0;
2373
2374         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2375                 " pending_bssid=" MACSTR " reason=%d state=%s",
2376                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2377                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2378
2379         if (!is_zero_ether_addr(wpa_s->bssid))
2380                 addr = wpa_s->bssid;
2381         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2382                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2383                   wpa_s->wpa_state == WPA_ASSOCIATING))
2384                 addr = wpa_s->pending_bssid;
2385         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2386                 /*
2387                  * When using driver-based BSS selection, we may not know the
2388                  * BSSID with which we are currently trying to associate. We
2389                  * need to notify the driver of this disconnection even in such
2390                  * a case, so use the all zeros address here.
2391                  */
2392                 addr = wpa_s->bssid;
2393                 zero_addr = 1;
2394         }
2395
2396 #ifdef CONFIG_TDLS
2397         wpa_tdls_teardown_peers(wpa_s->wpa);
2398 #endif /* CONFIG_TDLS */
2399
2400 #ifdef CONFIG_MESH
2401         if (wpa_s->ifmsh) {
2402                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2403                              wpa_s->ifname);
2404                 wpa_supplicant_leave_mesh(wpa_s);
2405         }
2406 #endif /* CONFIG_MESH */
2407
2408         if (addr) {
2409                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2410                 os_memset(&event, 0, sizeof(event));
2411                 event.deauth_info.reason_code = (u16) reason_code;
2412                 event.deauth_info.locally_generated = 1;
2413                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2414                 if (zero_addr)
2415                         addr = NULL;
2416         }
2417
2418         wpa_supplicant_clear_connection(wpa_s, addr);
2419 }
2420
2421 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2422                                               struct wpa_ssid *ssid)
2423 {
2424         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2425                 return;
2426
2427         ssid->disabled = 0;
2428         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2429         wpas_notify_network_enabled_changed(wpa_s, ssid);
2430
2431         /*
2432          * Try to reassociate since there is no current configuration and a new
2433          * network was made available.
2434          */
2435         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2436                 wpa_s->reassociate = 1;
2437 }
2438
2439
2440 /**
2441  * wpa_supplicant_enable_network - Mark a configured network as enabled
2442  * @wpa_s: wpa_supplicant structure for a network interface
2443  * @ssid: wpa_ssid structure for a configured network or %NULL
2444  *
2445  * Enables the specified network or all networks if no network specified.
2446  */
2447 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2448                                    struct wpa_ssid *ssid)
2449 {
2450         if (ssid == NULL) {
2451                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2452                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2453         } else
2454                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2455
2456         if (wpa_s->reassociate && !wpa_s->disconnected) {
2457                 if (wpa_s->sched_scanning) {
2458                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2459                                    "new network to scan filters");
2460                         wpa_supplicant_cancel_sched_scan(wpa_s);
2461                 }
2462
2463                 if (wpa_supplicant_fast_associate(wpa_s) != 1)
2464                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2465         }
2466 }
2467
2468
2469 /**
2470  * wpa_supplicant_disable_network - Mark a configured network as disabled
2471  * @wpa_s: wpa_supplicant structure for a network interface
2472  * @ssid: wpa_ssid structure for a configured network or %NULL
2473  *
2474  * Disables the specified network or all networks if no network specified.
2475  */
2476 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2477                                     struct wpa_ssid *ssid)
2478 {
2479         struct wpa_ssid *other_ssid;
2480         int was_disabled;
2481
2482         if (ssid == NULL) {
2483                 if (wpa_s->sched_scanning)
2484                         wpa_supplicant_cancel_sched_scan(wpa_s);
2485
2486                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2487                      other_ssid = other_ssid->next) {
2488                         was_disabled = other_ssid->disabled;
2489                         if (was_disabled == 2)
2490                                 continue; /* do not change persistent P2P group
2491                                            * data */
2492
2493                         other_ssid->disabled = 1;
2494
2495                         if (was_disabled != other_ssid->disabled)
2496                                 wpas_notify_network_enabled_changed(
2497                                         wpa_s, other_ssid);
2498                 }
2499                 if (wpa_s->current_ssid)
2500                         wpa_supplicant_deauthenticate(
2501                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2502         } else if (ssid->disabled != 2) {
2503                 if (ssid == wpa_s->current_ssid)
2504                         wpa_supplicant_deauthenticate(
2505                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2506
2507                 was_disabled = ssid->disabled;
2508
2509                 ssid->disabled = 1;
2510
2511                 if (was_disabled != ssid->disabled) {
2512                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2513                         if (wpa_s->sched_scanning) {
2514                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2515                                            "to remove network from filters");
2516                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2517                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2518                         }
2519                 }
2520         }
2521 }
2522
2523
2524 /**
2525  * wpa_supplicant_select_network - Attempt association with a network
2526  * @wpa_s: wpa_supplicant structure for a network interface
2527  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2528  */
2529 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2530                                    struct wpa_ssid *ssid)
2531 {
2532
2533         struct wpa_ssid *other_ssid;
2534         int disconnected = 0;
2535
2536         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2537                 wpa_supplicant_deauthenticate(
2538                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2539                 disconnected = 1;
2540         }
2541
2542         if (ssid)
2543                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2544
2545         /*
2546          * Mark all other networks disabled or mark all networks enabled if no
2547          * network specified.
2548          */
2549         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2550              other_ssid = other_ssid->next) {
2551                 int was_disabled = other_ssid->disabled;
2552                 if (was_disabled == 2)
2553                         continue; /* do not change persistent P2P group data */
2554
2555                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2556                 if (was_disabled && !other_ssid->disabled)
2557                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2558
2559                 if (was_disabled != other_ssid->disabled)
2560                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2561         }
2562
2563         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2564                 /* We are already associated with the selected network */
2565                 wpa_printf(MSG_DEBUG, "Already associated with the "
2566                            "selected network - do nothing");
2567                 return;
2568         }
2569
2570         if (ssid) {
2571                 wpa_s->current_ssid = ssid;
2572                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2573                 wpa_s->connect_without_scan =
2574                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2575         } else {
2576                 wpa_s->connect_without_scan = NULL;
2577         }
2578
2579         wpa_s->disconnected = 0;
2580         wpa_s->reassociate = 1;
2581
2582         if (wpa_s->connect_without_scan ||
2583             wpa_supplicant_fast_associate(wpa_s) != 1)
2584                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2585
2586         if (ssid)
2587                 wpas_notify_network_selected(wpa_s, ssid);
2588 }
2589
2590
2591 /**
2592  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2593  * @wpa_s: wpa_supplicant structure for a network interface
2594  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2595  * @pkcs11_module_path: PKCS #11 module path or NULL
2596  * Returns: 0 on success; -1 on failure
2597  *
2598  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2599  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2600  * module path fails the paths will be reset to the default value (NULL).
2601  */
2602 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2603                                            const char *pkcs11_engine_path,
2604                                            const char *pkcs11_module_path)
2605 {
2606         char *pkcs11_engine_path_copy = NULL;
2607         char *pkcs11_module_path_copy = NULL;
2608
2609         if (pkcs11_engine_path != NULL) {
2610                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2611                 if (pkcs11_engine_path_copy == NULL)
2612                         return -1;
2613         }
2614         if (pkcs11_module_path != NULL) {
2615                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2616                 if (pkcs11_module_path_copy == NULL) {
2617                         os_free(pkcs11_engine_path_copy);
2618                         return -1;
2619                 }
2620         }
2621
2622         os_free(wpa_s->conf->pkcs11_engine_path);
2623         os_free(wpa_s->conf->pkcs11_module_path);
2624         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2625         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2626
2627         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2628         eapol_sm_deinit(wpa_s->eapol);
2629         wpa_s->eapol = NULL;
2630         if (wpa_supplicant_init_eapol(wpa_s)) {
2631                 /* Error -> Reset paths to the default value (NULL) once. */
2632                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2633                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2634                                                                NULL);
2635
2636                 return -1;
2637         }
2638         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2639
2640         return 0;
2641 }
2642
2643
2644 /**
2645  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2646  * @wpa_s: wpa_supplicant structure for a network interface
2647  * @ap_scan: AP scan mode
2648  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2649  *
2650  */
2651 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2652 {
2653
2654         int old_ap_scan;
2655
2656         if (ap_scan < 0 || ap_scan > 2)
2657                 return -1;
2658
2659 #ifdef ANDROID
2660         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2661             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2662             wpa_s->wpa_state < WPA_COMPLETED) {
2663                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2664                            "associating", wpa_s->conf->ap_scan, ap_scan);
2665                 return 0;
2666         }
2667 #endif /* ANDROID */
2668
2669         old_ap_scan = wpa_s->conf->ap_scan;
2670         wpa_s->conf->ap_scan = ap_scan;
2671
2672         if (old_ap_scan != wpa_s->conf->ap_scan)
2673                 wpas_notify_ap_scan_changed(wpa_s);
2674
2675         return 0;
2676 }
2677
2678
2679 /**
2680  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2681  * @wpa_s: wpa_supplicant structure for a network interface
2682  * @expire_age: Expiration age in seconds
2683  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2684  *
2685  */
2686 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2687                                           unsigned int bss_expire_age)
2688 {
2689         if (bss_expire_age < 10) {
2690                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2691                         bss_expire_age);
2692                 return -1;
2693         }
2694         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2695                 bss_expire_age);
2696         wpa_s->conf->bss_expiration_age = bss_expire_age;
2697
2698         return 0;
2699 }
2700
2701
2702 /**
2703  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2704  * @wpa_s: wpa_supplicant structure for a network interface
2705  * @expire_count: number of scans after which an unseen BSS is reclaimed
2706  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2707  *
2708  */
2709 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2710                                             unsigned int bss_expire_count)
2711 {
2712         if (bss_expire_count < 1) {
2713                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2714                         bss_expire_count);
2715                 return -1;
2716         }
2717         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2718                 bss_expire_count);
2719         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2720
2721         return 0;
2722 }
2723
2724
2725 /**
2726  * wpa_supplicant_set_scan_interval - Set scan interval
2727  * @wpa_s: wpa_supplicant structure for a network interface
2728  * @scan_interval: scan interval in seconds
2729  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2730  *
2731  */
2732 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2733                                      int scan_interval)
2734 {
2735         if (scan_interval < 0) {
2736                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2737                         scan_interval);
2738                 return -1;
2739         }
2740         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2741                 scan_interval);
2742         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2743
2744         return 0;
2745 }
2746
2747
2748 /**
2749  * wpa_supplicant_set_debug_params - Set global debug params
2750  * @global: wpa_global structure
2751  * @debug_level: debug level
