wpa_supplicant/wnm_sta.c

   1 /*
   2  * wpa_supplicant - WNM
   3  * Copyright (c) 2011-2013, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "common/ieee802_11_defs.h"
  13 #include "common/wpa_ctrl.h"
  14 #include "rsn_supp/wpa.h"
  15 #include "wpa_supplicant_i.h"
  16 #include "driver_i.h"
  17 #include "scan.h"
  18 #include "ctrl_iface.h"
  19 #include "bss.h"
  20 #include "wnm_sta.h"
  21 #include "hs20_supplicant.h"
  22
  23 #define MAX_TFS_IE_LEN  1024
  24 #define WNM_MAX_NEIGHBOR_REPORT 10
  25
  26
  27 /* get the TFS IE from driver */
  28 static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
  29                                    u16 *buf_len, enum wnm_oper oper)
  30 {
  31         wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
  32
  33         return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
  34 }
  35
  36
  37 /* set the TFS IE to driver */
  38 static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
  39                                    const u8 *addr, u8 *buf, u16 *buf_len,
  40                                    enum wnm_oper oper)
  41 {
  42         wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
  43
  44         return wpa_drv_wnm_oper(wpa_s, oper, addr, buf, buf_len);
  45 }
  46
  47
  48 /* MLME-SLEEPMODE.request */
  49 int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
  50                                  u8 action, u16 intval, struct wpabuf *tfs_req)
  51 {
  52         struct ieee80211_mgmt *mgmt;
  53         int res;
  54         size_t len;
  55         struct wnm_sleep_element *wnmsleep_ie;
  56         u8 *wnmtfs_ie;
  57         u8 wnmsleep_ie_len;
  58         u16 wnmtfs_ie_len;  /* possibly multiple IE(s) */
  59         enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
  60                 WNM_SLEEP_TFS_REQ_IE_NONE;
  61
  62         wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
  63                    "action=%s to " MACSTR,
  64                    action == 0 ? "enter" : "exit",
  65                    MAC2STR(wpa_s->bssid));
  66
  67         /* WNM-Sleep Mode IE */
  68         wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
  69         wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
  70         if (wnmsleep_ie == NULL)
  71                 return -1;
  72         wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
  73         wnmsleep_ie->len = wnmsleep_ie_len - 2;
  74         wnmsleep_ie->action_type = action;
  75         wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
  76         wnmsleep_ie->intval = host_to_le16(intval);
  77         wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
  78                     (u8 *) wnmsleep_ie, wnmsleep_ie_len);
  79
  80         /* TFS IE(s) */
  81         if (tfs_req) {
  82                 wnmtfs_ie_len = wpabuf_len(tfs_req);
  83                 wnmtfs_ie = os_malloc(wnmtfs_ie_len);
  84                 if (wnmtfs_ie == NULL) {
  85                         os_free(wnmsleep_ie);
  86                         return -1;
  87                 }
  88                 os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
  89         } else {
  90                 wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
  91                 if (wnmtfs_ie == NULL) {
  92                         os_free(wnmsleep_ie);
  93                         return -1;
  94                 }
  95                 if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
  96                                             tfs_oper)) {
  97                         wnmtfs_ie_len = 0;
  98                         os_free(wnmtfs_ie);
  99                         wnmtfs_ie = NULL;
 100                 }
 101         }
 102         wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
 103                     (u8 *) wnmtfs_ie, wnmtfs_ie_len);
 104
 105         mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
 106         if (mgmt == NULL) {
 107                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
 108                            "WNM-Sleep Request action frame");
 109                 os_free(wnmsleep_ie);
 110                 os_free(wnmtfs_ie);
 111                 return -1;
 112         }
 113
 114         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 115         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 116         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 117         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 118                                            WLAN_FC_STYPE_ACTION);
 119         mgmt->u.action.category = WLAN_ACTION_WNM;
 120         mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
 121         mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
 122         os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
 123                   wnmsleep_ie_len);
 124         /* copy TFS IE here */
 125         if (wnmtfs_ie_len > 0) {
 126                 os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
 127                           wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
 128         }
 129
 130         len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
 131                 wnmtfs_ie_len;
 132
 133         res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 134                                   wpa_s->own_addr, wpa_s->bssid,
 135                                   &mgmt->u.action.category, len, 0);
 136         if (res < 0)
 137                 wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
 138                            "(action=%d, intval=%d)", action, intval);
 139
 140         os_free(wnmsleep_ie);
 141         os_free(wnmtfs_ie);
 142         os_free(mgmt);
 143
 144         return res;
 145 }
 146
 147
 148 static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
 149                                          u8 *tfsresp_ie_start,
 150                                          u8 *tfsresp_ie_end)
 151 {
 152         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
 153                          wpa_s->bssid, NULL, NULL);
 154         /* remove GTK/IGTK ?? */
 155
 156         /* set the TFS Resp IE(s) */
 157         if (tfsresp_ie_start && tfsresp_ie_end &&
