wpa_supplicant/interworking.c

   1 /*
   2  * Interworking (IEEE 802.11u)
   3  * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "common/ieee802_11_defs.h"
  13 #include "common/gas.h"
  14 #include "common/wpa_ctrl.h"
  15 #include "utils/pcsc_funcs.h"
  16 #include "drivers/driver.h"
  17 #include "eap_common/eap_defs.h"
  18 #include "eap_peer/eap_methods.h"
  19 #include "wpa_supplicant_i.h"
  20 #include "config.h"
  21 #include "config_ssid.h"
  22 #include "bss.h"
  23 #include "scan.h"
  24 #include "notify.h"
  25 #include "gas_query.h"
  26 #include "hs20_supplicant.h"
  27 #include "interworking.h"
  28
  29
  30 #if defined(EAP_SIM) | defined(EAP_SIM_DYNAMIC)
  31 #define INTERWORKING_3GPP
  32 #else
  33 #if defined(EAP_AKA) | defined(EAP_AKA_DYNAMIC)
  34 #define INTERWORKING_3GPP
  35 #else
  36 #if defined(EAP_AKA_PRIME) | defined(EAP_AKA_PRIME_DYNAMIC)
  37 #define INTERWORKING_3GPP
  38 #endif
  39 #endif
  40 #endif
  41
  42 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s);
  43
  44
  45 static void interworking_reconnect(struct wpa_supplicant *wpa_s)
  46 {
  47         if (wpa_s->wpa_state >= WPA_AUTHENTICATING) {
  48                 wpa_supplicant_cancel_sched_scan(wpa_s);
  49                 wpa_supplicant_deauthenticate(wpa_s,
  50                                               WLAN_REASON_DEAUTH_LEAVING);
  51         }
  52         wpa_s->disconnected = 0;
  53         wpa_s->reassociate = 1;
  54         wpa_supplicant_req_scan(wpa_s, 0, 0);
  55 }
  56
  57
  58 static struct wpabuf * anqp_build_req(u16 info_ids[], size_t num_ids,
  59                                       struct wpabuf *extra)
  60 {
  61         struct wpabuf *buf;
  62         size_t i;
  63         u8 *len_pos;
  64
  65         buf = gas_anqp_build_initial_req(0, 4 + num_ids * 2 +
  66                                          (extra ? wpabuf_len(extra) : 0));
  67         if (buf == NULL)
  68                 return NULL;
  69
  70         len_pos = gas_anqp_add_element(buf, ANQP_QUERY_LIST);
  71         for (i = 0; i < num_ids; i++)
  72                 wpabuf_put_le16(buf, info_ids[i]);
  73         gas_anqp_set_element_len(buf, len_pos);
  74         if (extra)
  75                 wpabuf_put_buf(buf, extra);
  76
  77         gas_anqp_set_len(buf);
  78
  79         return buf;
  80 }
  81
  82
  83 static void interworking_anqp_resp_cb(void *ctx, const u8 *dst,
  84                                       u8 dialog_token,
  85                                       enum gas_query_result result,
  86                                       const struct wpabuf *adv_proto,
  87                                       const struct wpabuf *resp,
  88                                       u16 status_code)
  89 {
  90         struct wpa_supplicant *wpa_s = ctx;
  91
  92         anqp_resp_cb(wpa_s, dst, dialog_token, result, adv_proto, resp,
  93                      status_code);
  94         interworking_next_anqp_fetch(wpa_s);
  95 }
  96
  97
  98 static int interworking_anqp_send_req(struct wpa_supplicant *wpa_s,
  99                                       struct wpa_bss *bss)
 100 {
 101         struct wpabuf *buf;
 102         int ret = 0;
 103         int res;
 104         u16 info_ids[] = {
 105                 ANQP_CAPABILITY_LIST,
 106                 ANQP_VENUE_NAME,
 107                 ANQP_NETWORK_AUTH_TYPE,
 108                 ANQP_ROAMING_CONSORTIUM,
 109                 ANQP_IP_ADDR_TYPE_AVAILABILITY,
 110                 ANQP_NAI_REALM,
 111                 ANQP_3GPP_CELLULAR_NETWORK,
 112                 ANQP_DOMAIN_NAME
 113         };
 114         struct wpabuf *extra = NULL;
 115
 116         wpa_printf(MSG_DEBUG, "Interworking: ANQP Query Request to " MACSTR,
 117                    MAC2STR(bss->bssid));
 118
 119 #ifdef CONFIG_HS20
 120         if (wpa_bss_get_vendor_ie(bss, HS20_IE_VENDOR_TYPE)) {
 121                 u8 *len_pos;
 122
 123                 extra = wpabuf_alloc(100);
 124                 if (!extra)
 125                         return -1;
 126
 127                 len_pos = gas_anqp_add_element(extra, ANQP_VENDOR_SPECIFIC);
 128                 wpabuf_put_be24(extra, OUI_WFA);
 129                 wpabuf_put_u8(extra, HS20_ANQP_OUI_TYPE);
 130                 wpabuf_put_u8(extra, HS20_STYPE_QUERY_LIST);
 131                 wpabuf_put_u8(extra, 0); /* Reserved */
 132                 wpabuf_put_u8(extra, HS20_STYPE_CAPABILITY_LIST);
 133                 wpabuf_put_u8(extra, HS20_STYPE_OPERATOR_FRIENDLY_NAME);
 134                 wpabuf_put_u8(extra, HS20_STYPE_WAN_METRICS);
 135                 wpabuf_put_u8(extra, HS20_STYPE_CONNECTION_CAPABILITY);
 136                 wpabuf_put_u8(extra, HS20_STYPE_OPERATING_CLASS);
 137                 gas_anqp_set_element_len(extra, len_pos);
 138         }
 139 #endif /* CONFIG_HS20 */
 140
 141         buf = anqp_build_req(info_ids, sizeof(info_ids) / sizeof(info_ids[0]),
 142                              extra);
 143         wpabuf_free(extra);
 144         if (buf == NULL)
 145                 return -1;
 146
 147         res = gas_query_req(wpa_s->gas, bss->bssid, bss->freq, buf,
 148                             interworking_anqp_resp_cb, wpa_s);
 149         if (res < 0) {
 150                 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
 151                 ret = -1;
 152         } else
 153                 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
 154                            "%u", res);
 155
 156         wpabuf_free(buf);
 157         return ret;
 158 }
 159
 160
 161 struct nai_realm_eap {
 162         u8 method;
 163         u8 inner_method;
 164         enum nai_realm_eap_auth_inner_non_eap inner_non_eap;
 165         u8 cred_type;
 166         u8 tunneled_cred_type;
 167 };
 168
 169 struct nai_realm {
 170         u8 encoding;
 171         char *realm;
 172         u8 eap_count;
 173         struct nai_realm_eap *eap;
 174 };
 175
 176
 177 static void nai_realm_free(struct nai_realm *realms, u16 count)
 178 {
 179         u16 i;
 180
 181         if (realms == NULL)
 182                 return;
 183         for (i = 0; i < count; i++) {
 184                 os_free(realms[i].eap);
 185                 os_free(realms[i].realm);
 186         }
 187         os_free(realms);
 188 }
 189
 190
 191 static const u8 * nai_realm_parse_eap(struct nai_realm_eap *e, const u8 *pos,
 192                                       const u8 *end)
 193 {
 194         u8 elen, auth_count, a;
 195         const u8 *e_end;
 196
 197         if (pos + 3 > end) {
 198                 wpa_printf(MSG_DEBUG, "No room for EAP Method fixed fields");
 199                 return NULL;
 200         }
 201
 202         elen = *pos++;
 203         if (pos + elen > end || elen < 2) {
 204                 wpa_printf(MSG_DEBUG, "No room for EAP Method subfield");
 205                 return NULL;
 206         }
 207         e_end = pos + elen;
 208         e->method = *pos++;
 209         auth_count = *pos++;
 210         wpa_printf(MSG_DEBUG, "EAP Method: len=%u method=%u auth_count=%u",
 211                    elen, e->method, auth_count);
 212
 213         for (a = 0; a < auth_count; a++) {
 214                 u8 id, len;
 215
 216                 if (pos + 2 > end || pos + 2 + pos[1] > end) {
 217                         wpa_printf(MSG_DEBUG, "No room for Authentication "
 218                                    "Parameter subfield");
