wpa_supplicant/scan.c

   1 /*
   2  * WPA Supplicant - Scanning
   3  * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "common/wpa_ctrl.h"
  15 #include "config.h"
  16 #include "wpa_supplicant_i.h"
  17 #include "driver_i.h"
  18 #include "wps_supplicant.h"
  19 #include "p2p_supplicant.h"
  20 #include "p2p/p2p.h"
  21 #include "hs20_supplicant.h"
  22 #include "notify.h"
  23 #include "bss.h"
  24 #include "gas_query.h"
  25 #include "scan.h"
  26
  27
  28 static void wpa_supplicant_gen_assoc_event(struct wpa_supplicant *wpa_s)
  29 {
  30         struct wpa_ssid *ssid;
  31         union wpa_event_data data;
  32
  33         ssid = wpa_supplicant_get_ssid(wpa_s);
  34         if (ssid == NULL)
  35                 return;
  36
  37         if (wpa_s->current_ssid == NULL) {
  38                 wpa_s->current_ssid = ssid;
  39                 if (wpa_s->current_ssid != NULL)
  40                         wpas_notify_network_changed(wpa_s);
  41         }
  42         wpa_supplicant_initiate_eapol(wpa_s);
  43         wpa_dbg(wpa_s, MSG_DEBUG, "Already associated with a configured "
  44                 "network - generating associated event");
  45         os_memset(&data, 0, sizeof(data));
  46         wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
  47 }
  48
  49
  50 #ifdef CONFIG_WPS
  51 static int wpas_wps_in_use(struct wpa_supplicant *wpa_s,
  52                            enum wps_request_type *req_type)
  53 {
  54         struct wpa_ssid *ssid;
  55         int wps = 0;
  56
  57         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
  58                 if (!(ssid->key_mgmt & WPA_KEY_MGMT_WPS))
  59                         continue;
  60
  61                 wps = 1;
  62                 *req_type = wpas_wps_get_req_type(ssid);
  63                 if (!ssid->eap.phase1)
  64                         continue;
  65
  66                 if (os_strstr(ssid->eap.phase1, "pbc=1"))
  67                         return 2;
  68         }
  69
  70 #ifdef CONFIG_P2P
  71         if (!wpa_s->global->p2p_disabled && wpa_s->global->p2p &&
  72             !wpa_s->conf->p2p_disabled) {
  73                 wpa_s->wps->dev.p2p = 1;
  74                 if (!wps) {
  75                         wps = 1;
  76                         *req_type = WPS_REQ_ENROLLEE_INFO;
  77                 }
  78         }
  79 #endif /* CONFIG_P2P */
  80
  81         return wps;
  82 }
  83 #endif /* CONFIG_WPS */
  84
  85
  86 /**
  87  * wpa_supplicant_enabled_networks - Check whether there are enabled networks
  88  * @wpa_s: Pointer to wpa_supplicant data
  89  * Returns: 0 if no networks are enabled, >0 if networks are enabled
  90  *
  91  * This function is used to figure out whether any networks (or Interworking
  92  * with enabled credentials and auto_interworking) are present in the current
  93  * configuration.
  94  */
  95 int wpa_supplicant_enabled_networks(struct wpa_supplicant *wpa_s)
  96 {
  97         struct wpa_ssid *ssid = wpa_s->conf->ssid;
  98         int count = 0, disabled = 0;
  99         while (ssid) {
 100                 if (!wpas_network_disabled(wpa_s, ssid))
 101                         count++;
 102                 else
 103                         disabled++;
 104                 ssid = ssid->next;
 105         }
 106         if (wpa_s->conf->cred && wpa_s->conf->interworking &&
 107             wpa_s->conf->auto_interworking)
 108                 count++;
 109         if (count == 0 && disabled > 0) {
 110                 wpa_dbg(wpa_s, MSG_DEBUG, "No enabled networks (%d disabled "
 111                         "networks)", disabled);
 112         }
 113         return count;
 114 }
 115
 116
 117 static void wpa_supplicant_assoc_try(struct wpa_supplicant *wpa_s,
 118                                      struct wpa_ssid *ssid)
 119 {
 120         while (ssid) {
 121                 if (!wpas_network_disabled(wpa_s, ssid))
 122                         break;
 123                 ssid = ssid->next;
 124         }
 125
 126         /* ap_scan=2 mode - try to associate with each SSID. */
 127         if (ssid == NULL) {
 128                 wpa_dbg(wpa_s, MSG_DEBUG, "wpa_supplicant_assoc_try: Reached "
 129                         "end of scan list - go back to beginning");
 130                 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
 131                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 132                 return;
 133         }
 134         if (ssid->next) {
 135                 /* Continue from the next SSID on the next attempt. */
 136                 wpa_s->prev_scan_ssid = ssid;
 137         } else {
 138                 /* Start from the beginning of the SSID list. */
 139                 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
 140         }
 141         wpa_supplicant_associate(wpa_s, NULL, ssid);
 142 }
 143
 144
 145 static int int_array_len(const int *a)
 146 {
 147         int i;
 148         for (i = 0; a && a[i]; i++)
 149                 ;
 150         return i;
 151 }
 152
 153
 154 static void int_array_concat(int **res, const int *a)
 155 {
 156         int reslen, alen, i;
 157         int *n;
 158
 159         reslen = int_array_len(*res);
 160         alen = int_array_len(a);
 161
 162         n = os_realloc_array(*res, reslen + alen + 1, sizeof(int));
 163         if (n == NULL) {
 164                 os_free(*res);
 165                 *res = NULL;
 166                 return;
 167         }
 168         for (i = 0; i <= alen; i++)
 169                 n[reslen + i] = a[i];
 170         *res = n;
 171 }
 172
 173
 174 static int freq_cmp(const void *a, const void *b)
 175 {
 176         int _a = *(int *) a;
 177         int _b = *(int *) b;
 178
 179         if (_a == 0)
 180                 return 1;
 181         if (_b == 0)
 182                 return -1;
 183         return _a - _b;
 184 }
 185
 186
 187 static void int_array_sort_unique(int *a)
 188 {
 189         int alen;
 190         int i, j;
 191
 192         if (a == NULL)
 193                 return;
 194
 195         alen = int_array_len(a);
 196         qsort(a, alen, sizeof(int), freq_cmp);
 197
 198         i = 0;
 199         j = 1;
 200         while (a[i] && a[j]) {
 201                 if (a[i] == a[j]) {
 202                         j++;
 203                         continue;
 204                 }
 205                 a[++i] = a[j++];
 206         }
 207         if (a[i])
 208                 i++;
 209         a[i] = 0;
 210 }
 211
 212
 213 /**
 214  * wpa_supplicant_trigger_scan - Request driver to start a scan
 215  * @wpa_s: Pointer to wpa_supplicant data
 216  * @params: Scan parameters
 217  * Returns: 0 on success, -1 on failure
 218  */
 219 int wpa_supplicant_trigger_scan(struct wpa_supplicant *wpa_s,
 220                                 struct wpa_driver_scan_params *params)
 221 {
 222         int ret;
 223
 224         wpa_supplicant_notify_scanning(wpa_s, 1);
 225
 226         ret = wpa_drv_scan(wpa_s, params);
 227         if (ret) {
 228                 wpa_supplicant_notify_scanning(wpa_s, 0);
 229                 wpas_notify_scan_done(wpa_s, 0);
 230         } else {
 231                 os_get_time(&wpa_s->scan_trigger_time);
 232                 wpa_s->scan_runs++;
 233                 wpa_s->normal_scans++;
 234         }
 235
 236         return ret;
 237 }
 238
 239
 240 static void
 241 wpa_supplicant_delayed_sched_scan_timeout(void *eloop_ctx, void *timeout_ctx)
 242 {
 243         struct wpa_supplicant *wpa_s = eloop_ctx;
 244
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Starting delayed sched scan");
 246
 247         if (wpa_supplicant_req_sched_scan(wpa_s))
 248                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 249 }
 250
 251
 252 static void
 253 wpa_supplicant_sched_scan_timeout(void *eloop_ctx, void *timeout_ctx)
 254 {
 255         struct wpa_supplicant *wpa_s = eloop_ctx;
 256
 257         wpa_dbg(wpa_s, MSG_DEBUG, "Sched scan timeout - stopping it");
 258
 259         wpa_s->sched_scan_timed_out = 1;
 260         wpa_supplicant_cancel_sched_scan(wpa_s);
