wpa_supplicant/mbo.c

   1 /*
   2  * wpa_supplicant - MBO
   3  *
   4  * Copyright(c) 2015 Intel Deutschland GmbH
   5  * Contact Information:
   6  * Intel Linux Wireless <ilw@linux.intel.com>
   7  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "utils/includes.h"
  14
  15 #include "utils/common.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "config.h"
  18 #include "wpa_supplicant_i.h"
  19 #include "driver_i.h"
  20 #include "bss.h"
  21
  22 /* type + length + oui + oui type */
  23 #define MBO_IE_HEADER 6
  24
  25
  26 static int wpas_mbo_validate_non_pref_chan(u8 oper_class, u8 chan, u8 reason)
  27 {
  28         if (reason > MBO_NON_PREF_CHAN_REASON_INT_INTERFERENCE)
  29                 return -1;
  30
  31         /* Only checking the validity of the channel and oper_class */
  32         if (ieee80211_chan_to_freq(NULL, oper_class, chan) == -1)
  33                 return -1;
  34
  35         return 0;
  36 }
  37
  38
  39 const u8 * wpas_mbo_get_bss_attr(struct wpa_bss *bss, enum mbo_attr_id attr)
  40 {
  41         const u8 *mbo, *end;
  42
  43         if (!bss)
  44                 return NULL;
  45
  46         mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
  47         if (!mbo)
  48                 return NULL;
  49
  50         end = mbo + 2 + mbo[1];
  51         mbo += MBO_IE_HEADER;
  52
  53         return get_ie(mbo, end - mbo, attr);
  54 }
  55
  56
  57 static void wpas_mbo_non_pref_chan_attr_body(struct wpa_supplicant *wpa_s,
  58                                              struct wpabuf *mbo,
  59                                              u8 start, u8 end)
  60 {
  61         u8 i;
  62
  63         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].oper_class);
  64
  65         for (i = start; i < end; i++)
  66                 wpabuf_put_u8(mbo, wpa_s->non_pref_chan[i].chan);
  67
  68         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].preference);
  69         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason);
  70         wpabuf_put_u8(mbo, wpa_s->non_pref_chan[start].reason_detail);
  71 }
  72
  73
  74 static void wpas_mbo_non_pref_chan_attr(struct wpa_supplicant *wpa_s,
  75                                         struct wpabuf *mbo, u8 start, u8 end)
  76 {
  77         size_t size = end - start + 4;
  78
  79         if (size + 2 > wpabuf_tailroom(mbo))
  80                 return;
  81
  82         wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
  83         wpabuf_put_u8(mbo, size); /* Length */
  84
  85         wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
  86 }
  87
  88
  89 static void wpas_mbo_non_pref_chan_subelem_hdr(struct wpabuf *mbo, u8 len)
  90 {
  91         wpabuf_put_u8(mbo, WLAN_EID_VENDOR_SPECIFIC);
  92         wpabuf_put_u8(mbo, len); /* Length */
  93         wpabuf_put_be24(mbo, OUI_WFA);
  94         wpabuf_put_u8(mbo, MBO_ATTR_ID_NON_PREF_CHAN_REPORT);
  95 }
  96
  97
  98 static void wpas_mbo_non_pref_chan_subelement(struct wpa_supplicant *wpa_s,
  99                                               struct wpabuf *mbo, u8 start,
 100                                               u8 end)
 101 {
 102         size_t size = end - start + 8;
 103
 104         if (size + 2 > wpabuf_tailroom(mbo))
 105                 return;
 106
