wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14
  15 #include "common.h"
  16 #include "crypto/random.h"
  17 #include "crypto/sha1.h"
  18 #include "eapol_supp/eapol_supp_sm.h"
  19 #include "eap_peer/eap.h"
  20 #include "eap_peer/eap_proxy.h"
  21 #include "eap_server/eap_methods.h"
  22 #include "rsn_supp/wpa.h"
  23 #include "eloop.h"
  24 #include "config.h"
  25 #include "utils/ext_password.h"
  26 #include "l2_packet/l2_packet.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "driver_i.h"
  29 #include "ctrl_iface.h"
  30 #include "pcsc_funcs.h"
  31 #include "common/version.h"
  32 #include "rsn_supp/preauth.h"
  33 #include "rsn_supp/pmksa_cache.h"
  34 #include "common/wpa_ctrl.h"
  35 #include "common/ieee802_11_defs.h"
  36 #include "common/hw_features_common.h"
  37 #include "p2p/p2p.h"
  38 #include "fst/fst.h"
  39 #include "blacklist.h"
  40 #include "wpas_glue.h"
  41 #include "wps_supplicant.h"
  42 #include "ibss_rsn.h"
  43 #include "sme.h"
  44 #include "gas_query.h"
  45 #include "ap.h"
  46 #include "p2p_supplicant.h"
  47 #include "wifi_display.h"
  48 #include "notify.h"
  49 #include "bgscan.h"
  50 #include "autoscan.h"
  51 #include "bss.h"
  52 #include "scan.h"
  53 #include "offchannel.h"
  54 #include "hs20_supplicant.h"
  55 #include "wnm_sta.h"
  56 #include "wpas_kay.h"
  57 #include "mesh.h"
  58
  59 const char *const wpa_supplicant_version =
  60 "wpa_supplicant v" VERSION_STR "\n"
  61 "Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> and contributors";
  62
  63 const char *const wpa_supplicant_license =
  64 "This software may be distributed under the terms of the BSD license.\n"
  65 "See README for more details.\n"
  66 #ifdef EAP_TLS_OPENSSL
  67 "\nThis product includes software developed by the OpenSSL Project\n"
  68 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  69 #endif /* EAP_TLS_OPENSSL */
  70 ;
  71
  72 #ifndef CONFIG_NO_STDOUT_DEBUG
  73 /* Long text divided into parts in order to fit in C89 strings size limits. */
  74 const char *const wpa_supplicant_full_license1 =
  75 "";
  76 const char *const wpa_supplicant_full_license2 =
  77 "This software may be distributed under the terms of the BSD license.\n"
  78 "\n"
  79 "Redistribution and use in source and binary forms, with or without\n"
  80 "modification, are permitted provided that the following conditions are\n"
  81 "met:\n"
  82 "\n";
  83 const char *const wpa_supplicant_full_license3 =
  84 "1. Redistributions of source code must retain the above copyright\n"
  85 "   notice, this list of conditions and the following disclaimer.\n"
  86 "\n"
  87 "2. Redistributions in binary form must reproduce the above copyright\n"
  88 "   notice, this list of conditions and the following disclaimer in the\n"
  89 "   documentation and/or other materials provided with the distribution.\n"
  90 "\n";
  91 const char *const wpa_supplicant_full_license4 =
  92 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  93 "   names of its contributors may be used to endorse or promote products\n"
  94 "   derived from this software without specific prior written permission.\n"
  95 "\n"
  96 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
  97 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
  98 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
  99 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 100 const char *const wpa_supplicant_full_license5 =
 101 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 102 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 103 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 104 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 105 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 106 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 107 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 108 "\n";
 109 #endif /* CONFIG_NO_STDOUT_DEBUG */
 110
 111 /* Configure default/group WEP keys for static WEP */
 112 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 113 {
 114         int i, set = 0;
 115
 116         for (i = 0; i < NUM_WEP_KEYS; i++) {
 117                 if (ssid->wep_key_len[i] == 0)
 118                         continue;
 119
 120                 set = 1;
 121                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 122                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 123                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 124         }
 125
 126         return set;
 127 }
 128
 129
 130 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 131                                     struct wpa_ssid *ssid)
 132 {
 133         u8 key[32];
 134         size_t keylen;
 135         enum wpa_alg alg;
 136         u8 seq[6] = { 0 };
 137         int ret;
 138
 139         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 140          * sending unicast and multicast packets. */
 141
 142         if (ssid->mode != WPAS_MODE_IBSS) {
 143                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 144                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 145                 return -1;
 146         }
 147
 148         if (!ssid->psk_set) {
 149                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 150                         "WPA-None");
 151                 return -1;
 152         }
 153
 154         switch (wpa_s->group_cipher) {
 155         case WPA_CIPHER_CCMP:
 156                 os_memcpy(key, ssid->psk, 16);
 157                 keylen = 16;
 158                 alg = WPA_ALG_CCMP;
 159                 break;
 160         case WPA_CIPHER_GCMP:
 161                 os_memcpy(key, ssid->psk, 16);
 162                 keylen = 16;
 163                 alg = WPA_ALG_GCMP;
 164                 break;
 165         case WPA_CIPHER_TKIP:
 166                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 167                 os_memcpy(key, ssid->psk, 16 + 8);
 168                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 169                 keylen = 32;
 170                 alg = WPA_ALG_TKIP;
 171                 break;
 172         default:
 173                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 174                         "WPA-None", wpa_s->group_cipher);
 175                 return -1;
 176         }
 177
 178         /* TODO: should actually remember the previously used seq#, both for TX
 179          * and RX from each STA.. */
 180
 181         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 182         os_memset(key, 0, sizeof(key));
 183         return ret;
 184 }
 185
 186
 187 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 188 {
 189         struct wpa_supplicant *wpa_s = eloop_ctx;
 190         const u8 *bssid = wpa_s->bssid;
 191         if (is_zero_ether_addr(bssid))
 192                 bssid = wpa_s->pending_bssid;
 193         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 194                 MAC2STR(bssid));
 195         wpa_blacklist_add(wpa_s, bssid);
 196         wpa_sm_notify_disassoc(wpa_s->wpa);
 197         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 198         wpa_s->reassociate = 1;
 199
 200         /*
 201          * If we timed out, the AP or the local radio may be busy.
 202          * So, wait a second until scanning again.
 203          */
 204         wpa_supplicant_req_scan(wpa_s, 1, 0);
 205 }
 206
 207
 208 /**
 209  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 210  * @wpa_s: Pointer to wpa_supplicant data
 211  * @sec: Number of seconds after which to time out authentication
 212  * @usec: Number of microseconds after which to time out authentication
 213  *
 214  * This function is used to schedule a timeout for the current authentication
 215  * attempt.
 216  */
 217 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 218                                      int sec, int usec)
 219 {
 220         if (wpa_s->conf->ap_scan == 0 &&
 221             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 222                 return;
 223
 224         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 225                 "%d usec", sec, usec);
 226         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 227         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 228 }
 229
 230
 231 /**
 232  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 233  * @wpa_s: Pointer to wpa_supplicant data
 234  *
 235  * This function is used to cancel authentication timeout scheduled with
 236  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 237  * been completed.
 238  */
 239 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 240 {
 241         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 242         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 243         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 244 }
 245
 246
 247 /**
 248  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 249  * @wpa_s: Pointer to wpa_supplicant data
 250  *
 251  * This function is used to configure EAPOL state machine based on the selected
 252  * authentication mode.
 253  */
 254 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 255 {
 256 #ifdef IEEE8021X_EAPOL
 257         struct eapol_config eapol_conf;
 258         struct wpa_ssid *ssid = wpa_s->current_ssid;
 259
 260 #ifdef CONFIG_IBSS_RSN
 261         if (ssid->mode == WPAS_MODE_IBSS &&
 262             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 263             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 264                 /*
 265                  * RSN IBSS authentication is per-STA and we can disable the
 266                  * per-BSSID EAPOL authentication.
 267                  */
 268                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 269                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 270                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 271                 return;
 272         }
 273 #endif /* CONFIG_IBSS_RSN */
 274
 275         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 276         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 277
 278         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 279             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 280                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 281         else
 282                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 283
 284         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 286                 eapol_conf.accept_802_1x_keys = 1;
 287                 eapol_conf.required_keys = 0;
 288                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 289                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 290                 }
 291                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 292                         eapol_conf.required_keys |=
 293                                 EAPOL_REQUIRE_KEY_BROADCAST;
 294                 }
 295
 296                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 297                         eapol_conf.required_keys = 0;
 298         }
 299         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 300         eapol_conf.workaround = ssid->eap_workaround;
 301         eapol_conf.eap_disabled =
 302                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 303                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 304                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 305         eapol_conf.external_sim = wpa_s->conf->external_sim;
 306
 307 #ifdef CONFIG_WPS
 308         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 309                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 310                 if (wpa_s->current_bss) {
 311                         struct wpabuf *ie;
 312                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 313                                                          WPS_IE_VENDOR_TYPE);
 314                         if (ie) {
 315                                 if (wps_is_20(ie))
 316                                         eapol_conf.wps |=
 317                                                 EAPOL_PEER_IS_WPS20_AP;
 318                                 wpabuf_free(ie);
 319                         }
 320                 }
 321         }
 322 #endif /* CONFIG_WPS */
 323
 324         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 325
 326         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 327 #endif /* IEEE8021X_EAPOL */
 328 }
 329
 330
 331 /**
 332  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 333  * @wpa_s: Pointer to wpa_supplicant data
 334  * @ssid: Configuration data for the network
 335  *
 336  * This function is used to configure WPA state machine and related parameters
 337  * to a mode where WPA is not enabled. This is called as part of the
 338  * authentication configuration when the selected network does not use WPA.
 339  */
 340 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 341                                        struct wpa_ssid *ssid)
 342 {
 343         int i;
 344
 345         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 346                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 347         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 348                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 349         else
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 351         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 352         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 353         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 354         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 355         wpa_s->group_cipher = WPA_CIPHER_NONE;
 356         wpa_s->mgmt_group_cipher = 0;
 357
 358         for (i = 0; i < NUM_WEP_KEYS; i++) {
 359                 if (ssid->wep_key_len[i] > 5) {
 360                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 361                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 362                         break;
 363                 } else if (ssid->wep_key_len[i] > 0) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 366                         break;
 367                 }
 368         }
 369
 370         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 371         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 372         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 373                          wpa_s->pairwise_cipher);
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 375 #ifdef CONFIG_IEEE80211W
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 377                          wpa_s->mgmt_group_cipher);
 378 #endif /* CONFIG_IEEE80211W */
 379
 380         pmksa_cache_clear_current(wpa_s->wpa);
 381 }
 382
 383
 384 void free_hw_features(struct wpa_supplicant *wpa_s)
 385 {
 386         int i;
 387         if (wpa_s->hw.modes == NULL)
 388                 return;
 389
 390         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 391                 os_free(wpa_s->hw.modes[i].channels);
 392                 os_free(wpa_s->hw.modes[i].rates);
 393         }
 394
 395         os_free(wpa_s->hw.modes);
 396         wpa_s->hw.modes = NULL;
 397 }
 398
 399
 400 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 401 {
 402         int i;
 403
 404         bgscan_deinit(wpa_s);
 405         autoscan_deinit(wpa_s);
 406         scard_deinit(wpa_s->scard);
 407         wpa_s->scard = NULL;
 408         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 409         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 410         l2_packet_deinit(wpa_s->l2);
 411         wpa_s->l2 = NULL;
 412         if (wpa_s->l2_br) {
 413                 l2_packet_deinit(wpa_s->l2_br);
 414                 wpa_s->l2_br = NULL;
 415         }
 416 #ifdef CONFIG_TESTING_OPTIONS
 417         l2_packet_deinit(wpa_s->l2_test);
 418         wpa_s->l2_test = NULL;
 419 #endif /* CONFIG_TESTING_OPTIONS */
 420
 421         if (wpa_s->conf != NULL) {
 422                 struct wpa_ssid *ssid;
 423                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 424                         wpas_notify_network_removed(wpa_s, ssid);
 425         }
 426
 427         os_free(wpa_s->confname);
 428         wpa_s->confname = NULL;
 429
 430         os_free(wpa_s->confanother);
 431         wpa_s->confanother = NULL;
 432
 433         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 434         eapol_sm_deinit(wpa_s->eapol);
 435         wpa_s->eapol = NULL;
 436
 437         rsn_preauth_deinit(wpa_s->wpa);
 438
 439 #ifdef CONFIG_TDLS
 440         wpa_tdls_deinit(wpa_s->wpa);
 441 #endif /* CONFIG_TDLS */
 442
 443         wmm_ac_clear_saved_tspecs(wpa_s);
 444         pmksa_candidate_free(wpa_s->wpa);
 445         wpa_sm_deinit(wpa_s->wpa);
 446         wpa_s->wpa = NULL;
 447         wpa_blacklist_clear(wpa_s);
 448
 449         wpa_bss_deinit(wpa_s);
 450
 451         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 452         wpa_supplicant_cancel_scan(wpa_s);
 453         wpa_supplicant_cancel_auth_timeout(wpa_s);
 454         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 455 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 456         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 457                              wpa_s, NULL);
 458 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 459
 460         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 461
 462         wpas_wps_deinit(wpa_s);
 463
 464         wpabuf_free(wpa_s->pending_eapol_rx);
 465         wpa_s->pending_eapol_rx = NULL;
 466
 467 #ifdef CONFIG_IBSS_RSN
 468         ibss_rsn_deinit(wpa_s->ibss_rsn);
 469         wpa_s->ibss_rsn = NULL;
 470 #endif /* CONFIG_IBSS_RSN */
 471
 472         sme_deinit(wpa_s);
 473
 474 #ifdef CONFIG_AP
 475         wpa_supplicant_ap_deinit(wpa_s);
 476 #endif /* CONFIG_AP */
 477
 478         wpas_p2p_deinit(wpa_s);
 479
 480 #ifdef CONFIG_OFFCHANNEL
 481         offchannel_deinit(wpa_s);
 482 #endif /* CONFIG_OFFCHANNEL */
 483
 484         wpa_supplicant_cancel_sched_scan(wpa_s);
 485
 486         os_free(wpa_s->next_scan_freqs);
 487         wpa_s->next_scan_freqs = NULL;
 488
 489         os_free(wpa_s->manual_scan_freqs);
 490         wpa_s->manual_scan_freqs = NULL;
 491
 492         os_free(wpa_s->manual_sched_scan_freqs);
 493         wpa_s->manual_sched_scan_freqs = NULL;
 494
 495         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 496
 497         /*
 498          * Need to remove any pending gas-query radio work before the
 499          * gas_query_deinit() call because gas_query::work has not yet been set
 500          * for works that have not been started. gas_query_free() will be unable
 501          * to cancel such pending radio works and once the pending gas-query
 502          * radio work eventually gets removed, the deinit notification call to
 503          * gas_query_start_cb() would result in dereferencing freed memory.
 504          */
 505         if (wpa_s->radio)
 506                 radio_remove_works(wpa_s, "gas-query", 0);
 507         gas_query_deinit(wpa_s->gas);
 508         wpa_s->gas = NULL;
 509
 510         free_hw_features(wpa_s);
 511
 512         ieee802_1x_dealloc_kay_sm(wpa_s);
 513
 514         os_free(wpa_s->bssid_filter);
 515         wpa_s->bssid_filter = NULL;
 516
 517         os_free(wpa_s->disallow_aps_bssid);
 518         wpa_s->disallow_aps_bssid = NULL;
 519         os_free(wpa_s->disallow_aps_ssid);
 520         wpa_s->disallow_aps_ssid = NULL;
 521
 522         wnm_bss_keep_alive_deinit(wpa_s);
 523 #ifdef CONFIG_WNM
 524         wnm_deallocate_memory(wpa_s);
 525 #endif /* CONFIG_WNM */
 526
 527         ext_password_deinit(wpa_s->ext_pw);
 528         wpa_s->ext_pw = NULL;
 529
 530         wpabuf_free(wpa_s->last_gas_resp);
 531         wpa_s->last_gas_resp = NULL;
 532         wpabuf_free(wpa_s->prev_gas_resp);
 533         wpa_s->prev_gas_resp = NULL;
 534
 535         os_free(wpa_s->last_scan_res);
 536         wpa_s->last_scan_res = NULL;
 537
 538 #ifdef CONFIG_HS20
 539         hs20_deinit(wpa_s);
 540 #endif /* CONFIG_HS20 */
 541
 542         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 543                 wpabuf_free(wpa_s->vendor_elem[i]);
 544                 wpa_s->vendor_elem[i] = NULL;
 545         }
 546
 547         wmm_ac_notify_disassoc(wpa_s);
 548 }
 549
 550
 551 /**
 552  * wpa_clear_keys - Clear keys configured for the driver
 553  * @wpa_s: Pointer to wpa_supplicant data
 554  * @addr: Previously used BSSID or %NULL if not available
 555  *
 556  * This function clears the encryption keys that has been previously configured
 557  * for the driver.
 558  */
 559 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 560 {
 561         int i, max;
 562
 563 #ifdef CONFIG_IEEE80211W
 564         max = 6;
 565 #else /* CONFIG_IEEE80211W */
 566         max = 4;
 567 #endif /* CONFIG_IEEE80211W */
 568
 569         /* MLME-DELETEKEYS.request */
 570         for (i = 0; i < max; i++) {
 571                 if (wpa_s->keys_cleared & BIT(i))
 572                         continue;
 573                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 574                                 NULL, 0);
 575         }
 576         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 577             !is_zero_ether_addr(addr)) {
 578                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 579                                 0);
 580                 /* MLME-SETPROTECTION.request(None) */
 581                 wpa_drv_mlme_setprotection(
 582                         wpa_s, addr,
 583                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 584                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 585         }
 586         wpa_s->keys_cleared = (u32) -1;
 587 }
 588
 589
 590 /**
 591  * wpa_supplicant_state_txt - Get the connection state name as a text string
 592  * @state: State (wpa_state; WPA_*)
 593  * Returns: The state name as a printable text string
 594  */
 595 const char * wpa_supplicant_state_txt(enum wpa_states state)
 596 {
 597         switch (state) {
 598         case WPA_DISCONNECTED:
 599                 return "DISCONNECTED";
 600         case WPA_INACTIVE:
 601                 return "INACTIVE";
 602         case WPA_INTERFACE_DISABLED:
 603                 return "INTERFACE_DISABLED";
 604         case WPA_SCANNING:
 605                 return "SCANNING";
 606         case WPA_AUTHENTICATING:
 607                 return "AUTHENTICATING";
 608         case WPA_ASSOCIATING:
 609                 return "ASSOCIATING";
 610         case WPA_ASSOCIATED:
 611                 return "ASSOCIATED";
 612         case WPA_4WAY_HANDSHAKE:
 613                 return "4WAY_HANDSHAKE";
 614         case WPA_GROUP_HANDSHAKE:
 615                 return "GROUP_HANDSHAKE";
 616         case WPA_COMPLETED:
 617                 return "COMPLETED";
 618         default:
 619                 return "UNKNOWN";
 620         }
 621 }
 622
 623
 624 #ifdef CONFIG_BGSCAN
 625
 626 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 627 {
 628         const char *name;
 629
 630         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 631                 name = wpa_s->current_ssid->bgscan;
 632         else
 633                 name = wpa_s->conf->bgscan;
 634         if (name == NULL || name[0] == '\0')
 635                 return;
 636         if (wpas_driver_bss_selection(wpa_s))
 637                 return;
 638         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 639                 return;
 640 #ifdef CONFIG_P2P
 641         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 642                 return;
 643 #endif /* CONFIG_P2P */
 644
 645         bgscan_deinit(wpa_s);
 646         if (wpa_s->current_ssid) {
 647                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 648                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 649                                 "bgscan");
 650                         /*
 651                          * Live without bgscan; it is only used as a roaming
 652                          * optimization, so the initial connection is not
 653                          * affected.
 654                          */
 655                 } else {
 656                         struct wpa_scan_results *scan_res;
 657                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 658                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 659                                                                    0);
 660                         if (scan_res) {
 661                                 bgscan_notify_scan(wpa_s, scan_res);
 662                                 wpa_scan_results_free(scan_res);
 663                         }
 664                 }
 665         } else
 666                 wpa_s->bgscan_ssid = NULL;
 667 }
 668
 669
 670 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 671 {
 672         if (wpa_s->bgscan_ssid != NULL) {
 673                 bgscan_deinit(wpa_s);
 674                 wpa_s->bgscan_ssid = NULL;
 675         }
 676 }
 677
 678 #endif /* CONFIG_BGSCAN */
 679
 680
 681 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 682 {
 683         if (autoscan_init(wpa_s, 0))
 684                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 685 }
 686
 687
 688 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 689 {
 690         autoscan_deinit(wpa_s);
 691 }
 692
 693
 694 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 695 {
 696         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 697             wpa_s->wpa_state == WPA_SCANNING) {
 698                 autoscan_deinit(wpa_s);
 699                 wpa_supplicant_start_autoscan(wpa_s);
 700         }
 701 }
 702
 703
 704 /**
 705  * wpa_supplicant_set_state - Set current connection state
 706  * @wpa_s: Pointer to wpa_supplicant data
 707  * @state: The new connection state
 708  *
 709  * This function is called whenever the connection state changes, e.g.,
 710  * association is completed for WPA/WPA2 4-Way Handshake is started.
 711  */
 712 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 713                               enum wpa_states state)
 714 {
 715         enum wpa_states old_state = wpa_s->wpa_state;
 716
 717         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 718                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 719                 wpa_supplicant_state_txt(state));
 720
 721         if (state == WPA_INTERFACE_DISABLED) {
 722                 /* Assure normal scan when interface is restored */
 723                 wpa_s->normal_scans = 0;
 724         }
 725
 726         if (state == WPA_COMPLETED) {
 727                 wpas_connect_work_done(wpa_s);
 728                 /* Reinitialize normal_scan counter */
 729                 wpa_s->normal_scans = 0;
 730         }
 731
 732 #ifdef CONFIG_P2P
 733         /*
 734          * P2PS client has to reply to Probe Request frames received on the
 735          * group operating channel. Enable Probe Request frame reporting for
 736          * P2P connected client in case p2p_cli_probe configuration property is
 737          * set to 1.