 158             tfsresp_ie_end - tfsresp_ie_start >= 0) {
 159                 u16 tfsresp_ie_len;
 160                 tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
 161                         tfsresp_ie_start;
 162                 wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
 163                 /* pass the TFS Resp IE(s) to driver for processing */
 164                 if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
 165                                             tfsresp_ie_start,
 166                                             &tfsresp_ie_len,
 167                                             WNM_SLEEP_TFS_RESP_IE_SET))
 168                         wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
 169         }
 170 }
 171
 172
 173 static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
 174                                         const u8 *frm, u16 key_len_total)
 175 {
 176         u8 *ptr, *end;
 177         u8 gtk_len;
 178
 179         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM,  wpa_s->bssid,
 180                          NULL, NULL);
 181
 182         /* Install GTK/IGTK */
 183
 184         /* point to key data field */
 185         ptr = (u8 *) frm + 1 + 2;
 186         end = ptr + key_len_total;
 187         wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
 188
 189         while (ptr + 1 < end) {
 190                 if (ptr + 2 + ptr[1] > end) {
 191                         wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
 192                                    "length");
 193                         if (end > ptr) {
 194                                 wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
 195                                             ptr, end - ptr);
 196                         }
 197                         break;
 198                 }
 199                 if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
 200                         if (ptr[1] < 11 + 5) {
 201                                 wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
 202                                            "subelem");
 203                                 break;
 204                         }
 205                         gtk_len = *(ptr + 4);
 206                         if (ptr[1] < 11 + gtk_len ||
 207                             gtk_len < 5 || gtk_len > 32) {
 208                                 wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
 209                                            "subelem");
 210                                 break;
 211                         }
 212                         wpa_wnmsleep_install_key(
 213                                 wpa_s->wpa,
 214                                 WNM_SLEEP_SUBELEM_GTK,
 215                                 ptr);
 216                         ptr += 13 + gtk_len;
 217 #ifdef CONFIG_IEEE80211W
 218                 } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
 219                         if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
 220                                 wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
 221                                            "subelem");
 222                                 break;
 223                         }
 224                         wpa_wnmsleep_install_key(wpa_s->wpa,
 225                                                  WNM_SLEEP_SUBELEM_IGTK, ptr);
 226                         ptr += 10 + WPA_IGTK_LEN;
 227 #endif /* CONFIG_IEEE80211W */
 228                 } else
 229                         break; /* skip the loop */
 230         }
 231 }
 232
 233
 234 static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
 235                                         const u8 *frm, int len)
 236 {
 237         /*
 238          * Action [1] | Dialog Token [1] | Key Data Len [2] | Key Data |
 239          * WNM-Sleep Mode IE | TFS Response IE
 240          */
 241         u8 *pos = (u8 *) frm; /* point to payload after the action field */
 242         u16 key_len_total;
 243         struct wnm_sleep_element *wnmsleep_ie = NULL;
 244         /* multiple TFS Resp IE (assuming consecutive) */
 245         u8 *tfsresp_ie_start = NULL;
 246         u8 *tfsresp_ie_end = NULL;
 247
 248         if (len < 3)
 249                 return;
 250         key_len_total = WPA_GET_LE16(frm + 1);
 251
 252         wpa_printf(MSG_DEBUG, "WNM-Sleep Mode Response token=%u key_len_total=%d",
 253                    frm[0], key_len_total);
 254         pos += 3 + key_len_total;
 255         if (pos > frm + len) {
 256                 wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
 257                 return;
 258         }
 259         while (pos - frm < len) {
 260                 u8 ie_len = *(pos + 1);
 261                 if (pos + 2 + ie_len > frm + len) {
 262                         wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
 263                         break;
 264                 }
 265                 wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
 266                 if (*pos == WLAN_EID_WNMSLEEP)
 267                         wnmsleep_ie = (struct wnm_sleep_element *) pos;
 268                 else if (*pos == WLAN_EID_TFS_RESP) {
 269                         if (!tfsresp_ie_start)
 270                                 tfsresp_ie_start = pos;
 271                         tfsresp_ie_end = pos;
 272                 } else
 273                         wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
 274                 pos += ie_len + 2;
 275         }
 276
 277         if (!wnmsleep_ie) {
 278                 wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
 279                 return;
 280         }
 281
 282         if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
 283             wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
 284                 wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
 285                            "frame (action=%d, intval=%d)",
 286                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
 287                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
 288                         wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