 107         wpas_mbo_non_pref_chan_subelem_hdr(mbo, size);
 108         wpas_mbo_non_pref_chan_attr_body(wpa_s, mbo, start, end);
 109 }
 110
 111
 112 static void wpas_mbo_non_pref_chan_attrs(struct wpa_supplicant *wpa_s,
 113                                          struct wpabuf *mbo, int subelement)
 114 {
 115         u8 i, start = 0;
 116         struct wpa_mbo_non_pref_channel *start_pref;
 117
 118         if (!wpa_s->non_pref_chan || !wpa_s->non_pref_chan_num) {
 119                 if (subelement)
 120                         wpas_mbo_non_pref_chan_subelem_hdr(mbo, 4);
 121                 return;
 122         }
 123         start_pref = &wpa_s->non_pref_chan[0];
 124
 125         for (i = 1; i <= wpa_s->non_pref_chan_num; i++) {
 126                 struct wpa_mbo_non_pref_channel *non_pref = NULL;
 127
 128                 if (i < wpa_s->non_pref_chan_num)
 129                         non_pref = &wpa_s->non_pref_chan[i];
 130                 if (!non_pref ||
 131                     non_pref->oper_class != start_pref->oper_class ||
 132                     non_pref->reason != start_pref->reason ||
 133                     non_pref->reason_detail != start_pref->reason_detail ||
 134                     non_pref->preference != start_pref->preference) {
 135                         if (subelement)
 136                                 wpas_mbo_non_pref_chan_subelement(wpa_s, mbo,
 137                                                                   start, i);
 138                         else
 139                                 wpas_mbo_non_pref_chan_attr(wpa_s, mbo, start,
 140                                                             i);
 141
 142                         if (!non_pref)
 143                                 return;
 144
 145                         start = i;
 146                         start_pref = non_pref;
 147                 }
 148         }
 149 }
 150
 151
 152 int wpas_mbo_ie(struct wpa_supplicant *wpa_s, u8 *buf, size_t len)
 153 {
 154         struct wpabuf *mbo;
 155         int res;
 156
 157         if (len < MBO_IE_HEADER + 3 + 7)
 158                 return 0;
 159
 160         /* Leave room for the MBO IE header */
 161         mbo = wpabuf_alloc(len - MBO_IE_HEADER);
 162         if (!mbo)
 163                 return 0;
 164
 165         /* Add non-preferred channels attribute */
 166         wpas_mbo_non_pref_chan_attrs(wpa_s, mbo, 0);
 167
 168         /*
 169          * Send cellular capabilities attribute even if AP does not advertise
 170          * cellular capabilities.
 171          */
 172         wpabuf_put_u8(mbo, MBO_ATTR_ID_CELL_DATA_CAPA);
 173         wpabuf_put_u8(mbo, 1);
 174         wpabuf_put_u8(mbo, wpa_s->conf->mbo_cell_capa);
 175
 176         res = mbo_add_ie(buf, len, wpabuf_head_u8(mbo), wpabuf_len(mbo));
 177         if (!res)
 178                 wpa_printf(MSG_ERROR, "Failed to add MBO IE");
 179
 180         wpabuf_free(mbo);
 181         return res;
 182 }
 183
 184
 185 static void wpas_mbo_send_wnm_notification(struct wpa_supplicant *wpa_s)
 186 {
 187         struct wpabuf *buf;
 188         int res;
 189
 190         /*
 191          * Send WNM-Notification Request frame only in case of a change in
 192          * non-preferred channels list during association, if the AP supports
 193          * MBO.
