Interworking: Add support for using eap_proxy offload
[mech_eap.git] / wpa_supplicant / interworking.c
index bbcfe4d..2f35240 100644 (file)
@@ -13,6 +13,7 @@
 #include "common/gas.h"
 #include "common/wpa_ctrl.h"
 #include "utils/pcsc_funcs.h"
+#include "utils/eloop.h"
 #include "drivers/driver.h"
 #include "eap_common/eap_defs.h"
 #include "eap_peer/eap.h"
 #endif
 
 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
+static struct wpa_cred * interworking_credentials_available_realm(
+       struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
+static struct wpa_cred * interworking_credentials_available_3gpp(
+       struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
 
 
 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
@@ -53,16 +58,8 @@ static void interworking_reconnect(struct wpa_supplicant *wpa_s)
        wpa_s->disconnected = 0;
        wpa_s->reassociate = 1;
 
-       if (wpa_s->last_scan_res_used > 0) {
-               struct os_time now;
-               os_get_time(&now);
-               if (now.sec - wpa_s->last_scan.sec <= 5) {
-                       wpa_printf(MSG_DEBUG, "Interworking: Old scan results "
-                                  "are fresh - connect without new scan");
-                       if (wpas_select_network_from_last_scan(wpa_s) == 0)
-                               return;
-               }
-       }
+       if (wpa_supplicant_fast_associate(wpa_s) >= 0)
+               return;
 
        wpa_supplicant_req_scan(wpa_s, 0, 0);
 }
@@ -170,6 +167,13 @@ static int additional_roaming_consortiums(struct wpa_bss *bss)
 }
 
 
+static void interworking_continue_anqp(void *eloop_ctx, void *sock_ctx)
+{
+       struct wpa_supplicant *wpa_s = eloop_ctx;
+       interworking_next_anqp_fetch(wpa_s);
+}
+
+
 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
                                      struct wpa_bss *bss)
 {
@@ -183,6 +187,7 @@ static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
 
        wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
                   MAC2STR(bss->bssid));
+       wpa_s->interworking_gas_bss = bss;
 
        info_ids[num_info_ids++] = ANQP_CAPABILITY_LIST;
        if (all) {
@@ -238,6 +243,8 @@ static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
        if (res < 0) {
                wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
                ret = -1;
+               eloop_register_timeout(0, 0, interworking_continue_anqp, wpa_s,
+                                      NULL);
        } else
                wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
                           "%u", res);
@@ -401,11 +408,9 @@ static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
                return NULL;
        }
        wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
-       r->realm = os_malloc(realm_len + 1);
+       r->realm = dup_binstr(pos, realm_len);
        if (r->realm == NULL)
                return NULL;
-       os_memcpy(r->realm, pos, realm_len);
-       r->realm[realm_len] = '\0';
        pos += realm_len;
 
        if (pos + 1 > f_end) {
@@ -516,13 +521,18 @@ static int nai_realm_cred_username(struct nai_realm_eap *eap)
                return 0;
        }
 
-       if (eap->method == EAP_TYPE_PEAP &&
-           eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
-               return 0;
+       if (eap->method == EAP_TYPE_PEAP) {
+               if (eap->inner_method &&
+                   eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
+                       return 0;
+               if (!eap->inner_method &&
+                   eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL)
+                       return 0;
+       }
 
        if (eap->method == EAP_TYPE_TTLS) {
                if (eap->inner_method == 0 && eap->inner_non_eap == 0)
-                       return 0;
+                       return 1; /* Assume TTLS/MSCHAPv2 is used */
                if (eap->inner_method &&
                    eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
                        return 0;
@@ -717,9 +727,12 @@ static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 #endif /* INTERWORKING_3GPP */
 
 
-static int interworking_set_hs20_params(struct wpa_ssid *ssid)
+static int interworking_set_hs20_params(struct wpa_supplicant *wpa_s,
+                                       struct wpa_ssid *ssid)
 {
-       if (wpa_config_set(ssid, "key_mgmt", "WPA-EAP", 0) < 0)
+       if (wpa_config_set(ssid, "key_mgmt",
+                          wpa_s->conf->pmf != NO_MGMT_FRAME_PROTECTION ?
+                          "WPA-EAP WPA-EAP-SHA256" : "WPA-EAP", 0) < 0)
                return -1;
        if (wpa_config_set(ssid, "proto", "RSN", 0) < 0)
                return -1;
@@ -730,50 +743,19 @@ static int interworking_set_hs20_params(struct wpa_ssid *ssid)
 