 289                                                      tfsresp_ie_end);
 290                 } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
 291                         wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
 292                 }
 293         } else {
 294                 wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
 295                            "(action=%d, intval=%d)",
 296                            wnmsleep_ie->action_type, wnmsleep_ie->intval);
 297                 if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
 298                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
 299                                          wpa_s->bssid, NULL, NULL);
 300                 else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
 301                         wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
 302                                          wpa_s->bssid, NULL, NULL);
 303         }
 304 }
 305
 306
 307 void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
 308 {
 309         int i;
 310
 311         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
 312                 os_free(wpa_s->wnm_neighbor_report_elements[i].meas_pilot);
 313                 os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
 314         }
 315
 316         wpa_s->wnm_num_neighbor_report = 0;
 317         os_free(wpa_s->wnm_neighbor_report_elements);
 318         wpa_s->wnm_neighbor_report_elements = NULL;
 319 }
 320
 321
 322 static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
 323                                            u8 id, u8 elen, const u8 *pos)
 324 {
 325         switch (id) {
 326         case WNM_NEIGHBOR_TSF:
 327                 if (elen < 2 + 2) {
 328                         wpa_printf(MSG_DEBUG, "WNM: Too short TSF");
 329                         break;
 330                 }
 331                 rep->tsf_offset = WPA_GET_LE16(pos);
 332                 rep->beacon_int = WPA_GET_LE16(pos + 2);
 333                 rep->tsf_present = 1;
 334                 break;
 335         case WNM_NEIGHBOR_CONDENSED_COUNTRY_STRING:
 336                 if (elen < 2) {
 337                         wpa_printf(MSG_DEBUG, "WNM: Too short condensed "
 338                                    "country string");
 339                         break;
 340                 }
 341                 os_memcpy(rep->country, pos, 2);
 342                 rep->country_present = 1;
 343                 break;
 344         case WNM_NEIGHBOR_BSS_TRANSITION_CANDIDATE:
 345                 if (elen < 1) {
 346                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS transition "
 347                                    "candidate");
 348                         break;
 349                 }
 350                 rep->preference = pos[0];
 351                 rep->preference_present = 1;
 352                 break;
 353         case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
 354                 rep->bss_term_tsf = WPA_GET_LE64(pos);
 355                 rep->bss_term_dur = WPA_GET_LE16(pos + 8);
 356                 rep->bss_term_present = 1;
 357                 break;
 358         case WNM_NEIGHBOR_BEARING:
 359                 if (elen < 8) {
 360                         wpa_printf(MSG_DEBUG, "WNM: Too short neighbor "
 361                                    "bearing");
 362                         break;
 363                 }
 364                 rep->bearing = WPA_GET_LE16(pos);
 365                 rep->distance = WPA_GET_LE32(pos + 2);
 366                 rep->rel_height = WPA_GET_LE16(pos + 2 + 4);
 367                 rep->bearing_present = 1;
 368                 break;
 369         case WNM_NEIGHBOR_MEASUREMENT_PILOT:
 370                 if (elen < 1) {
 371                         wpa_printf(MSG_DEBUG, "WNM: Too short measurement "
 372                                    "pilot");
 373                         break;
 374                 }
 375                 os_free(rep->meas_pilot);
 376                 rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot));
 377                 if (rep->meas_pilot == NULL)
 378                         break;
 379                 rep->meas_pilot->measurement_pilot = pos[0];
 380                 rep->meas_pilot->subelem_len = elen - 1;
 381                 os_memcpy(rep->meas_pilot->subelems, pos + 1, elen - 1);
 382                 break;
 383         case WNM_NEIGHBOR_RRM_ENABLED_CAPABILITIES:
 384                 if (elen < 5) {
 385                         wpa_printf(MSG_DEBUG, "WNM: Too short RRM enabled "
 386                                    "capabilities");
 387                         break;
 388                 }
 389                 os_memcpy(rep->rm_capab, pos, 5);
 390                 rep->rm_capab_present = 1;
 391                 break;
 392         case WNM_NEIGHBOR_MULTIPLE_BSSID:
 393                 if (elen < 1) {
 394                         wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID");
 395                         break;
 396                 }
 397                 os_free(rep->mul_bssid);
 398                 rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid));
 399                 if (rep->mul_bssid == NULL)
 400                         break;
 401                 rep->mul_bssid->max_bssid_indicator = pos[0];
 402                 rep->mul_bssid->subelem_len = elen - 1;
 403                 os_memcpy(rep->mul_bssid->subelems, pos + 1, elen - 1);
 404                 break;
 405         }
 406 }
 407
 408
 409 static void wnm_parse_neighbor_report(struct wpa_supplicant *wpa_s,
 410                                       const u8 *pos, u8 len,
 411                                       struct neighbor_report *rep)
 412 {
 413         u8 left = len;
 414
 415         if (left < 13) {
 416                 wpa_printf(MSG_DEBUG, "WNM: Too short neighbor report");
 417                 return;
 418         }
 419
 420         os_memcpy(rep->bssid, pos, ETH_ALEN);
 421         rep->bssid_info = WPA_GET_LE32(pos + ETH_ALEN);
 422         rep->regulatory_class = *(pos + 10);
 423         rep->channel_number = *(pos + 11);
 424         rep->phy_type = *(pos + 12);
 425
 426         pos += 13;