 219                         return NULL;
 220                 }
 221
 222                 id = *pos++;
 223                 len = *pos++;
 224
 225                 switch (id) {
 226                 case NAI_REALM_EAP_AUTH_NON_EAP_INNER_AUTH:
 227                         if (len < 1)
 228                                 break;
 229                         e->inner_non_eap = *pos;
 230                         if (e->method != EAP_TYPE_TTLS)
 231                                 break;
 232                         switch (*pos) {
 233                         case NAI_REALM_INNER_NON_EAP_PAP:
 234                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP");
 235                                 break;
 236                         case NAI_REALM_INNER_NON_EAP_CHAP:
 237                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP");
 238                                 break;
 239                         case NAI_REALM_INNER_NON_EAP_MSCHAP:
 240                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP");
 241                                 break;
 242                         case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
 243                                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2");
 244                                 break;
 245                         }
 246                         break;
 247                 case NAI_REALM_EAP_AUTH_INNER_AUTH_EAP_METHOD:
 248                         if (len < 1)
 249                                 break;
 250                         e->inner_method = *pos;
 251                         wpa_printf(MSG_DEBUG, "Inner EAP method: %u",
 252                                    e->inner_method);
 253                         break;
 254                 case NAI_REALM_EAP_AUTH_CRED_TYPE:
 255                         if (len < 1)
 256                                 break;
 257                         e->cred_type = *pos;
 258                         wpa_printf(MSG_DEBUG, "Credential Type: %u",
 259                                    e->cred_type);
 260                         break;
 261                 case NAI_REALM_EAP_AUTH_TUNNELED_CRED_TYPE:
 262                         if (len < 1)
 263                                 break;
 264                         e->tunneled_cred_type = *pos;
 265                         wpa_printf(MSG_DEBUG, "Tunneled EAP Method Credential "
 266                                    "Type: %u", e->tunneled_cred_type);
 267                         break;
 268                 default:
 269                         wpa_printf(MSG_DEBUG, "Unsupported Authentication "
 270                                    "Parameter: id=%u len=%u", id, len);
 271                         wpa_hexdump(MSG_DEBUG, "Authentication Parameter "
 272                                     "Value", pos, len);
 273                         break;
 274                 }
 275
 276                 pos += len;
 277         }
 278
 279         return e_end;
 280 }
 281
 282
 283 static const u8 * nai_realm_parse_realm(struct nai_realm *r, const u8 *pos,
 284                                         const u8 *end)
 285 {
 286         u16 len;
 287         const u8 *f_end;
 288         u8 realm_len, e;
 289
 290         if (end - pos < 4) {
 291                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 292                            "fixed fields");
 293                 return NULL;
 294         }
 295
 296         len = WPA_GET_LE16(pos); /* NAI Realm Data field Length */
 297         pos += 2;
 298         if (pos + len > end || len < 3) {
 299                 wpa_printf(MSG_DEBUG, "No room for NAI Realm Data "
 300                            "(len=%u; left=%u)",
 301                            len, (unsigned int) (end - pos));
 302                 return NULL;
 303         }
 304         f_end = pos + len;
 305
 306         r->encoding = *pos++;
 307         realm_len = *pos++;
 308         if (pos + realm_len > f_end) {
 309                 wpa_printf(MSG_DEBUG, "No room for NAI Realm "
 310                            "(len=%u; left=%u)",
 311                            realm_len, (unsigned int) (f_end - pos));
 312                 return NULL;
 313         }
 314         wpa_hexdump_ascii(MSG_DEBUG, "NAI Realm", pos, realm_len);
 315         r->realm = os_malloc(realm_len + 1);
 316         if (r->realm == NULL)
 317                 return NULL;
 318         os_memcpy(r->realm, pos, realm_len);
 319         r->realm[realm_len] = '\0';
 320         pos += realm_len;
 321
 322         if (pos + 1 > f_end) {
 323                 wpa_printf(MSG_DEBUG, "No room for EAP Method Count");
 324                 return NULL;
 325         }
 326         r->eap_count = *pos++;
 327         wpa_printf(MSG_DEBUG, "EAP Count: %u", r->eap_count);
 328         if (pos + r->eap_count * 3 > f_end) {
 329                 wpa_printf(MSG_DEBUG, "No room for EAP Methods");
 330                 return NULL;
 331         }
 332         r->eap = os_zalloc(r->eap_count * sizeof(struct nai_realm_eap));
 333         if (r->eap == NULL)
 334                 return NULL;
 335
 336         for (e = 0; e < r->eap_count; e++) {
 337                 pos = nai_realm_parse_eap(&r->eap[e], pos, f_end);
 338                 if (pos == NULL)
 339                         return NULL;
 340         }
 341
 342         return f_end;
 343 }
 344
 345
 346 static struct nai_realm * nai_realm_parse(struct wpabuf *anqp, u16 *count)
 347 {
 348         struct nai_realm *realm;
 349         const u8 *pos, *end;
 350         u16 i, num;
 351
 352         if (anqp == NULL || wpabuf_len(anqp) < 2)
 353                 return NULL;
 354
 355         pos = wpabuf_head_u8(anqp);
 356         end = pos + wpabuf_len(anqp);
 357         num = WPA_GET_LE16(pos);
 358         wpa_printf(MSG_DEBUG, "NAI Realm Count: %u", num);
 359         pos += 2;
 360
 361         if (num * 5 > end - pos) {
 362                 wpa_printf(MSG_DEBUG, "Invalid NAI Realm Count %u - not "
 363                            "enough data (%u octets) for that many realms",
 364                            num, (unsigned int) (end - pos));
 365                 return NULL;
 366         }
 367
 368         realm = os_zalloc(num * sizeof(struct nai_realm));
 369         if (realm == NULL)
 370                 return NULL;
 371
 372         for (i = 0; i < num; i++) {
 373                 pos = nai_realm_parse_realm(&realm[i], pos, end);
 374                 if (pos == NULL) {
 375                         nai_realm_free(realm, num);
 376                         return NULL;
 377                 }
 378         }
 379
 380         *count = num;
 381         return realm;
 382 }
 383
 384
 385 static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
 386 {
 387         char *tmp, *pos, *end;
 388         int match = 0;
 389
 390         if (realm->realm == NULL || home_realm == NULL)
 391                 return 0;
 392
 393         if (os_strchr(realm->realm, ';') == NULL)
 394                 return os_strcasecmp(realm->realm, home_realm) == 0;
 395
 396         tmp = os_strdup(realm->realm);
 397         if (tmp == NULL)
 398                 return 0;
 399
 400         pos = tmp;
 401         while (*pos) {
 402                 end = os_strchr(pos, ';');
 403                 if (end)
 404                         *end = '\0';
 405                 if (os_strcasecmp(pos, home_realm) == 0) {
 406                         match = 1;
 407                         break;