 738          */
 739         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 740             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 741             wpa_s->current_ssid->p2p_group) {
 742                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 743                         wpa_dbg(wpa_s, MSG_DEBUG,
 744                                 "P2P: Enable CLI Probe Request RX reporting");
 745                         wpa_s->p2p_cli_probe =
 746                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 747                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 748                         wpa_dbg(wpa_s, MSG_DEBUG,
 749                                 "P2P: Disable CLI Probe Request RX reporting");
 750                         wpa_s->p2p_cli_probe = 0;
 751                         wpa_drv_probe_req_report(wpa_s, 0);
 752                 }
 753         }
 754 #endif /* CONFIG_P2P */
 755
 756         if (state != WPA_SCANNING)
 757                 wpa_supplicant_notify_scanning(wpa_s, 0);
 758
 759         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 760                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 761 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 762                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 763                         MACSTR " completed [id=%d id_str=%s]",
 764                         MAC2STR(wpa_s->bssid),
 765                         ssid ? ssid->id : -1,
 766                         ssid && ssid->id_str ? ssid->id_str : "");
 767 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 768                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 769                 wpa_blacklist_clear(wpa_s);
 770                 wpa_s->extra_blacklist_count = 0;
 771                 wpa_s->new_connection = 0;
 772                 wpa_drv_set_operstate(wpa_s, 1);
 773 #ifndef IEEE8021X_EAPOL
 774                 wpa_drv_set_supp_port(wpa_s, 1);
 775 #endif /* IEEE8021X_EAPOL */
 776                 wpa_s->after_wps = 0;
 777                 wpa_s->known_wps_freq = 0;
 778                 wpas_p2p_completed(wpa_s);
 779
 780                 sme_sched_obss_scan(wpa_s, 1);
 781         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 782                    state == WPA_ASSOCIATED) {
 783                 wpa_s->new_connection = 1;
 784                 wpa_drv_set_operstate(wpa_s, 0);
 785 #ifndef IEEE8021X_EAPOL
 786                 wpa_drv_set_supp_port(wpa_s, 0);
 787 #endif /* IEEE8021X_EAPOL */
 788                 sme_sched_obss_scan(wpa_s, 0);
 789         }
 790         wpa_s->wpa_state = state;
 791
 792 #ifdef CONFIG_BGSCAN
 793         if (state == WPA_COMPLETED)
 794                 wpa_supplicant_start_bgscan(wpa_s);
 795         else if (state < WPA_ASSOCIATED)
 796                 wpa_supplicant_stop_bgscan(wpa_s);
 797 #endif /* CONFIG_BGSCAN */
 798
 799         if (state == WPA_AUTHENTICATING)
 800                 wpa_supplicant_stop_autoscan(wpa_s);
 801
 802         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 803                 wpa_supplicant_start_autoscan(wpa_s);
 804
 805         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 806                 wmm_ac_notify_disassoc(wpa_s);
 807
 808         if (wpa_s->wpa_state != old_state) {
 809                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 810
 811                 /*
 812                  * Notify the P2P Device interface about a state change in one
 813                  * of the interfaces.
 814                  */
 815                 wpas_p2p_indicate_state_change(wpa_s);
 816
 817                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 818                     old_state == WPA_COMPLETED)
 819                         wpas_notify_auth_changed(wpa_s);
 820         }
 821 }
 822
 823
 824 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 825 {
 826         int pending = 0;
 827 #ifdef CONFIG_WPS
 828         struct wpa_supplicant *wpa_s = global->ifaces;
 829         while (wpa_s) {
 830                 struct wpa_supplicant *next = wpa_s->next;
 831                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 832                         pending = 1;
 833 #ifdef CONFIG_P2P
 834                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 835                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 836                         wpas_p2p_disconnect(wpa_s);
 837 #endif /* CONFIG_P2P */
 838                 wpa_s = next;
 839         }
 840 #endif /* CONFIG_WPS */
 841         if (pending)
 842                 return;
 843         eloop_terminate();
 844 }
 845
 846
 847 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 848 {
 849         struct wpa_global *global = signal_ctx;
 850         wpa_supplicant_terminate_proc(global);
 851 }
 852
 853
 854 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 855 {
 856         enum wpa_states old_state = wpa_s->wpa_state;
 857
 858         wpa_s->pairwise_cipher = 0;
 859         wpa_s->group_cipher = 0;
 860         wpa_s->mgmt_group_cipher = 0;
 861         wpa_s->key_mgmt = 0;
 862         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 863                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 864
 865         if (wpa_s->wpa_state != old_state)
 866                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 867 }
 868
 869
 870 /**
 871  * wpa_supplicant_reload_configuration - Reload configuration data
 872  * @wpa_s: Pointer to wpa_supplicant data
 873  * Returns: 0 on success or -1 if configuration parsing failed
 874  *
 875  * This function can be used to request that the configuration data is reloaded
 876  * (e.g., after configuration file change). This function is reloading
 877  * configuration only for one interface, so this may need to be called multiple
 878  * times if %wpa_supplicant is controlling multiple interfaces and all
 879  * interfaces need reconfiguration.
 880  */
 881 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 882 {
 883         struct wpa_config *conf;
 884         int reconf_ctrl;
 885         int old_ap_scan;
 886
 887         if (wpa_s->confname == NULL)
 888                 return -1;
 889         conf = wpa_config_read(wpa_s->confname, NULL);
 890         if (conf == NULL) {
 891                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 892                         "file '%s' - exiting", wpa_s->confname);
 893                 return -1;
 894         }
 895         wpa_config_read(wpa_s->confanother, conf);
 896
 897         conf->changed_parameters = (unsigned int) -1;
 898
 899         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 900                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 901                     os_strcmp(conf->ctrl_interface,
 902                               wpa_s->conf->ctrl_interface) != 0);
 903
 904         if (reconf_ctrl && wpa_s->ctrl_iface) {
 905                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 906                 wpa_s->ctrl_iface = NULL;
 907         }
 908
 909         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 910         if (wpa_s->current_ssid) {
 911                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 912                         wpa_s->own_disconnect_req = 1;
 913                 wpa_supplicant_deauthenticate(wpa_s,
 914                                               WLAN_REASON_DEAUTH_LEAVING);
 915         }
 916
 917         /*
 918          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 919          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 920          */
 921         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 922                 /*
 923                  * Clear forced success to clear EAP state for next
 924                  * authentication.
 925                  */
 926                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 927         }
 928         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 929         wpa_sm_set_config(wpa_s->wpa, NULL);
 930         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 931         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 932         rsn_preauth_deinit(wpa_s->wpa);
 933
 934         old_ap_scan = wpa_s->conf->ap_scan;
 935         wpa_config_free(wpa_s->conf);
 936         wpa_s->conf = conf;
 937         if (old_ap_scan != wpa_s->conf->ap_scan)
 938                 wpas_notify_ap_scan_changed(wpa_s);
 939
 940         if (reconf_ctrl)
 941                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 942
 943         wpa_supplicant_update_config(wpa_s);
 944
 945         wpa_supplicant_clear_status(wpa_s);
 946         if (wpa_supplicant_enabled_networks(wpa_s)) {
 947                 wpa_s->reassociate = 1;
 948                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 949         }
 950         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 951         return 0;
 952 }
 953
 954
 955 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 956 {
 957         struct wpa_global *global = signal_ctx;
 958         struct wpa_supplicant *wpa_s;
 959         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 960                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 961                         sig);
 962                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 963                         wpa_supplicant_terminate_proc(global);
 964                 }
 965         }
 966 }
 967
 968
 969 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
 970                                          struct wpa_ssid *ssid,
 971                                          struct wpa_ie_data *ie)
 972 {
 973         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
 974         if (ret) {
 975                 if (ret == -2) {
 976                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
 977                                 "from association info");
 978                 }
 979                 return -1;
 980         }
 981
 982         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
 983                 "cipher suites");
 984         if (!(ie->group_cipher & ssid->group_cipher)) {
 985                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
 986                         "cipher 0x%x (mask 0x%x) - reject",
 987                         ie->group_cipher, ssid->group_cipher);
 988                 return -1;
 989         }
 990         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
 991                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
 992                         "cipher 0x%x (mask 0x%x) - reject",
 993                         ie->pairwise_cipher, ssid->pairwise_cipher);
 994                 return -1;
 995         }
 996         if (!(ie->key_mgmt & ssid->key_mgmt)) {
 997                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
 998                         "management 0x%x (mask 0x%x) - reject",
 999                         ie->key_mgmt, ssid->key_mgmt);
1000                 return -1;
1001         }
1002
1003 #ifdef CONFIG_IEEE80211W
1004         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1005             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1006                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1007                         "that does not support management frame protection - "
1008                         "reject");
1009                 return -1;
1010         }
1011 #endif /* CONFIG_IEEE80211W */
1012
1013         return 0;
1014 }
1015
1016
1017 /**
1018  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1019  * @wpa_s: Pointer to wpa_supplicant data
1020  * @bss: Scan results for the selected BSS, or %NULL if not available
1021  * @ssid: Configuration data for the selected network
1022  * @wpa_ie: Buffer for the WPA/RSN IE
1023  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1024  * used buffer length in case the functions returns success.
1025  * Returns: 0 on success or -1 on failure
1026  *
1027  * This function is used to configure authentication and encryption parameters
1028  * based on the network configuration and scan result for the selected BSS (if
1029  * available).
1030  */
1031 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1032                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1033                               u8 *wpa_ie, size_t *wpa_ie_len)
1034 {
1035         struct wpa_ie_data ie;
1036         int sel, proto;
1037         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1038
1039         if (bss) {
1040                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1041                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1042                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1043         } else
1044                 bss_wpa = bss_rsn = bss_osen = NULL;
1045
1046         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1047             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1048             (ie.group_cipher & ssid->group_cipher) &&
1049             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1050             (ie.key_mgmt & ssid->key_mgmt)) {
1051                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1052                 proto = WPA_PROTO_RSN;
1053         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1054                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1055                    (ie.group_cipher & ssid->group_cipher) &&
1056                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1057                    (ie.key_mgmt & ssid->key_mgmt)) {
1058                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1059                 proto = WPA_PROTO_WPA;
1060 #ifdef CONFIG_HS20
1061         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1062                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1063                 /* TODO: parse OSEN element */
1064                 os_memset(&ie, 0, sizeof(ie));
1065                 ie.group_cipher = WPA_CIPHER_CCMP;
1066                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1067                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1068                 proto = WPA_PROTO_OSEN;
1069 #endif /* CONFIG_HS20 */
1070         } else if (bss) {
1071                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1072                 wpa_dbg(wpa_s, MSG_DEBUG,
1073                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1074                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1075                         ssid->key_mgmt);
1076                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1077                         MAC2STR(bss->bssid),
1078                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1079                         bss_wpa ? " WPA" : "",
1080                         bss_rsn ? " RSN" : "",
1081                         bss_osen ? " OSEN" : "");
1082                 if (bss_rsn) {
1083                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1084                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1085                                 wpa_dbg(wpa_s, MSG_DEBUG,
1086                                         "Could not parse RSN element");
1087                         } else {
1088                                 wpa_dbg(wpa_s, MSG_DEBUG,
1089                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1090                                         ie.pairwise_cipher, ie.group_cipher,
1091                                         ie.key_mgmt);
1092                         }
1093                 }
1094                 if (bss_wpa) {
1095                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1096                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1097                                 wpa_dbg(wpa_s, MSG_DEBUG,
1098                                         "Could not parse WPA element");
1099                         } else {
1100                                 wpa_dbg(wpa_s, MSG_DEBUG,
1101                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1102                                         ie.pairwise_cipher, ie.group_cipher,
1103                                         ie.key_mgmt);
1104                         }
1105                 }
1106                 return -1;
1107         } else {
1108                 if (ssid->proto & WPA_PROTO_OSEN)
1109                         proto = WPA_PROTO_OSEN;
1110                 else if (ssid->proto & WPA_PROTO_RSN)
1111                         proto = WPA_PROTO_RSN;
1112                 else
1113                         proto = WPA_PROTO_WPA;
1114                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1115                         os_memset(&ie, 0, sizeof(ie));
1116                         ie.group_cipher = ssid->group_cipher;
1117                         ie.pairwise_cipher = ssid->pairwise_cipher;
1118                         ie.key_mgmt = ssid->key_mgmt;
1119 #ifdef CONFIG_IEEE80211W
1120                         ie.mgmt_group_cipher =
1121                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1122                                 WPA_CIPHER_AES_128_CMAC : 0;
1123 #endif /* CONFIG_IEEE80211W */
1124                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1125                                 "based on configuration");
1126                 } else
1127                         proto = ie.proto;
1128         }
1129
1130         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1131                 "pairwise %d key_mgmt %d proto %d",
1132                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1133 #ifdef CONFIG_IEEE80211W
1134         if (ssid->ieee80211w) {
1135                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1136                         ie.mgmt_group_cipher);
1137         }
1138 #endif /* CONFIG_IEEE80211W */
1139
1140         wpa_s->wpa_proto = proto;
1141         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1142         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1143                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1144
1145         if (bss || !wpa_s->ap_ies_from_associnfo) {
1146                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1147                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1148                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1149                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1150                         return -1;
1151         }
1152
1153         sel = ie.group_cipher & ssid->group_cipher;
1154         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1155         if (wpa_s->group_cipher < 0) {
1156                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1157                         "cipher");
1158                 return -1;
1159         }
1160         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1161                 wpa_cipher_txt(wpa_s->group_cipher));
1162
1163         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1164         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1165         if (wpa_s->pairwise_cipher < 0) {
1166                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1167                         "cipher");
1168                 return -1;
1169         }
1170         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1171                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1172
1173         sel = ie.key_mgmt & ssid->key_mgmt;
1174 #ifdef CONFIG_SAE
1175         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1176                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1177 #endif /* CONFIG_SAE */
1178         if (0) {
1179 #ifdef CONFIG_SUITEB192
1180         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1181                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1182                 wpa_dbg(wpa_s, MSG_DEBUG,
1183                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1184 #endif /* CONFIG_SUITEB192 */
1185 #ifdef CONFIG_SUITEB
1186         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1187                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1188                 wpa_dbg(wpa_s, MSG_DEBUG,
1189                         "WPA: using KEY_MGMT 802.1X with Suite B");
1190 #endif /* CONFIG_SUITEB */
1191 #ifdef CONFIG_IEEE80211R
1192         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1193                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1194                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1195         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1196                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1197                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1198 #endif /* CONFIG_IEEE80211R */
1199 #ifdef CONFIG_SAE
1200         } else if (sel & WPA_KEY_MGMT_SAE) {
1201                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1202                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1203         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1204                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1205                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1206 #endif /* CONFIG_SAE */
1207 #ifdef CONFIG_IEEE80211W
1208         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1209                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1210                 wpa_dbg(wpa_s, MSG_DEBUG,
1211                         "WPA: using KEY_MGMT 802.1X with SHA256");
1212         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1213                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1214                 wpa_dbg(wpa_s, MSG_DEBUG,
1215                         "WPA: using KEY_MGMT PSK with SHA256");
1216 #endif /* CONFIG_IEEE80211W */
1217         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1218                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1219                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1220         } else if (sel & WPA_KEY_MGMT_PSK) {
1221                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1222                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1223         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1224                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1225                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1226 #ifdef CONFIG_HS20
1227         } else if (sel & WPA_KEY_MGMT_OSEN) {
1228                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1229                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1230 #endif /* CONFIG_HS20 */
1231         } else {
1232                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1233                         "authenticated key management type");
1234                 return -1;
1235         }
1236
1237         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1238         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1239                          wpa_s->pairwise_cipher);
1240         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1241
1242 #ifdef CONFIG_IEEE80211W
1243         sel = ie.mgmt_group_cipher;
1244         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1245             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1246                 sel = 0;
1247         if (sel & WPA_CIPHER_AES_128_CMAC) {
1248                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1249                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1250                         "AES-128-CMAC");
1251         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1252                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1253                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1254                         "BIP-GMAC-128");
1255         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1256                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1257                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1258                         "BIP-GMAC-256");
1259         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1260                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1261                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1262                         "BIP-CMAC-256");
1263         } else {
1264                 wpa_s->mgmt_group_cipher = 0;
1265                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1266         }
1267         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1268                          wpa_s->mgmt_group_cipher);
1269         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1270                          wpas_get_ssid_pmf(wpa_s, ssid));
1271 #endif /* CONFIG_IEEE80211W */
1272
1273         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1274                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1275                 return -1;
1276         }
1277
1278         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1279                 int psk_set = 0;
1280
1281                 if (ssid->psk_set) {
1282                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL);
1283                         psk_set = 1;
1284                 }
1285 #ifndef CONFIG_NO_PBKDF2
1286                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1287                     ssid->passphrase) {
1288                         u8 psk[PMK_LEN];
1289                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1290                                     4096, psk, PMK_LEN);
1291                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1292                                         psk, PMK_LEN);
1293                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1294                         psk_set = 1;
1295                         os_memset(psk, 0, sizeof(psk));
1296                 }
1297 #endif /* CONFIG_NO_PBKDF2 */
1298 #ifdef CONFIG_EXT_PASSWORD
1299                 if (ssid->ext_psk) {
1300                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1301                                                              ssid->ext_psk);
1302                         char pw_str[64 + 1];
1303                         u8 psk[PMK_LEN];
1304
1305                         if (pw == NULL) {
1306                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1307                                         "found from external storage");
1308                                 return -1;
1309                         }
1310
1311                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1312                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1313                                         "PSK length %d in external storage",
1314                                         (int) wpabuf_len(pw));
1315                                 ext_password_free(pw);
1316                                 return -1;
1317                         }
1318
1319                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1320                         pw_str[wpabuf_len(pw)] = '\0';
1321
1322 #ifndef CONFIG_NO_PBKDF2
1323                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1324                         {
1325                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1326                                             4096, psk, PMK_LEN);
1327                                 os_memset(pw_str, 0, sizeof(pw_str));
1328                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1329                                                 "external passphrase)",
1330                                                 psk, PMK_LEN);
1331                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1332                                 psk_set = 1;
1333                                 os_memset(psk, 0, sizeof(psk));
1334                         } else
1335 #endif /* CONFIG_NO_PBKDF2 */
1336                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1337                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1338                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1339                                                 "Invalid PSK hex string");
1340                                         os_memset(pw_str, 0, sizeof(pw_str));
1341                                         ext_password_free(pw);
1342                                         return -1;
1343                                 }
1344                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL);
1345                                 psk_set = 1;
1346                                 os_memset(psk, 0, sizeof(psk));
1347                         } else {
1348                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1349                                         "PSK available");
1350                                 os_memset(pw_str, 0, sizeof(pw_str));
1351                                 ext_password_free(pw);
1352                                 return -1;
1353                         }
1354
1355                         os_memset(pw_str, 0, sizeof(pw_str));
1356                         ext_password_free(pw);
1357                 }
1358 #endif /* CONFIG_EXT_PASSWORD */
1359
1360                 if (!psk_set) {
1361                         wpa_msg(wpa_s, MSG_INFO,
1362                                 "No PSK available for association");
1363                         return -1;
1364                 }
1365         } else
1366                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1367
1368         return 0;
1369 }
1370
1371
1372 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1373 {
1374         *pos = 0x00;
1375
1376         switch (idx) {
1377         case 0: /* Bits 0-7 */
1378                 break;
1379         case 1: /* Bits 8-15 */
1380                 break;
1381         case 2: /* Bits 16-23 */
1382 #ifdef CONFIG_WNM
1383                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1384                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1385 #endif /* CONFIG_WNM */
1386                 break;
1387         case 3: /* Bits 24-31 */
1388 #ifdef CONFIG_WNM
1389                 *pos |= 0x02; /* Bit 25 - SSID List */
1390 #endif /* CONFIG_WNM */
1391 #ifdef CONFIG_INTERWORKING
1392                 if (wpa_s->conf->interworking)
1393                         *pos |= 0x80; /* Bit 31 - Interworking */
1394 #endif /* CONFIG_INTERWORKING */
1395                 break;
1396         case 4: /* Bits 32-39 */
1397 #ifdef CONFIG_INTERWORKING
1398                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1399                         *pos |= 0x01; /* Bit 32 - QoS Map */
1400 #endif /* CONFIG_INTERWORKING */
1401                 break;
1402         case 5: /* Bits 40-47 */
1403 #ifdef CONFIG_HS20
1404                 if (wpa_s->conf->hs20)
1405                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1406 #endif /* CONFIG_HS20 */
1407                 break;
1408         case 6: /* Bits 48-55 */
1409                 break;
1410         }
1411 }
1412
1413
1414 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1415 {
1416         u8 *pos = buf;
1417         u8 len = 6, i;
1418
1419         if (len < wpa_s->extended_capa_len)
1420                 len = wpa_s->extended_capa_len;
1421         if (buflen < (size_t) len + 2) {
1422                 wpa_printf(MSG_INFO,
1423                            "Not enough room for building extended capabilities element");
1424                 return -1;
1425         }
1426
1427         *pos++ = WLAN_EID_EXT_CAPAB;
1428         *pos++ = len;
1429         for (i = 0; i < len; i++, pos++) {
1430                 wpas_ext_capab_byte(wpa_s, pos, i);
1431
1432                 if (i < wpa_s->extended_capa_len) {
1433                         *pos &= ~wpa_s->extended_capa_mask[i];
1434                         *pos |= wpa_s->extended_capa[i];
1435                 }
1436         }
1437
1438         while (len > 0 && buf[1 + len] == 0) {
1439                 len--;
1440                 buf[1] = len;
1441         }
1442         if (len == 0)
1443                 return 0;
1444
1445         return 2 + len;
1446 }
1447
1448
1449 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1450                           struct wpa_bss *test_bss)
1451 {
1452         struct wpa_bss *bss;
1453
1454         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1455                 if (bss == test_bss)
1456                         return 1;
1457         }
1458
1459         return 0;
1460 }
1461
1462
1463 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1464                            struct wpa_ssid *test_ssid)
1465 {
1466         struct wpa_ssid *ssid;
1467
1468         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1469                 if (ssid == test_ssid)
1470                         return 1;
1471         }
1472
1473         return 0;
1474 }
1475
1476
1477 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1478                         struct wpa_ssid *test_ssid)
1479 {
1480         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1481                 return 0;
1482
1483         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1484 }
1485
1486
1487 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1488 {
1489         if (cwork == NULL)
1490                 return;
1491         os_free(cwork);
1492 }
1493
1494
1495 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1496 {
1497         struct wpa_connect_work *cwork;
1498         struct wpa_radio_work *work = wpa_s->connect_work;
1499
1500         if (!work)
1501                 return;
1502
1503         wpa_s->connect_work = NULL;
1504         cwork = work->ctx;
1505         work->ctx = NULL;
1506         wpas_connect_work_free(cwork);
1507         radio_work_done(work);
1508 }
1509
1510
1511 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1512 {
1513         struct os_reltime now;
1514         u8 addr[ETH_ALEN];
1515
1516         os_get_reltime(&now);
1517         if (wpa_s->last_mac_addr_style == style &&
1518             wpa_s->last_mac_addr_change.sec != 0 &&
1519             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1520                                 wpa_s->conf->rand_addr_lifetime)) {
1521                 wpa_msg(wpa_s, MSG_DEBUG,
1522                         "Previously selected random MAC address has not yet expired");
1523                 return 0;
1524         }
1525
1526         switch (style) {
1527         case 1:
1528                 if (random_mac_addr(addr) < 0)
1529                         return -1;
1530                 break;
1531         case 2:
1532                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1533                 if (random_mac_addr_keep_oui(addr) < 0)
1534                         return -1;
1535                 break;
1536         default:
1537                 return -1;
1538         }
1539
1540         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1541                 wpa_msg(wpa_s, MSG_INFO,
1542                         "Failed to set random MAC address");
1543                 return -1;
1544         }
1545
1546         os_get_reltime(&wpa_s->last_mac_addr_change);
1547         wpa_s->mac_addr_changed = 1;
1548         wpa_s->last_mac_addr_style = style;
1549
1550         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1551                 wpa_msg(wpa_s, MSG_INFO,
1552                         "Could not update MAC address information");
1553                 return -1;
1554         }
1555
1556         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1557                 MAC2STR(addr));
1558
1559         return 0;
1560 }
1561
1562
1563 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1564 {
1565         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1566             !wpa_s->conf->preassoc_mac_addr)
1567                 return 0;
1568
1569         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1570 }
1571
1572
1573 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1574
1575 /**
1576  * wpa_supplicant_associate - Request association
1577  * @wpa_s: Pointer to wpa_supplicant data
1578  * @bss: Scan results for the selected BSS, or %NULL if not available
1579  * @ssid: Configuration data for the selected network
1580  *
1581  * This function is used to request %wpa_supplicant to associate with a BSS.