 427         left -= 13;
 428
 429         while (left >= 2) {
 430                 u8 id, elen;
 431
 432                 id = *pos++;
 433                 elen = *pos++;
 434                 wpa_printf(MSG_DEBUG, "WNM: Subelement id=%u len=%u", id, elen);
 435                 left -= 2;
 436                 if (elen > left) {
 437                         wpa_printf(MSG_DEBUG,
 438                                    "WNM: Truncated neighbor report subelement");
 439                         break;
 440                 }
 441                 wnm_parse_neighbor_report_elem(rep, id, elen, pos);
 442                 left -= elen;
 443                 pos += elen;
 444         }
 445 }
 446
 447
 448 static int compare_scan_neighbor_results(struct wpa_supplicant *wpa_s,
 449                                          struct wpa_scan_results *scan_res,
 450                                          struct neighbor_report *neigh_rep,
 451                                          u8 num_neigh_rep, u8 *bssid_to_connect)
 452 {
 453
 454         u8 i, j;
 455         const u8 *ssid;
 456         struct wpa_bss *bss = wpa_s->current_bss;
 457
 458         if (scan_res == NULL || num_neigh_rep == 0 || !bss)
 459                 return 0;
 460
 461         wpa_printf(MSG_DEBUG, "WNM: Current BSS " MACSTR " RSSI %d",
 462                    MAC2STR(wpa_s->bssid), bss->level);
 463
 464         for (i = 0; i < num_neigh_rep; i++) {
 465                 struct neighbor_report *nei = &neigh_rep[i];
 466                 struct wpa_scan_res *res = NULL;
 467
 468                 if (nei->preference_present && nei->preference == 0) {
 469                         wpa_printf(MSG_DEBUG, "Skip excluded BSS " MACSTR,
 470                                    MAC2STR(nei->bssid));
 471                         continue;
 472                 }
 473
 474                 for (j = 0; j < scan_res->num; j++) {
 475                         if (os_memcmp(scan_res->res[j]->bssid,
 476                                       neigh_rep[i].bssid, ETH_ALEN) == 0) {
 477                                 res = scan_res->res[j];
 478                                 break;
 479                         }
 480                 }
 481
 482                 if (!res) {
 483                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 484                                    " (pref %d) not found in scan results",
 485                                    MAC2STR(nei->bssid),
 486                                    nei->preference_present ? nei->preference :
 487                                    -1);
 488                         continue;
 489                 }
 490
 491                 ssid = wpa_scan_get_ie(res, WLAN_EID_SSID);
 492                 if (ssid == NULL || bss->ssid_len != ssid[1] ||
 493                     os_memcmp(bss->ssid, ssid + 2, ssid[1]) != 0) {
 494                         /*
 495                          * TODO: Could consider allowing transition to another
 496                          * ESS if PMF was enabled for the association.
 497                          */
 498                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 499                                    " (pref %d) in different ESS",
 500                                    MAC2STR(nei->bssid),
 501                                    nei->preference_present ? nei->preference :
 502                                    -1);
 503                         continue;
 504                 }
 505
 506                 if (res->level < bss->level && res->level < -80) {
 507                         wpa_printf(MSG_DEBUG, "Candidate BSS " MACSTR
 508                                    " (pref %d) does not have sufficient signal level (%d)",
 509                                    MAC2STR(nei->bssid),
 510                                    nei->preference_present ? nei->preference :
 511                                    -1,
 512                                    res->level);
 513                         continue;
 514                 }
 515
 516                 wpa_printf(MSG_DEBUG,
 517                            "WNM: Found an acceptable prefed transition candidate BSS "
 518                            MACSTR " (RSSI %d)",
 519                            MAC2STR(nei->bssid), res->level);
 520                 os_memcpy(bssid_to_connect, nei->bssid, ETH_ALEN);
 521                 return 1;
 522         }
 523
 524         return 0;
 525 }
 526
 527
 528 static void wnm_send_bss_transition_mgmt_resp(
 529         struct wpa_supplicant *wpa_s, u8 dialog_token,
 530         enum bss_trans_mgmt_status_code status, u8 delay,
 531         const u8 *target_bssid)
 532 {
 533         u8 buf[1000], *pos;
 534         struct ieee80211_mgmt *mgmt;
 535         size_t len;
 536
 537         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response "
 538                    "to " MACSTR " dialog_token=%u status=%u delay=%d",
 539                    MAC2STR(wpa_s->bssid), dialog_token, status, delay);
 540
 541         mgmt = (struct ieee80211_mgmt *) buf;
 542         os_memset(&buf, 0, sizeof(buf));
 543         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 544         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 545         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 546         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 547                                            WLAN_FC_STYPE_ACTION);
 548         mgmt->u.action.category = WLAN_ACTION_WNM;
 549         mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP;
 550         mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token;
 551         mgmt->u.action.u.bss_tm_resp.status_code = status;
 552         mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay;
 553         pos = mgmt->u.action.u.bss_tm_resp.variable;
 554         if (target_bssid) {
 555                 os_memcpy(pos, target_bssid, ETH_ALEN);
 556                 pos += ETH_ALEN;
 557         } else if (status == WNM_BSS_TM_ACCEPT) {
 558                 /*
 559                  * P802.11-REVmc clarifies that the Target BSSID field is always
 560                  * present when status code is zero, so use a fake value here if
 561                  * no BSSID is yet known.