2752  * @debug_timestamp: determines if show timestamp in debug data
2753  * @debug_show_keys: determines if show keys in debug data
2754  * Returns: 0 if succeed or -1 if debug_level has wrong value
2755  */
2756 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2757                                     int debug_timestamp, int debug_show_keys)
2758 {
2759
2760         int old_level, old_timestamp, old_show_keys;
2761
2762         /* check for allowed debuglevels */
2763         if (debug_level != MSG_EXCESSIVE &&
2764             debug_level != MSG_MSGDUMP &&
2765             debug_level != MSG_DEBUG &&
2766             debug_level != MSG_INFO &&
2767             debug_level != MSG_WARNING &&
2768             debug_level != MSG_ERROR)
2769                 return -1;
2770
2771         old_level = wpa_debug_level;
2772         old_timestamp = wpa_debug_timestamp;
2773         old_show_keys = wpa_debug_show_keys;
2774
2775         wpa_debug_level = debug_level;
2776         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2777         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2778
2779         if (wpa_debug_level != old_level)
2780                 wpas_notify_debug_level_changed(global);
2781         if (wpa_debug_timestamp != old_timestamp)
2782                 wpas_notify_debug_timestamp_changed(global);
2783         if (wpa_debug_show_keys != old_show_keys)
2784                 wpas_notify_debug_show_keys_changed(global);
2785
2786         return 0;
2787 }
2788
2789
2790 /**
2791  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2792  * @wpa_s: Pointer to wpa_supplicant data
2793  * Returns: A pointer to the current network structure or %NULL on failure
2794  */
2795 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2796 {
2797         struct wpa_ssid *entry;
2798         u8 ssid[MAX_SSID_LEN];
2799         int res;
2800         size_t ssid_len;
2801         u8 bssid[ETH_ALEN];
2802         int wired;
2803
2804         res = wpa_drv_get_ssid(wpa_s, ssid);
2805         if (res < 0) {
2806                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2807                         "driver");
2808                 return NULL;
2809         }
2810         ssid_len = res;
2811
2812         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2813                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2814                         "driver");
2815                 return NULL;
2816         }
2817
2818         wired = wpa_s->conf->ap_scan == 0 &&
2819                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2820
2821         entry = wpa_s->conf->ssid;
2822         while (entry) {
2823                 if (!wpas_network_disabled(wpa_s, entry) &&
2824                     ((ssid_len == entry->ssid_len &&
2825                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2826                     (!entry->bssid_set ||
2827                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2828                         return entry;
2829 #ifdef CONFIG_WPS
2830                 if (!wpas_network_disabled(wpa_s, entry) &&
2831                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2832                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2833                     (!entry->bssid_set ||
2834                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2835                         return entry;
2836 #endif /* CONFIG_WPS */
2837
2838                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2839                     entry->ssid_len == 0 &&
2840                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2841                         return entry;
2842
2843                 entry = entry->next;
2844         }
2845
2846         return NULL;
2847 }
2848
2849
2850 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2851 {
2852         struct wpa_global *global = wpa_s->global;
2853
2854         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2855                 global->drv_priv[i] = wpa_drivers[i]->global_init();
2856                 if (global->drv_priv[i] == NULL) {
2857                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
2858                                    "'%s'", wpa_drivers[i]->name);
2859                         return -1;
2860                 }
2861         }
2862
2863         wpa_s->driver = wpa_drivers[i];
2864         wpa_s->global_drv_priv = global->drv_priv[i];
2865
2866         return 0;
2867 }
2868
2869
2870 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
2871                                      const char *name)
2872 {
2873         int i;
2874         size_t len;
2875         const char *pos, *driver = name;
2876
2877         if (wpa_s == NULL)
2878                 return -1;
2879
2880         if (wpa_drivers[0] == NULL) {
2881                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
2882                         "wpa_supplicant");
2883                 return -1;
2884         }
2885
2886         if (name == NULL) {
2887                 /* default to first driver in the list */
2888                 return select_driver(wpa_s, 0);
2889         }
2890
2891         do {
2892                 pos = os_strchr(driver, ',');
2893                 if (pos)
2894                         len = pos - driver;
2895                 else
2896                         len = os_strlen(driver);
2897
2898                 for (i = 0; wpa_drivers[i]; i++) {
2899                         if (os_strlen(wpa_drivers[i]->name) == len &&
2900                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
2901                             0) {
2902                                 /* First driver that succeeds wins */
2903                                 if (select_driver(wpa_s, i) == 0)
2904                                         return 0;
2905                         }
2906                 }
2907
2908                 driver = pos + 1;
2909         } while (pos);
2910
2911         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
2912         return -1;
2913 }
2914
2915
2916 /**
2917  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
2918  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
2919  *      with struct wpa_driver_ops::init()
2920  * @src_addr: Source address of the EAPOL frame
2921  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
2922  * @len: Length of the EAPOL data
2923  *
2924  * This function is called for each received EAPOL frame. Most driver
2925  * interfaces rely on more generic OS mechanism for receiving frames through
2926  * l2_packet, but if such a mechanism is not available, the driver wrapper may
2927  * take care of received EAPOL frames and deliver them to the core supplicant
2928  * code by calling this function.
2929  */
2930 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
2931                              const u8 *buf, size_t len)
2932 {
2933         struct wpa_supplicant *wpa_s = ctx;
2934
2935         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
2936         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
2937
2938 #ifdef CONFIG_PEERKEY
2939         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
2940             wpa_s->current_ssid->peerkey &&
2941             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2942             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
2943                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
2944                 return;
2945         }
2946 #endif /* CONFIG_PEERKEY */
2947
2948         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
2949             (wpa_s->last_eapol_matches_bssid &&
2950 #ifdef CONFIG_AP
2951              !wpa_s->ap_iface &&
2952 #endif /* CONFIG_AP */
2953              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
2954                 /*
2955                  * There is possible race condition between receiving the
2956                  * association event and the EAPOL frame since they are coming
2957                  * through different paths from the driver. In order to avoid
2958                  * issues in trying to process the EAPOL frame before receiving
2959                  * association information, lets queue it for processing until
2960                  * the association event is received. This may also be needed in
2961                  * driver-based roaming case, so also use src_addr != BSSID as a
2962                  * trigger if we have previously confirmed that the
2963                  * Authenticator uses BSSID as the src_addr (which is not the
2964                  * case with wired IEEE 802.1X).
2965                  */
2966                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
2967                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
2968                         wpa_supplicant_state_txt(wpa_s->wpa_state),
2969                         MAC2STR(wpa_s->bssid));
2970                 wpabuf_free(wpa_s->pending_eapol_rx);
2971                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
2972                 if (wpa_s->pending_eapol_rx) {
2973                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
2974                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
2975                                   ETH_ALEN);
2976                 }
2977                 return;
2978         }
2979
2980         wpa_s->last_eapol_matches_bssid =
2981                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
2982
2983 #ifdef CONFIG_AP
2984         if (wpa_s->ap_iface) {
2985                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
2986                 return;
2987         }
2988 #endif /* CONFIG_AP */
2989
2990         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
2991                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
2992                         "no key management is configured");
2993                 return;
2994         }
2995
2996         if (wpa_s->eapol_received == 0 &&
2997             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
2998              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
2999              wpa_s->wpa_state != WPA_COMPLETED) &&
3000             (wpa_s->current_ssid == NULL ||
3001              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3002                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3003                 wpa_supplicant_req_auth_timeout(
3004                         wpa_s,
3005                         (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3006                          wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3007                          wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) ?
3008                         70 : 10, 0);
3009         }
3010         wpa_s->eapol_received++;
3011
3012         if (wpa_s->countermeasures) {
3013                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3014                         "EAPOL packet");
3015                 return;
3016         }
3017
3018 #ifdef CONFIG_IBSS_RSN
3019         if (wpa_s->current_ssid &&
3020             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3021                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3022                 return;
3023         }
3024 #endif /* CONFIG_IBSS_RSN */
3025
3026         /* Source address of the incoming EAPOL frame could be compared to the
3027          * current BSSID. However, it is possible that a centralized
3028          * Authenticator could be using another MAC address than the BSSID of
3029          * an AP, so just allow any address to be used for now. The replies are
3030          * still sent to the current BSSID (if available), though. */
3031
3032         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3033         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3034             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3035                 return;
3036         wpa_drv_poll(wpa_s);
3037         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3038                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3039         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3040                 /*
3041                  * Set portValid = TRUE here since we are going to skip 4-way
3042                  * handshake processing which would normally set portValid. We
3043                  * need this to allow the EAPOL state machines to be completed
3044                  * without going through EAPOL-Key handshake.
3045                  */
3046                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3047         }
3048 }
3049
3050
3051 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3052 {
3053         if ((!wpa_s->p2p_mgmt ||
3054              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3055             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3056                 l2_packet_deinit(wpa_s->l2);
3057                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3058                                            wpa_drv_get_mac_addr(wpa_s),
3059                                            ETH_P_EAPOL,
3060                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3061                 if (wpa_s->l2 == NULL)
3062                         return -1;
3063         } else {
3064                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3065                 if (addr)
3066                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3067         }
3068
3069         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3070                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3071                 return -1;
3072         }
3073
3074         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3075
3076         return 0;
3077 }
3078
3079
3080 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3081                                            const u8 *buf, size_t len)
3082 {
3083         struct wpa_supplicant *wpa_s = ctx;
3084         const struct l2_ethhdr *eth;
3085
3086         if (len < sizeof(*eth))
3087                 return;
3088         eth = (const struct l2_ethhdr *) buf;
3089
3090         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3091             !(eth->h_dest[0] & 0x01)) {
3092                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3093                         " (bridge - not for this interface - ignore)",
3094                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3095                 return;
3096         }
3097
3098         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3099                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3100         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3101                                 len - sizeof(*eth));
3102 }
3103
3104
3105 /**
3106  * wpa_supplicant_driver_init - Initialize driver interface parameters
3107  * @wpa_s: Pointer to wpa_supplicant data
3108  * Returns: 0 on success, -1 on failure
3109  *
3110  * This function is called to initialize driver interface parameters.
3111  * wpa_drv_init() must have been called before this function to initialize the
3112  * driver interface.