 408                 }
 409                 if (end == NULL)
 410                         break;
 411                 pos = end + 1;
 412         }
 413
 414         os_free(tmp);
 415
 416         return match;
 417 }
 418
 419
 420 static int nai_realm_cred_username(struct nai_realm_eap *eap)
 421 {
 422         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
 423                 return 0; /* method not supported */
 424
 425         if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP) {
 426                 /* Only tunneled methods with username/password supported */
 427                 return 0;
 428         }
 429
 430         if (eap->method == EAP_TYPE_PEAP &&
 431             eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
 432                 return 0;
 433
 434         if (eap->method == EAP_TYPE_TTLS) {
 435                 if (eap->inner_method == 0 && eap->inner_non_eap == 0)
 436                         return 0;
 437                 if (eap->inner_method &&
 438                     eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL)
 439                         return 0;
 440                 if (eap->inner_non_eap &&
 441                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
 442                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
 443                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
 444                     eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2)
 445                         return 0;
 446         }
 447
 448         if (eap->inner_method &&
 449             eap->inner_method != EAP_TYPE_GTC &&
 450             eap->inner_method != EAP_TYPE_MSCHAPV2)
 451                 return 0;
 452
 453         return 1;
 454 }
 455
 456
 457 static int nai_realm_cred_cert(struct nai_realm_eap *eap)
 458 {
 459         if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
 460                 return 0; /* method not supported */
 461
 462         if (eap->method != EAP_TYPE_TLS) {
 463                 /* Only EAP-TLS supported for credential authentication */
 464                 return 0;
 465         }
 466
 467         return 1;
 468 }
 469
 470
 471 static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred,
 472                                                  struct nai_realm *realm)
 473 {
 474         u8 e;
 475
 476         if (cred == NULL ||
 477             cred->username == NULL ||
 478             cred->username[0] == '\0' ||
 479             ((cred->password == NULL ||
 480               cred->password[0] == '\0') &&
 481              (cred->private_key == NULL ||
 482               cred->private_key[0] == '\0')))
 483                 return NULL;
 484
 485         for (e = 0; e < realm->eap_count; e++) {
 486                 struct nai_realm_eap *eap = &realm->eap[e];
 487                 if (cred->password && cred->password[0] &&
 488                     nai_realm_cred_username(eap))
 489                         return eap;
 490                 if (cred->private_key && cred->private_key[0] &&
 491                     nai_realm_cred_cert(eap))
 492                         return eap;
 493         }
 494
 495         return NULL;
 496 }
 497
 498
 499 #ifdef INTERWORKING_3GPP
 500
 501 static int plmn_id_match(struct wpabuf *anqp, const char *imsi, int mnc_len)
 502 {
 503         u8 plmn[3];
 504         const u8 *pos, *end;
 505         u8 udhl;
 506
 507         /* See Annex A of 3GPP TS 24.234 v8.1.0 for description */
 508         plmn[0] = (imsi[0] - '0') | ((imsi[1] - '0') << 4);
 509         plmn[1] = imsi[2] - '0';
 510         /* default to MNC length 3 if unknown */
 511         if (mnc_len != 2)
 512                 plmn[1] |= (imsi[5] - '0') << 4;
 513         else
 514                 plmn[1] |= 0xf0;
 515         plmn[2] = (imsi[3] - '0') | ((imsi[4] - '0') << 4);
 516
 517         if (anqp == NULL)
 518                 return 0;
 519         pos = wpabuf_head_u8(anqp);
 520         end = pos + wpabuf_len(anqp);
 521         if (pos + 2 > end)
 522                 return 0;
 523         if (*pos != 0) {
 524                 wpa_printf(MSG_DEBUG, "Unsupported GUD version 0x%x", *pos);
 525                 return 0;
 526         }
 527         pos++;
 528         udhl = *pos++;
 529         if (pos + udhl > end) {
 530                 wpa_printf(MSG_DEBUG, "Invalid UDHL");
 531                 return 0;
 532         }
 533         end = pos + udhl;
 534
 535         while (pos + 2 <= end) {
 536                 u8 iei, len;
 537                 const u8 *l_end;
 538                 iei = *pos++;
 539                 len = *pos++ & 0x7f;
 540                 if (pos + len > end)
 541                         break;
 542                 l_end = pos + len;
 543
 544                 if (iei == 0 && len > 0) {
 545                         /* PLMN List */
 546                         u8 num, i;
 547                         num = *pos++;
 548                         for (i = 0; i < num; i++) {
 549                                 if (pos + 3 > end)
 550                                         break;
 551                                 if (os_memcmp(pos, plmn, 3) == 0)
 552                                         return 1; /* Found matching PLMN */
 553                         }
 554                 }
 555
 556                 pos = l_end;
 557         }
 558
 559         return 0;
 560 }
 561
 562
 563 static int build_root_nai(char *nai, size_t nai_len, const char *imsi,
 564                           char prefix)
 565 {
 566         const char *sep, *msin;
 567         char *end, *pos;
 568         size_t msin_len, plmn_len;
 569
 570         /*
 571          * TS 23.003, Clause 14 (3GPP to WLAN Interworking)
 572          * Root NAI:
 573          * <aka:0|sim:1><IMSI>@wlan.mnc<MNC>.mcc<MCC>.3gppnetwork.org
 574          * <MNC> is zero-padded to three digits in case two-digit MNC is used
 575          */
 576
 577         if (imsi == NULL || os_strlen(imsi) > 16) {
 578                 wpa_printf(MSG_DEBUG, "No valid IMSI available");
 579                 return -1;
 580         }
 581         sep = os_strchr(imsi, '-');
 582         if (sep == NULL)
 583                 return -1;
 584         plmn_len = sep - imsi;
 585         if (plmn_len != 5 && plmn_len != 6)
 586                 return -1;
 587         msin = sep + 1;
 588         msin_len = os_strlen(msin);
 589
 590         pos = nai;
 591         end = nai + nai_len;
 592         if (prefix)
 593                 *pos++ = prefix;
 594         os_memcpy(pos, imsi, plmn_len);
 595         pos += plmn_len;
 596         os_memcpy(pos, msin, msin_len);
 597         pos += msin_len;
 598         pos += os_snprintf(pos, end - pos, "@wlan.mnc");
 599         if (plmn_len == 5) {
 600                 *pos++ = '0';
 601                 *pos++ = imsi[3];
 602                 *pos++ = imsi[4];
 603         } else {
 604                 *pos++ = imsi[3];
 605                 *pos++ = imsi[4];
 606                 *pos++ = imsi[5];
 607         }
 608         pos += os_snprintf(pos, end - pos, ".mcc%c%c%c.3gppnetwork.org",
 609                            imsi[0], imsi[1], imsi[2]);
 610
 611         return 0;
 612 }
 613
 614
 615 static int set_root_nai(struct wpa_ssid *ssid, const char *imsi, char prefix)
 616 {
 617         char nai[100];
 618         if (build_root_nai(nai, sizeof(nai), imsi, prefix) < 0)
 619                 return -1;