 
 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
+                                    struct wpa_cred *cred,
                                     struct wpa_bss *bss)
 {
 #ifdef INTERWORKING_3GPP
-       struct wpa_cred *cred;
        struct wpa_ssid *ssid;
        const u8 *ie;
+       int eap_type;
+       int res;
+       char prefix;
 
        if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
                return -1;
 
-       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
-               char *sep;
-               const char *imsi;
-               int mnc_len;
-
-#ifdef PCSC_FUNCS
-               if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
-                   wpa_s->imsi[0]) {
-                       imsi = wpa_s->imsi;
-                       mnc_len = wpa_s->mnc_len;
-                       goto compare;
-               }
-#endif /* PCSC_FUNCS */
-
-               if (cred->imsi == NULL || !cred->imsi[0] ||
-                   cred->milenage == NULL || !cred->milenage[0])
-                       continue;
-
-               sep = os_strchr(cred->imsi, '-');
-               if (sep == NULL ||
-                   (sep - cred->imsi != 5 && sep - cred->imsi != 6))
-                       continue;
-               mnc_len = sep - cred->imsi - 3;
-               imsi = cred->imsi;
-
-#ifdef PCSC_FUNCS
-       compare:
-#endif /* PCSC_FUNCS */
-               if (plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len))
-                       break;
-       }
-       if (cred == NULL)
-               return -1;
-
        ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
        if (ie == NULL)
                return -1;
@@ -783,6 +765,7 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
        ssid = wpa_config_add_network(wpa_s->conf);
        if (ssid == NULL)
                return -1;
+       ssid->parent_cred = cred;
 
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
@@ -794,17 +777,43 @@ static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
        os_memcpy(ssid->ssid, ie + 2, ie[1]);
        ssid->ssid_len = ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
-       /* TODO: figure out whether to use EAP-SIM, EAP-AKA, or EAP-AKA' */
-       if (wpa_config_set(ssid, "eap", "SIM", 0) < 0) {
-               wpa_printf(MSG_DEBUG, "EAP-SIM not supported");
+       eap_type = EAP_TYPE_SIM;
+       if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
+               eap_type = EAP_TYPE_AKA;
+       if (cred->eap_method && cred->eap_method[0].vendor == EAP_VENDOR_IETF) {
+               if (cred->eap_method[0].method == EAP_TYPE_SIM ||
+                   cred->eap_method[0].method == EAP_TYPE_AKA ||
+                   cred->eap_method[0].method == EAP_TYPE_AKA_PRIME)
+                       eap_type = cred->eap_method[0].method;
+       }
+
+       switch (eap_type) {
+       case EAP_TYPE_SIM:
+               prefix = '1';
+               res = wpa_config_set(ssid, "eap", "SIM", 0);
+               break;
+       case EAP_TYPE_AKA:
+               prefix = '0';
+               res = wpa_config_set(ssid, "eap", "AKA", 0);
+               break;
+       case EAP_TYPE_AKA_PRIME:
+               prefix = '6';
+               res = wpa_config_set(ssid, "eap", "AKA'", 0);
+               break;
+       default:
+               res = -1;
+               break;
+       }
+       if (res < 0) {
+               wpa_printf(MSG_DEBUG, "Selected EAP method (%d) not supported",
+                          eap_type);
                goto fail;
        }
-       if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
-               wpa_config_set(ssid, "eap", "AKA", 0);
-       if (!cred->pcsc && set_root_nai(ssid, cred->imsi, '1') < 0) {
+
+       if (!cred->pcsc && set_root_nai(ssid, cred->imsi, prefix) < 0) {
                wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
                goto fail;
        }
@@ -915,6 +924,24 @@ static int roaming_consortium_match(const u8 *ie, const struct wpabuf *anqp,
 }
 