1582  */
1583 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1584                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1585 {
1586         struct wpa_connect_work *cwork;
1587         int rand_style;
1588
1589         wpa_s->own_disconnect_req = 0;
1590
1591         if (ssid->mac_addr == -1)
1592                 rand_style = wpa_s->conf->mac_addr;
1593         else
1594                 rand_style = ssid->mac_addr;
1595
1596         wmm_ac_clear_saved_tspecs(wpa_s);
1597         wpa_s->reassoc_same_bss = 0;
1598
1599         if (wpa_s->last_ssid == ssid) {
1600                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1601                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1602                         wmm_ac_save_tspecs(wpa_s);
1603                         wpa_s->reassoc_same_bss = 1;
1604                 }
1605         } else if (rand_style > 0) {
1606                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1607                         return;
1608                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1609         } else if (wpa_s->mac_addr_changed) {
1610                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1611                         wpa_msg(wpa_s, MSG_INFO,
1612                                 "Could not restore permanent MAC address");
1613                         return;
1614                 }
1615                 wpa_s->mac_addr_changed = 0;
1616                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1617                         wpa_msg(wpa_s, MSG_INFO,
1618                                 "Could not update MAC address information");
1619                         return;
1620                 }
1621                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1622         }
1623         wpa_s->last_ssid = ssid;
1624
1625 #ifdef CONFIG_IBSS_RSN
1626         ibss_rsn_deinit(wpa_s->ibss_rsn);
1627         wpa_s->ibss_rsn = NULL;
1628 #endif /* CONFIG_IBSS_RSN */
1629
1630         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1631             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1632 #ifdef CONFIG_AP
1633                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1634                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1635                                 "mode");
1636                         return;
1637                 }
1638                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1639                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1640                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1641                                 wpas_p2p_ap_setup_failed(wpa_s);
1642                         return;
1643                 }
1644                 wpa_s->current_bss = bss;
1645 #else /* CONFIG_AP */
1646                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1647                         "the build");
1648 #endif /* CONFIG_AP */
1649                 return;
1650         }
1651
1652         if (ssid->mode == WPAS_MODE_MESH) {
1653 #ifdef CONFIG_MESH
1654                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1655                         wpa_msg(wpa_s, MSG_INFO,
1656                                 "Driver does not support mesh mode");
1657                         return;
1658                 }
1659                 if (bss)
1660                         ssid->frequency = bss->freq;
1661                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1662                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1663                         return;
1664                 }
1665                 wpa_s->current_bss = bss;
1666                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_STARTED
1667                              "ssid=\"%s\" id=%d",
1668                              wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1669                              ssid->id);
1670 #else /* CONFIG_MESH */
1671                 wpa_msg(wpa_s, MSG_ERROR,
1672                         "mesh mode support not included in the build");
1673 #endif /* CONFIG_MESH */
1674                 return;
1675         }
1676
1677 #ifdef CONFIG_TDLS
1678         if (bss)
1679                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1680                                 bss->ie_len);
1681 #endif /* CONFIG_TDLS */
1682
1683         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1684             ssid->mode == IEEE80211_MODE_INFRA) {
1685                 sme_authenticate(wpa_s, bss, ssid);
1686                 return;
1687         }
1688
1689         if (wpa_s->connect_work) {
1690                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1691                 return;
1692         }
1693
1694         if (radio_work_pending(wpa_s, "connect")) {
1695                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1696                 return;
1697         }
1698
1699         cwork = os_zalloc(sizeof(*cwork));
1700         if (cwork == NULL)
1701                 return;
1702
1703         cwork->bss = bss;
1704         cwork->ssid = ssid;
1705
1706         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1707                            wpas_start_assoc_cb, cwork) < 0) {
1708                 os_free(cwork);
1709         }
1710 }
1711
1712
1713 static int bss_is_ibss(struct wpa_bss *bss)
1714 {
1715         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1716                 IEEE80211_CAP_IBSS;
1717 }
1718
1719
1720 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1721                           const struct wpa_ssid *ssid,
1722                           struct hostapd_freq_params *freq)
1723 {
1724         enum hostapd_hw_mode hw_mode;
1725         struct hostapd_hw_modes *mode = NULL;
1726         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1727                            184, 192 };
1728         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1729         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1730         u8 channel;
1731         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1732         unsigned int j;
1733         struct hostapd_freq_params vht_freq;
1734
1735         freq->freq = ssid->frequency;
1736
1737         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1738                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1739
1740                 if (ssid->mode != WPAS_MODE_IBSS)
1741                         break;
1742
1743                 /* Don't adjust control freq in case of fixed_freq */
1744                 if (ssid->fixed_freq)
1745                         break;
1746
1747                 if (!bss_is_ibss(bss))
1748                         continue;
1749
1750                 if (ssid->ssid_len == bss->ssid_len &&
1751                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1752                         wpa_printf(MSG_DEBUG,
1753                                    "IBSS already found in scan results, adjust control freq: %d",
1754                                    bss->freq);
1755                         freq->freq = bss->freq;
1756                         obss_scan = 0;
1757                         break;
1758                 }
1759         }
1760
1761         /* For IBSS check HT_IBSS flag */
1762         if (ssid->mode == WPAS_MODE_IBSS &&
1763             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1764                 return;
1765
1766         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1767             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1768             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1769                 wpa_printf(MSG_DEBUG,
1770                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1771                 return;
1772         }
1773
1774         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1775         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1776                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1777                         mode = &wpa_s->hw.modes[i];
1778                         break;
1779                 }
1780         }
1781
1782         if (!mode)
1783                 return;
1784
1785         freq->ht_enabled = ht_supported(mode);
1786         if (!freq->ht_enabled)
1787                 return;
1788
1789         /* Setup higher BW only for 5 GHz */
1790         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1791                 return;
1792
1793         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1794                 pri_chan = &mode->channels[chan_idx];
1795                 if (pri_chan->chan == channel)
1796                         break;
1797                 pri_chan = NULL;
1798         }
1799         if (!pri_chan)
1800                 return;
1801
1802         /* Check primary channel flags */
1803         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1804                 return;
1805
1806         /* Check/setup HT40+/HT40- */
1807         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1808                 if (ht40plus[j] == channel) {
1809                         ht40 = 1;
1810                         break;
1811                 }
1812         }
1813
1814         /* Find secondary channel */
1815         for (i = 0; i < mode->num_channels; i++) {
1816                 sec_chan = &mode->channels[i];
1817                 if (sec_chan->chan == channel + ht40 * 4)
1818                         break;
1819                 sec_chan = NULL;
1820         }
1821         if (!sec_chan)
1822                 return;
1823
1824         /* Check secondary channel flags */
1825         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1826                 return;
1827
1828         freq->channel = pri_chan->chan;
1829
1830         switch (ht40) {
1831         case -1:
1832                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1833                         return;
1834                 freq->sec_channel_offset = -1;
1835                 break;
1836         case 1:
1837                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1838                         return;
1839                 freq->sec_channel_offset = 1;
1840                 break;
1841         default:
1842                 break;
1843         }
1844
1845         if (freq->sec_channel_offset && obss_scan) {
1846                 struct wpa_scan_results *scan_res;
1847
1848                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1849                 if (scan_res == NULL) {
1850                         /* Back to HT20 */
1851                         freq->sec_channel_offset = 0;
1852                         return;
1853                 }
1854
1855                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1856                                      sec_chan->chan);
1857                 switch (res) {
1858                 case 0:
1859                         /* Back to HT20 */
1860                         freq->sec_channel_offset = 0;
1861                         break;
1862                 case 1:
1863                         /* Configuration allowed */
1864                         break;
1865                 case 2:
1866                         /* Switch pri/sec channels */
1867                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1868                         freq->sec_channel_offset = -freq->sec_channel_offset;
1869                         freq->channel = sec_chan->chan;
1870                         break;
1871                 default:
1872                         freq->sec_channel_offset = 0;
1873                         break;
1874                 }
1875
1876                 wpa_scan_results_free(scan_res);
1877         }
1878
1879         wpa_printf(MSG_DEBUG,
1880                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1881                    freq->channel, freq->sec_channel_offset);
1882
1883         /* Not sure if mesh is ready for VHT */
1884         if (ssid->mode != WPAS_MODE_IBSS)
1885                 return;
1886
1887         /* For IBSS check VHT_IBSS flag */
1888         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1889                 return;
1890
1891         vht_freq = *freq;
1892
1893         vht_freq.vht_enabled = vht_supported(mode);
1894         if (!vht_freq.vht_enabled)
1895                 return;
1896
1897         /* setup center_freq1, bandwidth */
1898         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1899                 if (freq->channel >= vht80[j] &&
1900                     freq->channel < vht80[j] + 16)
1901                         break;
1902         }
1903
1904         if (j == ARRAY_SIZE(vht80))
1905                 return;
1906
1907         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1908                 struct hostapd_channel_data *chan;
1909
1910                 chan = hw_get_channel_chan(mode, i, NULL);
1911                 if (!chan)
1912                         return;
1913
1914                 /* Back to HT configuration if channel not usable */
1915                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1916                         return;
1917         }
1918
1919         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
1920                                     freq->channel, freq->ht_enabled,
1921                                     vht_freq.vht_enabled,
1922                                     freq->sec_channel_offset,
1923                                     VHT_CHANWIDTH_80MHZ,
1924                                     vht80[j] + 6, 0, 0) != 0)
1925                 return;
1926
1927         *freq = vht_freq;
1928
1929         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
1930                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
1931 }
1932
1933
1934 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
1935 {
1936         struct wpa_connect_work *cwork = work->ctx;
1937         struct wpa_bss *bss = cwork->bss;
1938         struct wpa_ssid *ssid = cwork->ssid;
1939         struct wpa_supplicant *wpa_s = work->wpa_s;
1940         u8 wpa_ie[200];
1941         size_t wpa_ie_len;
1942         int use_crypt, ret, i, bssid_changed;
1943         int algs = WPA_AUTH_ALG_OPEN;
1944         unsigned int cipher_pairwise, cipher_group;
1945         struct wpa_driver_associate_params params;
1946         int wep_keys_set = 0;
1947         int assoc_failed = 0;
1948         struct wpa_ssid *old_ssid;
1949 #ifdef CONFIG_HT_OVERRIDES
1950         struct ieee80211_ht_capabilities htcaps;
1951         struct ieee80211_ht_capabilities htcaps_mask;
1952 #endif /* CONFIG_HT_OVERRIDES */
1953 #ifdef CONFIG_VHT_OVERRIDES
1954        struct ieee80211_vht_capabilities vhtcaps;
1955        struct ieee80211_vht_capabilities vhtcaps_mask;
1956 #endif /* CONFIG_VHT_OVERRIDES */
1957
1958         if (deinit) {
1959                 if (work->started) {
1960                         wpa_s->connect_work = NULL;
1961
1962                         /* cancel possible auth. timeout */
1963                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
1964                                              NULL);
1965                 }
1966                 wpas_connect_work_free(cwork);
1967                 return;
1968         }
1969
1970         wpa_s->connect_work = work;
1971
1972         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
1973             wpas_network_disabled(wpa_s, ssid)) {
1974                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
1975                 wpas_connect_work_done(wpa_s);
1976                 return;
1977         }
1978
1979         os_memset(&params, 0, sizeof(params));
1980         wpa_s->reassociate = 0;
1981         wpa_s->eap_expected_failure = 0;
1982         if (bss &&
1983             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
1984 #ifdef CONFIG_IEEE80211R
1985                 const u8 *ie, *md = NULL;
1986 #endif /* CONFIG_IEEE80211R */
1987                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
1988                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
1989                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
1990                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
1991                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
1992                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
1993                 if (bssid_changed)
1994                         wpas_notify_bssid_changed(wpa_s);
1995 #ifdef CONFIG_IEEE80211R
1996                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
1997                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
1998                         md = ie + 2;
1999                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2000                 if (md) {
2001                         /* Prepare for the next transition */
2002                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2003                 }
2004 #endif /* CONFIG_IEEE80211R */
2005 #ifdef CONFIG_WPS
2006         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2007                    wpa_s->conf->ap_scan == 2 &&
2008                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2009                 /* Use ap_scan==1 style network selection to find the network
2010                  */
2011                 wpas_connect_work_done(wpa_s);
2012                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2013                 wpa_s->reassociate = 1;
2014                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2015                 return;
2016 #endif /* CONFIG_WPS */
2017         } else {
2018                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2019                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2020                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2021         }
2022         if (!wpa_s->pno)
2023                 wpa_supplicant_cancel_sched_scan(wpa_s);
2024
2025         wpa_supplicant_cancel_scan(wpa_s);
2026
2027         /* Starting new association, so clear the possibly used WPA IE from the
2028          * previous association. */
2029         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2030
2031 #ifdef IEEE8021X_EAPOL
2032         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2033                 if (ssid->leap) {
2034                         if (ssid->non_leap == 0)
2035                                 algs = WPA_AUTH_ALG_LEAP;
2036                         else
2037                                 algs |= WPA_AUTH_ALG_LEAP;
2038                 }
2039         }
2040 #endif /* IEEE8021X_EAPOL */
2041         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2042         if (ssid->auth_alg) {
2043                 algs = ssid->auth_alg;
2044                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2045                         "0x%x", algs);
2046         }
2047
2048         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2049                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2050             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2051                 int try_opportunistic;
2052                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2053                                      wpa_s->conf->okc :
2054                                      ssid->proactive_key_caching) &&
2055                         (ssid->proto & WPA_PROTO_RSN);
2056                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2057                                             ssid, try_opportunistic) == 0)
2058                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2059                 wpa_ie_len = sizeof(wpa_ie);
2060                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2061                                               wpa_ie, &wpa_ie_len)) {
2062                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2063                                 "key management and encryption suites");
2064                         wpas_connect_work_done(wpa_s);
2065                         return;
2066                 }
2067         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2068                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2069                 /*
2070                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2071                  * use non-WPA since the scan results did not indicate that the
2072                  * AP is using WPA or WPA2.
2073                  */
2074                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2075                 wpa_ie_len = 0;
2076                 wpa_s->wpa_proto = 0;
2077         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2078                 wpa_ie_len = sizeof(wpa_ie);
2079                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2080                                               wpa_ie, &wpa_ie_len)) {
2081                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2082                                 "key management and encryption suites (no "
2083                                 "scan results)");
2084                         wpas_connect_work_done(wpa_s);
2085                         return;
2086                 }
2087 #ifdef CONFIG_WPS
2088         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2089                 struct wpabuf *wps_ie;
2090                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2091                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2092                         wpa_ie_len = wpabuf_len(wps_ie);
2093                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2094                 } else
2095                         wpa_ie_len = 0;
2096                 wpabuf_free(wps_ie);
2097                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2098                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2099                         params.wps = WPS_MODE_PRIVACY;
2100                 else
2101                         params.wps = WPS_MODE_OPEN;
2102                 wpa_s->wpa_proto = 0;
2103 #endif /* CONFIG_WPS */
2104         } else {
2105                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2106                 wpa_ie_len = 0;
2107                 wpa_s->wpa_proto = 0;
2108         }
2109
2110 #ifdef CONFIG_P2P
2111         if (wpa_s->global->p2p) {
2112                 u8 *pos;
2113                 size_t len;
2114                 int res;
2115                 pos = wpa_ie + wpa_ie_len;
2116                 len = sizeof(wpa_ie) - wpa_ie_len;
2117                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2118                                             ssid->p2p_group);
2119                 if (res >= 0)
2120                         wpa_ie_len += res;
2121         }
2122
2123         wpa_s->cross_connect_disallowed = 0;
2124         if (bss) {
2125                 struct wpabuf *p2p;
2126                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2127                 if (p2p) {
2128                         wpa_s->cross_connect_disallowed =
2129                                 p2p_get_cross_connect_disallowed(p2p);
2130                         wpabuf_free(p2p);
2131                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2132                                 "connection",
2133                                 wpa_s->cross_connect_disallowed ?
2134                                 "disallows" : "allows");
2135                 }
2136         }
2137
2138         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2139 #endif /* CONFIG_P2P */
2140
2141 #ifdef CONFIG_HS20
2142         if (is_hs20_network(wpa_s, ssid, bss)) {
2143                 struct wpabuf *hs20;
2144                 hs20 = wpabuf_alloc(20);
2145                 if (hs20) {
2146                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2147                         size_t len;
2148
2149                         wpas_hs20_add_indication(hs20, pps_mo_id);
2150                         len = sizeof(wpa_ie) - wpa_ie_len;
2151                         if (wpabuf_len(hs20) <= len) {
2152                                 os_memcpy(wpa_ie + wpa_ie_len,
2153                                           wpabuf_head(hs20), wpabuf_len(hs20));
2154                                 wpa_ie_len += wpabuf_len(hs20);
2155                         }
2156                         wpabuf_free(hs20);
2157                 }
2158         }
2159 #endif /* CONFIG_HS20 */
2160
2161         /*
2162          * Workaround: Add Extended Capabilities element only if the AP
2163          * included this element in Beacon/Probe Response frames. Some older
2164          * APs seem to have interoperability issues if this element is
2165          * included, so while the standard may require us to include the
2166          * element in all cases, it is justifiable to skip it to avoid
2167          * interoperability issues.
