wpa_supplicant/gas_query.c

   1 /*
   2  * Generic advertisement service (GAS) query
   3  * Copyright (c) 2009, Atheros Communications
   4  * Copyright (c) 2011-2014, Qualcomm Atheros, Inc.
   5  * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
   6  *
   7  * This software may be distributed under the terms of the BSD license.
   8  * See README for more details.
   9  */
  10
  11 #include "includes.h"
  12
  13 #include "common.h"
  14 #include "utils/eloop.h"
  15 #include "common/ieee802_11_defs.h"
  16 #include "common/gas.h"
  17 #include "common/wpa_ctrl.h"
  18 #include "rsn_supp/wpa.h"
  19 #include "wpa_supplicant_i.h"
  20 #include "driver_i.h"
  21 #include "offchannel.h"
  22 #include "gas_query.h"
  23
  24
  25 /** GAS query timeout in seconds */
  26 #define GAS_QUERY_TIMEOUT_PERIOD 2
  27
  28
  29 /**
  30  * struct gas_query_pending - Pending GAS query
  31  */
  32 struct gas_query_pending {
  33         struct dl_list list;
  34         struct gas_query *gas;
  35         u8 addr[ETH_ALEN];
  36         u8 dialog_token;
  37         u8 next_frag_id;
  38         unsigned int wait_comeback:1;
  39         unsigned int offchannel_tx_started:1;
  40         int freq;
  41         u16 status_code;
  42         struct wpabuf *req;
  43         struct wpabuf *adv_proto;
  44         struct wpabuf *resp;
  45         void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
  46                    enum gas_query_result result,
  47                    const struct wpabuf *adv_proto,
  48                    const struct wpabuf *resp, u16 status_code);
  49         void *ctx;
  50 };
  51
  52 /**
  53  * struct gas_query - Internal GAS query data
  54  */
  55 struct gas_query {
  56         struct wpa_supplicant *wpa_s;
  57         struct dl_list pending; /* struct gas_query_pending */
  58         struct gas_query_pending *current;
  59         struct wpa_radio_work *work;
  60 };
  61
  62
  63 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx);
  64 static void gas_query_timeout(void *eloop_data, void *user_ctx);
  65
  66
  67 /**
  68  * gas_query_init - Initialize GAS query component
  69  * @wpa_s: Pointer to wpa_supplicant data
  70  * Returns: Pointer to GAS query data or %NULL on failure
  71  */
  72 struct gas_query * gas_query_init(struct wpa_supplicant *wpa_s)
  73 {
  74         struct gas_query *gas;
  75
  76         gas = os_zalloc(sizeof(*gas));
  77         if (gas == NULL)
  78                 return NULL;
  79
  80         gas->wpa_s = wpa_s;
  81         dl_list_init(&gas->pending);
  82
  83         return gas;
  84 }
  85
  86
  87 static const char * gas_result_txt(enum gas_query_result result)
  88 {
  89         switch (result) {
  90         case GAS_QUERY_SUCCESS:
  91                 return "SUCCESS";
  92         case GAS_QUERY_FAILURE:
  93                 return "FAILURE";
  94         case GAS_QUERY_TIMEOUT:
  95                 return "TIMEOUT";
  96         case GAS_QUERY_PEER_ERROR:
  97                 return "PEER_ERROR";
  98         case GAS_QUERY_INTERNAL_ERROR:
  99                 return "INTERNAL_ERROR";
 100         case GAS_QUERY_CANCELLED:
 101                 return "CANCELLED";
 102         case GAS_QUERY_DELETED_AT_DEINIT:
 103                 return "DELETED_AT_DEINIT";
 104         }
 105
 106         return "N/A";
 107 }
 108
 109
 110 static void gas_query_free(struct gas_query_pending *query, int del_list)
 111 {
 112         struct gas_query *gas = query->gas;
 113
 114         if (del_list)
 115                 dl_list_del(&query->list);
 116
 117         if (gas->work && gas->work->ctx == query) {
 118                 radio_work_done(gas->work);
 119                 gas->work = NULL;
 120         }
 121
 122         wpabuf_free(query->req);
 123         wpabuf_free(query->adv_proto);
 124         wpabuf_free(query->resp);
 125         os_free(query);
 126 }
 127
 128
 129 static void gas_query_done(struct gas_query *gas,
 130                            struct gas_query_pending *query,
 131                            enum gas_query_result result)
 132 {
 133         wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR
 134                 " dialog_token=%u freq=%d status_code=%u result=%s",
 135                 MAC2STR(query->addr), query->dialog_token, query->freq,
 136                 query->status_code, gas_result_txt(result));
 137         if (gas->current == query)