 562                  */
 563                 os_memset(pos, 0, ETH_ALEN);
 564                 pos += ETH_ALEN;
 565         }
 566
 567         len = pos - (u8 *) &mgmt->u.action.category;
 568
 569         wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 570                             wpa_s->own_addr, wpa_s->bssid,
 571                             &mgmt->u.action.category, len, 0);
 572 }
 573
 574
 575 static void wnm_scan_response(struct wpa_supplicant *wpa_s,
 576                               struct wpa_scan_results *scan_res)
 577 {
 578         u8 bssid[ETH_ALEN];
 579
 580         if (scan_res == NULL) {
 581                 wpa_printf(MSG_ERROR, "Scan result is NULL");
 582                 goto send_bss_resp_fail;
 583         }
 584
 585         /* Compare the Neighbor Report and scan results */
 586         if (compare_scan_neighbor_results(wpa_s, scan_res,
 587                                           wpa_s->wnm_neighbor_report_elements,
 588                                           wpa_s->wnm_num_neighbor_report,
 589                                           bssid) == 1) {
 590                 /* Associate to the network */
 591                 struct wpa_bss *bss;
 592                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 593
 594                 bss = wpa_bss_get_bssid(wpa_s, bssid);
 595                 if (!bss) {
 596                         wpa_printf(MSG_DEBUG, "WNM: Target AP not found from "
 597                                    "BSS table");
 598                         goto send_bss_resp_fail;
 599                 }
 600
 601                 /* Send the BSS Management Response - Accept */
 602                 if (wpa_s->wnm_reply) {
 603                         wnm_send_bss_transition_mgmt_resp(wpa_s,
 604                                                   wpa_s->wnm_dialog_token,
 605                                                   WNM_BSS_TM_ACCEPT,
 606                                                   0, bssid);
 607                 }
 608
 609                 wpa_s->reassociate = 1;
 610                 wpa_supplicant_connect(wpa_s, bss, ssid);
 611                 wnm_deallocate_memory(wpa_s);
 612                 return;
 613         }
 614
 615         /* Send reject response for all the failures */
 616 send_bss_resp_fail:
 617         wnm_deallocate_memory(wpa_s);
 618         if (wpa_s->wnm_reply) {
 619                 wnm_send_bss_transition_mgmt_resp(wpa_s,
 620                                                   wpa_s->wnm_dialog_token,
 621                                                   WNM_BSS_TM_REJECT_UNSPECIFIED,
 622                                                   0, NULL);
 623         }
 624         return;
 625 }
 626
 627
 628 static int cand_pref_compar(const void *a, const void *b)
 629 {
 630         const struct neighbor_report *aa = a;
 631         const struct neighbor_report *bb = b;
 632
 633         if (!aa->preference_present && !bb->preference_present)
 634                 return 0;
 635         if (!aa->preference_present)
 636                 return 1;
 637         if (!bb->preference_present)
 638                 return -1;
 639         if (bb->preference > aa->preference)
 640                 return 1;
 641         if (bb->preference < aa->preference)
 642                 return -1;
 643         return 0;
 644 }
 645
 646
 647 static void wnm_sort_cand_list(struct wpa_supplicant *wpa_s)
 648 {
 649         if (!wpa_s->wnm_neighbor_report_elements)
 650                 return;
 651         qsort(wpa_s->wnm_neighbor_report_elements,
 652               wpa_s->wnm_num_neighbor_report, sizeof(struct neighbor_report),
 653               cand_pref_compar);
 654 }
 655
 656
 657 static void wnm_dump_cand_list(struct wpa_supplicant *wpa_s)
 658 {
 659         unsigned int i;
 660
 661         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Candidate List");
 662         if (!wpa_s->wnm_neighbor_report_elements)
 663                 return;
 664         for (i = 0; i < wpa_s->wnm_num_neighbor_report; i++) {
 665                 struct neighbor_report *nei;
 666
 667                 nei = &wpa_s->wnm_neighbor_report_elements[i];
 668                 wpa_printf(MSG_DEBUG, "%u: " MACSTR
 669                            " info=0x%x op_class=%u chan=%u phy=%u pref=%d",
 670                            i, MAC2STR(nei->bssid), nei->bssid_info,
 671                            nei->regulatory_class,
 672                            nei->channel_number, nei->phy_type,
 673                            nei->preference_present ? nei->preference : -1);
 674         }
 675 }
 676
 677
 678 static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
 679                                              const u8 *pos, const u8 *end,
 680                                              int reply)
 681 {
 682         unsigned int beacon_int;
 683         u8 valid_int;
 684
 685         if (pos + 5 > end)
 686                 return;
 687
 688         if (wpa_s->current_bss)
 689                 beacon_int = wpa_s->current_bss->beacon_int;
 690         else
 691                 beacon_int = 100; /* best guess */