 194          */
 195         if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_bss ||
 196             !wpa_bss_get_vendor_ie(wpa_s->current_bss, MBO_IE_VENDOR_TYPE))
 197                 return;
 198
 199         buf = wpabuf_alloc(512);
 200         if (!buf)
 201                 return;
 202
 203         wpabuf_put_u8(buf, WLAN_ACTION_WNM);
 204         wpabuf_put_u8(buf, WNM_NOTIFICATION_REQ);
 205         wpa_s->mbo_wnm_token++;
 206         if (wpa_s->mbo_wnm_token == 0)
 207                 wpa_s->mbo_wnm_token++;
 208         wpabuf_put_u8(buf, wpa_s->mbo_wnm_token);
 209         wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); /* Type */
 210
 211         wpas_mbo_non_pref_chan_attrs(wpa_s, buf, 1);
 212
 213         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 214                                   wpa_s->own_addr, wpa_s->bssid,
 215                                   wpabuf_head(buf), wpabuf_len(buf), 0);
 216         if (res < 0)
 217                 wpa_printf(MSG_DEBUG,
 218                            "Failed to send WNM-Notification Request frame with non-preferred channel list");
 219
 220         wpabuf_free(buf);
 221 }
 222
 223
 224 static int wpa_non_pref_chan_is_eq(struct wpa_mbo_non_pref_channel *a,
 225                                    struct wpa_mbo_non_pref_channel *b)
 226 {
 227         return a->oper_class == b->oper_class && a->chan == b->chan;
 228 }
 229
 230
 231 /*
 232  * wpa_non_pref_chan_cmp - Compare two channels for sorting
 233  *
 234  * In MBO IE non-preferred channel subelement we can put many channels in an
 235  * attribute if they are in the same operating class and have the same
 236  * preference, reason, and reason detail. To make it easy for the functions that
 237  * build the IE attributes and WNM Request subelements, save the channels sorted
 238  * by their oper_class, reason, and reason_detail.
 239  */
 240 static int wpa_non_pref_chan_cmp(const void *_a, const void *_b)
 241 {
 242         const struct wpa_mbo_non_pref_channel *a = _a, *b = _b;
 243
 244         if (a->oper_class != b->oper_class)
 245                 return a->oper_class - b->oper_class;
 246         if (a->reason != b->reason)
 247                 return a->reason - b->reason;
 248         if (a->reason_detail != b->reason_detail)
 249                 return a->reason_detail - b->reason_detail;
 250         return a->preference - b->preference;
 251 }
 252
 253
 254 int wpas_mbo_update_non_pref_chan(struct wpa_supplicant *wpa_s,
 255                                   const char *non_pref_chan)
 256 {
 257         char *cmd, *token, *context = NULL;
 258         struct wpa_mbo_non_pref_channel *chans = NULL, *tmp_chans;
 259         size_t num = 0, size = 0;
 260         unsigned i;
 261
 262         wpa_printf(MSG_DEBUG, "MBO: Update non-preferred channels, non_pref_chan=%s",
 263                    non_pref_chan ? non_pref_chan : "N/A");
 264
 265         /*
 266          * The shortest channel configuration is 10 characters - commas, 3
 267          * colons, and 4 values that one of them (oper_class) is 2 digits or
 268          * more.
 269          */
 270         if (!non_pref_chan || os_strlen(non_pref_chan) < 10)
 271                 goto update;
 272
 273         cmd = os_strdup(non_pref_chan);
 274         if (!cmd)
 275                 return -1;
 276
 277         while ((token = str_token(cmd, " ", &context))) {
 278                 struct wpa_mbo_non_pref_channel *chan;
 279                 int ret;
 280                 unsigned int _oper_class;
 281                 unsigned int _chan;
 282                 unsigned int _preference;
 283                 unsigned int _reason;
 284                 unsigned int _reason_detail;
 285
 286                 if (num == size) {
 287                         size = size ? size * 2 : 1;
 288                         tmp_chans = os_realloc_array(chans, size,
 289                                                      sizeof(*chans));
 290                         if (!tmp_chans) {
 291                                 wpa_printf(MSG_ERROR,
 292                                            "Couldn't reallocate non_pref_chan");
 293                                 goto fail;
 294                         }