3113  */
3114 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3115 {
3116         static int interface_count = 0;
3117
3118         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3119                 return -1;
3120
3121         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3122                 MAC2STR(wpa_s->own_addr));
3123         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3124         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3125
3126         if (wpa_s->bridge_ifname[0]) {
3127                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3128                         "interface '%s'", wpa_s->bridge_ifname);
3129                 wpa_s->l2_br = l2_packet_init_bridge(
3130                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3131                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3132                 if (wpa_s->l2_br == NULL) {
3133                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3134                                 "connection for the bridge interface '%s'",
3135                                 wpa_s->bridge_ifname);
3136                         return -1;
3137                 }
3138         }
3139
3140         wpa_clear_keys(wpa_s, NULL);
3141
3142         /* Make sure that TKIP countermeasures are not left enabled (could
3143          * happen if wpa_supplicant is killed during countermeasures. */
3144         wpa_drv_set_countermeasures(wpa_s, 0);
3145
3146         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3147         wpa_drv_flush_pmkid(wpa_s);
3148
3149         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3150         wpa_s->prev_scan_wildcard = 0;
3151
3152         if (wpa_supplicant_enabled_networks(wpa_s)) {
3153                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3154                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3155                         interface_count = 0;
3156                 }
3157 #ifndef ANDROID
3158                 if (!wpa_s->p2p_mgmt &&
3159                     wpa_supplicant_delayed_sched_scan(wpa_s,
3160                                                       interface_count % 3,
3161                                                       100000))
3162                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3163                                                 100000);
3164 #endif /* ANDROID */
3165                 interface_count++;
3166         } else
3167                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3168
3169         return 0;
3170 }
3171
3172
3173 static int wpa_supplicant_daemon(const char *pid_file)
3174 {
3175         wpa_printf(MSG_DEBUG, "Daemonize..");
3176         return os_daemonize(pid_file);
3177 }
3178
3179
3180 static struct wpa_supplicant * wpa_supplicant_alloc(void)
3181 {
3182         struct wpa_supplicant *wpa_s;
3183
3184         wpa_s = os_zalloc(sizeof(*wpa_s));
3185         if (wpa_s == NULL)
3186                 return NULL;
3187         wpa_s->scan_req = INITIAL_SCAN_REQ;
3188         wpa_s->scan_interval = 5;
3189         wpa_s->new_connection = 1;
3190         wpa_s->parent = wpa_s;
3191         wpa_s->sched_scanning = 0;
3192
3193         return wpa_s;
3194 }
3195
3196
3197 #ifdef CONFIG_HT_OVERRIDES
3198
3199 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3200                              struct ieee80211_ht_capabilities *htcaps,
3201                              struct ieee80211_ht_capabilities *htcaps_mask,
3202                              const char *ht_mcs)
3203 {
3204         /* parse ht_mcs into hex array */
3205         int i;
3206         const char *tmp = ht_mcs;
3207         char *end = NULL;
3208
3209         /* If ht_mcs is null, do not set anything */
3210         if (!ht_mcs)
3211                 return 0;
3212
3213         /* This is what we are setting in the kernel */
3214         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3215
3216         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3217
3218         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3219                 errno = 0;
3220                 long v = strtol(tmp, &end, 16);
3221                 if (errno == 0) {
3222                         wpa_msg(wpa_s, MSG_DEBUG,
3223                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3224                                 i, v, end, tmp);
3225                         if (end == tmp)
3226                                 break;
3227
3228                         htcaps->supported_mcs_set[i] = v;
3229                         tmp = end;
3230                 } else {
3231                         wpa_msg(wpa_s, MSG_ERROR,
3232                                 "Failed to parse ht-mcs: %s, error: %s\n",
3233                                 ht_mcs, strerror(errno));
3234                         return -1;
3235                 }
3236         }
3237
3238         /*
3239          * If we were able to parse any values, then set mask for the MCS set.
3240          */
3241         if (i) {
3242                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3243                           IEEE80211_HT_MCS_MASK_LEN - 1);
3244                 /* skip the 3 reserved bits */
3245                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3246                         0x1f;
3247         }
3248
3249         return 0;
3250 }
3251
3252
3253 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3254                                  struct ieee80211_ht_capabilities *htcaps,
3255                                  struct ieee80211_ht_capabilities *htcaps_mask,
3256                                  int disabled)
3257 {
3258         le16 msk;
3259
3260         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3261
3262         if (disabled == -1)
3263                 return 0;
3264
3265         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3266         htcaps_mask->ht_capabilities_info |= msk;
3267         if (disabled)
3268                 htcaps->ht_capabilities_info &= msk;
3269         else
3270                 htcaps->ht_capabilities_info |= msk;
3271
3272         return 0;
3273 }
3274
3275
3276 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3277                                 struct ieee80211_ht_capabilities *htcaps,
3278                                 struct ieee80211_ht_capabilities *htcaps_mask,
3279                                 int factor)
3280 {
3281         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3282
3283         if (factor == -1)
3284                 return 0;
3285
3286         if (factor < 0 || factor > 3) {
3287                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3288                         "Must be 0-3 or -1", factor);
3289                 return -EINVAL;
3290         }
3291
3292         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3293         htcaps->a_mpdu_params &= ~0x3;
3294         htcaps->a_mpdu_params |= factor & 0x3;
3295
3296         return 0;
3297 }
3298
3299
3300 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3301                                  struct ieee80211_ht_capabilities *htcaps,
3302                                  struct ieee80211_ht_capabilities *htcaps_mask,
3303                                  int density)
3304 {
3305         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3306
3307         if (density == -1)
3308                 return 0;
3309
3310         if (density < 0 || density > 7) {
3311                 wpa_msg(wpa_s, MSG_ERROR,
3312                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3313                         density);
3314                 return -EINVAL;
3315         }
3316
3317         htcaps_mask->a_mpdu_params |= 0x1C;
3318         htcaps->a_mpdu_params &= ~(0x1C);
3319         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3320
3321         return 0;
3322 }
3323
3324
3325 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3326                                 struct ieee80211_ht_capabilities *htcaps,
3327                                 struct ieee80211_ht_capabilities *htcaps_mask,
3328                                 int disabled)
3329 {
3330         /* Masking these out disables HT40 */
3331         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3332                                 HT_CAP_INFO_SHORT_GI40MHZ);
3333
3334         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3335
3336         if (disabled)
3337                 htcaps->ht_capabilities_info &= ~msk;
3338         else
3339                 htcaps->ht_capabilities_info |= msk;
3340
3341         htcaps_mask->ht_capabilities_info |= msk;
3342
3343         return 0;
3344 }
3345
3346
3347 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3348                                struct ieee80211_ht_capabilities *htcaps,
3349                                struct ieee80211_ht_capabilities *htcaps_mask,
3350                                int disabled)
3351 {
3352         /* Masking these out disables SGI */
3353         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3354                                 HT_CAP_INFO_SHORT_GI40MHZ);
3355
3356         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3357
3358         if (disabled)
3359                 htcaps->ht_capabilities_info &= ~msk;
3360         else
3361                 htcaps->ht_capabilities_info |= msk;
3362
3363         htcaps_mask->ht_capabilities_info |= msk;
3364
3365         return 0;
3366 }
3367
3368
3369 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3370                                struct ieee80211_ht_capabilities *htcaps,
3371                                struct ieee80211_ht_capabilities *htcaps_mask,
3372                                int disabled)
3373 {
3374         /* Masking these out disables LDPC */
3375         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3376
3377         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3378
3379         if (disabled)
3380                 htcaps->ht_capabilities_info &= ~msk;
3381         else
3382                 htcaps->ht_capabilities_info |= msk;
3383
3384         htcaps_mask->ht_capabilities_info |= msk;
3385
3386         return 0;
3387 }
3388
3389
3390 void wpa_supplicant_apply_ht_overrides(
3391         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3392         struct wpa_driver_associate_params *params)
3393 {
3394         struct ieee80211_ht_capabilities *htcaps;
3395         struct ieee80211_ht_capabilities *htcaps_mask;
3396
3397         if (!ssid)
3398                 return;
3399
3400         params->disable_ht = ssid->disable_ht;
3401         if (!params->htcaps || !params->htcaps_mask)
3402                 return;
3403
3404         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3405         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3406         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3407         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3408                               ssid->disable_max_amsdu);
3409         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3410         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3411         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3412         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3413         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3414
3415         if (ssid->ht40_intolerant) {
3416                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3417                 htcaps->ht_capabilities_info |= bit;
3418                 htcaps_mask->ht_capabilities_info |= bit;
3419         }
3420 }
3421
3422 #endif /* CONFIG_HT_OVERRIDES */
3423
3424
3425 #ifdef CONFIG_VHT_OVERRIDES
3426 void wpa_supplicant_apply_vht_overrides(
3427         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3428         struct wpa_driver_associate_params *params)
3429 {
3430         struct ieee80211_vht_capabilities *vhtcaps;
3431         struct ieee80211_vht_capabilities *vhtcaps_mask;
3432
3433         if (!ssid)
3434                 return;
3435
3436         params->disable_vht = ssid->disable_vht;
3437
3438         vhtcaps = (void *) params->vhtcaps;
3439         vhtcaps_mask = (void *) params->vhtcaps_mask;
3440
3441         if (!vhtcaps || !vhtcaps_mask)
3442                 return;
3443
3444         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3445         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3446
3447 #ifdef CONFIG_HT_OVERRIDES
3448         /* if max ampdu is <= 3, we have to make the HT cap the same */
3449         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3450                 int max_ampdu;
3451
3452                 max_ampdu = (ssid->vht_capa &
3453                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3454                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3455
3456                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3457                 wpa_set_ampdu_factor(wpa_s,
3458                                      (void *) params->htcaps,
3459                                      (void *) params->htcaps_mask,
3460                                      max_ampdu);
3461         }
3462 #endif /* CONFIG_HT_OVERRIDES */
3463
3464 #define OVERRIDE_MCS(i)                                                 \
3465         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3466                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3467                         3 << 2 * (i - 1);                               \
3468                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3469                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3470         }                                                               \
3471         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3472                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3473                         3 << 2 * (i - 1);                               \
3474                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3475                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3476         }
3477
3478         OVERRIDE_MCS(1);
3479         OVERRIDE_MCS(2);
3480         OVERRIDE_MCS(3);
3481         OVERRIDE_MCS(4);
3482         OVERRIDE_MCS(5);
3483         OVERRIDE_MCS(6);
3484         OVERRIDE_MCS(7);
3485         OVERRIDE_MCS(8);
3486 }
3487 #endif /* CONFIG_VHT_OVERRIDES */
3488
3489
3490 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3491 {
3492 #ifdef PCSC_FUNCS
3493         size_t len;
3494
3495         if (!wpa_s->conf->pcsc_reader)
3496                 return 0;
3497
3498         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3499         if (!wpa_s->scard)
3500                 return 1;
3501
3502         if (wpa_s->conf->pcsc_pin &&
3503             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3504                 scard_deinit(wpa_s->scard);
3505                 wpa_s->scard = NULL;
3506                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3507                 return -1;
3508         }
3509
3510         len = sizeof(wpa_s->imsi) - 1;
3511         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3512                 scard_deinit(wpa_s->scard);
3513                 wpa_s->scard = NULL;
3514                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3515                 return -1;
3516         }
3517         wpa_s->imsi[len] = '\0';
3518
3519         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3520
3521         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3522                    wpa_s->imsi, wpa_s->mnc_len);
3523
3524         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3525         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3526 #endif /* PCSC_FUNCS */
3527
3528         return 0;
3529 }
3530
3531
3532 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3533 {
3534         char *val, *pos;
3535
3536         ext_password_deinit(wpa_s->ext_pw);
3537         wpa_s->ext_pw = NULL;
3538         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3539
3540         if (!wpa_s->conf->ext_password_backend)
3541                 return 0;
3542
3543         val = os_strdup(wpa_s->conf->ext_password_backend);
3544         if (val == NULL)
3545                 return -1;
3546         pos = os_strchr(val, ':');
3547         if (pos)
3548                 *pos++ = '\0';
3549
3550         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3551
3552         wpa_s->ext_pw = ext_password_init(val, pos);
3553         os_free(val);
3554         if (wpa_s->ext_pw == NULL) {
3555                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3556                 return -1;
3557         }
3558         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3559
3560         return 0;
3561 }
3562
3563
3564 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3565                                     const struct wpa_driver_capa *capa)
3566 {
3567         struct wowlan_triggers *triggers;
3568         int ret = 0;
3569
3570         if (!wpa_s->conf->wowlan_triggers)
3571                 return 0;
3572
3573         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3574         if (triggers) {
3575                 ret = wpa_drv_wowlan(wpa_s, triggers);
3576                 os_free(triggers);
3577         }
3578         return ret;
3579 }
3580
3581
3582 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3583                                               const char *rn)
3584 {
3585         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3586         struct wpa_radio *radio;
3587
3588         while (rn && iface) {
3589                 radio = iface->radio;
3590                 if (radio && os_strcmp(rn, radio->name) == 0) {
3591                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3592                                    wpa_s->ifname, rn);
3593                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3594                         return radio;
3595                 }
3596
3597                 iface = iface->next;
3598         }
3599
3600         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3601                    wpa_s->ifname, rn ? rn : "N/A");
3602         radio = os_zalloc(sizeof(*radio));
3603         if (radio == NULL)
3604                 return NULL;
3605
3606         if (rn)
3607                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3608         dl_list_init(&radio->ifaces);
3609         dl_list_init(&radio->work);
3610         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3611
3612         return radio;
3613 }
3614
3615
3616 static void radio_work_free(struct wpa_radio_work *work)
3617 {
3618         if (work->wpa_s->scan_work == work) {
3619                 /* This should not really happen. */
3620                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3621                         work->type, work, work->started);
3622                 work->wpa_s->scan_work = NULL;
3623         }
3624
3625 #ifdef CONFIG_P2P
3626         if (work->wpa_s->p2p_scan_work == work) {
3627                 /* This should not really happen. */
3628                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3629                         work->type, work, work->started);
3630                 work->wpa_s->p2p_scan_work = NULL;
3631         }
3632 #endif /* CONFIG_P2P */
3633
3634         dl_list_del(&work->list);
3635         os_free(work);
3636 }
3637
3638
3639 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
3640 {
3641         struct wpa_radio *radio = eloop_ctx;
3642         struct wpa_radio_work *work;
3643         struct os_reltime now, diff;
3644         struct wpa_supplicant *wpa_s;
3645
3646         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
3647         if (work == NULL)
3648                 return;
3649
3650         if (work->started)
3651                 return; /* already started and still in progress */
3652
3653         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
3654                               radio_list);
3655         if (wpa_s && wpa_s->radio->external_scan_running) {
3656                 wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
3657                 return;
3658         }
3659
3660         os_get_reltime(&now);
3661         os_reltime_sub(&now, &work->time, &diff);
3662         wpa_dbg(work->wpa_s, MSG_DEBUG, "Starting radio work '%s'@%p after %ld.%06ld second wait",
3663                 work->type, work, diff.sec, diff.usec);
3664         work->started = 1;
3665         work->time = now;
3666         work->cb(work, 0);
3667 }
3668
3669
3670 /*
3671  * This function removes both started and pending radio works running on
3672  * the provided interface's radio.
