wpa_supplicant/wpa_supplicant.c

   1 /*
   2  * WPA Supplicant
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  *
   8  * This file implements functions for registering and unregistering
   9  * %wpa_supplicant interfaces. In addition, this file contains number of
  10  * functions for managing network connections.
  11  */
  12
  13 #include "includes.h"
  14 #ifdef CONFIG_MATCH_IFACE
  15 #include <net/if.h>
  16 #include <fnmatch.h>
  17 #endif /* CONFIG_MATCH_IFACE */
  18
  19 #include "common.h"
  20 #include "crypto/random.h"
  21 #include "crypto/sha1.h"
  22 #include "eapol_supp/eapol_supp_sm.h"
  23 #include "eap_peer/eap.h"
  24 #include "eap_peer/eap_proxy.h"
  25 #include "eap_server/eap_methods.h"
  26 #include "rsn_supp/wpa.h"
  27 #include "eloop.h"
  28 #include "config.h"
  29 #include "utils/ext_password.h"
  30 #include "l2_packet/l2_packet.h"
  31 #include "wpa_supplicant_i.h"
  32 #include "driver_i.h"
  33 #include "ctrl_iface.h"
  34 #include "pcsc_funcs.h"
  35 #include "common/version.h"
  36 #include "rsn_supp/preauth.h"
  37 #include "rsn_supp/pmksa_cache.h"
  38 #include "common/wpa_ctrl.h"
  39 #include "common/ieee802_11_defs.h"
  40 #include "common/hw_features_common.h"
  41 #include "p2p/p2p.h"
  42 #include "fst/fst.h"
  43 #include "blacklist.h"
  44 #include "wpas_glue.h"
  45 #include "wps_supplicant.h"
  46 #include "ibss_rsn.h"
  47 #include "sme.h"
  48 #include "gas_query.h"
  49 #include "ap.h"
  50 #include "p2p_supplicant.h"
  51 #include "wifi_display.h"
  52 #include "notify.h"
  53 #include "bgscan.h"
  54 #include "autoscan.h"
  55 #include "bss.h"
  56 #include "scan.h"
  57 #include "offchannel.h"
  58 #include "hs20_supplicant.h"
  59 #include "wnm_sta.h"
  60 #include "wpas_kay.h"
  61 #include "mesh.h"
  62
  63 const char *const wpa_supplicant_version =
  64 "wpa_supplicant v" VERSION_STR "\n"
  65 "Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi> and contributors";
  66
  67 const char *const wpa_supplicant_license =
  68 "This software may be distributed under the terms of the BSD license.\n"
  69 "See README for more details.\n"
  70 #ifdef EAP_TLS_OPENSSL
  71 "\nThis product includes software developed by the OpenSSL Project\n"
  72 "for use in the OpenSSL Toolkit (http://www.openssl.org/)\n"
  73 #endif /* EAP_TLS_OPENSSL */
  74 ;
  75
  76 #ifndef CONFIG_NO_STDOUT_DEBUG
  77 /* Long text divided into parts in order to fit in C89 strings size limits. */
  78 const char *const wpa_supplicant_full_license1 =
  79 "";
  80 const char *const wpa_supplicant_full_license2 =
  81 "This software may be distributed under the terms of the BSD license.\n"
  82 "\n"
  83 "Redistribution and use in source and binary forms, with or without\n"
  84 "modification, are permitted provided that the following conditions are\n"
  85 "met:\n"
  86 "\n";
  87 const char *const wpa_supplicant_full_license3 =
  88 "1. Redistributions of source code must retain the above copyright\n"
  89 "   notice, this list of conditions and the following disclaimer.\n"
  90 "\n"
  91 "2. Redistributions in binary form must reproduce the above copyright\n"
  92 "   notice, this list of conditions and the following disclaimer in the\n"
  93 "   documentation and/or other materials provided with the distribution.\n"
  94 "\n";
  95 const char *const wpa_supplicant_full_license4 =
  96 "3. Neither the name(s) of the above-listed copyright holder(s) nor the\n"
  97 "   names of its contributors may be used to endorse or promote products\n"
  98 "   derived from this software without specific prior written permission.\n"
  99 "\n"
 100 "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n"
 101 "\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n"
 102 "LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n"
 103 "A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n";
 104 const char *const wpa_supplicant_full_license5 =
 105 "OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n"
 106 "SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n"
 107 "LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n"
 108 "DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n"
 109 "THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n"
 110 "(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n"
 111 "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
 112 "\n";
 113 #endif /* CONFIG_NO_STDOUT_DEBUG */
 114
 115 /* Configure default/group WEP keys for static WEP */
 116 int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 117 {
 118         int i, set = 0;
 119
 120         for (i = 0; i < NUM_WEP_KEYS; i++) {
 121                 if (ssid->wep_key_len[i] == 0)
 122                         continue;
 123
 124                 set = 1;
 125                 wpa_drv_set_key(wpa_s, WPA_ALG_WEP, NULL,
 126                                 i, i == ssid->wep_tx_keyidx, NULL, 0,
 127                                 ssid->wep_key[i], ssid->wep_key_len[i]);
 128         }
 129
 130         return set;
 131 }
 132
 133
 134 int wpa_supplicant_set_wpa_none_key(struct wpa_supplicant *wpa_s,
 135                                     struct wpa_ssid *ssid)
 136 {
 137         u8 key[32];
 138         size_t keylen;
 139         enum wpa_alg alg;
 140         u8 seq[6] = { 0 };
 141         int ret;
 142
 143         /* IBSS/WPA-None uses only one key (Group) for both receiving and
 144          * sending unicast and multicast packets. */
 145
 146         if (ssid->mode != WPAS_MODE_IBSS) {
 147                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid mode %d (not "
 148                         "IBSS/ad-hoc) for WPA-None", ssid->mode);
 149                 return -1;
 150         }
 151
 152         if (!ssid->psk_set) {
 153                 wpa_msg(wpa_s, MSG_INFO, "WPA: No PSK configured for "
 154                         "WPA-None");
 155                 return -1;
 156         }
 157
 158         switch (wpa_s->group_cipher) {
 159         case WPA_CIPHER_CCMP:
 160                 os_memcpy(key, ssid->psk, 16);
 161                 keylen = 16;
 162                 alg = WPA_ALG_CCMP;
 163                 break;
 164         case WPA_CIPHER_GCMP:
 165                 os_memcpy(key, ssid->psk, 16);
 166                 keylen = 16;
 167                 alg = WPA_ALG_GCMP;
 168                 break;
 169         case WPA_CIPHER_TKIP:
 170                 /* WPA-None uses the same Michael MIC key for both TX and RX */
 171                 os_memcpy(key, ssid->psk, 16 + 8);
 172                 os_memcpy(key + 16 + 8, ssid->psk + 16, 8);
 173                 keylen = 32;
 174                 alg = WPA_ALG_TKIP;
 175                 break;
 176         default:
 177                 wpa_msg(wpa_s, MSG_INFO, "WPA: Invalid group cipher %d for "
 178                         "WPA-None", wpa_s->group_cipher);
 179                 return -1;
 180         }
 181
 182         /* TODO: should actually remember the previously used seq#, both for TX
 183          * and RX from each STA.. */
 184
 185         ret = wpa_drv_set_key(wpa_s, alg, NULL, 0, 1, seq, 6, key, keylen);
 186         os_memset(key, 0, sizeof(key));
 187         return ret;
 188 }
 189
 190
 191 static void wpa_supplicant_timeout(void *eloop_ctx, void *timeout_ctx)
 192 {
 193         struct wpa_supplicant *wpa_s = eloop_ctx;
 194         const u8 *bssid = wpa_s->bssid;
 195         if (is_zero_ether_addr(bssid))
 196                 bssid = wpa_s->pending_bssid;
 197         wpa_msg(wpa_s, MSG_INFO, "Authentication with " MACSTR " timed out.",
 198                 MAC2STR(bssid));
 199         wpa_blacklist_add(wpa_s, bssid);
 200         wpa_sm_notify_disassoc(wpa_s->wpa);
 201         wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 202         wpa_s->reassociate = 1;
 203
 204         /*
 205          * If we timed out, the AP or the local radio may be busy.
 206          * So, wait a second until scanning again.
 207          */
 208         wpa_supplicant_req_scan(wpa_s, 1, 0);
 209 }
 210
 211
 212 /**
 213  * wpa_supplicant_req_auth_timeout - Schedule a timeout for authentication
 214  * @wpa_s: Pointer to wpa_supplicant data
 215  * @sec: Number of seconds after which to time out authentication
 216  * @usec: Number of microseconds after which to time out authentication
 217  *
 218  * This function is used to schedule a timeout for the current authentication
 219  * attempt.
 220  */
 221 void wpa_supplicant_req_auth_timeout(struct wpa_supplicant *wpa_s,
 222                                      int sec, int usec)
 223 {
 224         if (wpa_s->conf->ap_scan == 0 &&
 225             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED))
 226                 return;
 227
 228         wpa_dbg(wpa_s, MSG_DEBUG, "Setting authentication timeout: %d sec "
 229                 "%d usec", sec, usec);
 230         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 231         eloop_register_timeout(sec, usec, wpa_supplicant_timeout, wpa_s, NULL);
 232 }
 233
 234
 235 /**
 236  * wpa_supplicant_cancel_auth_timeout - Cancel authentication timeout
 237  * @wpa_s: Pointer to wpa_supplicant data
 238  *
 239  * This function is used to cancel authentication timeout scheduled with
 240  * wpa_supplicant_req_auth_timeout() and it is called when authentication has
 241  * been completed.
 242  */
 243 void wpa_supplicant_cancel_auth_timeout(struct wpa_supplicant *wpa_s)
 244 {
 245         wpa_dbg(wpa_s, MSG_DEBUG, "Cancelling authentication timeout");
 246         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
 247         wpa_blacklist_del(wpa_s, wpa_s->bssid);
 248 }
 249
 250
 251 /**
 252  * wpa_supplicant_initiate_eapol - Configure EAPOL state machine
 253  * @wpa_s: Pointer to wpa_supplicant data
 254  *
 255  * This function is used to configure EAPOL state machine based on the selected
 256  * authentication mode.
 257  */
 258 void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s)
 259 {
 260 #ifdef IEEE8021X_EAPOL
 261         struct eapol_config eapol_conf;
 262         struct wpa_ssid *ssid = wpa_s->current_ssid;
 263
 264 #ifdef CONFIG_IBSS_RSN
 265         if (ssid->mode == WPAS_MODE_IBSS &&
 266             wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
 267             wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
 268                 /*
 269                  * RSN IBSS authentication is per-STA and we can disable the
 270                  * per-BSSID EAPOL authentication.
 271                  */
 272                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 273                 eapol_sm_notify_eap_success(wpa_s->eapol, TRUE);
 274                 eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 275                 return;
 276         }
 277 #endif /* CONFIG_IBSS_RSN */
 278
 279         eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 280         eapol_sm_notify_eap_fail(wpa_s->eapol, FALSE);
 281
 282         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
 283             wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE)
 284                 eapol_sm_notify_portControl(wpa_s->eapol, ForceAuthorized);
 285         else
 286                 eapol_sm_notify_portControl(wpa_s->eapol, Auto);
 287
 288         os_memset(&eapol_conf, 0, sizeof(eapol_conf));
 289         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
 290                 eapol_conf.accept_802_1x_keys = 1;
 291                 eapol_conf.required_keys = 0;
 292                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_UNICAST) {
 293                         eapol_conf.required_keys |= EAPOL_REQUIRE_KEY_UNICAST;
 294                 }
 295                 if (ssid->eapol_flags & EAPOL_FLAG_REQUIRE_KEY_BROADCAST) {
 296                         eapol_conf.required_keys |=
 297                                 EAPOL_REQUIRE_KEY_BROADCAST;
 298                 }
 299
 300                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED)
 301                         eapol_conf.required_keys = 0;
 302         }
 303         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 304         eapol_conf.workaround = ssid->eap_workaround;
 305         eapol_conf.eap_disabled =
 306                 !wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) &&
 307                 wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
 308                 wpa_s->key_mgmt != WPA_KEY_MGMT_WPS;
 309         eapol_conf.external_sim = wpa_s->conf->external_sim;
 310
 311 #ifdef CONFIG_WPS
 312         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
 313                 eapol_conf.wps |= EAPOL_LOCAL_WPS_IN_USE;
 314                 if (wpa_s->current_bss) {
 315                         struct wpabuf *ie;
 316                         ie = wpa_bss_get_vendor_ie_multi(wpa_s->current_bss,
 317                                                          WPS_IE_VENDOR_TYPE);
 318                         if (ie) {
 319                                 if (wps_is_20(ie))
 320                                         eapol_conf.wps |=
 321                                                 EAPOL_PEER_IS_WPS20_AP;
 322                                 wpabuf_free(ie);
 323                         }
 324                 }
 325         }
 326 #endif /* CONFIG_WPS */
 327
 328         eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf);
 329
 330         ieee802_1x_alloc_kay_sm(wpa_s, ssid);
 331 #endif /* IEEE8021X_EAPOL */
 332 }
 333
 334
 335 /**
 336  * wpa_supplicant_set_non_wpa_policy - Set WPA parameters to non-WPA mode
 337  * @wpa_s: Pointer to wpa_supplicant data
 338  * @ssid: Configuration data for the network
 339  *
 340  * This function is used to configure WPA state machine and related parameters
 341  * to a mode where WPA is not enabled. This is called as part of the
 342  * authentication configuration when the selected network does not use WPA.
 343  */
 344 void wpa_supplicant_set_non_wpa_policy(struct wpa_supplicant *wpa_s,
 345                                        struct wpa_ssid *ssid)
 346 {
 347         int i;
 348
 349         if (ssid->key_mgmt & WPA_KEY_MGMT_WPS)
 350                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPS;
 351         else if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA)
 352                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
 353         else
 354                 wpa_s->key_mgmt = WPA_KEY_MGMT_NONE;
 355         wpa_sm_set_ap_wpa_ie(wpa_s->wpa, NULL, 0);
 356         wpa_sm_set_ap_rsn_ie(wpa_s->wpa, NULL, 0);
 357         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
 358         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
 359         wpa_s->group_cipher = WPA_CIPHER_NONE;
 360         wpa_s->mgmt_group_cipher = 0;
 361
 362         for (i = 0; i < NUM_WEP_KEYS; i++) {
 363                 if (ssid->wep_key_len[i] > 5) {
 364                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP104;
 365                         wpa_s->group_cipher = WPA_CIPHER_WEP104;
 366                         break;
 367                 } else if (ssid->wep_key_len[i] > 0) {
 368                         wpa_s->pairwise_cipher = WPA_CIPHER_WEP40;
 369                         wpa_s->group_cipher = WPA_CIPHER_WEP40;
 370                         break;
 371                 }
 372         }
 373
 374         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED, 0);
 375         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
 376         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
 377                          wpa_s->pairwise_cipher);
 378         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
 379 #ifdef CONFIG_IEEE80211W
 380         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
 381                          wpa_s->mgmt_group_cipher);
 382 #endif /* CONFIG_IEEE80211W */
 383
 384         pmksa_cache_clear_current(wpa_s->wpa);
 385 }
 386
 387
 388 void free_hw_features(struct wpa_supplicant *wpa_s)
 389 {
 390         int i;
 391         if (wpa_s->hw.modes == NULL)
 392                 return;
 393
 394         for (i = 0; i < wpa_s->hw.num_modes; i++) {
 395                 os_free(wpa_s->hw.modes[i].channels);
 396                 os_free(wpa_s->hw.modes[i].rates);
 397         }
 398
 399         os_free(wpa_s->hw.modes);
 400         wpa_s->hw.modes = NULL;
 401 }
 402
 403
 404 static void free_bss_tmp_disallowed(struct wpa_supplicant *wpa_s)
 405 {
 406         struct wpa_bss_tmp_disallowed *bss, *prev;
 407
 408         dl_list_for_each_safe(bss, prev, &wpa_s->bss_tmp_disallowed,
 409                               struct wpa_bss_tmp_disallowed, list) {
 410                 dl_list_del(&bss->list);
 411                 os_free(bss);
 412         }
 413 }
 414
 415
 416 static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 417 {
 418         int i;
 419
 420         bgscan_deinit(wpa_s);
 421         autoscan_deinit(wpa_s);
 422         scard_deinit(wpa_s->scard);
 423         wpa_s->scard = NULL;
 424         wpa_sm_set_scard_ctx(wpa_s->wpa, NULL);
 425         eapol_sm_register_scard_ctx(wpa_s->eapol, NULL);
 426         l2_packet_deinit(wpa_s->l2);
 427         wpa_s->l2 = NULL;
 428         if (wpa_s->l2_br) {
 429                 l2_packet_deinit(wpa_s->l2_br);
 430                 wpa_s->l2_br = NULL;
 431         }
 432 #ifdef CONFIG_TESTING_OPTIONS
 433         l2_packet_deinit(wpa_s->l2_test);
 434         wpa_s->l2_test = NULL;
 435 #endif /* CONFIG_TESTING_OPTIONS */
 436
 437         if (wpa_s->conf != NULL) {
 438                 struct wpa_ssid *ssid;
 439                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
 440                         wpas_notify_network_removed(wpa_s, ssid);
 441         }
 442
 443         os_free(wpa_s->confname);
 444         wpa_s->confname = NULL;
 445
 446         os_free(wpa_s->confanother);
 447         wpa_s->confanother = NULL;
 448
 449         wpa_sm_set_eapol(wpa_s->wpa, NULL);
 450         eapol_sm_deinit(wpa_s->eapol);
 451         wpa_s->eapol = NULL;
 452
 453         rsn_preauth_deinit(wpa_s->wpa);
 454
 455 #ifdef CONFIG_TDLS
 456         wpa_tdls_deinit(wpa_s->wpa);
 457 #endif /* CONFIG_TDLS */
 458
 459         wmm_ac_clear_saved_tspecs(wpa_s);
 460         pmksa_candidate_free(wpa_s->wpa);
 461         wpa_sm_deinit(wpa_s->wpa);
 462         wpa_s->wpa = NULL;
 463         wpa_blacklist_clear(wpa_s);
 464
 465         wpa_bss_deinit(wpa_s);
 466
 467         wpa_supplicant_cancel_delayed_sched_scan(wpa_s);
 468         wpa_supplicant_cancel_scan(wpa_s);
 469         wpa_supplicant_cancel_auth_timeout(wpa_s);
 470         eloop_cancel_timeout(wpa_supplicant_stop_countermeasures, wpa_s, NULL);
 471 #ifdef CONFIG_DELAYED_MIC_ERROR_REPORT
 472         eloop_cancel_timeout(wpa_supplicant_delayed_mic_error_report,
 473                              wpa_s, NULL);
 474 #endif /* CONFIG_DELAYED_MIC_ERROR_REPORT */
 475
 476         eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
 477
 478         wpas_wps_deinit(wpa_s);
 479
 480         wpabuf_free(wpa_s->pending_eapol_rx);
 481         wpa_s->pending_eapol_rx = NULL;
 482
 483 #ifdef CONFIG_IBSS_RSN
 484         ibss_rsn_deinit(wpa_s->ibss_rsn);
 485         wpa_s->ibss_rsn = NULL;
 486 #endif /* CONFIG_IBSS_RSN */
 487
 488         sme_deinit(wpa_s);
 489
 490 #ifdef CONFIG_AP
 491         wpa_supplicant_ap_deinit(wpa_s);
 492 #endif /* CONFIG_AP */
 493
 494         wpas_p2p_deinit(wpa_s);
 495
 496 #ifdef CONFIG_OFFCHANNEL
 497         offchannel_deinit(wpa_s);
 498 #endif /* CONFIG_OFFCHANNEL */
 499
 500         wpa_supplicant_cancel_sched_scan(wpa_s);
 501
 502         os_free(wpa_s->next_scan_freqs);
 503         wpa_s->next_scan_freqs = NULL;
 504
 505         os_free(wpa_s->manual_scan_freqs);
 506         wpa_s->manual_scan_freqs = NULL;
 507
 508         os_free(wpa_s->manual_sched_scan_freqs);
 509         wpa_s->manual_sched_scan_freqs = NULL;
 510
 511         wpas_mac_addr_rand_scan_clear(wpa_s, MAC_ADDR_RAND_ALL);
 512
 513         /*
 514          * Need to remove any pending gas-query radio work before the
 515          * gas_query_deinit() call because gas_query::work has not yet been set
 516          * for works that have not been started. gas_query_free() will be unable
 517          * to cancel such pending radio works and once the pending gas-query
 518          * radio work eventually gets removed, the deinit notification call to
 519          * gas_query_start_cb() would result in dereferencing freed memory.
 520          */
 521         if (wpa_s->radio)
 522                 radio_remove_works(wpa_s, "gas-query", 0);
 523         gas_query_deinit(wpa_s->gas);
 524         wpa_s->gas = NULL;
 525
 526         free_hw_features(wpa_s);
 527
 528         ieee802_1x_dealloc_kay_sm(wpa_s);
 529
 530         os_free(wpa_s->bssid_filter);
 531         wpa_s->bssid_filter = NULL;
 532
 533         os_free(wpa_s->disallow_aps_bssid);
 534         wpa_s->disallow_aps_bssid = NULL;
 535         os_free(wpa_s->disallow_aps_ssid);
 536         wpa_s->disallow_aps_ssid = NULL;
 537
 538         wnm_bss_keep_alive_deinit(wpa_s);
 539 #ifdef CONFIG_WNM
 540         wnm_deallocate_memory(wpa_s);
 541 #endif /* CONFIG_WNM */
 542
 543         ext_password_deinit(wpa_s->ext_pw);
 544         wpa_s->ext_pw = NULL;
 545
 546         wpabuf_free(wpa_s->last_gas_resp);
 547         wpa_s->last_gas_resp = NULL;
 548         wpabuf_free(wpa_s->prev_gas_resp);
 549         wpa_s->prev_gas_resp = NULL;
 550
 551         os_free(wpa_s->last_scan_res);
 552         wpa_s->last_scan_res = NULL;
 553
 554 #ifdef CONFIG_HS20
 555         hs20_deinit(wpa_s);
 556 #endif /* CONFIG_HS20 */
 557
 558         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
 559                 wpabuf_free(wpa_s->vendor_elem[i]);
 560                 wpa_s->vendor_elem[i] = NULL;
 561         }
 562
 563         wmm_ac_notify_disassoc(wpa_s);
 564
 565         wpa_s->sched_scan_plans_num = 0;
 566         os_free(wpa_s->sched_scan_plans);
 567         wpa_s->sched_scan_plans = NULL;
 568
 569 #ifdef CONFIG_MBO
 570         wpa_s->non_pref_chan_num = 0;
 571         os_free(wpa_s->non_pref_chan);
 572         wpa_s->non_pref_chan = NULL;
 573 #endif /* CONFIG_MBO */
 574
 575         free_bss_tmp_disallowed(wpa_s);
 576 }
 577
 578
 579 /**
 580  * wpa_clear_keys - Clear keys configured for the driver
 581  * @wpa_s: Pointer to wpa_supplicant data
 582  * @addr: Previously used BSSID or %NULL if not available
 583  *
 584  * This function clears the encryption keys that has been previously configured
 585  * for the driver.
 586  */
 587 void wpa_clear_keys(struct wpa_supplicant *wpa_s, const u8 *addr)
 588 {
 589         int i, max;
 590
 591 #ifdef CONFIG_IEEE80211W
 592         max = 6;
 593 #else /* CONFIG_IEEE80211W */
 594         max = 4;
 595 #endif /* CONFIG_IEEE80211W */
 596
 597         /* MLME-DELETEKEYS.request */
 598         for (i = 0; i < max; i++) {
 599                 if (wpa_s->keys_cleared & BIT(i))
 600                         continue;
 601                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, NULL, i, 0, NULL, 0,
 602                                 NULL, 0);
 603         }
 604         if (!(wpa_s->keys_cleared & BIT(0)) && addr &&
 605             !is_zero_ether_addr(addr)) {
 606                 wpa_drv_set_key(wpa_s, WPA_ALG_NONE, addr, 0, 0, NULL, 0, NULL,
 607                                 0);
 608                 /* MLME-SETPROTECTION.request(None) */
 609                 wpa_drv_mlme_setprotection(
 610                         wpa_s, addr,
 611                         MLME_SETPROTECTION_PROTECT_TYPE_NONE,
 612                         MLME_SETPROTECTION_KEY_TYPE_PAIRWISE);
 613         }
 614         wpa_s->keys_cleared = (u32) -1;
 615 }
 616
 617
 618 /**
 619  * wpa_supplicant_state_txt - Get the connection state name as a text string
 620  * @state: State (wpa_state; WPA_*)
 621  * Returns: The state name as a printable text string
 622  */
 623 const char * wpa_supplicant_state_txt(enum wpa_states state)
 624 {
 625         switch (state) {
 626         case WPA_DISCONNECTED:
 627                 return "DISCONNECTED";
 628         case WPA_INACTIVE:
 629                 return "INACTIVE";
 630         case WPA_INTERFACE_DISABLED:
 631                 return "INTERFACE_DISABLED";
 632         case WPA_SCANNING:
 633                 return "SCANNING";
 634         case WPA_AUTHENTICATING:
 635                 return "AUTHENTICATING";
 636         case WPA_ASSOCIATING:
 637                 return "ASSOCIATING";
 638         case WPA_ASSOCIATED:
 639                 return "ASSOCIATED";
 640         case WPA_4WAY_HANDSHAKE:
 641                 return "4WAY_HANDSHAKE";
 642         case WPA_GROUP_HANDSHAKE:
 643                 return "GROUP_HANDSHAKE";
 644         case WPA_COMPLETED:
 645                 return "COMPLETED";
 646         default:
 647                 return "UNKNOWN";
 648         }
 649 }
 650
 651
 652 #ifdef CONFIG_BGSCAN
 653
 654 static void wpa_supplicant_start_bgscan(struct wpa_supplicant *wpa_s)
 655 {
 656         const char *name;
 657
 658         if (wpa_s->current_ssid && wpa_s->current_ssid->bgscan)
 659                 name = wpa_s->current_ssid->bgscan;
 660         else
 661                 name = wpa_s->conf->bgscan;
 662         if (name == NULL || name[0] == '\0')
 663                 return;
 664         if (wpas_driver_bss_selection(wpa_s))
 665                 return;
 666         if (wpa_s->current_ssid == wpa_s->bgscan_ssid)
 667                 return;
 668 #ifdef CONFIG_P2P
 669         if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE)
 670                 return;
 671 #endif /* CONFIG_P2P */
 672
 673         bgscan_deinit(wpa_s);
 674         if (wpa_s->current_ssid) {
 675                 if (bgscan_init(wpa_s, wpa_s->current_ssid, name)) {
 676                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
 677                                 "bgscan");
 678                         /*
 679                          * Live without bgscan; it is only used as a roaming
 680                          * optimization, so the initial connection is not
 681                          * affected.
 682                          */
 683                 } else {
 684                         struct wpa_scan_results *scan_res;
 685                         wpa_s->bgscan_ssid = wpa_s->current_ssid;
 686                         scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL,
 687                                                                    0);
 688                         if (scan_res) {
 689                                 bgscan_notify_scan(wpa_s, scan_res);
 690                                 wpa_scan_results_free(scan_res);
 691                         }
 692                 }
 693         } else
 694                 wpa_s->bgscan_ssid = NULL;
 695 }
 696
 697
 698 static void wpa_supplicant_stop_bgscan(struct wpa_supplicant *wpa_s)
 699 {
 700         if (wpa_s->bgscan_ssid != NULL) {
 701                 bgscan_deinit(wpa_s);
 702                 wpa_s->bgscan_ssid = NULL;
 703         }
 704 }
 705
 706 #endif /* CONFIG_BGSCAN */
 707
 708
 709 static void wpa_supplicant_start_autoscan(struct wpa_supplicant *wpa_s)
 710 {
 711         if (autoscan_init(wpa_s, 0))
 712                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize autoscan");
 713 }
 714
 715
 716 static void wpa_supplicant_stop_autoscan(struct wpa_supplicant *wpa_s)
 717 {
 718         autoscan_deinit(wpa_s);
 719 }
 720
 721
 722 void wpa_supplicant_reinit_autoscan(struct wpa_supplicant *wpa_s)
 723 {
 724         if (wpa_s->wpa_state == WPA_DISCONNECTED ||
 725             wpa_s->wpa_state == WPA_SCANNING) {
 726                 autoscan_deinit(wpa_s);
 727                 wpa_supplicant_start_autoscan(wpa_s);
 728         }
 729 }
 730
 731
 732 /**
 733  * wpa_supplicant_set_state - Set current connection state
 734  * @wpa_s: Pointer to wpa_supplicant data
 735  * @state: The new connection state
 736  *
 737  * This function is called whenever the connection state changes, e.g.,
 738  * association is completed for WPA/WPA2 4-Way Handshake is started.
 739  */
 740 void wpa_supplicant_set_state(struct wpa_supplicant *wpa_s,
 741                               enum wpa_states state)
 742 {
 743         enum wpa_states old_state = wpa_s->wpa_state;
 744
 745         wpa_dbg(wpa_s, MSG_DEBUG, "State: %s -> %s",
 746                 wpa_supplicant_state_txt(wpa_s->wpa_state),
 747                 wpa_supplicant_state_txt(state));
 748
 749         if (state == WPA_INTERFACE_DISABLED) {
 750                 /* Assure normal scan when interface is restored */
 751                 wpa_s->normal_scans = 0;
 752         }
 753
 754         if (state == WPA_COMPLETED) {
 755                 wpas_connect_work_done(wpa_s);
 756                 /* Reinitialize normal_scan counter */
 757                 wpa_s->normal_scans = 0;
 758         }
 759
 760 #ifdef CONFIG_P2P
 761         /*
 762          * P2PS client has to reply to Probe Request frames received on the
 763          * group operating channel. Enable Probe Request frame reporting for
 764          * P2P connected client in case p2p_cli_probe configuration property is
 765          * set to 1.
 766          */
 767         if (wpa_s->conf->p2p_cli_probe && wpa_s->current_ssid &&
 768             wpa_s->current_ssid->mode == WPAS_MODE_INFRA &&
 769             wpa_s->current_ssid->p2p_group) {
 770                 if (state == WPA_COMPLETED && !wpa_s->p2p_cli_probe) {
 771                         wpa_dbg(wpa_s, MSG_DEBUG,
 772                                 "P2P: Enable CLI Probe Request RX reporting");
 773                         wpa_s->p2p_cli_probe =
 774                                 wpa_drv_probe_req_report(wpa_s, 1) >= 0;
 775                 } else if (state != WPA_COMPLETED && wpa_s->p2p_cli_probe) {
 776                         wpa_dbg(wpa_s, MSG_DEBUG,
 777                                 "P2P: Disable CLI Probe Request RX reporting");
 778                         wpa_s->p2p_cli_probe = 0;
 779                         wpa_drv_probe_req_report(wpa_s, 0);
 780                 }
 781         }
 782 #endif /* CONFIG_P2P */
 783
 784         if (state != WPA_SCANNING)
 785                 wpa_supplicant_notify_scanning(wpa_s, 0);
 786
 787         if (state == WPA_COMPLETED && wpa_s->new_connection) {
 788                 struct wpa_ssid *ssid = wpa_s->current_ssid;
 789 #if defined(CONFIG_CTRL_IFACE) || !defined(CONFIG_NO_STDOUT_DEBUG)
 790                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CONNECTED "- Connection to "
 791                         MACSTR " completed [id=%d id_str=%s]",
 792                         MAC2STR(wpa_s->bssid),
 793                         ssid ? ssid->id : -1,
 794                         ssid && ssid->id_str ? ssid->id_str : "");
 795 #endif /* CONFIG_CTRL_IFACE || !CONFIG_NO_STDOUT_DEBUG */
 796                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
 797                 wpa_blacklist_clear(wpa_s);
 798                 wpa_s->extra_blacklist_count = 0;
 799                 wpa_s->new_connection = 0;
 800                 wpa_drv_set_operstate(wpa_s, 1);
 801 #ifndef IEEE8021X_EAPOL
 802                 wpa_drv_set_supp_port(wpa_s, 1);
 803 #endif /* IEEE8021X_EAPOL */
 804                 wpa_s->after_wps = 0;
 805                 wpa_s->known_wps_freq = 0;
 806                 wpas_p2p_completed(wpa_s);
 807
 808                 sme_sched_obss_scan(wpa_s, 1);
 809         } else if (state == WPA_DISCONNECTED || state == WPA_ASSOCIATING ||
 810                    state == WPA_ASSOCIATED) {
 811                 wpa_s->new_connection = 1;
 812                 wpa_drv_set_operstate(wpa_s, 0);
 813 #ifndef IEEE8021X_EAPOL
 814                 wpa_drv_set_supp_port(wpa_s, 0);
 815 #endif /* IEEE8021X_EAPOL */
 816                 sme_sched_obss_scan(wpa_s, 0);
 817         }
 818         wpa_s->wpa_state = state;
 819
 820 #ifdef CONFIG_BGSCAN
 821         if (state == WPA_COMPLETED)
 822                 wpa_supplicant_start_bgscan(wpa_s);
 823         else if (state < WPA_ASSOCIATED)
 824                 wpa_supplicant_stop_bgscan(wpa_s);
 825 #endif /* CONFIG_BGSCAN */
 826
 827         if (state == WPA_AUTHENTICATING)
 828                 wpa_supplicant_stop_autoscan(wpa_s);
 829
 830         if (state == WPA_DISCONNECTED || state == WPA_INACTIVE)
 831                 wpa_supplicant_start_autoscan(wpa_s);
 832
 833         if (old_state >= WPA_ASSOCIATED && wpa_s->wpa_state < WPA_ASSOCIATED)
 834                 wmm_ac_notify_disassoc(wpa_s);
 835
 836         if (wpa_s->wpa_state != old_state) {
 837                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 838
 839                 /*
 840                  * Notify the P2P Device interface about a state change in one
 841                  * of the interfaces.