 138                 gas->current = NULL;
 139         if (query->offchannel_tx_started)
 140                 offchannel_send_action_done(gas->wpa_s);
 141         eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
 142         eloop_cancel_timeout(gas_query_timeout, gas, query);
 143         dl_list_del(&query->list);
 144         query->cb(query->ctx, query->addr, query->dialog_token, result,
 145                   query->adv_proto, query->resp, query->status_code);
 146         gas_query_free(query, 0);
 147 }
 148
 149
 150 /**
 151  * gas_query_deinit - Deinitialize GAS query component
 152  * @gas: GAS query data from gas_query_init()
 153  */
 154 void gas_query_deinit(struct gas_query *gas)
 155 {
 156         struct gas_query_pending *query, *next;
 157
 158         if (gas == NULL)
 159                 return;
 160
 161         dl_list_for_each_safe(query, next, &gas->pending,
 162                               struct gas_query_pending, list)
 163                 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT);
 164
 165         os_free(gas);
 166 }
 167
 168
 169 static struct gas_query_pending *
 170 gas_query_get_pending(struct gas_query *gas, const u8 *addr, u8 dialog_token)
 171 {
 172         struct gas_query_pending *q;
 173         dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
 174                 if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 &&
 175                     q->dialog_token == dialog_token)
 176                         return q;
 177         }
 178         return NULL;
 179 }
 180
 181
 182 static int gas_query_append(struct gas_query_pending *query, const u8 *data,
 183                             size_t len)
 184 {
 185         if (wpabuf_resize(&query->resp, len) < 0) {
 186                 wpa_printf(MSG_DEBUG, "GAS: No memory to store the response");
 187                 return -1;
 188         }
 189         wpabuf_put_data(query->resp, data, len);
 190         return 0;
 191 }
 192
 193
 194 static void gas_query_tx_status(struct wpa_supplicant *wpa_s,
 195                                 unsigned int freq, const u8 *dst,
 196                                 const u8 *src, const u8 *bssid,
 197                                 const u8 *data, size_t data_len,
 198                                 enum offchannel_send_action_result result)
 199 {
 200         struct gas_query_pending *query;
 201         struct gas_query *gas = wpa_s->gas;
 202
 203         if (gas->current == NULL) {
 204                 wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: freq=%u dst="
 205                            MACSTR " result=%d - no query in progress",
 206                            freq, MAC2STR(dst), result);
 207                 return;
 208         }
 209
 210         query = gas->current;
 211
 212         wpa_printf(MSG_DEBUG, "GAS: TX status: freq=%u dst=" MACSTR
 213                    " result=%d query=%p dialog_token=%u",
 214                    freq, MAC2STR(dst), result, query, query->dialog_token);
 215         if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) {
 216                 wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination");
 217                 return;
 218         }
 219
 220         if (result == OFFCHANNEL_SEND_ACTION_SUCCESS) {
 221                 eloop_cancel_timeout(gas_query_timeout, gas, query);
 222                 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
 223                                        gas_query_timeout, gas, query);
 224         }
 225         if (result == OFFCHANNEL_SEND_ACTION_FAILED) {
 226                 eloop_cancel_timeout(gas_query_timeout, gas, query);
 227                 eloop_register_timeout(0, 0, gas_query_timeout, gas, query);
 228         }
 229 }
 230
 231
 232 static int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr)
 233 {
 234         if (wpa_s->current_ssid == NULL ||
 235             wpa_s->wpa_state < WPA_4WAY_HANDSHAKE ||
 236             os_memcmp(addr, wpa_s->bssid, ETH_ALEN) != 0)
 237                 return 0;
 238         return wpa_sm_pmf_enabled(wpa_s->wpa);
 239 }
 240
 241
 242 static int gas_query_tx(struct gas_query *gas, struct gas_query_pending *query,
 243                         struct wpabuf *req)
 244 {
 245         int res, prot = pmf_in_use(gas->wpa_s, query->addr);
 246
 247         wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u "