3673  * Prior to the removal of the radio work, its callback (cb) is called with
3674  * deinit set to be 1. Each work's callback is responsible for clearing its
3675  * internal data and restoring to a correct state.
3676  * @wpa_s: wpa_supplicant data
3677  * @type: type of works to be removed
3678  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
3679  * this interface's works.
3680  */
3681 void radio_remove_works(struct wpa_supplicant *wpa_s,
3682                         const char *type, int remove_all)
3683 {
3684         struct wpa_radio_work *work, *tmp;
3685         struct wpa_radio *radio = wpa_s->radio;
3686
3687         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
3688                               list) {
3689                 if (type && os_strcmp(type, work->type) != 0)
3690                         continue;
3691
3692                 /* skip other ifaces' works */
3693                 if (!remove_all && work->wpa_s != wpa_s)
3694                         continue;
3695
3696                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
3697                         work->type, work, work->started ? " (started)" : "");
3698                 work->cb(work, 1);
3699                 radio_work_free(work);
3700         }
3701
3702         /* in case we removed the started work */
3703         radio_work_check_next(wpa_s);
3704 }
3705
3706
3707 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
3708 {
3709         struct wpa_radio *radio = wpa_s->radio;
3710
3711         if (!radio)
3712                 return;
3713
3714         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
3715                    wpa_s->ifname, radio->name);
3716         dl_list_del(&wpa_s->radio_list);
3717         radio_remove_works(wpa_s, NULL, 0);
3718         wpa_s->radio = NULL;
3719         if (!dl_list_empty(&radio->ifaces))
3720                 return; /* Interfaces remain for this radio */
3721
3722         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
3723         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3724         os_free(radio);
3725 }
3726
3727
3728 void radio_work_check_next(struct wpa_supplicant *wpa_s)
3729 {
3730         struct wpa_radio *radio = wpa_s->radio;
3731
3732         if (dl_list_empty(&radio->work))
3733                 return;
3734         if (wpa_s->ext_work_in_progress) {
3735                 wpa_printf(MSG_DEBUG,
3736                            "External radio work in progress - delay start of pending item");
3737                 return;
3738         }
3739         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
3740         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
3741 }
3742
3743
3744 /**
3745  * radio_add_work - Add a radio work item
3746  * @wpa_s: Pointer to wpa_supplicant data
3747  * @freq: Frequency of the offchannel operation in MHz or 0
3748  * @type: Unique identifier for each type of work
3749  * @next: Force as the next work to be executed
3750  * @cb: Callback function for indicating when radio is available
3751  * @ctx: Context pointer for the work (work->ctx in cb())
3752  * Returns: 0 on success, -1 on failure
3753  *
3754  * This function is used to request time for an operation that requires
3755  * exclusive radio control. Once the radio is available, the registered callback
3756  * function will be called. radio_work_done() must be called once the exclusive
3757  * radio operation has been completed, so that the radio is freed for other
3758  * operations. The special case of deinit=1 is used to free the context data
3759  * during interface removal. That does not allow the callback function to start
3760  * the radio operation, i.e., it must free any resources allocated for the radio
3761  * work and return.
3762  *
3763  * The @freq parameter can be used to indicate a single channel on which the
3764  * offchannel operation will occur. This may allow multiple radio work
3765  * operations to be performed in parallel if they apply for the same channel.
3766  * Setting this to 0 indicates that the work item may use multiple channels or
3767  * requires exclusive control of the radio.
3768  */
3769 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
3770                    const char *type, int next,
3771                    void (*cb)(struct wpa_radio_work *work, int deinit),
3772                    void *ctx)
3773 {
3774         struct wpa_radio_work *work;
3775         int was_empty;
3776
3777         work = os_zalloc(sizeof(*work));
3778         if (work == NULL)
3779                 return -1;
3780         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
3781         os_get_reltime(&work->time);
3782         work->freq = freq;
3783         work->type = type;
3784         work->wpa_s = wpa_s;
3785         work->cb = cb;
3786         work->ctx = ctx;
3787
3788         was_empty = dl_list_empty(&wpa_s->radio->work);
3789         if (next)
3790                 dl_list_add(&wpa_s->radio->work, &work->list);
3791         else
3792                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
3793         if (was_empty) {
3794                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
3795                 radio_work_check_next(wpa_s);
3796         }
3797
3798         return 0;
3799 }
3800
3801
3802 /**
3803  * radio_work_done - Indicate that a radio work item has been completed
3804  * @work: Completed work
3805  *
3806  * This function is called once the callback function registered with
3807  * radio_add_work() has completed its work.
3808  */
3809 void radio_work_done(struct wpa_radio_work *work)
3810 {
3811         struct wpa_supplicant *wpa_s = work->wpa_s;
3812         struct os_reltime now, diff;
3813         unsigned int started = work->started;
3814
3815         os_get_reltime(&now);
3816         os_reltime_sub(&now, &work->time, &diff);
3817         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
3818                 work->type, work, started ? "done" : "canceled",
3819                 diff.sec, diff.usec);
3820         radio_work_free(work);
3821         if (started)
3822                 radio_work_check_next(wpa_s);
3823 }
3824
3825
3826 struct wpa_radio_work *
3827 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
3828 {
3829         struct wpa_radio_work *work;
3830         struct wpa_radio *radio = wpa_s->radio;
3831
3832         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
3833                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
3834                         return work;
3835         }
3836
3837         return NULL;
3838 }
3839
3840
3841 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
3842                             struct wpa_interface *iface)
3843 {
3844         const char *ifname, *driver, *rn;
3845
3846         driver = iface->driver;
3847 next_driver:
3848         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
3849                 return -1;
3850
3851         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
3852         if (wpa_s->drv_priv == NULL) {
3853                 const char *pos;
3854                 pos = driver ? os_strchr(driver, ',') : NULL;
3855                 if (pos) {
3856                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
3857                                 "driver interface - try next driver wrapper");
3858                         driver = pos + 1;
3859                         goto next_driver;
3860                 }
3861                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
3862                         "interface");
3863                 return -1;
3864         }
3865         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
3866                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
3867                         "driver_param '%s'", wpa_s->conf->driver_param);
3868                 return -1;
3869         }
3870
3871         ifname = wpa_drv_get_ifname(wpa_s);
3872         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
3873                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
3874                         "interface name with '%s'", ifname);
3875                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
3876         }
3877
3878         rn = wpa_driver_get_radio_name(wpa_s);
3879         if (rn && rn[0] == '\0')
3880                 rn = NULL;
3881
3882         wpa_s->radio = radio_add_interface(wpa_s, rn);
3883         if (wpa_s->radio == NULL)
3884                 return -1;
3885
3886         return 0;
3887 }
3888
3889
3890 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
3891                                      struct wpa_interface *iface)
3892 {
3893         struct wpa_driver_capa capa;
3894         int capa_res;
3895
3896         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
3897                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
3898                    iface->confname ? iface->confname : "N/A",
3899                    iface->driver ? iface->driver : "default",
3900                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
3901                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
3902
3903         if (iface->confname) {
3904 #ifdef CONFIG_BACKEND_FILE
3905                 wpa_s->confname = os_rel2abs_path(iface->confname);
3906                 if (wpa_s->confname == NULL) {
3907                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
3908                                    "for configuration file '%s'.",
3909                                    iface->confname);
3910                         return -1;
3911                 }
3912                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
3913                            iface->confname, wpa_s->confname);
3914 #else /* CONFIG_BACKEND_FILE */
3915                 wpa_s->confname = os_strdup(iface->confname);
3916 #endif /* CONFIG_BACKEND_FILE */
3917                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
3918                 if (wpa_s->conf == NULL) {
3919                         wpa_printf(MSG_ERROR, "Failed to read or parse "
3920                                    "configuration '%s'.", wpa_s->confname);
3921                         return -1;
3922                 }
3923                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
3924                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
3925
3926                 /*
3927                  * Override ctrl_interface and driver_param if set on command
3928                  * line.