 692
 693         wpa_s->wnm_dialog_token = pos[0];
 694         wpa_s->wnm_mode = pos[1];
 695         wpa_s->wnm_dissoc_timer = WPA_GET_LE16(pos + 2);
 696         valid_int = pos[4];
 697         wpa_s->wnm_reply = reply;
 698
 699         wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: "
 700                    "dialog_token=%u request_mode=0x%x "
 701                    "disassoc_timer=%u validity_interval=%u",
 702                    wpa_s->wnm_dialog_token, wpa_s->wnm_mode,
 703                    wpa_s->wnm_dissoc_timer, valid_int);
 704
 705         pos += 5;
 706
 707         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED) {
 708                 if (pos + 12 > end) {
 709                         wpa_printf(MSG_DEBUG, "WNM: Too short BSS TM Request");
 710                         return;
 711                 }
 712                 os_memcpy(wpa_s->wnm_bss_termination_duration, pos, 12);
 713                 pos += 12; /* BSS Termination Duration */
 714         }
 715
 716         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT) {
 717                 char url[256];
 718
 719                 if (pos + 1 > end || pos + 1 + pos[0] > end) {
 720                         wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition "
 721                                    "Management Request (URL)");
 722                         return;
 723                 }
 724                 os_memcpy(url, pos + 1, pos[0]);
 725                 url[pos[0]] = '\0';
 726                 pos += 1 + pos[0];
 727
 728                 wpa_msg(wpa_s, MSG_INFO, ESS_DISASSOC_IMMINENT "%d %u %s",
 729                         wpa_sm_pmf_enabled(wpa_s->wpa),
 730                         wpa_s->wnm_dissoc_timer * beacon_int * 128 / 125, url);
 731         }
 732
 733         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT) {
 734                 wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - "
 735                         "Disassociation Timer %u", wpa_s->wnm_dissoc_timer);
 736                 if (wpa_s->wnm_dissoc_timer && !wpa_s->scanning) {
 737                         /* TODO: mark current BSS less preferred for
 738                          * selection */
 739                         wpa_printf(MSG_DEBUG, "Trying to find another BSS");
 740                         wpa_supplicant_req_scan(wpa_s, 0, 0);
 741                 }
 742         }
 743
 744         if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED) {
 745                 unsigned int valid_ms;
 746
 747                 wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
 748                 wnm_deallocate_memory(wpa_s);
 749                 wpa_s->wnm_neighbor_report_elements = os_zalloc(
 750                         WNM_MAX_NEIGHBOR_REPORT *
 751                         sizeof(struct neighbor_report));
 752                 if (wpa_s->wnm_neighbor_report_elements == NULL)
 753                         return;
 754
 755                 while (pos + 2 <= end &&
 756                        wpa_s->wnm_num_neighbor_report < WNM_MAX_NEIGHBOR_REPORT)
 757                 {
 758                         u8 tag = *pos++;
 759                         u8 len = *pos++;
 760
 761                         wpa_printf(MSG_DEBUG, "WNM: Neighbor report tag %u",
 762                                    tag);
 763                         if (pos + len > end) {
 764                                 wpa_printf(MSG_DEBUG, "WNM: Truncated request");
 765                                 return;
 766                         }
 767                         if (tag == WLAN_EID_NEIGHBOR_REPORT) {
 768                                 struct neighbor_report *rep;
 769                                 rep = &wpa_s->wnm_neighbor_report_elements[
 770                                         wpa_s->wnm_num_neighbor_report];
 771                                 wnm_parse_neighbor_report(wpa_s, pos, len, rep);
 772                         }
 773
 774                         pos += len;
 775                         wpa_s->wnm_num_neighbor_report++;
 776                 }
 777                 wnm_sort_cand_list(wpa_s);
 778                 wnm_dump_cand_list(wpa_s);
 779                 valid_ms = valid_int * beacon_int * 128 / 125;
 780                 wpa_printf(MSG_DEBUG, "WNM: Candidate list valid for %u ms",
 781                            valid_ms);
 782                 os_get_reltime(&wpa_s->wnm_cand_valid_until);
 783                 wpa_s->wnm_cand_valid_until.sec += valid_ms / 1000;
 784                 wpa_s->wnm_cand_valid_until.usec += (valid_ms % 1000) * 1000;
 785                 wpa_s->wnm_cand_valid_until.sec +=
 786                         wpa_s->wnm_cand_valid_until.usec / 1000000;
 787                 wpa_s->wnm_cand_valid_until.usec %= 1000000;
 788
 789                 wpa_s->scan_res_handler = wnm_scan_response;
 790                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 791         } else if (reply) {
 792                 enum bss_trans_mgmt_status_code status;
 793                 if (wpa_s->wnm_mode & WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT)