 620         return wpa_config_set_quoted(ssid, "identity", nai);
 621 }
 622
 623 #endif /* INTERWORKING_3GPP */
 624
 625
 626 static int interworking_connect_3gpp(struct wpa_supplicant *wpa_s,
 627                                      struct wpa_bss *bss)
 628 {
 629 #ifdef INTERWORKING_3GPP
 630         struct wpa_cred *cred;
 631         struct wpa_ssid *ssid;
 632         const u8 *ie;
 633
 634         if (bss->anqp_3gpp == NULL)
 635                 return -1;
 636
 637         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 638                 char *sep;
 639                 const char *imsi;
 640                 int mnc_len;
 641
 642 #ifdef PCSC_FUNCS
 643                 if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
 644                     wpa_s->imsi[0]) {
 645                         imsi = wpa_s->imsi;
 646                         mnc_len = wpa_s->mnc_len;
 647                         goto compare;
 648                 }
 649 #endif /* PCSC_FUNCS */
 650
 651                 if (cred->imsi == NULL || !cred->imsi[0] ||
 652                     cred->milenage == NULL || !cred->milenage[0])
 653                         continue;
 654
 655                 sep = os_strchr(cred->imsi, '-');
 656                 if (sep == NULL ||
 657                     (sep - cred->imsi != 5 && sep - cred->imsi != 6))
 658                         continue;
 659                 mnc_len = sep - cred->imsi - 3;
 660                 imsi = cred->imsi;
 661
 662 #ifdef PCSC_FUNCS
 663         compare:
 664 #endif /* PCSC_FUNCS */
 665                 if (plmn_id_match(bss->anqp_3gpp, imsi, mnc_len))
 666                         break;
 667         }
 668         if (cred == NULL)
 669                 return -1;
 670
 671         ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
 672         if (ie == NULL)
 673                 return -1;
 674         wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR " (3GPP)",
 675                    MAC2STR(bss->bssid));
 676
 677         ssid = wpa_config_add_network(wpa_s->conf);
 678         if (ssid == NULL)
 679                 return -1;
 680
 681         wpas_notify_network_added(wpa_s, ssid);
 682         wpa_config_set_network_defaults(ssid);
 683         ssid->priority = cred->priority;
 684         ssid->temporary = 1;
 685         ssid->ssid = os_zalloc(ie[1] + 1);
 686         if (ssid->ssid == NULL)
 687                 goto fail;
 688         os_memcpy(ssid->ssid, ie + 2, ie[1]);
 689         ssid->ssid_len = ie[1];
 690
 691         /* TODO: figure out whether to use EAP-SIM, EAP-AKA, or EAP-AKA' */
 692         if (wpa_config_set(ssid, "eap", "SIM", 0) < 0) {
 693                 wpa_printf(MSG_DEBUG, "EAP-SIM not supported");
 694                 goto fail;
 695         }
 696         if (cred->pcsc && wpa_s->scard && scard_supports_umts(wpa_s->scard))
 697                 wpa_config_set(ssid, "eap", "AKA", 0);
 698         if (!cred->pcsc && set_root_nai(ssid, cred->imsi, '1') < 0) {
 699                 wpa_printf(MSG_DEBUG, "Failed to set Root NAI");
 700                 goto fail;
 701         }
 702
 703         if (cred->milenage && cred->milenage[0]) {
 704                 if (wpa_config_set_quoted(ssid, "password",
 705                                           cred->milenage) < 0)
 706                         goto fail;
 707         } else if (cred->pcsc) {
 708                 if (wpa_config_set_quoted(ssid, "pcsc", "") < 0)
 709                         goto fail;
 710                 if (wpa_s->conf->pcsc_pin &&
 711                     wpa_config_set_quoted(ssid, "pin", wpa_s->conf->pcsc_pin)
 712                     < 0)
 713                         goto fail;
 714         }
 715
 716         if (cred->password && cred->password[0] &&
 717             wpa_config_set_quoted(ssid, "password", cred->password) < 0)
 718                 goto fail;
 719
 720         wpa_config_update_prio_list(wpa_s->conf);
 721         interworking_reconnect(wpa_s);
 722
 723         return 0;
 724
 725 fail:
 726         wpas_notify_network_removed(wpa_s, ssid);
 727         wpa_config_remove_network(wpa_s->conf, ssid->id);
 728 #endif /* INTERWORKING_3GPP */
 729         return -1;
 730 }
 731
 732
 733 int interworking_connect(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 734 {
 735         struct wpa_cred *cred;
 736         struct wpa_ssid *ssid;
 737         struct nai_realm *realm;
 738         struct nai_realm_eap *eap = NULL;
 739         u16 count, i;
 740         char buf[100];
 741         const u8 *ie;
 742
 743         if (wpa_s->conf->cred == NULL || bss == NULL)
 744                 return -1;
 745         ie = wpa_bss_get_ie(bss, WLAN_EID_SSID);
 746         if (ie == NULL || ie[1] == 0) {
 747                 wpa_printf(MSG_DEBUG, "Interworking: No SSID known for "
 748                            MACSTR, MAC2STR(bss->bssid));
 749                 return -1;
 750         }
 751
 752         realm = nai_realm_parse(bss->anqp_nai_realm, &count);
 753         if (realm == NULL) {
 754                 wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
 755                            "Realm list from " MACSTR, MAC2STR(bss->bssid));
 756                 count = 0;
 757         }
 758
 759         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 760                 for (i = 0; i < count; i++) {
 761                         if (!nai_realm_match(&realm[i], cred->realm))
 762                                 continue;
 763                         eap = nai_realm_find_eap(cred, &realm[i]);
 764                         if (eap)
 765                                 break;
 766                 }
 767                 if (eap)
 768                         break;
 769         }
 770
 771         if (!eap) {
 772                 if (interworking_connect_3gpp(wpa_s, bss) == 0) {
 773                         if (realm)
 774                                 nai_realm_free(realm, count);
 775                         return 0;
 776                 }
 777
 778                 wpa_printf(MSG_DEBUG, "Interworking: No matching credentials "
 779                            "and EAP method found for " MACSTR,
 780                            MAC2STR(bss->bssid));
 781                 nai_realm_free(realm, count);
 782                 return -1;
 783         }
 784
 785         wpa_printf(MSG_DEBUG, "Interworking: Connect with " MACSTR,
 786                    MAC2STR(bss->bssid));
 787
 788         ssid = wpa_config_add_network(wpa_s->conf);
 789         if (ssid == NULL) {
 790                 nai_realm_free(realm, count);
 791                 return -1;
 792         }
 793         wpas_notify_network_added(wpa_s, ssid);
 794         wpa_config_set_network_defaults(ssid);
 795         ssid->priority = cred->priority;
 796         ssid->temporary = 1;
 797         ssid->ssid = os_zalloc(ie[1] + 1);
 798         if (ssid->ssid == NULL)
 799                 goto fail;
 800         os_memcpy(ssid->ssid, ie + 2, ie[1]);
 801         ssid->ssid_len = ie[1];
 802
 803         if (wpa_config_set(ssid, "eap", eap_get_name(EAP_VENDOR_IETF,
 804                                                      eap->method), 0) < 0)
 805                 goto fail;
 806
 807         if (eap->method == EAP_TYPE_TTLS &&
 808             cred->username && cred->username[0]) {
 809                 const char *pos;
 810                 char *anon;
 811                 /* Use anonymous NAI in Phase 1 */
 812                 pos = os_strchr(cred->username, '@');