 842                  */
 843                 wpas_p2p_indicate_state_change(wpa_s);
 844
 845                 if (wpa_s->wpa_state == WPA_COMPLETED ||
 846                     old_state == WPA_COMPLETED)
 847                         wpas_notify_auth_changed(wpa_s);
 848         }
 849 }
 850
 851
 852 void wpa_supplicant_terminate_proc(struct wpa_global *global)
 853 {
 854         int pending = 0;
 855 #ifdef CONFIG_WPS
 856         struct wpa_supplicant *wpa_s = global->ifaces;
 857         while (wpa_s) {
 858                 struct wpa_supplicant *next = wpa_s->next;
 859                 if (wpas_wps_terminate_pending(wpa_s) == 1)
 860                         pending = 1;
 861 #ifdef CONFIG_P2P
 862                 if (wpa_s->p2p_group_interface != NOT_P2P_GROUP_INTERFACE ||
 863                     (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group))
 864                         wpas_p2p_disconnect(wpa_s);
 865 #endif /* CONFIG_P2P */
 866                 wpa_s = next;
 867         }
 868 #endif /* CONFIG_WPS */
 869         if (pending)
 870                 return;
 871         eloop_terminate();
 872 }
 873
 874
 875 static void wpa_supplicant_terminate(int sig, void *signal_ctx)
 876 {
 877         struct wpa_global *global = signal_ctx;
 878         wpa_supplicant_terminate_proc(global);
 879 }
 880
 881
 882 void wpa_supplicant_clear_status(struct wpa_supplicant *wpa_s)
 883 {
 884         enum wpa_states old_state = wpa_s->wpa_state;
 885
 886         wpa_s->pairwise_cipher = 0;
 887         wpa_s->group_cipher = 0;
 888         wpa_s->mgmt_group_cipher = 0;
 889         wpa_s->key_mgmt = 0;
 890         if (wpa_s->wpa_state != WPA_INTERFACE_DISABLED)
 891                 wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
 892
 893         if (wpa_s->wpa_state != old_state)
 894                 wpas_notify_state_changed(wpa_s, wpa_s->wpa_state, old_state);
 895 }
 896
 897
 898 /**
 899  * wpa_supplicant_reload_configuration - Reload configuration data
 900  * @wpa_s: Pointer to wpa_supplicant data
 901  * Returns: 0 on success or -1 if configuration parsing failed
 902  *
 903  * This function can be used to request that the configuration data is reloaded
 904  * (e.g., after configuration file change). This function is reloading
 905  * configuration only for one interface, so this may need to be called multiple
 906  * times if %wpa_supplicant is controlling multiple interfaces and all
 907  * interfaces need reconfiguration.
 908  */
 909 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 910 {
 911         struct wpa_config *conf;
 912         int reconf_ctrl;
 913         int old_ap_scan;
 914
 915         if (wpa_s->confname == NULL)
 916                 return -1;
 917         conf = wpa_config_read(wpa_s->confname, NULL);
 918         if (conf == NULL) {
 919                 wpa_msg(wpa_s, MSG_ERROR, "Failed to parse the configuration "
 920                         "file '%s' - exiting", wpa_s->confname);
 921                 return -1;
 922         }
 923         wpa_config_read(wpa_s->confanother, conf);
 924
 925         conf->changed_parameters = (unsigned int) -1;
 926
 927         reconf_ctrl = !!conf->ctrl_interface != !!wpa_s->conf->ctrl_interface
 928                 || (conf->ctrl_interface && wpa_s->conf->ctrl_interface &&
 929                     os_strcmp(conf->ctrl_interface,
 930                               wpa_s->conf->ctrl_interface) != 0);
 931
 932         if (reconf_ctrl && wpa_s->ctrl_iface) {
 933                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
 934                 wpa_s->ctrl_iface = NULL;
 935         }
 936
 937         eapol_sm_invalidate_cached_session(wpa_s->eapol);
 938         if (wpa_s->current_ssid) {
 939                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
 940                         wpa_s->own_disconnect_req = 1;
 941                 wpa_supplicant_deauthenticate(wpa_s,
 942                                               WLAN_REASON_DEAUTH_LEAVING);
 943         }
 944
 945         /*
 946          * TODO: should notify EAPOL SM about changes in opensc_engine_path,
 947          * pkcs11_engine_path, pkcs11_module_path, openssl_ciphers.
 948          */
 949         if (wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
 950                 /*
 951                  * Clear forced success to clear EAP state for next
 952                  * authentication.
 953                  */
 954                 eapol_sm_notify_eap_success(wpa_s->eapol, FALSE);
 955         }
 956         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
 957         wpa_sm_set_config(wpa_s->wpa, NULL);
 958         wpa_sm_pmksa_cache_flush(wpa_s->wpa, NULL);
 959         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
 960         rsn_preauth_deinit(wpa_s->wpa);
 961
 962         old_ap_scan = wpa_s->conf->ap_scan;
 963         wpa_config_free(wpa_s->conf);
 964         wpa_s->conf = conf;
 965         if (old_ap_scan != wpa_s->conf->ap_scan)
 966                 wpas_notify_ap_scan_changed(wpa_s);
 967
 968         if (reconf_ctrl)
 969                 wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
 970
 971         wpa_supplicant_update_config(wpa_s);
 972
 973         wpa_supplicant_clear_status(wpa_s);
 974         if (wpa_supplicant_enabled_networks(wpa_s)) {
 975                 wpa_s->reassociate = 1;
 976                 wpa_supplicant_req_scan(wpa_s, 0, 0);
 977         }
 978         wpa_dbg(wpa_s, MSG_DEBUG, "Reconfiguration completed");
 979         return 0;
 980 }
 981
 982
 983 static void wpa_supplicant_reconfig(int sig, void *signal_ctx)
 984 {
 985         struct wpa_global *global = signal_ctx;
 986         struct wpa_supplicant *wpa_s;
 987         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
 988                 wpa_dbg(wpa_s, MSG_DEBUG, "Signal %d received - reconfiguring",
 989                         sig);
 990                 if (wpa_supplicant_reload_configuration(wpa_s) < 0) {
 991                         wpa_supplicant_terminate_proc(global);
 992                 }
 993         }
 994
 995         if (wpa_debug_reopen_file() < 0) {
 996                 /* Ignore errors since we cannot really do much to fix this */
 997                 wpa_printf(MSG_DEBUG, "Could not reopen debug log file");
 998         }
 999 }
1000
1001
1002 static int wpa_supplicant_suites_from_ai(struct wpa_supplicant *wpa_s,
1003                                          struct wpa_ssid *ssid,
1004                                          struct wpa_ie_data *ie)
1005 {
1006         int ret = wpa_sm_parse_own_wpa_ie(wpa_s->wpa, ie);
1007         if (ret) {
1008                 if (ret == -2) {
1009                         wpa_msg(wpa_s, MSG_INFO, "WPA: Failed to parse WPA IE "
1010                                 "from association info");
1011                 }
1012                 return -1;
1013         }
1014
1015         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Using WPA IE from AssocReq to set "
1016                 "cipher suites");
1017         if (!(ie->group_cipher & ssid->group_cipher)) {
1018                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled group "
1019                         "cipher 0x%x (mask 0x%x) - reject",
1020                         ie->group_cipher, ssid->group_cipher);
1021                 return -1;
1022         }
1023         if (!(ie->pairwise_cipher & ssid->pairwise_cipher)) {
1024                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled pairwise "
1025                         "cipher 0x%x (mask 0x%x) - reject",
1026                         ie->pairwise_cipher, ssid->pairwise_cipher);
1027                 return -1;
1028         }
1029         if (!(ie->key_mgmt & ssid->key_mgmt)) {
1030                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver used disabled key "
1031                         "management 0x%x (mask 0x%x) - reject",
1032                         ie->key_mgmt, ssid->key_mgmt);
1033                 return -1;
1034         }
1035
1036 #ifdef CONFIG_IEEE80211W
1037         if (!(ie->capabilities & WPA_CAPABILITY_MFPC) &&
1038             wpas_get_ssid_pmf(wpa_s, ssid) == MGMT_FRAME_PROTECTION_REQUIRED) {
1039                 wpa_msg(wpa_s, MSG_INFO, "WPA: Driver associated with an AP "
1040                         "that does not support management frame protection - "
1041                         "reject");
1042                 return -1;
1043         }
1044 #endif /* CONFIG_IEEE80211W */
1045
1046         return 0;
1047 }
1048
1049
1050 /**
1051  * wpa_supplicant_set_suites - Set authentication and encryption parameters
1052  * @wpa_s: Pointer to wpa_supplicant data
1053  * @bss: Scan results for the selected BSS, or %NULL if not available
1054  * @ssid: Configuration data for the selected network
1055  * @wpa_ie: Buffer for the WPA/RSN IE
1056  * @wpa_ie_len: Maximum wpa_ie buffer size on input. This is changed to be the
1057  * used buffer length in case the functions returns success.
1058  * Returns: 0 on success or -1 on failure
1059  *
1060  * This function is used to configure authentication and encryption parameters
1061  * based on the network configuration and scan result for the selected BSS (if
1062  * available).
1063  */
1064 int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
1065                               struct wpa_bss *bss, struct wpa_ssid *ssid,
1066                               u8 *wpa_ie, size_t *wpa_ie_len)
1067 {
1068         struct wpa_ie_data ie;
1069         int sel, proto;
1070         const u8 *bss_wpa, *bss_rsn, *bss_osen;
1071
1072         if (bss) {
1073                 bss_wpa = wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE);
1074                 bss_rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
1075                 bss_osen = wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE);
1076         } else
1077                 bss_wpa = bss_rsn = bss_osen = NULL;
1078
1079         if (bss_rsn && (ssid->proto & WPA_PROTO_RSN) &&
1080             wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie) == 0 &&
1081             (ie.group_cipher & ssid->group_cipher) &&
1082             (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1083             (ie.key_mgmt & ssid->key_mgmt)) {
1084                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using IEEE 802.11i/D9.0");
1085                 proto = WPA_PROTO_RSN;
1086         } else if (bss_wpa && (ssid->proto & WPA_PROTO_WPA) &&
1087                    wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie) == 0 &&
1088                    (ie.group_cipher & ssid->group_cipher) &&
1089                    (ie.pairwise_cipher & ssid->pairwise_cipher) &&
1090                    (ie.key_mgmt & ssid->key_mgmt)) {
1091                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using IEEE 802.11i/D3.0");
1092                 proto = WPA_PROTO_WPA;
1093 #ifdef CONFIG_HS20
1094         } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
1095                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
1096                 /* TODO: parse OSEN element */
1097                 os_memset(&ie, 0, sizeof(ie));
1098                 ie.group_cipher = WPA_CIPHER_CCMP;
1099                 ie.pairwise_cipher = WPA_CIPHER_CCMP;
1100                 ie.key_mgmt = WPA_KEY_MGMT_OSEN;
1101                 proto = WPA_PROTO_OSEN;
1102 #endif /* CONFIG_HS20 */
1103         } else if (bss) {
1104                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select WPA/RSN");
1105                 wpa_dbg(wpa_s, MSG_DEBUG,
1106                         "WPA: ssid proto=0x%x pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1107                         ssid->proto, ssid->pairwise_cipher, ssid->group_cipher,
1108                         ssid->key_mgmt);
1109                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: BSS " MACSTR " ssid='%s'%s%s%s",
1110                         MAC2STR(bss->bssid),
1111                         wpa_ssid_txt(bss->ssid, bss->ssid_len),
1112                         bss_wpa ? " WPA" : "",
1113                         bss_rsn ? " RSN" : "",
1114                         bss_osen ? " OSEN" : "");
1115                 if (bss_rsn) {
1116                         wpa_hexdump(MSG_DEBUG, "RSN", bss_rsn, 2 + bss_rsn[1]);
1117                         if (wpa_parse_wpa_ie(bss_rsn, 2 + bss_rsn[1], &ie)) {
1118                                 wpa_dbg(wpa_s, MSG_DEBUG,
1119                                         "Could not parse RSN element");
1120                         } else {
1121                                 wpa_dbg(wpa_s, MSG_DEBUG,
1122                                         "RSN: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1123                                         ie.pairwise_cipher, ie.group_cipher,
1124                                         ie.key_mgmt);
1125                         }
1126                 }
1127                 if (bss_wpa) {
1128                         wpa_hexdump(MSG_DEBUG, "WPA", bss_wpa, 2 + bss_wpa[1]);
1129                         if (wpa_parse_wpa_ie(bss_wpa, 2 + bss_wpa[1], &ie)) {
1130                                 wpa_dbg(wpa_s, MSG_DEBUG,
1131                                         "Could not parse WPA element");
1132                         } else {
1133                                 wpa_dbg(wpa_s, MSG_DEBUG,
1134                                         "WPA: pairwise_cipher=0x%x group_cipher=0x%x key_mgmt=0x%x",
1135                                         ie.pairwise_cipher, ie.group_cipher,
1136                                         ie.key_mgmt);
1137                         }
1138                 }
1139                 return -1;
1140         } else {
1141                 if (ssid->proto & WPA_PROTO_OSEN)
1142                         proto = WPA_PROTO_OSEN;
1143                 else if (ssid->proto & WPA_PROTO_RSN)
1144                         proto = WPA_PROTO_RSN;
1145                 else
1146                         proto = WPA_PROTO_WPA;
1147                 if (wpa_supplicant_suites_from_ai(wpa_s, ssid, &ie) < 0) {
1148                         os_memset(&ie, 0, sizeof(ie));
1149                         ie.group_cipher = ssid->group_cipher;
1150                         ie.pairwise_cipher = ssid->pairwise_cipher;
1151                         ie.key_mgmt = ssid->key_mgmt;
1152 #ifdef CONFIG_IEEE80211W
1153                         ie.mgmt_group_cipher =
1154                                 ssid->ieee80211w != NO_MGMT_FRAME_PROTECTION ?
1155                                 WPA_CIPHER_AES_128_CMAC : 0;
1156 #endif /* CONFIG_IEEE80211W */
1157                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Set cipher suites "
1158                                 "based on configuration");
1159                 } else
1160                         proto = ie.proto;
1161         }
1162
1163         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected cipher suites: group %d "
1164                 "pairwise %d key_mgmt %d proto %d",
1165                 ie.group_cipher, ie.pairwise_cipher, ie.key_mgmt, proto);
1166 #ifdef CONFIG_IEEE80211W
1167         if (ssid->ieee80211w) {
1168                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected mgmt group cipher %d",
1169                         ie.mgmt_group_cipher);
1170         }
1171 #endif /* CONFIG_IEEE80211W */
1172
1173         wpa_s->wpa_proto = proto;
1174         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, proto);
1175         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_RSN_ENABLED,
1176                          !!(ssid->proto & (WPA_PROTO_RSN | WPA_PROTO_OSEN)));
1177
1178         if (bss || !wpa_s->ap_ies_from_associnfo) {
1179                 if (wpa_sm_set_ap_wpa_ie(wpa_s->wpa, bss_wpa,
1180                                          bss_wpa ? 2 + bss_wpa[1] : 0) ||
1181                     wpa_sm_set_ap_rsn_ie(wpa_s->wpa, bss_rsn,
1182                                          bss_rsn ? 2 + bss_rsn[1] : 0))
1183                         return -1;
1184         }
1185
1186 #ifdef CONFIG_NO_WPA
1187         wpa_s->group_cipher = WPA_CIPHER_NONE;
1188         wpa_s->pairwise_cipher = WPA_CIPHER_NONE;
1189 #else /* CONFIG_NO_WPA */
1190         sel = ie.group_cipher & ssid->group_cipher;
1191         wpa_s->group_cipher = wpa_pick_group_cipher(sel);
1192         if (wpa_s->group_cipher < 0) {
1193                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select group "
1194                         "cipher");
1195                 return -1;
1196         }
1197         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using GTK %s",
1198                 wpa_cipher_txt(wpa_s->group_cipher));
1199
1200         sel = ie.pairwise_cipher & ssid->pairwise_cipher;
1201         wpa_s->pairwise_cipher = wpa_pick_pairwise_cipher(sel, 1);
1202         if (wpa_s->pairwise_cipher < 0) {
1203                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select pairwise "
1204                         "cipher");
1205                 return -1;
1206         }
1207         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using PTK %s",
1208                 wpa_cipher_txt(wpa_s->pairwise_cipher));
1209 #endif /* CONFIG_NO_WPA */
1210
1211         sel = ie.key_mgmt & ssid->key_mgmt;
1212 #ifdef CONFIG_SAE
1213         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
1214                 sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
1215 #endif /* CONFIG_SAE */
1216         if (0) {
1217 #ifdef CONFIG_SUITEB192
1218         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
1219                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
1220                 wpa_dbg(wpa_s, MSG_DEBUG,
1221                         "WPA: using KEY_MGMT 802.1X with Suite B (192-bit)");
1222 #endif /* CONFIG_SUITEB192 */
1223 #ifdef CONFIG_SUITEB
1224         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
1225                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SUITE_B;
1226                 wpa_dbg(wpa_s, MSG_DEBUG,
1227                         "WPA: using KEY_MGMT 802.1X with Suite B");
1228 #endif /* CONFIG_SUITEB */
1229 #ifdef CONFIG_IEEE80211R
1230         } else if (sel & WPA_KEY_MGMT_FT_IEEE8021X) {
1231                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_IEEE8021X;
1232                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/802.1X");
1233         } else if (sel & WPA_KEY_MGMT_FT_PSK) {
1234                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_PSK;
1235                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT FT/PSK");
1236 #endif /* CONFIG_IEEE80211R */
1237 #ifdef CONFIG_SAE
1238         } else if (sel & WPA_KEY_MGMT_SAE) {
1239                 wpa_s->key_mgmt = WPA_KEY_MGMT_SAE;
1240                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT SAE");
1241         } else if (sel & WPA_KEY_MGMT_FT_SAE) {
1242                 wpa_s->key_mgmt = WPA_KEY_MGMT_FT_SAE;
1243                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: using KEY_MGMT FT/SAE");
1244 #endif /* CONFIG_SAE */
1245 #ifdef CONFIG_IEEE80211W
1246         } else if (sel & WPA_KEY_MGMT_IEEE8021X_SHA256) {
1247                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X_SHA256;
1248                 wpa_dbg(wpa_s, MSG_DEBUG,
1249                         "WPA: using KEY_MGMT 802.1X with SHA256");
1250         } else if (sel & WPA_KEY_MGMT_PSK_SHA256) {
1251                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK_SHA256;
1252                 wpa_dbg(wpa_s, MSG_DEBUG,
1253                         "WPA: using KEY_MGMT PSK with SHA256");
1254 #endif /* CONFIG_IEEE80211W */
1255         } else if (sel & WPA_KEY_MGMT_IEEE8021X) {
1256                 wpa_s->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
1257                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT 802.1X");
1258         } else if (sel & WPA_KEY_MGMT_PSK) {
1259                 wpa_s->key_mgmt = WPA_KEY_MGMT_PSK;
1260                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-PSK");
1261         } else if (sel & WPA_KEY_MGMT_WPA_NONE) {
1262                 wpa_s->key_mgmt = WPA_KEY_MGMT_WPA_NONE;
1263                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using KEY_MGMT WPA-NONE");
1264 #ifdef CONFIG_HS20
1265         } else if (sel & WPA_KEY_MGMT_OSEN) {
1266                 wpa_s->key_mgmt = WPA_KEY_MGMT_OSEN;
1267                 wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using KEY_MGMT OSEN");
1268 #endif /* CONFIG_HS20 */
1269         } else {
1270                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to select "
1271                         "authenticated key management type");
1272                 return -1;
1273         }
1274
1275         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_KEY_MGMT, wpa_s->key_mgmt);
1276         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PAIRWISE,
1277                          wpa_s->pairwise_cipher);
1278         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_GROUP, wpa_s->group_cipher);
1279
1280 #ifdef CONFIG_IEEE80211W
1281         sel = ie.mgmt_group_cipher;
1282         if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION ||
1283             !(ie.capabilities & WPA_CAPABILITY_MFPC))
1284                 sel = 0;
1285         if (sel & WPA_CIPHER_AES_128_CMAC) {
1286                 wpa_s->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
1287                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1288                         "AES-128-CMAC");
1289         } else if (sel & WPA_CIPHER_BIP_GMAC_128) {
1290                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_128;
1291                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1292                         "BIP-GMAC-128");
1293         } else if (sel & WPA_CIPHER_BIP_GMAC_256) {
1294                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_GMAC_256;
1295                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1296                         "BIP-GMAC-256");
1297         } else if (sel & WPA_CIPHER_BIP_CMAC_256) {
1298                 wpa_s->mgmt_group_cipher = WPA_CIPHER_BIP_CMAC_256;
1299                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: using MGMT group cipher "
1300                         "BIP-CMAC-256");
1301         } else {
1302                 wpa_s->mgmt_group_cipher = 0;
1303                 wpa_dbg(wpa_s, MSG_DEBUG, "WPA: not using MGMT group cipher");
1304         }
1305         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MGMT_GROUP,
1306                          wpa_s->mgmt_group_cipher);
1307         wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_MFP,
1308                          wpas_get_ssid_pmf(wpa_s, ssid));
1309 #endif /* CONFIG_IEEE80211W */
1310
1311         if (wpa_sm_set_assoc_wpa_ie_default(wpa_s->wpa, wpa_ie, wpa_ie_len)) {
1312                 wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to generate WPA IE");
1313                 return -1;
1314         }
1315
1316         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt)) {
1317                 int psk_set = 0;
1318
1319                 if (ssid->psk_set) {
1320                         wpa_sm_set_pmk(wpa_s->wpa, ssid->psk, PMK_LEN, NULL,
1321                                        NULL);
1322                         psk_set = 1;
1323                 }
1324 #ifndef CONFIG_NO_PBKDF2
1325                 if (bss && ssid->bssid_set && ssid->ssid_len == 0 &&
1326                     ssid->passphrase) {
1327                         u8 psk[PMK_LEN];
1328                         pbkdf2_sha1(ssid->passphrase, bss->ssid, bss->ssid_len,
1329                                     4096, psk, PMK_LEN);
1330                         wpa_hexdump_key(MSG_MSGDUMP, "PSK (from passphrase)",
1331                                         psk, PMK_LEN);
1332                         wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL, NULL);
1333                         psk_set = 1;
1334                         os_memset(psk, 0, sizeof(psk));
1335                 }
1336 #endif /* CONFIG_NO_PBKDF2 */
1337 #ifdef CONFIG_EXT_PASSWORD
1338                 if (ssid->ext_psk) {
1339                         struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
1340                                                              ssid->ext_psk);
1341                         char pw_str[64 + 1];
1342                         u8 psk[PMK_LEN];
1343
1344                         if (pw == NULL) {
1345                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No PSK "
1346                                         "found from external storage");
1347                                 return -1;
1348                         }
1349
1350                         if (wpabuf_len(pw) < 8 || wpabuf_len(pw) > 64) {
1351                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: Unexpected "
1352                                         "PSK length %d in external storage",
1353                                         (int) wpabuf_len(pw));
1354                                 ext_password_free(pw);
1355                                 return -1;
1356                         }
1357
1358                         os_memcpy(pw_str, wpabuf_head(pw), wpabuf_len(pw));
1359                         pw_str[wpabuf_len(pw)] = '\0';
1360
1361 #ifndef CONFIG_NO_PBKDF2
1362                         if (wpabuf_len(pw) >= 8 && wpabuf_len(pw) < 64 && bss)
1363                         {
1364                                 pbkdf2_sha1(pw_str, bss->ssid, bss->ssid_len,
1365                                             4096, psk, PMK_LEN);
1366                                 os_memset(pw_str, 0, sizeof(pw_str));
1367                                 wpa_hexdump_key(MSG_MSGDUMP, "PSK (from "
1368                                                 "external passphrase)",
1369                                                 psk, PMK_LEN);
1370                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1371                                                NULL);
1372                                 psk_set = 1;
1373                                 os_memset(psk, 0, sizeof(psk));
1374                         } else
1375 #endif /* CONFIG_NO_PBKDF2 */
1376                         if (wpabuf_len(pw) == 2 * PMK_LEN) {
1377                                 if (hexstr2bin(pw_str, psk, PMK_LEN) < 0) {
1378                                         wpa_msg(wpa_s, MSG_INFO, "EXT PW: "
1379                                                 "Invalid PSK hex string");
1380                                         os_memset(pw_str, 0, sizeof(pw_str));
1381                                         ext_password_free(pw);
1382                                         return -1;
1383                                 }
1384                                 wpa_sm_set_pmk(wpa_s->wpa, psk, PMK_LEN, NULL,
1385                                                NULL);
1386                                 psk_set = 1;
1387                                 os_memset(psk, 0, sizeof(psk));
1388                         } else {
1389                                 wpa_msg(wpa_s, MSG_INFO, "EXT PW: No suitable "
1390                                         "PSK available");
1391                                 os_memset(pw_str, 0, sizeof(pw_str));
1392                                 ext_password_free(pw);
1393                                 return -1;
1394                         }
1395
1396                         os_memset(pw_str, 0, sizeof(pw_str));
1397                         ext_password_free(pw);
1398                 }
1399 #endif /* CONFIG_EXT_PASSWORD */
1400
1401                 if (!psk_set) {
1402                         wpa_msg(wpa_s, MSG_INFO,
1403                                 "No PSK available for association");
1404                         return -1;
1405                 }
1406         } else
1407                 wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
1408
1409         return 0;
1410 }
1411
1412
1413 static void wpas_ext_capab_byte(struct wpa_supplicant *wpa_s, u8 *pos, int idx)
1414 {
1415         *pos = 0x00;
1416
1417         switch (idx) {
1418         case 0: /* Bits 0-7 */
1419                 break;
1420         case 1: /* Bits 8-15 */
1421                 break;
1422         case 2: /* Bits 16-23 */
1423 #ifdef CONFIG_WNM
1424                 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
1425                 *pos |= 0x08; /* Bit 19 - BSS Transition */
1426 #endif /* CONFIG_WNM */
1427                 break;
1428         case 3: /* Bits 24-31 */
1429 #ifdef CONFIG_WNM
1430                 *pos |= 0x02; /* Bit 25 - SSID List */
1431 #endif /* CONFIG_WNM */
1432 #ifdef CONFIG_INTERWORKING
1433                 if (wpa_s->conf->interworking)
1434                         *pos |= 0x80; /* Bit 31 - Interworking */
1435 #endif /* CONFIG_INTERWORKING */
1436                 break;
1437         case 4: /* Bits 32-39 */
1438 #ifdef CONFIG_INTERWORKING
1439                 if (wpa_s->drv_flags / WPA_DRIVER_FLAGS_QOS_MAPPING)
1440                         *pos |= 0x01; /* Bit 32 - QoS Map */
1441 #endif /* CONFIG_INTERWORKING */
1442                 break;
1443         case 5: /* Bits 40-47 */
1444 #ifdef CONFIG_HS20
1445                 if (wpa_s->conf->hs20)
1446                         *pos |= 0x40; /* Bit 46 - WNM-Notification */
1447 #endif /* CONFIG_HS20 */
1448 #ifdef CONFIG_MBO
1449                 *pos |= 0x40; /* Bit 46 - WNM-Notification */
1450 #endif /* CONFIG_MBO */
1451                 break;
1452         case 6: /* Bits 48-55 */
1453                 break;
1454         }
1455 }
1456
1457
1458 int wpas_build_ext_capab(struct wpa_supplicant *wpa_s, u8 *buf, size_t buflen)
1459 {
1460         u8 *pos = buf;
1461         u8 len = 6, i;
1462
1463         if (len < wpa_s->extended_capa_len)
1464                 len = wpa_s->extended_capa_len;
1465         if (buflen < (size_t) len + 2) {
1466                 wpa_printf(MSG_INFO,
1467                            "Not enough room for building extended capabilities element");
1468                 return -1;
1469         }
1470
1471         *pos++ = WLAN_EID_EXT_CAPAB;
1472         *pos++ = len;
1473         for (i = 0; i < len; i++, pos++) {
1474                 wpas_ext_capab_byte(wpa_s, pos, i);
1475
1476                 if (i < wpa_s->extended_capa_len) {
1477                         *pos &= ~wpa_s->extended_capa_mask[i];
1478                         *pos |= wpa_s->extended_capa[i];
1479                 }
1480         }
1481
1482         while (len > 0 && buf[1 + len] == 0) {
1483                 len--;
1484                 buf[1] = len;
1485         }
1486         if (len == 0)
1487                 return 0;
1488
1489         return 2 + len;
1490 }
1491
1492
1493 static int wpas_valid_bss(struct wpa_supplicant *wpa_s,
1494                           struct wpa_bss *test_bss)
1495 {
1496         struct wpa_bss *bss;
1497
1498         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
1499                 if (bss == test_bss)
1500                         return 1;
1501         }
1502
1503         return 0;
1504 }
1505
1506
1507 static int wpas_valid_ssid(struct wpa_supplicant *wpa_s,
1508                            struct wpa_ssid *test_ssid)
1509 {
1510         struct wpa_ssid *ssid;
1511
1512         for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
1513                 if (ssid == test_ssid)
1514                         return 1;
1515         }
1516
1517         return 0;
1518 }
1519
1520
1521 int wpas_valid_bss_ssid(struct wpa_supplicant *wpa_s, struct wpa_bss *test_bss,
1522                         struct wpa_ssid *test_ssid)
1523 {
1524         if (test_bss && !wpas_valid_bss(wpa_s, test_bss))
1525                 return 0;
1526
1527         return test_ssid == NULL || wpas_valid_ssid(wpa_s, test_ssid);
1528 }
1529
1530
1531 void wpas_connect_work_free(struct wpa_connect_work *cwork)
1532 {
1533         if (cwork == NULL)
1534                 return;
1535         os_free(cwork);
1536 }
1537
1538
1539 void wpas_connect_work_done(struct wpa_supplicant *wpa_s)
1540 {
1541         struct wpa_connect_work *cwork;
1542         struct wpa_radio_work *work = wpa_s->connect_work;
1543
1544         if (!work)
1545                 return;
1546
1547         wpa_s->connect_work = NULL;
1548         cwork = work->ctx;
1549         work->ctx = NULL;
1550         wpas_connect_work_free(cwork);
1551         radio_work_done(work);
1552 }
1553
1554
1555 int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style)
1556 {
1557         struct os_reltime now;
1558         u8 addr[ETH_ALEN];
1559
1560         os_get_reltime(&now);
1561         if (wpa_s->last_mac_addr_style == style &&
1562             wpa_s->last_mac_addr_change.sec != 0 &&
1563             !os_reltime_expired(&now, &wpa_s->last_mac_addr_change,
1564                                 wpa_s->conf->rand_addr_lifetime)) {
1565                 wpa_msg(wpa_s, MSG_DEBUG,
1566                         "Previously selected random MAC address has not yet expired");
1567                 return 0;
1568         }
1569
1570         switch (style) {
1571         case 1:
1572                 if (random_mac_addr(addr) < 0)
1573                         return -1;
1574                 break;
1575         case 2:
1576                 os_memcpy(addr, wpa_s->perm_addr, ETH_ALEN);
1577                 if (random_mac_addr_keep_oui(addr) < 0)
1578                         return -1;
1579                 break;
1580         default:
1581                 return -1;
1582         }
1583
1584         if (wpa_drv_set_mac_addr(wpa_s, addr) < 0) {
1585                 wpa_msg(wpa_s, MSG_INFO,
1586                         "Failed to set random MAC address");
1587                 return -1;
1588         }
1589
1590         os_get_reltime(&wpa_s->last_mac_addr_change);
1591         wpa_s->mac_addr_changed = 1;
1592         wpa_s->last_mac_addr_style = style;
1593
1594         if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1595                 wpa_msg(wpa_s, MSG_INFO,
1596                         "Could not update MAC address information");
1597                 return -1;
1598         }
1599
1600         wpa_msg(wpa_s, MSG_DEBUG, "Using random MAC address " MACSTR,
1601                 MAC2STR(addr));
1602
1603         return 0;
1604 }
1605
1606
1607 int wpas_update_random_addr_disassoc(struct wpa_supplicant *wpa_s)
1608 {
1609         if (wpa_s->wpa_state >= WPA_AUTHENTICATING ||
1610             !wpa_s->conf->preassoc_mac_addr)
1611                 return 0;
1612
1613         return wpas_update_random_addr(wpa_s, wpa_s->conf->preassoc_mac_addr);
1614 }
1615
1616
1617 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit);
1618
1619 /**
1620  * wpa_supplicant_associate - Request association
1621  * @wpa_s: Pointer to wpa_supplicant data
1622  * @bss: Scan results for the selected BSS, or %NULL if not available
1623  * @ssid: Configuration data for the selected network
1624  *
1625  * This function is used to request %wpa_supplicant to associate with a BSS.