 261 }
 262
 263
 264 static int
 265 wpa_supplicant_start_sched_scan(struct wpa_supplicant *wpa_s,
 266                                 struct wpa_driver_scan_params *params,
 267                                 int interval)
 268 {
 269         int ret;
 270
 271         wpa_supplicant_notify_scanning(wpa_s, 1);
 272         ret = wpa_drv_sched_scan(wpa_s, params, interval * 1000);
 273         if (ret)
 274                 wpa_supplicant_notify_scanning(wpa_s, 0);
 275         else
 276                 wpa_s->sched_scanning = 1;
 277
 278         return ret;
 279 }
 280
 281
 282 static int wpa_supplicant_stop_sched_scan(struct wpa_supplicant *wpa_s)
 283 {
 284         int ret;
 285
 286         ret = wpa_drv_stop_sched_scan(wpa_s);
 287         if (ret) {
 288                 wpa_dbg(wpa_s, MSG_DEBUG, "stopping sched_scan failed!");
 289                 /* TODO: what to do if stopping fails? */
 290                 return -1;
 291         }
 292
 293         return ret;
 294 }
 295
 296
 297 static struct wpa_driver_scan_filter *
 298 wpa_supplicant_build_filter_ssids(struct wpa_config *conf, size_t *num_ssids)
 299 {
 300         struct wpa_driver_scan_filter *ssids;
 301         struct wpa_ssid *ssid;
 302         size_t count;
 303
 304         *num_ssids = 0;
 305         if (!conf->filter_ssids)
 306                 return NULL;
 307
 308         for (count = 0, ssid = conf->ssid; ssid; ssid = ssid->next) {
 309                 if (ssid->ssid && ssid->ssid_len)
 310                         count++;
 311         }
 312         if (count == 0)
 313                 return NULL;
 314         ssids = os_zalloc(count * sizeof(struct wpa_driver_scan_filter));
 315         if (ssids == NULL)
 316                 return NULL;
 317
 318         for (ssid = conf->ssid; ssid; ssid = ssid->next) {
 319                 if (!ssid->ssid || !ssid->ssid_len)
 320                         continue;
 321                 os_memcpy(ssids[*num_ssids].ssid, ssid->ssid, ssid->ssid_len);
 322                 ssids[*num_ssids].ssid_len = ssid->ssid_len;
 323                 (*num_ssids)++;
 324         }
 325
 326         return ssids;
 327 }
 328
 329
 330 static void wpa_supplicant_optimize_freqs(
 331         struct wpa_supplicant *wpa_s, struct wpa_driver_scan_params *params)
 332 {
 333 #ifdef CONFIG_P2P
 334         if (params->freqs == NULL && wpa_s->p2p_in_provisioning &&
 335             wpa_s->go_params) {
 336                 /* Optimize provisioning state scan based on GO information */
 337                 if (wpa_s->p2p_in_provisioning < 5 &&
 338                     wpa_s->go_params->freq > 0) {
 339                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Scan only GO "
 340                                 "preferred frequency %d MHz",
 341                                 wpa_s->go_params->freq);
 342                         params->freqs = os_zalloc(2 * sizeof(int));
 343                         if (params->freqs)
 344                                 params->freqs[0] = wpa_s->go_params->freq;
 345                 } else if (wpa_s->p2p_in_provisioning < 8 &&
 346                            wpa_s->go_params->freq_list[0]) {
 347                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: Scan only common "
 348                                 "channels");
 349                         int_array_concat(&params->freqs,
 350                                          wpa_s->go_params->freq_list);
 351                         if (params->freqs)
 352                                 int_array_sort_unique(params->freqs);
 353                 }
 354                 wpa_s->p2p_in_provisioning++;
 355         }
 356 #endif /* CONFIG_P2P */
 357
 358 #ifdef CONFIG_WPS
 359         if (params->freqs == NULL && wpa_s->after_wps && wpa_s->wps_freq) {
 360                 /*
 361                  * Optimize post-provisioning scan based on channel used
 362                  * during provisioning.
 363                  */
 364                 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Scan only frequency %u MHz "
 365                         "that was used during provisioning", wpa_s->wps_freq);
 366                 params->freqs = os_zalloc(2 * sizeof(int));
 367                 if (params->freqs)
 368                         params->freqs[0] = wpa_s->wps_freq;
 369                 wpa_s->after_wps--;
 370         }
 371
 372         if (params->freqs == NULL && wpa_s->known_wps_freq && wpa_s->wps_freq)
 373         {
 374                 /* Optimize provisioning scan based on already known channel */
 375                 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Scan only frequency %u MHz",
 376                         wpa_s->wps_freq);
 377                 params->freqs = os_zalloc(2 * sizeof(int));
 378                 if (params->freqs)
 379                         params->freqs[0] = wpa_s->wps_freq;
 380                 wpa_s->known_wps_freq = 0; /* only do this once */
 381         }
 382 #endif /* CONFIG_WPS */
 383 }
 384
 385
 386 #ifdef CONFIG_INTERWORKING
 387 static void wpas_add_interworking_elements(struct wpa_supplicant *wpa_s,
 388                                            struct wpabuf *buf)
 389 {
 390         if (wpa_s->conf->interworking == 0)
 391                 return;
 392
 393         wpabuf_put_u8(buf, WLAN_EID_EXT_CAPAB);
 394         wpabuf_put_u8(buf, 4);
 395         wpabuf_put_u8(buf, 0x00);
 396         wpabuf_put_u8(buf, 0x00);
 397         wpabuf_put_u8(buf, 0x00);
 398         wpabuf_put_u8(buf, 0x80); /* Bit 31 - Interworking */
 399
 400         wpabuf_put_u8(buf, WLAN_EID_INTERWORKING);
 401         wpabuf_put_u8(buf, is_zero_ether_addr(wpa_s->conf->hessid) ? 1 :
 402                       1 + ETH_ALEN);
 403         wpabuf_put_u8(buf, wpa_s->conf->access_network_type);
 404         /* No Venue Info */
 405         if (!is_zero_ether_addr(wpa_s->conf->hessid))
 406                 wpabuf_put_data(buf, wpa_s->conf->hessid, ETH_ALEN);
 407 }
 408 #endif /* CONFIG_INTERWORKING */
 409
 410
 411 static struct wpabuf * wpa_supplicant_extra_ies(struct wpa_supplicant *wpa_s)
 412 {
 413         struct wpabuf *extra_ie = NULL;
 414 #ifdef CONFIG_WPS
 415         int wps = 0;
 416         enum wps_request_type req_type = WPS_REQ_ENROLLEE_INFO;
 417 #endif /* CONFIG_WPS */
 418
 419 #ifdef CONFIG_INTERWORKING
 420         if (wpa_s->conf->interworking &&
 421             wpabuf_resize(&extra_ie, 100) == 0)
 422                 wpas_add_interworking_elements(wpa_s, extra_ie);
 423 #endif /* CONFIG_INTERWORKING */
 424
 425 #ifdef CONFIG_WPS
 426         wps = wpas_wps_in_use(wpa_s, &req_type);
 427
 428         if (wps) {
 429                 struct wpabuf *wps_ie;
 430                 wps_ie = wps_build_probe_req_ie(wps == 2 ? DEV_PW_PUSHBUTTON :
 431                                                 DEV_PW_DEFAULT,
 432                                                 &wpa_s->wps->dev,
 433                                                 wpa_s->wps->uuid, req_type,
 434                                                 0, NULL);
 435                 if (wps_ie) {
 436                         if (wpabuf_resize(&extra_ie, wpabuf_len(wps_ie)) == 0)
 437                                 wpabuf_put_buf(extra_ie, wps_ie);
 438                         wpabuf_free(wps_ie);
 439                 }
 440         }
 441
 442 #ifdef CONFIG_P2P
 443         if (wps) {
 444                 size_t ielen = p2p_scan_ie_buf_len(wpa_s->global->p2p);
 445                 if (wpabuf_resize(&extra_ie, ielen) == 0)
 446                         wpas_p2p_scan_ie(wpa_s, extra_ie);
 447         }
 448 #endif /* CONFIG_P2P */
 449
 450 #endif /* CONFIG_WPS */
 451
 452 #ifdef CONFIG_HS20
 453         if (wpa_s->conf->hs20 && wpabuf_resize(&extra_ie, 7) == 0)
 454                 wpas_hs20_add_indication(extra_ie);
 455 #endif /* CONFIG_HS20 */
 456
 457         return extra_ie;
 458 }
 459
 460
 461 #ifdef CONFIG_P2P
 462
 463 /*
 464  * Check whether there are any enabled networks or credentials that could be
 465  * used for a non-P2P connection.