 248                    "freq=%d prot=%d", MAC2STR(query->addr),
 249                    (unsigned int) wpabuf_len(req), query->freq, prot);
 250         if (prot) {
 251                 u8 *categ = wpabuf_mhead_u8(req);
 252                 *categ = WLAN_ACTION_PROTECTED_DUAL;
 253         }
 254         res = offchannel_send_action(gas->wpa_s, query->freq, query->addr,
 255                                      gas->wpa_s->own_addr, query->addr,
 256                                      wpabuf_head(req), wpabuf_len(req), 1000,
 257                                      gas_query_tx_status, 0);
 258         if (res == 0)
 259                 query->offchannel_tx_started = 1;
 260         return res;
 261 }
 262
 263
 264 static void gas_query_tx_comeback_req(struct gas_query *gas,
 265                                       struct gas_query_pending *query)
 266 {
 267         struct wpabuf *req;
 268
 269         req = gas_build_comeback_req(query->dialog_token);
 270         if (req == NULL) {
 271                 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
 272                 return;
 273         }
 274
 275         if (gas_query_tx(gas, query, req) < 0) {
 276                 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
 277                            MACSTR, MAC2STR(query->addr));
 278                 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
 279         }
 280
 281         wpabuf_free(req);
 282 }
 283
 284
 285 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx)
 286 {
 287         struct gas_query *gas = eloop_data;
 288         struct gas_query_pending *query = user_ctx;
 289
 290         wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR,
 291                    MAC2STR(query->addr));
 292         gas_query_tx_comeback_req(gas, query);
 293 }
 294
 295
 296 static void gas_query_tx_comeback_req_delay(struct gas_query *gas,
 297                                             struct gas_query_pending *query,
 298                                             u16 comeback_delay)
 299 {
 300         unsigned int secs, usecs;
 301
 302         secs = (comeback_delay * 1024) / 1000000;
 303         usecs = comeback_delay * 1024 - secs * 1000000;
 304         wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR
 305                    " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs);
 306         eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
 307         eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout,
 308                                gas, query);
 309 }
 310
 311
 312 static void gas_query_rx_initial(struct gas_query *gas,
 313                                  struct gas_query_pending *query,
 314                                  const u8 *adv_proto, const u8 *resp,
 315                                  size_t len, u16 comeback_delay)
 316 {
 317         wpa_printf(MSG_DEBUG, "GAS: Received initial response from "
 318                    MACSTR " (dialog_token=%u comeback_delay=%u)",
 319                    MAC2STR(query->addr), query->dialog_token, comeback_delay);
 320
 321         query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]);
 322         if (query->adv_proto == NULL) {
 323                 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
 324                 return;
 325         }
 326
 327         if (comeback_delay) {
 328                 query->wait_comeback = 1;
 329                 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
 330                 return;
 331         }
 332
 333         /* Query was completed without comeback mechanism */
 334         if (gas_query_append(query, resp, len) < 0) {
 335                 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
 336                 return;
 337         }
 338
 339         gas_query_done(gas, query, GAS_QUERY_SUCCESS);
 340 }
 341
 342
 343 static void gas_query_rx_comeback(struct gas_query *gas,
 344                                   struct gas_query_pending *query,
 345                                   const u8 *adv_proto, const u8 *resp,
 346                                   size_t len, u8 frag_id, u8 more_frags,
 347                                   u16 comeback_delay)
 348 {
 349         wpa_printf(MSG_DEBUG, "GAS: Received comeback response from "
 350                    MACSTR " (dialog_token=%u frag_id=%u more_frags=%u "
 351                    "comeback_delay=%u)",