2168          */
2169         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2170                 u8 ext_capab[18];
2171                 int ext_capab_len;
2172                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2173                                                      sizeof(ext_capab));
2174                 if (ext_capab_len > 0) {
2175                         u8 *pos = wpa_ie;
2176                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2177                                 pos += 2 + pos[1];
2178                         os_memmove(pos + ext_capab_len, pos,
2179                                    wpa_ie_len - (pos - wpa_ie));
2180                         wpa_ie_len += ext_capab_len;
2181                         os_memcpy(pos, ext_capab, ext_capab_len);
2182                 }
2183         }
2184
2185         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2186                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2187                 size_t len;
2188
2189                 len = sizeof(wpa_ie) - wpa_ie_len;
2190                 if (wpabuf_len(buf) <= len) {
2191                         os_memcpy(wpa_ie + wpa_ie_len,
2192                                   wpabuf_head(buf), wpabuf_len(buf));
2193                         wpa_ie_len += wpabuf_len(buf);
2194                 }
2195         }
2196
2197 #ifdef CONFIG_FST
2198         if (wpa_s->fst_ies) {
2199                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2200
2201                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2202                         os_memcpy(wpa_ie + wpa_ie_len,
2203                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2204                         wpa_ie_len += fst_ies_len;
2205                 }
2206         }
2207 #endif /* CONFIG_FST */
2208
2209         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2210         use_crypt = 1;
2211         cipher_pairwise = wpa_s->pairwise_cipher;
2212         cipher_group = wpa_s->group_cipher;
2213         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2214             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2215                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2216                         use_crypt = 0;
2217                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2218                         use_crypt = 1;
2219                         wep_keys_set = 1;
2220                 }
2221         }
2222         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2223                 use_crypt = 0;
2224
2225 #ifdef IEEE8021X_EAPOL
2226         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2227                 if ((ssid->eapol_flags &
2228                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2229                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2230                     !wep_keys_set) {
2231                         use_crypt = 0;
2232                 } else {
2233                         /* Assume that dynamic WEP-104 keys will be used and
2234                          * set cipher suites in order for drivers to expect
2235                          * encryption. */
2236                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2237                 }
2238         }
2239 #endif /* IEEE8021X_EAPOL */
2240
2241         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2242                 /* Set the key before (and later after) association */
2243                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2244         }
2245
2246         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2247         if (bss) {
2248                 params.ssid = bss->ssid;
2249                 params.ssid_len = bss->ssid_len;
2250                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2251                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2252                                    MACSTR " freq=%u MHz based on scan results "
2253                                    "(bssid_set=%d)",
2254                                    MAC2STR(bss->bssid), bss->freq,
2255                                    ssid->bssid_set);
2256                         params.bssid = bss->bssid;
2257                         params.freq.freq = bss->freq;
2258                 }
2259                 params.bssid_hint = bss->bssid;
2260                 params.freq_hint = bss->freq;
2261         } else {
2262                 params.ssid = ssid->ssid;
2263                 params.ssid_len = ssid->ssid_len;
2264         }
2265
2266         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2267             wpa_s->conf->ap_scan == 2) {
2268                 params.bssid = ssid->bssid;
2269                 params.fixed_bssid = 1;
2270         }
2271
2272         /* Initial frequency for IBSS/mesh */
2273         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2274             ssid->frequency > 0 && params.freq.freq == 0)
2275                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2276
2277         if (ssid->mode == WPAS_MODE_IBSS) {
2278                 params.fixed_freq = ssid->fixed_freq;
2279                 if (ssid->beacon_int)
2280                         params.beacon_int = ssid->beacon_int;
2281                 else
2282                         params.beacon_int = wpa_s->conf->beacon_int;
2283         }
2284
2285         params.wpa_ie = wpa_ie;
2286         params.wpa_ie_len = wpa_ie_len;
2287         params.pairwise_suite = cipher_pairwise;
2288         params.group_suite = cipher_group;
2289         params.key_mgmt_suite = wpa_s->key_mgmt;
2290         params.wpa_proto = wpa_s->wpa_proto;
2291         params.auth_alg = algs;
2292         params.mode = ssid->mode;
2293         params.bg_scan_period = ssid->bg_scan_period;
2294         for (i = 0; i < NUM_WEP_KEYS; i++) {
2295                 if (ssid->wep_key_len[i])
2296                         params.wep_key[i] = ssid->wep_key[i];
2297                 params.wep_key_len[i] = ssid->wep_key_len[i];
2298         }
2299         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2300
2301         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2302             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2303              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2304                 params.passphrase = ssid->passphrase;
2305                 if (ssid->psk_set)
2306                         params.psk = ssid->psk;
2307         }
2308
2309         if (wpa_s->conf->key_mgmt_offload) {
2310                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2311                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2312                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2313                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2314                         params.req_key_mgmt_offload =
2315                                 ssid->proactive_key_caching < 0 ?
2316                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2317                 else
2318                         params.req_key_mgmt_offload = 1;
2319
2320                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2321                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2322                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2323                     ssid->psk_set)
2324                         params.psk = ssid->psk;
2325         }
2326
2327         params.drop_unencrypted = use_crypt;
2328
2329 #ifdef CONFIG_IEEE80211W
2330         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2331         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2332                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2333                 struct wpa_ie_data ie;
2334                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2335                     ie.capabilities &
2336                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2337                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2338                                 "MFP: require MFP");
2339                         params.mgmt_frame_protection =
2340                                 MGMT_FRAME_PROTECTION_REQUIRED;
2341                 }
2342         }
2343 #endif /* CONFIG_IEEE80211W */
2344
2345         params.p2p = ssid->p2p_group;
2346
2347         if (wpa_s->parent->set_sta_uapsd)
2348                 params.uapsd = wpa_s->parent->sta_uapsd;
2349         else
2350                 params.uapsd = -1;
2351
2352 #ifdef CONFIG_HT_OVERRIDES
2353         os_memset(&htcaps, 0, sizeof(htcaps));
2354         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2355         params.htcaps = (u8 *) &htcaps;
2356         params.htcaps_mask = (u8 *) &htcaps_mask;
2357         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2358 #endif /* CONFIG_HT_OVERRIDES */
2359 #ifdef CONFIG_VHT_OVERRIDES
2360         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2361         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2362         params.vhtcaps = &vhtcaps;
2363         params.vhtcaps_mask = &vhtcaps_mask;
2364         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2365 #endif /* CONFIG_VHT_OVERRIDES */
2366
2367 #ifdef CONFIG_P2P
2368         /*
2369          * If multi-channel concurrency is not supported, check for any
2370          * frequency conflict. In case of any frequency conflict, remove the
2371          * least prioritized connection.
2372          */
2373         if (wpa_s->num_multichan_concurrent < 2) {
2374                 int freq, num;
2375                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2376                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2377                         wpa_printf(MSG_DEBUG,
2378                                    "Assoc conflicting freq found (%d != %d)",
2379                                    freq, params.freq.freq);
2380                         if (wpas_p2p_handle_frequency_conflicts(
2381                                     wpa_s, params.freq.freq, ssid) < 0) {
2382                                 wpas_connect_work_done(wpa_s);
2383                                 return;
2384                         }
2385                 }
2386         }
2387 #endif /* CONFIG_P2P */
2388
2389         ret = wpa_drv_associate(wpa_s, &params);
2390         if (ret < 0) {
2391                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2392                         "failed");
2393                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2394                         /*
2395                          * The driver is known to mean what is saying, so we
2396                          * can stop right here; the association will not
2397                          * succeed.
2398                          */
2399                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2400                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2401                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2402                         return;
2403                 }
2404                 /* try to continue anyway; new association will be tried again
2405                  * after timeout */
2406                 assoc_failed = 1;
2407         }
2408
2409         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2410                 /* Set the key after the association just in case association
2411                  * cleared the previously configured key. */
2412                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2413                 /* No need to timeout authentication since there is no key
2414                  * management. */
2415                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2416                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2417 #ifdef CONFIG_IBSS_RSN
2418         } else if (ssid->mode == WPAS_MODE_IBSS &&
2419                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2420                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2421                 /*
2422                  * RSN IBSS authentication is per-STA and we can disable the
2423                  * per-BSSID authentication.
2424                  */
2425                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2426 #endif /* CONFIG_IBSS_RSN */
2427         } else {
2428                 /* Timeout for IEEE 802.11 authentication and association */
2429                 int timeout = 60;
2430
2431                 if (assoc_failed) {
2432                         /* give IBSS a bit more time */
2433                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2434                 } else if (wpa_s->conf->ap_scan == 1) {
2435                         /* give IBSS a bit more time */
2436                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2437                 }
2438                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2439         }
2440
2441         if (wep_keys_set &&
2442             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2443                 /* Set static WEP keys again */
2444                 wpa_set_wep_keys(wpa_s, ssid);
2445         }
2446
2447         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2448                 /*
2449                  * Do not allow EAP session resumption between different
2450                  * network configurations.
2451                  */
2452                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2453         }
2454         old_ssid = wpa_s->current_ssid;
2455         wpa_s->current_ssid = ssid;
2456         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2457                 wpa_s->current_bss = bss;
2458         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2459         wpa_supplicant_initiate_eapol(wpa_s);
2460         if (old_ssid != wpa_s->current_ssid)
2461                 wpas_notify_network_changed(wpa_s);
2462 }
2463
2464
2465 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2466                                             const u8 *addr)
2467 {
2468         struct wpa_ssid *old_ssid;
2469
2470         wpas_connect_work_done(wpa_s);
2471         wpa_clear_keys(wpa_s, addr);
2472         old_ssid = wpa_s->current_ssid;
2473         wpa_supplicant_mark_disassoc(wpa_s);
2474         wpa_sm_set_config(wpa_s->wpa, NULL);
2475         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2476         if (old_ssid != wpa_s->current_ssid)
2477                 wpas_notify_network_changed(wpa_s);
2478         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2479 }
2480
2481
2482 /**
2483  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2484  * @wpa_s: Pointer to wpa_supplicant data
2485  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2486  *
2487  * This function is used to request %wpa_supplicant to deauthenticate from the
2488  * current AP.
2489  */
2490 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2491                                    int reason_code)
2492 {
2493         u8 *addr = NULL;
2494         union wpa_event_data event;
2495         int zero_addr = 0;
2496
2497         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2498                 " pending_bssid=" MACSTR " reason=%d state=%s",
2499                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2500                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2501
2502         if (!is_zero_ether_addr(wpa_s->bssid))
2503                 addr = wpa_s->bssid;
2504         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2505                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2506                   wpa_s->wpa_state == WPA_ASSOCIATING))
2507                 addr = wpa_s->pending_bssid;
2508         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2509                 /*
2510                  * When using driver-based BSS selection, we may not know the
2511                  * BSSID with which we are currently trying to associate. We
2512                  * need to notify the driver of this disconnection even in such
2513                  * a case, so use the all zeros address here.
2514                  */
2515                 addr = wpa_s->bssid;
2516                 zero_addr = 1;
2517         }
2518
2519 #ifdef CONFIG_TDLS
2520         wpa_tdls_teardown_peers(wpa_s->wpa);
2521 #endif /* CONFIG_TDLS */
2522
2523 #ifdef CONFIG_MESH
2524         if (wpa_s->ifmsh) {
2525                 wpa_msg_ctrl(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2526                              wpa_s->ifname);
2527                 wpa_supplicant_leave_mesh(wpa_s);
2528         }
2529 #endif /* CONFIG_MESH */
2530
2531         if (addr) {
2532                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2533                 os_memset(&event, 0, sizeof(event));
2534                 event.deauth_info.reason_code = (u16) reason_code;
2535                 event.deauth_info.locally_generated = 1;
2536                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2537                 if (zero_addr)
2538                         addr = NULL;
2539         }
2540
2541         wpa_supplicant_clear_connection(wpa_s, addr);
2542 }
2543
2544 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2545                                               struct wpa_ssid *ssid)
2546 {
2547         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2548                 return;
2549
2550         ssid->disabled = 0;
2551         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2552         wpas_notify_network_enabled_changed(wpa_s, ssid);
2553
2554         /*
2555          * Try to reassociate since there is no current configuration and a new
2556          * network was made available.
2557          */
2558         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2559                 wpa_s->reassociate = 1;
2560 }
2561
2562
2563 /**
2564  * wpa_supplicant_enable_network - Mark a configured network as enabled
2565  * @wpa_s: wpa_supplicant structure for a network interface
2566  * @ssid: wpa_ssid structure for a configured network or %NULL
2567  *
2568  * Enables the specified network or all networks if no network specified.
2569  */
2570 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2571                                    struct wpa_ssid *ssid)
2572 {
2573         if (ssid == NULL) {
2574                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2575                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2576         } else
2577                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2578
2579         if (wpa_s->reassociate && !wpa_s->disconnected &&
2580             (!wpa_s->current_ssid ||
2581              wpa_s->wpa_state == WPA_DISCONNECTED ||
2582              wpa_s->wpa_state == WPA_SCANNING)) {
2583                 if (wpa_s->sched_scanning) {
2584                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2585                                    "new network to scan filters");
2586                         wpa_supplicant_cancel_sched_scan(wpa_s);
2587                 }
2588
2589                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2590                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2591                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2592                 }
2593         }
2594 }
2595
2596
2597 /**
2598  * wpa_supplicant_disable_network - Mark a configured network as disabled
2599  * @wpa_s: wpa_supplicant structure for a network interface
2600  * @ssid: wpa_ssid structure for a configured network or %NULL
2601  *
2602  * Disables the specified network or all networks if no network specified.
2603  */
2604 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2605                                     struct wpa_ssid *ssid)
2606 {
2607         struct wpa_ssid *other_ssid;
2608         int was_disabled;
2609
2610         if (ssid == NULL) {
2611                 if (wpa_s->sched_scanning)
2612                         wpa_supplicant_cancel_sched_scan(wpa_s);
2613
2614                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2615                      other_ssid = other_ssid->next) {
2616                         was_disabled = other_ssid->disabled;
2617                         if (was_disabled == 2)
2618                                 continue; /* do not change persistent P2P group
2619                                            * data */
2620
2621                         other_ssid->disabled = 1;
2622
2623                         if (was_disabled != other_ssid->disabled)
2624                                 wpas_notify_network_enabled_changed(
2625                                         wpa_s, other_ssid);
2626                 }
2627                 if (wpa_s->current_ssid)
2628                         wpa_supplicant_deauthenticate(
2629                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2630         } else if (ssid->disabled != 2) {
2631                 if (ssid == wpa_s->current_ssid)
2632                         wpa_supplicant_deauthenticate(
2633                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2634
2635                 was_disabled = ssid->disabled;
2636
2637                 ssid->disabled = 1;
2638
2639                 if (was_disabled != ssid->disabled) {
2640                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2641                         if (wpa_s->sched_scanning) {
2642                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2643                                            "to remove network from filters");
2644                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2645                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2646                         }
2647                 }
2648         }
2649 }
2650
2651
2652 /**
2653  * wpa_supplicant_select_network - Attempt association with a network
2654  * @wpa_s: wpa_supplicant structure for a network interface
2655  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2656  */
2657 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2658                                    struct wpa_ssid *ssid)
2659 {
2660
2661         struct wpa_ssid *other_ssid;
2662         int disconnected = 0;
2663
2664         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2665                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2666                         wpa_s->own_disconnect_req = 1;
2667                 wpa_supplicant_deauthenticate(
2668                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2669                 disconnected = 1;
2670         }
2671
2672         if (ssid)
2673                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2674
2675         /*
2676          * Mark all other networks disabled or mark all networks enabled if no
2677          * network specified.
2678          */
2679         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2680              other_ssid = other_ssid->next) {
2681                 int was_disabled = other_ssid->disabled;
2682                 if (was_disabled == 2)
2683                         continue; /* do not change persistent P2P group data */
2684
2685                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2686                 if (was_disabled && !other_ssid->disabled)
2687                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2688
2689                 if (was_disabled != other_ssid->disabled)
2690                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2691         }
2692
2693         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid) {
2694                 /* We are already associated with the selected network */
2695                 wpa_printf(MSG_DEBUG, "Already associated with the "
2696                            "selected network - do nothing");
2697                 return;
2698         }
2699
2700         if (ssid) {
2701                 wpa_s->current_ssid = ssid;
2702                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2703                 wpa_s->connect_without_scan =
2704                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2705
2706                 /*
2707                  * Don't optimize next scan freqs since a new ESS has been
2708                  * selected.
2709                  */
2710                 os_free(wpa_s->next_scan_freqs);
2711                 wpa_s->next_scan_freqs = NULL;
2712         } else {
2713                 wpa_s->connect_without_scan = NULL;
2714         }
2715
2716         wpa_s->disconnected = 0;
2717         wpa_s->reassociate = 1;
2718
2719         if (wpa_s->connect_without_scan ||
2720             wpa_supplicant_fast_associate(wpa_s) != 1) {
2721                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2722                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2723         }
2724
2725         if (ssid)
2726                 wpas_notify_network_selected(wpa_s, ssid);
2727 }
2728
2729
2730 /**
2731  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2732  * @wpa_s: wpa_supplicant structure for a network interface
2733  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2734  * @pkcs11_module_path: PKCS #11 module path or NULL
2735  * Returns: 0 on success; -1 on failure
2736  *
2737  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2738  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2739  * module path fails the paths will be reset to the default value (NULL).
2740  */
2741 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2742                                            const char *pkcs11_engine_path,
2743                                            const char *pkcs11_module_path)
2744 {
2745         char *pkcs11_engine_path_copy = NULL;
2746         char *pkcs11_module_path_copy = NULL;
2747
2748         if (pkcs11_engine_path != NULL) {
2749                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2750                 if (pkcs11_engine_path_copy == NULL)
2751                         return -1;
2752         }
2753         if (pkcs11_module_path != NULL) {
2754                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2755                 if (pkcs11_module_path_copy == NULL) {
2756                         os_free(pkcs11_engine_path_copy);
2757                         return -1;
2758                 }
2759         }
2760
2761         os_free(wpa_s->conf->pkcs11_engine_path);
2762         os_free(wpa_s->conf->pkcs11_module_path);
2763         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2764         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2765
2766         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2767         eapol_sm_deinit(wpa_s->eapol);
2768         wpa_s->eapol = NULL;
2769         if (wpa_supplicant_init_eapol(wpa_s)) {
2770                 /* Error -> Reset paths to the default value (NULL) once. */
2771                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2772                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2773                                                                NULL);
2774
2775                 return -1;
2776         }
2777         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2778
2779         return 0;
2780 }
2781
2782
2783 /**
2784  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2785  * @wpa_s: wpa_supplicant structure for a network interface
2786  * @ap_scan: AP scan mode
2787  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2788  *
2789  */
2790 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2791 {
2792
2793         int old_ap_scan;
2794
2795         if (ap_scan < 0 || ap_scan > 2)
2796                 return -1;
2797
2798         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2799                 wpa_printf(MSG_INFO,
2800                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2801         }
2802
2803 #ifdef ANDROID
2804         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2805             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2806             wpa_s->wpa_state < WPA_COMPLETED) {
2807                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2808                            "associating", wpa_s->conf->ap_scan, ap_scan);
2809                 return 0;
2810         }
2811 #endif /* ANDROID */
2812
2813         old_ap_scan = wpa_s->conf->ap_scan;
2814         wpa_s->conf->ap_scan = ap_scan;
2815
2816         if (old_ap_scan != wpa_s->conf->ap_scan)
2817                 wpas_notify_ap_scan_changed(wpa_s);
2818
2819         return 0;
2820 }
2821
2822
2823 /**
2824  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2825  * @wpa_s: wpa_supplicant structure for a network interface
2826  * @expire_age: Expiration age in seconds
2827  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2828  *
2829  */
2830 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2831                                           unsigned int bss_expire_age)
2832 {
2833         if (bss_expire_age < 10) {
2834                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2835                         bss_expire_age);
2836                 return -1;
2837         }
2838         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2839                 bss_expire_age);
2840         wpa_s->conf->bss_expiration_age = bss_expire_age;
2841
2842         return 0;
2843 }
2844
2845
2846 /**
2847  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2848  * @wpa_s: wpa_supplicant structure for a network interface
2849  * @expire_count: number of scans after which an unseen BSS is reclaimed
2850  * Returns: 0 if succeed or -1 if expire_count has an invalid value
2851  *
2852  */
2853 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
2854                                             unsigned int bss_expire_count)
2855 {
2856         if (bss_expire_count < 1) {
2857                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
2858                         bss_expire_count);
2859                 return -1;
2860         }
2861         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
2862                 bss_expire_count);
2863         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
2864
2865         return 0;
2866 }
2867
2868
2869 /**
2870  * wpa_supplicant_set_scan_interval - Set scan interval
2871  * @wpa_s: wpa_supplicant structure for a network interface
2872  * @scan_interval: scan interval in seconds
2873  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
2874  *
2875  */
2876 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
2877                                      int scan_interval)
2878 {
2879         if (scan_interval < 0) {
2880                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
2881                         scan_interval);
2882                 return -1;
2883         }
2884         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
2885                 scan_interval);
2886         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
2887
2888         return 0;
2889 }
2890
2891
2892 /**
2893  * wpa_supplicant_set_debug_params - Set global debug params
2894  * @global: wpa_global structure
2895  * @debug_level: debug level
2896  * @debug_timestamp: determines if show timestamp in debug data
2897  * @debug_show_keys: determines if show keys in debug data
2898  * Returns: 0 if succeed or -1 if debug_level has wrong value
2899  */
2900 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
2901                                     int debug_timestamp, int debug_show_keys)
2902 {
2903
2904         int old_level, old_timestamp, old_show_keys;
2905
2906         /* check for allowed debuglevels */
2907         if (debug_level != MSG_EXCESSIVE &&
2908             debug_level != MSG_MSGDUMP &&
2909             debug_level != MSG_DEBUG &&
2910             debug_level != MSG_INFO &&
2911             debug_level != MSG_WARNING &&
2912             debug_level != MSG_ERROR)
2913                 return -1;
2914
2915         old_level = wpa_debug_level;
2916         old_timestamp = wpa_debug_timestamp;
2917         old_show_keys = wpa_debug_show_keys;
2918
2919         wpa_debug_level = debug_level;
2920         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
2921         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
2922
2923         if (wpa_debug_level != old_level)
2924                 wpas_notify_debug_level_changed(global);
2925         if (wpa_debug_timestamp != old_timestamp)
2926                 wpas_notify_debug_timestamp_changed(global);
2927         if (wpa_debug_show_keys != old_show_keys)
2928                 wpas_notify_debug_show_keys_changed(global);
2929
2930         return 0;
2931 }
2932
2933
2934 /**
2935  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
2936  * @wpa_s: Pointer to wpa_supplicant data
2937  * Returns: A pointer to the current network structure or %NULL on failure
2938  */
2939 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
2940 {
2941         struct wpa_ssid *entry;
2942         u8 ssid[SSID_MAX_LEN];
2943         int res;
2944         size_t ssid_len;
2945         u8 bssid[ETH_ALEN];
2946         int wired;
2947
2948         res = wpa_drv_get_ssid(wpa_s, ssid);
2949         if (res < 0) {
2950                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
2951                         "driver");
2952                 return NULL;
2953         }
2954         ssid_len = res;
2955
2956         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
2957                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
2958                         "driver");
2959                 return NULL;
2960         }
2961
2962         wired = wpa_s->conf->ap_scan == 0 &&
2963                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
2964
2965         entry = wpa_s->conf->ssid;
2966         while (entry) {
2967                 if (!wpas_network_disabled(wpa_s, entry) &&
2968                     ((ssid_len == entry->ssid_len &&
2969                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
2970                     (!entry->bssid_set ||
2971                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2972                         return entry;
2973 #ifdef CONFIG_WPS
2974                 if (!wpas_network_disabled(wpa_s, entry) &&
2975                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
2976                     (entry->ssid == NULL || entry->ssid_len == 0) &&
2977                     (!entry->bssid_set ||
2978                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
2979                         return entry;
2980 #endif /* CONFIG_WPS */
2981
2982                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
2983                     entry->ssid_len == 0 &&
2984                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
2985                         return entry;
2986
2987                 entry = entry->next;
2988         }
2989
2990         return NULL;
2991 }
2992
2993
2994 static int select_driver(struct wpa_supplicant *wpa_s, int i)
2995 {
2996         struct wpa_global *global = wpa_s->global;
2997
2998         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
2999                 global->drv_priv[i] = wpa_drivers[i]->global_init();
3000                 if (global->drv_priv[i] == NULL) {
3001                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3002                                    "'%s'", wpa_drivers[i]->name);
3003                         return -1;
3004                 }
3005         }
3006
3007         wpa_s->driver = wpa_drivers[i];
3008         wpa_s->global_drv_priv = global->drv_priv[i];
3009
3010         return 0;
3011 }
3012
3013
3014 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3015                                      const char *name)
3016 {
3017         int i;
3018         size_t len;
3019         const char *pos, *driver = name;
3020
3021         if (wpa_s == NULL)
3022                 return -1;
3023
3024         if (wpa_drivers[0] == NULL) {
3025                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3026                         "wpa_supplicant");
3027                 return -1;
3028         }
3029
3030         if (name == NULL) {
3031                 /* default to first driver in the list */
3032                 return select_driver(wpa_s, 0);
3033         }
3034
3035         do {
3036                 pos = os_strchr(driver, ',');
3037                 if (pos)
3038                         len = pos - driver;
3039                 else
3040                         len = os_strlen(driver);
3041
3042                 for (i = 0; wpa_drivers[i]; i++) {
3043                         if (os_strlen(wpa_drivers[i]->name) == len &&
3044                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3045                             0) {
3046                                 /* First driver that succeeds wins */
3047                                 if (select_driver(wpa_s, i) == 0)
3048                                         return 0;
3049                         }
3050                 }
3051
3052                 driver = pos + 1;
3053         } while (pos);
3054
3055         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3056         return -1;
3057 }
3058
3059
3060 /**
3061  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3062  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3063  *      with struct wpa_driver_ops::init()
3064  * @src_addr: Source address of the EAPOL frame
3065  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3066  * @len: Length of the EAPOL data
3067  *
3068  * This function is called for each received EAPOL frame. Most driver
3069  * interfaces rely on more generic OS mechanism for receiving frames through
3070  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3071  * take care of received EAPOL frames and deliver them to the core supplicant
3072  * code by calling this function.