1626  */
1627 void wpa_supplicant_associate(struct wpa_supplicant *wpa_s,
1628                               struct wpa_bss *bss, struct wpa_ssid *ssid)
1629 {
1630         struct wpa_connect_work *cwork;
1631         int rand_style;
1632
1633         wpa_s->own_disconnect_req = 0;
1634
1635         /*
1636          * If we are starting a new connection, any previously pending EAPOL
1637          * RX cannot be valid anymore.
1638          */
1639         wpabuf_free(wpa_s->pending_eapol_rx);
1640         wpa_s->pending_eapol_rx = NULL;
1641
1642         if (ssid->mac_addr == -1)
1643                 rand_style = wpa_s->conf->mac_addr;
1644         else
1645                 rand_style = ssid->mac_addr;
1646
1647         wmm_ac_clear_saved_tspecs(wpa_s);
1648         wpa_s->reassoc_same_bss = 0;
1649
1650         if (wpa_s->last_ssid == ssid) {
1651                 wpa_dbg(wpa_s, MSG_DEBUG, "Re-association to the same ESS");
1652                 if (wpa_s->current_bss && wpa_s->current_bss == bss) {
1653                         wmm_ac_save_tspecs(wpa_s);
1654                         wpa_s->reassoc_same_bss = 1;
1655                 }
1656         } else if (rand_style > 0) {
1657                 if (wpas_update_random_addr(wpa_s, rand_style) < 0)
1658                         return;
1659                 wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);
1660         } else if (wpa_s->mac_addr_changed) {
1661                 if (wpa_drv_set_mac_addr(wpa_s, NULL) < 0) {
1662                         wpa_msg(wpa_s, MSG_INFO,
1663                                 "Could not restore permanent MAC address");
1664                         return;
1665                 }
1666                 wpa_s->mac_addr_changed = 0;
1667                 if (wpa_supplicant_update_mac_addr(wpa_s) < 0) {
1668                         wpa_msg(wpa_s, MSG_INFO,
1669                                 "Could not update MAC address information");
1670                         return;
1671                 }
1672                 wpa_msg(wpa_s, MSG_DEBUG, "Using permanent MAC address");
1673         }
1674         wpa_s->last_ssid = ssid;
1675
1676 #ifdef CONFIG_IBSS_RSN
1677         ibss_rsn_deinit(wpa_s->ibss_rsn);
1678         wpa_s->ibss_rsn = NULL;
1679 #endif /* CONFIG_IBSS_RSN */
1680
1681         if (ssid->mode == WPAS_MODE_AP || ssid->mode == WPAS_MODE_P2P_GO ||
1682             ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION) {
1683 #ifdef CONFIG_AP
1684                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_AP)) {
1685                         wpa_msg(wpa_s, MSG_INFO, "Driver does not support AP "
1686                                 "mode");
1687                         return;
1688                 }
1689                 if (wpa_supplicant_create_ap(wpa_s, ssid) < 0) {
1690                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
1691                         if (ssid->mode == WPAS_MODE_P2P_GROUP_FORMATION)
1692                                 wpas_p2p_ap_setup_failed(wpa_s);
1693                         return;
1694                 }
1695                 wpa_s->current_bss = bss;
1696 #else /* CONFIG_AP */
1697                 wpa_msg(wpa_s, MSG_ERROR, "AP mode support not included in "
1698                         "the build");
1699 #endif /* CONFIG_AP */
1700                 return;
1701         }
1702
1703         if (ssid->mode == WPAS_MODE_MESH) {
1704 #ifdef CONFIG_MESH
1705                 if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_MESH)) {
1706                         wpa_msg(wpa_s, MSG_INFO,
1707                                 "Driver does not support mesh mode");
1708                         return;
1709                 }
1710                 if (bss)
1711                         ssid->frequency = bss->freq;
1712                 if (wpa_supplicant_join_mesh(wpa_s, ssid) < 0) {
1713                         wpa_msg(wpa_s, MSG_ERROR, "Could not join mesh");
1714                         return;
1715                 }
1716                 wpa_s->current_bss = bss;
1717                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_STARTED "ssid=\"%s\" id=%d",
1718                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
1719                         ssid->id);
1720 #else /* CONFIG_MESH */
1721                 wpa_msg(wpa_s, MSG_ERROR,
1722                         "mesh mode support not included in the build");
1723 #endif /* CONFIG_MESH */
1724                 return;
1725         }
1726
1727 #ifdef CONFIG_TDLS
1728         if (bss)
1729                 wpa_tdls_ap_ies(wpa_s->wpa, (const u8 *) (bss + 1),
1730                                 bss->ie_len);
1731 #endif /* CONFIG_TDLS */
1732
1733         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) &&
1734             ssid->mode == IEEE80211_MODE_INFRA) {
1735                 sme_authenticate(wpa_s, bss, ssid);
1736                 return;
1737         }
1738
1739         if (wpa_s->connect_work) {
1740                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since connect_work exist");
1741                 return;
1742         }
1743
1744         if (radio_work_pending(wpa_s, "connect")) {
1745                 wpa_dbg(wpa_s, MSG_DEBUG, "Reject wpa_supplicant_associate() call since pending work exist");
1746                 return;
1747         }
1748
1749         wpas_abort_ongoing_scan(wpa_s);
1750
1751         cwork = os_zalloc(sizeof(*cwork));
1752         if (cwork == NULL)
1753                 return;
1754
1755         cwork->bss = bss;
1756         cwork->ssid = ssid;
1757
1758         if (radio_add_work(wpa_s, bss ? bss->freq : 0, "connect", 1,
1759                            wpas_start_assoc_cb, cwork) < 0) {
1760                 os_free(cwork);
1761         }
1762 }
1763
1764
1765 static int bss_is_ibss(struct wpa_bss *bss)
1766 {
1767         return (bss->caps & (IEEE80211_CAP_ESS | IEEE80211_CAP_IBSS)) ==
1768                 IEEE80211_CAP_IBSS;
1769 }
1770
1771
1772 static int drv_supports_vht(struct wpa_supplicant *wpa_s,
1773                             const struct wpa_ssid *ssid)
1774 {
1775         enum hostapd_hw_mode hw_mode;
1776         struct hostapd_hw_modes *mode = NULL;
1777         u8 channel;
1778         int i;
1779
1780 #ifdef CONFIG_HT_OVERRIDES
1781         if (ssid->disable_ht)
1782                 return 0;
1783 #endif /* CONFIG_HT_OVERRIDES */
1784
1785         hw_mode = ieee80211_freq_to_chan(ssid->frequency, &channel);
1786         if (hw_mode == NUM_HOSTAPD_MODES)
1787                 return 0;
1788         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1789                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1790                         mode = &wpa_s->hw.modes[i];
1791                         break;
1792                 }
1793         }
1794
1795         if (!mode)
1796                 return 0;
1797
1798         return mode->vht_capab != 0;
1799 }
1800
1801
1802 void ibss_mesh_setup_freq(struct wpa_supplicant *wpa_s,
1803                           const struct wpa_ssid *ssid,
1804                           struct hostapd_freq_params *freq)
1805 {
1806         enum hostapd_hw_mode hw_mode;
1807         struct hostapd_hw_modes *mode = NULL;
1808         int ht40plus[] = { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157,
1809                            184, 192 };
1810         int vht80[] = { 36, 52, 100, 116, 132, 149 };
1811         struct hostapd_channel_data *pri_chan = NULL, *sec_chan = NULL;
1812         u8 channel;
1813         int i, chan_idx, ht40 = -1, res, obss_scan = 1;
1814         unsigned int j, k;
1815         struct hostapd_freq_params vht_freq;
1816         int chwidth, seg0, seg1;
1817         u32 vht_caps = 0;
1818
1819         freq->freq = ssid->frequency;
1820
1821         for (j = 0; j < wpa_s->last_scan_res_used; j++) {
1822                 struct wpa_bss *bss = wpa_s->last_scan_res[j];
1823
1824                 if (ssid->mode != WPAS_MODE_IBSS)
1825                         break;
1826
1827                 /* Don't adjust control freq in case of fixed_freq */
1828                 if (ssid->fixed_freq)
1829                         break;
1830
1831                 if (!bss_is_ibss(bss))
1832                         continue;
1833
1834                 if (ssid->ssid_len == bss->ssid_len &&
1835                     os_memcmp(ssid->ssid, bss->ssid, bss->ssid_len) == 0) {
1836                         wpa_printf(MSG_DEBUG,
1837                                    "IBSS already found in scan results, adjust control freq: %d",
1838                                    bss->freq);
1839                         freq->freq = bss->freq;
1840                         obss_scan = 0;
1841                         break;
1842                 }
1843         }
1844
1845         /* For IBSS check HT_IBSS flag */
1846         if (ssid->mode == WPAS_MODE_IBSS &&
1847             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_HT_IBSS))
1848                 return;
1849
1850         if (wpa_s->group_cipher == WPA_CIPHER_WEP40 ||
1851             wpa_s->group_cipher == WPA_CIPHER_WEP104 ||
1852             wpa_s->pairwise_cipher == WPA_CIPHER_TKIP) {
1853                 wpa_printf(MSG_DEBUG,
1854                            "IBSS: WEP/TKIP detected, do not try to enable HT");
1855                 return;
1856         }
1857
1858         hw_mode = ieee80211_freq_to_chan(freq->freq, &channel);
1859         for (i = 0; wpa_s->hw.modes && i < wpa_s->hw.num_modes; i++) {
1860                 if (wpa_s->hw.modes[i].mode == hw_mode) {
1861                         mode = &wpa_s->hw.modes[i];
1862                         break;
1863                 }
1864         }
1865
1866         if (!mode)
1867                 return;
1868
1869         freq->ht_enabled = ht_supported(mode);
1870         if (!freq->ht_enabled)
1871                 return;
1872
1873         /* Setup higher BW only for 5 GHz */
1874         if (mode->mode != HOSTAPD_MODE_IEEE80211A)
1875                 return;
1876
1877         for (chan_idx = 0; chan_idx < mode->num_channels; chan_idx++) {
1878                 pri_chan = &mode->channels[chan_idx];
1879                 if (pri_chan->chan == channel)
1880                         break;
1881                 pri_chan = NULL;
1882         }
1883         if (!pri_chan)
1884                 return;
1885
1886         /* Check primary channel flags */
1887         if (pri_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1888                 return;
1889
1890         /* Check/setup HT40+/HT40- */
1891         for (j = 0; j < ARRAY_SIZE(ht40plus); j++) {
1892                 if (ht40plus[j] == channel) {
1893                         ht40 = 1;
1894                         break;
1895                 }
1896         }
1897
1898         /* Find secondary channel */
1899         for (i = 0; i < mode->num_channels; i++) {
1900                 sec_chan = &mode->channels[i];
1901                 if (sec_chan->chan == channel + ht40 * 4)
1902                         break;
1903                 sec_chan = NULL;
1904         }
1905         if (!sec_chan)
1906                 return;
1907
1908         /* Check secondary channel flags */
1909         if (sec_chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
1910                 return;
1911
1912         freq->channel = pri_chan->chan;
1913
1914         switch (ht40) {
1915         case -1:
1916                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS))
1917                         return;
1918                 freq->sec_channel_offset = -1;
1919                 break;
1920         case 1:
1921                 if (!(pri_chan->flag & HOSTAPD_CHAN_HT40PLUS))
1922                         return;
1923                 freq->sec_channel_offset = 1;
1924                 break;
1925         default:
1926                 break;
1927         }
1928
1929         if (freq->sec_channel_offset && obss_scan) {
1930                 struct wpa_scan_results *scan_res;
1931
1932                 scan_res = wpa_supplicant_get_scan_results(wpa_s, NULL, 0);
1933                 if (scan_res == NULL) {
1934                         /* Back to HT20 */
1935                         freq->sec_channel_offset = 0;
1936                         return;
1937                 }
1938
1939                 res = check_40mhz_5g(mode, scan_res, pri_chan->chan,
1940                                      sec_chan->chan);
1941                 switch (res) {
1942                 case 0:
1943                         /* Back to HT20 */
1944                         freq->sec_channel_offset = 0;
1945                         break;
1946                 case 1:
1947                         /* Configuration allowed */
1948                         break;
1949                 case 2:
1950                         /* Switch pri/sec channels */
1951                         freq->freq = hw_get_freq(mode, sec_chan->chan);
1952                         freq->sec_channel_offset = -freq->sec_channel_offset;
1953                         freq->channel = sec_chan->chan;
1954                         break;
1955                 default:
1956                         freq->sec_channel_offset = 0;
1957                         break;
1958                 }
1959
1960                 wpa_scan_results_free(scan_res);
1961         }
1962
1963         wpa_printf(MSG_DEBUG,
1964                    "IBSS/mesh: setup freq channel %d, sec_channel_offset %d",
1965                    freq->channel, freq->sec_channel_offset);
1966
1967         if (!drv_supports_vht(wpa_s, ssid))
1968                 return;
1969
1970         /* For IBSS check VHT_IBSS flag */
1971         if (ssid->mode == WPAS_MODE_IBSS &&
1972             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_VHT_IBSS))
1973                 return;
1974
1975         vht_freq = *freq;
1976
1977         vht_freq.vht_enabled = vht_supported(mode);
1978         if (!vht_freq.vht_enabled)
1979                 return;
1980
1981         /* setup center_freq1, bandwidth */
1982         for (j = 0; j < ARRAY_SIZE(vht80); j++) {
1983                 if (freq->channel >= vht80[j] &&
1984                     freq->channel < vht80[j] + 16)
1985                         break;
1986         }
1987
1988         if (j == ARRAY_SIZE(vht80))
1989                 return;
1990
1991         for (i = vht80[j]; i < vht80[j] + 16; i += 4) {
1992                 struct hostapd_channel_data *chan;
1993
1994                 chan = hw_get_channel_chan(mode, i, NULL);
1995                 if (!chan)
1996                         return;
1997
1998                 /* Back to HT configuration if channel not usable */
1999                 if (chan->flag & (HOSTAPD_CHAN_DISABLED | HOSTAPD_CHAN_NO_IR))
2000                         return;
2001         }
2002
2003         chwidth = VHT_CHANWIDTH_80MHZ;
2004         seg0 = vht80[j] + 6;
2005         seg1 = 0;
2006
2007         if (ssid->max_oper_chwidth == VHT_CHANWIDTH_80P80MHZ) {
2008                 /* setup center_freq2, bandwidth */
2009                 for (k = 0; k < ARRAY_SIZE(vht80); k++) {
2010                         /* Only accept 80 MHz segments separated by a gap */
2011                         if (j == k || abs(vht80[j] - vht80[k]) == 16)
2012                                 continue;
2013                         for (i = vht80[k]; i < vht80[k] + 16; i += 4) {
2014                                 struct hostapd_channel_data *chan;
2015
2016                                 chan = hw_get_channel_chan(mode, i, NULL);
2017                                 if (!chan)
2018                                         continue;
2019
2020                                 if (chan->flag & (HOSTAPD_CHAN_DISABLED |
2021                                                   HOSTAPD_CHAN_NO_IR |
2022                                                   HOSTAPD_CHAN_RADAR))
2023                                         continue;
2024
2025                                 /* Found a suitable second segment for 80+80 */
2026                                 chwidth = VHT_CHANWIDTH_80P80MHZ;
2027                                 vht_caps |=
2028                                         VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
2029                                 seg1 = vht80[k] + 6;
2030                         }
2031
2032                         if (chwidth == VHT_CHANWIDTH_80P80MHZ)
2033                                 break;
2034                 }
2035         }
2036
2037         if (hostapd_set_freq_params(&vht_freq, mode->mode, freq->freq,
2038                                     freq->channel, freq->ht_enabled,
2039                                     vht_freq.vht_enabled,
2040                                     freq->sec_channel_offset,
2041                                     chwidth, seg0, seg1, vht_caps) != 0)
2042                 return;
2043
2044         *freq = vht_freq;
2045
2046         wpa_printf(MSG_DEBUG, "IBSS: VHT setup freq cf1 %d, cf2 %d, bw %d",
2047                    freq->center_freq1, freq->center_freq2, freq->bandwidth);
2048 }
2049
2050
2051 static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
2052 {
2053         struct wpa_connect_work *cwork = work->ctx;
2054         struct wpa_bss *bss = cwork->bss;
2055         struct wpa_ssid *ssid = cwork->ssid;
2056         struct wpa_supplicant *wpa_s = work->wpa_s;
2057         u8 wpa_ie[200];
2058         size_t wpa_ie_len;
2059         int use_crypt, ret, i, bssid_changed;
2060         int algs = WPA_AUTH_ALG_OPEN;
2061         unsigned int cipher_pairwise, cipher_group;
2062         struct wpa_driver_associate_params params;
2063         int wep_keys_set = 0;
2064         int assoc_failed = 0;
2065         struct wpa_ssid *old_ssid;
2066 #ifdef CONFIG_HT_OVERRIDES
2067         struct ieee80211_ht_capabilities htcaps;
2068         struct ieee80211_ht_capabilities htcaps_mask;
2069 #endif /* CONFIG_HT_OVERRIDES */
2070 #ifdef CONFIG_VHT_OVERRIDES
2071        struct ieee80211_vht_capabilities vhtcaps;
2072        struct ieee80211_vht_capabilities vhtcaps_mask;
2073 #endif /* CONFIG_VHT_OVERRIDES */
2074 #ifdef CONFIG_MBO
2075         const u8 *mbo = NULL;
2076 #endif /* CONFIG_MBO */
2077
2078         if (deinit) {
2079                 if (work->started) {
2080                         wpa_s->connect_work = NULL;
2081
2082                         /* cancel possible auth. timeout */
2083                         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s,
2084                                              NULL);
2085                 }
2086                 wpas_connect_work_free(cwork);
2087                 return;
2088         }
2089
2090         wpa_s->connect_work = work;
2091
2092         if (cwork->bss_removed || !wpas_valid_bss_ssid(wpa_s, bss, ssid) ||
2093             wpas_network_disabled(wpa_s, ssid)) {
2094                 wpa_dbg(wpa_s, MSG_DEBUG, "BSS/SSID entry for association not valid anymore - drop connection attempt");
2095                 wpas_connect_work_done(wpa_s);
2096                 return;
2097         }
2098
2099         os_memset(&params, 0, sizeof(params));
2100         wpa_s->reassociate = 0;
2101         wpa_s->eap_expected_failure = 0;
2102         if (bss &&
2103             (!wpas_driver_bss_selection(wpa_s) || wpas_wps_searching(wpa_s))) {
2104 #ifdef CONFIG_IEEE80211R
2105                 const u8 *ie, *md = NULL;
2106 #endif /* CONFIG_IEEE80211R */
2107                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
2108                         " (SSID='%s' freq=%d MHz)", MAC2STR(bss->bssid),
2109                         wpa_ssid_txt(bss->ssid, bss->ssid_len), bss->freq);
2110                 bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
2111                 os_memset(wpa_s->bssid, 0, ETH_ALEN);
2112                 os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
2113                 if (bssid_changed)
2114                         wpas_notify_bssid_changed(wpa_s);
2115 #ifdef CONFIG_IEEE80211R
2116                 ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
2117                 if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
2118                         md = ie + 2;
2119                 wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
2120                 if (md) {
2121                         /* Prepare for the next transition */
2122                         wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
2123                 }
2124 #endif /* CONFIG_IEEE80211R */
2125 #ifdef CONFIG_WPS
2126         } else if ((ssid->ssid == NULL || ssid->ssid_len == 0) &&
2127                    wpa_s->conf->ap_scan == 2 &&
2128                    (ssid->key_mgmt & WPA_KEY_MGMT_WPS)) {
2129                 /* Use ap_scan==1 style network selection to find the network
2130                  */
2131                 wpas_connect_work_done(wpa_s);
2132                 wpa_s->scan_req = MANUAL_SCAN_REQ;
2133                 wpa_s->reassociate = 1;
2134                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2135                 return;
2136 #endif /* CONFIG_WPS */
2137         } else {
2138                 wpa_msg(wpa_s, MSG_INFO, "Trying to associate with SSID '%s'",
2139                         wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
2140                 os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2141         }
2142         if (!wpa_s->pno)
2143                 wpa_supplicant_cancel_sched_scan(wpa_s);
2144
2145         wpa_supplicant_cancel_scan(wpa_s);
2146
2147         /* Starting new association, so clear the possibly used WPA IE from the
2148          * previous association. */
2149         wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
2150
2151 #ifdef IEEE8021X_EAPOL
2152         if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2153                 if (ssid->leap) {
2154                         if (ssid->non_leap == 0)
2155                                 algs = WPA_AUTH_ALG_LEAP;
2156                         else
2157                                 algs |= WPA_AUTH_ALG_LEAP;
2158                 }
2159         }
2160 #endif /* IEEE8021X_EAPOL */
2161         wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x", algs);
2162         if (ssid->auth_alg) {
2163                 algs = ssid->auth_alg;
2164                 wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
2165                         "0x%x", algs);
2166         }
2167
2168         if (bss && (wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
2169                     wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
2170             wpa_key_mgmt_wpa(ssid->key_mgmt)) {
2171                 int try_opportunistic;
2172                 try_opportunistic = (ssid->proactive_key_caching < 0 ?
2173                                      wpa_s->conf->okc :
2174                                      ssid->proactive_key_caching) &&
2175                         (ssid->proto & WPA_PROTO_RSN);
2176                 if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
2177                                             ssid, try_opportunistic) == 0)
2178                         eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
2179                 wpa_ie_len = sizeof(wpa_ie);
2180                 if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
2181                                               wpa_ie, &wpa_ie_len)) {
2182                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2183                                 "key management and encryption suites");
2184                         wpas_connect_work_done(wpa_s);
2185                         return;
2186                 }
2187         } else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) && bss &&
2188                    wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
2189                 /*
2190                  * Both WPA and non-WPA IEEE 802.1X enabled in configuration -
2191                  * use non-WPA since the scan results did not indicate that the
2192                  * AP is using WPA or WPA2.
2193                  */
2194                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2195                 wpa_ie_len = 0;
2196                 wpa_s->wpa_proto = 0;
2197         } else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
2198                 wpa_ie_len = sizeof(wpa_ie);
2199                 if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
2200                                               wpa_ie, &wpa_ie_len)) {
2201                         wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed to set WPA "
2202                                 "key management and encryption suites (no "
2203                                 "scan results)");
2204                         wpas_connect_work_done(wpa_s);
2205                         return;
2206                 }
2207 #ifdef CONFIG_WPS
2208         } else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
2209                 struct wpabuf *wps_ie;
2210                 wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
2211                 if (wps_ie && wpabuf_len(wps_ie) <= sizeof(wpa_ie)) {
2212                         wpa_ie_len = wpabuf_len(wps_ie);
2213                         os_memcpy(wpa_ie, wpabuf_head(wps_ie), wpa_ie_len);
2214                 } else
2215                         wpa_ie_len = 0;
2216                 wpabuf_free(wps_ie);
2217                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2218                 if (!bss || (bss->caps & IEEE80211_CAP_PRIVACY))
2219                         params.wps = WPS_MODE_PRIVACY;
2220                 else
2221                         params.wps = WPS_MODE_OPEN;
2222                 wpa_s->wpa_proto = 0;
2223 #endif /* CONFIG_WPS */
2224         } else {
2225                 wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
2226                 wpa_ie_len = 0;
2227                 wpa_s->wpa_proto = 0;
2228         }
2229
2230 #ifdef CONFIG_P2P
2231         if (wpa_s->global->p2p) {
2232                 u8 *pos;
2233                 size_t len;
2234                 int res;
2235                 pos = wpa_ie + wpa_ie_len;
2236                 len = sizeof(wpa_ie) - wpa_ie_len;
2237                 res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
2238                                             ssid->p2p_group);
2239                 if (res >= 0)
2240                         wpa_ie_len += res;
2241         }
2242
2243         wpa_s->cross_connect_disallowed = 0;
2244         if (bss) {
2245                 struct wpabuf *p2p;
2246                 p2p = wpa_bss_get_vendor_ie_multi(bss, P2P_IE_VENDOR_TYPE);
2247                 if (p2p) {
2248                         wpa_s->cross_connect_disallowed =
2249                                 p2p_get_cross_connect_disallowed(p2p);
2250                         wpabuf_free(p2p);
2251                         wpa_dbg(wpa_s, MSG_DEBUG, "P2P: WLAN AP %s cross "
2252                                 "connection",
2253                                 wpa_s->cross_connect_disallowed ?
2254                                 "disallows" : "allows");
2255                 }
2256         }
2257
2258         os_memset(wpa_s->p2p_ip_addr_info, 0, sizeof(wpa_s->p2p_ip_addr_info));
2259 #endif /* CONFIG_P2P */
2260
2261 #ifdef CONFIG_MBO
2262         if (bss) {
2263                 mbo = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
2264                 if (mbo) {
2265                         int len;
2266
2267                         len = wpas_mbo_supp_op_class_ie(wpa_s, bss->freq,
2268                                                         wpa_ie + wpa_ie_len,
2269                                                         sizeof(wpa_ie) -
2270                                                         wpa_ie_len);
2271                         if (len > 0)
2272                                 wpa_ie_len += len;
2273                 }
2274         }
2275 #endif /* CONFIG_MBO */
2276
2277         /*
2278          * Workaround: Add Extended Capabilities element only if the AP
2279          * included this element in Beacon/Probe Response frames. Some older
2280          * APs seem to have interoperability issues if this element is
2281          * included, so while the standard may require us to include the
2282          * element in all cases, it is justifiable to skip it to avoid
2283          * interoperability issues.
2284          */
2285         if (!bss || wpa_bss_get_ie(bss, WLAN_EID_EXT_CAPAB)) {
2286                 u8 ext_capab[18];
2287                 int ext_capab_len;
2288                 ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
2289                                                      sizeof(ext_capab));
2290                 if (ext_capab_len > 0) {
2291                         u8 *pos = wpa_ie;
2292                         if (wpa_ie_len > 0 && pos[0] == WLAN_EID_RSN)
2293                                 pos += 2 + pos[1];
2294                         os_memmove(pos + ext_capab_len, pos,
2295                                    wpa_ie_len - (pos - wpa_ie));
2296                         wpa_ie_len += ext_capab_len;
2297                         os_memcpy(pos, ext_capab, ext_capab_len);
2298                 }
2299         }
2300
2301 #ifdef CONFIG_HS20
2302         if (is_hs20_network(wpa_s, ssid, bss)) {
2303                 struct wpabuf *hs20;
2304
2305                 hs20 = wpabuf_alloc(20);
2306                 if (hs20) {
2307                         int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
2308                         size_t len;
2309
2310                         wpas_hs20_add_indication(hs20, pps_mo_id);
2311                         len = sizeof(wpa_ie) - wpa_ie_len;
2312                         if (wpabuf_len(hs20) <= len) {
2313                                 os_memcpy(wpa_ie + wpa_ie_len,
2314                                           wpabuf_head(hs20), wpabuf_len(hs20));
2315                                 wpa_ie_len += wpabuf_len(hs20);
2316                         }
2317                         wpabuf_free(hs20);
2318                 }
2319         }
2320 #endif /* CONFIG_HS20 */
2321
2322         if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
2323                 struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
2324                 size_t len;
2325
2326                 len = sizeof(wpa_ie) - wpa_ie_len;
2327                 if (wpabuf_len(buf) <= len) {
2328                         os_memcpy(wpa_ie + wpa_ie_len,
2329                                   wpabuf_head(buf), wpabuf_len(buf));
2330                         wpa_ie_len += wpabuf_len(buf);
2331                 }
2332         }
2333
2334 #ifdef CONFIG_FST
2335         if (wpa_s->fst_ies) {
2336                 int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
2337
2338                 if (wpa_ie_len + fst_ies_len <= sizeof(wpa_ie)) {
2339                         os_memcpy(wpa_ie + wpa_ie_len,
2340                                   wpabuf_head(wpa_s->fst_ies), fst_ies_len);
2341                         wpa_ie_len += fst_ies_len;
2342                 }
2343         }
2344 #endif /* CONFIG_FST */
2345
2346 #ifdef CONFIG_MBO
2347         if (mbo) {
2348                 int len;
2349
2350                 len = wpas_mbo_ie(wpa_s, wpa_ie + wpa_ie_len,
2351                                   sizeof(wpa_ie) - wpa_ie_len);
2352                 if (len >= 0)
2353                         wpa_ie_len += len;
2354         }
2355 #endif /* CONFIG_MBO */
2356
2357         wpa_clear_keys(wpa_s, bss ? bss->bssid : NULL);
2358         use_crypt = 1;
2359         cipher_pairwise = wpa_s->pairwise_cipher;
2360         cipher_group = wpa_s->group_cipher;
2361         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE ||
2362             wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2363                 if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE)
2364                         use_crypt = 0;
2365                 if (wpa_set_wep_keys(wpa_s, ssid)) {
2366                         use_crypt = 1;
2367                         wep_keys_set = 1;
2368                 }
2369         }
2370         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPS)
2371                 use_crypt = 0;
2372
2373 #ifdef IEEE8021X_EAPOL
2374         if (wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
2375                 if ((ssid->eapol_flags &
2376                      (EAPOL_FLAG_REQUIRE_KEY_UNICAST |
2377                       EAPOL_FLAG_REQUIRE_KEY_BROADCAST)) == 0 &&
2378                     !wep_keys_set) {
2379                         use_crypt = 0;
2380                 } else {
2381                         /* Assume that dynamic WEP-104 keys will be used and
2382                          * set cipher suites in order for drivers to expect
2383                          * encryption. */
2384                         cipher_pairwise = cipher_group = WPA_CIPHER_WEP104;
2385                 }
2386         }
2387 #endif /* IEEE8021X_EAPOL */
2388
2389         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2390                 /* Set the key before (and later after) association */
2391                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2392         }
2393
2394         wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
2395         if (bss) {
2396                 params.ssid = bss->ssid;
2397                 params.ssid_len = bss->ssid_len;
2398                 if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set) {
2399                         wpa_printf(MSG_DEBUG, "Limit connection to BSSID "
2400                                    MACSTR " freq=%u MHz based on scan results "
2401                                    "(bssid_set=%d)",
2402                                    MAC2STR(bss->bssid), bss->freq,
2403                                    ssid->bssid_set);
2404                         params.bssid = bss->bssid;
2405                         params.freq.freq = bss->freq;
2406                 }
2407                 params.bssid_hint = bss->bssid;
2408                 params.freq_hint = bss->freq;
2409                 params.pbss = bss_is_pbss(bss);
2410         } else {
2411                 params.ssid = ssid->ssid;
2412                 params.ssid_len = ssid->ssid_len;
2413                 params.pbss = ssid->pbss;
2414         }
2415
2416         if (ssid->mode == WPAS_MODE_IBSS && ssid->bssid_set &&
2417             wpa_s->conf->ap_scan == 2) {
2418                 params.bssid = ssid->bssid;
2419                 params.fixed_bssid = 1;
2420         }
2421
2422         /* Initial frequency for IBSS/mesh */
2423         if ((ssid->mode == WPAS_MODE_IBSS || ssid->mode == WPAS_MODE_MESH) &&
2424             ssid->frequency > 0 && params.freq.freq == 0)
2425                 ibss_mesh_setup_freq(wpa_s, ssid, &params.freq);
2426
2427         if (ssid->mode == WPAS_MODE_IBSS) {
2428                 params.fixed_freq = ssid->fixed_freq;
2429                 if (ssid->beacon_int)
2430                         params.beacon_int = ssid->beacon_int;
2431                 else
2432                         params.beacon_int = wpa_s->conf->beacon_int;
2433         }
2434
2435         params.wpa_ie = wpa_ie;
2436         params.wpa_ie_len = wpa_ie_len;
2437         params.pairwise_suite = cipher_pairwise;
2438         params.group_suite = cipher_group;
2439         params.key_mgmt_suite = wpa_s->key_mgmt;
2440         params.wpa_proto = wpa_s->wpa_proto;
2441         params.auth_alg = algs;
2442         params.mode = ssid->mode;
2443         params.bg_scan_period = ssid->bg_scan_period;
2444         for (i = 0; i < NUM_WEP_KEYS; i++) {
2445                 if (ssid->wep_key_len[i])
2446                         params.wep_key[i] = ssid->wep_key[i];
2447                 params.wep_key_len[i] = ssid->wep_key_len[i];
2448         }
2449         params.wep_tx_keyidx = ssid->wep_tx_keyidx;
2450
2451         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
2452             (params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2453              params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
2454                 params.passphrase = ssid->passphrase;
2455                 if (ssid->psk_set)
2456                         params.psk = ssid->psk;
2457         }
2458
2459         if (wpa_s->conf->key_mgmt_offload) {
2460                 if (params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
2461                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
2462                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
2463                     params.key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
2464                         params.req_key_mgmt_offload =
2465                                 ssid->proactive_key_caching < 0 ?
