2 * Copyright (c) 2009, Atheros Communications, Inc.
3 * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
13 #include "common/ieee802_11_common.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/gas.h"
16 #include "common/wpa_ctrl.h"
17 #include "rsn_supp/wpa.h"
18 #include "wpa_supplicant_i.h"
22 #include "blacklist.h"
23 #include "gas_query.h"
24 #include "interworking.h"
25 #include "hs20_supplicant.h"
28 void wpas_hs20_add_indication(struct wpabuf *buf, int pps_mo_id)
32 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
33 wpabuf_put_u8(buf, pps_mo_id >= 0 ? 7 : 5);
34 wpabuf_put_be24(buf, OUI_WFA);
35 wpabuf_put_u8(buf, HS20_INDICATION_OUI_TYPE);
38 conf |= HS20_PPS_MO_ID_PRESENT;
39 wpabuf_put_u8(buf, conf);
41 wpabuf_put_le16(buf, pps_mo_id);
45 int is_hs20_network(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
48 if (!wpa_s->conf->hs20 || !ssid)
51 if (ssid->parent_cred)
54 if (bss && !wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE))
58 * This may catch some non-Hotspot 2.0 cases, but it is safer to do that
59 * than cause Hotspot 2.0 connections without indication element getting
60 * added. Non-Hotspot 2.0 APs should ignore the unknown vendor element.
63 if (!(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X))
65 if (!(ssid->pairwise_cipher & WPA_CIPHER_CCMP))
67 if (ssid->proto != WPA_PROTO_RSN)
74 int hs20_get_pps_mo_id(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
76 struct wpa_cred *cred;
78 if (ssid == NULL || ssid->parent_cred == NULL)
81 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
82 if (ssid->parent_cred == cred)
83 return cred->update_identifier;
90 struct wpabuf * hs20_build_anqp_req(u32 stypes, const u8 *payload,
96 buf = gas_anqp_build_initial_req(0, 100 + payload_len);
100 len_pos = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
101 wpabuf_put_be24(buf, OUI_WFA);
102 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
103 if (stypes == BIT(HS20_STYPE_NAI_HOME_REALM_QUERY)) {
104 wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY);
105 wpabuf_put_u8(buf, 0); /* Reserved */
107 wpabuf_put_data(buf, payload, payload_len);
108 } else if (stypes == BIT(HS20_STYPE_ICON_REQUEST)) {
109 wpabuf_put_u8(buf, HS20_STYPE_ICON_REQUEST);
110 wpabuf_put_u8(buf, 0); /* Reserved */
112 wpabuf_put_data(buf, payload, payload_len);
115 wpabuf_put_u8(buf, HS20_STYPE_QUERY_LIST);
116 wpabuf_put_u8(buf, 0); /* Reserved */
117 for (i = 0; i < 32; i++) {
119 wpabuf_put_u8(buf, i);
122 gas_anqp_set_element_len(buf, len_pos);
124 gas_anqp_set_len(buf);
130 int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
131 const u8 *payload, size_t payload_len)
139 freq = wpa_s->assoc_freq;
140 bss = wpa_bss_get_bssid(wpa_s, dst);
142 wpa_bss_anqp_unshare_alloc(bss);
148 wpa_printf(MSG_DEBUG, "HS20: ANQP Query Request to " MACSTR " for "
149 "subtypes 0x%x", MAC2STR(dst), stypes);
151 buf = hs20_build_anqp_req(stypes, payload, payload_len);
155 res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
157 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
161 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
168 void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
169 const u8 *sa, const u8 *data, size_t slen)
171 const u8 *pos = data;
173 struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
174 struct wpa_bss_anqp *anqp = NULL;
186 pos++; /* Reserved */
190 case HS20_STYPE_CAPABILITY_LIST:
191 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
192 " HS Capability List", MAC2STR(sa));