 813                 if (pos) {
 814                         size_t buflen = 9 + os_strlen(pos) + 1;
 815                         anon = os_malloc(buflen);
 816                         if (anon == NULL)
 817                                 goto fail;
 818                         os_snprintf(anon, buflen, "anonymous%s", pos);
 819                 } else if (cred->realm) {
 820                         size_t buflen = 10 + os_strlen(cred->realm) + 1;
 821                         anon = os_malloc(buflen);
 822                         if (anon == NULL)
 823                                 goto fail;
 824                         os_snprintf(anon, buflen, "anonymous@%s", cred->realm);
 825                 } else {
 826                         anon = os_strdup("anonymous");
 827                         if (anon == NULL)
 828                                 goto fail;
 829                 }
 830                 if (wpa_config_set_quoted(ssid, "anonymous_identity", anon) <
 831                     0) {
 832                         os_free(anon);
 833                         goto fail;
 834                 }
 835                 os_free(anon);
 836         }
 837
 838         if (cred->username && cred->username[0] &&
 839             wpa_config_set_quoted(ssid, "identity", cred->username) < 0)
 840                 goto fail;
 841
 842         if (cred->password && cred->password[0] &&
 843             wpa_config_set_quoted(ssid, "password", cred->password) < 0)
 844                 goto fail;
 845
 846         if (cred->client_cert && cred->client_cert[0] &&
 847             wpa_config_set_quoted(ssid, "client_cert", cred->client_cert) < 0)
 848                 goto fail;
 849
 850         if (cred->private_key && cred->private_key[0] &&
 851             wpa_config_set_quoted(ssid, "private_key", cred->private_key) < 0)
 852                 goto fail;
 853
 854         if (cred->private_key_passwd && cred->private_key_passwd[0] &&
 855             wpa_config_set_quoted(ssid, "private_key_passwd",
 856                                   cred->private_key_passwd) < 0)
 857                 goto fail;
 858
 859         switch (eap->method) {
 860         case EAP_TYPE_TTLS:
 861                 if (eap->inner_method) {
 862                         os_snprintf(buf, sizeof(buf), "\"autheap=%s\"",
 863                                     eap_get_name(EAP_VENDOR_IETF,
 864                                                  eap->inner_method));
 865                         if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
 866                                 goto fail;
 867                         break;
 868                 }
 869                 switch (eap->inner_non_eap) {
 870                 case NAI_REALM_INNER_NON_EAP_PAP:
 871                         if (wpa_config_set(ssid, "phase2", "\"auth=PAP\"", 0) <
 872                             0)
 873                                 goto fail;
 874                         break;
 875                 case NAI_REALM_INNER_NON_EAP_CHAP:
 876                         if (wpa_config_set(ssid, "phase2", "\"auth=CHAP\"", 0)
 877                             < 0)
 878                                 goto fail;
 879                         break;
 880                 case NAI_REALM_INNER_NON_EAP_MSCHAP:
 881                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAP\"",
 882                                            0) < 0)
 883                                 goto fail;
 884                         break;
 885                 case NAI_REALM_INNER_NON_EAP_MSCHAPV2:
 886                         if (wpa_config_set(ssid, "phase2", "\"auth=MSCHAPV2\"",
 887                                            0) < 0)
 888                                 goto fail;
 889                         break;
 890                 }
 891                 break;
 892         case EAP_TYPE_PEAP:
 893                 os_snprintf(buf, sizeof(buf), "\"auth=%s\"",
 894                             eap_get_name(EAP_VENDOR_IETF, eap->inner_method));
 895                 if (wpa_config_set(ssid, "phase2", buf, 0) < 0)
 896                         goto fail;
 897                 break;
 898         case EAP_TYPE_TLS:
 899                 break;
 900         }
 901
 902         if (cred->ca_cert && cred->ca_cert[0] &&
 903             wpa_config_set_quoted(ssid, "ca_cert", cred->ca_cert) < 0)
 904                 goto fail;
 905
 906         nai_realm_free(realm, count);
 907
 908         wpa_config_update_prio_list(wpa_s->conf);
 909         interworking_reconnect(wpa_s);
 910
 911         return 0;
 912
 913 fail:
 914         wpas_notify_network_removed(wpa_s, ssid);
 915         wpa_config_remove_network(wpa_s->conf, ssid->id);
 916         nai_realm_free(realm, count);
 917         return -1;
 918 }
 919
 920
 921 static struct wpa_cred * interworking_credentials_available_3gpp(
 922         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 923 {
 924         struct wpa_cred *cred, *selected = NULL;
 925         int ret;
 926
 927 #ifdef INTERWORKING_3GPP
 928         if (bss->anqp_3gpp == NULL)
 929                 return NULL;
 930
 931         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 932                 char *sep;
 933                 const char *imsi;
 934                 int mnc_len;
 935
 936 #ifdef PCSC_FUNCS
 937                 if (cred->pcsc && wpa_s->conf->pcsc_reader && wpa_s->scard &&
 938                     wpa_s->imsi[0]) {
 939                         imsi = wpa_s->imsi;
 940                         mnc_len = wpa_s->mnc_len;
 941                         goto compare;
 942                 }
 943 #endif /* PCSC_FUNCS */
 944
 945                 if (cred->imsi == NULL || !cred->imsi[0] ||
 946                     cred->milenage == NULL || !cred->milenage[0])
 947                         continue;
 948
 949                 sep = os_strchr(cred->imsi, '-');
 950                 if (sep == NULL ||
 951                     (sep - cred->imsi != 5 && sep - cred->imsi != 6))
 952                         continue;
 953                 mnc_len = sep - cred->imsi - 3;
 954                 imsi = cred->imsi;
 955
 956 #ifdef PCSC_FUNCS
 957         compare:
 958 #endif /* PCSC_FUNCS */
 959                 wpa_printf(MSG_DEBUG, "Interworking: Parsing 3GPP info from "
 960                            MACSTR, MAC2STR(bss->bssid));
 961                 ret = plmn_id_match(bss->anqp_3gpp, imsi, mnc_len);
 962                 wpa_printf(MSG_DEBUG, "PLMN match %sfound", ret ? "" : "not ");
 963                 if (ret) {
 964                         if (selected == NULL ||
 965                             selected->priority < cred->priority)
 966                                 selected = cred;
 967                 }
 968         }
 969 #endif /* INTERWORKING_3GPP */
 970         return selected;
 971 }
 972
 973
 974 static struct wpa_cred * interworking_credentials_available_realm(
 975         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 976 {
 977         struct wpa_cred *cred, *selected = NULL;
 978         struct nai_realm *realm;
 979         u16 count, i;
 980
 981         if (bss->anqp_nai_realm == NULL)
 982                 return NULL;
 983
 984         if (wpa_s->conf->cred == NULL)
 985                 return NULL;
 986
 987         wpa_printf(MSG_DEBUG, "Interworking: Parsing NAI Realm list from "
 988                    MACSTR, MAC2STR(bss->bssid));
 989         realm = nai_realm_parse(bss->anqp_nai_realm, &count);