2466                                 wpa_s->conf->okc : ssid->proactive_key_caching;
2467                 else
2468                         params.req_key_mgmt_offload = 1;
2469
2470                 if ((params.key_mgmt_suite == WPA_KEY_MGMT_PSK ||
2471                      params.key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
2472                      params.key_mgmt_suite == WPA_KEY_MGMT_FT_PSK) &&
2473                     ssid->psk_set)
2474                         params.psk = ssid->psk;
2475         }
2476
2477         params.drop_unencrypted = use_crypt;
2478
2479 #ifdef CONFIG_IEEE80211W
2480         params.mgmt_frame_protection = wpas_get_ssid_pmf(wpa_s, ssid);
2481         if (params.mgmt_frame_protection != NO_MGMT_FRAME_PROTECTION && bss) {
2482                 const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
2483                 struct wpa_ie_data ie;
2484                 if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ie) == 0 &&
2485                     ie.capabilities &
2486                     (WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
2487                         wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Selected AP supports "
2488                                 "MFP: require MFP");
2489                         params.mgmt_frame_protection =
2490                                 MGMT_FRAME_PROTECTION_REQUIRED;
2491                 }
2492         }
2493 #endif /* CONFIG_IEEE80211W */
2494
2495         params.p2p = ssid->p2p_group;
2496
2497         if (wpa_s->p2pdev->set_sta_uapsd)
2498                 params.uapsd = wpa_s->p2pdev->sta_uapsd;
2499         else
2500                 params.uapsd = -1;
2501
2502 #ifdef CONFIG_HT_OVERRIDES
2503         os_memset(&htcaps, 0, sizeof(htcaps));
2504         os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
2505         params.htcaps = (u8 *) &htcaps;
2506         params.htcaps_mask = (u8 *) &htcaps_mask;
2507         wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
2508 #endif /* CONFIG_HT_OVERRIDES */
2509 #ifdef CONFIG_VHT_OVERRIDES
2510         os_memset(&vhtcaps, 0, sizeof(vhtcaps));
2511         os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
2512         params.vhtcaps = &vhtcaps;
2513         params.vhtcaps_mask = &vhtcaps_mask;
2514         wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
2515 #endif /* CONFIG_VHT_OVERRIDES */
2516
2517 #ifdef CONFIG_P2P
2518         /*
2519          * If multi-channel concurrency is not supported, check for any
2520          * frequency conflict. In case of any frequency conflict, remove the
2521          * least prioritized connection.
2522          */
2523         if (wpa_s->num_multichan_concurrent < 2) {
2524                 int freq, num;
2525                 num = get_shared_radio_freqs(wpa_s, &freq, 1);
2526                 if (num > 0 && freq > 0 && freq != params.freq.freq) {
2527                         wpa_printf(MSG_DEBUG,
2528                                    "Assoc conflicting freq found (%d != %d)",
2529                                    freq, params.freq.freq);
2530                         if (wpas_p2p_handle_frequency_conflicts(
2531                                     wpa_s, params.freq.freq, ssid) < 0) {
2532                                 wpas_connect_work_done(wpa_s);
2533                                 return;
2534                         }
2535                 }
2536         }
2537 #endif /* CONFIG_P2P */
2538
2539         ret = wpa_drv_associate(wpa_s, &params);
2540         if (ret < 0) {
2541                 wpa_msg(wpa_s, MSG_INFO, "Association request to the driver "
2542                         "failed");
2543                 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SANE_ERROR_CODES) {
2544                         /*
2545                          * The driver is known to mean what is saying, so we
2546                          * can stop right here; the association will not
2547                          * succeed.
2548                          */
2549                         wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
2550                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
2551                         os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
2552                         return;
2553                 }
2554                 /* try to continue anyway; new association will be tried again
2555                  * after timeout */
2556                 assoc_failed = 1;
2557         }
2558
2559         if (wpa_s->key_mgmt == WPA_KEY_MGMT_WPA_NONE) {
2560                 /* Set the key after the association just in case association
2561                  * cleared the previously configured key. */
2562                 wpa_supplicant_set_wpa_none_key(wpa_s, ssid);
2563                 /* No need to timeout authentication since there is no key
2564                  * management. */
2565                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2566                 wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
2567 #ifdef CONFIG_IBSS_RSN
2568         } else if (ssid->mode == WPAS_MODE_IBSS &&
2569                    wpa_s->key_mgmt != WPA_KEY_MGMT_NONE &&
2570                    wpa_s->key_mgmt != WPA_KEY_MGMT_WPA_NONE) {
2571                 /*
2572                  * RSN IBSS authentication is per-STA and we can disable the
2573                  * per-BSSID authentication.
2574                  */
2575                 wpa_supplicant_cancel_auth_timeout(wpa_s);
2576 #endif /* CONFIG_IBSS_RSN */
2577         } else {
2578                 /* Timeout for IEEE 802.11 authentication and association */
2579                 int timeout = 60;
2580
2581                 if (assoc_failed) {
2582                         /* give IBSS a bit more time */
2583                         timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5;
2584                 } else if (wpa_s->conf->ap_scan == 1) {
2585                         /* give IBSS a bit more time */
2586                         timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10;
2587                 }
2588                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
2589         }
2590
2591         if (wep_keys_set &&
2592             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC)) {
2593                 /* Set static WEP keys again */
2594                 wpa_set_wep_keys(wpa_s, ssid);
2595         }
2596
2597         if (wpa_s->current_ssid && wpa_s->current_ssid != ssid) {
2598                 /*
2599                  * Do not allow EAP session resumption between different
2600                  * network configurations.
2601                  */
2602                 eapol_sm_invalidate_cached_session(wpa_s->eapol);
2603         }
2604         old_ssid = wpa_s->current_ssid;
2605         wpa_s->current_ssid = ssid;
2606         if (!wpas_driver_bss_selection(wpa_s) || ssid->bssid_set)
2607                 wpa_s->current_bss = bss;
2608         wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
2609         wpa_supplicant_initiate_eapol(wpa_s);
2610         if (old_ssid != wpa_s->current_ssid)
2611                 wpas_notify_network_changed(wpa_s);
2612 }
2613
2614
2615 static void wpa_supplicant_clear_connection(struct wpa_supplicant *wpa_s,
2616                                             const u8 *addr)
2617 {
2618         struct wpa_ssid *old_ssid;
2619
2620         wpas_connect_work_done(wpa_s);
2621         wpa_clear_keys(wpa_s, addr);
2622         old_ssid = wpa_s->current_ssid;
2623         wpa_supplicant_mark_disassoc(wpa_s);
2624         wpa_sm_set_config(wpa_s->wpa, NULL);
2625         eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2626         if (old_ssid != wpa_s->current_ssid)
2627                 wpas_notify_network_changed(wpa_s);
2628         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
2629 }
2630
2631
2632 /**
2633  * wpa_supplicant_deauthenticate - Deauthenticate the current connection
2634  * @wpa_s: Pointer to wpa_supplicant data
2635  * @reason_code: IEEE 802.11 reason code for the deauthenticate frame
2636  *
2637  * This function is used to request %wpa_supplicant to deauthenticate from the
2638  * current AP.
2639  */
2640 void wpa_supplicant_deauthenticate(struct wpa_supplicant *wpa_s,
2641                                    int reason_code)
2642 {
2643         u8 *addr = NULL;
2644         union wpa_event_data event;
2645         int zero_addr = 0;
2646
2647         wpa_dbg(wpa_s, MSG_DEBUG, "Request to deauthenticate - bssid=" MACSTR
2648                 " pending_bssid=" MACSTR " reason=%d state=%s",
2649                 MAC2STR(wpa_s->bssid), MAC2STR(wpa_s->pending_bssid),
2650                 reason_code, wpa_supplicant_state_txt(wpa_s->wpa_state));
2651
2652         if (!is_zero_ether_addr(wpa_s->bssid))
2653                 addr = wpa_s->bssid;
2654         else if (!is_zero_ether_addr(wpa_s->pending_bssid) &&
2655                  (wpa_s->wpa_state == WPA_AUTHENTICATING ||
2656                   wpa_s->wpa_state == WPA_ASSOCIATING))
2657                 addr = wpa_s->pending_bssid;
2658         else if (wpa_s->wpa_state == WPA_ASSOCIATING) {
2659                 /*
2660                  * When using driver-based BSS selection, we may not know the
2661                  * BSSID with which we are currently trying to associate. We
2662                  * need to notify the driver of this disconnection even in such
2663                  * a case, so use the all zeros address here.
2664                  */
2665                 addr = wpa_s->bssid;
2666                 zero_addr = 1;
2667         }
2668
2669 #ifdef CONFIG_TDLS
2670         wpa_tdls_teardown_peers(wpa_s->wpa);
2671 #endif /* CONFIG_TDLS */
2672
2673 #ifdef CONFIG_MESH
2674         if (wpa_s->ifmsh) {
2675                 wpa_msg(wpa_s, MSG_INFO, MESH_GROUP_REMOVED "%s",
2676                         wpa_s->ifname);
2677                 wpa_supplicant_leave_mesh(wpa_s);
2678         }
2679 #endif /* CONFIG_MESH */
2680
2681         if (addr) {
2682                 wpa_drv_deauthenticate(wpa_s, addr, reason_code);
2683                 os_memset(&event, 0, sizeof(event));
2684                 event.deauth_info.reason_code = (u16) reason_code;
2685                 event.deauth_info.locally_generated = 1;
2686                 wpa_supplicant_event(wpa_s, EVENT_DEAUTH, &event);
2687                 if (zero_addr)
2688                         addr = NULL;
2689         }
2690
2691         wpa_supplicant_clear_connection(wpa_s, addr);
2692 }
2693
2694 static void wpa_supplicant_enable_one_network(struct wpa_supplicant *wpa_s,
2695                                               struct wpa_ssid *ssid)
2696 {
2697         if (!ssid || !ssid->disabled || ssid->disabled == 2)
2698                 return;
2699
2700         ssid->disabled = 0;
2701         wpas_clear_temp_disabled(wpa_s, ssid, 1);
2702         wpas_notify_network_enabled_changed(wpa_s, ssid);
2703
2704         /*
2705          * Try to reassociate since there is no current configuration and a new
2706          * network was made available.
2707          */
2708         if (!wpa_s->current_ssid && !wpa_s->disconnected)
2709                 wpa_s->reassociate = 1;
2710 }
2711
2712
2713 /**
2714  * wpa_supplicant_enable_network - Mark a configured network as enabled
2715  * @wpa_s: wpa_supplicant structure for a network interface
2716  * @ssid: wpa_ssid structure for a configured network or %NULL
2717  *
2718  * Enables the specified network or all networks if no network specified.
2719  */
2720 void wpa_supplicant_enable_network(struct wpa_supplicant *wpa_s,
2721                                    struct wpa_ssid *ssid)
2722 {
2723         if (ssid == NULL) {
2724                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
2725                         wpa_supplicant_enable_one_network(wpa_s, ssid);
2726         } else
2727                 wpa_supplicant_enable_one_network(wpa_s, ssid);
2728
2729         if (wpa_s->reassociate && !wpa_s->disconnected &&
2730             (!wpa_s->current_ssid ||
2731              wpa_s->wpa_state == WPA_DISCONNECTED ||
2732              wpa_s->wpa_state == WPA_SCANNING)) {
2733                 if (wpa_s->sched_scanning) {
2734                         wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan to add "
2735                                    "new network to scan filters");
2736                         wpa_supplicant_cancel_sched_scan(wpa_s);
2737                 }
2738
2739                 if (wpa_supplicant_fast_associate(wpa_s) != 1) {
2740                         wpa_s->scan_req = NORMAL_SCAN_REQ;
2741                         wpa_supplicant_req_scan(wpa_s, 0, 0);
2742                 }
2743         }
2744 }
2745
2746
2747 /**
2748  * wpa_supplicant_disable_network - Mark a configured network as disabled
2749  * @wpa_s: wpa_supplicant structure for a network interface
2750  * @ssid: wpa_ssid structure for a configured network or %NULL
2751  *
2752  * Disables the specified network or all networks if no network specified.
2753  */
2754 void wpa_supplicant_disable_network(struct wpa_supplicant *wpa_s,
2755                                     struct wpa_ssid *ssid)
2756 {
2757         struct wpa_ssid *other_ssid;
2758         int was_disabled;
2759
2760         if (ssid == NULL) {
2761                 if (wpa_s->sched_scanning)
2762                         wpa_supplicant_cancel_sched_scan(wpa_s);
2763
2764                 for (other_ssid = wpa_s->conf->ssid; other_ssid;
2765                      other_ssid = other_ssid->next) {
2766                         was_disabled = other_ssid->disabled;
2767                         if (was_disabled == 2)
2768                                 continue; /* do not change persistent P2P group
2769                                            * data */
2770
2771                         other_ssid->disabled = 1;
2772
2773                         if (was_disabled != other_ssid->disabled)
2774                                 wpas_notify_network_enabled_changed(
2775                                         wpa_s, other_ssid);
2776                 }
2777                 if (wpa_s->current_ssid)
2778                         wpa_supplicant_deauthenticate(
2779                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2780         } else if (ssid->disabled != 2) {
2781                 if (ssid == wpa_s->current_ssid)
2782                         wpa_supplicant_deauthenticate(
2783                                 wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2784
2785                 was_disabled = ssid->disabled;
2786
2787                 ssid->disabled = 1;
2788
2789                 if (was_disabled != ssid->disabled) {
2790                         wpas_notify_network_enabled_changed(wpa_s, ssid);
2791                         if (wpa_s->sched_scanning) {
2792                                 wpa_printf(MSG_DEBUG, "Stop ongoing sched_scan "
2793                                            "to remove network from filters");
2794                                 wpa_supplicant_cancel_sched_scan(wpa_s);
2795                                 wpa_supplicant_req_scan(wpa_s, 0, 0);
2796                         }
2797                 }
2798         }
2799 }
2800
2801
2802 /**
2803  * wpa_supplicant_select_network - Attempt association with a network
2804  * @wpa_s: wpa_supplicant structure for a network interface
2805  * @ssid: wpa_ssid structure for a configured network or %NULL for any network
2806  */
2807 void wpa_supplicant_select_network(struct wpa_supplicant *wpa_s,
2808                                    struct wpa_ssid *ssid)
2809 {
2810
2811         struct wpa_ssid *other_ssid;
2812         int disconnected = 0;
2813
2814         if (ssid && ssid != wpa_s->current_ssid && wpa_s->current_ssid) {
2815                 if (wpa_s->wpa_state >= WPA_AUTHENTICATING)
2816                         wpa_s->own_disconnect_req = 1;
2817                 wpa_supplicant_deauthenticate(
2818                         wpa_s, WLAN_REASON_DEAUTH_LEAVING);
2819                 disconnected = 1;
2820         }
2821
2822         if (ssid)
2823                 wpas_clear_temp_disabled(wpa_s, ssid, 1);
2824
2825         /*
2826          * Mark all other networks disabled or mark all networks enabled if no
2827          * network specified.
2828          */
2829         for (other_ssid = wpa_s->conf->ssid; other_ssid;
2830              other_ssid = other_ssid->next) {
2831                 int was_disabled = other_ssid->disabled;
2832                 if (was_disabled == 2)
2833                         continue; /* do not change persistent P2P group data */
2834
2835                 other_ssid->disabled = ssid ? (ssid->id != other_ssid->id) : 0;
2836                 if (was_disabled && !other_ssid->disabled)
2837                         wpas_clear_temp_disabled(wpa_s, other_ssid, 0);
2838
2839                 if (was_disabled != other_ssid->disabled)
2840                         wpas_notify_network_enabled_changed(wpa_s, other_ssid);
2841         }
2842
2843         if (ssid && ssid == wpa_s->current_ssid && wpa_s->current_ssid &&
2844             wpa_s->wpa_state >= WPA_AUTHENTICATING) {
2845                 /* We are already associated with the selected network */
2846                 wpa_printf(MSG_DEBUG, "Already associated with the "
2847                            "selected network - do nothing");
2848                 return;
2849         }
2850
2851         if (ssid) {
2852                 wpa_s->current_ssid = ssid;
2853                 eapol_sm_notify_config(wpa_s->eapol, NULL, NULL);
2854                 wpa_s->connect_without_scan =
2855                         (ssid->mode == WPAS_MODE_MESH) ? ssid : NULL;
2856
2857                 /*
2858                  * Don't optimize next scan freqs since a new ESS has been
2859                  * selected.
2860                  */
2861                 os_free(wpa_s->next_scan_freqs);
2862                 wpa_s->next_scan_freqs = NULL;
2863         } else {
2864                 wpa_s->connect_without_scan = NULL;
2865         }
2866
2867         wpa_s->disconnected = 0;
2868         wpa_s->reassociate = 1;
2869
2870         if (wpa_s->connect_without_scan ||
2871             wpa_supplicant_fast_associate(wpa_s) != 1) {
2872                 wpa_s->scan_req = NORMAL_SCAN_REQ;
2873                 wpa_supplicant_req_scan(wpa_s, 0, disconnected ? 100000 : 0);
2874         }
2875
2876         if (ssid)
2877                 wpas_notify_network_selected(wpa_s, ssid);
2878 }
2879
2880
2881 /**
2882  * wpas_set_pkcs11_engine_and_module_path - Set PKCS #11 engine and module path
2883  * @wpa_s: wpa_supplicant structure for a network interface
2884  * @pkcs11_engine_path: PKCS #11 engine path or NULL
2885  * @pkcs11_module_path: PKCS #11 module path or NULL
2886  * Returns: 0 on success; -1 on failure
2887  *
2888  * Sets the PKCS #11 engine and module path. Both have to be NULL or a valid
2889  * path. If resetting the EAPOL state machine with the new PKCS #11 engine and
2890  * module path fails the paths will be reset to the default value (NULL).
2891  */
2892 int wpas_set_pkcs11_engine_and_module_path(struct wpa_supplicant *wpa_s,
2893                                            const char *pkcs11_engine_path,
2894                                            const char *pkcs11_module_path)
2895 {
2896         char *pkcs11_engine_path_copy = NULL;
2897         char *pkcs11_module_path_copy = NULL;
2898
2899         if (pkcs11_engine_path != NULL) {
2900                 pkcs11_engine_path_copy = os_strdup(pkcs11_engine_path);
2901                 if (pkcs11_engine_path_copy == NULL)
2902                         return -1;
2903         }
2904         if (pkcs11_module_path != NULL) {
2905                 pkcs11_module_path_copy = os_strdup(pkcs11_module_path);
2906                 if (pkcs11_module_path_copy == NULL) {
2907                         os_free(pkcs11_engine_path_copy);
2908                         return -1;
2909                 }
2910         }
2911
2912         os_free(wpa_s->conf->pkcs11_engine_path);
2913         os_free(wpa_s->conf->pkcs11_module_path);
2914         wpa_s->conf->pkcs11_engine_path = pkcs11_engine_path_copy;
2915         wpa_s->conf->pkcs11_module_path = pkcs11_module_path_copy;
2916
2917         wpa_sm_set_eapol(wpa_s->wpa, NULL);
2918         eapol_sm_deinit(wpa_s->eapol);
2919         wpa_s->eapol = NULL;
2920         if (wpa_supplicant_init_eapol(wpa_s)) {
2921                 /* Error -> Reset paths to the default value (NULL) once. */
2922                 if (pkcs11_engine_path != NULL && pkcs11_module_path != NULL)
2923                         wpas_set_pkcs11_engine_and_module_path(wpa_s, NULL,
2924                                                                NULL);
2925
2926                 return -1;
2927         }
2928         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
2929
2930         return 0;
2931 }
2932
2933
2934 /**
2935  * wpa_supplicant_set_ap_scan - Set AP scan mode for interface
2936  * @wpa_s: wpa_supplicant structure for a network interface
2937  * @ap_scan: AP scan mode
2938  * Returns: 0 if succeed or -1 if ap_scan has an invalid value
2939  *
2940  */
2941 int wpa_supplicant_set_ap_scan(struct wpa_supplicant *wpa_s, int ap_scan)
2942 {
2943
2944         int old_ap_scan;
2945
2946         if (ap_scan < 0 || ap_scan > 2)
2947                 return -1;
2948
2949         if (ap_scan == 2 && os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
2950                 wpa_printf(MSG_INFO,
2951                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
2952         }
2953
2954 #ifdef ANDROID
2955         if (ap_scan == 2 && ap_scan != wpa_s->conf->ap_scan &&
2956             wpa_s->wpa_state >= WPA_ASSOCIATING &&
2957             wpa_s->wpa_state < WPA_COMPLETED) {
2958                 wpa_printf(MSG_ERROR, "ap_scan = %d (%d) rejected while "
2959                            "associating", wpa_s->conf->ap_scan, ap_scan);
2960                 return 0;
2961         }
2962 #endif /* ANDROID */
2963
2964         old_ap_scan = wpa_s->conf->ap_scan;
2965         wpa_s->conf->ap_scan = ap_scan;
2966
2967         if (old_ap_scan != wpa_s->conf->ap_scan)
2968                 wpas_notify_ap_scan_changed(wpa_s);
2969
2970         return 0;
2971 }
2972
2973
2974 /**
2975  * wpa_supplicant_set_bss_expiration_age - Set BSS entry expiration age
2976  * @wpa_s: wpa_supplicant structure for a network interface
2977  * @expire_age: Expiration age in seconds
2978  * Returns: 0 if succeed or -1 if expire_age has an invalid value
2979  *
2980  */
2981 int wpa_supplicant_set_bss_expiration_age(struct wpa_supplicant *wpa_s,
2982                                           unsigned int bss_expire_age)
2983 {
2984         if (bss_expire_age < 10) {
2985                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration age %u",
2986                         bss_expire_age);
2987                 return -1;
2988         }
2989         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration age: %d sec",
2990                 bss_expire_age);
2991         wpa_s->conf->bss_expiration_age = bss_expire_age;
2992
2993         return 0;
2994 }
2995
2996
2997 /**
2998  * wpa_supplicant_set_bss_expiration_count - Set BSS entry expiration scan count
2999  * @wpa_s: wpa_supplicant structure for a network interface
3000  * @expire_count: number of scans after which an unseen BSS is reclaimed
3001  * Returns: 0 if succeed or -1 if expire_count has an invalid value
3002  *
3003  */
3004 int wpa_supplicant_set_bss_expiration_count(struct wpa_supplicant *wpa_s,
3005                                             unsigned int bss_expire_count)
3006 {
3007         if (bss_expire_count < 1) {
3008                 wpa_msg(wpa_s, MSG_ERROR, "Invalid bss expiration count %u",
3009                         bss_expire_count);
3010                 return -1;
3011         }
3012         wpa_msg(wpa_s, MSG_DEBUG, "Setting bss expiration scan count: %u",
3013                 bss_expire_count);
3014         wpa_s->conf->bss_expiration_scan_count = bss_expire_count;
3015
3016         return 0;
3017 }
3018
3019
3020 /**
3021  * wpa_supplicant_set_scan_interval - Set scan interval
3022  * @wpa_s: wpa_supplicant structure for a network interface
3023  * @scan_interval: scan interval in seconds
3024  * Returns: 0 if succeed or -1 if scan_interval has an invalid value
3025  *
3026  */
3027 int wpa_supplicant_set_scan_interval(struct wpa_supplicant *wpa_s,
3028                                      int scan_interval)
3029 {
3030         if (scan_interval < 0) {
3031                 wpa_msg(wpa_s, MSG_ERROR, "Invalid scan interval %d",
3032                         scan_interval);
3033                 return -1;
3034         }
3035         wpa_msg(wpa_s, MSG_DEBUG, "Setting scan interval: %d sec",
3036                 scan_interval);
3037         wpa_supplicant_update_scan_int(wpa_s, scan_interval);
3038
3039         return 0;
3040 }
3041
3042
3043 /**
3044  * wpa_supplicant_set_debug_params - Set global debug params
3045  * @global: wpa_global structure
3046  * @debug_level: debug level
3047  * @debug_timestamp: determines if show timestamp in debug data
3048  * @debug_show_keys: determines if show keys in debug data
3049  * Returns: 0 if succeed or -1 if debug_level has wrong value
3050  */
3051 int wpa_supplicant_set_debug_params(struct wpa_global *global, int debug_level,
3052                                     int debug_timestamp, int debug_show_keys)
3053 {
3054
3055         int old_level, old_timestamp, old_show_keys;
3056
3057         /* check for allowed debuglevels */
3058         if (debug_level != MSG_EXCESSIVE &&
3059             debug_level != MSG_MSGDUMP &&
3060             debug_level != MSG_DEBUG &&
3061             debug_level != MSG_INFO &&
3062             debug_level != MSG_WARNING &&
3063             debug_level != MSG_ERROR)
3064                 return -1;
3065
3066         old_level = wpa_debug_level;
3067         old_timestamp = wpa_debug_timestamp;
3068         old_show_keys = wpa_debug_show_keys;
3069
3070         wpa_debug_level = debug_level;
3071         wpa_debug_timestamp = debug_timestamp ? 1 : 0;
3072         wpa_debug_show_keys = debug_show_keys ? 1 : 0;
3073
3074         if (wpa_debug_level != old_level)
3075                 wpas_notify_debug_level_changed(global);
3076         if (wpa_debug_timestamp != old_timestamp)
3077                 wpas_notify_debug_timestamp_changed(global);
3078         if (wpa_debug_show_keys != old_show_keys)
3079                 wpas_notify_debug_show_keys_changed(global);
3080
3081         return 0;
3082 }
3083
3084
3085 /**
3086  * wpa_supplicant_get_ssid - Get a pointer to the current network structure
3087  * @wpa_s: Pointer to wpa_supplicant data
3088  * Returns: A pointer to the current network structure or %NULL on failure
3089  */
3090 struct wpa_ssid * wpa_supplicant_get_ssid(struct wpa_supplicant *wpa_s)
3091 {
3092         struct wpa_ssid *entry;
3093         u8 ssid[SSID_MAX_LEN];
3094         int res;
3095         size_t ssid_len;
3096         u8 bssid[ETH_ALEN];
3097         int wired;
3098
3099         res = wpa_drv_get_ssid(wpa_s, ssid);
3100         if (res < 0) {
3101                 wpa_msg(wpa_s, MSG_WARNING, "Could not read SSID from "
3102                         "driver");
3103                 return NULL;
3104         }
3105         ssid_len = res;
3106
3107         if (wpa_drv_get_bssid(wpa_s, bssid) < 0) {
3108                 wpa_msg(wpa_s, MSG_WARNING, "Could not read BSSID from "
3109                         "driver");
3110                 return NULL;
3111         }
3112
3113         wired = wpa_s->conf->ap_scan == 0 &&
3114                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_WIRED);
3115
3116         entry = wpa_s->conf->ssid;
3117         while (entry) {
3118                 if (!wpas_network_disabled(wpa_s, entry) &&
3119                     ((ssid_len == entry->ssid_len &&
3120                       os_memcmp(ssid, entry->ssid, ssid_len) == 0) || wired) &&
3121                     (!entry->bssid_set ||
3122                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3123                         return entry;
3124 #ifdef CONFIG_WPS
3125                 if (!wpas_network_disabled(wpa_s, entry) &&
3126                     (entry->key_mgmt & WPA_KEY_MGMT_WPS) &&
3127                     (entry->ssid == NULL || entry->ssid_len == 0) &&
3128                     (!entry->bssid_set ||
3129                      os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0))
3130                         return entry;
3131 #endif /* CONFIG_WPS */
3132
3133                 if (!wpas_network_disabled(wpa_s, entry) && entry->bssid_set &&
3134                     entry->ssid_len == 0 &&
3135                     os_memcmp(bssid, entry->bssid, ETH_ALEN) == 0)
3136                         return entry;
3137
3138                 entry = entry->next;
3139         }
3140
3141         return NULL;
3142 }
3143
3144
3145 static int select_driver(struct wpa_supplicant *wpa_s, int i)
3146 {
3147         struct wpa_global *global = wpa_s->global;
3148
3149         if (wpa_drivers[i]->global_init && global->drv_priv[i] == NULL) {
3150                 global->drv_priv[i] = wpa_drivers[i]->global_init(global);
3151                 if (global->drv_priv[i] == NULL) {
3152                         wpa_printf(MSG_ERROR, "Failed to initialize driver "
3153                                    "'%s'", wpa_drivers[i]->name);
3154                         return -1;
3155                 }
3156         }
3157
3158         wpa_s->driver = wpa_drivers[i];
3159         wpa_s->global_drv_priv = global->drv_priv[i];
3160
3161         return 0;
3162 }
3163
3164
3165 static int wpa_supplicant_set_driver(struct wpa_supplicant *wpa_s,
3166                                      const char *name)
3167 {
3168         int i;
3169         size_t len;
3170         const char *pos, *driver = name;
3171
3172         if (wpa_s == NULL)
3173                 return -1;
3174
3175         if (wpa_drivers[0] == NULL) {
3176                 wpa_msg(wpa_s, MSG_ERROR, "No driver interfaces build into "
3177                         "wpa_supplicant");
3178                 return -1;
3179         }
3180
3181         if (name == NULL) {
3182                 /* default to first driver in the list */
3183                 return select_driver(wpa_s, 0);
3184         }
3185
3186         do {
3187                 pos = os_strchr(driver, ',');
3188                 if (pos)
3189                         len = pos - driver;
3190                 else
3191                         len = os_strlen(driver);
3192
3193                 for (i = 0; wpa_drivers[i]; i++) {
3194                         if (os_strlen(wpa_drivers[i]->name) == len &&
3195                             os_strncmp(driver, wpa_drivers[i]->name, len) ==
3196                             0) {
3197                                 /* First driver that succeeds wins */
3198                                 if (select_driver(wpa_s, i) == 0)
3199                                         return 0;
3200                         }
3201                 }
3202
3203                 driver = pos + 1;
3204         } while (pos);
3205
3206         wpa_msg(wpa_s, MSG_ERROR, "Unsupported driver '%s'", name);
3207         return -1;
3208 }
3209
3210
3211 /**
3212  * wpa_supplicant_rx_eapol - Deliver a received EAPOL frame to wpa_supplicant
3213  * @ctx: Context pointer (wpa_s); this is the ctx variable registered
3214  *      with struct wpa_driver_ops::init()
3215  * @src_addr: Source address of the EAPOL frame
3216  * @buf: EAPOL data starting from the EAPOL header (i.e., no Ethernet header)
3217  * @len: Length of the EAPOL data
3218  *
3219  * This function is called for each received EAPOL frame. Most driver
3220  * interfaces rely on more generic OS mechanism for receiving frames through
3221  * l2_packet, but if such a mechanism is not available, the driver wrapper may
3222  * take care of received EAPOL frames and deliver them to the core supplicant
3223  * code by calling this function.