 466  */
 467 static int non_p2p_network_enabled(struct wpa_supplicant *wpa_s)
 468 {
 469         struct wpa_ssid *ssid;
 470
 471         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 472                 if (wpas_network_disabled(wpa_s, ssid))
 473                         continue;
 474                 if (!ssid->p2p_group)
 475                         return 1;
 476         }
 477
 478         if (wpa_s->conf->cred && wpa_s->conf->interworking &&
 479             wpa_s->conf->auto_interworking)
 480                 return 1;
 481
 482         return 0;
 483 }
 484
 485 #endif /* CONFIG_P2P */
 486
 487
 488 static struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
 489                                           u16 num_modes,
 490                                           enum hostapd_hw_mode mode)
 491 {
 492         u16 i;
 493
 494         for (i = 0; i < num_modes; i++) {
 495                 if (modes[i].mode == mode)
 496                         return &modes[i];
 497         }
 498
 499         return NULL;
 500 }
 501
 502
 503 static void wpa_setband_scan_freqs_list(struct wpa_supplicant *wpa_s,
 504                                         enum hostapd_hw_mode band,
 505                                         struct wpa_driver_scan_params *params)
 506 {
 507         /* Include only supported channels for the specified band */
 508         struct hostapd_hw_modes *mode;
 509         int count, i;
 510
 511         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, band);
 512         if (mode == NULL) {
 513                 /* No channels supported in this band - use empty list */
 514                 params->freqs = os_zalloc(sizeof(int));
 515                 return;
 516         }
 517
 518         params->freqs = os_zalloc((mode->num_channels + 1) * sizeof(int));
 519         if (params->freqs == NULL)
 520                 return;
 521         for (count = 0, i = 0; i < mode->num_channels; i++) {
 522                 if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
 523                         continue;
 524                 params->freqs[count++] = mode->channels[i].freq;
 525         }
 526 }
 527
 528
 529 static void wpa_setband_scan_freqs(struct wpa_supplicant *wpa_s,
 530                                    struct wpa_driver_scan_params *params)
 531 {
 532         if (wpa_s->hw.modes == NULL)
 533                 return; /* unknown what channels the driver supports */
 534         if (params->freqs)
 535                 return; /* already using a limited channel set */
 536         if (wpa_s->setband == WPA_SETBAND_5G)
 537                 wpa_setband_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211A,
 538                                             params);
 539         else if (wpa_s->setband == WPA_SETBAND_2G)
 540                 wpa_setband_scan_freqs_list(wpa_s, HOSTAPD_MODE_IEEE80211G,
 541                                             params);
 542 }
 543
 544
 545 static void wpa_supplicant_scan(void *eloop_ctx, void *timeout_ctx)
 546 {
 547         struct wpa_supplicant *wpa_s = eloop_ctx;
 548         struct wpa_ssid *ssid;
 549         enum scan_req_type scan_req = NORMAL_SCAN_REQ;
 550         int ret;
 551         struct wpabuf *extra_ie = NULL;
 552         struct wpa_driver_scan_params params;
 553         struct wpa_driver_scan_params *scan_params;
 554         size_t max_ssids;
 555         enum wpa_states prev_state;
 556
 557         if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
 558                 wpa_dbg(wpa_s, MSG_DEBUG, "Skip scan - interface disabled");
 559                 wpas_p2p_continue_after_scan(wpa_s);
 560                 return;
 561         }
 562
 563         if (wpa_s->disconnected && wpa_s->scan_req == NORMAL_SCAN_REQ) {
 564                 wpa_dbg(wpa_s, MSG_DEBUG, "Disconnected - do not scan");
 565                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 566                 wpas_p2p_continue_after_scan(wpa_s);
 567                 return;
 568         }
 569
 570         if (!wpa_supplicant_enabled_networks(wpa_s) &&
 571             wpa_s->scan_req == NORMAL_SCAN_REQ) {
 572                 wpa_dbg(wpa_s, MSG_DEBUG, "No enabled networks - do not scan");
 573                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
 574                 wpas_p2p_continue_after_scan(wpa_s);
 575                 return;
 576         }
 577
 578         if (wpa_s->conf->ap_scan != 0 &&
 579             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)) {
 580                 wpa_dbg(wpa_s, MSG_DEBUG, "Using wired authentication - "
 581                         "overriding ap_scan configuration");
 582                 wpa_s->conf->ap_scan = 0;
 583                 wpas_notify_ap_scan_changed(wpa_s);
 584         }
 585
 586         if (wpa_s->conf->ap_scan == 0) {
 587                 wpa_supplicant_gen_assoc_event(wpa_s);
 588                 return;
 589         }
 590
 591 #ifdef CONFIG_P2P
 592         if (wpas_p2p_in_progress(wpa_s) || wpas_wpa_is_in_progress(wpa_s, 0)) {
 593                 if (wpa_s->sta_scan_pending &&
 594                     wpas_p2p_in_progress(wpa_s) == 2 &&
 595                     wpa_s->global->p2p_cb_on_scan_complete) {
 596                         wpa_dbg(wpa_s, MSG_DEBUG, "Process pending station "
 597                                 "mode scan during P2P search");
 598                 } else {
 599                         wpa_dbg(wpa_s, MSG_DEBUG, "Delay station mode scan "
 600                                 "while P2P operation is in progress");
 601                         wpa_s->sta_scan_pending = 1;
 602                         wpa_supplicant_req_scan(wpa_s, 5, 0);
 603                         return;
 604                 }
 605         }
 606 #endif /* CONFIG_P2P */
 607
 608 #ifdef CONFIG_GAS
 609         if (gas_query_in_progress(wpa_s->gas)) {
 610                 wpa_dbg(wpa_s, MSG_DEBUG, "Delay scan while GAS query is in progress");
 611                 wpa_supplicant_req_scan(wpa_s, 1, 0);
 612                 return;
 613         }
 614 #endif /* CONFIG_GAS */
 615
 616         if (wpa_s->conf->ap_scan == 2)
 617                 max_ssids = 1;
 618         else {
 619                 max_ssids = wpa_s->max_scan_ssids;
 620                 if (max_ssids > WPAS_MAX_SCAN_SSIDS)
 621                         max_ssids = WPAS_MAX_SCAN_SSIDS;
 622         }
 623
 624         scan_req = wpa_s->scan_req;
 625         wpa_s->scan_req = NORMAL_SCAN_REQ;
 626
 627         os_memset(&params, 0, sizeof(params));
 628
 629         prev_state = wpa_s->wpa_state;
 630         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 631             wpa_s->wpa_state == WPA_INACTIVE)
 632                 wpa_supplicant_set_state(wpa_s, WPA_SCANNING);
 633
 634         /*
 635          * If autoscan has set its own scanning parameters
 636          */
 637         if (wpa_s->autoscan_params != NULL) {
 638                 scan_params = wpa_s->autoscan_params;
 639                 goto scan;
 640         }
 641
 642         if (scan_req != MANUAL_SCAN_REQ && wpa_s->connect_without_scan) {
 643                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
 644                         if (ssid == wpa_s->connect_without_scan)
 645                                 break;
 646                 }
 647                 wpa_s->connect_without_scan = NULL;
 648                 if (ssid) {
 649                         wpa_printf(MSG_DEBUG, "Start a pre-selected network "
 650                                    "without scan step");
 651                         wpa_supplicant_associate(wpa_s, NULL, ssid);
 652                         return;
 653                 }
 654         }
 655
 656 #ifdef CONFIG_P2P
 657         if ((wpa_s->p2p_in_provisioning || wpa_s->show_group_started) &&
 658             wpa_s->go_params) {
 659                 wpa_printf(MSG_DEBUG, "P2P: Use specific SSID for scan during "
 660                            "P2P group formation");
 661                 params.ssids[0].ssid = wpa_s->go_params->ssid;
 662                 params.ssids[0].ssid_len = wpa_s->go_params->ssid_len;
 663                 params.num_ssids = 1;
 664                 goto ssid_list_set;
 665         }
 666 #endif /* CONFIG_P2P */
 667
 668         /* Find the starting point from which to continue scanning */
 669         ssid = wpa_s->conf->ssid;
 670         if (wpa_s->prev_scan_ssid != WILDCARD_SSID_SCAN) {
 671                 while (ssid) {
 672                         if (ssid == wpa_s->prev_scan_ssid) {
 673                                 ssid = ssid->next;
 674                                 break;
 675                         }
 676                         ssid = ssid->next;
 677                 }
 678         }
 679
 680         if (scan_req != MANUAL_SCAN_REQ && wpa_s->conf->ap_scan == 2) {
 681                 wpa_s->connect_without_scan = NULL;
 682                 wpa_s->prev_scan_wildcard = 0;
 683                 wpa_supplicant_assoc_try(wpa_s, ssid);
 684                 return;
 685         } else if (wpa_s->conf->ap_scan == 2) {
 686                 /*
 687                  * User-initiated scan request in ap_scan == 2; scan with
 688                  * wildcard SSID.