3073  */
3074 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3075                              const u8 *buf, size_t len)
3076 {
3077         struct wpa_supplicant *wpa_s = ctx;
3078
3079         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3080         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3081
3082 #ifdef CONFIG_PEERKEY
3083         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3084             wpa_s->current_ssid->peerkey &&
3085             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3086             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3087                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3088                 return;
3089         }
3090 #endif /* CONFIG_PEERKEY */
3091
3092         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3093             (wpa_s->last_eapol_matches_bssid &&
3094 #ifdef CONFIG_AP
3095              !wpa_s->ap_iface &&
3096 #endif /* CONFIG_AP */
3097              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3098                 /*
3099                  * There is possible race condition between receiving the
3100                  * association event and the EAPOL frame since they are coming
3101                  * through different paths from the driver. In order to avoid
3102                  * issues in trying to process the EAPOL frame before receiving
3103                  * association information, lets queue it for processing until
3104                  * the association event is received. This may also be needed in
3105                  * driver-based roaming case, so also use src_addr != BSSID as a
3106                  * trigger if we have previously confirmed that the
3107                  * Authenticator uses BSSID as the src_addr (which is not the
3108                  * case with wired IEEE 802.1X).
3109                  */
3110                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3111                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3112                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3113                         MAC2STR(wpa_s->bssid));
3114                 wpabuf_free(wpa_s->pending_eapol_rx);
3115                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3116                 if (wpa_s->pending_eapol_rx) {
3117                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3118                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3119                                   ETH_ALEN);
3120                 }
3121                 return;
3122         }
3123
3124         wpa_s->last_eapol_matches_bssid =
3125                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3126
3127 #ifdef CONFIG_AP
3128         if (wpa_s->ap_iface) {
3129                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3130                 return;
3131         }
3132 #endif /* CONFIG_AP */
3133
3134         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3135                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3136                         "no key management is configured");
3137                 return;
3138         }
3139
3140         if (wpa_s->eapol_received == 0 &&
3141             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3142              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3143              wpa_s->wpa_state != WPA_COMPLETED) &&
3144             (wpa_s->current_ssid == NULL ||
3145              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3146                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3147                 int timeout = 10;
3148
3149                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3150                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3151                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3152                         /* Use longer timeout for IEEE 802.1X/EAP */
3153                         timeout = 70;
3154                 }
3155
3156 #ifdef CONFIG_WPS
3157                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3158                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3159                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3160                         /*
3161                          * Use shorter timeout if going through WPS AP iteration
3162                          * for PIN config method with an AP that does not
3163                          * advertise Selected Registrar.
3164                          */
3165                         struct wpabuf *wps_ie;
3166
3167                         wps_ie = wpa_bss_get_vendor_ie_multi(
3168                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3169                         if (wps_ie &&
3170                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3171                                 timeout = 10;
3172                         wpabuf_free(wps_ie);
3173                 }
3174 #endif /* CONFIG_WPS */
3175
3176                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3177         }
3178         wpa_s->eapol_received++;
3179
3180         if (wpa_s->countermeasures) {
3181                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3182                         "EAPOL packet");
3183                 return;
3184         }
3185
3186 #ifdef CONFIG_IBSS_RSN
3187         if (wpa_s->current_ssid &&
3188             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3189                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3190                 return;
3191         }
3192 #endif /* CONFIG_IBSS_RSN */
3193
3194         /* Source address of the incoming EAPOL frame could be compared to the
3195          * current BSSID. However, it is possible that a centralized
3196          * Authenticator could be using another MAC address than the BSSID of
3197          * an AP, so just allow any address to be used for now. The replies are
3198          * still sent to the current BSSID (if available), though. */
3199
3200         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3201         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3202             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3203                 return;
3204         wpa_drv_poll(wpa_s);
3205         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3206                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3207         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3208                 /*
3209                  * Set portValid = TRUE here since we are going to skip 4-way
3210                  * handshake processing which would normally set portValid. We
3211                  * need this to allow the EAPOL state machines to be completed
3212                  * without going through EAPOL-Key handshake.
3213                  */
3214                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3215         }
3216 }
3217
3218
3219 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3220 {
3221         if ((!wpa_s->p2p_mgmt ||
3222              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3223             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3224                 l2_packet_deinit(wpa_s->l2);
3225                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3226                                            wpa_drv_get_mac_addr(wpa_s),
3227                                            ETH_P_EAPOL,
3228                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3229                 if (wpa_s->l2 == NULL)
3230                         return -1;
3231         } else {
3232                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3233                 if (addr)
3234                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3235         }
3236
3237         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3238                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3239                 return -1;
3240         }
3241
3242         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3243
3244         return 0;
3245 }
3246
3247
3248 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3249                                            const u8 *buf, size_t len)
3250 {
3251         struct wpa_supplicant *wpa_s = ctx;
3252         const struct l2_ethhdr *eth;
3253
3254         if (len < sizeof(*eth))
3255                 return;
3256         eth = (const struct l2_ethhdr *) buf;
3257
3258         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3259             !(eth->h_dest[0] & 0x01)) {
3260                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3261                         " (bridge - not for this interface - ignore)",
3262                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3263                 return;
3264         }
3265
3266         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3267                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3268         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3269                                 len - sizeof(*eth));
3270 }
3271
3272
3273 /**
3274  * wpa_supplicant_driver_init - Initialize driver interface parameters
3275  * @wpa_s: Pointer to wpa_supplicant data
3276  * Returns: 0 on success, -1 on failure
3277  *
3278  * This function is called to initialize driver interface parameters.
3279  * wpa_drv_init() must have been called before this function to initialize the
3280  * driver interface.
3281  */
3282 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3283 {
3284         static int interface_count = 0;
3285
3286         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3287                 return -1;
3288
3289         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3290                 MAC2STR(wpa_s->own_addr));
3291         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3292         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3293
3294         if (wpa_s->bridge_ifname[0]) {
3295                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3296                         "interface '%s'", wpa_s->bridge_ifname);
3297                 wpa_s->l2_br = l2_packet_init_bridge(
3298                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3299                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3300                 if (wpa_s->l2_br == NULL) {
3301                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3302                                 "connection for the bridge interface '%s'",
3303                                 wpa_s->bridge_ifname);
3304                         return -1;
3305                 }
3306         }
3307
3308         if (wpa_s->conf->ap_scan == 2 &&
3309             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3310                 wpa_printf(MSG_INFO,
3311                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3312         }
3313
3314         wpa_clear_keys(wpa_s, NULL);
3315
3316         /* Make sure that TKIP countermeasures are not left enabled (could
3317          * happen if wpa_supplicant is killed during countermeasures. */
3318         wpa_drv_set_countermeasures(wpa_s, 0);
3319
3320         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3321         wpa_drv_flush_pmkid(wpa_s);
3322
3323         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3324         wpa_s->prev_scan_wildcard = 0;
3325
3326         if (wpa_supplicant_enabled_networks(wpa_s)) {
3327                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3328                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3329                         interface_count = 0;
3330                 }
3331 #ifndef ANDROID
3332                 if (!wpa_s->p2p_mgmt &&
3333                     wpa_supplicant_delayed_sched_scan(wpa_s,
3334                                                       interface_count % 3,
3335                                                       100000))
3336                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3337                                                 100000);
3338 #endif /* ANDROID */
3339                 interface_count++;
3340         } else
3341                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3342
3343         return 0;
3344 }
3345
3346
3347 static int wpa_supplicant_daemon(const char *pid_file)
3348 {
3349         wpa_printf(MSG_DEBUG, "Daemonize..");
3350         return os_daemonize(pid_file);
3351 }
3352
3353
3354 static struct wpa_supplicant *
3355 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3356 {
3357         struct wpa_supplicant *wpa_s;
3358
3359         wpa_s = os_zalloc(sizeof(*wpa_s));
3360         if (wpa_s == NULL)
3361                 return NULL;
3362         wpa_s->scan_req = INITIAL_SCAN_REQ;
3363         wpa_s->scan_interval = 5;
3364         wpa_s->new_connection = 1;
3365         wpa_s->parent = parent ? parent : wpa_s;
3366         wpa_s->sched_scanning = 0;
3367
3368         return wpa_s;
3369 }
3370
3371
3372 #ifdef CONFIG_HT_OVERRIDES
3373
3374 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3375                              struct ieee80211_ht_capabilities *htcaps,
3376                              struct ieee80211_ht_capabilities *htcaps_mask,
3377                              const char *ht_mcs)
3378 {
3379         /* parse ht_mcs into hex array */
3380         int i;
3381         const char *tmp = ht_mcs;
3382         char *end = NULL;
3383
3384         /* If ht_mcs is null, do not set anything */
3385         if (!ht_mcs)
3386                 return 0;
3387
3388         /* This is what we are setting in the kernel */
3389         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3390
3391         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3392
3393         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3394                 errno = 0;
3395                 long v = strtol(tmp, &end, 16);
3396                 if (errno == 0) {
3397                         wpa_msg(wpa_s, MSG_DEBUG,
3398                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3399                                 i, v, end, tmp);
3400                         if (end == tmp)
3401                                 break;
3402
3403                         htcaps->supported_mcs_set[i] = v;
3404                         tmp = end;
3405                 } else {
3406                         wpa_msg(wpa_s, MSG_ERROR,
3407                                 "Failed to parse ht-mcs: %s, error: %s\n",
3408                                 ht_mcs, strerror(errno));
3409                         return -1;
3410                 }
3411         }
3412
3413         /*
3414          * If we were able to parse any values, then set mask for the MCS set.
3415          */
3416         if (i) {
3417                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3418                           IEEE80211_HT_MCS_MASK_LEN - 1);
3419                 /* skip the 3 reserved bits */
3420                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3421                         0x1f;
3422         }
3423
3424         return 0;
3425 }
3426
3427
3428 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3429                                  struct ieee80211_ht_capabilities *htcaps,
3430                                  struct ieee80211_ht_capabilities *htcaps_mask,
3431                                  int disabled)
3432 {
3433         le16 msk;
3434
3435         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3436
3437         if (disabled == -1)
3438                 return 0;
3439
3440         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3441         htcaps_mask->ht_capabilities_info |= msk;
3442         if (disabled)
3443                 htcaps->ht_capabilities_info &= msk;
3444         else
3445                 htcaps->ht_capabilities_info |= msk;
3446
3447         return 0;
3448 }
3449
3450
3451 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3452                                 struct ieee80211_ht_capabilities *htcaps,
3453                                 struct ieee80211_ht_capabilities *htcaps_mask,
3454                                 int factor)
3455 {
3456         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3457
3458         if (factor == -1)
3459                 return 0;
3460
3461         if (factor < 0 || factor > 3) {
3462                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3463                         "Must be 0-3 or -1", factor);
3464                 return -EINVAL;
3465         }
3466
3467         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3468         htcaps->a_mpdu_params &= ~0x3;
3469         htcaps->a_mpdu_params |= factor & 0x3;
3470
3471         return 0;
3472 }
3473
3474
3475 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3476                                  struct ieee80211_ht_capabilities *htcaps,
3477                                  struct ieee80211_ht_capabilities *htcaps_mask,
3478                                  int density)
3479 {
3480         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3481
3482         if (density == -1)
3483                 return 0;
3484
3485         if (density < 0 || density > 7) {
3486                 wpa_msg(wpa_s, MSG_ERROR,
3487                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3488                         density);
3489                 return -EINVAL;
3490         }
3491
3492         htcaps_mask->a_mpdu_params |= 0x1C;
3493         htcaps->a_mpdu_params &= ~(0x1C);
3494         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3495
3496         return 0;
3497 }
3498
3499
3500 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3501                                 struct ieee80211_ht_capabilities *htcaps,
3502                                 struct ieee80211_ht_capabilities *htcaps_mask,
3503                                 int disabled)
3504 {
3505         /* Masking these out disables HT40 */
3506         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3507                                 HT_CAP_INFO_SHORT_GI40MHZ);
3508
3509         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3510
3511         if (disabled)
3512                 htcaps->ht_capabilities_info &= ~msk;
3513         else
3514                 htcaps->ht_capabilities_info |= msk;
3515
3516         htcaps_mask->ht_capabilities_info |= msk;
3517
3518         return 0;
3519 }
3520
3521
3522 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3523                                struct ieee80211_ht_capabilities *htcaps,
3524                                struct ieee80211_ht_capabilities *htcaps_mask,
3525                                int disabled)
3526 {
3527         /* Masking these out disables SGI */
3528         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3529                                 HT_CAP_INFO_SHORT_GI40MHZ);
3530
3531         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3532
3533         if (disabled)
3534                 htcaps->ht_capabilities_info &= ~msk;
3535         else
3536                 htcaps->ht_capabilities_info |= msk;
3537
3538         htcaps_mask->ht_capabilities_info |= msk;
3539
3540         return 0;
3541 }
3542
3543
3544 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3545                                struct ieee80211_ht_capabilities *htcaps,
3546                                struct ieee80211_ht_capabilities *htcaps_mask,
3547                                int disabled)
3548 {
3549         /* Masking these out disables LDPC */
3550         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3551
3552         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3553
3554         if (disabled)
3555                 htcaps->ht_capabilities_info &= ~msk;
3556         else
3557                 htcaps->ht_capabilities_info |= msk;
3558
3559         htcaps_mask->ht_capabilities_info |= msk;
3560
3561         return 0;
3562 }
3563
3564
3565 void wpa_supplicant_apply_ht_overrides(
3566         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3567         struct wpa_driver_associate_params *params)
3568 {
3569         struct ieee80211_ht_capabilities *htcaps;
3570         struct ieee80211_ht_capabilities *htcaps_mask;
3571
3572         if (!ssid)
3573                 return;
3574
3575         params->disable_ht = ssid->disable_ht;
3576         if (!params->htcaps || !params->htcaps_mask)
3577                 return;
3578
3579         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3580         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3581         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3582         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3583                               ssid->disable_max_amsdu);
3584         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3585         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3586         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3587         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3588         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3589
3590         if (ssid->ht40_intolerant) {
3591                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3592                 htcaps->ht_capabilities_info |= bit;
3593                 htcaps_mask->ht_capabilities_info |= bit;
3594         }
3595 }
3596
3597 #endif /* CONFIG_HT_OVERRIDES */
3598
3599
3600 #ifdef CONFIG_VHT_OVERRIDES
3601 void wpa_supplicant_apply_vht_overrides(
3602         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3603         struct wpa_driver_associate_params *params)
3604 {
3605         struct ieee80211_vht_capabilities *vhtcaps;
3606         struct ieee80211_vht_capabilities *vhtcaps_mask;
3607
3608         if (!ssid)
3609                 return;
3610
3611         params->disable_vht = ssid->disable_vht;
3612
3613         vhtcaps = (void *) params->vhtcaps;
3614         vhtcaps_mask = (void *) params->vhtcaps_mask;
3615
3616         if (!vhtcaps || !vhtcaps_mask)
3617                 return;
3618
3619         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3620         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3621
3622 #ifdef CONFIG_HT_OVERRIDES
3623         /* if max ampdu is <= 3, we have to make the HT cap the same */
3624         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3625                 int max_ampdu;
3626
3627                 max_ampdu = (ssid->vht_capa &
3628                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3629                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3630
3631                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3632                 wpa_set_ampdu_factor(wpa_s,
3633                                      (void *) params->htcaps,
3634                                      (void *) params->htcaps_mask,
3635                                      max_ampdu);
3636         }
3637 #endif /* CONFIG_HT_OVERRIDES */
3638
3639 #define OVERRIDE_MCS(i)                                                 \
3640         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3641                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3642                         3 << 2 * (i - 1);                               \
3643                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3644                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3645         }                                                               \
3646         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3647                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3648                         3 << 2 * (i - 1);                               \
3649                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3650                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3651         }
3652
3653         OVERRIDE_MCS(1);
3654         OVERRIDE_MCS(2);
3655         OVERRIDE_MCS(3);
3656         OVERRIDE_MCS(4);
3657         OVERRIDE_MCS(5);
3658         OVERRIDE_MCS(6);
3659         OVERRIDE_MCS(7);
3660         OVERRIDE_MCS(8);
3661 }
3662 #endif /* CONFIG_VHT_OVERRIDES */
3663
3664
3665 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3666 {
3667 #ifdef PCSC_FUNCS
3668         size_t len;
3669
3670         if (!wpa_s->conf->pcsc_reader)
3671                 return 0;
3672
3673         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3674         if (!wpa_s->scard)
3675                 return 1;
3676
3677         if (wpa_s->conf->pcsc_pin &&
3678             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3679                 scard_deinit(wpa_s->scard);
3680                 wpa_s->scard = NULL;
3681                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3682                 return -1;
3683         }
3684
3685         len = sizeof(wpa_s->imsi) - 1;
3686         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3687                 scard_deinit(wpa_s->scard);
3688                 wpa_s->scard = NULL;
3689                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3690                 return -1;
3691         }
3692         wpa_s->imsi[len] = '\0';
3693
3694         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3695
3696         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3697                    wpa_s->imsi, wpa_s->mnc_len);
3698
3699         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3700         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3701 #endif /* PCSC_FUNCS */
3702
3703         return 0;
3704 }
3705
3706
3707 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3708 {
3709         char *val, *pos;
3710
3711         ext_password_deinit(wpa_s->ext_pw);
3712         wpa_s->ext_pw = NULL;
3713         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3714
3715         if (!wpa_s->conf->ext_password_backend)
3716                 return 0;
3717
3718         val = os_strdup(wpa_s->conf->ext_password_backend);
3719         if (val == NULL)
3720                 return -1;
3721         pos = os_strchr(val, ':');
3722         if (pos)
3723                 *pos++ = '\0';
3724
3725         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3726
3727         wpa_s->ext_pw = ext_password_init(val, pos);
3728         os_free(val);
3729         if (wpa_s->ext_pw == NULL) {
3730                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3731                 return -1;
3732         }
3733         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3734
3735         return 0;
3736 }
3737
3738
3739 #ifdef CONFIG_FST
3740
3741 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3742 {
3743         struct wpa_supplicant *wpa_s = ctx;
3744
3745         return (is_zero_ether_addr(wpa_s->bssid) ||
3746                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3747 }
3748
3749
3750 static void wpas_fst_get_channel_info_cb(void *ctx,
3751                                          enum hostapd_hw_mode *hw_mode,
3752                                          u8 *channel)
3753 {
3754         struct wpa_supplicant *wpa_s = ctx;
3755
3756         if (wpa_s->current_bss) {
3757                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3758                                                   channel);
3759         } else if (wpa_s->hw.num_modes) {
3760                 *hw_mode = wpa_s->hw.modes[0].mode;
3761         } else {
3762                 WPA_ASSERT(0);
3763                 *hw_mode = 0;
3764         }
3765 }
3766
3767
3768 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3769 {
3770         struct wpa_supplicant *wpa_s = ctx;
3771
3772         *modes = wpa_s->hw.modes;
3773         return wpa_s->hw.num_modes;
3774 }
3775
3776
3777 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3778 {
3779         struct wpa_supplicant *wpa_s = ctx;
3780
3781         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3782         wpa_s->fst_ies = fst_ies;
3783 }
3784
3785
3786 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3787 {
3788         struct wpa_supplicant *wpa_s = ctx;
3789
3790         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3791         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3792                                           wpa_s->own_addr, wpa_s->bssid,
3793                                           wpabuf_head(data), wpabuf_len(data),
3794                                    0);
3795 }
3796
3797
3798 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3799 {
3800         struct wpa_supplicant *wpa_s = ctx;
3801
3802         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3803         return wpa_s->received_mb_ies;
3804 }
3805
3806
3807 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3808                                      const u8 *buf, size_t size)
3809 {
3810         struct wpa_supplicant *wpa_s = ctx;
3811         struct mb_ies_info info;
3812
3813         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3814
3815         if (!mb_ies_info_by_ies(&info, buf, size)) {
3816                 wpabuf_free(wpa_s->received_mb_ies);
3817                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3818         }
3819 }
3820
3821
3822 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3823                                    Boolean mb_only)
3824 {
3825         struct wpa_supplicant *wpa_s = ctx;
3826
3827         *get_ctx = NULL;
3828         if (!is_zero_ether_addr(wpa_s->bssid))
3829                 return (wpa_s->received_mb_ies || !mb_only) ?