3224  */
3225 void wpa_supplicant_rx_eapol(void *ctx, const u8 *src_addr,
3226                              const u8 *buf, size_t len)
3227 {
3228         struct wpa_supplicant *wpa_s = ctx;
3229
3230         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR, MAC2STR(src_addr));
3231         wpa_hexdump(MSG_MSGDUMP, "RX EAPOL", buf, len);
3232
3233 #ifdef CONFIG_PEERKEY
3234         if (wpa_s->wpa_state > WPA_ASSOCIATED && wpa_s->current_ssid &&
3235             wpa_s->current_ssid->peerkey &&
3236             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) &&
3237             wpa_sm_rx_eapol_peerkey(wpa_s->wpa, src_addr, buf, len) == 1) {
3238                 wpa_dbg(wpa_s, MSG_DEBUG, "RSN: Processed PeerKey EAPOL-Key");
3239                 return;
3240         }
3241 #endif /* CONFIG_PEERKEY */
3242
3243         if (wpa_s->wpa_state < WPA_ASSOCIATED ||
3244             (wpa_s->last_eapol_matches_bssid &&
3245 #ifdef CONFIG_AP
3246              !wpa_s->ap_iface &&
3247 #endif /* CONFIG_AP */
3248              os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) != 0)) {
3249                 /*
3250                  * There is possible race condition between receiving the
3251                  * association event and the EAPOL frame since they are coming
3252                  * through different paths from the driver. In order to avoid
3253                  * issues in trying to process the EAPOL frame before receiving
3254                  * association information, lets queue it for processing until
3255                  * the association event is received. This may also be needed in
3256                  * driver-based roaming case, so also use src_addr != BSSID as a
3257                  * trigger if we have previously confirmed that the
3258                  * Authenticator uses BSSID as the src_addr (which is not the
3259                  * case with wired IEEE 802.1X).
3260                  */
3261                 wpa_dbg(wpa_s, MSG_DEBUG, "Not associated - Delay processing "
3262                         "of received EAPOL frame (state=%s bssid=" MACSTR ")",
3263                         wpa_supplicant_state_txt(wpa_s->wpa_state),
3264                         MAC2STR(wpa_s->bssid));
3265                 wpabuf_free(wpa_s->pending_eapol_rx);
3266                 wpa_s->pending_eapol_rx = wpabuf_alloc_copy(buf, len);
3267                 if (wpa_s->pending_eapol_rx) {
3268                         os_get_reltime(&wpa_s->pending_eapol_rx_time);
3269                         os_memcpy(wpa_s->pending_eapol_rx_src, src_addr,
3270                                   ETH_ALEN);
3271                 }
3272                 return;
3273         }
3274
3275         wpa_s->last_eapol_matches_bssid =
3276                 os_memcmp(src_addr, wpa_s->bssid, ETH_ALEN) == 0;
3277
3278 #ifdef CONFIG_AP
3279         if (wpa_s->ap_iface) {
3280                 wpa_supplicant_ap_rx_eapol(wpa_s, src_addr, buf, len);
3281                 return;
3282         }
3283 #endif /* CONFIG_AP */
3284
3285         if (wpa_s->key_mgmt == WPA_KEY_MGMT_NONE) {
3286                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignored received EAPOL frame since "
3287                         "no key management is configured");
3288                 return;
3289         }
3290
3291         if (wpa_s->eapol_received == 0 &&
3292             (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE) ||
3293              !wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) ||
3294              wpa_s->wpa_state != WPA_COMPLETED) &&
3295             (wpa_s->current_ssid == NULL ||
3296              wpa_s->current_ssid->mode != IEEE80211_MODE_IBSS)) {
3297                 /* Timeout for completing IEEE 802.1X and WPA authentication */
3298                 int timeout = 10;
3299
3300                 if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) ||
3301                     wpa_s->key_mgmt == WPA_KEY_MGMT_IEEE8021X_NO_WPA ||
3302                     wpa_s->key_mgmt == WPA_KEY_MGMT_WPS) {
3303                         /* Use longer timeout for IEEE 802.1X/EAP */
3304                         timeout = 70;
3305                 }
3306
3307 #ifdef CONFIG_WPS
3308                 if (wpa_s->current_ssid && wpa_s->current_bss &&
3309                     (wpa_s->current_ssid->key_mgmt & WPA_KEY_MGMT_WPS) &&
3310                     eap_is_wps_pin_enrollee(&wpa_s->current_ssid->eap)) {
3311                         /*
3312                          * Use shorter timeout if going through WPS AP iteration
3313                          * for PIN config method with an AP that does not
3314                          * advertise Selected Registrar.
3315                          */
3316                         struct wpabuf *wps_ie;
3317
3318                         wps_ie = wpa_bss_get_vendor_ie_multi(
3319                                 wpa_s->current_bss, WPS_IE_VENDOR_TYPE);
3320                         if (wps_ie &&
3321                             !wps_is_addr_authorized(wps_ie, wpa_s->own_addr, 1))
3322                                 timeout = 10;
3323                         wpabuf_free(wps_ie);
3324                 }
3325 #endif /* CONFIG_WPS */
3326
3327                 wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0);
3328         }
3329         wpa_s->eapol_received++;
3330
3331         if (wpa_s->countermeasures) {
3332                 wpa_msg(wpa_s, MSG_INFO, "WPA: Countermeasures - dropped "
3333                         "EAPOL packet");
3334                 return;
3335         }
3336
3337 #ifdef CONFIG_IBSS_RSN
3338         if (wpa_s->current_ssid &&
3339             wpa_s->current_ssid->mode == WPAS_MODE_IBSS) {
3340                 ibss_rsn_rx_eapol(wpa_s->ibss_rsn, src_addr, buf, len);
3341                 return;
3342         }
3343 #endif /* CONFIG_IBSS_RSN */
3344
3345         /* Source address of the incoming EAPOL frame could be compared to the
3346          * current BSSID. However, it is possible that a centralized
3347          * Authenticator could be using another MAC address than the BSSID of
3348          * an AP, so just allow any address to be used for now. The replies are
3349          * still sent to the current BSSID (if available), though. */
3350
3351         os_memcpy(wpa_s->last_eapol_src, src_addr, ETH_ALEN);
3352         if (!wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt) &&
3353             eapol_sm_rx_eapol(wpa_s->eapol, src_addr, buf, len) > 0)
3354                 return;
3355         wpa_drv_poll(wpa_s);
3356         if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE))
3357                 wpa_sm_rx_eapol(wpa_s->wpa, src_addr, buf, len);
3358         else if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
3359                 /*
3360                  * Set portValid = TRUE here since we are going to skip 4-way
3361                  * handshake processing which would normally set portValid. We
3362                  * need this to allow the EAPOL state machines to be completed
3363                  * without going through EAPOL-Key handshake.
3364                  */
3365                 eapol_sm_notify_portValid(wpa_s->eapol, TRUE);
3366         }
3367 }
3368
3369
3370 int wpa_supplicant_update_mac_addr(struct wpa_supplicant *wpa_s)
3371 {
3372         if ((!wpa_s->p2p_mgmt ||
3373              !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
3374             !(wpa_s->drv_flags & WPA_DRIVER_FLAGS_P2P_DEDICATED_INTERFACE)) {
3375                 l2_packet_deinit(wpa_s->l2);
3376                 wpa_s->l2 = l2_packet_init(wpa_s->ifname,
3377                                            wpa_drv_get_mac_addr(wpa_s),
3378                                            ETH_P_EAPOL,
3379                                            wpa_supplicant_rx_eapol, wpa_s, 0);
3380                 if (wpa_s->l2 == NULL)
3381                         return -1;
3382         } else {
3383                 const u8 *addr = wpa_drv_get_mac_addr(wpa_s);
3384                 if (addr)
3385                         os_memcpy(wpa_s->own_addr, addr, ETH_ALEN);
3386         }
3387
3388         if (wpa_s->l2 && l2_packet_get_own_addr(wpa_s->l2, wpa_s->own_addr)) {
3389                 wpa_msg(wpa_s, MSG_ERROR, "Failed to get own L2 address");
3390                 return -1;
3391         }
3392
3393         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3394
3395         return 0;
3396 }
3397
3398
3399 static void wpa_supplicant_rx_eapol_bridge(void *ctx, const u8 *src_addr,
3400                                            const u8 *buf, size_t len)
3401 {
3402         struct wpa_supplicant *wpa_s = ctx;
3403         const struct l2_ethhdr *eth;
3404
3405         if (len < sizeof(*eth))
3406                 return;
3407         eth = (const struct l2_ethhdr *) buf;
3408
3409         if (os_memcmp(eth->h_dest, wpa_s->own_addr, ETH_ALEN) != 0 &&
3410             !(eth->h_dest[0] & 0x01)) {
3411                 wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3412                         " (bridge - not for this interface - ignore)",
3413                         MAC2STR(src_addr), MAC2STR(eth->h_dest));
3414                 return;
3415         }
3416
3417         wpa_dbg(wpa_s, MSG_DEBUG, "RX EAPOL from " MACSTR " to " MACSTR
3418                 " (bridge)", MAC2STR(src_addr), MAC2STR(eth->h_dest));
3419         wpa_supplicant_rx_eapol(wpa_s, src_addr, buf + sizeof(*eth),
3420                                 len - sizeof(*eth));
3421 }
3422
3423
3424 /**
3425  * wpa_supplicant_driver_init - Initialize driver interface parameters
3426  * @wpa_s: Pointer to wpa_supplicant data
3427  * Returns: 0 on success, -1 on failure
3428  *
3429  * This function is called to initialize driver interface parameters.
3430  * wpa_drv_init() must have been called before this function to initialize the
3431  * driver interface.
3432  */
3433 int wpa_supplicant_driver_init(struct wpa_supplicant *wpa_s)
3434 {
3435         static int interface_count = 0;
3436
3437         if (wpa_supplicant_update_mac_addr(wpa_s) < 0)
3438                 return -1;
3439
3440         wpa_dbg(wpa_s, MSG_DEBUG, "Own MAC address: " MACSTR,
3441                 MAC2STR(wpa_s->own_addr));
3442         os_memcpy(wpa_s->perm_addr, wpa_s->own_addr, ETH_ALEN);
3443         wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
3444
3445         if (wpa_s->bridge_ifname[0]) {
3446                 wpa_dbg(wpa_s, MSG_DEBUG, "Receiving packets from bridge "
3447                         "interface '%s'", wpa_s->bridge_ifname);
3448                 wpa_s->l2_br = l2_packet_init_bridge(
3449                         wpa_s->bridge_ifname, wpa_s->ifname, wpa_s->own_addr,
3450                         ETH_P_EAPOL, wpa_supplicant_rx_eapol_bridge, wpa_s, 1);
3451                 if (wpa_s->l2_br == NULL) {
3452                         wpa_msg(wpa_s, MSG_ERROR, "Failed to open l2_packet "
3453                                 "connection for the bridge interface '%s'",
3454                                 wpa_s->bridge_ifname);
3455                         return -1;
3456                 }
3457         }
3458
3459         if (wpa_s->conf->ap_scan == 2 &&
3460             os_strcmp(wpa_s->driver->name, "nl80211") == 0) {
3461                 wpa_printf(MSG_INFO,
3462                            "Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures");
3463         }
3464
3465         wpa_clear_keys(wpa_s, NULL);
3466
3467         /* Make sure that TKIP countermeasures are not left enabled (could
3468          * happen if wpa_supplicant is killed during countermeasures. */
3469         wpa_drv_set_countermeasures(wpa_s, 0);
3470
3471         wpa_dbg(wpa_s, MSG_DEBUG, "RSN: flushing PMKID list in the driver");
3472         wpa_drv_flush_pmkid(wpa_s);
3473
3474         wpa_s->prev_scan_ssid = WILDCARD_SSID_SCAN;
3475         wpa_s->prev_scan_wildcard = 0;
3476
3477         if (wpa_supplicant_enabled_networks(wpa_s)) {
3478                 if (wpa_s->wpa_state == WPA_INTERFACE_DISABLED) {
3479                         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
3480                         interface_count = 0;
3481                 }
3482 #ifndef ANDROID
3483                 if (!wpa_s->p2p_mgmt &&
3484                     wpa_supplicant_delayed_sched_scan(wpa_s,
3485                                                       interface_count % 3,
3486                                                       100000))
3487                         wpa_supplicant_req_scan(wpa_s, interface_count % 3,
3488                                                 100000);
3489 #endif /* ANDROID */
3490                 interface_count++;
3491         } else
3492                 wpa_supplicant_set_state(wpa_s, WPA_INACTIVE);
3493
3494         return 0;
3495 }
3496
3497
3498 static int wpa_supplicant_daemon(const char *pid_file)
3499 {
3500         wpa_printf(MSG_DEBUG, "Daemonize..");
3501         return os_daemonize(pid_file);
3502 }
3503
3504
3505 static struct wpa_supplicant *
3506 wpa_supplicant_alloc(struct wpa_supplicant *parent)
3507 {
3508         struct wpa_supplicant *wpa_s;
3509
3510         wpa_s = os_zalloc(sizeof(*wpa_s));
3511         if (wpa_s == NULL)
3512                 return NULL;
3513         wpa_s->scan_req = INITIAL_SCAN_REQ;
3514         wpa_s->scan_interval = 5;
3515         wpa_s->new_connection = 1;
3516         wpa_s->parent = parent ? parent : wpa_s;
3517         wpa_s->p2pdev = wpa_s->parent;
3518         wpa_s->sched_scanning = 0;
3519
3520         dl_list_init(&wpa_s->bss_tmp_disallowed);
3521
3522         return wpa_s;
3523 }
3524
3525
3526 #ifdef CONFIG_HT_OVERRIDES
3527
3528 static int wpa_set_htcap_mcs(struct wpa_supplicant *wpa_s,
3529                              struct ieee80211_ht_capabilities *htcaps,
3530                              struct ieee80211_ht_capabilities *htcaps_mask,
3531                              const char *ht_mcs)
3532 {
3533         /* parse ht_mcs into hex array */
3534         int i;
3535         const char *tmp = ht_mcs;
3536         char *end = NULL;
3537
3538         /* If ht_mcs is null, do not set anything */
3539         if (!ht_mcs)
3540                 return 0;
3541
3542         /* This is what we are setting in the kernel */
3543         os_memset(&htcaps->supported_mcs_set, 0, IEEE80211_HT_MCS_MASK_LEN);
3544
3545         wpa_msg(wpa_s, MSG_DEBUG, "set_htcap, ht_mcs -:%s:-", ht_mcs);
3546
3547         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3548                 errno = 0;
3549                 long v = strtol(tmp, &end, 16);
3550                 if (errno == 0) {
3551                         wpa_msg(wpa_s, MSG_DEBUG,
3552                                 "htcap value[%i]: %ld end: %p  tmp: %p",
3553                                 i, v, end, tmp);
3554                         if (end == tmp)
3555                                 break;
3556
3557                         htcaps->supported_mcs_set[i] = v;
3558                         tmp = end;
3559                 } else {
3560                         wpa_msg(wpa_s, MSG_ERROR,
3561                                 "Failed to parse ht-mcs: %s, error: %s\n",
3562                                 ht_mcs, strerror(errno));
3563                         return -1;
3564                 }
3565         }
3566
3567         /*
3568          * If we were able to parse any values, then set mask for the MCS set.
3569          */
3570         if (i) {
3571                 os_memset(&htcaps_mask->supported_mcs_set, 0xff,
3572                           IEEE80211_HT_MCS_MASK_LEN - 1);
3573                 /* skip the 3 reserved bits */
3574                 htcaps_mask->supported_mcs_set[IEEE80211_HT_MCS_MASK_LEN - 1] =
3575                         0x1f;
3576         }
3577
3578         return 0;
3579 }
3580
3581
3582 static int wpa_disable_max_amsdu(struct wpa_supplicant *wpa_s,
3583                                  struct ieee80211_ht_capabilities *htcaps,
3584                                  struct ieee80211_ht_capabilities *htcaps_mask,
3585                                  int disabled)
3586 {
3587         le16 msk;
3588
3589         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_max_amsdu: %d", disabled);
3590
3591         if (disabled == -1)
3592                 return 0;
3593
3594         msk = host_to_le16(HT_CAP_INFO_MAX_AMSDU_SIZE);
3595         htcaps_mask->ht_capabilities_info |= msk;
3596         if (disabled)
3597                 htcaps->ht_capabilities_info &= msk;
3598         else
3599                 htcaps->ht_capabilities_info |= msk;
3600
3601         return 0;
3602 }
3603
3604
3605 static int wpa_set_ampdu_factor(struct wpa_supplicant *wpa_s,
3606                                 struct ieee80211_ht_capabilities *htcaps,
3607                                 struct ieee80211_ht_capabilities *htcaps_mask,
3608                                 int factor)
3609 {
3610         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_factor: %d", factor);
3611
3612         if (factor == -1)
3613                 return 0;
3614
3615         if (factor < 0 || factor > 3) {
3616                 wpa_msg(wpa_s, MSG_ERROR, "ampdu_factor: %d out of range. "
3617                         "Must be 0-3 or -1", factor);
3618                 return -EINVAL;
3619         }
3620
3621         htcaps_mask->a_mpdu_params |= 0x3; /* 2 bits for factor */
3622         htcaps->a_mpdu_params &= ~0x3;
3623         htcaps->a_mpdu_params |= factor & 0x3;
3624
3625         return 0;
3626 }
3627
3628
3629 static int wpa_set_ampdu_density(struct wpa_supplicant *wpa_s,
3630                                  struct ieee80211_ht_capabilities *htcaps,
3631                                  struct ieee80211_ht_capabilities *htcaps_mask,
3632                                  int density)
3633 {
3634         wpa_msg(wpa_s, MSG_DEBUG, "set_ampdu_density: %d", density);
3635
3636         if (density == -1)
3637                 return 0;
3638
3639         if (density < 0 || density > 7) {
3640                 wpa_msg(wpa_s, MSG_ERROR,
3641                         "ampdu_density: %d out of range. Must be 0-7 or -1.",
3642                         density);
3643                 return -EINVAL;
3644         }
3645
3646         htcaps_mask->a_mpdu_params |= 0x1C;
3647         htcaps->a_mpdu_params &= ~(0x1C);
3648         htcaps->a_mpdu_params |= (density << 2) & 0x1C;
3649
3650         return 0;
3651 }
3652
3653
3654 static int wpa_set_disable_ht40(struct wpa_supplicant *wpa_s,
3655                                 struct ieee80211_ht_capabilities *htcaps,
3656                                 struct ieee80211_ht_capabilities *htcaps_mask,
3657                                 int disabled)
3658 {
3659         /* Masking these out disables HT40 */
3660         le16 msk = host_to_le16(HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET |
3661                                 HT_CAP_INFO_SHORT_GI40MHZ);
3662
3663         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ht40: %d", disabled);
3664
3665         if (disabled)
3666                 htcaps->ht_capabilities_info &= ~msk;
3667         else
3668                 htcaps->ht_capabilities_info |= msk;
3669
3670         htcaps_mask->ht_capabilities_info |= msk;
3671
3672         return 0;
3673 }
3674
3675
3676 static int wpa_set_disable_sgi(struct wpa_supplicant *wpa_s,
3677                                struct ieee80211_ht_capabilities *htcaps,
3678                                struct ieee80211_ht_capabilities *htcaps_mask,
3679                                int disabled)
3680 {
3681         /* Masking these out disables SGI */
3682         le16 msk = host_to_le16(HT_CAP_INFO_SHORT_GI20MHZ |
3683                                 HT_CAP_INFO_SHORT_GI40MHZ);
3684
3685         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_sgi: %d", disabled);
3686
3687         if (disabled)
3688                 htcaps->ht_capabilities_info &= ~msk;
3689         else
3690                 htcaps->ht_capabilities_info |= msk;
3691
3692         htcaps_mask->ht_capabilities_info |= msk;
3693
3694         return 0;
3695 }
3696
3697
3698 static int wpa_set_disable_ldpc(struct wpa_supplicant *wpa_s,
3699                                struct ieee80211_ht_capabilities *htcaps,
3700                                struct ieee80211_ht_capabilities *htcaps_mask,
3701                                int disabled)
3702 {
3703         /* Masking these out disables LDPC */
3704         le16 msk = host_to_le16(HT_CAP_INFO_LDPC_CODING_CAP);
3705
3706         wpa_msg(wpa_s, MSG_DEBUG, "set_disable_ldpc: %d", disabled);
3707
3708         if (disabled)
3709                 htcaps->ht_capabilities_info &= ~msk;
3710         else
3711                 htcaps->ht_capabilities_info |= msk;
3712
3713         htcaps_mask->ht_capabilities_info |= msk;
3714
3715         return 0;
3716 }
3717
3718
3719 void wpa_supplicant_apply_ht_overrides(
3720         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3721         struct wpa_driver_associate_params *params)
3722 {
3723         struct ieee80211_ht_capabilities *htcaps;
3724         struct ieee80211_ht_capabilities *htcaps_mask;
3725
3726         if (!ssid)
3727                 return;
3728
3729         params->disable_ht = ssid->disable_ht;
3730         if (!params->htcaps || !params->htcaps_mask)
3731                 return;
3732
3733         htcaps = (struct ieee80211_ht_capabilities *) params->htcaps;
3734         htcaps_mask = (struct ieee80211_ht_capabilities *) params->htcaps_mask;
3735         wpa_set_htcap_mcs(wpa_s, htcaps, htcaps_mask, ssid->ht_mcs);
3736         wpa_disable_max_amsdu(wpa_s, htcaps, htcaps_mask,
3737                               ssid->disable_max_amsdu);
3738         wpa_set_ampdu_factor(wpa_s, htcaps, htcaps_mask, ssid->ampdu_factor);
3739         wpa_set_ampdu_density(wpa_s, htcaps, htcaps_mask, ssid->ampdu_density);
3740         wpa_set_disable_ht40(wpa_s, htcaps, htcaps_mask, ssid->disable_ht40);
3741         wpa_set_disable_sgi(wpa_s, htcaps, htcaps_mask, ssid->disable_sgi);
3742         wpa_set_disable_ldpc(wpa_s, htcaps, htcaps_mask, ssid->disable_ldpc);
3743
3744         if (ssid->ht40_intolerant) {
3745                 le16 bit = host_to_le16(HT_CAP_INFO_40MHZ_INTOLERANT);
3746                 htcaps->ht_capabilities_info |= bit;
3747                 htcaps_mask->ht_capabilities_info |= bit;
3748         }
3749 }
3750
3751 #endif /* CONFIG_HT_OVERRIDES */
3752
3753
3754 #ifdef CONFIG_VHT_OVERRIDES
3755 void wpa_supplicant_apply_vht_overrides(
3756         struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid,
3757         struct wpa_driver_associate_params *params)
3758 {
3759         struct ieee80211_vht_capabilities *vhtcaps;
3760         struct ieee80211_vht_capabilities *vhtcaps_mask;
3761
3762         if (!ssid)
3763                 return;
3764
3765         params->disable_vht = ssid->disable_vht;
3766
3767         vhtcaps = (void *) params->vhtcaps;
3768         vhtcaps_mask = (void *) params->vhtcaps_mask;
3769
3770         if (!vhtcaps || !vhtcaps_mask)
3771                 return;
3772
3773         vhtcaps->vht_capabilities_info = ssid->vht_capa;
3774         vhtcaps_mask->vht_capabilities_info = ssid->vht_capa_mask;
3775
3776 #ifdef CONFIG_HT_OVERRIDES
3777         /* if max ampdu is <= 3, we have to make the HT cap the same */
3778         if (ssid->vht_capa_mask & VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) {
3779                 int max_ampdu;
3780
3781                 max_ampdu = (ssid->vht_capa &
3782                              VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX) >>
3783                         VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX_SHIFT;
3784
3785                 max_ampdu = max_ampdu < 3 ? max_ampdu : 3;
3786                 wpa_set_ampdu_factor(wpa_s,
3787                                      (void *) params->htcaps,
3788                                      (void *) params->htcaps_mask,
3789                                      max_ampdu);
3790         }
3791 #endif /* CONFIG_HT_OVERRIDES */
3792
3793 #define OVERRIDE_MCS(i)                                                 \
3794         if (ssid->vht_tx_mcs_nss_ ##i >= 0) {                           \
3795                 vhtcaps_mask->vht_supported_mcs_set.tx_map |=           \
3796                         3 << 2 * (i - 1);                               \
3797                 vhtcaps->vht_supported_mcs_set.tx_map |=                \
3798                         ssid->vht_tx_mcs_nss_ ##i << 2 * (i - 1);       \
3799         }                                                               \
3800         if (ssid->vht_rx_mcs_nss_ ##i >= 0) {                           \
3801                 vhtcaps_mask->vht_supported_mcs_set.rx_map |=           \
3802                         3 << 2 * (i - 1);                               \
3803                 vhtcaps->vht_supported_mcs_set.rx_map |=                \
3804                         ssid->vht_rx_mcs_nss_ ##i << 2 * (i - 1);       \
3805         }
3806
3807         OVERRIDE_MCS(1);
3808         OVERRIDE_MCS(2);
3809         OVERRIDE_MCS(3);
3810         OVERRIDE_MCS(4);
3811         OVERRIDE_MCS(5);
3812         OVERRIDE_MCS(6);
3813         OVERRIDE_MCS(7);
3814         OVERRIDE_MCS(8);
3815 }
3816 #endif /* CONFIG_VHT_OVERRIDES */
3817
3818
3819 static int pcsc_reader_init(struct wpa_supplicant *wpa_s)
3820 {
3821 #ifdef PCSC_FUNCS
3822         size_t len;
3823
3824         if (!wpa_s->conf->pcsc_reader)
3825                 return 0;
3826
3827         wpa_s->scard = scard_init(wpa_s->conf->pcsc_reader);
3828         if (!wpa_s->scard)
3829                 return 1;
3830
3831         if (wpa_s->conf->pcsc_pin &&
3832             scard_set_pin(wpa_s->scard, wpa_s->conf->pcsc_pin) < 0) {
3833                 scard_deinit(wpa_s->scard);
3834                 wpa_s->scard = NULL;
3835                 wpa_msg(wpa_s, MSG_ERROR, "PC/SC PIN validation failed");
3836                 return -1;
3837         }
3838
3839         len = sizeof(wpa_s->imsi) - 1;
3840         if (scard_get_imsi(wpa_s->scard, wpa_s->imsi, &len)) {
3841                 scard_deinit(wpa_s->scard);
3842                 wpa_s->scard = NULL;
3843                 wpa_msg(wpa_s, MSG_ERROR, "Could not read IMSI");
3844                 return -1;
3845         }
3846         wpa_s->imsi[len] = '\0';
3847
3848         wpa_s->mnc_len = scard_get_mnc_len(wpa_s->scard);
3849
3850         wpa_printf(MSG_DEBUG, "SCARD: IMSI %s (MNC length %d)",
3851                    wpa_s->imsi, wpa_s->mnc_len);
3852
3853         wpa_sm_set_scard_ctx(wpa_s->wpa, wpa_s->scard);
3854         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
3855 #endif /* PCSC_FUNCS */
3856
3857         return 0;
3858 }
3859
3860
3861 int wpas_init_ext_pw(struct wpa_supplicant *wpa_s)
3862 {
3863         char *val, *pos;
3864
3865         ext_password_deinit(wpa_s->ext_pw);
3866         wpa_s->ext_pw = NULL;
3867         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, NULL);
3868
3869         if (!wpa_s->conf->ext_password_backend)
3870                 return 0;
3871
3872         val = os_strdup(wpa_s->conf->ext_password_backend);
3873         if (val == NULL)
3874                 return -1;
3875         pos = os_strchr(val, ':');
3876         if (pos)
3877                 *pos++ = '\0';
3878
3879         wpa_printf(MSG_DEBUG, "EXT PW: Initialize backend '%s'", val);
3880
3881         wpa_s->ext_pw = ext_password_init(val, pos);
3882         os_free(val);
3883         if (wpa_s->ext_pw == NULL) {
3884                 wpa_printf(MSG_DEBUG, "EXT PW: Failed to initialize backend");
3885                 return -1;
3886         }
3887         eapol_sm_set_ext_pw_ctx(wpa_s->eapol, wpa_s->ext_pw);
3888
3889         return 0;
3890 }
3891
3892
3893 #ifdef CONFIG_FST
3894
3895 static const u8 * wpas_fst_get_bssid_cb(void *ctx)
3896 {
3897         struct wpa_supplicant *wpa_s = ctx;
3898
3899         return (is_zero_ether_addr(wpa_s->bssid) ||
3900                 wpa_s->wpa_state != WPA_COMPLETED) ? NULL : wpa_s->bssid;
3901 }
3902
3903
3904 static void wpas_fst_get_channel_info_cb(void *ctx,
3905                                          enum hostapd_hw_mode *hw_mode,
3906                                          u8 *channel)
3907 {
3908         struct wpa_supplicant *wpa_s = ctx;
3909
3910         if (wpa_s->current_bss) {
3911                 *hw_mode = ieee80211_freq_to_chan(wpa_s->current_bss->freq,
3912                                                   channel);
3913         } else if (wpa_s->hw.num_modes) {
3914                 *hw_mode = wpa_s->hw.modes[0].mode;
3915         } else {
3916                 WPA_ASSERT(0);
3917                 *hw_mode = 0;
3918         }
3919 }
3920
3921
3922 static int wpas_fst_get_hw_modes(void *ctx, struct hostapd_hw_modes **modes)
3923 {
3924         struct wpa_supplicant *wpa_s = ctx;
3925
3926         *modes = wpa_s->hw.modes;
3927         return wpa_s->hw.num_modes;
3928 }
3929
3930
3931 static void wpas_fst_set_ies_cb(void *ctx, const struct wpabuf *fst_ies)
3932 {
3933         struct wpa_supplicant *wpa_s = ctx;
3934
3935         wpa_hexdump_buf(MSG_DEBUG, "FST: Set IEs", fst_ies);
3936         wpa_s->fst_ies = fst_ies;
3937 }
3938
3939
3940 static int wpas_fst_send_action_cb(void *ctx, const u8 *da, struct wpabuf *data)
3941 {
3942         struct wpa_supplicant *wpa_s = ctx;
3943
3944         WPA_ASSERT(os_memcmp(wpa_s->bssid, da, ETH_ALEN) == 0);
3945         return wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
3946                                           wpa_s->own_addr, wpa_s->bssid,
3947                                           wpabuf_head(data), wpabuf_len(data),
3948                                    0);
3949 }
3950
3951
3952 static const struct wpabuf * wpas_fst_get_mb_ie_cb(void *ctx, const u8 *addr)
3953 {
3954         struct wpa_supplicant *wpa_s = ctx;
3955
3956         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3957         return wpa_s->received_mb_ies;
3958 }
3959
3960
3961 static void wpas_fst_update_mb_ie_cb(void *ctx, const u8 *addr,
3962                                      const u8 *buf, size_t size)
3963 {
3964         struct wpa_supplicant *wpa_s = ctx;
3965         struct mb_ies_info info;
3966
3967         WPA_ASSERT(os_memcmp(wpa_s->bssid, addr, ETH_ALEN) == 0);
3968
3969         if (!mb_ies_info_by_ies(&info, buf, size)) {
3970                 wpabuf_free(wpa_s->received_mb_ies);
3971                 wpa_s->received_mb_ies = mb_ies_by_info(&info);
3972         }
3973 }
3974
3975
3976 const u8 * wpas_fst_get_peer_first(void *ctx, struct fst_get_peer_ctx **get_ctx,
3977                                    Boolean mb_only)
3978 {
3979         struct wpa_supplicant *wpa_s = ctx;
3980
3981         *get_ctx = NULL;
3982         if (!is_zero_ether_addr(wpa_s->bssid))
3983                 return (wpa_s->received_mb_ies || !mb_only) ?