 689                  */
 690                 ssid = NULL;
 691         } else {
 692                 struct wpa_ssid *start = ssid, *tssid;
 693                 int freqs_set = 0;
 694                 if (ssid == NULL && max_ssids > 1)
 695                         ssid = wpa_s->conf->ssid;
 696                 while (ssid) {
 697                         if (!wpas_network_disabled(wpa_s, ssid) &&
 698                             ssid->scan_ssid) {
 699                                 wpa_hexdump_ascii(MSG_DEBUG, "Scan SSID",
 700                                                   ssid->ssid, ssid->ssid_len);
 701                                 params.ssids[params.num_ssids].ssid =
 702                                         ssid->ssid;
 703                                 params.ssids[params.num_ssids].ssid_len =
 704                                         ssid->ssid_len;
 705                                 params.num_ssids++;
 706                                 if (params.num_ssids + 1 >= max_ssids)
 707                                         break;
 708                         }
 709                         ssid = ssid->next;
 710                         if (ssid == start)
 711                                 break;
 712                         if (ssid == NULL && max_ssids > 1 &&
 713                             start != wpa_s->conf->ssid)
 714                                 ssid = wpa_s->conf->ssid;
 715                 }
 716
 717                 for (tssid = wpa_s->conf->ssid; tssid; tssid = tssid->next) {
 718                         if (wpas_network_disabled(wpa_s, tssid))
 719                                 continue;
 720                         if ((params.freqs || !freqs_set) && tssid->scan_freq) {
 721                                 int_array_concat(&params.freqs,
 722                                                  tssid->scan_freq);
 723                         } else {
 724                                 os_free(params.freqs);
 725                                 params.freqs = NULL;
 726                         }
 727                         freqs_set = 1;
 728                 }
 729                 int_array_sort_unique(params.freqs);
 730         }
 731
 732         if (ssid && max_ssids == 1) {
 733                 /*
 734                  * If the driver is limited to 1 SSID at a time interleave
 735                  * wildcard SSID scans with specific SSID scans to avoid
 736                  * waiting a long time for a wildcard scan.
 737                  */
 738                 if (!wpa_s->prev_scan_wildcard) {
 739                         params.ssids[0].ssid = NULL;
 740                         params.ssids[0].ssid_len = 0;
 741                         wpa_s->prev_scan_wildcard = 1;
 742                         wpa_dbg(wpa_s, MSG_DEBUG, "Starting AP scan for "
 743                                 "wildcard SSID (Interleave with specific)");
 744                 } else {
 745                         wpa_s->prev_scan_ssid = ssid;
 746                         wpa_s->prev_scan_wildcard = 0;
 747                         wpa_dbg(wpa_s, MSG_DEBUG,
 748                                 "Starting AP scan for specific SSID: %s",
 749                                 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
 750                 }
 751         } else if (ssid) {
 752                 /* max_ssids > 1 */
 753
 754                 wpa_s->prev_scan_ssid = ssid;
 755                 wpa_dbg(wpa_s, MSG_DEBUG, "Include wildcard SSID in "
 756                         "the scan request");
 757                 params.num_ssids++;
 758         } else {
 759                 wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
 760                 params.num_ssids++;
 761                 wpa_dbg(wpa_s, MSG_DEBUG, "Starting AP scan for wildcard "
 762                         "SSID");
 763         }
 764 #ifdef CONFIG_P2P
 765 ssid_list_set:
 766 #endif /* CONFIG_P2P */
 767
 768         wpa_supplicant_optimize_freqs(wpa_s, &params);
 769         extra_ie = wpa_supplicant_extra_ies(wpa_s);
 770
 771         if (params.freqs == NULL && wpa_s->next_scan_freqs) {
 772                 wpa_dbg(wpa_s, MSG_DEBUG, "Optimize scan based on previously "
 773                         "generated frequency list");
 774                 params.freqs = wpa_s->next_scan_freqs;
 775         } else
 776                 os_free(wpa_s->next_scan_freqs);
 777         wpa_s->next_scan_freqs = NULL;
 778         wpa_setband_scan_freqs(wpa_s, &params);
 779
 780         /* See if user specified frequencies. If so, scan only those. */
 781         if (wpa_s->conf->freq_list && !params.freqs) {
 782                 wpa_dbg(wpa_s, MSG_DEBUG,
 783                         "Optimize scan based on conf->freq_list");
 784                 int_array_concat(&params.freqs, wpa_s->conf->freq_list);
 785         }
 786
 787         /* Use current associated channel? */
 788         if (wpa_s->conf->scan_cur_freq && !params.freqs) {
 789                 unsigned int num = wpa_s->num_multichan_concurrent;
 790
 791                 params.freqs = os_calloc(num + 1, sizeof(int));
 792                 if (params.freqs) {
 793                         num = get_shared_radio_freqs(wpa_s, params.freqs, num);
 794                         if (num > 0) {
 795                                 wpa_dbg(wpa_s, MSG_DEBUG, "Scan only the "
 796                                         "current operating channels since "
 797                                         "scan_cur_freq is enabled");
 798                         } else {
 799                                 os_free(params.freqs);
 800                                 params.freqs = NULL;
 801                         }
 802                 }
 803         }
 804
 805         params.filter_ssids = wpa_supplicant_build_filter_ssids(
 806                 wpa_s->conf, &params.num_filter_ssids);
 807         if (extra_ie) {
 808                 params.extra_ies = wpabuf_head(extra_ie);
 809                 params.extra_ies_len = wpabuf_len(extra_ie);
 810         }
 811
 812 #ifdef CONFIG_P2P
 813         if (wpa_s->p2p_in_provisioning ||
 814             (wpa_s->show_group_started && wpa_s->go_params)) {
 815                 /*
 816                  * The interface may not yet be in P2P mode, so we have to
 817                  * explicitly request P2P probe to disable CCK rates.
 818                  */
 819                 params.p2p_probe = 1;
 820         }
 821 #endif /* CONFIG_P2P */
 822
 823         scan_params = &params;
 824
 825 scan:
 826 #ifdef CONFIG_P2P
 827         /*
 828          * If the driver does not support multi-channel concurrency and a
 829          * virtual interface that shares the same radio with the wpa_s interface
 830          * is operating there may not be need to scan other channels apart from
 831          * the current operating channel on the other virtual interface. Filter
 832          * out other channels in case we are trying to find a connection for a
 833          * station interface when we are not configured to prefer station
 834          * connection and a concurrent operation is already in process.
 835          */
 836         if (wpa_s->scan_for_connection && scan_req == NORMAL_SCAN_REQ &&
 837             !scan_params->freqs && !params.freqs &&
 838             wpas_is_p2p_prioritized(wpa_s) &&
 839             wpa_s->p2p_group_interface == NOT_P2P_GROUP_INTERFACE &&
 840             non_p2p_network_enabled(wpa_s)) {
 841                 unsigned int num = wpa_s->num_multichan_concurrent;
 842
 843                 params.freqs = os_calloc(num + 1, sizeof(int));
 844                 if (params.freqs) {
 845                         num = get_shared_radio_freqs(wpa_s, params.freqs, num);
 846                         if (num > 0 && num == wpa_s->num_multichan_concurrent) {
 847                                 wpa_dbg(wpa_s, MSG_DEBUG, "Scan only the current operating channels since all channels are already used");
 848                         } else {
 849                                 os_free(params.freqs);
 850                                 params.freqs = NULL;
 851                         }
 852                 }
 853         }
 854 #endif /* CONFIG_P2P */
 855
 856         ret = wpa_supplicant_trigger_scan(wpa_s, scan_params);
 857
 858         wpabuf_free(extra_ie);
 859         os_free(params.freqs);
 860         os_free(params.filter_ssids);
 861
 862         if (ret) {
 863                 wpa_msg(wpa_s, MSG_WARNING, "Failed to initiate AP scan");
 864                 if (prev_state != wpa_s->wpa_state)
 865                         wpa_supplicant_set_state(wpa_s, prev_state);
 866                 /* Restore scan_req since we will try to scan again */
 867                 wpa_s->scan_req = scan_req;
 868                 wpa_supplicant_req_scan(wpa_s, 1, 0);
 869         } else {
 870                 wpa_s->scan_for_connection = 0;
 871         }
 872 }
 873
 874
 875 void wpa_supplicant_update_scan_int(struct wpa_supplicant *wpa_s, int sec)
 876 {
 877         struct os_time remaining, new_int;
 878         int cancelled;
 879
 880         cancelled = eloop_cancel_timeout_one(wpa_supplicant_scan, wpa_s, NULL,
 881                                              &remaining);
 882
 883         new_int.sec = sec;
 884         new_int.usec = 0;
 885         if (cancelled && os_time_before(&remaining, &new_int)) {
 886                 new_int.sec = remaining.sec;
 887                 new_int.usec = remaining.usec;
 888         }
 889
 890         if (cancelled) {
 891                 eloop_register_timeout(new_int.sec, new_int.usec,
 892                                        wpa_supplicant_scan, wpa_s, NULL);
 893         }
 894         wpa_s->scan_interval = sec;
 895 }
 896
 897
 898 /**
 899  * wpa_supplicant_req_scan - Schedule a scan for neighboring access points
 900  * @wpa_s: Pointer to wpa_supplicant data
 901  * @sec: Number of seconds after which to scan
 902  * @usec: Number of microseconds after which to scan
 903  *
 904  * This function is used to schedule a scan for neighboring access points after
 905  * the specified time.