3830                         wpa_s->bssid : NULL;
3831         return NULL;
3832 }
3833
3834
3835 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3836                                   Boolean mb_only)
3837 {
3838         return NULL;
3839 }
3840
3841 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3842                                        struct fst_wpa_obj *iface_obj)
3843 {
3844         iface_obj->ctx              = wpa_s;
3845         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
3846         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
3847         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
3848         iface_obj->set_ies          = wpas_fst_set_ies_cb;
3849         iface_obj->send_action      = wpas_fst_send_action_cb;
3850         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
3851         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
3852         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
3853         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
3854 }
3855 #endif /* CONFIG_FST */
3856
3857 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
3858                                     const struct wpa_driver_capa *capa)
3859 {
3860         struct wowlan_triggers *triggers;
3861         int ret = 0;
3862
3863         if (!wpa_s->conf->wowlan_triggers)
3864                 return 0;
3865
3866         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
3867         if (triggers) {
3868                 ret = wpa_drv_wowlan(wpa_s, triggers);
3869                 os_free(triggers);
3870         }
3871         return ret;
3872 }
3873
3874
3875 static enum wpa_radio_work_band wpas_freq_to_band(int freq)
3876 {
3877         if (freq < 3000)
3878                 return BAND_2_4_GHZ;
3879         if (freq > 50000)
3880                 return BAND_60_GHZ;
3881         return BAND_5_GHZ;
3882 }
3883
3884
3885 static unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s,
3886                                    const int *freqs)
3887 {
3888         int i;
3889         unsigned int band = 0;
3890
3891         if (freqs) {
3892                 /* freqs are specified for the radio work */
3893                 for (i = 0; freqs[i]; i++)
3894                         band |= wpas_freq_to_band(freqs[i]);
3895         } else {
3896                 /*
3897                  * freqs are not specified, implies all
3898                  * the supported freqs by HW
3899                  */
3900                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
3901                         if (wpa_s->hw.modes[i].num_channels != 0) {
3902                                 if (wpa_s->hw.modes[i].mode ==
3903                                     HOSTAPD_MODE_IEEE80211B ||
3904                                     wpa_s->hw.modes[i].mode ==
3905                                     HOSTAPD_MODE_IEEE80211G)
3906                                         band |= BAND_2_4_GHZ;
3907                                 else if (wpa_s->hw.modes[i].mode ==
3908                                          HOSTAPD_MODE_IEEE80211A)
3909                                         band |= BAND_5_GHZ;
3910                                 else if (wpa_s->hw.modes[i].mode ==
3911                                          HOSTAPD_MODE_IEEE80211AD)
3912                                         band |= BAND_60_GHZ;
3913                                 else if (wpa_s->hw.modes[i].mode ==
3914                                          HOSTAPD_MODE_IEEE80211ANY)
3915                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
3916                                                 BAND_60_GHZ;
3917                         }
3918                 }
3919         }
3920
3921         return band;
3922 }
3923
3924
3925 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
3926                                               const char *rn)
3927 {
3928         struct wpa_supplicant *iface = wpa_s->global->ifaces;
3929         struct wpa_radio *radio;
3930
3931         while (rn && iface) {
3932                 radio = iface->radio;
3933                 if (radio && os_strcmp(rn, radio->name) == 0) {
3934                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
3935                                    wpa_s->ifname, rn);
3936                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3937                         return radio;
3938                 }
3939
3940                 iface = iface->next;
3941         }
3942
3943         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
3944                    wpa_s->ifname, rn ? rn : "N/A");
3945         radio = os_zalloc(sizeof(*radio));
3946         if (radio == NULL)
3947                 return NULL;
3948
3949         if (rn)
3950                 os_strlcpy(radio->name, rn, sizeof(radio->name));
3951         dl_list_init(&radio->ifaces);
3952         dl_list_init(&radio->work);
3953         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
3954
3955         return radio;
3956 }
3957
3958
3959 static void radio_work_free(struct wpa_radio_work *work)
3960 {
3961         if (work->wpa_s->scan_work == work) {
3962                 /* This should not really happen. */
3963                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
3964                         work->type, work, work->started);
3965                 work->wpa_s->scan_work = NULL;
3966         }
3967
3968 #ifdef CONFIG_P2P
3969         if (work->wpa_s->p2p_scan_work == work) {
3970                 /* This should not really happen. */
3971                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
3972                         work->type, work, work->started);
3973                 work->wpa_s->p2p_scan_work = NULL;
3974         }
3975 #endif /* CONFIG_P2P */
3976
3977         if (work->started) {
3978                 work->wpa_s->radio->num_active_works--;
3979                 wpa_dbg(work->wpa_s, MSG_DEBUG,
3980                         "radio_work_free('%s'@%p: num_active_works --> %u",
3981                         work->type, work,
3982                         work->wpa_s->radio->num_active_works);
3983         }
3984
3985         dl_list_del(&work->list);
3986         os_free(work);
3987 }
3988
3989
3990 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
3991 {
3992         struct wpa_radio_work *active_work = NULL;
3993         struct wpa_radio_work *tmp;
3994
3995         /* Get the active work to know the type and band. */
3996         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
3997                 if (tmp->started) {
3998                         active_work = tmp;
3999                         break;
4000                 }
4001         }
4002
4003         if (!active_work) {
4004                 /* No active work, start one */
4005                 radio->num_active_works = 0;
4006                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4007                                  list) {
4008                         if (os_strcmp(tmp->type, "scan") == 0 &&
4009                             radio->external_scan_running &&
4010                             (((struct wpa_driver_scan_params *)
4011                               tmp->ctx)->only_new_results ||
4012                              tmp->wpa_s->clear_driver_scan_cache))
4013                                 continue;
4014                         return tmp;
4015                 }
4016                 return NULL;
4017         }
4018
4019         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4020             os_strcmp(active_work->type, "connect") == 0) {
4021                 /*
4022                  * If the active work is either connect or sme-connect,
4023                  * do not parallelize them with other radio works.
4024                  */
4025                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4026                         "Do not parallelize radio work with %s",
4027                         active_work->type);
4028                 return NULL;
4029         }
4030
4031         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4032                 if (tmp->started)
4033                         continue;
4034
4035                 /*
4036                  * If connect or sme-connect are enqueued, parallelize only
4037                  * those operations ahead of them in the queue.
4038                  */
4039                 if (os_strcmp(tmp->type, "connect") == 0 ||
4040                     os_strcmp(tmp->type, "sme-connect") == 0)
4041                         break;
4042
4043                 /*
4044                  * Check that the radio works are distinct and
4045                  * on different bands.
4046                  */
4047                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4048                     (active_work->bands != tmp->bands)) {
4049                         /*
4050                          * If a scan has to be scheduled through nl80211 scan
4051                          * interface and if an external scan is already running,
4052                          * do not schedule the scan since it is likely to get
4053                          * rejected by kernel.
4054                          */
4055                         if (os_strcmp(tmp->type, "scan") == 0 &&
4056                             radio->external_scan_running &&
4057                             (((struct wpa_driver_scan_params *)
4058                               tmp->ctx)->only_new_results ||
4059                              tmp->wpa_s->clear_driver_scan_cache))
4060                                 continue;
4061
4062                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4063                                 "active_work:%s new_work:%s",
4064                                 active_work->type, tmp->type);
4065                         return tmp;
4066                 }
4067         }
4068
4069         /* Did not find a radio work to schedule in parallel. */
4070         return NULL;
4071 }
4072
4073
4074 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4075 {
4076         struct wpa_radio *radio = eloop_ctx;
4077         struct wpa_radio_work *work;
4078         struct os_reltime now, diff;
4079         struct wpa_supplicant *wpa_s;
4080
4081         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4082         if (work == NULL) {
4083                 radio->num_active_works = 0;
4084                 return;
4085         }
4086
4087         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4088                               radio_list);
4089
4090         if (!(wpa_s &&
4091               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4092                 if (work->started)
4093                         return; /* already started and still in progress */
4094
4095                 if (wpa_s && wpa_s->radio->external_scan_running) {
4096                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4097                         return;
4098                 }
4099         } else {
4100                 work = NULL;
4101                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4102                         /* get the work to schedule next */
4103                         work = radio_work_get_next_work(radio);
4104                 }
4105                 if (!work)
4106                         return;
4107         }
4108
4109         wpa_s = work->wpa_s;
4110         os_get_reltime(&now);
4111         os_reltime_sub(&now, &work->time, &diff);
4112         wpa_dbg(wpa_s, MSG_DEBUG,
4113                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4114                 work->type, work, diff.sec, diff.usec);
4115         work->started = 1;
4116         work->time = now;
4117         radio->num_active_works++;
4118
4119         work->cb(work, 0);
4120
4121         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4122             radio->num_active_works < MAX_ACTIVE_WORKS)
4123                 radio_work_check_next(wpa_s);
4124 }
4125
4126
4127 /*
4128  * This function removes both started and pending radio works running on
4129  * the provided interface's radio.
4130  * Prior to the removal of the radio work, its callback (cb) is called with
4131  * deinit set to be 1. Each work's callback is responsible for clearing its
4132  * internal data and restoring to a correct state.
4133  * @wpa_s: wpa_supplicant data
4134  * @type: type of works to be removed
4135  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4136  * this interface's works.
4137  */
4138 void radio_remove_works(struct wpa_supplicant *wpa_s,
4139                         const char *type, int remove_all)
4140 {
4141         struct wpa_radio_work *work, *tmp;
4142         struct wpa_radio *radio = wpa_s->radio;
4143
4144         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4145                               list) {
4146                 if (type && os_strcmp(type, work->type) != 0)
4147                         continue;
4148
4149                 /* skip other ifaces' works */
4150                 if (!remove_all && work->wpa_s != wpa_s)
4151                         continue;
4152
4153                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4154                         work->type, work, work->started ? " (started)" : "");
4155                 work->cb(work, 1);
4156                 radio_work_free(work);
4157         }
4158
4159         /* in case we removed the started work */
4160         radio_work_check_next(wpa_s);
4161 }
4162
4163
4164 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4165 {
4166         struct wpa_radio *radio = wpa_s->radio;
4167
4168         if (!radio)
4169                 return;
4170
4171         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4172                    wpa_s->ifname, radio->name);
4173         dl_list_del(&wpa_s->radio_list);
4174         radio_remove_works(wpa_s, NULL, 0);
4175         wpa_s->radio = NULL;
4176         if (!dl_list_empty(&radio->ifaces))
4177                 return; /* Interfaces remain for this radio */
4178
4179         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4180         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4181         os_free(radio);
4182 }
4183
4184
4185 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4186 {
4187         struct wpa_radio *radio = wpa_s->radio;
4188
4189         if (dl_list_empty(&radio->work))
4190                 return;
4191         if (wpa_s->ext_work_in_progress) {
4192                 wpa_printf(MSG_DEBUG,
4193                            "External radio work in progress - delay start of pending item");
4194                 return;
4195         }
4196         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4197         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4198 }
4199
4200
4201 /**
4202  * radio_add_work - Add a radio work item
4203  * @wpa_s: Pointer to wpa_supplicant data
4204  * @freq: Frequency of the offchannel operation in MHz or 0
4205  * @type: Unique identifier for each type of work
4206  * @next: Force as the next work to be executed
4207  * @cb: Callback function for indicating when radio is available
4208  * @ctx: Context pointer for the work (work->ctx in cb())
4209  * Returns: 0 on success, -1 on failure
4210  *
4211  * This function is used to request time for an operation that requires
4212  * exclusive radio control. Once the radio is available, the registered callback
4213  * function will be called. radio_work_done() must be called once the exclusive
4214  * radio operation has been completed, so that the radio is freed for other
4215  * operations. The special case of deinit=1 is used to free the context data
4216  * during interface removal. That does not allow the callback function to start
4217  * the radio operation, i.e., it must free any resources allocated for the radio
4218  * work and return.
4219  *
4220  * The @freq parameter can be used to indicate a single channel on which the
4221  * offchannel operation will occur. This may allow multiple radio work
4222  * operations to be performed in parallel if they apply for the same channel.
4223  * Setting this to 0 indicates that the work item may use multiple channels or
4224  * requires exclusive control of the radio.
4225  */
4226 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4227                    const char *type, int next,
4228                    void (*cb)(struct wpa_radio_work *work, int deinit),
4229                    void *ctx)
4230 {
4231         struct wpa_radio *radio = wpa_s->radio;
4232         struct wpa_radio_work *work;
4233         int was_empty;
4234
4235         work = os_zalloc(sizeof(*work));
4236         if (work == NULL)
4237                 return -1;
4238         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4239         os_get_reltime(&work->time);
4240         work->freq = freq;
4241         work->type = type;
4242         work->wpa_s = wpa_s;
4243         work->cb = cb;
4244         work->ctx = ctx;
4245
4246         if (freq)
4247                 work->bands = wpas_freq_to_band(freq);
4248         else if (os_strcmp(type, "scan") == 0 ||
4249                  os_strcmp(type, "p2p-scan") == 0)
4250                 work->bands = wpas_get_bands(wpa_s,
4251                                              ((struct wpa_driver_scan_params *)
4252                                               ctx)->freqs);
4253         else
4254                 work->bands = wpas_get_bands(wpa_s, NULL);
4255
4256         was_empty = dl_list_empty(&wpa_s->radio->work);
4257         if (next)
4258                 dl_list_add(&wpa_s->radio->work, &work->list);
4259         else
4260                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4261         if (was_empty) {
4262                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4263                 radio_work_check_next(wpa_s);
4264         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4265                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4266                 wpa_dbg(wpa_s, MSG_DEBUG,
4267                         "Try to schedule a radio work (num_active_works=%u)",
4268                         radio->num_active_works);
4269                 radio_work_check_next(wpa_s);
4270         }
4271
4272         return 0;
4273 }
4274
4275
4276 /**
4277  * radio_work_done - Indicate that a radio work item has been completed
4278  * @work: Completed work
4279  *
4280  * This function is called once the callback function registered with
4281  * radio_add_work() has completed its work.
4282  */
4283 void radio_work_done(struct wpa_radio_work *work)
4284 {
4285         struct wpa_supplicant *wpa_s = work->wpa_s;
4286         struct os_reltime now, diff;
4287         unsigned int started = work->started;
4288
4289         os_get_reltime(&now);
4290         os_reltime_sub(&now, &work->time, &diff);
4291         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4292                 work->type, work, started ? "done" : "canceled",
4293                 diff.sec, diff.usec);
4294         radio_work_free(work);
4295         if (started)
4296                 radio_work_check_next(wpa_s);
4297 }
4298
4299
4300 struct wpa_radio_work *
4301 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4302 {
4303         struct wpa_radio_work *work;
4304         struct wpa_radio *radio = wpa_s->radio;
4305
4306         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4307                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4308                         return work;
4309         }
4310
4311         return NULL;
4312 }
4313
4314
4315 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4316                             struct wpa_interface *iface)
4317 {
4318         const char *ifname, *driver, *rn;
4319
4320         driver = iface->driver;
4321 next_driver:
4322         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4323                 return -1;
4324
4325         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4326         if (wpa_s->drv_priv == NULL) {
4327                 const char *pos;
4328                 pos = driver ? os_strchr(driver, ',') : NULL;
4329                 if (pos) {
4330                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4331                                 "driver interface - try next driver wrapper");
4332                         driver = pos + 1;
4333                         goto next_driver;
4334                 }
4335                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4336                         "interface");
4337                 return -1;
4338         }
4339         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4340                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4341                         "driver_param '%s'", wpa_s->conf->driver_param);
4342                 return -1;
4343         }
4344
4345         ifname = wpa_drv_get_ifname(wpa_s);
4346         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4347                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4348                         "interface name with '%s'", ifname);
4349                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4350         }
4351
4352         rn = wpa_driver_get_radio_name(wpa_s);
4353         if (rn && rn[0] == '\0')
4354                 rn = NULL;
4355
4356         wpa_s->radio = radio_add_interface(wpa_s, rn);
4357         if (wpa_s->radio == NULL)
4358                 return -1;
4359
4360         return 0;
4361 }
4362
4363
4364 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4365                                      struct wpa_interface *iface)
4366 {
4367         struct wpa_driver_capa capa;
4368         int capa_res;
4369
4370         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4371                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4372                    iface->confname ? iface->confname : "N/A",
4373                    iface->driver ? iface->driver : "default",
4374                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4375                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4376
4377         if (iface->confname) {
4378 #ifdef CONFIG_BACKEND_FILE
4379                 wpa_s->confname = os_rel2abs_path(iface->confname);
4380                 if (wpa_s->confname == NULL) {
4381                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4382                                    "for configuration file '%s'.",
4383                                    iface->confname);
4384                         return -1;
4385                 }
4386                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4387                            iface->confname, wpa_s->confname);
4388 #else /* CONFIG_BACKEND_FILE */
4389                 wpa_s->confname = os_strdup(iface->confname);
4390 #endif /* CONFIG_BACKEND_FILE */
4391                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4392                 if (wpa_s->conf == NULL) {
4393                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4394                                    "configuration '%s'.", wpa_s->confname);
4395                         return -1;
4396                 }
4397                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4398                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4399
4400                 /*
4401                  * Override ctrl_interface and driver_param if set on command
4402                  * line.
4403                  */
4404                 if (iface->ctrl_interface) {
4405                         os_free(wpa_s->conf->ctrl_interface);
4406                         wpa_s->conf->ctrl_interface =
4407                                 os_strdup(iface->ctrl_interface);
4408                 }
4409
4410                 if (iface->driver_param) {
4411                         os_free(wpa_s->conf->driver_param);
4412                         wpa_s->conf->driver_param =
4413                                 os_strdup(iface->driver_param);
4414                 }
4415
4416                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4417                         os_free(wpa_s->conf->ctrl_interface);
4418                         wpa_s->conf->ctrl_interface = NULL;
4419                 }
4420         } else
4421                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4422                                                      iface->driver_param);
4423
4424         if (wpa_s->conf == NULL) {
4425                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4426                 return -1;
4427         }
4428
4429         if (iface->ifname == NULL) {
4430                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4431                 return -1;
4432         }
4433         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4434                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4435                            iface->ifname);
4436                 return -1;
4437         }
4438         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4439
4440         if (iface->bridge_ifname) {
4441                 if (os_strlen(iface->bridge_ifname) >=
4442                     sizeof(wpa_s->bridge_ifname)) {
4443                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4444                                    "name '%s'.", iface->bridge_ifname);
4445                         return -1;
4446                 }
4447                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4448                            sizeof(wpa_s->bridge_ifname));
4449         }
4450
4451         /* RSNA Supplicant Key Management - INITIALIZE */
4452         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4453         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4454
4455         /* Initialize driver interface and register driver event handler before
4456          * L2 receive handler so that association events are processed before
4457          * EAPOL-Key packets if both become available for the same select()
4458          * call. */
4459         if (wpas_init_driver(wpa_s, iface) < 0)
4460                 return -1;
4461
4462         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4463                 return -1;
4464
4465         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4466                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4467                           NULL);
4468         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4469
4470         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4471             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4472                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4473                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4474                         "dot11RSNAConfigPMKLifetime");
4475                 return -1;
4476         }
4477
4478         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4479             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4480                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4481                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4482                         "dot11RSNAConfigPMKReauthThreshold");
4483                 return -1;
4484         }
4485
4486         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4487             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4488                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4489                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4490                         "dot11RSNAConfigSATimeout");
4491                 return -1;
4492         }
4493
4494         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4495                                                       &wpa_s->hw.num_modes,
4496                                                       &wpa_s->hw.flags);
4497         if (wpa_s->hw.modes) {
4498                 u16 i;
4499
4500                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4501                         if (wpa_s->hw.modes[i].vht_capab) {
4502                                 wpa_s->hw_capab = CAPAB_VHT;
4503                                 break;
4504                         }
4505
4506                         if (wpa_s->hw.modes[i].ht_capab &
4507                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4508                                 wpa_s->hw_capab = CAPAB_HT40;
4509                         else if (wpa_s->hw.modes[i].ht_capab &&
4510                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4511                                 wpa_s->hw_capab = CAPAB_HT;
4512                 }
4513         }
4514
4515         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4516         if (capa_res == 0) {
4517                 wpa_s->drv_capa_known = 1;
4518                 wpa_s->drv_flags = capa.flags;
4519                 wpa_s->drv_enc = capa.enc;
4520                 wpa_s->drv_smps_modes = capa.smps_modes;
4521                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4522                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4523                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4524                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4525                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4526                 wpa_s->max_match_sets = capa.max_match_sets;
4527                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4528                 wpa_s->max_stations = capa.max_stations;
4529                 wpa_s->extended_capa = capa.extended_capa;
4530                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4531                 wpa_s->extended_capa_len = capa.extended_capa_len;
4532                 wpa_s->num_multichan_concurrent =
4533                         capa.num_multichan_concurrent;
4534                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4535
4536                 if (capa.mac_addr_rand_scan_supported)
4537                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4538                 if (wpa_s->sched_scan_supported &&
4539                     capa.mac_addr_rand_sched_scan_supported)
4540                         wpa_s->mac_addr_rand_supported |=
4541                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4542         }
4543         if (wpa_s->max_remain_on_chan == 0)
4544                 wpa_s->max_remain_on_chan = 1000;
4545
4546         /*
4547          * Only take p2p_mgmt parameters when P2P Device is supported.
4548          * Doing it here as it determines whether l2_packet_init() will be done
4549          * during wpa_supplicant_driver_init().