3929                  */
3930                 if (iface->ctrl_interface) {
3931                         os_free(wpa_s->conf->ctrl_interface);
3932                         wpa_s->conf->ctrl_interface =
3933                                 os_strdup(iface->ctrl_interface);
3934                 }
3935
3936                 if (iface->driver_param) {
3937                         os_free(wpa_s->conf->driver_param);
3938                         wpa_s->conf->driver_param =
3939                                 os_strdup(iface->driver_param);
3940                 }
3941
3942                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
3943                         os_free(wpa_s->conf->ctrl_interface);
3944                         wpa_s->conf->ctrl_interface = NULL;
3945                 }
3946         } else
3947                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
3948                                                      iface->driver_param);
3949
3950         if (wpa_s->conf == NULL) {
3951                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
3952                 return -1;
3953         }
3954
3955         if (iface->ifname == NULL) {
3956                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
3957                 return -1;
3958         }
3959         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
3960                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
3961                            iface->ifname);
3962                 return -1;
3963         }
3964         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
3965
3966         if (iface->bridge_ifname) {
3967                 if (os_strlen(iface->bridge_ifname) >=
3968                     sizeof(wpa_s->bridge_ifname)) {
3969                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
3970                                    "name '%s'.", iface->bridge_ifname);
3971                         return -1;
3972                 }
3973                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
3974                            sizeof(wpa_s->bridge_ifname));
3975         }
3976
3977         /* RSNA Supplicant Key Management - INITIALIZE */
3978         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
3979         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
3980
3981         /* Initialize driver interface and register driver event handler before
3982          * L2 receive handler so that association events are processed before
3983          * EAPOL-Key packets if both become available for the same select()
3984          * call. */
3985         if (wpas_init_driver(wpa_s, iface) < 0)
3986                 return -1;
3987
3988         if (wpa_supplicant_init_wpa(wpa_s) < 0)
3989                 return -1;
3990
3991         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
3992                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
3993                           NULL);
3994         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
3995
3996         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
3997             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
3998                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
3999                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4000                         "dot11RSNAConfigPMKLifetime");
4001                 return -1;
4002         }
4003
4004         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4005             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4006                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4007                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4008                         "dot11RSNAConfigPMKReauthThreshold");
4009                 return -1;
4010         }
4011
4012         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4013             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4014                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4015                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4016                         "dot11RSNAConfigSATimeout");
4017                 return -1;
4018         }
4019
4020         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4021                                                       &wpa_s->hw.num_modes,
4022                                                       &wpa_s->hw.flags);
4023
4024         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4025         if (capa_res == 0) {
4026                 wpa_s->drv_capa_known = 1;
4027                 wpa_s->drv_flags = capa.flags;
4028                 wpa_s->drv_enc = capa.enc;
4029                 wpa_s->drv_smps_modes = capa.smps_modes;
4030                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4031                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4032                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4033                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4034                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4035                 wpa_s->max_match_sets = capa.max_match_sets;
4036                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4037                 wpa_s->max_stations = capa.max_stations;
4038                 wpa_s->extended_capa = capa.extended_capa;
4039                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4040                 wpa_s->extended_capa_len = capa.extended_capa_len;
4041                 wpa_s->num_multichan_concurrent =
4042                         capa.num_multichan_concurrent;
4043                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4044
4045                 if (capa.mac_addr_rand_scan_supported)
4046                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4047                 if (wpa_s->sched_scan_supported &&
4048                     capa.mac_addr_rand_sched_scan_supported)
4049                         wpa_s->mac_addr_rand_supported |=
4050                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4051         }
4052         if (wpa_s->max_remain_on_chan == 0)
4053                 wpa_s->max_remain_on_chan = 1000;
4054
4055         /*
4056          * Only take p2p_mgmt parameters when P2P Device is supported.
4057          * Doing it here as it determines whether l2_packet_init() will be done
4058          * during wpa_supplicant_driver_init().
4059          */
4060         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4061                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4062         else
4063                 iface->p2p_mgmt = 1;
4064
4065         if (wpa_s->num_multichan_concurrent == 0)
4066                 wpa_s->num_multichan_concurrent = 1;
4067
4068         if (wpa_supplicant_driver_init(wpa_s) < 0)
4069                 return -1;
4070
4071 #ifdef CONFIG_TDLS
4072         if ((!iface->p2p_mgmt ||
4073              !(wpa_s->drv_flags &
4074                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4075             wpa_tdls_init(wpa_s->wpa))
4076                 return -1;
4077 #endif /* CONFIG_TDLS */
4078
4079         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4080             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4081                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4082                 return -1;
4083         }
4084
4085         if (wpas_wps_init(wpa_s))
4086                 return -1;
4087
4088         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4089                 return -1;
4090         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4091
4092         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4093         if (wpa_s->ctrl_iface == NULL) {
4094                 wpa_printf(MSG_ERROR,
4095                            "Failed to initialize control interface '%s'.\n"
4096                            "You may have another wpa_supplicant process "
4097                            "already running or the file was\n"
4098                            "left by an unclean termination of wpa_supplicant "
4099                            "in which case you will need\n"
4100                            "to manually remove this file before starting "
4101                            "wpa_supplicant again.\n",
4102                            wpa_s->conf->ctrl_interface);
4103                 return -1;
4104         }
4105
4106         wpa_s->gas = gas_query_init(wpa_s);
4107         if (wpa_s->gas == NULL) {
4108                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4109                 return -1;
4110         }
4111
4112         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4113                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4114                 return -1;
4115         }
4116
4117         if (wpa_bss_init(wpa_s) < 0)
4118                 return -1;
4119
4120         /*
4121          * Set Wake-on-WLAN triggers, if configured.
4122          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4123          * have effect anyway when the interface is down).
4124          */
4125         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4126                 return -1;
4127
4128 #ifdef CONFIG_EAP_PROXY
4129 {
4130         size_t len;
4131         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4132                                                      &len);
4133         if (wpa_s->mnc_len > 0) {
4134                 wpa_s->imsi[len] = '\0';
4135                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4136                            wpa_s->imsi, wpa_s->mnc_len);
4137         } else {
4138                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4139         }
4140 }
4141 #endif /* CONFIG_EAP_PROXY */
4142
4143         if (pcsc_reader_init(wpa_s) < 0)
4144                 return -1;
4145
4146         if (wpas_init_ext_pw(wpa_s) < 0)
4147                 return -1;
4148
4149         wpas_rrm_reset(wpa_s);
4150
4151         return 0;
4152 }
4153
4154
4155 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4156                                         int notify, int terminate)
4157 {
4158         struct wpa_global *global = wpa_s->global;
4159         struct wpa_supplicant *iface, *prev;
4160
4161         if (wpa_s == wpa_s->parent)
4162                 wpas_p2p_group_remove(wpa_s, "*");
4163
4164         iface = global->ifaces;
4165         while (iface) {
4166                 if (iface == wpa_s || iface->parent != wpa_s) {
4167                         iface = iface->next;
4168                         continue;
4169                 }
4170                 wpa_printf(MSG_DEBUG,
4171                            "Remove remaining child interface %s from parent %s",
4172                            iface->ifname, wpa_s->ifname);
4173                 prev = iface;
4174                 iface = iface->next;
4175                 wpa_supplicant_remove_iface(global, prev, terminate);
4176         }
4177
4178         wpa_s->disconnected = 1;
4179         if (wpa_s->drv_priv) {
4180                 wpa_supplicant_deauthenticate(wpa_s,
4181                                               WLAN_REASON_DEAUTH_LEAVING);
4182
4183                 wpa_drv_set_countermeasures(wpa_s, 0);
4184                 wpa_clear_keys(wpa_s, NULL);
4185         }
4186
4187         wpa_supplicant_cleanup(wpa_s);
4188         wpas_p2p_deinit_iface(wpa_s);
4189
4190         wpas_ctrl_radio_work_flush(wpa_s);
4191         radio_remove_interface(wpa_s);
4192
4193         if (wpa_s->drv_priv)
4194                 wpa_drv_deinit(wpa_s);
4195
4196         if (notify)
4197                 wpas_notify_iface_removed(wpa_s);
4198
4199         if (terminate)
4200                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4201
4202         if (wpa_s->ctrl_iface) {
4203                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4204                 wpa_s->ctrl_iface = NULL;
4205         }
4206
4207 #ifdef CONFIG_MESH
4208         if (wpa_s->ifmsh) {
4209                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4210                 wpa_s->ifmsh = NULL;
4211         }
4212 #endif /* CONFIG_MESH */
4213
4214         if (wpa_s->conf != NULL) {
4215                 wpa_config_free(wpa_s->conf);
4216                 wpa_s->conf = NULL;
4217         }
4218
4219         os_free(wpa_s);
4220 }
4221
4222
4223 /**
4224  * wpa_supplicant_add_iface - Add a new network interface
4225  * @global: Pointer to global data from wpa_supplicant_init()
4226  * @iface: Interface configuration options
4227  * Returns: Pointer to the created interface or %NULL on failure
4228  *
4229  * This function is used to add new network interfaces for %wpa_supplicant.
4230  * This can be called before wpa_supplicant_run() to add interfaces before the
4231  * main event loop has been started. In addition, new interfaces can be added
4232  * dynamically while %wpa_supplicant is already running. This could happen,
4233  * e.g., when a hotplug network adapter is inserted.
4234  */
4235 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4236                                                  struct wpa_interface *iface)
4237 {
4238         struct wpa_supplicant *wpa_s;
4239         struct wpa_interface t_iface;
4240         struct wpa_ssid *ssid;
4241
4242         if (global == NULL || iface == NULL)
4243                 return NULL;
4244
4245         wpa_s = wpa_supplicant_alloc();
4246         if (wpa_s == NULL)
4247                 return NULL;
4248
4249         wpa_s->global = global;
4250
4251         t_iface = *iface;
4252         if (global->params.override_driver) {
4253                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4254                            "('%s' -> '%s')",
4255                            iface->driver, global->params.override_driver);
4256                 t_iface.driver = global->params.override_driver;
4257         }
4258         if (global->params.override_ctrl_interface) {
4259                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4260                            "ctrl_interface ('%s' -> '%s')",
4261                            iface->ctrl_interface,
4262                            global->params.override_ctrl_interface);
4263                 t_iface.ctrl_interface =
4264                         global->params.override_ctrl_interface;
4265         }
4266         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4267                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4268                            iface->ifname);
4269                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4270                 return NULL;
4271         }
4272
4273         if (iface->p2p_mgmt == 0) {
4274                 /* Notify the control interfaces about new iface */
4275                 if (wpas_notify_iface_added(wpa_s)) {
4276                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4277                         return NULL;
4278                 }
4279
4280                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4281                         wpas_notify_network_added(wpa_s, ssid);
4282         }
4283
4284         wpa_s->next = global->ifaces;
4285         global->ifaces = wpa_s;
4286
4287         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4288         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4289
4290 #ifdef CONFIG_P2P
4291         if (wpa_s->global->p2p == NULL &&
4292             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4293             wpas_p2p_add_p2pdev_interface(wpa_s, iface->conf_p2p_dev) < 0) {
4294                 wpa_printf(MSG_INFO,
4295                            "P2P: Failed to enable P2P Device interface");
4296                 /* Try to continue without. P2P will be disabled. */
4297         }
4298 #endif /* CONFIG_P2P */
4299
4300         return wpa_s;
4301 }
4302
4303
4304 /**
4305  * wpa_supplicant_remove_iface - Remove a network interface
4306  * @global: Pointer to global data from wpa_supplicant_init()
4307  * @wpa_s: Pointer to the network interface to be removed
4308  * Returns: 0 if interface was removed, -1 if interface was not found
4309  *
4310  * This function can be used to dynamically remove network interfaces from
4311  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4312  * addition, this function is used to remove all remaining interfaces when
4313  * %wpa_supplicant is terminated.