3984                         wpa_s->bssid : NULL;
3985         return NULL;
3986 }
3987
3988
3989 const u8 * wpas_fst_get_peer_next(void *ctx, struct fst_get_peer_ctx **get_ctx,
3990                                   Boolean mb_only)
3991 {
3992         return NULL;
3993 }
3994
3995 void fst_wpa_supplicant_fill_iface_obj(struct wpa_supplicant *wpa_s,
3996                                        struct fst_wpa_obj *iface_obj)
3997 {
3998         iface_obj->ctx              = wpa_s;
3999         iface_obj->get_bssid        = wpas_fst_get_bssid_cb;
4000         iface_obj->get_channel_info = wpas_fst_get_channel_info_cb;
4001         iface_obj->get_hw_modes     = wpas_fst_get_hw_modes;
4002         iface_obj->set_ies          = wpas_fst_set_ies_cb;
4003         iface_obj->send_action      = wpas_fst_send_action_cb;
4004         iface_obj->get_mb_ie        = wpas_fst_get_mb_ie_cb;
4005         iface_obj->update_mb_ie     = wpas_fst_update_mb_ie_cb;
4006         iface_obj->get_peer_first   = wpas_fst_get_peer_first;
4007         iface_obj->get_peer_next    = wpas_fst_get_peer_next;
4008 }
4009 #endif /* CONFIG_FST */
4010
4011 static int wpas_set_wowlan_triggers(struct wpa_supplicant *wpa_s,
4012                                     const struct wpa_driver_capa *capa)
4013 {
4014         struct wowlan_triggers *triggers;
4015         int ret = 0;
4016
4017         if (!wpa_s->conf->wowlan_triggers)
4018                 return 0;
4019
4020         triggers = wpa_get_wowlan_triggers(wpa_s->conf->wowlan_triggers, capa);
4021         if (triggers) {
4022                 ret = wpa_drv_wowlan(wpa_s, triggers);
4023                 os_free(triggers);
4024         }
4025         return ret;
4026 }
4027
4028
4029 enum wpa_radio_work_band wpas_freq_to_band(int freq)
4030 {
4031         if (freq < 3000)
4032                 return BAND_2_4_GHZ;
4033         if (freq > 50000)
4034                 return BAND_60_GHZ;
4035         return BAND_5_GHZ;
4036 }
4037
4038
4039 unsigned int wpas_get_bands(struct wpa_supplicant *wpa_s, const int *freqs)
4040 {
4041         int i;
4042         unsigned int band = 0;
4043
4044         if (freqs) {
4045                 /* freqs are specified for the radio work */
4046                 for (i = 0; freqs[i]; i++)
4047                         band |= wpas_freq_to_band(freqs[i]);
4048         } else {
4049                 /*
4050                  * freqs are not specified, implies all
4051                  * the supported freqs by HW
4052                  */
4053                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4054                         if (wpa_s->hw.modes[i].num_channels != 0) {
4055                                 if (wpa_s->hw.modes[i].mode ==
4056                                     HOSTAPD_MODE_IEEE80211B ||
4057                                     wpa_s->hw.modes[i].mode ==
4058                                     HOSTAPD_MODE_IEEE80211G)
4059                                         band |= BAND_2_4_GHZ;
4060                                 else if (wpa_s->hw.modes[i].mode ==
4061                                          HOSTAPD_MODE_IEEE80211A)
4062                                         band |= BAND_5_GHZ;
4063                                 else if (wpa_s->hw.modes[i].mode ==
4064                                          HOSTAPD_MODE_IEEE80211AD)
4065                                         band |= BAND_60_GHZ;
4066                                 else if (wpa_s->hw.modes[i].mode ==
4067                                          HOSTAPD_MODE_IEEE80211ANY)
4068                                         band = BAND_2_4_GHZ | BAND_5_GHZ |
4069                                                 BAND_60_GHZ;
4070                         }
4071                 }
4072         }
4073
4074         return band;
4075 }
4076
4077
4078 static struct wpa_radio * radio_add_interface(struct wpa_supplicant *wpa_s,
4079                                               const char *rn)
4080 {
4081         struct wpa_supplicant *iface = wpa_s->global->ifaces;
4082         struct wpa_radio *radio;
4083
4084         while (rn && iface) {
4085                 radio = iface->radio;
4086                 if (radio && os_strcmp(rn, radio->name) == 0) {
4087                         wpa_printf(MSG_DEBUG, "Add interface %s to existing radio %s",
4088                                    wpa_s->ifname, rn);
4089                         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4090                         return radio;
4091                 }
4092
4093                 iface = iface->next;
4094         }
4095
4096         wpa_printf(MSG_DEBUG, "Add interface %s to a new radio %s",
4097                    wpa_s->ifname, rn ? rn : "N/A");
4098         radio = os_zalloc(sizeof(*radio));
4099         if (radio == NULL)
4100                 return NULL;
4101
4102         if (rn)
4103                 os_strlcpy(radio->name, rn, sizeof(radio->name));
4104         dl_list_init(&radio->ifaces);
4105         dl_list_init(&radio->work);
4106         dl_list_add(&radio->ifaces, &wpa_s->radio_list);
4107
4108         return radio;
4109 }
4110
4111
4112 static void radio_work_free(struct wpa_radio_work *work)
4113 {
4114         if (work->wpa_s->scan_work == work) {
4115                 /* This should not really happen. */
4116                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as scan_work",
4117                         work->type, work, work->started);
4118                 work->wpa_s->scan_work = NULL;
4119         }
4120
4121 #ifdef CONFIG_P2P
4122         if (work->wpa_s->p2p_scan_work == work) {
4123                 /* This should not really happen. */
4124                 wpa_dbg(work->wpa_s, MSG_INFO, "Freeing radio work '%s'@%p (started=%d) that is marked as p2p_scan_work",
4125                         work->type, work, work->started);
4126                 work->wpa_s->p2p_scan_work = NULL;
4127         }
4128 #endif /* CONFIG_P2P */
4129
4130         if (work->started) {
4131                 work->wpa_s->radio->num_active_works--;
4132                 wpa_dbg(work->wpa_s, MSG_DEBUG,
4133                         "radio_work_free('%s'@%p: num_active_works --> %u",
4134                         work->type, work,
4135                         work->wpa_s->radio->num_active_works);
4136         }
4137
4138         dl_list_del(&work->list);
4139         os_free(work);
4140 }
4141
4142
4143 static struct wpa_radio_work * radio_work_get_next_work(struct wpa_radio *radio)
4144 {
4145         struct wpa_radio_work *active_work = NULL;
4146         struct wpa_radio_work *tmp;
4147
4148         /* Get the active work to know the type and band. */
4149         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4150                 if (tmp->started) {
4151                         active_work = tmp;
4152                         break;
4153                 }
4154         }
4155
4156         if (!active_work) {
4157                 /* No active work, start one */
4158                 radio->num_active_works = 0;
4159                 dl_list_for_each(tmp, &radio->work, struct wpa_radio_work,
4160                                  list) {
4161                         if (os_strcmp(tmp->type, "scan") == 0 &&
4162                             radio->external_scan_running &&
4163                             (((struct wpa_driver_scan_params *)
4164                               tmp->ctx)->only_new_results ||
4165                              tmp->wpa_s->clear_driver_scan_cache))
4166                                 continue;
4167                         return tmp;
4168                 }
4169                 return NULL;
4170         }
4171
4172         if (os_strcmp(active_work->type, "sme-connect") == 0 ||
4173             os_strcmp(active_work->type, "connect") == 0) {
4174                 /*
4175                  * If the active work is either connect or sme-connect,
4176                  * do not parallelize them with other radio works.
4177                  */
4178                 wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4179                         "Do not parallelize radio work with %s",
4180                         active_work->type);
4181                 return NULL;
4182         }
4183
4184         dl_list_for_each(tmp, &radio->work, struct wpa_radio_work, list) {
4185                 if (tmp->started)
4186                         continue;
4187
4188                 /*
4189                  * If connect or sme-connect are enqueued, parallelize only
4190                  * those operations ahead of them in the queue.
4191                  */
4192                 if (os_strcmp(tmp->type, "connect") == 0 ||
4193                     os_strcmp(tmp->type, "sme-connect") == 0)
4194                         break;
4195
4196                 /*
4197                  * Check that the radio works are distinct and
4198                  * on different bands.
4199                  */
4200                 if (os_strcmp(active_work->type, tmp->type) != 0 &&
4201                     (active_work->bands != tmp->bands)) {
4202                         /*
4203                          * If a scan has to be scheduled through nl80211 scan
4204                          * interface and if an external scan is already running,
4205                          * do not schedule the scan since it is likely to get
4206                          * rejected by kernel.
4207                          */
4208                         if (os_strcmp(tmp->type, "scan") == 0 &&
4209                             radio->external_scan_running &&
4210                             (((struct wpa_driver_scan_params *)
4211                               tmp->ctx)->only_new_results ||
4212                              tmp->wpa_s->clear_driver_scan_cache))
4213                                 continue;
4214
4215                         wpa_dbg(active_work->wpa_s, MSG_DEBUG,
4216                                 "active_work:%s new_work:%s",
4217                                 active_work->type, tmp->type);
4218                         return tmp;
4219                 }
4220         }
4221
4222         /* Did not find a radio work to schedule in parallel. */
4223         return NULL;
4224 }
4225
4226
4227 static void radio_start_next_work(void *eloop_ctx, void *timeout_ctx)
4228 {
4229         struct wpa_radio *radio = eloop_ctx;
4230         struct wpa_radio_work *work;
4231         struct os_reltime now, diff;
4232         struct wpa_supplicant *wpa_s;
4233
4234         work = dl_list_first(&radio->work, struct wpa_radio_work, list);
4235         if (work == NULL) {
4236                 radio->num_active_works = 0;
4237                 return;
4238         }
4239
4240         wpa_s = dl_list_first(&radio->ifaces, struct wpa_supplicant,
4241                               radio_list);
4242
4243         if (!(wpa_s &&
4244               wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)) {
4245                 if (work->started)
4246                         return; /* already started and still in progress */
4247
4248                 if (wpa_s && wpa_s->radio->external_scan_running) {
4249                         wpa_printf(MSG_DEBUG, "Delay radio work start until externally triggered scan completes");
4250                         return;
4251                 }
4252         } else {
4253                 work = NULL;
4254                 if (radio->num_active_works < MAX_ACTIVE_WORKS) {
4255                         /* get the work to schedule next */
4256                         work = radio_work_get_next_work(radio);
4257                 }
4258                 if (!work)
4259                         return;
4260         }
4261
4262         wpa_s = work->wpa_s;
4263         os_get_reltime(&now);
4264         os_reltime_sub(&now, &work->time, &diff);
4265         wpa_dbg(wpa_s, MSG_DEBUG,
4266                 "Starting radio work '%s'@%p after %ld.%06ld second wait",
4267                 work->type, work, diff.sec, diff.usec);
4268         work->started = 1;
4269         work->time = now;
4270         radio->num_active_works++;
4271
4272         work->cb(work, 0);
4273
4274         if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS) &&
4275             radio->num_active_works < MAX_ACTIVE_WORKS)
4276                 radio_work_check_next(wpa_s);
4277 }
4278
4279
4280 /*
4281  * This function removes both started and pending radio works running on
4282  * the provided interface's radio.
4283  * Prior to the removal of the radio work, its callback (cb) is called with
4284  * deinit set to be 1. Each work's callback is responsible for clearing its
4285  * internal data and restoring to a correct state.
4286  * @wpa_s: wpa_supplicant data
4287  * @type: type of works to be removed
4288  * @remove_all: 1 to remove all the works on this radio, 0 to remove only
4289  * this interface's works.
4290  */
4291 void radio_remove_works(struct wpa_supplicant *wpa_s,
4292                         const char *type, int remove_all)
4293 {
4294         struct wpa_radio_work *work, *tmp;
4295         struct wpa_radio *radio = wpa_s->radio;
4296
4297         dl_list_for_each_safe(work, tmp, &radio->work, struct wpa_radio_work,
4298                               list) {
4299                 if (type && os_strcmp(type, work->type) != 0)
4300                         continue;
4301
4302                 /* skip other ifaces' works */
4303                 if (!remove_all && work->wpa_s != wpa_s)
4304                         continue;
4305
4306                 wpa_dbg(wpa_s, MSG_DEBUG, "Remove radio work '%s'@%p%s",
4307                         work->type, work, work->started ? " (started)" : "");
4308                 work->cb(work, 1);
4309                 radio_work_free(work);
4310         }
4311
4312         /* in case we removed the started work */
4313         radio_work_check_next(wpa_s);
4314 }
4315
4316
4317 static void radio_remove_interface(struct wpa_supplicant *wpa_s)
4318 {
4319         struct wpa_radio *radio = wpa_s->radio;
4320
4321         if (!radio)
4322                 return;
4323
4324         wpa_printf(MSG_DEBUG, "Remove interface %s from radio %s",
4325                    wpa_s->ifname, radio->name);
4326         dl_list_del(&wpa_s->radio_list);
4327         radio_remove_works(wpa_s, NULL, 0);
4328         wpa_s->radio = NULL;
4329         if (!dl_list_empty(&radio->ifaces))
4330                 return; /* Interfaces remain for this radio */
4331
4332         wpa_printf(MSG_DEBUG, "Remove radio %s", radio->name);
4333         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4334         os_free(radio);
4335 }
4336
4337
4338 void radio_work_check_next(struct wpa_supplicant *wpa_s)
4339 {
4340         struct wpa_radio *radio = wpa_s->radio;
4341
4342         if (dl_list_empty(&radio->work))
4343                 return;
4344         if (wpa_s->ext_work_in_progress) {
4345                 wpa_printf(MSG_DEBUG,
4346                            "External radio work in progress - delay start of pending item");
4347                 return;
4348         }
4349         eloop_cancel_timeout(radio_start_next_work, radio, NULL);
4350         eloop_register_timeout(0, 0, radio_start_next_work, radio, NULL);
4351 }
4352
4353
4354 /**
4355  * radio_add_work - Add a radio work item
4356  * @wpa_s: Pointer to wpa_supplicant data
4357  * @freq: Frequency of the offchannel operation in MHz or 0
4358  * @type: Unique identifier for each type of work
4359  * @next: Force as the next work to be executed
4360  * @cb: Callback function for indicating when radio is available
4361  * @ctx: Context pointer for the work (work->ctx in cb())
4362  * Returns: 0 on success, -1 on failure
4363  *
4364  * This function is used to request time for an operation that requires
4365  * exclusive radio control. Once the radio is available, the registered callback
4366  * function will be called. radio_work_done() must be called once the exclusive
4367  * radio operation has been completed, so that the radio is freed for other
4368  * operations. The special case of deinit=1 is used to free the context data
4369  * during interface removal. That does not allow the callback function to start
4370  * the radio operation, i.e., it must free any resources allocated for the radio
4371  * work and return.
4372  *
4373  * The @freq parameter can be used to indicate a single channel on which the
4374  * offchannel operation will occur. This may allow multiple radio work
4375  * operations to be performed in parallel if they apply for the same channel.
4376  * Setting this to 0 indicates that the work item may use multiple channels or
4377  * requires exclusive control of the radio.
4378  */
4379 int radio_add_work(struct wpa_supplicant *wpa_s, unsigned int freq,
4380                    const char *type, int next,
4381                    void (*cb)(struct wpa_radio_work *work, int deinit),
4382                    void *ctx)
4383 {
4384         struct wpa_radio *radio = wpa_s->radio;
4385         struct wpa_radio_work *work;
4386         int was_empty;
4387
4388         work = os_zalloc(sizeof(*work));
4389         if (work == NULL)
4390                 return -1;
4391         wpa_dbg(wpa_s, MSG_DEBUG, "Add radio work '%s'@%p", type, work);
4392         os_get_reltime(&work->time);
4393         work->freq = freq;
4394         work->type = type;
4395         work->wpa_s = wpa_s;
4396         work->cb = cb;
4397         work->ctx = ctx;
4398
4399         if (freq)
4400                 work->bands = wpas_freq_to_band(freq);
4401         else if (os_strcmp(type, "scan") == 0 ||
4402                  os_strcmp(type, "p2p-scan") == 0)
4403                 work->bands = wpas_get_bands(wpa_s,
4404                                              ((struct wpa_driver_scan_params *)
4405                                               ctx)->freqs);
4406         else
4407                 work->bands = wpas_get_bands(wpa_s, NULL);
4408
4409         was_empty = dl_list_empty(&wpa_s->radio->work);
4410         if (next)
4411                 dl_list_add(&wpa_s->radio->work, &work->list);
4412         else
4413                 dl_list_add_tail(&wpa_s->radio->work, &work->list);
4414         if (was_empty) {
4415                 wpa_dbg(wpa_s, MSG_DEBUG, "First radio work item in the queue - schedule start immediately");
4416                 radio_work_check_next(wpa_s);
4417         } else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS)
4418                    && radio->num_active_works < MAX_ACTIVE_WORKS) {
4419                 wpa_dbg(wpa_s, MSG_DEBUG,
4420                         "Try to schedule a radio work (num_active_works=%u)",
4421                         radio->num_active_works);
4422                 radio_work_check_next(wpa_s);
4423         }
4424
4425         return 0;
4426 }
4427
4428
4429 /**
4430  * radio_work_done - Indicate that a radio work item has been completed
4431  * @work: Completed work
4432  *
4433  * This function is called once the callback function registered with
4434  * radio_add_work() has completed its work.
4435  */
4436 void radio_work_done(struct wpa_radio_work *work)
4437 {
4438         struct wpa_supplicant *wpa_s = work->wpa_s;
4439         struct os_reltime now, diff;
4440         unsigned int started = work->started;
4441
4442         os_get_reltime(&now);
4443         os_reltime_sub(&now, &work->time, &diff);
4444         wpa_dbg(wpa_s, MSG_DEBUG, "Radio work '%s'@%p %s in %ld.%06ld seconds",
4445                 work->type, work, started ? "done" : "canceled",
4446                 diff.sec, diff.usec);
4447         radio_work_free(work);
4448         if (started)
4449                 radio_work_check_next(wpa_s);
4450 }
4451
4452
4453 struct wpa_radio_work *
4454 radio_work_pending(struct wpa_supplicant *wpa_s, const char *type)
4455 {
4456         struct wpa_radio_work *work;
4457         struct wpa_radio *radio = wpa_s->radio;
4458
4459         dl_list_for_each(work, &radio->work, struct wpa_radio_work, list) {
4460                 if (work->wpa_s == wpa_s && os_strcmp(work->type, type) == 0)
4461                         return work;
4462         }
4463
4464         return NULL;
4465 }
4466
4467
4468 static int wpas_init_driver(struct wpa_supplicant *wpa_s,
4469                             struct wpa_interface *iface)
4470 {
4471         const char *ifname, *driver, *rn;
4472
4473         driver = iface->driver;
4474 next_driver:
4475         if (wpa_supplicant_set_driver(wpa_s, driver) < 0)
4476                 return -1;
4477
4478         wpa_s->drv_priv = wpa_drv_init(wpa_s, wpa_s->ifname);
4479         if (wpa_s->drv_priv == NULL) {
4480                 const char *pos;
4481                 pos = driver ? os_strchr(driver, ',') : NULL;
4482                 if (pos) {
4483                         wpa_dbg(wpa_s, MSG_DEBUG, "Failed to initialize "
4484                                 "driver interface - try next driver wrapper");
4485                         driver = pos + 1;
4486                         goto next_driver;
4487                 }
4488                 wpa_msg(wpa_s, MSG_ERROR, "Failed to initialize driver "
4489                         "interface");
4490                 return -1;
4491         }
4492         if (wpa_drv_set_param(wpa_s, wpa_s->conf->driver_param) < 0) {
4493                 wpa_msg(wpa_s, MSG_ERROR, "Driver interface rejected "
4494                         "driver_param '%s'", wpa_s->conf->driver_param);
4495                 return -1;
4496         }
4497
4498         ifname = wpa_drv_get_ifname(wpa_s);
4499         if (ifname && os_strcmp(ifname, wpa_s->ifname) != 0) {
4500                 wpa_dbg(wpa_s, MSG_DEBUG, "Driver interface replaced "
4501                         "interface name with '%s'", ifname);
4502                 os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
4503         }
4504
4505         rn = wpa_driver_get_radio_name(wpa_s);
4506         if (rn && rn[0] == '\0')
4507                 rn = NULL;
4508
4509         wpa_s->radio = radio_add_interface(wpa_s, rn);
4510         if (wpa_s->radio == NULL)
4511                 return -1;
4512
4513         return 0;
4514 }
4515
4516
4517 static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
4518                                      struct wpa_interface *iface)
4519 {
4520         struct wpa_driver_capa capa;
4521         int capa_res;
4522
4523         wpa_printf(MSG_DEBUG, "Initializing interface '%s' conf '%s' driver "
4524                    "'%s' ctrl_interface '%s' bridge '%s'", iface->ifname,
4525                    iface->confname ? iface->confname : "N/A",
4526                    iface->driver ? iface->driver : "default",
4527                    iface->ctrl_interface ? iface->ctrl_interface : "N/A",
4528                    iface->bridge_ifname ? iface->bridge_ifname : "N/A");
4529
4530         if (iface->confname) {
4531 #ifdef CONFIG_BACKEND_FILE
4532                 wpa_s->confname = os_rel2abs_path(iface->confname);
4533                 if (wpa_s->confname == NULL) {
4534                         wpa_printf(MSG_ERROR, "Failed to get absolute path "
4535                                    "for configuration file '%s'.",
4536                                    iface->confname);
4537                         return -1;
4538                 }
4539                 wpa_printf(MSG_DEBUG, "Configuration file '%s' -> '%s'",
4540                            iface->confname, wpa_s->confname);
4541 #else /* CONFIG_BACKEND_FILE */
4542                 wpa_s->confname = os_strdup(iface->confname);
4543 #endif /* CONFIG_BACKEND_FILE */
4544                 wpa_s->conf = wpa_config_read(wpa_s->confname, NULL);
4545                 if (wpa_s->conf == NULL) {
4546                         wpa_printf(MSG_ERROR, "Failed to read or parse "
4547                                    "configuration '%s'.", wpa_s->confname);
4548                         return -1;
4549                 }
4550                 wpa_s->confanother = os_rel2abs_path(iface->confanother);
4551                 wpa_config_read(wpa_s->confanother, wpa_s->conf);
4552
4553                 /*
4554                  * Override ctrl_interface and driver_param if set on command
4555                  * line.
4556                  */
4557                 if (iface->ctrl_interface) {
4558                         os_free(wpa_s->conf->ctrl_interface);
4559                         wpa_s->conf->ctrl_interface =
4560                                 os_strdup(iface->ctrl_interface);
4561                 }
4562
4563                 if (iface->driver_param) {
4564                         os_free(wpa_s->conf->driver_param);
4565                         wpa_s->conf->driver_param =
4566                                 os_strdup(iface->driver_param);
4567                 }
4568
4569                 if (iface->p2p_mgmt && !iface->ctrl_interface) {
4570                         os_free(wpa_s->conf->ctrl_interface);
4571                         wpa_s->conf->ctrl_interface = NULL;
4572                 }
4573         } else
4574                 wpa_s->conf = wpa_config_alloc_empty(iface->ctrl_interface,
4575                                                      iface->driver_param);
4576
4577         if (wpa_s->conf == NULL) {
4578                 wpa_printf(MSG_ERROR, "\nNo configuration found.");
4579                 return -1;
4580         }
4581
4582         if (iface->ifname == NULL) {
4583                 wpa_printf(MSG_ERROR, "\nInterface name is required.");
4584                 return -1;
4585         }
4586         if (os_strlen(iface->ifname) >= sizeof(wpa_s->ifname)) {
4587                 wpa_printf(MSG_ERROR, "\nToo long interface name '%s'.",
4588                            iface->ifname);
4589                 return -1;
4590         }
4591         os_strlcpy(wpa_s->ifname, iface->ifname, sizeof(wpa_s->ifname));
4592
4593         if (iface->bridge_ifname) {
4594                 if (os_strlen(iface->bridge_ifname) >=
4595                     sizeof(wpa_s->bridge_ifname)) {
4596                         wpa_printf(MSG_ERROR, "\nToo long bridge interface "
4597                                    "name '%s'.", iface->bridge_ifname);
4598                         return -1;
4599                 }
4600                 os_strlcpy(wpa_s->bridge_ifname, iface->bridge_ifname,
4601                            sizeof(wpa_s->bridge_ifname));
4602         }
4603
4604         /* RSNA Supplicant Key Management - INITIALIZE */
4605         eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
4606         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
4607
4608         /* Initialize driver interface and register driver event handler before
4609          * L2 receive handler so that association events are processed before
4610          * EAPOL-Key packets if both become available for the same select()
4611          * call. */
4612         if (wpas_init_driver(wpa_s, iface) < 0)
4613                 return -1;
4614
4615         if (wpa_supplicant_init_wpa(wpa_s) < 0)
4616                 return -1;
4617
4618         wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname,
4619                           wpa_s->bridge_ifname[0] ? wpa_s->bridge_ifname :
4620                           NULL);
4621         wpa_sm_set_fast_reauth(wpa_s->wpa, wpa_s->conf->fast_reauth);
4622
4623         if (wpa_s->conf->dot11RSNAConfigPMKLifetime &&
4624             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_LIFETIME,
4625                              wpa_s->conf->dot11RSNAConfigPMKLifetime)) {
4626                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4627                         "dot11RSNAConfigPMKLifetime");
4628                 return -1;
4629         }
4630
4631         if (wpa_s->conf->dot11RSNAConfigPMKReauthThreshold &&
4632             wpa_sm_set_param(wpa_s->wpa, RSNA_PMK_REAUTH_THRESHOLD,
4633                              wpa_s->conf->dot11RSNAConfigPMKReauthThreshold)) {
4634                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4635                         "dot11RSNAConfigPMKReauthThreshold");
4636                 return -1;
4637         }
4638
4639         if (wpa_s->conf->dot11RSNAConfigSATimeout &&
4640             wpa_sm_set_param(wpa_s->wpa, RSNA_SA_TIMEOUT,
4641                              wpa_s->conf->dot11RSNAConfigSATimeout)) {
4642                 wpa_msg(wpa_s, MSG_ERROR, "Invalid WPA parameter value for "
4643                         "dot11RSNAConfigSATimeout");
4644                 return -1;
4645         }
4646
4647         wpa_s->hw.modes = wpa_drv_get_hw_feature_data(wpa_s,
4648                                                       &wpa_s->hw.num_modes,
4649                                                       &wpa_s->hw.flags);
4650         if (wpa_s->hw.modes) {
4651                 u16 i;
4652
4653                 for (i = 0; i < wpa_s->hw.num_modes; i++) {
4654                         if (wpa_s->hw.modes[i].vht_capab) {
4655                                 wpa_s->hw_capab = CAPAB_VHT;
4656                                 break;
4657                         }
4658
4659                         if (wpa_s->hw.modes[i].ht_capab &
4660                             HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)
4661                                 wpa_s->hw_capab = CAPAB_HT40;
4662                         else if (wpa_s->hw.modes[i].ht_capab &&
4663                                  wpa_s->hw_capab == CAPAB_NO_HT_VHT)
4664                                 wpa_s->hw_capab = CAPAB_HT;
4665                 }
4666         }
4667
4668         capa_res = wpa_drv_get_capa(wpa_s, &capa);
4669         if (capa_res == 0) {
4670                 wpa_s->drv_capa_known = 1;
4671                 wpa_s->drv_flags = capa.flags;
4672                 wpa_s->drv_enc = capa.enc;
4673                 wpa_s->drv_smps_modes = capa.smps_modes;
4674                 wpa_s->drv_rrm_flags = capa.rrm_flags;
4675                 wpa_s->probe_resp_offloads = capa.probe_resp_offloads;
4676                 wpa_s->max_scan_ssids = capa.max_scan_ssids;
4677                 wpa_s->max_sched_scan_ssids = capa.max_sched_scan_ssids;
4678                 wpa_s->max_sched_scan_plans = capa.max_sched_scan_plans;
4679                 wpa_s->max_sched_scan_plan_interval =
4680                         capa.max_sched_scan_plan_interval;
4681                 wpa_s->max_sched_scan_plan_iterations =
4682                         capa.max_sched_scan_plan_iterations;
4683                 wpa_s->sched_scan_supported = capa.sched_scan_supported;
4684                 wpa_s->max_match_sets = capa.max_match_sets;
4685                 wpa_s->max_remain_on_chan = capa.max_remain_on_chan;
4686                 wpa_s->max_stations = capa.max_stations;
4687                 wpa_s->extended_capa = capa.extended_capa;
4688                 wpa_s->extended_capa_mask = capa.extended_capa_mask;
4689                 wpa_s->extended_capa_len = capa.extended_capa_len;
4690                 wpa_s->num_multichan_concurrent =
4691                         capa.num_multichan_concurrent;
4692                 wpa_s->wmm_ac_supported = capa.wmm_ac_supported;
4693
4694                 if (capa.mac_addr_rand_scan_supported)
4695                         wpa_s->mac_addr_rand_supported |= MAC_ADDR_RAND_SCAN;
4696                 if (wpa_s->sched_scan_supported &&
4697                     capa.mac_addr_rand_sched_scan_supported)
4698                         wpa_s->mac_addr_rand_supported |=
4699                                 (MAC_ADDR_RAND_SCHED_SCAN | MAC_ADDR_RAND_PNO);
4700         }
4701         if (wpa_s->max_remain_on_chan == 0)
4702                 wpa_s->max_remain_on_chan = 1000;
4703
4704         /*
4705          * Only take p2p_mgmt parameters when P2P Device is supported.
4706          * Doing it here as it determines whether l2_packet_init() will be done
4707          * during wpa_supplicant_driver_init().
4708          */
4709         if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
4710                 wpa_s->p2p_mgmt = iface->p2p_mgmt;
4711         else
4712                 iface->p2p_mgmt = 1;
4713
4714         if (wpa_s->num_multichan_concurrent == 0)
4715                 wpa_s->num_multichan_concurrent = 1;
4716
4717         if (wpa_supplicant_driver_init(wpa_s) < 0)
4718                 return -1;
4719
4720 #ifdef CONFIG_TDLS
4721         if ((!iface->p2p_mgmt ||
4722              !(wpa_s->drv_flags &
4723                WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)) &&
4724             wpa_tdls_init(wpa_s->wpa))
4725                 return -1;
4726 #endif /* CONFIG_TDLS */
4727
4728         if (wpa_s->conf->country[0] && wpa_s->conf->country[1] &&
4729             wpa_drv_set_country(wpa_s, wpa_s->conf->country)) {
4730                 wpa_dbg(wpa_s, MSG_DEBUG, "Failed to set country");
4731                 return -1;
4732         }
4733
4734 #ifdef CONFIG_FST
4735         if (wpa_s->conf->fst_group_id) {
4736                 struct fst_iface_cfg cfg;
4737                 struct fst_wpa_obj iface_obj;
4738
4739                 fst_wpa_supplicant_fill_iface_obj(wpa_s, &iface_obj);
4740                 os_strlcpy(cfg.group_id, wpa_s->conf->fst_group_id,
4741                            sizeof(cfg.group_id));
4742                 cfg.priority = wpa_s->conf->fst_priority;
4743                 cfg.llt = wpa_s->conf->fst_llt;
4744
4745                 wpa_s->fst = fst_attach(wpa_s->ifname, wpa_s->own_addr,
4746                                         &iface_obj, &cfg);
4747                 if (!wpa_s->fst) {
4748                         wpa_msg(wpa_s, MSG_ERROR,
4749                                 "FST: Cannot attach iface %s to group %s",
4750                                 wpa_s->ifname, cfg.group_id);
4751                         return -1;
4752                 }
4753         }
4754 #endif /* CONFIG_FST */
4755
4756         if (wpas_wps_init(wpa_s))
4757                 return -1;
4758
4759         if (wpa_supplicant_init_eapol(wpa_s) < 0)
4760                 return -1;
4761         wpa_sm_set_eapol(wpa_s->wpa, wpa_s->eapol);
4762
4763         wpa_s->ctrl_iface = wpa_supplicant_ctrl_iface_init(wpa_s);
4764         if (wpa_s->ctrl_iface == NULL) {
4765                 wpa_printf(MSG_ERROR,
4766                            "Failed to initialize control interface '%s'.\n"
4767                            "You may have another wpa_supplicant process "
4768                            "already running or the file was\n"
4769                            "left by an unclean termination of wpa_supplicant "
4770                            "in which case you will need\n"
4771                            "to manually remove this file before starting "
4772                            "wpa_supplicant again.\n",
4773                            wpa_s->conf->ctrl_interface);
4774                 return -1;
4775         }
4776
4777         wpa_s->gas = gas_query_init(wpa_s);
4778         if (wpa_s->gas == NULL) {
4779                 wpa_printf(MSG_ERROR, "Failed to initialize GAS query");
4780                 return -1;
4781         }
4782
4783         if (iface->p2p_mgmt && wpas_p2p_init(wpa_s->global, wpa_s) < 0) {
4784                 wpa_msg(wpa_s, MSG_ERROR, "Failed to init P2P");
4785                 return -1;
4786         }
4787
4788         if (wpa_bss_init(wpa_s) < 0)
4789                 return -1;
4790
4791         /*
4792          * Set Wake-on-WLAN triggers, if configured.