 906  */
 907 void wpa_supplicant_req_scan(struct wpa_supplicant *wpa_s, int sec, int usec)
 908 {
 909         /* If there's at least one network that should be specifically scanned
 910          * then don't cancel the scan and reschedule.  Some drivers do
 911          * background scanning which generates frequent scan results, and that
 912          * causes the specific SSID scan to get continually pushed back and
 913          * never happen, which causes hidden APs to never get probe-scanned.
 914          */
 915         if (eloop_is_timeout_registered(wpa_supplicant_scan, wpa_s, NULL) &&
 916             wpa_s->conf->ap_scan == 1) {
 917                 struct wpa_ssid *ssid = wpa_s->conf->ssid;
 918
 919                 while (ssid) {
 920                         if (!wpas_network_disabled(wpa_s, ssid) &&
 921                             ssid->scan_ssid)
 922                                 break;
 923                         ssid = ssid->next;
 924                 }
 925                 if (ssid) {
 926                         wpa_dbg(wpa_s, MSG_DEBUG, "Not rescheduling scan to "
 927                                 "ensure that specific SSID scans occur");
 928                         return;
 929                 }
 930         }
 931
 932         wpa_dbg(wpa_s, MSG_DEBUG, "Setting scan request: %d sec %d usec",
 933                 sec, usec);
 934         eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
 935         eloop_register_timeout(sec, usec, wpa_supplicant_scan, wpa_s, NULL);
 936 }
 937
 938
 939 /**
 940  * wpa_supplicant_delayed_sched_scan - Request a delayed scheduled scan
 941  * @wpa_s: Pointer to wpa_supplicant data
 942  * @sec: Number of seconds after which to scan
 943  * @usec: Number of microseconds after which to scan
 944  * Returns: 0 on success or -1 otherwise
 945  *
 946  * This function is used to schedule periodic scans for neighboring
 947  * access points after the specified time.
 948  */
 949 int wpa_supplicant_delayed_sched_scan(struct wpa_supplicant *wpa_s,
 950                                       int sec, int usec)
 951 {
 952         if (!wpa_s->sched_scan_supported)
 953                 return -1;
 954
 955         eloop_register_timeout(sec, usec,
 956                                wpa_supplicant_delayed_sched_scan_timeout,
 957                                wpa_s, NULL);
 958
 959         return 0;
 960 }
 961
 962
 963 /**
 964  * wpa_supplicant_req_sched_scan - Start a periodic scheduled scan
 965  * @wpa_s: Pointer to wpa_supplicant data
 966  * Returns: 0 is sched_scan was started or -1 otherwise
 967  *
 968  * This function is used to schedule periodic scans for neighboring
 969  * access points repeating the scan continuously.
 970  */
 971 int wpa_supplicant_req_sched_scan(struct wpa_supplicant *wpa_s)
 972 {
 973         struct wpa_driver_scan_params params;
 974         struct wpa_driver_scan_params *scan_params;
 975         enum wpa_states prev_state;
 976         struct wpa_ssid *ssid = NULL;
 977         struct wpabuf *extra_ie = NULL;
 978         int ret;
 979         unsigned int max_sched_scan_ssids;
 980         int wildcard = 0;
 981         int need_ssids;
 982
 983         if (!wpa_s->sched_scan_supported)
 984                 return -1;
 985
 986         if (wpa_s->max_sched_scan_ssids > WPAS_MAX_SCAN_SSIDS)
 987                 max_sched_scan_ssids = WPAS_MAX_SCAN_SSIDS;
 988         else
 989                 max_sched_scan_ssids = wpa_s->max_sched_scan_ssids;
 990         if (max_sched_scan_ssids < 1 || wpa_s->conf->disable_scan_offload)
 991                 return -1;
 992
 993         if (wpa_s->sched_scanning) {
 994                 wpa_dbg(wpa_s, MSG_DEBUG, "Already sched scanning");
 995                 return 0;
 996         }
 997
 998         need_ssids = 0;
 999         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1000                 if (!wpas_network_disabled(wpa_s, ssid) && !ssid->scan_ssid) {
1001                         /* Use wildcard SSID to find this network */
1002                         wildcard = 1;
1003                 } else if (!wpas_network_disabled(wpa_s, ssid) &&
1004                            ssid->ssid_len)
1005                         need_ssids++;
1006
1007 #ifdef CONFIG_WPS
1008                 if (!wpas_network_disabled(wpa_s, ssid) &&
1009                     ssid->key_mgmt == WPA_KEY_MGMT_WPS) {
1010                         /*
1011                          * Normal scan is more reliable and faster for WPS
1012                          * operations and since these are for short periods of
1013                          * time, the benefit of trying to use sched_scan would
1014                          * be limited.
1015                          */
1016                         wpa_dbg(wpa_s, MSG_DEBUG, "Use normal scan instead of "
1017                                 "sched_scan for WPS");
1018                         return -1;
1019                 }
1020 #endif /* CONFIG_WPS */
1021         }
1022         if (wildcard)
1023                 need_ssids++;
1024
1025         if (wpa_s->normal_scans < 3 &&
1026             (need_ssids <= wpa_s->max_scan_ssids ||
1027              wpa_s->max_scan_ssids >= (int) max_sched_scan_ssids)) {
1028                 /*
1029                  * When normal scan can speed up operations, use that for the
1030                  * first operations before starting the sched_scan to allow
1031                  * user space sleep more. We do this only if the normal scan
1032                  * has functionality that is suitable for this or if the
1033                  * sched_scan does not have better support for multiple SSIDs.
1034                  */
1035                 wpa_dbg(wpa_s, MSG_DEBUG, "Use normal scan instead of "
1036                         "sched_scan for initial scans (normal_scans=%d)",
1037                         wpa_s->normal_scans);
1038                 return -1;
1039         }
1040
1041         os_memset(&params, 0, sizeof(params));
1042
1043         /* If we can't allocate space for the filters, we just don't filter */
1044         params.filter_ssids = os_zalloc(wpa_s->max_match_sets *
1045                                         sizeof(struct wpa_driver_scan_filter));
1046
1047         prev_state = wpa_s->wpa_state;
1048         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
1049             wpa_s->wpa_state == WPA_INACTIVE)
1050                 wpa_supplicant_set_state(wpa_s, WPA_SCANNING);
1051
1052         if (wpa_s->autoscan_params != NULL) {
1053                 scan_params = wpa_s->autoscan_params;
1054                 goto scan;
1055         }
1056
1057         /* Find the starting point from which to continue scanning */
1058         ssid = wpa_s->conf->ssid;
1059         if (wpa_s->prev_sched_ssid) {
1060                 while (ssid) {
1061                         if (ssid == wpa_s->prev_sched_ssid) {
1062                                 ssid = ssid->next;
1063                                 break;
1064                         }
1065                         ssid = ssid->next;
1066                 }
1067         }
1068
1069         if (!ssid || !wpa_s->prev_sched_ssid) {
1070                 wpa_dbg(wpa_s, MSG_DEBUG, "Beginning of SSID list");
1071                 if (wpa_s->conf->sched_scan_interval)
1072                         wpa_s->sched_scan_interval =
1073                                 wpa_s->conf->sched_scan_interval;
1074                 if (wpa_s->sched_scan_interval == 0)
1075                         wpa_s->sched_scan_interval = 10;
1076                 wpa_s->sched_scan_timeout = max_sched_scan_ssids * 2;
1077                 wpa_s->first_sched_scan = 1;
1078                 ssid = wpa_s->conf->ssid;
1079                 wpa_s->prev_sched_ssid = ssid;
1080         }
1081
1082         if (wildcard) {
1083                 wpa_dbg(wpa_s, MSG_DEBUG, "Add wildcard SSID to sched_scan");
1084                 params.num_ssids++;
1085         }
1086
1087         while (ssid) {
1088                 if (wpas_network_disabled(wpa_s, ssid))
1089                         goto next;
1090
1091                 if (params.num_filter_ssids < wpa_s->max_match_sets &&
1092                     params.filter_ssids && ssid->ssid && ssid->ssid_len) {
1093                         wpa_dbg(wpa_s, MSG_DEBUG, "add to filter ssid: %s",
1094                                 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1095                         os_memcpy(params.filter_ssids[params.num_filter_ssids].ssid,
1096                                   ssid->ssid, ssid->ssid_len);
1097                         params.filter_ssids[params.num_filter_ssids].ssid_len =
1098                                 ssid->ssid_len;
1099                         params.num_filter_ssids++;
1100                 } else if (params.filter_ssids && ssid->ssid && ssid->ssid_len)