 352                    MAC2STR(query->addr), query->dialog_token, frag_id,
 353                    more_frags, comeback_delay);
 354
 355         if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) ||
 356             os_memcmp(adv_proto, wpabuf_head(query->adv_proto),
 357                       wpabuf_len(query->adv_proto)) != 0) {
 358                 wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed "
 359                            "between initial and comeback response from "
 360                            MACSTR, MAC2STR(query->addr));
 361                 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
 362                 return;
 363         }
 364
 365         if (comeback_delay) {
 366                 if (frag_id) {
 367                         wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response "
 368                                    "with non-zero frag_id and comeback_delay "
 369                                    "from " MACSTR, MAC2STR(query->addr));
 370                         gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
 371                         return;
 372                 }
 373                 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
 374                 return;
 375         }
 376
 377         if (frag_id != query->next_frag_id) {
 378                 wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response "
 379                            "from " MACSTR, MAC2STR(query->addr));
 380                 if (frag_id + 1 == query->next_frag_id) {
 381                         wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible "
 382                                    "retry of previous fragment");
 383                         return;
 384                 }
 385                 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
 386                 return;
 387         }
 388         query->next_frag_id++;
 389
 390         if (gas_query_append(query, resp, len) < 0) {
 391                 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
 392                 return;
 393         }
 394
 395         if (more_frags) {
 396                 gas_query_tx_comeback_req(gas, query);
 397                 return;
 398         }
 399
 400         gas_query_done(gas, query, GAS_QUERY_SUCCESS);
 401 }
 402
 403
 404 /**
 405  * gas_query_rx - Indicate reception of a Public Action or Protected Dual frame
 406  * @gas: GAS query data from gas_query_init()
 407  * @da: Destination MAC address of the Action frame
 408  * @sa: Source MAC address of the Action frame
 409  * @bssid: BSSID of the Action frame
 410  * @categ: Category of the Action frame
 411  * @data: Payload of the Action frame
 412  * @len: Length of @data
 413  * @freq: Frequency (in MHz) on which the frame was received
 414  * Returns: 0 if the Public Action frame was a GAS frame or -1 if not
 415  */
 416 int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa,
 417                  const u8 *bssid, u8 categ, const u8 *data, size_t len,
 418                  int freq)
 419 {
 420         struct gas_query_pending *query;
 421         u8 action, dialog_token, frag_id = 0, more_frags = 0;
 422         u16 comeback_delay, resp_len;
 423         const u8 *pos, *adv_proto;
 424         int prot, pmf;
 425
 426         if (gas == NULL || len < 4)
 427                 return -1;
 428
 429         prot = categ == WLAN_ACTION_PROTECTED_DUAL;
 430         pmf = pmf_in_use(gas->wpa_s, bssid);
 431         if (prot && !pmf) {
 432                 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled");
 433                 return 0;
 434         }
 435         if (!prot && pmf) {
 436                 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled");
 437                 return 0;
 438         }
 439
 440         pos = data;
 441         action = *pos++;
 442         dialog_token = *pos++;
 443
 444         if (action != WLAN_PA_GAS_INITIAL_RESP &&
 445             action != WLAN_PA_GAS_COMEBACK_RESP)
 446                 return -1; /* Not a GAS response */
 447
 448         query = gas_query_get_pending(gas, sa, dialog_token);
 449         if (query == NULL) {
 450                 wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR
 451                            " dialog token %u", MAC2STR(sa), dialog_token);
 452                 return -1;
 453         }
 454