 295                         chans = tmp_chans;
 296                 }
 297
 298                 chan = &chans[num];
 299
 300                 ret = sscanf(token, "%u:%u:%u:%u:%u", &_oper_class,
 301                              &_chan, &_preference, &_reason,
 302                              &_reason_detail);
 303                 if ((ret != 4 && ret != 5) ||
 304                     _oper_class > 255 || _chan > 255 ||
 305                     _preference > 255 || _reason > 65535 ||
 306                     (ret == 5 && _reason_detail > 255)) {
 307                         wpa_printf(MSG_ERROR, "Invalid non-pref chan input %s",
 308                                    token);
 309                         goto fail;
 310                 }
 311                 chan->oper_class = _oper_class;
 312                 chan->chan = _chan;
 313                 chan->preference = _preference;
 314                 chan->reason = _reason;
 315                 chan->reason_detail = ret == 4 ? 0 : _reason_detail;
 316
 317                 if (wpas_mbo_validate_non_pref_chan(chan->oper_class,
 318                                                     chan->chan, chan->reason)) {
 319                         wpa_printf(MSG_ERROR,
 320                                    "Invalid non_pref_chan: oper class %d chan %d reason %d",
 321                                    chan->oper_class, chan->chan, chan->reason);
 322                         goto fail;
 323                 }
 324
 325                 for (i = 0; i < num; i++)
 326                         if (wpa_non_pref_chan_is_eq(chan, &chans[i]))
 327                                 break;
 328                 if (i != num) {
 329                         wpa_printf(MSG_ERROR,
 330                                    "oper class %d chan %d is duplicated",
 331                                    chan->oper_class, chan->chan);
 332                         goto fail;
 333                 }
 334
 335                 num++;
 336         }
 337
 338         os_free(cmd);
 339
 340         if (chans) {
 341                 qsort(chans, num, sizeof(struct wpa_mbo_non_pref_channel),
 342                       wpa_non_pref_chan_cmp);
 343         }
 344
 345 update:
 346         os_free(wpa_s->non_pref_chan);
 347         wpa_s->non_pref_chan = chans;
 348         wpa_s->non_pref_chan_num = num;
 349         wpas_mbo_send_wnm_notification(wpa_s);
 350
 351         return 0;
 352
 353 fail:
 354         os_free(chans);
 355         os_free(cmd);
 356         return -1;
 357 }
 358
 359
 360 void wpas_mbo_scan_ie(struct wpa_supplicant *wpa_s, struct wpabuf *ie)
 361 {
 362         wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
 363         wpabuf_put_u8(ie, 7);
 364         wpabuf_put_be24(ie, OUI_WFA);
 365         wpabuf_put_u8(ie, MBO_OUI_TYPE);
 366
 367         wpabuf_put_u8(ie, MBO_ATTR_ID_CELL_DATA_CAPA);
 368         wpabuf_put_u8(ie, 1);
 369         wpabuf_put_u8(ie, wpa_s->conf->mbo_cell_capa);
 370 }
 371
 372
 373 enum chan_allowed {
 374         NOT_ALLOWED, ALLOWED
 375 };
 376
 377 static enum chan_allowed allow_channel(struct hostapd_hw_modes *mode, u8 chan,
 378                                        unsigned int *flags)
 379 {
 380         int i;
 381
 382         for (i = 0; i < mode->num_channels; i++) {
 383                 if (mode->channels[i].chan == chan)
 384                         break;
 385         }
 386
 387         if (i == mode->num_channels ||
 388             (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED))
 389                 return NOT_ALLOWED;
 390
 391         if (flags)
 392                 *flags = mode->channels[i].flag;
 393
 394         return ALLOWED;
 395 }
 396
 397
 398 static int get_center_80mhz(struct hostapd_hw_modes *mode, u8 channel)
 399 {
 400         u8 center_channels[] = {42, 58, 106, 122, 138, 155};
 401         size_t i;
 402
 403         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
 404                 return 0;
 405
 406         for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
 407                 /*
 408                  * In 80 MHz, the bandwidth "spans" 12 channels (e.g., 36-48),
 409                  * so the center channel is 6 channels away from the start/end.