1101                 {
1102                         wpa_dbg(wpa_s, MSG_DEBUG, "Not enough room for SSID "
1103                                 "filter for sched_scan - drop filter");
1104                         os_free(params.filter_ssids);
1105                         params.filter_ssids = NULL;
1106                         params.num_filter_ssids = 0;
1107                 }
1108
1109                 if (ssid->scan_ssid && ssid->ssid && ssid->ssid_len) {
1110                         if (params.num_ssids == max_sched_scan_ssids)
1111                                 break; /* only room for broadcast SSID */
1112                         wpa_dbg(wpa_s, MSG_DEBUG,
1113                                 "add to active scan ssid: %s",
1114                                 wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
1115                         params.ssids[params.num_ssids].ssid =
1116                                 ssid->ssid;
1117                         params.ssids[params.num_ssids].ssid_len =
1118                                 ssid->ssid_len;
1119                         params.num_ssids++;
1120                         if (params.num_ssids >= max_sched_scan_ssids) {
1121                                 wpa_s->prev_sched_ssid = ssid;
1122                                 do {
1123                                         ssid = ssid->next;
1124                                 } while (ssid &&
1125                                          (wpas_network_disabled(wpa_s, ssid) ||
1126                                           !ssid->scan_ssid));
1127                                 break;
1128                         }
1129                 }
1130
1131         next:
1132                 wpa_s->prev_sched_ssid = ssid;
1133                 ssid = ssid->next;
1134         }
1135
1136         if (params.num_filter_ssids == 0) {
1137                 os_free(params.filter_ssids);
1138                 params.filter_ssids = NULL;
1139         }
1140
1141         extra_ie = wpa_supplicant_extra_ies(wpa_s);
1142         if (extra_ie) {
1143                 params.extra_ies = wpabuf_head(extra_ie);
1144                 params.extra_ies_len = wpabuf_len(extra_ie);
1145         }
1146
1147         scan_params = &params;
1148
1149 scan:
1150         if (ssid || !wpa_s->first_sched_scan) {
1151                 wpa_dbg(wpa_s, MSG_DEBUG,
1152                         "Starting sched scan: interval %d timeout %d",
1153                         wpa_s->sched_scan_interval, wpa_s->sched_scan_timeout);
1154         } else {
1155                 wpa_dbg(wpa_s, MSG_DEBUG,
1156                         "Starting sched scan: interval %d (no timeout)",
1157                         wpa_s->sched_scan_interval);
1158         }
1159
1160         wpa_setband_scan_freqs(wpa_s, scan_params);
1161
1162         ret = wpa_supplicant_start_sched_scan(wpa_s, scan_params,
1163                                               wpa_s->sched_scan_interval);
1164         wpabuf_free(extra_ie);
1165         os_free(params.filter_ssids);
1166         if (ret) {
1167                 wpa_msg(wpa_s, MSG_WARNING, "Failed to initiate sched scan");
1168                 if (prev_state != wpa_s->wpa_state)
1169                         wpa_supplicant_set_state(wpa_s, prev_state);
1170                 return ret;
1171         }
1172
1173         /* If we have more SSIDs to scan, add a timeout so we scan them too */
1174         if (ssid || !wpa_s->first_sched_scan) {
1175                 wpa_s->sched_scan_timed_out = 0;
1176                 eloop_register_timeout(wpa_s->sched_scan_timeout, 0,
1177                                        wpa_supplicant_sched_scan_timeout,
1178                                        wpa_s, NULL);
1179                 wpa_s->first_sched_scan = 0;
1180                 wpa_s->sched_scan_timeout /= 2;
1181                 wpa_s->sched_scan_interval *= 2;
1182                 if (wpa_s->sched_scan_timeout < wpa_s->sched_scan_interval) {
1183                         wpa_s->sched_scan_interval = 10;
1184                         wpa_s->sched_scan_timeout = max_sched_scan_ssids * 2;
1185                 }
1186         }
1187
1188         /* If there is no more ssids, start next time from the beginning */
1189         if (!ssid)
1190                 wpa_s->prev_sched_ssid = NULL;
1191
1192         return 0;
1193 }
1194
1195
1196 /**
1197  * wpa_supplicant_cancel_scan - Cancel a scheduled scan request
1198  * @wpa_s: Pointer to wpa_supplicant data
1199  *
1200  * This function is used to cancel a scan request scheduled with
1201  * wpa_supplicant_req_scan().
1202  */
1203 void wpa_supplicant_cancel_scan(struct wpa_supplicant *wpa_s)
1204 {
1205         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling scan request");
1206         eloop_cancel_timeout(wpa_supplicant_scan, wpa_s, NULL);
1207         wpas_p2p_continue_after_scan(wpa_s);
1208 }
1209
1210
1211 /**
1212  * wpa_supplicant_cancel_delayed_sched_scan - Stop a delayed scheduled scan
1213  * @wpa_s: Pointer to wpa_supplicant data
1214  *
1215  * This function is used to stop a delayed scheduled scan.
1216  */
1217 void wpa_supplicant_cancel_delayed_sched_scan(struct wpa_supplicant *wpa_s)
1218 {
1219         if (!wpa_s->sched_scan_supported)
1220                 return;
1221
1222         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling delayed sched scan");
1223         eloop_cancel_timeout(wpa_supplicant_delayed_sched_scan_timeout,
1224                              wpa_s, NULL);
1225 }
1226
1227
1228 /**
1229  * wpa_supplicant_cancel_sched_scan - Stop running scheduled scans
1230  * @wpa_s: Pointer to wpa_supplicant data
1231  *
1232  * This function is used to stop a periodic scheduled scan.
1233  */
1234 void wpa_supplicant_cancel_sched_scan(struct wpa_supplicant *wpa_s)
1235 {
1236         if (!wpa_s->sched_scanning)
1237                 return;
1238
1239         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling sched scan");
1240         eloop_cancel_timeout(wpa_supplicant_sched_scan_timeout, wpa_s, NULL);
1241         wpa_supplicant_stop_sched_scan(wpa_s);
1242 }
1243
1244
1245 /**
1246  * wpa_supplicant_notify_scanning - Indicate possible scan state change
1247  * @wpa_s: Pointer to wpa_supplicant data
1248  * @scanning: Whether scanning is currently in progress
1249  *
1250  * This function is to generate scanning notifycations. It is called whenever
1251  * there may have been a change in scanning (scan started, completed, stopped).
1252  * wpas_notify_scanning() is called whenever the scanning state changed from the
1253  * previously notified state.
1254  */
1255 void wpa_supplicant_notify_scanning(struct wpa_supplicant *wpa_s,
1256                                     int scanning)
1257 {
1258         if (wpa_s->scanning != scanning) {
1259                 wpa_s->scanning = scanning;
1260                 wpas_notify_scanning(wpa_s);
1261         }
1262 }
1263
1264
1265 static int wpa_scan_get_max_rate(const struct wpa_scan_res *res)
1266 {
1267         int rate = 0;
1268         const u8 *ie;
1269         int i;
1270
1271         ie = wpa_scan_get_ie(res, WLAN_EID_SUPP_RATES);
1272         for (i = 0; ie && i < ie[1]; i++) {
1273                 if ((ie[i + 2] & 0x7f) > rate)
1274                         rate = ie[i + 2] & 0x7f;
1275         }
1276
1277         ie = wpa_scan_get_ie(res, WLAN_EID_EXT_SUPP_RATES);
1278         for (i = 0; ie && i < ie[1]; i++) {
1279                 if ((ie[i + 2] & 0x7f) > rate)
1280                         rate = ie[i + 2] & 0x7f;
1281         }
1282
1283         return rate;
1284 }
1285
1286
1287 /**
1288  * wpa_scan_get_ie - Fetch a specified information element from a scan result
1289  * @res: Scan result entry
1290  * @ie: Information element identitifier (WLAN_EID_*)
1291  * Returns: Pointer to the information element (id field) or %NULL if not found
1292  *
1293  * This function returns the first matching information element in the scan
1294  * result.
1295  */
1296 const u8 * wpa_scan_get_ie(const struct wpa_scan_res *res, u8 ie)
1297 {
1298         const u8 *end, *pos;
1299
1300         pos = (const u8 *) (res + 1);
1301         end = pos + res->ie_len;
1302
1303         while (pos + 1 < end) {
1304                 if (pos + 2 + pos[1] > end)
1305                         break;
1306                 if (pos[0] == ie)
1307                         return pos;
1308                 pos += 2 + pos[1];
1309         }
1310
1311         return NULL;
1312 }
1313
1314
1315 /**
1316  * wpa_scan_get_vendor_ie - Fetch vendor information element from a scan result
1317  * @res: Scan result entry
1318  * @vendor_type: Vendor type (four octets starting the IE payload)
1319  * Returns: Pointer to the information element (id field) or %NULL if not found
1320  *
1321  * This function returns the first matching information element in the scan
1322  * result.