 455         if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) {
 456                 wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from "
 457                            MACSTR " dialog token %u when waiting for comeback "
 458                            "response", MAC2STR(sa), dialog_token);
 459                 return 0;
 460         }
 461
 462         if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) {
 463                 wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from "
 464                            MACSTR " dialog token %u when waiting for initial "
 465                            "response", MAC2STR(sa), dialog_token);
 466                 return 0;
 467         }
 468
 469         query->status_code = WPA_GET_LE16(pos);
 470         pos += 2;
 471
 472         if (query->status_code != WLAN_STATUS_SUCCESS) {
 473                 wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token "
 474                            "%u failed - status code %u",
 475                            MAC2STR(sa), dialog_token, query->status_code);
 476                 gas_query_done(gas, query, GAS_QUERY_FAILURE);
 477                 return 0;
 478         }
 479
 480         if (action == WLAN_PA_GAS_COMEBACK_RESP) {
 481                 if (pos + 1 > data + len)
 482                         return 0;
 483                 frag_id = *pos & 0x7f;
 484                 more_frags = (*pos & 0x80) >> 7;
 485                 pos++;
 486         }
 487
 488         /* Comeback Delay */
 489         if (pos + 2 > data + len)
 490                 return 0;
 491         comeback_delay = WPA_GET_LE16(pos);
 492         pos += 2;
 493
 494         /* Advertisement Protocol element */
 495         if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) {
 496                 wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement "
 497                            "Protocol element in the response from " MACSTR,
 498                            MAC2STR(sa));
 499                 return 0;
 500         }
 501
 502         if (*pos != WLAN_EID_ADV_PROTO) {
 503                 wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement "
 504                            "Protocol element ID %u in response from " MACSTR,
 505                            *pos, MAC2STR(sa));
 506                 return 0;
 507         }
 508
 509         adv_proto = pos;
 510         pos += 2 + pos[1];
 511
 512         /* Query Response Length */
 513         if (pos + 2 > data + len) {
 514                 wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length");
 515                 return 0;
 516         }
 517         resp_len = WPA_GET_LE16(pos);
 518         pos += 2;
 519
 520         if (pos + resp_len > data + len) {
 521                 wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in "
 522                            "response from " MACSTR, MAC2STR(sa));
 523                 return 0;
 524         }
 525
 526         if (pos + resp_len < data + len) {
 527                 wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data "
 528                            "after Query Response from " MACSTR,
 529                            (unsigned int) (data + len - pos - resp_len),
 530                            MAC2STR(sa));
 531         }
 532
 533         if (action == WLAN_PA_GAS_COMEBACK_RESP)
 534                 gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len,
 535                                       frag_id, more_frags, comeback_delay);
 536         else
 537                 gas_query_rx_initial(gas, query, adv_proto, pos, resp_len,
 538                                      comeback_delay);
 539
 540         return 0;
 541 }
 542
 543
 544 static void gas_query_timeout(void *eloop_data, void *user_ctx)
 545 {
 546         struct gas_query *gas = eloop_data;
 547         struct gas_query_pending *query = user_ctx;
 548
 549         wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR
 550                    " dialog token %u",
 551                    MAC2STR(query->addr), query->dialog_token);
 552         gas_query_done(gas, query, GAS_QUERY_TIMEOUT);
 553 }
 554
 555
 556 static int gas_query_dialog_token_available(struct gas_query *gas,
 557                                             const u8 *dst, u8 dialog_token)
 558 {
 559         struct gas_query_pending *q;
 560         dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