 410                  */
 411                 if (channel >= center_channels[i] - 6 &&
 412                     channel <= center_channels[i] + 6)
 413                         return center_channels[i];
 414         }
 415
 416         return 0;
 417 }
 418
 419
 420 static enum chan_allowed verify_80mhz(struct hostapd_hw_modes *mode, u8 channel)
 421 {
 422         u8 center_chan;
 423         unsigned int i;
 424
 425         center_chan = get_center_80mhz(mode, channel);
 426         if (!center_chan)
 427                 return NOT_ALLOWED;
 428
 429         /* check all the channels are available */
 430         for (i = 0; i < 4; i++) {
 431                 unsigned int flags;
 432                 u8 adj_chan = center_chan - 6 + i * 4;
 433
 434                 if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
 435                         return NOT_ALLOWED;
 436
 437                 if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_70)) ||
 438                     (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_50)) ||
 439                     (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_30)) ||
 440                     (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_10)))
 441                         return NOT_ALLOWED;
 442         }
 443
 444         return ALLOWED;
 445 }
 446
 447
 448 static int get_center_160mhz(struct hostapd_hw_modes *mode, u8 channel)
 449 {
 450         u8 center_channels[] = { 50, 114 };
 451         unsigned int i;
 452
 453         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
 454                 return 0;
 455
 456         for (i = 0; i < ARRAY_SIZE(center_channels); i++) {
 457                 /*
 458                  * In 160 MHz, the bandwidth "spans" 28 channels (e.g., 36-64),
 459                  * so the center channel is 14 channels away from the start/end.
 460                  */
 461                 if (channel >= center_channels[i] - 14 &&
 462                     channel <= center_channels[i] + 14)
 463                         return center_channels[i];
 464         }
 465
 466         return 0;
 467 }
 468
 469
 470 static enum chan_allowed verify_160mhz(struct hostapd_hw_modes *mode,
 471                                        u8 channel)
 472 {
 473         u8 center_chan;
 474         unsigned int i;
 475
 476         center_chan = get_center_160mhz(mode, channel);
 477         if (!center_chan)
 478                 return NOT_ALLOWED;
 479
 480         /* Check all the channels are available */
 481         for (i = 0; i < 8; i++) {
 482                 unsigned int flags;
 483                 u8 adj_chan = center_chan - 14 + i * 4;
 484
 485                 if (allow_channel(mode, adj_chan, &flags) == NOT_ALLOWED)
 486                         return NOT_ALLOWED;
 487
 488                 if ((i == 0 && !(flags & HOSTAPD_CHAN_VHT_10_150)) ||
 489                     (i == 1 && !(flags & HOSTAPD_CHAN_VHT_30_130)) ||
 490                     (i == 2 && !(flags & HOSTAPD_CHAN_VHT_50_110)) ||
 491                     (i == 3 && !(flags & HOSTAPD_CHAN_VHT_70_90)) ||
 492                     (i == 4 && !(flags & HOSTAPD_CHAN_VHT_90_70)) ||
 493                     (i == 5 && !(flags & HOSTAPD_CHAN_VHT_110_50)) ||
 494                     (i == 6 && !(flags & HOSTAPD_CHAN_VHT_130_30)) ||
 495                     (i == 7 && !(flags & HOSTAPD_CHAN_VHT_150_10)))
 496                         return NOT_ALLOWED;
 497         }
 498
 499         return ALLOWED;
 500 }
 501
 502
 503 enum chan_allowed verify_channel(struct hostapd_hw_modes *mode, u8 channel,
 504                                  u8 bw)
 505 {
 506         unsigned int flag = 0;
 507         enum chan_allowed res, res2;
 508
 509         res2 = res = allow_channel(mode, channel, &flag);
 510         if (bw == BW40MINUS) {
 511                 if (!(flag & HOSTAPD_CHAN_HT40MINUS))
 512                         return NOT_ALLOWED;
 513                 res2 = allow_channel(mode, channel - 4, NULL);
 514         } else if (bw == BW40PLUS) {
