2 * Copyright (c) 2009, Atheros Communications, Inc.
3 * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
13 #include "common/ieee802_11_common.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/gas.h"
16 #include "common/wpa_ctrl.h"
17 #include "rsn_supp/wpa.h"
18 #include "wpa_supplicant_i.h"
22 #include "blacklist.h"
23 #include "gas_query.h"
24 #include "interworking.h"
25 #include "hs20_supplicant.h"
28 void wpas_hs20_add_indication(struct wpabuf *buf, int pps_mo_id)
32 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC);
33 wpabuf_put_u8(buf, pps_mo_id >= 0 ? 7 : 5);
34 wpabuf_put_be24(buf, OUI_WFA);
35 wpabuf_put_u8(buf, HS20_INDICATION_OUI_TYPE);
38 conf |= HS20_PPS_MO_ID_PRESENT;
39 wpabuf_put_u8(buf, conf);
41 wpabuf_put_le16(buf, pps_mo_id);
45 int is_hs20_network(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
48 if (!wpa_s->conf->hs20 || !ssid)
51 if (ssid->parent_cred)
54 if (bss && !wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE))
58 * This may catch some non-Hotspot 2.0 cases, but it is safer to do that
59 * than cause Hotspot 2.0 connections without indication element getting
60 * added. Non-Hotspot 2.0 APs should ignore the unknown vendor element.
63 if (!(ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X))
65 if (!(ssid->pairwise_cipher & WPA_CIPHER_CCMP))
67 if (ssid->proto != WPA_PROTO_RSN)
74 int hs20_get_pps_mo_id(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
76 struct wpa_cred *cred;
78 if (ssid == NULL || ssid->parent_cred == NULL)
81 for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
82 if (ssid->parent_cred == cred)
83 return cred->update_identifier;
90 struct wpabuf * hs20_build_anqp_req(u32 stypes, const u8 *payload,
96 buf = gas_anqp_build_initial_req(0, 100 + payload_len);
100 len_pos = gas_anqp_add_element(buf, ANQP_VENDOR_SPECIFIC);
101 wpabuf_put_be24(buf, OUI_WFA);
102 wpabuf_put_u8(buf, HS20_ANQP_OUI_TYPE);
103 if (stypes == BIT(HS20_STYPE_NAI_HOME_REALM_QUERY)) {
104 wpabuf_put_u8(buf, HS20_STYPE_NAI_HOME_REALM_QUERY);
105 wpabuf_put_u8(buf, 0); /* Reserved */
107 wpabuf_put_data(buf, payload, payload_len);
110 wpabuf_put_u8(buf, HS20_STYPE_QUERY_LIST);
111 wpabuf_put_u8(buf, 0); /* Reserved */
112 for (i = 0; i < 32; i++) {
114 wpabuf_put_u8(buf, i);
117 gas_anqp_set_element_len(buf, len_pos);
119 gas_anqp_set_len(buf);
125 int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
126 const u8 *payload, size_t payload_len)
134 freq = wpa_s->assoc_freq;
135 bss = wpa_bss_get_bssid(wpa_s, dst);
137 wpa_bss_anqp_unshare_alloc(bss);
143 wpa_printf(MSG_DEBUG, "HS20: ANQP Query Request to " MACSTR " for "
144 "subtypes 0x%x", MAC2STR(dst), stypes);
146 buf = hs20_build_anqp_req(stypes, payload, payload_len);
150 res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
152 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
156 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
163 void hs20_parse_rx_hs20_anqp_resp(struct wpa_supplicant *wpa_s,
164 const u8 *sa, const u8 *data, size_t slen)
166 const u8 *pos = data;
168 struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
169 struct wpa_bss_anqp *anqp = NULL;
180 pos++; /* Reserved */
184 case HS20_STYPE_CAPABILITY_LIST:
185 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
186 " HS Capability List", MAC2STR(sa));
187 wpa_hexdump_ascii(MSG_DEBUG, "HS Capability List", pos, slen);
189 case HS20_STYPE_OPERATOR_FRIENDLY_NAME:
190 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
191 " Operator Friendly Name", MAC2STR(sa));
192 wpa_hexdump_ascii(MSG_DEBUG, "oper friendly name", pos, slen);
194 wpabuf_free(anqp->hs20_operator_friendly_name);
195 anqp->hs20_operator_friendly_name =
196 wpabuf_alloc_copy(pos, slen);
199 case HS20_STYPE_WAN_METRICS:
200 wpa_hexdump(MSG_DEBUG, "WAN Metrics", pos, slen);
202 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: Too short WAN "
203 "Metrics value from " MACSTR, MAC2STR(sa));
206 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
207 " WAN Metrics %02x:%u:%u:%u:%u:%u", MAC2STR(sa),
208 pos[0], WPA_GET_LE32(pos + 1), WPA_GET_LE32(pos + 5),
209 pos[9], pos[10], WPA_GET_LE16(pos + 11));
211 wpabuf_free(anqp->hs20_wan_metrics);
212 anqp->hs20_wan_metrics = wpabuf_alloc_copy(pos, slen);
215 case HS20_STYPE_CONNECTION_CAPABILITY:
216 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
217 " Connection Capability", MAC2STR(sa));
218 wpa_hexdump_ascii(MSG_DEBUG, "conn capability", pos, slen);
220 wpabuf_free(anqp->hs20_connection_capability);
221 anqp->hs20_connection_capability =
222 wpabuf_alloc_copy(pos, slen);
225 case HS20_STYPE_OPERATING_CLASS:
226 wpa_msg(wpa_s, MSG_INFO, "RX-HS20-ANQP " MACSTR
227 " Operating Class", MAC2STR(sa));
228 wpa_hexdump_ascii(MSG_DEBUG, "Operating Class", pos, slen);
230 wpabuf_free(anqp->hs20_operating_class);
231 anqp->hs20_operating_class =
232 wpabuf_alloc_copy(pos, slen);
236 wpa_printf(MSG_DEBUG, "HS20: Unsupported subtype %u", subtype);
242 void hs20_rx_subscription_remediation(struct wpa_supplicant *wpa_s,
243 const char *url, u8 osu_method)
246 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION "%u %s",
249 wpa_msg(wpa_s, MSG_INFO, HS20_SUBSCRIPTION_REMEDIATION);
253 void hs20_rx_deauth_imminent_notice(struct wpa_supplicant *wpa_s, u8 code,
254 u16 reauth_delay, const char *url)
256 if (!wpa_sm_pmf_enabled(wpa_s->wpa)) {
257 wpa_printf(MSG_DEBUG, "HS 2.0: Ignore deauthentication imminent notice since PMF was not enabled");
261 wpa_msg(wpa_s, MSG_INFO, HS20_DEAUTH_IMMINENT_NOTICE "%u %u %s",
262 code, reauth_delay, url);
264 if (code == HS20_DEAUTH_REASON_CODE_BSS) {
265 wpa_printf(MSG_DEBUG, "HS 2.0: Add BSS to blacklist");
266 wpa_blacklist_add(wpa_s, wpa_s->bssid);
269 if (code == HS20_DEAUTH_REASON_CODE_ESS && wpa_s->current_ssid) {
272 if (now.sec + reauth_delay <=
273 wpa_s->current_ssid->disabled_until.sec)
275 wpa_printf(MSG_DEBUG, "HS 2.0: Disable network for %u seconds",
277 wpa_s->current_ssid->disabled_until.sec =
278 now.sec + reauth_delay;