1323  */
1324 const u8 * wpa_scan_get_vendor_ie(const struct wpa_scan_res *res,
1325                                   u32 vendor_type)
1326 {
1327         const u8 *end, *pos;
1328
1329         pos = (const u8 *) (res + 1);
1330         end = pos + res->ie_len;
1331
1332         while (pos + 1 < end) {
1333                 if (pos + 2 + pos[1] > end)
1334                         break;
1335                 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
1336                     vendor_type == WPA_GET_BE32(&pos[2]))
1337                         return pos;
1338                 pos += 2 + pos[1];
1339         }
1340
1341         return NULL;
1342 }
1343
1344
1345 /**
1346  * wpa_scan_get_vendor_ie_beacon - Fetch vendor information from a scan result
1347  * @res: Scan result entry
1348  * @vendor_type: Vendor type (four octets starting the IE payload)
1349  * Returns: Pointer to the information element (id field) or %NULL if not found
1350  *
1351  * This function returns the first matching information element in the scan
1352  * result.
1353  *
1354  * This function is like wpa_scan_get_vendor_ie(), but uses IE buffer only
1355  * from Beacon frames instead of either Beacon or Probe Response frames.
1356  */
1357 const u8 * wpa_scan_get_vendor_ie_beacon(const struct wpa_scan_res *res,
1358                                          u32 vendor_type)
1359 {
1360         const u8 *end, *pos;
1361
1362         if (res->beacon_ie_len == 0)
1363                 return NULL;
1364
1365         pos = (const u8 *) (res + 1);
1366         pos += res->ie_len;
1367         end = pos + res->beacon_ie_len;
1368
1369         while (pos + 1 < end) {
1370                 if (pos + 2 + pos[1] > end)
1371                         break;
1372                 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
1373                     vendor_type == WPA_GET_BE32(&pos[2]))
1374                         return pos;
1375                 pos += 2 + pos[1];
1376         }
1377
1378         return NULL;
1379 }
1380
1381
1382 /**
1383  * wpa_scan_get_vendor_ie_multi - Fetch vendor IE data from a scan result
1384  * @res: Scan result entry
1385  * @vendor_type: Vendor type (four octets starting the IE payload)
1386  * Returns: Pointer to the information element payload or %NULL if not found
1387  *
1388  * This function returns concatenated payload of possibly fragmented vendor
1389  * specific information elements in the scan result. The caller is responsible
1390  * for freeing the returned buffer.
1391  */
1392 struct wpabuf * wpa_scan_get_vendor_ie_multi(const struct wpa_scan_res *res,
1393                                              u32 vendor_type)
1394 {
1395         struct wpabuf *buf;
1396         const u8 *end, *pos;
1397
1398         buf = wpabuf_alloc(res->ie_len);
1399         if (buf == NULL)
1400                 return NULL;
1401
1402         pos = (const u8 *) (res + 1);
1403         end = pos + res->ie_len;
1404
1405         while (pos + 1 < end) {
1406                 if (pos + 2 + pos[1] > end)
1407                         break;
1408                 if (pos[0] == WLAN_EID_VENDOR_SPECIFIC && pos[1] >= 4 &&
1409                     vendor_type == WPA_GET_BE32(&pos[2]))
1410                         wpabuf_put_data(buf, pos + 2 + 4, pos[1] - 4);
1411                 pos += 2 + pos[1];
1412         }
1413
1414         if (wpabuf_len(buf) == 0) {
1415                 wpabuf_free(buf);
1416                 buf = NULL;
1417         }
1418
1419         return buf;
1420 }
1421
1422
1423 /*
1424  * Channels with a great SNR can operate at full rate. What is a great SNR?
1425  * This doc https://supportforums.cisco.com/docs/DOC-12954 says, "the general
1426  * rule of thumb is that any SNR above 20 is good." This one
1427  * http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00805e9a96.shtml#qa23
1428  * recommends 25 as a minimum SNR for 54 Mbps data rate. 30 is chosen here as a
1429  * conservative value.
1430  */
1431 #define GREAT_SNR 30
1432
1433 /* Compare function for sorting scan results. Return >0 if @b is considered
1434  * better. */
1435 static int wpa_scan_result_compar(const void *a, const void *b)
1436 {
1437 #define IS_5GHZ(n) (n > 4000)
1438 #define MIN(a,b) a < b ? a : b
1439         struct wpa_scan_res **_wa = (void *) a;
1440         struct wpa_scan_res **_wb = (void *) b;
1441         struct wpa_scan_res *wa = *_wa;
1442         struct wpa_scan_res *wb = *_wb;
1443         int wpa_a, wpa_b, maxrate_a, maxrate_b;
1444         int snr_a, snr_b;
1445
1446         /* WPA/WPA2 support preferred */
1447         wpa_a = wpa_scan_get_vendor_ie(wa, WPA_IE_VENDOR_TYPE) != NULL ||
1448                 wpa_scan_get_ie(wa, WLAN_EID_RSN) != NULL;
1449         wpa_b = wpa_scan_get_vendor_ie(wb, WPA_IE_VENDOR_TYPE) != NULL ||
1450                 wpa_scan_get_ie(wb, WLAN_EID_RSN) != NULL;
1451
1452         if (wpa_b && !wpa_a)
1453                 return 1;
1454         if (!wpa_b && wpa_a)
1455                 return -1;
1456
1457         /* privacy support preferred */
1458         if ((wa->caps & IEEE80211_CAP_PRIVACY) == 0 &&
1459             (wb->caps & IEEE80211_CAP_PRIVACY))
1460                 return 1;
1461         if ((wa->caps & IEEE80211_CAP_PRIVACY) &&
1462             (wb->caps & IEEE80211_CAP_PRIVACY) == 0)
1463                 return -1;
1464
1465         if ((wa->flags & wb->flags & WPA_SCAN_LEVEL_DBM) &&
1466             !((wa->flags | wb->flags) & WPA_SCAN_NOISE_INVALID)) {
1467                 snr_a = MIN(wa->level - wa->noise, GREAT_SNR);
1468                 snr_b = MIN(wb->level - wb->noise, GREAT_SNR);
1469         } else {
1470                 /* Not suitable information to calculate SNR, so use level */
1471                 snr_a = wa->level;
1472                 snr_b = wb->level;
1473         }
1474
1475         /* best/max rate preferred if SNR close enough */
1476         if ((snr_a && snr_b && abs(snr_b - snr_a) < 5) ||
1477             (wa->qual && wb->qual && abs(wb->qual - wa->qual) < 10)) {
1478                 maxrate_a = wpa_scan_get_max_rate(wa);
1479                 maxrate_b = wpa_scan_get_max_rate(wb);
1480                 if (maxrate_a != maxrate_b)
1481                         return maxrate_b - maxrate_a;
1482                 if (IS_5GHZ(wa->freq) ^ IS_5GHZ(wb->freq))
1483                         return IS_5GHZ(wa->freq) ? -1 : 1;
1484         }
1485
1486         /* use freq for channel preference */
1487
1488         /* all things being equal, use SNR; if SNRs are
1489          * identical, use quality values since some drivers may only report
1490          * that value and leave the signal level zero */
1491         if (snr_b == snr_a)
1492                 return wb->qual - wa->qual;
1493         return snr_b - snr_a;
1494 #undef MIN
1495 #undef IS_5GHZ
1496 }
1497
1498
1499 #ifdef CONFIG_WPS
1500 /* Compare function for sorting scan results when searching a WPS AP for
1501  * provisioning. Return >0 if @b is considered better. */
1502 static int wpa_scan_result_wps_compar(const void *a, const void *b)
1503 {
1504         struct wpa_scan_res **_wa = (void *) a;
1505         struct wpa_scan_res **_wb = (void *) b;
1506         struct wpa_scan_res *wa = *_wa;
1507         struct wpa_scan_res *wb = *_wb;
1508         int uses_wps_a, uses_wps_b;
1509         struct wpabuf *wps_a, *wps_b;
1510         int res;
1511
1512         /* Optimization - check WPS IE existence before allocated memory and
1513          * doing full reassembly. */
1514         uses_wps_a = wpa_scan_get_vendor_ie(wa, WPS_IE_VENDOR_TYPE) != NULL;
1515         uses_wps_b = wpa_scan_get_vendor_ie(wb, WPS_IE_VENDOR_TYPE) != NULL;
1516         if (uses_wps_a && !uses_wps_b)
1517                 return -1;
1518         if (!uses_wps_a && uses_wps_b)
1519                 return 1;
1520
1521         if (uses_wps_a && uses_wps_b) {
1522                 wps_a = wpa_scan_get_vendor_ie_multi(wa, WPS_IE_VENDOR_TYPE);
1523                 wps_b = wpa_scan_get_vendor_ie_multi(wb, WPS_IE_VENDOR_TYPE);
1524                 res = wps_ap_priority_compar(wps_a, wps_b);
1525                 wpabuf_free(wps_a);
1526                 wpabuf_free(wps_b);
1527                 if (res)
1528                         return res;
1529         }
1530
1531         /*
1532          * Do not use current AP security policy as a sorting criteria during
1533          * WPS provisioning step since the AP may get reconfigured at the
1534          * completion of provisioning.