 515                 if (!(flag & HOSTAPD_CHAN_HT40PLUS))
 516                         return NOT_ALLOWED;
 517                 res2 = allow_channel(mode, channel + 4, NULL);
 518         } else if (bw == BW80) {
 519                 res2 = verify_80mhz(mode, channel);
 520         } else if (bw == BW160) {
 521                 res2 = verify_160mhz(mode, channel);
 522         }
 523
 524         if (res == NOT_ALLOWED || res2 == NOT_ALLOWED)
 525                 return NOT_ALLOWED;
 526
 527         return ALLOWED;
 528 }
 529
 530
 531 static int wpas_op_class_supported(struct wpa_supplicant *wpa_s,
 532                                    const struct oper_class_map *op_class)
 533 {
 534         int chan;
 535         size_t i;
 536         struct hostapd_hw_modes *mode;
 537
 538         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op_class->mode);
 539         if (!mode)
 540                 return 0;
 541
 542         if (op_class->op_class == 128 || op_class->op_class == 130) {
 543                 u8 channels[] = { 42, 58, 106, 122, 138, 155 };
 544
 545                 for (i = 0; i < ARRAY_SIZE(channels); i++) {
 546                         if (verify_channel(mode, channels[i], op_class->bw) ==
 547                             NOT_ALLOWED)
 548                                 return 0;
 549                 }
 550
 551                 return 1;
 552         }
 553
 554         if (op_class->op_class == 129) {
 555                 if (verify_channel(mode, 50, op_class->bw) == NOT_ALLOWED ||
 556                     verify_channel(mode, 114, op_class->bw) == NOT_ALLOWED)
 557                         return 0;
 558
 559                 return 1;
 560         }
 561
 562         for (chan = op_class->min_chan; chan <= op_class->max_chan;
 563              chan += op_class->inc) {
 564                 if (verify_channel(mode, chan, op_class->bw) == NOT_ALLOWED)
 565                         return 0;
 566         }
 567
 568         return 1;
 569 }
 570
 571
 572 int wpas_mbo_supp_op_class_ie(struct wpa_supplicant *wpa_s, int freq, u8 *pos,
 573                               size_t len)
 574 {
 575         struct wpabuf *buf;
 576         u8 op, current, chan;
 577         u8 *ie_len;
 578         int res;
 579
 580         /*
 581          * Assume 20 MHz channel for now.
 582          * TODO: Use the secondary channel and VHT channel width that will be
 583          * used after association.
 584          */
 585         if (ieee80211_freq_to_channel_ext(freq, 0, VHT_CHANWIDTH_USE_HT,
 586                                           &current, &chan) == NUM_HOSTAPD_MODES)
 587                 return 0;
 588
 589         /*
 590          * Need 3 bytes for EID, length, and current operating class, plus
 591          * 1 byte for every other supported operating class.
 592          */
 593         buf = wpabuf_alloc(global_op_class_size + 3);
 594         if (!buf)
 595                 return 0;
 596
 597         wpabuf_put_u8(buf, WLAN_EID_SUPPORTED_OPERATING_CLASSES);
 598         /* Will set the length later, putting a placeholder */
 599         ie_len = wpabuf_put(buf, 1);
 600         wpabuf_put_u8(buf, current);
 601
 602         for (op = 0; global_op_class[op].op_class; op++) {
 603                 if (wpas_op_class_supported(wpa_s, &global_op_class[op]))
 604                         wpabuf_put_u8(buf, global_op_class[op].op_class);
 605         }
 606
 607         *ie_len = wpabuf_len(buf) - 2;
 608         if (*ie_len < 2 || wpabuf_len(buf) > len) {
 609                 wpa_printf(MSG_ERROR,
 610                            "Failed to add supported operating classes IE");
 611                 res = 0;
 612         } else {
 613                 os_memcpy(pos, wpabuf_head(buf), wpabuf_len(buf));
 614                 res = wpabuf_len(buf);
 615                 wpa_hexdump_buf(MSG_DEBUG,
 616                                 "MBO: Added supported operating classes IE",
 617                                 buf);
 618         }
 619
 620         wpabuf_free(buf);
 621         return res;