 
+static int cred_excluded_ssid(struct wpa_cred *cred, struct wpa_bss *bss)
+{
+       size_t i;
+
+       if (!cred->excluded_ssid)
+               return 0;
+
+       for (i = 0; i < cred->num_excluded_ssid; i++) {
+               struct excluded_ssid *e = &cred->excluded_ssid[i];
+               if (bss->ssid_len == e->ssid_len &&
+                   os_memcmp(bss->ssid, e->ssid, e->ssid_len) == 0)
+                       return 1;
+       }
+
+       return 0;
+}
+
+
 static struct wpa_cred * interworking_credentials_available_roaming_consortium(
        struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 {
@@ -942,6 +969,9 @@ static struct wpa_cred * interworking_credentials_available_roaming_consortium(
                                              cred->roaming_consortium_len))
                        continue;
 
+               if (cred_excluded_ssid(cred, bss))
+                       continue;
+
                if (selected == NULL ||
                    selected->priority < cred->priority)
                        selected = cred;
@@ -1017,6 +1047,17 @@ static int interworking_set_eap_params(struct wpa_ssid *ssid,
            wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
                return -1;
 
+#ifdef ANDROID
+       if (cred->private_key &&
+           os_strncmp(cred->private_key, "keystore://", 11) == 0) {
+               /* Use OpenSSL engine configuration for Android keystore */
+               if (wpa_config_set_quoted(ssid, "engine_id", "keystore") < 0 ||
+                   wpa_config_set_quoted(ssid, "key_id",
+                                         cred->private_key + 11) < 0 ||
+                   wpa_config_set(ssid, "engine", "1", 0) < 0)
+                       return -1;
+       } else
+#endif /* ANDROID */
        if (cred->private_key && cred->private_key[0] &&
            wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
                return -1;
@@ -1055,6 +1096,7 @@ static int interworking_connect_roaming_consortium(
        ssid = wpa_config_add_network(wpa_s->conf);
        if (ssid == NULL)
                return -1;
+       ssid->parent_cred = cred;
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
        ssid->priority = cred->priority;
@@ -1065,7 +1107,7 @@ static int interworking_connect_roaming_consortium(
        os_memcpy(ssid->ssid, ssid_ie + 2, ssid_ie[1]);
        ssid->ssid_len = ssid_ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
        if (cred->eap_method == NULL) {
@@ -1094,7 +1136,7 @@ fail:
 
 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 {
-       struct wpa_cred *cred;
+       struct wpa_cred *cred, *cred_rc, *cred_3gpp;
        struct wpa_ssid *ssid;
        struct nai_realm *realm;
        struct nai_realm_eap *eap = NULL;
@@ -1121,39 +1163,61 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                return -1;
        }
 
-       cred = interworking_credentials_available_roaming_consortium(wpa_s,
-                                                                    bss);
-       if (cred)
-               return interworking_connect_roaming_consortium(wpa_s, cred,
+       cred_rc = interworking_credentials_available_roaming_consortium(wpa_s,
+                                                                       bss);
+       if (cred_rc) {
+               wpa_printf(MSG_DEBUG, "Interworking: Highest roaming "
+                          "consortium matching credential priority %d",
+                          cred_rc->priority);
+       }
+
+       cred = interworking_credentials_available_realm(wpa_s, bss);
+       if (cred) {
+               wpa_printf(MSG_DEBUG, "Interworking: Highest NAI Realm list "
+                          "matching credential priority %d",
+                          cred->priority);
+       }
+
+       cred_3gpp = interworking_credentials_available_3gpp(wpa_s, bss);
+       if (cred_3gpp) {
+               wpa_printf(MSG_DEBUG, "Interworking: Highest 3GPP matching "
+                          "credential priority %d", cred_3gpp->priority);
+       }
+
+       if (cred_rc &&
+           (cred == NULL || cred_rc->priority >= cred->priority) &&
+           (cred_3gpp == NULL || cred_rc->priority >= cred_3gpp->priority))
+               return interworking_connect_roaming_consortium(wpa_s, cred_rc,
                                                               bss, ie);
 
+       if (cred_3gpp &&
+           (cred == NULL || cred_3gpp->priority >= cred->priority)) {
+               return interworking_connect_3gpp(wpa_s, cred_3gpp, bss);
+       }
+
+       if (cred == NULL) {
+               wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
+                          "found for " MACSTR, MAC2STR(bss->bssid));
+               return -1;
+       }
+
        realm = nai_realm_parse(bss->anqp ? bss->anqp->nai_realm : NULL,
                                &count);
        if (realm == NULL) {
                wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
                           "Realm list from " MACSTR, MAC2STR(bss->bssid));
-               count = 0;
+               return -1;
        }
 