 794                         status = WNM_BSS_TM_ACCEPT;
 795                 else {
 796                         wpa_msg(wpa_s, MSG_INFO, "WNM: BSS Transition Management Request did not include candidates");
 797                         status = WNM_BSS_TM_REJECT_UNSPECIFIED;
 798                 }
 799                 wnm_send_bss_transition_mgmt_resp(wpa_s,
 800                                                   wpa_s->wnm_dialog_token,
 801                                                   status, 0, NULL);
 802         }
 803 }
 804
 805
 806 int wnm_send_bss_transition_mgmt_query(struct wpa_supplicant *wpa_s,
 807                                        u8 query_reason)
 808 {
 809         u8 buf[1000], *pos;
 810         struct ieee80211_mgmt *mgmt;
 811         size_t len;
 812         int ret;
 813
 814         wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Query to "
 815                    MACSTR " query_reason=%u",
 816                    MAC2STR(wpa_s->bssid), query_reason);
 817
 818         mgmt = (struct ieee80211_mgmt *) buf;
 819         os_memset(&buf, 0, sizeof(buf));
 820         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 821         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 822         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 823         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 824                                            WLAN_FC_STYPE_ACTION);
 825         mgmt->u.action.category = WLAN_ACTION_WNM;
 826         mgmt->u.action.u.bss_tm_query.action = WNM_BSS_TRANS_MGMT_QUERY;
 827         mgmt->u.action.u.bss_tm_query.dialog_token = 1;
 828         mgmt->u.action.u.bss_tm_query.query_reason = query_reason;
 829         pos = mgmt->u.action.u.bss_tm_query.variable;
 830
 831         len = pos - (u8 *) &mgmt->u.action.category;
 832
 833         ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 834                                   wpa_s->own_addr, wpa_s->bssid,
 835                                   &mgmt->u.action.category, len, 0);
 836
 837         return ret;
 838 }
 839
 840
 841 static void ieee802_11_rx_wnm_notif_req_wfa(struct wpa_supplicant *wpa_s,
 842                                             const u8 *sa, const u8 *data,
 843                                             int len)
 844 {
 845         const u8 *pos, *end, *next;
 846         u8 ie, ie_len;
 847
 848         pos = data;
 849         end = data + len;
 850
 851         while (pos + 1 < end) {
 852                 ie = *pos++;
 853                 ie_len = *pos++;
 854                 wpa_printf(MSG_DEBUG, "WNM: WFA subelement %u len %u",
 855                            ie, ie_len);
 856                 if (ie_len > end - pos) {
 857                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for "
 858                                    "subelement");
 859                         break;
 860                 }
 861                 next = pos + ie_len;
 862                 if (ie_len < 4) {
 863                         pos = next;
 864                         continue;
 865                 }
 866                 wpa_printf(MSG_DEBUG, "WNM: Subelement OUI %06x type %u",
 867                            WPA_GET_BE24(pos), pos[3]);
 868
 869 #ifdef CONFIG_HS20
 870                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 5 &&
 871                     WPA_GET_BE24(pos) == OUI_WFA &&
 872                     pos[3] == HS20_WNM_SUB_REM_NEEDED) {
 873                         /* Subscription Remediation subelement */
 874                         const u8 *ie_end;
 875                         u8 url_len;
 876                         char *url;
 877                         u8 osu_method;
 878
 879                         wpa_printf(MSG_DEBUG, "WNM: Subscription Remediation "
 880                                    "subelement");
 881                         ie_end = pos + ie_len;
 882                         pos += 4;
 883                         url_len = *pos++;
 884                         if (url_len == 0) {
 885                                 wpa_printf(MSG_DEBUG, "WNM: No Server URL included");
 886                                 url = NULL;
 887                                 osu_method = 1;
 888                         } else {
 889                                 if (pos + url_len + 1 > ie_end) {
 890                                         wpa_printf(MSG_DEBUG, "WNM: Not enough room for Server URL (len=%u) and Server Method (left %d)",
 891                                                    url_len,
 892                                                    (int) (ie_end - pos));
 893                                         break;
 894                                 }
 895                                 url = os_malloc(url_len + 1);
 896                                 if (url == NULL)
 897                                         break;
 898                                 os_memcpy(url, pos, url_len);
 899                                 url[url_len] = '\0';
 900                                 osu_method = pos[url_len];
 901                         }