4550          */
4551         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4552                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4553         else
4554                 iface->p2p_mgmt = 1;
4555
4556         if (wpa_s->num_multichan_concurrent == 0)
4557                 wpa_s->num_multichan_concurrent = 1;
4558
4559         if (wpa_supplicant_driver_init(wpa_s) < 0)
4560                 return -1;
4561
4562 #ifdef CONFIG_TDLS
4563         if ((!iface->p2p_mgmt ||
4564              !(wpa_s->drv_flags &
4565                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4566             wpa_tdls_init(wpa_s->wpa))
4567                 return -1;
4568 #endif /* CONFIG_TDLS */
4569
4570         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4571             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4572                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4573                 return -1;
4574         }
4575
4576 #ifdef CONFIG_FST
4577         if (wpa_s->conf->fst_group_id) {
4578                 struct fst_iface_cfg cfg;
4579                 struct fst_wpa_obj iface_obj;
4580
4581                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4582                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4583                            sizeof(cfg.group_id));
4584                 cfg.priority = wpa_s->conf->fst_priority;
4585                 cfg.llt = wpa_s->conf->fst_llt;
4586
4587                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4588                                         &iface_obj, &cfg);
4589                 if (!wpa_s->fst) {
4590                         wpa_msg(wpa_s, MSG_ERROR,
4591                                 "FST: Cannot attach iface %s to group %s",
4592                                 wpa_s->ifname, cfg.group_id);
4593                         return -1;
4594                 }
4595         }
4596 #endif /* CONFIG_FST */
4597
4598         if (wpas_wps_init(wpa_s))
4599                 return -1;
4600
4601         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4602                 return -1;
4603         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4604
4605         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4606         if (wpa_s->ctrl_iface == NULL) {
4607                 wpa_printf(MSG_ERROR,
4608                            "Failed to initialize control interface '%s'.\n"
4609                            "You may have another wpa_supplicant process "
4610                            "already running or the file was\n"
4611                            "left by an unclean termination of wpa_supplicant "
4612                            "in which case you will need\n"
4613                            "to manually remove this file before starting "
4614                            "wpa_supplicant again.\n",
4615                            wpa_s->conf->ctrl_interface);
4616                 return -1;
4617         }
4618
4619         wpa_s->gas = gas_query_init(wpa_s);
4620         if (wpa_s->gas == NULL) {
4621                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4622                 return -1;
4623         }
4624
4625         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4626                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4627                 return -1;
4628         }
4629
4630         if (wpa_bss_init(wpa_s) < 0)
4631                 return -1;
4632
4633         /*
4634          * Set Wake-on-WLAN triggers, if configured.
4635          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4636          * have effect anyway when the interface is down).
4637          */
4638         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4639                 return -1;
4640
4641 #ifdef CONFIG_EAP_PROXY
4642 {
4643         size_t len;
4644         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4645                                                      &len);
4646         if (wpa_s->mnc_len > 0) {
4647                 wpa_s->imsi[len] = '\0';
4648                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4649                            wpa_s->imsi, wpa_s->mnc_len);
4650         } else {
4651                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4652         }
4653 }
4654 #endif /* CONFIG_EAP_PROXY */
4655
4656         if (pcsc_reader_init(wpa_s) < 0)
4657                 return -1;
4658
4659         if (wpas_init_ext_pw(wpa_s) < 0)
4660                 return -1;
4661
4662         wpas_rrm_reset(wpa_s);
4663
4664         return 0;
4665 }
4666
4667
4668 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4669                                         int notify, int terminate)
4670 {
4671         struct wpa_global *global = wpa_s->global;
4672         struct wpa_supplicant *iface, *prev;
4673
4674         if (wpa_s == wpa_s->parent)
4675                 wpas_p2p_group_remove(wpa_s, "*");
4676
4677         iface = global->ifaces;
4678         while (iface) {
4679                 if (iface == wpa_s || iface->parent != wpa_s) {
4680                         iface = iface->next;
4681                         continue;
4682                 }
4683                 wpa_printf(MSG_DEBUG,
4684                            "Remove remaining child interface %s from parent %s",
4685                            iface->ifname, wpa_s->ifname);
4686                 prev = iface;
4687                 iface = iface->next;
4688                 wpa_supplicant_remove_iface(global, prev, terminate);
4689         }
4690
4691         wpa_s->disconnected = 1;
4692         if (wpa_s->drv_priv) {
4693                 wpa_supplicant_deauthenticate(wpa_s,
4694                                               WLAN_REASON_DEAUTH_LEAVING);
4695
4696                 wpa_drv_set_countermeasures(wpa_s, 0);
4697                 wpa_clear_keys(wpa_s, NULL);
4698         }
4699
4700         wpa_supplicant_cleanup(wpa_s);
4701         wpas_p2p_deinit_iface(wpa_s);
4702
4703         wpas_ctrl_radio_work_flush(wpa_s);
4704         radio_remove_interface(wpa_s);
4705
4706 #ifdef CONFIG_FST
4707         if (wpa_s->fst) {
4708                 fst_detach(wpa_s->fst);
4709                 wpa_s->fst = NULL;
4710         }
4711         if (wpa_s->received_mb_ies) {
4712                 wpabuf_free(wpa_s->received_mb_ies);
4713                 wpa_s->received_mb_ies = NULL;
4714         }
4715 #endif /* CONFIG_FST */
4716
4717         if (wpa_s->drv_priv)
4718                 wpa_drv_deinit(wpa_s);
4719
4720         if (notify)
4721                 wpas_notify_iface_removed(wpa_s);
4722
4723         if (terminate)
4724                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4725
4726         if (wpa_s->ctrl_iface) {
4727                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4728                 wpa_s->ctrl_iface = NULL;
4729         }
4730
4731 #ifdef CONFIG_MESH
4732         if (wpa_s->ifmsh) {
4733                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4734                 wpa_s->ifmsh = NULL;
4735         }
4736 #endif /* CONFIG_MESH */
4737
4738         if (wpa_s->conf != NULL) {
4739                 wpa_config_free(wpa_s->conf);
4740                 wpa_s->conf = NULL;
4741         }
4742
4743         os_free(wpa_s->ssids_from_scan_req);
4744
4745         os_free(wpa_s);
4746 }
4747
4748
4749 /**
4750  * wpa_supplicant_add_iface - Add a new network interface
4751  * @global: Pointer to global data from wpa_supplicant_init()
4752  * @iface: Interface configuration options
4753  * @parent: Parent interface or %NULL to assign new interface as parent
4754  * Returns: Pointer to the created interface or %NULL on failure
4755  *
4756  * This function is used to add new network interfaces for %wpa_supplicant.
4757  * This can be called before wpa_supplicant_run() to add interfaces before the
4758  * main event loop has been started. In addition, new interfaces can be added
4759  * dynamically while %wpa_supplicant is already running. This could happen,
4760  * e.g., when a hotplug network adapter is inserted.
4761  */
4762 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
4763                                                  struct wpa_interface *iface,
4764                                                  struct wpa_supplicant *parent)
4765 {
4766         struct wpa_supplicant *wpa_s;
4767         struct wpa_interface t_iface;
4768         struct wpa_ssid *ssid;
4769
4770         if (global == NULL || iface == NULL)
4771                 return NULL;
4772
4773         wpa_s = wpa_supplicant_alloc(parent);
4774         if (wpa_s == NULL)
4775                 return NULL;
4776
4777         wpa_s->global = global;
4778
4779         t_iface = *iface;
4780         if (global->params.override_driver) {
4781                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
4782                            "('%s' -> '%s')",
4783                            iface->driver, global->params.override_driver);
4784                 t_iface.driver = global->params.override_driver;
4785         }
4786         if (global->params.override_ctrl_interface) {
4787                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
4788                            "ctrl_interface ('%s' -> '%s')",
4789                            iface->ctrl_interface,
4790                            global->params.override_ctrl_interface);
4791                 t_iface.ctrl_interface =
4792                         global->params.override_ctrl_interface;
4793         }
4794         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
4795                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
4796                            iface->ifname);
4797                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
4798                 return NULL;
4799         }
4800
4801         if (iface->p2p_mgmt == 0) {
4802                 /* Notify the control interfaces about new iface */
4803                 if (wpas_notify_iface_added(wpa_s)) {
4804                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
4805                         return NULL;
4806                 }
4807
4808                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
4809                         wpas_notify_network_added(wpa_s, ssid);
4810         }
4811
4812         wpa_s->next = global->ifaces;
4813         global->ifaces = wpa_s;
4814
4815         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
4816         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
4817
4818 #ifdef CONFIG_P2P
4819         if (wpa_s->global->p2p == NULL &&
4820             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
4821             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
4822             wpas_p2p_add_p2pdev_interface(
4823                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
4824                 wpa_printf(MSG_INFO,
4825                            "P2P: Failed to enable P2P Device interface");
4826                 /* Try to continue without. P2P will be disabled. */
4827         }
4828 #endif /* CONFIG_P2P */
4829
4830         return wpa_s;
4831 }
4832
4833
4834 /**
4835  * wpa_supplicant_remove_iface - Remove a network interface
4836  * @global: Pointer to global data from wpa_supplicant_init()
4837  * @wpa_s: Pointer to the network interface to be removed
4838  * Returns: 0 if interface was removed, -1 if interface was not found
4839  *
4840  * This function can be used to dynamically remove network interfaces from
4841  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
4842  * addition, this function is used to remove all remaining interfaces when
4843  * %wpa_supplicant is terminated.
4844  */
4845 int wpa_supplicant_remove_iface(struct wpa_global *global,
4846                                 struct wpa_supplicant *wpa_s,
4847                                 int terminate)
4848 {
4849         struct wpa_supplicant *prev;
4850 #ifdef CONFIG_MESH
4851         unsigned int mesh_if_created = wpa_s->mesh_if_created;
4852         char *ifname = NULL;
4853 #endif /* CONFIG_MESH */
4854
4855         /* Remove interface from the global list of interfaces */
4856         prev = global->ifaces;
4857         if (prev == wpa_s) {
4858                 global->ifaces = wpa_s->next;
4859         } else {
4860                 while (prev && prev->next != wpa_s)
4861                         prev = prev->next;
4862                 if (prev == NULL)
4863                         return -1;
4864                 prev->next = wpa_s->next;
4865         }
4866
4867         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
4868
4869 #ifdef CONFIG_MESH
4870         if (mesh_if_created) {
4871                 ifname = os_strdup(wpa_s->ifname);
4872                 if (ifname == NULL) {
4873                         wpa_dbg(wpa_s, MSG_ERROR,
4874                                 "mesh: Failed to malloc ifname");
4875                         return -1;
4876                 }
4877         }
4878 #endif /* CONFIG_MESH */
4879
4880         if (global->p2p_group_formation == wpa_s)
4881                 global->p2p_group_formation = NULL;
4882         if (global->p2p_invite_group == wpa_s)
4883                 global->p2p_invite_group = NULL;
4884         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
4885
4886 #ifdef CONFIG_MESH
4887         if (mesh_if_created) {
4888                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
4889                 os_free(ifname);
4890         }
4891 #endif /* CONFIG_MESH */
4892
4893         return 0;
4894 }
4895
4896
4897 /**
4898  * wpa_supplicant_get_eap_mode - Get the current EAP mode
4899  * @wpa_s: Pointer to the network interface
4900  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
4901  */
4902 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
4903 {
4904         const char *eapol_method;
4905
4906         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
4907             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
4908                 return "NO-EAP";
4909         }
4910
4911         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
4912         if (eapol_method == NULL)
4913                 return "UNKNOWN-EAP";
4914
4915         return eapol_method;
4916 }
4917
4918
4919 /**
4920  * wpa_supplicant_get_iface - Get a new network interface
4921  * @global: Pointer to global data from wpa_supplicant_init()
4922  * @ifname: Interface name
4923  * Returns: Pointer to the interface or %NULL if not found
4924  */
4925 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
4926                                                  const char *ifname)
4927 {
4928         struct wpa_supplicant *wpa_s;
4929
4930         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4931                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
4932                         return wpa_s;
4933         }
4934         return NULL;
4935 }
4936
4937
4938 #ifndef CONFIG_NO_WPA_MSG
4939 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
4940 {
4941         struct wpa_supplicant *wpa_s = ctx;
4942         if (wpa_s == NULL)
4943                 return NULL;
4944         return wpa_s->ifname;
4945 }
4946 #endif /* CONFIG_NO_WPA_MSG */
4947
4948
4949 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
4950 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
4951 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
4952
4953 /* Periodic cleanup tasks */
4954 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
4955 {
4956         struct wpa_global *global = eloop_ctx;
4957         struct wpa_supplicant *wpa_s;
4958
4959         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
4960                                wpas_periodic, global, NULL);
4961
4962 #ifdef CONFIG_P2P
4963         if (global->p2p)
4964                 p2p_expire_peers(global->p2p);
4965 #endif /* CONFIG_P2P */
4966
4967         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
4968                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
4969 #ifdef CONFIG_AP
4970                 ap_periodic(wpa_s);
4971 #endif /* CONFIG_AP */
4972         }
4973 }
4974
4975
4976 /**
4977  * wpa_supplicant_init - Initialize %wpa_supplicant
4978  * @params: Parameters for %wpa_supplicant
4979  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
4980  *
4981  * This function is used to initialize %wpa_supplicant. After successful
4982  * initialization, the returned data pointer can be used to add and remove
4983  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
4984  */
4985 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
4986 {
4987         struct wpa_global *global;
4988         int ret, i;
4989
4990         if (params == NULL)
4991                 return NULL;
4992
4993 #ifdef CONFIG_DRIVER_NDIS
4994         {
4995                 void driver_ndis_init_ops(void);
4996                 driver_ndis_init_ops();
4997         }
4998 #endif /* CONFIG_DRIVER_NDIS */
4999
5000 #ifndef CONFIG_NO_WPA_MSG
5001         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5002 #endif /* CONFIG_NO_WPA_MSG */
5003
5004         if (params->wpa_debug_file_path)
5005                 wpa_debug_open_file(params->wpa_debug_file_path);
5006         else
5007                 wpa_debug_setup_stdout();
5008         if (params->wpa_debug_syslog)
5009                 wpa_debug_open_syslog();
5010         if (params->wpa_debug_tracing) {
5011                 ret = wpa_debug_open_linux_tracing();
5012                 if (ret) {
5013                         wpa_printf(MSG_ERROR,
5014                                    "Failed to enable trace logging");
5015                         return NULL;
5016                 }
5017         }
5018
5019         ret = eap_register_methods();
5020         if (ret) {
5021                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5022                 if (ret == -2)
5023                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5024                                    "the same EAP type.");
5025                 return NULL;
5026         }
5027
5028         global = os_zalloc(sizeof(*global));
5029         if (global == NULL)
5030                 return NULL;
5031         dl_list_init(&global->p2p_srv_bonjour);
5032         dl_list_init(&global->p2p_srv_upnp);
5033         global->params.daemonize = params->daemonize;
5034         global->params.wait_for_monitor = params->wait_for_monitor;
5035         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5036         if (params->pid_file)
5037                 global->params.pid_file = os_strdup(params->pid_file);
5038         if (params->ctrl_interface)
5039                 global->params.ctrl_interface =
5040                         os_strdup(params->ctrl_interface);
5041         if (params->ctrl_interface_group)
5042                 global->params.ctrl_interface_group =
5043                         os_strdup(params->ctrl_interface_group);
5044         if (params->override_driver)
5045                 global->params.override_driver =
5046                         os_strdup(params->override_driver);
5047         if (params->override_ctrl_interface)
5048                 global->params.override_ctrl_interface =
5049                         os_strdup(params->override_ctrl_interface);
5050 #ifdef CONFIG_P2P
5051         if (params->conf_p2p_dev)
5052                 global->params.conf_p2p_dev =
5053                         os_strdup(params->conf_p2p_dev);
5054 #endif /* CONFIG_P2P */
5055         wpa_debug_level = global->params.wpa_debug_level =
5056                 params->wpa_debug_level;
5057         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5058                 params->wpa_debug_show_keys;
5059         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5060                 params->wpa_debug_timestamp;
5061
5062         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5063
5064         if (eloop_init()) {
5065                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5066                 wpa_supplicant_deinit(global);
5067                 return NULL;
5068         }
5069
5070         random_init(params->entropy_file);
5071
5072         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5073         if (global->ctrl_iface == NULL) {
5074                 wpa_supplicant_deinit(global);
5075                 return NULL;
5076         }
5077
5078         if (wpas_notify_supplicant_initialized(global)) {
5079                 wpa_supplicant_deinit(global);
5080                 return NULL;
5081         }
5082
5083         for (i = 0; wpa_drivers[i]; i++)
5084                 global->drv_count++;
5085         if (global->drv_count == 0) {
5086                 wpa_printf(MSG_ERROR, "No drivers enabled");
5087                 wpa_supplicant_deinit(global);
5088                 return NULL;
5089         }
5090         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5091         if (global->drv_priv == NULL) {
5092                 wpa_supplicant_deinit(global);
5093                 return NULL;
5094         }
5095
5096 #ifdef CONFIG_WIFI_DISPLAY
5097         if (wifi_display_init(global) < 0) {
5098                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5099                 wpa_supplicant_deinit(global);
5100                 return NULL;
5101         }
5102 #endif /* CONFIG_WIFI_DISPLAY */
5103
5104         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5105                                wpas_periodic, global, NULL);
5106
5107         return global;
5108 }
5109
5110
5111 /**
5112  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5113  * @global: Pointer to global data from wpa_supplicant_init()
5114  * Returns: 0 after successful event loop run, -1 on failure
5115  *
5116  * This function starts the main event loop and continues running as long as
5117  * there are any remaining events. In most cases, this function is running as
5118  * long as the %wpa_supplicant process in still in use.
5119  */
5120 int wpa_supplicant_run(struct wpa_global *global)
5121 {
5122         struct wpa_supplicant *wpa_s;
5123
5124         if (global->params.daemonize &&
5125             wpa_supplicant_daemon(global->params.pid_file))
5126                 return -1;
5127
5128         if (global->params.wait_for_monitor) {
5129                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5130                         if (wpa_s->ctrl_iface)
5131                                 wpa_supplicant_ctrl_iface_wait(
5132                                         wpa_s->ctrl_iface);
5133         }
5134
5135         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5136         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5137
5138         eloop_run();
5139
5140         return 0;
5141 }
5142
5143
5144 /**
5145  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5146  * @global: Pointer to global data from wpa_supplicant_init()
5147  *
5148  * This function is called to deinitialize %wpa_supplicant and to free all
5149  * allocated resources. Remaining network interfaces will also be removed.
5150  */
5151 void wpa_supplicant_deinit(struct wpa_global *global)
5152 {
5153         int i;
5154
5155         if (global == NULL)
5156                 return;
5157
5158         eloop_cancel_timeout(wpas_periodic, global, NULL);
5159
5160 #ifdef CONFIG_WIFI_DISPLAY
5161         wifi_display_deinit(global);
5162 #endif /* CONFIG_WIFI_DISPLAY */
5163
5164         while (global->ifaces)
5165                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5166
5167         if (global->ctrl_iface)
5168                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5169
5170         wpas_notify_supplicant_deinitialized(global);
5171
5172         eap_peer_unregister_methods();
5173 #ifdef CONFIG_AP
5174         eap_server_unregister_methods();
5175 #endif /* CONFIG_AP */
5176
5177         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5178                 if (!global->drv_priv[i])
5179                         continue;
5180                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5181         }
5182         os_free(global->drv_priv);
5183
5184         random_deinit();
5185
5186         eloop_destroy();
5187
5188         if (global->params.pid_file) {
5189                 os_daemonize_terminate(global->params.pid_file);
5190                 os_free(global->params.pid_file);
5191         }
5192         os_free(global->params.ctrl_interface);
5193         os_free(global->params.ctrl_interface_group);
5194         os_free(global->params.override_driver);
5195         os_free(global->params.override_ctrl_interface);
5196 #ifdef CONFIG_P2P
5197         os_free(global->params.conf_p2p_dev);
5198 #endif /* CONFIG_P2P */
5199
5200         os_free(global->p2p_disallow_freq.range);
5201         os_free(global->p2p_go_avoid_freq.range);
5202         os_free(global->add_psk);
5203
5204         os_free(global);
5205         wpa_debug_close_syslog();
5206         wpa_debug_close_file();
5207         wpa_debug_close_linux_tracing();
5208 }
5209
5210
5211 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5212 {
5213         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5214             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5215                 char country[3];
5216                 country[0] = wpa_s->conf->country[0];
5217                 country[1] = wpa_s->conf->country[1];
5218                 country[2] = '\0';
5219                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5220                         wpa_printf(MSG_ERROR, "Failed to set country code "
5221                                    "'%s'", country);
5222                 }
5223         }
5224
5225         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5226                 wpas_init_ext_pw(wpa_s);
5227
5228 #ifdef CONFIG_WPS
5229         wpas_wps_update_config(wpa_s);
5230 #endif /* CONFIG_WPS */
5231         wpas_p2p_update_config(wpa_s);
5232         wpa_s->conf->changed_parameters = 0;
5233 }
5234
5235
5236 void add_freq(int *freqs, int *num_freqs, int freq)
5237 {
5238         int i;
5239
5240         for (i = 0; i < *num_freqs; i++) {
5241                 if (freqs[i] == freq)
5242                         return;
5243         }
5244
5245         freqs[*num_freqs] = freq;
5246         (*num_freqs)++;
5247 }
5248
5249
5250 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5251 {
5252         struct wpa_bss *bss, *cbss;
5253         const int max_freqs = 10;
5254         int *freqs;
5255         int num_freqs = 0;
5256
5257         freqs = os_calloc(max_freqs + 1, sizeof(int));
5258         if (freqs == NULL)
5259                 return NULL;
5260
5261         cbss = wpa_s->current_bss;
5262
5263         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5264                 if (bss == cbss)
5265                         continue;
5266                 if (bss->ssid_len == cbss->ssid_len &&
5267                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5268                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5269                         add_freq(freqs, &num_freqs, bss->freq);
5270                         if (num_freqs == max_freqs)
5271                                 break;
5272                 }
5273         }
5274
5275         if (num_freqs == 0) {
5276                 os_free(freqs);
5277                 freqs = NULL;
5278         }
5279
5280         return freqs;
5281 }
5282
5283
5284 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5285 {
5286         int timeout;
5287         int count;
5288         int *freqs = NULL;
5289
5290         wpas_connect_work_done(wpa_s);
5291
5292         /*
5293          * Remove possible authentication timeout since the connection failed.