 990         if (realm == NULL) {
 991                 wpa_printf(MSG_DEBUG, "Interworking: Could not parse NAI "
 992                            "Realm list from " MACSTR, MAC2STR(bss->bssid));
 993                 return NULL;
 994         }
 995
 996         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
 997                 if (cred->realm == NULL)
 998                         continue;
 999
1000                 for (i = 0; i < count; i++) {
1001                         if (!nai_realm_match(&realm[i], cred->realm))
1002                                 continue;
1003                         if (nai_realm_find_eap(cred, &realm[i])) {
1004                                 if (selected == NULL ||
1005                                     selected->priority < cred->priority)
1006                                         selected = cred;
1007                                 break;
1008                         }
1009                 }
1010         }
1011
1012         nai_realm_free(realm, count);
1013
1014         return selected;
1015 }
1016
1017
1018 static struct wpa_cred * interworking_credentials_available(
1019         struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
1020 {
1021         struct wpa_cred *cred, *cred2;
1022
1023         cred = interworking_credentials_available_realm(wpa_s, bss);
1024         cred2 = interworking_credentials_available_3gpp(wpa_s, bss);
1025         if (cred && cred2 && cred2->priority >= cred->priority)
1026                 cred = cred2;
1027         if (!cred)
1028                 cred = cred2;
1029
1030         return cred;
1031 }
1032
1033
1034 static int domain_name_list_contains(struct wpabuf *domain_names,
1035                                      const char *domain)
1036 {
1037         const u8 *pos, *end;
1038         size_t len;
1039
1040         len = os_strlen(domain);
1041         pos = wpabuf_head(domain_names);
1042         end = pos + wpabuf_len(domain_names);
1043
1044         while (pos + 1 < end) {
1045                 if (pos + 1 + pos[0] > end)
1046                         break;
1047
1048                 wpa_hexdump_ascii(MSG_DEBUG, "Interworking: AP domain name",
1049                                   pos + 1, pos[0]);
1050                 if (pos[0] == len &&
1051                     os_strncasecmp(domain, (const char *) (pos + 1), len) == 0)
1052                         return 1;
1053
1054                 pos += 1 + pos[0];
1055         }
1056
1057         return 0;
1058 }
1059
1060
1061 static int interworking_home_sp(struct wpa_supplicant *wpa_s,
1062                                 struct wpabuf *domain_names)
1063 {
1064         struct wpa_cred *cred;
1065 #ifdef INTERWORKING_3GPP
1066         char nai[100], *realm;
1067 #endif /* INTERWORKING_3GPP */
1068
1069         if (domain_names == NULL || wpa_s->conf->cred == NULL)
1070                 return -1;
1071
1072         for (cred = wpa_s->conf->cred; cred; cred = cred->next) {
1073 #ifdef INTERWORKING_3GPP
1074                 if (cred->imsi &&
1075                     build_root_nai(nai, sizeof(nai), cred->imsi, 0) == 0) {
1076                         realm = os_strchr(nai, '@');
1077                         if (realm)
1078                                 realm++;
1079                         wpa_printf(MSG_DEBUG, "Interworking: Search for match "
1080                                    "with SIM/USIM domain %s", realm);
1081                         if (realm &&
1082                             domain_name_list_contains(domain_names, realm))
1083                                 return 1;
1084                 }
1085 #endif /* INTERWORKING_3GPP */
1086
1087                 if (cred->domain == NULL)
1088                         continue;
1089
1090                 wpa_printf(MSG_DEBUG, "Interworking: Search for match with "
1091                            "home SP FQDN %s", cred->domain);
1092                 if (domain_name_list_contains(domain_names, cred->domain))
1093                         return 1;
1094         }
1095
1096         return 0;
1097 }
1098
1099
1100 static int interworking_find_network_match(struct wpa_supplicant *wpa_s)
1101 {
1102         struct wpa_bss *bss;
1103         struct wpa_ssid *ssid;
1104
1105         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1106                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1107                         if (wpas_network_disabled(ssid) ||
1108                             ssid->mode != WPAS_MODE_INFRA)
1109                                 continue;
1110                         if (ssid->ssid_len != bss->ssid_len ||
1111                             os_memcmp(ssid->ssid, bss->ssid, ssid->ssid_len) !=
1112                             0)
1113                                 continue;
1114                         /*
1115                          * TODO: Consider more accurate matching of security
1116                          * configuration similarly to what is done in events.c
1117                          */
1118                         return 1;
1119                 }
1120         }
1121
1122         return 0;
1123 }
1124
1125
1126 static void interworking_select_network(struct wpa_supplicant *wpa_s)
1127 {
1128         struct wpa_bss *bss, *selected = NULL, *selected_home = NULL;
1129         int selected_prio = -999999, selected_home_prio = -999999;
1130         unsigned int count = 0;
1131         const char *type;
1132         int res;
1133         struct wpa_cred *cred;
1134
1135         wpa_s->network_select = 0;
1136
1137         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1138                 cred = interworking_credentials_available(wpa_s, bss);
1139                 if (!cred)
1140                         continue;
1141                 count++;
1142                 res = interworking_home_sp(wpa_s, bss->anqp_domain_name);
1143                 if (res > 0)
1144                         type = "home";
1145                 else if (res == 0)
1146                         type = "roaming";
1147                 else
1148                         type = "unknown";
1149                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_AP MACSTR " type=%s",
1150                         MAC2STR(bss->bssid), type);
1151                 if (wpa_s->auto_select) {
1152                         if (selected == NULL ||
1153                             cred->priority > selected_prio) {
1154                                 selected = bss;
1155                                 selected_prio = cred->priority;
1156                         }
1157                         if (res > 0 &&
1158                             (selected_home == NULL ||
1159                              cred->priority > selected_home_prio)) {
1160                                 selected_home = bss;
1161                                 selected_home_prio = cred->priority;
1162                         }
1163                 }
1164         }
1165
1166         if (selected_home && selected_home != selected &&
1167             selected_home_prio >= selected_prio) {
1168                 /* Prefer network operated by the Home SP */
1169                 selected = selected_home;
1170         }
1171
1172         if (count == 0) {
1173                 /*
1174                  * No matching network was found based on configured
1175                  * credentials. Check whether any of the enabled network blocks
1176                  * have matching APs.