4314  */
4315 int wpa_supplicant_remove_iface(struct wpa_global *global,
4316                                 struct wpa_supplicant *wpa_s,
4317                                 int terminate)
4318 {
4319         struct wpa_supplicant *prev;
4320 #ifdef CONFIG_MESH
4321         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4322         char *ifname = NULL;
4323 #endif /* CONFIG_MESH */
4324
4325         /* Remove interface from the global list of interfaces */
4326         prev = global->ifaces;
4327         if (prev == wpa_s) {
4328                 global->ifaces = wpa_s->next;
4329         } else {
4330                 while (prev && prev->next != wpa_s)
4331                         prev = prev->next;
4332                 if (prev == NULL)
4333                         return -1;
4334                 prev->next = wpa_s->next;
4335         }
4336
4337         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4338
4339 #ifdef CONFIG_MESH
4340         if (mesh_if_created) {
4341                 ifname = os_strdup(wpa_s->ifname);
4342                 if (ifname == NULL) {
4343                         wpa_dbg(wpa_s, MSG_ERROR,
4344                                 "mesh: Failed to malloc ifname");
4345                         return -1;
4346                 }
4347         }
4348 #endif /* CONFIG_MESH */
4349
4350         if (global->p2p_group_formation == wpa_s)
4351                 global->p2p_group_formation = NULL;
4352         if (global->p2p_invite_group == wpa_s)
4353                 global->p2p_invite_group = NULL;
4354         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4355
4356 #ifdef CONFIG_MESH
4357         if (mesh_if_created) {
4358                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4359                 os_free(ifname);
4360         }
4361 #endif /* CONFIG_MESH */
4362
4363         return 0;
4364 }
4365
4366
4367 /**
4368  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4369  * @wpa_s: Pointer to the network interface
4370  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4371  */
4372 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4373 {
4374         const char *eapol_method;
4375
4376         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4377             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4378                 return "NO-EAP";
4379         }
4380
4381         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4382         if (eapol_method == NULL)
4383                 return "UNKNOWN-EAP";
4384
4385         return eapol_method;
4386 }
4387
4388
4389 /**
4390  * wpa_supplicant_get_iface - Get a new network interface
4391  * @global: Pointer to global data from wpa_supplicant_init()
4392  * @ifname: Interface name
4393  * Returns: Pointer to the interface or %NULL if not found
4394  */
4395 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4396                                                  const char *ifname)
4397 {
4398         struct wpa_supplicant *wpa_s;
4399
4400         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4401                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4402                         return wpa_s;
4403         }
4404         return NULL;
4405 }
4406
4407
4408 #ifndef CONFIG_NO_WPA_MSG
4409 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4410 {
4411         struct wpa_supplicant *wpa_s = ctx;
4412         if (wpa_s == NULL)
4413                 return NULL;
4414         return wpa_s->ifname;
4415 }
4416 #endif /* CONFIG_NO_WPA_MSG */
4417
4418
4419 /**
4420  * wpa_supplicant_init - Initialize %wpa_supplicant
4421  * @params: Parameters for %wpa_supplicant
4422  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4423  *
4424  * This function is used to initialize %wpa_supplicant. After successful
4425  * initialization, the returned data pointer can be used to add and remove
4426  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4427  */
4428 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4429 {
4430         struct wpa_global *global;
4431         int ret, i;
4432
4433         if (params == NULL)
4434                 return NULL;
4435
4436 #ifdef CONFIG_DRIVER_NDIS
4437         {
4438                 void driver_ndis_init_ops(void);
4439                 driver_ndis_init_ops();
4440         }
4441 #endif /* CONFIG_DRIVER_NDIS */
4442
4443 #ifndef CONFIG_NO_WPA_MSG
4444         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
4445 #endif /* CONFIG_NO_WPA_MSG */
4446
4447         if (params->wpa_debug_file_path)
4448                 wpa_debug_open_file(params->wpa_debug_file_path);
4449         else
4450                 wpa_debug_setup_stdout();
4451         if (params->wpa_debug_syslog)
4452                 wpa_debug_open_syslog();
4453         if (params->wpa_debug_tracing) {
4454                 ret = wpa_debug_open_linux_tracing();
4455                 if (ret) {
4456                         wpa_printf(MSG_ERROR,
4457                                    "Failed to enable trace logging");
4458                         return NULL;
4459                 }
4460         }
4461
4462         ret = eap_register_methods();
4463         if (ret) {
4464                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
4465                 if (ret == -2)
4466                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
4467                                    "the same EAP type.");
4468                 return NULL;
4469         }
4470
4471         global = os_zalloc(sizeof(*global));
4472         if (global == NULL)
4473                 return NULL;
4474         dl_list_init(&global->p2p_srv_bonjour);
4475         dl_list_init(&global->p2p_srv_upnp);
4476         global->params.daemonize = params->daemonize;
4477         global->params.wait_for_monitor = params->wait_for_monitor;
4478         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
4479         if (params->pid_file)
4480                 global->params.pid_file = os_strdup(params->pid_file);
4481         if (params->ctrl_interface)
4482                 global->params.ctrl_interface =
4483                         os_strdup(params->ctrl_interface);
4484         if (params->ctrl_interface_group)
4485                 global->params.ctrl_interface_group =
4486                         os_strdup(params->ctrl_interface_group);
4487         if (params->override_driver)
4488                 global->params.override_driver =
4489                         os_strdup(params->override_driver);
4490         if (params->override_ctrl_interface)
4491                 global->params.override_ctrl_interface =
4492                         os_strdup(params->override_ctrl_interface);
4493         wpa_debug_level = global->params.wpa_debug_level =
4494                 params->wpa_debug_level;
4495         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
4496                 params->wpa_debug_show_keys;
4497         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
4498                 params->wpa_debug_timestamp;
4499
4500         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
4501
4502         if (eloop_init()) {
4503                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
4504                 wpa_supplicant_deinit(global);
4505                 return NULL;
4506         }
4507
4508         random_init(params->entropy_file);
4509
4510         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
4511         if (global->ctrl_iface == NULL) {
4512                 wpa_supplicant_deinit(global);
4513                 return NULL;
4514         }
4515
4516         if (wpas_notify_supplicant_initialized(global)) {
4517                 wpa_supplicant_deinit(global);
4518                 return NULL;
4519         }
4520
4521         for (i = 0; wpa_drivers[i]; i++)
4522                 global->drv_count++;
4523         if (global->drv_count == 0) {
4524                 wpa_printf(MSG_ERROR, "No drivers enabled");
4525                 wpa_supplicant_deinit(global);
4526                 return NULL;
4527         }
4528         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
4529         if (global->drv_priv == NULL) {
4530                 wpa_supplicant_deinit(global);
4531                 return NULL;
4532         }
4533
4534 #ifdef CONFIG_WIFI_DISPLAY
4535         if (wifi_display_init(global) < 0) {
4536                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
4537                 wpa_supplicant_deinit(global);
4538                 return NULL;
4539         }
4540 #endif /* CONFIG_WIFI_DISPLAY */
4541
4542         return global;
4543 }
4544
4545
4546 /**
4547  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
4548  * @global: Pointer to global data from wpa_supplicant_init()
4549  * Returns: 0 after successful event loop run, -1 on failure
4550  *
4551  * This function starts the main event loop and continues running as long as
4552  * there are any remaining events. In most cases, this function is running as
4553  * long as the %wpa_supplicant process in still in use.
4554  */
4555 int wpa_supplicant_run(struct wpa_global *global)
4556 {
4557         struct wpa_supplicant *wpa_s;
4558
4559         if (global->params.daemonize &&
4560             wpa_supplicant_daemon(global->params.pid_file))
4561                 return -1;
4562
4563         if (global->params.wait_for_monitor) {
4564                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
4565                         if (wpa_s->ctrl_iface)
4566                                 wpa_supplicant_ctrl_iface_wait(
4567                                         wpa_s->ctrl_iface);
4568         }
4569
4570         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
4571         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
4572
4573         eloop_run();
4574
4575         return 0;
4576 }
4577
4578
4579 /**
4580  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
4581  * @global: Pointer to global data from wpa_supplicant_init()
4582  *
4583  * This function is called to deinitialize %wpa_supplicant and to free all
4584  * allocated resources. Remaining network interfaces will also be removed.
4585  */
4586 void wpa_supplicant_deinit(struct wpa_global *global)
4587 {
4588         int i;
4589
4590         if (global == NULL)
4591                 return;
4592
4593 #ifdef CONFIG_WIFI_DISPLAY
4594         wifi_display_deinit(global);
4595 #endif /* CONFIG_WIFI_DISPLAY */
4596
4597         while (global->ifaces)
4598                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
4599
4600         if (global->ctrl_iface)
4601                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
4602
4603         wpas_notify_supplicant_deinitialized(global);
4604
4605         eap_peer_unregister_methods();
4606 #ifdef CONFIG_AP
4607         eap_server_unregister_methods();
4608 #endif /* CONFIG_AP */
4609
4610         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
4611                 if (!global->drv_priv[i])
4612                         continue;
4613                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
4614         }
4615         os_free(global->drv_priv);
4616
4617         random_deinit();
4618
4619         eloop_destroy();
4620
4621         if (global->params.pid_file) {
4622                 os_daemonize_terminate(global->params.pid_file);
4623                 os_free(global->params.pid_file);
4624         }
4625         os_free(global->params.ctrl_interface);
4626         os_free(global->params.ctrl_interface_group);
4627         os_free(global->params.override_driver);
4628         os_free(global->params.override_ctrl_interface);
4629
4630         os_free(global->p2p_disallow_freq.range);
4631         os_free(global->p2p_go_avoid_freq.range);
4632         os_free(global->add_psk);
4633
4634         os_free(global);
4635         wpa_debug_close_syslog();
4636         wpa_debug_close_file();
4637         wpa_debug_close_linux_tracing();
4638 }
4639
4640
4641 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
4642 {
4643         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
4644             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
4645                 char country[3];
4646                 country[0] = wpa_s->conf->country[0];
4647                 country[1] = wpa_s->conf->country[1];
4648                 country[2] = '\0';
4649                 if (wpa_drv_set_country(wpa_s, country) < 0) {
4650                         wpa_printf(MSG_ERROR, "Failed to set country code "
4651                                    "'%s'", country);
4652                 }
4653         }
4654
4655         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
4656                 wpas_init_ext_pw(wpa_s);
4657
4658 #ifdef CONFIG_WPS
4659         wpas_wps_update_config(wpa_s);
4660 #endif /* CONFIG_WPS */
4661         wpas_p2p_update_config(wpa_s);
4662         wpa_s->conf->changed_parameters = 0;
4663 }
4664
4665
4666 void add_freq(int *freqs, int *num_freqs, int freq)
4667 {
4668         int i;
4669
4670         for (i = 0; i < *num_freqs; i++) {
4671                 if (freqs[i] == freq)
4672                         return;
4673         }
4674
4675         freqs[*num_freqs] = freq;
4676         (*num_freqs)++;
4677 }
4678
4679
4680 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
4681 {
4682         struct wpa_bss *bss, *cbss;
4683         const int max_freqs = 10;
4684         int *freqs;
4685         int num_freqs = 0;
4686
4687         freqs = os_calloc(max_freqs + 1, sizeof(int));
4688         if (freqs == NULL)
4689                 return NULL;
4690
4691         cbss = wpa_s->current_bss;
4692
4693         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
4694                 if (bss == cbss)
4695                         continue;
4696                 if (bss->ssid_len == cbss->ssid_len &&
4697                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
4698                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
4699                         add_freq(freqs, &num_freqs, bss->freq);
4700                         if (num_freqs == max_freqs)
4701                                 break;
4702                 }
4703         }
4704
4705         if (num_freqs == 0) {
4706                 os_free(freqs);
4707                 freqs = NULL;
4708         }
4709
4710         return freqs;
4711 }
4712
4713
4714 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
4715 {
4716         int timeout;
4717         int count;
4718         int *freqs = NULL;
4719
4720         wpas_connect_work_done(wpa_s);
4721
4722         /*
4723          * Remove possible authentication timeout since the connection failed.