5294          */
5295         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5296
5297         /*
5298          * There is no point in blacklisting the AP if this event is
5299          * generated based on local request to disconnect.
5300          */
5301         if (wpa_s->own_disconnect_req) {
5302                 wpa_s->own_disconnect_req = 0;
5303                 wpa_dbg(wpa_s, MSG_DEBUG,
5304                         "Ignore connection failure due to local request to disconnect");
5305                 return;
5306         }
5307         if (wpa_s->disconnected) {
5308                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5309                         "indication since interface has been put into "
5310                         "disconnected state");
5311                 return;
5312         }
5313
5314         /*
5315          * Add the failed BSSID into the blacklist and speed up next scan
5316          * attempt if there could be other APs that could accept association.
5317          * The current blacklist count indicates how many times we have tried
5318          * connecting to this AP and multiple attempts mean that other APs are
5319          * either not available or has already been tried, so that we can start
5320          * increasing the delay here to avoid constant scanning.
5321          */
5322         count = wpa_blacklist_add(wpa_s, bssid);
5323         if (count == 1 && wpa_s->current_bss) {
5324                 /*
5325                  * This BSS was not in the blacklist before. If there is
5326                  * another BSS available for the same ESS, we should try that
5327                  * next. Otherwise, we may as well try this one once more
5328                  * before allowing other, likely worse, ESSes to be considered.
5329                  */
5330                 freqs = get_bss_freqs_in_ess(wpa_s);
5331                 if (freqs) {
5332                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5333                                 "has been seen; try it next");
5334                         wpa_blacklist_add(wpa_s, bssid);
5335                         /*
5336                          * On the next scan, go through only the known channels
5337                          * used in this ESS based on previous scans to speed up
5338                          * common load balancing use case.
5339                          */
5340                         os_free(wpa_s->next_scan_freqs);
5341                         wpa_s->next_scan_freqs = freqs;
5342                 }
5343         }
5344
5345         /*
5346          * Add previous failure count in case the temporary blacklist was
5347          * cleared due to no other BSSes being available.
5348          */
5349         count += wpa_s->extra_blacklist_count;
5350
5351         if (count > 3 && wpa_s->current_ssid) {
5352                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5353                            "consider temporary network disabling");
5354                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5355         }
5356
5357         switch (count) {
5358         case 1:
5359                 timeout = 100;
5360                 break;
5361         case 2:
5362                 timeout = 500;
5363                 break;
5364         case 3:
5365                 timeout = 1000;
5366                 break;
5367         case 4:
5368                 timeout = 5000;
5369                 break;
5370         default:
5371                 timeout = 10000;
5372                 break;
5373         }
5374
5375         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5376                 "ms", count, timeout);
5377
5378         /*
5379          * TODO: if more than one possible AP is available in scan results,
5380          * could try the other ones before requesting a new scan.
5381          */
5382         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5383                                 1000 * (timeout % 1000));
5384 }
5385
5386
5387 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5388 {
5389         return wpa_s->conf->ap_scan == 2 ||
5390                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5391 }
5392
5393
5394 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5395 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5396                                               struct wpa_ssid *ssid,
5397                                               const char *field,
5398                                               const char *value)
5399 {
5400 #ifdef IEEE8021X_EAPOL
5401         struct eap_peer_config *eap = &ssid->eap;
5402
5403         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5404         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5405                               (const u8 *) value, os_strlen(value));
5406
5407         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5408         case WPA_CTRL_REQ_EAP_IDENTITY:
5409                 os_free(eap->identity);
5410                 eap->identity = (u8 *) os_strdup(value);
5411                 eap->identity_len = os_strlen(value);
5412                 eap->pending_req_identity = 0;
5413                 if (ssid == wpa_s->current_ssid)
5414                         wpa_s->reassociate = 1;
5415                 break;
5416         case WPA_CTRL_REQ_EAP_PASSWORD:
5417                 bin_clear_free(eap->password, eap->password_len);
5418                 eap->password = (u8 *) os_strdup(value);
5419                 eap->password_len = os_strlen(value);
5420                 eap->pending_req_password = 0;
5421                 if (ssid == wpa_s->current_ssid)
5422                         wpa_s->reassociate = 1;
5423                 break;
5424         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5425                 bin_clear_free(eap->new_password, eap->new_password_len);
5426                 eap->new_password = (u8 *) os_strdup(value);
5427                 eap->new_password_len = os_strlen(value);
5428                 eap->pending_req_new_password = 0;
5429                 if (ssid == wpa_s->current_ssid)
5430                         wpa_s->reassociate = 1;
5431                 break;
5432         case WPA_CTRL_REQ_EAP_PIN:
5433                 str_clear_free(eap->pin);
5434                 eap->pin = os_strdup(value);
5435                 eap->pending_req_pin = 0;
5436                 if (ssid == wpa_s->current_ssid)
5437                         wpa_s->reassociate = 1;
5438                 break;
5439         case WPA_CTRL_REQ_EAP_OTP:
5440                 bin_clear_free(eap->otp, eap->otp_len);
5441                 eap->otp = (u8 *) os_strdup(value);
5442                 eap->otp_len = os_strlen(value);
5443                 os_free(eap->pending_req_otp);
5444                 eap->pending_req_otp = NULL;
5445                 eap->pending_req_otp_len = 0;
5446                 break;
5447         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5448                 str_clear_free(eap->private_key_passwd);
5449                 eap->private_key_passwd = os_strdup(value);
5450                 eap->pending_req_passphrase = 0;
5451                 if (ssid == wpa_s->current_ssid)
5452                         wpa_s->reassociate = 1;
5453                 break;
5454         case WPA_CTRL_REQ_SIM:
5455                 str_clear_free(eap->external_sim_resp);
5456                 eap->external_sim_resp = os_strdup(value);
5457                 break;
5458         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5459                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5460                         return -1;
5461                 ssid->mem_only_psk = 1;
5462                 if (ssid->passphrase)
5463                         wpa_config_update_psk(ssid);
5464                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5465                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5466                 break;
5467         default:
5468                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5469                 return -1;
5470         }
5471
5472         return 0;
5473 #else /* IEEE8021X_EAPOL */
5474         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5475         return -1;
5476 #endif /* IEEE8021X_EAPOL */
5477 }
5478 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5479
5480
5481 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5482 {
5483         int i;
5484         unsigned int drv_enc;
5485
5486         if (wpa_s->p2p_mgmt)
5487                 return 1; /* no normal network profiles on p2p_mgmt interface */
5488
5489         if (ssid == NULL)
5490                 return 1;
5491
5492         if (ssid->disabled)
5493                 return 1;
5494
5495         if (wpa_s->drv_capa_known)
5496                 drv_enc = wpa_s->drv_enc;
5497         else
5498                 drv_enc = (unsigned int) -1;
5499
5500         for (i = 0; i < NUM_WEP_KEYS; i++) {
5501                 size_t len = ssid->wep_key_len[i];
5502                 if (len == 0)
5503                         continue;
5504                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5505                         continue;
5506                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5507                         continue;
5508                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5509                         continue;
5510                 return 1; /* invalid WEP key */
5511         }
5512
5513         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5514             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5515             !ssid->mem_only_psk)
5516                 return 1;
5517
5518         return 0;
5519 }
5520
5521
5522 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5523 {
5524 #ifdef CONFIG_IEEE80211W
5525         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5526                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5527                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5528                         /*
5529                          * Driver does not support BIP -- ignore pmf=1 default
5530                          * since the connection with PMF would fail and the
5531                          * configuration does not require PMF to be enabled.
5532                          */
5533                         return NO_MGMT_FRAME_PROTECTION;
5534                 }
5535
5536                 return wpa_s->conf->pmf;
5537         }
5538
5539         return ssid->ieee80211w;
5540 #else /* CONFIG_IEEE80211W */
5541         return NO_MGMT_FRAME_PROTECTION;
5542 #endif /* CONFIG_IEEE80211W */
5543 }
5544
5545
5546 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5547 {
5548         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5549                 return 1;
5550         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5551                 return 0;
5552         return -1;
5553 }
5554
5555
5556 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5557 {
5558         struct wpa_ssid *ssid = wpa_s->current_ssid;
5559         int dur;
5560         struct os_reltime now;
5561
5562         if (ssid == NULL) {
5563                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5564                            "SSID block");
5565                 return;
5566         }
5567
5568         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5569                 return;
5570
5571         ssid->auth_failures++;
5572
5573 #ifdef CONFIG_P2P
5574         if (ssid->p2p_group &&
5575             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5576                 /*
5577                  * Skip the wait time since there is a short timeout on the
5578                  * connection to a P2P group.
5579                  */
5580                 return;
5581         }
5582 #endif /* CONFIG_P2P */
5583
5584         if (ssid->auth_failures > 50)
5585                 dur = 300;
5586         else if (ssid->auth_failures > 10)
5587                 dur = 120;
5588         else if (ssid->auth_failures > 5)
5589                 dur = 90;
5590         else if (ssid->auth_failures > 3)
5591                 dur = 60;
5592         else if (ssid->auth_failures > 2)
5593                 dur = 30;
5594         else if (ssid->auth_failures > 1)
5595                 dur = 20;
5596         else
5597                 dur = 10;
5598
5599         if (ssid->auth_failures > 1 &&
5600             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5601                 dur += os_random() % (ssid->auth_failures * 10);
5602
5603         os_get_reltime(&now);
5604         if (now.sec + dur <= ssid->disabled_until.sec)
5605                 return;
5606
5607         ssid->disabled_until.sec = now.sec + dur;
5608
5609         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5610                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5611                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5612                 ssid->auth_failures, dur, reason);
5613 }
5614
5615
5616 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5617                               struct wpa_ssid *ssid, int clear_failures)
5618 {
5619         if (ssid == NULL)
5620                 return;
5621
5622         if (ssid->disabled_until.sec) {
5623                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5624                         "id=%d ssid=\"%s\"",
5625                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5626         }
5627         ssid->disabled_until.sec = 0;
5628         ssid->disabled_until.usec = 0;
5629         if (clear_failures)
5630                 ssid->auth_failures = 0;
5631 }
5632
5633
5634 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5635 {
5636         size_t i;
5637
5638         if (wpa_s->disallow_aps_bssid == NULL)
5639                 return 0;
5640
5641         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5642                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5643                               bssid, ETH_ALEN) == 0)
5644                         return 1;
5645         }
5646
5647         return 0;
5648 }
5649
5650
5651 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5652                     size_t ssid_len)
5653 {
5654         size_t i;
5655
5656         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5657                 return 0;
5658
5659         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5660                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5661                 if (ssid_len == s->ssid_len &&
5662                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5663                         return 1;
5664         }
5665
5666         return 0;
5667 }
5668
5669
5670 /**
5671  * wpas_request_connection - Request a new connection
5672  * @wpa_s: Pointer to the network interface
5673  *
5674  * This function is used to request a new connection to be found. It will mark
5675  * the interface to allow reassociation and request a new scan to find a
5676  * suitable network to connect to.
5677  */
5678 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5679 {
5680         wpa_s->normal_scans = 0;
5681         wpa_s->scan_req = NORMAL_SCAN_REQ;
5682         wpa_supplicant_reinit_autoscan(wpa_s);
5683         wpa_s->extra_blacklist_count = 0;
5684         wpa_s->disconnected = 0;
5685         wpa_s->reassociate = 1;
5686
5687         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5688                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5689         else
5690                 wpa_s->reattach = 0;
5691 }
5692
5693
5694 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5695                     struct wpa_used_freq_data *freqs_data,
5696                     unsigned int len)
5697 {
5698         unsigned int i;
5699
5700         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5701                 len, title);
5702         for (i = 0; i < len; i++) {
5703                 struct wpa_used_freq_data *cur = &freqs_data[i];
5704                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5705                         i, cur->freq, cur->flags);
5706         }
5707 }
5708
5709
5710 /*
5711  * Find the operating frequencies of any of the virtual interfaces that
5712  * are using the same radio as the current interface, and in addition, get
5713  * information about the interface types that are using the frequency.
5714  */
5715 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5716                                 struct wpa_used_freq_data *freqs_data,
5717                                 unsigned int len)
5718 {
5719         struct wpa_supplicant *ifs;
5720         u8 bssid[ETH_ALEN];
5721         int freq;
5722         unsigned int idx = 0, i;
5723
5724         wpa_dbg(wpa_s, MSG_DEBUG,
5725                 "Determining shared radio frequencies (max len %u)", len);
5726         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5727
5728         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
5729                          radio_list) {
5730                 if (idx == len)
5731                         break;
5732
5733                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
5734                         continue;
5735
5736                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
5737                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
5738                     ifs->current_ssid->mode == WPAS_MODE_MESH)
5739                         freq = ifs->current_ssid->frequency;
5740                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
5741                         freq = ifs->assoc_freq;
5742                 else
5743                         continue;
5744
5745                 /* Hold only distinct freqs */
5746                 for (i = 0; i < idx; i++)
5747                         if (freqs_data[i].freq == freq)
5748                                 break;
5749
5750                 if (i == idx)
5751                         freqs_data[idx++].freq = freq;
5752
5753                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
5754                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
5755                                 WPA_FREQ_USED_BY_P2P_CLIENT :
5756                                 WPA_FREQ_USED_BY_INFRA_STATION;
5757                 }
5758         }
5759
5760         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
5761         return idx;
5762 }
5763
5764
5765 /*
5766  * Find the operating frequencies of any of the virtual interfaces that
5767  * are using the same radio as the current interface.
5768  */
5769 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
5770                            int *freq_array, unsigned int len)
5771 {
5772         struct wpa_used_freq_data *freqs_data;
5773         int num, i;
5774
5775         os_memset(freq_array, 0, sizeof(int) * len);
5776
5777         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
5778         if (!freqs_data)
5779                 return -1;
5780
5781         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
5782         for (i = 0; i < num; i++)
5783                 freq_array[i] = freqs_data[i].freq;
5784
5785         os_free(freqs_data);
5786
5787         return num;
5788 }
5789
5790
5791 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
5792 {
5793         struct rrm_data *rrm = data;
5794
5795         if (!rrm->notify_neighbor_rep) {
5796                 wpa_printf(MSG_ERROR,
5797                            "RRM: Unexpected neighbor report timeout");
5798                 return;
5799         }
5800
5801         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
5802         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
5803
5804         rrm->notify_neighbor_rep = NULL;
5805         rrm->neighbor_rep_cb_ctx = NULL;
5806 }
5807
5808
5809 /*
5810  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
5811  * @wpa_s: Pointer to wpa_supplicant
5812  */
5813 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
5814 {
5815         wpa_s->rrm.rrm_used = 0;
5816
5817         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5818                              NULL);
5819         if (wpa_s->rrm.notify_neighbor_rep)
5820                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
5821         wpa_s->rrm.next_neighbor_rep_token = 1;
5822 }
5823
5824
5825 /*
5826  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
5827  * @wpa_s: Pointer to wpa_supplicant
5828  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
5829  * @report_len: Length of neighbor report buffer
5830  */
5831 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
5832                                    const u8 *report, size_t report_len)
5833 {
5834         struct wpabuf *neighbor_rep;
5835
5836         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
5837         if (report_len < 1)
5838                 return;
5839
5840         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
5841                 wpa_printf(MSG_DEBUG,
5842                            "RRM: Discarding neighbor report with token %d (expected %d)",
5843                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
5844                 return;
5845         }
5846
5847         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
5848                              NULL);
5849
5850         if (!wpa_s->rrm.notify_neighbor_rep) {
5851                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
5852                 return;
5853         }
5854
5855         /* skipping the first byte, which is only an id (dialog token) */
5856         neighbor_rep = wpabuf_alloc(report_len - 1);
5857         if (neighbor_rep == NULL)
5858                 return;
5859         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
5860         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
5861                    report[0]);
5862         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
5863                                        neighbor_rep);
5864         wpa_s->rrm.notify_neighbor_rep = NULL;
5865         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
5866 }
5867
5868
5869 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
5870 /* Workaround different, undefined for Windows, error codes used here */
5871 #define ENOTCONN -1
5872 #define EOPNOTSUPP -1
5873 #define ECANCELED -1
5874 #endif
5875
5876 /**
5877  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
5878  * @wpa_s: Pointer to wpa_supplicant
5879  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
5880  *        is sent in the request.
5881  * @cb: Callback function to be called once the requested report arrives, or
5882  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
5883  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
5884  *      the requester's responsibility to free it.
5885  *      In the latter case NULL will be sent in 'neighbor_rep'.
5886  * @cb_ctx: Context value to send the callback function
5887  * Returns: 0 in case of success, negative error code otherwise
5888  *
5889  * In case there is a previous request which has not been answered yet, the
5890  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
5891  * Request must contain a callback function.
5892  */
5893 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
5894                                        const struct wpa_ssid *ssid,
5895                                        void (*cb)(void *ctx,
5896                                                   struct wpabuf *neighbor_rep),
5897                                        void *cb_ctx)
5898 {
5899         struct wpabuf *buf;
5900         const u8 *rrm_ie;
5901
5902         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
5903                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
5904                 return -ENOTCONN;
5905         }
5906
5907         if (!wpa_s->rrm.rrm_used) {
5908                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
5909                 return -EOPNOTSUPP;
5910         }
5911
5912         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
5913                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
5914         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
5915             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
5916                 wpa_printf(MSG_DEBUG,
5917                            "RRM: No network support for Neighbor Report.");
5918                 return -EOPNOTSUPP;
5919         }
5920
5921         if (!cb) {
5922                 wpa_printf(MSG_DEBUG,
5923                            "RRM: Neighbor Report request must provide a callback.");
5924                 return -EINVAL;
5925         }
5926
5927         /* Refuse if there's a live request */
5928         if (wpa_s->rrm.notify_neighbor_rep) {
5929                 wpa_printf(MSG_DEBUG,
5930                            "RRM: Currently handling previous Neighbor Report.");
5931                 return -EBUSY;
5932         }
5933
5934         /* 3 = action category + action code + dialog token */
5935         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
5936         if (buf == NULL) {
5937                 wpa_printf(MSG_DEBUG,
5938                            "RRM: Failed to allocate Neighbor Report Request");
5939                 return -ENOMEM;
5940         }
5941
5942         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
5943                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
5944                    wpa_s->rrm.next_neighbor_rep_token);
5945
5946         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
5947         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
5948         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
5949         if (ssid) {
5950                 wpabuf_put_u8(buf, WLAN_EID_SSID);
5951                 wpabuf_put_u8(buf, ssid->ssid_len);
5952                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
5953         }
5954
5955         wpa_s->rrm.next_neighbor_rep_token++;
5956
5957         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
5958                                 wpa_s->own_addr, wpa_s->bssid,
5959                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
5960                 wpa_printf(MSG_DEBUG,
5961                            "RRM: Failed to send Neighbor Report Request");
5962                 wpabuf_free(buf);
5963                 return -ECANCELED;
5964         }
5965
5966         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
5967         wpa_s->rrm.notify_neighbor_rep = cb;
5968         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
5969                                wpas_rrm_neighbor_rep_timeout_handler,
5970                                &wpa_s->rrm, NULL);
5971
5972         wpabuf_free(buf);
5973         return 0;
5974 }
5975
5976
5977 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
5978                                               const u8 *src,
5979                                               const u8 *frame, size_t len,
5980                                               int rssi)
5981 {
5982         struct wpabuf *buf;
5983         const struct rrm_link_measurement_request *req;
5984         struct rrm_link_measurement_report report;
5985
5986         if (wpa_s->wpa_state != WPA_COMPLETED) {
5987                 wpa_printf(MSG_INFO,
5988                            "RRM: Ignoring link measurement request. Not associated");
5989                 return;
5990         }
5991
5992         if (!wpa_s->rrm.rrm_used) {
5993                 wpa_printf(MSG_INFO,
5994                            "RRM: Ignoring link measurement request. Not RRM network");
5995                 return;
5996         }
5997
5998         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
5999                 wpa_printf(MSG_INFO,
6000                            "RRM: Measurement report failed. TX power insertion not supported");
6001                 return;
6002         }
6003
6004         req = (const struct rrm_link_measurement_request *) frame;
6005         if (len < sizeof(*req)) {
6006                 wpa_printf(MSG_INFO,
6007                            "RRM: Link measurement report failed. Request too short");
6008                 return;
6009         }
6010
6011         os_memset(&report, 0, sizeof(report));
6012         report.tpc.eid = WLAN_EID_TPC_REPORT;
6013         report.tpc.len = 2;
6014         report.rsni = 255; /* 255 indicates that RSNI is not available */
6015         report.dialog_token = req->dialog_token;
6016
6017         /*
6018          * It's possible to estimate RCPI based on RSSI in dBm. This
6019          * calculation will not reflect the correct value for high rates,
6020          * but it's good enough for Action frames which are transmitted
6021          * with up to 24 Mbps rates.
6022          */
6023         if (!rssi)
6024                 report.rcpi = 255; /* not available */
6025         else if (rssi < -110)
6026                 report.rcpi = 0;
6027         else if (rssi > 0)
6028                 report.rcpi = 220;
6029         else
6030                 report.rcpi = (rssi + 110) * 2;
6031
6032         /* action_category + action_code */
6033         buf = wpabuf_alloc(2 + sizeof(report));
6034         if (buf == NULL) {
6035                 wpa_printf(MSG_ERROR,
6036                            "RRM: Link measurement report failed. Buffer allocation failed");
6037                 return;
6038         }
6039
6040         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6041         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6042         wpabuf_put_data(buf, &report, sizeof(report));
6043         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6044                     wpabuf_head(buf), wpabuf_len(buf));
6045
6046         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6047                                 wpa_s->own_addr, wpa_s->bssid,
6048                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6049                 wpa_printf(MSG_ERROR,
6050                            "RRM: Link measurement report failed. Send action failed");
6051         }
6052         wpabuf_free(buf);
6053 }