4793          * Note: We don't restore/remove the triggers on shutdown (it doesn't
4794          * have effect anyway when the interface is down).
4795          */
4796         if (capa_res == 0 && wpas_set_wowlan_triggers(wpa_s, &capa) < 0)
4797                 return -1;
4798
4799 #ifdef CONFIG_EAP_PROXY
4800 {
4801         size_t len;
4802         wpa_s->mnc_len = eapol_sm_get_eap_proxy_imsi(wpa_s->eapol, wpa_s->imsi,
4803                                                      &len);
4804         if (wpa_s->mnc_len > 0) {
4805                 wpa_s->imsi[len] = '\0';
4806                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI %s (MNC length %d)",
4807                            wpa_s->imsi, wpa_s->mnc_len);
4808         } else {
4809                 wpa_printf(MSG_DEBUG, "eap_proxy: IMSI not available");
4810         }
4811 }
4812 #endif /* CONFIG_EAP_PROXY */
4813
4814         if (pcsc_reader_init(wpa_s) < 0)
4815                 return -1;
4816
4817         if (wpas_init_ext_pw(wpa_s) < 0)
4818                 return -1;
4819
4820         wpas_rrm_reset(wpa_s);
4821
4822         wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
4823
4824 #ifdef CONFIG_HS20
4825         hs20_init(wpa_s);
4826 #endif /* CONFIG_HS20 */
4827 #ifdef CONFIG_MBO
4828         wpas_mbo_update_non_pref_chan(wpa_s, wpa_s->conf->non_pref_chan);
4829 #endif /* CONFIG_MBO */
4830
4831         return 0;
4832 }
4833
4834
4835 static void wpa_supplicant_deinit_iface(struct wpa_supplicant *wpa_s,
4836                                         int notify, int terminate)
4837 {
4838         struct wpa_global *global = wpa_s->global;
4839         struct wpa_supplicant *iface, *prev;
4840
4841         if (wpa_s == wpa_s->parent)
4842                 wpas_p2p_group_remove(wpa_s, "*");
4843
4844         iface = global->ifaces;
4845         while (iface) {
4846                 if (iface->p2pdev == wpa_s)
4847                         iface->p2pdev = iface->parent;
4848                 if (iface == wpa_s || iface->parent != wpa_s) {
4849                         iface = iface->next;
4850                         continue;
4851                 }
4852                 wpa_printf(MSG_DEBUG,
4853                            "Remove remaining child interface %s from parent %s",
4854                            iface->ifname, wpa_s->ifname);
4855                 prev = iface;
4856                 iface = iface->next;
4857                 wpa_supplicant_remove_iface(global, prev, terminate);
4858         }
4859
4860         wpa_s->disconnected = 1;
4861         if (wpa_s->drv_priv) {
4862                 wpa_supplicant_deauthenticate(wpa_s,
4863                                               WLAN_REASON_DEAUTH_LEAVING);
4864
4865                 wpa_drv_set_countermeasures(wpa_s, 0);
4866                 wpa_clear_keys(wpa_s, NULL);
4867         }
4868
4869         wpa_supplicant_cleanup(wpa_s);
4870         wpas_p2p_deinit_iface(wpa_s);
4871
4872         wpas_ctrl_radio_work_flush(wpa_s);
4873         radio_remove_interface(wpa_s);
4874
4875 #ifdef CONFIG_FST
4876         if (wpa_s->fst) {
4877                 fst_detach(wpa_s->fst);
4878                 wpa_s->fst = NULL;
4879         }
4880         if (wpa_s->received_mb_ies) {
4881                 wpabuf_free(wpa_s->received_mb_ies);
4882                 wpa_s->received_mb_ies = NULL;
4883         }
4884 #endif /* CONFIG_FST */
4885
4886         if (wpa_s->drv_priv)
4887                 wpa_drv_deinit(wpa_s);
4888
4889         if (notify)
4890                 wpas_notify_iface_removed(wpa_s);
4891
4892         if (terminate)
4893                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
4894
4895         if (wpa_s->ctrl_iface) {
4896                 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
4897                 wpa_s->ctrl_iface = NULL;
4898         }
4899
4900 #ifdef CONFIG_MESH
4901         if (wpa_s->ifmsh) {
4902                 wpa_supplicant_mesh_iface_deinit(wpa_s, wpa_s->ifmsh);
4903                 wpa_s->ifmsh = NULL;
4904         }
4905 #endif /* CONFIG_MESH */
4906
4907         if (wpa_s->conf != NULL) {
4908                 wpa_config_free(wpa_s->conf);
4909                 wpa_s->conf = NULL;
4910         }
4911
4912         os_free(wpa_s->ssids_from_scan_req);
4913
4914         os_free(wpa_s);
4915 }
4916
4917
4918 #ifdef CONFIG_MATCH_IFACE
4919
4920 /**
4921  * wpa_supplicant_match_iface - Match an interface description to a name
4922  * @global: Pointer to global data from wpa_supplicant_init()
4923  * @ifname: Name of the interface to match
4924  * Returns: Pointer to the created interface description or %NULL on failure
4925  */
4926 struct wpa_interface * wpa_supplicant_match_iface(struct wpa_global *global,
4927                                                   const char *ifname)
4928 {
4929         int i;
4930         struct wpa_interface *iface, *miface;
4931
4932         for (i = 0; i < global->params.match_iface_count; i++) {
4933                 miface = &global->params.match_ifaces[i];
4934                 if (!miface->ifname ||
4935                     fnmatch(miface->ifname, ifname, 0) == 0) {
4936                         iface = os_zalloc(sizeof(*iface));
4937                         if (!iface)
4938                                 return NULL;
4939                         *iface = *miface;
4940                         iface->ifname = ifname;
4941                         return iface;
4942                 }
4943         }
4944
4945         return NULL;
4946 }
4947
4948
4949 /**
4950  * wpa_supplicant_match_existing - Match existing interfaces
4951  * @global: Pointer to global data from wpa_supplicant_init()
4952  * Returns: 0 on success, -1 on failure
4953  */
4954 static int wpa_supplicant_match_existing(struct wpa_global *global)
4955 {
4956         struct if_nameindex *ifi, *ifp;
4957         struct wpa_supplicant *wpa_s;
4958         struct wpa_interface *iface;
4959
4960         ifp = if_nameindex();
4961         if (!ifp) {
4962                 wpa_printf(MSG_ERROR, "if_nameindex: %s", strerror(errno));
4963                 return -1;
4964         }
4965
4966         for (ifi = ifp; ifi->if_name; ifi++) {
4967                 wpa_s = wpa_supplicant_get_iface(global, ifi->if_name);
4968                 if (wpa_s)
4969                         continue;
4970                 iface = wpa_supplicant_match_iface(global, ifi->if_name);
4971                 if (iface) {
4972                         wpa_s = wpa_supplicant_add_iface(global, iface, NULL);
4973                         os_free(iface);
4974                         if (wpa_s)
4975                                 wpa_s->matched = 1;
4976                 }
4977         }
4978
4979         if_freenameindex(ifp);
4980         return 0;
4981 }
4982
4983 #endif /* CONFIG_MATCH_IFACE */
4984
4985
4986 /**
4987  * wpa_supplicant_add_iface - Add a new network interface
4988  * @global: Pointer to global data from wpa_supplicant_init()
4989  * @iface: Interface configuration options
4990  * @parent: Parent interface or %NULL to assign new interface as parent
4991  * Returns: Pointer to the created interface or %NULL on failure
4992  *
4993  * This function is used to add new network interfaces for %wpa_supplicant.
4994  * This can be called before wpa_supplicant_run() to add interfaces before the
4995  * main event loop has been started. In addition, new interfaces can be added
4996  * dynamically while %wpa_supplicant is already running. This could happen,
4997  * e.g., when a hotplug network adapter is inserted.
4998  */
4999 struct wpa_supplicant * wpa_supplicant_add_iface(struct wpa_global *global,
5000                                                  struct wpa_interface *iface,
5001                                                  struct wpa_supplicant *parent)
5002 {
5003         struct wpa_supplicant *wpa_s;
5004         struct wpa_interface t_iface;
5005         struct wpa_ssid *ssid;
5006
5007         if (global == NULL || iface == NULL)
5008                 return NULL;
5009
5010         wpa_s = wpa_supplicant_alloc(parent);
5011         if (wpa_s == NULL)
5012                 return NULL;
5013
5014         wpa_s->global = global;
5015
5016         t_iface = *iface;
5017         if (global->params.override_driver) {
5018                 wpa_printf(MSG_DEBUG, "Override interface parameter: driver "
5019                            "('%s' -> '%s')",
5020                            iface->driver, global->params.override_driver);
5021                 t_iface.driver = global->params.override_driver;
5022         }
5023         if (global->params.override_ctrl_interface) {
5024                 wpa_printf(MSG_DEBUG, "Override interface parameter: "
5025                            "ctrl_interface ('%s' -> '%s')",
5026                            iface->ctrl_interface,
5027                            global->params.override_ctrl_interface);
5028                 t_iface.ctrl_interface =
5029                         global->params.override_ctrl_interface;
5030         }
5031         if (wpa_supplicant_init_iface(wpa_s, &t_iface)) {
5032                 wpa_printf(MSG_DEBUG, "Failed to add interface %s",
5033                            iface->ifname);
5034                 wpa_supplicant_deinit_iface(wpa_s, 0, 0);
5035                 return NULL;
5036         }
5037
5038         if (iface->p2p_mgmt == 0) {
5039                 /* Notify the control interfaces about new iface */
5040                 if (wpas_notify_iface_added(wpa_s)) {
5041                         wpa_supplicant_deinit_iface(wpa_s, 1, 0);
5042                         return NULL;
5043                 }
5044
5045                 for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next)
5046                         wpas_notify_network_added(wpa_s, ssid);
5047         }
5048
5049         wpa_s->next = global->ifaces;
5050         global->ifaces = wpa_s;
5051
5052         wpa_dbg(wpa_s, MSG_DEBUG, "Added interface %s", wpa_s->ifname);
5053         wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
5054
5055 #ifdef CONFIG_P2P
5056         if (wpa_s->global->p2p == NULL &&
5057             !wpa_s->global->p2p_disabled && !wpa_s->conf->p2p_disabled &&
5058             (wpa_s->drv_flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE) &&
5059             wpas_p2p_add_p2pdev_interface(
5060                     wpa_s, wpa_s->global->params.conf_p2p_dev) < 0) {
5061                 wpa_printf(MSG_INFO,
5062                            "P2P: Failed to enable P2P Device interface");
5063                 /* Try to continue without. P2P will be disabled. */
5064         }
5065 #endif /* CONFIG_P2P */
5066
5067         return wpa_s;
5068 }
5069
5070
5071 /**
5072  * wpa_supplicant_remove_iface - Remove a network interface
5073  * @global: Pointer to global data from wpa_supplicant_init()
5074  * @wpa_s: Pointer to the network interface to be removed
5075  * Returns: 0 if interface was removed, -1 if interface was not found
5076  *
5077  * This function can be used to dynamically remove network interfaces from
5078  * %wpa_supplicant, e.g., when a hotplug network adapter is ejected. In
5079  * addition, this function is used to remove all remaining interfaces when
5080  * %wpa_supplicant is terminated.
5081  */
5082 int wpa_supplicant_remove_iface(struct wpa_global *global,
5083                                 struct wpa_supplicant *wpa_s,
5084                                 int terminate)
5085 {
5086         struct wpa_supplicant *prev;
5087 #ifdef CONFIG_MESH
5088         unsigned int mesh_if_created = wpa_s->mesh_if_created;
5089         char *ifname = NULL;
5090 #endif /* CONFIG_MESH */
5091
5092         /* Remove interface from the global list of interfaces */
5093         prev = global->ifaces;
5094         if (prev == wpa_s) {
5095                 global->ifaces = wpa_s->next;
5096         } else {
5097                 while (prev && prev->next != wpa_s)
5098                         prev = prev->next;
5099                 if (prev == NULL)
5100                         return -1;
5101                 prev->next = wpa_s->next;
5102         }
5103
5104         wpa_dbg(wpa_s, MSG_DEBUG, "Removing interface %s", wpa_s->ifname);
5105
5106 #ifdef CONFIG_MESH
5107         if (mesh_if_created) {
5108                 ifname = os_strdup(wpa_s->ifname);
5109                 if (ifname == NULL) {
5110                         wpa_dbg(wpa_s, MSG_ERROR,
5111                                 "mesh: Failed to malloc ifname");
5112                         return -1;
5113                 }
5114         }
5115 #endif /* CONFIG_MESH */
5116
5117         if (global->p2p_group_formation == wpa_s)
5118                 global->p2p_group_formation = NULL;
5119         if (global->p2p_invite_group == wpa_s)
5120                 global->p2p_invite_group = NULL;
5121         wpa_supplicant_deinit_iface(wpa_s, 1, terminate);
5122
5123 #ifdef CONFIG_MESH
5124         if (mesh_if_created) {
5125                 wpa_drv_if_remove(global->ifaces, WPA_IF_MESH, ifname);
5126                 os_free(ifname);
5127         }
5128 #endif /* CONFIG_MESH */
5129
5130         return 0;
5131 }
5132
5133
5134 /**
5135  * wpa_supplicant_get_eap_mode - Get the current EAP mode
5136  * @wpa_s: Pointer to the network interface
5137  * Returns: Pointer to the eap mode or the string "UNKNOWN" if not found
5138  */
5139 const char * wpa_supplicant_get_eap_mode(struct wpa_supplicant *wpa_s)
5140 {
5141         const char *eapol_method;
5142
5143         if (wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt) == 0 &&
5144             wpa_s->key_mgmt != WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
5145                 return "NO-EAP";
5146         }
5147
5148         eapol_method = eapol_sm_get_method_name(wpa_s->eapol);
5149         if (eapol_method == NULL)
5150                 return "UNKNOWN-EAP";
5151
5152         return eapol_method;
5153 }
5154
5155
5156 /**
5157  * wpa_supplicant_get_iface - Get a new network interface
5158  * @global: Pointer to global data from wpa_supplicant_init()
5159  * @ifname: Interface name
5160  * Returns: Pointer to the interface or %NULL if not found
5161  */
5162 struct wpa_supplicant * wpa_supplicant_get_iface(struct wpa_global *global,
5163                                                  const char *ifname)
5164 {
5165         struct wpa_supplicant *wpa_s;
5166
5167         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5168                 if (os_strcmp(wpa_s->ifname, ifname) == 0)
5169                         return wpa_s;
5170         }
5171         return NULL;
5172 }
5173
5174
5175 #ifndef CONFIG_NO_WPA_MSG
5176 static const char * wpa_supplicant_msg_ifname_cb(void *ctx)
5177 {
5178         struct wpa_supplicant *wpa_s = ctx;
5179         if (wpa_s == NULL)
5180                 return NULL;
5181         return wpa_s->ifname;
5182 }
5183 #endif /* CONFIG_NO_WPA_MSG */
5184
5185
5186 #ifndef WPA_SUPPLICANT_CLEANUP_INTERVAL
5187 #define WPA_SUPPLICANT_CLEANUP_INTERVAL 10
5188 #endif /* WPA_SUPPLICANT_CLEANUP_INTERVAL */
5189
5190 /* Periodic cleanup tasks */
5191 static void wpas_periodic(void *eloop_ctx, void *timeout_ctx)
5192 {
5193         struct wpa_global *global = eloop_ctx;
5194         struct wpa_supplicant *wpa_s;
5195
5196         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5197                                wpas_periodic, global, NULL);
5198
5199 #ifdef CONFIG_P2P
5200         if (global->p2p)
5201                 p2p_expire_peers(global->p2p);
5202 #endif /* CONFIG_P2P */
5203
5204         for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next) {
5205                 wpa_bss_flush_by_age(wpa_s, wpa_s->conf->bss_expiration_age);
5206 #ifdef CONFIG_AP
5207                 ap_periodic(wpa_s);
5208 #endif /* CONFIG_AP */
5209         }
5210 }
5211
5212
5213 /**
5214  * wpa_supplicant_init - Initialize %wpa_supplicant
5215  * @params: Parameters for %wpa_supplicant
5216  * Returns: Pointer to global %wpa_supplicant data, or %NULL on failure
5217  *
5218  * This function is used to initialize %wpa_supplicant. After successful
5219  * initialization, the returned data pointer can be used to add and remove
5220  * network interfaces, and eventually, to deinitialize %wpa_supplicant.
5221  */
5222 struct wpa_global * wpa_supplicant_init(struct wpa_params *params)
5223 {
5224         struct wpa_global *global;
5225         int ret, i;
5226
5227         if (params == NULL)
5228                 return NULL;
5229
5230 #ifdef CONFIG_DRIVER_NDIS
5231         {
5232                 void driver_ndis_init_ops(void);
5233                 driver_ndis_init_ops();
5234         }
5235 #endif /* CONFIG_DRIVER_NDIS */
5236
5237 #ifndef CONFIG_NO_WPA_MSG
5238         wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
5239 #endif /* CONFIG_NO_WPA_MSG */
5240
5241         if (params->wpa_debug_file_path)
5242                 wpa_debug_open_file(params->wpa_debug_file_path);
5243         else
5244                 wpa_debug_setup_stdout();
5245         if (params->wpa_debug_syslog)
5246                 wpa_debug_open_syslog();
5247         if (params->wpa_debug_tracing) {
5248                 ret = wpa_debug_open_linux_tracing();
5249                 if (ret) {
5250                         wpa_printf(MSG_ERROR,
5251                                    "Failed to enable trace logging");
5252                         return NULL;
5253                 }
5254         }
5255
5256         ret = eap_register_methods();
5257         if (ret) {
5258                 wpa_printf(MSG_ERROR, "Failed to register EAP methods");
5259                 if (ret == -2)
5260                         wpa_printf(MSG_ERROR, "Two or more EAP methods used "
5261                                    "the same EAP type.");
5262                 return NULL;
5263         }
5264
5265         global = os_zalloc(sizeof(*global));
5266         if (global == NULL)
5267                 return NULL;
5268         dl_list_init(&global->p2p_srv_bonjour);
5269         dl_list_init(&global->p2p_srv_upnp);
5270         global->params.daemonize = params->daemonize;
5271         global->params.wait_for_monitor = params->wait_for_monitor;
5272         global->params.dbus_ctrl_interface = params->dbus_ctrl_interface;
5273         if (params->pid_file)
5274                 global->params.pid_file = os_strdup(params->pid_file);
5275         if (params->ctrl_interface)
5276                 global->params.ctrl_interface =
5277                         os_strdup(params->ctrl_interface);
5278         if (params->ctrl_interface_group)
5279                 global->params.ctrl_interface_group =
5280                         os_strdup(params->ctrl_interface_group);
5281         if (params->override_driver)
5282                 global->params.override_driver =
5283                         os_strdup(params->override_driver);
5284         if (params->override_ctrl_interface)
5285                 global->params.override_ctrl_interface =
5286                         os_strdup(params->override_ctrl_interface);
5287 #ifdef CONFIG_MATCH_IFACE
5288         global->params.match_iface_count = params->match_iface_count;
5289         if (params->match_iface_count) {
5290                 global->params.match_ifaces =
5291                         os_calloc(params->match_iface_count,
5292                                   sizeof(struct wpa_interface));
5293                 os_memcpy(global->params.match_ifaces,
5294                           params->match_ifaces,
5295                           params->match_iface_count *
5296                           sizeof(struct wpa_interface));
5297         }
5298 #endif /* CONFIG_MATCH_IFACE */
5299 #ifdef CONFIG_P2P
5300         if (params->conf_p2p_dev)
5301                 global->params.conf_p2p_dev =
5302                         os_strdup(params->conf_p2p_dev);
5303 #endif /* CONFIG_P2P */
5304         wpa_debug_level = global->params.wpa_debug_level =
5305                 params->wpa_debug_level;
5306         wpa_debug_show_keys = global->params.wpa_debug_show_keys =
5307                 params->wpa_debug_show_keys;
5308         wpa_debug_timestamp = global->params.wpa_debug_timestamp =
5309                 params->wpa_debug_timestamp;
5310
5311         wpa_printf(MSG_DEBUG, "wpa_supplicant v" VERSION_STR);
5312
5313         if (eloop_init()) {
5314                 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
5315                 wpa_supplicant_deinit(global);
5316                 return NULL;
5317         }
5318
5319         random_init(params->entropy_file);
5320
5321         global->ctrl_iface = wpa_supplicant_global_ctrl_iface_init(global);
5322         if (global->ctrl_iface == NULL) {
5323                 wpa_supplicant_deinit(global);
5324                 return NULL;
5325         }
5326
5327         if (wpas_notify_supplicant_initialized(global)) {
5328                 wpa_supplicant_deinit(global);
5329                 return NULL;
5330         }
5331
5332         for (i = 0; wpa_drivers[i]; i++)
5333                 global->drv_count++;
5334         if (global->drv_count == 0) {
5335                 wpa_printf(MSG_ERROR, "No drivers enabled");
5336                 wpa_supplicant_deinit(global);
5337                 return NULL;
5338         }
5339         global->drv_priv = os_calloc(global->drv_count, sizeof(void *));
5340         if (global->drv_priv == NULL) {
5341                 wpa_supplicant_deinit(global);
5342                 return NULL;
5343         }
5344
5345 #ifdef CONFIG_WIFI_DISPLAY
5346         if (wifi_display_init(global) < 0) {
5347                 wpa_printf(MSG_ERROR, "Failed to initialize Wi-Fi Display");
5348                 wpa_supplicant_deinit(global);
5349                 return NULL;
5350         }
5351 #endif /* CONFIG_WIFI_DISPLAY */
5352
5353         eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
5354                                wpas_periodic, global, NULL);
5355
5356         return global;
5357 }
5358
5359
5360 /**
5361  * wpa_supplicant_run - Run the %wpa_supplicant main event loop
5362  * @global: Pointer to global data from wpa_supplicant_init()
5363  * Returns: 0 after successful event loop run, -1 on failure
5364  *
5365  * This function starts the main event loop and continues running as long as
5366  * there are any remaining events. In most cases, this function is running as
5367  * long as the %wpa_supplicant process in still in use.
5368  */
5369 int wpa_supplicant_run(struct wpa_global *global)
5370 {
5371         struct wpa_supplicant *wpa_s;
5372
5373         if (global->params.daemonize &&
5374             (wpa_supplicant_daemon(global->params.pid_file) ||
5375              eloop_sock_requeue()))
5376                 return -1;
5377
5378 #ifdef CONFIG_MATCH_IFACE
5379         if (wpa_supplicant_match_existing(global))
5380                 return -1;
5381 #endif
5382
5383         if (global->params.wait_for_monitor) {
5384                 for (wpa_s = global->ifaces; wpa_s; wpa_s = wpa_s->next)
5385                         if (wpa_s->ctrl_iface && !wpa_s->p2p_mgmt)
5386                                 wpa_supplicant_ctrl_iface_wait(
5387                                         wpa_s->ctrl_iface);
5388         }
5389
5390         eloop_register_signal_terminate(wpa_supplicant_terminate, global);
5391         eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
5392
5393         eloop_run();
5394
5395         return 0;
5396 }
5397
5398
5399 /**
5400  * wpa_supplicant_deinit - Deinitialize %wpa_supplicant
5401  * @global: Pointer to global data from wpa_supplicant_init()
5402  *
5403  * This function is called to deinitialize %wpa_supplicant and to free all
5404  * allocated resources. Remaining network interfaces will also be removed.
5405  */
5406 void wpa_supplicant_deinit(struct wpa_global *global)
5407 {
5408         int i;
5409
5410         if (global == NULL)
5411                 return;
5412
5413         eloop_cancel_timeout(wpas_periodic, global, NULL);
5414
5415 #ifdef CONFIG_WIFI_DISPLAY
5416         wifi_display_deinit(global);
5417 #endif /* CONFIG_WIFI_DISPLAY */
5418
5419         while (global->ifaces)
5420                 wpa_supplicant_remove_iface(global, global->ifaces, 1);
5421
5422         if (global->ctrl_iface)
5423                 wpa_supplicant_global_ctrl_iface_deinit(global->ctrl_iface);
5424
5425         wpas_notify_supplicant_deinitialized(global);
5426
5427         eap_peer_unregister_methods();
5428 #ifdef CONFIG_AP
5429         eap_server_unregister_methods();
5430 #endif /* CONFIG_AP */
5431
5432         for (i = 0; wpa_drivers[i] && global->drv_priv; i++) {
5433                 if (!global->drv_priv[i])
5434                         continue;
5435                 wpa_drivers[i]->global_deinit(global->drv_priv[i]);
5436         }
5437         os_free(global->drv_priv);
5438
5439         random_deinit();
5440
5441         eloop_destroy();
5442
5443         if (global->params.pid_file) {
5444                 os_daemonize_terminate(global->params.pid_file);
5445                 os_free(global->params.pid_file);
5446         }
5447         os_free(global->params.ctrl_interface);
5448         os_free(global->params.ctrl_interface_group);
5449         os_free(global->params.override_driver);
5450         os_free(global->params.override_ctrl_interface);
5451 #ifdef CONFIG_MATCH_IFACE
5452         os_free(global->params.match_ifaces);
5453 #endif /* CONFIG_MATCH_IFACE */
5454 #ifdef CONFIG_P2P
5455         os_free(global->params.conf_p2p_dev);
5456 #endif /* CONFIG_P2P */
5457
5458         os_free(global->p2p_disallow_freq.range);
5459         os_free(global->p2p_go_avoid_freq.range);
5460         os_free(global->add_psk);
5461
5462         os_free(global);
5463         wpa_debug_close_syslog();
5464         wpa_debug_close_file();
5465         wpa_debug_close_linux_tracing();
5466 }
5467
5468
5469 void wpa_supplicant_update_config(struct wpa_supplicant *wpa_s)
5470 {
5471         if ((wpa_s->conf->changed_parameters & CFG_CHANGED_COUNTRY) &&
5472             wpa_s->conf->country[0] && wpa_s->conf->country[1]) {
5473                 char country[3];
5474                 country[0] = wpa_s->conf->country[0];
5475                 country[1] = wpa_s->conf->country[1];
5476                 country[2] = '\0';
5477                 if (wpa_drv_set_country(wpa_s, country) < 0) {
5478                         wpa_printf(MSG_ERROR, "Failed to set country code "
5479                                    "'%s'", country);
5480                 }
5481         }
5482
5483         if (wpa_s->conf->changed_parameters & CFG_CHANGED_EXT_PW_BACKEND)
5484                 wpas_init_ext_pw(wpa_s);
5485
5486         if (wpa_s->conf->changed_parameters & CFG_CHANGED_SCHED_SCAN_PLANS)
5487                 wpas_sched_scan_plans_set(wpa_s, wpa_s->conf->sched_scan_plans);
5488
5489 #ifdef CONFIG_WPS
5490         wpas_wps_update_config(wpa_s);
5491 #endif /* CONFIG_WPS */
5492         wpas_p2p_update_config(wpa_s);
5493         wpa_s->conf->changed_parameters = 0;
5494 }
5495
5496
5497 void add_freq(int *freqs, int *num_freqs, int freq)
5498 {
5499         int i;
5500
5501         for (i = 0; i < *num_freqs; i++) {
5502                 if (freqs[i] == freq)
5503                         return;
5504         }
5505
5506         freqs[*num_freqs] = freq;
5507         (*num_freqs)++;
5508 }
5509
5510
5511 static int * get_bss_freqs_in_ess(struct wpa_supplicant *wpa_s)
5512 {
5513         struct wpa_bss *bss, *cbss;
5514         const int max_freqs = 10;
5515         int *freqs;
5516         int num_freqs = 0;
5517
5518         freqs = os_calloc(max_freqs + 1, sizeof(int));
5519         if (freqs == NULL)
5520                 return NULL;
5521
5522         cbss = wpa_s->current_bss;
5523
5524         dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
5525                 if (bss == cbss)
5526                         continue;
5527                 if (bss->ssid_len == cbss->ssid_len &&
5528                     os_memcmp(bss->ssid, cbss->ssid, bss->ssid_len) == 0 &&
5529                     wpa_blacklist_get(wpa_s, bss->bssid) == NULL) {
5530                         add_freq(freqs, &num_freqs, bss->freq);
5531                         if (num_freqs == max_freqs)
5532                                 break;
5533                 }
5534         }
5535
5536         if (num_freqs == 0) {
5537                 os_free(freqs);
5538                 freqs = NULL;
5539         }
5540
5541         return freqs;
5542 }
5543
5544
5545 void wpas_connection_failed(struct wpa_supplicant *wpa_s, const u8 *bssid)
5546 {
5547         int timeout;
5548         int count;
5549         int *freqs = NULL;
5550
5551         wpas_connect_work_done(wpa_s);
5552
5553         /*
5554          * Remove possible authentication timeout since the connection failed.
5555          */
5556         eloop_cancel_timeout(wpa_supplicant_timeout, wpa_s, NULL);
5557
5558         /*
5559          * There is no point in blacklisting the AP if this event is
5560          * generated based on local request to disconnect.
5561          */
5562         if (wpa_s->own_disconnect_req) {
5563                 wpa_s->own_disconnect_req = 0;
5564                 wpa_dbg(wpa_s, MSG_DEBUG,
5565                         "Ignore connection failure due to local request to disconnect");
5566                 return;
5567         }
5568         if (wpa_s->disconnected) {
5569                 wpa_dbg(wpa_s, MSG_DEBUG, "Ignore connection failure "
5570                         "indication since interface has been put into "
5571                         "disconnected state");
5572                 return;
5573         }
5574
5575         /*
5576          * Add the failed BSSID into the blacklist and speed up next scan
5577          * attempt if there could be other APs that could accept association.
5578          * The current blacklist count indicates how many times we have tried
5579          * connecting to this AP and multiple attempts mean that other APs are
5580          * either not available or has already been tried, so that we can start
5581          * increasing the delay here to avoid constant scanning.
5582          */
5583         count = wpa_blacklist_add(wpa_s, bssid);
5584         if (count == 1 && wpa_s->current_bss) {
5585                 /*
5586                  * This BSS was not in the blacklist before. If there is
5587                  * another BSS available for the same ESS, we should try that
5588                  * next. Otherwise, we may as well try this one once more
5589                  * before allowing other, likely worse, ESSes to be considered.
5590                  */
5591                 freqs = get_bss_freqs_in_ess(wpa_s);
5592                 if (freqs) {
5593                         wpa_dbg(wpa_s, MSG_DEBUG, "Another BSS in this ESS "
5594                                 "has been seen; try it next");
5595                         wpa_blacklist_add(wpa_s, bssid);
5596                         /*
5597                          * On the next scan, go through only the known channels
5598                          * used in this ESS based on previous scans to speed up
5599                          * common load balancing use case.
5600                          */
5601                         os_free(wpa_s->next_scan_freqs);
5602                         wpa_s->next_scan_freqs = freqs;
5603                 }
5604         }
5605
5606         /*
5607          * Add previous failure count in case the temporary blacklist was
5608          * cleared due to no other BSSes being available.