1177                  */
1178                 if (interworking_find_network_match(wpa_s)) {
1179                         wpa_printf(MSG_DEBUG, "Interworking: Possible BSS "
1180                                    "match for enabled network configurations");
1181                         interworking_reconnect(wpa_s);
1182                         return;
1183                 }
1184
1185                 wpa_msg(wpa_s, MSG_INFO, INTERWORKING_NO_MATCH "No network "
1186                         "with matching credentials found");
1187         }
1188
1189         if (selected)
1190                 interworking_connect(wpa_s, selected);
1191 }
1192
1193
1194 static void interworking_next_anqp_fetch(struct wpa_supplicant *wpa_s)
1195 {
1196         struct wpa_bss *bss;
1197         int found = 0;
1198         const u8 *ie;
1199
1200         if (!wpa_s->fetch_anqp_in_progress)
1201                 return;
1202
1203         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1204                 if (!(bss->caps & IEEE80211_CAP_ESS))
1205                         continue;
1206                 ie = wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB);
1207                 if (ie == NULL || ie[1] < 4 || !(ie[5] & 0x80))
1208                         continue; /* AP does not support Interworking */
1209
1210                 if (!(bss->flags & WPA_BSS_ANQP_FETCH_TRIED)) {
1211                         found++;
1212                         bss->flags |= WPA_BSS_ANQP_FETCH_TRIED;
1213                         wpa_msg(wpa_s, MSG_INFO, "Starting ANQP fetch for "
1214                                 MACSTR, MAC2STR(bss->bssid));
1215                         interworking_anqp_send_req(wpa_s, bss);
1216                         break;
1217                 }
1218         }
1219
1220         if (found == 0) {
1221                 wpa_msg(wpa_s, MSG_INFO, "ANQP fetch completed");
1222                 wpa_s->fetch_anqp_in_progress = 0;
1223                 if (wpa_s->network_select)
1224                         interworking_select_network(wpa_s);
1225         }
1226 }
1227
1228
1229 static void interworking_start_fetch_anqp(struct wpa_supplicant *wpa_s)
1230 {
1231         struct wpa_bss *bss;
1232
1233         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list)
1234                 bss->flags &= ~WPA_BSS_ANQP_FETCH_TRIED;
1235
1236         wpa_s->fetch_anqp_in_progress = 1;
1237         interworking_next_anqp_fetch(wpa_s);
1238 }
1239
1240
1241 int interworking_fetch_anqp(struct wpa_supplicant *wpa_s)
1242 {
1243         if (wpa_s->fetch_anqp_in_progress || wpa_s->network_select)
1244                 return 0;
1245
1246         wpa_s->network_select = 0;
1247
1248         interworking_start_fetch_anqp(wpa_s);
1249
1250         return 0;
1251 }
1252
1253
1254 void interworking_stop_fetch_anqp(struct wpa_supplicant *wpa_s)
1255 {
1256         if (!wpa_s->fetch_anqp_in_progress)
1257                 return;
1258
1259         wpa_s->fetch_anqp_in_progress = 0;
1260 }
1261
1262
1263 int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
1264                   u16 info_ids[], size_t num_ids)
1265 {
1266         struct wpabuf *buf;
1267         int ret = 0;
1268         int freq;
1269         struct wpa_bss *bss;
1270         int res;
1271
1272         freq = wpa_s->assoc_freq;
1273         bss = wpa_bss_get_bssid(wpa_s, dst);
1274         if (bss)
1275                 freq = bss->freq;
1276         if (freq <= 0)
1277                 return -1;
1278
1279         wpa_printf(MSG_DEBUG, "ANQP: Query Request to " MACSTR " for %u id(s)",
1280                    MAC2STR(dst), (unsigned int) num_ids);
1281
1282         buf = anqp_build_req(info_ids, num_ids, NULL);
1283         if (buf == NULL)
1284                 return -1;
1285
1286         res = gas_query_req(wpa_s->gas, dst, freq, buf, anqp_resp_cb, wpa_s);
1287         if (res < 0) {
1288                 wpa_printf(MSG_DEBUG, "ANQP: Failed to send Query Request");
1289                 ret = -1;
1290         } else
1291                 wpa_printf(MSG_DEBUG, "ANQP: Query started with dialog token "
1292                            "%u", res);
1293
1294         wpabuf_free(buf);
1295         return ret;
1296 }
1297
1298
1299 static void interworking_parse_rx_anqp_resp(struct wpa_supplicant *wpa_s,
1300                                             const u8 *sa, u16 info_id,
1301                                             const u8 *data, size_t slen)
1302 {
1303         const u8 *pos = data;
1304         struct wpa_bss *bss = wpa_bss_get_bssid(wpa_s, sa);
1305 #ifdef CONFIG_HS20
1306         u8 type;
1307 #endif /* CONFIG_HS20 */
1308
1309         switch (info_id) {
1310         case ANQP_CAPABILITY_LIST:
1311                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1312                         " ANQP Capability list", MAC2STR(sa));
1313                 break;
1314         case ANQP_VENUE_NAME:
1315                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1316                         " Venue Name", MAC2STR(sa));
1317                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Venue Name", pos, slen);
1318                 if (bss) {
1319                         wpabuf_free(bss->anqp_venue_name);
1320                         bss->anqp_venue_name = wpabuf_alloc_copy(pos, slen);
1321                 }
1322                 break;
1323         case ANQP_NETWORK_AUTH_TYPE:
1324                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1325                         " Network Authentication Type information",
1326                         MAC2STR(sa));
1327                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Network Authentication "
1328                                   "Type", pos, slen);
1329                 if (bss) {
1330                         wpabuf_free(bss->anqp_network_auth_type);
1331                         bss->anqp_network_auth_type =
1332                                 wpabuf_alloc_copy(pos, slen);
1333                 }
1334                 break;
1335         case ANQP_ROAMING_CONSORTIUM:
1336                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1337                         " Roaming Consortium list", MAC2STR(sa));
1338                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: Roaming Consortium",
1339                                   pos, slen);
1340                 if (bss) {
1341                         wpabuf_free(bss->anqp_roaming_consortium);
1342                         bss->anqp_roaming_consortium =
1343                                 wpabuf_alloc_copy(pos, slen);