193 wpa_hexdump_ascii(MSG_DEBUG, "HS Capability List", pos, slen);
195 case HS20_STYPE_OPERATOR_FRIENDLY_NAME:
196 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
197 " Operator Friendly Name", MAC2STR(sa));
198 wpa_hexdump_ascii(MSG_DEBUG, "oper friendly name", pos, slen);
200 wpabuf_free(anqp->hs20_operator_friendly_name);
201 anqp->hs20_operator_friendly_name =
202 wpabuf_alloc_copy(pos, slen);
205 case HS20_STYPE_WAN_METRICS:
206 wpa_hexdump(MSG_DEBUG, "WAN Metrics", pos, slen);
208 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short WAN "
209 "Metrics value from " MACSTR, MAC2STR(sa));
212 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
213 " WAN Metrics %02x:%u:%u:%u:%u:%u", MAC2STR(sa),
214 pos[0], WPA_GET_LE32(pos + 1), WPA_GET_LE32(pos + 5),
215 pos[9], pos[10], WPA_GET_LE16(pos + 11));
217 wpabuf_free(anqp->hs20_wan_metrics);
218 anqp->hs20_wan_metrics = wpabuf_alloc_copy(pos, slen);
221 case HS20_STYPE_CONNECTION_CAPABILITY:
222 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
223 " Connection Capability", MAC2STR(sa));
224 wpa_hexdump_ascii(MSG_DEBUG, "conn capability", pos, slen);
226 wpabuf_free(anqp->hs20_connection_capability);
227 anqp->hs20_connection_capability =
228 wpabuf_alloc_copy(pos, slen);
231 case HS20_STYPE_OPERATING_CLASS:
232 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
233 " Operating Class", MAC2STR(sa));
234 wpa_hexdump_ascii(MSG_DEBUG, "Operating Class", pos, slen);
236 wpabuf_free(anqp->hs20_operating_class);
237 anqp->hs20_operating_class =
238 wpabuf_alloc_copy(pos, slen);
241 case HS20_STYPE_ICON_BINARY_FILE:
242 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
243 " Icon Binary File", MAC2STR(sa));
246 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon "
247 "Binary File value from " MACSTR, MAC2STR(sa));
251 wpa_printf(MSG_DEBUG, "HS 2.0: Download Status Code %u", *pos);
255 if ((size_t) 1 + pos[0] > slen) {
256 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon "
257 "Binary File value from " MACSTR, MAC2STR(sa));
260 wpa_hexdump_ascii(MSG_DEBUG, "Icon Type", pos + 1, pos[0]);
265 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon "
266 "Binary File value from " MACSTR, MAC2STR(sa));
269 data_len = WPA_GET_BE16(pos);
273 if (data_len > slen) {
274 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short Icon "
275 "Binary File value from " MACSTR, MAC2STR(sa));
279 wpa_printf(MSG_DEBUG, "Icon Binary Data: %u bytes", data_len);
282 wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);
288 void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
289 const char *url, u8 osu_method)
292 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION "%u %s",
295 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION);
299 void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
300 u16 reauth_delay, const char *url)
302 if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
303 wpa_printf(MSG_DEBUG, "HS 2.0: Ignore deauthentication imminent notice since PMF was not enabled");
307 wpa_msg(wpa_s, MSG_INFO, HS20_DEAUTH_IMMINENT_NOTICE "%u %u %s",
308 code, reauth_delay, url);
310 if (code == HS20_DEAUTH_REASON_CODE_BSS) {
311 wpa_printf(MSG_DEBUG, "HS 2.0: Add BSS to blacklist");
312 wpa_blacklist_add(wpa_s, wpa_s->bssid);
315 if (code == HS20_DEAUTH_REASON_CODE_ESS && wpa_s->current_ssid) {
318 if (now.sec + reauth_delay <=
319 wpa_s->current_ssid->disabled_until.sec)
321 wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds",
323 wpa_s->current_ssid->disabled_until.sec =
324 now.sec + reauth_delay;