5609          */
5610         count += wpa_s->extra_blacklist_count;
5611
5612         if (count > 3 && wpa_s->current_ssid) {
5613                 wpa_printf(MSG_DEBUG, "Continuous association failures - "
5614                            "consider temporary network disabling");
5615                 wpas_auth_failed(wpa_s, "CONN_FAILED");
5616         }
5617
5618         switch (count) {
5619         case 1:
5620                 timeout = 100;
5621                 break;
5622         case 2:
5623                 timeout = 500;
5624                 break;
5625         case 3:
5626                 timeout = 1000;
5627                 break;
5628         case 4:
5629                 timeout = 5000;
5630                 break;
5631         default:
5632                 timeout = 10000;
5633                 break;
5634         }
5635
5636         wpa_dbg(wpa_s, MSG_DEBUG, "Blacklist count %d --> request scan in %d "
5637                 "ms", count, timeout);
5638
5639         /*
5640          * TODO: if more than one possible AP is available in scan results,
5641          * could try the other ones before requesting a new scan.
5642          */
5643         wpa_supplicant_req_scan(wpa_s, timeout / 1000,
5644                                 1000 * (timeout % 1000));
5645 }
5646
5647
5648 int wpas_driver_bss_selection(struct wpa_supplicant *wpa_s)
5649 {
5650         return wpa_s->conf->ap_scan == 2 ||
5651                 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_BSS_SELECTION);
5652 }
5653
5654
5655 #if defined(CONFIG_CTRL_IFACE) || defined(CONFIG_CTRL_IFACE_DBUS_NEW)
5656 int wpa_supplicant_ctrl_iface_ctrl_rsp_handle(struct wpa_supplicant *wpa_s,
5657                                               struct wpa_ssid *ssid,
5658                                               const char *field,
5659                                               const char *value)
5660 {
5661 #ifdef IEEE8021X_EAPOL
5662         struct eap_peer_config *eap = &ssid->eap;
5663
5664         wpa_printf(MSG_DEBUG, "CTRL_IFACE: response handle field=%s", field);
5665         wpa_hexdump_ascii_key(MSG_DEBUG, "CTRL_IFACE: response value",
5666                               (const u8 *) value, os_strlen(value));
5667
5668         switch (wpa_supplicant_ctrl_req_from_string(field)) {
5669         case WPA_CTRL_REQ_EAP_IDENTITY:
5670                 os_free(eap->identity);
5671                 eap->identity = (u8 *) os_strdup(value);
5672                 eap->identity_len = os_strlen(value);
5673                 eap->pending_req_identity = 0;
5674                 if (ssid == wpa_s->current_ssid)
5675                         wpa_s->reassociate = 1;
5676                 break;
5677         case WPA_CTRL_REQ_EAP_PASSWORD:
5678                 bin_clear_free(eap->password, eap->password_len);
5679                 eap->password = (u8 *) os_strdup(value);
5680                 eap->password_len = os_strlen(value);
5681                 eap->pending_req_password = 0;
5682                 if (ssid == wpa_s->current_ssid)
5683                         wpa_s->reassociate = 1;
5684                 break;
5685         case WPA_CTRL_REQ_EAP_NEW_PASSWORD:
5686                 bin_clear_free(eap->new_password, eap->new_password_len);
5687                 eap->new_password = (u8 *) os_strdup(value);
5688                 eap->new_password_len = os_strlen(value);
5689                 eap->pending_req_new_password = 0;
5690                 if (ssid == wpa_s->current_ssid)
5691                         wpa_s->reassociate = 1;
5692                 break;
5693         case WPA_CTRL_REQ_EAP_PIN:
5694                 str_clear_free(eap->pin);
5695                 eap->pin = os_strdup(value);
5696                 eap->pending_req_pin = 0;
5697                 if (ssid == wpa_s->current_ssid)
5698                         wpa_s->reassociate = 1;
5699                 break;
5700         case WPA_CTRL_REQ_EAP_OTP:
5701                 bin_clear_free(eap->otp, eap->otp_len);
5702                 eap->otp = (u8 *) os_strdup(value);
5703                 eap->otp_len = os_strlen(value);
5704                 os_free(eap->pending_req_otp);
5705                 eap->pending_req_otp = NULL;
5706                 eap->pending_req_otp_len = 0;
5707                 break;
5708         case WPA_CTRL_REQ_EAP_PASSPHRASE:
5709                 str_clear_free(eap->private_key_passwd);
5710                 eap->private_key_passwd = os_strdup(value);
5711                 eap->pending_req_passphrase = 0;
5712                 if (ssid == wpa_s->current_ssid)
5713                         wpa_s->reassociate = 1;
5714                 break;
5715         case WPA_CTRL_REQ_SIM:
5716                 str_clear_free(eap->external_sim_resp);
5717                 eap->external_sim_resp = os_strdup(value);
5718                 break;
5719         case WPA_CTRL_REQ_PSK_PASSPHRASE:
5720                 if (wpa_config_set(ssid, "psk", value, 0) < 0)
5721                         return -1;
5722                 ssid->mem_only_psk = 1;
5723                 if (ssid->passphrase)
5724                         wpa_config_update_psk(ssid);
5725                 if (wpa_s->wpa_state == WPA_SCANNING && !wpa_s->scanning)
5726                         wpa_supplicant_req_scan(wpa_s, 0, 0);
5727                 break;
5728         case WPA_CTRL_REQ_EXT_CERT_CHECK:
5729                 if (eap->pending_ext_cert_check != PENDING_CHECK)
5730                         return -1;
5731                 if (os_strcmp(value, "good") == 0)
5732                         eap->pending_ext_cert_check = EXT_CERT_CHECK_GOOD;
5733                 else if (os_strcmp(value, "bad") == 0)
5734                         eap->pending_ext_cert_check = EXT_CERT_CHECK_BAD;
5735                 else
5736                         return -1;
5737                 break;
5738         default:
5739                 wpa_printf(MSG_DEBUG, "CTRL_IFACE: Unknown field '%s'", field);
5740                 return -1;
5741         }
5742
5743         return 0;
5744 #else /* IEEE8021X_EAPOL */
5745         wpa_printf(MSG_DEBUG, "CTRL_IFACE: IEEE 802.1X not included");
5746         return -1;
5747 #endif /* IEEE8021X_EAPOL */
5748 }
5749 #endif /* CONFIG_CTRL_IFACE || CONFIG_CTRL_IFACE_DBUS_NEW */
5750
5751
5752 int wpas_network_disabled(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5753 {
5754         int i;
5755         unsigned int drv_enc;
5756
5757         if (wpa_s->p2p_mgmt)
5758                 return 1; /* no normal network profiles on p2p_mgmt interface */
5759
5760         if (ssid == NULL)
5761                 return 1;
5762
5763         if (ssid->disabled)
5764                 return 1;
5765
5766         if (wpa_s->drv_capa_known)
5767                 drv_enc = wpa_s->drv_enc;
5768         else
5769                 drv_enc = (unsigned int) -1;
5770
5771         for (i = 0; i < NUM_WEP_KEYS; i++) {
5772                 size_t len = ssid->wep_key_len[i];
5773                 if (len == 0)
5774                         continue;
5775                 if (len == 5 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP40))
5776                         continue;
5777                 if (len == 13 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP104))
5778                         continue;
5779                 if (len == 16 && (drv_enc & WPA_DRIVER_CAPA_ENC_WEP128))
5780                         continue;
5781                 return 1; /* invalid WEP key */
5782         }
5783
5784         if (wpa_key_mgmt_wpa_psk(ssid->key_mgmt) && !ssid->psk_set &&
5785             (!ssid->passphrase || ssid->ssid_len != 0) && !ssid->ext_psk &&
5786             !ssid->mem_only_psk)
5787                 return 1;
5788
5789         return 0;
5790 }
5791
5792
5793 int wpas_get_ssid_pmf(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
5794 {
5795 #ifdef CONFIG_IEEE80211W
5796         if (ssid == NULL || ssid->ieee80211w == MGMT_FRAME_PROTECTION_DEFAULT) {
5797                 if (wpa_s->conf->pmf == MGMT_FRAME_PROTECTION_OPTIONAL &&
5798                     !(wpa_s->drv_enc & WPA_DRIVER_CAPA_ENC_BIP)) {
5799                         /*
5800                          * Driver does not support BIP -- ignore pmf=1 default
5801                          * since the connection with PMF would fail and the
5802                          * configuration does not require PMF to be enabled.
5803                          */
5804                         return NO_MGMT_FRAME_PROTECTION;
5805                 }
5806
5807                 return wpa_s->conf->pmf;
5808         }
5809
5810         return ssid->ieee80211w;
5811 #else /* CONFIG_IEEE80211W */
5812         return NO_MGMT_FRAME_PROTECTION;
5813 #endif /* CONFIG_IEEE80211W */
5814 }
5815
5816
5817 int wpas_is_p2p_prioritized(struct wpa_supplicant *wpa_s)
5818 {
5819         if (wpa_s->global->conc_pref == WPA_CONC_PREF_P2P)
5820                 return 1;
5821         if (wpa_s->global->conc_pref == WPA_CONC_PREF_STA)
5822                 return 0;
5823         return -1;
5824 }
5825
5826
5827 void wpas_auth_failed(struct wpa_supplicant *wpa_s, char *reason)
5828 {
5829         struct wpa_ssid *ssid = wpa_s->current_ssid;
5830         int dur;
5831         struct os_reltime now;
5832
5833         if (ssid == NULL) {
5834                 wpa_printf(MSG_DEBUG, "Authentication failure but no known "
5835                            "SSID block");
5836                 return;
5837         }
5838
5839         if (ssid->key_mgmt == WPA_KEY_MGMT_WPS)
5840                 return;
5841
5842         ssid->auth_failures++;
5843
5844 #ifdef CONFIG_P2P
5845         if (ssid->p2p_group &&
5846             (wpa_s->p2p_in_provisioning || wpa_s->show_group_started)) {
5847                 /*
5848                  * Skip the wait time since there is a short timeout on the
5849                  * connection to a P2P group.
5850                  */
5851                 return;
5852         }
5853 #endif /* CONFIG_P2P */
5854
5855         if (ssid->auth_failures > 50)
5856                 dur = 300;
5857         else if (ssid->auth_failures > 10)
5858                 dur = 120;
5859         else if (ssid->auth_failures > 5)
5860                 dur = 90;
5861         else if (ssid->auth_failures > 3)
5862                 dur = 60;
5863         else if (ssid->auth_failures > 2)
5864                 dur = 30;
5865         else if (ssid->auth_failures > 1)
5866                 dur = 20;
5867         else
5868                 dur = 10;
5869
5870         if (ssid->auth_failures > 1 &&
5871             wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt))
5872                 dur += os_random() % (ssid->auth_failures * 10);
5873
5874         os_get_reltime(&now);
5875         if (now.sec + dur <= ssid->disabled_until.sec)
5876                 return;
5877
5878         ssid->disabled_until.sec = now.sec + dur;
5879
5880         wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TEMP_DISABLED
5881                 "id=%d ssid=\"%s\" auth_failures=%u duration=%d reason=%s",
5882                 ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len),
5883                 ssid->auth_failures, dur, reason);
5884 }
5885
5886
5887 void wpas_clear_temp_disabled(struct wpa_supplicant *wpa_s,
5888                               struct wpa_ssid *ssid, int clear_failures)
5889 {
5890         if (ssid == NULL)
5891                 return;
5892
5893         if (ssid->disabled_until.sec) {
5894                 wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_REENABLED
5895                         "id=%d ssid=\"%s\"",
5896                         ssid->id, wpa_ssid_txt(ssid->ssid, ssid->ssid_len));
5897         }
5898         ssid->disabled_until.sec = 0;
5899         ssid->disabled_until.usec = 0;
5900         if (clear_failures)
5901                 ssid->auth_failures = 0;
5902 }
5903
5904
5905 int disallowed_bssid(struct wpa_supplicant *wpa_s, const u8 *bssid)
5906 {
5907         size_t i;
5908
5909         if (wpa_s->disallow_aps_bssid == NULL)
5910                 return 0;
5911
5912         for (i = 0; i < wpa_s->disallow_aps_bssid_count; i++) {
5913                 if (os_memcmp(wpa_s->disallow_aps_bssid + i * ETH_ALEN,
5914                               bssid, ETH_ALEN) == 0)
5915                         return 1;
5916         }
5917
5918         return 0;
5919 }
5920
5921
5922 int disallowed_ssid(struct wpa_supplicant *wpa_s, const u8 *ssid,
5923                     size_t ssid_len)
5924 {
5925         size_t i;
5926
5927         if (wpa_s->disallow_aps_ssid == NULL || ssid == NULL)
5928                 return 0;
5929
5930         for (i = 0; i < wpa_s->disallow_aps_ssid_count; i++) {
5931                 struct wpa_ssid_value *s = &wpa_s->disallow_aps_ssid[i];
5932                 if (ssid_len == s->ssid_len &&
5933                     os_memcmp(ssid, s->ssid, ssid_len) == 0)
5934                         return 1;
5935         }
5936
5937         return 0;
5938 }
5939
5940
5941 /**
5942  * wpas_request_connection - Request a new connection
5943  * @wpa_s: Pointer to the network interface
5944  *
5945  * This function is used to request a new connection to be found. It will mark
5946  * the interface to allow reassociation and request a new scan to find a
5947  * suitable network to connect to.
5948  */
5949 void wpas_request_connection(struct wpa_supplicant *wpa_s)
5950 {
5951         wpa_s->normal_scans = 0;
5952         wpa_s->scan_req = NORMAL_SCAN_REQ;
5953         wpa_supplicant_reinit_autoscan(wpa_s);
5954         wpa_s->extra_blacklist_count = 0;
5955         wpa_s->disconnected = 0;
5956         wpa_s->reassociate = 1;
5957
5958         if (wpa_supplicant_fast_associate(wpa_s) != 1)
5959                 wpa_supplicant_req_scan(wpa_s, 0, 0);
5960         else
5961                 wpa_s->reattach = 0;
5962 }
5963
5964
5965 void dump_freq_data(struct wpa_supplicant *wpa_s, const char *title,
5966                     struct wpa_used_freq_data *freqs_data,
5967                     unsigned int len)
5968 {
5969         unsigned int i;
5970
5971         wpa_dbg(wpa_s, MSG_DEBUG, "Shared frequencies (len=%u): %s",
5972                 len, title);
5973         for (i = 0; i < len; i++) {
5974                 struct wpa_used_freq_data *cur = &freqs_data[i];
5975                 wpa_dbg(wpa_s, MSG_DEBUG, "freq[%u]: %d, flags=0x%X",
5976                         i, cur->freq, cur->flags);
5977         }
5978 }
5979
5980
5981 /*
5982  * Find the operating frequencies of any of the virtual interfaces that
5983  * are using the same radio as the current interface, and in addition, get
5984  * information about the interface types that are using the frequency.
5985  */
5986 int get_shared_radio_freqs_data(struct wpa_supplicant *wpa_s,
5987                                 struct wpa_used_freq_data *freqs_data,
5988                                 unsigned int len)
5989 {
5990         struct wpa_supplicant *ifs;
5991         u8 bssid[ETH_ALEN];
5992         int freq;
5993         unsigned int idx = 0, i;
5994
5995         wpa_dbg(wpa_s, MSG_DEBUG,
5996                 "Determining shared radio frequencies (max len %u)", len);
5997         os_memset(freqs_data, 0, sizeof(struct wpa_used_freq_data) * len);
5998
5999         dl_list_for_each(ifs, &wpa_s->radio->ifaces, struct wpa_supplicant,
6000                          radio_list) {
6001                 if (idx == len)
6002                         break;
6003
6004                 if (ifs->current_ssid == NULL || ifs->assoc_freq == 0)
6005                         continue;
6006
6007                 if (ifs->current_ssid->mode == WPAS_MODE_AP ||
6008                     ifs->current_ssid->mode == WPAS_MODE_P2P_GO ||
6009                     ifs->current_ssid->mode == WPAS_MODE_MESH)
6010                         freq = ifs->current_ssid->frequency;
6011                 else if (wpa_drv_get_bssid(ifs, bssid) == 0)
6012                         freq = ifs->assoc_freq;
6013                 else
6014                         continue;
6015
6016                 /* Hold only distinct freqs */
6017                 for (i = 0; i < idx; i++)
6018                         if (freqs_data[i].freq == freq)
6019                                 break;
6020
6021                 if (i == idx)
6022                         freqs_data[idx++].freq = freq;
6023
6024                 if (ifs->current_ssid->mode == WPAS_MODE_INFRA) {
6025                         freqs_data[i].flags |= ifs->current_ssid->p2p_group ?
6026                                 WPA_FREQ_USED_BY_P2P_CLIENT :
6027                                 WPA_FREQ_USED_BY_INFRA_STATION;
6028                 }
6029         }
6030
6031         dump_freq_data(wpa_s, "completed iteration", freqs_data, idx);
6032         return idx;
6033 }
6034
6035
6036 /*
6037  * Find the operating frequencies of any of the virtual interfaces that
6038  * are using the same radio as the current interface.
6039  */
6040 int get_shared_radio_freqs(struct wpa_supplicant *wpa_s,
6041                            int *freq_array, unsigned int len)
6042 {
6043         struct wpa_used_freq_data *freqs_data;
6044         int num, i;
6045
6046         os_memset(freq_array, 0, sizeof(int) * len);
6047
6048         freqs_data = os_calloc(len, sizeof(struct wpa_used_freq_data));
6049         if (!freqs_data)
6050                 return -1;
6051
6052         num = get_shared_radio_freqs_data(wpa_s, freqs_data, len);
6053         for (i = 0; i < num; i++)
6054                 freq_array[i] = freqs_data[i].freq;
6055
6056         os_free(freqs_data);
6057
6058         return num;
6059 }
6060
6061
6062 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
6063 {
6064         struct rrm_data *rrm = data;
6065
6066         if (!rrm->notify_neighbor_rep) {
6067                 wpa_printf(MSG_ERROR,
6068                            "RRM: Unexpected neighbor report timeout");
6069                 return;
6070         }
6071
6072         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
6073         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
6074
6075         rrm->notify_neighbor_rep = NULL;
6076         rrm->neighbor_rep_cb_ctx = NULL;
6077 }
6078
6079
6080 /*
6081  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
6082  * @wpa_s: Pointer to wpa_supplicant
6083  */
6084 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
6085 {
6086         wpa_s->rrm.rrm_used = 0;
6087
6088         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6089                              NULL);
6090         if (wpa_s->rrm.notify_neighbor_rep)
6091                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
6092         wpa_s->rrm.next_neighbor_rep_token = 1;
6093 }
6094
6095
6096 /*
6097  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
6098  * @wpa_s: Pointer to wpa_supplicant
6099  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
6100  * @report_len: Length of neighbor report buffer
6101  */
6102 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
6103                                    const u8 *report, size_t report_len)
6104 {
6105         struct wpabuf *neighbor_rep;
6106
6107         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
6108         if (report_len < 1)
6109                 return;
6110
6111         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
6112                 wpa_printf(MSG_DEBUG,
6113                            "RRM: Discarding neighbor report with token %d (expected %d)",
6114                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
6115                 return;
6116         }
6117
6118         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
6119                              NULL);
6120
6121         if (!wpa_s->rrm.notify_neighbor_rep) {
6122                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
6123                 return;
6124         }
6125
6126         /* skipping the first byte, which is only an id (dialog token) */
6127         neighbor_rep = wpabuf_alloc(report_len - 1);
6128         if (neighbor_rep == NULL)
6129                 return;
6130         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
6131         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
6132                    report[0]);
6133         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
6134                                        neighbor_rep);
6135         wpa_s->rrm.notify_neighbor_rep = NULL;
6136         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
6137 }
6138
6139
6140 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
6141 /* Workaround different, undefined for Windows, error codes used here */
6142 #define ENOTCONN -1
6143 #define EOPNOTSUPP -1
6144 #define ECANCELED -1
6145 #endif
6146
6147 /**
6148  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
6149  * @wpa_s: Pointer to wpa_supplicant
6150  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
6151  *        is sent in the request.
6152  * @cb: Callback function to be called once the requested report arrives, or
6153  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
6154  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
6155  *      the requester's responsibility to free it.
6156  *      In the latter case NULL will be sent in 'neighbor_rep'.
6157  * @cb_ctx: Context value to send the callback function
6158  * Returns: 0 in case of success, negative error code otherwise
6159  *
6160  * In case there is a previous request which has not been answered yet, the
6161  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
6162  * Request must contain a callback function.
6163  */
6164 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
6165                                        const struct wpa_ssid *ssid,
6166                                        void (*cb)(void *ctx,
6167                                                   struct wpabuf *neighbor_rep),
6168                                        void *cb_ctx)
6169 {
6170         struct wpabuf *buf;
6171         const u8 *rrm_ie;
6172
6173         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
6174                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
6175                 return -ENOTCONN;
6176         }
6177
6178         if (!wpa_s->rrm.rrm_used) {
6179                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
6180                 return -EOPNOTSUPP;
6181         }
6182
6183         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
6184                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
6185         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
6186             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
6187                 wpa_printf(MSG_DEBUG,
6188                            "RRM: No network support for Neighbor Report.");
6189                 return -EOPNOTSUPP;
6190         }
6191
6192         if (!cb) {
6193                 wpa_printf(MSG_DEBUG,
6194                            "RRM: Neighbor Report request must provide a callback.");
6195                 return -EINVAL;
6196         }
6197
6198         /* Refuse if there's a live request */
6199         if (wpa_s->rrm.notify_neighbor_rep) {
6200                 wpa_printf(MSG_DEBUG,
6201                            "RRM: Currently handling previous Neighbor Report.");
6202                 return -EBUSY;
6203         }
6204
6205         /* 3 = action category + action code + dialog token */
6206         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0));
6207         if (buf == NULL) {
6208                 wpa_printf(MSG_DEBUG,
6209                            "RRM: Failed to allocate Neighbor Report Request");
6210                 return -ENOMEM;
6211         }
6212
6213         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
6214                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
6215                    wpa_s->rrm.next_neighbor_rep_token);
6216
6217         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6218         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
6219         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
6220         if (ssid) {
6221                 wpabuf_put_u8(buf, WLAN_EID_SSID);
6222                 wpabuf_put_u8(buf, ssid->ssid_len);
6223                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
6224         }
6225
6226         wpa_s->rrm.next_neighbor_rep_token++;
6227
6228         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
6229                                 wpa_s->own_addr, wpa_s->bssid,
6230                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
6231                 wpa_printf(MSG_DEBUG,
6232                            "RRM: Failed to send Neighbor Report Request");
6233                 wpabuf_free(buf);
6234                 return -ECANCELED;
6235         }
6236
6237         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
6238         wpa_s->rrm.notify_neighbor_rep = cb;
6239         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
6240                                wpas_rrm_neighbor_rep_timeout_handler,
6241                                &wpa_s->rrm, NULL);
6242
6243         wpabuf_free(buf);
6244         return 0;
6245 }
6246
6247
6248 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
6249                                               const u8 *src,
6250                                               const u8 *frame, size_t len,
6251                                               int rssi)
6252 {
6253         struct wpabuf *buf;
6254         const struct rrm_link_measurement_request *req;
6255         struct rrm_link_measurement_report report;
6256
6257         if (wpa_s->wpa_state != WPA_COMPLETED) {
6258                 wpa_printf(MSG_INFO,
6259                            "RRM: Ignoring link measurement request. Not associated");
6260                 return;
6261         }
6262
6263         if (!wpa_s->rrm.rrm_used) {
6264                 wpa_printf(MSG_INFO,
6265                            "RRM: Ignoring link measurement request. Not RRM network");
6266                 return;
6267         }
6268
6269         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
6270                 wpa_printf(MSG_INFO,
6271                            "RRM: Measurement report failed. TX power insertion not supported");
6272                 return;
6273         }
6274
6275         req = (const struct rrm_link_measurement_request *) frame;
6276         if (len < sizeof(*req)) {
6277                 wpa_printf(MSG_INFO,
6278                            "RRM: Link measurement report failed. Request too short");
6279                 return;
6280         }
6281
6282         os_memset(&report, 0, sizeof(report));
6283         report.tpc.eid = WLAN_EID_TPC_REPORT;
6284         report.tpc.len = 2;
6285         report.rsni = 255; /* 255 indicates that RSNI is not available */
6286         report.dialog_token = req->dialog_token;
6287
6288         /*
6289          * It's possible to estimate RCPI based on RSSI in dBm. This
6290          * calculation will not reflect the correct value for high rates,
6291          * but it's good enough for Action frames which are transmitted
6292          * with up to 24 Mbps rates.
6293          */
6294         if (!rssi)
6295                 report.rcpi = 255; /* not available */
6296         else if (rssi < -110)
6297                 report.rcpi = 0;
6298         else if (rssi > 0)
6299                 report.rcpi = 220;
6300         else
6301                 report.rcpi = (rssi + 110) * 2;
6302
6303         /* action_category + action_code */
6304         buf = wpabuf_alloc(2 + sizeof(report));
6305         if (buf == NULL) {
6306                 wpa_printf(MSG_ERROR,
6307                            "RRM: Link measurement report failed. Buffer allocation failed");
6308                 return;
6309         }
6310
6311         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
6312         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
6313         wpabuf_put_data(buf, &report, sizeof(report));
6314         wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
6315                     wpabuf_head(buf), wpabuf_len(buf));
6316
6317         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
6318                                 wpa_s->own_addr, wpa_s->bssid,
6319                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
6320                 wpa_printf(MSG_ERROR,
6321                            "RRM: Link measurement report failed. Send action failed");
6322         }
6323         wpabuf_free(buf);
6324 }
6325
6326
6327 struct wpa_supplicant *
6328 wpas_vendor_elem(struct wpa_supplicant *wpa_s, enum wpa_vendor_elem_frame frame)
6329 {
6330         switch (frame) {
6331 #ifdef CONFIG_P2P
6332         case VENDOR_ELEM_PROBE_REQ_P2P:
6333         case VENDOR_ELEM_PROBE_RESP_P2P:
6334         case VENDOR_ELEM_PROBE_RESP_P2P_GO:
6335         case VENDOR_ELEM_BEACON_P2P_GO:
6336         case VENDOR_ELEM_P2P_PD_REQ:
6337         case VENDOR_ELEM_P2P_PD_RESP:
6338         case VENDOR_ELEM_P2P_GO_NEG_REQ:
6339         case VENDOR_ELEM_P2P_GO_NEG_RESP:
6340         case VENDOR_ELEM_P2P_GO_NEG_CONF:
6341         case VENDOR_ELEM_P2P_INV_REQ:
6342         case VENDOR_ELEM_P2P_INV_RESP:
6343         case VENDOR_ELEM_P2P_ASSOC_REQ:
6344         case VENDOR_ELEM_P2P_ASSOC_RESP:
6345                 return wpa_s->p2pdev;
6346 #endif /* CONFIG_P2P */
6347         default:
6348                 return wpa_s;
6349         }
6350 }
6351
6352
6353 void wpas_vendor_elem_update(struct wpa_supplicant *wpa_s)
6354 {
6355         unsigned int i;
6356         char buf[30];
6357
6358         wpa_printf(MSG_DEBUG, "Update vendor elements");
6359
6360         for (i = 0; i < NUM_VENDOR_ELEM_FRAMES; i++) {
6361                 if (wpa_s->vendor_elem[i]) {
6362                         int res;
6363
6364                         res = os_snprintf(buf, sizeof(buf), "frame[%u]", i);
6365                         if (!os_snprintf_error(sizeof(buf), res)) {
6366                                 wpa_hexdump_buf(MSG_DEBUG, buf,
6367                                                 wpa_s->vendor_elem[i]);
6368                         }
6369                 }
6370         }
6371
6372 #ifdef CONFIG_P2P
6373         if (wpa_s->parent == wpa_s &&
6374             wpa_s->global->p2p &&
6375             !wpa_s->global->p2p_disabled)
6376                 p2p_set_vendor_elems(wpa_s->global->p2p, wpa_s->vendor_elem);
6377 #endif /* CONFIG_P2P */
6378 }
6379
6380
6381 int wpas_vendor_elem_remove(struct wpa_supplicant *wpa_s, int frame,
6382                             const u8 *elem, size_t len)
6383 {
6384         u8 *ie, *end;
6385
6386         ie = wpabuf_mhead_u8(wpa_s->vendor_elem[frame]);
6387         end = ie + wpabuf_len(wpa_s->vendor_elem[frame]);
6388
6389         for (; ie + 1 < end; ie += 2 + ie[1]) {
6390                 if (ie + len > end)
6391                         break;
6392                 if (os_memcmp(ie, elem, len) != 0)
6393                         continue;
6394
6395                 if (wpabuf_len(wpa_s->vendor_elem[frame]) == len) {
6396                         wpabuf_free(wpa_s->vendor_elem[frame]);
6397                         wpa_s->vendor_elem[frame] = NULL;
6398                 } else {
6399                         os_memmove(ie, ie + len, end - (ie + len));
6400                         wpa_s->vendor_elem[frame]->used -= len;
6401                 }
6402                 wpas_vendor_elem_update(wpa_s);
6403                 return 0;
6404         }
6405
6406         return -1;
6407 }
6408
6409
6410 struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
6411                                    u16 num_modes, enum hostapd_hw_mode mode)
6412 {
6413         u16 i;
6414
6415         for (i = 0; i < num_modes; i++) {
6416                 if (modes[i].mode == mode)
6417                         return &modes[i];
6418         }
6419
6420         return NULL;
6421 }
6422
6423
6424 static struct
6425 wpa_bss_tmp_disallowed * wpas_get_disallowed_bss(struct wpa_supplicant *wpa_s,
6426                                                  const u8 *bssid)
6427 {
6428         struct wpa_bss_tmp_disallowed *bss;
6429
6430         dl_list_for_each(bss, &wpa_s->bss_tmp_disallowed,
6431                          struct wpa_bss_tmp_disallowed, list) {
6432                 if (os_memcmp(bssid, bss->bssid, ETH_ALEN) == 0)
6433                         return bss;
6434         }
6435
6436         return NULL;
6437 }
6438
6439
6440 void wpa_bss_tmp_disallow(struct wpa_supplicant *wpa_s, const u8 *bssid,
6441                           unsigned int sec)
6442 {
6443         struct wpa_bss_tmp_disallowed *bss;
6444         struct os_reltime until;
6445
6446         os_get_reltime(&until);
6447         until.sec += sec;
6448
6449         bss = wpas_get_disallowed_bss(wpa_s, bssid);
6450         if (bss) {
6451                 bss->disallowed_until = until;
6452                 return;
6453         }
6454
6455         bss = os_malloc(sizeof(*bss));
6456         if (!bss) {
6457                 wpa_printf(MSG_DEBUG,
6458                            "Failed to allocate memory for temp disallow BSS");
6459                 return;
6460         }
6461
6462         bss->disallowed_until = until;
6463         os_memcpy(bss->bssid, bssid, ETH_ALEN);
6464         dl_list_add(&wpa_s->bss_tmp_disallowed, &bss->list);
6465 }
6466
6467
6468 int wpa_is_bss_tmp_disallowed(struct wpa_supplicant *wpa_s, const u8 *bssid)
6469 {
6470         struct wpa_bss_tmp_disallowed *bss = NULL, *tmp, *prev;
6471         struct os_reltime now, age;
6472
6473         os_get_reltime(&now);
6474
6475         dl_list_for_each_safe(tmp, prev, &wpa_s->bss_tmp_disallowed,
6476                          struct wpa_bss_tmp_disallowed, list) {
6477                 if (!os_reltime_before(&now, &tmp->disallowed_until)) {
6478                         /* This BSS is not disallowed anymore */
6479                         dl_list_del(&tmp->list);
6480                         os_free(tmp);
6481                         continue;
6482                 }
6483                 if (os_memcmp(bssid, tmp->bssid, ETH_ALEN) == 0) {
6484                         bss = tmp;
6485                         break;
6486                 }
6487         }
6488         if (!bss)
6489                 return 0;
6490
6491         os_reltime_sub(&bss->disallowed_until, &now, &age);
6492         wpa_printf(MSG_DEBUG,
6493                    "BSS " MACSTR " disabled for %ld.%0ld seconds",
6494                    MAC2STR(bss->bssid), age.sec, age.usec);
6495         return 1;
6496 }