-       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
-               for (i = 0; i < count; i++) {
-                       if (!nai_realm_match(&realm[i], cred->realm))
-                               continue;
-                       eap = nai_realm_find_eap(cred, &realm[i]);
-                       if (eap)
-                               break;
-               }
+       for (i = 0; i < count; i++) {
+               if (!nai_realm_match(&realm[i], cred->realm))
+                       continue;
+               eap = nai_realm_find_eap(cred, &realm[i]);
                if (eap)
                        break;
        }
 
        if (!eap) {
-               if (interworking_connect_3gpp(wpa_s, bss) == 0) {
-                       if (realm)
-                               nai_realm_free(realm, count);
-                       return 0;
-               }
-
                wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
                           "and EAP method found for " MACSTR,
                           MAC2STR(bss->bssid));
@@ -1169,6 +1233,7 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                nai_realm_free(realm, count);
                return -1;
        }
+       ssid->parent_cred = cred;
        wpas_notify_network_added(wpa_s, ssid);
        wpa_config_set_network_defaults(ssid);
        ssid->priority = cred->priority;
@@ -1179,7 +1244,7 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
        os_memcpy(ssid->ssid, ie + 2, ie[1]);
        ssid->ssid_len = ie[1];
 
-       if (interworking_set_hs20_params(ssid) < 0)
+       if (interworking_set_hs20_params(wpa_s, ssid) < 0)
                goto fail;
 
        if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
@@ -1217,11 +1282,20 @@ int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
                                           0) < 0)
                                goto fail;
                        break;
+               default:
+                       /* EAP params were not set - assume TTLS/MSCHAPv2 */
+                       if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
+                                          0) < 0)
+                               goto fail;
+                       break;
                }
                break;
        case EAP_TYPE_PEAP:
                os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
-                           eap_get_name(EAP_VENDOR_IETF, eap->inner_method));
+                           eap_get_name(EAP_VENDOR_IETF,
+                                        eap->inner_method ?
+                                        eap->inner_method :
+                                        EAP_TYPE_MSCHAPV2));
                if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
                        goto fail;
                break;
@@ -1251,10 +1325,11 @@ fail:
 static struct wpa_cred * interworking_credentials_available_3gpp(
        struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 {
-       struct wpa_cred *cred, *selected = NULL;
+       struct wpa_cred *selected = NULL;
+#ifdef INTERWORKING_3GPP
+       struct wpa_cred *cred;
        int ret;
 
-#ifdef INTERWORKING_3GPP
        if (bss->anqp == NULL || bss->anqp->anqp_3gpp == NULL)
                return NULL;
 
@@ -1271,6 +1346,13 @@ static struct wpa_cred * interworking_credentials_available_3gpp(
                        goto compare;
                }
 #endif /* PCSC_FUNCS */
+#ifdef CONFIG_EAP_PROXY
+               if (cred->pcsc && wpa_s->mnc_len > 0 && wpa_s->imsi[0]) {
+                       imsi = wpa_s->imsi;
+                       mnc_len = wpa_s->mnc_len;
+                       goto compare;
+               }
+#endif /* CONFIG_EAP_PROXY */
 
                if (cred->imsi == NULL || !cred->imsi[0] ||
                    cred->milenage == NULL || !cred->milenage[0])
@@ -1283,14 +1365,16 @@ static struct wpa_cred * interworking_credentials_available_3gpp(
                mnc_len = sep - cred->imsi - 3;
                imsi = cred->imsi;
 
-#ifdef PCSC_FUNCS
+#if defined(PCSC_FUNCS) || defined(CONFIG_EAP_PROXY)
        compare:
-#endif /* PCSC_FUNCS */
+#endif /* PCSC_FUNCS || CONFIG_EAP_PROXY */
                wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
                           MACSTR, MAC2STR(bss->bssid));
                ret = plmn_id_match(bss->anqp->anqp_3gpp, imsi, mnc_len);
                wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
                if (ret) {
+                       if (cred_excluded_ssid(cred, bss))
+                               continue;
                        if (selected == NULL ||
                            selected->priority < cred->priority)
                                selected = cred;
@@ -1331,6 +1415,8 @@ static struct wpa_cred * interworking_credentials_available_realm(
                        if (!nai_realm_match(&realm[i], cred->realm))
                                continue;
                        if (nai_realm_find_eap(cred, &realm[i])) {
+                               if (cred_excluded_ssid(cred, bss))
+                                       continue;
                                if (selected == NULL ||
                                    selected->priority < cred->priority)
                                        selected = cred;
@@ -1395,50 +1481,61 @@ static int domain_name_list_contains(struct wpabuf *domain_names,
 }
 