1535          */
1536
1537         /* all things being equal, use signal level; if signal levels are
1538          * identical, use quality values since some drivers may only report
1539          * that value and leave the signal level zero */
1540         if (wb->level == wa->level)
1541                 return wb->qual - wa->qual;
1542         return wb->level - wa->level;
1543 }
1544 #endif /* CONFIG_WPS */
1545
1546
1547 static void dump_scan_res(struct wpa_scan_results *scan_res)
1548 {
1549 #ifndef CONFIG_NO_STDOUT_DEBUG
1550         size_t i;
1551
1552         if (scan_res->res == NULL || scan_res->num == 0)
1553                 return;
1554
1555         wpa_printf(MSG_EXCESSIVE, "Sorted scan results");
1556
1557         for (i = 0; i < scan_res->num; i++) {
1558                 struct wpa_scan_res *r = scan_res->res[i];
1559                 u8 *pos;
1560                 if ((r->flags & (WPA_SCAN_LEVEL_DBM | WPA_SCAN_NOISE_INVALID))
1561                     == WPA_SCAN_LEVEL_DBM) {
1562                         int snr = r->level - r->noise;
1563                         wpa_printf(MSG_EXCESSIVE, MACSTR " freq=%d qual=%d "
1564                                    "noise=%d level=%d snr=%d%s flags=0x%x "
1565                                    "age=%u",
1566                                    MAC2STR(r->bssid), r->freq, r->qual,
1567                                    r->noise, r->level, snr,
1568                                    snr >= GREAT_SNR ? "*" : "", r->flags,
1569                                    r->age);
1570                 } else {
1571                         wpa_printf(MSG_EXCESSIVE, MACSTR " freq=%d qual=%d "
1572                                    "noise=%d level=%d flags=0x%x age=%u",
1573                                    MAC2STR(r->bssid), r->freq, r->qual,
1574                                    r->noise, r->level, r->flags, r->age);
1575                 }
1576                 pos = (u8 *) (r + 1);
1577                 if (r->ie_len)
1578                         wpa_hexdump(MSG_EXCESSIVE, "IEs", pos, r->ie_len);
1579                 pos += r->ie_len;
1580                 if (r->beacon_ie_len)
1581                         wpa_hexdump(MSG_EXCESSIVE, "Beacon IEs",
1582                                     pos, r->beacon_ie_len);
1583         }
1584 #endif /* CONFIG_NO_STDOUT_DEBUG */
1585 }
1586
1587
1588 /**
1589  * wpa_supplicant_filter_bssid_match - Is the specified BSSID allowed
1590  * @wpa_s: Pointer to wpa_supplicant data
1591  * @bssid: BSSID to check
1592  * Returns: 0 if the BSSID is filtered or 1 if not
1593  *
1594  * This function is used to filter out specific BSSIDs from scan reslts mainly
1595  * for testing purposes (SET bssid_filter ctrl_iface command).
1596  */
1597 int wpa_supplicant_filter_bssid_match(struct wpa_supplicant *wpa_s,
1598                                       const u8 *bssid)
1599 {
1600         size_t i;
1601
1602         if (wpa_s->bssid_filter == NULL)
1603                 return 1;
1604
1605         for (i = 0; i < wpa_s->bssid_filter_count; i++) {
1606                 if (os_memcmp(wpa_s->bssid_filter + i * ETH_ALEN, bssid,
1607                               ETH_ALEN) == 0)
1608                         return 1;
1609         }
1610
1611         return 0;
1612 }
1613
1614
1615 static void filter_scan_res(struct wpa_supplicant *wpa_s,
1616                             struct wpa_scan_results *res)
1617 {
1618         size_t i, j;
1619
1620         if (wpa_s->bssid_filter == NULL)
1621                 return;
1622
1623         for (i = 0, j = 0; i < res->num; i++) {
1624                 if (wpa_supplicant_filter_bssid_match(wpa_s,
1625                                                       res->res[i]->bssid)) {
1626                         res->res[j++] = res->res[i];
1627                 } else {
1628                         os_free(res->res[i]);
1629                         res->res[i] = NULL;
1630                 }
1631         }
1632
1633         if (res->num != j) {
1634                 wpa_printf(MSG_DEBUG, "Filtered out %d scan results",
1635                            (int) (res->num - j));
1636                 res->num = j;
1637         }
1638 }
1639
1640
1641 /**
1642  * wpa_supplicant_get_scan_results - Get scan results
1643  * @wpa_s: Pointer to wpa_supplicant data
1644  * @info: Information about what was scanned or %NULL if not available
1645  * @new_scan: Whether a new scan was performed
1646  * Returns: Scan results, %NULL on failure
1647  *
1648  * This function request the current scan results from the driver and updates
1649  * the local BSS list wpa_s->bss. The caller is responsible for freeing the
1650  * results with wpa_scan_results_free().
1651  */
1652 struct wpa_scan_results *
1653 wpa_supplicant_get_scan_results(struct wpa_supplicant *wpa_s,
1654                                 struct scan_info *info, int new_scan)
1655 {
1656         struct wpa_scan_results *scan_res;
1657         size_t i;
1658         int (*compar)(const void *, const void *) = wpa_scan_result_compar;
1659
1660         scan_res = wpa_drv_get_scan_results2(wpa_s);
1661         if (scan_res == NULL) {
1662                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to get scan results");
1663                 return NULL;
1664         }
1665         if (scan_res->fetch_time.sec == 0) {
1666                 /*
1667                  * Make sure we have a valid timestamp if the driver wrapper
1668                  * does not set this.
1669                  */
1670                 os_get_time(&scan_res->fetch_time);
1671         }
1672         filter_scan_res(wpa_s, scan_res);
1673
1674 #ifdef CONFIG_WPS
1675         if (wpas_wps_in_progress(wpa_s)) {
1676                 wpa_dbg(wpa_s, MSG_DEBUG, "WPS: Order scan results with WPS "
1677                         "provisioning rules");
1678                 compar = wpa_scan_result_wps_compar;
1679         }
1680 #endif /* CONFIG_WPS */
1681
1682         qsort(scan_res->res, scan_res->num, sizeof(struct wpa_scan_res *),
1683               compar);
1684         dump_scan_res(scan_res);
1685
1686         wpa_bss_update_start(wpa_s);
1687         for (i = 0; i < scan_res->num; i++)
1688                 wpa_bss_update_scan_res(wpa_s, scan_res->res[i],
1689                                         &scan_res->fetch_time);
1690         wpa_bss_update_end(wpa_s, info, new_scan);
1691
1692         return scan_res;
1693 }
1694
1695
1696 /**
1697  * wpa_supplicant_update_scan_results - Update scan results from the driver
1698  * @wpa_s: Pointer to wpa_supplicant data
1699  * Returns: 0 on success, -1 on failure
1700  *
1701  * This function updates the BSS table within wpa_supplicant based on the
1702  * currently available scan results from the driver without requesting a new
1703  * scan. This is used in cases where the driver indicates an association
1704  * (including roaming within ESS) and wpa_supplicant does not yet have the
1705  * needed information to complete the connection (e.g., to perform validation
1706  * steps in 4-way handshake).
1707  */
1708 int wpa_supplicant_update_scan_results(struct wpa_supplicant *wpa_s)
1709 {
1710         struct wpa_scan_results *scan_res;
1711         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1712         if (scan_res == NULL)
1713                 return -1;
1714         wpa_scan_results_free(scan_res);
1715
1716         return 0;
1717 }
1718
1719
1720 /**
1721  * scan_only_handler - Reports scan results
1722  */
1723 void scan_only_handler(struct wpa_supplicant *wpa_s,
1724                        struct wpa_scan_results *scan_res)
1725 {
1726         wpa_dbg(wpa_s, MSG_DEBUG, "Scan-only results received");
1727         wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS);
1728         wpas_notify_scan_results(wpa_s);
1729         wpas_notify_scan_done(wpa_s, 1);
1730 }
1731
1732
1733 int wpas_scan_scheduled(struct wpa_supplicant *wpa_s)
1734 {
1735         return eloop_is_timeout_registered(wpa_supplicant_scan, wpa_s, NULL);
1736 }