4724          */
4725         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
4726
4727         if (wpa_s->disconnected) {
4728                 /*
4729                  * There is no point in blacklisting the AP if this event is
4730                  * generated based on local request to disconnect.
4731                  */
4732                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
4733                         "indication since interface has been put into "
4734                         "disconnected state");
4735                 return;
4736         }
4737
4738         /*
4739          * Add the failed BSSID into the blacklist and speed up next scan
4740          * attempt if there could be other APs that could accept association.
4741          * The current blacklist count indicates how many times we have tried
4742          * connecting to this AP and multiple attempts mean that other APs are
4743          * either not available or has already been tried, so that we can start
4744          * increasing the delay here to avoid constant scanning.
4745          */
4746         count = wpa_blacklist_add(wpa_s, bssid);
4747         if (count == 1 && wpa_s->current_bss) {
4748                 /*
4749                  * This BSS was not in the blacklist before. If there is
4750                  * another BSS available for the same ESS, we should try that
4751                  * next. Otherwise, we may as well try this one once more
4752                  * before allowing other, likely worse, ESSes to be considered.
4753                  */
4754                 freqs = get_bss_freqs_in_ess(wpa_s);
4755                 if (freqs) {
4756                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
4757                                 "has been seen; try it next");
4758                         wpa_blacklist_add(wpa_s, bssid);
4759                         /*
4760                          * On the next scan, go through only the known channels
4761                          * used in this ESS based on previous scans to speed up
4762                          * common load balancing use case.
4763                          */
4764                         os_free(wpa_s->next_scan_freqs);
4765                         wpa_s->next_scan_freqs = freqs;
4766                 }
4767         }
4768
4769         /*
4770          * Add previous failure count in case the temporary blacklist was
4771          * cleared due to no other BSSes being available.
4772          */
4773         count += wpa_s->extra_blacklist_count;
4774
4775         if (count > 3 && wpa_s->current_ssid) {
4776                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
4777                            "consider temporary network disabling");
4778                 wpas_auth_failed(wpa_s, "CONN_FAILED");
4779         }
4780
4781         switch (count) {
4782         case 1:
4783                 timeout = 100;
4784                 break;
4785         case 2:
4786                 timeout = 500;
4787                 break;
4788         case 3:
4789                 timeout = 1000;
4790                 break;
4791         case 4:
4792                 timeout = 5000;
4793                 break;
4794         default:
4795                 timeout = 10000;
4796                 break;
4797         }
4798
4799         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
4800                 "ms", count, timeout);
4801
4802         /*
4803          * TODO: if more than one possible AP is available in scan results,
4804          * could try the other ones before requesting a new scan.
4805          */
4806         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
4807                                 1000 * (timeout % 1000));
4808 }
4809
4810
4811 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
4812 {
4813         return wpa_s->conf->ap_scan == 2 ||
4814                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
4815 }
4816
4817
4818 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
4819 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
4820                                               struct wpa_ssid *ssid,
4821                                               const char *field,
4822                                               const char *value)
4823 {
4824 #ifdef IEEE8021X_EAPOL
4825         struct eap_peer_config *eap = &ssid->eap;
4826
4827         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
4828         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
4829                               (const u8 *) value, os_strlen(value));
4830
4831         switch (wpa_supplicant_ctrl_req_from_string(field)) {
4832         case WPA_CTRL_REQ_EAP_IDENTITY:
4833                 os_free(eap->identity);
4834                 eap->identity = (u8 *) os_strdup(value);
4835                 eap->identity_len = os_strlen(value);
4836                 eap->pending_req_identity = 0;
4837                 if (ssid == wpa_s->current_ssid)
4838                         wpa_s->reassociate = 1;
4839                 break;
4840         case WPA_CTRL_REQ_EAP_PASSWORD:
4841                 bin_clear_free(eap->password, eap->password_len);
4842                 eap->password = (u8 *) os_strdup(value);
4843                 eap->password_len = os_strlen(value);
4844                 eap->pending_req_password = 0;
4845                 if (ssid == wpa_s->current_ssid)
4846                         wpa_s->reassociate = 1;
4847                 break;
4848         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
4849                 bin_clear_free(eap->new_password, eap->new_password_len);
4850                 eap->new_password = (u8 *) os_strdup(value);
4851                 eap->new_password_len = os_strlen(value);
4852                 eap->pending_req_new_password = 0;
4853                 if (ssid == wpa_s->current_ssid)
4854                         wpa_s->reassociate = 1;
4855                 break;
4856         case WPA_CTRL_REQ_EAP_PIN:
4857                 str_clear_free(eap->pin);
4858                 eap->pin = os_strdup(value);
4859                 eap->pending_req_pin = 0;
4860                 if (ssid == wpa_s->current_ssid)
4861                         wpa_s->reassociate = 1;
4862                 break;
4863         case WPA_CTRL_REQ_EAP_OTP:
4864                 bin_clear_free(eap->otp, eap->otp_len);
4865                 eap->otp = (u8 *) os_strdup(value);
4866                 eap->otp_len = os_strlen(value);
4867                 os_free(eap->pending_req_otp);
4868                 eap->pending_req_otp = NULL;
4869                 eap->pending_req_otp_len = 0;
4870                 break;
4871         case WPA_CTRL_REQ_EAP_PASSPHRASE:
4872                 str_clear_free(eap->private_key_passwd);
4873                 eap->private_key_passwd = os_strdup(value);
4874                 eap->pending_req_passphrase = 0;
4875                 if (ssid == wpa_s->current_ssid)
4876                         wpa_s->reassociate = 1;
4877                 break;
4878         case WPA_CTRL_REQ_SIM:
4879                 str_clear_free(eap->external_sim_resp);
4880                 eap->external_sim_resp = os_strdup(value);
4881                 break;
4882         default:
4883                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
4884                 return -1;
4885         }
4886
4887         return 0;
4888 #else /* IEEE8021X_EAPOL */
4889         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
4890         return -1;
4891 #endif /* IEEE8021X_EAPOL */
4892 }
4893 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
4894
4895
4896 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4897 {
4898         int i;
4899         unsigned int drv_enc;
4900
4901         if (ssid == NULL)
4902                 return 1;
4903
4904         if (ssid->disabled)
4905                 return 1;
4906
4907         if (wpa_s && wpa_s->drv_capa_known)
4908                 drv_enc = wpa_s->drv_enc;
4909         else
4910                 drv_enc = (unsigned int) -1;
4911
4912         for (i = 0; i < NUM_WEP_KEYS; i++) {
4913                 size_t len = ssid->wep_key_len[i];
4914                 if (len == 0)
4915                         continue;
4916                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
4917                         continue;
4918                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
4919                         continue;
4920                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
4921                         continue;
4922                 return 1; /* invalid WEP key */
4923         }
4924
4925         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
4926             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk)
4927                 return 1;
4928
4929         return 0;
4930 }
4931
4932
4933 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
4934 {
4935 #ifdef CONFIG_IEEE80211W
4936         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
4937                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
4938                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
4939                         /*
4940                          * Driver does not support BIP -- ignore pmf=1 default
4941                          * since the connection with PMF would fail and the
4942                          * configuration does not require PMF to be enabled.
4943                          */
4944                         return NO_MGMT_FRAME_PROTECTION;
4945                 }
4946
4947                 return wpa_s->conf->pmf;
4948         }
4949
4950         return ssid->ieee80211w;
4951 #else /* CONFIG_IEEE80211W */
4952         return NO_MGMT_FRAME_PROTECTION;
4953 #endif /* CONFIG_IEEE80211W */
4954 }
4955
4956
4957 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
4958 {
4959         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
4960                 return 1;
4961         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
4962                 return 0;
4963         return -1;
4964 }
4965
4966
4967 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
4968 {
4969         struct wpa_ssid *ssid = wpa_s->current_ssid;
4970         int dur;
4971         struct os_reltime now;
4972
4973         if (ssid == NULL) {
4974                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
4975                            "SSID block");
4976                 return;
4977         }
4978
4979         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
4980                 return;
4981
4982         ssid->auth_failures++;
4983
4984 #ifdef CONFIG_P2P
4985         if (ssid->p2p_group &&
4986             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
4987                 /*
4988                  * Skip the wait time since there is a short timeout on the
4989                  * connection to a P2P group.
4990                  */
4991                 return;
4992         }
4993 #endif /* CONFIG_P2P */
4994
4995         if (ssid->auth_failures > 50)
4996                 dur = 300;
4997         else if (ssid->auth_failures > 10)
4998                 dur = 120;
4999         else if (ssid->auth_failures > 5)
5000                 dur = 90;
5001         else if (ssid->auth_failures > 3)
5002                 dur = 60;
5003         else if (ssid->auth_failures > 2)
5004                 dur = 30;
5005         else if (ssid->auth_failures > 1)
5006                 dur = 20;
5007         else
5008                 dur = 10;
5009
5010         if (ssid->auth_failures > 1 &&
5011             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5012                 dur += os_random() % (ssid->auth_failures * 10);
5013
5014         os_get_reltime(&now);
5015         if (now.sec + dur <= ssid->disabled_until.sec)
5016                 return;
5017
5018         ssid->disabled_until.sec = now.sec + dur;
5019
5020         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5021                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5022                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5023                 ssid->auth_failures, dur, reason);
5024 }
5025
5026
5027 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5028                               struct wpa_ssid *ssid, int clear_failures)
5029 {
5030         if (ssid == NULL)
5031                 return;
5032
5033         if (ssid->disabled_until.sec) {
5034                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5035                         "id=%d ssid=\"%s\"",
5036                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5037         }
5038         ssid->disabled_until.sec = 0;
5039         ssid->disabled_until.usec = 0;
5040         if (clear_failures)
5041                 ssid->auth_failures = 0;
5042 }
5043
5044
5045 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5046 {
5047         size_t i;
5048
5049         if (wpa_s->disallow_aps_bssid == NULL)
5050                 return 0;
5051
5052         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5053                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5054                               bssid, ETH_ALEN) == 0)
5055                         return 1;
5056         }
5057
5058         return 0;
5059 }
5060
5061
5062 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5063                     size_t ssid_len)
5064 {
5065         size_t i;
5066
5067         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5068                 return 0;
5069
5070         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5071                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5072                 if (ssid_len == s->ssid_len &&
5073                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5074                         return 1;
5075         }
5076
5077         return 0;
5078 }
5079
5080
5081 /**
5082  * wpas_request_connection - Request a new connection
5083  * @wpa_s: Pointer to the network interface
5084  *
5085  * This function is used to request a new connection to be found. It will mark
5086  * the interface to allow reassociation and request a new scan to find a
5087  * suitable network to connect to.