 
-static int interworking_home_sp(struct wpa_supplicant *wpa_s,
-                               struct wpabuf *domain_names)
+int interworking_home_sp_cred(struct wpa_supplicant *wpa_s,
+                             struct wpa_cred *cred,
+                             struct wpabuf *domain_names)
 {
-       struct wpa_cred *cred;
 #ifdef INTERWORKING_3GPP
        char nai[100], *realm;
-#endif /* INTERWORKING_3GPP */
 
-       if (domain_names == NULL || wpa_s->conf->cred == NULL)
-               return -1;
-
-       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
-#ifdef INTERWORKING_3GPP
-               char *imsi = NULL;
-               int mnc_len = 0;
-               if (cred->imsi)
-                       imsi = cred->imsi;
+       char *imsi = NULL;
+       int mnc_len = 0;
+       if (cred->imsi)
+               imsi = cred->imsi;
 #ifdef CONFIG_PCSC
-               else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
-                        wpa_s->scard && wpa_s->imsi[0]) {
-                       imsi = wpa_s->imsi;
-                       mnc_len = wpa_s->mnc_len;
-               }
+       else if (cred->pcsc && wpa_s->conf->pcsc_reader &&
+                wpa_s->scard && wpa_s->imsi[0]) {
+               imsi = wpa_s->imsi;
+               mnc_len = wpa_s->mnc_len;
+       }
 #endif /* CONFIG_PCSC */
-               if (imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0)
-                   == 0) {
-                       realm = os_strchr(nai, '@');
-                       if (realm)
-                               realm++;
-                       wpa_printf(MSG_DEBUG, "Interworking: Search for match "
-                                  "with SIM/USIM domain %s", realm);
-                       if (realm &&
-                           domain_name_list_contains(domain_names, realm))
-                               return 1;
-               }
+       if (domain_names &&
+           imsi && build_root_nai(nai, sizeof(nai), imsi, mnc_len, 0) == 0) {
+               realm = os_strchr(nai, '@');
+               if (realm)
+                       realm++;
+               wpa_printf(MSG_DEBUG, "Interworking: Search for match "
+                          "with SIM/USIM domain %s", realm);
+               if (realm &&
+                   domain_name_list_contains(domain_names, realm))
+                       return 1;
+       }
 #endif /* INTERWORKING_3GPP */
 
-               if (cred->domain == NULL)
-                       continue;
+       if (domain_names == NULL || cred->domain == NULL)
+               return 0;
 
-               wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
-                          "home SP FQDN %s", cred->domain);
-               if (domain_name_list_contains(domain_names, cred->domain))
-                       return 1;
+       wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
+                  "home SP FQDN %s", cred->domain);
+       if (domain_name_list_contains(domain_names, cred->domain))
+               return 1;
+
+       return 0;
+}
+
+
+static int interworking_home_sp(struct wpa_supplicant *wpa_s,
+                               struct wpabuf *domain_names)
+{
+       struct wpa_cred *cred;
+
+       if (domain_names == NULL || wpa_s->conf->cred == NULL)
+               return -1;
+
+       for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
+               int res = interworking_home_sp_cred(wpa_s, cred, domain_names);
+               if (res)
+                       return res;
        }
 
        return 0;
@@ -1561,13 +1658,50 @@ static void interworking_select_network(struct wpa_supplicant *wpa_s)
 }
 