 902                         hs20_rx_subscription_remediation(wpa_s, url,
 903                                                          osu_method);
 904                         os_free(url);
 905                         pos = next;
 906                         continue;
 907                 }
 908
 909                 if (ie == WLAN_EID_VENDOR_SPECIFIC && ie_len >= 8 &&
 910                     WPA_GET_BE24(pos) == OUI_WFA &&
 911                     pos[3] == HS20_WNM_DEAUTH_IMMINENT_NOTICE) {
 912                         const u8 *ie_end;
 913                         u8 url_len;
 914                         char *url;
 915                         u8 code;
 916                         u16 reauth_delay;
 917
 918                         ie_end = pos + ie_len;
 919                         pos += 4;
 920                         code = *pos++;
 921                         reauth_delay = WPA_GET_LE16(pos);
 922                         pos += 2;
 923                         url_len = *pos++;
 924                         wpa_printf(MSG_DEBUG, "WNM: HS 2.0 Deauthentication "
 925                                    "Imminent - Reason Code %u   "
 926                                    "Re-Auth Delay %u  URL Length %u",
 927                                    code, reauth_delay, url_len);
 928                         if (pos + url_len > ie_end)
 929                                 break;
 930                         url = os_malloc(url_len + 1);
 931                         if (url == NULL)
 932                                 break;
 933                         os_memcpy(url, pos, url_len);
 934                         url[url_len] = '\0';
 935                         hs20_rx_deauth_imminent_notice(wpa_s, code,
 936                                                        reauth_delay, url);
 937                         os_free(url);
 938                         pos = next;
 939                         continue;
 940                 }
 941 #endif /* CONFIG_HS20 */
 942
 943                 pos = next;
 944         }
 945 }
 946
 947
 948 static void ieee802_11_rx_wnm_notif_req(struct wpa_supplicant *wpa_s,
 949                                         const u8 *sa, const u8 *frm, int len)
 950 {
 951         const u8 *pos, *end;
 952         u8 dialog_token, type;
 953
 954         /* Dialog Token [1] | Type [1] | Subelements */
 955
 956         if (len < 2 || sa == NULL)
 957                 return;
 958         end = frm + len;
 959         pos = frm;
 960         dialog_token = *pos++;
 961         type = *pos++;
 962
 963         wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Received WNM-Notification Request "
 964                 "(dialog_token %u type %u sa " MACSTR ")",
 965                 dialog_token, type, MAC2STR(sa));
 966         wpa_hexdump(MSG_DEBUG, "WNM-Notification Request subelements",
 967                     pos, end - pos);
 968
 969         if (wpa_s->wpa_state != WPA_COMPLETED ||
 970             os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0) {
 971                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: WNM-Notification frame not "
 972                         "from our AP - ignore it");
 973                 return;
 974         }
 975
 976         switch (type) {
 977         case 1:
 978                 ieee802_11_rx_wnm_notif_req_wfa(wpa_s, sa, pos, end - pos);
 979                 break;
 980         default:
 981                 wpa_dbg(wpa_s, MSG_DEBUG, "WNM: Ignore unknown "
 982                         "WNM-Notification type %u", type);
 983                 break;
 984         }
 985 }
 986
 987
 988 void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
 989                               const struct ieee80211_mgmt *mgmt, size_t len)
 990 {
 991         const u8 *pos, *end;
 992         u8 act;
 993
 994         if (len < IEEE80211_HDRLEN + 2)
 995                 return;
 996
 997         pos = ((const u8 *) mgmt) + IEEE80211_HDRLEN + 1;
 998         act = *pos++;
 999         end = ((const u8 *) mgmt) + len;
1000
1001         wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR,
1002                    act, MAC2STR(mgmt->sa));
1003         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
1004             os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1005                 wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action "
1006                            "frame");
1007                 return;
1008         }
1009
1010         switch (act) {
1011         case WNM_BSS_TRANS_MGMT_REQ:
1012                 ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end,
1013                                                  !(mgmt->da[0] & 0x01));
1014                 break;
1015         case WNM_SLEEP_MODE_RESP:
1016                 ieee802_11_rx_wnmsleep_resp(wpa_s, pos, end - pos);
1017                 break;
1018         case WNM_NOTIFICATION_REQ:
1019                 ieee802_11_rx_wnm_notif_req(wpa_s, mgmt->sa, pos, end - pos);
1020                 break;
1021         default:
1022                 wpa_printf(MSG_ERROR, "WNM: Unknown request");
1023                 break;
1024         }
1025 }