 561                 if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 &&
 562                     dialog_token == q->dialog_token)
 563                         return 0;
 564         }
 565
 566         return 1;
 567 }
 568
 569
 570 static void gas_query_start_cb(struct wpa_radio_work *work, int deinit)
 571 {
 572         struct gas_query_pending *query = work->ctx;
 573         struct gas_query *gas = query->gas;
 574
 575         if (deinit) {
 576                 gas_query_free(query, 1);
 577                 return;
 578         }
 579
 580         gas->work = work;
 581
 582         if (gas_query_tx(gas, query, query->req) < 0) {
 583                 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
 584                            MACSTR, MAC2STR(query->addr));
 585                 gas_query_free(query, 1);
 586                 return;
 587         }
 588         gas->current = query;
 589
 590         wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u",
 591                    query->dialog_token);
 592         eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
 593                                gas_query_timeout, gas, query);
 594
 595 }
 596
 597
 598 /**
 599  * gas_query_req - Request a GAS query
 600  * @gas: GAS query data from gas_query_init()
 601  * @dst: Destination MAC address for the query
 602  * @freq: Frequency (in MHz) for the channel on which to send the query
 603  * @req: GAS query payload (to be freed by gas_query module in case of success
 604  *      return)
 605  * @cb: Callback function for reporting GAS query result and response
 606  * @ctx: Context pointer to use with the @cb call
 607  * Returns: dialog token (>= 0) on success or -1 on failure
 608  */
 609 int gas_query_req(struct gas_query *gas, const u8 *dst, int freq,
 610                   struct wpabuf *req,
 611                   void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
 612                              enum gas_query_result result,
 613                              const struct wpabuf *adv_proto,
 614                              const struct wpabuf *resp, u16 status_code),
 615                   void *ctx)
 616 {
 617         struct gas_query_pending *query;
 618         int dialog_token;
 619         static int next_start = 0;
 620
 621         if (wpabuf_len(req) < 3)
 622                 return -1;
 623
 624         for (dialog_token = 0; dialog_token < 256; dialog_token++) {
 625                 if (gas_query_dialog_token_available(
 626                             gas, dst, (next_start + dialog_token) % 256))
 627                         break;
 628         }
 629         if (dialog_token == 256)
 630                 return -1; /* Too many pending queries */
 631         dialog_token = (next_start + dialog_token) % 256;
 632         next_start = (dialog_token + 1) % 256;
 633
 634         query = os_zalloc(sizeof(*query));
 635         if (query == NULL)
 636                 return -1;
 637
 638         query->gas = gas;
 639         os_memcpy(query->addr, dst, ETH_ALEN);
 640         query->dialog_token = dialog_token;
 641         query->freq = freq;
 642         query->cb = cb;
 643         query->ctx = ctx;
 644         query->req = req;
 645         dl_list_add(&gas->pending, &query->list);
 646
 647         *(wpabuf_mhead_u8(req) + 2) = dialog_token;
 648
 649         wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_START "addr=" MACSTR
 650                 " dialog_token=%u freq=%d",
 651                 MAC2STR(query->addr), query->dialog_token, query->freq);
 652
 653         if (radio_add_work(gas->wpa_s, freq, "gas-query", 0, gas_query_start_cb,
 654                            query) < 0) {
 655                 gas_query_free(query, 1);
 656                 return -1;
 657         }
 658
 659         return dialog_token;
 660 }
 661
 662
 663 /**
 664  * gas_query_cancel - Cancel a pending GAS query
 665  * @gas: GAS query data from gas_query_init()
 666  * @dst: Destination MAC address for the query
 667  * @dialog_token: Dialog token from gas_query_req()
 668  */
 669 void gas_query_cancel(struct gas_query *gas, const u8 *dst, u8 dialog_token)
 670 {
 671         struct gas_query_pending *query;
 672
 673         query = gas_query_get_pending(gas, dst, dialog_token);
 674         if (query)
 675                 gas_query_done(gas, query, GAS_QUERY_CANCELLED);
 676
 677 }