 
+static struct wpa_bss_anqp *
+interworking_match_anqp_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
+{
+       struct wpa_bss *other;
+
+       if (is_zero_ether_addr(bss->hessid))
+               return NULL; /* Cannot be in the same homegenous ESS */
+
+       dl_list_for_each(other, &wpa_s->bss, struct wpa_bss, list) {
+               if (other == bss)
+                       continue;
+               if (other->anqp == NULL)
+                       continue;
+               if (other->anqp->roaming_consortium == NULL &&
+                   other->anqp->nai_realm == NULL &&
+                   other->anqp->anqp_3gpp == NULL &&
+                   other->anqp->domain_name == NULL)
+                       continue;
+               if (!(other->flags & WPA_BSS_ANQP_FETCH_TRIED))
+                       continue;
+               if (os_memcmp(bss->hessid, other->hessid, ETH_ALEN) != 0)
+                       continue;
+               if (bss->ssid_len != other->ssid_len ||
+                   os_memcmp(bss->ssid, other->ssid, bss->ssid_len) != 0)
+                       continue;
+
+               wpa_printf(MSG_DEBUG, "Interworking: Share ANQP data with "
+                          "already fetched BSSID " MACSTR " and " MACSTR,
+                          MAC2STR(other->bssid), MAC2STR(bss->bssid));
+               other->anqp->users++;
+               return other->anqp;
+       }
+
+       return NULL;
+}
+
+
 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
 {
        struct wpa_bss *bss;
        int found = 0;
        const u8 *ie;
 
-       if (!wpa_s->fetch_anqp_in_progress)
+       if (eloop_terminated() || !wpa_s->fetch_anqp_in_progress)
                return;
 
        dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
@@ -1579,6 +1713,12 @@ static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
 
                if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
                        if (bss->anqp == NULL) {
+                               bss->anqp = interworking_match_anqp_info(wpa_s,
+                                                                        bss);
+                               if (bss->anqp) {
+                                       /* Shared data already fetched */
+                                       continue;
+                               }
                                bss->anqp = wpa_bss_anqp_alloc();
                                if (bss->anqp == NULL)
                                        break;
@@ -1647,8 +1787,10 @@ int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
 
        freq = wpa_s->assoc_freq;
        bss = wpa_bss_get_bssid(wpa_s, dst);
-       if (bss)
+       if (bss) {
+               wpa_bss_anqp_unshare_alloc(bss);
                freq = bss->freq;
+       }
        if (freq <= 0)
                return -1;
 
@@ -1673,11 +1815,11 @@ int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
 
 
 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
-                                           const u8 *sa, u16 info_id,
+                                           struct wpa_bss *bss, const u8 *sa,
+                                           u16 info_id,
                                            const u8 *data, size_t slen)
 {
        const u8 *pos = data;
-       struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
        struct wpa_bss_anqp *anqp = NULL;
 #ifdef CONFIG_HS20
        u8 type;
@@ -1813,6 +1955,7 @@ void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
        const u8 *end;
        u16 info_id;
        u16 slen;
+       struct wpa_bss *bss = NULL, *tmp;
 
        if (result != GAS_QUERY_SUCCESS)
                return;
@@ -1825,6 +1968,21 @@ void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
                return;
        }
 
+       /*
+        * If possible, select the BSS entry based on which BSS entry was used
+        * for the request. This can help in cases where multiple BSS entries
+        * may exist for the same AP.
+        */
+       dl_list_for_each_reverse(tmp, &wpa_s->bss, struct wpa_bss, list) {
+               if (tmp == wpa_s->interworking_gas_bss &&
+                   os_memcmp(tmp->bssid, dst, ETH_ALEN) == 0) {
+                       bss = tmp;
+                       break;
+               }
+       }
+       if (bss == NULL)
+               bss = wpa_bss_get_bssid(wpa_s, dst);
+
        pos = wpabuf_head(resp);
        end = pos + wpabuf_len(resp);
 
@@ -1842,7 +2000,7 @@ void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
                                   "for Info ID %u", info_id);
                        break;
                }
-               interworking_parse_rx_anqp_resp(wpa_s, dst, info_id, pos,
+               interworking_parse_rx_anqp_resp(wpa_s, bss, dst, info_id, pos,
                                                slen);
                pos += slen;
        }
@@ -1868,7 +2026,7 @@ int interworking_select(struct wpa_supplicant *wpa_s, int auto_select)
        wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
                   "selection");
        wpa_s->scan_res_handler = interworking_scan_res_handler;
-       wpa_s->scan_req = 2;
+       wpa_s->scan_req = MANUAL_SCAN_REQ;
        wpa_supplicant_req_scan(wpa_s, 0, 0);
 
        return 0;