5088  */
5089 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5090 {
5091         wpa_s->normal_scans = 0;
5092         wpa_s->scan_req = NORMAL_SCAN_REQ;
5093         wpa_supplicant_reinit_autoscan(wpa_s);
5094         wpa_s->extra_blacklist_count = 0;
5095         wpa_s->disconnected = 0;
5096         wpa_s->reassociate = 1;
5097
5098         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5099                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5100         else
5101                 wpa_s->reattach = 0;
5102 }
5103
5104
5105 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5106                     struct wpa_used_freq_data *freqs_data,
5107                     unsigned int len)
5108 {
5109         unsigned int i;
5110
5111         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5112                 len, title);
5113         for (i = 0; i < len; i++) {
5114                 struct wpa_used_freq_data *cur = &freqs_data[i];
5115                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5116                         i, cur->freq, cur->flags);
5117         }
5118 }
5119
5120
5121 /*
5122  * Find the operating frequencies of any of the virtual interfaces that
5123  * are using the same radio as the current interface, and in addition, get
5124  * information about the interface types that are using the frequency.
5125  */
5126 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5127                                 struct wpa_used_freq_data *freqs_data,
5128                                 unsigned int len)
5129 {
5130         struct wpa_supplicant *ifs;
5131         u8 bssid[ETH_ALEN];
5132         int freq;
5133         unsigned int idx = 0, i;
5134
5135         wpa_dbg(wpa_s, MSG_DEBUG,
5136                 "Determining shared radio frequencies (max len %u)", len);
5137         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5138
5139         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5140                          radio_list) {
5141                 if (idx == len)
5142                         break;
5143
5144                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5145                         continue;
5146
5147                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5148                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO)
5149                         freq = ifs->current_ssid->frequency;
5150                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5151                         freq = ifs->assoc_freq;
5152                 else
5153                         continue;
5154
5155                 /* Hold only distinct freqs */
5156                 for (i = 0; i < idx; i++)
5157                         if (freqs_data[i].freq == freq)
5158                                 break;
5159
5160                 if (i == idx)
5161                         freqs_data[idx++].freq = freq;
5162
5163                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5164                         freqs_data[i].flags = ifs->current_ssid->p2p_group ?
5165                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5166                                 WPA_FREQ_USED_BY_INFRA_STATION;
5167                 }
5168         }
5169
5170         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5171         return idx;
5172 }
5173
5174
5175 /*
5176  * Find the operating frequencies of any of the virtual interfaces that
5177  * are using the same radio as the current interface.
5178  */
5179 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5180                            int *freq_array, unsigned int len)
5181 {
5182         struct wpa_used_freq_data *freqs_data;
5183         int num, i;
5184
5185         os_memset(freq_array, 0, sizeof(int) * len);
5186
5187         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5188         if (!freqs_data)
5189                 return -1;
5190
5191         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5192         for (i = 0; i < num; i++)
5193                 freq_array[i] = freqs_data[i].freq;
5194
5195         os_free(freqs_data);
5196
5197         return num;
5198 }
5199
5200
5201 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5202 {
5203         struct rrm_data *rrm = data;
5204
5205         if (!rrm->notify_neighbor_rep) {
5206                 wpa_printf(MSG_ERROR,
5207                            "RRM: Unexpected neighbor report timeout");
5208                 return;
5209         }
5210
5211         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5212         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5213
5214         rrm->notify_neighbor_rep = NULL;
5215         rrm->neighbor_rep_cb_ctx = NULL;
5216 }
5217
5218
5219 /*
5220  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5221  * @wpa_s: Pointer to wpa_supplicant
5222  */
5223 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5224 {
5225         wpa_s->rrm.rrm_used = 0;
5226
5227         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5228                              NULL);
5229         if (wpa_s->rrm.notify_neighbor_rep)
5230                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5231         wpa_s->rrm.next_neighbor_rep_token = 1;
5232 }
5233
5234
5235 /*
5236  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5237  * @wpa_s: Pointer to wpa_supplicant
5238  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5239  * @report_len: Length of neighbor report buffer
5240  */
5241 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5242                                    const u8 *report, size_t report_len)
5243 {
5244         struct wpabuf *neighbor_rep;
5245
5246         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5247         if (report_len < 1)
5248                 return;
5249
5250         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5251                 wpa_printf(MSG_DEBUG,
5252                            "RRM: Discarding neighbor report with token %d (expected %d)",
5253                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5254                 return;
5255         }
5256
5257         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5258                              NULL);
5259
5260         if (!wpa_s->rrm.notify_neighbor_rep) {
5261                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5262                 return;
5263         }
5264
5265         /* skipping the first byte, which is only an id (dialog token) */
5266         neighbor_rep = wpabuf_alloc(report_len - 1);
5267         if (neighbor_rep == NULL)
5268                 return;
5269         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5270         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5271                    report[0]);
5272         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5273                                        neighbor_rep);
5274         wpa_s->rrm.notify_neighbor_rep = NULL;
5275         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5276 }
5277
5278
5279 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5280 /* Workaround different, undefined for Windows, error codes used here */
5281 #define ENOTCONN -1
5282 #define EOPNOTSUPP -1
5283 #define ECANCELED -1
5284 #endif
5285
5286 /**
5287  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5288  * @wpa_s: Pointer to wpa_supplicant
5289  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5290  *        is sent in the request.
5291  * @cb: Callback function to be called once the requested report arrives, or
5292  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5293  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5294  *      the requester's responsibility to free it.
5295  *      In the latter case NULL will be sent in 'neighbor_rep'.
5296  * @cb_ctx: Context value to send the callback function
5297  * Returns: 0 in case of success, negative error code otherwise
5298  *
5299  * In case there is a previous request which has not been answered yet, the
5300  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5301  * Request must contain a callback function.
5302  */
5303 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5304                                        const struct wpa_ssid *ssid,
5305                                        void (*cb)(void *ctx,
5306                                                   struct wpabuf *neighbor_rep),
5307                                        void *cb_ctx)
5308 {
5309         struct wpabuf *buf;
5310         const u8 *rrm_ie;
5311
5312         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5313                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5314                 return -ENOTCONN;
5315         }
5316
5317         if (!wpa_s->rrm.rrm_used) {
5318                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5319                 return -EOPNOTSUPP;
5320         }
5321
5322         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5323                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5324         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5325             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5326                 wpa_printf(MSG_DEBUG,
5327                            "RRM: No network support for Neighbor Report.");
5328                 return -EOPNOTSUPP;
5329         }
5330
5331         if (!cb) {
5332                 wpa_printf(MSG_DEBUG,
5333                            "RRM: Neighbor Report request must provide a callback.");
5334                 return -EINVAL;
5335         }
5336
5337         /* Refuse if there's a live request */
5338         if (wpa_s->rrm.notify_neighbor_rep) {
5339                 wpa_printf(MSG_DEBUG,
5340                            "RRM: Currently handling previous Neighbor Report.");
5341                 return -EBUSY;
5342         }
5343
5344         /* 3 = action category + action code + dialog token */
5345         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5346         if (buf == NULL) {
5347                 wpa_printf(MSG_DEBUG,
5348                            "RRM: Failed to allocate Neighbor Report Request");
5349                 return -ENOMEM;
5350         }
5351
5352         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5353                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5354                    wpa_s->rrm.next_neighbor_rep_token);
5355
5356         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5357         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5358         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5359         if (ssid) {
5360                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5361                 wpabuf_put_u8(buf, ssid->ssid_len);
5362                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5363         }
5364
5365         wpa_s->rrm.next_neighbor_rep_token++;
5366
5367         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5368                                 wpa_s->own_addr, wpa_s->bssid,
5369                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5370                 wpa_printf(MSG_DEBUG,
5371                            "RRM: Failed to send Neighbor Report Request");
5372                 wpabuf_free(buf);
5373                 return -ECANCELED;
5374         }
5375
5376         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5377         wpa_s->rrm.notify_neighbor_rep = cb;
5378         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5379                                wpas_rrm_neighbor_rep_timeout_handler,
5380                                &wpa_s->rrm, NULL);
5381
5382         wpabuf_free(buf);
5383         return 0;
5384 }
5385
5386
5387 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5388                                               const u8 *src,
5389                                               const u8 *frame, size_t len,
5390                                               int rssi)
5391 {
5392         struct wpabuf *buf;
5393         const struct rrm_link_measurement_request *req;
5394         struct rrm_link_measurement_report report;
5395
5396         if (wpa_s->wpa_state != WPA_COMPLETED) {
5397                 wpa_printf(MSG_INFO,
5398                            "RRM: Ignoring link measurement request. Not associated");
5399                 return;
5400         }
5401
5402         if (!wpa_s->rrm.rrm_used) {
5403                 wpa_printf(MSG_INFO,
5404                            "RRM: Ignoring link measurement request. Not RRM network");
5405                 return;
5406         }
5407
5408         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5409                 wpa_printf(MSG_INFO,
5410                            "RRM: Measurement report failed. TX power insertion not supported");
5411                 return;
5412         }
5413
5414         req = (const struct rrm_link_measurement_request *) frame;
5415         if (len < sizeof(*req)) {
5416                 wpa_printf(MSG_INFO,
5417                            "RRM: Link measurement report failed. Request too short");
5418                 return;
5419         }
5420
5421         os_memset(&report, 0, sizeof(report));
5422         report.tpc.eid = WLAN_EID_TPC_REPORT;
5423         report.tpc.len = 2;
5424         report.rsni = 255; /* 255 indicates that RSNI is not available */
5425         report.dialog_token = req->dialog_token;
5426
5427         /*
5428          * It's possible to estimate RCPI based on RSSI in dBm. This
5429          * calculation will not reflect the correct value for high rates,
5430          * but it's good enough for Action frames which are transmitted
5431          * with up to 24 Mbps rates.
5432          */
5433         if (!rssi)
5434                 report.rcpi = 255; /* not available */
5435         else if (rssi < -110)
5436                 report.rcpi = 0;
5437         else if (rssi > 0)
5438                 report.rcpi = 220;
5439         else
5440                 report.rcpi = (rssi + 110) * 2;
5441
5442         /* action_category + action_code */
5443         buf = wpabuf_alloc(2 + sizeof(report));
5444         if (buf == NULL) {
5445                 wpa_printf(MSG_ERROR,
5446                            "RRM: Link measurement report failed. Buffer allocation failed");
5447                 return;
5448         }
5449
5450         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5451         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
5452         wpabuf_put_data(buf, &report, sizeof(report));
5453         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
5454                     wpabuf_head(buf), wpabuf_len(buf));
5455
5456         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
5457                                 wpa_s->own_addr, wpa_s->bssid,
5458                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
5459                 wpa_printf(MSG_ERROR,
5460                            "RRM: Link measurement report failed. Send action failed");
5461         }
5462         wpabuf_free(buf);
5463 }