1344                 }
1345                 break;
1346         case ANQP_IP_ADDR_TYPE_AVAILABILITY:
1347                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1348                         " IP Address Type Availability information",
1349                         MAC2STR(sa));
1350                 wpa_hexdump(MSG_MSGDUMP, "ANQP: IP Address Availability",
1351                             pos, slen);
1352                 if (bss) {
1353                         wpabuf_free(bss->anqp_ip_addr_type_availability);
1354                         bss->anqp_ip_addr_type_availability =
1355                                 wpabuf_alloc_copy(pos, slen);
1356                 }
1357                 break;
1358         case ANQP_NAI_REALM:
1359                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1360                         " NAI Realm list", MAC2STR(sa));
1361                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: NAI Realm", pos, slen);
1362                 if (bss) {
1363                         wpabuf_free(bss->anqp_nai_realm);
1364                         bss->anqp_nai_realm = wpabuf_alloc_copy(pos, slen);
1365                 }
1366                 break;
1367         case ANQP_3GPP_CELLULAR_NETWORK:
1368                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1369                         " 3GPP Cellular Network information", MAC2STR(sa));
1370                 wpa_hexdump_ascii(MSG_DEBUG, "ANQP: 3GPP Cellular Network",
1371                                   pos, slen);
1372                 if (bss) {
1373                         wpabuf_free(bss->anqp_3gpp);
1374                         bss->anqp_3gpp = wpabuf_alloc_copy(pos, slen);
1375                 }
1376                 break;
1377         case ANQP_DOMAIN_NAME:
1378                 wpa_msg(wpa_s, MSG_INFO, "RX-ANQP " MACSTR
1379                         " Domain Name list", MAC2STR(sa));
1380                 wpa_hexdump_ascii(MSG_MSGDUMP, "ANQP: Domain Name", pos, slen);
1381                 if (bss) {
1382                         wpabuf_free(bss->anqp_domain_name);
1383                         bss->anqp_domain_name = wpabuf_alloc_copy(pos, slen);
1384                 }
1385                 break;
1386         case ANQP_VENDOR_SPECIFIC:
1387                 if (slen < 3)
1388                         return;
1389
1390                 switch (WPA_GET_BE24(pos)) {
1391 #ifdef CONFIG_HS20
1392                 case OUI_WFA:
1393                         pos += 3;
1394                         slen -= 3;
1395
1396                         if (slen < 1)
1397                                 return;
1398                         type = *pos++;
1399                         slen--;
1400
1401                         switch (type) {
1402                         case HS20_ANQP_OUI_TYPE:
1403                                 hs20_parse_rx_hs20_anqp_resp(wpa_s, sa, pos,
1404                                                              slen);
1405                                 break;
1406                         default:
1407                                 wpa_printf(MSG_DEBUG, "HS20: Unsupported ANQP "
1408                                            "vendor type %u", type);
1409                                 break;
1410                         }
1411                         break;
1412 #endif /* CONFIG_HS20 */
1413                 default:
1414                         wpa_printf(MSG_DEBUG, "Interworking: Unsupported "
1415                                    "vendor-specific ANQP OUI %06x",
1416                                    WPA_GET_BE24(pos));
1417                         return;
1418                 }
1419                 break;
1420         default:
1421                 wpa_printf(MSG_DEBUG, "Interworking: Unsupported ANQP Info ID "
1422                            "%u", info_id);
1423                 break;
1424         }
1425 }
1426
1427
1428 void anqp_resp_cb(void *ctx, const u8 *dst, u8 dialog_token,
1429                   enum gas_query_result result,
1430                   const struct wpabuf *adv_proto,
1431                   const struct wpabuf *resp, u16 status_code)
1432 {
1433         struct wpa_supplicant *wpa_s = ctx;
1434         const u8 *pos;
1435         const u8 *end;
1436         u16 info_id;
1437         u16 slen;
1438
1439         if (result != GAS_QUERY_SUCCESS)
1440                 return;
1441
1442         pos = wpabuf_head(adv_proto);
1443         if (wpabuf_len(adv_proto) < 4 || pos[0] != WLAN_EID_ADV_PROTO ||
1444             pos[1] < 2 || pos[3] != ACCESS_NETWORK_QUERY_PROTOCOL) {
1445                 wpa_printf(MSG_DEBUG, "ANQP: Unexpected Advertisement "
1446                            "Protocol in response");
1447                 return;
1448         }
1449
1450         pos = wpabuf_head(resp);
1451         end = pos + wpabuf_len(resp);
1452
1453         while (pos < end) {
1454                 if (pos + 4 > end) {
1455                         wpa_printf(MSG_DEBUG, "ANQP: Invalid element");
1456                         break;
1457                 }
1458                 info_id = WPA_GET_LE16(pos);
1459                 pos += 2;
1460                 slen = WPA_GET_LE16(pos);
1461                 pos += 2;
1462                 if (pos + slen > end) {
1463                         wpa_printf(MSG_DEBUG, "ANQP: Invalid element length "
1464                                    "for Info ID %u", info_id);
1465                         break;
1466                 }
1467                 interworking_parse_rx_anqp_resp(wpa_s, dst, info_id, pos,
1468                                                 slen);
1469                 pos += slen;
1470         }
1471 }
1472
1473
1474 static void interworking_scan_res_handler(struct wpa_supplicant *wpa_s,
1475                                           struct wpa_scan_results *scan_res)
1476 {
1477         wpa_printf(MSG_DEBUG, "Interworking: Scan results available - start "
1478                    "ANQP fetch");
1479         interworking_start_fetch_anqp(wpa_s);
1480 }
1481
1482
1483 int interworking_select(struct wpa_supplicant *wpa_s, int auto_select)
1484 {
1485         interworking_stop_fetch_anqp(wpa_s);
1486         wpa_s->network_select = 1;
1487         wpa_s->auto_select = !!auto_select;
1488         wpa_printf(MSG_DEBUG, "Interworking: Start scan for network "
1489                    "selection");
1490         wpa_s->scan_res_handler = interworking_scan_res_handler;
1491         wpa_s->scan_req = 2;
1492         wpa_supplicant_req_scan(wpa_s, 0, 0);
1493
1494         return 0;
1495 }