 622 }
 623
 624
 625 void wpas_mbo_ie_trans_req(struct wpa_supplicant *wpa_s, const u8 *mbo_ie,
 626                            size_t len)
 627 {
 628         const u8 *pos, *cell_pref = NULL, *reason = NULL;
 629         u8 id, elen;
 630         u16 disallowed_sec = 0;
 631
 632         if (len <= 4 || WPA_GET_BE24(mbo_ie) != OUI_WFA ||
 633             mbo_ie[3] != MBO_OUI_TYPE)
 634                 return;
 635
 636         pos = mbo_ie + 4;
 637         len -= 4;
 638
 639         while (len >= 2) {
 640                 id = *pos++;
 641                 elen = *pos++;
 642                 len -= 2;
 643
 644                 if (elen > len)
 645                         goto fail;
 646
 647                 switch (id) {
 648                 case MBO_ATTR_ID_CELL_DATA_PREF:
 649                         if (elen != 1)
 650                                 goto fail;
 651
 652                         if (wpa_s->conf->mbo_cell_capa ==
 653                             MBO_CELL_CAPA_AVAILABLE)
 654                                 cell_pref = pos;
 655                         else
 656                                 wpa_printf(MSG_DEBUG,
 657                                            "MBO: Station does not support Cellular data connection");
 658                         break;
 659                 case MBO_ATTR_ID_TRANSITION_REASON:
 660                         if (elen != 1)
 661                                 goto fail;
 662
 663                         reason = pos;
 664                         break;
 665                 case MBO_ATTR_ID_ASSOC_RETRY_DELAY:
 666                         if (elen != 2)
 667                                 goto fail;
 668
 669                         if (wpa_s->wnm_mode &
 670                             WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
 671                                 wpa_printf(MSG_DEBUG,
 672                                            "MBO: Unexpected association retry delay, BSS is terminating");
 673                                 goto fail;
 674                         } else if (wpa_s->wnm_mode &
 675                                    WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
 676                                 disallowed_sec = WPA_GET_LE16(pos);
 677                         } else {
 678                                 wpa_printf(MSG_DEBUG,
 679                                            "MBO: Association retry delay attribute not in disassoc imminent mode");
 680                         }
 681
 682                         break;
 683                 case MBO_ATTR_ID_AP_CAPA_IND:
 684                 case MBO_ATTR_ID_NON_PREF_CHAN_REPORT:
 685                 case MBO_ATTR_ID_CELL_DATA_CAPA:
 686                 case MBO_ATTR_ID_ASSOC_DISALLOW:
 687                 case MBO_ATTR_ID_TRANSITION_REJECT_REASON:
 688                         wpa_printf(MSG_DEBUG,
 689                                    "MBO: Attribute %d should not be included in BTM Request frame",
 690                                    id);
 691                         break;
 692                 default:
 693                         wpa_printf(MSG_DEBUG, "MBO: Unknown attribute id %u",
 694                                    id);
 695                         return;
 696                 }
 697
 698                 pos += elen;
 699                 len -= elen;
 700         }
 701
 702         if (cell_pref)
 703                 wpa_msg(wpa_s, MSG_INFO, MBO_CELL_PREFERENCE "preference=%u",
 704                         *cell_pref);
 705
 706         if (reason)
 707                 wpa_msg(wpa_s, MSG_INFO, MBO_TRANSITION_REASON "reason=%u",
 708                         *reason);
 709
 710         if (disallowed_sec && wpa_s->current_bss)
 711                 wpa_bss_tmp_disallow(wpa_s, wpa_s->current_bss->bssid,
 712                                      disallowed_sec);
 713
 714         return;
 715 fail:
 716         wpa_printf(MSG_DEBUG, "MBO IE parsing failed (id=%u len=%u left=%zu)",
 717                    id, elen, len);
 718 }